ML19332D919

Preliminary Assessment of BWR Mark III Containment Challenges,Failure Modes & Potential Improvements in Performance

ML19332D919
Person / Time
Issue date:	11/17/1989
From:	NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
To:
Shared Package
ML19332D908	List: ML19332D907 ML19332D919
References
NUDOCS 8912060039
Download: ML19332D919 (61)

Text

..

,q sc li x,

)

.A<

.=

&L l

1 i

1 t

a 4

A PRELIMINARY ASSESSMENT OF BWR MARK III CONTAINMENT CHALLENGES, FAILURE MODES, AND POTENTIAL IMPROVEMENTS IN PERFORMANCE

.. ' * $5 N'.

November 17, 1989 8912060039 891122 PDR ORG NREA PDC

,w.

g.y-j

~

t-

-s.

!~

i-j g

.n:

i

~

- W TRACT-This report describes the risk significant challenges posed j

to Mark III containment systems by : severe accide 'ts.

Design.

similarities and differences between the Mark III pla.ts that are important to containment performance are summarized.

The accident i

- sequences responsible for the challenges are' described, and the postulated containment' failure modes associated with each challenge are: identified.. Improvements are discussed that have the potential either to prevent core damage or containment failure, or. to

. mitigate the consequences of such failure by reducing the off-site release of fission products.

For each of these potential improvements, a qualitative analysis of the impact upon core damage frequency and risk is given.

Those modifications with the potential for cost-effective risk reduction are described.

i L

l' l

"a l

l l

Draft Report 11

e p.

4 EXECUTIVE

SUMMARY

In SECY-87-297, dated ~ December 8,

1987, the NRC staff presented to the Commission its program plan to evaluate, generic severe accident containment vulnerabilities via the containment Performance Improvement (CPI) program.

This effort is predicated on-the conclusion there are generic severe accident challenges for each light water reactor (IMR) containment type that should be assessed to determine whether additional regulatory guidance or requirements concerning needed containment features are warranted, and to confirm the adequacy of the existing Commission policy. The bases for the conclusion that such assessments are needed include the relatively large uncertainty in the ability of IMR containments to successfully survive some severe accident challenges, as indicated by draft NUREG-1150.8 All IMR containment types are to be assessed beginning with the boiling water reactors (BWRs) with Mark I containments.

This effort is closely integrated with the Individual Plant Examination (IPE) program and is intended to focus on resolution of hardware and procedural issues related to generic L

containment challenges.

Any new regulatory requirements from this program would be developed consistent with the safety goal and backfit rule and would-constitute closure of generic containment performance issues.

The present report concerns BWR plants with l

a Mark III containment design.

u This report focuses on the identification of potential challenges to containment integrity that can arise from a severe accident and the potential improvements that could reduce the

' frequency of a

severe accident or mitigate the off-site consequences in the event that a severe ac'cident should occur.

The impact of these improvements upon core damage frequency and risk is examined qualitatively.

As the result of phenomenological uncertainties, and the state

.;,- '.'. o f flux of the ongoing research efforts, the conclusions about potential improvements contained in this report should be viewed as tentative.

The estimated costs for selected improvements were taken from previously published information and are not meant to be interpreted as final estimates, since no cost-benefit analysis was performed for this report.

The most recent draft NUREG-1150 (dated June 1989) analysis of Grand Gulf has identified the dominant containment failure j

challenges to be the result of station blackout (SBO) accident sequences.

The most significant challenges arising from these sequences are due to hydrogen deflagrations and detonations, fuel-coolant interactions, and containment over-pressurization by non-condensible gases from core-concrete interactions.

Potential improvements to reduce the risk from station blackout include enhanced depressurization capability, the installation of a backup power supply for the existing hydrogen ignition systems or a backfit with powerless ignitors, enhanced operator control over the upper containment pool dump valves, and a method of venting the containment through a hardened pipe that Draft Report lii

. L :

~~;:~.-. -- -. -..~.

c.

'is independent of AC power.-

The backup power supply for the ignitors could be sized to also provide power for the upper

. containment pool dump. valves.

The backup power supply would-provida-an "uninterruptible" hydrogen ignition system which would burn the hydrogen before it reached detonable concentrations.

Providing enhanced operator control over the upper containment pool dump valves would permit dumping of the water at advantageous times when the normal pool-dump initiation signals would not function and would-also provide the operators with the ability to prohibit dumping at other. times.. Venting the containment via " soft" HVAC ductwork could result in a-failure of the ductwork and thus raise

. concerns about the habitability of the auxiliary building and the survivability of the equipment in the affected area.

A hardened vent would eliminate these potential concerns.

The table below summarizes the qualitative benefits, as well as any negative aspects, of each of the proposed improvements.

l l

l

+

[

. s, Draft Report iv

=. - - -

j

.l QUALITATIVE ASSESCMENT OF BENEFITS AND DRAWBACKS OF PROPOSED MARK III CONTAINMENT IMPROVEMENTS Potentle1 Potentlel Potentlet.

leprovement tonefIta Dred ecks

1. Erdenced reactor o todsces core demoge o Increases chance of depressurlastion frequency of some ex vos ct stoen e

system (80.5 14M) eegences emplosion o May redace enount of e Optlam RPY tevel hydrogen generated for depressuritetton o toescos the has not been likelihood of DCN detertined

2. Back g voter e6pply o todsces frequency o new heresore will system (80.01 2.4M) of some core demoge be esponsive sessences o alsk rensetton will o terroeses possibility probably not be of cavity fIoodire teree (see 5. below) e teletively low cost if fire system is used 3.

Wydrogen control by o te& aced contalrunent -

o Increases chance leproved lenition feltures (Sise seq.)

of contelruusnt systems (1300K) dae to hydrogen failure for deftsgrations/

LT88 sessences detonetions 4.

Estended vectam o may reduce the chance o Increases chance 6

breaker operation of ex vesset steem of snapression pool emplosion bypass o May reesce the pressure o May incrosse chance transler.t caused by-of dry CCI hydrogen burns in the o May increase shence wetwett of DCN 5.

Estended siepression o te& aces likelihood of o Increases chance pool make@

dry CCI of steen emplosion capability o Provides scr@bing of o Increases chance of fission proeJets N2 burn if UcP is 5

s s'p

• g should stepression

&mped af ter core pool bypass occur demose o Redsces chante of DCH 6.

Containment venting e.

l'ord pipe went o Prevents tote over-o Nigh tlkelihood of system with pressure feltures for o g pression poet dedicated power transients with scram bypass may leed to source (80.69-6.1M) en increase in risk o Moderately high cost r

l l

l Draft Report V

i 9-

'g.

4

'b 9

o CONTINUED

- Potentist Potentist Potentist

.Reprovement.

Genefits Dre s ecks 1~

6.

leproved centairment vont system (continued).

o Presuptive venting

o. Does not prevent rechaces the contelruent. thernet failure, base pressure prior to steen emplosions, core demose er steen epikes o Reekscos hydrogen.

o Can lead to evettable for inadvertent releases escendary conteltaent burning o Reduces the drivire pressure (release rete) for other

-failure modes base pressure prior to core demose b.

Filtered contelreent o See 4.e o -

See 4.e

-vent system with

.o May relieve pressure o Filtre - very high dedicated power from hydrogen burns cost (830 50M) o Assures att releases MVS$ high cost vitt be scre bed (ssa)

~~ - o Con prevent therent felture i

l I

~

f, t'

. 4-~'

I H

i:

l' l-1 1

Draft Report vi

1

-1

..'a' y

1 ACRONYMS ADS-automatic depressurization system ARI alternate rod insertion ATWS-anticipated transient without scram p

BWR

-boiling water reactor-CCI core-concrete interaction

- CDF:

core damage frequency CLWG Containment Loads Working Group CPI containment performance improvement.

CRD control rod drive CST condensate storage tank u

DBA-design basis accident DCH direct containment heating ECCS emergency core cooling system EPG emergency procedure guideline

)

FCI

. fuel-coolant interaction FSAR final safety analysis report 1

HEP

' human. error probability HIS hydrogen ignition system-HPCS-high pressure core spray 1

HVAC heating ventilating and air conditioning IPE individual plant evaluation KWU Kraftwerk Union LOCA loss of coolant accident LOSP loss of off-site power lLPCI low pressure core injection LPCS low-pressure core spray LTSB long-term. station blackout MAAP Modular Accident Analysis Program -

l MSCWL minimum steam cooling water level MSIV main steam isolation valve PCPL primary containment pressure limitation PCS power 1 conversion system i ; PDS plant damage' state 97, i' PRA.

probabilistic risk assessment PSIA pounds'per square inch absolute PSID pounds per square inch differential PSIG pounds per square inch gauge PWR pressurized water reactor RCIC reactor core isolation cooling RHR residual heat removal RPS reactor protection system RPT-recirculation pump trip RPV reactor pressure vessel

-SARRP Severe Accident Risk Reduction Program SBO station blackout SCFM standard cubic feet per minute SGTS standby gas treatment system SLCSL standby liquid control system SPC suppression pool cooling SRV safety relief valve SSW-standby service water system STCP Source Term Code Package STSB short-term station blackout TAF top of active fuel Draft Report vii 4.

.-m..

, _ n, r ;

'-~

^^~

~

e

• .U ss

?

U

-TABLE OF CONTENTS

' ABSTRACT 11 EXECUTIVE'

SUMMARY

. iii

... vil ACRONYMS i

1-1.' INTRODUCTION.

i 2.: MARK III PIANT FEATURES 3

2.1 Reactor Design 3

2.2' Primary Containment' Design 7'

3. DOMINANT CORE DAMAGE SEQUENCES.

18' 3.1 Station Blackout 18 3.2 Anticipated Transient Without Scram.

19 3.3: Loss of Power Conversion System.

19 34

-4.

CONTAINMENT CHALLENGES AND FAILURE MODES 21 4.1 Inadequate Containment Heat Removal.

21 r

4.1.1 Definition of Challenge 21 4.1.2 Potential Failure-Modes 23 4.1.3 Potential for Mitigation..

23 4.2-Hydrogen-Related Challenges.

24 1

4.2.1 Definition of Challenge 24 4.2.2 Potential Failure Modes-28 4.2.3 Potential for Mitigation.

29 4.3 Rapid Steam Pressure, Missiles,' and Direct L

32 containment Heating

....c.

4.3.1 Definition of. Challenge 33 4.3.2 Potential Failure Modes 35' 4.3.3. Potential for Mitigation.

-36 r

4.4 Core-Concreta-Interaction.

36 l

. /

'e -

4.4.1 Definition of Challenge 37 i

4.4.2 Potential Failure Modes 38 4.4.3 Potential for Mitigation.

38 4.5 Containment Bypass 38 4.5.1~ Definition of Challenge 38 4.5.2 Potential Failure Modes 39 4.5.3 Potential for Mitigation.

39

5. POTENTIAL IMPROVEMENTS.

40 F

5.1 Enhanced Reactor Depressurization Capability........

41 L,

5.2 Backup Water Supply System 43 5.3 Hydrogen Control by Improved Ignition 44 Systems 5.4 Extended Vacuum Breaker Operation.

45 5.5 Extended Suppression Pool Makeup Capability..

46 H

5.6 Containment Venting..

47

6. REFERENCES.

51 Draft Report viii

.__.m.-____.__

-..7..

ERELIMINARY EWR MARK III CONTAINMENT CHALLENGES.

FAILURE MODEL AND POTENTIAL

/

IMPROVEMENTS IN PERFORMANCE

1. INTRODUCTION j

In SECY-87-297,' dated December 8, 1987, the NRC staff j

presented to the commission its program plan to evaluate generic severe accident containment vulnerabilities via the Containment Performance Improvement (CPI) program.. This effort is predicated on the conclusion there are generic severe accident challenges to each light -water reactor (LWR) conteinment type that should be -

E assessed to. determine whether additional regulatory guidance or requirements concerning needed containment features are warranted, and to confirm the adequacy of the existing Commission policy. - The i

bases for the conclusion that auch assessments are needed include the relatively large uncertainty in the ability of IMR containments to successfully survive some severe. accident challenges, as indicated by draft NUREG-ll50*.

The present report addresses BWR plants with a Mark III containment design.

Previously, the CPI Program has analyzed potential improvements for BWRs with Mark I-containments".

Future and in-progress CPI studies will address BWRs with Mark II containments, pressurized water reactors (PWRs) with-ice condenser containments, and PFRs with large dry L

containments, both atmospheric and subatmospheric.

i The present report focuses on dominant severe accident challenges, as identified by current severe accident research, which can threaten Mark III containment integrity.

Potential

. improvements are evaluated as to their ability to arrest the core L

0: J.: melt progression, prevent or delay containment failure during

%. ' postulated severe accidents, or mitigate the off-site consequences of a fission product release.

A subsequent report will perform a risk analysis in order to correlate containment challenges, resulting consequences, sequence frequencies, and potential improvement benefits.

Potential improvements and benefits are considered for each containment challenge.

In-this report, a preliminary cualitative risk analysis is presented to relate severe accident sequence frequencies, containment failure mode conditional probabilities, and the magnitude of the off-site consequences.

The risk from operation of a nuclear power plant is the sum over all sequences of the frequency of the accident times the conditional probability of each potential containment release mode for each accident sequence times the mean magnitude of the consequence, given the source term for the particular combination of the release mode and the sequence.12 consequently, all factors affecting plant risk should be considered in a program to improve containment performance.

The containment challenges identified in this report involve many phenomenological issues that are still the subject of I

Draft Report 1

. gw) n -

my y

--e-

~~

. + -

u.

considerable uncertainty.

Therefore, while the material in this report relies' primarily on the findings of NRC-sponsored research, other viewpoints are presented where appropriate.

Controversial and highly uncertain -issues are der.crited -in order to provide a

!?

reference for further discussion.

1:

L

' The BWR Mark III plants and their important safety design

-features, along with'the differences and similarities among the 1'

various plants, are discussed in Section 2.

Section 3 discusses the important accident sequences that could challenge containment integrity.

Section 4 describes the containment challenges and

' failure modes resulting from the dominant ~ accident sequences.

Section 5 describes plant improvements that have the potential to prevent core damage or to mitigate containment failure or off-site q

consequences. A qualitative assessment is provided to identify the-benefits and drawbacks associated with each potential improvement, g

l l

l l,

l l

{

~ ~l t

l l

L l.

Draft Report 2

l.-

2. MARK III PIANT FEATURES A general summary of design information for the U.S. BWRs with Mark III. containments is presented in this section.

As indicated in Table 1, there are presently four nuclear power plants

-'in the U.S. with Mark III containments, located at four different sites.

As seen in Table 1, many different architect / engineer and construction firms were used to build the four plants.

Design similarities and differences are presented in Tables 2 and 3.

The discussion in the following sections focuses on variations in design features among the four units - currently licensed, and is limited to those features of the reactor and containment design thought to be.most significant in determining the plant response to severe accidents. Section 2.1 describes some of the more important features of the BWR/6 reactor line, and Section 2.2 describes the primary containment design.

Unless otherwise noted, the plant-specific information for the following discussion was obtained from tge g pective Final Safety Analysis Reports (FSAR) for the plants 2.1 Reactor Desian BWR plants with Mark III containments feature the General Electric Company (GE)

BWR/6 reactor product line.

Table 2 summarites some of the important reactor design information for the

. reactors in the Mark III plants.

A comparison of the emergency core cooling systems (ECCS) is also included in Table 2.

The BWR/6 reactors feature a high l

pressure. core spray (HPCS) system, a low pressure core spray (LPCS)

L system, the low pressure coolant' injection (LPCI) function of the

. residual heat removal (RHR)

system, and the automatic

depressurization system (ADS).

