ML20117D080

TER on IPE - Back-End Analysis

ML20117D080
Person / Time
Site:	Millstone
Issue date:	11/30/1995
From:	Moieni P SCIENTECH, INC.
To:	NRC
Shared Package
ML20117D072	List: ML20117D068 ML20117D074 ML20117D080
References
CON-NRC-04-91-068-36, CON-NRC-4-91-68-36 SCIE-NRC-232-94, NUDOCS 9604050396
Download: ML20117D080 (41)

Text

_, _ ~ ~'

l I

4

, SCIE-NRC-232-94 l

l l

l Millstone Unit 2 l Technical Evaluation Report on the Individual Plant Examination Back-End Analysis P. Moieni H. A. Wagage J. F. Meyer l

Pmpared for the U.S. Nuclear Regulatory Commission Under Contract NRC-05-91-068-36  !

November 1995 SCIENTECH, Inc.

11140 Rockville Pike, Suite 500 Rockville, Maryland 20852 4

4604o50 s% d W'

1 e

• TARr R OF CONTENTS ERES E Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E-1 1

l 1

E.1 Plant Characterization ............................... E-1 l l

! E.2 Licensee IPE Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E-1 )

E.3 Back-End Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E-2 E.4 Containment Performance Improvements (CPI) . . . . . . . . . . . . . . . . E-3 E.5 Vulnerabilities and Plant Improvements . . . . . . . . . . . . . . . . . . . . . E-4 l

E. 6 Observations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E-4 l i

I l 1. INTRODUCTION .....................................1 '

l 1.1 Review Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 i 1.2 Plant Characterization ................................1

2. TECHNICAL REVIEW ..................................4 2.1 Licensee IPE Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 l

l 2.1.1 Completeness and Methodology ......................4 ,

1 1

2.1.2 Multi-Unit Effects and As-Built, As-Operated Status . . . . . . . . . . 5 l 2.1.3 Licensee Participation and Peer Review . . . . . . . . . . . . . . . . . . 5 2.2 Containment Analysis / Characterization . . . . . . . . . . . . . . . . . . . . . . 5 1 2.2.1 Front-end Back-end Dehies . . . . . . . . . . . . . . . . . . . . . 5 l 2.2.2 Containment Event Tree Development . . . . . . . . . . . . . . . . . . . 7 2.2.3 Failure Modes and Timing . . . . . . . . . . . . . . . . . . . . . . . . . . 10 l

l 2.2.4 Containment Isolation Failure . . . . . . . . . . . . . . . . . . . . . . . . 12 2.2.5 System / Human Responses . . . . . . . . . . . . . . . . . . . . . . . . . . 13 1-l l

l Milissone Unit 2 bok ' nd ii November 1995 t

l 1

a i!

l l

TABLE OF CONTENTS (cont.)

Easc i 1

. I 2.2.6 Radionuclide Release Characterization . . . . . . . . . . . . . . . . . . . 14 l 1

2.3 Accident Progression and Containment Perfonnance Analysis . . . . . . . . 15 1 4

I 2.3.1 Severe Accident Progression ........................ 15 2.3.2 Dominant Contributors: Consistency with IPE Insights . . . . . . . 20 -

2.3.3 Characterization of Containment Performance . . . . . . . . . . . . . 22 2.3.4 Impact on Equipment Behavior . . . . . . . . . . . . . . . . . . . . . . 23 2.3.5 Uncertainty and Sensitivity Analyses . . . . . . . . . . . . . . . . . . . 24 2.4 Reducing Pmbability of Core Damage or Fission Product Release . . . . 25 2.4.1 Definition of Vulnerability . . . . . . . . . . . . . . . . . . . . . . . . . 25 i 2.4.2 Plant Improvements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 i

l 2.5_ Responses to CPI Program Recommendations . . . . . . . . . . . . . . . . . 25 2.6 IPE Insights, Improvements and Commitments . . . . . . . . . . . . . . . . 26

3. CONTRACTOR OBSERVATIONS AND CONCLUSIONS . . . . . . . . . . . . 28 l

4. REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Appendix 1

l' i

i i

Millstone Una 2 Back-End iii November 1995

7

%$ y I

E EXECUTIVE

SUMMARY

His report presents the results of SCIENTECH's review of the back-end part of the .

1 Nonheast Nuclear Energy Company (NNECO) Individual Plant Examination (IPE) submittal of the Mdistone Nuclear Power Station, Unit 2 (MP2).

i j E.1 Plant Characterization 4

i De MP2 plant is operated by NNECO and is located in the town of Waterford, j Connecticut, on the shore of Iong Island Sound and the east side of Niantic Bay. The site is about 3.2 miles WSW of the town limits of New Iondon and 40 miles SE of Waterford, Connecticut. Unit 1 (a General Electric (GE) designed boiling water reactor l (BWR)) and Unit 3 (a Westinghouse-designed pressurized water reactor (PWR)) share the l site with MP2. The MP2 is a combustion engineering (CE) designed nuclear steam , supply i system (NSSS) whose rated thermal power is 2,700 MWt with a net electric output of j 863 MWe. The containment is a Bechtel-designed, atmospheric, large, dry type. A j double containment system, consisting of a pre-stressed, post-tensioned, concrete, i cylindrical structure and a surrounding enclosure building, houses the NSSS. De i

4 auxiliary building contains the fuel handling facility, radioactive waste processing system, nuclear steam supply system (NSSS) auxiliary equipment, heating and ventilation system equipment, laboratories, and the control room. The containment completely encloses the reactor, the reactor coolant system (RCS), and ponions of the auxiliary and engineered i safety feature systems. De containment design pressure is 54 psig. De median failure '

l pressure is 150 psig.

4 E.2 IJeensee IPE Process The Nonheast Utilhies Service Company (NUSCO) and NNECO staff performed the individual plant examiration, receiving suppon from consultants in performing the bwk-

! end analysis. The utili.y staff perfonned the front-end analysis in its entirety without ,

3 outside supoort. Smc 15 to 20 NUSCO/NNECO staff members panicipated in the IPE '

effon. EQE Imemational performed the containment structural analysis, which the NUSCO Civil Engineering Depanment reviewed. Gabor, Kenton and Associates (GKA) offered limited technical support on the back-end analysis, which GKA also reviewed )

i independently.

Members of the IPE team performed " routine" walkdowns and interviewed personnel as part of their effon to familiarize themselves with the plant, collect data, and to verify the j as-built plant configuration. ,

[ De approach taken in conducting the NUSCO IPE was to perform a Izvel 2 probabilistic risk assessment (PRA) by estimating the frequency of radionuclide releases l for a spectrum of postulated severe accidents. The MP2 IPE was performed using the

. standard large fault tree and small event tree approach, which reflects fault tree linkage 4

and nodalintion of each event tree using the accident mitigation function. The front-end a

results, i.e., the dominant core damage accident sequences, were binned into a number of 1 1

Millstone Unit 2 Back-End E.1 November 1995 l

-._e_. - , - .

F plant damage states (PDSs), which in turn, were used as entry states to the containment event trees (CETs) for the back-end analysis. The CET headings in the MP2 IPE were containment failure phenomena-related while the supporting logic (or fault) trees combined both phenomena-related and safety system-related events, as well as potential l post-core damage opemtor recovery actions, ne fault trees were used to evaluate the  !

split fractions for each CET node. This approach is consistent with the guidelines given in NUREG-1335. De PC-based computer code CAFTA was used for accident sequence quantification in the MP2 IPE. The MAAP code was used for the determiaid- i containment loading calculations in the back-end analysis. Also, a number of scoping thermal-hydraulic calculations were performed to complement the MAAP analyses in the back-end part of the MP2 IPE. MAAP also was used to develop some of the success ,

criteria in the front-end analysis (e.g., the number of safety injection tanks required to i respond to a large loss of coolant accident (LOCA).  !

E.3 Back-End Analysis Based on the front-end analysis, the total mean core damage frequency (CDF) was estimated to be 3.4E-5 per year, which is comparable to the total mean CDFs of similar PWR plants. It was assumed that core damage would occur when clad temperature ,

l reached 2,200 'F. De dominant initiating event contributors were loss of normal power l events (25%), loss of DC bus 201A or 201B (23%), and LOCAs (19%, of which 1.5%

involved steam generator tube rupture (SGTR) events). Interfacing system LOCA

, sequences that bypass containment contributed less than 0.2% to the total CDF.

l According to the submittal, because of the diversity of emergency electric power supplies at MP2, which includes a Unit 1-to-Unit 2 electrical cross-tie, station blackout (SBO) ,

would be a relatively low contributor to the CDF (1.2% of the total CDF). However,  !

the SBO contribution to the CDF of other nuclear power plants (NPPs) usually is not negligible.

Based on the back-end analysis, 9.5% of CDF sequences would lead to early containment l failure with a total radionuclide release frequency of 3.2E-6 per year. He percentage of l CDF sequences that would result in late containment failure was 32.4, with a l radionuclide release frequency of 1.1E-5 per year. The frequency of "no release with i

containment remaining intact" was reported to be 1.9E-5 per year (55.9% of the CDF).

De dominant early containment failure appeared to be due to direct containment beating (DCH) and the late containment failure due mainly to basemat melt-through (BMT).

(The MAAP computer code predicted failure times of more than 55 hours6.365741e-4 days <br />0.0153 hours <br />9.093915e-5 weeks <br />2.09275e-5 months <br /> after accident initiation for BMT sequences.) The total release frequencies for SGTR and interfacing system LOCA events were shown to be 6.7E-7 per year (approximately 2% of the CDF) and 6.6E-8 per year (approximately 0.2% of the CDF), respectively. Containment isolation failure probability was shown to be negligible due to a highly reliable containment isolation system (approximately 0.02% of the contribution to total conditional j containment failure probability, given core damage).

! Similar to the front-end CDF as an indicator of plant response to accident initiators, the frequency of "Early-High" radionuclide release,s was used as an indicator of containment performance and risk to the public in the back-end analysis. The "Early-High" release Minstone Unit 2 Back-End E-2 November 1995

]

category was defined based on the magnitude and timing of the radionuclide releases.

This category includes those accident sequences that would result in "high" (higher than 10% Cs! and Tellurium fission products) and "early" releases (within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> of vessel breach. This High-Early release category is similar to the "large" release category used in some other IPE studies.) The reported mean frequency of high-carly radionuclide t releases at MP2 was 0.26E-6 per year, which is below the NRC's safety goal of 1.0E-6  ;

per year. [1] In comparing the MP2 releases with the NRC safety goals, the IPE team ignored the "high" releases of tellurium when they were accompanied by " medium" releases of CsI, which had a total frequency of 1.08E-6 per reactor year. We believe, t however, that the "high" releases of tellurium need to be considered in the context of "large" releases. It is noted that this category represented only 1.7% of the total release frequency of 1.5E-5 per year. The IPE submittal reports a total mean frequency of 3.4E-6 per year for the early release category (i.e., 3.2E-6 for non-bypass sequences, >

5.1E-8 for SGTR, and 6.6E-8 for Interfacing System loss of Coolant Accident (ISLOCA) sequences). The source terms were calculated using MAAP code, and evaluated for 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after accident initiation.

