ML20135A742
| ML20135A742 | |
| Person / Time | |
|---|---|
| Site: | 05200003 |
| Issue date: | 11/22/1996 |
| From: | Haag C, Mcintyre B WESTINGHOUSE ELECTRIC COMPANY, DIV OF CBS CORP. |
| To: | |
| Shared Package | |
| ML20135A740 | List: |
| References | |
| WCAP-13914, WCAP-13914-R01, WCAP-13914-R1, NUDOCS 9612040024 | |
| Download: ML20135A742 (68) | |
Text
.
Westinghouse Non-Proprietary Class 3 t
a WC AP-13914
. .$_$ $ $ g $ $ $ .
Re ion 1 4
Framework for AP600 Severe Accident-Management Guidance; Westinghouse Energy Systems W es.
$ A> J . Ji30 3 g c' DR
- : * .. _ .;y ': :.y...: - % l%;,:'- ; ') 1 L: .,:.0 : f,.'.,'..'. . p . v. ; .-
l .},, .' ,y l ?s h:<l: ,;4 ):}'p'. .l llfl.. '{ Ij';..'.. ,. - .: .h.;: *'.?j,.
- l . [ lk. .
- . . ... i ' .'.. *l" h4 :l:. . '.",l n :.A y *Lli;. ..' . .;, f. ? '., l *. '; Q ' ,-lf, ^- l'
.~ . evy v v' #l.'. . y&
' . ', ;.b'._ . ; :.f,;[.
,,~y ; _
,.',.}' , \: : : n . * ;. . s;
~
- .4 j'. ' ._
' 1" . , , ' . ':.5.; : . ; ;'. , . .
' .' .. a; '. ..'
- 9,,;- l y'..
...;.,..'t.. ,C; ;;, . -
3 . .- % q .I-., . "Q. > ;J . 4.:,. .% . p* . *..:. ;
[ .; ,; ,., .:5 ; ,: i;.p' 7.. n *,'. ,' Q *:.:.;f
.., @ :,. .s i, ',. .) :"l.,;pl;,'. 7. ;; . J~. :.4, . . .;* ..lc..p.:i ;
- y,;; y):l9 :*'.:..- ,
.,K,<
g ,. . t
- ....e.,t . , .? s: .'..n.. '1..,..?.,.-...:+-
- s. . . \
.- . . .** :.e...g:" r. %: ,,: ,u -
.:. . .: : . .; - 5"...-
s.1%N *
. *. -a ':; p.:.,.>,*\.*.*.t?.*.,=.~3,'.<
r., y., .e.y - * ; We ,,t,.
" : '*s.g , ._ .
>,s .-[.' ..:
- -a. .p. . '..,
- .g'.'><?- - .
q,t ,. ,:. , ,. ,,.::ref g y. ,t .. /4., . .M'S ' , ,',, : . .j p, , e,. ,y
., .... . . . y , f ...... d. . . ., , , - y .
- ,,.s,.,.,n. :: , > , ,. : . 3. ;. y ; , L, .:~,,.< '..:. ..3,,
. i-<.;' q.:: . . ...:4-
., %,. 3.y: ', , . , .._,: q ; .,.,,-;.*.
, t .
.e,y. ,. z ;, . ,
.,..,...9,.,_.,
.~- , y; .:..:,..,;a 4. ji . . : . . ,y, , . .% ,....; ;,, . , , sp...-.
,.u
.; g
..,.......:.;.,.b".y:..<..
. .r. m _ o;.
, . , ,~, . ,3.u ;. > ,s. c, .3 sr.
, , . ,. ..r .. ,e _ n -
- i. . , _ a ;
e
'.. . u.; .. :. e:y(., :.-
- g , . . -. .. ,
p.....4.p.,.,.....,a.. . , ,::; ),,, 5 -,,a y.. 9,..y. , '$ ,,, .; .,y;:. ;..g, :y%y;9.e :. : v. ~.w;; . - ;;
. . *, , ..- .: . -;,~. _: ,qr ;.p ,y<_>;,. . .n.. .c ! .... ;
. . ~e ~. ,:,; .e , s -:..:m.f.yi' l ,;s._qi y:,3,. , 3
,.v ,
- ,. . . m. .q.. ;, .,
- . , . . -v . : 1 .. e s
. s :: .: ,: n, 4, f.a. . ;. ,..
- ,V: , . .v y . . s.y,'s
.1: p ,; >v
. l.e ,,; J. - . . :;-. .. ... .,. . .y, c,;s,;..x$ - ( .-,,.k-:.. .
c-. .-y
.t .sv .i 3,
.i,. ,, , x,.
P'. : ; .: ;:,;
. - . . ??.
e
. .; - ; ) . _ . c.. ; f~ _: .. . , -% , . ;;. m l-l,, , -.,;.
.a~,,(n
. . .m._.: :.;_
- v". ?:.y -q:g . - ;2 s*.' ?:y,, :t Q;Q+5 >.q, .M . :Dn 3. ;. q.y :[.s -g:>5 o ',, <:,,;:n; . .:,.: . ; .:y:.( ni..
.......:.'.,.?..;
~.W. 2 :. .-
- . z . ;. ; .. e .
- > .',
- : -e .;. , ' 2: ! w . . ., .; Q: .o :q f Y : .-. i 3 ' .. .?
- . 1 ' . n": . :~
+ . ' i. . . r, ._ } .. ,,.,
,'.y. Q:.
- p. ,.ie: .. . l C ,[ . . C .-~ ; . ; .,j;.. .. a. .;.::.y: :. nr-i f o,' /; .)f$ ., .., f ;j ,,/u, 3. - ' ;<p: , ; .d.
r,,"... *; :
. , ;:.5 s.g: ,,;; ;.,.
.: . .g:y;./,' ,.y):j; :p' ;-i .
3ly j ,..,;y.f .
. .. ..9. . , - . , , '1 .
- '..;. . ? ;;
-m'
- .
- .**a.. , , ~ . . , .
- i) . ;. . . .
. ' ..: :. v l ,. . .. ' ; .'. ; .
<..- t-
,..,:.' G,: ', , :: y f.,'.r.
. . ~ .>,i.
, .:. . ~, . . '. y,..
... . .' q _; . '.,:3, t .s ,( . . .; ., ,, %,;; ,(: y:; ;,,.te . _ g,:,L. ;, ;;. : ' /.q,p ',f.'YQ ;. :g'l.
.. A. . ' t,.
. .:. ,7 : . . , : 3 . .::;+L u a . % ..;;..
.. .....__l,..
. : 4. .";e.:
-A .*,, . n. ..y..
.cnl.;..
. : .y
,l ; ',.,},;(: f4 .if.
- . . .z. .c,.;, .::Y .p,. i . t .i. .; ,s l>t. .q. 6 -. . . ,
l y %.. ,..) ' .h, . .* ?;,4 . ? .t: '
, c
.:: .~ ):..an ;._;;..x. ;. .y * -
,.,t"
- i . ' ..,. , ey,g., .';; / -:
. sp - .+. 8.. - .
( 't g;" .,. ,; . ,. 3
. . i . '.: ,;'g. ycf.. 7a;3..: ; . , f. , v; _ .,a, :.w;t.,.j :, g .. .g. y .y. . . r' . .,.: Wl, . Q.. .e.;; ;c(l
. y .. ) , *- .../,*:_ ','a ;~ -.y .: . Q .)' , ) ;,. : e.,.; q Q; v. , ( .Q'*;.t,,,1;%' [. . ' ;
k, ,*, :. .. e
- 'T
[. j .y .,Q,,
, ..?:,,;j;* , . 't,[ ;:.4 - *:.;[ ;,c., ;,. :_.
e . ; e , . '.. ;.' ;.; : ....
- _ 3. l5 . n.* y. Q. .
,.r.-l,. , y - : .:.
- :', ;,. ," .i
,* :) _ 2 ; .;..w......._ ,
7 \:
. .. . ; t. . . y ; '.2." , .;.. ...._;: . q,
....-.c y.. .e i m ***...,,'..::...> o. ~- , . - :; ;. . .
'. s,
.:. y .: .:, r ,, . .
. . . ~ - - , . - ' .4 :. .
- . . , 't-v.,: . ' ! ;, y; :. ,1.: . f :_ .:..:. .' f .. - 4 :- . . _ - ,.; .,; : > . .
. , .;: -.A.'. i . .".;. .. . ; .r,. ., ' ..W., , . .,, , . f l *q . ' ., ':. .;;. , . . ,' .';a *'....?'.i.
. .g;c j ;,.... .. .'..s,';,..- - .-.
\ -
- * * * ';, : r :
~ .; %. : ; R .j. .. .*. q :: ... '. . ':
.: - Y.? - *, ,,;@ ; . . . ,; t : - 'i
- ."-p
- . :: ,,..:.i..-
7% .. :: .e
- .',i.,.,- .l %. .. .. , n.: c, 4 .**.; ,.- '
s.~- .c
^s ,
.c ,. ~.,, . , . . '..; ; . . .-. .,. y; . . .., .[. . ,:. . 7 ] ,_ 8 ', " '. , '. ' /,( ;.,g , ...[l
. . " y L.] -
' ["jl. l , Q .. .l2,_ ,N ' I j
- 7. .
q... ..x
..e .. . ...:.: . . ,... . ,..-.
.: . : - .+ u . ; ., w. . ,;
.....'.y v..
,c..- s- v - 4.. -~,t,.. . . ;. :.
. -t....:.: -..
. . . ..-.;; '. .. -. ~ . a . e.. -
- -
- ,:. u :. . -
. y; , '.".. : . ;, :, %: . ...-
, e . .1..;....,
- .,., ? ::. - . , . .
~
- .: . r: . * ;
>- . . . t s, :. .. ' ,2. qg. .:-; .; Q. .; ..$
s ;
. '. l lf ., ' J.%q ., ; .. '._. < a,,.;; ; ;.- . .. .: ,; :~:, .. ::'.*.*.',';i',l.,.'.'. '
-l. ; 7 ~. :: - '
s( ,;. . .: - . ?.l. .
'. ' G :.. ..-. ...., ,- :,;. , . - ; ; =:'?, .,:.', : ~lM..i' . . .. s .. w '.. ; . . m. ._
y.? + - . . . .:.
- ... . :* ".;- : ' . . ,;. . ; . .. . .- :.n- -
. ~ , . . . _ :. i*..i::.. .
. :.,. m. :. -
. ..n,t,..,.,
....;. ~ . . . . . . ..< : ;., . . c - .
- .::e.: -<. ,.c .v .. :' r., w: ':.-
,,',x.. . . f ,t ; .. *;. _. . . . . . *; : , . . .t ~ .
.'.....:..i.,.,. ;. - <.
- . :. ?. .~. .. ,, ,' ~
- s. . - . - :;~ ;,,;.. ::,.v . 7'
. s: , _ . ; s ., . : . .
t . sa .
, .:. ,. . ., %x W. : .,. . . a . .,* : : f ... ..: ; s e
. .. . .~.,~
N,'. .;, , ': N .'2:. . ,,._.,j- ;-
t 'p._~ . ..
,4 c,
.~i1
. . a
, ..? . 4
, . . . . ..J,'.,.'
. ..^.,.,.i..f,,.s:.
,; .., :q..,s i,. j
. , . , . - p 4. . %
t,..,
.3,
.,q t....
. . , , . v.. p .. ^ ..f.s .. .'..,3.. ; ,c , ,s
- 1
,:: .g 'e ...?- :, , , ..- ' '; .% ,,'.v.'c ', ,R, 5.., .t . . , . ' ' ,
'-O . :, ,. +. f3:s' . .,
.'.': :: ' . . _ p. -
'a.: .. s '. .>'. ; u 'y . .'.! .7.. ',~'. .' -. . 'm
~ . .
.....)....
e
' s %- ;
" . a,;, ::,, _ ts. 7;.:; :.M .-::.*c,; " . ,. . ,: ;'
- ;q ;' ;..;. ,G' . .;,_i:
. '?...'.^ :,'.;r..
- w, ;.. .. ; , , .,
- . l ,. ;. :.i. .._.. ; ., s
-cz -. ?[ t
, . .: : ,~. . , z . . . .: ;;.
7.._.
_ . , ' . *, : ., u . .~. ; . '
~
. ..: ^ *l ' v. ; ,', , , . . ..::
- . ' . . ;c.'s. .}. ', .. * -
.?; };y.. .
.j';. )" -.:.: , .e. m[y
. :. ;.s'v . _ q.:a ;.:. z. .a _ : . . . , .y.:~...'..,._'*; lg.q : ' . s a' L . ,^;..
.? ... :,. ;? '. '. l . . , ' ." :; : :,
. ;-.~', '" '.[ g; . < . - ll' . _
1.0: :.; .&a'
,'.;:.'?_, .;:j:.1 .; g
.....'.,...a.
.. .~,e . 'p
. o,,
l ., . ,; -
- u. ;.. ;. . , . 'i; . - .* :. .?.
. , . ... >. .- .:_.n. .w . .
- . ~
L- . ; ,;. :2 .-
7-
- .v.' . .: . .
_ ;, .~ ^' ;;. . ; .'- . 'N t
1;:..- ..,:...r : . .. ' . - . - . :: ; . . ' .. .. ;- ;- l_ < : . ,,
- . ~ w.; }_. _..
'.s *
~ : .: ~ a
.':L;
.- ' : A . ~:^ ': '. ' .. p ': . .' .:; ..:..'.,.
~.
': y : . ' .% " > y :l ~ %: '? :.:.' - . '* '.:',.t '?;;
..;...,<<li. . .- ; ' :. - . .
.: 4 :.. i ,-
T. : ' . ':. : .. ; .
. ' f -
.. ,' j- - s',.. . .; -., .. . ,' [ , .f , ,'.( I , , . ' . ' '.. ',..'l t _ . . ;.' . [..
,I'
.[ '.l.y f i
. ' '[s .' j-[,1 -( Q { ' f., * ,+a8
.'.8 '
-l },' .j ...u, ~ . ,. . m; .? n.,,. , . ., ..
.. . . .. . , l .: . . .
....f ..,.;...,
., . . -. e
. . .:. .. c. . .-.: ., .. # .?..
..(,... '.,..., *' . . . - ,.
,, _ . . ,., ,., , , ... .,. . , . . ...',:. ._ ; ; =.. ,,:l, " , , . -T;;; -} - y; ;. ..: , _c -n.e-r
. .,'.;. : ;, . ". [.* v. , . .
..; ,. . . . . , ) ,, ,
, y,
, 4 '._ . :, . _ . . _.; }a
...,....,j..,
. ' .. - +
- t. ~t;,- . ,
..;'.*....;.:,.1.,..,5.-..-)9,...,,,.:+.
- .- . ;: .. . ;. 3 r ,.;. ., .y,
.h . ; < ' .....y,- :. .. ... . ; _ ; ;,..*g , y .. . . . ._ . , ' , , , ,e . . . . - - . . ,: . .
, q; . s.
.:1. ,z.; . c .,_ a
.-.:q ~;. .
.; .;, , 2 , . . .. > ;. ;-.._ .. x. v . . ~ :- w - .: .. ;' '".' .u- ::. -: .:, ._
., .y : , .,
, l , .. .p .,;..,';,-;..'* . : ,
$ d:.. ' : .n . y., < h; ., -.. ,
[. '.'/ y .. . . . p'I. : . : . . $,j::N.
.l.i ., (. ,. I l
..' ,.4 ,,, ..3. ;. , .'-d.: --, .:.. . ,. i.c.... 3 ,.- l 3.
,yl. :.. .. s;'.,,.t, . ." f.j..d*. .',N . ... .,.', .,t ,-; :', ... . ;. i , .. ', .~,/. I' , ; - . .g.y: .. <t...,...
. .. ... . . . .w.. :.-.;.:.'. .,,.l
. , . . .v. . -
c : g :,t ..
. . . , . . g; . . f..
.; c 'i. :. ; . . . : . ., n. . .. l% . ' , . ?. :..z .;:
- \ g . :. .: ; . y a
..':9.
. '. .yl* i ;+.. : . :.
., . ';..' , ' ... . .l. ~
'.;,[: ..'.f.:.: ;. p.. y . l.; w .
- n ?.;.[* . ; :"* ~;,'.); :-l.'
.u*
't - ' l d:.,.e,.
b.;,.f. .;/ *.! . ,_%. I . ;. : f .h 3,lfc.;
,z e.,. . '. ' ,a{ .;:.' , ., _. ,b, '\.:'y....
L ., :s' . ;-:*, !, ,. .' ,^f' : ,e. . ,; ..
. i' Y, '^" f, U 'Y..U; , ; . $'. .?{l'. } . _ f:....;l.'...,,<q....; ', . . ,' ) . ;N f' ~ .. Vl- -' f^
. <; l Yl;l '.N , !$ D. ,, , f' ,;* l i - :
f $ , : ~,,j ; ,, .
d.^. : f ' , ,,,l'.f . '._*^ , . , T ' , r . . , c ,,. .. .:...,..<1 ., '::
.i.'..-
l ., ~ . .
- . w. , ,,;-f ). 3, ,;
- ,' , ' :r' : v;, v. y ; . y'
- 'u. .Q ,, J. t.. . - {. . ,5 . , . .a; .'.ar .-
s
. - t.n.* .
,^ : ;
as,. .
,- - ^..,,,..,,,q.'- . . A..s3 ;[ .,
l Yy . W. ;, '.,:.*;,,* ':
,) . ., ; : ,a ::,; :_ '. '. '[: 3, -
- e
. :q: y _ ,. . .,;,, ;.G..i-
- -%. ..' ...,;.
- '.. .' ,'i," . . . : : t . ':
,:. _. ', : ,. ,.. ..., ;... .vl. ;.u.: , s. ._ ;. '.. Q?,
- : .. . , f. .:. ' c. f.;;; . _ .,, _':. e ,;' ' );.*l*~. ,, .p. ;. ....;; ,. *: ,'.;c', ., , ,.. . . . ;, ;:-[".:).,
.,c , i .. _. ._ _ ; '. ; . . < , ;.
.~
. ,'] _f p.- : .I,
- ' i.; . 7, . = . '.
- : a. s ; - n- '
}.
,....,n...:.
..,y_*.e.'. ., ;;s .. , ; !;: :
. ,s.
s+
.:, y :. : ;. , , y , . ; . . . ' , ; .:.
_ .: . . . ;:.:.a.. :..n:'..- ;w..;' '. .... . ..; ,.c._e..;...-(,..". . :n --
- i. . . ,.- ... ':
~......,a
' . ~ ~ '+ . .
... , f .,l;. '. ' ':',:,-li, ?. .l.,.'\. l,. ';?;.; y ?. ' . . :Say. : ,:.: . ., ,,'..C:' ,, :. c.. .. : : .-
.. .../ . - . . . .: i.
- D. ;' !;;,;), ?l.[*f .,l ?. $'l,.. - .. <? . 'l, l'. \ '. . .g', _.s .'p '.- \l" * .
- J. , .,,-i'* .. p. : ' ,, lg , . ; .' .;'M T. :;.f::-: .c f.._. ._. .y.. Y' , .. _-
, W ; ; -'t v..
- . f:, .
vr. .. t. *.; . .; ' &; ::.' . ! .;.;>.
- .L..-%
.~ :y' ;. g. ,,g .Q;y_,f :, W.
- ; e .:. b;". , g ," .. 3. :. - , . . . :p :
- a. ', . , ' -,'
- g. .. x.: s.t. .y :.y:.., v. f. ;
w;y: : . ,n,, -. .. .. .g.7. s .L_ .: .. ':l, 3. .; p a.:... ~ :9a . e ;,;p ; .::
3; ~ :: 3 . ,: . ,3... ..: .
- 7:.. ..... ,. - .;., [._ y.; m ,;. [ . . 3.
a
- e .. .: . . .a...u m.,. t g.m 7.g . ,. .::9:. : ,. . . +.,7..
. . -w.
