ML20153G447
| ML20153G447 | |
| Person / Time | |
|---|---|
| Site: | 05200003 |
| Issue date: | 12/31/1993 |
| From: | Ohkawa D WESTINGHOUSE ELECTRIC COMPANY, DIV OF CBS CORP. |
| To: | |
| Shared Package | |
| ML20153G427 | List: |
| References | |
| WCAP-13913, WCAP-13913-01, WCAP-13913-1, NUDOCS 9809300076 | |
| Download: ML20153G447 (38) | |
Text
{{#Wiki_filter:_ . . . . . . . - . . - _ . . . . . - . _ - - . . - . . . . . . . . . . - . . - . . - . . . . . . - . - - - - . _ . . . WCAP-13913 Framework for AP600 Severe Accident Management Guidance December 1993 Westinghouse Electric Corporation Energy Systems Business Unit Nuclear Technology Division
- P.O. Box 355 Pittsburgh, Pennsylvania 15230 01993 Westinghouse Electric Corporation All Rights Reserved 9809300076 900922 @
PDR ADOCK 05200003 A PDR 4
L
. AP600 DOCUMENT COVER SHEET ape 00 CENTRAL FILE USE ONLY; RFSe- RFS ITEM #;
\ Form 5820tF(943)(WP xmot] _ 0058.FRM APG00 DOCUMENT NO. REVISION NO. PAGES ATTACHED ASSIGNED TO Gto-GL-031 0 76 N/A I ATTACHMENTS
- ALTERNATE DOCUMENT NUMBER
- uRAP- I'5 all3 /j)8tl4 DESIGN AGENT ORGANIZATION: toeskqWe $
PROJECT: /I9400 t "*" M l WORK BREAKDOWN #: g,3,l,g,q I TITLE: l Fr mework Se A%oo see Ac.t. A +d- em.ad" BIN a %ct. i l l CALCULATION / ANALYSIS
REFERENCE:
DCP #/REV INCORPORATED:
- ELECTRONIC FILENAME
- APPLICATION:
i Woftd Yev'Stof W11913. Rd g , ,,, , WiM 4 w in d m o , sie m e n O.WES lETARY)
$ DOE DESIGN CERTIFICATION PROGRAM GOVERNMENT UMITED RIGHTS STATEMENT (See sever g (C) WESTINGHOUSE ELECTRIC CORPORATION 191F l A license le reserved to he U.S. Govemment under contract DE AC03 90SFts495.
O DOE CONTRACT DELIVERABLES (DELIVERED DATA) :30,19e6 or Desagn Certficehon under DOE Suthect to specated exceptone, disclosure of his data le restr6cled until L. contract DE AC03 eOSF18495, wheoheveris later. EPRI CONFIDENTIAUOBLIGATION NOTICES: NOTICE: 1 2 3[4OsD . EO FO CATEGORY: AM B LJ C O ARC FOAKE PROGRAM ARC LIMITED RIGHTS STATEMENT [See reverse side of this form] (C) WESTINGHOUSE ELECTRIC CORPORATION 19 A license is reserved to the U.S. Govemment under contract DE-FC02-NE34267 and subcontract ARC-934 SC 001. O ARC CONTRACT DELIVEPABLES (DELIVERED DATA)
- Subject to speedied exceptone, disclosure of his data le sostncted under ARC Subcontract ARC-934 SC 001.
ORIGe. ATOR SIGNAT R ATE hasr K. OkKnw a. K. Ohk w m- 'alach3 AP600 RESPONSIBLE MANAGER SIGNATURE
- APPMOVAL DATE
}.
- Approval of me toeponestdo manager asipufee that draJmont is complete, all segswed reviews are -@te, electronec flie se attached and document se released for use.
w.gcln K4:4 7M E'w ? . - 4 - TABLE OF CONTENTS l l Pggg 1.0 INTRODUCrlON . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I 2.0 REQUIREMENTS FOR SEVERE ACCIDENT MANAGEMENT . . . . . . . . . . . . . . . . . . . . 2 3.0 DECISION. MAKING PROCESS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 3.1 Role of the Plant Personnel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 3.2 Structure of AP600 Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 3.2.1 Diagnostic Flow Chart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 3.2.2 Severe Challenge Status Tree . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 3.2.3 Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 4.0 SEVERE ACCIDENT MANAGEMENT GOALS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 4.1 Controlled. Stable Core State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 4.2 Controlled, Stable Containment Stve . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 4.2.1 Hydrogen Flammahility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 4.2.2 Core / Concrete Interactions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 4.2.3 High Pressure Melt Ejection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 4.2.4 S team Explosions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 4.2.5 Creep Rupture Failure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 4.2.6 Containment Vacuum . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 4.3 Fission Product Release Prevention, Termination t.nd Mitigation . . . . . . . . . . . . . . . 16 4.4 Secondary Goals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 5.0 HIGH LEVEL SEVERE ACCIDENT MANAGEMENT ACTIONS . . . . . . . . . . . . . . . . . . 20 5.1 Inject into RCS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 5.2 Inject into Containment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 5.3 Inject into Steam Generators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 5.4 Depressurize RCS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 5.5 Depressurize Steam Generators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 5.6 Depressurize Containment ......................................... 28 5.7 Pressurize Containment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 5.8 B urn Hydrogen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 5.9 Vent Conta inment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 6.0 CONCLUS IONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
7.0 REFERENCES
..................................................... 35 3 i
y n .. . A g TgTy(. 1 . . ;
1.0 INTRODUCTION
Prevention and mitigation of accidents has been an integral part of the design process for AP600. A significant driving force in the passive plant design is the key accident management philosophy of preventing accidents from progressing to core damage. However, in the event of a low probability core damage accident, it is prudent to have severe accident management guidance with the objective of terminating the progression of the accident and returning the plant to a controlled, stable state. Herefore, this document contains a summary of the overall philosophy and high level strategies that will form the basis of the AP600 severe accident management guidance. De Westinghouse plan for addressing severe accident management for AP600 will be based on the Westinghouse Owners Group Severe Accident Management Guidance (WOG SAMG) for the current generation of operating plants. Since some of the AP600 design features reduce or eliminate the potential for some severe accident phenomena and fission product boundary challenges, the WOG SAMG provides an envelope of possible severe accident management considerations. Rus, the WOG SAMG has direct applications to the development of AP600 severe accident management guidance, and will be the staning point from which comparisons are made. he scope of the AP600 severe accident management guidance is to address significant core damage accidents. Prior to core damage, the Emergency Operating Procedures (EOPs), which are based on the AP600 Emergency Response Guidelines (ERGS) will be used. [Ref.1] Although the EOPs/ ERGS for existing plants have proven to be effective in the prevention of core damage, they do not address scenarios after significant core damage has occurred. De AP600 severe accident management guidance will be developed for use after the AP600 emergency response guidelines are no longer applicable he AP600 severe accident management guidance will include the application ofinsights that are derived from the AP600 Probabilistic Risk Assessment (PRA), and elements that have been learned through severe accident management research over the past 15 years. As such, severe accident management guidance is the mechanism that brings the current level of knowledge on severe accidents to the hands of the operating and technical staff at the plant. However, the overall uncertainty of the core melt progression is still quite high, and thus the management of a severe accident can only be pre-constructed by guidance that is less prescriptive than the guidelines for design basis events and other accidents prior to core damage. He contents of this document include a discussion of severe accident management requirements, the anticipated structure for the decision making process, the goals that must be accomplished for severe accident management, and a summary of possible strategies for AP600 severe accident management. His document provides the framework for future AP600 severe accident management guidance development and therefore does not specifically address many issues in detail. 1
l 2.0 REQUIREMENTS FOR SEVERE ACCIDENT MANAGEMENT nere are no current NRC reauirements for the development of severe accident management guidance. However, NRC policy statements from the NRC Staff to the NRC Commissioners (SECY letters) identify concerns and future actions of the NRC concerning this subject. Specifically, SECY-89-012 provides the l following information. I
" Accident Management encompasses those actions taken during the course of an accident by the plant operating and technical staff to: (1) prevent core damage, (2) terminate the progress of core damage ifit begins and retain the core within the reactor vessel, (3) maintain containment integrity as long as possible, and (4) minimize offsite releases. Accident management, in effect, extends l the defense-in-depth principle to plant operating staff by extending the operating procedures well l beyond the plant design basis into severe fuel damage regimes, with the operator skills and I creativity to find ways to terminate accidents beyond the design basis or to limit offsite releases.
'Ihe NRC staff has concluded, based on PRAs and severe accident analyses, that the risk l associated with severe core damage accidents can be further reduced through effective accident management. In this context, effective accident management would ensure that optimal and maximum safety benefits are derived from available, existing systems and plant operating staff through pre-planned strategies... Accordingly, accident management is considered to be an essential element of the severe accident closure process described in the Integration Plan for Closure of Severe Accident Issues (SECY-88-147) and the Generic Letter on the Individual Plant Examination (Generic Letter 88-20).
In the IPE Generic Letter, the staff deferred the requirement to develop an accident management plan, stating that we are currently developing more specific guidance on this matter and are working with NUMARC to (1) define the scope and content of acceptable accident management programs, and (2) identify a plan of action that will ultimately result in incorporating any plant-specific actions deemed necessary, as a result of tne IPE, ivo an overall severe accident management program." Also within SECY-89-012, the first objective for an accident management plan developed by licensees for each plant is:
" Developing technically sound strategies for maximizing the effectiveness of esonnel and equipment in preventing and mitigating potential severe accidents. This includes ensuring that guidance anc' ; ricedures to implement these strategies are in place at all plants."
In a June 3,1993 meeting between the NRC and NUMARC, the NRC endorsed a NUMARC industry initiative on accident management as an alternative to an NRC Generic Letter. (Ref. 2] Currently in draft 2
mv. , : .. o . n . e. , , , ,, , n-form, the industry initiative does not contain specific regulatory criteria. Rather, industry has defined its goals and objectives by its actions relative to severe accident management. Rese include, but are not limited to, performance and submittal of an Individual Plant Examination (IPE) and an Individual Plant Examination of External Events (IPEEE), development of generic (Owners Group) severe accident management material, and numerous interactions at various levels among industry, the NRC, and vendors. It is anticipated that the NUMARC initiative will be issued in March 1994 as a revision to NUMARC 91-04, " Severe Accident Issue Closure Guidelines." he NRC has expressed the view that the industry initiative is acceptable as an alternative to the accident management generic letter provided that the NRC could conclude that "the initiative meets the objectives for accident management established at the time the severe accident program was initiated." [Ref. 2] he previous information is in regards to general positions of the NRC on severe accident management, and it does not distinguish between current operating plants and new, advanced plant designs. However, the NRC has indicated their interest in AP600 severe accident management through several of the Requests for Additional Information (RAls) over the past year. Specifically, RAI 720.55 asks how Westinghouse plans to use the AP600 Probabilistic Risk Assessment to identify and assess accident management measures. Furthermore, in RAI 720.56, the NRC asked how Westinghouse plans to address the five elements of accident management as defined in SECY-89-012. Dese elements are: 1) accident management procedures, 2) training for severe accidents, 3) accident management guidance,
- 4) instrumentation, and 5) decision-making responsibilities.
