ML20198Q990

Rev 4 to Framework for AP600 Severe Accident Mgt Guidance

ML20198Q990
Person / Time
Site:	05200003
Issue date:	01/15/1998
From:	WESTINGHOUSE ELECTRIC COMPANY, DIV OF CBS CORP.
To:
Shared Package
ML20198Q931	List: ML20198Q990 NSD-NRC-98-5524, Provides W Responses to FSER Open Items on AP600.Summary of Encl Responses,Fser Open Item Number,Associated Oits Number & Status to Be Designated in W Status Column of Oits, Included in Table 1.Rev 4 to WCAP-13914 Encl
References
WCAP-13914, WCAP-13914-R04, WCAP-13914-R4, NUDOCS 9801230193
Download: ML20198Q990 (63)

Text

g . e

.I ' ' "' ,' N :1,

}l , * . ,. - s,,

g' \s , * . A' , )/.

'.%',, [(.ll;'

a= : ![

l '

.P&h3h+'

~'![$ , ' . ,{ i ,*

, <- a* '", 7. - 4. - Fa 4 h;' . .'  ; w-;, ). . : ni.*.x:

r

, E

• l6 . ;,- (q'". I .-

• Jyv.,. e!

l ..s 4,3 " . ' . * - A. . , ? , 2 4' s .s, s., n. . -

..:./ - *,' .. .' 3; . v% ,., -@;.g  ?

y

• c;%

!^$  ; 'N ' . ' ' * ?r:]l m - '_ . ' . N ';, ?., . l

,

• e,

.;k ~  ; -l fn.' .'s'* G! * , [.e. %

r

--l .... . .. . . . . . . , --.* . = ,; o ? .-n. .. ,. . ,> . ,.; , , . . J. ).. <.y ' .,<. g g *

,*..g-

, . , . .;l. f. _,*, n =. .'. t.-)4;..' n.

3 , , , 4 1

i

'9. . . ', g ,. %, , . ,.

,.,9l4{., . ,j, *. ; ,'. ' '

• 7' h i* .p 4 e

.t .g ' 4,j ,, .. . 's 2 e;- [ , * ,[ y '., '. - A . p j,

.c..  !

.' g

... r .e,d, , *

- b,g . ' , V -

4, g *? k , ' ,4 i

• f 4,

• 9 .; p, rp * .,

Y.j$ P'hj s [l['. [,*

• d. j Y.. b . i ; E i - ' . . . '

. S.'

h .;, '.', ' ' ..w,[, . . ' c ..f, '< ".I,y '

.f, .

,' t .. . s,

t. . .

s ... . .g , .. . . . .,

r.

..t .. .s. .,

.g .n.. .. ,y,. . - - ;. , . , <. ,,.

3 o...

,s ,t.

.4 e ey. ' s , .* - . . '

. .. y.; -

f. , _

s,. V. . . ; :' , -

s

'.~.) -: ,_,>;. .

i rf,,

1 , s

.".*, ' ' ., '. -,.: . : . .- ; ;'. ,. .1 '..'

• . y _ l l' , _'k <. . b ' . .,;. f* % . ' '

I, .

eh.....',.'....

s ys e *<;d;4 . . -

e. n*., Cr.. s

.. . . . 3. . f;*

y ;* .. . . M. .e, > ., ,; ..,. s ... ,,. _.,. ~. * ) p G* . . . *

.e. .

..,e

,, . 1 >< ..r .

.. - . 1

' ',. 9 e i;.. ., y , . ' . . < . .2 3 . <:.. K v.

. .P. .,y ' . < '. . . , * ' . .

• 4:. *;t ,

. ,*h .

..e. .,,.

i y*

i .

. .. ,3 b, . h ..w A +* . ,) * - * .'* , ..v.....'.. /

• j *' . *. , l.

'[...... . ()

6-

f. ': . , .&, ' . :,;~ . . .y _

s .. ,

<c%,1 s ,.:, < , ; . , - 3%rr . v: ; . . . . .'A p . . .. . '...,'.as .

... . . u , ' :,, n , _ . . . .

,1./i

, '.@ l

• 9,**. . . * .  ;* .. (; ., , s

'l .:.g .

4 ,

- . . ,f

.t-3 _

. ,,' a f 'i. ,./

i . . ,j,,3 ,: ..p- , 'm ., ,.c...3,.

..~.$,, ~

l

'O,..

a . ', .. . .. ., ': , , S +

' ^*.

6...; -? . }y . ', f,i.,f..."..

. . . ., .. i _ . ,, a.* .,..c, .,b* 1l3 ,

e.. ,,

f., f .,a>

. **j , ,L. . , 4'*<,**a .m ' . , ,e . .i. '

• ep * .. * *'-  % -} \

m e. .Jf')-,.y?-

. . . e

! ,' ) O *g)- l D.** *4' w , ' g.,,

,. . . .**s * - -

• i.,..*., 48 -  :

b 9+ 4 . 4 ' ,. ' :. . F *'-J..,:.*s,.'> 's ,.

.4 '.*.,k 46 y'* s

..'f*?,

,1 -

< e eo-c s,t y% . voit.fr.t el- . . g *+ . , ' . , - ' ', *.. 'i' i

p ,,s ". ,e  ; . . ' , u -

s > .' 4-'

k .h . .; i k ., ,~. ,. . i #.,+

,! . -. *lt . ',7 [. 1 .' i 7 '. .... . . . ' g - , . ' . . * -

D ' ', .. .

....g'.%.

a, . .- s..- .

. 4

?l*. A. w 'e

.'o i . ; . . . , \ _e .n ' <

OG ~ . .A. ,', o'. * * ,

'I , , .

' ,,' . _,-l ...

• [

.] ; ' . : ' 9 ' ,, 1 * . * .s

. ;/ .l . . ' - , {\ '. .s .',,..,_' .  : , j., *

9 y .L,i.s

.s*. ,7 .- ..e

,,o s> , . . . . - ,,5 .i.- . . , , . , , , - ,. , .' . * . . . , n , i,'....

,, g - ., - .- a.  ;- .

. //N , a r

' tw @. t

4. - [ .J . 9' , ., 4 ]2. s . . ' .,;..,- ',. I ,", . 5'...,.t,,**.

. w +; e,!.,.,'".','.a ,, e, a ..p.,,.'.t,.. . .

'..y.

- -;- ~ J. W s .

,',--- 1

. .. . .* . . /*,

-l... '.: s. . , .A, g .l .y . . . l ,e,. '..N l*..,.'

t

i. . ]) z *,+.; C,5,'.j , ,a* c g. , .. ,- - -. ,,

j - -'

' . ' , ,k g*, ;. . ,,

. ~a h : ' . * ,,

-l..,, . (, . '; , 4s . ,

- a 4

- t, .,, ,

s n- . . . ,s ' , -

M;.' < 'q M' , s/( .. g ' ,*

7?, *a ,+42.7 J 9,f ', ' <. ,., -

, ,; 4* - 1 ..4,"

. .,; .,~.

y  ?. .

,'l, ' . , ;* . . p*.. \ r m - .

) , 'k. - - '. <o.,

,a - ,.+ .rh , i. e

.,Q*'

_,* e;*, ..,',.s'.. .,,. ?' * ,. . . - p

- '...:',.v. . . .. .-; ' ; '-- . ;: %.[ ' .,,,- =. ,

.: n ', ' s. '

, * ( r, * -, . :  %. .

• +: f. - L ..* .q-" _

.: s... f>- - . , . . , - .

4, .

'..,, , .. g

\';.,.f'

. .; .r s. . = , s_.*.?..;. - s - . ..

e .; , . .

';Q. :i,=.*-  :. . ;3 f.i. . s q, s,

. _ ,)<-. sj ,' s

? _ ,,.; .gy j.i . * '.. .[t**; _ ,\_., :,7.-. $.;J.y1.y__ , .' . ;

= - . ,_

oyg c. ,y  ? g'q: f',; , s.'.-<.%,, ..

[ , j *. , ( p.'h, ,- . , , e. y..' -

s

~'

.. ; ,4 . , ,, . . . . -- , .e . g ,g.,.

1 *

. s.

, ,. ,.j.,3 , ,., .

.N gM y *4. .f' ,

,: ....,.'..t*

y s >38 . - ._ . ,* . pT .>f._s .. . . .

,.g*,, ,a . , - * - , Y. - I

.d,.', ... , g' .f. , . . -l .f4, * : . f -, *.,y,,.'.

g, .. .

, ; . e. .. .

k. ,3j 4 f. Td, '. , ' '.

'- * ' # j. -- ,'". g

.*../,*l.'.~ 1, '.;

.s

' e 3'

.r

,t ,..

s. ,

.,,.'n, ,. e

- '7 4,' 't 4 . t g.

4 e

.e ', , _ .

. .- . . ' , ,* i'

,f(- 'g. .,3 y *; . . 1* s , e

- . e.*

i

• g. .. .

y. . ,

y

-,,'r,.. '.,*.., .* .*-^,

g v, . , ' . i -.a. 4- ..

..,.:'.' . . . --. '."'i i

• * : lL,o -. c. , i.., ,',".

. ,l .

p

. o L .I , < .,. - [',*.. .

' g, . ' * *-

c * ' y, .%

.d' ';. ;;*..' ,. '. '. y , '

• 4. -

.. 3 ..t ,. .

, ',. v } t , ?'  :. ;e*

61 s' ., ,* ' . , _ . * ' '

' , ' . . wln, -g tr' i, - , ' , .

s

. ,A. .

,, , I; _ s +. g-

,,**- .#' ..**,' - g' ".' I. g '

• -/,, '(( A,.. 'e ' *

., g. ,

6 j... 'i. - .s . '

• !,i , ', .* g..;. ..:, , * ' ;, . , . . '

, , J ,, , kp ,,,.. .... ', . , ,

.. ,6 e p.>>+.4",,. 'e ,1 c .

.- . * , .' .y s-G(4(.*',,,.

. .j . . 1 . , . .

ci T / g.;.g' ,'f . 4 . . . '. '.;*.an.'.;, -, , .. ( j %,- *C 3,

.g , ,.,. ;,' Q.;*', e. i

,. 3

_ . ~ , - - , . , , .

..y -

.e,f

&sp . .

.- . ;a s

,l  !, .' , ' . _4

.%'.,s ' , Q *

^

.s.,,{.

• 3; ,

s .y e .. v

. . q a .-

a. . s, p, , ,. 6.,.... , , . . . .w.. . . . . .

. ; i- .,.3 , , , , . . , .

. . u3 . . , , . . - . ., ;_ .s , -

, .:. ,- . ,y 3 .

..,.?i..._,,.. . , . ,

'. .. s .

> , Y . .; , ,. / . , %.. '.','d;3 ' q9} .'. g' -* ..;, N - ;. ,. I [ 3. . , [ h, . ' ' #,

('fp. ' [ ; I } [e' s +

, .......y[.d. , s -k ,. - ., T l*",.,,', ,

... ,.. . .\ :b ' . ' . . " , . . . + *s

_: ,, (

. '., . . a , %. 1,.{

• j $ ,'. ,4 ,#.*s s

. ' . .-i,..%..

. * , ..e 3 a. ** '?. ,::i.J.. * ',:. ...,

< !l t

.t. .4 1- . .,..e-< p....

1

+ ,. ** - .

. ' 1 . '.  :. .f ,; , ,

./ . n ., ,. . ..,,,' ' , ., , f . . ' .

.'c' .

4 U*".'..,

s'. i , -*. %,.,0,L h . . . t. .' ... ,, f r. ' 't. , .' o.,3 / . ' ' # %..,,

.';

• p:. J.'

'i

, 4. +. . i '., r g y<,- a ..Sc'

, 5

.;a %

,., p, e. ;; ; ,'h. . - )

"S+ *',,i,c'4+ ,..

y , .. ,fy 154 7 , * ,.. i ... . c .r,,,e

. , , . " , , , , j p

_. , , i.. . .. '.. + .

, . ., .?'.., 4 I * .' ' '#

.* . . t

', h ,.:. . - .. #.

wi 5 p. t

• ; +'

', 3 ,. :

s.* f 1, ' jg' '. /. . e 3?, ,4 ..."1.,,,,...;..

/

- - ,- .n .1',',

i *- .

',;.+

h *,,V i . .J '% , V* $ . / e ,, , .'g , . 5 j, ,'y . ,

,' U

..-l; . .

. * . ' * ,e i

..' '. {.

f..q,1.., e.i,....,~a,...

. 8 .n' .., . i . *.;

. n , . 3 =..',',"';*l'e,'- . . . -  ;,;; ;, *; ,.f.. t

,.,6

, . . , y ;{ , .1,< , ,. . ) . t

, , y ,s+.,,j,

,*y-j, a

s ..,,L . , . - .- . .pg s .,*.,

' -,a .g ,

f, .

. ;- ,.s 4 s.e.-* ,... .

.q ,

. . , .. ~ ',\4 \,, {.f..s

,e . ..

o ' 2. .u * . > r

. s- .7 .- .

3 s t. . ,

i.h j ' j{ . .(. ,l . . ',~ ,{ / .,$ ,

,[. ',. . s.,. - ;..,

. ,. . . . ~*[ [ . .".. ,

g ,' .,., Y- 4 , ' . " . S Yk,J ;' ,*

y, .*7 .,. , t :,. . J*, : . , . _ h . [f,. s. _.. ..h.  ; , - *,_' ' .Q; .p[;[;

. .. j?. .. , h :.5.7, .e.-

,,I. c . y ,.; eyN . .

w+ * .

.. s;; .* e . _ . - o. .< ;,. q

• .: , :. g' .A . * %. . , 5 .

s .,,

t 8-  % v-

.[e,. ,'f ")' a

(.

ms..

, *'.  :#' 'F

. - - <- . '. \.

e,, ,a 4,.. *

,n

; ' ks- ..'%.,...

• y . . ,y: , .;: ,.; ,%,9.#

. . . ..; aI

, .a.-.e..

p. ,*..,c;s r3,. ,.

.L..i.e,....,.

,' . ,... ..i*

a > .:

. ~,...'.s.,'.:..,.m,..s

-.s. .*L -t ..;.,.a*

. . :f.,. :; .

• ' i ..s '.'?O...,n.. ' ; * *e,:.*y, , ..x... . .., ' r...r, .. ' 4 . .O <3.~.

,s;

',s, p . ,. . , -.. .. , . .' *..

. ., s es* ....y- :, .

g .ym  :- .: .. Y.a..., a  :. . . s L*- .s . \ -

< .. ':t < i.n ,e , e t., '

)y/

1. . n , . e

,', i C .f.f. .,a. . , . . . . M (,% ' ? f'a ., a ..