The IPE results show that the mean frequency of the plant damage state "TEH" (i.e., a transient that would lead to early core melt with high RCS pressure at the time of core melt, and with containment spray available) was 2.255E-5 per year, which contributed ap;. cximately to two-thirds of the total MP2 mean CDF. Main arammline and main feedline breaks accounted for 3.5E-7, or 1.56%, of the TEH frequency. De remaining 2.22E-5 represented transients dominated by a total loss of feedwater (main feedwater (MFW) and auxiliary feedwater (AFW)) and failure of feed and bleed operations, but with the availability of one train of containment spray.

E.4 Containment Performance Improvements (CPI)

The IPE team performed phenomenological evaluations of hydrogen combustion and detonation for the MP2. Based on MAAP simulations and bounding analyses with conservative assumptions, the IPE team concluded that, only by assuming 100-percent cladding oxidation could an early hydrogen burn challenge the containment integrity.

The highest containment pressure rise from a hydrogen burn was predicted to be 84 psia for a break occurring in the main feedline (PDS TEFHl). This is well below the calculated 5th percentile containment failure pressure of 102 psig. Based on the Sherman/Berman methodology [2] the MP2 IPE team concluded that, for all accident sequences, the likelihood of deflagration to detonation transition (DDT) was highly unlikely to impossible. De MP2 IPE team used a probability range of 0.001 to 0.01 that the containment would fail as a result of hydrogen detonation.

The submittal states that the open design of the MP2 containment prevents the formation of high hydrogen concentration pockets. A scoping analysis indicated that natural circulation mixes the containment atmosphere every 5 to 15 minutes. Herefore, it was concluded that global hydrogen bums would be more prevaient than locali=i burns in the MP2 containment.

Millstone Unit 2 Back-End E-3 November 1995

E M

l E.5. Vulnerabilities and Plant Improvements i

1 The licensee identified a potential reactor coolant pump thermal barrier tube rupture as a

vulnerability. A modification to eliminate this vulnerability is planned in April of 1997 (Refuel Outage 13).

E.6 Observations V.

! The IPE submittal contains a substantial amount of information with regard to the i

recommendations of the Generic Letter (GL) 88-20 and NUREG-1335.

i j Although the IPE team used plant damage states to provide tb interface between the l front-end and back-end analysis, they paid an incomplete attention in understanding the i results of the containment performance analysis in terms of the front-end initiator drivers.

1 The IPE team did not include the frequency of "high" releases of Te accompanied with i

" medium" releases of Csl in comparing with NRC safety goal for "large" release. This appears to be a weakness.

4 The following are the major findings of the MP2 IPE, as stated in the submittal:

i j

• The IPE results show that the mean frequency of the plant damage state "TEH" was  !

i 2.255E-5 per year, which would contribute approximately two-thirds of the total I

MP2 mean CDF. This PDS was dominated (2.22E-5 per year) by transients with a total loss of feedwater (MFW and AFW), failure of feed and bleed operations, and j by the availability of one train of containment spray.

l

• The containment analyses indicate that the MP2 containment is not vulnerable to

early containment failure modes due to hydrogen combustion, in-vessel steam

! explosion, reactor pressure vessel rocket-type failure, ex-vessel steam explosion, or j structural failure of the reactor cavity walls. For high-pressure core-melt sequences, l the only mode of early containment failure was as the result of high-pressure melt

{ ejection and the associated DCH. The results show that the conditional probability I

of early containment failure was approximately 0.095, dominated by the DCH phenomenon. The MAAP code simulations of the dominant MP2 plant damage i states indicated that the containment basemat melt-through was the dominant late

! containment failure mode for low-pressure sequences. The conditional prol ability of j late containment failure was approximately 0.32, and dominated by the BMT

, phenomenon. The conditional probability of the MP2 containment remaining intact was 0.56.

• The MP2 containment ultimate pressure capability analysis identified three

! containment failure modes, namely, liner tear at the purge air / main feedwater

} penetrations, basemat shear, and cylindrical hoop membrane failure. The median f failure pressure was approximately 150 psig, which is about 2.8 times the design j pressure; the failure mode could be either liner tear or basemat shear. The lower i bound failure pressure (5th percentile) was approximately 102 psig, which was most 4 Millstone Unit 2 Back-End E-4 November 1995

likely due to basemat shear. The submittal's comparison of MP2 results with those of an IPE performed at Calvert Cliffs shows similarities between the two containments, with the MP2 having a moderately larger ultimate capacity for the three overpressurization failure modes.

i l Some unique MP2 design features contribute significantly to the ways in which its l containment responsed to severe accident conditions and also to its overall safety.

For example, the MP2 containment heat removal (CHR) system consists of four containment air recirculation (CAR) fan units, separated into two iPat trains,

, and two trains of corpinment spray (CS). The success of the CHR during severe

accidents would dspend on the availability of one of four CAR fans or one of two CS trains. The MP2 steel door that covers the reactor cavity accessway would have two significant effects on containment response to a severe accident

(1) water on the lower compartment floor could not flood the cavity (and hence would reduce the likelihood of ex-vessel steam explosion failure mode), and ( 2) the accessway blockage would eliminate a potential flow path between the lower compartment and

the reactor cavity (and hence reduce heat and gas transfer out from the cavity and containment overpressurization in many low-pressure vessel failure and dry cavity sequences). The tight reactor cavity design reduces the likelihood of containment penetation tear-out by reactor pressure vessel (RPV) dislocation during postulated severe accidents. He containment basemat is fabricated from a basaltic concrete which, compared with limestone concrete, would result in the formation of a minimal amount of noncondensible CO2 gas during corium-concrete interaction i (CCI). Also, the open design of the MP2 containment would prevent the formation of high hydrogen concentration pockets. Hence, global hydrogen burns would be more prevalent than locatind burns in the MP2 containment.

• The licensee identified a potential reactor coolant pump thermal barrier tube rupture as a vulnerability. A modification to eliminate this vulnerability is planned in April of 1997 (Refuel Outage 13).

De key conclusions of the technical evaluation of the MP2 IPE back-end analysis are summarized below:

• The submittal appears to be complete, comprehensive, generally well documented, and in conformance with the recommendations of GL 88-20 and NUREG-1335.

• To perform the back-end analysis, the IPE team used state-of-the-art understanding  ;

and methods of addressing severe accident phenomena, and performed comprehensive plant-specific assessments of all of the potential containment failure modes identified in NUREG-1335. De results of the DCH experiments conducted at Purdue University, sponsored by the CE Owners Group, together with MAAP simulations and scoping analyses, were used to address the MP2 carly containment failure caused by the DCH phenomenon. Similarly, MAAP simulations and plant-specific scoping analyses were used to address the MP2 late containment failure j caused by the BMT phenomenon in accident sequences during which corium Mdisteoe Unit 2 Back-End E-5 November 1995

d accumulates in the reactor cavity and the potential for corium-concrete interaction exists.

l

• As part of the back-end analysis, three CETs were developed that addressed plant and containment mitigating systems, post-core-damage operator recovery actions, l

i and severe accident phenomenological issues such as CCI resulting in BMT, in-vessel and ex-vessel steam explosion, hydrogen combustion, and DCH. De CET top events in the MP2 IPE mostly were phenomena-related while the supporting l logic (or fault) trees combined both phenomena-related and safety-system-related

! events, as well as potential post-core-damage operator recovery actions. De IPE l team performed plant-specific detenninistic transient calculations using MAAP, l which they augmented using the results of scoping analyses, probabilistic

! containment ultimate capability analyses (containment fragility analyses) as well as experimental results and results from other studies. Engineering judgment.was used to quantify CETs and subsequently assess the containment failure probabilities and the frequency of radionuclide releases. The IPE team addressed phenomenological uncertainties by performing sensitivity studies with MAAP and by relying on insights from other studies.

l l

i I

I i

Millstone Unit 2 Back-End E4 November 1995 l

o q

1. INTRODUCTION 1.1 Review Process

)

This technical evaluation report (TER) presents the results of the SCIENTECH's review of the back-end part of the Northeast Nuclear Energy Company (NNECO) Individual Plant Examination (IPE) submittal of the Millstone Nuclear Power Station, Unit 2 (MP2). 1

[3] His TER complies with the requirements for IPE back-end reviews of the U.S.

Nuclear Regulatory Commission (NRC) in its contractor task orders, and adopts the NRC ]

review objectives, which include the following: l To help NRC staff determine if the IPE submittal provides the level of detail t

requested in the " Submittal Guidance Document," NUREG-1335;

• To help NRC staff assess if the IPE submittal meets the intent of Generic i Letter 88-20; and l To complete the IPE Evaluation Data Summary Sheet. .

l l SCIENTECH sent the NRC a draft TER on the back-end portion of the MP2 IPE l submittal in November 1994. RawA in part on this draft submittal, the NRC staff .

submitted a Request for AdditionalInformation (RAI) to NNECO on April 14, 1995. l l NNECO responded to the RAI in a document dated September 20,1995. [4] nis final  ;

i TER is based on the original submittal and the response to the RAI. I Section 2 of the TER summarizes SCIENTECH's review and briefly describes the MP2 4 IPE submittal, as it pertains to the work requirements outlined in the contractor task l

order. Each portion of Section 2 corresponds to a specific work requirement. Section 2 also outlines the insights gained, plant improvements identified, and utility commitments made as a result of the IPE. Section 3 presents SCIENTECH's overall observations and conclusions. References are given in Section 4. The Appendix contains an IPE evaluation and data summary sheet.

1.2 Plant Characterization i The Millstone Unit 2 plant has a combustion-engineering-designed pressurized water reactor (PWR) nuclear steam supply system (NSSS) and a Bechtel-designed atmospheric, large, dry containment. The MP2 containment data and design description are provided in detail in Section 4.1 of the IPE submittal. A double-containment system, consisting of a pre-stressed, post-tensioned, concrete, cylindrical structure and a surrounding enclosure building, houses the NSSS. The auxiliary building contains the fuel handling facility, radioactive waste processing system, NSSS auxiliary equipment, heating and ventilation system equipment, laboratories, and the control room, ne containment completely l encloses the reactor, the reactor coolant system (RCS), and portions of the auxiliary and

engineered safety feature systems. In conjunction with the containment safety systems, 7 the contamment provides a fission product barrier and has a maximum internal design pressure of 54 psig. The general arrangement of the MP2 containment is shown in l

Millstone Unit 2 Back-End 1 November 1995

e qq m

Figures 4.1-1 to 4.1-3 of the submittal. The principal design parameters and characteristics of the MP2 containment are summarized in Table 4.1-1. (On page 4-8 of the submittal, this table is numbered as "4.4-1," and should be corrected to read "4.1-1.")