These systems are segregated into W.

three divisions to provide separation of redundant functions.

~ Division It is comprised of one train of LPCI, LPCS, Division I of ADS, an independent standby AC-power source, and an independent DC battery to provide emergency DC power to vital loads.

Draft Report 3

_e.

L'q,

[ ::

t i

l-

~,

8 14tLE 1.

UNITED STATES EUCLEAR P0hEt PLANTS WITN IWtt lli CONTAllpENT8 y:

Date of-Utility / Plant bene -

Architecturet Construction-Commercist Ergineer-Fire Operation l Cleveland Electric Itt einsting Co.

Perry 1 silbert utility 11/87 1

Outf states.

Utlllties Co.-

t River tend 1

' Stone & Webster

' Stone & Webster 6/06 Ittinola Power Co.

Clinton 1

. Sortent & Lady toteein -

4/87 t

System Energy; tesources, Inc.

Grand outf 1 Dechtet tochtet 7/75 s.

"World List of Nucteer Power Plante", kucteer bows Vol.' 3x. he. 2. American euclear teclety, February, 1999.

I l-I b

l.

L

...: <...?

's -,

l L

ll l -:

L 1'

i

.c l

l l-l Draft Report 4

Q.

j;f *7""

i m%

C.s G

'e-

• y.

2.

f

. TABLE 2.

CWPAtlBON OF Ohm itARK lli GEACTQt DEllel CNARACTERISTICS Plant Peregeter Clinton Brand Gulf Perry River tend

'StPctorDeslan

. leerk 6 sterk 6 teork 6 sterk 6 o stodet -.

e ? - Vesset ID tin.).

218.

251.

- 238.-

218.

o. Ne her of Fue1-624 800 748 -

424 l

Sundles o-Reted Power'

- 2094

- 3833.

3579.

2096.

=!

OIWth) -

j o-Power Density

-52.4 54.1 54.1 52.4 3

.IkW/L1~

-l o -- Turbine owess IX) 35 --

35 35 10 l

g-o Ircs FLou (mun)

{

et 1147 psId

.-1400.

1650.

1550.

1400.

et 200. psid 5010.-

T115.

6000.

5010.

elintam.

5.

4.

5.

5.

i l.

h E?su !ft) l

• Design AC motor AC motor AC motor AC motor t-

-- Injection Above cr.

Above er Above er Above er Location-aperger operger' sporger operger-

'o-LPCS

~

~

FLou tepsd '

5010.

' F115.'

4000.

5010 128 psid i

. Design AC motor.

AC motor AC entor AC entor Injection Above er Above er Above er Above er l

Location sporger operger-operger operger ~

o.

LPCI'.

. 5050.* 3 7450.* 3 6500.* 3 5050.

• 3.

Ftou tepe) i 24 paid 24 paid to paid 24 paid

• - Deslen AC motor AC entor AC motor AC motor

- Injection Cr ehroud ' Cr ehroud-Cr ehroud

• {

Loestion

~~

L

' 'I ADS destyisted

.o SRV's -

7 8

8 7

o-RCIC' F1ou ta n)-

400.

800.

700.

600.

-- Design.

Turbine Turbine Turbine Turbine

+: Injection RPV lleed Feedeter RPV 16eed RPV 16eed Locetion

-Division II is comprised of the remaining two LPCI trains of RHR, Division II of ADS, and independent AC and DC power sources analogous to those in Division I.

Division III consists of HPCS, a dedicated diesel generator as an independent standby AC-power

- source, and an independent DC-power source. As summarized in Table 2, the basic design features of the ECCS for all of the BWR/6 units studied are essentially' identical except for differences in flow capacity, which correspond to the relative size scale of each plant.

The ECCS systems associated with the BWR/6 plants are designed with sufficient net positive suction head (NPSH) to ensure pumping capability with the suppression pool water at saturated Draft Report 5

i

.r

.?

conditions..

This feature becomes significant during accident sequences-that challenge the-heat capacity limits of the suppression pool.

It is also important for sequences that involve containment venting or containment failure before vesselefailure, conditions that could result in rapid containment depresshisation with accompanying saturation of the-suppression pool.

The HPCS system delivers water to the reactor core through a peripheral ring spray sparger mounted inside the core shroud and

.above the core.

The system is capable of supplying coolant over the - entire range of reactor system operating pressures.

The primary purpose of the system is to maintain reactor vessel inventory after small breaks that do not depressurize the reactor vessel.-

It also acts to depressurize the reactor vessel under these circumstances and provides spray cooling heat transfer during sequences-involving core uncovery.

The HPCS system can draw a suction from either the condensate storage tank (CST) or the suppression. pool.

The transfer of suction from the condensate l

storage tank to the suppression pool is fully automatic, occurring on either low CST level or high suppression pool level.

HPCS is automatically actuated on either lower reactor water level (Level 2,

which is well above - the top of active fuel) or high drywell pressure (-2 psig).

Other

'hihh pressure injection systems include the condensate /feedwater system, the reactor core isolation cooling (RCIC) system, and the control rod drive (CRD) hydraulic system.

The RCIC and CRD systems are net part of the ECCS and have a lower makeup flow rate than the ECCS.

However; in postulated high pressure severe accidents, these systems may be important sources of makeup flow.

The RCIC makeup flow rates are included in Table 2.

The turbine-driven RCIC system delivers approximately 10% of

.he maximum HPCS flow rate.

Although a survey of plant-specific t

E. -CCRD flow rates was not made, it is expected that the CRD injection

. rate during normal operations would be approximately 65 gpm.

With optimum manual valve lineup, each CRD pump could probably deliver more that 100 gpm to the reactor vessel.

All the Mark III plants include an automatic depressurization system (ADS) as part of the ECCS to depressurize the reactor vessel l

and allow low pressure ECCS injection.

Upon receipt of an ADS initiation signal, the ADS opens a subset of the safety / relief valves (SRVs).

Vessel-effluent is piped through the SRVs to spargers located near the bottom of the suppression pool.

l Discharging effluent into the bottom of the suppression pool maximizes the condensation of steam and the scrubbing of any non-noble gas fission products.

The SRVs are grouped into banks of valves that operate in unison to protect the vessel from over-pressurization.

Each SRV bank has a successively increasing L

pressure setpoint to provide graduated pressure relief with increasing reactor system pressure.

Two low pressure injection systems are provided as part of the ECCS, LPCS and LPCI.

LPCS is an independent loop similar to the HPCS, except that LPCS is a low pressure system, it does not have Draft Report 6

- -., ~, -,. _ _ _.. _, _. -

x 3

n S a dedicated independent power supply, and the suction path from the CST is not available.

The LPCI system is a subsystem of the residual heat'-removal (RHR) system and'is a large capacity, low pressure system.

y RCIC is steam turbine-driven and is capable of taking a suction from either the CST or the suppression pool to supply high pressure makeup flow.

Alternatively, a suction path from the RHR j

system'can be established to support the steam condensing mode of RHR.

Unlike the ECCS, RCIC is only designed to operate with suction: temperatures up to 140*F.

Automatic actuation of RCIC occurs on a low reactor water level signal (Level 2) to provide makeup flow to the vessel. As with HPCS, suction transfer from the CST to the suppression pool occurs automatically.

The connection to RHR allows RCIC to pump condensate discharge from the RHR - heat exchangers, produced during the RHR steam condensing mode of. operation, back to the vessel.

The - steam condensing mode of RHR, in conjunction with the RCIC return, is i

designed to condense all of the steam generated 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> following a scram from 100% power. Except for Grand Gulf, the discharge line of RCIC injects into.the vessel head spray connection.

The head spray injection produces a

steam-quenching

effect, which depressurizes the reactor vessel.

At Grand Gulf RCIC injects into a feedwater.. line.

A comparison of RCIC systems is provided in

.j l

Table 2.

Reactivity control is provided by cruciform-shaped bottom entry control rods.

The reactor protection 1 system (RPS) monitors several system parameters and, if necessary, generates a reactor y

scram ' signal to rapidly insert the contrcl rods into the core.

l Anticipated. transient.without scram (ATWS) protection is provided

.by.the alternate rod insertion (ARI) and recirculation pump trip n (RPT) functions.

The ARI system provides a. backup scram signal f

5f

should the RPS fail.

The ATWS RPT function trips the field breakers to the recirculation pump motors, increasing the core void fraction and thus reducing core thermal power to the natural circulation. rod line limits.

Redundant reactivity control is provided.by the standby liquid control system (SLCS).

The SLCS is manually initiated from the control room to pump a sodium pentaborate solution into the reactor if the reactor cannot be shut down, or be kept shut down with the control rods.

2.2 Primary Containment Desian The BWR Mark III containment consists of two regions, the drywell and the wetwell (see Figure 1).

The wetwell consists of an annular region around the drywell and is separated from the drywell by a weir wall.

The drywell atmosphere is in contact with the suppression pool water surface in the annular region between the weir wall and the drywell wall.

When the drywell airspace is pressurized, the suppression pool water is depressed in the drywell and gases from the drywell are forced through submerged holes in the drywell wall-into the suppression pool. Since the holes in the drywell wall are below the normal water level of the pool, all Draft Report 7

]

3

w c 3 c,.'

effluent entering the wetwell first passes through the water in the L

suppression pool. The benefits of the suppression pool include (a) scrubbing of the non-noble gas fission products, (b)-a source of

_ water for the ECCS, and (c) a large gaat sink for steam L

condensation.

For example, a 140,000 ft pool is capable of absorbing 100 MW-hr of energy with only a 40'F temperature rise.

Table 3 summarizes.the general containment design information for the four Mark III plant sites.

The Mark III containment has a much larger free volume (1.8 MCF) than previous BWR designs (.5 MCF for Mark IIs and.2 MCF for Marks Is).

Because of the larger g

i size of the Mark III containment, containment inerting was not l-included in its design, and hydrogen control systems are provided for hydrogen control during design basis accidents.

Figures 1 through 4 show the general containment layout at l --

each of the Mark III units studied.

Two basic containment construction types are employed.

At Perry and River Send the containment boundary is a free-standing steel shall that is contained within a concrete reactor building.

The Clinton and Grand Gulf containments are both constructed from.a steel-lined i.

reinforced concrete shell.

Grand Gulf, which was chosen as the Mark III NUREG-1150 study plant, has a concrete containment boundary.consis. ting of the foundation mat, the cylindrical wall, and the reactor building done.

The flat circular foundation mat is 9'-6" thick and has an outside diameter of 134 '. The foundation mat supports a right circular cylindrical wall 3'-6" thick, with an inner radius of 62', and a height of 144 '-9" from the top of the l

foundation mat to the springline.

Abovs tht cylindrical wall is the hemispherical shell of the containment done. The done is 2 '-6" I

thick with an inside radius of 62 '.

The inner surface of the concrete is completely lined by welded steel plate to form a gas-tight barrier. The volume within the containment boundary consists i-

.,e J,. o f the drywell and suppression pool.

The drywell wall is a L

32 '. cylindrical structure made of reinforced concrete.

The drywell is

~

L connected to the wetwell by 28-inch diameter vents in the drywell wall located below the surface of the suppression pool.

A water seal is maintained over the vents by a 17-foot weir wall located inside of the drywell wall.

Steam released within the drywell boundary is relieved through the annulus between the' weir wall and drywell wall, out through the submerged vents, and into the wetwell water volume, where the remainder of the steam is condensed.

l l

l l

l Draft Report 8

1..;.

1

-4 y

r-

~.-~

g j

-4

l.

. TABLE 3. ColpARIsou 0F glst RAAK lit PelRARY GIlWTAIIBEWT DElite CantACTEt!STICS Plant

//

1 i;

Peremeter,

'Clinton Grand autf Perry

- River tend Contalruent Desien o - Totet Free volume '

1.00E*4 1.67E+6 1.20E+6 1.19E+6 Ift*3

'o--

Peo vetune 0.13dE+4 0.14E+6.. 0.1M+6 0.13E+6 fft e Centalrument.

0.42 0.44 0.34 0.41 Votums/Thornet r reting

.l (ft kno

o. Centelruent 0.067 0.037 0.054 0.065 pool Votime/

Thermal Power ntfm.

tft /khQ r

e Drywett/bletuett-Vents

- thsher 102

-135 120-129 e : Design Preneure

- 198153

- Internet.

15.

15.

15.

15.

Externet 3.0 3.0 0.8 9.6 o Drywell Design Pressure 198191 Internet

'30.

30.

30.

25.

Eateens1 17.

21.

21.

20.

.o-Itaxima Leeksee 0.45 0.35 0.20 0.26 Ekot/Doy1' e tout es Removat tote 37.F2 50.F2 46.9*2 37.F2 (10e6 Stu/hr) t of Core Thefant-Peuer Draft Report 9

~..

. _ ~ _

.g;

.: s 1

t

,g-1ABLE 3. - ' (coufiguED)

~

5 Plant

Peresster Clinten trend Gulf-Perry River tend asA Peak Reasonne o'

Drywett tpsis) 18.9-22.0 22.1 19.2 4

et centelnment (psis) 8.7 11.5 11.3 7.6 Cam ustible Gas-S

.centrol e:. u, stimine DrywelI to 600.*2 1000.*2 500.*2 600.*2 C3ntstruusnt (scfal.

e contelrunent Purge 300.*2 65.*2 50.

2500.

-to SGTS tacta0' o N,neceelner 70.*2 100.*2 100.*2 100.*2 T

(Ecfa) o.

N Ignitors If3 115 90 -

??

106

?

2 Secondarygtdp 1.71 3.64 0.393 0.357 Vetuma tft

• 1.E+61 Amutus -

0.393 0.357 Aun Btdo.

3.04

+

- Enct Stdg.

0.60 Operating Pressure (in mal

- Amulus

-0.40 3.0

- Aux 0tde.

-0.25

-0.125 0.0 0.0

- Enct Stdg.

0.0 t

in Leekage Rete -

0.65 -

100.

IEWot/ day)

Ffsolen Product-Centrol Systems o Ce 9 1ty

_ 4000.*2 12500.*2 700.*2 12500.*2

.Ift / sin)-

l

.- f l'

L l.o 1,

1 l-i l'

l l

Draft Report 10

! 'l '

__.__....___.._,_.-_.__m___

m

?

3 s

.g.

e 4

)

E b.% &T S' f

i p/

's

\\

\\ CapffhfhastenT tab

,Gahrh Shsenahas

\\

1 (astfashhatteT

.\\

f

= t4ammt CL.440'=4' i

3 g

j tAmant.m g6 em ir-

- -W i

\\

A R?m t

m wee. 6 eve.

i 86.64938 SE,>

L r.en -

l peu s' 2

s

- t. ese r-

.,m;,

p.

Q, j.

.e

,'j*

!L**e-.

'=-

,e D

l

[O ll' r

l r.m r

j l li 5 h in y -

b.

/,,,

w h

r '.:.g}. W }i' n~

7

~".4g

(

6

~~

• i1 1

4

s. w., 'l

[

-=6*%,,,

a s

a....

,see srum

+,

-.\\

m

/,,,

I

,A

-e~

hme f.4

• g,1,';...A.' 4,

,,,ic j

4.,. g. &

,u a ti W 2;;;c':::: =-

Q'

_c..<

h.

'ld'--hh****

)~' I sei. I bM

\\

'.f ',

me

_b

.i:

5-F

{

n'

.m.

I-

).

fi:l y-4

.i

.-c.

rr l

)

,, e q(,,i a'a...