..y i,

..9,'..

g

. .,. ..j. f ' : . ... , ;. , 'e a .' .s. for , *;. i

.y' ~ . . , ' , -

e :9 -n,, ,'.t

' ':9' v3 .c y ,: c.

..e...,,' . .  ? */ , ,  %  :..).

.., , ; c,. .- ,g .a.. f.l ,. .gn).

p

. / ., p *

.,., .,....y. . c.3..ig , , g.

.s

%.. . ) c . .m. . ;, .s

. , ., . i . .. ,. - 4. 'q .. .g,.. ;,.?

,  : , t

.. . .y ,,..n..  ;,. ', ;,, ,.ac:. N. .>. - .~.,y .,

% r-

/. .

- e e

t T:... - NE, ,; )Ji..

- - [fg di YF 6 . .' -'l' ) - $ c#v 1 '7e ' - p,.M f f ,' t

., (g [, . -- ;N. .

.niq. d[*'d,gt.

.3 1 -'.} ..- :j j:L . 3,. 1, .G.,y,tM y.V, : L ',q,,$ . ? lX ,.io: s. Q.f y%4 .f::;:. f,(dyl('.g.h:jq, . s s :

.4,

..,' M [ " . :. ,

uf: J. [, . .lg, -

.';[9

. ',),}Q@;Q:f.- + y*]lRTg.Q

• 1; :.a, :Q' r.L.f ,{e iQ

.z S. ej V .,f:".Q'< . .Q.ys.W}.I,,'y ;Q$ $n . i-Q:, a . .:** i,,;y %f.f .

e.g\ r$ f

r. ft ' .

n. r s M s. a n v .

_i U ;f,h;". M ),? . :py .. y:m 5 , h?,t i <' '[I_ ..;

. ,(% ..*,. t'.'i; '

et

. zde s, ll:[. ....,;b w . . p' ,.'l;[ .l.ll k - y.. g,. ... ,.c. . 1., .,c... . l .a, {' ,.'. ,.l- e ; ,3,g. g>. i ,1. ,Q

.a...: %. 43, .,y:b ~a b .5.)* b n. ' . ]l; ' ,.,, .y ,t

. . p i . .y .i; s

.y

. , .. - (. .e, ,..-

. j , ; .t.=,.g . 3., .-. . . ; g-. .4. :. . ,

,1,g , n.Wg

.j .

y'i .f,.t. he ..).y ,.

s

, . .g

,.,.nq .,.. , pq f. y a- t., p w. ., . . :.4 8, . ,

*p...,

. -, 0,, ,y,, ,.y5

. ,q .

, ,,., 3;.. n.p 3 ,(,. ,.p q. ..

u ay?

.;6 . ,

[, ', -

{. '

y';, ;' I /

..' ' [ ;. s -; .

h' -

l lp'N .q.et.

,&s .&.y,n. a U : '.'.Qc f.. '.'a.

I.>3 ry . y 's, ; f ; .s. u*  :$' :g.) *  ? . ' T

\

.* 3l ',<. A yyi  %. ...e.  :

.'?? J. h' '.k ' %.

. .n . y .,lls n( ,.[, A,9 . s . .': .

..t, g , . . e. rp t '. e, 'p. e ,v . 9,,.d.. u. . .,,t.' , ....m q. - . -i'? + ', { d. '^ , . J.

s .

- ....g . :g1 r s .y - .p. m.<r.e ,,&..,- j v

..,.v...t,.,,. 2, .

v.,s. .m - ?

3 b.

. :., g. y t , f i . . A .

,..p. ,t.. y;

.,w .. n,e nfy.

j .

,.y.,p'.s3-.:o .s ..,,g, , ;.:} p, ; dis j ,4 . ,. y* . t ,/ , w-

. .. <,. y, , f g+9f t(;,c.  : 4, , . yf t'g,. ,1,3. , , ' y , o' . g, g .. -a

k. .g. sf,.4 ,.

s; * . 6

$. .. te, , .3. ).

....;...,,4,4 J(p,f ..g,.'.

at g.-' g,,. ..u. -

; t,

;.,, f._..n . g , .

34

,p.... '\ ;,. . ..: .9'4 #, .e . ,, ,t.;  :.

. r ; ;,. m 3

.y.i <,\.4...p u, 9 c "c u n..

. .. ; ; tr , t. ..;. ; y: p h , n. ;;y 4 .. ,

r :.

, t.7s < ,%  :,:; dy,;;;6,.,qjjn. ,  ;

\y#- y"..;/  :: . , . j' -.

... ;j[, g l 'f,- a;)2,....p*f.,c n., . s '.; ,.  :

r ,., w . - + % es ,5. +z !c. ., .

.x ,;u <

s.

\. y. .m?. . *.*

3 , '3.<, n .v;,.,'*-

'e .',' y' ', ,~.y;\, . , y 'y ,

. gy..  !

f'.. ; .n .s'..

• L..?.., * . '. ,nc.~e;*' t%.t y. [Q:.

', ,.Q:.'.

3. ' '

.y% .c

.W*:..

.- .w. . < .f- .,s,, eq.,, ' h,% " .: 8.

. . . . 'y ' y. 4^- .e&", . .

y'.  :

,n' $. .' ;.. . 3O.. y-

.q,L .g.p?a- ' L '. .. e .., . m* *1 y ,: ..il. .

a,. .g,  ; g, y .. ,q3.;f

. . a .

,q.,u g , 8 ;: .q,s;4.p y . ,. ..'

yy ;;,W,*:9<.g r.,. -..'c, . j. 3'. .# "4 . . . .' . . . .

, , , r. ,

f f'. ;f,y

. .i 3,

, ;.c, $ .#t ..,g'.g , ;,,. ; :

r;; cs </ . g.,.2 , 1s y.,,

3 ,

. ;, . y*9, . y.g 3 ,e . .

+

a....js. u.

4.g . ;3 '.p . y,

. i.; w.-i ; . . .;' ., , . , ...

. . s ;3p . . , ,q ,. . , .ai :,.'y:..;a . ,.,pnf.Q

' W:f. y, :# q , . gf.f.4

c. )% 's . ; *;

.t,..-  ;). Q. > s

]- . ; . ..a . ~. m.., ,.,..t.,'*g .'.y's. - . .~,lpf:, ,. .;.5 . ' ' ....;mi.A . .._'.m , .:. . ~.w., p; g*1,;mj.. 'y .'.,; .'.l;;: '. , ,

m .s ~ . . u .. .

. . , , ' , .' '. s f ' ., 'j.,

1. * ,.t' .. '.' *. w:* th ' . i'.- s, ,. . y ,+[,.

..- '.u. . . ..r.. ., .o' j. 'u x.( ' >. ..

(.a g,g. . . i - , . . ,

2.*'.. % .3( < -

• / [ - , ... .. , . 7

. v.o["nf k

}* ' .

k_,t

. m m' [* j 9e . . .,.,B,f y f.m..m*

I a w .' w,[g' . .y. x.'g'. . . ." ',' uf . . v . : :. ,  :.  :, a 's. .= ? ,

,4 [ . . .  : t: $# .

D

w re.;y.y. yc.,...%. . ..c.w.,&,

.$,g .,; m.x, s .. . w, 3.

g.% vm;w: Y o :. p j.n.m.y. .sw.gw. Qji;}W,. .:m.y [:w,.y ::.3.m.. ... ;.

.L ,.... a.u,c.r a; a

, . , . t . o. 3. . t .

L.'

.s L:gm y . n- .1 R. c.. x,. . ... . p 0;.. m. g%: p n.,u p .5. . , .g: A A a;p.g .-. :2n. ., x L-

.m p . q* .

e. ,7$; ., ,

.: 4 ,.s Q.s 3. p e w y n . mnw .  : t.. n;~ p,; +m e s

. .p .,.)y. 9 ..: ;. g . . g . , ;.Q ,.

,~ ., f.g.1; q~;y~,}%w b;9;y . ,g s. ag 9'.y+ W R v *,+i.!g..;;.,  % ,y c.t.. m..g .3 . , g , , y  :.. . _  ;,y r.

r

. y. f:

Q y s'4.. , p ;, ; -

r 3. . , e p49,y..g, sJ.:o 7 , yx y. .yl3 k

.,ay yg

- f?,.y> o.

s ,, , g

• a%m .., y ; r.3 ;:n.a  :- .: m .'

h, .. y ,,f. , , .' . . ; .',.- ~ .,wv .w% a. ... .u .

, .%. n g ', f [e.v D ' '

.[ I,'., {

e f, '[,' ' . ; ,afO4 il' ' Y, } .,, 'e86k

- 3 .:p $[',Ig.... - Q i; k.a.f.Y*j;N,.'ns., - 3/ g '.' _v , -J'

,'*f*. {* I,. t. <.. p t > -

p[. .? Q ;.j. . , 3. c., 1. f,e...a&. j: :o . g.t ,.LQ Q

.U h 9[y[ .,Nff{', i[.f,. .

. .h f. [;. ' f 2/f I,' :( k'd. ... .. . .

Y,[,h [j % (. fifh;hkhh.hhIh.h 4 . 4 3.,lr.

C. .

.,kk[.. ).gw.q,,,$/',

&,G;&. . ..:

&e, . f

Westinghouse Non Proprietary Class 3 Framework for AP600 Severe Accident i Managem.ent Guidance

.W e s t i n g h o u s e Energy Systems pnun nny

, AP600 DOCUMENT COVER SHEET AP600 CENTRAL FILE USE ONLY; TDC: IDS: I $

Form 68202G494)

Rf$8: RF5 ITEM #;

l M DOCUMENTNO. REWSION NO. ALSIGNED TO GWGLO27 3 Page 1 of 2 ALTERNATE DOCUMENT NUMBER: WCAP 13914 WORK BREAKDOWN #. 3.2.4 DESIGN AGENT ORGANIZATION. Westinghouse TITLE: Fremework for AP600 Severe Accident Management Guidance ATTACHMENTS: DCP 8/REV. INCORPORATED IN THIS DOCUMENT REVISION:

Nona CALCULATIONIANALYSIS REFERENCE; N/A ELECTRONIC FILENAME ELECTRONIC FILE FORMAT ELECTRONIC FILE DESCRIPTION (C) WESTINGHOUSE ELECTRIC COMPANY 1998 WESTINGHOUSE PROPRIETARY CLASS 2

~ This document contans informehon propnetary to Westinghouse Eleutne Corporsuon; R ts submmed in confidence and is to be used so6ely for the purpose for which R m fummhed and retumed upon request Thrt document and such information a not to be reproduced, transmitted, decioned or used otherwme in whole or m part without pnar wntten authontation of Westinghouse Electne Corporation. Energy Systems Busness Unn, subted to the legends Contarned hereof.

WESTINGHOUSE PROPRIETARY CLASS 2C The document to the property of and contaire Propnetary information owned by Westinghouse Electne Corporation and/or its shiwe and suppbera. R is transmnted to you in confidence and trust and you agree to treet that documord in stnd accordance with the terms and condetsons of the agreemord under which R was provided to you.

X WESTINGHOUSE CLASS 3 (NON PROPRIETARY)

COMPLETE 1 IF WORK PERFORMED UNDER DESIGN CERTIFICATION QB COMPLETE 2 IF WORK PERFORMED UNDER FOAKE.

1 DOE DESIGN CERTIFICATION PROGRAM GOVERNMENT LIMITED RIGHTS STATEMENTISee page 21 Copyrg*t statement A bcense es resened to tne U S. Govemmert under contract DE AC03-90SF16495.

X DOE CONTRACT DELIVERABLES (DELIVERED DATA)

Subsect to specified exceptions, draciosure of this data to restncted urtd September 30, t 995 or Desgn certAcetion under DOE contract DE-ACO3-90$F18495, whichswr is later.

C D E F EPRI CONFIDENTIAL: NOTICE; 1X 2 3 4 5 CATEGORY: A B 2 ARC FOAKE PROGRAM . ARC LIMITED RIGHTS STATEMENTISee page 21

~ Copynght statemert A beense le reserved to the U.S. under contred DE-FCO2-NE34267 and subcontract ARC-94SC@i.

ARC CONTRACT DELIVERABLES (cob C DATA)

Subt ea to specifwd exceptens, doctosure of s, under ARC Subcontract ARC-93-3-SC QRtGtNAT OR SIG .

R J. Lutz [ kh APPROVAL DATE A"900 RE Si+0NSIBLE MANAGER SIGNAT QRE' 6 S.K Foder m,e - f.s -

[ - e..~e.,_se,e gf 3 gg January 15,1998 me - .c,.e. - ando-me,..

ro6seeed tte use.

vaa.covennoe

AP600 DOCUMENT COVER SHEET l AP900 CENTRAL FILE USE ONLY; TDC: IDS: I $  ;

Form 983020(6/94) _

RF3e; RF8 ITEM #:

i i

APGOD DOCUENT NO. REVl560N NO. AS56GNED TO

@WGLO27 3 Page 1 of 2 ALTERNATE DOCUMENT NUMBER: WCAP 13914 WORK BREAKDOWN t. 3.2.4 i r

DESIGN AGENT ORGANtZATION: Westinghouse TITLE. Framework for AP600 Severe Accident Management Guidance ATTACHMENTS: DCP #/REV. INCORPORATED IN THIS DOCUMENT REVISION:

None CALCULATION / ANALYSIS REFERENCE; N/A ELECTRONIC FILENAME ELECTRONIC FILE FORMAT ELECTRONIC FILE DESCRIPTION ,

1 (C) WESTINGHOUSE ELECTRIC COMPANY 1998 WESTINGHOUSE PROPRIETARY CLASS 2 >

This document contems mformet.n propnetary to Westmphouse Electnc Corporenon; a is submmed in conndence and as to 1. used solely tw the purpose for wh.h n is fum.hed and retumed upon requeet. This documord and such informehon is not to be reproduced, trenommed, W or used othenmee in whole or m port wahout pner wrmen sumonrsten of Washnghouse Eleotne Corporshon. Energy Systems ik'uness Unt, autged to the legends conleined hereof.

WESTINGHOUSE PROPRIETARY CLMS 2C '

Thss document le the property of and contems Propnetary informehon owned ty Westmghouse Eleotne Corporaton and/or its subcostractors and

• supphers R is tronommed to you in conndence and trust, and you agree to treet th. documerd in etnet socordance with the terms and condmons of the ogreement unoer whsch it was provided to you.

X WESTINGHOUSE CLASS 3 (NON PROPRIETARY)

COhPLETE 1 IF WORK PERFORMED UNDER DESIGN CERTIFICATION QB COMPLETE 2 IF WORK PERFORMED UNDER FOAKE.

