ML20128F441

TER on IPE Back-End Submittal

ML20128F441
Person / Time
Site:	Beaver Valley
Issue date:	08/31/1995
From:	Meyer J, Hanry Wagage SCIENTECH, INC.
To:	NRC
Shared Package
ML20128F445	List: ML20128F441 ML20128F469 ML20129H177 ML20129H300
References
CON-NRC-05-91-068-32, CON-NRC-5-91-68-32 SCIE-NRC-231-94, NUDOCS 9610080074
Download: ML20128F441 (43)

Text

___--

l l

l SCIE-NRC-231-94 l

1 BEAVER VALLEY UNIT 1 TECHNICAL EVALUATION REPORT ON TliE INDIVIDUAL PLANT EXAMINATION BACK-END SUBMITTAL l

\

l I

l H. A. Wagage

! J. F. Meyer l

l Prepared for the U.S. Nuclear Regulatory Commission

! Under Contract NRC-05-91-068-32

! August 1995 SCIENTECH, Inc.

l 11140 Rockville Pike, Suite 500 l Rockville, Maryland 20852 l

{

I 9610080074 960930 PDR ADOCK 05000334 p PDR

. _ - - . . _ _ - . - - _ , . - - - , -- , , - - . _ . _ _ _ , _ - - _ - _ . , . . - _ . _ _ . - . _ _ . . . . _ . . . . . - . . - ._. . _._.---,__m_

SCIE-NRC-231-94 BEAVER VALLEY UNIT 1 TECHNICAL EVALUATION REPORT ON THE INDIVIDUAL PLANT EXAhDNATION BACK-END SUBhDTTAL 4

H. A. Wagage J. F. Meyer Prepared for the U.S. Nuclear kgulatory Commission Under Contract NRC-05-91-%8-32 August 1995

! SCIENTECH, Inc.

l 11140 Rockville Pike, Suite 500 Rockville, Maryland 20852 i

f

(

TABLE OF CONTENTS P_i!!u E. EXECUTIVE

SUMMARY

. . ..... ..... .....................iv E.1 Plant Characterization . . . . . . . . . . . . . . . . . . . . . . . . . ..........iv E.2 Licensee IPE Process ......... ... ......................iv E.3 Back End Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iv E.4 Containment Performance Improvements (CPI)' . . . . . . . . . . . . . . . . . . . . . viii E.5 Vulnerabilities and Plant Improvements . . . . . . . . .. . . . . . . . . . . . . . . . . viii E.6 Observations . . . . . . . . . . . ..............................ix

1. INTRODUCTION ..........................................I 1.1 Review Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I 1.2 Plant Characterization ........................ .......... 1

2. TECHNICAL REVIEW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 2.1 Licensee IPE Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 2.1.1 Completeness and Methodology . . . . . . . . . . . . . . . . . . . . . . . . . 4 2.1.2 Multi-Unit Effects and As-Built As-Opera'.ed Status ............ 5 2.1.3 Licensee Participation and Peer Review . . . . . . . . . . . . . . . . . . . . 6 2.2 Containment Analysis / Characterization . . . . . . . . . . . . . . . . . . . . . . . . . . 7 2.2.1 Front-end Back-end Dependencies . . . . . . . . . . . . . . . . . . . . . . . 7 2.2.2 Containment Event Tree Development . . . . . . . . . . . . . . . . . . . . . 7 2.2.3 Failure Modes and Timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 2.2.4 Containment Isolation Failure . . . . . . . . . . . . . . . . . . . . . . . . . 10 Beaver Valley Unit 1 Back.End ii August 1995

s 1 TABLE OF CONTENTS (cont.)

Page 2.2.5 System / Human Response . . . . . . . . . . . . . ... .. . .. I1 2.2.6 Radionuclide Release Characterization . . . . . . . . . . . . . . . . . . . . . I1 2.3 Accid:nt Progression and Containment Performance Analysis . . . . . . . . . . . 14 2.3.1 Severe Accident Progression .........................14 2.3.2 Dominant Contributors: Consistency with IPE Insights . . . . . . . . . . 15 l

2.3.3 Characterization of Containment Performance . . . . . . . . . . . . . . . 17 1 2.3.4 Impact on Equipment Behavior . . . ....................20 2.3.5 Uncertainty and Sensitivity Analysis . . . . . . . . . . . . . . . . . . . . . 21 2.4 Reducing Probability of Core Damage or Fission Product Release . . . . . . . . 22 2.4.1 Definition of Vulnerability . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 2.4.2 Plant Improvements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 2.5 Responses to CPI Program Recommendations . . . . . . . . . . . . . . . . . . . . . 23 2.6 IPE Insights, Improvements and Commitments . . . . . . . . . . . . . . . . . . . . 23

3. CONTRACTOR OBSERVATIONS AND CONCLUSIONS . . . . . . . . . . . . . 27

4. REFERENCES ..........................................30 Appendix I

Besver Valley Unit 1 Back.End iii August 1995 i

i E. EXECUTIVE

SUMMARY

This technical evaluation repon (TER) documents the results of the SCIENTECH submittal-only review of the back-end ponion of the Beaver Valley Unit 1 (BV1) Individual Plant Examination (IPE) submittal.

E.1 Plant Characterization Similar to the Surry nuclear power plant, the Beaver Valley Unit 1 plant is a pressurized water reactor (PWR) with a 3-loop nuclear steam supply system, designed by Westinghouse and engineered and constructed by Stone and Webster. Both plants have steel-lined, reinforced-concrete, subatmospheric containments. The major difference between the two plants is that Surry Unit 1 is rated for 775 MWe, and BV1 is rated for 833 MWe. In addition, BV1 is similar to Beaver Valley Unit 2 (BV2). The NRC staff completed its safety evaluation repon on the BV2 IPE in May 1993. The BV1 containment cavity is not conducive to flooding.

E.2 Licensee IPE Process The Duquesne Light Company (DLC) pedormed the IPE with support from Pickard, Lowe and Garrick (PLG), Inc., and from the Stone and Webster (S&W) Engineering Corporation.

DLC reviewed the IPE in-house, in addition to and independent of the internal reviews conducted by PLG and S&W. The IPE team worked on site and panicipated in plant walk-throughs and inspections.

During the back-end analysis, the IPE team linked the Level 2 CET with the I.evel 1 event tees, quantifying all of the accident sequences from initiator to release category. The team used this quantification to analyze support systems and intersystem dependencies as well as to achieve the proper interface between the front-end and back-end analyses. Using this approach appears to have ensured that the suppon state conditions were properly accounted for throughout the front-end and back-end trees. '

l To quantify accident sequences, the BV1 IPE team used the computer code, RISKMAN, and the Surry NbREG/CR-4551 split fractions of top events and radionuclide release terms extensively. Although no plant-specific MAAP analysis was performed, the IPE team did l use the results reponed from the Beaver Valley Unit 2 (BV2) IPE, which were obtained using MAAP, Version 14. The IPE team used the msults of some of the MAAP sensitivity analyses performed for BV2. Because similar designs lead to similar MAAP input values, the team's application of the Unit 2 results appears to have been reasonable. The IPE team used a mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for the back-end analysis.

E.3 Back End Analysis For Beaver Valley Unit 1, the IPE team calculated the total core damage frequency (CDF) from internal initiators to be 2.13E-4 per reactor year. One of the imponant groups of sequences that led to this CDP was loss of offsite power (23.9 percent) followed by loss of Beaver Valley Unit 1 Back-End iv August 1995

i

-emergency AC power train (19.3 percent). The next three contributors in descending order of magnitude were partial loss of main feedwater (12.3 percent), total loss of river water (11.2 percent), and non-isolable small LOCA (5.6 percent).  ;

1 The containment event tree (CET) used in the Beaver Valley 1 plant IPE was similar to the l I

accident progression event tree used in the NUREG-1150 analysis of the Surry nuclear power plant. The IPE team reviewed each of the 71 top events identified at the Surc 91 ant for their applicability to the BV1 CET. After eliminating the events already contained in the BV1 plant damage states (PDSs) and combining several top events into single events, the IPE team identified 25 top events as applicable to the BV1 CET.

The BV1 CET was comparatively more detailed than the CETs used for many other IPEs. It integrated the systemic with the phenomenological aspects of severe accident progression.

The IPE team did not take human actions into account in the CET for one of the following reasons: either procedural guidance did not exist, or because human actions were explicitly modeled in the front-end analysis, or because systems that might require operator actions (e.g., fan coolers) were not considered. Through the CET top events, the BV1 IPE team was able to directly address phenomenological issues concerning hydrogen burn, direct containment heating, steam explosions, molten core concrete interactions, and steam /noncondensible gas pressurization.

Members of the IPE team did not perform a plant-specific stmetural analysis of th- BV1 containment. Instead, they compared and found that the design of the BV1 containment building was similar to that of the Surry I containment. In conducting the BV1 IPE, the team decided to use the Surry I containment failure distribution.

The BV1 IPE team used a dermition of early containment failure that was more conservative than the one used in the NUREG-1150 study. For BVI, early containment failure was defined as occurring before or within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of vessel breach. In the NUREG-ll50 study, it was defined as occurring before or within a few minutes of vessel breach. The IPE team dermed large radionuclide releases as those with a source term equal to or greater than the  ;

PWR-4 source term of WASH-1400 (releases of 9-percent iodine and 4-percent cesium).  ;

The total frequency for large, early containment failures or small bypasses for BV1 was 1.06E-5 per reactor year.

The results of the back-end analyses at BV1 showed the following contributors to ,

containment failure, given as a percentage of total CDF: early failure, 6.5; late failure, 43.4; containment bypass, 4.5; containment isolation failure,16.3; and intact containment, i

29.3. A modeling assumption that had a major impact on these results was that there was no in-vessel recovery after the initiation of core damage. By comparison, the Surry plant had a

~ 46.7 percent in-vessel recovery. Two of the containment characteristics that drove these contributors to containment failure were 1) the relatively small volume of the containment, making DCH and hydrogen burns more important, and 2) the high probability that the reactor cavity would be dry.

Beaver Valley Unit t Back End v August 1995

I The 16.3-percent CDF that the team calculated for containment isolation failures is relatively l high, e.g.,0.2 percent for the North Anna IPE and 1.0 percent for the Zion NUREG-1150 study. However. DLC has defined containment integrity conservatively: Containment l isolation failure size was assumed to be less than 3 inches in diameter. Because the BV1 containment is subatmospheric, larger openings were not expected to exist. This definition appears to be more conservative than that used in many IPEs where the diameter of the opening for containment isolation was assumed to be greater than 2 inches. At BV1 isolation failures were not excluded based on small size and openings up to 1/8 inch in diameter were investigated. The isolation failures found at BV1 were 2 inches and 1 inch in diameter. j During the IPES at other plants, an openin:; of diameter 2 inches or less did not cause containment isolation failure, whereas, at BVI, it did.