, \\ /

• l' e.a. v aa=** a Q.

c.t,]

i 4

_ 6,.w

/

'_,g,

...Q s. war u.)

v e

y I}

Div.

~lI - lif E.

pj

' 'i

[

,g i

N l

eE m.mm I

j

\\h_l A r,,',

a _[.u'~.l

+

w

,~u n.<

g s e"

.,'. t w

am

.es.,.....+.

s Figure 1.

Clinton contalrunent layout.

Draft Report 11

3-q-

1, '

' Ij f 'I '

~

f J

h <-

1

?

1 v-,...

s,,,,

.e l

i p............

DD E-E ~~ t c qq'.

1T' I

i

• u,.

,. - % su gp..

~

- f-..

p N,1

.T'1,-

l H

l l !

e,

..(':.: z ed

,_.a 7

m..u.....,

I., j,;,,,i

io

'm c.

. :i u.,,,

.-l.,l.

3_,

u M,'L

Db==I t

u,,,

In

1. -a.im t

w h=.:q lli g, j.,H

-g t :=.

t.

N imm m

, p.e%sf.

y

-a%.

'P'.I l'

- E,, l e

t.

y

.c. =..y c.'. - -

N n".,

MPL,M. '1

• i.y j.--

.,, ?a...-

"a

-, [ *

./,

s,m

. ':.: _ _ n

--,,<g...

l 11* *W,1.7 l

b"*****

g WD8t'IWCAL CAGLt Figure 2.

Grand Gulf contelnment toyout.

Draft Report 12

1 4

i, CON %smaNT fl%LL,

e L L.167' b's g

g,g ggi g g p g t *

.ls _

'de LL 'Ft1'.b*g

^

Q g tL 14 9'a i'-

S S

IPRIllG LWIL

/IL.111'. 0"

[higg ggggg

/ OP Of RAIL T

J LL.Til* O'

.as POLAR CRANL RIVG Cp69lCER' S'

(

/CONTAltfMcNT -

3 ventu 4

..l M

lod as gggy, ggg.g;.

ORYt(LL getAD

[A O

IL*UTh f

u 4

1 4

i ia

.-n

_,c..q

,r;., f,-

l

..I g gygg g h

's I, -Cotuta w (1 T P. IT PLACL$)

,f. -

si.ev GG4.1*

)

A 9

sTerrower c.

i

..y

[,.

.e.n

. :. n'

. l-

.:tr f.

,q c u s

.o*

l

,-s a ve,s n...,...

g1gyg,,..'.J/

S

/

m: --:

c_o. e.

f

-u 1

c.:o,

WoM

. ;i

.e.

m m u.

3:e

.c:.a.

DbSV. GM f

1 YpplywgLL l1'

. n.. '. y

.d r -

wagg '

It'.Dr @

CSADE ELEV f.fd.d

'.;W 1

1 1

F c' Vw

, s).

..s fi'-- 4 5

, afar.r.eu.rr

\\

l

- m,.

x

,/

e

- w,9 ;>.).

i g-

m. -,co,,:,,

3 g

am jm.* u.

. - toc.

.e --~ eav. new.

u.r,e 2.

s

. s.... ----

4

.Fo,,,.

u

muu, g,

L

.i [W 9

w e m u. ej gggggu y, stierswc4 st.sse

r-

,. _y 1

I 4.a..* a

.vm

c. it.

,: r-qw soi.t samum

E

,,,essee, uL. ms e.

2 0

.g...

-y svis r..,ec. a es.. e-

.gT y;

gggy, g,.

l

-g-

..'4

..i ret Ev.,ge -g

..,9 Np-Aawotus coar.arre

=

~

4:?

,','. j o '.j 8'4 1,'.,Y u

o n n u o n o o g

l-

. i.. '.

. ?.

ou Ma7...., 4 FouNOATi o

Figure 3.

Perry contelrusent toyout.

Draft Report 13 w w-w w w a-w m wmm--

___,________m,

/e

i,

. l +e ;

e.

..s...e...g.

...s.g...

g.e..

JY 4

mw h

l i

,an=......4.....

,/

e

.Y 7 'I ~' '"

r **.u a..

F

.....e......

/

A i

8P.f.........6 k?

'5 aj F

I;if M

i_

N.......

i i

/

i-g

,/

\\

l H& u#l.

l 2

---m s

.e EI' f

,g I?%,,

i r

^

1 w z

.......... s 4

%j

'j,

/

.t

.u;

.r i

s, 3

I p-c_ 1 2

pmm- -. _.2 L

7 c...__

t'

('

)

ida a

b E

C l

r-t;=f.T e

3

,/b s

J,,c f2

\\

f:e.

i3

. c,

_ q%

a

./

/

4.

~

/

(............. i

'...........u......

/

Figure 4.

River Bend contalrunent toyout.

Draft Report 14

--9.-

e-

--.w--wgg a

=cy,em-'-w-

--'Trwv

&'=9"*'-

=r-W--+*

"9 i-w-

-ew+we-w w

W y

.y The'SRVs discharge through quenchers located at the bottom of the suppression pool.

Vacuum breakers located in the drywell on the SRV tailpipes prevent the tailpipes from drawing fluid up from the suppression pool as the steam in the lines condenses following SRV closure, i

l The Grand Gulf reactor vessel is supported by a cylindrical u

pedestal 5.75 feet thick.

Exterior to the pedestal is a nine-foot l

thick concrete support mat that sits above the foundation mat and extends from the reactor support. pedestal to the base of the drywell weir wall.

The cavity within the pedestal is 21'-2" in diameter and 6'-3" deep from the basemat to the top of the reactor pressure vessel (RPV) pedestal mat.

Molten core debris from a postulated failure of the RPV bottom head would likely be contained within the pedestal cavity.

The Mark III pedestal design is less susceptible to failure from corium attack than the earlier Mark II designs, since the - lower region of the Mark III pedestal is surrounded by the pedestal mat as opposed to the Mark II designs, which are either surrounded by or placed directly into the suppression pool.

Should corium attack fail the pedestal, containment failure and suppression pool bypass would likely result from vessel movement breaking the seals of attached piping at the drywell and containment boundaries.

During normal plant operations, equipment and floor drains in the drywell drain to sumps located in the in-pedestal cavity.

There are two 460-gallon sumps, each of whicfr is equipped with two 50 gpm AC-powered level control pumps.

Each sump has a single discharge line common to the two level control pumps.

This discharge line is equipped with a pair of normally open, air

_ operated isolation valves in series.

These valves will automati-

,. -(cally close on reactor vessel low water level - Level 2,

high

.drywell pressure, loss of control air, or loss of power co the solenoid pilot valve, and can also be closed by remote manual operation from the control room.

Fluid from the two active sumps is normally discharged to two 5000-gallon auxiliary building drain transfer tanks, and from there to equipment and floor drain collec-

. tion tanks in the radwaste - building.

The drywell floor drain collection tank has four floor drain lines from the 100'-9" level of the drywell.

The floor drains are each 4-inch lines that feed two 8-inch drain headers, one of which is reduced to six inches before discharging to the floor drain sump.

During severe accidents, the sump discharge lines will isolate and the sump pumps may experience loss of power, allowing the sumps to overflow.

The drain lines into the sump will provide a flow path for water accumulating on the drywell floor.

Since the sumps are equipped with well-fitted, but not water-tight steel plate access covers, flooding of the pedestal will be possible before water levels on the drywell floor reach the pedestal access and CRD removal opening.

The rate at which flooding of the pedestal cavity occurs is limited by the rate of leakage from the sump vent (approximately a 1/2" line) or from around the sump cover.

There should also be a flow path from the pedestal cavity floor into the sump, but it Draft Report 15 x

L i

9 4i-

,4.

is'not shown in the. Grand Gulf FSAR.

As discussed later in this report,. the rate at which the cavity can be filled through the floor drain lines turns out to be an important consideration in determining the potential for.a steam; explosion should a severe accident progress to the point of RPV failure.

The containment design pressure is 15 psig at all Mark IIIs.

There is a significant margin between the design pressure and the maximum design basis ~ accident (DBA) pressure for both the containment and drywell structures. The peak containment pressures calculated for design basis accidents occur during the long-term.

phase of a main steamline break when the peak suppression. pool temperatures are reached. Several analyses have estimated the Mark III ultimate containment pressures to be significantly higher tha the design pressure, with values ranging from 55 psig to 100 psig.'g The higher ultimate strengths are associated with the free-standing steel designs of Perry and River Band.

All of the Mark III plants, with the exception of River Bend, have similar residual heat removal (RHR) systems.

In addition to the LPCI mode discussed earlier, RHR can also be used to remove heat from containment-when lined up in either the suppression pool cooling mode or the containment spray mode.

Two RHR pump trains circulate suppression pool water through two heat exchangers and back to the suppression pool or to the containment spray nozzles.

Containment sprays are initiated automatically during a loss-of-coolant accident -(LOCA) ten minutes after the containment pressure exceeds the spray initiation setpoint. The containment sprays will condense' steam in the containment and scrub.pon-noble gas fission products.

Vacuum breakers are installed in the drywell, which communicate to the suppression pool air space to control rapid weir wall overflow in a large break LOCA that could cause drag and impact loadings to essential equipment and systems in the drywell above the weir wall.

Drywell vacuum relief is not required 'to s

' ? assist in hydrogen dilution or to protect the structural integrity

' of the drywell. following a large break IDCA."

(River Band has neither a containment spray system nor drywell vacuum breakers.)

The Perry FSAR specifies elemental and particulate iodine removal rates of 2.5/hr and.88/hr, respectively for the containment spray system.

The Grand Gulf containment spray system elemental and particulate iodine removal rates are stated as 6.7/hr and 1.66/hr, respectively.

The Clinton FSAR does not take credit for the containment sprays for fission product control.

Combustible gas control is provided by hydrogen mixing systems, containment purge systems, post-IDCA hydrogen recombiners, and hydrogen ignition systems.

Hydrogen mixing systems are installed in each of the four plants studied, although the specific designs vary from plant to plant. At Grand Gulf and Perry, containment air is forced into the drywell where it mixes with hydrogen in the drywell volume.

Return air flow to the containment passes through the suppression pool vents.

At Clinton, air from the drywell is exhausted to spargers located below the suppression pool surface; return air flows through the containment vacuum breakers into the drywell.

At River Bend, fans in the upper drywell exhaust to the Draft Report 16

. ~....... -...

p containment air space while return air enters through two lines-located just above the suppression pool.

Containment purge is provided at each of the plants.

The purge system utilizes.the filter trains of the standby gas treatment systems (SGTS) (annulus exhaust gas treatment system at Perry) to filter releases from containment.

containment makeup air is provided by compressors which draw from outside air.

The post-IDCA hydrogen recombiners, which are present at each of the plants, are designed to control long-term containment hydrogen concentrations produced as a result of:

1.

Metal-water-reactions involving the circonium fuel cladding and the reactor coolant, 2.

Radiolytic decomposition of the post-accident emergency cooling solutions, 3.

Corrosion of metals by solutions used for emergency cooling or containment spray, i

When AC-power is available, the recombiners-can be used from the onset of an accident in which severe core damage has resulted. The recombiners cannot, however, control the large scale generation of hydrogen that would be expected to occur during a core degradation event.

Their recombination rate of 100 scfm was designed to protect against.the hydrogen generation rates occurring during and after a design basis IOCA, not against the higher rates occurring.

i during the core degradation phase of a severe accident.

At these higher rates, hydrogen production will overwhelm the recombiners, allowing flammable concentrations to be

reached, and the recombiners to become an isolated ignition s'ource.

i Hydrogen control during postulated degraded core accidents f

relies, instead, on distributed ignition systems which are L

. installed at each of the plants.

AC-powered ignitors, distributed l-

,.c. w throughout the primary containment-and drywell, are designed to 4,',

.l burn the hydrogen in such a manner. that containment over-l pressurization from hydrogen detonations does not occur.

I l-l Draft Report 17 l.

~._,___.-......._m._,_-

j

- 1 y

w i

-3.-DOMINANT CORE DAMAGE SEQUENCES J

e In this'section the dominant accident sequences leading to core

' damage are discussed, with Grand Gulf being used as the reference plant. The latest draft NUREG/CR-4550 analysis of Grand Gulf (June I

~1989)' has. defined the dominant to be those_ with a frequency greater than: 1.0E-8/yr.'pequencesFour types of sequences have been identified that meet this criteria.

They are short-term station blackout (STSB),

long-term station blackout (LTSB),

anticipated transients without scram (ATWS), and transients with

)

loss of the power conversion system.

The importance of each type of sequence with respect to total core damage frequency is shown in Table 4."

The most important sequences are clearly those involving station blackout - (SBO).

Station blackout as a class is described in Section 3.1.

Next in importance are the ATWS sequences (designated as TCUX) which are l:

L described'in Section 3.2.

Least significant among the dominant sequences are those that result from transients with a loss of the

' power. conversion system (PCS), designated as TQUX and discussed in l=

Section 3.3.

Together these sequence types contribute more than 99% of the total Grand Gulf core damage frequency.

3.1 Station Blackout There are five dominant station blackout sequences that.

together comprise 97% of the total core damage frequency (CDF) at Grand-Gulf.

The dominant-sequence (89% of CDF) is initiated when a ; loss of off-site power (IDSP) generates e successful reactor scram, followed by a loss of all three divisions of on-site AC power.

The SRVs function to relieve the pressure transient caused by the closure of the turbine stop valves, and reactor water level drops below Level 2 as a result of steam loss to the suppression

,., - pool.' RCIC fails to start and the core is uncovered, resulting"in

. "!_ {coredamageathighreactorpressure.

The second most'significant sequence is responsible for 4% of the total CDF. This sequence is like the previous one, except that one SRV fails to close prior to the failure of the RCIC system.

With one stuck open SRV there i

TABLE 4. GRAle RAF DOMINANT ACCIDENT SEQUENCE CONTRIBUTIONS 70 CORE 8ELT FREeENCY Accident Type Segaence steen Fregaency 1 Contribution to Core Designator (per reactor year)

Demoge Fregaency 8T88 Tsu or Taux 3.OE 6 94.21 LTS8 ft 1.1E 7 2.61 ATW5 TQJK 1.1E 7 2.7X Loss of PCs Toux 1.3E 8

<11 Draft Report 18 1

r.

is an increased probability that the reactor will be depressurized during core damage.

In the third most significant station blackout nequen'ce (2%),

RCIC operates properly until the RCIC turbine trips on high backpressure.

During this time, the SRVs are properly limiting reactor pressure.

After the RCIC turbine trip, the reactor is depressurized and firewater is connected as a source of reactor water makeup.

The SRVc eventually fail due to battery depletion, and the reactor is maintained depressurized by using the RCIC steam line.

The operators fail to maintain pressure below the firewater shutoff head, and core damage results when firewater injection is lost.

3 In the fourth 2tation blackout sequence (1%), the 3RVs fail to reclose, thub creating a leak beyond the makeup capacity of the RCIC. As a result of the relief flow /RCIC alsmatch, the core e v e n t u a l l y u r.c o v e r s, leading to short-term core damage at low reactor pressure.

The last significant station blackout sequence (1%) is very much like the third except that when the RCIC turbine trips on high back pressure, the firewater system alignment for inject:,on fails.

With no other s'ource of injection available the core uncovers and results in core damage.

3.2 Anticioated Transient Without__ Scram l

l Approximately 3% of the total CDF. et Grand Gulf is attributable to a single ATWS sequence (TCUX).

$his sequence is initiated by l

a transient, which is followed by closure of the main steam isolation valves (MSIVs).