1 DOE DESIGN CERTIFICATION PROGRAM GOVERNMENT LIMITED RIGHTS STATEMENTisa peo 21 .

! CopyngNt statement A heenee is reserved to the U S. Govemment under controot DE AC03 00SF1ades.

X DOE CONTRACT DELIVERABLES (DELIVERED DATA) subesce to specifed esceptons, m e of th. date is reetnoted unts sentembw 30,1ses or Desson Catecemon undw DOE conwoot DE ACO3-

!. sosFtsees, whenever is immer.

1X 2 3 4 6 CATEGORY: A B C D E F l EPRICONFIDENTIAL NOTICE:

l l:

2_ ARC FOAKE PROGRAM . ARC LIMITED RIGHTS STATEMENTism page 21 g Copynged statement A Imenee is reserved to the U.S. C - . . - / under cortreet DE-FCO2-NE34267 and subcontreet ARC-93-3-SC-001,

-~

ARC CONTRACT DELNERABLES (CO C DATA) sumissie spear.d emmemons - e of #3 undw ARC Subconsect ARC 934 8

ORIGihATOR 51G U

- R J. Lutz /

MONSIBLE NENAGER APPROVAL DATE SIGNATi(RE  ; 6 l

S, K. Fowler ^

mmapon.ede - ,.es

(

_ ,-- are - e.oron. .e . m end - .

j $44 January 15,1996

- e eso ,

s r .y- . . , ~ _ . . _ _ _ . - . _ _ - - -______ ._ _ _ ________ ___-__ _.___ _ _ -

m__

AP600 DOCUMENT COVER SHEET Page 2 Form t,82020(wa) UMITED RIGHTS STATEMENTS DOE GOVERNMENT UMITED RIGHTS STATEMENT Ttwse data are sutmtted wah k,nned n;rts under gwemment contract No. DE AC03-905Ft 6495. These data may be reproduced (A) and used by tte govemmert wth the express hmaston that they wil hat, wthout wntten permeson of the contractor, be used for purpcees of manuf adurer nor declosed ousade the pwomment; except that the govemment may dectose these date outsase the govemmert for the fonowing purposes, if any, provided that the gwernment makes such deciosure subled to prohibition egenet further use and deciosure.

(l) Ttus *Proprotary Data

• may be esc 60 sed for evoluston purposes under the restnctons abwe.

(IQ The *Propnetary Data" may te decioned to the Electne Power Research inattute (EPRI), electne utslay representatras and their dirad consunarts, excluding dired conr.orcial competnors, and the DOE Natonal Laboratores under the prohtbetons and restnctons above.

This notce shall be marked on any repraducten of these data,in whole or in part.

(D)

AF;C UMITED RIGHTS STATEMENT:

This propretary dets, fummhed under Subcontract Number ARC g3-3-SC 001 wth ARC may be dupicated and used by the govemment and A subpect to the limnabons of Artcle H 17 F. of that subcontract, wth the express hmRatons that the propnetary data may not be dedosed outside the gwemmert or ARC, or ARC's Class t & 3 members or EPRI or to used for purposes of manufacture without pnor permmason of the Subcontractor, except that further declosure or uma may to rnade swy for the following pu'icsos.

The propnetary data may te disclosed to other than commeretal competnors of SA ai.c4 for evaluaton purposes of the subcontract unoer the restncton that the proprotary data be retened in confidence and not be further decomed, and subted to the terms of a non-declosure agreemert between the Subcontractor and that orgarutaten, excluding DOE and as contractors DEFINITIONS CONTRACT / DELIVERED DATA 0 Consists of docurnents (e 0, specifications, drawings, reports) which are generated under the DOE or ARC contracts which contain no background propnetary data.

EPRI CONFIDENTIAUTY / OBUGATIONNOTICES NOTICE 1: The data in the document a outgect to no confidentaley obhgatons.

NOTICE 3: The data in the document a propnetary and confidental to Westnghouse Electnc Corporaton an@or ts Contractors 11 la forwarded to rec # pert unoer en obhgeton of Confidence and Trust for kmrted purposes orty. Any use, der.,losure to unauthonred persons, or copytng of thr doeurtwns or parts thereof te prohibaed except as agreed to in advance by the Electne Power Research Institute (EPRI) and Westinghouse Electne Corporaton Recipent of this data t.as a duty to inquire of EPRI andw Westinghouse as to the uses of the Informaton contained heren that are permitted NOTICE 3: The data in the document is propnetary and co9federtial to Westnghouse Electne Corporaton and/or as Contradors it is forwarded to recipent under an othgation of Confioence and Trust for use only in evaluaton tasks spectfcally authortred by the Electne Power Research Instnute (EPRI). Any use, disclosure to unauthonred persons, or copying the document or parts thereof is prohibaed except as agreed to in advance by EPRI and Westinghouse Electre Corporatort Recipient of this data has a duty to nquire of EPRI and/or Westnghouse as to the uses of the mformaton contaned herein that are permitted The document and any copies or excerpts thereof that may have been generated are to be retumed to Westinghouse, directly or through EPRI, when requested to do so NOTICE 4: The data in the docurnent a propnetary and confidental to Westinghouse Electric Corporaton en@or as Contractors. It is beng revealed en confioence and trust only to Employees of EPRI and to certain cortractors of EPRI for hmned evaluaton t seks authorred by EPRt. Any use, doctosure to unautnonzed persons, or copying of the document or parts thereof is prohstded This Document and any copes or excerpts thereof that may have teen generated are to to retumed to Westinghouse, direcity or inrough EPRI, when requested to do no.

NOTICE $: The data 6n this document a propnetary and confidertal to Westinghouse Electnc Corporaton andw Rs Contractors. Access to the cata to grven in Confidence and Trust only at Westinghouse facilities for bmand evaluaton tasks assagned by EPRI, Any use, declosure to unauthonted persons. or copying of this document or parts thereof is prohitmod. Neither thts documert nor any excerpts therefrom Fra to be removed from Westnghouse fac11aes EPRI CONFIDENTIAUTY / OBUGATION CATEGORIES CATEGORY T 4-(See Dettvered Data) Consats of CONTRACTOR Foreground Data ti.at to contaned in an asued reported.

CATEGORY *B* 4 (See Dehvored Data) Consats of CONTRACTOR Foreground Data that is not contained in an maued report, except for computer programs CATEGORY 'C' 4. Consmis of CONTRACTOR Background Data except for computer programs.

CATEGORY *D" 4 Consets of computer programs deve40 ped ln the course of performing the Work.

CATEGORY *E' 4 Conssts of computer programs devotoped pnor to the Effecttve Date or after the Effecttwo Date but outside the scope of the W ork CATEGORY *F* 4 Consats of Wm.L.a plans and adminstratrve reports ame,covce coe

WESTINGilOUSE NON PROPRIETARY CLASS 3 i

s. i WCAP-13914 Framework for AP600 Severe Accident Management Guidance  !

e i

1 January 1998 '

I Revision 3 r

~

i Westinghouse Electric Company Energy Systems Business Unit P.O. Box 355 Pittsburgh, PA 15230-0355 I C 1998-Westinghouse Electric Company -

All Rights Resen ed .

I a\4022w.wytit@l1496

1 i

d; l

TABLE OF CONTENTS Ll I

1 -- INTRODUCTION . . . . . . . . . . . . '. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. 11 j

t 2 REQUIREMENTS POR SEVERE ACCIDENT MANAGEMENT . . . . . . . . . , . . . . 21.

3 DECISION MAKING PROCESS . . . . , . . . . . . . . .' . . . . . . . . . . . . . . . . . . . . . . . 31 3.1 ROLE OF THE FLANT PERSONNEL . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2 3.2 - STRUCIURE OF AP600 GUIDANCE . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 3.2.1 Diagnostic Flow Chart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 3.2.2 Severe Challenge Status Tree . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-3 3.2.3 Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-4

.4- SEVERE ACCIDENT MANAGEMENT GOALS . . . . . . . . . . . . . . . . . . . . . . . . . 41 4.1 . CONTROLLED, STABLE CORE STATE . . . . . . . . . . . . . . . . . . . . . . . . . 41 4.2 CONTROLLED, STABLE CONTAINMENT STATE . . . . . . . . . . . . . . . . . . -4 4 .

4.2.1 Hydrogen Flammability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-6 4.2.2 Core / Concrete Interactie- . . . . . . . . . . . . . . . . , . . . . .........47 4.2.3 High Pressure Melt Ejeen: . . . . . . . . . . . . . . . . . . . . ......... 4-8 4.2.4 Steam Explosions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-8 4.2.5 Creep Rupture Failure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-9 4.2.6 Containment Vacuum . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 10 4.3 FISSION PRODUCT RELEASE PREVENTION, TERMINATION AND MITIG ATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-11 4.4 - SECONDARY GOALS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-13 5 HIGH LEVEL ACTIONS FOR AP600 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 1 5.1 INJECT INTO RCS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 3 5.2 INJECT INTO CONTAINMENT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-6 5.3 ' INJECT INTO STEAM GENERATORS . . . . . . . . . . . . . . . . . . . . . . . . . . 5 7 1- 5.4- DEPRESSl*RIZE RCS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 9 51 DEPRESSURIZE STEAM GENERATORS . . . . . . . . . . . . . . . . . . . . . . . . . 510 5.6 DEPRESSURIZE CONTAINMENT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 511 o 5.7 PRESSURIZE CONTAINMENT 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-12 l 1 5.8 BURN HYDROGEN - . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-13

- 5.9 VENT CONTAINMENT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-13 I: 5.10 MITIGATE FISSION PRODUCT RELEASES . . . . . . . . . . . . . . . . . . . . . . 5-15

.5.11

SUMMARY

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-15 .

-6 CONCLUSION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

~7L REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . -. 7-1 APPENDIX =A' AP600 SEVERE ACCIDENT MANAGEMENT INSIGHTS . . . . . . . . . . . . A-1 APPENDIX B AP600 SAMG RAls AND RESPONSES . . . . . . . . . . . . . . . . . . . . . . . . . . . B 1 .

swenw.wgneum : nwwon 3. )===y im :

'*A-t l e-m *vi- e-~ w .,

7 94p gyyu-,

, _ . . ._ .. _.,__..__.._-...._.-._._.-.m..___.

i

'f f

LIST OF TAllLES .i i

Table 51 AP600 High level Actions Relative to Severe Accident  !

Management Goals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 2 ,

Table 5-2 Summary of High level Severe Accident Management {

Stfetegies for AP600 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 16 -

i i

i r

t

-p t

1 t

i i

I 6

i h

i c

h I

r I

k i

e I

t i

e

,--.m e

ex\40Dw.wpt:lb411496 -. Rettoson 3, January 1998 i i

f

11 1 INTEDDUCTION Prevention and mitigation of accidenn has been an integral part of the design process for AP600. A significant driving force in the passive plant design is the key accident management philosophy of preventing accidents from progressing to core damage.

However, in the event of a low probability core damage accident, it is prudent to have severe accident management guidance with the objective of terminating the progression of the accident and returning the plant to a controlled, stable state. Therefore, this document contains a summary of the overall philosophy and high level strategies that will form the basis of the AP600 severe accident management guidance.

The Westinghouse plan for addressing wvere accident management for AP600 will be based on the Westinghouse Owners Group Severe Accident Management Guidance (WDG SAMG) for the current generation of operating plants [Ref.1). Since some of the AP600 design features reduce or climinate the potential for some severe accident phenomena and fission product boundary challenges, the WOG SAMG provide 4 an envelope of possible severe accident management considerations. Thus, the WOG SAMG has direct applications to the development of AP600 severe accident management guidance, and will be the starting point from which comparisons are made.

The scope of the AP600 severe accident management guidance is to address significant core damage accidents. Prior to core damage, the Emergency Operating Procedures (EOPs),

which are based on the AP600 Emergency Response Guidelines (ERGS) will be used [Ref. 2].

Although the EOPs/ ERGS for existing plants (e.g., the WOG ERG package [Ref. 3]) have proven to be effective in the prevention of core damage, they do not address scenarios after significant core damage has occurred.

The AP600 severe accident management guidance will be developed for use a r the AP600 emergency response guidelines are no longer applicable. The AP600 severe acudent management guidance will indade the application of insights that are derived from the AP600 Probabilistic Xisk Assessment (PRA) (Ref. 4], and elements that have been leamed through severe accident management research over the past 15 years. As such, severe accident management guidance is the mechanism that brings the current level of knowledge on severe accidents to the hands of the operating and technical staff at the plant. However, the overall unecrtainty of the core melt progression is still quite high, and thus the management of a severe accident can only be pre-constructed by guidance that is less prescriptive than the guidelines for design basis events and other. accidents prior to core damage.

The contents of this document include a discussion of severe accident management requirements, the anticipated structure for the decision making process, the goals tnat must Introduction RevWon 3. January 1998 o;\4022w.wpf;1t411498

1-3  :

be accomplished for severe accident management, and a summary of possible strategies for  ;

AP600 severe accident management. Included in the severe accident management i discussions are key severe accident management insights obtained from the AP600 PRA.

This document provides the framework for future AP600 severe accident management i guidance development and therefore does not specifically address many issues in detail.

I

I 21 2 REQUIREMENTS FOR SEVERE ACCIDENT MANAGEMENT l There are no current NRC requierents for the development of severe accident management i guidance. liowever, NRC policy statements from the NRC Staff to the NRC Commissioners i (SECY letters) identify concerns and future actions of the NRC concerning this subject.

Specifically, SECY 89412 [Ref 5) provides the following information.

" Accident Management encompasses those actions taken during the course of an accident by the plant operating and technical staff to: (1) prevent core damage, (2) terminate the progress of core damage if it begins and retain the core within the reactor vessel, (3) maintain containment integrity as long as possible, and (4) minimize offsite releases. Accident management, in effect, extends the defense-in-depth principle to plant operating staff by extending the operating procedures well beyond the plant design basis into severe fuel damage regimes, with the operator skills and creativity to find ways to terminate accidents beyond the design basis or to limit offsite releases.

The NRC staff has concluded, based on PRAs and severe accident analyses, that the risk a.4sociated with severe core damage accidents can be further reduced through effective accident management. In this context, effective accident management would ensure that optimal and maximum safety benefits are derived from available, existing systems and plant operating staff through pre planned strategies... Accordingly, accident management is considered to be an est.ential element of the severe accident closure process described in the Integration Plan for Closure of Severe Accident Issues (SECY-88-147) [Ref. 6) and the Generic Letter on the Individual Plant Examination (Generic Letter 88 20) [Ref. 7].

In the IPE Generic Istte., the staff deferred the requirement to develop an accident management plan, stating that we are currently developing more specific guidance on this matter and are working with NUMARC to (1) define the scope and content of acceptable accident management programs, and (2) identify a plan of action that will ultimately result in incorporating any plant-specific actions deemed necessary, as a result of the IPE, into an overall severe accident management program."