The small containment isolation failure plant damage states contributed so much to the CDF because the majority of the failures (96.2% of isolation failures or 15.5% of the total CDF, based on the saved sequence database) were due to emergency switchgear ventilation failure, which resulted in the guamnteed failure of all emergency power and, conseque itly, in containment isolation. The normally open reactor coolant pump (RCP) seal return line i requires AC power to close. Failure to isolate the RCP seal retum line was modeled as a failure of containment isolation.

The IPE team presented radionuclide releases in terms r,f 20 release categories and four major release category groups (RCGs), I through IV. The descriptions and percentile I

contributions to the CDF from RCGs were as follows: large, early containment failures and bypasses, 5.0 (1.06E-5 per year); small, early contaimnent failures and bypasses, 22.3; late containment failures, 43.4; and long-term containment releases (intact contamment), 29.3.

In most of the 4ccident sequences, the BV1 containment cavity stayed dry. Even in those sequences where the cavity was flooded, the IPE team argued that the contamment sprays were operational, making it less important that the aerosol was removed by the water pool overlying the melt. Therefore, in characterizing the BV1 source terms, the team members assumed that the cavity stayed dry during all of the accident sequences. (The presence of water in the cavity, however, was considered in calculating core-concrete interactions.)

BV1 has a smaller subatmospheric contamment than do other PWRs with large, dry containments. This makes the issue of hydrogen combustion more important for BVI. For example,40-percent oxidation of the core zircalloy would raise the molar concentration of hydrogen in the dry air of the BV1 contamment on the order of 10 percent, while 100-percent oxidation of zircalloy would raise the concentation on the order of 22 percent. In analyzing hydrogen combustion at BVI, the IPE team used assumptions more conservative than those used during the NUREG-1150 study of the Surry plant (e.g., members of the IPE team used a detonation limit of 12 percent compared with the 14-percent limit used in the Surry analysis). The IPE team assumed that hydrogen detonations would always fail the containment.

Containment failures at vessel breach caused by high-pressure melt ejection (HPME) were due in part to hydrogen combustion. The pressure rise in vessel breach represented the combined effects of blowdown, hydrogen burning, DCH, and steam explosion. The IPE Beaver Valley Unit 1 Back-End vi August 1995

-- -. . - - - - _ . . - - = . - - - - _ _ _ _ - - - . . . - - - - -

t j

i team assumed that large quantities of hydrogen would be available for combustion before and 1 after vessel breach. If this hydrogen had not burned before or at vessel breach and the l containment atmosphere was not inened by steam, there was a high probability that a bum 1 would occur in the "early" time frame, within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of vessel breach. Based o. 7 the lower flammability limit of 4 percent hydrogen the in air, the team assumed a probability of 0.965 l that an "early" hydrogen bum would occur if containment sprays were operating and no j HPME occurred at vessel breach. If debris was cooled and the containment sprays were operating, no significant source of additional hydrogen would be present in the early time frame, and bums were assumed to be unlikely. If an early hydrogen bum did occur, the 1 containment failure was assumed to be a certainty, i

~

The IPE team assumed that, if the debris was not being cooled, there was a 50-percent chance that there would be a hydrogen burn in the " late" time frame (more than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after j vessel breach) if the containment was inerted, i.e., sprays were not operating. If the j containment was not inerted (i.e., electrical power was available and sprays were operating)

and debris was not cooled, it was assumed that late hydrogen burns would occur. If the debris was being cooled and the containment sprays were operating, no significant source of.

i hydrogen would be present, and therefore late hydrogen burns would be unlikely.

Percentile contributions of hydrogen bum / deflagration-to-detonation transition to the various j release classes were reported as follows (page 58 of Dusquesne's response to the RAI): [3]

!

• 0.2 % of release category group (RCG) I - large, early containment failures and bypasses

• 0.0% of RCG II - small, early containment failures and bypasses

• 11.3% of RCG III - late containment failures.

It appears that the IPE team gave adequate consideration to the CPI Program recommendations on issues related to hydrogen combustion. The IPE team addressed hydrogen pocketing issues during the containment walkdown.

Based on the MAAP analysis performed in the BV2 IPE, the BV1 IPE team concluded that 4

induced steam generator tube mpture (ISGTR) was not a major concern for BVI. Team l members predicted that hot leg or surge line failure would occur during high-RCS pressure sequences prior to ISGTR.

i Early overpressurization of the containment was a major contributor to the early, large containment failure category at BVI. (For comparison purposes the major contributor to

such failures at the Surry plant was containment bypass). According to the submittal, direct containment heating, which is caused by high-pressure melt ejection, strongly influenced early overpressurization failure of the containment. A major reason for the strong influence 1 from HPME was a modeling assumption that did not allow for operator depressurization, thus increasing the likelihood of vessel breach at high pressure.

~

Beaver Valley Unit 1 Back-End vii August 1995 w - - - , ,-

E.4 Containment Performance Improvements (CPIs)

In response to Containment Perfomiance Improvement Program recommendations, the BV1 IPE team did the following:

• Visually inspected the containment geometry and openness and the location of potential ignition sources for combustible gases during the containment walkdown performed to gather information for the back-end vialysis 3 i

• Evaluated and found that the containment penetration seals were not vulnerable to thermal attack from hot combustion gases

• Addressed important issues regarding hydrogen generation and hydrogen combustion / detonation

• Analyzed the vulnerability of containment performance to hydrogen combustion using BV1 CET top events.

E.5 Vulnerabilities and Plant Improvements The IPE team identified a back-end improvement which was an enhancement to update procedures to depressurize primary and secondary systems. The existing EOPs at BV1 were not explicit for sequences where high head safety injection was unavailable. This improvement is to be considered in the BV1 Accident Management Program.

The IPE team identified two back-end plant vulnerabilities based on major contributors to large, early radionuclide releases. The first vulnerability involved phenomena leading to containment overpressurization during a core-melt sequence that included the,RCS blowdown, early hydrogen bums, and DCH. In this regarti, the IPE team identified several actions that could be taken to lower containment overpressurization: lower the RCS pressure before vessel breach, flood the reactor cavity, and establish debris cooling after vessel breach.

The second vulnerability that the team identified was containment bypass from interfacing  ;

system loss of coolant accidents (LOCAs) and steam generator tube ruptures (SGTRs).  !

Interfacing system LOCAs contributed 10.7 percent to the large, early releases compared with 77 percent for the Surry plant. This relatively low contribution resulted from there being only one interfacing system, the LHSI, located outside the containment at BV1. (The ,

RHR system is located inside the containment.) The SGTRs contributed 3.2 percent to the  !

large, early releases at BV1 compared with 10 percent for the Surry plant. 'Ihus, the combined contribution of interfacing system LOCAs and SGTRs to large, early releases at BV1 was 13.9 percent compared with 87 percent for the SurTy plant. Changes to plant procedures and training were being implemented to enhance the operator response to such sequences. For "LOCA outside the containment," the IPE team identified the importance of improving guidance to the operators on the key valve to close.

i Beaver Valley Unit 1 Back-End viii August 1995

E.6 Observttions SCIENTECH feund DLC treatment of radiological releases to be satisfactory and consistent witi- Generic Letter 88-20. SCIENTECH noted the following strengths in the BV1 IPE back-end analysis:

• In order to treat properly the dependencies between the front-end safety systems that are needed to prevent damage to the core, to the contamment system, and to the support systems that tie both together, the IPE team included all the active containment systems (e.g., quench and recirculation sprays, containment isolation) in the front-end trees.

• Containment event tree development and quantification in the BV1 IPE is very thorough, well presented, and in accordance with the level of detail requested in the GL 88-20 and NUREG-1335.

• It appears that the IPE team identified all relevant potential containment failure modes. All applicable containment failure modes that appear in Table 2-2 of NUREG-1335 were considered, i

~

Beaver Valley Unit i Back-End ix August 1995

1. INTRODUCTION 1.1 Review Process hus technical evaluation repon (TER) documents the results of the SCIENTECH review of the back-end ponion of the Beaver Valley Unit 1 (BV1) Individual Plant Examination (IPE) submittal. [1,3] This TER was prepared to comply with the requirements for IPE back-end reviews of the U.S. Nuclear Regulatory Commission (NRC) in its contractor task orders, and adopts the NRC review objectives, which include the following:

• To help NRC staff determine if the IPE submittal provides the level of detail I requested in the " Submittal Guidance Document," NUREG-1335 l l

• To help NRC staff assess if the IPE submittal meets the intent of Generic letter 88-20 j l

• To complete the IPE Evaluation Data Summary Sheet In October 1994 SCIENTECH delivered a draft TER for the back-end ponion of the BV1 IPE submittal to the NRC. Based in pan on this draft submittal, the NRC staff submitted a Request for AdditionalInformation (RAI) to Duquesne Light Company. Duquesne Light Company responded to the RAI in a document dated March 10, 1995. This final TER is based on the original submittal and the response to the RAI.

Section 2 of the TER summarizes SCIENTECH's review and briefly describes the BV1 IPE submittal, as it pertains to the work requirements outlined in the contractor task order. Each ponion of Section 2 corresponds to a specific work requirement. Section 2 also outlines the insights gained, plant improvements identified, and utility commitments made as a result of the IPE. Section 3 presents SCIENTECH's overall observations and conclusions.

References are given in Section 4. The appendix contains an IPE evaluation and data summary sheet.

1.2 Plant Characterization Similar to the Surry nuclear power plant, the Beaver Valley Unit I plant is a pressurized '

water reactor with a 3-loop nuclear steam supply system, designed by Westinghouse and engineered and constmeted by S&W. Both plants have steel-lined, re'mforced-concrete, subatmospheric containments. The major difference between the two plants is that Surry Unit 1 is rated for 775 MWe, and BV1 is rated for 833 MWe. 'Ihe BV1 containment data and design description are provided in detail in Section 4.1 of the IPE submittal. The principal design parameters and characteristics of the BV1 containment are summarized and compared with their Surry Unit I counterpans in Table 4.1-1 of the submittal.

The BV1 containment building is a steel-lined concrete shell with a venical cylinder, a hemispherical dome, and a flat base. The flat base is 10 feet thick and suppons the cylinder and the cylindrical dome. The cylinder is 4 feet, 6 inches thick and 122 feet,1 inch high, and is covered with a 3/8-inch-thick steel liner. The 2-foot,6-inch-thick dome has a 63-foot radius and is covered with a 1/2-inch-thick steel liner.