The foundation of the containment stmeture is a circular, steel-reinforced, concrete slab 8.5 feet thick and 137.5 feet in diameter, which rests on granite 32.5 feet below sea level. A 0.25-inch steel liner is anchored to the top of the slab. Another reinforced concrete slab is placed over the steel liner. The walls are steel-reinforced concrete, 3 feet, 9 inches thick, with an inside diameter of 130 feet. De hemispherical dome is -

3 feet, 3 inches thick, and provides support to the containment spray (CS) headers and the maintenance truss at its pivot point. The internal height of the containment is 176 feet. An 0.25-inch-thick, cartion steel liner extends over the entire internal surface of the containment stmeture to act as a leak-tight membrane to prevent the release of radioactive fission products during severe accidents. -

The reactor cavity is the area surrounding the reactor pressure vessel (RPV) immediately below the upper head bolting flange. The RPV fits tightly within the cavity (the bottom of the RPV is about 2 feet above the base of the reactor cavity). The design of the cavity is shown in Figures 4.1-4 to 4.1-6 of the submittal. The MP2 RPV design does not include any penetrations on the lower head. As such, the cavity does not include an in-core instrument tunnel. The only access to the cavity is via an access port, 3 feet square, centered 3.5 feet above the cavity base on the east side. De outboard entrance is covered with a bolted hatch. Hence, there is no direct hydraulic connection between the cavity and the lower compartment sump. Because of the presence of a neutron shield ring, only a negligible amount of CS water can flow into the cavity. During all accident scenarios, therefore, the cavity would be expected to remain essentially dry prior to RPV failure.

The MP2 containment heat removal (CHR) system consists of four containment air recirculation (CAR) fan units, separated into two independent trains and two trains of containment spray. The success of the CHR in responding to severe accidents depends on there being available either one of four CAR fans, or one of two CS trains.

The containment post-incident hydrogen control system, which maintains the hydrogen concentration below 3%, consists of four subsystems: (1) the post-incident recirculation (PIR) system to mix any hydrogen accumulated in the upper portion of the containment with the rest of the containment atmosphere, (2) the hydrogen concentration monitor and analyzer, (3) the hydrogen recombiner system, and (4) the hydrogen purge system. The hydrogen recombiner syr.em is activated manually from the control room within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of an accident.

To ensure that containme.it integrity will exist when it is required, redundant isolation valves (at least two) in series are provided between the outside atmosphere and the inside of the containment. He isolation valves close automatically upon activation of-the containment isolation actuation signal (CIAS). Containment penetrations that open directly onto the containment, such as the normal sump drain, are also isolated Millstone Unit 2 Back-End 2 November 1995

l f4 y

automatically. The submittal does not state whether in the event of automatic isolation failure manual backup is available in the MP2 main control room.

The following paragraphs summarize the design features of the MP2 containment:

The MP2 containment heat removal system consists of four containment air recirculation fan units, separated into two independent trains, and two trains of containment spray. The success of the CHR in responding to severe accidents i depends on there being available either one of four CAR fans, or one of two CS i trains.

The MP2 steel door that covers the reactor cavity accessway has two significant effects on containment response: (1) water on the lower compartment floor cannot flood the cavity (and hence reduces the likelihood of entering into the ex-vessel steam l explosion failure mode), and (2) accessway blockage eliminates a potential flow path between the lower compartment and the reactor cavity (and hence reduces heat and gas transfer oui from the cavity and containment overpressurization for many low-pmssure vessel failure and dry cavity sequences).

The tight reactor cavity design reduces the likelihood of containment penetration tear- l out by RPV dislocation during postulated severe accidents.

The containment basemat is fabricated from a basaltic concrete which, compared with l limestone concrete, results in a minimal amount of noncondensible CO2 gas forming during CCI.

I Millstone Unit 2 Back-End 3 November 1995

y-

'l l l

! 2. TECHNICAL REVIEW 2.1 - Licensee IPE Process i 2M. Comniatanaec and Methodologv.

I

! De submittal appears to be complete in accordance with the level of detail outlined in NUREG-1335 and appears to meet the NRC sequence selection screening criteria described in Generic Letter 88-20.

l l The IPE methodology used is described clearly. The approach followed is consistent with the basic tenets of Generic Letter GL 88-20, Appendix 1.

! De methodology used to perform the IPE is described clearly in the submittal. The approach taken, which is consistent with the basic tenet: of GL 88-20, Appaa* 1, also  !

is described clearly along with the team's basic underlying assumptions. The important

. plant information and data are well documented and the key IPE results and fmdings are I well presented. De IPE relied on MP2-specific data and scoping analyses, as well as on

! the results of experiments sponsored by the CE Owners Group, (CEOG) and on insights l from other PRA studies, i.e., NUREG-1150.

. Similar to other traditional PRAs, the MP2 IPE employed two distinctly separate levels of i analyses, namely, plant response model (front-end analysis) and containment response

! model and source term calculation (back-end analysis). The front-end portion consisted

mainly of the analysis of a list of initiators and their associated event trees and the analysis of front-line and support system fault tree models. The MP2 IPE was carried  ;

j out using the standard large fault tree and small event tree approach, which involves fault '

l- tree hnking and nodalizing of the event trees through the accident mitigation function, j The results of the accident sequence quantification in the front-end portion of the analysis i are described in tenns of the core damage frequencies associated with the event tree end ,

states. It was assumed that core damage would occur when the clad tempeture reached

+

2,200F. The cutoff frequency was assumed to be 1.0E-9 per year.

1 l The CDF sequences were binned into several plant damage states presenting similar

i. challenges to the containment during the back-end analysis. Defming the PDSs helped i the IPE back-end analysis team to scope containment event tree development and i analysis. The MP2 IPE identified 26 PDS classes for nonbypass sequences in which the

containment was initially intact (Table 4.9-5 of the submittal), two classes for steam j generator tube rupture (SGTR) (Table 4.9-6), and one PDS class for Interfacing System j Loss of Coolant Accident (ISLOCA) sequences in which the containment was bypassed

. (Table 4.9-7). The results of the PDSs were entered into the back-end models (i.e.,

CETs) to calculate the final accident sequence results in terms of release of fi;sion i products. Using this approach, the IPE team appears to have addressed the interface j between the front-end and back-end analyses properly.

J

) Members of the IPE team used the PC-based computer code CAFTA for accident j sequence quantification in the MP2 IPE. They used the MAAP code, augmented with a Millstone Unit 2 Back-End 4 November 1995

number of scoping thermal-hydraulic analyses, to perform the deterministic containment loading calculations in the back-end analysis and also used MAAP to develop some of the success criteria in the front-end analysis (e.g., the number of safety injection tanks required to respond to a large LOCA). They calculated source terms using MAAP code, and evaluated them for 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after accident initiation.

W Multi-Unit Effects and As-Built. As-OoeratM Statm.

De MP2 IPE team designated 1986 as a cutoff for initiating events data and June 1987 for plant-specific data on the mitigation systems. To familiarize themselves with the plant, members of the IPE team performed " routine" walkdowns and interviewed personnel. They also collected data, and attempted to verify the "as-built" plant configuration. Page 14 of NNECO's response to the staff's RAI notes the following: [4]

Since the data up to 1987 (Mitigating Systems) and 1986 (initiating events) were used, we cannot guarantee all details of IPE are representative of the as-built, as-operated plant. Reasonable guarantee against major vulnerabilities is attributed to the fact that the PRA engineers who worked on the Ievel I PRA are utility engineers who have close interactions with the plant on a daily basis. Furthermore, we look at IPE as a snapshot in time. We have enough procedures in place (e.g., Significant Event Tracking, Design Review, Backward and Forward Imking Risk Monitors) to detect any new vulnembilities.

W Licensee Particination and Peer Review.

Some 15 to 20 NUSCO/NNECO staff members participated in the IPE effort. The utility staff performed the front-end analysis in its entirety, and received some support from  ;

consultants when conducting the back-end analysis. EQE International performed the l containment structural analysis, which the NUSCO Civil Engineering Department )

reviewed. Gabor, Kenton and Associates (GKA) offered limited technical support on the i back-end analysis, which GKA also reviewed independently. j De team that performed the independent review of the MP2 IPE consisted of in-house l personnel at Northeast Utilities, including individuals from unit engineering, the project services department, nuclear licensing, civil engineering, and the PRA staff, as well as '

two outside contractors, i.e., EQE and GKA (Section 5.2 of submittal).

2.2 Containanent Analysis / Characterization W Front-end Back-end Deoendencies.

The CDF sequences from the front-end analysis were binned into several plant damage states, presenting similar challenges to the containment during the back-end analysis. The definitions of the PDSs provided the interface between the front-end and back-end analyses, and also helped the IPE back-end analysis team to scope the containment event tsee (CET) development and analysis. The results of the PDSs were then entered into the back-end models (i.e. CETs) to calculate the final accident sequence results in terms of Millstone Unit 2 Back-End 5 November 1995

g i

release of fission products. Figure 4.3-4 in the submittal shows the process of the front-end/back-end coupling used in the MP2 IPE. Using this approach, the team appears to have addressed the interface between the front-end and back-end analyses properly.

'Ibe criteria used to derme the PDS classes are not stated explicitly in the submittal.

! Also, the number of key PDS classes reported in various parts of the IPE submittal are

different. In Section 3.1.5 of the submittal, it is stated that each PDS group was assigned

) an alphanumeric name to indicate the following:

i

• Type of initiator (e.g., LOCA, transient) involved

• Time of core damage (early, late)

• Availability of CHR systems (CAR fans, CS)

• RPV pressure at time of core damage (high, low)

I

Based on a review of Table 3.1.5-2 and Tables C-1 to C-5 of the submittal, it appears

that the IPE team considered at least the following criteria when developing the PDS bins:

4

• Initiating event; .

'

• Emergency Core Cooling System status;

• Reactor Coolant System pressure;

• Auxiliary feedwater status;

• Power-operated relief valve status;

• CHR status;

• Containment status; and

• Core damage timing.

The IPE team examined three main classes of PDSs at MP2, each represented by a CET.

These included nonbypass sequences in which the containment was intact initially, and SGTR and ISLOCA sequences in which the containment was bypassed. The first PDS class (i.e., nonbypass) was subdivided into 26 PDSs and the steam generator tube rupture was subdivided into two subclasses, making a total of 29 PDSs.

In SGTR scenarios that involved a stuck-open atmospheric dump valve (ADV), the worst radionuclide release was assumed to occur when feedwater to the faulted steam generator was isolated. By not isolating feedwater to the faulted steam generator it was thought that the source term release to the environment would be reduced because the fission products in the water pool on the secondary side would be scrubbed. In addition, SGTR sequences involving a stuck-open ADV and l:uccessful RCS cooldown using the intact steam generator were assumed to lead to a law core melt and, consequently, to a late radionuclide release.

It appears that the concept of front-end back-end interbce dependencies in the MP2 IPE is in accordance with the guidance provided in NOREG-1335.

Millstone Unit 2 Back-End 6 November 1995

q,,

2ll Conhinment Event Tree Develooment.

In the MP2 IPE, the probabilistic quantification of severe accident progression was performed using CETs and fault trees. 'Ihe CET was used to map out the possible containment conditions that could affect the radionuclide releases associated with a given core damage sequence (or class). The CET headings in the MP2 IPE are containment failure phenomena-related while the supporting logic (or fault) trees combine both phenomena-related and safety-system-related events, as well as potential post-core-damage operator recovery actions. The fault trees were used to evaluate the split fractions for each CET node.

The MP2 IPE team developed three CETs to represent the following three main classes of PDSs:

Class 1 CET (CETI): Nonbypass sequences in which containment is intact initially; Class 2 CET (CET2): SGTR in which the containment is bypassed; and Class 3 CET (CET3): ISLOCA sequences in which the containment is bypassed.