. . s. .::. ~.; 3, ; ;, . ., ; .u.. , . ._
.=; .~ .. ::- w .m , .;... : ;;,
- m. . , ;.. . ...e.<.. , . . : ;..p.. ::al.,. ;..cm,:uc,:, p,~,;. .. c. .h.. u. .; .,. . x_...e;. .:.
.a .~., y; . ;;;.:., ,r;, : :. .,:y , .
.: .4 h.,.. . ;;. .. :.. ..e", .: .. .u .c;,,.n.c. - . ,
. . * . x. . .*
. ~;
a.-
.,. di
' .1;:.t-..%;l -
^' -
.g .
r
, . :n .e. .:< ; V, . Ms:c i '.... ] c." . m: : . :' , .3 ^ ". ;l_-':.' 3 .s,;b t -o
, . . . re.*.l- e .;.'.Y: . ;,:yp : ,.
.s.:.:
- .: . . .? 3. :d fi; . '.;"';. .a.jlf. g f*.:*;*$yl6,.*{l:;.?'
s..
- e. t ;, , :: :. : 't ,. ' , . . . ,. . Q:.
. ,, . "y ?y:. .
- 9- t.$ QQllll,h
.: ; . . . iq.. t .s
-: l k ,5';W
, f. =, . , ( .Y-* -
. . ,ifA , i:3::${.k;h.
,y 4 .L .
.Q;;h ,,1
- 'I5;f:, f'6 .~
re,,+. 'a .
'.% + +:0 f:.,'W,Y.h-l,:S
.?.ys, 9 a..n ..
- 3. .. . .
, f, '}f.l;h':e .
4t,g. ).
.u :a :x / . ., u. s .
y.,
L, ..
.; 7: , , . .s s. w. , . ;;L.c:,:s :v q . ';.. .;y.ic: Y .m..9.:. . .. ...' :
k;N.
se L ?tm:,; M M .i. .v:~b ;7 . >.:(i. M ,y.s; *AQ. , q. .. i::};V@(.". 'b.
T,.:-ll > : t, ,'.9 : . ',:Q /J./,Hj.if,. ff>. :::.y Myd:R),A '.. -
i .. .:
ng):{;gM:;.'].[a.g hl .:!$..n p y;;j;%::,.y[?.:g,gp:Q.n :::p'q:;:;,,g!,Q m Ay x, . ...: % Nkn L:.:,.? w :.
- n. : , : r., . M:n ,..w.:
' .: q.y y ' -Q'q;,.g:.ny;"
ri'(w::l;,[.1;,{((;9.y ?:..gng;;
. : .j:Ja;y.t 75 y: : j. g a.: 4Q g,yy.3 Q n.y ;;w .
.' f f ,
. aL .y n,,,e=[.f,%. n x.gn;:qp%g-m. u.q+n:Q,9.;m %7 f;fu 9 ~ *:Rl:.}'?fWdQ::f$,$u
- v. y"6.:;>;:.py!
~,79 - e.a v W;.5%% 4. h,y:Qf%fp%%;;n.%.c:g4.
Q.,y
. 73g%, , %gyNg
,f c Qg &y . -Tfi;),.M.'.. y; .;gjlQ;k:p;;QQ- Q;;v..
- =f;&p yW,,Q;y;c _ .4}f;
+r -
N k 7 Nt ikh[ .
' ? . 2:.:< ,.
'.;. :*.. : . .'..n: :.q)
. .? $:'.f? l e
- $
- p-
$ h&40h. k. ,:y s
^g:M: A: jWrpj?:
h:y,.Q c .n w:. :y. . ....8 . .e /%.y.e ,
- 14 &
- f .$k~.
J< ::.;>.n, i
C#Wy.<bM n;;
- f? n Oh.c.
y;6.
- ,x hm%y. .q.p hWt n,;p..
$.dh/n.@%%g%Q.M@w$%w$.MM$%gldg;h@W P n ww w Kif ggg g g [g$ h g$; 3yM
- g - - , ,
l i
i Westinghouse Non-Proprietary Class 3 i
$ $ $ $ $ $ $ $, Revision 1-i
- i. .
I Framework for AP600 Severe Accident Management Guidance l
l l
l l -
i Westinghouse Energy Systems i
i i
1
AP600 DOCUMENT COVER SHEET TDC: IDS. I S Form 58202G(5/94) [tixxxx.wpf:1x] '
AP600 CENTRAL FILE USE ONLY:
0058.FRM RFS#. RFS ITEM #:
AP600 DOCUMENT NO. REVISION NO. ASSIGNED TO GWGLO27 1 Page 1 of 1 ALTERNATE DOCUMENT NUMBER: WCAP-13914 WORK BREAKDOWN #: 3.1.2 DESIGN AGENT ORGANIZATION: Westinghouse TITLE: Framework for AP600 Severe Accident Management Guidance ATTACHMENTS: DCP #/REV. INCORPORATED IN THIS DOCUMENT REVISION:
CALCULATION / ANALYSIS
REFERENCE:
ELECTRONIC FILENAME ELECTRONIC FILE FORMAT ELECTRONIC FILE DESCRIPTION l
(C) WESTINGHOUSE ELECTRIC CORPORATION 199fL 0 WESTINGHOUSE PROPRIETARY CLASS 2 This document contains information proprietary to Westinghouse Electne Corporation; it is submitted in confidence and is to be used solely for the purpose for which it is fumished and retumed upon request. This document and such information is not to be reproduced, transmitted, disclosed or used otherwise in whole or in part without prior wntien authonzation of Westinghouse Electric Corporation. Energy Systems Business Unit, subject to the legends contained hereof.
O WESTINGHOUSE PROPRIETARY CLASS 2C This document is the property of and contans Propnetary information owned by Westinghouse Electnc Corporation and'or its subcontractors and suppliers. It is transmitted to you in confidence and trust, and you agree to treat th:s document in strict accordance with the terms and conditions of the agreement under which it was provided to you,
@ WESTINGHOUSE CLASS 3 (NON PROPRIETARY)
COMPLETE 1 IF WORK PERFORMED UNDER DESIGN CERTIFICATION OR ~ COMPLETE 2 IF WORK PERFORMED UNDER FOAKE.
1 @ DOE DESIGN CERTIFICATION PROGRAM - GOVERNMENT LIMITED RIGHTS STATEMENT [See page 2)
Copynght statement: A license is reserved to the U.S. Government under contract DE AC03 90SF18495.
O DOE CONTRACT DELIVERABLES (DELIVERED DATA)
Subject to specified exceptions, disclosure of this data is restncted until September 30,1995 or Design Certification under DOE contract DE-ACO3-90SF18495, whichever is later.
EPRI CONFIDENTIAL: NOT!CE: 1E 2 3 40 5 CATEGORY: A N B C D E F 2 0 ARC FOAKE PROGRAM - ARC LIMITED RIGHTS STATEMENT [See page 2)
Copyright statement: A license is reserved to the U.S. Government under contract DE-FCO2-NE34267 and subcontract ARC-93 3-SC 001.
O ARC CONTRACT DELIVERABLES (CONTRACT DATA)
Subject to specified exceptions, disclosure of this data is restncted under ARC Subcontract ARC 93-3-SC 001.
ORIGINATOR SIGNA RE/D TE C. L Haag .
g/ gg AP600 RESPONSIBLE MANAGER B. A. McIntyre SIG
~{ APPROVAL DATE g, ,g
' Approval of the responsitse manager signities that document is complete, aMuired reviews are complete, electronic tile is attached and document is relezed for uce.
l AP600 DOCUMENT COVER SHEET Pagea !
I Form 58202G(W94) LIMITED RIGHTS STATEMENTS DOE GOVERNMENT LIMITED RIGHTS STATEMENT l
l (A) These data are submitted with limited rights under govemment contract No. DE-AC03 90SF18495. These data may be reproduced and used by the govemment with the express hmitation that they will not, without wntlen permission of the contractor, be useo for purposes {
o' manufacturer nor esclosed outside the government; except that the govemment may dsclose these data outside the govemment for the following purposes, if any, provided that the govemment makes such disclosure subject to prohibrtion against further use and disclosure:
(1) This ' Proprietary Data" may be disclosed for evaluation purposes under the restnetions above.
(ll) The 'Propnetary Data" may be esclosed to the Electnc Power Research Institute (EPRI), electnc utihty representatives and their
{
direct consultants, excluding direct commercial competitors, and the DOE National Laboratories under the prohibitions and 1 restnctons above.
(B) This notice shall be marked on any reproduction of these data, in whole or in part.
ARC LIMITED RIGHTS STATEMENT:
This proprietary data, fumished under Subcontract Number ARC-93 3-SC 001 with ARC may be duphcated and used by the government and
- ARC, subject to the hmitations of Article H 17.F. of that subcontract, with the express hmitations that the propnetary data may not be disclosed outside the govemment or ARC, or ARC's Class 1 & 3 members or EPRI or be used for purposes of manufacture without pnor permission of the Subcontractor, except that further disclosure or use may be made solely for the following purposes:
This propnetary data may be disclosed to other than commercial competitors of Subcontractor for evaluabon purposes of this subcontract under ,
the restncton that the proprietary data be retained in conhdence and not be further dsclosed. and subject to the terms of a non-disclosure j agreement between the Subcontractor and that organization, excluding DOE and its contractors.
DEFINITIONS CONTRACT /DEUVERED DATA - Consists of docurnents (e.g. specifications, drawings, reports) which are generated under the DOE or ARC contracts which Contain no background proprietary data, EPRI CONFIDENTIALITY / OBLIGATION NOTICES NOTICE 1: The data in this document is subject to no confidentiahty obligations.
NOTICE 2: The data in this document is proprietary and confidential to Westinghouse Electric Corporaton ana/orits Contractors. It is forwarded to recipient under an obhgation of Confidence and Trust for hmited purposes only. Any use, esclosure to unauthonzed persons, or copying of this document or parts thereof is prohibited except as agreed to in advance by the Electnc Power Research insttute (EPRI) and Westinghouse Electnc Corporation. Recipient of this data has a duty to snquire of EPRI and'or Westinghouse as to the uses of the information contained herein that are permitted.
J NOTICE 3: The data in this document is propnetary and confidential to Westinghouse Electnc Corporation and/or its Contractors. It is forwarded l to recipient under an obhgation of Confidence and Trust for use only in evaluation tasks specifically authonzed by the Electne Power Research insttute (EPR1). Any use, disclosure to unauthonzed persons, or copying this document or parts thereof is prohibited except as agreed to in ,
advance by EPRI and Westinghouse Electne Corporaton. Recipient of this data has a duty to inquire of EPRI andor Westinghouse as to the I uses of the information contained herein that are permitted. This document and any copies or excerpts thereof that may have been generated are to be retumed to Wesbnghouse, drectly or through EPRI, when requested to do so.
NOTICE 4: The data in this document is propnetary and confidential to Westinghouse Electric Corporation andor its Contractors. It is being revealed in conhdence and trust only to Emplo Any use, dsclosure to unauthonzed persons,yees or copyingof of EPRI and to certain this document or partscontractors of EPRIThis thereof is prohibited for hmited evaluaton Document and any tasks copiesauthonzed or b excerpts thereof that may have been generated are to be retumed to Westinghouse, directly or through EPRI when requested to do so.
NOTICE 5: The data in this document is proprietary and confidential to Westinghouse Electne Corporation and'or its Contractors. Access to I this data is given in Cont denm and Trust only at Westinghouse facihtles for limited evaluation tasks assigned by EPRI. Any use, disclosure l to unauthonzed persons, or copying of this document or parts thereof is prohibited. Neither this document nor any excerpts therefrom are to be removed from Westinghouse facilities.
EPRI CONFIDENTIALITY / OBLIGATION CATEGORIES -
CATEJORY "A"- (See Dehvered Data) Consists of CONTRACTOR Foreground Data that is contained in an issued reported.
CATEGORY "B"- (See Delivered Data) Consists of CONTRACTOR Foreground Data that is not contained in an issued report, except for computer programs. ,
CATEGORY "C"- Consists of CONTRACTOR Background Data except for computer programs.
CATEGORY "D"- Connsts of computer programs developed in the course of performing the Work CATEGORY "E"- Consists of computer programs developed prior to the Effective Date or after tne Effective Date but outside the scope of the Work.
CATEGORY "F"- Consists of administrative plans and administrabve reports.
i 1 l
t l 1 WESTINGHOUSE NON-PROPRIETARY CLASS 3 i
! WCAP-13914 l
l 1
Framework for AP600 Severe i Accident Management Guidance I
l
, i l l l
l ,
l l l November 1996 l
l Revision 1 I l
l
[
l l
l Westinghouse riectric Corporation Energy Systents Business Unit P.O. Bax 355 :
Pittsburgh, PA 15230-0355 C 19% Westinghouse Electric Corporation All Rights Reserved m:\3324w.wpt:1b-1113%
l i
1 l 1 TABLE OF CONTENTS I 1
1 LIST OF TABLES ............ .......................................... v i l
1
! 1 INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . 1 -1 l 1
2 REQUIREMENTS FOR SEVERE ACCIDENT MANAGEMENT . . . ........... 2-1 3 DECISION-MAKING PROCESS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1 l
3.1 ROLE OF THE PLANT PERSONNEL . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2 i 3.2 STRUCTURE OF AP600 GUIDANCE . . . . . . . . . . . . . . . . . . .......... 3-2
~
3.2.1 Diagnostic Flow Chart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2 3.2.2 Severe Challenge Status Tree . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-3 l 3.2.3 G uid elines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-4 4 SEVERE ACCIDENT MANAGEMENT GOALS . . . . . . . . . . . . . . . . . . . . . . . .. 4-1 4.1 CONTROLLED, STABLE CORE STATE . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1 4.2 CONTROLLED, STABLE CONTAINMENT STATE . . . . . . . . . . . . . . . .. 4-4 4.2.1 Hydrogen Flammability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-6 4.2.2 Core / Concrete Interaction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-7 4.2.3 High Pressure Melt Ejection ..... ....................... 4-8 i 4.2.4 Steam Explosions . . . . . . . . . . . . . . . . . . . . . ................ 4-8 4.2.5 Creep Rupture Failure . . . . . . . . . ........................ 4-9 l 4.2.6 Containment Vacuum . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-10 4.3 FISSION PRGDUCT RELEASE PREVENTION, TERMINATION AND i MITIG ATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-11 3 4.4 SECONDARY GOALS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-12 :
I 5 HIGH LEVEL ACTIONS FOR AP600 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-1 l 5.1 INJECT INTO RCS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-1 5.2 INJECT INTO CONTAINMENT . . . ............................ 5-6 5.3 INJECT INTO STEAM GENERATORS . . . . . . . . . . . . . . . . . . . . . . . .... 5-7 5.4 DEPRESSURIZE RCS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-8 5.5 DEPRESSURIZE STEAM GENERATORS . . . . . . . . . . . . . ........... 5-10 5.6 DEPRESSURIZE CONTAINMENT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-11 5.7 PRESSURIZE CONTAINMENT , . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-12 5.8 BURN HYDROG EN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-12 5.9 VENT CONTAINMENT . . .................. ............ 5-13 5.10 MITIGATE FISSION PRODUCT RELEASES . . . . . . . . . . . . . . . . . . . . . . 5-14 5.11 SUMMA RY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-15 6 CONC LUSION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...... .... 6-1 7 REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-1 i
APPENDIX A AP600 SEVERE ACCIDENT MANAGEMENT INSIGHTS . . . . . . . . . . . . . A-1
- APPENDIX B AP600 SAMG RAls AND RESPONSES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ,
1 1
m:\3323w.wpf;1b-111596 Revision 1. November 1996
LIST OF TABLES Table 5-1 AP600 High Level Actions Relative to Severe Accident M anagement Goals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-2 Table 5-2 Summary of High Level Severe Accident Management Stra tegies for AP600 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-16 l
i l
m:\3323w.wpt:ll>111596 Revision 1, November 1996
1-1 1 INTRODUCTION Prevention and mitigation of accidents has been an integral part of the design process for AP600. A significant driving force in the passive plant design is the key accident management philosophy of preventing accidents from progressing to core damage.
However, in the event of a low probability core damage accident, it is prudent to have severe accident management guidance with the objective of terminating the progression of the accident and returning the plant to a controlled, stable state. Therefore, this document contains a summary of the overall philosophy and high level strategies that will form the
. basis of the AP600 severe accident management guidance.
The Westinghouse plan for addressing severe accident management for AP600 will be based on the Westinghouse Owners Group Severe Accident Management Guidance (WOG SAMG) for the current generation of operating plants [Ref.1). Since some of the AP600 design features reduce or eliminate the potential for some severe accident phenomena and fission product boundary challenges, the WOG SAMG provides an envelope of possible severe accident management considerations. Thus, the WOG SAMG has direct applications to the development of AP600 severe accident management guidance, and will be the starting point from which comparisons are made.
The scope of the AP600 severe accident management guidance is to address significant core damage accidents. Prior to core damage, the Emergency Operating Procedures (EOPs),
which are based on the AP600 Emergency Response Guidelines (ERGS) will be used [Ref. 2].
Although the EOPs/ ERGS for existing plants (e.g., the WOG ERG package [Ref. 3]) have proven to be effective in the prevention of core damage, they do not address scenarios after significant core damage has occurred.
The AP600 severe accident management guidance will be developed for use after the AP600 emergency response guidelines are no longer applicable. The AP600 severe accident management guidance will include the application of insights that are derived from the AP600 Probabilistic Risk Assessment (FRA) [Ref. 4], and elements that have been learned through severe accident management research over the past 15 years. As such, severe accident management guidance is the mechanism that brings the current level of knowledge
, on severe accidents to the hands of the operating and technical staff at the plant. However, the overall uncertainty of the core melt progression is still quite high, and thus the management of a severe accident can only be pre-constructed by guidance that is less prescriptive than the guidelines for design basis events and other accidents prior to core damage.
The contents of this document include a discussion of severe accident management requirements, the anticipated structure for the decision making process, the goals that must introduction Revision 1, Novemter 1996 m:\3323w.wpf:1tw111396
. . . - . - - - .._. - .- - .. . .. - . - ~ - . . . - _ - . . . . ._ -
1-2 i
I be accomplished for severe accident management, and a summary of possible strategies for i AP600 severe accident management. Included in the severe accident management I discussions are key severe accident management insights obtained from the AP600 PRA. I This document provides the framework for future AP600 severe accident management guidance development and therefore does not specifically address many issues in detail. l l
I 1
4 1
I l
t t
t l
l l
t I
i c
. i i
l l
l l
l l
Introduction Revision 1, November 1996 m:\3323w.wpf:1b-111396
r 2-1 2 REQUIREMENTS FOR SEVERE ACCIDENT MANAGEMENT i
4 There are no current NRC reauirements for the development of severe accident management t
, guidance. However, NRC policy statements from the NRC Staff to the NRC Commissioners ,
(SECY letters) identify concerns and future actions of the NRC concerning this subject.
Speci'ically, SECY-89-012 [Ref. 5] provides the following information.
" Accident Management encompasses those actions taken during the course of an ,
accident by the plant operating and technical staff to: (1) prevent core damage,
. (2) terminate the progress of core damage if it begins and retain the core within the .
! reactor vessel, (3) maintain containment integrity as long as possible, and (4) minimize I offsite releases. Accident management, in effect, extends the defense-in-depth principle to plant operating staff by extending the operating procedures well beyond the plant design basis into severe fuel damage regimes, with the operator skills and !
creativity to find ways to terminate accidents beyond the design basis or to limit j
- offsite releases. ,
The NRC staff has concluded, based on PRAs and severe accident analyses, that the risk associated with severe core damage accidents can be further reduced through ,
j effective accident management. In this context, effective accident management would
, cr.sure that optimal and maximum safety benefits are derived from available, existing i
j systems and plant operating staff through pre-planned strategies... Accordingly,
, accident management is considered to be an essential element of the severe accident closure process described in the Integration Plan for Closure of Severe Accident Issues (SECY-88-147) [Ref. 6] and the Generic Letter on the Individual Plant Examination (Generic Letter 88-20) [Ref. 7].