In addition, the Advanced Light Water Reactor (ALWR) Utility Requirements Document (URD) states that the Plant Designer shall establish the technical basis for a severe accident management program that includes core damage prevention and mitigation. The Plant Designer is also to translate the plant design bases into operational limitations and responses which can then be developed into procedural guidelines and training by the Plant Owner. He Plant Designer is also responsible for confirming that the plant design is compatible with the EPGs and the severe accident management program based on the plant specific PRA and other relevant information. [Ref. 3] De NRC's Safety Evaluation Report for this document states: "De use of PRA for developing and confirming the severe-accident management program and EPGs is also consistent with the Commission's severe-accident policy." [Ref. 4] I 3
- w . m .e u -c y w s . o ., u
- 3.0 DECISION MAKING PROCESS Severe accident management involves the implementation of actions to bring the plant to a controlled, stable state following core damage and to mitigate challenges to the containment fission product boundary.
In a severe accident state, the first two fission product boundaries (the fuel rod cladding and the reactor coolant system) may be severely damaged and the focus shifts to maintaining the final fission product boundary. To effectively choose the appropdate severe accident management actions and to prioritize the implementation of the appropriate actions, assessment of the plant condidons is needed. De nature of severe accidents and the possible responses dictate that severe accident management diagnostics be symptom-based. Several specific features of severe accidents can be cited which support the symptom-based approach: a) Severe accident management m 9 Wvide a response for a wide range of severe accident conditions. While a large number w possible scenarios have been identified in severe accident studies,it is likely that most of these scenarios do not accurately represent realistic severe accident scenarios due to modelling assumptions in these studies (such as all equipment failures are assumed to occur at time zero). b) During a severe accident, the plant conditions are undergoing continual change. Severe accident management must relate actions to symptoms. c) he overall goals of severe accident management involve the response to challenges to fission product boundaries, which can be diagnosed through symptoms. In other words, the symptom-based approach is a key method to develop flexibility in the AP600 severe accident management guidance. His flexibility refers primarily to the ability of plant personnel to shift priorities and implement accident management strategies based on the situation of the plant during the accident. Specific technical decisions may be knowledge-based, and will be dependent on the interpretation of the plant status. Herefore, the appropriateness of spcific actions cannot be predetermined during the development of AP600 severe accident management guidance. His approach kilows the guidance developed to be useful during any severe accident, even scenarios which are not currently recognized situations. As such, an AP600 severe accident management plan is the final stage in the defense-in-depth plant safety concept. Although flexibility is a necessity, there is a need for the guidance itself to be a structured process for choosing the appropriate actions based on actual plant conditions. Human factor considerations during a high stress environment that would accompany a severe accident require that the guidance be simple to use. Rus, the AP600 severe accident management guidance must be an effective decision-making tool based on some fundamental concepts about the organization of the guidance, as detailed below. 4
3.1 Role of the Plant Personnel NUMARC has developed recommendations for severe accident assessment and mitigation that divide responsibilities of personnel into categories of evaluators, decision makers, and implementers. The evaluators must assess the plant symptoms to determine the plant state, and then evaluate the potential strategies that may be used to mitigate the event. The decision makers are to assess and select the strategies to be implemented. The implementers are responsible for performing the steps necessary to accomplish the objectives of the strategies, such as hands-on control of valves, breakers, controllers and special equipment. The plant personnel to perform each of these functions will be identified in a later phase of the development of the AP600 severe accident management plan. Factors that will be considered include:
- the structure of the organization that is needed for accidents prior to core damage, so that there would be an orderly transition to management of the accident after core damage is diagnosed, e the instrumentation, equipment and computers necessary to fulfill each function, e the skills, training and expertise of personnel, e the size and location of the necessary staff, and
- the desire to address severe accident management preparation, while still maintaining a focus on the prevention of core damage.
3.2 Structure of AP600 Guidance ! The AP600 guidance for severe accident management will include overall diagnostic tools that control the flow of the decision-making process, as well as detailed guidelines. The following sections provide a summary of the expected flow charts, as well as further information on the content of the detailed guidelines. 3.2.1 Diagnostic Flow Chart As identified in Section 3.0, there is a need for severe accident management guidance to have an organized structure to facilitate effective decision-making. For AP600, the form of this structure should be based on the WOG SAMG, although some of the details may differ. The clement discussed within this section is the Diagnostic Flow Chart, which is the primary decision-making tool to determine when the plant has achieved the overall goals of severe accident management. The Diagnostic Flow Chan (DFC) is the primary tool to identify the appropriate guidelines for the key possible plant conditions that may occur following a severe accident. The flow chart is the point of entry 5
4 into severe accident management (from the ERGS), and it also serves as the exit point. The flowchart is based on setpoints for different parameters that are either necessary to define a controlled, stable state or which may prevent further challenges to fission product boundaries. The elements that determine a controlled, stable state are discussed in Section 4.0. Prevention of fission product boundary challenges refers to the prevention of severe accident phenomena, which may challenge fission product boundary integrity, such as induced steam generator tube rupture, high pressure melt ejection and reactor vessel lower head failure. Key plant conditions will be defined based on the capability to take actions to control the conditions and on the potential challenge to the containment fission product boundaries which these conditions may indicate. Based on the particular plant conditions identified in the DFC, a specific guideline is consulted to evaluate the availability and effectiveness of the various severe accident management strategies which may be used to control the conditions. If a controlled, stable state is achieved, the DFC instructs plant personnel to develop a set of limitations and cautions for the long term recovery process, based on the consideration oflarge quantities of fission products released from the core and other important aspects of the severe accident scenario. The parameters in the DFC will be prioritized and the setpoint values will be determined during the development of the detailed AP600 guidance. 3.2.2 Severe Challenge Status Tree The Severe Challenge Status Tree (SCST) is the primary tool used by the emergency response team to identify immediate and severe challenges to containment fission product boundaries and to select the appropriate guideline for strategies to respond to the challenge. De SCSTidentifies the severe challenges for all possible plant conditions that may occur following a severe accident. He plant conditions on the SCST will be defined based on the severity of the challenge arxl capability to take actions to control the conditions in time to mitigate the challenge to the containment fission product boundaries. Based on the particular plant conditions identified in the SCST, a specific guideline is consulted to evaluate the availability and effectiveness of the various severe accident management strategies which may be used to control the conditions. De parameters in the SCST are regularly monitored to determine whether a severe challenge has developed. He SCST parameters are to be monitored simultaneously with the usage of the Diagnostic Flow Chart (DFC). De existence of the SCST as a monitoring tool allows for the effective use of the pre-prioritized DFC, which addresses less-immediate concerns. However, if the setpoint for a SCST parameter is reached, all activities being guided by the DFC would be put on hold until the SCST challenge has been addressed. 6
Auged A*r ~+ , w am.o ae. p ww~ ~ - 3.23 Guidelines While a Diagnostic Flow Chart and Severe Challenge Status Tree are used to establish the organizational structure of severe accident management guidance, the details and the majority of the technical content are contained within guidelines. Guidelines are referenced directly from the DFC or SCST due to a plant parameter being outside the desired range. The structure of the guidelines willinclude the following major considerations:
- 1) Equipment Availability - The guidelines will contain lists of the possible equipment that may be used to implement an action. If no equipment is available, instructions will include the consideration of restoring the non functioning equipment.
- 2) Benefits vs. Potential Negative Impacts - The potential actions will be considered in regards to their benefits weighed against the expected negative impacts. If the negative impacts are judged to be large, then methods to minimize the negative impacts will be considered when possible. If the impacts differ based on the choice of methods or equipment, this distinction will be made.
- 3) Implementation - If the decision is made to implement a strategy, implementation instructions will be provided that include any Ilmitations that were identified during the evaluation. The implementation instructions will also identify the expected response of the plant as a basis to compare the actual response. The option to abort the action, or to implement additional actions, will also be considered.
7
u .g . , , . e a.ug.w w q . - 4.0 SEVERE ACCIDENT MANAGEMENT GOALS I l l Before any guidance for severe accident management can be developed, the first step is to identify the l overall goals that the guidance must achieve. As stated in the introduction, the overall objective of severe accident management is to terminate the core damage progression. However, the scope of severe accident management also entails maintaining the capability of the containment as long as possible, and minimizing fission product releases and their effects. These severe accident management objectives can be translated into specific goals that must be met. These three goals are: 1) to return the core to a controlled, stable state, 2) to maintain or return the containment to a controlled, stable state, and 3) to terminate any fission product releases from the plant. Secondary goals, to be achieved while focusing on the primary goals, are to i) minimize fission product releases, and li) maximize equipment and monitoring capabilities. Before details are provided on each of these goals,it should be noted that severe accident management l does not guarantee the achievement of the goals. Severe accident management is a structured approach I that best utilizes available resources at the plant based on the current understanding of severe accidents. 4.1 Controlled, Stable Core State A controlled, stable core state is defined as core conditions under which no significant shart term or long term physical or chemical changes (i.e., severe accident phenomena) would be expected to occur. A significant short term or long term change is one which would require an operator response to prevent a change in core location, a challenge to containment integrity, or fission product releases. In order to achieve a controlled, stable core state, two primary conditions must be met.
- 1. A process must be in place for transferring all energy being generated in the core to a long term heat sink.
- 2. The core temperature must be well below the point where chemical or physical changes might occur.
For a severe accident, the core is assumed to be uncovered ar.d owtheated when severe accident management begins. Therefore, both decay heat and sensible heat must be removed from the core, along with any chemical heat which is produced during the recovery phase. However, providing a means to remove all of the core energy does not guarantee a controlled, stable core state. This is best illustrated by the TM1-2 accident in which core relocation continued for a significant period of time after a process was in place for cooling the core [Ref. 5). This was because the core geometry did not facilitate efficient transfer of energy from the molten core material to the coolant. Thus, the core can only be considered in a controlled, stable state when its temperature is sufficiently low, anA a heat removal process is in place.
'Ihus, both criteria are necessary and sufficient conditions for achieving a controlled, stable core state.
8
,. m . n 2 ( s m ., a m.,, .. n The amount of energy that will have to be transferred from the core is dependent on whether the core a,,c remains subcritical. Before significant downward relocation of core material occurs, the amount of l negative reactivity required for suberiticality is bounded by the ERG considerations. As core downward relocation progresses, the required negative reactivity for suberiticality decreases due to geometry compaction [Ref. 6] The core compaction results in a significant change in the local moderator to fuel volume ratio, thus requiring less negative reactivity such as control rods or soluble boron.