Using CET1, accident sequences with containment isolation failure were modeled with a guaranteed early containment failure in the MP2 IPE. Figures 4.7-1 to 4.7-3 in the submittal show the three CETs developed in the MP2 IPE. The specific CETs for various PDS subclasses are documented in Appendix D to the submittal and the supporting fault trees used for quantification of the CET nodes are provided in Appendix F. 'Ihe definitions, names, and the probability estimates for the fault tree basic events are provided in Table 4.8-4 of the submittal. 'Ibe operator recovery actions modeled in the back-end analysis are given in Tables 4.8.2-1 (page 4-168) and Table 4.8-3 (page 4-149) of the submittal.

Ten headings or nodes for the nonbypass sequences, which mostly relate to severe accident phenomena, are listed for CET1. These nodes address induced SGTR, RCS pressure at vessel failure, in-vessel accident recovery, early containment failure, debris coolability, core (or corium-concrete interaction, late containment failure, containment failure type (leak or rupture), containment spray effectiveness for aerosol scrubbing, and fission product revaporization. As stated earlier, tivt system-related events and potential operator recovery actions are modeled in the supporting fault trees. 'Ihe following top events were considered for CETI (see Section 4.7 for a description of these top events, and also the assumptions behind the CErl structure):

O. Nonbypass event, ISOL (CETI entry state)

1. No induced SGTR, NISGTR

2. RCS at low pressure, LOWPRFS

3. Vessel intact, VI

4. Containment intact early, CIE

5. Debris covered in cavity, DCC I

6. No core-concrete interaction, NCCI Millstone Unit 2 Back-End 7 November 1995

qy

7. Containment intact late, CIL

8. Containment leak or basemat melt-through, LEAK

9. Containment sprays effective, SPR -

10. No fission product revaporization, NREVAP i Node 3 addresses in-vessel recovery. The submittal states that the RPV may not fail in cases where adequate core cooling is maintained, even after the onset of core damage.  ;

The debris could be coolable in vessel, either internally by injecting water into the vessel, or externally by cooling the vessel lower head. However, because no inochanism exists to provide a sustained water flow to the MP2 reactor cavity (dry cavity) to cool the lower ,

head, external cooling was not considered. According to the submittal, as part of the MP2 Accident Management program, a sensitivity study could be performed to simulate and assess the impact and the potential benefit of removing the steel door of the access ,

tunnel. l i

The CIE node distinguishes sequences in which the containment failed shortly after RPV j breach (within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, due, for example, to DCH) from sequences where containment ,

failure occurred late or not at all (page 4-134 of the submittal). This implies that the IPE  !

team defined an "early" containment failure as one occurring within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> of vessel j breach.

The DCC node addresses the amount of debris that would be expected to remain in the reactor cavity, depending on the RCS pressure at the time of core melt. De CIL node addresses late containment failure, due to long-term overpressurization, a late hydrogen burn, or basemat melt-through.

The CET2 for bypass SGTR sequences and CET3 for bypass ISLOCA sequences are rather simplified because these bypass sequences are nearly always driven by in-vessel releases, so that the CETs do not address concerns associated with the ex-vessel phenomena. The CET2 and the CET3 each include three top events. (See Section 4.7 for a description of the headings, and also the assumptions behind the CET structure.) i The following are the top events in CET2 (page 4-143):

i

0. Initiating event SGTR, SGTR2 (CET2 entry state) )

. 1. RCS cooldown using the intact SG, COOL i

2. Failed SG SRV does not stick open, SRV

3. Faulted SG feedwater isolated, FEED.

He following are the top events in CET3 (page 4-144):

0. Initiating event ISLOCA, ISLOCA (CET3 entry state).

1. Break size small, BSS

2. Break flooded, FLOOD

3. Auxiliary building mitigates fission product release, MIT.

2 To quantify probabilistically the CETs and subsequently assess the containment failure probabilities and the frequency of radionuclide releases, members of the MP2 IPE team i Mmm- Unit 2 Back-End 8 November 1995

. - - - . - . - - . - - - - - - -- - - . - - . - - - - - -- - - ~ .

i

. 4 i

i

. relied on plant-specific deterministic transient calculations using MAAP. They also used  ;

the results of scoping analyses, probabilistic containment ultimate capability analyses l (containment fragility analyses), the results of DCH experiments conducted at Purdue i i University [5], results from other studies, and engineering judgment. Phenomenological

uncertainties were addressed through the use of sensitivity studies performed with MAAP .

as well as through insights gained from other studies. Sections 4.4.4 through 4.4.18 of l the submittal contain well-documented summaries of the MP2-specific scoping analyses, which were performed to supplement the MAAP analyses and to support the team's probaulistic assessment of all of the postulated phenomena-related containment failure  ;

modes (e.g., DCH, BMT, CCI, in-vessel and ex-vessel eramm explosion, hydrogen burn). l l Table 7.2-1 of the submittal summarizes the MP2 results and compares them with the i j results from three other CE-designed plants (San Onofre 2 /3, Palo Verde, and j Palisades),

i

! Using the standard stress-strength appinach, the NNECO contractor, EQE Engineering

! Consultants, performed a probabilistic evaluation of an MP2 containment failure caused j by overpressurization beyond design basis events. First, a list of containment failure 0 mechanisms was developed (see Section 2.2.3 in this TER). Then, to establish the MP2

, containment fragility curves, a series of calculations was performed (i.e., the strength

! part of the analysis) to find out the probabilistic, plant-specific, containment ultimate j capability under various accident temperatures, pressures, and dynamic loadings (see i

Figures 4.4.3-1 to 4.4.3-3 in the submittal). Next, a series of plant-specific, thermal-

hydraulic calculations was performed using the MAAP code to assess various temperature 4

and pressure challenges imposed on the containment under different severe accident conditions or bins (i.e., the stress part of the analysis). 'Ihe final step was to convolute the containment capability (or fragility) curves and the accident scenario profiles determined f om MAAP runs to estimate the probabilities of containment failure under various postulated accident conditions.

In light of the recent direct containment heating experiments sponsored by the CE Owners Group and conducted at Purdue University [5], the MP2 IPE took a conservative probabilistic approach using an event tree (see Figure 4.8.4-1 in the submittal) to assess I an MP2 containment failure caused by the DCH phenomenon. Essentially, the event tree j calculated the containment failure probability using the fragility curves developed for the )

MP2 containment and the calculated containment pressure due to DCH overpressurization. According to the submittal, the experimental data on DCH suggest that there is minimal containment pressurization due to DCH at RPV failure pressures below 200 psia, and virtually complete DCH above 1,000 psia. Using this information and running MAAP for the dominant MP2 PDSs, the IPE team showed that, assuming 100-percent debris fragmentation, the peak containment pressure at RPV failure was about 200 psia for an SBO sequence with no containment heat removal capability and i about 137 psia for a small LOCA sequence with CHR. Also, the MAAP results I indicated a 15 psia containment pressure rise due to RCS blowdown for an SBO sequence l with no CHR. To estimate for the MP2 PDSs the containment failure probabilities l caused by DCH, the team used data from the Purdue experiments, MAAP results, and '

engineering judgment to develop a DCH decomposition event tree. For example, the )

estimated failure probability was 0.116 in situations where the RCS pressure was high j Millstone Unit 2 Back-End 9 November 1995

0%

and CHR capability was available (see basic event VPHFF-ULT-15 in the logic tree on page F-16 of the submittal). In situations where the RCS pressure was low and where CHR was either successful or had failed, the estimated probabilities of failure were 0.01 and 0.001, respectively (see basic events VPHFF-PULT-17 and VPHFF-PULT-18 in the )

logic tree on page F-17 of the submittal).  !

The submittal states that the open design of the MP2 containment prevents the formation of high hydrogen concentration pockets. A scoping analysis indicated that natural circulation mixes the containment atmosphere every 5 to 15 minutes. Therefore, it was concluded that global hydrogen burns would be more prevalent than lacalimd burns in the MP2 containment. In addition, a scoping analysis indicated that, only by assuming 100-percent claMmg cxidation, could an early hydrogen burn be eWM to challenge the containment integrity.

The team's evaluation of the potential for creep rupture failure of the RCS under severe accident conditions is documented in Section 4.6, pages 4-126 to 4-132 of the submittal.

The results from MAAP simulations were input into a computer code, which was developed based on the I. arson-Miller model to predict the time it would take to reach creep failure for a number of MP2 PDSs.

'Ihe IPE team concluded that the MP2 accident sequences that progress at or near the pressurizer power-operated relief valve (PORV) set point are evpe+M to experience a hot leg creep rupture failure prior to RPV failure. This would result in a reduced likelihood of early containment failure to RCS depressurization. It was further determined that surge line and steam generator tube creep ruptures were highly unlikely to occur prior to  !

hot leg creep rupture. For accident sequences with high RCS pressure that do not experience a hot leg creep rupture, it was shown that the DCH is the dominant early containment failure mode.

In reporting the dominant accident sequences, the IPE team used the criteria given in Appendix 2 of the GL 88-20 and NUREG-1335, and provided in Table 3.4.1-5 of the submittal the top 97 back-end sequences that would result in containment failure. As shown in Table 3.4.1-5, the sequences with containment release frequencies greater than  !

5.0E-9 per year contributed to about 85% (or about 1.28E-5 per year) of the total MP2 containment failure frequency (i.e.,1.5E-5 per year). 'Ibe top 100 front-end core damage sequences cutsets are summarized in Table 3.4.1-2. As shown in this table, the core damage sequences with frequencies greater than 5.6E-8 per year contributed to about 59% (or about 2.0E-5 per year) of the total MP2 CDF (i.e., 3.4E-5 per year).

Containment event tree development and CET quantification in the MP2 IPE are very thorough, well presented, satisfy the intent of GL 88-20, and are in accordance with the level of detail expected by NUREG-1335.

UJ Containment Failure Modes and Timine.

As part of the MP2 back-end analysis, the IPE team evaluated the containment failure modes, timing, and capacity. This evaluation is described in Section 4.4 of the IPE Mdissone Unit 2 Back-End 10 November 1995

l...-

g' o . a i l I

i

submittal. For purposes of quantitative analysis, the team compiled a comprehensive list  !

of containment failure modes based on MP2-specific design documents, NUREG-1150,  !

NUREG-1335, and other studies. Tables 4.4.4-1, page 4-77 of the submittal, lists the  ;

i- following potential containment failure modes that were considered in the MP2 IPE )

study

i

• Direct bypass (SGTR, ISLOCA);

l Early overpressunzation (DCH, ex-vessel steam explosion, hydrogen burns);

! Late overpressurization (hydrogen burns, steam and noncondensible gases);

• Early melt-through (direct contact of molten debris with containment liner);

l i

• Core-concrete interaction (late basemat melt-through);

j

• Blowdown forces (RPV rocket failure, tear-out of vessel penetrations); and i

• Thermal degadation of pg,aution seal material.

i The following important pammeters were identified for all of the containment failure j modes (table 4.4.4-1, page 4-77 of the submittal):

i

!

• Time of containment failure (e.g., early, late); and

Size of containment failure (e.g., leak, rupture).

i' j The definition of leak versus rupture is not explicitly given in the submittal. However, it l

appears that the containment leaks represent breach areas of 5.7 in2 or less.

i:

j Using MAAP, all of the severe-accident-phenomena-related containment failure modes i f were analyzed probabilistically. These modes, which included DCH, basemat melt- l

! through due to CCI, in-vessel and ex-vessel steam explosions, and hydrogen burns, were  !

all analyzed using a combination of plant-specific deterministic transient calculations,  !