Beaver Valley Unit 1 Back-End 1 August 1995

Table 1 compares the key design features of the BV1 plant containment systems wi;h those of

! the Nonh Anna and Surry plants. This comparison indicates that all three containment i systems are similar. (The Containment Capacity Measure for BV1 is smaller than it is for ,

Nonh Anna and Surry. But the difference in values (1.75 for BVI, and 1.85 each for the other two) does not indicate that the BV1 containment is less robust than the North Anna or Surry containments.) In addition, the BV1 containment includes the following imponant features:

• The reactor vessel is surrounded by an annular neutron shield tank, surrounded by the concrete primary shield wall. A gap of 2-3/4 inches between the reactor vessel and shield tank permits water drainage from the refueling tank to the reactor cavity. The water in the containment proper would have to rise to a level of 14 feet,7 inches, before it would overflow to the cavity through the instmment tunnel. Conversely, water that entered into the cavity from the refueling tank would be unavailable for i recirculation until the cavity and instn ment tunnel were fdled to a level of 16 feet, 7 inches, above the cavity floor.

• As noted above, the BV1 reactor vessel is supponed by the shield tank, which, in turn, is supponed by a steel suppon skin. An annular ring of steel-clad lead shielding surrounds the skin. During a severe accident involving a release of molten core into the cavity, heating of the cavity atmosphere could melt the lead shield and add up to 100,000 lbm of lead to the melt pool on the cavity floor.

• The upper floor cf the containment has many openings that permit containment spray water to drain to the bottom floor of the containment and to the sump. The opening to the sump is protected by large venical bars, a coarse mesh screen, and a fine mesh screen.

• The BV1 containment fan coolers do not perfonn a safety functionc They trip on a safety signal and therefore are unavailable in response to most accidents.

• The configurations of stmetures and of equipment inside the containment were found l to be conducive to good air circulation. The steam generator, pressurizer cubicles, and most companments within the containment are open at their tops to the general containment atmosphere.

1 l

I Beaver Valley Unit i Back-End 2 August 1995 .

)

Table 1: Summary of Key Plant and Cont:inm:nt Design Features for the Beaver Valley Plant i

Characteristic Nonh Anna Surry Beaver Valley 1 Thermal Power, MWt 2,893 2,441 2,652 i RCS Water Volume, m' 282 260.6 259 Containment Free Volume, m' 51,680 49,000 49,800 (ft') (1.83E6) (1.73E6) (1.76E6) {

Mass of Fuel, kg 82,160 79,637 -82,179 Mass of zircalloy, kg 17,108 16,463 17,338 Mean Failure Pressure, psia 143 141 141 Containment Capacity Measure" 1.85 1.85 1.75

• Containment Capacity Measure = IContainment Free Volume. ft'l x IMean Failure Pressure, esisi x 10

[ Mass of Fuel, kg) x [ Mass of zircalloy, kg]

Beaver Valley Unit 1 Back-End 3 August 1995 .

2. TECIINICAL REVIEW In conducting the " submittal only" review, SCIENTECH compared the Beaver Valley Unit 1 IPE submittal with the requirements of Generic Letter (GL) 88-20 and its supplements, using guidance provided in NUREG-1335. In presenting our review nndings we used the stmeture of Task Order Subtask I and followed the key requirements of the GL and its supplements.

Inconsistencies between the BV1 IPE and other probabilistic risk assessment (PRA) studies in terms of the methodology used and the results obtained are noted, and the BV1 IPE strengths and weaknesses are identined. I 2.1 Licensee IPE Process J

2M Completeness and Methodology. ,

The BV1 IPE submittal contains a substantial amount of information in accordance with the requirements of GL 88-20, its supplements, and NUREG-1335. The submittal appears to be ,

, complete and to provide the level of detail requested in NUREG-1335.

The methodology used to conduct the IPE at BV1 is described clearly in the submittal and the approach taken is consistent with the basic tenets of GL 88-20, Appendix 1. This approach and the basic assumptions underlying it are described clearly. The imponant plant information and data are well documented and the key IPE results and findings are well presented.

The containment event tree (CET) used in the Beaver Valley 1 plant IPE was similar to the j accident progression event tree used in the IRTREG-Il50 analysis of the Surry nuclear power plant. The IPE team reviewed each of the 71 top events identified at the Surry plant for their applicability to the BV1 CET. After eliminating the events already contained in the BV1 plant damage states (PDSs) and combining several top events into single events, the IPE ~

team identified 25 top events as applicable to the BV1 CET (excluding the entry state top event).

The entry state to the CET was either a PDS or a Level 1 event tree. The Ixvel I core damage frequency (CDF) sequences were binned into several PDSs with similar challenges presented to the containment. After considering plant conditions, systems, and features that can have a signincant impact on the potential course of an accident, the IPE team identined a total of 640 possible PDSs. This number was later reduced to 143 by eliminating some combinations of some PDS characteristics. Because of this large number, the IPE team found that it was more convenient to quantify the level 2 CET by physically Imkmg it to the Level I event trees and quantifying the entire accident sequence frequencies from initiator to release category.

This quantification was applied to analyze support systems and intersystem dependencies as well as to achieve the proper interface between the front-end and back-end analyses. Using this approach appears to have ensured that the suppon state conditions were properly accounted for throughout the front-end and back-end trees. However, it is not easy to trace Beaver Valley Unit 1 Back-End 4 August 1995

_ _ . .__ ~ _ _ _._.___._._ __._ _ _ _.__ _._.-_ _ _

L  !

4 and review the results obtained from a very large integrated risk model involving a very .

large number of accident sequences.

l To quantify accident sequences, the BV1 IPE team used the computer code, RISKMAN, and i the NUREG/CR-4551 split fractions of top events and radionuclide release terms extensively.

j Although no plant-specific MAAP analysis was performed, the IPE team did use the results reported from the Beaver Valley Unit 2 (BV2) IPE, which were obtained using MAAP,

~

- Version 14. Because similar designs lead to similar MAAP input values, the team's application of the Unit 2 results appears to have been reasonable.

4

] The BV1 IPE team defined early containment failure as that occurring before or within 3 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of vessel breach. This definition is different from the one used in the NUREG-ll50 study in which the early containment failure of a pressurized water reactor (PWR) was defined as occurring ber ore or within a few minutes of vessel breach. Therefore, some l containment failures that were considered early during the BV1 IPE would be binned as late

! under the NUREG-1150 definition. The BV1 IPE team used a 24-hour mission time in its

analysis. j

2.1.2 Multi-unit effects and As-built. As-ooerated Status.

1

! Beaver Valley Units 1 and 2 have containment buildings that are very similar in design and j function. Therefore, in developing the Unit 11.evel 2 back-end analysis model the IPE team j used the same logic and some of the split fraction values of the ,back-end model used for j Unit 2.

I The Beaver Valley Unit 1 IPE team was located on site and participated in plant walk-throughs and inspections. The team did a 1-day plant familiarization walkthrough in 4

November 1988 and, for purposes of Unit I back-end analysis, a half-day containment walk-i through in September 1989. During the back-end containment walkthrough, the IPE team l

members made a general inspection of the geometry and " openness" of the contamment and of the location of potential ignition sources for combustible gases. 'Ihey focused specifically j on the following:

l-

• Configuration of the reactor cavity and instmment tunnel ,

!

• Pathways to and location and configuration of the containment sump

• Equipment hatches and personnel air locks

• Containment penetrations (Section 4.1.2.1, pages 4.1-2 and 4.1-3).

j Before the walkthrough, the team compared the BV1 with the BV2 and Surry Unit 1 4

containment designs to identify any design conditions that could cause the BV1 containment

! to behave differently if subjected to high pressure and temperature. In addition, the l Duquesne Light Company independent review team verified that the models reflect actual 1

plant design and operation. It appears that the BV1 containment-specific features were modeled.

Beaver Valley Unit 1 Back-End 5 August 1995 5

T

- - - - . . - - - , , ,m . ..--, r,.-- r -y v v. , . .- - w

. _ . _ . _ . _ _ . _ _ - _ . _ _ _ _ _ . = _ _ . _ . _ _ . , _ _ _ . . _ .__________.s i

J I 2.13 Licenste Panicipation and Peer Review of IPE.

i l In 1988, DLC initiated plans to develop PRAs on BV1 and BV2. The nuclear engineering 2

depanment was responsible for developing the technical capability to complete the PRAs with suppon from Pickard, lowe and Garrick (PLG), Inc., and from the Stone and Webster j (S&W) Engineering Corporation. To gain in-house knowledge and maximize the benefit from

! performing PRAs, the DLC did the following (Section 5.1, page 5.1-1 of the submittal):

l

• Became involved in all aspects of the BV2 PRA. With support from PLG and S&W, ,

i DLC developed the technical capability to perform PRAs, and updated the BV2 PRA to use plant-specific data and reflect plant changes made in 1990 and 1991.

l

• Led the BV1 PRA team, based on knowledge gained in performing the BV2 PRA.

i * ~ Performed reviews of both PRAs, in addition to and independent of the internal

!- reviews conducted by PLG and S&W.

l

• Understood both PRAs in sufficient detail to be able to present and use their results l

i with minimal suppon from PLG and S&W.

I In suppon of the BV1 PRA, the Engineering Analysis Assurance (EAA) group pmvided

. interface with other DLC depanments to ensure that assumptions were correct about plant j design and capabilities, success criteria, and the implementation of emergency operating

! procedures. DLC involvement included the following:

i j

• Three DLC engineers panicipated in the BV2 containment walkthrough and later the

' BV1 walkthough in suppon of the Level 2 "Back-End Analysis."

• DLC EAA engineers developed the MAAP input parameter file and ran cases with j suppon frpm S&W.

!

• DLC training and operations personnel reviewed the important operator actions and j provided input to the quantification and accuracy of human actions, f

• DLC prepared the BV1 IPE submittal.

The DLC independent review team included personnel selected from certain depanments in l

j order to provide specific knowledge of BV1 plant design, system configuration, and operating procedures. The IPE team responded to comments and recommendations from PRA team members, supporting depanmental personnel, and DLC independent review team l

members on a continual basis. The DLC independent review verified that the model reflected actual plant design and operation. 'Ihe review also enhanced awareness and j j knowledge of PRA throughout the DLC organization.

It appears that DLC involvement in the IPE was significant and that the IPE received ,

adequate internal and external peer reviews.