Also w; thin SECY-89-012, the first objective for an accident management plan developed by licensees for each plant is:

" Developing technically sound strategies for maximizing the effectiveness of personnel and equipment in preventing and mitigating potential severe accidents. This includes ensuring that guidance and procedures to implement these strategies are in place at all plants."

Requirements for Severe Accident Management RevWon 3, January 1998 oA40:2w*pf It411498

23 On November 4,1994, the Nuclear Energy Institute's (NEI) Nuclear Strategic issues Advisory Committee voted unanimously to establish a formal industry position on severe accident management and to bind each of the utilities currently operating light water reactors in the U.S.A. to implement the measures in that position by December 1998. The formal industry position on r.evere accident management was issued as NEI 91-04, Revision 1, " Severe Accident Closure Guidelines" [Ref. 8]. The basic elements of the severe accident management required by NEl 9104, Re" 1 include written guidance, training and a process for periodic utility self assessment. The NRC has accepted the industry position on severe accident management as a substitute for formal regulatory requirements (Ref.17] but is defining an ,

approach for assuring the quality and effectiveness of the implementation of the industry's initiative.

The previous information is in regards to general positions of the NRC on severe accident management, and it does not distinguish between current operating plants and new, advanced plant designs. However, the NRC has indicated their interest in AP600 Severe accident management through several of the Requests for Additional Information (RAls) which are presented in Appendix B. Specifically, RAI 720.55 asks how Westinghouse plans to use the AP600 Probabilistic Risk Assessment to identify and assess accident management measures. Furthermore, in RAI 720.56, the NRC asked how Westinghouse plans to address the five elements of accident management as defined in SECY-89-012. These elements are:

1) accident management procedures,2) training for severe accidents,3) accident management guidance,4) instrumentation, and 5) decision making responsibilities. Subsequently, in RAI 480.212, the NRC asked about severe accident management actions that might be required after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to prevent or mitigate uncontrolled fission product releases. More recently, in RAI 480.439, the NRC has inquired about how insights developed from the AP600 PRA would be incorporated into the combined license (COL) applicant's severe accident management guidance.

In addition, the Advanced Light Water Reactor (ALWR) Utility Requirements Document (URD) [Ref 9] states that the Plant Designer shall establish the technical basis for a severe accident management program tha' includes core damage prevention and mitigation. The Plant Designer is also to translate the plant design bases into operational limitations and responses which can then be ueveloped into procedural guidelines and training by the Plant Owner. The Plant Designer is also responsible for confirming that the plant design is compatible with the ERGS and the severe accident management program based on the plant specific PRA and other relevant information. The NRC's Safety Evaluation Report for this document states: "The use of PRA for developing and confirming the severe-accident management program and ERGS is also consistent with the Commission's severe-accident policy" [Ref.10].

Requirements for Severe Accident Management Revision 3. January 1998 oA400w.wpf 1t41168

M i 3 DECISION-MAKING PROCESS Severe accident management involves the implementation of actions to bring the plant to a controlled, stable state following core damage and to mitigate challenges to the containment fission product boundary. In a severe accident state, the first two fission product boundaries (the fuel rod cladding and the reactor coolant system) may be severely damaged and the focus shifts to maintaining the final fission product boundary. To effectively choose the appropriate severe accident management actions and to prioritized the implementation of the appropriate actions, assessment of the plant conditions is needed.

The nature of severe accidents and the possible responses dictate that severe accident management diagnostics be symptom-based. Several specific features of severe accidents can be cited which support the symptom based approach:

a) Severe accident management must provide a response for a *. vide range of severe accident conditions. While a large number of possible scenados have been identified in severe accident studies, it is likely that most of these scenarios do not accurately represent realistic severe accident scenarios due to modelling assumptions in these studies (such as all ecluipment failures are assumed to occur at time zero).

b) During a severe accident, the plant conditions are undergoing continual change.

Severe accident management must relate actions to symptoms.

c) The overall goals of severe accident management involve the response to challenges to fission product boundaries, which can be diagnosed through symptoms.

In other words, the symptom-based approach is a key method to develop flexibility in the AP600 severe accident management guidance. his flexibility refers primarily to the ability of plant personnel to sluit priorities and implement accident management strategies based on the situation of the plant during the accident. Specific technical decisions may be knowledge-based, and will be dependent on the interpretation of the plant status. Therefore, the appropriateness of specific actions cannot be predetermined during the development of AP600 severe accident management guidance. This approach allows the guidance developed to be useful during any severe accident, even scenarios which are not currently recognized situations. As such, an AP600 severe accident management plan is the final stage in the defense-in-depth plant safety concept.

Although flexibility is a necessity, there is a need for the guidance itself to be a structured process for choosing the appropriate actions based on actual plant conditions. Human factor considerations during a high stress environment that would accompany a severe accident require that the guidance be simple to use. Thus, the AP600 severe accident management Decision-Making Process Re"islan 3, January 1998 oM022w*pf.1b-011498

3-2 guidance must tv an effective decision-making tool based on some fundamental concepts about the organization of the guidance, as detailed below.

3.1 ROLE OF Tile PLANT PERSONNEL NEl has developed recommendations for severe accident assessment and mitigation that divide responsibilities of personnel into categories of ctuluators, decision makers, and irnplementors. The evaluators must assess the plant symptoms to determine the plant state, and then evaluate the potential strategies that may be used to mitigate the event. The decision makers are to arses > and select the strategies to be implemented. The implementors ara responsible for performing the steps necessary to accomplish the objectives of the strategica, such as hands-on control of valves, breakers, controllers and r,pecial equipment.

The plant personnel to perform each of these functions will be identified by the AP600 COL applicant in the development of the sewre accident management plan. Factors that will be considered include:

• The structure of the organization that is needed for accidents prior to core damage, so that there would be an orderly transition to management of the accident after core damage is diagnosed,

• The instrumentation, equipment and computers necessary to fulfill each function,

. The skills, training and expertise of personnel,

• The size and location of the necessary staff, and

. The desire to address severa accident management preparation, while still maintaining a focus on the prevention of core damage.

3.2 STRUCTURE OF AP600 GUIDANCE The AP600 guidance for severe accident management will include overall diagnostic tools that control the flow of the de*lon-making process, as well as detailed guidelines. The fallowing sections provide a sununary of the expected flow charts, as well as further information on the content of the detailed guidelines.

3.2.1 Diagnostic Flow Chart As identified in Section 3.0, there is a need for severe accident management guidance to have an organized structure to facilitate effective decision-making. For AP600, the form of this ikcision Making Process Revtsion 3, January 1998 o.\402?w wpt 1t>011498

_- - -. . _ _ - _ _ -- . - - . - _ __ ~. -__

33 1

i structure should be based on the WOG SAMG, although some of the details may differ. The element discussed within tlus section is the Diagnostic Flow Chart, which is the primary  !

decision making tool to determine when the plant has achieved the overall goals of severe ,

accident management.

The Diagnostic Flow Chart (DFC) is the primary tool to identify the appropriate guidelines for the key possible plant conditions that may occur following a severe accident. The flow chart is the point of entry into severe accident management (from the ERGS), and it also serves es the exit point. The flowchart is based on setpoints for different parameters that are either necessary to define a controlled, stable state or which may prevent further challenges to fission product boundaries. The elements that determine a controlled, r, table state are ,

discust.ed in Section 4.0. Prevention of fission product boundary challenges refers to the [

prevention of severe accident phenomena, which may challenge fission product boundary l Integrity, such as induced steam generator tube rupture, high pressure melt ejection and l reactor vessel lower head failure. Key plant conditions will be defined based on the  ;

capability to take actions to control the conditions and on the potential challenge to the containment fission product boundaries which these conditions may indicate. Based on the particular plant conditions identified in the DFC, a specific guideline is consulted to evaluate the availability and effectiveness of the various severe accident management strategies which .

may be used to control the conditions. If a controlkd, stable state is achieved, the DFC ,

instructs plant personnel to develop a set of limitations and cautions for the long term recovery process, based on the consideration of large quantities of fission products released  !

from the core and other important aspects of the severe accident scenario. The parameters in .

the DFC will be prioritized and the setpoint values will be determined during the development of the detailed AP600 guidance.

The development of the priorities for checking the parameters that determine a controlled stable state (i.e., the order of appearance of parameters on the DFC) will be based on fission product challenges to the containment fission product boundary, the speed at which such  ;

challenges can occur, the time in the accident progression at which the challenges can occur, and the time available for intervention. The priorities and the actual values for the DFC parameters (l.c., the setpoints) will be based on the AP600 severe accident response 1 characteristics as detailed in the AP600 PRA and will consider the severe accident management insights identified from the AP600 PRA, as documented in Appendix A of this report.

3.2.2 - Severe Challenge Status Tree The Severe Challenge Status Tiec (SCST) is the primary tool used by the emergency response i F - team to identify immediate and severe challenges to containment fission product boundaries and ;to select the appropriate guideline for strategies to respond to the challenge. The SCST -

identifies the severe challenges for all possible plant conditions that may occur following a <

Decision-Making Process Revision 3, January 199s oM022w.wpf.It411498 -

3-4 severe accident. ne plant conditions on the SCST will be defined based on the severity of the challenge and capability to take actions to control the conditions in time to mitigate the challenge to the containment fission product boundaries. Based on the particular plant conditions identified in the SCST, a specific guideline is consulted to evaluate the availability and effectiveness of the various severe accident management strategies which may be used to control the conditions.

He parameters in the SCST are regularly monitored to determine whether a severe challenge has developed. The SCST parameters are to be monitored simultaneously with the usage of the DFC. He existence of the SCST as a monbring tool allows for the effective use of the pre-prioritized DFC, which addresses less immediate concerns. However, if the setpoint for a SCST parameter is reached, all activities being guided by the DFC would be put on hold until the SCST challenge has been addressed.

The development of the priorities for checking the parameters that determine challenges to the containment fission product boundary (i.e., the order of appearance of parameters on the SCST) will be based on the severity of the fission product challenges to the containment fission product boundary, the speed at which such challenges can occur, the time in the accident progression at which the challenges can occur, and the time available for intervention. The priorities and the actual values for the Severe Challenge Status Tree parameters (i.e., the setpoints) will be based on the AP600 severe accident response characteristics as detailed in the AP600 PRA and will consider the severe accident management insights identified from the AP600 PRA, as documented in Appendix A of this report.

3.2.3 Guidelines While a Diagnostic Flow Chart and Severe Challenge Status Tree are used to establish the organizational structure of severe accident management guidance, the details and the majority of the technical content are contained within guidelines. Guidelines are referenced directly from the DFC or SCST due to a plant parameter being outside the desired range.

The structure of the guidelines willinclude the following major considerations:

1) Equipment Availability The guidelines will contain lists of the possible equipment that may be used to implement an action. If no equipment is available, instructions will include the consideration of restoring the non-functioning equipment.

2) Benefits vs. Potential Negative Impacts - The potential actions will be considered in regards to their benefits weighed against the expected negative impacts, If the negative impacts are judged to be large, then methods to minimize the negative impacts will be considered when possible. If the impacts differ based on the choice of methods or equipment, this distinction will be made, bision-Maktng Process Emsion 3. knuary 1998 oA4022w.wpf,lt411498

i 35 l

i

3) Implementation If the decision is made to implement a strategy, implementation  ;

instructions will be provided that include any limitations that were identified during  ;

the evaluation. The implementation instructions will also identify the expected response of the plant as a basis to compare the actual response. The option to abort

• the action, or to implement additional actions, will also be considered.

^

t

4) Long Term Concerns Once a severe accident management strategy is implemented, i there may be one or more additional plant parameters that require periodic l surveillance to assure that the strategy implemented will continue to be effective. l Ther.e generally include support functions such as an adequate water supply, and continued equipment cooling. The identification of the long term concems associated ,

with the implementation of any severe accident management strategy should also l include a brief description of the actions that can be taken to address the long term '

concerns when they become critical to the continuation of the r, elected strategy.

l f

t 4

I e

Y h

4

' l.% cision-Making Proce58 Reviskm 3, Janwy 1998 tr\4022w.wptit411498 -

.e

41 4 SEVERE ACCIDENT MANAGEMENT GOAI.S Before any guidance for severe accident management can be developed, the first step is to identify the overall goals that the guidance must achieve. As stated in the introduction, the overall objective of severe accident management is to terminate the core damage progression.

However, the scope of severe accident management also entails maintaining the capability of i the contahunent as long as possible, and minimizing fission product releases and their effects.

These severe accident management objectives can be translated into specific goals that must be met. These three goals are: 1) to return the core to a controlled, stable state, 2) to maintain or return the containment to a controlled, stable state, and 3) to terminate any fission product releases from the plant. Secondary goals, to be achieved while focusing on the primary goals, are to 1) minimize fission product releases, and li) maximize equipment and monitoring capabilities.

Before details are provided on each of these goals, it should be noted that severe accident management does not guarantee the achievement of the goals. Severe accident management is a structured approach that best utilizes available resources at the plant based on the current understanding of severe accidents.

4.1 CONTROLLED, STABLE CORE STATE A controlled, stable core state is defined as core conditions under which no significant short term or long term physical or chemical changes (i.e., severe accident phenomena) would be expected to occur. A significant short term or long term change is one which would require an operator response to prevent a change in core location, a challenge to containment integrity, or fission product releases. In order to achieve a controlled, stable core state, two primary conditions must N met:

1. A process must be in place for transferring all energy being generated in the core to a long term hear sink.

2. The core temperature must be well belou the point where chemical or physical changes might occur.

For a severe accident, the core is assumed to be uncovered and overheated when severe accident management begins. Therefore, both decay heat and sensible heat must be removed from the core, along with any chemical heat which is produced during the recovery phase.

However, providing a means to remove all of the core energy does not guarantee a controlled, stable core state. This is best illustrated by the TMI 2 accident in which core relocation continued for a significant period of time after a process was in place for cooling the core [Ref.11). This was because the core geometry did not facilitate efficient transfer of Severe Acrident Management Goals Rntion 3, January 1998 oA4022w wpf Hv011498

42 i energy from the molten core material to the coolant. Thus, the core can only be considered in a controlled, stable state when its temperature is sufficiently low, and a heat removal process is in place. Thus, both criteria are necessary and sufficient conditions for achieving a controlled, stable core state.

The amount of energy that will have to be transferred from the core is dependent on whether the core remains subcritical. Before significant downward relocation of core material occurs, the amount of negative reactivity required for subcriticality is bounded by the ERG considerations. As core downward relocation progresses, the required negative reactivity for subtriticality decreases due to geometry compaction (Ref.12]. The core compaction results in a significant change in the local moderator to fuel volume ratio, thus requiring less negative reactivity such as control rods or soluble boron.