, which were augmented by scoping analyses, probabilistic containment ultimate capability  !

analyses (containment fragility analyses), experimental results, results from other studies, j j and engineering judgment. The team addressed phenomenological uncertainties by

performing sensitivity studies using MAAP as well as insights from other studies.

, Sections 4.4.4 to 4.4.18 of the submittal describe in detail the evaluation of various a containment failure modes for MP2. A concise summary of the MP2 results and their

[ comparison with the results of three other CE-designed plant studies (San Onofre 2/3,

' Palo Verde, and Palisades) are provided in Table 7.2-1 of the submittal.

j The team's evaluation of the potential for failure of electrical pm.uution seals due to j overheating is described in Section 4.4.10, pages 4-95 and 4-% of the submittal. Based i on MAAP simulations and results from a Sandia study, the IPE team concluded that MP2 l is not vulnerable to failure of electrical penetration seals due to overheating as would be j expected for a large, dry containment. According to the submittal, although certain core

damage sequences (such as station blackout) would result in containment temperatures exceeding the seal design values, limited heat transfer to the outboard seal would prevent i their degradation, i.e., the inboard seal might fail, but the outboard seal would remain

. intact.

i l

I I

I l %nma- Unit 2 Back-End 11 November 1995 i

~

3 i

1 The NNECO contractor, EQE Engineering, perfonned a p'obabilistic evaluation of the MP2 containment ultimate capability, which is summarized in Section 4.4.1 of the

submittal. According to the submittal, the Civil Engineering group at NUSCO and i

another contractor, i.e., GKA (Gabor, Kenton and Associates) reviewed the EQE report.

l The containment capability calculations were performed at different postulated l containment temperatures (i.e., 400*F, 600*F, and 800'F). 'Ibe numerical results are 1 summarized in Table 4.4.4-1, and the containment fragility curves are shown in i Figures 4.4.3-1,4.4.3-2, and 4.4.3-3 for 400*F,600*F, and 800'F, respectively. The

} uncertainties were represented by lognonnal distributions.

l The MP2 containment ultimate pressure capability analysis identified three containment failure modes, namely, liner tear at the purge air / main feedwater i~.~.Mions, basemat j shear, and cylindrical hoop membrane failure. 'Ihe median failure pressure was

approximately 150 psig, which is about 2.8 times the design pressure and the failure l mode could be either liner tear or basemat shear. The lower bound failure pressure

! (5th percentile) was approximately 102 psig and would be most likely to occur as the i result of basemat shear. The IPE team's comparison of MP2 results with those from a

j. study of Calvert Cliffs indicates that there are similarities between the two containments,

with MP2 having a moderately larger ultimate capacity to withstand the three i overpressurization failure modes.

l To summarize, according to the MP2 IPE submittal, a small percentage of CDF l sequences would lead to early containment failure (9.5% of the CDF) with a total j radionuclide release frequency of 3.2E-6 per year. The perey of CDF sequences 1

that would result in late containment failure was 32.4 with a radionuclide release i frequency of 1.1E-5 per year. The frequency of no release with containment remaining

! ' intact was reported to be 1.9E-5 per year (55.9% of the CDF). 'Ihe dominant early

contamment failure appeared to the result of direct containment heating (DCH) and the

!. late containment failure due mainly to basemat melt-through. (MAAP predicts failure l times of greater than 55 hours6.365741e-4 days <br />0.0153 hours <br />9.093915e-5 weeks <br />2.09275e-5 months <br /> after accident initiation for BMT sequences.) The containment isolation failure probability was shown to be negligible as the result of a

highly reliable containment isolation system (approximately a 0.02% contribution to total

!. conditional containment failure probability, given core damage). The total release j frequencies for SGTR and ISLOCA events were shown to be 6.7E-7 per year l (approximately 2% of the CDF) and 6.6E-8 per year (approximately 0.2% of the CDF),

i respectively.

t l The IPE team appears to have identified and analyzed all relevant potential containment failure modes and to have considered all applicable containment failure modes included in i Table 2-2 of NUREG-1335.

i.'

j 2.2.4 Containment Isolation Failure.  !

1 Details about the containment isolation failure (CIF) are provided in Attachment #7 to the l utility's response to the staff's RAI. [2] Assessing the probability of containment

isolation failure involves consideration of the following two components:

Minstone Unit 2 Back-End 12 November 1995 i

y

. Identification of the penetrations (potential leakage paths) that may not be isolated following an accident in order to prevent or mitigate radioactivity releases outside the primary containment; and

. Estimation of the frequency of failure to isolate.

Factors that should be considered in the course of quantifying the probability of containment isolation failure include:

. Number, types, and failure modes of the isolation valves;

. Types of the automatic isolation signals that are generated;

. Failure of the operator to manually isolate (if possible) the isolation valves;

. Operator maintenance erfors These are errors committed during maintenance or testing in which the operator fails to restore the valves to their proper positions or in some other way defeats the isolation capabihty of the valves; and

. Mechanical failure of the isolation valves.

The probability of MP2 containment isolation failure was estim*~i to be 2.1E-4, based on the calculations of 8.0E-5 from pre-existing failures, 8.5E-5 from letdown line isolation failure, and 4.3E-5 from hydrogen purge linc isolation failure.

2.2.5 System / Human Response.

NNECO's response to the NRC RAI notes on page 53 that operator actions in the back-end analysis were represented by " House Events," which could be either true (i.e.,1) or false (i.e., 0) depending on whether or not the front-end analysis credited such recovery actions. The evaluation of accident management / mitigation decisions (e.g., to remove the accessway door in order to be able to flood the reactor cavity and establish ex-vessel lower head cooling, or to cool the ex-vessel molten debris) was the only instance in which operator action was determined exclusively in the back-end analysis. As noted on page 54 of NNECO's response to the RAI, the following operator actions were credited in the back-end analysis.

• V-FLANGE -

Reactor cavity flange (access door) not removed;

• VOPAF-PZR-SRV - Operator does not open pressurizer's PORV; and

• VOPAF-2ND-SRV - Operator does not open ADVs.

Millmone Unit 2 Back-End 13 November 1995

- - - = . - . . - . . - . - - _ - ._- --- -._. .. - - - . _ _ .

, 4!) :

t a

}

W Radionuclide Relente rateeories and Characterintian .

! The IPE team defined release categories to qualitatively describe the magnitude and  ;

! timing of fission product releases resulting from various accident sequences (i.e., CET  !

} end states). 'Ihe release categories binned accident sequences with different accident j progression details, but similar characteristics. The following designators were used to define the release categories:

j Containment Failure Timing: Early and Late relative to the time of core damage; l

l Magnitude of Volatile Source Term: Using Cal as a surrogate, High (> 10%), ,

j Moderate or medium (1 % to 10%), and Low (< 1 %); ' t i

• Magnitude of Nonvolatile Source Term: Using tellurium as sunogate, High l (> 10%), Moderate or medium (1 % to 10%), and Low (< 1 %); and i

)

• Mode of Containment Failure: Eupture, Leak-type failure or basemat melt-through,

which was considered a leak, Induced SGTR, SGTR, and Y-sequences involving j interfacing systems LOCA.

Noble gases (mainly krypton and xenon) were assumed to be completely released in all 1 cases, and therefore did not have a designator. 'Ibe IPE team defined the magnitude of l

! Cs! and tellu-ium source terms based on a study by G. D. Kaiser. [6] According to the submittal, Kaiser found that, once the average release fractions of cesium, iodine, and tellurium dropped below 10% (by weight), the conditional mean number of early fatalities j became relatively small. The IPE team binned bypass (SGTR and ISLOCA) sequences separately into release categories, i

e i Many PRAs defined release categories using only volatile releases as surrogates. 'Ihe l MP2 IPE team argued, however, that sequences with high volatile releases may have low i nonvolatile releases and vice versa. The team concluded that classifying the aggregate of I

all of the fission product releases as "high," " medium," or " low" was an inaccurate practice and could be confusing. The MP2 team approach of using both volatile and

! nonvolatile release tenns was a more conservative one than using volatile release terms l only. As shown in Table 4.9-5, page 4-189 of the submittal, an early, " medium" release

} of iodine, but a "high" release of tellurium was involved in sequences that had a frequency of 1.077E-6 per year (3.2 % of the total CDF).

! 'Ihe " rules" and other considerations the MP2 IPE team used to define the release l categories and to assign them to CET end states are described on pages 4-177 through

4-180 of the submittal. The following are highlights from them.

1

! * "Early, low" releases are higher in magnitude than " late, low" releases, i.e., the designators of release magnitude need to be viewed as relative to the other release i categories for sequences that have the same timing and release modes. In addition,

} sequences that have the same designators but different containment failure timing i generally are not compatible; Mdimaa Uni t2 Back-End 14 November 1995 5

y q Containment sprays were assumed to greatly mitigate fission product releases except for the releases involving early containment failure caused by DCH;.

• Revaporization was considered for cases in which the bulk of the cesium and iodine inventory was retained in the RCS, i.e., high RCS pressure sequences.

Revaporization was ignored for early containment failure cases because the IPE team believed that the release magnitudes and overall risk were driven by the prompt release of fission products at containment failure, but not by the potential for a slow rate of evolution of volatile fission products over an extended period; and

• Although the MAAP code did not model fission product sembbing in the soil for sequences with basemat melt-though, the IPE team considered that the scrubbing through soil to be quite effective and treated basemat failure releases as Late, Leak-type releases.

Table 1 lists release categories involving early releases of "high" Cal or tellurium, which amount to a total frequency of 1.47E-6 per reactor year (4.31 % of total CDF).

However, the submittal notes on page 4-185 that the " contribution of E-HH release only is about 2.6E-7/RY . . . which is below the NRC's safety goals." [1] In comparing the MP2 releases with the NRC safety goals, the IPE team ignored the "high" releases of 1 tellurium with " medium" releases of CsI, which had a total frequency of 1.08E-6 per reactor year. It is our opinion that the "high" releases of tellurium need to be considered in the context of "large" releases. i i

2.3 Accident Prognesion and Containment Perforinance Analysis  !:

2.1.1 Severe Accident Pmeression.

The CET developed for nonbypass sequences consisted of 10 top events that were mostly phenomena-related. These top events are listed in Section 2.2.2 of this report. Detailed  :

phenomenological issues as well as system-related questions and operator actions that influence severe accident progression were addressed using logic trees that were  ;

developed to support each of the CET top events. The following are the phenomenological basic events contained within the various logic trees (Table 4.8-1, pages 4-146 and 4-147):

• ISGTR occurs, given high pressure and a stuck-open ADV;

• ISGTR occurs, given no stuck-open ADV;  ;

• ADV is stuck open prior to an ISGTR;

• ADV does not stick open, given an ISGTR;

• ISGTR with a stuck-open ADV does not depressurize the RCS; i

• Hot leg / surge line remains intact, given high RCS pressure; l

• Hot leg / surge line remains intact, given medium RCS pressure;

• Ex-vessel cooling is not effective;

• Coolable debris bed is not formed in-vessel;

• Hydrogen burn fails containment, given CHR availability and in-vessel recovery; l 4

Millstone Unit 2 Back-End 15 November 1995

g q

sj I

\ l

! Table 1. Release Categories Involving Early Releases l 4

with "High" Cs! or Tellurium l 1

! 1

' . i Release Category Frequency Percentage of CDF i j (per reactor year) j

l E-HM-R 7.63E-10 0.00

, E-HH-R 2.56-7 0.75 i  :

i E-MH-R 1.08E-6 3.16  !