] l 6 August 1995 Beaver Valley Unit 1 Back-L;d 2

I I

n. + - - - , , . . ., - - - . . . . . - . . :.--., ,

2.2 Containment Analysis / Characterization W Front-end Back-end Dependencies.

As described in Section 2.1.1 of this repon, the IPE team developed PDSs which were used for purposes of presentation and understanding only, and not for the CET analysis. In selecting the entry conditions to the CET analysis, the team chose the Level I trees. The submittal notes that this linking of level 2 CET directly to the level I trees (Section 4.5, 1 page 4.5-1):

i greatly facilitztes the treatment of dependencies between I.evel 1 and I.evel 2 events, thus satisfying the ' cross-checking' concerns raised by the NRC in NUREG-1335.

In order to treat properly the dependencier between the front-end safety systems that are I needed to prevent damage to the core, to the containment system, and to the suppon systems that tie both together, the IPE team included all the active containment systems (e.g., quench and recirculation sprays, containment isolation) in the front-end trees. It appears that the IPE team's treatment of front-end back-end interface dependencies was complete and in accordance with the level of detail requested in NUREG-1335.

W Containment Event Tree Development.

The BV1 IPE model consisted of a directly linked set of system event trees (front-line and suppon) and containment event trees: each accident sequence was treated from the initiating j event to the release of radionuclides. The probabilistic quantification of severe accident progression was performed using the containment event tree approach. The CET was used i to map out the possible containment conditions affectirv 'Se radionuclide releases associated with a given core damage sequence (or class). The BV1 IPE team used a detailed CET, I which integrated systemic with phenomenological aspects of severe accident progression. l The team did not take human actions into account in the CET for one of the following I reasons: either because procedural guidance did not exist, or because human actions were explicitly modeled in the front-end analysis, or because systems that might require operator actions (e.g., fan coolers) were not considered, as described in Section 2.2.5 of this repon.

The IPE team reviewed each of the 71 top events used in the NUREG-ll50 study of Surry for their applicability to the BV1 CET. After eliminating events already contained in the BV1 PDSs and combining several top events into single events, the team identified the following 26 top events as applicable. These include the entry state top event (no.1).

• 1. Dummy event or PDS (IE)

• 2. Core damage state at the end of 1.evel 1 trees (SS)

• 3. Failure to arrest core damage and prevent vessel breach (CP)

• 4. Contamment bypass prior to core duage (BY)

• 5. I.arge bypass prior to core damage (BL)

6. Induced PORV failure (LS)

7. RCP seal LOCA (SP)

• 8. Induced steam generator tube rupture (IS)

Beaver Valley Unit 1 Back-End 7 August 1995

48 i-o 9. Induced RCS hot leg or surge line failure (IP) 3

• 10. RCS pressure at vessel breach (RP)

'

• 11. Containment failure prior to vessel breach (Cl)

• 12. Large containment failure prior to vessel breach (LI) 3

• 13. In-vessel steam explosion that fails containment (AP)

• 14. High-pressure melt ejection (ME)  ;

15. Containment failure at vessel breach (C2)

• 16. Large containment failure at vessel breach (L2)  ;

• - 17. Hydrogen burn within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of vessel breach (HE) 4

• 18. Contamment failure due to early hydmgen burn (CE) l

-* 19.- Large containment failure from early hydrogen burn (LE) r *

20. Failure to cool debris (DC)

• 21. Late bum of combustible gases (H3) ,

22. Late containment failure due to burn (C3)

• 23. Large, late containment failure due to hydrogen burn (L3) i 4

• 24. Long-term overpressurization (C4)

{

• 25. Long-term overpressurization that causes large containment failure (L4)

!

• 26. Basemat penetration (BI)

Top Event 1 involved the entry state from the Level 1 trees. Top Events 2 and 3 involved degraded core recovery, where core cooling is recovered after the core is degraded or has melted, but before the vessel is breached. Degraded core recovery was limited mainly to ,

core damage phases before significant core relocation to the bottom of the vessel occurred. l Top Events 2 through 12 involved the analysis of phenomena that occurred while the core was contained inside the vessel. Top Events 13 through 20 involved the analysis of  ;

phenomena that occurred immediately after vessel breach and lasted until debris quenching or dryout occurred. Top Events 21 through 26 involved the analysis of phenomena that occurred over the long term, after the quenching or the drying out of the debris. As seen in the above list, the BV1 CET included phenomenological questions as CET top events if they  ;

addressed one of the following issues (Section 4.5-1, page 4.5-2):

• Definition of a safe, stable state for the debris configuration either in-vessel or in the ,

containment

• Dependencies of later top events in the CET, such as RCS pressure at vessel breach,  ;

high-pressure melt ejection, hydrogen bum, basemat melt-through l I

• Containment failure events and failure modes. l l

Phenomenological issues concerning hydrogen burn, direct containment heating, steam explosions, molten core concrete interactions, and steam /noncondensible gas pressurization were addressed directly by CET top events. Split fraction values for CET top events reflected finite probabilities of different paths and thus they included uncertainties. A I detailed description of split fractions is given in Table 4.6.4, pages 4.6-32 through 4.6-41 of the submittal. (See Section 4.6.3 of the submittal for quantification.) j Beaver Valley Unit 1 Back End 8 August 1995 l 1

t Containment event tree development and quantification in the BV1 IPE is very thorough, '

. well presented, and in accordance with the level of details requested in the GL 88-20 and NUREG-1335.

2.2.3 Containment Failure Modes and Timine.

l The IPE team compared the design of the BV1 containment building with that of the Surry 1

containment to determine if the containment failure distribution identified for Surry could be l applied to BV1 with a high degree of confidence. A summary of this comparison is given in l Table 4.1-1, pages 4.1-9 through 4.1-16 of the submittal, and details are given in Table 4.1-2, pages 4.1-17 through 4.1-42. The comparison focused on propenies that would

affect the relationships among pressure, tempenture, and containment integrity. In

! panicular, the following design attributes were analyzed:

• Containment geometry

• Material propenies

• Rebar quantities and pattern

• Liner thickness

• Hatches and penetration configurations

• Calculated and actual pressure test data.

Based on this comparison, the IPE team concluded that, despite some minor differences, the BV1 and Surry containments were similar. Because the density of the rebar was somewhat higher in some areas of the BV1 than in the Surry I containment, the team conservatively applied the SurTy I containment failure distribution in conducting the BV1 IPE. This application of the Surry failure distribution to BV1 appears to have been reasonable.

The mean containment failure pressure for Surry as found in the NUREG-1150 study is 126 psig.

I The IPE team analyzed the following three failure mechanisms: containment penetration l leakage, reactor pressure vessel suppon failure, and containment failure modes associated I with anticipated transients without scram (ATWS) events. The team assessed the nonmetallic l seals used for large containment penetrations of BV1 (personnel air lock, equipment hatch, l and emergency air lock) and found that the seals were similar to those of the Surry plant. l

'Ihe submittal notes that the seal material used for BV1 is the EPDM compound. Based on the findings reponed in NUREG-1037 [4), the team concluded that large containment  ;

penetrations would not be a significant source of containment leakage.  !

A shield tank suppons the BV1 reactor vessel at the primary loop nozzles and transfers

- venical loads down through a skirt to the containment mat. As the result of accident ,

sequences involving vessel melt-through, the base of the skin would temporarily contain  ;

debris and would be likely to fail in the event of thermal attack by debris. The team investigated and determined that containment breach would be unlikely as the result of the RPV support failure.

Beaver Valley Unit I back End 9 August 1995

The IPE team considered severe accident sequences in which the size of the reactor coolant pressure boundary (RCPB) significantly exceeded the double-ended rupture of the largest coolant pipe that constitutes the emergency core cooling system (ECCS) design basis. For large, dry containments, the submittal notes, the containment pressure response to such events, referred to as " excessive LOCAs," was within the design basis. Therefore, the team focused on other containment failure modes. The main contributors to excessive LOCAs at BV1 were ATWS events involving the failure of primary system pressure relief. The team focused on the three weakest elements of the RCPB (control ' >d drive housing and bolts, residual heat removal gate valve, and reactor coolant pump casing and bolts) and found that such containment failures were unlikely. The submittal notes that, for BVI, the residual heat removal system was entirely within the containment so that failure of the gate valve disk would not lead to containment bypass.

It armars that the IPE team identified all relevant potential containment failure modes. All applicable containment failure modes that appear in Table 2-2 of NUREG-1335 were considered.

2.2.4 Containment Isolation Failure.

In the BV1 IPE, containment isolation (CI) was modeled in the front-end analysis. CI was the last top event of the front-line event trees for the transient /small LOCA, medium LOCA, and large LOCA. This top event questioned the failure to create and maintain an isolated containment following safety injection and CIA and CIB signals. The following containment penetrations were modeled (page 3.1-70 of the submittal):

• Containment major vents and dmins, e.g., sump pump discharge

• Connections to RCS, e.g., RCP seal water return

• Connections to containment atmosphere, e.g., containment vacuum line.

This top event also modeled the operator actions to ensure that isolation valves remained closed after the CIA and CIB signals were reset. Manual isolation of the RCP seal return line during a loss of vital AC was also modeled in this top event.

Containment isolation failure size was assumed to be less than 3 inches in diameter. Because the BV1 containment is subatmospheric, larger opnings were not expected to exist. This definition appears to be more conservative than that used in many IPEs where the diameter of the opening for containment isolation was assumed to be greater than 2 inches. At BV1 isolation failures were not excluded based on small size and openings up to 1/8 inches in diameter were investigated. The isolation failures found at BV1 were of 2 inches and 1 inch in diameter. At other plants, an opening of diameter 2 inches or less did not cause containment isolation failure, whereas, at EV1, it did.

Containment isolation failures contributed to 16.3 percent of the total BV1 CDF (or 3.48E-5 per year) (Table 1-3, page 1.4-7). This value is significantly higher than values resulting 3

from other PRAs, e.g.,0.2 percent for the North Anna IPE and 1.0 percent for the Zion Beaver Valley Unit 1 Back-End 10 August 1995

NUREG-ll50 study. The reason that the small containment isolation failure plant damage states contribute so much to the CDF is because the majority of the failures (96.2%, based on the saved sequence database) are due to the emergency switchgear ventilation failure (15.5% of the total CDF), which results in the guaranteed failure of all emergency power and consequently, containment isolation. The normally open reactor coolant pump (RCP) seal return line requires AC power to close. Failure to isolate the RCP seal return line was modeled as a failure of containment isolation.  ;

I W System / Human Response. i The BV1 IPE back-end analysis did not include human interaction events for the reasons  !

given below:

i

• Operator depressurization before core damage was addressed in the front-end f analysis. Operator depressurization after core damage was outside the scope of l existing emergency procedures and was left for consideration under accident  ;

management (No. 5, page 4.5-11).  ;

AC power recovery was not included in the CET because procedural guidance after core damage was unavailable (page 4.6-10; no. 45, page 4.5-16).  :

Status of the quench sprays system and of the recirculation spray system was determined in the I.evel 1 model and not explicitly treated as a CET top event. l Recirculation fan cooling system was not designed to operate under severe accident  !

conditions and therefore its status was not included as a CET top event. i In those accident sequences where the loss of emergency switchgear ventilation led to a station blackout, the IPE team did not take credit for operator actions taken to manually isolate the containment building. However, the team did take credit for operator actions in the case of an SBO that resulted from the loss of the offsite power initiator and where both emergency AC power trains failed. (Section 4.8.2). For BVI, containment isolation failure was responsible for 72 percent of the suiuences that made up Release Category Group II (small, early containment failures and bypasses). The submittal notes that containment isolation failures might be reduced if the operators were allowed to manually isolate the containment building following failures of the emergency switchgear ventilation.