However, for severe accident management, the extent of core relocation cannot be determined during accident itself. If the water injected during the severe accident comes solely from the tanks inside containment that are sufficiently borated, then there is no chance that the shutdown margin will be lo However, if the only available water sources do not contain sufficient boron to ensure that suberiticality conditions are achieved, there is the potential for a return to power, depending on the co l geometry. The use of unborated (or under-borated) water could only result in a return to power in th core at very low levels, which is a function of the injection rate to the core. For this scenario, the cor would be likely to continue to degrade since all of the heat generation is not removed by boiling of the injected water, resulting in a change in core geometry which leads to 2 suberitical state. If the core returns to a critical state, the excess reactivity would be coinpensated by void formation in th water. However, the rate at which criticality is approached must be sufficiently slow that the feedbac associated with the void development can be effective. If the injection rate of the water were too high prompt recriticality could be a concern, which could damage reactor coolant piping or steam generato tubes. However, generic severe accident studies [Ref. 6] have conservatively shown that even flow rate of 1000 gpm are an order of magnitude too low for prompt criticality. Since this is higher than an expected injection flowrates for the AP600 plant, there is no need to further consider criticality or prompt criticality issues. 'Ihe cooling of the core car, be accomplished via several methods. The preferred method is to cover the core debris with water while it is still in the reactor vessel. If the core cannot remain covered with water while in the vessel, submerging the bottom head of the reactor vessel with water may be sufficient to remove the core heat. [Ref. 7 and Ref. 8] If this method of flooding the containment cavity is successful, it prevents RPV failure and movement of the core material into the containment. Although either water inside the RPV or water submerging the bottom head of the RPV may be sufficient, the ideal condition is to create water inventories bcih inside and outside the RPV. This maximizes the possibility of reducing the core temperature and ensuring that further physical and chemical changes can no longer occur. If the core remains within the RPV, not only must the core initially be cooled, but a long term heat removal process must be established. The first possibility to be considered is heat transfer to the steam generators. For this option to be feasible, there must be a water inventory in the secondary side of the steam generators, the RCS should be relatively intact, and there must be some water inventory within the RCS. However,it is not necessary to have a complete RCS water inventory, since condensation of steam 9
1
, p pe: e,sm %
i s o r ,y 9 0- i n w , . w+ ~ is also an effective heat transfer mechanism. _ Another possibility for long term heat removal while the core is within the reactor vessel is to use the passive resihal heat removal (PRHR) system. This system is based on natural circulation from the RCS to heat exchangers in the in-conts ;nment refueling water storage tank (IRWST). Within the IRWST, the heat is then transferred to the containment through steaming. Therefore, the PRHR is an indirect method to transfer the core heat to the containment. For the PRHR to function, the RCS must be relatively intact, and there must be some water inventory within the RCS. In addition, there must be a sufficient water inventory within the IRWST. Since the IRWST is the largest water source for refilling the RCS and to flood the containment cavity, the IRWST water inventory is not likely to be maintained during a severe accident, and thus this method is not likely to be available for long term heat removal from the RCS. l The third long terr acat transfer process to be considered is a direct path to the containment, which is ' then cooled C ogh passive containment cooling. If there is a LOCA, steaming from the break can be an effective heat transfer medium, provided that additional water can continually be provided to the RCS. For a non-LOCA transient, an opening in the RCS can be created for direct steaming, such as opening the fourth stage valves of the automatic depressurization system (ADS). Another heat transfer pathway to the containment is via direct heat transfer through the walls of the RPV, coolant loops and direct vessel injection lines if water is surrounding the outside surfaces. If the severe accident is not mitigated before the RPV lower head fails and the core debris is transported ex-vessel, the only long term heat sink is the containment. In this scenario, a water inventory in the containment is needed for initial core cooling and long term heat removal. If the limited surface area of the core debris is not sufficient to permit removal of decay heat uud sensible heat, the core debris will remain molten and lateral movement will increase the heat transfer area until cooling can occur. One of the features of the AP600 plant is that the reactor cavity has been designed with sufficient floor space to permit debris spreading until a coolable geometry can be created. Thus, the cooling of the core debris external to the reactor vessel can be accomplished with the presence of water. In addition, accident sequences with debris quenching and a continual supply of water to the cavity experience very little, or no, concrete ablation. For core material dispersed at reactor vessel failure and refrozen on vertical containment surfaces and equipment, or present as thin layers on horizontal containment surfaces or equipment, no water may be required for long term cooling. Genenc analyses show that convection of the decay heat to the containment atmosphere could be sufficient to ensure long term cooling. If decay heat cannot be removed by convection, the disrersed core material will heat-up, become molten, and eventually drain to lower levels of the containment. Downward relocation of core debris will stop when all of the heat can be removed, either via convection from a new configuration or via transfer to water if the debris becomes submerged at lower containment levels. Furthermore, AP600 is designed such that only a small fraction of the core debris that is ejected from the reactor vessel could reach the upper containment area. [Ref. 7) 10
Therefore, core coolability after vessel failure remains primarily a concern of establishing a water inventory in the lower cavity. Thus, to maximize the possibility of achieving a controlled, sable core condition, the elements that must be considered in severe accident management are:
- water inventory in the RCS,
- water inventory in the containment cavity,
- heat transfer to the steam generators, and
- heat transfer to the containment.
i 4.2 Controlled. Stable Containment State ! I A controlled, stable containment state is defined as containment conditions under which no significant short term or long term physical or chemical changes would be expected to occur. A significant short term or long term change is one which would require an operator response to prevent a challenge to containment integrity or fission product releases. In order to achieve a controlled, stable containment state, several conditions must be met, as summarized below.
- 1. A process must be in-place for tansferring all of the energy that is being released to the containment to a long term heat sink.
- 2. The containment boundary must be protected and functional.
- 3. The containment and reactor coo! ant system conditions must be well below the point where chemical or physical processes (severe accident phenomena) might result in a dynamic change in containment conditions or a failure of the containment boundary.
'Ihe first two of these conditions are relatively straight-forward for the AP600. The energy removal condition requires that a heat sink be available and that a process for getting the energy from the containment to the heat sink exists. Without a means to remove the energy transferred from the core and from chemical processes occurring during a severe accident, the containment pressure and/or temperature will increase to the point where the containment structural integrity could be challenged. hus, ensuring that an adequate containment heat sink exicts will prevent containment pressures and temperatures from :
reaching the point where the integrity of the containment boundary is challenged. For the AP600 plant, the primary containment cooling mechanism is the Passive Containment Cooling System (PCCS). 'Ihis system causes the gravity drain of water onto the outside of the steel containment vessel, which then evaporates into the natural circulation alt flow around the containment vessel. Even without the water, air cooling alone is sufficient to remove decay heat that has been transferred to the containment. In this 11 ,
. p ._ . , . . . m n%, n . s , ,,, s . . .
scenario, the containment remains below the failure pressure, although it will exceed the design pressure. In addition, the AP600 fan cooler system may be available to supplement the passive cooling. However, . the AP600 fan cooler by itself would not be able to keep up with the decay heat production. De containment boundary condition requires that containment isolation be established and maintained. In the case of severe accidents the containment boundary includes a,ll, piping which penetrates the containment and which can have an unrestricted pathway to the environment. Rese pipes can be considered to be isolated if at least one valve in the pipe is closed (plus any bypass valves in parallel pipes), the line is pressurized with water, or a water seal is established in the line. In other words, all piping which is not actively carrying water to or from the containment, as part of severe accident management, must be isolated by closing at least one valve or establishing a sufficient water seal to prevent release of reactor coolant or containment fluids. Containment isolation considerations extend to - the steam generators, main steam lines and feedwater lines since steam generator tube faults (either tube failures or pre-existing leaks) are a major concern for severe accident management. He limited number _- 1 of containment penetrations in the AP600 design greatly simplifies this consideration, compared with the current generation of plants. $ The third condition for a controlled, stable containment state is more difficult to accomplish than the _ previous two conditions. The changes in containment conditions which can lead to challenges to the - containment include dynamic changes which cannot be predicted by trending containment parameters and _ longer term changes which can be more readily predicted by monitoring containment parameters. Both of these types of changes are ofinterest since they contribute to the potential for failure of the containment boundary. De dynamic and long term changes in containment conditions considered here are a result of severe accident phenomena. De severe accident phenomena considered in this goal decomposition include:
- Hydrogen flammability
- Core / concrete interactions (CCI) ,
= High pressure melt ejection (HPME), which includes l - - Direct containment heating (DCH)
Reactor vessel lift-off
. Steam explosions
- Creep rupture failure of reactor vessel or SG tubes
. Vacuum caused by hydrogen burning or venting Although the treatment of severe accident phenomenology for AP600 has been addressed in WCAP-13388, the discussions below summarize the impacts on management of the severe accident.
12
.gryv a . n.npy ,, 4 , u . .