} In the IPE Generic Letter, the staff deferred the requirement to develop an accident management plan, stating that we are currently developing more specific guidance on this matter and are working with NUMARC to (1) define the scope and content of acceptable accident management programs, and (2) identify a plan of action that will ultimately result in incorporating any plant-specific actions deemed necessary, as a result of the IPE, into an overall severe accident management program."
Also within SECY-89-012, the first objective for an accident management plan developed by licensees for each plant is:
" Developing technically sound strategies for maximizing the effectiveness of personnel and equipment in preventing and mitigating potential severe accidents. This includes ensuring that guidance and procedures to implement these strategies are in place at all plants."
Requirernents for Severe Accident Management Revision 1, November 19%
m:\3323w.wpf;1b-1113%
2-2 On November 4,1994, the Nuclear Energy Institute's (NEI) Nuclear Strategic Issues Advisory Committee voted unanimously to establish a formal industry position on severe accident management and to bind each of the utilities currently operating light water reactors in the ,
U.S.A. to implement the measures in that position by December 1998. The formal industry l position on severe accident management was issued as NEI 91-04, Revision 1, " Severe Accident Closure Guidelines" [Ref. 8]. The basic elements of the severe accident management
)
required by NEI 91-04, Rev.1 include written guidance, training and a process for periodic !
utility self-assessment. The NRC has accepted the industry position on severe accident -
management as a substitute for formal regulatory requirements [Ref.17] but is defining an approach for assuring the quality and effectiveness of the implementation of the industry's , l initiative. l The previous information is in regards to general positions of the NRC on severe accident
- l management, and it does not distinguish between current operating plants and new, I advanced plant designs. However, the NRC has indicated their interest in AP600 severe accident management through several of the Requests for Additional Information (RAls) which are presented in Appendix B. Specifically, RAI 720.55 asks how Westinghouse plans to use the AP600 Probabilistic Risk Assessment to identify and assess accident management measures. Furthermore, in RAI 720.56, the NRC asked how Westinghouse plans to address the five elements of accident management as defined in SECY-89-012. These elements are:
- 1) accident management procedures,2) training for severe accidents,3) accident management guidance,4) instrumentation, and 5) decision-making responsibilities. Subsequently, in RAI 480.212, the NRC asked about severe accident management actions that might be required after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to prevent or mitigate uncontrolled fission product releases. More recently, in RAI 480.439, the NRC has inquired about how insights developed from the AP600 PRA would be incorporated into the combined license (COL) applicant's severe accident management guidance.
In addition, the Advanced Light Water Reactor (ALWR) Utility Requirements Document (URD) [Ref 9] states that the Plant Designer shall establish the technical basis for a severe accident management program that includes core damage prevention and mitigation. The Plant Designer is also to translate the plant design bases into operational limitations and -
i responses which can then be developed into procedural guidelines and training by the Plant Owner. The Plant Designer is also responsible for confirming that the plant design is ,
compatible with the ERGS and the severe accident management program based on the plant ;
specific PRA and other relevant information. The NRC's Safety Evaluation Report for this l document states: "The use of PRA for developing and confirming the severe-accident )
management program and ERGS is also consistent with the Commission's severe-accident policy" [Ref.10].
Requirements for Severe Accident Management Revision 1, November 19%
m:\3323w.wpf;1b-1113%
t i
3-1 i
l 3 DECISION-MAKING PROCESS Severe accident management involves the implementation of actions to bring the plant to a controlled, stable state following core damage and to mitigate challenges to the containment fission product boundary. In a severe accident state, the frst two fission product boundaries l (the fuel rod cladding and the reactor coolant system) may be severely damaged and the ;
foets shifts to maintaining the final fission product boundary. To effectively choose the appre.priate severe accident management actions and to prioritized the implementation of the appropriate actions, assessment of the plant conditions is needed.
The nature of severe accidents and the possible responses dictate that severe accident management diagnostics be symptom-based. Several specific features of severe accidents can be cited which support the symptom-based approach:
a) Severe accident management must provide a response for a wide range of severe accident conditions. While a large number of possible scenarios have been identified in severe accident studies, it is likely that most of these scenarios do not accurately represent realistic severe accident scenanos due to modelling assumptions in these studies (such as all equipment failures are assumed to occur at time zero).
i During a severe accident, the plant conditions are undergoing continual change. !
b)
Severe accident management must relate actions to symptoms.
c) The overall goals of severe accident management involve the response to challenges to fission product boundaries, which can be diagnosed through symptoms.
In other words, the symptom-based approach is a key method to develop flexibility in the AP600 severe accident management guidance. This flexibility refers primarily to the ability of plant personnel to shift priorities and implement accident management strategies based on the situation of the plant during the accident. Specific technical decisions may be knowledge-based, and will be dependent on the interpretation of the plant status. Therefore, the appropriateness of specific actions cannot be predetermined during the development of ;
AP600 severe accident management guidance. This approach allows the guidance developed !
to be useful during any severe accident, even scenarios which are not currently recognized situations. As such, an AP600 severe accident management plan is the final stage in the defense-in-depth plant safety concept.
1 l
Although flexibility is a necessity, there is a need for the guidance itself to be a structured l process for choosing the appropriate actions based on actual plant conditions. Human factor considerations during a high stress environment that would accompany a severe accident require that the guidance be simple to use. Thus, the AP600 severe accident management I i l
Decision-Making Process Revision 1, November 19%
m:\3323w.wpf;1b-1113%
3-2 l
guidance must be an effective decision-making tool based on some fundamental concepts about the organization of the guidance, as detailed below.
3.1 ROLE OF THE PLANT PERSONNEL NEI has developed recommendations for severe accident assessment and mitigation that divide responsibilities of personnel into categories of evaluators, decision makers, and intplementors. The evaluators must assess the plant symptoms to determine the plant state, and then evaluate the potential strategies that may be used to mitigats the event. The decision makers are to assess and select the strategies to be implemented. The implementors ,
are responsible for performing the steps necessary to accomplish the objectives of the strategies, such as hands-on control of valves, breakers, controllers and special equipment.
The plant personnel to perform each of these functions will be identified by the AP600 COL applicant in the development of the severe accident management plan. Factors that will be considered include:
. The structure of the organization that is needed for accidents prior to core damage, so that there would be an orderly transition to management of the accident after core damage is diagnosed,
. The instrumentation, equipment and computers necessary to fulfill each function,
= The skills, training and expertise of personnel, The size and location of the necessary staff, and
. The desire to address severe accident management preparation, while still maintaining a focus on the prevention of core damage.
3.2 STRUCTURE OF AP600 GUIDANCE The AP600 guidance for severe accident management will include overall diagnostic tools that control the flow of the decision-making process, as well as detailed guidelines. The ,
following sections provide a summary of the expected flow charts, as well as further information on the content of the detailed guidelines.
l 3.2.1 Diagnostic Flow Chart As identified in Section 3.0, there is a need for severe accider t management guidance to have l an organized structure to facilitate effective decision-making. For AP600, the form of this Decision-Making Process Revision 1, November 1996 m:\3323w.wpf;1b-1113%
1 3-3 ~!
- structure should be based on the WOG SAMG, although some of the details may differ. The t element discussed within this section is the Diagnostic Flow Chart,' which is the primary
- decision-making tool to determine when the plant has achieved the overall goals of severe ;
accident management.
i The Diagnostic Flow Chart (DFC) is the primary tool to identify the appropriate guidelmes >
for the key possible plant conditions that may occur following a severe accident. The flow >
chart is the point of entry into severe accident management (from the ERGS), and it also i serves as the exit point. The flowchart is based on setpoints for different parameters that are j
. either necessary to define a controlled, stable state or which may prevent further challenges !
to fission product boundaries. The elements that determine a controlled, stable state are !
discussed in Section 4.0. Prevention of fission product boundary challenges refers to the l prevention of severe accident phenomena, which may challenge fission product boundary }
integrity, such as induced steam generator tube rupture, high pressure melt ejection and ;
reactor vessel lower head failure. Key plant conditions will be defined based on the capability to take actions to control the conditions and on the potential challenge to the ;
containment fission product boundaries which these conditions may indicate. Based on the l particular plant conditions identified in the DFC, a specific guideline is consulted to evaluate the availability and effectiveness of the various severe accident management strategies which j may be used to control the conditions. If a controlled, stable state is achieved, the DFC l instructs plant personnel to develop a set of limitations and cautions for the long term !
recovery process, based on the consideration of large quantities of fission products released ,
from the core and other important aspects of the severe accident scenario. The parameters in !
the DFC will be prioritized and thc setpoint values will be determined during the !
development of the detailed AP600 guidance. !
The development of the priorities for checking the parameters that determine a controlled .
stable state (i.e., the order of appearance of parameters on the DFC) will be based on fission ;
product challenges to the containment fission product boundary, the speed at which such !
challenges can occur, the time in the accident progression at which the challenges can occur, )
and the time available for intervention. The priorities and the actual values for the DFC l
. parameters (i.e., the setpoints) will be based on the AP600 severe accident response i characteristics as detailed in the AP600 PRA and will consider the severe accident j management insights identified from the AP600 PRA, as documented in Appendix A of tius '
.. 1 report. )
3.2.2 Severe Challenge Status Tree 1
The Severe Challenge Status Tree (SCST) is the primary tool used by the emergency response {
team to identify immediate and severe challenges to containment fission product boundaries l and to select the appropriate guideline for strategies to respond to the challenge. The SCST l identifies the severe challenges for all possible plant conditions that may occur following a !
Decision-Making Process Revision L November 1996 ,
m:\3323w.wpf:1b-H D% j
3-4 severe accident. The plant conditions on the SCST will be defined based on the severity of l the challenge and capability to take actions to control the conditions in time to mitigate the challenge to the containment fission product boundaries. Based on the particular plant conditions identified in the SCST, a specific guideline is consulted to evaluate the availability and effectiveness of the various severe accident management strategies which may be used to .
control the conditions. t f
The parameters in the SCST are regularly monitored to determine whether a severe challenge ,
has developed. The SCST parameters are to be monitored simultaneously with the usage of ,
the DFC. The existence of the SCST as a monitoring tool allows for the effective use of the ,
pre-prioritized DFC, which addresses less-immediate concerns. However,if the setpoint for a SCST parameter is reached, all activities being guided by the DFC would be put on hold until the SCST challenge has been addressed. -
l The development of the priorities for checking the parameters that determine challenges to i
the containment fission product boundary (i.e., the order of appearance of parameters on the SCST) will be based on the severity of the fission product challenges to the containment fission product boundary, the speed at which such challenges can occur, the time in the accident progression at which the challenges can occur, and the time available for intervention. The priorities and the actual values for the Severe Challenge Status Tree parameters (i.e., the setpoints) will be based on the AP600 severe accident response characteristics as detailed in the AP600 PRA and will consider the severe accident management insights identified from the AP600 PRA, as documented in Appendix A of this report.
3.2.3 Guidelines While a Diagnostic Flow Chart and Severe Challenge Status Tree are used to establish the organizational structure of severe accident management guidance, the details and the majority of the technical content are contained within guidelines. Guidelines are referenced ,
directly from the DFC or SCST due to a plant parameter being outside the desired range.
The structure of the guidelines will include the following major considerations: -
i
)
- 1) Equipment Availability - The guidelines will contain lists of the possible equipment ,
l that may be used to implement an action. If no equipment is available, instructions will include the consideration of restoring the non-functioning equipment.
- 2) Benefits vs. Potential Negative Impacts - The potential actions will be considered in l regards to their benefits weighed against the expected negative impacts. If the negative impacts are judged to be large, then methods to minimize the negative impacts will be considered when possible. If the impacts differ based on the choice of ;
methods or equipment, this distinction will be made. 1 Decision-Making Process Revision 1, November 1996 m:\3323w.wpf:1b-1113%
i 1
3-5 1
i
- 3) Implementation - If the decision is made to implement a strategy, implementation instructions will be provided that include any limitations that were identified during the evaluation. The implementation instructions will also identify the expected response of the plant as a basis to compare the actual response. The option to abort the action, or to implement additional actions, will also be considered.
- 4) Long Term Concerns - Once a severe accident management strategy is implemented, there may be one or more additional plant parameters that require periodic
~
surveillance to assure that the strategy implemented will continue to be effective.
, These generally include support functions such as an adequate water supply, and continued equipment cooling. The identification of the long term concerns associated i with the implementation of any severe accident management strategy should also include a brief description of the actions that can be taken to address the long term concerns when they become critical to the continuation of the selected strategy.
l 1
I i
l l
Decision-Making Process Revision 1, November 1996 m:\3323w.wpf:1b-1113%
i
l l
4-1 1
4 SEVERE ACCIDENT MANAGEMENT GOALS Before any guidance for severe accident management can be developed, the first step is to identify the overall goals that tl e guidance must achieve. As stated in the introduction, the overall objective of severe accident management is to terminate the core damage progression.
However, the scope of severe accident management also entails maintaining the capability of the containment as long as possible, and minimizing fission product releases and their effects.
These severe accident management objectives can be translated into specific goals that must be met. These three goals are: 1) to return the core to a controlled, stable state, 2) to
, maintain or return the containment to a controlled, stable state, and 3) to terminate any fission product releases from the plant. Secondary goals, to be achieved while focusing on the primary goals, are to i) minimize fission product releases, and ii) maximize equipment and monitoring capabilities.
Before details are provided on each of these goals, it should be noted that severe accident management does not guarantee the achievement of the goals. Severe accident management l is a structured approach that best utilizes available resources at the plant based on the current understanding of severe accidents.
l 4.1 CONTROLLED, STABLE CORE STATE A controlled, stable core state is defined as core conditions under which no significant short term or long term physical or chemical changes (i.e., severe accident phenomena) would be expected to occur. A significant short term or long term change is one which would require an operator response to prevent a change in core location, a challenge to containment integrity, or fission product releases. In order to achieve a controlled, stable core state, two primary conditions must be met:
- 1. A process must be in place for transferring all energy being generated in the core to a long term heat sink.
- 2. The core temperature must be well below the point where chemical or physical changes might occur.
For a severe accident, the core is assumed to be uncovered and overheated when severe accident management begins. Therefore, both decay heat and sensible heat must be removed from the core, along with any chemical heat which is produced during the recovery phase.
However, providing a means to remove all of the core energy does not guarantee a l controlled, stable core state. This is best illustrated by the TMI-2 accident in which core l
relocation continued for a significant period of time after a process was in place for cooling the core [Ref.11). This was because the core geometry did not facilitate efficient transfer of i
Severe Accident Management Goals Revision 1, November 1996 m:\3323w.wpf:1b-1113%
4-2 energy from the molten core material to the coolant. Thus, the core can only be considered in a controlled, stable state when its temperature is sufficiently low, and a heat removal I
process is in place. Thus, both criteria are necessary and sufficient conditions for achieving a [
controlled, stable core state. !
1 The amount of energy that will have to be transferred from the core is dependent on whether (
the core remains subcritical. Before significant downward relocation of core material occurs, j the amount of negative reactivity required for subcriticality is bounded by the ERG cons'derations.
i As core downward relocation progresses, the required negative reactivity for subcriticality decreases due to geometry compaction [Ref.12]. The core compaction results in , (;
a significant change in the local moderator to fuel volume ratio, thus requiring less negative
, reactivity such as control rods or soluble boron. i
, i 1
However, for severe accident management, the extent of core relocation cannot be ;
determined during the accident itself. If the water injected during the severe accident comes j solely from the tanks inside the containment that are sufficiently borated, then there is no ;
chance that the shutdown margin will be lost. However, if the only available water sources l do not contain sufficient boron to ensure that the suberiticality conditions are achieved, there ;
is the potential for a return to power, depending on the core geometry. The use of ;
unborated (or under-borated) water could only result in a return to power in the core at very l low levels, which is a function of the injection rate to the core. For this scenario, the core !'
would be likely to continue to degrade since all of the heat generation is not removed by boiling of the injected water, resulting in a change in core geometry which leads to a '
subcritical state.
i If the core returns to a critical state, the excess reactivity would be compensated by void formation in the water. However, the rate at which criticality is approached must be sufficiently slow that the feedback associated with the void development can be effective. If the injection rate of the water were too high, prompt recriticality could be a concern, which could damage reactor coolant piping or steam generator tubes. However, generic severe j accident studies [Ref. 7] have conservatively shown that even flow rates of 1000 gpm are an l order of magnitude too low for prompt criticality. Since this is higher than any expected .
injection flowrates for the AP600 plant, there is no need to further consider criticality or 4 prompt criticality issues.
The cooling of the core can be accomplished via several methods. The preferred method is to I
cover the core debris with water while it is still in the reactor vessel. If the core cannot remain covered with water while in the vessel, submerging the bottom head of the reactor vessel with water may be sufficient to remove the core heat. [Ref.13 and Ref.14] If this method of flooding the containment cavity is successful and if the reactor coolant system is sufficiently depressurized, it prevents reactor pressure vessel (RPV) failure and movement of the core material into the containment. Although either water inside the RPV or water Severe Accident Managernent Goals Revision 1, November 1996 m:\3323w.wpf:1b-1113%
4-3 submerging the bottom head of the RPV may be sufficient, the ideal condition is to create water inventories both inside and outside the RPV. This maximizes the possibility of reducing the core temperature and ensuring that further physical and chemical changes can no longer occur.
If the core remains within the RPV, not only must the core initially be cooled, but a long term heat removal process must be established. The first possibility to be considered is heat transfer to the steam generaters. For this option to be feasible, there must be a water inventory in the secondary side of the steam generators, the reactor coolant system (RCS) should be relatively intact, and there must be some water inventory ~within the RCS.
However, it is not necessary to have a complete RCS water inventory, since condensation of steam is also an effective heat transfer mechanism.
Another possibility for long term heat removal while the core is within the reactor vessel is to use the passive residual heat removal (PRHR) system. This system is based on natural circulation from the RCS to heat exchangers in the in-containment refueling water storage tank (IRWST). Within the IRWST, the heat is then transferred to the containment through steaming. Therefore, the PRHR is an indirect method to transfer the core heat to the containment. For the PRHR to function, the RCS must be relatively intact, and there must be some water inventory within the RCS. In addition, there must be a sufficient water inventory within the IRWST. Since the IRWST is the largest water source for refilling the RCS and to flood the containment cavity, the IRWST water inventory is not likely to be maintained during a severe accident, and thus this method is not likely to be available for long term heat removal from the RCS unless the IRWST can be refilled from an external water source.
The third long term heat transfer process to be considered is a direct path to the containment, which is then cooled through passive containment cooling. If there is a loss-of-coolant accident (LOCA), steaming from the break can be an effective heat transfer medium, provided that additional water can continually be provided to the RCS. For a non-LOCA transient, an opening in the RCS can be created for direct steaming, such as opening the
. fourth stage valves of the automatic depressurization system (ADS). Another heat transfer pathway to the containment is via direct heat transfer through the walls of the RPV, coolant loops and direct vessel injection lines if water is surrounding the outside surfaces.
If the severe accident is not mitigated before the RPV lower head fails and the core debris is transported ex-vessel, the only long term heat sink is the containment. In this scenario, a water inventory in the reactor cavity and the containment is needed for initial core cooling and long term heat removal. If the limited surface area of the core debris is not sufficient to permit removal of decay heat and sensible heat, the core debris will remain molten and lateral movement will increase the heat transfer area until cooling can occur. Although some ablation of the concrete basemat may occur in this case, the investigations reported in the i
Severe Accident Management Goals Revision 1, November 1996 I m:\3323w.wpf:1b-1113%
4-4 I
l AP600 PRA indicate that the core will eventually be quenched and concrete ablation will be l arrested. One of the features of the AP600 plant is that the reactor cavity has been designed with sufficient floor area to permit debris spreading until a coolable geometry can be created.