2.2.6 Radionuclide Release Catenories and Characterization.

The IPE team developed release categories, which are groups of CET end states that can be represented by similar source terms. The variations in source terms for accident sequences within one release category are smaller than the variations from one release category to another. The team considered the following elements and their states of condition in terms of how they might affect the definition of release categories for la.ge, dry PWR containments (Table 4,7-1, pages 4.7-11 and 4.7-12):

=. 1 Beaver Valley Unit 1 Back-End 11 August 1995

I 1

• _ Containment bypass (e.g., yes, no)  !

o 2

• RCS pressure (e.g., high, moderate, low)

{

• Time of containment breach (e.g., preexisting (i.e., before core degradation), early, j late)  ;

i l

• Size of containment breach (e.g., large, small)  ;

l

• Iocation of containment breach (e.g., through auxiliary building, outside auxiliary '

building, basemat melt-through, induced containment bypass)

]

4

* . Spray system (e.g., available through the accident, partially available (i.e., up to the j time of containment failure), not available)  ;

• Reactor cavity (e.g., wet, dry)

Separate release categories were assigned for the BV1 containment bypass. In considering the effect of the above on BVI, two high-levet simplifications were made (pages 4.7-1 and 4.7-2):

• 1. The issue of the presence of water in the cavity was eliminated in the definition of release categories based on the following: ,

- Any or all of the following conditions could add water to the cavity:

Operation of quench spray pumps before vessel failure Presence of water in the vessel lower head, or accumulator discharge (if the reactor pressure was sufficiently high to prevent discharge) after vessel failure Failure of the shield tank after vessel failure.

However, the amount of water that would be_added to the cavity in any of these cases would not be sufficient to keep the core debris covered for more than a few hours. If the low head safety injection (UISI) pumps or the two RSS pumps l lined up for vessel injection continued to run after vessel failure, water would be l present in the cavity. 'Ihe submittal states that this situation would occur after a j successful quench and recirculation spray operation and lineup for vessel )

injection, but with ECCS failure. Because the spray operation would scrub the l aerosols generated by core-concrete interaction, it was less important for the source term whether the cavity was ." wet" or " dry." Thus, the issue of the presence of water in the cavity was eliminated.  :

• 2. Based on ANS study results, [2] the IPE team decided to combine " preexisting" and "early" containment failures.

Beaver Valley Unit i Back End 12 August 1995

In addition, the IPE team made several other simplifications as described and presented in detail in Section 4.7.1.2. The simplineations of release categories appear reasonable. A total of 17 release categories were developed, excluding the three release categories for bypass sequences. The source terms for these categories were determined based on the following (Section 4.7.2.1, page 4.7-5):

• Review of Surry analyses

• Adaptation of existing Surry source terms to appropriate BV1 release categories

• - Development of the source terms for BVI release categories for which Surry analysis did not exist or for which there were several analysis with differing results.

In all cases (except intact containment cases), the team assumed a 100-percent noble gas release. For a major fraction of release categories, the source terms were based on the results of several existing analyses (BMI-2104, BMI-2139, NUREG/CR 5082, NUREG-09.58 Draft, NUREG/CR-4828, NUREG-0956, and an ANS repon). For other release categories, the source terms were determined from a limited number of analyses (primarily draft NUREG-0956) and from source tenns for similar release categories using conelation factors to account for the effects vi the following: operation of sprays for early containment failures, containment failure timing (early or late), and minimum limit of iodine release. The IPE team used a significant amount of available data for source term quantification. This application of available results to BV1 appears to have been reasonable and consistent with the requirements of GL 88-20.

Table 4.7-7, page 4.7-18, lists the characteristics of the 21 BV1 release categories, and Table 4,7-10, page 4.7-32, lists the release fractions of 20 release categories, excluding Release Category 21, which involved sequences with containment intact, in, terms of I (CsI),

Cs (CsOH), Te, Ba/Sr, and 12. Release energies and release timing (start ' time and duration) for these release categories are given in Sections 4.7.2.2 and 4.7.2.3 of the submittal, respectively.

NUREG-1335 sets out reponing guidelines for systemic sequences, which stipulate that "all systemic sequences within the upper 95% of the total containment failure frequency" be reponed to the NRC. However, arguing that late containment failures have much less potential than early ones for posing a threat to public health, the IPE team decided not to repon late containment failures and instead reponed the top 100 sequences for each of the following:

• Release Category Group I : large, early containment failures or large bypasses with source terms equal to or greater than the PWR-4 source term of WASH-1400 (releases of 9% iodine and 4% cesium) ~

• Release Category Group II: Small, early containment failures or small bypasses with source terms less than the PWR-4 source tenn of WASH-1400.

Beaver Valley Unit 1 Back-End 13 August 1995

7 I

2.3 Accid:nt Prcgressi:n end Centainment Performance Analysis.

1 I

Lil Severe Accident Proeression.

f Section 4.6.2 of the submittal describes the analyses of accident progressions that were performed as part of the BV2 PRA and that are applicable to the BV1 IPE. The probabilities of induced steam generator tube rupture (ISGTR) or induced hot leg failure before vessel breach from fast SBO scenarios with reduced coolant pump seal leakage were assessed at BV2 using temperature and pressure data obtained using the MAAP computer code (Version 14). Being a plant of similar design, BV1 has a similar MAAP input file. A major difference, however, is that the BV2 steam generator inventory was 28% larger than the 3

BVI. This larger inventory extended the time to steam generator dryout by cbout 0.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> (at BVI, dryout occurred 0.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> earlier) but was not likely to affect the temperature levels much. (The BV1 recovery times would be less than those for BV2.) ~

The BV2 IPE team performed seveml base case and sensitivity analyses of the occurrence of potential hot leg or steam generator creep rupture. The first base case calculated for fast SBO with the reactor scrammed and isolated, the RCP stopped, no feedwater flow available (i.e., the turbine driven pumps failed), steam generator pressure maintained at about 1,060 psig, and an RCP seal leak rate of 21 gpm/ pump equivalent; i.e., the low end of the i expected leak rate based on NUREG-1150 expert opinion (page 4.6-2). MAAP analysis i showed that, at the above leak rate of 21 gpm/ pump equivalent, the RCS pressure remained at the PORV set point of about 2350 psia at the vessel breach; for higher seal leak rates, the 4

vessel pressure dropped substantially. The IPE team ran two MAAP cases: one with core blockage ON, and one with core blockage OFF. In both cases, it was predicted that steam 7

generator dryout would occur in about 1.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, and core uncovery in about 2.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. In j the Blockage OFF case, the team predicted a slightly delayed time for vessel breach

(3.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, versus 3.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> for the Blockage ON case) and somewhat higher peak pressure

boundary temperatures: peak hot leg temperature (1,900*F, versus 1,500*F in the ON case) and peak steam generator tube temperature (800*F, versus 770*F in the ON case). Because it posed a higher threat to steam generator tube integrity, the Blockage OFF case was chosen as the first base case.

The second base case consisted of a slow SBO, similar to the SBO in the first base case, except that turbine-driven feedwater was available initially but failed later as a result, for example, of failures in running the turbine or failures resulting from DC power loss caused by battery drain. Using MAAP results for the two base cases and sensitivity analysis cases,  ;

3 the team calculated the possible creep mpture of the following RCS pressure boundary components exposed to high temperatures:

• Low-alloy steel reactor vessel hot leg nozzle safe ends

• 316 stainless-steel hot legs and surge lines

• Inconel 600 steam generator tubes.

4

~

Beaver Valley Unit 1 Back-End 14 August 1995

Using the results of the above analyses, the BV1 IPE team concluded that hot leg failures were likely to occur before vessel melt-though and that ISGTR was unlikely.

Two methods can be used to achieve in-vosel recovery: flooding the reactor cavity, and depressurizing the primary system :o allow LHSI. Flooding the cavity to a level sufficient to cool the bottom head before vessol breach was not possible at BVI. Also, as noted in

! Section 2.1.2.5 of this repon, "eperator depressurization before core damage" was not addressed in the back-end anaisis because it already had been addressed in the front-end ,

analysis. " Operator deptssurization after core damage began" was outside the scope of existing emergency prucedures and relegated to accident management considerations.  :

l Therefore, in-vesu recovery was not achieved at BVI. (Surry had an in-vessel recovery of 46.7% of the CDF.)

Through the CET top events, the BV1 IPE team was able to directly address phenomenological issues conceming hydrogen burn, direct containment heating, steam  !

explosions, molten core concrete interactions, and steam /noncondensible gas pmssurization.

Although the members of the IPE team relied heavily on the results of the NUREG-1150 study of the Surry plant, they concluded that the late (and very late) hydrogen bum models for Surry were somewhat optimistic. For scenarios with sprays, the Surry analysts assumed that ignition would occur whenever hydrogen concentrations in the containment reached flammable levels. For scenarios without sprays, they assumed that ignition would occur as soon as recovery of sprays resulted in steam deinertion. In both cases, plentiful ignition sources of sufficient energy to ignite hydrogen were assumed to be present. The BV1 IPE team performed a MAAP analysis after eliminating the above nonconservative assumptions, but still found that late hydrogen burn had little effect on containment failure.

During the back-end containment walkthrough, the IPE team made a general inspection of the geometry and the " openness" of the containment and also inspected the location of potential ignition sources for combustible gases (page 4.1-2).

112 Dg ninant Contributors: Consistency with IPE Insiehts.

Table 2 of this repon shows the results of SCIENTECH'c comparison of the dominant contributors to the BV1 conditional failure probability with the results of the NUREG-ll50 studies of the Zion and Surry plants and of the North Anna IPE. The CDP postulated for BV1 is the highest among the four plants listed in Table 2 and it is about five times higher than Surry's, the next highest in the list. However, as presented in Table 1-1 of the submittal, which is reproduced here as Table 3, the IPE team noted that the BV1 CDF was of the same order of magnitude as the CDFs derived from the PRAs of other PWRs based on comparable methods, databases, and work scopes. PLG performed all of the PRAs whose results are set out in Table 3, except for the one done of Surry, which was a NUREG-1150 study perforTned by NRC and its contractors.