The reactor scram fails (RPS and ARI l

,,.. ffailures) but the recirculation pumps are successfully tripped,

,y c'.thereby reducing reactor power.

The operators are then l

unsuccessful in actuating the standby liquid control system (SLCS) and the reactor continues to steam to the suppression pool through the SRVs.

The HPCS system fails'to function either when demanded i

cr ut some point during the required mission time.

When HPCS fails, the operators fail to depressurite the reactor, resulting in core damage at high pressure.

The draft NUREG-4550 analysis" grouped the cutsets from this sequence into both long-term and short-term plant damage states (PDSs). The short-tern PDS results when HPCS fails to operate upon demand. The long-term PDS results when HPCS initially operates and then fails in the long term (> 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />) due to either loss of room cooling, or failure to transfer suction to the suppression pool when the CST is depleted.

3.3 Loss of Power Conversion System The dominant sequence in this plant damage state is initiated by a transient with failure of the PCS followed by a reactor scram.

.Since the main condenser is unavailable as a heat sink, reactor Draft Report 19

o L'

pressure rises until ther SRVs open to allow steam to flow to the suppression pool, thus maintaining pressure below vessel safety limits.

The high pressure coolant injection systems (PCIC and HPCS) do not function on demand or are not actuated by the pperator L

and the turbine-driven feedwater pumps are unavailable due to the loss of the main condenser.

The reactor is not depressurized, either by the ADS or through operator action, resulting in core damage with the reactor at high pressure. The low pressure systems are available for injection but cannot inject into the vessel with the reactor at high pressure.

i

/

4

... r 7..

+-

Draft Report go

.. ~. -. -, - -. -.. -. -. -.,. -. -... -. _.. _ _ - _ - -.. - -. -. _ _. _. _ _ - _ _ _. _ - _ -

4. _,

m.

m m__.

O ls l

4. CONTAINMENT CHALLENGES AND FAIIATRE MODES This section provides a discussion of the risk significant i

containment challenges and failure modes resulting from the sequences defined in Section 3.

These challenges include gradual (static) overpressuritation, hydrogen-induced overpressurization, j

j steam spike-induced overpressurisation, and overpressurisation from core-concrete interaction (CCI).

4.1 Inadecruate containment Meat Removal Inadequate containment heat removal will gradually pressurize the containment building over a period of several hours to several days.

Pressuritation occurs because the containment heat removal capability is inadequate for the energy addition rate, resulting 5

in eventual saturation of the suppression pool and loss of the l

prsssure suppression function.

The associated containment failure mode is leakage that is sufficient to prevent further pressurization.

The potential for mitigation is dependent on (a) reducing the rate of heat addition to containment, (b) enhancing containment venting capabilities, or (c) increasing containment l

heat removal capability.

4.1.1 Definition of challance overpressure challenges due to an imbalance between the heat addition rate to containment and the heat removal rate fron containment typically are the result of either sequences involving the failure of long-term heat removal (TW) or ATWS sequences.

The most recent draft NUREG/CR-4550 analysis of Grand Gulf found TW to be a non-dominant sequence, principally because early containment failure doe not present a challenge to core integrity at the Mark III plants.p' In this respect, the Mark III plants differ from the J.. earlier Mark I and Mark II designs, in which containment failure

' can lead to a loss of coolant injection.

However, ATWS is

'significant and results in both long-term and short-tera plant damage states.

The long-tern plant damage state, by definition, will result in suppression pool heating of sufficient duration to cause an early overpressure challenge. However, the CDF associated with ATWS at Grand Gulf is believed to be overestimated, as discussed below.

In the ATWS sequences analyzed for Grand Gulf in draft NUREG/CR-4550," failure to actuate the SICS was combined in the human factors analysis with failure to depressurite the RPV; these two events, although separate on the event tree, were treated as one dependent event in the sequeneo cut sets.

If failure to actuate the SLCS were to be treated as a separate event in the sequence cut sets, the mean ATWS sequence frequency would decrease by approximately one order of magnitude from the current NUREG/CR-4550 result." As a result of combining the SLCS actuation failure with failure to depressurize, no SLCS hardware failures appear in the sequence cut sets.

Table 4.8-4 in the most recent draft of NUREG/CR-4550 indicates that these probabilities are dependent while they should be treated as independent probabilities (i.e.,

Draft Report 21

1 i

multiplied together)."

If SLCS initiation failure were separated from failure to depresaurite, and a larger human error probability were used, the SLCS hardware failures could become more important, i

The two dominant cut sets in the long-tern A'NS plant damage state involve failure of the NPCS suction transfer from the CST to the suppression pool (sequence 74-B in draft NUREG/CR-4550).

The i

fault tree model generating these cut sets appears excessively i

cor.servative and, although the NPCS fault tree does not explicitly j

show it, the discussion in draft NUREG/CR-4550 indicates that this transfor is questioned at the point of low level in the CST, not high level in the suppression pool (which occurs first)."

With a pinimum of 100,000 gallons in the CST ren.rved for HPCS, and with HPCS injecting at -1000 gpa (the reactor is not depressurized in this sequence), low level in the CST would not be reached for at least 100 minutes. With continued steaming to the suppression pool l

at 18-20% of rated power (level assumed to be controlled at top of I

active fuel (TAF)), the containment will be overpressurized or vented before the CST is depleted (this assumes that the automatic HPCS transfer to the suppression pool on high pool level either failed or was overridden).

Therefore, sequence 74-B is not considered in this report to be a contributor to CDF.

It may contribute to early containment overpressurization but should not result in core damage, since neither venting nor containment failure (failure assumed to be at the springline) should impair injection.

Another failure that appears in the cut sets for long-term ATWS is loss of HPCS room cooling, specifically due to failures in the standby service water (SSW) system.

However, the text of draft hours following a loss of room cooling.'}tinue to operate NUREG/CR-4550 states that HPCS will cor for 12 Again, the containment

. would be overpressurized long before this time or the reactor would

/

,J be successfully shut down.

Neither d these outcomes will result V.

in core damage.

Also, it is not credible that an ATWS sequence could continue for 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> without the reactor being shutdown by either manual' rod insertion or by SLCS injection (even with failure of the SLCS pumps, boron can be injected via alternate means, or repairs can be made to the SLcS).

and upon discussions with Sandia National Laboratory,gS sequence, Based on prict understanding of the long-tern AT a dominant mode of HPCs failure was thought to be failure of the operator to override the automatic suction transfer to the suppression pool on high pool level.

Failure to override this transfer would be postulated to fail HPCS, since the hot suppression pool water would i

provide inadequate lube oil cooling.

However, this failure does not appear in Any ATWS cut sets; therefore, we had to awsume that it was not modeled. This was confirmed in a telephone conversation with Mary Drouin of Science Applications International Corporation, who performed the Grand Gulf front-end analysis described in draf t NUR2G/CR-4550.

She indicated that this transfer was not modeled as a HPCS failure, since the HPCS notor bearings could withstand a fluid temperature of 350'F for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

Seal failure l

Draft Report 22

_i_ _ _ _ _ _ _ _ _. _ _ _ _.. _ _ _ _ _ _ _, _

4 y

l would occur prior to bearing failure, but seal failure was not postulated to fail HPCS.

l l

Furthermore, the existing analysis is based on Revision 3 of the BWR Owners Group Energency Procedure Guidelines '(EPGs).

i I

Revision 4, which is scheduled to be implemented at Grand Gulf in l'

the Fall of 1989, would require significant revisions to the ATWS event trees.

Under the new procedure guidelines, injection would be maintained from the CST and RPV level control would first be L

attempted using CRD flow and systems that inject outside the core shroud -(this ascumes t. hat the feed pumps are unavailable due to closure of the MSIVs).

At Grand Gulf this implies use of only the 1-RCIC, CRD, and condensate systems.

Since the condensate system is l

a low pressure system, and RCIC and CRD are inadequate to maintain level above the minimum steam cooling water level (MSCWL) defined l

in the EPG, the result is that depressurization would be called for l

early in the sequence, even if HPCS and RCIC were available. After I

. depressurization, several systems would be available for level control. Because of the high injection flow rates available at low pressure, control of flow rate and reactor power would be more difficult, hence human error probabilities should also change l

because of the increased complexity of actions required to maintain level.

The result is that the existing ATWS sequences will not make sense in the context of the Rev 4. EPGs.

l l

Thus, the current draft NUREG/CR-4550 estimate of ATWS core damage frequency appears to be significantly over-conservative.

l RequantifJcation may eliminate ATWS as a dominant core melt l

challenge and therefore, the associated overpressure containment I

failure mode occurring prior to core damage may become i

insignificant.

4.1.2 Potential Failure Modes c'h The specific containment failure mode associated with

- inadequate containment heat removal will be leakage or rupture L

caused by static overpressurization.

The most likely failure i

location is at the head knuckle for steel. containments, although I

both the cylinder wall and the personnel air}0ock have also been identified as possible failure locations.

(NUREG/CR-3653 summarizes the probable containment failure locations for static i

over-pressurization.)

Estimated failure pressures range from 55 psig to 100 psig, depending on analysis technique and failure criteria used. The Perry containment, with its free-standing steel construction, is predicted to have an ultimate pressure of 100 psig, with failure occurring at the head knuckle.

The Grand Gulf containment, with its reinforced concrete design, is predicted to fail at 55 psig, with failure occurring at the cylinder near the springline.

4.1.3 Potential for Mitiaation Containment venting could be used to protect the containment from inadequate heat removal.

Venting procedures that are in accordance with the EPG are in place at Grand Gulf, and the Draft Report 23

X..,..

T existing vent path could reasonably be expected to prevent overpressurization during ATWS scenarios.

The vent path is a 20-inch line made up of both hard pipe and heating, ventilating, and air conditioning (NVAC) ducting.

Failure of the NVAC duct portion of the path would not necessarily create environmental conditions in the auxiliary building that would force an and to recovery efforts, since the compartment containing the soft ducting is equipped with an opening to the steam tunnel blowout panel that should protect the compartment door from failure, thus preventing the spread of steam throughout the auxiliary bui10ing.

4.2 Hydroaan-Related challenses Hydrogen deflagrations or detonations can lead to containment failure from either static or dynamic overpressurization.

Prolonged diffusion burns can cause failure of sealing materials in the

drywell, and at the containment boundaries.

The consequences of failures resulting fror hydrogen combustion are aggravated by the possibility of simultaneous failure of both the containment and drywell.

This creates the possibility of a highly energetic release that is unfiltered by suppression pool scrubbing.

The probability that combustion will occur and create a pressure load capable of failing containment is relatively high for the dominant Grand Gulf plant damage states. Because of the relatively high probability of combustion-induced overpressure failures, and because of the severity of the resulting releases, hydrogen-related challenges are the most risk significant category of containment challenge at Grand Gulf.

Hydrogen-induced overpretssure is prominent at Grand Gulf because the containment is not inerted, and because the AC-powered hydrogen ignition system (HIS) will not function during station sequences, which dominate the risk profile.

During

~

'w 3 blackout

. short-term station blackouts, hydrogen deflagrations and detonations can occur as the result of spontaneous ignition.

During long-term station blackouts, the containment is postulated to become steam-inerted.

However, should the plant recover power after the onset of core damage, hydrogen deflagrations and detonations can still occur, since containment spray operation will condense steam from the containment atmosphere.

An ignition under i

these circumstances is likely and will have severe consequences due to the large amount of hydrogen available for combustion.

1 Actions with the potential to reduce the consequences of combustion are:

ensuring ignition occurs while hydrogen concentrations are within the range of 4-6 v/o, post-accident inerting of the containment, and removal of hydrogen and oxygen via 1

containment venting.

L 4.2.1 Definition of Cha11ence i

Oxidation of Eircaloy and stainless steel core components during core damage produces the hydrogen that threatens containment integrity in severe accidents.

The primary source of Eircaloy is the active fuel cladding.

The Zircaloy in the channel boxes and Draft Report 24

i i

^*

)

the stainless steel in the control rod sheaths also may react to generate hydrogen.

Several analyses have been documented that predict the amount of hydrogen generated during postulated core l

damage events at Grand Gulf.

The results obtained differ widely depending on the analytical tool and key assumptions ' used in developing the analytical model.

}

IDCOR published the rgsults of MAAP calculations for T 0W, AE, 3

T QW, and T C sequences.

These sequences, as defined by IDCOR, m

3 dif fer substantially from the current NUREG-1150 dominant core j

damage sequences, making useful comparisons difficult.

However, the T,QW sequence is similar enough to the NUREG-1150 short-term station blackout sequence to provide useful insights into the kind of results that are obtained with the MAAP code.

The IDCOR T sequence assumes an initiator that results in the complete loss,QW of I

injection when both the main feedwater and condensate systems are unavailable.

Thus, neither the primary injection system nor i.

containment heat removal is available.

The key difference between i

the IDCOR sequence and the NUREG-1150 short-term station blackout sequence is that the IDCOR analysis assumes the operators i

depressurite the reactor when reactor water level drops to Level j

1.

Core damage occurs at low pressure, resulting in the release of up to 0.05 lba/sec of hydrogen gas.

Since MAAP assumes channel i

blockage by molten fuel and cladding, the reaction is predicted to become limited'by steam starvation, and to result in the release i

of only 10 lba of hydrogen from in-vessel production sources.

A total release of 3000 lba is predicted, nearly all of which results from reactions occurring in the debris bed after vessel failure.

I IDCOR ran a variation of the T,Q W sequence to study the i

effects of failure to depressurize.

This sequence, in which core i

damage occurs at high pressure, is very similar to the short-term station blackout sequences currently responsible for 94% of the core damage frequency at Grand Gulf.

With no depressurization

' before vessel failure, MAAP predicts 430 lba of hydrogen will be

' generated by in-vessel oxidation, as opposed to 10 lba when the vessel is depressurized at Level 1.

The total amount of hydrogen produced in this case is also higher, at 3,200 lba as opposed to 3,000 lba when the vessel is depressurized at Level 1.

l Battelle has published the Yesults of STCP calculations for short-term station blackout, long-term station blackout, and ATWS sequences.'8 Their short-term station blackout analysis (TBS in their nomenclature), which is very similar to the IDCOR TQW i

3 sequence with depressurization at IAvel 1, shows 39% of the active fuel cladding will oxidize before vessel breach.

The referenced report does not state the mass of hydrogen released either before vessel breach, or later during reactions in the debris bed.

However, the long-term station blackout sequence is stated to result in the oxidation of 32% of the active fuel clad,12% of the Eircaloy in the channel boxes, and 10% of the stainless steel in i

the control blade sheaths, for a total of 26% of the Eircaloy in the core.

With only 32% of the clad reacted, this sequence resulted in the generation of 2,000 lba of hydrogen by the time of vessel breach.

Since the long-term station blackout sequence i

Draft Report 25

,,.c

'.o assumes injection with RCIC until battery failure at 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and d

subsequent core damage at high pressure due to failure to depressurize, this sequence is not directly comparable to any of the IDCOR analyses described above.

i f

The draft NUREG-1150 analysis of the short-tera station blackout sequ is based on preliminary MELCOR and BWR-LTAS calculations. gnceThese calculations have not yet been published, but i

i results have been made available to CPI personnel in the form of a pre-draft report.

The MELCOR portion of the analysis, used to determine containment response after core uncovery, predicts an average hydrogen production rate of 0.24 lba/sec from the onset of 3

tircaloy oxidation until vessel breach, which occurs approximately 1

3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> later.

A total of 2,700 lba of hydrogen are generated before vessel breach, followed by an additional 820 lba after vessel breach.