Thus, the cooling of the core debris external to the reactor vessel can be accomplished in the presence of water. However, if the core debris is transported ex-vessel into a dry reactor l cavity, the core debris will begin to ablate the concrete basemat. Subsequent introduction of ;
water into the reactor cavity may only be partially successful in arresting the concrete j ablation. Thus, it is important that the reactor cavity be flooded prior to core relocation from i the reactor vessel and that a continued supply of water be available to maintain a water .
cover over any core debris in the reactor cavity. , i For core material dispersed at reactor vessel failure and refrozen on vertical containment surfaces and equipment, or present as thin layers on horizontal containment surfaces or -
equipment, no water may be required for long term cooling. Generic analyses [Refs.13 and 14] show that convection or the decay heat to the containment atmosphere could be sufficient to ensure long term cooling. If decay heat cannot be removed by convection, the dispersed core material will heat-up, become molten, and eventually drain to lower levels of the containment. Downward relocation of core debris will stop when all of the heat can be removed, either via convection from a new configuration or via transfer to water if the debris becomes submerged at lower containment levels. Furthermore, AP600 is designed such that only a small fraction of the core debris that is ejected from the reactor vessel could reach the upper containment area. [Ref.13] Therefore, core coolability after vessel failure remains primarily a concern of establishing a water inventory in the lower cavity.
l Thus, to maximize the possibility of achieving a controlled, stable core cordition, the I elements that must be considered in severe accident management are:
- water inventory in the RCS, water inventory in the containment cavity,
- heat transfer to the steam generators, and a heat transfer to the containment.
4.2 CONTROLLED, STABLE CONTAINMENT STATE i
A controlled, stable containment state is defined as containment conditions under which no l significant short term or long term physical or chemical changes would be expected to occur. l A significant short term or long term change is one which would require an operator !
response to prevent a challenge to containment integrity or fission product releases. In order l to achieve a controlled, stable containment state, several conditions must be met, as summarized below. ;
Severe Accident Management Goals Revision 1, November 1996 m:\3323w.wpf;1b-1113% j
4-5
( 1. A process must be in-place for transferring all of the energy that is being released to the containment to a long term heat sink.
- 2. The containment boundary must be protected and functional.
- 3. The containment and reactor coolant system conditions must be well below the point where chemical or physical processes (severe accident phenomena) might result in a l dynamic change in containment conditions or a failure of the containment boundary.
~
l The first two of these conditions are relatively straight-forward for the AP600. The energy
, removal condition requires that a heat sink be available and that a process for getting the energy from the containment to the heat sink exists. Without a means to remove the energy transferred from the core and from chemical processes occurring during a severe accident, the containment pressure and/or temperature will increase to the point where the !
containment structural integrity could be challenged. Thus, ensuring that an adequate containment heat sink exists will prevent containment pressures and temperatures from reaching the point where the integrity of the containment boundary is challenged. For the AP600 plant, the primary containment cooling mechanism is the Passive Containment Cooling System (PCCS). This system causes the gravity drain of water onto the outside of i the steel containment vessel, which then evaporates into the natural circulation air flow around the containment vessel. The PCCS has sufficient water inventory to operate for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following an accident. The PRA results indicate that with the PCCS in operation, the containment pressure remains below the design pressure for all severe accident scenarios.
If the water flow over the outer containment shell is not available, air cooling alone is sufficient to remove decay heat from the containment. In the case without PCCS cooling, the AP600 PRA shows that the containment pressure will exceed the design pressure and approach the containment ultimate pressure capability. The AP600 PRA shows that although there is a very small probability of exceeding the containment pressure capability without PCCS operating, the containment pressure remains well below the median estimate of the containment ultimate capability. In either case, (with or without PCCS cooling), natural circulation of air around the outside of the containment requires that the drains at the bottom of the annulus remain open to prevent an accumulation of water from blocking the natural
, circulation flow path. In addition to the heat removal capability of the containment shell, the l AP600 fan cooler system may be available to supplement the passive cooling. While the !
AP600 fan cooler heat removal capability cannot match decay heat, it can be an effective !
~
supplement to the passive heat removal capability of the containment shell.
i The containment boundary condition requires that containment isolation be established and maintained. In the case of severe accidents the containment boundary includes a.ll piping which penetrates the containment and which can have an unrestricted pathway to the l environment. These pipes can be considered to be isolated if at least one valve in the pipe is closed (plus any bypass valves in parallel pipes), the line is pressurized with water, or a
( water seal is established in the line. In other words, all piping which is not actively carrying l
Severe Accident Management Goals Revision 1, November 1996 m:\3323w.wpf:1b 1113%
4-6 water to or from the containment, as part of severe accident management, must be isolated by closing at least one valve or establishing a sufficient water seal to prevent release of reactor coolant or containment fluids. Containment isolation considerations extend to the steam generators, main steam lines and feedwater lines since steam generator tube faults (either tube failures or pre-existing leaks) are a major concern for severe accident management. The limited number of containment penetrations in the AP600 design greatly simplifies this consideration, compared with the current generation of plants.
The third condition for a controlled, stable containment state is more difficult to accomplish than the previous two conditions. The changes in containment conditions which can lead to ,
challenges to the containment include dynamic changes which cannot be predicted by trending containment parameters and longer term changes which can be more readily predicted by monitoring containment parameters. Both of these iypes of changes are of interest since they contribute to the potential for failure of the containment boundary. The dynamic and long term changes in containment conditions considered here are a result of severe accident phenomena. The severe accident phenomena considered in this goal include:
Hydrogen flammability, including diffusion flames Core / concrete interactions (CCI)
- High pressure melt ejection (HPME), which includes
- Direct containment heating (DCH)
- Reactor vessel lift-off
. Steam explosions Creep rupture failure of reactor vessel or SG tubes Vacuum caused by hydrogen burning or venting Although the treatment of severe accident phenomenology for AP600 has been addressed in WCAP-13388, the discussions below summarize the impacts on management of the severe accident.
4.2.1 Hydrogen Flammability The first of the severe accident phenomena to be considered is hydrogen. The containment pressure rise when a flammable hydrogen mixture is burned in containment is a direct ,
function of the mass of hydrogen present in the containment. During a severe accident, hydrogen is expected in the containment as a result of the in-vessel reactions between the fuel rod cladding and the steam as the core overheats. For any accident sequences in which the RCS pressure is low during core melting, most of the hydrogen generated would be released from the RCS to the containment. However, for sequences with high RCS pressures, a large fraction of the in-vessel hydrogen generation might be trapped in the reactor coolant system. For these latter sequences, a failure of the RCS or an intentional action to depressurize the RCS to the containment (such as any stage of the AP600 ADS) after Severe Accident Management Goals Revision 1, November 1996 m:\3323w.wpf:1b-1113%
4-7 significant core damage has occurred cz.n suddenly change the containment conditions and may have an impact on hydrogen flammability. In addition, the AP600 PRA shows that some modes of RCS depressurization using the ADS Stages 2 and 3 (which discharge to the IRWST) may result in the creation of a standing diffusion flame near the IRWST vents. The AP600 PRA also indicates that diffusion flames may be created in the Core Makeup Tank (CMT) room for the Direct Vessel Injection (DVI) line break scenario. In this scenario, the diffusion flame is created when the containment water level exceeds the DVI line break location and the core is reflooded through the DVI line; the additional hydrogen during reflood can results in the creation of a diffusion flame. Although the AP600 PRA analyses
, predict that these diffusion flames will not challenge the containment integrity, they can lead to a significant change in containment conditions.
Although the AP600 plant is equipped with hydrogen igniters, this discussion is in relationship to scenarios in which the igniters fail and hydrogen accumulates. AP600 analyses have shown that the containment can withstand the pressure transient from the deflagration of the hydrogen equivalent to 100% of cladding oxidation. The AP600 PRA analyses also show that the containment atmosphere is well mixed due to the natural circulation currents setup inside containment for passive heat removal through the containment shell. The analyses do not predict any significant local concentrations of flammable gases that require accident management considerations. If significant core debris is released to a dry containment, core / concrete interactions can result in additional hydrogen generation along with carbon monoxide, which is a flammable gas. Another significant source of hydrogen to be considered is from interactions between unreacted (unoxidized) metals in the core debris and water or steam in the containment after reactor vessel failure.
Since a hydrogen burn can result in a change in containment conditions, a controlled, stable containment can only be achieved if the hydrogen is maintained in a nonflammable state and no significant sources of additional hydrogen are expected. Thus, a controlled, stable containment state with respect to flammable gases requires that: a) the core is covered by water, b) the containment hydrogen is less than the global flammability limits for containment conditions near ambient, c) there are no ongoing core concrete interactions, and
. d) the reactor coolant system is at a low pressure.
l 4.2.2 Core / Concrete Interaction Core / concrete interaction (CCI) can produce substantial changes in the containment conditions in a number of different ways. CCI results in the erosion of the bottom of the containment structure and can result in a containment failure at the basemat. CCI also results in the production of hydrogen and carbon monoxide gases which increases the flammable gas concentration in the containment. CCI without an overlying water layer also results in substantial heating of the containment gases via high temperature gas generation, j convective heating of existing gases and radiative heating of nearby structures. In addition, Severe Accident Management Goals Revision 1, November 1996 m:\3323w.wpf:1b-1113%
, 4-8 CCI can result in core material configurations which may not be readily coolable, even in the
. . presence of an overlying water cover.
Core / concrete interaction can be prevented by having an adequate level of water covering the containment and the reactor cavity floor. The reactor cavity water inventory can submerge the reactor vessel and thereby prevent the core debris from leaving the reactor vessel. In the event of reactor vessel failure, the water inventory in the reactor cavity can quench and cool core debris in this region to prevent core / concrete interaction. ' Thus, a -
controlled, stable containment state, with respect to core / concrete interaction, requires that either: a) the core is in the reactor vessel (as a result of either recovering in-vessel cooling or ,
submerging the reactor vessel) or b) the containment and reactor cavity floor regions are covered with sufficient water to quench any core debris discharged from the reactor vessel i
and c) water recirculation back to the cavity is available to maintain the cavity water level, -
- and thus core debris cooling.
4.2.3 High Pressure Melt Ejection If the reactor vessel fails while the reactor coolant system is at a high pressure, several severe
, accident phenomena can occur which have the potential for producing substantial changes in the containment conditions. The subsequent high pressure melt ejection (HPME) can produce direct containment heating (DCH) effects which may substantially change the i containment pressure and temperature. HPME can also result in vertical movement of the reactor vessel due to the thrust forces generated by core debris escaping through the failure location in the RPV. Some studies have indicated that the movement of the RPV may result in sufficient movement in other piping connected to the RCS to tear containment penetrations, thereby challenging containment integrity conditions. HPME also produces a substantial change in the containment hydrogen concentration as described under the hydrogen flammability discussion above. HPME is prevented by either preventing reactor vessel failure or by reducing the RCS pressure.
~ '
4.2.4 Steam Explosions 4
. Steam explosions, both within the RPV and in the containment, have been postulated as a !
l concern because O y may result in substantial changes in containment conditions by creating ,
breaches in the containment boundary. Steam explosions are a subset of core-coolant interactions which can produce rapid pressure changes in the RCS and the containment.
Steam explosions have an accompanying shock wave which, by itself can cause damage to
. the containment or RCS boundary [Ref.15]. !
An evaluation specific to the AP600 design was conducted to investigate the potential for in-
- vessel steam explosions. The evaluation concludes that in-vessel steam explosions cannet generate sufficient energy, in a short time scale, to generate a missile that could fail the Severe Accident Management Goals Revision 1, November 1996 m
- \3323w.wpf:1b-1113% ,
1
, - . - , ,----,,,,.y ---
,, -, , y -- -
w
4-9 AP600 containment [Ref.13]. In addition, the evaluation shows that the peak pressure from any potential in-vessel steam explosion is well within the normal operating pressure of the reactor coolant system. Therefore, the integrity of the RCS pressure boundary is not threatened.
Because of the AP600 containment layout, a significant ex-vessel steam explosion from core debris-water interaction can occur only in the reactor cavity. Evaluation of both steam ;
generation rates and potential shock waves induced by debris-water interactions shows that their magnitude is not expected to be sufficient to threaten the AP600 containment integrity. l
~
. [Ref.13] The impact of the shock wave on the cavity wall and vessel support structure was also evaluated as part of the AP600 PRA evaluations, with the conclusion that while the structural integrity of the cavity walls may be threatened, there is no impact on the overall containment integrity. Therefore, the principal consequence of ex-vessel explosive debris-water interaction is to rapidly cool the debris and pressurize the containment. Neither the steam generation nor the shock waves are expected to challenge the containment integrity for any credible accident scenario.
4.2.5 Creep Rupture Failure Core damage accident scenarios in which the core material is located within the reactor vessel can lead to substantial changes in the containment conditions if either the reactor vessel, the reactor coolant system piping or the steam generator tubes should fail. Reactor vessel failure is primarily a result of contact between molten core material and the inside surface of the vessel bottom head. Reactor coolant system piping and steam generator tube failures are primarily a result of the circulation of high temperature gases within the reactor coolant system which leads to creep rupture failure of the piping.
Creep rupture failure of the RCS piping can result in substantial changes in the containment pressure, hydrogen concentration and fission product inventory. Creep rupture failure of the RCS piping can only occur if the RCS pressure is near its nominal operating value and is a result of heating the pipe walls to a high temperature under high stress conditions. Thus, e
creep rupture failure of the RCS piping can be prevented by reducing the RCS pressure or submerging the RCS piping in water. Creep rupture failure of the SG tubing can result in substantial changes in the containment integrity since the secondary side of the steam generator pressurizes to the SG safety valve setpoint. This creates a direct pathway for fission product transport from the RCS to the environment. Creep rupture failure of the SG tubes is a result of heating the tube walls to a high temperature and can only occur under conditions of high RCS pressure and a dry steam generator secondary side. Thus, creep rupture failure of the SG tubes can be prevented by reducing the RCS pressure or maintaining an adequate SG secondary side water inventory.
Severe Accident Management Goals Revision 1, November 1996 m:\3323w.wpf:1b-1113%
._ _ _ _. _ ._ _ _ __ _ __.. _ _. . _ .._ _ ._ _ _ _ _ .- _ m _ . _ .m. _ ._.. _ . _ _..
-l 4 10 ;
j
- 4.2.6 Containment Vacuum l
l
- The final severe accident phenomena which must be considered in the definition of a !
controlled, stable containment state is the potential for changes in containment conditions which would result in a substantial vacuum in containment. A substantial vacuum in j i
containment could result in containment boundary failure. These conditions are most likely to be t concern following a large hydrogen burn in the containment or following relief of j some portion of the containment gases to the environment. A hydrogen burn will consume I some of the oxygen which was present in the containment prior to the accident. Upon . l condensation of all of the steam in containment and the reduction in containment .
temperature to near its pre-accident value, the gas volume may be reduced by as much as 21% (assuming all of the oxygen is consumed in a hydrogen burn). This could result in a ;
containment vacuum which challenges the negative design pressure of -2.5 psig. l In severe accident scenarios where a portion of the containment gases were released to the environment, either through late containment isolation or intentional containment venting, the potential for a strong containment vacuum which threatens containment integrity may ;
. also exist. To prevent these conditions, air or water must be introduced to the containment j such that the containment pressure is within the normal range when the containment !
temperature is near its nominal value. Thus, a controlled, stable containment state requires !
that the containment pressure be nearly ambient with no further significant decreases ]
expected. l i
To maximize the possibility of achieving a controlled, stable containment condition, a summary of all the elements that must be considered in severe accident management are:
. heat transfer from the containment,
- isolation of containment, ,
e hydrogen prevention / control, -
=
core / concrete interaction prevention,
- high pressure melt ejection prevention, creep rupture prevention, and * -
a containment vacuum prevention.
Severe Accident Management Goals Revision 1, November 1996 m:\3323w.wpf:1b-1113%
- - . - - . .- - ~. -- .
l 4-11 4.3 FISSION PRODUCT RELEASE PREVENTION, TERMINATION AND '
- MITIGATION To achieve the goal of terminating fission product releases from the plant, several conditions must be met
- l
- 1. The isolation of the containment boundary, including penetrations and steam
. generator tubes, must be maintained.
a -
. 2. The fission product inventory of the containment atmosphere must be minimized.
- 3. Significant leakage through the containment boundary must be stopped.
= \
Some of these conditions may be duplicates of previous conditions for maintaining a controlled, stable core and/or containment state. They are also included here to reinforce the goal of controlling and terminating fission product releases during a severe accident.
Prevention (or termination) of fission product releases therefore requires that the containment boundary be maintained and/or isolated or that the driving force for leakage be eliminated.
The containment boundary includes the containment structure, the containment penetrations, the steam generators tubes, and the piping of systems connected to the RCS or containment up to the first isolation valve which is operable. Isolation of the containment boundary includes: a) maintaining existing containment boundaries, and b) closing appropriate valves that isolate systems directly cormected to the containment atmosphers or the reactor coolant system, or c) creating a water seal whose static head is greater than the driving force where the first two methods are not available. All a the considerations for maintaining the containment boundary to prevent unconirolled fission product releases are covered under the goal of maintaining a controlled, stable containment state and are not repeated for the termination and mitigation of fission product releases.
Reducing the inventory of fission products available for release can be a function of the a
release pathway, which may be directly tied to the accident sequence. For containment releases, the fission product inventory airborne in the containment can be reduced by maintaining the RCS integrity thereby retaining a large fraction of fission products in the RCS. In addition, flooding the containment to submerge RCS piping and flooding the steam generators to submerge the U-tubes would provide cold surfaces for fission product deposition and retention. For release pathways which b pass3 containment, such as steam generator tube faults or leaks and interfacing system LOCAs (ISLOCAs), the fission product transport can be reduced by reducing the RCS pressure. Also, fission product scrubbing by submerging the release pathway is effective in reducing the dispersion.
Severe Accident Management Goals Revision 1, November 1996 m:\3323w.wpf:1b-1113%
4-12' In the AP600 design, airborne fission product removal is performed by the operation of the passive containment cooling system. The steam released in containment is condensed on the steel containment shell due to cooling from the passive containment cooling system and this process removes airborne fission products. Fission products that are deposited in the containment sump are retained within the water by the containment sump pH control system. This system adds a chemical buffer to the floodup inventory in containment to maintain the required recirculation sump pH to promote fission product retention.
' The final condition for this goal is to actually terminate the leakage from the containment.
Terminating leakage includes eliminating the driving force for leakage (generally a pressure ,
differential across a leakage path), isolating the leaking system, or creating a water seal whose static head is greater than the driving force. Several sources of leakage are worthy of consideration in the SAMG, including: containment, steam generators, and systems -
connected to either the containment or the RCS. Low levels of leakage from these sources are permitted within the plant design basis. The results of analyses which establish
. permissible leakage, with respect to offsite doses, are reported in the plant Safety Analysis Report. However, to de-escalate the emergency condition during a severe accident, essentially all of the leakage must be terminated. In the case of containment sources, the leakage can be terminated by reducing contaimnent pressure to near atmospheric. Leakage through containment penetrations can be terminated by closing all valves in the piping and/or by creating water seals in the piping. In the case of the steam generator tubes, leakage can be terminated by keeping the secondary system pressure above the RCS pressure. For systems connected to the RCS and containment, leakage can be stopped by finding alternative methods of accomplishing the same function. For example, recirculation systems which involve transporting high levels of radioactive water outside the containment can result in even very small amounts of leakage being significant. Use of systems that keep all radioactive water within the containment are preferred.