Compared with the results obtained at the other three plants listed in Table 2, the BV1 results show a significantly lower percentage of containment intact, which is reflected in significantly higher percentages of early and late containment failures and containment isolation. A major reasor; lor the higher containment failure percentage for BV1 is that the Beaver Valley Unit 1 Back End 15 August 1995

Tcbl2 2. Ccntrinment Failure cs a Pcreentage cf Tctal CDF:

Comparison with Other PRA Studies ,

i l

i Study CDF Early late Bypass 1 solation Intact (per rx Failure Failure Failure year)

North Anna IPE 6.8E-5 1.3 11.1 14.0 0.2 74.0 Zion /NUREG-1150 6.2E-5 0.5 24.0 0.5 1.0 73.0 Surry/NUREG-ll50 4. l E-5 0.7 5.9 12.2 na 81.2 Beaver Valley 1 IPE 2. lE-4 6.5 43.4 4.5 16.3 29.3 na not available but included in early containment failure Table 3. Comparison of PRA Results for Internal Events

• Mean CDP Plant (per reactor-year)

Three Mile Island 4.4E-4 Midland 2.9E-4 Beaver Valley Unit 1 2.1E-4 Beaver Valley Unit 2 1.9E-4 Seabrook Station 1.7E-4 i South Texas Project 1.7E-4 Diablo Canyon 1.3E-4 i

1.2E-4 Surry (without cross-ties)

Surry (with cross-ties) 0.4E-4

• Reproduced from the submittal [1]

Beaver Valley Unit 1 Back-End 16 August 1995

i  !

' i BV1 back-end analysis _does not take any credit for in vessel recovery. Section 4.6.3.1, i page 4.6-10 of the submittal, notes this as a major difference between the Surry and Beaver r l

Valley Level 2 analyses. l l

In the results reported on the NUREG-1150 study of Surry, substantial credit was taken for l the arrest of core damage before vessel breach (46.6% of the CDF for Surry involved no j vessel breach). To arrest core damage, the ECCS injection must be restored and the core  !

damage must not have progressed to a stage where the core has taken the form of an uncoolable geometry. For Surry, recovery of injection was due primarily to two events.

First, for cases in which AC power was lost, it might be possible to recover injection once the power was restored. The BV1 IPE team argued that such a recovery of injection was unlikely mainly because, once core damage had begun, procedural guidance for operator actions to restore coolant flow would be unavailable. Second, in other types of accidents,

. the ECCS might be operating, but the RCS pressure would be so high that it would prevent mjection into the vessel. As noted in the analysis of the Surry plant, depressurizing the RCS after initiation of core damage (uncovery of the top of the active fuel) could result:

• Because the pressurizer PORVs or SRVs were stuck open

• Through a temperature-induced RCP seal failure

• Because the operators deliberately opened the PORVs

• Through a temperature-induced SGTR

• Through a temperature-induced hot leg or surge line failure.

" Operator depressurization before core damage" was addressed in the plant model. The IPE team concluded that " operator depressurization after core damage began," (i.e., as described 'I in the third bullet, above) should be considered in the analysis of accident management because it was outside the scope of existing emergency procedures. 'Ihe conditions described in the remaining four bullets above were included in the BV1 CET, but only in the context of altering the RCS pressure at the time of vessel breach from what it was at the initiation of core damage.

As noted in Section 2.1.1, the BV1 IPE team dermed early containment failure as that occurring before or within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of vessel breach. This dermition is different from that used in the NUREG-1150 study, in which early containment failures of PWRs were dermed as those occurring before or within a few minutes of vessel breach (page 2-13). 'Iherefore, I some containment failures that were considered early during the BV1 IPE would be binned as late under the NUREG-1150 definition. The BV1 IPE team used a 24-hour mission time in 4 its analysis.  !

2.3.3 Characterintion of Coritninment Performance.

'Ihe IPE team used a CET to characterize containment performance. 'Ihe quantification of  !

the CET included the following (Section 4.6.3, page 4.6-9): l

• Detennination of top event split fractions Beaver Valley Unit 1 Back End 17 August 1995

o Combination of the split fraction values to determine conditional frequencies for each of the tree sequences

• Assignment of each CET sequence to a release category

• Summation of all CET sequences for each release category.

All of the above tasks, except for the determination of the CET top event split fractions, were performed using the event tree module of the RISKMAN computer program, which requires the following as input:

• Description of the top events in the CET

• Logic defining the structure of the tree

• Set of rules for assigning specine split fractions to account for dependencies on prior events

• Table of split fraction values

• Set of rules governing the assignment of CET sequences to each release category.

The above input parameters are described in detail in the submittal. The IPE team extracted most of the CET split fraction values directly from the results of the NUREG-Il50 study of the Surry plant and, where necessary, used engineering judgment to quantify some of the fractions. The team members found that certain operator actions at Surry were beyond the .

scope of existing operating procedures at BVI, and, therefore, they conservatively ignored those actions in the back-end analysis, e.g., " operator depressurization of the primary system after the initiation of core melt." However, these actions were described well in the submittal, giving them visibility for later refinement or possible inclusion in accident management initiatives.

The BV1 IPE team applied the insights gained from MAAP calculations performed as part of the BV2 IPE in many accident sequences with both LOCA and transient initiators, including SGTR, and in various combinations of ECCS, auxiliary feedwater, and containment spray systems assumed to be failed. 'Ihe specific insights used were ones regarding event timing, and included failures of the reactor coolant system (RCS) and steam generator tubes, ex-vessel hydrogen production and disposition, in-vessel fission product revaporization after vessel failure, and the transient inventory of water in the steam generator following SGTR.

Section 4.2.3 of the submittal describes three specific issues that were addressed regartling the BV1 containment: in-vessel and ex-vessel hydrogen generation, hydrogen combustion / detonation, and the effect of lead addition to the ex-vessel debris from the melting of a steel-clad lead shield. 'Ihe team noted that significant uncertainties existed in the analysis of containment performance during severe accidents related to the generation of hydrogen and its disposition because BV1 has a relatively smaller subatmospheric containment than the other PWRs with atmospheric containments. For example, 40-percent Beaver Valley Unit 1 Back-End 18 August 1995

. - _ . _ _ _ _ _ _ _ _ .- .... _ _. _ . _ . _.__.____._m _

oxidation of the core aircalloy would raise the molar concentration of hydrogen in the dry air of the BV1 containment on the order of 10 percent, while 100-percent oxidation of zircalloy would raise the concentration to the order of 22 percent. A major uncenainty about in-vessel hydrogen generation was the result of core blockage caused by relocation of core materials.

MAAP runs for fast SBO sequences at BV2 indicated that in-vessel hydrogen could be 75 percent higher if no blockage was assumed. The ex-vessel generation of hydrogen -

involved oxidation of the remaining metallic zircalloy, core structural steel, and steel rebar in the reactor cavity basemat. MAAP runs performed for BV2 showed substantial generation ,

hydrogen (and carbon monoxide) as a result of steel rebar oxidation during core-concrete  !

interactions.

l The IPE team noted that the combustion / detonation potential of hydrogen produced during severe accidents was imponant in all phases of the accidents: before vessel bre ch, at vessel breach, shortiy after vessel breach, f ud over the long term. The team found that several assumptions about hydrogen combushn/ detonation made during the NUREG-1150 study of the Surry plant were not conservative. For example, in the analysis of Surry, a detonation limit of 14-percent hydrogen was assumed. However, experiments conducted on flame acceleration and deflagration-to-detonation of hydrogen-air mixtures at the Sandia National Laboratories FLAME facility showed this limit to actually be 12 percent. The BV1 IPE team used this lower limit. The IPE team assumed that hydrogen detonations would always fail the contamment.

Containment failures at vessel breach due to HPME were due in pan to hydrogen combustion. The pressure rise in vessel breach represented the dombined effects of blowdown, hydrogen buming, DCH, and steam explosion. The IPE team assumed that large quantities of hydrogen would be available for combustion before and after vessel breach. If this hydrogen had not burned before or at vessel breach and the contamment atmosphere was not inened by steam, there was a high probability that a bum would occur in the "early" time frame, within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of vessel breach. Based on the lower flammability limit of 4%

hydrogen in the air, the team assumed a probability of 0.965 that an "early" hydrogen bum would occur if containment sprays were operating and no high-pressure melt ejection (HPME) occurred at vessel breach. If debris was cooled and the containment sprays were operating, no significant source of additional hydrogen would be present in early time frame, and burns would to be unlikely. If an early hydrogen burn did occur, containment failure was assumed to be a cenainty.

The IPE team assumed that if the debris was being not cooled, there was a 50-percent chance that there would be a hydrogen bum in the " late" time frame (more than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after vessel breach) if the containment was inened, i.e., sprays were not operating. If the containment was not inened (i.e., electrical power was available and sprays were operating) and debris was not cooled, it was assumed that late hydrogen bums would occur. If the debris was being cooled and the containment sprays were operating, no significant source of hydrogen would be present, and therefore late hydrogen bums would be unlikely.

Beaver Valley Unit 1 Back End 19 August 1995

i

~

j Percenu:ge contributions of hydrogen burn /deDagration-to-detonation transition to the various  ;

j- release classes were reported as follows (page 58, DLC response to the NRC RAI): [3]  ;

i

-* 0.2 % of release category group (RCG) I - large, early containment failures and bypasses t

0.0% of RCG II - small, early containment failures and bypasses i

• 11.3% of RCG III - late containment failures.