4.2.1 Hydrogen Flammability The first of the severe accident phenomena to be considered is hydrogen. The containment pressure rise when a flammable hydrogen mixture is burned in containment is a direct function of the mass of hydrogen present in the containment. During a severe accident, hydrogen is expected in the containment as a result of the in-vessel reactions between the fuel rod cladding and the steam as the core overheats. For any accident sequences in which the RCS pressure is low during core melting, most of the hydrogen generated would be released from the RCS to the containment. However, for sequences with high RCS pressures, a large fraction of the in-vessel hydrogen generation might be trapped in the reactor coohnt system. For these latter sequences, a failure of the RCS or an intentional action to depressurize tl.e RCS to the containment (such as any stage of the AP600 ADS) after significant core damage has occurred can i suddenly change the containment conditions and may have an impact on hydrogen flammabdity Although the AP600 plant is equipped with hydrogen igniters, this discussion is in relation (nip te scenarios in which the igniters fail and hydrogen accumulates. AP600 analyses have shown that the containment can withstand the pressure transient from the deflagration of the hydrogen equivalent to 100% of cladding oxidation. If significant core debris is released to a dry containment, core /concrne interactions can result in additional hydrogen generation along with carbon monoxide, which is a flammable gas. Another significant source of hydrogen to be considered is from interactions between unreacted (unoxidized) metals in the core debris and water or steam in the containment after reactor vessel failure. Since a hydrogen burn can result in a change in containment conditions, a controlled, stable containment can only be achieved if the hydrogen is maintained in a nonflammable state and no significant sources of additional hydrogen are expected. 'Ihus, a controlled, stable containment state with respect to flammable gases requires that: a) the core is covered by water, b) the containment hydrogen is less than the global flanunability limits for containment conditions near ambient, c) there are no ongoing core concrete interactions, and d) the reactor coolant system is at a low pressure. 4.2.2 Core / Concrete Interaction Core / concrete interaction (CCI) can produce substantial changes in the containment conditions in a number of different ways. CCI results in the erosion of the bottom of the containment structure and can result in a containment failure at the basemat. CCI also results in the production of hydrogen and carbon monoxide gases which increases the flammable gas concentration in the containment. CCI without an overlying water layer also results in substantial heating of the containment gases via high temperature gas generation, convective heating of existing gases and radiative heating of nearby structures. In addition, CCI can result in core material configurations which may not be readily coolable, even in the presence of an overlying water cover. 13
Corc/ concrete interaction can be prevented by having an adequate level of water covering the containment i and the reactor cavity floor. De reactor cavity water inventory may also submerge the reactor vessel and I thereby prevent the core debris from leaving the reactor vessel. In the event of reactor vessel failure, the water inventory in the reactor cavity can quench and cool core debris in this region to prevent core / concrete interaction. Thus, a controlled, stable containment state, with respect to core / concrete interaction, requires that either: a) the core is in the reactor vessel or b) the containment and reactor cavity floor regions are covered with sufficient water to quench any core debris discharged from the reactor j vessel and c) water recirculation back to the cavity is available to maintain the cavity water level, and thus
]
core debris cooling. 4.23 High Pressure Melt Ejection If the reactor vessel fails while the reactor coolant system is at a high pressure, several severe accident phenomena can occur which have the potential for producing substantial changes in the containment conditions. The subsequent high pressure melt ejection (HPME) can produce direct containment heating (DCH) effects which may substantially change the containment pressure and temperature. HPME can also result in vertical movement of the reactor vessel due to the thrust forces generated by core debris escaping through the failure location in the RPV bottom head. Some studies have indicated that the movement of the RPV may result in sufficient movement in other piping connected to the RCS to tear containment penetrations, thereby challenging containment integrity conditions. HPME also produces a substantial change in the containment hydrogen concentration as described under the hydrogen flammability discussion above. HPME is prevented by either preventing reactor vessel failure or by reducing the RCS j pressure. 4.2.4 Steam Explosions l Steam explosions, both within the RPV and in the containment, have been postulated as a concern because I they may result in substantial changes in containment conditions by creating breaches in the containment boundary. Steam explosions are a subset of core-coolant interactions which can produce rapid pressure changes in the RCS and the containment. Steam explosions have an accompanying shock wave which, by itself can cause damage to the containment or RCS boundary. [Ref. 9] An evaluation specific to the AP600 design was conducted to investigate the potential for in-vessel steam explosions. De evaluation concludes that in-vessel steam explosions cannot generate sufficient energy, in a short time scale, to generate a missile that could fall the AP600 containment. [Ref. 7] In addition, it was shown that the peak pressure from any potential in-vessel steam explosion is well within the normal operating pressure of the reactor coolant system. Therefore, the integrity of the RCS pressure boundary is not threatened. 14
Because of the AP600 containment layout, a significant ex vessel steam explosion from core debris-water interaction can occur only in the reactor cavity. Evaluation of both steam generation rates and potential shock waves induced by debris-water interactions shows that their magnitude is not expected to be sufficient to threaten the AP600 containment integrity. [Ref. 7] De impact of the shock wave on the cavity wall and vessel support structure was also evaluated, with the conclusion that the structural integrity of the cavity walls is not threatened. Therefore, the principal consequence of ex-vessel explosive debris-water interaction is to rapidly cool the debris and pressurize the containment. Neither the steam generation nor the shock waves are expected to challenge the containment integrity for any credible accident scenario. 4.2.5 Creep Rupture Failure ; Core damage accident scenarios in which the core material is located within the reactor vessel can lead to substantial changes in the containment conditions if either the reactor vessel, the reactor coolant system i piping or the steam generator tubes should fail. Reactor vessel failure is primarily a result of contact between molten core material and the inside surface of the vessel bottom head. Reactor coolant system j piping and steam generator tube failures are primarily a result of the circulation of high temperature gases I within the reactor coolant system which leads to creep rupture failure of the piping. l Creep rupture failure of the RCS piping can result in substantial changes in the containment pressure, hydrogen concentration and fission product inventory. Creep rupture failure of the RCS piping can only I occur if the RCS pressure is near its nominal operating value and is a result of heating the pipe walls to a high temperature under high stress conditions. Rus, creep rupture failure of the RCS piping can be { prevented by reducing the RCS pressure or submerging the RCS piping in water. Creep rupture failure of the SG tubing can result in substantial changes in the containment integrity since the secondary side j of the steam generator pressurizes to the SG safety valve setpoint. His creates a direct pathway for fission product transport from the RCS to the environment. Creep rupture failure of the SG tubes is a result of heating the tube walls to a high temperature and can only occur under conditions of high RCS pressure and a dry steam generator secondary side. Bus, creep rupture failure of the SG tubes can be prevented by reducing the RCS pressure or maintaining an adequate SG secondary side water inventory. l 4.2.6 Containment Vacuum L containment state is the potential for changes in containment conditions which would result in a substantial ! The final severe acc vacuum in containment. A substantial vacuum in containment could result in containment boundary ! failure. Dese conditions are most likely to be a concern following a large hydrogen burn in the l containment or following relief of some portion of the containment gases to the environment. A hydrogen ! burn will consume some of the oxygen which was present in the containment prior to the accident. Upon 15
. __ - . . . . - . . .. . - - .. ~ . ._
l condensation of all of the steam in containment and the reduction in containment temperature to near its pre accident value, the gas volume may be reduced by as much as 21% (assuming all of the oxygen is consumed in a hydrogen burn). This could result in a containment vacuum which challenges the negative design pressure of -15 psig. In severe accident scenarios where a ponion of the containment gases were released to the emironment, either through late containment isolation or intentional containment venting, the potential ft r a strong containment vacuum which threatens containment integrity may also exist. To prevent these conditions, air or water must be introduced to the containment such that the containment pressure is within the normal range when the containment temperature is near its nominal value. Thus, a controlled, stable containment state requires that the containment pressure be nearly ambient with no further significant decreases expected. To maximize the possibility of achieving a controlled, stable containment condition, a summary of all the elements that must be considered in severe accident management are:
- heat transfer from the containment,
- isolation of containment,
- hydrogen prevention / control, e core / concrete interaction preventior
- high pressure melt ejection preven. .,
e creep rupture prevention, and
- containment vacuum prevention.
4.3 Fission Product Release Prevention. Termination and Mitigation To achieve the goal of terminating fission product releases from the plant, several conditions must be met:
- 1. The isolation of the containment boundary, including penetrations and steam generator tubes, must be maintained.
- 2. The fission product inventory of the containment atmosphere must be minimized.
- 3. Significant leakage through the containment boundary must be stopped.
Some of these conditions may be duplicates of previous conditions for maintaining a controlled, stable 4 core and/or containment state. They are also included here to reinforce the goal of controlling and terminating fission product releases during a severe accident. i 16
I Prevention (or termination) of fission product releases therefore requires that the containment boundary be maintained and/or isolated or that the driving force for leakage be eliminated. De containment boundary includes the containment structure, the containment penetrations, the steam generators tubes, and the piping of systems connected to the RCS or containment up to the first isolation valve which is operable. Isolation of the containment boundary includes: a) maintaining existing containment boundaries, and b) closing appropriate valves that isolate systems directly connected to the containment l atmosphere or the reactor coolant system, or c) creating a water seal whose static head is greater than the driving force where the first two methods are not available. All of the considerations for maintaining the containment boundary to prevent uncontrolled fission product releases are covered under the goal of l maintaining a controlled, stable containment state and are not repeated for the termination and mitigation of fission product releases. l l Reducing the inventory of fission products available for release can be a function of the release pathway, which may be directly tied to the accident sequence. For containment releases, the fission product inventory airborne in the containment can be reduced by maintaining the RCS integrity thereby retaining a large fraction of fission products in the RCS. In addition, flooding the containment to submerge RCS piping and flooding the steam generators to submerge the U-tubes would provide cold surfaces for fission product deposition and retention. For release pathways which bypass containment, such as steam generator tube faults or leaks and interfacing system LOCAs (ISLOCAs), the fission product transport can be reduced by reducing the RCS pressure. Also, fission product scrubbing by submerging the release pathway is effective in reducing the dispersion. In the AP600 design, airborne fission product removal is performed by the operation of the passive containment cooling system. The steam released in containment is condensed on the steel containment shell due to cooling from the passive containment cooling system and this process removes airborne fission products. Fission products that are deposited in the containment sump are retained within the water by the containment sump pH control system. His system adds sodium hydroxide to the floodup inventory in containment to maintain the required recirculation sump pH to promote fission product retention. The final condition for this goal is to actually terminate the leakage from the containment. Terminating leakage includes eliminating the driving force for leakage (generally a pressure differential across a leakage path), isolating the leaking system, or creating a water seal whose static head is greater than the driving force. Several sources of leakage are worthy of consideration in the SAMG, including: containment, steam generators, and systems connected to either the cor.tainment or the RCS. IAw levels l ofleakage from these sources are permitted within the plant design basis. The results of analyses which establish permissible leakage, with respect to offsite doses, are reported in the plant Safety Analysis Report. However, to de-escalate the emergency condition during a severe accident, essentially all of the leakage must be terminated. In the case of containment sources, the leakage can be terminated by reducing containment pressure to near atmospheric. Leakage through containment penetrations can be terminated by closing all valves in the piping and/or by creating water seals in the piping. In the case of 17