To maximize the possibility of terminating fission pr6 duct releases, a summary of all the elements that must be considered in severe accident management are:
. isolation of containment, =
. reduce fission product inventory, and
. reduce fission product driving force. ,
4.4 SECONDARY GOALS Although the previous sections have addressed the goals that must be met for successful mitigation of a severe accident, there are two additional considerations that should be addressed. These considerations have been termed " secondary goals," since they are not fundamental to the termination of the accident, but their impact is widespread. The secondary goals affect the evaluation of which actions, or strategies, to implement. The two Severe Accident Management Goals Revision 1, November 19%
m:\3323w.wpf:1b-1113%
4-13 secondary goals are: i) to minimize fission product releases, and ii) to maximize equipment and monitoring capabilities.
l The secondary goal to minimize fission product releases is similar to the primary goal of i terminating fission product releases. However, the distinction is in the recognition that there may be a need to create an intentional, controlled, and short term fission product release to prevent a larger, uncontrolled, and long term release. Specifically, this is in reference to containment venting,if there is believed to be an immediate threat to the integrity of the containment structure. However, any action which violat.es the primary goal of terminating
, fission product releases should be done in a manner that minimizes the release. Another example is se case of steam generator depressurization. There are pathways that blow down directly to the environment, and other pathways (such as through the condenser) that would allow fission products to be scrubbed, and thus dispersion minimized.
The other secondary goal, to maximize equipment and monitoring capabilities, acknowledges that the survivability of some equipment and instruments may become questionable under some severe accident conditions. In general, severe accident conditions are no more severe than the design basis for instrumentation inside the containment. Depending on the scenario, however, temperatures and pressures may exceed the containment design basis, and thus the operability of instruments and equipment is uncertain. Therefore, when making severe accident management decisions, the impact on the instruments and equipment is a factor that should be included in the evaluation process.
The capability to repair and maintain equipment following the onset of a severe accident is also important. First, to arrive at a severe accident condition, it is quite likely that some of the plant equipment is not operable. Second, during a severe accident, the potential exists for malfunctions in equipment which is being used during the recovery. Third, since equipment may be used in non-standard ways for severe accident response, local access to areas may be required for valve alignments and/or equipment maintenance. The severe accident progression or actions taken to recover from the severe accident conditions may compromise the habitability, particularly due to high radiation levels, of certain plant areas
. and result in a condition in which some equipment cannot be aligned, maintained or repaired. As in the case of environmental conditions and power supplies for equipment operability, severe accident management decisions should take into account the habitability of plant areas in which alignment, maintenance or repair of equipment enhances the recovery capabilities.
Severe Accident Management Goals Revision 1, November 1996 m:\3323w.wpf:lb-1113%
I 5-1 5 HIGH LEVEL ACTIONS FOR AP600
- Based on the severe accident management goals defined in the previous section, certain elements are necessary to meet the goals. The elements can then further be divided into actions to be taken. The relationship of severe accident management goals to potential actions are summarized in Table 5-1, which forms the basis for possible severe accident management strategies.
The definition of a strategy for AP600 severe accident management consists of three components. A strategy is 1) an action or set of actions that 2) is taken for a specific purpose with 3) specific piece (s) of equipment. A strategy includes more than just the action, since the purposes must be well-understood for an effective evaluation, and the equipment to be used may impact the positive and negative expectations. This is the same strategy definition that was used for the WOG SAMG program, and it initially produced a list of over fifty strategies. Eventually, the strategies were combined to form a smaller number of guidelines, and they were grouped based on the potential actions. Since the AP600 severe accident management program is being developed based on the WOG SAMG program, this same process will be followed.
The information within this section is grouped according to the high level actions that may l be taken during the management of a severe accident. The discussion of each high level
{
action includes the identification of the benefits (purposes) of the action, the potential '
negative impacts, and the equipment possibilities. The development of the high level strategies is a preliminary step in the development of the AP600 severe accident management ]
guidance.
The information in this section considers the AP600 PRA, through Revision 8, and the
)
accident management insights derived from the PRA as discussed in Appendix A. 4 5.1 INJECT INTO RCS Injecting water into the RCS is the most fundamental action to mitigate the progression of a core damage accident. Regardless of where the core has relocated, the RCS may be the most
, effective pathway to get the water to the core debris. The underlying cause of all severe accidents is the inability to remove the decay heat generated by the core. Therefore, injecting water to the core region is the most direct means of restoring core cooling and stopping the accident progression.
As just stated, one of the benefits of injecting water into the RCS is the restoration of core cooling. The only possibility of preventing the core from relocating to the RPV lower head is to restore injection flow. As water initially flows to an overheated core, the water will High Level Actions for AP600 Revision 1, November 1996 m:\3323w.wphlb-1113%
5-2 Table 5-1 AP600 High Level Actions Relative to Severe Accident Management Goals Goal Element High Level Action Controlled, stable core Water Inventory in RCS - Inject into RCS
- Depressurize RCS Water Inventory in Containment - Inject into Containment Heat Transfer to SGs - Inject into RCS "
- Inject into SGs
- Depressurize SGs
- Heat Transfer tc, Containment - Inject into RCS
- Inject into Containment ,
- Depressurize RCS Controlled, stable Heat Transfer from Containment - Depressurize Containment containment - Vent Containment Isolation of Containment - Inject into SGs
- Depressurize RCS Hydrogen Prevention / Control - Vent Containment
- Pressurize Containment
- Burn Hydrogen
- Depressurize RCS
- Inject into Containment CCI Prevention - Inject into Containment HPME Prevention - Inject into Containment
- Depressurize RCS Creep Rupture Prevention - Depressurize RCS
- Inject irito SGs
- Inject into Containment Containment Vacuum Prevention - Pressurize Containment Terminate fission product Isolation of Containment - Inject into SGs releases - Depressurize RCS Reduce Fission Product Inventory - Inject into Containment
- Depressurize RCS i
- Depressurize Containment .
Reduce F.P. Driving Force - Depressurize Containment l
High Level Actions for AP600 Revision 1, November 1996 )
m:\3323w.wpf:1b.1113%
5-3 flash to steam due to the high temperatures in the core region. Heat can be removed from 4
the core by sensible and latent heat addition to the water and sensible heat addition to the steam.
i If the flow of water can remove energy at a rate exceeding the decay heat rate, then core cooling can eventually be restored.
Another benefit of injecting water into the RCS is the scrubbing of fission products. If a pool of water is overlying a core debris bed, fission products released from the core debris bed
, will be scrubbed by the water pool. Fission product scrubbing can result in a significant
. reduction in the amount of fission products released to the containment atmosphere. A water depth of a few feet is a sufficient level to significantly increase the decontamination ,
factor. [Ref.11] )
1 l
Finally, injection of water into the RCS may help retain the core within the reactor vessel. l 4
The energy removed by the water can slow the core damage progression and may delay or even prevent vessel failure. The injection of water during the TMI-2 accident, for example, provided sufficient heat removal to retain the core debris within the vessel. However, there is no guarantee that the injection of water in another severe accident would prevent the vessel from failing. Nevertheless, even a delay in vessel failure is a benefit worth achieving, j l
l There are also negative impacts from injecting water onto hot core debris durmg a severe '
accident. The key potential impact of these adverse effects should be considered before a decision is made to implement the strategy. The key potential negative impacts are the production of hydrogen and the potential for creep rupture of the steam generator tubes. A summary of these drawbacks is provided below.
The hot fuel cladding, in the presence of steam, oxidizes and produces significant amounts of hydrogen. If the containment hydrogen igniters are not working, the accumulation of hydrogen in the containment is a concern. Although AP600 analyses have shown that the containment can withstand the deflagration of hydrogen produced from 100% of the cladding
. being oxidized, the containment integrity could be challenged if there are significant additional combustible gases. The production of hydrogen is unavoidable when adding water to an overheated core (above 1800 F). However, the total hydrogen production for accidents where the core is recovered in-vessel should be less than 100% cladding oxidation.
Ultimately, to achieve a controlled, stable containment, the possibility of future hydrogen production must be minimized by covering the core with water. Without the reflooding of the core debris, the potential exists for significant additional hydrogen production that could later create a containment challenge. Therefore, although the hydrogen production due to injecting water into the RCS is a negative impact, it is not a containment challenge.
High Level Actions for AP600 Revision 1, November 1996 m:\3323w.wpf:1b.1113%
5-4 l l
i The AP600 PRA shows that hydrogen diffusion flames at the IRWST vents do not present a i threat to containment integrity based on opening the ADS valves to the IRWST in the AP600 PRA sequences. The same conclusion is reached with respect to diffusion flames in the CMT room for the case of a DVI line break. However, other sequences may not have similar conclusions. Additional investigations need to be carried out to define any special conditions under which opening the ADS valves to the IRWST could result in diffusion flames that could challenge the containment integrity. !
I Another potential negative impact is creep rupture of the steam generator tubes. This is a l failure mode that can occur when the steam generator tubes are subjected to high ,
i temperatures and large primary-to-secondary pressure differences. Tube temperatures can reach creep rupture limits quickly if hot gases that accumulate in the core upper plenum are forced into the steam generators by the rapid steaming that will occur when injection into the -
RCS reaches the overheated core debris in the reactor vessel. The potential for creep failure of steam generator tubes may be increased if the containment water level is above the coolant loop piping elevation because the RCS piping cannot fail by creep rupture. Since the steam generator tubes provide a fission product boundary, maintaining the tube integrity during a severe accident is important to the goal of eliminating fission product releases. There are two methods of preventing these adverse impacts: decrease the primary-to-secondary pressure difference, or make sure that the steam generator tubes are at least partially covered on the secondary side.
Two negative impacts that were also included in the WOG SAMG but that are not applicable -
to the AP600 design are containment flooding and an insufficient injection source.
Containment flooding for current plants is a concern because equipment such as containment vent valves or fan cooler exhaust / intake ducts may be located where they will be covered with water and unusable. However, the AP600 plant has been designed so that significant containment flooding does not affect necessary equipment. Another concern in most current plants is that the use of the water from the RWST may limit other uses of that water.
However, the AP600 plant is designed so that there are rarely systems competing for the same water inventory, and thus the injection of water does not impact the ability to perform other actions. The exception is the case where the IRWST is being drained to the .
containment. In a non-LOCA event where the containment inventory cannot subsequently drain into the reactor coolant system through the break, there may be some instances in ,
which a residual IRWST level is desired.
Furthermore, the design of the injection systems for the AP600 plant is significantly different than existing plants. Current plants rely primarily on the forced injection of water from sources outside the containment. However, the AP600 plant relies primarily on the passive injection from water tanks inside the containment. Each of the water tanks and injection j methods for AP600 is further discussed below.
]
High Level Actions for AP600 Revision 1, November 1996 m:\3323w.wpf:1b-1113%
5-5 The Core Makeup Tank (CMT) is a safety-related means to provide water inventory to the RCS. There are two CMTs, each with a capacity of 2000 ft', which replace the function of high head safety injection pumps in current plants. CMTs are located above the reactor l coolant loops and each has a pressure balancing line from a cold leg. The CMTs are maintained full of borated water and are designed to inject at any RCS pressure. The discharge from the CMTs is routed from the bottom of the tanks to separate safety injection nozzles on the reactor vessel. Each discharge line is normally isolated by two parallel air-operated valves that fail open on loss of air pressure, loss of de power, or loss of control signal. .
The AP600 is also provided with two accumulators that supply borated water at high makeup flow rates to refill the reactor vessel downcomer and lower plenum during a large loss of coolant ace , at or during other events requiring automatic or manual RCS depressurization. The back pressure for the accumulators is 700 psig, so that the RCS pressure must be reduced below this value before water will inject.
The in-containment refueling water storage tank (IRWST), in conjunction with the automatic depressurization system, provides the function of low head safety injection. To get injection from the in-containment refueling water storage tank, the RCS pressure must be reduced to a value near containment pressure. The automatic depressurization system is provided to accomplish this function. When the IRWST empties, the containment is flooded above the RCS loop level, and the water in the containment drains, by gravity, back into the RCS if there is a break in the hot or cold leg. Therefore, stable, long-term core cooling and makeup to the RCS is established. The passive containment cooling system supports this operation by removing heat from the containment. Steam released from the RCS is condensed. This condensate then drains back into the RCS for recirculation.
The normal residual heat removal system (NRHR) provides an additional mechanism for core cooling, taking water from the IRWST/ sump and injecting it into the safety injection lines.
The NRHR system needs cooling water and ac electrical power. If offsite power is lost, the power is supplied by two non-safety-related diesel generators. The NRHR loops take water
- . outside the containment, which could be a negative factor during a severe accident, since the coolant water is highly contaminated with fission products and may result in more personnel access restrictions. The PRHR capability would not be available if the IRWST is drained into the reactor cavity.
Finally, the chemical and volume control system (CVS) is the normal RCS inventory makeup l system. It has two non-safety grade high pressure pumps, which start automatically if a core I
makeup tank actuation signal is generated. The pumps are also automatically loaded on the non-safety diesel generators if offsite power is lost. The CVS is rated to provide a flowrate around 100 gpm per pump at full system pressure. If the core is totally uncovered, the CVS l
l High Level Actions for AP600 Revision 1, November 19%
m:\3323w.wpf:1b-1113%
5-6 i
is insufficient, by itself, to quench the core and reflood the vessel. However, this may be l sufficient to remove decay heat as it is produced. l Because the AP600 plant is a passive design, most of the methods of injecting water rely on the gravity draining of tanks. However, for this to occur from some of the tanks, the RCS must be depressurized. The largest tank, the IR.WST, requires that the RCS be almost fully depressurized. Therefore, during a severe accident in which injection capability has failed, it may be due to the RCS having a pressure that is too high. This makes the action of depressurizing the RCS very important for AP600. This high level action is further discussed l in Section 5.4. ,
l 1
5.2 INJECT INTO CONTAINMENT Another important strategy for AP600 is to inject water into the containment cavity so that water surrounds the outside of the reactor vessel. According to WCAP-13388 [Ref. 8], this action has more impact on accident management considerations than any other individual phenomena except the direct water addition to the debris. Based on experiments and l analyses, external flooding of the vessel can cause the core debris to be retained within the j lower vessel plenum. This action also has the benefits of protecting the containment, creatmg ;
a heat removal path from the core debris, stopping the accident progression through the l prevention of vessel failure, and preventing all ex-vessel phenomena from occurring. ]
i However, if the core is ex-vessel or if vessel failure is imminent, the injection of water into the containment has other benefits. The presence of water in the cavity will scrub fission j product inventory, and will prevent or limit core / concrete interaction (CCI). CCI is the phenomena of core debris attacking the concrete basemat if there is insufficient water in the I containment cavity to cool the debris. The consequences of CCI include the generation of non-condensable gases that will pressurize the containment, the generation of combustible l gases that can ignite and fail the containment, the generation of a significant amount of aerosols, and the eventual failure of the containment boundary due to basemat or liner melt- l through.
Injecting water into the containment to a level that covers the RCS loops is a viable action for the AP600 design and automatically occurs if all in-containment water sources are directed ,
into the containment cavity. For core damage events resulting from a large LOCA, this containment water level will ensure that water gets into the reactor vessel. For non-LOCA events, this water level protects RCS loops from creep failure and cools gases to help prevent steam generator tube creep rupture.
There are very few negative considerations of injecting water into the containment cavity. In the WOG SAMG, three negative impacts are identified, which are 1) de-inerting the containment if the sprays are used,2) using the water inventory in the RWST that may be High Level Actions for AP600 Revision 1, November 1996 mA3323w.wpf:1b-1113%
5-7 needed for other actions, and 3) pressurizing the containment to the point that gravity drain of the RWST would not be possible. For AP600, none of these negative impacts apply. The AP600 containment design does not include any internal containment sprays. There are also no competing uses for the IRWST water although draining the IRWST to the reactor cavity may impact the capability to use NRHR for core cooling. And if the method of containment injection is gravity drain of the IRWST, the flow rate is high and is possible regardless of containment pressure. This is because the IRWST is internal to the containment and gravity drain would not be impacted by containment pressure.
, One of the severe accident management insights from the AP600 PRA is that the total amount of hydrogen generated during some severe accident sequences is a strong function of the time / level for containment flooding. Thus, one of the negative impacts of flooding the containment to a level where water can flow from the containment into the RCS, may be the generation of additional hydrogen.
1 Another potential negative impact that was discussed in the WOG SAMG and is also applicable to AP600 is the potential for an ex-vessel steam explosion if the vessel fails. A steam explosion could result in the destruction of the reactor cavity walls which provide support for the reactor vessel. If a steam explosion destroys the reactor vessel supports, the containment fission product boundary may be challenged due to tearing of containment penetrations connected to the RCS as the reactor vessel drops to the reactor cavity floor.
Evaluations of the AP600 reactor cavity wall structural capability reported in Ref. 4 concludes that steam explosions in the reactor cavity do not pose a challenge to the containment fission product boundaries. While cavity walls may not withstand the effects of a severe steam explosion the evaluations indicate that there will be no impact on containment integrity.
5.3 INJECT INTO STEAM GENERATORS l
In conventional plants, the steam generators are designed to provide a heat sink for the RCS l during both normal and accident conditions. Therefore, in the WOG SAMG, injecting into the steam generators was judged to be one of the most important activities. In the AP600 plant, although the steam generators are designed for heat removal during normal operation, they are not a safety-related method of decay heat removal during an accident. However, j
~
injecting into the steam generators is still an important high level action for the management l of a severe accident in the AP600 plant.
Because much of the secondary side is located outside of containment, the SG tubes act as a containment boundary. Therefore, the prevention of induced steam generator tube ruptures is important for severe accident management. One of the methods of doing this is to inject water into the steam generator to keep the tubes cooled. This protects them from rupturing due to heatup from hot gases on the primary side of the tubes. Nevertheless, if a tube High Level Actions for AP600 Revision 1, November 1996 m:\3323w.wpf:1b-1113%
4
[ 5-8 1
rupture does occur, covering the break with water will scrub fission products from the ;
primary system following core damage. (
2 Also, although the AP600 steam generators are not a safety-related method for removing ,
decay heat, they may still be useful for this function during a severe accident. Not only may -i
' the heat removal be' of benefit, but the steam generators may be a method for depressurizing ;
the RCS.
However, there are also several drawbacks associated with injecting water into the steam - . ,
generators. These drawbacks have the potential to negatively impact the accident ,
progression by allowing the direct release of fission products to the environment. The first ;
concern is the thermal shock of the steam generators. If the steam generators have dried out !
- during a' severe accident, the tube temperatures may exceed 1000 F. The injection of ;old l water to the hot, dry steam generators can place significant thermal stresses on the tubes and j other components. These thermal stresses can result in the failure of either the shell side of .
the steam generator or the steam generator tubes. Failure of the shell side of a steam j generator during a severe accident reduces the amount of water that can enter the steam !
generator and increases flooding of the containment. Also, failure of the shell side of the ,
! steam generator can result in a direct release path to the atmosphere if the steam generator ;
relief / safety valves are not closed or the MSIV is open. Failure of one or more tubes will :
. result in a containment bypass and the potential release of fission products to the j
- environment. .l
}
Another potential concern with the injection of water into the steam generators can occur if the steam generators must first be depressurized. If the RCS is pressurized, the 'l depressurization of the steam generators could create a large primary-to-secondary AP that l could induce creep rupture of the steam generator tubes. Either this induced tube rupture, {
or pre-existing tube ruptures, would then make fission product releases to the environment a i concern. These potential negative impacts must be considered in the evaluation process that j determines whether steam generator injection should be attempted. l
- Equipment that may be used for this high level action is dependent on the pressure of the -
~ steam generators. For high pressures, only the startup feedwater pumps and the main feedwater pumps would be usable. For lower pressures, the list of possible equipment ~
expands to include condensate pumps, firewater pumps and service water pumps.
r 5.4 DEPRESSURIZE RCS t
i Many benefits can be realized by depressurizing the RCS during a severe accident. As l previously discussed in Section 5.1, the depressurization of the RCS will facilitate the l injection of water from the passive core cooling system tanks. It will also increase the j flowrate that would be provided if pumps are being used. If the ADS valves are used, the High Level Actions for AP600 Revision 1, November 1996 m:\3323w.wpf;1b-1113% ~
i
--. j
5-9 creation of the intentional opening in the RCS may be the method of establishing a long term heat removal path.