E-HM-I 9.27E-9 0.03 l

l E-HH-I 1.06E-9 0.00 E-HL-I 1.55E-8 0.05 i

j E-HL-S 5.07E-8 0.15 E-HL-V 5.96E-8 0.17

Total 1.47E-6 4.31 l

i

• Containment fails, given no CHR availability or in-vessel ncovery; l

l

• Flange does not fail, given high pressure; a

4

• Flange does not fail, given low pressure;

• CCI occurs in refueling pool, if no sprays are available; j

• CCI occurs in refueling pool, if sprays are available;

}

• CCI occurs in cavity, given upward debris dispersion (UDD) and debris covered with 4

I water in the cavity; f

• CCI occurs in cavity, given UDD and no water in the cavity;

!

• Pressure rises, given hydrogen burn after CCI fails containment; i

(

• Containment fails early by rupture mode, given overpressure; i e Containment fails late by mpture mode, given overpressure; l

• ALPHA mode fails containment, given low pressure;

}

• ALPHA mode fails containment, given high pressure;

• Cavity failure causes containment failure; Mm-a-. Unit 2 Back End 16 November 1995

{

i

j ,.

ag

• Vessel acts as rocket and fails containment; I

• Revaporization occurs with high retention; j

• Revaporization occurs with low retention; I

• RCP seal fails;

'

• Pressurizer PORV sticks open, given total loss of feedwater and no LOCA;

[ Vessel failure time is too short to depressurize RCS;

• Containment failure by overpressurization, given high RCS pressure and CHR is on; l

j

• Containment failure by overpressurization, given high RCS pressure and CHR is off; j

• Dispersed debris fails liner; j

• Containment failure by overpressurization, given low RCS pressure and CHR is on; i

• Containment failure by overpressurization, given low RCS pressure and CHR is off; I

• CDB does not form if ex-vessel steam explosion occurs; ,

• CDB does not form if no ex-vessel steam explosion occurs;

• Ex-vessel steam explosion occurs if cavity is wet;

• Melt-through occurs, given debris that is not coolable and CHR is on; l

• Melt-through occurs, given debris that is not coolable and no CHR is on; 1

l

• Accident progression fails containment air recirculation fans; and l

• Accident progression fails sprays.

i

! Best estimate values of the above basic events are summarized in Table 4.8-4, l pages 4-150 to 4-164 of the submittal. 'Ibe following phenomenological uncertainties l were addressed using MAAP calculations and hand calculations, which are described in l Sections 4.4.7 through 4.4.18 of the submittal:

!

• Early containment failure by DCH;

• Basemat melt-through; 1

1

• Heat transfer aspects of molten debris coolability; i

• Failure of electrical penetration scals by over-temperature; i

• In-vessel steam explosion; i

• Hydrogen combustion; 4

l

• Hydrogen detonation; i

n Milbaone Unit 2 Back-End 17 November 1995 1

1 i _ _ _ . . . _ _ - --

9'

• Rocket-induced containment failure; Ex-vessel steam explosion; Containment pressurization by dynamic interaction between ex-vessel molten corium and an overlaying pool of water; and u

Global versus localimi hydrogen burn in containment.

hriv Containmant Failure by DCH. At MP2, the IPE team determined that the DCH 4

phenomenon presented a significant threat to early containment failure in those high-pressure sequences that do not involve RCP creep mpture failure. He tight cavity

, geometry and the lack of an instrument tunnel were expected to cause the entrainment of debris to be forced upward, into, and above the refueling area, rather than into the lower compartment via the instrument tunnel. Debris dispersal into the upper compartment would enhance DCH because of the presence of a relatively larger amount of air that

could interact with the debris.

i i ne IPE team used the results of a CEOG-sponsored experiment performed at Purdue University in which a 1:20 scale model was developed and studied that closely replicated j the MP2 cavity. He important findings of the experiment included the following (from pages 4-81 and 4-82 of the submittal):

i i

• For pressures above 200-300 psia, most of the corium simulant (but less than 90%) was ejected from the cavity;

• Iarger orifice sizes, which translated into larger reactor vessel failure areas, increased the amount of debris ejected;

• Of the fraction ejected, roughly 40% was collected in the lower compartment; the transport path was through the annular gaps around the RCS hot and cold legs; and

• Of the fraction ejected, roughly 40% was collected in the refueling pool area. It was not certain whether all of this macerial would contribute to DCH.

Hydrogen Comb MEiDD. Significant quantities of hydrogen can be generated during severe accidents from oxidation of fuel rod cladding. Additional hydrogen and carbon monoxide can be generated following RPV failure as the result of corium-concrete interactions.

Combustion of hydrogen poses a threat to the containment integrity.

MP2 is equipped with numerous and redundant systems to monitor and control hydrogen concentration in the containment. De EOPs instruct the operators to enable the hydrogen monitoring system and to activate the post-accident recirculation system to limit the fonnation of hydrogen pockets in the upper regions of the containment. The design of the MP2 containment inhibits the accumulation of hydrogen in local areas because all compartments and cubicles are open at the top to enhance atmospheric mixing. If the Millstone Unit 2 Back-End 18 November 1995

8 y

i containment hydrogen concentration exceeds 1.5% (by volume), the EOPs require the operation of hydrogen recombiners. If containment hydrogen concentration reaches 3.0%

(by volume) and both recombiner units are inoperable, the dimetor of the site emergency organization may approve use of the contamment hydrogen purge system.

! The recombiner and purge systems are designed to handle desi Fn basis accidents, ,

including the worst postulated LOCA. Dese systems are considered inadequate to  !

control the hydrogen threat following a severe core damage accident in which 50% to

75% of the fuel rod cinMing might oxidize.

l The IPE team performed hand calculations to determine the containment peak pressure

resulting from the adiabatic isochoric complete combustion of hydrogen. The percentage of clad oxidized varied parametrically at 50%, 75%, and 100%. De volumetric j

percentage of steam varied between 11 and 51. As shown in Table 4.4.12-1, page 4-100 of the submittal, in a case involving clad oxidation at 100% w. acam at 51 % the peak pressure calculated was 124 psig, which was higher than the 5th percentile containment l failure pressure of 102 psig, but lower than the 50th percentile value of 150 psig.

MAAP calculations performed for sequences representing the MP2 dominant PDSs showed that hydrogen combustion did not pose a strong vulnerability as a potential l containment failure mode. The highest predicted pressure rise from a burn was 69 psig in a case involving a main feedwater line break.

The IPE team perfonned a sensitivity study to review the e.*fect on hydrogen bum potential of a late recovery of CHR. Calculation for an SBO sequence was m**A with one CAR fan actuated 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> into the scenario, ne results showed a gradual lowering of the containment steam fraction and containment pressure. Following the occurrences of several nonthreatening burns, the team postulated a global burn that raised the pressure from 26 to 43 psig.

Hydroeen Detonation. Direct initiation of detonation requires a high-energy trigger, such as a spark or an explosion. A typical CE-PWR ignition source (12 kV,480 V, or a welder's are) produces energies that are three orders of magnitude lower than that required to detonate a 13-volume-percent, dry, hydrogen mixture in a geometry favorable to detonations (unconfm' ed).

Detonation can also occur through flame acceleration. To evaluate such detonations, the IPE team used a CEOG assessment [7] based on a detonation ranking scheme developed by Sherman and Berman. [2] ne CEOG study was of a typical 2,700 MWt, CE-PWR that had a zirtaloy m::ss of 53,700 lbs, a containment free volume of 2.0E6 ft', and an

" unconfined" geometry. (MP2 had a zircaloy mass of 50,759 lbs, a containment free volume of 1.85E6 ft', and an unconfined geometry.) As in the CEOG study the IPE team used a probability range between 0.001 and 0.01 for the occurrence of detonations in the MP2 containment.

Global versus IsitiveA Hydronen Bum in Containmcal. To evaluate the potential for localized hydrogen burns, the IPE team calculated the degree of local mixing by natural Mdisione Unit 2 Back-End 19 November 1995

,_ 5%

circulation because vigorous natural circulation currents would make it difficult to create stratified regions with high hydrogen concentrations (hydrogen pockets) that would support local burn. The team calculated that in every 15 minutes the containment atmosphere circul. J totally, which implied that containment mixing was relatively rapid. Therefore the team concluded that global hydrogen burns were more dominant than lemli =I hydrogen burns for the MP2 containment.

The licensee appears to have =d-*-ly considered the phenomenological uncertainties and senshivities ,urrounding accident progression at MP2.

E3 Daminant Contributox Cantietaev with IPE Inmiehtm.

Table 2 of this report compares the results of the dominant contributors to the MP2 conditional failure probability with the results of the IPEs performed for similar CE plants and of the NUREG-1150 study of the Zion plant. The CDF postulated for MP2 is similar to that of the other plants listed in the table.

The IPE team recognized as a disadvantage the fact that there had not been a NUREG-1150 study of a CE plant whose results could be referred to when benchmarking the MP2 IPE results. To compensate for this, the team extended the scope of the MP2 IPE and compared the results with those from three other IPEs, namely, the ones done at Palo Verde (Arizona Public Service), San Onofre Units 2 and 3 (Southern California Edison), and at Palisades (Consumer Power). The team benchmarked the respective results of the IPEs associated with phenomenological issues. Table 7.2-1, on pages 7-8 through 7-15 of the submittal, summarizes the results of this comparison. The IPE team concluded that "overall, the Millstone Unit No. 2 back-end anaF fsis results are consistent with the finding of the C-E plants except in cases where the plenomenological issues are driven by the plant-specific configuration." (page 7-6)

As shown in Table 2, the MP2 IPE team postulated a conditional probability of early containment failure of 9.5%, which is similar to that for Palo Verde but higher than the percentages postulated for Zion and San Onofre and significantly lower than that for Palisades. (The Palisades IPE analysts found that, after vessel failure, debris was expected to flow through 24-inch pipes connecting the reactor cavity sump to the auxiliary building.) The major contributors to the differences in early containment failure probabilities are as follows:

Containment Overpressure Fragility: The MP2 containment had a mean failure pressure of 150 psig, which is in the mid-range compared with those of other containments (Zion-135 psig, Palisades-131 psig, Palo Verde-169 psig, and San Onofre-175 psig).

Creep Rupture Failure: MP2 accidents that progress g or near the PORV set-pressure are expected to experience a hot leg or surge line creep rupture before vessel failure. Such failure would occur before steam generator tube or surge line failure.

For similar pressures, the NUREG-ll50 expert panel for the Zion plant considered that the surge line would fail with a probability of 0.72. The Palisades IPE analysts Millstone Unit 2 Back End 20 November 1995

3 l

assumed the following conditional creep rupture failure probabilities: Surge line-0.025, hot leg-0.402, steam generator tubes-0.0034, pressurizer core SRVs-0.475, and PCS remaining intact-0.095. For the high RCS pressure sequences, the San Onofre IPE analysts assumed that hot leg creep rupture was a ,

certainty before steam generator tube failure or vessel failure.