Another 1,320 lba are predicted to be generated i

during CCI.

l The MELCOR analysis utilizes a hybrid BWR/6 model that was i

l scaled up from an existing La Salle BWR/5 input deck.

In addition, the containment model was decigned with a relatively coarse nodalization scheme in the interests of time. Because of questions about the adequacy of the scaling and nodalization used, CPI program contractors are currently performing independent ME140R calculations that may be used to verify some of the existing calculations.

No results from the CPI program calculations are presently available for comparison, however.

Most of the hydrogen generated from iri-vessel oxidation is transported to the suppression pool through the SRVs.

Hydrogen is non-condensible and has minimal solubility in water; therefore, hydrogen released into the suppression pool will generally relocate into the containment air spaces.

Hydrogen leaving the suppression 5 pool will tend to stratify in the upper regions of the containment

,in the absence of a mixing force.

Quarter Scale Test Facility results have provided some evidence that enough mixing occurs in the containment to prevent this stratification.

Therefore, if the ignitors have been turned on and are operational during core degradation, and the suppression pool is subcooled, hydrogen should ignite as it evolves from the pool surface.

The result would be a diffusion flame that may persist at locations above the SRV discharge into the suppression pool. The nature of the containnesnt challenge resulting from a diffusion flame will depend very strongly on the rate and duration of the hydrogen release through the SRVs.

If the burn persists long enough, elautomeric seals in both the containment and drywell could be threatened by overtemperature.

overpressurization is not considered to be a likely result of a diffusion burn.

In sequences where there is some probability of an SRV tailpipe vacuum breaker sticking open, some of the hydrogen generated in-vessel will relieve through the stuck-open vacuum breaker to the drywell.

Pre-draft NUREG-1150 MELCOR analyses indicate that blowdown of steam and hydrogen to the drywell will tend to push air out into the wetwell through the suppression pool vents, leaving Draft Report 26

____._q e

i the drywell atmosphere inert to hydrogen burns.

A stuck-open tailpipe vacuum breaker could, if it failed open during peak

release, cause flammable conditions in the drywell for approximately 20 minutes before the drywell inerted from either i

steam buildup or oxygen depletion.

Under these conditions, the hydrogen released from the RPV would be hot enough to self-ignite and would burn as a jet at the release point. Calculations predict that it would take 500 seconds for the hydrogen burn to deflete the oxygen in the drywell and that the rysulting pressure rnse would not challenge containment integrity.'

Therefore, while there is some chance of a hydrogen burn in the drywell, containment integrity is not likely to be challenged as a result.

During station blackout, none of the installed hydrogen control systems will be available because of the unavailability of Ac

)

power, and the possibility exists that hydrogen may accumulate in the wetwell in explosive concentrations before a randon trigger j

causes detonation.

However, the absence of an assured ignition source creates a very uncertain situation in these sequences.

Hydrogen burns have occurred in systems with no moving parts or electrical components.

However, there is no guarantee that spontaneous ignition will occur at hydrogen concentrations low enough for the resulting burn to be benign.

If either a deflagration or detonation occurs, it would likely occur in the wetwell-and bot'h the drywell and containment would be vulnerable to overpressure failure.

In long-term station blackout sequences, the SRV discharge will heat the suppression pool to its saturationstemperature prior to the onset of core degradation.

This makes steam-inerting of the wetwell likely.

Assuming late recovery of off-site power (after the onset of core damage), operation of containment sprays could potentially de-inert the containment atmosphere after large amounts of hydrogen have accumulated in the wetwell.

Should this happen,

,(

both the containment and drywell could be failed by a deflagration or detonation.

Note that if the operators at Grand Gulf cannot verify that power has not been lost to the ignitors, procedures instruct them to prevent power from being restored to the ignitors, as per Revision 4 of the EPGs.

Furthermore, during site visits as part of the NUREG-1150 effort and separately, as part of the CPI

program, nc trigger sources for hydrogen ignition could be identified.

Therefore, ignition under blackout conditions would have to be either spontaneous or the result of operator error.

When the accident progresses to the point of vessel failure, any hydrogen remaining within the reactor vessel will be released to the drywell.

The presence _of molten core material will likely guarantee an ignition source, but the hydrogen will be released along with any water or steam remaining in the vessel.

This will likely result in immediate inerting of the drywell atmosphere as air, steam, and hydrogen are pushed out of the drywell through the suppression pool vents.

Furthermore, the molten fuel will likely be released into a flooded reactor cavity.

Sufficient water is likely to be present to quench the fuel and slow any oxidation processes.

However, the presence of water in the in-pedestal area Draft Report 27

~.

at the time of vessel failure presents the possibility of a fuel-coolant interaction, steam spike, or steam explosion.

After vessel breach, hydrogen production may continue,.both in core debris remaining in the vessel, and in debris scattered about i

the drywell and in-pedestal cavity.

However, the main source of I

hydrogen production will be the thermal decomposition of concrete floors and walls in the drywell.

Core-concrete interactions generate large volumes of carbon dioxide and steam.

When these l

gases pass through partially molten core debris, they oxidize the 1

zirconium and other metals in the debris, producing hydrogen gas i

and elemental carbon.

Later, the elemental carbon will react with steam and carbon dioxide, evolving more hydrogen along with carbon monoxide.

This will continue until the inventory of elemental carbon is exhausted, at which point the production of combustible i

gases stops.

The above referenced MAAP calculations predict l

hydrogen production after vessel breach to be the dominant source of hydrogen during short-term station blackout sequences.

The above referenced STCP and ME140R calculations both indicate that l

hydrogen production after vessel breach is secondary in importance to in-vessel production.

i l

4.2.2 Potential Failure Modes The Containinent Performance Working Group (CPWG) analyzed local pressuye and temperature histories during diffusion type hydrogen l

burns.

Their analysis covered the case where hydrogen is released to the wetwell through the SRVs during core degradation.

Local i

l heat fluxes on the drywell and containment walls were calculated l

and the impact on elastomeric sealing materials was assessed.

The conclusion was that local heat fluxes caused by diffusion burns at i

the suppression pool surface do not degrade either the drywell or containment seals.

2L [

The containment response to the slow pressurization caused by j

a diffusion burn was also analyzed. The CPWG analysis assumed that 65% of the zirconium in the cladding was oxidized, and that the resulting hydrogen was burned continuously as it was released into I'

the wetwell.

The resulting pressure increase was calculated to be j

no more than 15 psi.

The CPWG assessed the probability of containment failure by this mechanism to be extremely low."

1 More recent MELCOR studies generally confirm the CPWG i

conclusions for diffusion burns and provide additional insight into the likelihood of containment failure from the more rapid burns that characterize deflagration or detonation."

MELCOR cannot predict hydrogen detonation or the pressure spike caused by a detonation.

Only rapid hydrogen burns at user-specified concentrations and flame speeds can be analyzed.

Again, it should be noted that the Mark III containment model used in MELCOR was coarsely nodalized, which means that more hydrogen would be required to be inside containment before the code would predict burning (or pseudo-detonation) than would actually be present, thus resulting in higher than anticipated pressure spikes. Some station blackout sensitivity runs indicated that wetwell hydrogen Draft Report 28

b d6flagrations are capable of simultaneously failing both the i

containment and the drywell by overpressure.

These high pressure 1

burns correspond to relatively high values for initial containment pressure, hydrogen concentration, flame speed, and percent burn j

completion, and are characteristic of deflagrations or detonations l

rather than diffusion burns.

I i

The results from the above MELCOR analyses, as well as HECTR, l

MARCH 2, MARCH 3, and MAAP analyses published in a number of separate reports, were evaluated by an expert panel.

The panelists were asked to estimate the likelihood that hydrogen combustion would of a prassure load to threaten containment integrity.gnoughThe issue was defined both in terms of the probability generate that hydrogen combustion will occur prior to vessel breach, and in terms of the probability that, given combustion occurs, either the containment or the drywell will fail from the resulting pressure i

load.

The panelists did not address the likelihood of ignition, or the probability of containment failure after vessel breach.

l They presented their results in terms of cumulative probability distributions for the expected containment load resulting for each of four distinct ranges of hydrogen concentration.

These curves, reflecting the experts' degree of belief that a particular combustion event would be capable of failing containment, were used in quantifying the NUREG-1150 Grand Gulf accident progression event trees.

The expert panel results indicate that the probability of ignition in the wetwell can be as high as 0.8 when core damage occurs with the reactor at high pressure.

For hydrogen concentrations between 4 and 8 v/o, the probability of the containment surviving the maximum deflagration is essentially 1.0.

At concentrations above 16 v/o, the probability that the containment will survive the maximum deflagration drops to nearly

,0, and the probability that the drywell will survive drops to less

.(.,

~, than 0. 2 0.

These numbers are for high initial steam concentrations

'in the containment.

At low initial steam concentrations, these numbers vary somewhat but are still indicative of a

high probability of containment and drywell failure for high hydrogen concentrations.

4.2.3 Potential for Mitiaation Mitigation of the consequences of hydrogen-related challenges presently depends on being able to burn the hydrogen as it is

formed, so that dangerous concentrations are avoided.

This approach has a high probability of success as long as power is maintained to the hydrogen ignition system.

It is during station blackout, when the normal ignitor power supply is lost, that this approach fails.

Possible solutions include providing uninterruptible backup power that will be available during station blackout, or relying on ignition systems that do not require electric power.

During long-term station blackout sequences, the potential for the accumulation of dangerous concentrations of hydrogen exists Draft Report 29

I even with the ignitors turned on.

In these sequences the containment is inert during hydrogen generation due to the presence of large amounts of steam.

De-inerting of the containment can result from containment spray actuation when power is restored.

A solution to the steam-inerting aspect of the hydrogen challenge i

might be to ensure that the containment can be inerted intentionally and kept inert for the duration of any postulated severe accident.

This could be accomplished by post-accident inerting with gas injection systems, Halon injection systems, or water fog systems, all of which have been considered in previous studies.

Post-accident inerting by gas injection was st in the February 1987 draft of NUREG/CR-4551 for Grand Gulf.'ydied The systen j

studied relied on the injection of carbon dioxide gas to dilute oxygen to below flammability limits.

The system would be supplied with DC power to ensure actuation would be possible during station

blackout, when normal hydrogen control systems would be i

unavailable.

Actuation would be required, by procedure, in place of the ignitors during these sequences.

The containment would require venting when the system was first actuated, and the vent path would be secured after the gas had been discharged.

The hardware required by this system would consist of carbon dioxide tanks stored outside of containment, the piping and spray headers required to distribute the gas to locations within containment below the level of the upper containment pool, isolation valves and controls, and safety interlocks to prevent inadvertent operation.

Problems with this system include the possibility of actuation during a design basis accident, when containment venting would be undesirable, and the possibility of inadvertent actuation when personnel are inside containment. Total cost for installation of this system was estimated to range from

$12,000,000 to

$34,000,000, and the MACCS-based benefit was s

s

-Q ^ calculated to range from -$160,000 to $139,000. The reason for the

' potential negative (i.e., increased risk) benefit in off-site risk reduction for this modification was not explained in the referenced study, but could be related to the possibility that the containment may be vented during core degradation in some sequences.

A paper published at the Second International Conference on the Impact of Hydrogen on Water Reactor Safety elaborated on the shortcon{ngsofasystemsimilartotheoneintheNUREG/CR-4551 study.*

Among the shortcomings identified were (a) the high likelihood of human error involved in initiating the system, (b) the long-term containment pressurization (as high as 37 pcia) above design pressure should actuation occur without simultaneous venting, (c) the higher off-site dose caused by the higher leak rates associated with the elevated pressures, (d) spray actuation l

1 should be inhibited when the CDIS is initiated to prevent even higher containment pressures, the reverse of present safety logic, I

(e) equipment damage is likely due to the resulting very cold temperatures (to -80

'F),

(f) the dif ficulty of ensuring high l

system reliability.

Draft Report 30 L

2-

.o Halon gas, which has also been proposed as a post-accident inerting agent, interferes with the combustion process itself.

While the exact mechanism is not completely understood, the result is that inerting can be achieved with significantly smaller' amounts of Halon than would be required for inerting by dilution (as with the CDIS).

The operational advantages of Halon are that a system can be installed that has few moving parts, minimal power requirements, high reliability, relative

economy, storage convenience, and ease of testing.

The design of a Halon injection system would be very similar to that of the CDIS discussed above.

One disadvantage of Halon injection is the decomposition of Halon to extremely toxic halogenic acids and carbonyl halides at temperatures over 900'F.

Halon and its decomposition products are also very corrosive and could cause potential degradation of safety systems.

Halon is also expensive, and operators may be hesitant to use it because of both the hazards and expense.

It will increase containment pressure at initiation, and must remain above the required inertion level at all times or it could become an aid to combustion.

Finally it could be impractical for Mark containments because of the large amount of equipment required.{II Reference 8 also describes a report issued by TVA rejecting the withanice'condensercontainment).gonschemeforSequoyah(aPWR use of Halon as a permanent mitigat TVA's objections were based on the uncertainty about the radiolytic decomposition of Halon and subsequent metal corrosion, uncertainty concerning suitable post-i accident water chemistry

control, Halon's toxicity at the l

concentrations required, and the difficulty ir) finding room for and l

installing the required tanks and components'.

l Laboratory tests of water fog inerting systems have demonstrated that water fogs applied to hydrogen-air mixtures cause

.;r g (LFL) at room temperature.g the hydrogen lower flammability limit only a marginal increase i Increases noted were 4.0 v/o to 4.4-5.3 v/o.

Fogs generated from an air-driven nozzle resulted in a slightly higher LFL of 7.2 v/o at 20'C.

Higher temperatures were found to increase the LFL, and the fog density required to achieve a given level of inerting was found to be strongly dependent upon droplet size.

In addition to increasing the LFL, fogs are thought to reduce the pressure rise associated with burning hydrogen at a given concentration.

While laboratory tests have shown that this concept is viable, the practical application is limited.

For fog systems to be used to best advantage, they should be used in conjunction with the hydrogen ignition system, since their function is more to reduce the pressure rise associated with combustion than to prevent ignition. Therefore, it is not likely that the dominant short-term station blackout sequences would benefit from the installation of a fog generating system unless it was designed with an independent power supply that was also capable of powering the hydrogen ignition system.

However, with the ignitors powered, the fog system would provide little additional benefit, since a controlled burn of hydrogen will not threaten containment even without the fog system.

In the long-term station blackout sequence, in which the containment is likely to be steam-inerted at the time of power recovery, actuation of a water fog syst;em Draft Report 31 1

c, #.

t 4

would have a similar effect to actuating the containment sprays, namely de-inerting of.the containment due to steam condensation.

As discussed earlier, this is an undesirable effect, since it could lead to a hydrogen burn when the ignitors are recovered.

Containment venting also has the potential to prevent hydrogen-related overpressurization by removing both oxygen and hydrogen from the containment.

If venting were accomplished during the long-term station blackout sequences, sufficient oxygen could be removed to maintain an inerted containment, even given the condensation of steam from the containment atmosphere caused by spray recovery.

Condensation of steam in a vented containment could lead to sufficient depressurization to pull oxygen back into the containment from the outside atmosphere. Condensation of steam in a vented, and then sealed, containment could lead to dangerous negative pressure differentials between the containment and outside atmosphere.

An alternative would be to have a nitrogen gas supply system to maintain containment pressure by injecting nitrogen into the containment as the steam is condensed.

This would prevent oxygen from being pulled back into containment and would prevent the containment from being de-inerted.

However, a system capable of this would have many of the disadvantages of the CDIS discussed above.