Ilowever, for severe accident management, the extent of core relocation cannot be determined during the accident itself. If the water injected during the severe accident comes solely from the tanks inside the containment that are sufficiently borated, then there is no chance that the shutdown margin will be lost. Ilowever, if the only available water sources do not contain sufficient boron to ensure that the s9beriticality conditions are achieved, there is the potential for a retum to power, depending on the core geometry. The use of unborated (or under borated) water could only result in a return to power in the core at very low levels, which is a function of the injection rate to the core. For this scenario, the core would be likely to continue (9 c.egrade since all of the heat generatian is not removed by boiling of the injected water, resulting in a change in core geometry which leads to a subcritical state.

If the core retums to a critical state, the excess reactivity would be compensated by void formation in the water. liowever, the rate at which enticality is approached must be sufficiently slow that the feedback associated with the void development can be effective. If the injection rate of the water were too high, prompt recriticality could be a concern, which could damage reactor coolant piping or steam generator tubes. liowever, generic severe accident studies lRef. 7] have conservatively shown that even flow rates of 1000 gpm are an order of magnitude too low for prompt criticality. Since this is higher than any expected injection flowrates for the AP600 plant, there is no need to further consider criticality or prompt criticality issues.

The cooling of the core can be accomplished via several methods *he preferred method is to cover the core debris with water while it is still in the reactor vessel. If the core cannot remain covered with water while in the vessel, submerging the bottom head of the reacter vessel with water may be sufficient to remove the core heat. [Ref.13 and Ref.14) If this method of flooding the containment cavity is successful and if the reactor coolant system is sufficiently depressurized, it prevents reactor pressure vessel (RPV) failure and movement of the core material into the containment. Although either water inside the RPV or water l

l Severe Acadent Management Goals ren 3, unmy tws i oA4022w.wyrtlwoll68 -

43 subrnerging the bottorn head of the RPV may be sufficient, the idest condition is to create water inventories both inside ard outside the RPV. This maximizes the possibility of reducing the core temperature and ensuring that further physical and chemical changes can no longer occur.

If the core remains within the RPV, not only must the core initially be cooled, but a long term heat removal process rnust be established. The first possibility to be considered is heat transfer to the steam generators. For this option to be feasible, there must be a water inventory in the secondary side of the steam generators, the reactor coolant system (RCS) should be relatively intact, and there must be some water inventory within the RCS.

However, it is not necessary to have a complete RCS water inventory, since condensation of steam is also an effective heat transfer mechanism.

Another possibility for long term heat removal while the core is within the reactor vessel is to use the panive sesidual heat removal (PRHR) system. This system is based on natural circulation from the RCS to heat exchangers in the in-contalmrent refueling water storage tank (IRWST). Within the IRWST, the heat is then transferred to the containment through steaming. Therefore, the PRHR is cn indirect method to transfer the core heat to the containment. For the PRHR to function, the RCS must be relatively intact, and there must be some water inventory withm the RCS, In addition, there must be a sufficient water inventory within the IRWST. Since the IRWST le the largest water source for refilling the RCS and to flood the containment cavity, the IRWST water inventory is not likely to be maintained during a severe accident, and thus this method is not likely to be available for long term heat removal from the RCS unless the IRWST can be refilled from an external water source.

The third long term heat transfer process to be considered is a direct path to the containment, which is then cooled through passive containment cooling. If there is a loss-of-coolant accident (LOCA), steaming from the break can be an effective heat transfer medium, provided that additional water can continually be provided to the RCS. For a non-LOCA transient, an opening in the RCS can be created for direct steaming, such as opening the fourth stage valves of the automatic depressurization system (ADS). Another heat transfer pathway to the containment is via direct heat transfer through the walls of tne RPV, coolant loops and direct vessel injection lines if water is surrounding the outside surfaces.

If the severe accident is not mitigated before the RPV lower head fails and the core debris is transported ex-vessel, the only long term heat sink is the containment. In this scenario, a water inventory in the reactor cavity and the containment is needed for initial core cooling and lang term heat removal. If the limited surface area of the core debris is not sufficient to permit removal of decay heat and sensible heat, the core debris will remain molten and lateral movement will increase the heat transfer area until cooling can occur. Although some ablation of the concrete basemat may occur in this case, the investigations reported in the Severe Accident Management Goals Reusion 3, January 1998 oA4022w.wpf.It411498

4-4 AP600 PRA indicate that the core will eventually be quenched and concrete ablation will be [

arrested. One of the features of the AP600 plant is that the reactor cavity has been designed ,

with sufficient floor area to permit debris spreading until a coolable geometry can be created.  ;

Thus, the cooling of the core debris external to the reactor vessel can be accomplished in the  ;

presence of water. However, if the core debris is transported ex vessel into a dry reactor  :

cavity, the core debris will begin to ablate the concrete basemat. Subsequent introduction of water into the reactor cavity may only be partially successful in arresting the concrete ablation. Thus, it is important that t'ic reactor cavity be flooded prior te core relocati>a from

[ the reactor vessel and that a continued supply of water be available to maintain a water cover over any core debris in the reactor cavit .

t I

For core material dispersed at reactor vessel fall tre and refrozen on vertical containment surfaces and equipment, or present as thin layers on horizontal containment surfaces or equipment, no water may be required for long term cooling. Generic analyses [5tefs.13 and  !

i 14] show that convectior of the decay heat to the containment atmosphere could be sufficient to ensure long terrr. ~mling. If decay heat cannot be removed by convection, the dispersed core material will 1., tat-up, become molten, and eventually drain to lower levels of the containment. Downward relocation of core debris will stop when all of the heat can be removed, either v'a convxtion from a new configuration or via transfer to water if the debris becomes submerged at lower containment levels. Farthermore, F600 is designed such that only a small fraction of the core debris that is ejected from the reactor vessel could reach the upper containment area. [Ref.13) Therefore, core coolability after vessel failure remains i primarily a concem of establishing a water inventory in the lower cavity.

Thus, to maximize the possibility of achieving a controlled, stable core condition, the elements that must be considered in severe accident management are:

. water inventory in the RCS,

• water inventory in the containment cavity, e heat transfer to the ste.m generators, and

. heat transfer to the containment.

4.2 CONTROlJ l'D, STABLE CONTAINMENT STATE A controlled, stable containment state is defined as containment conditions under which no significant short tenn or long term physical or chemical changes w >uld be expected to occur.

A significant short term or long term change is one which would require an operator response to prevent a challenge to containment integrity or fission prcduct releases. In order to achieve a controlled, stable containment state, several conditions must be met, as summarized below.

- Severe Accident Management Goals RMston 3, January 1998 o: \40:2w.wpfD 011496

m. < .--n-,s ,e-,e s *m.--. .,...-vr'~wwe,-- .-. , ,,e-m-.,, - . - - - _ -v-,---m.,,,,,w, ..- w~ - - . - .-- . - . -w w-

l _

45

1. A process must be in-place for transferring all of the energy that is being released to the containment to a long terrn heat sink.

2. The containment boundary must be protected and functional.

3. The containment and reactor coolant system conditions must be well below the point where chemical or physical processes (severe accident phenomena) might result in a dynamic change in containment conditions or a failure of the ontainment boundary.

The first two of these conditions are relatively straight-forward for the AP600. The energy removal condition reouires that a heat sink be available and that a process for getting the energy from the cos..amment to the heat sink exists. Without a means to remove the energy transferred from the core and from chemical processes occurring during a severe accident, the containment pressure and/or temperature will increase to the point where the containment structural integrity could be challenged. Thus, ensuring that an adequate containment heat sink exists will prevent containment pressures and temperatures from reaching the point where the integrity of the containment boundary is challenged. For the AP600 plant, the primary containment cooliq mechanism is the Passive Containment Cooling System (PCCS).

This system causes the gravity drain of water onto the outside of the steel containment vessel, which then evaporates into the natural circulation air flow around the containment vessel. The PCCS has sufficient water inventory to operate for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following an accident. The PFJ results indicate that with the PCCS in operation, the containment pressure remains below the design pressure for all severe accident scenarios. If the water flow over the outer containment shell is not available, air cooling alone is sufficient to remove decay heat from the containment. In the case without PCCS cooling, the AP600 PRA shows that the containment pressure will exceed the design pressure and approach the containment ultimate pm. re capability. The AP600 PRA shows that although there is a very small probability ot ewemling the containment pressure capability without PCCS operating, the containment pressure remains well below the median estimate of the containent ultimate capability, in either case, (with or without PCCS cooling), natural circulation of rh P"nd the outside of the containment requires that the drains at the bottom of the Lnnuh.s remN open to prevent an accumulation of water from blocking the natural circulation flow p.stt In addition to the heat removal capability of the containment shell, the AP600 fan cooler system may be available to supplement the passive cooling. Wh.le the AP600 f.m cooler heat removal capability cannot match decay heat, it can be an effective supp6 ment to the passive heat removal capability of the containment shell.

The containment ' aundary condition requires that containment isolation be established and maintained. In t' e case of severe accidents the containment boundary includes di piping which penetrates the containment and which can have an unrestricted pathway to the environment. These pipes can be considered to be isolated if at least one valve in the pipe is closed (plus any bypass valves in parallel pipes), the line is pressurized with water, or a water seal is established in the line. In other words, all piping which is not actively carrying Severe Accident Management Goals Revision 3. January 1998 j oA4022w wpf.Hw011498 l

4-6 water to or from the containment, as part of severe accident management, must be isolated by closing at least one valve or establishing a sufficient water seal to prevent release of reactor coolant or containment fluids. Containment isolation considerations extend to the steam generators, main steam lines and feedwater lines since steam generator tube faults (either tube failures or pre-existing leaks) are a majei conce n for severe accident management. The limited number of containment penetrations m the AP600 design greatly -

simplifies this consideration, compared with the cun mt rmeratien of plants.

The third condition for a controlled, stable containmer.t state is more difficult to accomplish than the previous two conditions. The changes in centainment conditions which can lead to challenges to the containment include dynamic changes which cannot be predicted by trending containment parameters and longer term changes which can be more readily predicted by monitoring containment parameters. Both of these types of changes are of interest since they contribute to the potential for failure of the containment boundary. The dynamic and long term changes in containment conditions considered here are a result of severe accident phenomena. The severe accident phenomena considered in this goal include:

. Hydrogen flammability, including diffusion flames Core / concrete interactions (CCl)

. High pressure melt ejection (HPME), which includes

- Direct containment heating (DCH)

- Reactor vessel lift-off

. Steam explosions

. Creep rupture failure of reactor vessel or SG tubes

. Vacuum caused by hydrogen buming or venting Although the treatment of severe accident phenomenology for AP600 has been addressed in WCAP-13388, the discussions below summarize the impacts on maaagement of the severe accident.

4.2.1 Hydrogen Flammability The first of the severe accident phenomena to be considered is hydrogen. 'Ihe containment pressure rise when a flammable hydrogen mixture is burned in containment is a direct function of the mass of hydrogen present in the containment. During a severe accident, hydrogen is expected in the contain nent as a result of the in-vessel reactions between the fuel rod cladding and the steam as the core overheats. For any accident sequences in which the RCS pressure is low during core melting, most of the hydrogen generated would be released from the RCS to the containment. However, for sequences with high RCS pressures, a large fraction of the in-vessel hydrogen generation might be trapped in the reactor coolant system. For these latter sequences, a failure o' the RCS or an intentional action to depressurize the RCS to the containment (such as any stage of the AP600 ADS) after Severe Accident Management Goals Rmston 3. January 1998 i oA4022w.wpf:1b 011498

4-7 significant core damage has occurred can suddenly change the containment conditions and may have an impact on hydrogen flammability. In addition, the AP600 PRA shows that some modes of RCS depressurization using the ADS Stages 2 and 3 (which discharge to the IRWST) may result in the creation of a standing diffusion ' lam near the IRWST vents. The AP600 PRA also indicates that diffusion flames may b acated in the Core Makeup Tank (CMT) toom for the Direct Vessel Injection (DVI) line break scenario, in this scenario, the diffusion flame is created when die containment water level exceeds the DVI line break location and the core is reflooded through the DVI line: the additional hydrogen during reflood can results in the creation of a diffusion flame. Although the AP600 PRA analyses predict that these diffusion flames will not challenge the containment integrity, they can lead to a significant change in containment conditions.

Although the AP600 plant is equipped with hydrogen igniters, this discussion is in relationship to scenarios in which the igniters fail and hydrogen accumulates. AP600 analyses have shown that the containment can withstand the pressure transient from the deflagration of the hydrogen equ~ valent to 100% of cladding oxidation. The AP600 PRA analyses also show that the containment atmosphere is well mixed due to the natural circulation currents setup inside containment for passive heat removal through the containment shell. The analyses do not predict any significant local concentrations of flammable gases that require accident management considerations. If significant core debris is released to a dry containment, core / concrete interactions can result in additional hydrogen generation along with carbon monoxide, which is a flammable gas. Another significant source of hydrogen to be considered is from interactions between unreacted (unoxidized) metals in the core debris and water or steam in the containment after reactor vessel failure.

Since a hydrogen burn can result in a change in containment conditions, a controlled, stable containment can only be achieved if the hydrogen is maintained in a nonflammable state and no significant sources of additional hydrogen are expected. Thus, a controlled, stable containment state with respect to flammable gases requires that: a) the core is covered by water, b) the containment hydrogen is less than the global flammability linuts for containment conditions near ambient, c) there are no ongoing core concrete interactions, and d) the reactor coolant system is at a low pressure.

4.2.2 Corel Concrete Interaction Core / concrete interaction (CCI) can produce substantial changes in the containment conditions in a number of different ways. CCI results in the erosion of the bottom of the containment structure and can result in a containment failure at the basemat. CCI also results in the production of hydrogen and carbon monoxide gases which increases the flammable gas concentration in the containment. CCI without an overlying water layer also results in substantial heating of the containment gases via high temperature gas generation, convective heating of existing gases and radiative heating of nearby structures. In addition, i

Severe Accident Management Goals Revision 3, January 1998  !

on4022w.wptttr011498

4-8 CCI can result in core material configurations which may not be readily coolable, even in the presence of an overlying water cover, Core / concrete interaction can be prevented by having an adequate level of water covering the containment and the reactor cavity floor. The reactor cavity water inventory can submerge the reactor vessel and thereby prevent the core debris from leaving the reactor vessel. In the event of reactor vessel failure, the water inventoly in the reactor cavity can quench and cool core debris in this region to prevent core / concrete interaction. Thus, a controlled, stable containment state, with respect to core / concrete interaction, requires that either: a) the core is in the reactor vessel (as a result of either recovering in-vessel cooling or submerging the reactor vessel) or b) the containment and reactor cavity floor regions are covered with sufficient water to quench any core debris discharged from the reactor vessel and c) water recirculation back to the cavity is available to maintain the cavity water level, and thus core debris cooling.