l the steam generator tubes, leakage can be terminated by keeping the secondary system pressure above the RCS pressure. For systems connected to the RCS and containment, leakage can be stopped by finding alternative methods of accomplishing the same function. For example, recirculation systems which involve transporting high levels of radioactive water outside the containment can result in even very small amounts
)
of leakage being significant. Use of systems that keep all radioactive water within the containment are j preferred. To maximize the possibility of terminating fission product releases, a summary of all the elements that must be considered in severe accident management are:
- isolation of containment,
- reduce fission product inventory, and a e reduce fission product driving force. l l
4.4 Secondary Goals
)
Although the previous sections have addressed the goals that must be met for successful mitigation of severe accident, there are two additional considerations that should be addressed. These considerations have been termed " secondary goals," since they are not fundamental to the termination of the accident, but their impact is widespread. He secondary goals affect the evaluation of which actions, or strategies, to implement. The two secondary goals are: i) to minimize fission product releases, and li) to maximize equipment and monitoring capabilities. i ne secondary goal to minimize fission product releases is similar to the primary goal of terminating fission product releases. However, the distinction is in the recognition that there may be a need to create ) I an intentional, controlled, and short term fission product release to prevent a larger, uncontrolled, and long term release. Specifically, this is in reference to containment venting, if there is believed to be an immediate threat to the integrity of the containment structure. However, any action which violates the
]
primary goal of terminating fission product releases should be done in a manner that minimizes the ) release. Another example is the case of steam generator depressurization. There are pathways that blow l down directly to the environment, and other pathways (such as through the condenser) that would allow ! fission products to be scrubbed, and thus dispersion minimized. ! l De other secondary goal, to maximize equipment and monitoring capabilities, acknowledges that the j survivability of some equipment and instruments may become questionable under some severe accident ! conditions. In general, severe accident conditions are no more severe than the design basis for i instrumentation inside the containment. Depending on the scenario, however, temperatures and pressures l may exceed the containment design basis, and thus the operability of instruments and equipment is j uncertain. Herefore, when making severe accident management decisions, the impact on the instruments j 18 I
u,,.<- .. . . . . . _ c an s 4.c et,c, and equipment is a factor that should be included in the evaluation process. 'Ihe capability to repair and maintain equipment following the onset of a severe accident is also important. First, to arrive at a severe accident condition, it is quite likely that some of the plant equipment is not operable. Second, during a severe accident, the potential exists for malfunctions in equipment which is being used during the recovery. Third, since equipment may be used in non-standard ways for severe accident response, local access to areas may be required for valve alignments and/or equipment i maintenance. Either the severe accident progression or actions taken to recover from the revere accident conditions may compromise the hat.itability, particularly due to high radiation levels, of catain plant areas and result in a condition in which some equipment cannot be aligned, maintained or repaired. As in the case of environmental conditions and power supplies for equipment operability, severe accident , i management decisions should take into account the habitability of plant areas in which alignment, ! maintenance or repair of equipment enhances the recovery capabilities. l l 4 l 1 i { I i i i l 1 1
\
l 1 l 19 1 1
l 5.0 HIGH LEVEL ACTIONS FOR AP600 l Based on the severe accident management goals defined in the previous section, certain elements are necessary to meet the goals. The elements can then further be divided into actions to be taken. The I relationship of severe accident management goals to potential actions are summarized in Table 5-1, which forms the basis for possible severe accident management strategies. De definition of a strategy for AP600 severe accident management consists of three components. A strategy is 1) an action or set of actions that 2) is taken for a specific purpose with 3) specific piece (s) of equipment. A strategy includes more than just the action, since the purposes must be well-understood for an effective evaluation, and the equipment to be used may impact the positive and negative expectations. His is the same strategy definition that was used for the WOG SAMG program, and it initially produced a list of over fifty strategies. Eventually, the strategies were combined to form a smaller number of guidelines, and they were grouped based on the potential actions. Since the AP600 severe accident management program is being developed based on the WOG SAMG program, this same process will be followed. The information within this section is grouped according to the high level actions that may be taken during the management of a severe accident. The discussion of each high level action includes the identification of the benefits (purposes) of the action, the potential negative impacts, and the equipment possibilities. The development of the high level strategies is a preliminary step in the development of the AP600 severe accident management guidance. The information contained within this section is subject to change based on the completion and finalization of 1) Rev. O of the WOG SAMG,2) the AP600 PRA,3) AP600 accident management insights and their disposition, and 4) the AP600 function-based task analyses. 5.1 Inlect into RCS Injecting water into the RCS is the most fundamental action to mitigate the progression of a core damage accident. Regardless of where the core has relocated, the RCS may be the most effective pathway to get the water to the core debris. The underlying cause of all severe accidents is the inability to remove the decay heat generated by the core. Derefore, injecting water to the core region is the most direct means of restoring core cooling and stopping the accident progression. As just stated, one of the benefits ofinjecting water into the RCS is the restoration of core cooling. The only possibility of preventing the core from relocating to the RPV lower head is to restore injection flow. As water initially flows to an overheated core, the water will flash to steam due to the high temperatures ( in the core region. Heat can be removed from the core by sensible and latent heat addition to the water ! and sensible heat addition to the steam. If the flow of water can remove energy at a rate exceeding the decay heat rate, then core cooling can eventually be restored. 20
, ,, .c..o..,.,+> 7. p ne A N m a ,
Table 5-1 AP600 High Level Actions Relative to Severe Accident Management Goals Goal Element High Level Action Controlled, stable core Water Inventory in RCS - Inject into RCS
- Depressurize RCS Water Inventory in Containment - Inject into Containment Heat Transfer to SGs - Inject into RCS
- Inject into SGs
- Depressurize SGs Heat Transfer to Ccotainment - Inject into RCS
- Inject into Containment
- Depressurize RCS Controlled, stable Heat Transfer from Containment - Depressurize containment containment - Vent Containment Isolation of Containment - Inject into SGs
- Depressurize RCS Hydrogen Prevention / Control - Vent Containment
- Pressurize Containment
- Burn Hydrogen
- Depressurize RCS
- Inject into Containment CCI Prevention - Inject into Containment HPME Prevention - Inject into Containment
- Depressurize RCS Creep Rupture Prevention - Depressurize RCS
- Inject into SGs Containment Vacuum Prevention - Pressurize Containment Terminate fission product Isolation of Containment - Inject into SGs releases - Depressurize RCS Reduce Fission Product Inventory - Inject into Containment
- Depressurize RCS Reduce F.P. Driving Force - Depressurize Containment i
21
)
ve hw , r , , , , , 33 p.ym y Another benefit ofinjecting water into the RCS is the sembbing of fissic products. If a pool of water j is overlying a core debris bed, fission products released from the core debris bed will be scrubbed by the water pool. Fission product scrubbing can result in a significant reduction in the amount of fission products released to the containment atmosphere. A water depth of a few feet is a sufficient level to significantly increase the decontamination factor. [Ref.10] Finally, injection of water into the .RCS may help retain the core within the reactor vessel. He energy removed by the water can slow the core damage pregression and may delay or even prevent vessel failure. De injection of water during the TMI-2 accident, for example, provided sufficient heat removal to retain the core debris within the vessel. However, there is no guarantee that the injection of water in another severe accident would prevent the vessel from falling. Nevertheless, even a delay in vessel failure is a l benefit worth achieving. l There are also negative impacts from injecting water onto hot core debris during a severe accident. De l potential impact of these adverse effects should be considered before a decision is made to implement the strategy. He potential negative impacts are the production of hydrogen and the potential for creep rupture of the steam generator tubes. A summary of these drawbacks is provided below. The hot fuel cladding, in the presence of steam, oxidizes and produces significant amounts of hydrogen. If the containment hydrogen igniters are not working, the accumulation of hydrogen in the containment is a concern. Although AP600 analyses have shown that the containment can withstand the deflagration of hydrogen produced from 100% of the cladding being oxidized, the containment integrity could be challenged if there are significant additional combustible gases. The production of hydrogen is unavoidable when adding water to an overheated core (above 1800*F). However, the total hydrogen production for accidents where the core is recovered in-vessel should be much less than 100% cladding oxidation. Ultimately, to achieve a controlled, stable containment, the possibility of future hydrogen production must be minimized by covering the core with water. Without the reflooding of the core debris, the potential exists for significant additional hydrogen production that could later create a containment challenge. Therefore, although the hydrogen production due to injecting water into the RCS is a negative impact, it is not a containment challenge. Another potential negative impact is creep rupture of the steam generator tubes. his is a failure mode that can occur when the steam generator tubes are subjected to high temperatures and large primary-to-secondary pressure differences. hbe temperatures can reach creep rupture limits quickly if hot gases that accumulate in the core upper plenum are forced into the steam generators by the rapid steaming that will occur when injection into the RCS reaches the overheated core debris in the reactor vessel. Since the steam generator tubes provide a fission product boundary, maintaining the tube integrity during a severe accident is important to the goal of eliminating fission product releases. Here are two methods of preventing these adverse impacts: decrease the primary-to-secondary pressure difference, or make sure that the steam generator tubes are at least partially covered on the secondary side. 22
,,,.w, av z. ;.m e.r;5% b Two negative impacts that were also included in the WOG SAMG but that are not applicable to the AP600 design are containment flooding and an insufficient injection source. Containment flooding for current plants is a concern because equipment such as containment vent valves or fan cooler exhaust / intake ducts may be located where they will be covered with water and unusable. However, the AP600 plant has been designed so that significant containment flooding does not affect necessary equipment. Another concern in most current plants is that the use of the water from the RWST may limit other uses of that water. However, the AP600 plant is designed so that there are rarely systems competing for the same water inventory, and thus the injection of water does not impact the ability to perform other actions.
Furthermore, the design of the injection systems for the AP600 plant is significantly different than existing plants. Current plants rely primarily on the forced injection of water from sources outside the containment. However, the AP600 plant relies primarily on the passive injection from water tanks inside the containment. Each of the water tanks and injection methods for AP600 is further discussed below, he Core Makeup Tank (CMT) is a safety related means to provide water inventory to the RCS. There are two CMTs, each with a capacity of 2000 ft', which replace the function of high head safety injection pumps in current plants. CMTs are located above the reactor coolant loops and have two pressure balancing lines: one from the top of the pressurizer and another from a cold leg pipe. The CMTs are maintained full of borated water and are designed to inject at any RCS pressure. The discharge from the CMTs is routed from the bottom of the tanks to separate safety injection nozzles on the reactor vessel. Each discharge line is normally isolated by two parallel air-operated valves that fail open on loss of air pressure, loss of de power, or loss of control signal.
]
He AP600 is also provided with two accumulators that supply borated water at high makeup flow rates to refill the reactor vessel downcomer and lower plenum during a large loss of coolant accident or during other events requiring automatic or manual RCS depressurization. The back pressure for the accumulators is 700 psig, so that the RCS pressure must be reduced below this value before water will inject. The in-containmeri refueling water storage tank (IRWST), in conjunction with the automatic depressurization system, provides the function oflow head safety injection. To get injection from the in-containment refueling water storage tank, the RCS pressure must be reduced to a value near containment pressure. The automatic depressurization system is provided to accomplish this function. When the IRWST empties, the containment is flooded above the RCS loop level, and the water in the containment drains, by gravity, back into the RCS if there is a break in the hot or cold leg. Herefore, stable, long-term core cooling and makeup to the RCS is established. The passive containment cooling system supports this operation by removing heat from the containment. Steam released from the RCS is condensed. This condensate then drains back into the RCS for recirculation. l The normal residual heat removal system (NRHR) provides an additional mechanism for core cooling, l l taking water from the IRWST/ sump and injecting it into the safety injection lines. The NRHR system 23
. , p- . g w u,, o ,, , ,,.