It would be contly, could create severe thermal transients, and could be a personnel hazard in the event of inadvertent actuation.

i Finally, minimizing the quantity of hydrogen generated in-vessel can reduce the amount of hydrogen entering the containment prior to vessel failure.

This latter mitigation approach, for station blackout

events, means that the reactor should be depressurized at an optimum water level, which current preliminary calculations for the Mark II CPI program indicate to be when the core is approximately two-thirds uncovered.

This approach would

,,e

, require additional analysis to justify revision of the EPGs, which w

. presently require depressurization when the core is only one-third uncovered.

4.3 Ranid Steam Pressure. Missiles, and Direct Containment Heatina The containment challenges described in this section all occur l

very near the time of vessel failure and belong to the broader I

classification of early containment failure challenges.

Included are in-vessel phenomena such as rapid steam pressurization and missiles generated at the time of core collapse and ex-vessel phenomena occurring at the time of vessel failure, such as direct containment heating (DCH) and ex-vessel steam explosions.

Since the creation of missiles with suf icient energy to fail the containment is not considered likely,[8 the predominant containment j

failure mechanism in this category is dynamic overpressurization.

4.3.1 Definition of Cha11ence Rapid steam pressurizations and steam explosions, both within and external to the reactor vessel, are characterized by rapid l

Draft Report 32

fragmentation of molten fuel as it is quenched in water, resulting in a large and rapid transfer of thermal energy to the coolant.

This in turn leads to steam generation, shock waves, and possible mechanical damage.

The Severe Accident Risk Reduction.. Program I

(SARRP) analysis of these phenomena relied on expert opinion to

)

quantify the vessel failure mode, the amount of core participating, and the reguiting pressure rise from both in-vessel and ex-vessel reactions.

The experts determined that the status of the in-pedestal cavity at the time of vessel breach has a major impact on the probability of a rapid steam pressurization event.

The experts agreed that it is essentially certain that the Mark III drywell will be flooded at the time of vessel failure during ATWS sequences with upper containment pool dump, and that the probability of flooding is greater than 80% during station blackout sequences that preclude upper pool dump.

The primary cause of drywell flooding i

is the manometer effect brought about by quasistatic pressurization of the wetwell.

This flooding occurs when the pressure in the wetwell becomes high enough to lift the suppression pool level in l

the drywell over the top of the weir wall.

The pressure required i

is at a minimum when both the suppression pool and the upper t

l' containment pool are both filled to the top of their respective operating ranges, and the upper containment pool is then dumped into the suppression pool.

The Grand Gulf FSAR states that, under these condition's, a wetwell pressure 0.16 psi higher than the drywell pressure will cause overflow of the weir wall.

The required pressure will be higher when the respective pool levels are at their lower limits, or when the upper containment pool has not been dumped, as may be the case in station blackout sequences.

The amount of water in the suppression pool prior to vessel breach, and hence the differential pressure required to cause flooding, is highly uncertain and sequence-specific.

During sequences in which core damage occurs in the long tera, a significant volume of water

. may have been injected into the reactor vessel from the condensate 2

' storage tank, or from other sources such as firewater.

Most of

's

~this water will be boiled off to the suppression pool before the onset of core damage.

In addition to the extra inventory from reactor vessel blowdown through the SRVs, the suppression pool i

l water will be undergoing volumetric expansion caused by energy l

addition from condensation of the SRV discharge.

l l

The extent to which the wetwell is pressurized with respect to the drywell is also uncertain.

During sequences caused by station

blackout, the drywell-to-containment vacuum breakers will not function, because a motor-operated damper in each of the four available vent paths is normally closed, and would require AC power to open.

Leakage from the wetwell back to the drywell can still occur, but only at Technical Specification allowed leakage rates, which will likely be too low to offset wetwell pressurization from evaporation of he suppression pool, and from the accumulation of hydrogen released through the SRVs during core degradation.

A number of calculations have been performed to determine the extent of drywell flooding.

Calculations performed with BWR-LTAS did not predict drywell flooding, perhaps because the drywell-to-Draft Report 33

4 wetwell leakage area used was four times the nominal value l

determined from leak rate tests at Grand Gulf.

A second calculation performed using the HECTR code with the same assumed 1eakage area and drywell heat load did predict drywell flooding (to l

a depth of 3 ft in the drywell and 9 to 10 ft in the in-pedestal l

cavity).

Draft NUREG-1150 MELCOR calculations have confirmed the i

HECTR results and have indicated that flooding during station blackout is very much dependent upon the rate of in-vessel hydrogen product {on, with higher generation rates making flooding more likely.

Besides confirming the MECTR results, the draft ME140R J

calculations have shown that hydrogen burns in the wetwell can also cause a sufficient pressure differential to flood the drywell.

In addition to the above mechanisms for drywell flooding, some experts thought the suppression pool level would oscillate as g result of the release of noncondensible gases through the SRVs.'

The level oscillations were thought to be sufficient to cause drywell flooding regardless of the amount of wetwell pressurization from the noncondensibles.

With flooding of the drywell virtually assured, a secondary issue is the path by which water can flow into the in-pedestal cavity.

Flow is expected through the in-pedestal access doorway or through the drain lines to the drywell floor drain sump.

Three feet of water' on the drywell floor (predicted by HECTR calculations) will not reach the access doorway.

This leaves sump overflow as the primary mechanism for filling the in-pedestal cavity.

current thinking is that drainage from the drywell floor into the cavity via sump overflow wi13 occur with sufficient speed to ensure cavity flooding prior to vessel breach.

Given that the cavity is flooded at vessel breach, the possibility of an ex-vessel steam explosion has to be considered.

_ If a steam explosion occurs, the potential exists to create' a un

" pressure impulse sufficient to collapse the reactor vessel

' pedestal.

Pedestal collapse can cause the reactor vessel to relocate, potentially damaging the drywell wall, or damaging seals at piping penetrations through the drywell or containment.

The result will be the creation of a suppression pool bypass path with the potential for a high consequence fission product rel m e.

The likelihood of an ex-vessel steam explosion sufficient to challenge containment was evaluated in terms of three parameters (a) the probability that the explosion will occur, conditional on a flooded in-pedestal cavity, (b) the probability that the pedestal will fail, conditional on the occurrence of an explosion, and (c) the prob of drywell failure due to collapse of the pedestal.gbilityThe probability of an explosion was evaluated as 0.86 based on intermediate-scale tests usang molten thermite and water.

The probability of pedestal failure, given an explosion, was assigned a uniform distribution over the interval 0.0 to 1.0 (i.e.

a point estimate of 0.50).

The conditional probability of drywell failure given failure of the pedestal was estimated as 0.17.

The probability of containment f ailure resulting from the explosion was not stated in the above reference.

As a final contradictory note, Draft Report 34

e recent work on Mark II containments, using state-of-the-art corium discharge computations to estimate the pressure response in Mark II containments, indicates that steam pressure spikes at vesse breach due to fuel-coolant interactions will not fail containment.'g While this work is not directly applicable to the Mark III containment, it does provide some reason to believe that the threat from steam explosions may be conservatively overstated in the NUREG-1150 analyses.

An older paper specific to Mark III containments, also conpluded direct failure by steam explosion to be extremely unlikely In-vessel steam explosions can result in two types of vessel

failures, both of which could lead to sudden containment pressurization.

In the alpha mode steam explosion, upper head failure occurs with sufficient energy to fail containment directly.

The second mode postulates catastrophic failure of both the upper and lower vessel heads.

Neither of these failure modes was i

considered likely by the experts.

In a BWR, the reactor vessel internals located above the core, namely the steam separators and dryers, would tend to absorb the impact of an upwardly directed in-vessel steam explosion.

The control rod drive and instrumentation supports in BWRs would likewise tend to minimize the potential for bottom head failure.

Direct containment heating refers to the high pressure ejection of molten core materials from a vessel breach.

Under certain conditions the material could be rapidly dispersed out of the pedestal into the drywell volume as fine particles.

The combination of direct heat transfer and". exothermic chemical reactions between the melt and the drywell atmosphere can lead to rapid containment pressurization and possible containment failure.

In addition, the chemical reactions can result in significant t

hydrogen production, increasing the probability of hydrogen burns.

The expert panel has indicated that direct containment heating bf '. would be unlikely to occur with a flooded in-pedestal cavity.

-Therefore, because of the high probability of a flooded cavity at Grand Gulf, direct containment heating is not considered a l

significant threat to Mark III containments.

4.3.2 E91tntial Failure Modes I

The potential containment failure modes associated with challenges from ex-vessel steam explosions include gross failure of either the concrete reactor vessel pedestal or the vessel supports, resulting in movement of the reactor vessel.

The vessel movement causes seal failure of attached piping at the drywell i

wall, resulting in suppression pool bypass.

Containment failure could occur either directly from the movement of attached piping failing containment penetrations or by gradual overpressurization as a result of suppression pool bypass.

Potential containment failure from static or dynamic overpressurization at vessel breach is possible, but is not adequately documented in existing NUREG-1150 supporting documents.

Draft Report 35

.L

i l

?

4.3.3 Potential for Mitiaation i

Some reduction in the probability of drywell failure.could be i

achieved by minimizing the hydrogen generated in-vessel prior to reactor vessel

failure, thus lessening the probability of a hydrogen burn inside containment.

This might be done by revising the EPGs.to call for depressurization only when two-thirds of the-i core has been uncovered.

Further reductions could be achieved by timing the upper containment pool dump so that it occurs only after vessel breach, thus lessening the probability of an ex-vessel steam explosion in the in-pedestal cavity at the time of vessel failure.

i However, this will not ensure that the drywell is not flooded prior to vessel breach.

Also, it is not clear that any mechanism currently exists to flood the drywell after vessel breach, if flooding is prevented before vessel breach.

The benefits of a flooded drywell appear to be significant, and the uncertainties in the likelihood of containment failure from steam explosion are t

large. Therefore, one can conclude that actions to prevent drywell flooding are probably not risk beneficial unless an independent drywell flooding system is provided to ensure that the in-pedestal cavity can be flooded after vessel breach, similar to the cavity flooding system proposed for the large dry PWR containments.

Even then, the possibility of reducing the threat from ex-vessel steam explosions ca.rries the price of increasing the threat from DCH, since DCH is thought to be more likely in a dry cavity.

Direct. containment heating can be prevented by ensuring a method of depressurizing the reactor priot to vessel failure.

Since failures to depressurize mostly result from operator errors, any actions taken to reduce the chance of operater error would be beneficial in reducing the likelihood of DCH, and would have the added benefit of reducing the amount of hydrogen generated in-However, the probability of an Q,.

- vessel during core degradation.5,'ex-vessel steam explosion is increased when the v at low pressure.

The balance between actions 'taken to mitigate DCH and actions taken to mitigate ex-vessel steam explosions cannot be resolved qualitatively.

However, it is anticipated that the advantages of flooding the drywell prior to vessel breach will be found to outweigh the risks from eny increased possibility of steam explosion when the quantitative analysis is performed.

4.4 Core-Concrete Interaction CCI is the cause of the only risk significant extremely late containment challenge.

This section provides a discussion of containment challenges resulting from CCI.

4.4.1 Definition of Cha11ence Following melt-through of the vessel bottom head, core debris would collect in the in-pedestal area, where it would interact with and ablate the underlying concrete. The consequences of CCI depend Draft Report 36 h'

~'

.- -. - _ ~ _ - -

i l

on the concrete composition and whether the cavity is flooded.

If sufficient water is present at the time of vessel failure, corium entering the cavity may be quenched and a coolable debris bed may be formed.

In this case, concrete attack may be prevented by maintaining an adequate coolant flow to the debris bed to makeup for boiloff.

In the case of a dry in-pedestal cavity, corium i

l-entering the pedestal would react with the concrete, liberating i

steam and non-condensible gases.

Steam generated in the process could potentially react with airconium in the melt to release heat

{

and combustible gases, such as hydrogen and carbon monoxide.

Non-condensible gas generation could lead to a gradual over-l pressurization and eventual failure of containment, while ignition of the combustible gases could result in a pressure spike that L

could contribute to drywell or containment failure.

The other major concern from CCI is the loss of structural integrity of the reactor vessel pedestal as a result of concrete ablation.

If CCI ablates a significant portion of the pedestal, l

a loss of structural integrity could potentially lead to relocation of the vessel.

As discussed in Section 4.3, relocation of the reactor vessel could result in suppression pool bypass and containment failure. The impact of CCI on the structural integrity of the pedestal has not been fully investigated and many of thg assumpt:.ons regarding its effects are based on expert opinion.'

For example, based solely upon expert opinion, the analysis of l

NtREG/CR-455*. for Grand Gulf assigned a probability of 0.40 to i

pedestal failure given that CCI occurs.

This analysis listed I

several important points brought cut by the reviewers.

Due to i

dehydration of the concrete, which is enhanood by heat conduction in the metal robar, the loss of structural integrity would be expected to be greater than might be predicted from the actual ablation depth.

The ablation would preferentially be directed downward rather than radially, lessening the impact on pedestal l

,. integrity, structural integrity might also be maintained by the l

.,6 3 rebar even if nearly all the concrete under the pedestal were l

removed.

l During CCI the drywell temperature is expected to approach 600-100 0'F.

Under these conditions the elastomeric seals separating the drywell from the wetwell are expected to degrade over about a 5-hour period, rosylting in a suppression pool bypass area of f t."

Give the relatively slow rate of gas approximately 1 production during CCI, a 1 ft*nopening is expected to be sufficient to prevent drywell pressure from being relieved through the suppression pool.

The result is that fission products released during CCI will not be scrubbed by the suppression pool.

This bypass is not expected to have significant impact on the time at which the ultimate containment pressure is reached since the dominant contributor to containment pressure during CCI is the buildup of non-condensible gases in the containment, which occurs l

regardless of whether the suppression pool is bypassed.

l 4.4.2 Potential Failure Modes l

Draft Report 37 L

N 4

Potential containment failure modes from CCI include gradual overpressurization from production of non-condensibles, rapid overpressurization from combustion of hydrogen and carbon monoxide, i

pedestal failure resulting in vessel relocation, and drywell seal failure resulting in suppression pool bypass.

l 4.4.3 Potential for Mitiaation i

Potential actions to mitigate the threat to containment from CCI include increasing the likelihood that the drywell pedestal is flooded and ensuring that adequate venting of non-condensible gases is provided. Flooding of the drywell and in-pedestal cavity during severe accident sequences is likely and this probability can be increased by ensuring operator control of the upper containment pool dump valves during 850 sequences.

However, any action to ensure flooding must be balanced against the increased likelihood of steam explosions.

If steam explosions could be determined to be more risk significant than DCH, then the optimum time to flood the cavity would be after vessel breach. When the cavity is filled with molten core debris, the availability of one of the two paths for flooding becomes questionable. It appears likely that the mass of corium covering the containment drain sump would prevent the drainage of water into the pedestal froa the drywell floor drains.

should this occur, the drywell water level will have to be higher than the pedestal access doorway before flooding can occur.

It is i

not clear that any mechanism exists, after vessel breach, to cause this much flooding even if the upper containment pool has dumped.

since the hazard associated with failing to quench the core debris or failing to provide filtration of the release through an overlying water layer is well known compared to the likelihood of a steam explosion capable of failing containment, enhancing the probability of flooding the cavity is considered to provide a not risk reduction.

.G The benefits associated with late venting are questionable

, because of the high likelihood that suppression pool bypass will produce an unscrubbed release.

4.5 containment Bvnans 4.5.1 Definition of challenae In this mode of containment failure, a release pathway is created that bypasses containment entirely.