There are also many other effects of depressurizing the RCS that are unique to core damage scenarios. The possibility of creep rupture of the steam generator tubes and the RCS pipes can be reduced or eliminated if the RCS pressure is lowered. Creep rupture is a plastic deformation process that occurs under high temperatures and sustained loads. Since high temperatures are a by-product of the severe accident, the reduction of the RCS pressure is a
~
good method to avoid failures due to creep rupture.
O Another important severe accident concern is high pressure melt ejection (HPME). This is a phenomenon that may occur if the RCS pressure is elevated at the time of vessel failure.
During HPME, the momentum of the core debris along with the driving force of high velocity gases released from the vessel, can transport the molten core debris away from the reactor cavity region. One method of preventing this phenomenon is to decrease the RCS pressure.
Decreasing the RCS pressure also can help isolate the containment and reduce fission product releases for containment bypass sequences. If there are ruptures or leaks in the steam generator tubes, the reduction of the RCS pressure will reduce the driving force on the fission products, and will help to maintain them within the primary system. In addition, if injection of water occurs due to the reduction in RCS pressure, the water inventory will help to scrub the fission products.
The final benefit of reducing the RCS pressure is for long term control of the hydrogen inventory. In order to exit the severe accident management guidance, the containment must be in a controlled, stable state. Part of the definition of this state is that there should be no potential for sudden, future changes to the co'ntainment atmosphere. If the RCS remains pressurized with hydrogen accumulated within the system, any future failure of the vessel or opening in the RCS would release the hydrogen to the containment atmosphere. Therefore, the RCS pressure should be reduced for long term concerns.
However, the long term benefit of hydrogen control also produces a short term negative
~
impact. If the RCS is depressurized using a vent path to the containment, the sudden release of a large quantity o' ydrogen to the containment could change the flammability status of the containment atmosphere. Although AP600 analyses have shown that the containment structure can withstand the resulting pressure transient, the plant decision-makers should be aware of the potential of the burn. The method of depressurizing the RCS can influence the potential negative impacts. Depressurizing the RCS using a flow path to the IRWST could result in a diffusion flame at the IRWST vents to containment. While the AP600 PRA has concluded that diffusion flames will not impact containment integrity, the diffusion flame still represents a slightly increased challenge to containment integrity since not all possible i
High Level Actions for AP600 Revision 1, November 1996 m:\3323w.wpf:1b-1113%
' 5-10 severe accident scenarios were treated in the PRA. Also with the opening of a pathway from the RCS to the containment, there could be a sudden increase in the containment pressure.
This pressure increase is not of sufficient magnitude to challenge the containment integrity.
- The safety' grade system for depressurizing the RCS is the Automatic Depressurization System (ADS). This system is a series of valves arranged in four stages, which pro;ide a phased depressurization capability. The valves of the first three stages are motor-operated valves and are mounted on the pressurizer. These valves discharge steam to the IRWST
- through spargers. The discharged steam is condensed and cooled by mixing it with water in .
the tank. The valves of the fourth stage are squib valves and are located on lines connected ,
to the two hot leg pipes. The fourth stage vents directly to containment.
Other equipment for depressurizing the RCS that will be investigated are the pressurizer -
spray, the RCS head vent, and CVS letdown. Another method is to depressurize the RCS via heat removal from the steam generators. The equipment associated with this action will be addressed in the following section.
5.5 DEPRESSURIZE STEAM GENERATORS The purposes of this high level action have been discussed in Sections 5.3 and 5.4.
Depressurizing the steam generators may be the first step to enable injection of water into the SGs, to establish a heat transfer path from the RCS to the SGs, or to depressurize the RCS.
The end purpose of this action may be the depressurization of the RCS, or the establishment of a long term decay heat removal pathway.
The principal negative impacts from depressurizing the steam generators are related to the potential for creating a release pathway. Not only might the steam generator inventory be lessened, but any fission products within the steam generators may be released to the environment. Furthermore, if there is a steam generator tube rupture, the lower steam generator pressure will increase the driving force of fission products from the primary to the secondary side. Even if no steam generator tube ruptures currently exist, the lowering of the steam generator pressure could increase the AP across the steam generator tubes, inducing a -
rupture or increasing leakage of fission products from the RCS through leaking steam generator tubes.
The two principal methods of depressurizing the steam generators are opening the SG power operated relief valves which discharge directly to environment or opening the steam dump valves which discharge to the main condenser. There are no known differences in the AP600 design, when compared to existing Westinghouse PWR plants, that would impact the equipment to perform this high level action.
High Level Actions for AP600 Revision 1, November 19E m:\3323w.wpf:1b-111596
5-11 5.6 DEPRESSURIZE CONTAINMENT During a severe accident it is likely that the containment will experience a substantial increase in pressure. Unless the RCS is intact, and the steam generators or the NRHR is being used for heat removal, all of the energy generated during the accident must ultimately be removed through the containment. Until the energy is effectively removed, the containment will pressurize. Therefore, one of the high level actions for severe accident management is to effectively remove heat from the containment which will, in turn, depressurize the containment. .
There are several benefits to depressurizing the containment. The fundamental benefit, as mentioned above, is the ultimate heat removal from the core, which is needed to conclude that the plant is in a controlled, stable state. However, depressurizing the containment might also be needed for immediate concerns. If overpressurization threatens the integrity of the containment, depressurization would be needed to address this severe challenge. Also, depressurization may be the method of reducing or eliminating fission product releases from the containment. Reducing the AP from the containment to the environment reduces the driving force behind the fission product leakage. Another benefit of depressurizing the containment is the general improvement of the containment atmosphere to alleviate potential equipment and instrumentation challenges. Finally, depressurizing the containment by condensing steam will increase water in the IRWST and containment for ex-vessel core debris cooling and flooding of the reactor pressure vessel and RCS loops.
The potential negative impact from depressurizing the containment is that with the condensation of steam from the containment atmosphere, the hydrogen becomes a larger fraction of the overall containment atmosphere. The higher hydrogen fraction may lead to a flammable state inside the containment. If the hydrogen was previously inflammable at the higher pressure due to the presence of steam, and if it becomes flammable due to the condensation of steam, this process is known as de-inerting. However, this concern is not anticipated for AP600 due to the existence of hydrogen igniters. Nevertheless, if the igniters were not functioning properly and significant hydrogen accumulated, the containment could be de-inerted by depressurization. Thus, the containment boundary could be challenged.
The AP600 passive safety-related containment cooling is provided by a water t.u& that allows a gravity fed flow onto the outside of the containment dome surface, with sufficient water for three days. After several days, the design basis is for heat removal by replenishment of the PCCS tank water inventory. This would permit the enhanced containment cooling for longer periods of time which would result in lower containment pressures compared to convective air flow alone. It is also important to ensure that the drains at the bottom of the annulus are open to prevent water from accumulating which could block or reduce the heat removal capability of the convective air flow. There are also two fan cooler units inside containment that were designed for normal operation heat loads.
High Level Actions for AP600 Revision 1, November 1996 m:\3323w.wpf:1tul11596
5-12 Although their heat removal capability is low in comparison to accident heat loads, they could be used to augment the passive cooling and further reduce containment pressure. The use of the fan coolers can also increase fission product removal in the containment as steam laden fission products condense on the fan cooler coils.
5.7 PRESSURIZE CONTAINMENT .
This high level action addresses two very different concerns. The first concern is to pressurize the containment to create a steam inert atmosphere that would prevent a hydrogen burn. As discussed in the previous section, the presence of a sufficient quantity of .
steam in the containment atmosphere can ensure that the hydrogen is not flammable, and thus the containment is " inert." However, pressurizing the containment to create an inert containment atmosphere is only a temporary solution. The passive features of the AP600 containment cooling system will also be working to condense steam, and the removal of the hydrogen will eventually be needed.
On the other end of the spectrum, the high level action of pressurizing the containment is to prevent a vacuum failure of the containment due to too low of a pressure. The threat of a containment vacuum could be created by previous containment venting, delayed containment isolation, or hydrogen burns that have substantially reduced the oxygen in the containment atmosphere.
The methods suggested in the WOG SAMG to accomplish these actions focus on turning off the containment heat sinks. For AP600 the gravity drain of the water over the outside of the containment shell may be terminated, which will lessen the heat transfer. Another pressurization method in the WOG SAMG is to open a pressurizer power-operated relief valve, if the RCS is still intact, to release steam into the containment. This method is also available for the AP600 plant via the 4th stage ADS valves. In addition, the IRWST, if it is being used via the PRHR system, steams directly to the containment.
If containment pressurization is being performed to prevent a containment vacuum, another option is to introduce instrument air into the containment. However, the negative impacts of -
this action are that there will be more oxygen that could be used in a hydrogen burn, and the possible failure to isolate the path being used for pressurization. ,
5.8 BURN HYDROGEN If hydrogen igniters are not functioning properly, it may be desirable to intentionally burn the hydrogen using other methods to create the initial spark. If the containment atmosphere is flammable, it is possible that an immediate smaller burn may be preferable to a larger burn later. Since the AP600 containment is capable of withstanding a hydrogen burn from all the fuel cladding being oxidized, this action may only become a factor when CCI is believed to High level Actions for AP600 Revision 1, November 1996 m:\3323w.wpf:lb-111596
5-13 be a potential concern. The negative impact would be a brief temperature and pressure spike in the containment. The methods that may be successful at creating the needed spark will be investigated during a later phase of the development of AP600 severe accident management guidance. One of the options that will be considered is to establish an alternate power source to the hydrogen igniters.
5.9 VENT CONTAINMENT Venting the containment is the last high level action to be addressed since the negative
, impacts from implementing this action are relatively certain. However, there are two strategies that consider this action as a method of achieving the long term goals of severe accident management. The first reason to consider venting is if the containment pressure has increased to the point that failure of the containment pressure boundary is expected. If the accident sequence has resulted in more severe containment conditions than anticipated, and if the heat sinks have not functioned as expected, there could be a need to consider the intentional venting of the containment. This would result in a release of fission products to the environment. But a short term release from which control can be regained may be preferable to a large release as a result of the failure of the containment structure.
Another reason to consider venting is as a hydrogen control measure in the containment. If hydrogen igniters have not functioned properly, and if core / concrete interaction has contributed to the hydrogen inventory, the containment integrity may be threatened by the potential for a hydrogen burn. Less drastic hydrogen control measures include inducing a hydrogen burn while the concentration is low enough that the possibility of containment failure can be precluded (Section 5.8) and pressurizing the containment to create an inert atmosphere (Section 5.7). However, the latter option is only a tentpnrary sohition, an.d .it may, be too late to implement the former option. Therefore, containment venting is also an a&itn that may be considered as a method of hydrogen control. Note that venting the containment does not reduce the flammability of the containment atmosphere, however, it reduces the impact of a hydrogen burn. This is because the containment pressure rise when a flammable hydrogen mixture is burned in containment is a direct function of the mass of hydrogen present in the containment. Therefore, reducing the hydrogen mass will reduce the amount of energy released in a burn. The hydrogen can be reduced, through venting, to the point
, *: 2t there is not enough energy to fail the containment.
The main negative impact of venting the containment is obviously the radiological release of fission products to the environment. Ideally, this release would be relatively small.
However, there is also the possibility that the vent pathway cannot be re-isolated. In addition, the release of non-condensable gases during the venting leads to the potential for a future challenge of the containment pressure boundary due to a containment vacuum. If non-condensable gases are released, containment isolation is re-established, and steam condenses from the atmosphere, the resulting containment vacuum could be severe enough l
High Levcl Actions for AP600 Revision 1, November 1996 m:\3323w.wpf:lt> 111596
l l
5-14 to fail the pressure boundary due to a compressive load. The methods that may be used to vent the AP600 containment will be investigated during a later phase of the development of the severe accident management guidance.
5.10 MITIGATE FISSION PRODUCT RELEASES In addition to the other severe accident management activities aimed at establishing or maintaining a controlled, stable core and containment state, there are several actions that can be taken solely for the purpose of controlling fission product releases from the plant after .
core damage has occurred. The actions are dependent on the release pathway. ,
in the event of leaking or ruptured steam generator tubes, fission products from the reactor coolant system may be released to the steam generator secondary side and subsequently to the atmosphcre. If the steam generator is open to the atmosphere (e.g., open relief valves or MSIV), the releases can be mitigated by isolating the release pathway, If isolation of the pathway is not possible or is not desired due to other severe accident management objectives, the releases may be reduced by either providing a large inventory of water in the steam generator for scrubbing or by reducing the primary-to-secondary pressure differential.
If the release pathway is from the containment the most obvious action is to isolate the release pathway. If isolation cannot be accomplished or the source is containment leakage, that is unisolatable, there are several actions that can be taken. Depressurization of the containment would decrease the driving force for the releases and would be effective if the leakage pathway is not in a " choked flow" regime. Other actions that can be taken include use of the fan coolers to enhance fission product removal from the containment atmosphere and limiting the reactor coolant depressurization to keep the fission products inside the reactor coolant system. Depending on the location of the release pathway, it may also be possible to flood the containment to a level that stops the leakage fiom the containment vapor space.
Release pathways from the auxiliary building are not likely in the AP600 design since all of the emergency fluid systems are completely contained in the containment building. -
However, if a release pathway from the auxiliary building can be identified, the most likely l source would be from lines directly connected to the reactor coolant system. In this case, the ,
most direct means of stopping the releases is to isolate the source. If this is either not possible or not desirable, then a reduction in the reactor coolant system pressure would be effective in reducing the fission product releases.
l
- l High Level Actions for AP600 Revision 1, November 19% l m:\3323w.wptib-1115%
I
I l
5-15 :
5.11
SUMMARY
I I
Table 5-2 provides a summary of the high level severe accident management strategies for I the AP600 plant design. These high level strategies should be considered in the development j of the AP600 Severe Accident Management Guidance by the COL applicant. !
i l
. i
-l l
I t
e I
i I
l i
I i
l High level Actions for AP600 Revision 1. November 1996 m.0323w.wpf.lb-111596
I 5-16 l l
4 Table 5-2 Summary of High Level Severe Accident Management Strategies for AP600 m -
m Other i Purpose Considerations Action (Positive laipacts) (Negative impacts) Equipment inject into RCS . To restore core cooling . Creation of hydrogen . CMT (immediate and long term) . Creep rupture of SG tubes . Accumulators
. To scrub fission products . IRWST i
. To prevent, or delay, vessel
- NRHR l failure . CVS Inject into . Create inventory in sump .
Ex-vessel steam explosions . Gravity Dram of IRWST 1 Containment for recirculation . Spent Fuel System , j
. Submerge lower head of injection ir to refueling i RPV to prevent failure cavity 1
. Cool core debns
. Prevent /hmit CCI .
- Prevent basemat melt-through
- Reduce flammable gas production
. Prevent HPME
. Reduce fission product inventory inject into SGs . Heat Sink . Thermal shock of SC High Pressure:
. Scrub fission products tubes Low Pressure:
. To make SGs available to . Creep rupture of SG - Condensate depressurize RCS tubes (if SG is first - Firewater depressurized, creating - Service Water large AP)
Depressurize RCS . To facilitate injection into . Short term hydrogen . ADS the RCS release and burn .
Auxiliary Press'zer Spray
. To establish long term . Containment . Head Vent heat transfer path pressurization . CVS Letdown
. To prevent HPME . via SGs
. Prevent creep rupture
. Isolate containment due to SG tube leaks
. Long term hydrogen control
. Reduce fission product inventory Depressunze SGs . To facilitate injection into . Loss of SG inventory . SC PORV SGs
- SG fission product .
Steam Dump
. To create heat transfer releases 1 path with RCS . Creep rupture of SG . j
. Depressurize RCS tubes if large AP is j created.
Depressurize . Prevent overpressurization . Hydrogen flammability . PCCS Containment . Mitigate containment . Contamment vacuum if . Fan Coolers fission prcduct leakage venting . Vents
. Alleviate equipment and instrumentation challenges due to harsh conditions High level Actions for AP600 Revision 1, November 19%
m:\3323w.wpf:1b-1113% l l
I
l l
5-17 Table 5-2 Summary of High Level Severe Accident Management Strategies for AP600 (Continued)
Other Purpose Considerations I Action (Positive impacts) (Negative Impacts) Equipment Pressunze
- To create inert atmosphere . Removal of hydrogen will
- Turning off containment i Containment so that hydrogen cannot eventually be needed heat sinks:
burn
. To prevent containment burn Stop water flow over vacuum from failing + Possible failure to isolate containment exterior containment structure pathway used for I pressurization Intentionally burn
- Let hydrogen burn while . Pressure and temperature
- nsk; to prevent future containment challenge.
Vent Containment . To avoid contamment . Radiological releases failure due to:
- Potential future concerns
- Overpressurization with containment failing
- Hydrogen Burn from sub-atmospheric loads
+ No guarantee that vent pathway will be able to reclose.
Mitigate fission . To reduce releases of fission . Ilydrogen burn . Contamment fan coolers Product Release products to atmosphere l
High Level Actions for AP600 Revision 1, November 1996 m:\3323w.wpf:1b-111346
6-1 6 CONCLUSION As described in the response to RAI 480.212, the COL applicant is responsible for developing a severe accident management plan for the AP600. This severe accident management plan should, as a minimum, meet the requirements of the Nuclear Energy Institute's Severe Accident Issue Closure as described in Section 5.0 of NEl-91-04, Revision 1. As further described in the response to RAI 480.439, the COL applicant's severe accident management ;
guidance should be based on the framework for severe accident management described in '
this report, the AP600 PRA and the severe accident management insights derived from the !
- AP600 PRA as discussed in Appendix A to this report. l l
Conclusions Revision 1, November 1996 m:\3323w.wpf:1b-111396
7-1 7 REFERENCES
- 1) Westinghouse Owner's Group Severe Accident Management Guidance, June 1994.
- 2) AP600 Standard Safety Analysis Report, Section 18.9.8.1, " Development of the Emergency Operating Procedures"
- 3) Westinghouse Owners Group Emergency Response Guidelines, Revision la, ,
September 1983.
- l
- 4) AP600 Probabilistic Risk Assessment, Revision 8, September,1996.
- 5) Staff Plans for Accident Manacement Regulatory and Research Procrams, U.S.
Nuclear Regulatory Commission, SECY-89-012, January 18,1989. ,
l
- 6) Intecration Plan for Closure of Severe Accident Issues, U.S. Nuclear Regulatory Commission, SECY-88-147, May 25,1988.
- 7) Individual Plant Examination for Severe Accident Vulnerabilities - 10 CFR 50.54m,
' LS. Nuclear Regulatory Commission, Generic Letter 88-20, November 23,1988. !
- 8) Severe Accident Issue Closure Guidelines, Nuclear Energy Institute, NEI 91-04, Rev.1, December 1994.
- 9) NP-6780-L, Advanced Licht Water Reactor Utility Reouirements Document, Volume III (ALWR Passive Plant), Chapter 1, "Overall Requirements,"
paragraph 2.3.3.9 ,
- 10) NRC Project No. 669, " Issuance of Final Safety Evaluation Report (FSER) on the Electric Power Research Institute (EPRI) Requirements Document for Passive Plant Designs," from R. W. Borchardt, Office of Nuclear Reactor Regulation, August 31,1993.
- 11) EPRI TR-101869, Severe Accident Manacement Guidance Technical Basis Report, Volume 2, Appendix K, " Debris Transport to the Lower Plenum."
- 12) EPRI TR-101869, Severe Accident Management Guidance Technical Basis Report, Volume 2 Appendix BB, " Potential for Criticality of the Core Material Under Recovery From Severe Accident Conditions."
References Revision 1, November 19%
m:\3323w.wpf:1b-1113%
7-2
- 13) WCAP-13388 (Proprietary) and WCAP-13389 (Non-Proprietary), AP600 :
Phenomenological Evaluation Summaries. I
- 14) EPRI TR-101869, Severe Accident Manacement Guidance Technical Basis Report, i
Volume 2, Appendix L, " External Cooling of the RPV with Debris in the Lower ;
Plenum."