4.2.3 High Pressure Melt Ejection if the reactor vessel fails while the reactor coolant system is at a high pressure, several severe accident phenomena can occur which have the potential for producing substantial changes in the containment conditions. The subsequent high pressure melt ejection (HPME) can produce direct containment heating (DCH) effects which may substantially chtmge the containment pressure and temperature. HPME can also resu!! in vertical movement of the reactor vessel due to the thrust forces generated by core debris escaping through the failure location in the RPV. Some studies have indicated that the movement of the RPV may result in sufficient movement in other piping connected to the RCS to tear containment penetrations, thereby challenging containment integ.ity conditions. HPME also produces a substantial change in the containment hydrogen concentration as described under the hydrogen flammability discussion above. HPME is prevented by either preventing reactor vessel failure or by reducing the RCS pressure.

4.2.4 Steam Explosions Steam explosions, both within the RPV and in the containment, have been postulated as a concern because they may recult in substantial changes in containmen; conditions by creating breaches in the containment boundary. Steam explosions are a subset of core-coolant interactions which can produce rapid pressure changes in the RCS and the containment.

Steam explosions have an accompanying shock wave which, by itself can umse damage to the containment or RCS boundary [Ref.15).'

An evaluation specific to the AP600 design was conducted to investigate the potential for in-vessel steam explosions. The evaluation concludes that in-vessel steam explosions cannot generate sufficient energy, in a shmt ame scale, to generate a missile that could fail the Severe Accident Management Gc.als Revuion 3, January 1999 o:\4022w.wpf:1b411498

,, . - - -. . - - ~ . - . - _ _ - . - . - - . - - .-

0 4  : AP600 containment [Ref.13). In addition, the evaluation shows that the peak pressure from i any potential in-vessel steam explosion is well withiri the normal operating pressure of the reactor coolant system.: Therefore, the integrity of the RCS pressure boundary is not =  ;

threatened. : -

U Because of the AP600 containment layout, a significant ex-vessel steam explosion from core

- debrisiwater interaction can occur only in the reactor cavity. . Evaluation of both steam

8eneration rates and potential shock waves induced by debris-water interactions shows that -

their magnitude is not expected to be sufficient to threaten the AP600 containment integrity. -

[Ref.13] The impact of the shock wave on the cavity wall and vessel support structure was : )

also evaluated as part of the AP600 PRA evaluations, with the conclusion that while~the - i structural integrity of the cavity walls may be threatened, there is no impact on the overall:  ;!

containment integrity.- Therefore, the principal consequence of ex vessel explosive debris- -

water interaction is to rapidly cocl the debris and pressurize the containment. Neither the  !

steam generation nor the shock waves are expected to challenge the containment integrity for .  ;

e

- any credible accident scenario, 4.2.5 Creep Rupture Failure-p Core damage accident scenarios in which the core material is located within the reactor vessel can lead to substantial changes in the containment conditions if either the reactor vessel, the reactor coolant system piping or the steam generator tubes should fail. Reactor l vessel failure is primarily a result of contact between molten core material and the inside surface of the vessel bottom head. Reactor coolant system piping and steam generator tube

failures are primarily a result of the circulation of high temperature gases within the reactor L - coolant system which leads to creep rupture failure of the piping.

Creep rupture failure of the RCS piping can result in substantial changes in the containment pressure, hydrogen concentration and fission product inventory. Creep rupture failure of the RCS piping can only occur if the RCS pressure is near its nominal operating value and is a

? =

result of heating the pipe walls to a high temperature 'under high stress conditions. Thus, creep rupture failure of the RCS piping can be prevented by reducing the RCS pressure or L submerging the RCS piping in water. Creep rupture failure of the SG tubing can result in l substantial changes in the containment integrity since the secondary side of the steam '

generator pressurizes to the SG safety valve setpoint. This creates a direct pathway for-  !

fission product transport from the RCS to the environment. Creep rupture failure of the SG tubes is a result of heating the tube walls to a high temperature and can only occur under u . conditions of high RCS pressure andi dry steam generator secondary side. Thus, creep ,

[ rupture failure of the SG tubes can be prevented by reducing the RCS pressure or -

L maintaining an adequate SG secondary side water inventory.

b t-

!T l Severe Accident Management Goals Revhion 3, #nuary 1998 '

4  ; oMo22w.wpf:1b-011496 -

4 10 4.2.6 Containment Vacuum The final severe accident phenomena which must be considered in the definition of a controlled, stable containment state is the potential for changes in containment conditions which would result in a substantial vacuum in containment. A substantial vacuum in containment could result in containment boundary failure. These conditions are most likely to be a cont.crn following a large hydrogen bum in the containment or following relief of some portion of the containment gases to the environment. A hydrogen burn will consume some of the oxygen which was present in the containmsnt prior to the accident Upon condensation of all of the steam in containment and the reduction in containment temperature to near its pre-accident value, the gas volume may be reduced by as much as 21% (assuming all of the oxygen is consumed in a hydrogen burn). This could result in a containment vacuum which challenges the negative design pressure of -2.5 psig.

In severe accident scenarios where a portion of the containment gases were released to the environment, either through late containment isolation or intentional containment venting, the potential for a strong containment vacuum which threatens containment integrity may also exist. To prevent these conditions, air or water must be introduced to the containment such that the containment pressure is within the normal range when the containment temperature is near its nominal value. Thus, a controlled, stable containment state requires that the containment pressure be nearly ambient with no further significant decreases expected.

To maximize the possibility of achieving a controlled, stable containment condition, a summary of all the elements that must be considered in severe accident management are:

. heat transfer from the containment, e isolation of containment, e hydrogen preventionAontrol, e core / concrete interaction prevention,

. high pressure melt ejection prevention, a creep rupture prevention, and

• containment vacuum prevention.

Severe Accident Management Goals Revuion 3, January 1998 i l

o;\4022w.wpf.lb 011498 _

4-11 1

I 4.3 FISSION PRODUCT RELEASE PREVENTION, TERMINATION AND MITIGATION To achieve the goal of terminating fission product releases from the plant, several conditions must be met:

1. 'Ihe isolation of the containment boundary, including penetrations and steam genertdor tubes, must be maintained.

2. The fission product inventory of the containment atmosphere must be minimized.

3. Significant leakage through the containment boundary must be stopped.

Some of these conditions may be duplicates of previous conditions for maintaining a controlled, stable core and/or containment state. They are also included here to reinforce the goal of controlling and terminating fission product releases during a severe accident.

Prevention (or termination) of fission product releases therefore requires that the containment boundary be maintained and/or isolated or that the driving force for leakage be eliminated.

The contairunent boundary includes the containment structure, the containment penetrations, the steam generators tubes, and the piping of systems connected to the RCS or containment up to the first isolation valve which is operable. Isolation of the containment boundary includes: a) maintaining existing containment boundaries, and b) closing appropriate valves that isolate systems directly connected to the containment atmosphere or the reactor coolant system, or c) creating a water seal whose static head is greater than the driving force where the first two methods are not available. All of the considerations for maintaining the containment boundary to prevent uncontrolkd fission product releases are covered under the goal of maintaining a controlled, stable containment state and are not repeated for the termination and mitigation of fission product releases.

Reducing the inventory of fission products available for release can be a function of the release pathway, which may be direct!, tied to the accident sequence. For containment releases, the fission product inventory airbome in the containment can be reduced by maintaining the RCS integrity thereby retaining a large fraction of fission products in the RCS. In addition, flooding the containment to submerge RCS piping and flooding the steam generators to submerge the U-tubes would provide cold surfaces for fission product deposition and retention. The nonsafety-related containment spray system could be used to hasten the reduction in the containment inventory of volatile and aerosol fission products already provided by passive natural processes. For release pathways which bypass containment, such as steam generator tube faults or leaks and interfacing system LOCAs (ISLOCAs), the fission product transport can be reduced by reducing the RCS pressure. Also, fission product scrubbing by submerging the release pathway is effective in reducing the dispersion.

Severe Accident Management Goals Revision 3, January 1998 j o:\4022w.wptib-011498 l

4-12

. In the AP600 design, airbome fission product removal is performed by the operation of the passive containment cooling system. The steam released in containment is condensed on the steel containment shell due to cooling from the passive containment cooling system and this process removes airborne fission products. In additien, the NRC has required a nonsafety-related containment spray system for the AP600 during a severe accident to actively reduce containment airbome volatile and aerosol fission products at a faster ' rate than the natural processes.- Fission products that are deposited in the containment sump are retained within the water by the containment semp pH control process. This process adds a chemical buffer to the floodup water inventory in containment to maintain the required pH to promote fission product retention.

The final condition for this goal is to actually terminate the leakage from the containment.

Terminating leakage includes eliminating the driving force for leakage (generally a pressure differential across a leakage path), isolating the leaking system, or creating a water seal whose static head is greater than the driving force. Several sources of leakage are worthy of consideration in the SAMG, including: containment, steam generators, and systems connected to either the containment or the RCS. Low levels of leakage from these sources are permitted within the plant design basis. The results of analyses which establish permissible leakage, with respect to offsite doses, are reported in the plant Safety Analysis Report. However, to de-escalate the emergency condition during a severe accident, essentially all of the leakage must be terminated. In the casa of containment sources, the leakage can be terminated by reducing containment pressure to near atmospheric. Leakage through containment penetrations can be terminated by closing all valves in the piping and/or by creating water seals in the piping. In the case of the steam generator tubes, leakage can be terminated by keeping the secondary system pressure above the RCS pressure. For systems connected to the RCS and containment, leakage can be stopped by finding alternative methods of accomplishing the same function. For example, recirculation systems which involve transporting high levels of radioactive water outside the containment can result in even very small amounts of leakage being significant. Use of systems that keep all radioactive water within the containment are preferred.

To maximize the possibility of terminating fission product releases, a summary of all the elements that must be considered in severe accident management are:

• isolation of containment, a

reduce fission product inventory, and

• reduce fission product driving force.

Severe Accident Management Goals Revision 3, January 1998 oA4022wxpf 1t411498

1 1

4-13:

n 4.4 SECONDARY GOALS - 1 i

[Although the previous sections have addressed the goals that must be met for successful 1 mitigation'of a severe accident, there are two additional considerations that should be addressed. These considerations have been termed " secondary goals,"~since~ they are not  !

,  : fundamental to the termination of the accident, but their impact is' widespread. The  !

1

- secondary goals affect the evaluation of which ~ actions, or strategies, to implement.- The'two

, secondary goals are: L i) to minimize fission product releases, and li) to maximize equipment

and monitoring capabilities. 3 4

he secondary goal to minimize fission product releases is similar to the primary goal of  !

- terminating fission product releases. However, the distinction is in the recognition that there l

may be a~ need to create an intentional, controlled, and short term fission product release to j prevem a larger, uncontrolled, and long term release. Specifically, this is in reference to ,

containment venting, if there is believed to be an immediate threat to the integrity of the- o i containment structure. However, any action which violates the primary goal of terminating ,

fission product releases should be done in a manner that minimizes the release. Another example is the case of steam generator depressurization. There are pathways that blow l

down directly to the environment, and other pathways (such as through the condenser) that

-would allow fission products to be scrubbed, and thus dispersion minimized.

Be other secondary goal, to maximize equipment and monitoring capabilities, acknowledges '

that the survivability of some equipment and instruments may become questionable under some severe accident conditions. -In general, severe accident conditions are no more severe than the design basis for instrumentation inside the containment. Depending on the scenario, <

however, temperatures and pressures may exceed the containment design basis, and thus the c  ; operability of instruments and equipment is uncertain. Therefore, when making severe accident management decisions, the impact on the instruments and equipment is a factor that >

- should be included in the evaluation process. ,

- The capability to repair and maintain equipment following the onset of a severe accident is

[- =also important.- First,' to arrive at a severe accident condition, it is quite likely that some of the plant equipment is not operable. - Second, during a severe accident, the potential exists for  ;

malfunctions .in equipment which is being used during the recovery. Third, since equipment -

. may be used in non-standard ways for severe accident response, local access to areas may be _ ,

7 required for valve alignments and/or equipment maintenance. The severe accident

- progression or actions taken to recover from the severe accident conditions may compromise

~t he habitability, particularly due to high radiation levels, of certain plant areas and result in a

condition in'which some equipment cannot be aligned, maintained or repaired. As in the -

- c ase of environmental' conditions and power supplies for equipment operability, severe k adcident management decisions should take into account the habitability of plant areas in ,

Lwhich alignment, maintenance or repair of equipment enhances the recovery capabilities.

l Severe Accident Management Goals - Revision 3, January 1996 ce\4022w.wpf:ltH)11496 -

e r s - ~ m m, v- < ~ ,-- . rw vw + , e - s -,y-,

1 ,

!5 lHIGH LEVEL ACTIONS FOR'AP600-i F Based on the severe accident management goals defined in the previous section, certain -

t elements are necessary to meet the goals. The elements can then further be divided into ;

. actions to be taken. 'the relationship of severe accident management goals to potential; actions are summarized in Table 5-1l which forms the basis for possible severe accident management strategies.

~ The definition of a strategy for AP600 severe accident management consists of three

. components. A strategy is 1) an action or set of actions that 2) is taken'for a specific purpose with 3) specific piece (s) of equipment.-- A strategy includes more than just the action, since the purposes must be well-understood for an effective evaluation, and the equipment to be used may' impact ths positive and negative expectations. ;This is the same strategy definition that was used for the WOG SAMG program, and it initially produced a list of over fifty strategies. Eventually, the strategies were combined to form a smaller number of guidelines, fand they were grouped based on the potential actions. Since the AP600 severe accident management program is being developed based on the WOG SAMG program, this same process will be followed.