Containment could be bypassed via the so-called interfacing systems IDCA, algo known as an Event V sequence in the tersinology of WASH-1400.

In this sequence, there is a failure of one or more valves that form a boundary between the high pressure reactor coolant system and a low pressure system outside containment.

Such sequences have been found in past probabilistic risk assessments (PRAs) to be insignificant contributors to the overall CDF and to risk.

However, because of the 1987 precursor event at the Biblis-A PWR in West Germany, the Office of Nuclear Reactor Regulation (NRR) has initiated an NRC review program to re-evaluate the contribution of the interfacing systems LOCA to risk at U.S. plants.

In addition, Draft Report 38

e a recent report by Brookhaven National Laborgtory (BNL) estimated the V sequence frequency for three U.S. BWRs.

The estimate ranged from 1.02E-6/yr for Peach Bottom to 8.81E-6/yr at Nine Mile Point i

2.

4.5.2 Potential Failure Modes The potential failure mode depends on the bypass pathway.

At present there is inadequate information to determine if any specific mode (ie., bypass pathway) is more likely than another.

i 4.5.3 Potential for Mitiaation Because these sequences have been generally found to be insignificant contributors to core damage frequency and risk, there i

is no feasible improvement to be investigated at this time.

Depending on the outcome of the NRC review program mentioned above, the improvements identified in the BNL report, and possibly others, may need to be implemented in order to lower the contribution to risk from containment bypass sequences.

.. C.

%. i Draft Report 39

• O l

5. POTENTIAL IMPROVEMENTS Risk-based improvements for the Mark III plants can be obtained by reducing the likelihood of core damage, by increasing the containment's capability for resisting failure challenges, or by reducing the off-site consequences of containment failure.

The basic event importance analysis performed as part of NUREG/CR-4550 eliminated.ghose events most capable of lowering CDF if reduced or identified The top CDF reduction events identified are:

o Failure to recover diesel generators, 3

o Failure to recover off-site power, and o

Failure of the RCIC turbine pump to run.

These events and a number of other diesel generator-related faults dominate the CDF reduction potential for Grand Gulf.

Note that these reduction events are specific to Grand Gulf; other Mark III plants would probably identify a different set of events.

Therefore, in the discussion that follows, some attention will be given to systems that, while not important at Grand Gulf, might nonetheless be of importance at other Mark III plants.

A comprehensive strategy to reduce off-site risk should address l

the timing and. reliability of reactor vessel depressurization.

First, the reactor should be depressurized at a level which minimizes the in-vessel production of hydrogen.

Revision 4 of the EPGs gives this level as equivalent to approximately one-third core uncovery.

However, there is some uncertainty as to exactly where the optimum level lies, since preliminary. BWRSAR calculations performed by ORNL for the Mark II CPI Program indicate that the L

reactor should be depressurized when the core is approximately two-thirds uncovered, a lower level than specified in the EPGs.

The chance of achieving depressurization when called for should also be improved as discussed in Section 5.1 below.

This would reduce v C,<[the overall core damage frequency by improving the chance that low

pressure, or alternate injection systems will be used to successfully avert core damage.

Next, one should ensure that the installed HIS functions throughout a station blackout in order to prevent the accumulation of a detonable quantity of hydrogen in the containment. This would provide a large reduction in the likelihood of the most risk significant containment challenge at Grand Gulf.

The in-pedestal floor should also be flooded prior to, and kept flooded after vessel breach (assuming a positive tradeoff between the benefits of flooding and the risk from ex-vessel steam explosions).

This will reduce the possibility of DCH, reduce the likelihood of CCI, and enhance fission product retention should CCI occur.

The above actions are those expected to provide the most economic reduction in off-site risk.

However, there is probably no cost-effective way to completely achieve all of the above given the low annual risk at Grand Gulf reported in NUREG-1150.8 The l

Draft Report 40 1

t following sections also include discussions of alternate injection

systems, improved vacuum breaker operation, and containment venting.

These improvements partially address issues already covered by previous recommendations, and provide small, or highly uncertain benefits at Grand Gulf.

They are included because the risk profile, and hence the value of the improvements, may be different at other Mark III facilities. The benefits and drawbacks of each of the proposed improvements are summarized in Table 5 and discussed in the following sections.

5.1 Enhanced Reactor Decreasurization Canability If no high pressure injection is available for coolant makeup, the vessel must be depressurized to allow injection from low pressure systems.

Doing this is the province of the ADS, with manual depressurization by the operator as a backup should ADS fail.

Since the issuance of the TMI Action Plan in NUREG-0737, the initiation logic for the ADS has been modified at some plants to increase the likelihood that the reactor will be depressurized when needed.

To increase the operability of the SRVs during severe accidents, a dedicated source of DC power to the SRV solenoids, assurance that the SRVs would be capable of being opened by the operator under environmental conditions associated with severe accidents, and improved operator training and Emergency Operating Procedures (EOPs) are proposed.

Because of the possibility of concurrent failure of both the AC and DC power systems, the addition of a dedicated DC power supply for the SRV solenoids could have some potential for reducing core damage frequency.

The containment vent pressure is set at the'. primary containment pressure limit (PCPL), as defined in the EPG.

This does not approach the containment pressure at which the SRVs might be prevented from opening by a low differential pressure between the t

l containment and the instrument air (N2) used to open the valves.

9. C.,

Revision 4 of the EPGs discusses various alternative means of i

'depressurizing the vessel.

For example, interlocks could be bypassed to allow the MSIVs to be opened.

This would allow use of the turbine bypass valver to reject steam to the main condenser, assuming that the main candenser were available.

The use of these alternative methods is indicated if less than the minimum number of SRVs required for emergency depressurization is open, and the differential pressure between the vessel and the suppression chamber is above the minimum pressure required to open an SRV (50 psig is a typical value).

Once the vessel has been depressurized, a number of systems can be used for low pressure makeup.

These are condensate pumps, RER pumps in the LPCI mode, LPCS, condensate transfer pumps, fire pumps, and service water pumps. Each of these sources is discussed below, along with possible difficulties that might have to be overcome before the source could be utilized.

1.

Condensate pumps:

Use of the condensate pumps may be limited by two basic interrelated considerations.

First, if the MSIVs were closed, condenser vacuum would be required if makeup to Draft Report 41 w,. -- -

L

>.s,

.s the condenser were via a " vacuum drag" line from the CST.

The available flow rate from the condensate pumps would then be limited to this makeup rate, since condenser hotwell inventory is only sufficient for a few minutes of operation at full flow.

Maintaining condenser vacuum could be difficult if auxiliary steam were not available as a motive force for the staan jet air ejectors.

Steam from the auxiliary boiler could be used, but this would of course be dependent upon the availability of the auxiliary boiler.

The mechanical air removal pumps could also be used, but these pumps discharge directly to the turbine building exhaust plenua, bypassing the offgas treatment system.

Plant-specific design differences in the balance-of-plant may also affect the condensate pump availability.

Of course, during SBO, the condensate pumps would be unavailable, since they require AC power.

2.

RHR pumps in LPCI mode:

The RHR pumps get a signal to start upon receipt of either a low vessel level signal (30 to 36 inches above TAF) or a

high drywell pressure signal (approximately 2 psig).

These signals also cause the RHR system to realign to the LPCI mode; the LPCI injection valves do not open, however, until vsssel pressure decreases below a set value.. Typical LPCI flow rates are on the order of 10,000 gpa per loop.

The operator cannot throttle the LPCI injection flow or realign the RHR system to any other operating mode during the first few minutes of LPCI operation.

However, LPCI flow can be terminated by stopping the RHR pumps.

This might be'an action taken during an ATWS to prevent injection of cold water into a critical reactor.

Again, during SBO, the RHR pumps would be unavailable due to the loss of AC power.

3.

Low pressure core spray pump: The LPCS pump generally receives a signal to start at the same time as the RHR pumps.

Eith'er l

'.C LPCS or LPCI is capable of mitigating a design basis IDCA.

The LPCS pump may also be capable of taking suction from the CST at some plants.

Again, like the RHR pumps, LPCS would be unavailable during 880.

l l

4.

Condensate transfer pumps:

The above systems constitute what might be called the " normal" means of low pressure injection.

Now we come to what are sometimes referred to as " alternate" means of injection.

The first of these is the condensate transfer pumps.

Interconnections between the condensate transfer system and the RHR and LPCS systems could allow the condensate transfer pumps to be used to inject water into the vessel via the R!IR or LPCS piping.

Two restrictions apply, however.

First, the connections are via manual valves in the auxiliary building; an operator would have to be dispatched to the auxiliary building to open these valves.

Under some circumstances, the environment in the auxiliary building could prohibit doing this.

Second, the lines are rather small (on the order of 4 in. in diameter), thus limiting the injection flow rate. However, this is a source that should be considered when evaluating the overall failure probability of low pressure Draft Report 42

I V

I injection.

As for the above systems, the condensate transfer j

pumps would be unavailable during 530.

5.

Fire pumps:

Plants typically have both motor-driven and diesel-driven fire pumps, which are used to supply water to the fire mains for fire protection.

However, via a hose or spoolpiece connection from the fire main to the service water system or to some other system, they could also be usEd to inject water into the reactor vessel or into the containment.

i The above restrictions on the use of the condensate transfer i

pumps also apply to the fire pumps.

An operator must manually l

connect the fire main to some other system like the service I

water system, and the flow rate is limited by the size of the hose or spoolpiece used to make the connection.

Note that AC power is required, even if the diesel fire pumps are used, unless the MOVs connecting the service water system to the RHR system can be opened manually.

Manual operation of these valves would require operator entry into the auxiliary building.

6.

Service' water:

As a last-ditch effort, plant EOPs direct the operator to line up service water to inject into the vessel from the ultimate heat sink connection to the RHR system.

These two systems are isolated from one another by two MOVs, which are operated from keylock switches in the main control room.

The valves could also be opened locally, using a manual handwheel attached to the valve operator.

This means of l

injection would also be unavailable during SBo, since AC power is needed to operate the service water pumps.

Typical PRAs only give credit to the first throe of these systems when evaluating the availability of low pressure injection.

The reason the other systems are not included is given as a lack i

of operator familiarity with using the systems for this purpose.

.,i.$ ^ This is not felt to be a valid reason for excluding them from consideration, since operators receive extensive training on potential sources of water to be used in an emergency.

This includes both classroom instruction and simulator training.

The use of these systems is spelled out in Revision 4 to the EPGs, l.

further reducing the likelihood that operators would overlook thea in an emergency.

Inclusion of these sources would result in a i

reduction in the contribution from TQUV sequences.

At Grand Gulf, this sequence was not a dominant contributor to core damage frequency or risk.

However, it might be found to be a more important contributor at some other Mark III plant; the discussion above has been provided with this in mind.

i 5.2 Backue Water sunoly system To arrest the station blackout events with the reactor depressurized, a low pr6ssure source of water that is independent of AC power is needed.

One such source of water is the diesel-driven fire pump.

The fire pumps could be manually connected to the_RHR system as outlined above.

Some plants may already have such a connection; others may have only a small diameter spoolpiece Draft Report 43

n

.c

.4 or a hose connection, which would severely limit the flow rate into containment.

Such an improvement could be of great benefit.

l Drawbacks to using the fire pumps include the manual connection that must be made to align the system, and the limited flow rates and lower discharge head that the fire pumps can produce in comparison with the RHR pumps.

Note also that AC power or local manual operation would be required to operate valves, unless the

~,

valve operators are DC-powered, which is typically not the case.

The other identified improvement would be to ensure that power is available to the valves that must be operated.

This could be done by utilizing an uninterruptible power source (a large one),

or by using DC-powered motor operator for these valves.

If the reactor vessel has been depressurized when the backup i

water supply becomes available, the backup water could be directed into the reactor vessel.

For accident sequences where the ramctor has been shut down, the backup water supply would only have to remove the decay heat and thus could prevent core degradation or terminate core failure.

For the ATWS sequence, the reactor is still producing between lo and 30% of rated steam flow and thus the backup water supply could only delay core failure.

5.3 Hyd)oaan Control by Incroved Ianition Systems This option involves either backfitting the current AC-powered hydrogen ngnition system with an independent power supply or installing advanced hydrogen ignition devices that will operate without power.

This potential improvement would ensure hydrogen control during the SBo sequences that currently dominate the Mark III plant core damage profile.

These improvements are primarily aimed at mitigating the consequences of short-tera station blackout

, sequences, since the likelihood of steam-inerting during long-tern Q

station blackout sequences would reduce the effectiveness of any

~

' enhanced ignition system.

There is some possibility that a continuously operating ignition system could aggravate the consequences of long-term station blackout sequences by triggering a detonation should recovery of off-site power lead to containment de-inerting through containment spray action.

The possibility of detonation under these circumstances is uncertain.

According to draft NUREG-1150, the short-term station blackout sequences clearly dominate the off-site risk so it is expected that the decrease in risk from short-tera station bleckouts will be significantly greater than any increase in risk for the long-tern station blackout. Again, note that these conclusions are specific to Grand Gulf and may not apply to other Mark III plants with a different core damage profile.

L A 10-15 KWe generator would be needed to power the existing l

hydrogen ignitors. A non-class IE generator of this size would have L

the advantage of being able to supply other energency loads if desired.

A DC system capable of supplying the required load could also be installed, and would have the advantage of increased Draft Report 44

._ ~

1, 1

4 reliability.

However, a

DC system would pose additional installation and maintenance problems.

The use of powerless catalytic ignitors is a very hronising means of mitigating the threat from short-term SBO.

Sandia National Laboratories at Livermore has developed a prototype i ~

catalytic ignitor that is capable of burning hgdrogen-air mixtures at hydrogen concentrations as low as 5.1 v/o.

The Sandia design is a watproof improvement to an earlier design that was impaired by steam condensing environments. Also reported is the development of a low-power design that uses a fraction of the power currently required by installed systems, and that would be well suited to battery-backed operation.

Siemens/Kraftwerk Union (KWU) in West Germany has also developed a powerless ignitor. The KWU design has been fully tested and malified for use in German reactors, and would presumably be avanlable in the United States.

Reference 32 provides a comparison of the KWU and Sandia designs.

Either would be suitable for use in the Mark III containment and the powerlass design is potentially less expensive to install than an additional power supply, especially for new plants.

5.4 Extended Vacuum Breaker Operation Drywell-to-wetwell vacuum breakers are installed at three out l

of four of the Mark III plants.

These vacuum breakers are not l

required to protect the drywell integrity during design basis accidents, operation of the vacuum breakers would allow hydrogen from the wetwell to flow into the drywell and would create the l

potential for_ suppression pool bypass.

However, operation of the vacuum breakers could reduce the pressure transient from hydrogen deflagrations (and some detonations, depending on the length of the pressure pulsa as compared to the operating time of the vacuum breaker).

This could prevent the hydrogen deflagrations from C ', pushing the suppression pool water over the dryvell weir wall and N-

-thus flooding the drywell in-pedestal cavity.

As discussed previously, this would reduce the potential for steam spikes or explosions when the reactor vessel fails.

The resulting potential risk benefit from extending vacuum breaker operation to station blackout is uncertain, but is thought to be minimal, since ex-vessel steam explosions are not expected to present a significant challenge to containment integrity and since the open vacuum breakers present a possible path for suppression pool bypass, as outlined below.

During sequences with the vacuum breakers operable and open, the check valves in series with the large motor-operated vacuum breakers may cycle open and shut repeatedly.

Should this occur there is a chance that one or more of these check valves could stick open, creating a suppression pool bypass path.