Early Containment Failure by DCH: 'Ihe MP2 IPE analysts used the results of experiments performed at Purdue University, which showed that, in high-pressure sequences, up to 98% of the ejected core debris may fragment and participate in DCH. MAAP calculations using best-estimate values showed significant pressure spikes from DCH (from 45 to 120 psid). Some MAAP sequences showed that hydrogen burns also would occur with DCH. For high-pressure sequences, the Palisades IPE analysts calculated a 1 % probability of containment failure as a consequence of DCH. (This analysis was performed before the results of the Purdue experiment we e available.) The San Onofre IPE analysts assumed that a small l fraction of the ejected debris could contribute to DCH (about 5% in a Zion-like cavity and even less at San Onofre).

Table 2. Containment Failure as a L. cage of Total CDF:

! Millstone 2 IPE Results Compared with the Zion NUREG-1150 PRA Results and with the Resuks of Other IPEs l Study CDF Early I. ate Bypass Isolation Intact

! (per Failure Failure Failure

! rx year) l Zion /NUREG-1150 6.2E-5 1.5 25 0.5 na 73 j Palo Verde IPE 9.0E-5 10 14 4 0' 72 l Palisades IPE 5.2E-5 32.5 15.1 5.5 0.4 46.3 l

San Onofre IPE 3.0E-5 0 9.4 6.7 0.07 83.8" q Millstone 2 IPE 3.4E-5 9.5 32.4 2.2 0.02 55.9 l

na not available i l Probability is less than 0.001, conditional on core melt Includes MCCI basemat penetration failures l

l

]

i As shown in Table 2, tb WP2 IPE team postulated a conditional probability of late

! containment failure of 32.4%, which is the highest compared with all of the other plants

.Minstone Unit 2 Back-End 21 November 1995 j l

l

listed in the table. De major contributors to the differences in late containment failure probabilities are as follows.

• Basemat Melt-through: MAAP simulations of the dominant MP2 PDSs showed that basemat melt-through would be the likely late containment failure mode for large i

LOCA sequences. MAAP predicted melt-through times of greater than 55 hours6.365741e-4 days <br />0.0153 hours <br />9.093915e-5 weeks <br />2.09275e-5 months <br /> after i accident initiation. He Palisades IPE analysts found that basemat melt-through l would not be a potential containment failure mode because, after vessel failure, debns I was expected to flow through 24-inch pipes connecting the reactor cavity sump to the j auxiliary building. Plant-specific scoping calculations at San Onofre showed that basemat melt-through would occur in the 16-to 24-hour range; and

• Flooding of the Reactor Cavity: The MP2, San Onofre, and Palo Verde cavities were not designed to permit them to be flooded by containment sprays; the Palisades cavity can be flooded, however.

2.3.3 Characterization of Containmmt Perfonnance.

As described in Section 2.2.2 of this report, the IPE team developed three CETs to characterize the MP2 containment pe.formance. Logic trees were developed to support each of the CET top events in addressing phenomenological issues as well as system-related questions and operator actions that influence severe accident progression.

Pjenomenological basic events contained within the various logic trees are listed in Section 2.3.1 of this report. He following are the system-related basic events contained within the various logic trees (Table 4.8-2, page 4-148):

• RWST is not injected; i

• AC power is not available or not recovered before vessel failure;

• AC power is not recovered after vessel failure;

• Low-pressure ECCS fails;

• High-pressure injection fails;

• I.ow-pressure injection fails;

• Alternate injection source does not work;

• Auxiliary feedwater fails;

• Large loss of coolant accident occurs;.

• LOCA occurs that causes a break greater than I half-inch but less than 2 inches in diameter;

• LOCA occurs that causes a break less than I half-inch in diameter,

• LOCA occurs that causes a break less than 2 inches in diameter;

• LOCA occurs that causes a break less than 6 inches in (ameter; Millstone Unit 2 Back-End 22 November 1995

y

• ContrJnment air recirculation fans fail at the initiation of accident;

• Containment sprays fail at the initiation of accident; and

• Containment isolation fails.

The following are the operator-action basic events contained within the various logic trees (Table 4.8-3, page 4-149):

• Cavity flange is not removed;

• Operator does not open pressurizer's PORV; and

• Operator does not open ADV.

Best-esthnate values of logic tree basic events are summarized in Table 4.8-4, pages 4-150 thmugh 4-164 of the submittal. The IPE team used MAAP calculations, hand calculations, and the results of other PRAs (e.g., NUREG-1150 study) in order to quantify the basic events. The probability values given for the basic events are between "0" and "1" and thus include event uncertainties. It appears that the MP2 IPE team has appropriately characterized containment performance for each of the CET end states.

11J Imnact on Equioment Behavior.

l NNECO's response to question 23 of the NRC staff's RAI indicated that the IPE team used MAAP to perform sensitivity studies of cases in which ECCS, pumps, CS pumps, and CAR fan coolers were not operable. [4] One reason for equipment unavailability might be the harsh environment in the Auxiliary Building resulting from severe core-melt accidents that lead to primary containment failure. Environmental conditions for the following key equipment qualifications were evaluated:

• CAR fan coolers (F-14A, F-14B, F-14C, and F-14D);

• Containment spray pumps (P-43A and P-43B);

• LPSI pumps (P-42A wJ P-42B);

• HPSI pumps (P-41A, P-41B, and 41C); and

• Auxiliary feedwater pumps (P-9A and P-9B for motor-driven pumps and P4 for the turbine-driven pump). j i

The submittal notes that the ECCS pumps, containment spray pumps, and feedwater pumps were located outside the primary containment and were therefore expected to be 1 operable irrespective of the harsh conditions inside the primary containment (with the exception of the case in which the primary containment failed). Because late containment 1 1

failure by basemat melt-through was the dominant containment failure mode, these pumps were expected to be operable for at least 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br /> before containment failure. j Millstone Unit 2 Back-End 23 November 1995 I

q M1 Uncaminty and Sensitivity Amtvses.

The MP-2 IPE team identified the following to involve significant uncertainty in the analysis of severe accidents: (1) the RCS pressure at the time of vessel failure and (2) the coolability of core debris following relocation to the reactor cavity (pages 4-185 thmugh 4-187 of the submittal). De IPE team performed the CET sensitivity analyses by varying the probability values of the key basic events of the logic trees related to the above.

To investigate the effect of RCS pressure. on the fmal results, the IPE team selected the basic event, "VSVFF-1," in which the " pressurizer PORV sticks open, given total loss of feedwater and no LOCA." A sensitivity calculation was performed after changing the event probability value from the base case value of 0.5 to zero. De results showed that the conditional probability of early containment failure had decreased from 9.7 % (in the best estimate CET quantifications) to 5.1 %. De conNeia=1 probability of late containment failure had increased from 33.1 % in the best-estimate CEr quantifications to 35.9 %.

To investigate the effect of the coolability of debris on the final result, the team selected the basic event, "V-FLANGE,"and two events that were related. In the V-FLANGE event "the cavity access tunnel door is not removed." In the related event, "VPHFF-CDB-37, "a coolable debris bed (CDB) does not form if an ex-vessel steam explosion (EVSE) is expected for a low-pressure sequence." In the related event, "VPHFF-CDB-38, "a CDB does not form if no EVSE is expe*~i for a low-pressure sequence."

The team performed a sensitivity calculation after changing the event probability values as follows.(from the base case value to the sensitivity case value): V-FLANGE - from 1.0 to zero, VPHFF-CDB from 0.5 to 0.1, and VPHFF-CDB 0.9 to 0.1. The results showed that a potential accident management strategy that allowed water to flow into the reactor cavity through the access tunnel would result in a coolable debris bed.

Having a CDB reduced the conditional probability of late containment failure from about 33.1 % (in the best-estimate quantifications) to about 23.5 %.

i In addition, the IPE team performed a sensitivity analysis using MAAP to determine the following related to the DCH phenomena:

• Time required for the bottom head to fail after contact with molten core debris, i.e.,"TTRX." For the base case calculations this time was set to 30 minutes. De l i

team found that any setting within the 15- to 30-minute range had no significant l

impact on the magnitude of the DCH phenomena. However, a TTRX set to 60 minutes caused a significant increase in DCH. De vessel failure pressure was sensitive to TTRX because of the occurrence of corium-coolant intenctions;

• Entrainment velocity multiplier, a number by which to multiply the Kutateladze criterion in order to represent the difficulty (greater than 1.0) or the case (less than 1.0) with which debris could be entrained from the cavity, "FENTR."

Millstone Unit 2 Back-End 24 November 1995

4 I

Using a value of 0.33 for this parameter did not have a large impact on the magnitude of the DCH phenomena;

• Initial radius of the RPV failure, "XRVPO." The IPE team considered this parameter to pose a large uncertainty at a plant like MP2, which has no bottom head penetrations. Using values of 5,15, and 30 cm for XRVP0 did not have a large impact on the magnitude of the DCH phenomena; and Fraction of the entrained corium mass assumed to be fmely fragmented and to interact completely with the containment air, "FCMDCH." The team calculated l a value of 1.0 for the maximum fragmentation and largest DCH effect. The  ;

FCMDCH parameter had the greatest, direct impact on DCH. Increasing it from the base case value of 0.10 to 0.25 increased the pressure at vessel failure by )

70 %. Increasing it funher to 1.0 resulted in a peak containment pressure of l 184 psig, well in excess of the containment capacity. j 2.4 Reducing Probability of Core Damage or Fission Product Release 2dl Definition of Vulnerability.

The licensee identified a potential reactor coolant pump thermal barrier tube mpture as a vulnerability. A modification to eliminate this vulnerability is planned in April of 1997 (Refuel Outage 13).

2dl Plant Imorovements. l i

In Section 6 the MP2 IPE submittal provides a discussion of plant improvements and unique safety features. As a msult of an earlier MP2 I.evel 1 PRA carried out in early 1990, the NUSCO staff discovered several design deficiencies. Six reportability evaluati.ons were initiated, three of which resulted in repons to the NRC. The submittal states that NNECO has since corrected all items associated with these deficiencies. The single most significant event that resulted in many plant changes was a panial loss of normal power event that occurred,during the 1992 refueling outage. The plant modifications implemented prior to plant restart after than incident resulted in a factor-of-2 mduction in CDF for internal events. No back-end-related plant improvements are reponed in the submittal.

2.5 Responses to Containment Peformance Improvement Program Recommendations One of the Containment Performance Improvement (CPI) Program recommendations that penains to PWRs with large, dry containments is that utilities evaluate their ccitainment and equipment vulnerabilities to hydrogen combustion (local and global) as part of their IPEs and that they identify the need for improvements in PWR procedures and equipment.

Millstone Unit 2 Back-End 25 November 1995

%g .