needs cooling water and ac electrical power. If offsite power is lost, the power is supplied by two nons safety related diesel generators. The NRHR loops take water outside the containment, which could be a negative factor during a severe accident, since the coolant water is highly contaminated with fission products and may result in more personnel access restrictions. Finally, the chemical and volume control system (CVS) is the normal RCS inventory makeup system. ; It has two non-safety grade high pressure pumps, which stan automatically if a core makeup tank actuation signal is generated. The pumps are also automatically loaded on the non-safety diesel generators if offsite power is lost. De CVS is rated to provide a flowrate around 100 gpm per pump at full system pressure. j If the core is totally uncovered, the CVS is insufficient, by itself, to quench the core and reflood the vessel. However, this may be sufficient to remove decay heat as it is produced. , Because the AP600 plant is a passive design, most of the methods of injecting water rely on the gravity draining of tanks. However, for this to occur from some of the tanks, the RCS must be depressurized. He largest tank, the IRWST, requires that the RCS be almost fully depressurized. Herefore, during a } severe accident in which injection capability has failed, it may be due to the RCS having a pressux that ! I is too high. His makes the action of depressurizing the RCS very important for AP600. His high level action is further discussed in Section 5.4. l 5.2 Inlect into Containment { 4 i Another important strategy for AP600 is to inject water into the containment cavity so that water
]
surrounds the outside of the reactor vessel. According to WCAP-13388 [Ref. 7], this action has more l impact on accident management considerations than any other individual phenomena except the direct i water addition to the debris. Based on experiments and analyses,it is believed that external flooding of the vessel can cause the core debris to be retained within the lower vessel plenum. His action also has 4 the benefits of protecting the containment, creating a heat removal path from the core debris, stopping the l accident progression through the prevention of vessel failure, and preventing all ex-vessel phenomena from I occurring. l I 1 However, if the core is ex-vessel or if vessel failure is imminent, the injection of water into the containment has other benefits. The presence of water in the cavity will scrub fission product inventory, i eliminate high pressure melt ejectim concerns, and will prevent or limit core / concrete interaction (CCI). CCI is the phenomena of core debris attacking the concrete basemat if there is no water in the containment cavity to cool the debris. He consequences of CCI include the generation of non-condensable gases that will pressurize the containment, the generation of combustible gases that can ignite and fail the containment, the generation of a significant amount of aerosols, and the eventual failure of the containment boundary due to basemat or liner melt through. 24
, w . . , . . m . 3. w. we ~
. g_
Injecting water into the containment to a level that covers the RCS loops is a viable action for the AP600 design and automatically occurs if all in-containment water sources are directed into the containment cavity. For core damage events resulting from a large LOCA, this containment water level will ensure that water gets into the reactor vessel. For non-LOCA events, this water level protects RCS loops from creep failure and cools gases to prevent steam generator tube creep rupture. Dere are very few negative considerations of injecting water into the containment cavity. In the WOG SAMG, three negative impacts are identified, which are 1) de-inerting the containment if the sprays are l used,2) using the water inventory in the RWST that may be needed for other actions, and 3) pressurizing the containment to the point that gravity drain of the RWST would not be possible. For AP600, none o l these negative impacts apply. The AP600 containment design does not include any intemal containmen sprays. There are also no competing uses for the IRWST water And if the method of containment injection is gravity drain of the IRWST, the flow rate is high and is possible regardless of containment pressure. His is because the IRWST is internal to the containment and gravity drain would not be impacted by containment pressure. l Another potential negative impact that was discussed in the WOG SAMG and is also applicable to AP600 is the potential for an ex-vessel steam explosion if the vessel fails. A steam explosion could result in the destruction of the reactor cavity walls which provide support for the reactor vessel. If a steam explosion destroys the reactor vessel supports, the containment fission product boundary may be challenged due to tearing of containment penetrations connected to the RCS as the reactor vessel drops to the reactor cavity floor. Evaluations of the AP600 reactor cavity wall structural capability concludes that steam explosions in the reactor cavity do not pose a challenge to the containment fission product boundaries. De cavity walls are expected to withstand the effects of any credible steam explosion. 5.3 Inlect into Steam Generators In conventional plants, the steam generators are designed to provide a heat sink for the RCS during both normal and accident conditions. Therefore, in the WOG SAMG, injecting into the steam generators was judged to be one of the most important activities. In the AP600 plant, although the steam generators are designed for heat removal during normal operation, they are not a safety-related method of decay heat removal during an accident. However, injecting into the steam generators is stili an important high level action for the management of a severe accident in the AP600 plant. Because much of the secondary side is located outside of containment, the SG tubes act as a containment boundary. Derefore, the prevention of induced steam generator tube ruptures is important for severe' accident management. One of the methods of doing this is to inject water into the steam generator to keep the tubes cooled. His protects them from rupturing due to heatup from hot gases on the primary side of the tubes. Nevertheless, if a tube rupture does occur, covering the break with water will scrub fission 25
m ,,c o e m e . u. , ;. . . ,, . products from the primary system following core damage. . Also, although the AP600 steam generators are not a safety-related method for removing decay heat, they may still be useful for this function during a severe accident. Not only may the heat removal be of benefit, but the steam generators may be a method for depressurizing the RCS. However, there are also several drawbacks associated with injecting water into the steam generators. These drawbacks have the potential to negatively impact the accident progression by allowing the direct release of fission products to the environment. The first concern is the thermal shock of the steam generators. If the steam generators have dried out during a severe accident, the tube temperatures may exceed 1000*F. The injection of cold water to the hot, dry steam generators can place significant thermal stresses on the tubes and other components. These thermal stresses can result in the failure of either the shell side of the steam generator or the steam generator tubes. Failure of the shell side of a steam generator during a severe. accident reduces the amount of water that can enter the steam generator and increases flooding of the containment. Failure of one or twre tubes will result in a containment bypass and the potential release of fission products to the environment. Another potential concern with the injection of water into the steam generators can occur if the steam generators must first be depressurized. If the RCS is pressurized, the depressurization of the steam generators could create a large primary-to-secondary AP that could induce creep rupture of the steam generator tubes. Either this induced tube rupture, or pre-existing tube ruptures, would then make fission product releases to the environment a concern. These potential negative impacts must be considered in the evaluation process that determines whether steam generator injection should be attempted. Equipment that may be used for this high level action is dependent on the pressure of the steam generators. For high pressures, only the startup feedwater pumps and the main feedwater pumps would be usable. For lower pressures, the list of possible equipment expands to include condensate pumps, firewater pumps and service water pumps. 5.4 Depressurize RCS Many benefits can be realized by depressurizing the RCS during a severe accident. As previously discussed in Section 5.1, the depressurization of the RCS will facilitate the injection of water from the passive core cooling system tanks. It will also increase the flowrate that would be provided if pumps are being used. If the ADS valves are used, the creation of the intentional opening in the RCS may be the method of establishing a long term heat removal path. There are also many other effects of depressurizing the RCS that are unique to core damage scenarios. The possibility of creep rupture of the steam generator tubes and the RCS pipes can be reduced or 26
onr .. - . . 4: ,w ,ee u , m/ 4 eliminated if the RCS pressure is lowered. Creep rupture is a plastic deformation process that occurs under high temperatures and sustained loads. Since high temperatures are a by-product of the severe accident, the reduction of the RCS pressure is a good method to avoid failures due to creep rupture. Another important severe accident concern is high pressure melt ejection (HPME). His is a phenomenon that may occur if the RCS pressure is elevated at the time of vessel failure. During HPME, the momentum of the core debris along with the driving force of high velocity gases released from the vessel, can transport the molten core debris away from the reactor cavity region. One method of preventing this phenomenon is to decrease the RCS pressure. Decreasing the RCS pressure also can help isolate the containment and reduce fission product releases for containment bypass sequences. If there are ruptures or leaks in the steam generator tubes, the reduction of the RCS pressure will reduce the driving force on the fission products, and will help to maintain them within the primary system. In addition,ifinjection of water occurs due to the reduction in RCS pressure, the water inventory will help to scrub the fission products. De final benefit of reducing the RCS pressure is for long term control cf the hydrogen inventory. In order to exit the severe accident management guidance, the containment must be in a controlled, stable state. Part of the definition of this state is that there should be no potential for sudden, future changes to the containment atmosphere. If the RCS remains pressurized with hydrogen accumulated within the system, any future failure of the vessel or opening in the RCS would release the hydrogen to the containment atmosphere. Therefore, the RCS pressure should be reduced for long term concerns. However, the long term benefit of hydrogen control also produces a short term negative impact. If the RCS is depressurized using a vent path to the containment, the sudden release of a large quantity of hydrogen to the containment could change the flammability status of the containment atmosphere. Although AP600 analyses have shown that the containment structure can withstand the resulting pressure transient, the plant decision-makers should be aware of the potential of the buin. Also with the opening of a pathway from the RCS to the containment, there could be a sudden increase in the containment ; pressure. His pressure increase is not of sufficient magnitude to challenge the containment integrity. The safety grade system for depressurizing the RCS is the Automatic Depressurization System (ADS). his system is a series of valves arranged in four stages, which provide a phased depressurization capability. He valves of the first three stages are motor-operated valves rnd are mounted on the pressurizer. These valves discharge steam to the IRWST through spargers. De discharged steam is condensed and cooled by mixing it with water in the tank. The valves of the fourth stage are air-operated valves and are located on lines connected to the two hot leg pipes. The fourth stage vene .!irectly to containment. Other equipment for depressurizing the RCS that will be investigated are the pressurizer spray, the RCS 27
l head vent, and CVS letdown. Another method is to depressurize the RCS via heat removal from the steam generators. He equipment associated with this action will be addressed in the following section. 5.5 Depressurize Steam Generators he purposes of this high level action have been discussed in Sections 5.3 and 5.4. Depressurizing the steam generators may be the first step to enable injection of water into the SGs, to establish a heat transfer path from the RCS to the SGs, or to depressurize the RCS. He end purpose of this action may be the depressurization of the RCS, or the establishment of a long term decay heat removal pathway. The principal negative impacts from depressurizing the steam generators are related to the potential for creating a release pathway. Not only might the steam generator inventory be lessened, but any fission products within the steam generators may be released to the environment. Furthermore,if there is a steam generator tube rupture, the lower steam generator pressure will increase the driving force of fission products from the primary to the secondary side. Even if no steam generator tube ruptures currently exist, the lowering of the steam generator pressure could increase tM 1" across the steam generator tubes, inducing a rupture orincreasing leakage of fission products f m K3 through leaking steam generator tubes. The two principal methods of depressur'. zing the steam generators are opening the SG power operated relief valves which discharge directly to environment or opening the steam dump valves wh'. n discharge to the main condenser. Dere are no known differences in the AP600 design, when compared to existing Westinghouse PWR plants, that would impact the equipment to perform this high level action. 5.6 Depressurire Containment During a severe accident it is likely that the containment will experience a substantial increase in pressure. Unless the RCS is intact, and the steam generators are being used for heat removal, all of the energy generated during the accident must ultimately be removed through the containment. Until the energy is effectively removed, the containment will pressurize. Therefore, one of the high level actions for severe accident management is to depressurize the containment. There are several benefits to depressurizing the containment. The fundamental benefit, a3 mentioned above, is the ultimate heat removal from the core, which is needed to conclude that the plant is in a controlled, stable state. However, depressurizing the containment might also be needed for immediate concerns. If overpressurization threatens the integrity of the containment, depressurization would be needed to address this severe challenge. Also, depressurization may be the method of reducing or eliminating fission product releases from the containment. Reducing the AP from the containment to the 28
^
. .. , . c , n. e s . A a , ;, u, : ; ; M.s n. .