1

! W Imoact on Eauioment Behavior.

i Section 4.1.4 of the submittal degribes the IPE team's assessment of the capability of BV1 equipment to survive in the harsh environments of severe accident conditions. This assessment was to ensure that equipment failures under severe accident conditions would not cause poor containment performance. Thus, the assessment was limited to assessing how a j

given accident could be mitigated once core damage had occurred; the potential for core damage arrest was analyzed in the I.evel I phase. Mitigation of a severe accident was l deemed possible by cooling the damaged core and removing energy and radioactive materials ,

from the containment atmosphere. Accident mitigation could be achieved at BV1 by  :

operation of the containment spray and heat removal systems. The submittal describes the a

survivability of monitoring and actuation systems, containment spray systems, and the l auxiliary feedwater system, as summanzed below. >

2 Monitorine and Actuation. In situations where an accident progresses to the point of severe j core damage or beyond vessel breach, the actions still available to the operator to mitigate i the consequences are reduced to those associated with understanding the condition of the i containment and the performance and control of the remaining systems for~ core debris and  ;

containment cooling. 'Ihe following are the conditions that provide important information to -

1 the operators after initiation of core damage and that rely on hardware located in the containment:

i

• RCS pressure l

• Core exit temperature l

• Coolant inventory

• Containment sump water level

• . Containment pressure  :

• Containment area radiation

• Containment hydrogen concentration l

• Containment atmosphere temperature

• Steam generator secondary-side water level

'Ihe JPE team relied on the IDCOR Technical Report 17, which addressed the issue of equipment survivability in a severe accident environment. In particular, the team used the results of the study of Zion, which is a PWR with a large, dry containment. 'Ihese results are listed in Table 4.1-3 of the submittal.

1 Beaver Valley Unit 1 Back End 20 August 1995

Containment Spray Systems. Containment spray systeras are the principal means of removing energy and radionuclides from the containment atmosphere. The BV1 containment has two spray systems: quench and recirculation. The quench spray pumps take suction from the residual water storage tank (RWST) and their operation is independent of containment conditions. For recirculation, the BV1 spray pumps were found not to be vulnerable to inadequate net posi:ive suction head (NPSII) caused by containment temperature and pressure. Neither were these pumps found to be vulnerable to structural loads caused by potential containment displacements (at high pressures approaching containment failure).

Auxiliary Feedwater System. Under the conditions of a severe accident progression, survival of the auxiliary feedwater flow to the steam generators is important because it ensures heat transfer from the primary to the secondary side, which could significantly affect core degradation, containment integrity, ar.d radionuclide behavis. Auxiliary feedwater pumps, which were assumed to opemte during so.ne level I sequences, were found not to be vulnerable to containment expansion, nor to expected temperatures in the containment.

It appears that the issue of equipment survivability received adequate attention during the BV1 IPE in accordance with the level of detail requested in NUREG-1335.

2.3.5 Uncertainty and Sensitivity Analysis i

The IPE team performed three sensitivity case runs. Sensitivity case A was to assess the l relative importance of the in-vessel recovery after core degradation. This case was mn using the dominant sequence model and by reducing the containment release to 50 percent. The net effect was a drop in the frequency of release category groups I and II by a factor of 2.

Sensitivity case B was run to determine the importance of thennally induced RCS failure before vessel breach. This cese was mn using guaranteed success split fractions, i.e., l thermally induced RCS failures do not occur before vessel breach. The resuhs showed a decrease in release category group II frequencies. The results also showed an increase in group I frequencies although induced steam generator tube rupture containment bypass frequencies were reduced. This increase was due to the higher probability of large, early containment failures resulting from th: RCS remaining at higher pressures. l Sensitivity case C was a hand calculation to determine the impact of procedural modifications l that would facilitate the deliberate depressurization of the RCS after core damage was '

initiated. This calculation was performed after changing the split fraction value for induced hot leg or surge line failure (IPS). The results showed that the implementation of procedures for deliberately depressurizing the RCS after core damage for fast station blackout TMLB'-type sequences would lower the group I frequency by 4.5 percent.

In addition, as described in section 2.3.1 of this report, the IPE team used the results of the MAAP sensitivity analysis performed for BV2, i.e., for the occurrence of potential hot leg or creep rupture.

Beaver Valley Unit 1 Back End 21 August 1995

2.4 - Reducing Th2 Preb:bility cf Cere Damage or Fission Prcduct Release  !

l 2.4.1 Dennition of Vuln.grability. l Table 6.3-1, page 6.3-6 of the submittal, lists BV1 vulnerabilities, which include four related to operator failures and three related to plant hardware failures. The IPE team identified these vulnerabilities by evaluating the major accident categories and the top-ranking sequences contributing to the BV1 CDF. Section 6.3.3 of the submittal describes two  !

l containment vulnerabilities identified by examining contributors to early containment release _l l frequency: containment bypass and containment overpressurization.

The containment bypass resulted from interfacing system loss of coolant accidents (LOCAs) I and steam generator tube rupures (SGTRs). The contribution from interfacing system i

LOCAs to large, early releases of BV1 was 10.7% compared with 77% for the Surry plant.

This contribution, which was lower than the one at Surry, resulted from there being only one interfacing system, the LHSI, located outside the antainment at BVI. (The RHR system is  !

located inside the containment.) The contribution from SGTRs to large, early releases of BVI was 3.2% compared with 10% for the Surry plant. Thus, the combined contribution of interfacing system LOCAs and SGTRs to large, early releases of BV1 was 13.9% compared l with 87% for the Surry plant. Bypass was considered a BV1 containment vulnerability.

! Changes to plant procedures and traiaing were being implemented to enhance the operator response to such sequences. For "LOCA outside the containment," the IPE team identified l the importance of improving guidance to the operators on the key valve to close.

1 Phenomena leading to containment overpressurization during a core-melt sequence included i l

the RCS blowdown, early hydrogen burns, and DCH. The IPE team identified several actions that could lower containment overpressurization: lower the RCS pressure before vessel breach, flood the reactor cavity, and establish debris cooling after vessel breach. The team identified the importance of improving procedures to better perform the above mitigative actions. Using the diesel-driven fire system pump was recommended to inject water to the containment and to cool steam generator tubes during an SBO sequence.

Throttling the quench spray pumps was recommended to conserve RWST inventory during l an accident sequence.

! It appears that the BV1 IPE team adequately identified back-end vulnerabilities and methods I that could be used to improve containment performance under severe accident conditions.

212 Plant Improvements.

Back-end improvements that the IPE team stated would help reduce the BV1 containment bypass frequency and containment overpressurization failure frequency are described in Section 2.4.1 of this report. In addition, Section 6.4.1, page 6.4-1 of the submittal, describes an enhancement to update procedures to depressurize primary and secondary

systems. The existing EOPs at BV1 were not explicit for sequences where high head safety

} injection (HHSI) was unavailable. Thus, the IPE team identified important plant l enhancements to mitigate the progression of severe accidents at the BV1 plant.

t i

Beaver Valley Unit 1 Back End 22 August 1995 I

l

.,. ,_. . ~_

- . . - - - - - - - .. . . - ~ . . _ . . -. . .- . - _ - . - .- - . . _.

l 2.5 Responses to Containment Perfermance Improvement Prcgram 1 Recommendations l

One of the CPI Program recommendations that pertains to PWRs with large, dry l

containments is that utilities evaluate their containment and equipment vulnerabilities to i hydrogen combustion (local and global) as pan of their IPEs and that they identify the need l for improvements in PWR procedures and equipment. ' Developing detonable mixtures of l hydrogen on a global basis may be especially imponant for smaller subatmospheric containments like BVI. Consistent with these recommendations, the BV1 IPE team did the l

! following:

l

• Visually inspected the containment geometry and openness and the location of potential ignition sources for combustible gases during the containment walkdown perfonned to gather infonnation for the back-erid analysis (Section 4.1.2, page 4.1-2)

• Evaluated and found that the containment penetration seals were not vulnerable to thermal attack from hot combustion gases

• Addressed important issues regarding hydrogen generation and hydrogen combustion / detonation, as described in Section 2.3.3 of this report

• Analyzed the vulnerability of containment performance to hydrogen combustion using BV1 CET top events.

2.6 IPE Insights, Improvements, and Commitments l

Figure 1, reproduced from the submittal, shows contributors to the BV1 CDF from

! sequences grouped by initiating event, The total CDF calculated for BV1 from internal initiators was 2.11E-4 per reactor year. One of the important groups of sequences that drove the final results was loss of offsite power (23.9 percent of the total CDF) followed by loss of emergency AC power train (19.3 percent). The next three contributors in descending order l

of imponance were the panial loss of the main feedwater (12.3 percent), total loss of river i

water (11.2 percent), and non-isolable small LOCA (5.6 percent).

l In order to gain more insights from the CDF results, the IPE team presented distributions l  ;

l that took into account panicular conditions of the plant that depended not only on the initiating event of each accident sequence, but also on the response to one or more plant systems. Because each sequence could possess more than one of the given conditions, the resulting sequence groups were not always mutually exclusive. The IPE team presented the ,

i following results obtained for accident sequence classes of general interest (given as a percentile contribution to CDF): RCP seal LOCA, 46.6; SBO, 30.4; containment bypass / isolation failure,20.7; loss of switchgear ventilation,15.5; and ATWS,20.1. A l large fraction of the core damage was the result of a RCP seal LOCA, a significant fraction j j of which was caused by an SBO and by a loss of switchgear ventilation.

l Beaver Valley Unit 1 Back-End 23 August 1995

i

~

l FigureI 1

J 4

i

.i j

Total Core Melt Frequency = 2.14E-04 Other (11.9%)

Lo** of Empwry 5*aageer j Verosten Q.2%)

Ma* Smet LOCA (2.8%

Laos of Offsite Power Q3D%)

l Stasm Gwwrator Q 4%)

Tutw Rupturs/"}y,,,"'I,,,

i>o,,,,

I,,,l Tram Q.5%)

4

' EscentA, Feedweser E --

W,r.:,5**,Y "

-Y$.

. . .t %s heatew Smet LOCA Y4h*' Loss of Emerpeney AC Poner Trah (19.3%)

Y" (5 0%)

l Total Laos of RMr Wow (11.2%)

! Parnet Loss or ush I Fenoneter (12.3%)

Figure 1. Contributors to CDF at BV1 fmm sequences grouped by initiating events.*

j

• Reproduced from the submittal [1]

i 1

$ 24 August 1995 j Beaver Valley Unit 1 Back-End l

1

. __--- - _~ ._ . -- - . - . - .. . -. -

l Table 4, which is reproduced from Table 1-3, page 1.4-7 of the submittal, shows the i characteristics of the primary system and of the containment at the initiation of core damage that are important for the accident progression. A major fraction of the CDF, i.e.,

79 percent, was made up of sequences involving the primary system at high pressure (i.e.,

17.6 percent at a pressure greater than or equal to 2,000 psia and 62 percent at a pressure i between 600 psia and 2,000 psia). These results demonstrate the importance of (

depressurizing the primary system to be able to inject low-pressure coolant to cool the '

damaged core in-vessel or to reduce the possibility of HPME. But operator depressurization was not considered in the back-end analysis because operator actions after core damage were not proceduralized. Induced failure of the RCS hot legs and "PORV stuck open" were the only important depressurization modes.