. . A l

l l

Section 4.4.12, pages 4-98 to 4-104 of the submittal, describes the phenomenological l l

evaluations of hydrogen combustion and detonation, which the IPE team performed for the MP2. Based on MAAP simulations and bounding analyses with conservative assumptions, the IPE team concluded that only by assuming 100% cin&hng oxidation could an early hydrogen burn challenge the containment integrity. He highest predicted l containment pressure rise from a hydrogen bum is 84 psia in case of main feedline break l (PDS TEFH1), which is well below the calculated 5th percentile containment failure l pressure of 102 psig. Based on the Shennan/Berman methodology, the MP2 IPE team l concluded that, for all accident sequences, the likelihood of deflagration to detonation l transition (DDT) is highly unlikely to impossible. De MP2 IPE team enti=*~i a l probability range of 0.001 to 0.01 that the containment would fail as the result of l l

hydrogen detonation. [7]

l  !

l Evaluation of the issue of global versus IWi=1 hydrogen burn in containment is )

l covered in Section 4.4.18, page 4-120 to 4-123 of the submittal. He submittal states that the open design of the MP2 containment prevents the formation of high hydrogen concentration pockets. A scoping analysis indicated that natural circulation mixes the

, containment atmosphere every 5 to 15 minutes. Derefore, it was concluded that global l hydrogen burns would be more prevalent than locali7ed burns in the MP2 containment.

l l 2.6 IPE Insights, Improvements and Commitments l

l The following are the major findings of the MP2 IPE, as stated in the submittal:

L l

• De IPE results show that the mean frequency of the plant damage state "TEH" l was 2.255E-5 per year, which would contribute approximately two-thirds of the l total MP2 mean CDF. This PDS was dominated (2.22E-5 per year) by transients with a total loss of feedwater (MFW and AFW), failure of feed and bleed operations, and by the availability of one train of containment spray;

• The containment analyses indicated that the MP2 containment is not vulnerable to early containment failures caused by hydrogen combustion, in-vessel steam l explosion, reactor pressure vessel rocket-type failure, ex-vessel steam explosion, or structural failure of the reactor cavity walls. For high-pressure core melt sequences, the only mode of early containment failure was shown to be due to high-pressure melt ejection and the associated DCH. The results show that the conditional probability of early containment failure was approximately 0.095, dominated by the DCH phenomenon. The MAAP code simulations of the dominant MP2 plant damage states indicated that the containment basemat melt-through was the dominant late containment failure mode for low-pressure sequences. De conditional probability oflate containment failure was approximately 0.32, dominated by the BMT phenomenon. He conditional probability of the MP2 containment remaining intact was 0.56; j

• ne MP2 containment ultimate pressure capability analysis identified three i containment failure modes, namely, liner tear at the purge air / main feedwater penetrations, basemat shear, and cylindrical hoop membrane failure, ne median Minstoee Unit 2 Back-End 26 November 1995

,o -

e failure pressure was approximately 150 psig, which is about 2.8 times the design pressure; the failure mode could be either liner tear or basemat shear. The lower bound failure pressure (5th percentile) was approximately 102 psig, which was most likely due to basemat shear. De submittal's comparison of MP2 results with those of an IPE performed at Calvert Cliffs showed similarities between the two containments, with the MP2 having a moderately larger ultimmte capacity for the three overpressurization failure modes;

• Some unique MP2 design features contribute significantly to the response of its containment to severe accident conditions as well as to its overall safety. For example, the MP2 containment heat removal system consists of four containment air recirculation fan units, separated into two let trains, and two trains of containment spmy. De success of the CHR during severe accidents would depend on the availability of either one of four CAR fans or one of two CS trains.

De MP2 steel door that covers the reactor cavity accessway would have two significant effects on containment response to a severe accident: (1) water on the lower compartment floor could not flood the cavity (and hence would reduce the likelihood of a failure as the result of an ex-vessel steam explosion), and (2) the accessway blockage would climinate a potential flow path between the lower l

compartment and the reactor cavity (and hence reduce heat and gas transfer out i from the cavity and containment overpressunzation in many low-pressure vessel failure and dry cavity sequences). De tight reactor cavity design reduces the likelihood of containment penetration tear-out by RPV dislocation during severe accidents. The containment basemat is fabricated from a basaltic concrete, which compared with limestone concrete, results in a minimal amount of noncondensible CO2 Eas during CCI. Also, the open design of the MP2 containment would prevent the formation of high hydrogen concentration pockets. Hence, global hydrogen burns would be more prevalent than lacalired burns in the M containment; and

• De licensee identified a potential reactor coolant pump thermal barrier tube rupture as a vulnerability. A modification to eliminate this vulnerability is i

planned in April of 1997 (Refuel Outage 13).

1 Millstone Unit 2 Back-End 27 November 1995 l

9,

3. CONTRACTOR OBSERVATIONS AND CONCLUSIONS The MP2 IPE submittal contains a substantial amount of information with regard to the recommendations of Generic Letter 88-20, its supplements, and NUREG-1335, and appears to be in accordance with the level of detail expected in NUREG-1335. The IPE methodology used is described clearly, as are the basic assumptions underlying the approach taken, which is consistent with the basic tenets of GL 88-20, Appendix 1.

Important plant information and data are well documented and the key IPE results and findings are, in general, well presented. The IPE team relied on MP2-specific data and scoping analyses as well as on the results from experiments sponsored by the CE Owners Group, and on insights from other PRA studies, i.e., NUREG-1150.

Although the IPE team used plant damage states to provide the interface between the front-end and back-end analysis, they paid an incomplete attention in understanding the results of the containment performance analysis in terms of the front-end initiator drivers. )

The IPE team did not include the frequency of "high" releases of Te accompanied with

" medium" releases of Csl in comparing with NRC safety goal for "large" release. This appears to be a weakness.

i ne key conclusions of the technical evaluation of the MP2 IPE back-end analysis are j summarized below:

I

• The submittal appears to be complete, comprehensive, generally well documented, and in conformance with the GL 88-20 and NUREG-1335;

• To perform the back-end analysis, the IPE team used state-of-the-art understanding and methods of addressing severe accident phenomena, and performed comprehensive plant-specific assessments of all of the potential containment failure modes identified in NUREG-1335. De results of the DCH experiments conducted at Purdue University, sponsored by the CE Owners Group, ,

together with MAAP simulations and scoping analyses, were used to address the MP2 carly containment failure caused by DCH phenomenon. Similarly, MAAP simulations and plant-specific scoping analyses were used to address the MP2 late containment failure caused by BMT phenomenon in accident sequences during which corium accumulates in the reactor cavity and the potential for corium-concrete interaction exists;

• As part of the back-end analysis, three CETs were developed that addressed plant and containment mitigating systems, post-core-damage operator recovery actions

~

and severe accident phenomenological issues such as CCI resulting in BMT, in-vessel and ex-vessel steam explosion, hydrogen combustion, and DCH. The CET top events in the MP2 IPE mostly were phenomena-related while the supporting logic (or fault) trees were a combination of phenomena- and safety-system-related events, as well as potential post-core-damage operator recovery actions. The IPE team performed plant-specific deterministic transient Millstone Unit 2 Back-End 28 November 1995

4 . l

' "f l calculations using MAAP, which they augmented using scoping analyses, probabilistic containment ultimate capability analysis (containment fragility 1 analysis), experimental results, and results from other studies. Engineering

judgment was used to quantify CETs and subsequently assess the containment I failure probabilities and the frequency of radionuclide releases. Phenomenological uncenainties were addressed through sensitivity studies performed with MAAP as well as using insights from other studies.

a 4

i I

i I

l l

Millstone Unit 2 Back-End 29 November 1995

9 l

4. REFERENCES

1. " Implementation of Safety Goal Policy." Nuclear Regulatory Commission.

SECY-89-102. March 30,1989.

2. She: man, M. and M. Berman. "The Possibility of local Detonations During Degraded Core Accidents in the Bellefonte Nuclear Power Plant," Nuclear Technology, Vol. 8, April 1988.

3. " Millstone Nuclear Power Station - Unit 2, Individual Plant Examination (IPE) for Internal Event." Northeast Nuclear Energy Company, December 1993.

4. " Millstone Nuclear Power Station - Unit No. 2: Request for Additional Information Conceming the Individual Plant Examination." Northeast Nuclear Energy Company. September 20,1995.

5. Comments Regarding the CEOG Report No. NPSD-917 on DCH. ,

Memorandum from R. Schneider, to D.' A. Dube and Y. F. Khalil, October 15, 1993. .

6. Kaiser, G. D. " Implications of Reduced Source Tenns for Ex-Plant Consequence Modeling and Emergency Planning." Nuclear Safety, Vol. 27, No. 3, i July-September 1986. l 1

7. " Development of Generic Positions on Selected Severe Accident Issues." CEOG Task 742 - Subtask 2, CE Report No. NPSD-767, December 1992.

l i

l l

l l

)

l

. i l ,

l Millstone Unit 2 Back-End 30 November 1995 ,

L_-. - -- _ .-.

.- . - -- . .- ~ - . . - . ..- -

.- . '. 9 APPENDIX IPE EVALUATION AND DATA

SUMMARY

SHEET PWR Back-End Facts Plant Name Millstone Unit 2 l

l Containment Type Large, dry Unique Containment Features The containment heat removal (CHR) system consists of four containment air recirculation (CAR) fan units, separated into two i_Wnt trains, and twb l

trains of containment spray (CS). The success of the CHR during severe accidents l would depen'd on the availability of either one of four CAR fans, or one of two

! CS trains.

De MP2 steel door that covers the reactor cavity accessway has two significant l

effects on containment response: (1) water on the lower compartment floor cannot flood the cavity (and hence reduces the likelihood of entering the ex-vessel steam explosion failure raode) and (2) the accessway blockage eliminates a potential flow path between the lower compartment and the reactor cavity (and hence reduces heat and gas transfer out from the cavity and containment overpressurization for l many low-pressure vessel failure and dry cavity sequences).

The tight reactor cavity design reduces the likelihood of containment penetration

tear-out by RPV dislocation during postulated severe accidents.

The containment basemat is fabricated from a basaltic concrete, which compared with limestone concrete, results in a minimal amount of noncondensible CO2 gas production during CCI.

He open design of the MP2 containment prevents the formation of high hydrogen concentration pockets, hence, global hydrogen burns would be more prevalent l than localized burns in the MP2 containment.

Unique Vessel Features

! De CE RPV design does not include any penetrations on the lower head. As j such, the cavity does not include an in-core instrument tunnel. The RPV fits tightly within the cavity (the bottom of the RPV is about 2 feet above the base of I. the reactor cavity).

Millstone Unit 2 Back-End A-1 November 1995

. a Number of Key Plant Damage States 29 Ultimate Containment Failure Pressure 150 psig (median or 50th percentile value) 102 psig (5th percentile value) t Additional Radionuclide Transport and Retention Structuns It appears that credit is given to the enclosure building filtration region (EBFR) and the enclosure building filtration system (EBFS) (see page 6-4 of the

! submittal).

l Conditional Probability That The Containment Is Not Isolated  !

l 0.0002 Important Insights, Including Unique Safety Features 1

Listed under Unique Containment Features I i

Implemented Plant Improvements No back-end related plant improvements are reported in the submittal.

C-Matrix * (Based on Table 4.9-8, page 4-191 of the submittal)

PDS CDF (per year) Early I. ate Intact Nonbypass events 3.335E-5 0.097 0.331 0.572 SGTR (bypasa)** 6.700E-7 0.076 0.924 0.00 ISLOCA (bypass) 6.600E-8 1.00 0.00 0.00

'

• A full C-Matrix, including all 26 nonbypass PD5s, can be ponerated from the results summari ed m Table 4.9-5, pages 4-188 and 4-189 of the submittal.

• • See Section 2.2.2 for a description of SGTR sequences.

f Millstone Unit 2 Beck-End A.2 November 1995

- .-