The information within this section is grouped according to the high level actions that may be taken during the management of a severe accident. The discussion of each high level #

action includes the identification of the benefits (purposes)'of the action, the potential

-negative impacts, and the equipment possibilities. The development of the high level strategier,is a preliminary step in the development of the AP600 severe accident management guidance.-

I ~ In addition to thE high level actions, the WOG SAMG also identifies long term concerns that -

I- either: 1) are required to maintain an accident management strategy, or 2) are issues to be

1. monitored after exiting the SAMG after a controlled stable state is reached. As in the case of ,

I / the WOG SAMG, the AP600 severe accident management guidance is expected to be exited -

I ' once a controlled stable state is reached.- This is expected to occur within about 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of 1 L the inception of core damage. Thus, the AP600 post-72 hour actions are not expected to be'  ;

' 11 considered in the development of the severe accident management strategies. However, the 1i ~ post-72 hour actions should be considered in developing the long term concerns after exiting

~

51/ the'AP600 severe accident management guidance.

l

. The information in this section considers the AP600 PRA, through Revision 8, and the accident management insights derived froni the PRA _as discussed in Appendix A.

n -

1 High Levei Actions for AP600 -- Revision 3. january 1998 oA4022w.wpf:1b411496,

-p , a., s. ~ ,yfy.mswg we e.p.,

r imm gy y,yyy y -,--g

5-2 Table 51 AP600 High Level Actions Relative to Severe Accident Management Goals Goal Element High Level Action Controlled, stable core Water Inventory in RCS - Inject into RCS

- Depressurize RCS Water Inventory in - Inject into Containment Containment Heat Transfer to SGs - Inject into RCS

- Inject into SGs

- Depressurize SGs )

1 Heat Transfer to Containment - Inject into RCS i

- Inject into Containment

- Depressurize RCS Controlled, stable Heat Transfer from - Depressurize Containment containment Containment - Vent Containment Isolation of Containment - Inject into SGs

- Depressurize RCS Hydrogen Prevention / Control - Vent Containment

- Pressurize Containment

- Bum Hydrogen

- Depressurize RCS

- Inject into Containment CCI Prevention - Inject into Containment HPME Prevention - Inject into Containment

- Depressurize RCS Creep Rupture Prevention - Depressurize RCS

- Inject into SGs

- Irject into Containment Containment Vacuum - Pressurize Containment Prevention Terminate fission product Isolation of Containment - Inject into SGs releases - Depressurize RCS Reduce Fission Product - Inject into Containment Inventory - Depressurize RCS

- Depressurize Containment Reduce F.P. Driving Force - Depressurize Containment High Level Actions for AP600 Revision 3, January 1998 oM022w.wpf;1t@11498

5-3 5.1 INJECT INTO RCS Injecting water into the F.CS is the most fundamental action to mitigate the progression of a core damage accident. Regardless of where the core has relocated, the RCS may be the most effective pathway to get the water to the core debris. The underlying cause of all severe accidents is the inability to remove the decay heat generated by the core. Therefore, injecting water to the core region is the most direct means of restoring core cooling and stopping the accident progression.

As just stated, one of the benefits of injecting water into the RCS is the restoration of core cooling. The only possibility of preventing the core from relocating to the RPV lower head is to restore injection flow. As water initially flows to an overheated core, the water will flash to steam due to the high temperatures in the core region. Heat can be removed from the core by sensible and latent heat addition to the water and sensible heat addition to the steam.

If the flow of water can remove energy at a rate exceeding the decay heat rate, then core cooling can eventually be restored.

Another benefit of injecting water into the RCS is the scrubbing of fission products. If a pool of water is overlying a core debris bed, fission products released from the core debris bed will be scrubbed by the water pool. Fission product scrubbing can result in a significant reduction in the amount of fission products released to the containment atmosphere. A water depth of a few feet is a sufficient level to significantly increase the decontamination factor. [Ref.11]

Finally, injection of water into the RCS may help retain the core within the reactor vessel.

The energy removed by the water can slow the core damage progression and may delay or even prevent vessel failure. The injection of water during the TMI-2 accident, for example, provided sufficient heat removal to retain the core debris within the vessel. However, there is no guarantee that the injection of water in another severe accident would prevent the vessel from failing. Nevertheless, even a delay in vessel failure is a benefit worth achieving.

There are also negative impacts from injedng water onto hot core debris during a severe accident. The key potential impact of these adverse effects should be considered before a decision is madc to implement the strategy. The key potential negative impacts are the production of hydrogen and the potential for creep rupture of the steam generator tubes. A summary of these drawbacks is provided below.

The hot fuel cladding, in the presence of steam, oxidizes and produces significant amounts of hydrogen. If the containment hydrogen igniters are not working, the accumulation of hydrogen in the containment is a concem. Although AP600 analyses h we shown that the containment can withstand the deflagration of hydrogen produced from 100% of the cladding High level Actions for AP600 Revision 3. January 1998 u\4022w.wpf;1t>0ll498

5-4 being oxidized, the containment integrity could be challenged if there are significant additional combustible gases. The production of hydrogen is unavoidable when adding water to an overheated core (above 1800 F). However, the total hydrogen production for accidents where the core is recovered in-vessel should be less than 100% cladding oxidation.

Ultimately, to achieve a controlled, stable containment, the possibility of future hydrogen production must be ninimized by covering the core with water. Without the reflooding of the core debris, the potential exists for significant additional hydrogen production that could later create a contairunent challenge. Therefore, although the hydrogen production due to injecting water into the RCS is a negative impact, it is not a containment challenge.

The AP600 PRA shows that hydrogen diffusion flames at the IRWST vents do not present a threat to containraent integrity based on opening the ADS valves to the IRWST in the AP600 PRA sequences. The same conclusion is reached with respect to diffusion flames in the CMT room for the case of a DVI line break. However, other sequences may not have similar conclusions. Additional investigations need to be carried out to define any special conditions under which opening the ADS valves to the IRWST could result in diffusion flames that could challenge the containment integrity.

Another potential negative impact is creep rupture of the steam generator tubes. This is a failure mode that can occur when the steam generator tubes are subjected to high temperatures and large primary-to-secondary pressure differences. Tube temperatures can reach creep rupture limits quickly if hot gases that accumulate in the core upper plenum are forced into the steam generators by the rapid steaming that will occur when injection into the RCS reaches the overheated core debris in the reactor vessel. The potential for creep failure of steam generator tubes may be increased if the containment water level is above the coolant loop piping elevation because the RCS piping cannot fail by creep rupture. Since the steam generator tubes provide a fission product boundary, maintaining the tube inegrity during a severe accident is important to the goal of eliminating fission product releases. There are two

methods of preventing these adverse impacts

decrease the primary-to-secondary pressure difference, or make sure that the steam generator tubes are at least partially covered on the secondary side.

l Two negative impacts that were also included in the WOG SAMG but that are not applicable j to the AP600 design are containment flooding and an insufficient injection source.

Containment flooding for current plants is a concern because equipment such as containment vent valves or fan cooler exhaust / intake ducts may be located where they will be covered

, with water and unusable. However, the AP600 plant has been designed so that significant containment flooding does not affect necessary equipment. Another concern in most current I plants is that the use of the water from the RWST may limit other uses of that water.

However, the AP600 plant is desir,ned so that there are rarely systems competing for the same water inventory, and thus the injection of water does not impact the ability to perform other actions. The exception is the case where the IRWST is being drained to the i High Level Actions for AP600 Revision 3, January 1998 l on4022w.wptib.011498

. ~ - .n ,- -, - - . - _ - . - . . ~ .- .- - . - -.- --

4 5-5'

- containmenty In~a non-LOCA event where the containment inventory cannot subsequently

~

! drain into the reactor coolant system through the break, there may be some instances in j Jwhich a residual IRWST level is' desired. a s -

- Furthermore, thel design of the injection systems for the AP600 plant is'significantly different I

than'edsting plants? Current plants rely primarily on the forced injection of water from j

- sources outside the containment. However, the AP600 plant relies primarily on the passive injection from water tanks inside the containment. Each of the water tanks'and injection methods for AP600 is further discussed below. j t

- Ihe Core Makeup Tank (CMT) is a safety-related means to provide water inventory to the~

RCS. There are two CMTs, each with a capacity of 2000 ft', which replace the function of j

. high head safety injection pumps in current plants. CMTs are located above the reactor l

' coolant loops and each has a p_ressure balancing line from a cold leg. The CMTs are maintained full of borated water and are designed to inje-t at any RCS pressure. The ,

Edischarge from the CMTs is routed from the bottom of the tanks to r.eparate safety injection-

' nczzles on the reactor vessel. Each discharge line is normally isolated by two parallel air--

operated valves that fail open on loss of air pressure, loss of de power, or loss of control

signal.'

The AP600 is al'so provided with two accumulators that supply borated water at high makeup flow rates to refill the reactor vessel downcomer and lower plenum during a large loss of coolant accident or during other events requiring automatic or manual RCS depressurization. The back pressure for the accumulators is 700 psig, so that the RCS pressure must be reduced below this value before water will inject.

' The in-containment refueling water storage tank (IRWST), in conjunction with the automatic g depressurization system, provides the function of low head safety injection. To get injection-L from the in-containment refueling water storage tank, the RCS pressure must be reduced to a

[ value near containment pressure. The automatic depressurization system is provided to accomplish this function. When the IRWST empties, the containment is flooded above the RCS loop level, and the water in the containment drains, by gravity, back into the RCS if there is a break in the hot or cold leg. Therefore, stable, long-term core cooling and makeup L to the' RCS is established. The passive containment cooling system supports this operation by a

g. removing heat from the containment. Steam released from the RCS is condensed. .This-- ,

D condensate then drains back into the RCS for recirculation.

iThe normal residual heat removal system (NRHR) prcvides an additional mechanism for core L' cooling _taking water from the IRWST/ sump and injecting it into the safety injection lines.

L LThe NRHR system needs' cooling water and ac electrical power. If offsite power is lost, the -

l powerTis'supplihl by two non-safety-related diesel generators. - The NRHR loops take water

[ outside the containment, which could be a negative factor during a severe accident, since the .

, High Level Actions for AP600  : Revision 3, Ja uary 1996 4 oA4022w.wpt:1t>411496 .

m A.E

< l.

/  ;

I L , -n 4w+ - J. . . . , . , , . . . ,~ ,_ p ,, , ,7 4 y , , _ . , , g ,

5-6 I

coolant water is highly contaminated with fission products and may result in more personnel access restrictions. The PRHR capability would not be available if the IRWST is drained into the reactor cavity.

Finally, the chemical and volume control system (CVS) is the normal RCS inventory makeup system. It has two non-safety grade high pressure pumps, which start automatically if a core makeup tank actuation signal is generated. The pumps are also automatically loaded on the non-safety diesel generators if offsite power is lost. The CVS is rated to provide a flowrate around 100 gpm per pump at full system pressure. If the core is totally uncovered, the CVS is insufficient, by itself, to quench the core and reflood the vessel. However, this may be sufficient to remove decay heat as it is produced.

Because the AP600 plant is a passive design, most of the methods of injecting water rely on the gravity draining of tanks. However, for this to occur from some of the tanks, the RCS must be depressurized. The largest tank, the IRWST, requires that the RCS be almost fully depressurized. Therefore, during a severe accident in which injection capability has failed, it may be due to the RCS having a pressure that is too high. This makes the action of depressurizing the RCS very important for AP600. This high level action is further discussed in Section 5.4.

5.2 INJECT INTO CONTAINMENT Another important strategy for AP600 is to inject water into the containment cavity so that water surrounds the outside of the reactor vessel. Accordmg to WCAP-133S8 [Ref. 8), this action has more impact on accident management considerations than any other individual phenomena except the direct water addition to the debris. Based on experiments and analyses, external flooding of the vessel can cause the core debris to be retained within the lower vessel plenum. This action also has the benefits of protecting the containment, creating a heat removal path from the core debris, stopping the accident progression through the prevention of vessel failure, and preventing all ex-vessel phenonsena from occurring.

However, if the core is ex-vessel or if vessel failure is imminent, the injection of water into the containment has other benefits. The presence of water in the cavity will scrub fission product inventory, and will prevent or limit core / concrete interaction (CCI). CCI is the

. phenomena of core debris attacking the concrete basemat if there is insufficient water in the containment cavity to cool the debris. The consequences of CCI include the generation of non-condensable gases that will pressurize the containment, the generation of combustible gases that can ignite and fail the containment, the generation of a significant amount of aerosols, and the eventual failure of the containment boundary due to basemat or liner melt-through.

High Level Actions for AP600 Revmon 3, January 1998 oM0 2w.wpf;1b-011498

1 5-7 i

Injectmg water into the containment to a level that covers the RCS loops is a viable action for? -l

~

-- the AP600 design and automatically occurs if all in-containment water sources are directed - l Into the containment cavity. For core damage events resdting from a large LOLA, this - j

containment water level will ensure that water gets into the reactor vessel.' For non-LOCA" d events, this water level protects RCS loops from creep failure and cooks gases to help prevent

steam generator tube creep rupture, j

'!here are very few negative considerations of injecting water into the containment cavity. In t

the WOG SAMG, three negative impacts are identified, which are 1) de-inerting the ,

containment if the sprays are used,2) using the water inventory in the RWST that may be needed for other actions, and 3) pressurizing the containment to the point that gravity drain i of the RWST would not be possible. For AP600, none of these negative impacts apply. The

' AP600 containment design does not include any internal containment sprays. There are also l

.~no competing uses for the IRWST water although draining the IRWST_ to the reactor cavity may' impact the capability to use NRHR for core cooling. And if the method of containment 1 injection is gravity drain of the IRWST, the flow rate is high and is possible regardless of '

containment pressure. 'Ihis is because the IRWST is intemal to the containment and gravity -

i drain would not be impacted by containment pressure.

One of the severe accident management insights from the AP600 PRA is that the total amount of hydrogen generated during some severe accident sequences is a strong function of the time / level for containment flooding. Thus, one of the negative impacts of flooding the  :

containment to a level where water can flow from the containment into the RCS, may be the

. generation of additional hydrogen.

J

- Another potential negative impact that was discussed in the WOG SAMG and is also

- applicable to AP600 is the potential for an ex-vessel steam explosion if the vessel fails. A - '

steam explosion could result in the destruction of the reactor cavity walls which provide support for the reactor vessel. If a steam explosion destroys the reactor vessel supporta, the

~

r ' containment fission product boundary may be challenged due to tearing of containment >

C

- penetrations connected to the RCS as the reactor vessel drops to.the reactor cavity floor.  ;

Evaluations of the AP600 reactor cavity wall stnictural capability nported in Ref. 4 concludes .

that steam explosions in the reactor cavity'do not pose a challenge to the containm-nt fission

~

. product boundaries. .While cavity walls may not withstand the effects of a severe steam

explosion the evaluations indicate that there will be no impact on containment integrity.

E 5.3 ' INJECT INTO STEAM GENERATORS In conventional plants, the steam generators are designed to provide a heat. sink for the RCS k Dduring both normal and accident conditionsc Therefore, in the WOG SAMG, injecting into

,the steam generators was judged to be one of the most important activities. In the AP600 --

% . plant, although the steam generators are dedgned for heat removal during normal operation, High Level Actions for AP600 - Revision 3, January 1998 ot\4022w.wptib.011496 l aa,e,- n-a ,, m y n p ,p+,gry.-wm-3 -, -n, 4 x uw--- - - ,,

5-8.

they are not a safety-related method of decay heat removal during an accident. However, injecting into the steam generators is still an important high level action for the management of a severe accident in the AP600 plant.