Table 4. Plant Damage State Annual Frequency and Percentage of CDF*

RCS Containment Isolation /Not Containment Small Large Pressure Bypassed Not isolated Bypass Bypass Total (psia) With Without < 3 inch Leak Containment Containment Heat Removal Heat Removal

> 2000 3.01 E-7 2.99E-6 3.40E-5 4.01E 7 3.77E-5 (0.1 %) (1.4 %) (15.9 %) (0.2%) (17.6%)

600 - 2000 3.42E-5 9.02E-5 7.44E-7 6. 98E-6 1.32E-4 (16.0 %) (42.3 %) (0.4 %) (3.3 %) (62.0%)

l 200 - 600 3.41 E-6 2.38 E-7 2.14E-8 4.00E-9 3.67E4 (1.6 %) (0.1 %) (< 0.1%) (< 0.01%) (1.7 %)

< 200 3.74 E-5 3.99E-7 6.90E-8 1.00E-6 1.09E-6 3.99E-5 (17.5 %) (0.2%) (< 0.1 %) (0.5 %) (0.5 %) (18.7 %)

Total 7.53E-5 9.38E-5 3.48E-5 8.42E-6 1.09E-6 2.13E-4 l

(35.2%) (44.0 %) (16.3 %) (4.0%) (0.5 %) (100%)

I

• Reproduced from the submittal [1]

i 1

e Beaver Valley Unit i Back-End 25 August 1995

t As shown in Table 4, at the initiation of core damage, " containment not isolated" (with l openings of sizes less than 3 inches in diameter) accounted for 16.3 percent of the BV1 CDF  !

and containment heat removal systems not operating" accounted for 44.0 percent. The l BV1 recirculation fan cooling system was not designed as a safety system and therefore was not used in the back-end analysis for containment heat removal. The status of the quench  !

sprays system and of the recirculation cprays system were determined in the Level 1 model l and they were not explicitly treated in the back-end analysis. No containment cooling (via '

the spray systems) recovery was modeled. Accident sequences that contributed 44 percent of  !

the CDF involved no containment heat removal after the initiation of core ' damage. l l l l l l'

l '

i J

l .

i  :

I I l

l i

1 l

l i

, l I

i l

j l

l 4 i 1

Beaver Valley Unit 1 Back-End 26 August 1995

1 l

3. CONTRACTOR OBSERVATIONS AND CONCLUSIONS 1

l i

i The BV1 IPE submittal contains a substantial amount of information regarding the 1 requirements of Generic Letter 88-20, its supplements, and NUREG-1335, and appears to be l

! complete in accordance with the level of detail requested in NUREG-1335. The IPE l

methodology used is described clearly in the submittal. The approach followed is consistent 1 with the basic tenets of GL 88-20, Appendix 1, and the assumptions underlying the approach are clearly described. The important plant information and data are wel! documented and the l key IPE results and findings are well presented. The submittal relies heavily on the results j of the NUREG-1150 study performed for the Surry plant.

The BV1 IPE team used a definition for early containment failure that was more conservative than the one used in the NUREG-ll50 study. For BVI, early containment failure occurred l before or within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of vessel breach. In the NUREG-1150 study, it was defined as l occurring before or within a few minutes of vessel breach.

The following is a BV1 containment feature that affected the results of the back-end analysis:

• The BV1 containment cavity stayed dry for most of the accident sequences. Even in those sequences where the cavity was flooded, the team argued that the containment sprays workeo, making it less important that the aerosol was removed by the water  !

pool overlying the melt. In characterizing the BV1 source terms, the team assumed that the cavity stayed dry during all of the accident sequences. (The pmsence of water in the cavity, however,was considered in calculating core-concrete interactions.)

The following are severe accident phenomena that affected the results of the BV1 back-end analysis:

l

• Early overpressurization of the containment accounted for 81.1 percent of the l contribution to the early, large containment failure category (compared with 7 percent at the Surry plant). Direct containment heating caused by HPME strongly influenced early overpressurization failure of the containment. A major reason for the strong influence of HPME was a modeling assumption that did not allow for operator  !

l depressurization, which increased the likelihood of vessel breach at high pressure.

• Based on MAAP analysis performed during the BV2 IPE, the BV1 IPE team concluded that induced SGTR was not a concern for BVI, determining that hot leg or l

! surge line failure had a much higher probability of occurring in sequences with RCS l

high pressure.

1

• BV1 has a relatively smaller subatmospheric contamment than ther PWRs with j atmospheric containments. This makes the issue of hydrogen combustion more imponant for BVI. For example,40-percent oxidation of the core zircalloy would raise the molar concentration of hydrogen in the dry air of the BV1 containment on ,

the order of 10 percent, while 100-percent oxidation of zircalloy would raise the concentration on the order of 22 percent.

I Beaver Valley Unit 1 Back-End 27 August 1995

l l l

( i

l The resuhs of the back-end analyses at BV1 showed the following contributors to containment failure, given as a percentage of total CDF: early failure, 6.5; late failure 43.4; l containment bypass,4.5; containment isolation failure,16.3; and intact containment,29.3.

A modeling assumption that had a major impact on these results was that there was no in-vessel recovery after the initiation of core damage. By comparison, the Surry plant had a 46.7 percent in-vessel recovery. Two of the containment characteristics that drove these contributors to containment failure were 1) the relatively small volume of the containment, i making DCH and hydrogen bums more important, and 2) the high probability that the reactor cavity would be dry.

The 16.3-percent CDF that the team calculated for containment isolation failures is relatively high, e.g.,0.2 percent for the North Anna IPE and 1.0 percent for the Zion NUREG-1150 study. However, DLC has dermed containment integrity conservatively: Containment isolation failure size was assumed to be less than 3 inches in diameter. Because the BV1 containment is subatmorpheric, larger openings were not expected to exist. This dermition appears to be more conservative than that used in many IPEs where the diameter of the opening for containment isolation was assumed to be greater than 2 inches. At BV1 isolation failures were not excluded based on small size and openings up to 1/8 inch in diameter were investigated. The isolation failures found at BV1 were 2 inches and 1 inch in diameter.

During the IPES at other plants, an opening of diameter 2 inches or less did not cause containment isolation failure, whereas, at BVI, it did.

1 The IPE team identified two back-end plant vulnerabilities based on major contributors to large, early radionuclide releases. The first vulnerability involved phenomena leading to containment overpressurization during a core-melt sequence that included the RCS blowdown, early hydrogen burns, and DCH. The IPE team identified several actions that l

could lower containment overpressurization: lower the RCS pressure before vessel breach, flood the reactor cavity, and establish debris cooling after vessel breach.

The second vulnerability that the team identified was containment bypass from interfacing l system loss of coolant accidents (LOCAs) and steam generator tube ruptures (SGTRs). )

Interfacing system LOCAs contributed 10.7 percent to the large, early releases of BV1 l compared with 77 percent for the Surry plant. This relatively low contribution resulted from there being only one interfacing system, the LHSI, located outside the containment at BV1.

(The RHR system is located inside the contamment.) The SGTRs contributed 3.2 percent to the large, early releases at BV1 compared with 10 percent for the Surry plant. Thus, the l l

combined contribution of interfacing system LOCAs and SGTRs to large, early releases at BV1 was 13.9 percent of large early, releases compared with 87 percent for the Surry plant. i Changes to plant procedures and training were being implemented to enhance the operator response to such sequences. For "LOCA outside the containment," the IPE team identified the importance of improving guidance to the operators on the key valve to close.

Beaver Valley Unit 1 Back-End 28 August 1995 l

l l

l

-.--. -__._- ~ ____.___ . _ . _ _ __ _ _ = - _ . _ _ _ _ . _ _ .

l Based on the review, SCIENTECH noted the following strengths in the BV1 IPE back-end  !

analysis:  ;

• In order to treat properly the dependencies between the tront-end safety systems that l l

are needed to prevent damage to the core, to the containment system, and to the support systems that tie both together, the IPE team included all the active .

containment systems (e.g., quench and recirculation sprays, containment isolation) in the front-end trees. l

• ' Containment event tr:e development and quantification in the BV1 IPE is very thorough, well presented, and in accordance with the level of details requested in the  !

( GL 88-20 and NUREG-1335.

L

• It appears that the IPE team identified all relevant potential containment failure

modes. All applicable containment failure modes that appear in Table 2-2 of j NUREG-1335 were considered.  !

l

, i l

l l

l l

)

l l

l l

i Beaver Valley Unit 1 Back End 29 August 1995

i

4. REFERENCES

1. Duquesne Light Company, " Beaver Valley Nuclear Station-Unit 1 Individual plant i Examination (IPE) for Internal Events," October 1992. l l

2. ' American Nuclear Society, "Repon of the Special Committee on Source Terms," j September 1984. j

3. Duquesne Light Company, " Forwards Request for AdditionalInformation Re. GL 88-20," March 1995.

4. U.S. Nuclear Regulatory Commission, " Containment Performance Working Group l t

Repon," draft repon for comment, NUREG-1037, May 1985.

l i

l l f

1 l

1 I

l l

1

l. l l

I I

i 4.

Beaver Valley Unit 1 Back-End 30 August 1995 l

APPENDLX IPE EVALUATION AND DATA

SUMMARY

SIIEET

}WR Back-End Facts Plant Name l

Beaver Valley 1 .

Containment Type Large, dry, subatmospheric i

Unique Containment Features Fan coolers are not safety-related and therefore are not expected to work during severe accidents Unique Vessel Features l

None found Number of Plant Damage States 143 Ultimate Containment Failure Pressure 126 psig (mean value)

Additional Radionuclide Transport and Retention Structures Reactor building retention is credited, Conditional Probability That The Containment Is Not Isolated i

i 0.163 Important Insights, Including Unique Safety Features i

The containment cavity consists of a lead shield that could melt and add to the core melt, thus changing core-concrete interactions; the cavity would stay dry for most of the accident sequences; Beaver Valley Unit I containment is similar to that of Surry Unit 1 and the Beaver Valley Unit 2 i

A-1 August 1995 I Beaver Valley Unit 1 Back-End l

P Implemented Plant Imprstements 1 i

Changes to procedures and training that would reduce the frequencies of containment  !

. bypass and containment overpressurization failure and that would update procedures to l depressurize primary and secondary systems are in progress or being reviewed.

l-  !

C4(atrix - .

1

. Information in the submittal was not sufficient to generate a C-matrix. i 1

l i

J i

l I

i i

l J

1 i

a 1

l l

l ,

I Beaver Valley Unit i Back-End A-2 August 1995 l

l

APPENDIX C BEAVER VALLEY I NUCLEAR PLANT INDIVIDUAL PLANT EXAMINATION TECHNICAL EVALUATION REPORT 1

(HUMAN RELIABILITY ANALYSIS) l l

j i

i