- 15) EPRI TR-101869, Severe Accident Manacement Guidance Technical Basis Report, ;
Volume 2. Appendix G, " Steam Explosions." j
- 16) EPRI TR-101869, Severe Accident Manacement Guidance Technical Basis Report, Volume 2. Appendix U, " Water Overlying Core Debris."
Status of Implementation Plan for Closure of Severe Accident issues, Status of IPEs, 17) and Status of Severe Accident Researchs U.S. Nuclear Regulatory Commission, January 4,1995. ,
t I
l i
l I
t References Revision 1, November 1996 m:\3323w.wpf:1b-1113%
A-1 APPENDIX A AP600 SEVERE ACCIDENT MANAGEMENT INSIGHTS This appendix contains a brief description of the severe accident management insights identified from the AP600 PRA that are significantly different from those for conventional plants. Each of the insights is described in relation to the principle issue or objective of the severe accident management strategy. ,
ADS Valves I Hydrogen Diffusion Flames
.f* Opening the Stage 2 and 3 ADS valves to the IRWST after core damage has occurred can result in a situation where the hydrogen generated in-vessel is transported to the IRWST and then to the containment through the IRWST vents. When the hydrogen exits the IRWST vents, a standing diffusion flame may be created if an ignition source (e.g., the hydrogen igniters) is available. The amount of hydrogen flowing through the Stage 2 and 3 valves can be significantly reduced if the Stage 4 valves are also used. The standing diffusion flame can radiantly heat any structures within sight of the standing flame. It has been postulated that a standing diffusion flame at the exit of the IRWST vent could threaten containment integrity.
However, detailed studies documented in the AP600 PRA [Ref. 4] for a wide range of accident sequences in which just the Stage 2 and 3 ADS valves were used indicates that containment integrity should not be challenged by this mode.
However, not all accident sequences with a range of accident management activities were evaluated in the AP600 PRA. Thus, the development of the AP600 severe accident management guidance needs to consider the possible inclusion of a caution on leaving the ADS valves to the IRWST in an open position during the period of time where significant hydrogen generation is occurring.
On the negative side of the issue, regarding use of the ADS valves for RCS depressurization, is the ability to depressurize the RCS using only the Stage 4 ADS valves. Based on the analyses docume nted in the AP600 PRA, the use of only the Stage 4 ADS valves may, in some cases, lead to issues reir'ed to the effectiveness of long term core cooling. In this case, the additional relief area pre rided by the Stage 2 and 3 ADS valves is required to maintain the RCS at a low enough pressure.
In-Vessel Retention of Core Debris I Reactor Cavity Flooding A substantial amount of experimental and analytical work has been performed to support the hypothesis that the core debris can be maintained within the reactor vessel if the reactor cavity can be initially flooded to an elevation higher than the level of core debris in the Appendix A Revision 1, November 1996 !
m:\3323w.wpf:1b-111596
i A-2 reactor vessel AND if the reactor coolant system can be depressurized. The experimental and analytical evidence show that sufficient heat transfer occurs between the core debris, the reactor vessel walls and the water on the outside of the walls to maintain the temperature of the reactor vessel walls below the point where melt-through or creep failure of the vessel is physically possible. The AP600 PRA shows that for most severe accident sequences, the reactor cavity is passively flooded to, or above, the reactor vessel nozzle elevation as a result !
of the severe accident sequence progression. Only in the cases where draining of the IRWST fails does the potential exist for the reactor cavity to-be dry or partially flooded. The Level 2 PRA, Revision 8, assumes that guidance will be available in the Emergency Response Guidelines (ERGS) for FR-C.1, " Response to Inadequate Core Cooling" to initiate manual .
l' flooding of the reactor cavity from the IRWST if the core exit thermocouple temperatures cannot be reduced using the strategies suggested in that guideline. The placement of the manual cavity flooding initiation in the AP600 ERGS was necessary in order to assure that the cavity would be flooded to the appropriate level prior to the first downward relocation of core material inside the reactor vessel. The rate at which the IRWST could drain into the reactor cavity, assuming only gravity, required a lead time for initiation that is prior to the time at which transition to the SAMG might occur.
In the longer term, to prevent reactor vessel failure, it is postulated that the containment water level must be increased to submerge the reactor vessel up to the elevation of the :
coolant loops. With the entire core in the bottom of the reactor vessel, there udght be sufficient heatup of the cylindrical walls of the reactor vessel in the longer term such that the vessel wall temperature might approach the point where creep failure of the reactor vessel could occur. By submerging the entire reactor vessel up to the coolant loop level, the evidence presented in the AP600 PRA shows failure of the reactor vessel is physically unreasonable. If the entire IRWST is drained to the containment, the containment water level should be above the elevation of the loop piping.
In both cases, the potential for reactor vessel failure is significantly reduced if the reactor coolant system is depressurized to the containment pressure. Reactor coolant depressurization is part of the ERG guidance. .
Another advantage of flooding the reactor cavity / containment to slightly above the coolant !
loop level is that if a LOCA exists (either as an accident initiator or as an induced LOCA .
caused by creep failure of RCS piping) this becomes a means to provide water to the core debris inside the reactor vcwl. In this case, the reactor coolant system pressure must be reduced to the containn at pressure in order for reflood of the in-vessel core debris to be successfully accomplished.
A negative impact of flooding the containment to the level of the coolant loops was identified for the Direct Vessel Injection (DVI) line break but is also applicable to other scenarios ;
1 l
Appendix A Revision 1, November 1996 m:\3323w.wpf:1b-1115%
i i
)
A-3 involving a break in the reactor coolant system. For the particular case analyzed in the AP600 Level 2 PRA, containment flooding reached the DVI line break location after the core was substantially uncovered but before the core began to relocate downward in the reactor pressure vessel. In this case, the arnount of hydrogen generated was maximized due to the large surface area of overheated unreacted zirconium that was available. If the con +ainment water level had reached the DVI line break location either earlier or later in the accident sequences, substantially less hydrogen would be generated. While the AP600 PRA concluded that the hydrogen generation in this case did not pose a challenge to the containment integrity, this case (including other RCS break cases) should be considered further in the development of severe accident management guidance.
For the DVI line break case with reflooding of the core through the DVI line break location, AP600 also predicted the potential for diffusion flames in the CMT room. While the AP600 I PRA concluded that the creation of these diffusion flames would not challenge containment integrity, this should be considered further in the development of severe accident management guidance.
Even though the PRA assumes that the initiation of cavity flooding and reactor coolant system depressurization is part of the ERGS, it should also be included in the AP600 SAMG since the SAMG should provide another attempt to accomplish actions to bring the plant to a controlled stable state after core overheating has begun when the ERG actions may have j failed. The development of the AP600 severe accident management guidance needs to j
consider both cavity flooding to a level above the elevation of the core debris in the reactor i vessel to prevent short term reactor vessel failure and cavity flooding to the reactor coolant loop level to prevent long term reactor vessel failure. The development of the AP600 SAMG also needs to consider the depressurization of the reactor coolant system to the containment pressure.
l Induced Steam Generator Tube Rupture The AP600 PRA analyses show that the reactor coolant loop layout promotes strong full circuit natural circulation flows after core uncovery if the reactor coolant system pressure is at or near its nominal full power value. If the reactor coolant system pressure is high and the secondary side of the steam generator (s) is dry, the steam generator tubes can heat to a temperature where creep failure of the tubes is possible. In this case, it is postulated that the RCS piping in the vicinity of the reactor vessel nozzles will fail prior to the time that the SG l tubes reach the temperature required for creep failure. However, due to uncertainties in the l modelling, it is prudent to provide SAMG guidance to take steps to further preclude the possibility of induced tube rupture. These actions are to inject water into the SG secondary side and to depressurize the reactor coolant system.
Appendix A Revision 1, November 1996 l m:\3323w.wpf:1b-111596
A-4 ;
i Due to the strong natural circulation flows after core uncovery in the'AP600 design, extra care must be taken if the SG secondary side must be depressurized to utilize a low pressure. j source of water injection to the SG secondary side. Depressurization of the steam generator 1 secondary side will increase the stresses on the steam generator tubes and 'can shorten the !
time required for creep failure of the tubes to occur. Thus, the development of the AP600 SAMG should consider the necessity for a caution or limitation on steam generator secondary side depressurization for situations where the reactor coolant system pressure is above the .
steam generator secondary pressure. t If the reactor coolant system pressure is at or near its nominal full power value, flooding the- ,
- containment above the level of the reactor coolant loop piping may result in a condition j where creep failure of the steam generator tubes becomes more likely. In this case, the water !
on the outside of the reactor vessel and the reactor coolant piping may prevent or delay l creep failure of those portions of the reactor coolant pressure boundary. If the steam !
generator secondary side is dry and natural circulation flows remain strong, the steam l generator tubes will continue to heat up. Without reactor vessel or reactor coolant pipe creep !
failure to relieve the reactor coolant system pressure (and the stresses on the steam generator i tubes), the steam generator tubes become more susceptible to creep failure. The development ;
of the reactor cavity / containment flooding strategies for the AP600 SAMG should consider a caution or limitation on flooding to the reactor coolant loop level when the reactor coolant ,
system pressure is high and the st-m generator secondary side is dry.
The AP600 PRA indicates' that most of the accident scenarios in which the RCS is at high 'l pressure at the time of core overheating and downward relocation is a result of a total failure l of the instrumentation and control system. ' Accident management should consider strategies .l to maintain steam generator tube integrity until the instrumentation and control system I function ; can be recovered. The priority for verifying and mitigating steam generator tube challenges after instrumentation and control power is recovered should also be considered in :
the development of the AP600 SAMG.
Hydrogen Igniter Operation a
Hydrogen igniters are installed in the AP600 containment to continually burn hydrogen as it is released to the containment, thereby preventing the accumulation of hydrogen to levels .
that could challenge the integrity of the containment. All of the analyses in the AP600 PRA assume that the igniters either operate successfdlly for the duration of the accident or, if failed, are failed for the duration of the accident. In the case where the igniters are initially failed, the hydrogen accumulates in the containment and can reach concentration that, if ignited, could challenge the integrity of the containment. If the hydrogen igniters become !
available and are " turned on" after significant core damage has occurred, they could be an ignition source for burning the accumulated hydrogen. The development of the AP600 1
Appendix A Revision 1, November 19% l m:\3323w.wpf:1b-1113%
l 1
A-5 severe accident management guidance should address considerations for use of the hydrogen igniters when they are not operaing at the time core overheating begins.
Passive Containtnent Cooling In the AP600 design, the ultimate heat sink for h. eat rejection from the containment to the atmosphere is via the containment passive cooling. Heat is transferred from the vapor inside the containment, through the containment wall to the natural convective air currents on the outside of the containment shell. To enhance the heat removal capability when the core
, decay heat is high, a passive containment cooling system distributes water, via gravity drain )
from a tank, over the containment dome. Under this arrangement, the vapor inside the containment rises to a temperature where the heat rejection is equal to the hear generation. ]
s .
In the case where the passive containment cooling water is available, the containment pressure will equilibrate at a level below the design basis pressure for the containment. If i the passive cooling water is not available, a higher containment pressure will be established at equilibrium due to the higher containment temperatures required for the same heat rejection rate. The AP600 PRA analysis of the containment performance shows that there may be a minor threat to containment integrity at this higher containment pressure. Based on the conservative containment fragility curves presented in Section 42 of the AP600 PRA, there is a containment failure probability of about 1.0 E-03 at the predicted peak containment pressure for the case with no PCCS available. The predicted equilibrium pressure is well below the lower bound containment failure pressure from the containment fragility curve.
In those cases where no containment failure is predicted to occur., that conclusion is predicated on the assumption that the drains at the bottom of the annulus outside the primary containment are open. If these drains are not open, the water flowing over the containment dome could accumulate in the bottom of the annulus and block the natural convectL air flow over the outside of the containment shell.
Therefore, the AP600 SAMG should consider that containment failure due to overpressurization is not expected to occur. The AP600 SAMG should address considerations for assuring that the drains at the bottom of the annulus outside of the primary containment
, steel shell are open.
The AP600 PRA does not provide detailed analyses of the containment performance if the reactor vessel fails and the core is ex-vessel. If the core is quenched and cooled by water in the reactor cavity, the containment performance should be nearly the same as for the in-vessel core since only deay heat and in-vessel chemical heat additions are possible.
However, if core concr& interactions generate an additional heat load for the containment and add noncondensib'e gases to the containment, severe accident management strategies for Appendix A Revision 1, November 1996 m:\3323w.wpf:1b-111396
A-6 diagnosing and dealing with flammable gases and containment pressure that can challenge ,
the containment need to be considered. In general, this is several tens of hours after the I accident initiation and therefore would have a relatively low priority compared to other severe accident management strategies for AP600.
a Water Losses From Containment )
In the case where the containment cannot be completely isolated, the ability to successfully accomplish several of the severe accident management strategies may be challenged. For the case where the isolation failure is above the flooded-up containment water level, steam ,
would escape to the atmosphere rather than remain in the closed-cycle passive containment cooling. In this case, the containment water level would gradually decrease. If the isolation failure is below the flooded-up containment water level, the water would be directly lost from the containment. In this case, the containment water level may decrease more rapidly, depending on the size of the unisolated breach in the containment.
If the containraent water inventory is not replenished at a rate equal to that being lost, the ability a continue accident management strategies is challenged. In particular, the ability to use the PRHR or NRHR from the IRWST would eventually be lost. At some other point in l time, the ability to keep the reactor vessel cooled and thereby prevent vessel failure would be lost. Uitimately, the ability to cool any ex-vessel cc,re debris would be lost and ablation of the concrete basemat would begin.
Thus, monitoring the containment water level and having the ability to replenish the cetinment water inventory needs to be addressed in the AP600 SAMG. ,
e Appendix A Revision 1, November 1996 m:\332' - wpf:1b-1113%
B-1
' APPENDIX BL SAMG RAls AND RESPONSES e
'l1 Appendix B Revision 1, November 1996 m:\3323w.wpf:1b-1113%
l i
I I
l NRC REQUEST FOR ADDITIONAL INFORMATION v- -re Revision 1 Ouestion: 480.212 Identify and discuss actions t'at would be required to prevent or mitigate uncontrolled fission product releases after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> due to (a) long ten.' non-condensible gas generation. (b) depletion of coolant inventory due to nonnal <
leakage and early bypass sequences. (c) late containment bypass (temperature-induced SGTR), and (d) depletion of.
PCSS water inventory, a
Response
- As discussed in the response to RAI 720.55 and RAI 720.56, Westinghouse has developed a fnunework and a set of high level strategies for severe accident management. This work is documented in " Framework for AP600 Severe Accident Management Guidance", WCAP4343, Dec=Ser 19M 13914 revision 1. November 1996. High level strategies to diagnose potential fission product release pathways and then to prevent, tenninate and/or mitigate those fission product releases are identified and discussed in WCAP4344313914. The high level strategies presented in WCAP-l@l-113914 are applicable to all of the items outlined in this question.
Westinghouse believes that the development of the fnunework for a severe accident management program for the Af%00 plant design, including the identification of high level strategies provides a sufficient basis for the development of the detailed AP600 Severe Accident Management Guidance by the COL applicant.
O I
1 i
3 Westinghouse 480.212(RI)-1 -
l l
I
NRC REQUEST FOR ADDITIONAL INFORMATION r imih w ._
Ouestion 480.439 Westinghouse responses to RAls 720.54 and 720.55 (May 1993) indicated that numerous accident management strategies or related EOP changes would be adopted for AP600, and that additional accident management strategies would be eviduated and integrated into the AP6(K) accident management phm if found to be effective. WCAP-13913
" Framework for AP600 Severe Accident Management Guidance"(Dec 1993) was subsequently submitted, but does not provide a complete or current accounting of the critical PRA insights and accident management strategies that would need to be funher evaluated by a COL applicant as pan of their development of an accident management program, many of which have been developed or refmed subsequent to issuance of the topical repon. Examples of
, the insights or strategies that the COL applicant would need to address as part of their plant-specific implementation of accident management include:
initiation of reactor vessel cavity flooding use of fan coolers for fission product removal use of igniters to control hydrogen reciosing of the ADS valves to control hydrogen diffusion 11ames and fission products makeup to the containment for long tenn cooling makeup to the passive containment cooling system (PCS) strategies for reflooding a damaged core which is retained in-vessel use of portable battery chargers to backup hatteries identification and use of additional supplies of borated water strategies to enhance or restore flow through the PCS annulus use of a firewater pump for injection into the steam generators
. +
use of existing penetrations to vent containment Furthermore, the respmse to RAI 720.56 (May 1993) indicates that Ge completion of the development of the severe
, accident management guidance for AP6(X)is pan of the man-machine interface specification. However, neither this specification nor a COL action item describing the necessary actions on the part of the COL applicant have been submitted to our knowledge. (The March 1996 response to RAI 480.212 indicates that the COL applicant will develop plant-specine severe accident guidance based on WCAP-13913, but WCAP-13913 is incomplete as discussed above, and a clear commitment or COL action item has not been provided to assure that this will be done).
T westinghouse **
NRC REQUEST FOR ADDITIONAL INFORMATION Mm.C I i
n- i Please provide the following additional information to assure that all severe accident insights / strategies to be addressed by the COL applicant are identified and that a pnress and commitment for perfonning the necessary plant- ;
specific actions is established:
j a) A complete accounting (e.g., annotated list) of severe accident insights / strategies that the COL applic:mt will be responsible for addressing as part of their pl:mt-specific iniplementation of accident management, !
. i b) A description of the scope and objectives of each strategy, including whether the strategy is to be )
incorpomted into the Emergency Operating Procedures (EOPs) or the Severe Accident Management Guidance (SAMG), and where in these documents this infonnation is or will be k)cated, and , ,
c) A description of the process by which the insights / strategies to be addressed by the COL applicant will be communicated to the COL applicant, and a corTesponding COL action item addressing this commitment.
Response
The overall severe accident management philosophy and high level stmtegies applicable to AP6(X) are described in WCAP-13914, Revision I, "Fnunework for AP6(K) Severe Accident Mimagement Guidance," November 1996. The overall philosophy and high level strategies described in the previous version of WCAP-13913 and WCAP-13914 has been reviewed following the completion of the AP6(H)PRA. The severe accident management insights identified from the AP6(X) PRA have been incorporated into WCAP-13914, revision 1. Thus, WCAP-13914, revision 1, is a valid basis upon which a COL applicant can develop Severe Accident Management Guidance.
As discussed in WCAP-13914, revision 1, the AP6(X) Severe Accident Management Guid mee should be similar in content and structure to the generic Westinghouse Owners Group Severe Accident Management Guidance (WOG SAMG) that fonns the basis for Severe Accident Management Guidance at existing plants. The COL applicant should use the generic WOG SAMG and the infonnation in WCAP-13914, including the PRA insights described in 1 Appendix A of that WCAP, to develop the AP6(M) Severe Accident Management Guidance. This paress will address the example insights and/or strategies delineated in this RAl. The evaluation of the applicable accident management strategies by the COL applicant will include a determination of the appropriate guidance set (e.g.,
Emergency Response Guidelines versus Severe Accident Management Guidance) where the strategy will reside.