The draft NUREG-1150 MELCOR calculations do not model vacuum breaker behavior, sg the number of cycles expected during these sequences is unknown.

However, the Mark II CPI program MELCOR calculations do model the vacuum breaker operations.

For the Mark II containments (the Mark III information is not available at this time), with the reactor depressurized, the vacuum breakers cycle Draft Report 45

___._..~__;_.l.___.-.__.______._____._..._

n.

t approximately 65 times.

@ cycle is defined as a vacuum breaker L

going from the fully closed position, to the fully open position, and returning to the fully closed position.)

While the calcula-tions have not been completed at this time, it is believed that, for the case where the reactor is pressurized, the number of vacuum breaker cycles may increase by a factor of two or more, since a significantly larger amount of hydrogen is expected to be generated in-vessel.

The aa-)or uncertainty associated with extending vacuum breaker i

operation to station blackout is whether the available vacuum breaker flow area is sufficient to prevent drywell flooding.

Current draft P.'G-1150 MELCOR predictions suggest that the area is inadequate The CPI program calculations will provide additional insight.

If the vacuum breakers can prevent drywell flooding, enhanced vacuum breaker operability in conjunction with an alternate method of drywell flooding could provide a significant risk benefit.

5.5 Extended Suneression Pool Makeuo canability This option would extend the operation of the upper containment pool dump valves to station blackout sequences by providing backup power for valve.. control.

By ensuring operator control of the upper pool dump valves during station blackout, it should be possible to reduce the probability of CCI.

Dumping the upper containment pool water volume to the suppression pool does not, of itself, ensure flow.over the weir wall and flooding of the drywell.

The weir wall is designed to hold the normal maximum suppression pool water plus the water in the upper containment pool.

However, upper pool dump will increase the likelihood that other mechanisms will cause flooding, as discussed in Section 4.3.1.

The draf t NUREG-1150 analysis has estimated the amourt of water that would be expected c-to overflow the weir wall, and CPI MELCOR analysis will provide C ',,. additional information on the level of the water in the drywell in-pedestal area, and the timing of the water overflowing the weir wall.

Given that sufficient water enters the drywell in-pedestal l

area, any CCI that occurs will occur under water.

However, the chance of steam explosion will be increased.

There is a potential drawback to providing a backup source of power to the upper containment pool dump valves and that is the threat that operation of the valves late in the sequence could result in an uncontrolled hydrogen burn inside the containment.

This could be a particular problem if the valves were backfitted with DC-powered motor operators, since the brushes and commutators in the DC motor would provide a very good ignition source.

It is therefore imperative that procedural guidance be provided to ensure that the valves are operated very early during SBO, before core damage occurs, so that there is no threat to the containment from j

uncontrolled hydrogen burns.

l l

Draft Report 46

e g j,7 y

)

L i

1 s.

J 5.6' Cap,j;3 nnent ventina i

. Containment _ venting to prevent overpressurizatkis is currently only considered as~a last resort, when other means of preventing containment failure from overpressure are unavailable or.

L ineffective.

By deliberately venting the containment, instead of l~

allowu,g it to fail at its ultimate pressure capacity, it may be possibit to. reseal the ' containment at some later point in the accidant and thereby reduce releases. Venting, when performed from the containment wetwell airspace, also helps reduce releases by scrubbing the effluent through-the suppression pool.

Releases 4

scr.@ bed this way will contain fewer particulate fission products, aat.wugh. fission product noble gases will be unaffacted.

Venting my also be useful in controlling the buildup of hydrogen.. Current

-CPI MELCOR calculations are being performed to determine whether

venting, if _ performed prior to core degradation, would allow sufficient hydrogen or oxygen to escape to prevent hydrogen

[-

detonations, or to mitigate hydrogen detonations sufficiently as to prevent the detonations from structurally damaging containment.

Venting the containment is not without potential negative consequences, however.

For example, the Mark III containment is expected to experience drywell seal failures during CCI.

Given an assumed leakage' area, the draft NUREG-1150 MELCOR calculations show the genteration of gases will not occur at a high enough rate to clear the watwell vents.

The result will be releases that are unfiltered by suppression pool scrubbing if the containment is vented-late.

There is concern in BWRs with Mark I and Mark II containments that saturated suppression pool water conditions could lead to injection failure. At Grand Gulf, the RHR pumps can pump saturated

_. water, thus injection will continue even with a saturated pool.

u-l

Therefore, sequences that are vented will not lead automatically "to core damage.

The vent path at Grand Gulf is a 20-inch diameter containment purge - exhaust line that discharges to the roof _ of the auxiliary building.

The exhaust line passes through approximately twenty feet of the auxiliary building.

Most of this pat.h consists of 20-inch diameter hard pipe, with about ten feet of HVAC ducting midway along the path.

Should the HVAC ducting segment fail, the ccapartment at the failure location would be filled with steam.

a This compartment is connected to the blowout tunnels via a 1 ft vent that would probably be capable of relieving enough pressure to avoid failure of the compartment door.

This compartment pressure relief capability and the location of injection system e

pumps in separate watertight compartments provides a measure of assurance that failure of the auctwork will not result in environmental conditions which would fail the injection systems.

Hardened vent modifications have been considered at other BWR facilities.

However, it is doubtful that the risk reduction provided by the improved systems would be sufficient to justify the cost.

A minimal upgrade could consist of replacing the short Draft Report 47

P

['

.g v:

..w segment of HVAC pipe with piping capable of handling containment pressures of 17.24 psi (the current venting limit).

The addition' of AC-independent valves that can be remotely operated would increase the usefulness of the system. during station. blackout sequences.

The existing valves would have to be opened manually during station blackout and would require entry into-containment to complete the valve. lineup.

This would have to be done in anticipation of a severe containment challenge, since the only guidance provided in Rev. 4 of the EPGs is to vent before reaching the primary containment pressure limitation (PCPL) and environmental conditions in the containment would likely preclude entry into containment after the onset of severe core damage.

1.t-the high-cost extreme are the external filtered vent systems, such as the Supplemental containment System proposed by the Long Island Lighting Company (Lilco) for Shoreham.

Briefly, the SCS would be a gravel-filled concrete structure separate from

- the secondary containment, but connected to the primary containment by a high capacity hardened vent line.

The system would be actuated by operator action or by rupture discs set at the desired venting. pressure.

The gravel bed would scrub particulates and the height of the structure would provide for an elevated. release.

Reference 25 analyzed the proposed Shoreham installation and found that reductions in both core melt frequency and risk could be achieved.

The DF for the SCS design could be on the order of 1000.

for fission. product particulates, as compared to a DF of 10 to 100 for the - suppression pool.

However, because of the - high cost associated with the SCS, its -installation at U.S BWRs is not expected to be cost-beneficial.

Such a systda is currently in use at the 'Barseback Nuclear Power Station in southern Sweden.

A i

Multi-Venturi Scrubber System (MVSS) (Asea-Aton design) is being incorporated at the Oskarshama, Forsmark,. and Ringhals reactor

, facilities. This design uses approximately 80,000 gallons of water and does not rely on AC or DC power.

This design is expected t.o

> ht less expensive than the gravel bed Filtra design (approximately

,y w

05M as compared to $10-$50M for Filtra).

Given the already low risk.. associated with Grand Gulf, it is doubtful. that the risk reduction provided by these systems could be shown to be. cost effective.

l Draft Report 48

4,

<e-U 4

9;;

.s TABLE 5.

a nLITAflWE AttE88 PENT OF BENEFITS AIS DRAW ACK8 0F PROPOSED l

IIAtt til CONTAIISENT IsrRORIENTS Potentlet Potentist Potentist

-leprovement tonefIte Dreencks w

1. Ersenced reactor o te 6ees core danese o Increases ehence of depressurlastion fre gency of some en wesset steen system (to.5 14N) eewonces emptoelen o lley re&ce amowit of e-Optlas RPV Love 1 hydresen ponere?od for depressurftetten o te &ces the has not been likeltheed of DCN deterwined

2. Back@ water ogply a te &ces frequency o New herchere will system (80.81 2.408) of same core deaepe be empersive sagences o alsk reshactlen witt o increases passibtIity probably not be of cavity fleedire large (see 5. below) e teletively low cost if fire system is used 3.

tydrogen centrol by o teshaced contelrusent o incrosses chance leproved lysitten failures (STSO seq.)

of containment t

systems (8300K) akar to hyseresen felture for deflagrations /

Lisa se mences detenstlens 4.

Estended vacuus o lley reduce the chance o increases chance breaker operation of ea vesset steam of ag pression pool emplesien bypass o - fley reduce the pressure o stay increase chance transient caused by of airy CCI hydrogen burns in the o Itoy increase chance ustwell of DCH 5.

Estended suppression e Reduces likelthead of o increases chance j

pool aske@

dry CCI of steen empleslen capability e Provides screbirg of o Increases chance of

~

../ *c.

fission prockacts N2 burn if UCP is eheutd og pression shaped af ter core

' 9.

~

spot bypeas occur elemage o toduces chance of DCN 1

l 6.

Contalrunent venting e.

Nord pipe vent o Prevents tote over-o Nigh tlkollheed of system with pressure feltures for o g pressias pool dedicated power transients with scram bypass may Lead to source (80.69 6.141) en increase in risk o Icederately high cost l

1 1..

l-l I

Draft Report 49

??

i, ~

'44.

3; i

i

' TAst.E 5. (couTInutD)

Potont{el Potentiet Potontiet-leprovement genefits Dreuhocas 6.

leproved contotrument vent system (contirmand) -

o Preisptive venting o Does not prevent redaces the containment thernet felture, base pressure prior to steen empleelens,

- oore domspe er steen epikes o Reduces hydragon e can teed to eveltable for inadvertent releases escendary contairement burnin0 o he&ses the drivire pressure (reteese rete) for other felture modes tese pressure prior to care doomse b.

Filter contalrusent o See 4.e o toe 4.s vont system with o - leay retteve pressure o Filtre - very high dedicated power from hydrogen burns east (830 HIM) o Assures etI re!aeses INS $ - high cast vitt be scrubbed (ssa) o can prevent thernet failure

,-,.3

'n.

n

,5 Draft Report 50

k.

6. REFERENCES 1.

.SECY-88-147, U.S. NRC, Intesration Plan for closure of Severe Accident Issues, V. Stallo to NRC Commissioners, May 25, 1988.

2.

NASH-1400, U.S. NRC, Reactor Safety Studv--An Assessment of Mcident Risks in - U. S.

Commercial Nuclear Power Plants, (NJREG-75/014), October 1975.

'3.

NUREG-0737, U.S.

NRC, Clarification of TMI Action Plan Reauirements, November 1980.

1 4.

NUREG-1037, U.S. NRC, Containment Performance Workina GIQ2E 7

Report, (Draft), May 1985.

l:

5.

NUREG-1079, U.S.

NRC, Estimates of Early Containment Imads p

from Core Malt Accidents, (Draft), December 1985.

i 6.

Draft NUREG-1150, U.S.

NRC, Severe Accident Risks:

An Assessment of Five U.S. Nuclear Power Plants, Revision 1, June 1989.

7.

NUREG-1350, Volume 1, U.S. NRC, Nuclear Reaulatory Commission 1989 Information Dicest, March 1989.

8.

NUREG/CR-2726, Camp, A.

L.,

et al.,

Liaht Water Reactor flydroaen Manual, August 1983, i.

9.

NUREG/CR-3306, Theofanous, T. G., et al., LWR and HTGR Coolant Dynamics:

The Containment of Severe Accidents, July 1983.

1 10.

NUREG/CR-3653, Greinann, L., et al., Final Report Containment ADAlysis Techniaues A State-of-the-Art Su==arv, Narch 1984.

..s

~ 11.

NUREG/CR-4550, Drouin, N. T., et al., Analysis of Core Damaae Frecuency Grand Gulf. Unit l' Internal Events, Revision 1,

Volume 6, February 1989.

12.

NUREG/CR-4551, Amos, C.

N.,

et al.,

Evaluation of Severe Accident Risks and the Potential for Risk Reduction:

Grand Gulf. Unit 1, (Draft), April 1987.

13.

NUREG/CR-4624-V4, Denning, R. S., et al., Radionuclide Release Calculations for Selected Severe Accident Scenarios, July 1986.

14.

NUREG/CR-4696, Blackman, H.

S.,

et al., containment Ventina Analysis for the Peach Bottom Nuclear Power Plant, EGG-2464, December 1986.

15.

NUREG/CR-5030, Theofanous, T.

G.,

et al.,

An Assessment of Steam-exolosion-induced, Containment Failure, February 1989.

. Draft Report 51

. ~. - -.. -. -... -. -.

(

l

..* s

.41 4

s 16.

NUREG/CR-5124, Chu,- T. L., et al., Interfacina Systems IncAt Boilina Water Reactors, February 1989.

j at 17.

NUREG/CR-5331, Dingman, S.

E.,

et al., MELCOR Analyses for

-Accident Proaression Issues, (Predraft).

18.

NUREG/CP-0038, U.S.

NRC, Proceedinas of the Second International conference on the Innact of Hydrocen on Water Reactor Safety, October 3-7, 1982, p. 272.

19.

NUREG/CP-0104, U.S. NRC, Transactions of the Seventeenth Water Reactor safety Information Meetina, October 23-25, 1989, p.

15-11.

20.

Clinton Final Safety Analysis Report.

21.

Grand Gulf Final Safety Analysis Report.

I 22.

Perry Final Safety Analysis Report.

23.

River Dend Final Safety Analysis Report.

24.

IDCOR-TR23.1GG, Mississippi Power and Light Co., Grand Gulf Nuclear Station - Intecrated Containment Analysis, March 1985.

25.

NEDO-31331, General Electric Company, BWR Owner's Group Emeraency Procedure Guidelines, Revision 4, March 1987.

[-

26.

BWR Mark I Containment Challenges,-Presented at BWR Mark I Workshop, Baltimore, Maryland, February, 1988.

f 27.

Burns, E.

R.,

et al., Shoreham Nuclear Power Station Full l

Power PRA. 'PRA Update:

Sueolemental Containment System Imolementation, IT/Delian Corporation, Prepared for Long c;-

Island Lighting Company, February 1987.

t'

[

28.

Galyean, W. J., and D. L. Kelly, containment ventina Analysis l

for the Shoreham Nuclear Power Station, EG&G Idaho, Inc.

Informal Report, January 1989.

l 29.

Kelly, D.

L.,

Wagner, K.

C.,

An Assessment of BWR Mark II containment Challances, Failure

Modes, and Potential Imorovements in Performance. (Draft Report), May 1989.

l' l

30.

Silver, E.

G.,

" Operating U.S.

Power Reactors,", Nuclear Safety. 24, September-October 1983.

L 31.

Soderman, E., Mitlaation of Severe Accidents, Nuclear Europe, l

p.18-19, dated 11-12/1987.

l 32.

Thorne, J. V., et al., Develooment of a Wet-Proofed Catalvtic Ioniter for Lean Hydrocen-Air Mixtures, May 4, 1989.

33.

Draft Grand Gulf Accident Progression Event Tree.

Draft Report 52

-.. -. -.: - ~:::::::

Q, ;.

.. V.

.4

. AM,

. f. ; L,,

+.

e

34.. Informal meeting between Sandia NUREG/CR-4551 analysts and CPI contractors,; June,.1989.

i

?

b 1

e i

i'.

~

.s g

1 l-L i

l-I-

l l

l l

i,.

l Draft Report 53 l

l e=

T F#

F y-T

-(~T-

--ywv

1. -w-m y-t4-+-

3-n m

w rwe e

m.

m

_ _ _ _ _,______.,___-