environment reduces the driving force behind the fission product leakage. Another benefit o depressurizing the containment is the general improvement of the containment atmosphere to alleviate potential equipment and instrumentation challenges. Finally, depressurizing the containment by condensing steam will increase water in the IRWST and containment for ex-vessel core debris cooling and flooding of the reactor protection vessel and RCS loops. De potential negative impact from depressurizing the containment is that with the condensation of steam from the containment atmosphere, the hydrogen becomes a larger fraction of the overall containment atmosphere. The higher hydrogen fraction may lead to a flammable state inside the containment. If the hydrogen was previously inflammable at the higher pressure due to the presence of steam, and if it becomes flammable due to the condensation of steam, this process is known as de-inerting. However, this concern is not anticipated for AP600 due to the existence of hydrogen igniters. Nevertheless, if the igniters were not functioning properly and significant hydrogen accumulated, the containment could be de-inerted by depressurization. Thus, the containment boundary could be challenged. The AP600 passive safety-related containment cooling is provided by a water tank that allows a gravity-fed flow onto the outside of the containment dome surface, with sufficient water for three days. After three days, heat can be removed by convective air flow to maintain containment pressure below design pressure. Dere are also two fan coolers, although they are designed for normal operation and thus their heat removal capacity is low. De final option to depressurize the contamment is to vent the containment, which is addressed as a separate high level action in Section 5.9. 5.7 Pressurize Containment This high level action addresses two very different concerns. He first concern is to pressurize the containment to create a steam inert atmosphere that would prevent a hydrogen burn. As discussed in the previous section, the presence of a sufficient quantity of steam in the containment atmosphere can ensure that the hydrogen is not flammable, and thus the contairunent is " inert." However, pressurizing the containment to create an inert containment atmosphere is only a temporary solution. The passive features of the AP600 containment cooling system will also be working to condense steam, and the removal of the hydrogen will eventually be needed. On the other end of the spectrum, the high level action of pressurizing the containment is to prevent a vacuum failure of the containment due to too low of a pressure. The threat of a containment vacuum could be created by previous containment venting, delayed containment isolation, or hydrogen burns that have subs'antially reduced the oxygen in the containment atmosphere. The methods suggested in the WOG SAMG to accomplish these actions focus on turning off the containment heat sinks. For AP600 the gravity drain of the water over the outside of the containment 29
shell may be terminated, which will lessen the heat transfer. Another pressurization method in the WOG S AMG is to open a pressurizer power-operated relief valve, if the RCS is still intact, to release steam into the containmera. This method is also available for the AP600 plant via the 4th stage ADS valves. In addition, the IRWST, ifit is being used via the PRHR system, steams directly to the containment. If containment pressurization is being performed to prevent a containment vacuum, another option is to Introduce instrument air into the containment. However, the negative impacts of this action are that there will be more oxygen that could be used in a hydrogen burn, and the possible failure to isolate the path being used for pressurization. i 4 5.8 Burn Hydronen If hydrogen igniters are not functioning properly, it may be desirable to intentionally burn the hydrogen using other methods to create the initial spark. If the containment atmosphere is flammable,it is possible J that an immediate smaller burn may be preferable to a larger burn later. Since the AP600 containment is believed to be capable of withstanding a hydrogen burn from all the fuel cladding being oxidized, this action may only become a factor when CCIis believed to be a potential concern. De negative impact would be a brief temperature and pressure spike in the containment. De methods that may be successful at creating the needed spark will be investigated during a later phase of the development of AP600 severe accident management guidance. One of the options that will be considered is to establish an alternate power source to the hydrogen igniters. I 5.9 Vent Containment 1 Venting the containment is the last high level action to be addressed since the negative impacts from implementing this action are relatively certain. However, there are two strategies that consider this action as a method of achieving the long term goals of severe accident management. De first reason to consider venting is if the containment pressure has increased to the point that failure of the containment pressur boundary is expected. If the accident sequence has resulted in more severe containment conditions th anticipated, and if the heat sinks have not functioned as expected, there could be a need to consider the intentional venting of the containment. His would result in a release of fission products to the environment. But a short term release from which control can be regained may be preferable to a large release as a result of the failure of the containment structure. Another reason to consider venting is as a hydrogen control measure in the containment. If hydrogen igniters have not functioned properly, and if core / concrete interaction has contributed to the hydrogen inventory, the containment integrity may be threatened by the potential for a hydrogen burn. Less drastic hydrogen control measures include inducing a hydrogen burn while the concentration is low enough that 30
the possibility of containment failure can be precluded (Section 5.8) and pressurizing the containment to create an inert atmosphere (Section 5.7). However, the latter option is only a temporary solution, and it may be too late to implement the former option. Therefore, containment venting is also an action that i may be considered as a method of hydrogen control. Note that venting the containment does not reduce I the flammability of the containment atmosphere, however,it reduces the impact of a hydrogen burn. This is because the containment pressure rise when a flammable hydrogen mixture is burned in containment is a direct function of the mass of hydrogen present in the containment. Therefore, reducing the hydrogen mass will reduce the amount of energy released in a burn. 'Ihe hydrogen can be reduced, through venting, to the point that there is not enough energy to fail the containment. The main negative impact of venting the containment is obviously the radiological release of fission I products to the environment. Ideally, this release would be relatively small. However, there is also the l possibility that the vent pathway cannot be re-isolated. In addition, the release of non-condensable gases during the venting leads to the potential for a future challenge of the containment pressure boundary due to a containment vacuum. If: condensable gases are released, containment isolation is re-established, j and steam condenses from the aunosphere, the resulting containment vacuum could be severe enough to fail the pressure boundary due to a compressive load. The methods that may be used to vent the AP600 containment will be investigated during a later phase of the development of the severe accident management guidance. l l 31
_ - . - --. . -. -- --. . ~ . . -. - - -- .. . ~ .--- -- TABLE 5 2
SUMMARY
OF HIGH LEVEL SEVERE ACCIDENT MANAGEMENT STRATEGIES FOR AP600 PURPOSE OTHER EQUIPMENT ACTION (Pasitive impacts) CONSIDERATIONS (Negadre Impacts) l Inject into RG e To resmre core cooling
- Qention of hydrogen
- CMT Gmmediate and long term)
- Qeep rupure of SG tubes e Accumulators e To scrub fission products e IRWST e To pevent, or deley, vessel e NRHR failwe e CVS l l
Inject into e Deate inventory in sump for . Es.venel steam explosions e Gravity Drain of IRWST ) Containment recirculadon e SFS injection into refueling l e Cover lower head of RPV to cavity i I prevent failwe e Cool core debris e Prevent 4imit CCI Prevent buemas melt-thru Reduce flammable su pro & action e Prevent HPME e Reduce finion product inventory laject into SGs e Heat Sink . Thermal shock of SG tubes High Pressure: e Cover SG tubes to pevem . F.P. release from leaking - Main FW creep rupture tubes Startup FW e Scrub fission produas e Ocep rupture of SG tubes low Presswe:
- To make SGs available to 6f SG is first depessurued, - Condensate depessurue RCS creadng large AP) Firewater Service Water Depresswize RCS
- To facilitate injection into e Short term hydrogen release e ADS the RCS and burn e Auxiliary Press'zer Spay e To establish long term heat
- Containment pressuruation . Head Vent transfer path e CVS letdown
. To prevent HPME o via SGs e Prevent creep rupture e Isolate containment due to SG tube leaks e long term hydrogen control e Reduce fission product l anventory Depessurize SGs
- To facilitate injeaion into e Ims of SG inventory e SG PORY SGs e SG fission poduct releases
- Steam Dump e To creats heat transfer path e Deep rupwe of SG tubes with RCS iflarge Apis created.
e Depresswire RCS Depressuriae e Prevent ow.y.wii iion e Hydrogen flammability e PCCS Containment e Midgate containment fission e Containment vacuum if a Fan Coolers product leakage venting
- Vents e Alleviate equipment and instrumentation challenges due to harsh condinons 32
4 TABLE 5 2 (Continued) i
SUMMARY
OF HIGH LEVEL SEVERE ACCIDENT MANAGEMENT STRATEGIES FOR AP600 I , PURPOSE OTHER EQUIPMENT ACTION (Positive Impacts) CONSIDERATIONS (Negative Impacts) l Presswise . To create inert aunosphere so . Removal of hydrogen will . Twning off containment ! Containment that hydrogen cannot bwn eventually be needed beat sinks: l
+ To prevent containment e More oxygen for hydrogen Fan Coolws I vacuum from failing burn - Stop water flow over containment structure e Possible failwe to isolate containment exterior pathway used for pressurization Intentionally burn
- Let hydrogen burn while + Presswe and temperature . Alternate power source for hydrogen containment failwe is not a spike hydrogen igniters risk: to prevent future containment challenge.
Vent Containment + To avoid containment failure . Radiological releases ! due to:
- Potential future conarns
, Overpressurization with containment failing 1
Hydrogen Burn from sub atmospheric loads
. No guarantee that vent pathway will be able to
,' reclose. i a 4 1 33
6.0 CONCLUSION
nis document has examined the overall framework for the development of the AP600 severe accident management guidance. The decision-making process, the roles of plant staff, and the high level contents of the guidelines have been examined. In addition, the goals of severe accident management have been defined, and necessary high level actions to achieve the goals have been summarized. ) The conclusion of this assessment is that the AP600 high level actions for severe accident management are similar to those developed for the WOG SAMG. However, the differences between the AP600 plant and conventional plants result in some differences in accident management applications, as summarized below.
- 1) Because AP600 does not have internal containment sprays, there is no potential for rapidly de-Inerting the containment. This minimizes the negative impacts to be considered when injecting into the containment and depressurizing the containment. I 1
l
- 2) The AP600 plant has been designed to facilitate the flooding of the contamment cavity. This l
creates several benefits. a) Flooding the containment to cover the RPV lower head increases the probability that the core debris can be retained in vessel and that ex-vessel phenomena can be avoided. ) b) The flooding level is able to cover the RCS loops, which can prevent creep rupture failure of the RCS piping. c) Flooding can be accomplished without endangering vital instruments and equipment.
- 3) The AP600 containment passive cooling lowers the need for operator action to contro; the containment pressure and temperature. l l
- 4) Due to the high natural circulation flow rates in the AP600 RCS, the actions to inject to the steam generators and depressurize the RCS should have high priority to prevent induced steam generator ,
tube ruptures. l
- 5) Because of the passive nature of the RCS injection systems, depressurizing the RCS should have a high priority to facilitate water injection.
34
7.0 REFERENCES
- 1) DE-AC03-90SF18495, AP600 Standarc' Safety Analysis Report. Section 18.9.8.1," Development of the Emergency Operating Procedures"
- 2) SECY-93-308, " Status of Implementation Plan for Closure of Severe Accident Issues, Status of the Individual Plant Examinations and Stat:s of Severe Accident Research," November 15,1993.
- 3) NP-6780-L, Advanced Licht Water Reactor Utility Reouirements Document. Volume ID (ALWR Passive Plant), Chapter 1, "Overall Requirements," paragraph 2.3.3.9
- 4) NRC Project No. 669, " Issuance of Final Safety Evaluation Report (FSER) on the Electric Power Research Institute (EPRI) Requirements Document for Passive Plant Designs," from R. W.
Borchardt, Office of Nuclear Reactor Regulation, August 31,1993.