1 Chapter 19 of the AP6(H) SSAR will include a COL item that commits the Combined License applicants to developing a severe accident management program.
i e
NRC REQUEST FOR ADDIT!ONAL INFORMATION Response Revision 1 Question 720.55 The unique design of the AP6(X) may provide a passive method to both prevent and mitigate severe accidents with a minimum of human intervention. The insights to effective accident management plans can he developed from the success criteria developed from the PRA's assessment of containment performance. Provide a description of Westinghouse *s planned use of the AP6(X) PRA to identify and assess accident management measures.
e Response (Revision 1):
e Prevention and mitigation of accidents, including severe accidents, have been an integral part of the design process for the AP6(X). ' A significant objective in the passive plant design is preventing accidents from progressing to core damage. Additiomd features to protect the plant fission product boundaries in the event of a core damage accident have also been included in the AP6(X) design. The derivations of the design features are diverse; some features are derived from generic severe accident an:dyses, and others have been derived from AP6(X) accident analyses. Specific design features have been incorporated into the AP6(X) phmt as a result of generic severe accident phenomenological insights from previous severe accident work. An example of such a design feature is the lower containment layout, which provides for submerging the reactor vessel with a minimum water discharge to containment. There are also accident management features incorpomted into the AP6(X) based on key findings from the APNX) PRA. Examples of AP6(X) features from the PRA include manual operation of the reactor coohmt depressurization system and the passive RHR system upon detection of high core exit temperatures, and manual operations to flood the reactor cavity with water from the IRWST if it has not drained automatically into the reactor vessel.
As part of the development of a comprehensive accident management plan for the AP6(X), a systematic review of the Level 1 and Level 2 PRA results is being carried out to identify and document potential accident management insights. These insights relate to the prevention of core damage, mitigation of core damage, protection of fission product boundaries, and mitigation of fission product releases. Prior to the beginning of the systematic review, guidelines were developed to establish the scope and conduct of the review of the various segments of the PRA.
An existing Westinghouse data base of accident m:magement insights, which were derived from insights identified in a number of PWR IPE studies and from NRC research, is he;ng reviewed for applicability to the AP6(X).
Additionally, insights identified and documented during the Westinghouse development of generic severe accident management guidance for the Westinghouse Owners Group (for operating Westinghouse PWRs) will be reviewed for applicability to the AP6(X). A number of accident management insights have already been identified and documented as part of the AP6(X) severe accident phenomenological evaluations; these are documented in WCAP-
. 13388.
Based on the insights identified, candidate accident management strategies will be developed. Additional severe
. accident evaluations and analyses, when appropriate, will be carried out to determine the feasibility and effectiveness of candidate accident management strategies. All candidate accident management strategies will be evaluated by a small team of senior PRA experts and AP6(X) designers. Accident management strategies found to be effective will be integrated into the AP6(X) accident management plan. Initially, the candidate accident management strategies will he used to develop high level severe accident management guidance (see also the response to 0720.56).
W Westinghouse 720.55(RI)-1
l NRC REQUEST FOR ADDITIONAL INFORMATION l 1
JMP I Response Revision 1 n-This approach results in a complete and comprehensive integration of the AP6(K) PRA and severe accident I considerations into the AP6(X) accident management plan which includes plant design features, symptom-based !
emergency response guidelines, and severe accident management guidance. The development of the AP6(X) I emergency response guidelines is discussed in the response to Q720.54, and the severe accident management Fuidance is discussed in more detail in the response to Q720.56. Also, the approach takes maximum advantage of the ongoing work in severe accidents by both the industry and the NRC.
- I PRA Revision: NONE G
720.55(RI)-2 3 Westinghouse 1
l NRC REQUEST FOR ADDITIONAL INFORMATION mu Response Revision 3 Question 720.56 The AP600 PRA does not indicate how the accident management issues discussed by SECY 89-012 will he implemented. Describe Westinghouse's planned approach for assuring that each of the five elements of accident management defined in SECY-894112 will be appropriately addressed by the vendor and licensee. Identify the respective responsibilities of Westinghouse and the licensee for addressing each of the five elements, and any
, metfuls and/or guidance that are expected to be used in this pmcess.
Response (Revision 3):
The AP600 plan for addressing the severe accident management prognun requirements discussed in SECY-89-012 is based on the current efforts by Westinghouse on behalf of the Westinghouse Owners Group (WOG) to develop severe accident management guidance (SAMG) for the current generation of operating plants. From the standpoint of potential severe accident phenomena and potential challenges to the plant fission prmiuct boundaries, the AP(H) response to severe accidents is bounded by that of the current generation of Westinghouse PWRs. Thus, the onymg Westinghouse Owners Group program " & e'ap generic severe accident management guidance has direct applications to the development of AP600 plant severe accident management response guidance. It4*epec:ed F" the The respective responsibilities of Westinghouse and the licensee for addressing each of the five elements of SECY-89-012 u!!! he : :nitar-to4htwespec:.re rest = 451!!: . nf4hisVestinghnu= 0" ners Group-mal 4he4iwn,tw for-4he-eunent-operating p!a-F "":e respective respo: dhilities-are summarized in the following paragraphs.
The4rann rk for:he AWde::ete e neci&n!- agen e": guidance h::: % & e'apedand decen e-*ed " WCAP
!'9! ? (Nprietary) "d "/ CAP !?9' 4 (Ne Proprie4aryh-h4rameworb-doeument4neh*'~ '"- r--
aseklentammagemem: reyuren:en* , :Fe "-iipated strue:ure fer :he dect :: ling proeess-the-pels4 hat-must4*e assompi!+ed fm - cre acci&- manage e-* =d a-ammwey of pe 45!e senteg:es " AP4E wrere necidemt
)
- = age n - Ce up!::n-- "r 'he & ce!apmenudahe nevere accident numagement-guidaneeJor-41*4P4A14*-part <
of-4hesmta-ma# e interfna ivdopmenmosew Westinghouse has developed high level accident management guidance for AP600 based on the Westinghouse Owners Gmup Severe Accident Management Guidance, and the analyses and results of both the AP600 SSAR and the AP600 PRA. This high level guidance addresses dif erences in AP600 severe accident management strategies, l compared to those documented in the WOG S AMG, as y ell as severe accident management insights identified during the performance of the AP600 PRA. These AP600 high level severe accident management strategies are documented in WCAP-13914, Framework for AP600 Severe Accident Management Guidance", Revision 1, November 1996.
It is the responsibility of the COL applicant to develop tta AP600 Severe Accident Management Guidance, based on the information contained in WCAP-13914.
The accident management issues discussed in SECY-89-012 cover a bmad range of accident management activities
{
including the symptom-based emergency operating pmeedures and the utility site emergency plan. The severe I accident management issues discussed in SECY-89-012 must interface with both of these. For the AP600, the '
interface with the symptom-based emergency operating procedures will be similar to the interface for the curwnt generation of operating plants (i.e., the transition from emergency operating procedures to severe accident i
720.56(R3)-1 W
- WestinEhouse
i NRC REQUEST FOR ADDITIONAL INFORMATION Response Revision 3 management guidance). While the site emergency plan is expected to be simplified for the APN10. the interface between the emergency plan and the severe accident management guidance, on a broad scale,is very simihtr to that for the current generation of operating plants. That is, the severe accident management guidance must fit the emergency response team responsibilities and authorities. including the chain of command. While generic symptom-based emergency operating guidelines exist to establish a concise interface, the site emergency plan is developed by -
each COL applicant, based on specifics of its emergency respmse organization and interfaces with fedend, state and kiced government agencies. Thus, the severe accident management prognun for the APNK) cannot tot:dly address .
the issues discussed in SECY-89-012. Issues, such as ovendl decision-making responsibility and duties and responsibilities of individuals in the emergency response organization and training, are interfaces with the COL applicant site emergency plan that can be addressed only in the combined license application. ,
The following is a high-level discussion of the method in which Westinghouse will address each of the severe accident management issues discussed in SECY-89-012 for the APNKt Accident Management Procedures This element refers to the consideration of generic accident management strategies identified by the NRC to enhance the ability to cope with the severe accident scenarios that tend to dominate risk in PRAs for the current generation of operating plants. These strategies have been identified in several NRC reports, including NUREG/CR-5474 smd NUREG/CR-5781. The applicability of the stnttegies identified in NUREG/CR-5474 for APNN)is discussed in the response to RAI 720.54. The applicability of the strategies identified in NUREG/CR-5781 is ptrt of the insights evaluation discussed in the response to RAI 720.55. As discussed in the responses to RAls 720.54 and 720.55, the applicable NRC strategies are further considered in the development of either generic symptom-hased emergency operating procedures or generic severe accident management guidance, as appropriate.
Training for Sesere Accidents Training is within the scope of the COL applicant emergency phm. Thus, the specific details of severe accident ;
management training are in the scope of the combined license application. '
Accident Management Guidance l
Westinghouse 4" de Ap has developed high level generic severe accident management guidance for the APNN) i that provides a framework for meane . Jg plant conditions during a severe accident and a high level set !
of strategies for responding to those plant conditions. The Westinghouse Owners Group severe accident management -
guidance, be4 developed for the current operating phtnts. 4'! N m.ed+e was used as the basis for defining the high level APNK) severe accident management guidance documented in WCAP-13914. Revision 1. From the standpoint of potential severe accident phenomena and challenges to the phtnt fission product boundaries, the APN10 .
severe accident response is bounded by the current generation of Westinghouse PWRs. The APNN) high level severe accident management guidance mitwwporate incorporates those insights from the AIWWI PRA and other applicable sources, as described in the response to RAI 720.55. The high level severe accident management guid mee developed for the APNK) wilkpamde provides a me:ms for diagnosing challenges to the plant fission product boundaries, for responding to ch:dlenges with appropriate strategies, and for retuming the plant to a controlled stable condition.
l 1
720.56(R3)-2 l W Westinghouse
l NRC REQUEST FOR ADDITIONAL INFORMATION tm Response Revision 3 The high level severe accident management guidance i "" ^ identify also identifies potential negative impacts (e.g.,
increased challenge to a fission product boundary) of implementing each of the strategies contidned in the guidance.
Finallyr-the guliere <!Il-comain :"n-- e related ' :he expected planwess:r , :oc np!c c::athw-el-a paniair :.t ategy. Se r=e nedden: ==pe:nentfuidanc+4vil! :de identify-a4kn 'ed se: nf ; enpmationaleids in * !a-diagm - : *lA*-:n pn- ' rag 44-evaluatic: " t': 'agn::cde " ==:e nf :Wawyatiw-impwt*
av.oeiated-with4mtd ementatien ? speei4-*tr% The detailed severe accident management guidance will be
, developed by the COL applicant, based on the high level severe accident management strategies documented in WCAP-13914.
Instrumentation o
The severe accident management guidance relies upon the diagnosis of challenges to fission product boundaries and the diagnosis of a controlled, stable state, Westinghnus 1 "" ide-:!fy, 4 :W The AP6(0 severe accident management guidance 2 should identify primary and secondary instrumentation indications for those key parameters needed for diagnosis. This approach is consistent with the approach taken in the Westinghouse Owners Group severe accident management guidelines for current operating plants. Where appropriate, the severe accident management guidance will should identify methods for inferring the parameters needed for diagnosis from other instrumentation readings.
During the development of the AP6(O severe accident management guidance by the COL applicant, any insights regarding instrumentation (particularly with regard to instrumentation survivability and readout r:mge) will-4w doemnemed+nd should be further evaluated.
Decision-Making Responsibilities Based on information developed during the Westinghouse Owners Group severe accident management guidance program, the decision-making responsibilities during a severe accident should not change significantly from those already specified in the utility site ;mergency plan for existing plants. The only significant difference introduced ,
by severe accident immagement guidance is the bmader responsibility for the plant technical support staff to provide recommended actions to the control room staff af ter core damage has occurred. The tools available to the technical ,
support staff for this broader respmsibility are the severe accident management guidance derived from the AIWU I
generic severe accident management guidelines. Considemtions related to decision-making responsibilities during an accident, including severe accidents, are in the scope of the combined license application.
l PRA Revision: NONE l
l l
l l 720.56(R3)-3 l W WB5tiligh0llSe l
l l
l
A l
[
i i
e t
l l
l l
l l
t l
l l
l l
l r
I
! l l
l
. I I 1 I
i .
Page 6 November 25,1996 3
Enclosure 3 to Westinghouse Ixtter NSD-NRC-96-4891 November 25,1996 1
l l
0254H
i NRC REQUEST FOR ADDITIONAL INFORMATION Response Revision 3 Question 720.56 The AP600 PRA does not indicate how the accident management issues discussed by SECY 89-012 will be implemented. Describe Westinghouse's planned approach for assuring that each of the five elements of accident ;
management denned in SECY-89-012 will be appropriately addressed by the vendor and licensee. Identify the i respective responsibilities of Westinghouse and the licensee for addressing each of the five elements, and any l methods and/or guidance that are expected to be used in this process.
l i
l Response (Revision 3):
The AP600 plan for addressing the severe accident management program requirements discussed in SECY-89-012 is based on the current efforts by Westinghouse on behalf of the Westinghouse Owners Group (WOG) to develop severe accident management guidance (SAMG) for the current generation of operating plants. From the standpoint ;
of potential severe accident phenomena and potential challenges to the plant fission product boundaries, the AP600 response to severe accidents is bounded by that of the current generation of Westinghouse PWRs. Thus, the engemg l Westinghouse Owners Group prog +am N deve!cp generic severe accident management guidance has direct applications to the development of AP600 plant severe accident management response guidance. I: n : pe ::d in:
the The respective responsibilities of Westinghouse and the licensee for addressing each of the five elements of SECY-89-012 w+114o-simi! : Y i: respective-+esponsibilities of ie Westinghow,e-Owner +Grcup and i: !!::asees foe 4he-eurtent-operating-plants-The-respective responsibilities-are summarized in the following paragraphs. l The-framework 4erahe-AP6^0 ==re neciden: managemen: g ! dane: h : Seen d:=!cped and documented-in-WC-AP- l M94-HProprie:: y) nd WCAP 13914-(Non-Proprietary). The framework-documen* :nclud::: di=a=:en of n vere
- iden; managemenuequirement+rthe-anticipated-streeture4er4he dec:: en naking pree =, i: goals 4h:: must be aceemplished-fer :. =re asiden* managemert, and sum nary of pazib!: atrateg+ea,-for AP6T = vere ::iden; managenwnt-Completion-of-the-development c' 6: =rer :::iden! management-gedance for Se AP600 h pa-:
of4he-man-maehine-interface 4evelopraent procen Westinghouse has developed high level accident management guidance for AP600 based on the Westinghouse Owners Group Severe Accident Management Guidance, and the analyses and results of both the AP600 SSAR and the AP600 PRA. This high level guidance addresses differences in AP600 severe accident management strategies, compared to those documented in the WOG SAMG, as well as severe accident management insights identiGed during the performance of the AP600 PRA. These AP600 high level severe accident management strategies are documented in WCAP-13914, " Framework for AP600 Severe Accident Management Guidance", Revision 1, November 1996.
It is the responsibility of the COL applicant to develop the AP600 Severe Accident Management Guidance, based on the information contained in WCAP-13914.
The accident management issues discussed in SECY-89-012 cover a broad range of accident management activities including the symptom-based emergency operating procedures and the utility site emergency plan. The severe accident management issues discussed in SECY-89-012 must interface with both of these. For the AP600, the interface with the symptom-based emergency operating procedures will be similar to the interface for the current generation of operating plants (i.e., the transition from emergency operating procedures to severe accident W- WestinEh0use
, i L
1 l
1 1
NRC REQUEST FOR ADDITIONAL. INFORMATION Response Revision 3 management guidance). While the site emergency plan is expected to be simplified for the AP600, the interface between the emergency plan and the severe accident management guidance, on a broad scale, is very similar to that for the current generation of operating plants. That is, the severe accident management guidance must fit the i emergency response team responsibilities and authorities, including the chain of command. While generic symptom-based emergency operating guidelines exist to establish a concise interface, the site emergency plan is developed by each COL applicant, based on specifics of its emergency response organization and interfaces with federal, state and local government agencies. Thus, the severe accident management program for the AP600 cannot totally address the issues discussed in SECY-89-012. Issues, such as overall decision-making responsibility and duties and responsibilities of individuals in the emergency response organization and training, are interfaces with the COL applicant site emergency plan that can be addressed only in the combined license application.
The following is a high-level discussion of the method in which Westinghouse will address each of the severe accident management issues discussed in SECY-89-012 for the AP600:
Accident Management Procedures This element refers to the consideration of generic accident management strategies identified by the NRC to enhance the ability to cope with the severe accident scenarios that tend to dominate risk in PRAs for the current generation of operating plants. These strategies have been identified in several NRC reports, including NUREG/CR-5474 and NUREG/CR-5781. The applicability of the strategies identified in NUREG/CR-5474 for AP600 is discussed in the response to RAI 720.54. The applicability of the strategies identified in NUREG/CR-5781 is part of the insights evaluation discussed in the response to RAI 720.55. As discussed in the responses to RAls 720.54 and 720.55 the applicable NRC strategies are further considered in the development of either generic symptom-based emergency operating procedures or generic severe accident management guidance, as appropriate. .
Training for Severe Accidents Training is within the scope of the COL applicant emergency plan. Thus, the specific details of severe accident management training are in the scope of the combined license application.
Accident Management Guidance Westinghouse will-de+elop has developed high level generic severe accident management guidance for the AP600 that provides a framework for means-of-diagnosing plant conditions during a severe accident and a high level set of strategies for responding to those plant conditions. The Westinghouse Owners Group severe accident management guidance, being-developed for the current operating plants, will be m.ed r, a was used as the basis for defining the high level AP600 severe accident management guidance documented in WCAP-13914, Revision 1. From the standpoint of potential severe accident phenomena and challenges to the plant fission product boundaries, the AP600 severe accident response is bounded by the current generation of Westinghouse PWRs. The AP600 high level severe accident management guidance wdl4aeorporate incorporates those insights from the AP600 PRA and other applicable sources, as described in the response to RAI 720.55. The highlevel severe accident management guidance developed for the AP600 will-provide provides a means for diagnosing challenges to the plant fission product boundaries, for responding to challenges with appropriate strategies, and for returning the plant to a controlled, stable condition.
720.56(R3)-2 W Westinghouse
NRC REQUEST FOR ADDITIONAL INFORMATION Response Revision 3 i
The high level severe accident management guidance ;i!! :!w identify also identifies potential negative impacts (e.g.,
increased challenge to a fission product boundary) of implementing each of the strategies contained in the guidance.
Maallyshe-guidanee-will-contain-informatien-related-to-the expected p!:n! respense af:er ! np!::nen:auan cf a partieulastrategy41:e severe acciden' managemen: g ddance vall-also+1emify-a4imited se: cf ec:nputatiena! ali ic :=: in diagnostie; and/or :c pemd! rapid eve! ::len cf e :nagni:ude nf .cn:: cf 6 ega::ve !:npaets
.z.ceinted hh-i:np!:n:en:atic cf : pecifie :::ategy, The detailed severe accident management guidance will be developed by the COL applicant, based on the high level severe accident management strategies documented in WCAP-13914.
Instrumentation The severe accident management guidance relies upon the diagnosis of challenges to fission product boundaries and the diagnosis of a controlled, stable state. We:.!!nghou= ; " identifyria-the The AP600 severe accident management guidance, should identify' primary and secondary instrumentation indications for those key parameters needed for diagnosis. This approach is consistent with the approach taken in the Westinghouse Owners Group severe accident management guidelines for current operating plants. Where appropriate, the severe accident management guidance will should. identify methods for inferring the parameters needed for diagnosis from other instrumentation readings.
During the development of the AP600 severe accident management guidance by the COL applicant, any insights regarding instrumentation (particularly with regard to instrumentation survivability and readout range) will-be doeumented-and should be further evaluated.
Decision Making Responsibilities Based on information developed during the Westinghouse Owners Group severe accident management guidance program, the decision-making responsibilities during a severe accident should not change significantly from those already specified in the utility site emergency plan for existing plants. The only significant difference introduced by severe accident management guidance is the broader responsibility for the plaat technical support staff to provide recommended actions to the control room staif after core damage has occurred. The tools available to the technical support staff for this broader responsibility are the severe accident management guidance derived from the AP600 generic severe accident management guidelines. Considerations related to' decision-making responsibilities during an accident, including severe accidents, are in the scope of the combined license application.
PRA Revision: NONE W- WestinEhouse