- 5) EPRI TR-101869, Severe Accident Management Guidance Technical Basis Report. Volume 2. ,
Appendix K, " Debris Transport to the Lower Plenum." l 1
- 6) EPRI TR-101869, Severe Accider.t Management Guidance Technical Basis Report. Volume 2.
l Appendix BB, " Potential for Criticality of the Core Material Under Recovery From Severe I Accident Conditions."
- 7) WCAP-13388 (Proprietary) and WCAP-13389 (Non-Proprietary), AP600 Phenomenological Evaluation Summaries.
- 8) EPRI TR-101869, Severe Accident Management Guidance Technical Basis Report. Volume 2.
Appendix L, " External Cooling of the RPV with Debris in the Lower Plenum."
- 9) EPRI TR-101869, Severe Accident Management Guidance Technical Basis Report. Volume 2.
Appendix G, " Steam Explosions."
- 10) EPRI TR-101869, Severe Accident Management Guidance Technical Basis Report, Vohtme 2.
Appendix U, " Water Overlying Core Debris." 35
I l Westinghouse Energy Systems Box 355 Electric C0rporatl0n Pmsewgn Pemsylvansa 15230 0355 ( DCP/NRCl413 NSD NRC-98-5757 Docket No.: 52-003 l August 14,1998 l Document Control Desk U. S. Nuclear Regulatory Commission Washington, DC 20555 ATTENTION: T. R. Quay SlJBJECT: RESPONSE TO NRC LETTERS CONCERNING REQUEST FOR WITHHOLDING INFORMATION
Reference:
- 1. Letter, Sebrosky to McIntyre, " Request for withholding information from public disclosure for Westinghouse AP600 design letter of October 20,1993," dated June 18,1998.
- 2. Letter, Sebrosky to McIntyre, " Request for withholding information from public disclosure for Westinghouse AP600 design letter of January 17,1994," dated June 18,1998.
(
- 3. Letter, Sebrosky to McIntyre, " Request for withholding information from public disclosure for Westinghouse AP600 letters of September 20,1993, January 21, 1994, and February 3,1994," dated July 10,1998.
- 4. Letter, Sebrosky to McIntyre, " Request for withholding proprietary information for Westinghouse letters dated April 18,1995," dated July 15,1998.
- 5. Letter, Huffman to McIntyre, " Request for withholding information from public disclosure of Westinghouse report on AP600 function based task analysis," dated July 17,1998.
Dear Mr. Quay:
Reference 1 provided the NRC assessment of the Westinghouse claim that proprietary information was provided in a letter dated October 20,1993, that contained the response to a staff request for l additional information regarding the AP600 probabilistic risk assessment. The NRC assessment was -{ that the material was similar to material that exists in the current (1998) nonproprietary version of the l AP600 probabilistic risk assessment (PRA) report. In addition, the staff indicated the material was l used by the staffin the development of the AP600 draft safety evaluation report and therefore should ;
~
remain on the docket. At the time this request for additional information response was provided to the _ l 37% wpf I 8Pncronn M l
'OI -
ftC opttr t' 1 LO/10*d 2002SIPt0C18 01 2LLP PLC 2tp STiln30BNON-380 ad LO:G1 8G.PI Ofl0
s % DCP/NRC1413 NSD NRC-98 5757 August 14,1998 ( NRC technical staff, the information was considered to be proprietary by Westinghouse since it contained information that had commercial value to Westinghouse. If this request for additional information response was indeed used by the staff in development of the AP600 draft final safety evaluation report in November 30,1994, then at this time, almost five years later, this informatior is no longer considered to be proprietary by Westinghouse. Reference 2 provided the NRC assessment of the Westinghouse claim that proprietary information was provided in a letter dated January 17,1994, that contained the response to a staff request for additional information regarding the AP600 instrumentation and cc trol system. The NRC assessment was that the material was similar to material that exists in the current (1998) nonproprietary version of the AP600 standard safety analysis report. In addition, the staffindicated the material was used by the I staff in the development of the AP600 draft safety evaluation report and therefore should remain on ! 1 the docket. At the time this request for additional information response was provided to the NRC technical staff, the information was considered to be proprietary by Westinghouse since it contained
, information that had commercial value to Westinghouse. If this request for additional information response was indeed used by the staffin development of the AP600 draft final safety evaluation report I in November 30,1994, then at this time, over four years later, this information is no longer considered to be proprietary by Westinghouse. l l
Reference 3 provided the NRC assessment of the Westinghouse claim that proprietary information was provided in a letter dated September 20,1993, that contained information related to the AP600 PRA and WCAP-13795, which provided the PRA uncertainty analysis.' He NRC assessment was that the j material was similar to material that exists in the current (1998) nonproprietary version of the AP600 ( probabilistic risk assessment (PRA) report, in addition, the staffindicated the material was used by the staff in the development of the AP600 draft safety evaluation report and therefore should remain on the docket. At the time this information was provided to the NRC technical staff, it was considered to be proprietary by Westinghouse since it contained information that had commercial value to Westinghouse. If the information transmitted by the Westinghouse September 20,1993, letter was indeed used by the staff in development of the AP600 draft final safety evaluation report in November 30,1994, then at this time, almost five years later, this information is no longer considered to be proprietary by Westinghouse. Reference 3 also provided the NRC assessment of the Westinghouse claim that proprietary information was provided in a letter dated January 21,1994, that contained WCAP-13913, " Framework for AP600 Severe Accident Management Guidance" (SAMG). The NRC assessment was that th: material was similar to material that exists in current (1998) nonproprietary AP600 documents (e.g., WCAP 13914,
" Framework for AP600 Severe Accident Management Guidance"). In addition, the staff indicated the material was used by the staff in the development of the AP600 draft safety evaluation report and therefore should remain on the docket. At the time this Framework for SAMO was provided to the NRC technical staff, the information was considered to be proprietary by Westinghouse since it contained information that had commercial value to Westinghouse. At this time, over four years later, this information is no longer considered to be proprietary by Westinghouse.
me .,e 40/20*d 2002 GIP 10C18 01 2LLP PLC 2IP 3771030dNOW-380 ad LO:51 BG.Pl 900
J l DCP/NRC14i3 NSD NRC-98 5757 August 14,1998 (' - Reference 3 also provided the NRC assessment of the Westinghouse claim that proprietary information was provided in a letter dated February 3,1994, that contained additional copies of WCAP-13913,
" Framework for AP600 Severe Accident Management Guidance"(SAMG). The NRC assessment was that the material was similar to material that exists in current (1998) nonproprictary AP600 documents (e.g., WCAP-13914, "Framcwork for AP600 Severe Accident Management Guidance"). In addition, the staffindicated the material was used by the staffin the development of the AP600 draft safety evaluation report and therefore should remain on the docket. At the time this Framework for SAMG was provided to the NRC technical staff, the information was considered to be proprietary by j
Westinghouse since it contained information that had commercial value to Westinghouse. At this j time, over four years later, this information is no longer considered to be proprietary by Westinghouse. l Reference 4 provided the NRC assessment of the Westinghouse claim that proprietary information was ; provided in a letter dated April 18,1995, that contained information for a MAAP4/RELAP comparison l for the AP600 in response to a staff request for additional information. The NRC assessment was that the Westinghouse cover letter indicated that Enclosure 2 is a non proprietary version of Enclosure 3, however, the staff could not find any portion of the enclosures marked as proprietary. The staff assessment further states the conventional bracketed-superscript notation also appears to be missing. Finally, the NRC assessment states the stafY could not determine which part of the material enclosed with the Westinghouse letter was Enclosure 1,2, or 3. It should be noted that the Westinghouse April I 18,1995, cover letter states " Enclosures 2 (nonproprietary) and 3 (proprietary) provide the requested ! information." The letter does not indicate that enclosure 2 was a duplicate of enclosure 3 minus the proprietary information.. A cover sheet was provided just prior to pach of the enclosures to the Westinghouse letter. De enclosures contained the following: Enclosure 1 provided a copy of the (- NRC's two page request for information for the MAAP RELAP comparison. Enclosure 2 provided the requested information, and was titled " Requested Information for AP600 MAAP4/RELAP Comparison." Under section 4, Initial Conditions, of Es. closure 2 it states the initial conditions information (which was proprietary) is provided in Enclosure 3 of the subject Westinghouse letter. Finally, Enclosure 3 contained the list ofinitial conditions. He information provided in Enclosure 3 was labeled as Westinghouse Proprietary Class 2 at the top of the page, however, the specific proprietary information was not indicated by the bracketed-superscripted notation. In addition to the initial conditions, a mark up of AP600 PRA Figure K-1 was provided in Enclosure 3. Again, the information was labeled as Westinghouse Proprietary Class 2 at the top of the page, however, the specific proprietary information was not indicated by the bracketed superscripted notation. At the time the information provided in Enclosure 3 of the subject Westinghouse letter was provided to the NRC technical staff, the information was considered to be proprietary by Westinghouse since it contained information that had commercial value to Westinghouse. At this time, over three years later, this information is no longer considered to be proprietary by Westinghouse. Reference 5 provided the NRC assessment of the Westinghouse claim that proprietary information was provided in a letter dated February 8,1994, provided a copy of WCAP-13957, "AP600 Reactor Coolant System Mass Inventory: Function Based Risk Analysis." He NRC assessment was that the material was not "information that the staff customarily accepts as proprietary." In addition, the staff indicated the material was used by the staffin the development of the AP600 final safety evaluation report and therefore should remain on the docket. At the time this report was prepared, the stm.,r l 40/CO*d 2002GtPIOClO 01 244P PLC 21P 37110308NOW-380 ad 80:St 86,PI Dnd
/
DCP/NRCl4r3 NSD-NRC 98 5757 4. August 14,1998 (. information was considered to be proprietary by Westinghouse since it contained infonnation that had commercial value to Westinghouse, and was of the type ofinformation that was customarily held in confidence by Westinghouse. That the material was not information that the staff customarily accep 1 as proprietary is not relevant to making the proprietary determination. However, in an effort to expedite the issuance of the AP600 Final Safety Evaluation Report and Final Design Approval, l Westinghouse agrees to no longer consider this information to be proprietary. l in a telephone call on July 8,1998, the staffinformed Westinghouse of a concern related to WCAP- i 13288 and WCAP-13289, which were associated with the AP600 check valve testing specification.
)
The concern was that the proprietary report had no proprietary information identified and the nonproprietary report had been placed in the public document room. Westinghouse has reviewed these reports and, at this time, considers none of th- information to be proprietary. This response addresses the proprietary issues delineated in the references. tb k Y S ' Brian A. McIntyre, Mana Advanced Plant Safety and Licensing jml 1 cc: J. W. Roe - NRC/NRR/DRPM ' (--- J. M. Sebrosky - NRC/NRR/DRPM W. C. Huffman NRC/NRR/DRPM H. A. Sepp - Westinghouse i Shemmpf 40/PO*d 2002 SIP 10CIO 01 2LLP PLC 2IP 3171030dNOW-380 83 60:G1 86.P! 9n0 _}}