Because much of the secondary side is located outside of containment, the SG tubes act as a containment boundary. Therefore, the prevention of induced steam generator tube ruptures is important for severe accident management. One of the methods of doing this is to injet water into the steam generator to keep the tubes cooled. This protects them from rupturing due to heatup from hot gases on the primary side of the tubes. Nevertheless, if a tube rupture does occur, covering the break with water will scrub fission products from the primary system following core damage.

Also, although the AP600 steam generators are not a safety-related method for removing decay heat, they may still be useful for this function during a severe accident. Not only may the heat removal be of benefit, but the steam generators may be a method for depressurizing the RCS.

However, there are also several drawbacks associated with injecting water into the steam generators. These drawbacks have the potential to negatively impact the accident progression by allowing the direct release of fission products to the environment. The first concem is the thermal shwk of the steam generators. If the steam generators have dried out during a severe accident, the tube temperatures may exceed 1000'F. The injection of cold water to the hot, dry steam generators can place significant thermal stresses on the tubes and other components. These thermal strem can result in the failure of either the shell side of the skam generator or the steam genert. Nbes. Failure of the shell side of a steam generator during a severe accident reducea ue amount of water that can enter the steam generator and increases flooding of the containment. Also, failure of the shell side of the steam generator can result in a direct release path to the atmosphere if the steam generator relief / safety valves are not closed or the MSIV is open. Failure of one or more tubes will result in a containment bypass and the potential release of fission products to the environment.

Another potential concern with the injection of water into the steam generators can occur if the steam generators must first be depressurized. If the RCS is pressurized, the depressurization of the steam generators could create a large primary-to-secondary AP that could induce creep rupture of the steam generator tubes. Either this induced tube rupture, or pre-existing tube ruptures, would then make fission product releases to the environment a concem. These potential negative impacts must be considered in the evaluation process that determines whether steam generator injection should be attempted.

Equipment that may be used for this high level action is dependent on the pressure of the steam generators. For high pressures, only the startup feedwater pumps and the main High Level Actions for AP600 Revision 3. January 1998 oA4022w.wpf;1t>.Oll498

4L- A E = - - 4 j pJ .d-- JE- %bJ 94 4 --.HP-a# s. A .N h 8.aA.L.J 3 4r 4$4a.. eJS ,aeR 4 &- L_4o--w e e

&hc3- Saw +_ m. .x _

. 5-9:  ;

feedwater pumps would be _ usable.: For lower pressures, the list of possible' equipment - _

i

- expands to indude condensate pumps l firewater pumps and service water pumps. - .

5.41 L DEPRESSUR.IZE RCS ,

l

/

Many benefits can be realized by depressurizing the RCS during a severe accident.'

• As  ;

previously discussed in Section 5.1, the depressurization of the RCS will facilitate the .

. injection of water from the passive core cooling system tanks. It will also increase the [

' flowrate that would be provided if pumps are being used. If the ADS valves are used, th creation of the intentional opening in the RCS may be the method of establishing a long term heat removal path.

There are also many other effects of depressurizing the RCS that are unique to core damage ,

scenarios.' The possibility of creep rupture of the steam generator tubes and the RCS pipes can be reduced or eliminated if the RCS pressure is lowered. Creep rupture is a plastic :

j deformation process that occurs under high temperatures and sustained loads. Since high temperatures are a by-product of the severe accident, the reduction of the RCS pressure is a good method to avoid failures due to creep rupture.

Another important severe accident concem is high pressure melt ejection (HPME). This is a ,

phenomenon that may occur if the RCS pressure is elevated at the time of vessel failure.  :

During HPME, the momentum of the core debris along with the driving force of high velocity gases released from the vessel, can transport the molten core debris away from the  :

reactor cavity region. One method of preventing this phenomenon is to decrease the RCS

. pressure.

i Decreasing the RCS pressure also can help isolate the containment and reduce fission product releases for containrsent bypass sequences. If there are ruptures or leaks in the steam

. generator tubes, the reduction' of the RCS pressure will reduce the driving force on the fission .

-. products, and will help to maintain them within the primary system. In' addition, if injection of water occurs due to the reduction in RCS pressure, the water inventory will help to scrub the fission products.

. The final benefit of reducing the RCS pressure is for long term control of the hydrogen -

inventory.1In order to exit the severe accident management guidance, the containment must ,

~ be in a controlled, stable state. Part of the definition of this state is that there should be noi

potential for sudden, future shanges to the containment atmosphere. If the RCS remains '

4 pressurized with hydrogen accumulated within the system, any future failure of the vessel or'

~

l opening in the RCS would release the hydrogen to the containment atmosphere. Therefore,

) the RCS pressure should be reduced for long term concems. ,

5 s High level Actions for AP600 x Remion 3, knuary 1998

" o:\4022w.wpf.lb.011498 (-

g-h- < + ,ey r-- .w-e --v  % k.--, n -p ,  % wp 9

1 5-10 l

However, the long term benefit of hydrogen control also produces a short term negative impact. If the RCS is depressurized using a vent path to the containment, the sudden release of a large quantity of hydrogen to the containment could change the flammability status of

. the containment atmosphere. Although AP600 analyses have shown that the containment structure can withstand the resulting pressure transient, the plant decision-makers should be aware of the potential of the bum. The method of depressurizing the RCS can influence the potential negative impacts. Depressurizing the RCS using a flow path to the IRWST could result in a diffusion flame at the IRWST vents to containment. While the AP600 PRA has concluded that diffusion flames will not impact containment integrity, the diffusion flame still represents a slightly increased challenge to containment integrity since not all possible severe accident scenarios were treated in the PRA. Also with the opening of a pathway from the RCS to the containment, there could be a sudden increase in the containment pressure.

This prersure increase is not of sufficient magnitude to challenge the containment integrity.

The safety grade system for depressurizing the RCS is the Automatic Depressurization System (ADS). This system is a series of valves arranged in four stages, which provide a phased depressurization capability. The valves of the first three stages are motor-operated valves and are mounted on the pressurizer. These valves discharge steam to the IRWST through spargers. The discharged steam is condensed and cooled by mixing it with water in the tank. The valves of the fourth stage are squib valves and are located on lines connected to the two hot leg pipes. The fourth stage vents directly to containment.

Other equipment for depressurizing the RCS that will be investigated are the pressurizer spray, the RCS head vent, and CVS letdown. Another method is to depressurize the RCS via heat removal from the steam generators. The equipment associated with this action will be

- addressed in the following section.

5.5 DEPRESSURIZE STEAM GENERATORS The purposes of this high level action have been discussed in Sections 5.3 and 5.4.

Depressurizing the steam generators may be the first step to enable injection of water into the SGs, to establish a heat transfer path from the RCS to the SGs, or to depressurize the RCS.

The end purpose of this action may be the depressurization of the RCS, or the establishment of a long term decay heat removal pathway.

. The principal negative impacts from depressurizing the steam generators are related to the potential for creating a release pathway. Not only might the steam generator inventory be lessened, but any fission products w; thin the steam generators may be released to the erwironment. Furthermore, if there is a steam generator tube rupture, the lower steam generator pressure will increase the driving force of fission products from the primary to the secondary side. Even if no steam generator tube ruptures currently exist, the lowering of the steam generator pressure could increase the AP across the steam geneator tubes, inducing a High Level Actions for AP600 Revision 3, January 1998 oA4022w.wpf-1M11498

- , - - . , _ - . . - . - . . , . . ~ . .- - . - ,

5-11  :

rupture or increasing leakage of fission products from the RCS through leaking steam i .l l generator tubes.-

- The two principal methods of depressurizing the steam generators are_ opening the SG power j operated relief valves which discharge directly to environment or opening the steam dump J valves which discharge to the main condenser. There are no known differences in the AP600 f design, when compared to existing Westinghouse PWR plants, that would impact the equipment to perform this high level action.'

5.6- DEPRESSURIZE CONTAINMENTL

. . .. )

During a severe accident it is likely that the containment will experience a substantial increase in pressure. Unless the RCS is intact, and the steam generators or the NRHR is

being used for heat removal, all of the energy generated during the accident must ultimately-be removed through the containment. Until the energy is effectively removed, the Econtainment will pressurize. Therefore, one of the high level actions for severe accident -

' management is'to effectively remove heat from the containment which will,- in turn, depressurize the containment.- l There are several benefits to depressurizing the containment. -The fundamental benefit, as .

. mentioned above, is the ultimate heat removal from the core, which is needed to conclude '

- that the plant is in a controlled, stable state. However, depressurizing the containment might also be needed for immediate concerns. If overpressurization threatens the integrity of the containment, depressurization would be meded to address this severe challenge. Also, depressurization may be the method of reducing or eliminating fission product releases from

, the containment. Reducing the AP from the containtnent to the em*ironment reduces the

' driving force behind the fission product leakage. .nother benefit of depressurizing the -

containment is the general improvement of the containment atmosphere to alleviate potential .

equipment and. instrumentation challenges. Finally, depressurizing the containment by condensing steam will increase water in the IRWST and containment for ex-vessel core debris cooling and flooding of the reactor pressure vessel and RCS loops.

The potential negative impact from depressurizing the contamment *.s that with the 1 condensation of steam from the containment atmosphere, the hydrogen becomes a larger

fraction of the overall containment atmosphere. The higher hydrogen fraction may lead to a i flammable state inside the containment. If the hydrogen was previously inflammable'at the

higher pressure due to the presence of steam, and if it becomes flammable due to the -

condensation of steam, this process is known as de-inerting. .However, this' concern ~is not ianticipated for AP600 due to the existence of hydrogen igniters. Nevertheless,if the igniters i

wem not functioning properly and significant hydrogen accumulated, the contairunent could

,_ -belde-inerted by depressurization. Thus, the containment boundary could be challenged.

High Level Actions for AP600 Reymion 3, January 1998

oA4022w.wpt

1b-011496 y _ ,

i 5-12 I

The AP600 passive safety-related containment cooling is provided by a water tank that allows a gravity fed flow onto the oatside of the containment dome surface, with sufficient water for three days. After several days, the design basis is for heat removal by replenishment of the PCCS tank water inventory. This would permit the enhanced contalrunent cooling for longer periods of time which would result in lower containment pressures compared to convective air flow alone. It is also important to ensure that the drains at the bottom of the annulus are open to prevent water from accumulating which .

could block or reduce the heat removal capability of the convective air flow. Them are also two fan cooler units inside containment that were designed for normal operation heat loads.

Although their heat removal capability is low in comparison to accident heat loads, they could be used to augment the passive cooling and further reduce containment pressure. The use of the fan coolers can also increase fission product removal in the containment as steam laden fission products condense on the fan cooler coils.

. 5.7 PRESSURIZE CONTAINMENT This high level action addresses two very different concems. The first concern is to

- pressurize the containment to create a steam inert atmosphere that would prevent a hydrogen burn. As discussed in the previous section, the presence of a sufficient quantity of steam in the containment atmosphere can ensure that the hydrogen is not flammable, and thus the containment is " inert." However, pressurizing the containment to create an inert containment atmosphere is only a temporary solution. The passive features of the AP600 containment cooling system will also be working to condense steam, and the removal of the hydrogen will eventually be needed.

On the other end of the spectrum, the high level action of pressurizing the containment is to prevent a vacuum failure of the containment due to too low of a pressure. The threat of a containment vacuum could be created by previous containment venting, delayed containment isolation, or hydrogen burns that have substantially reduced the oxygen in the containment atmosphere.

The methods suggested in the WOG SAMG to accomplish these actions focus on turning off the containment heat sinks. For AP600 the gravity drain of the water over the outside of the containment sixil may be terminated, which will lessen the heat transfer. Another pressurization method in the WOG SAMG is to open a pressurizer power-operated relief valve,if the RCS is still intact, to release steam into the containment. This method is also available for the AP600 plant via the 4th stage ADS valves. In addition, the IRWST, if it is being used via the PRHR system, steams directly to the containment.

If containment pressurization is being performed to prevent a containment vacuum, another option is to introduce instrument air into the containment. However, the negative impacts of 4

High Level Actions for AP600 Rmsion 3. knu2ry 1998 o;\4022w.wpf:lt411498

, 5-13 i

this action are that there will be more oxygen that could be used in a hydrogen bum, and the possible failure to isolate the path being used for pressurization.

5.8 BURN IIYDROGEN I The AP600 design includes hydrogen igniters to bum hydrogen as it is produced, thereby I preventing the accumulation of flammable mixtures of hydrogen in the containment. For I accident scenarios in which the normal ac power supply for the hydrogen igniters (non-I safety-related onsite ac power) is not available, the igniters can be powered from other I sources including offsite ac power, onsite non-essential diesel generators, or non-Class 1E I batteries via de-to ac inverters.

If hydrogen igniters are not functiening properly, it may be desirable to intentionally bum the hydrogen using other methods to create the initial spark. If the containment atmosphere is flammable, it is possible that an immediate smaller burn may be preferable to a larger burn later. Since the AP600 containment is capable of withstanding a hydrogen bum from all the fuel cladding being oxidized, this action may only become a factor when CCI is believed to be a potential concem. The negative impact would be a brief temperature and pressure spike in the containment. The methods that may be successful at ceating the needed spark will be investigated during a later phase of the development of AP600 severe accident management I guidance. One of the options is to use altemate power sources to the hydrogen igniters, I which are identified above.

5.9 VENT CONTAINMENT Venting the containment is the last high level action to be addressed since the negative impacts from implementing this action are relatively certain. However, there are two strategies that consider this action as a method of achieving the long term goals of severe accident management. The first reason to consider venting is if the containment pressure has increased to the point that failure of the containment pressure boundary is expected. If the accident sequence has resulted in more severe containment conditions than anticipated, and if the heat sinks have not functioned as expected, there could be a need to consider the intentional venting of the containment. This would result in a release of fission products to the environment. But a short term release from which control can be regained may be preferable to a large release as a result of the failure of the containment structure.

Another reason to consider venting is as a hydrogen control measure in the containment. If hydrogen igniters have not functioned properly, and if core / concrete interaction has contributed to the hydrogen inventory, the containment integrity may be threatened by the potential for a hydrogen barn. Less drastic hydrogen control measures include inducing a hydrogen burn while the concentration is low enough that the possibility of containment failure can be precluded (Section 5.8) and pressurizing the containment to create an inert High Level Actions for Al%00 Revuum 3, January 1998 oA4022w wpf.lb-011498 l

5-14 atmosphere (Section S.7). However, the latter option is only a temporary solution, and it may be too late to implement the former option. Therefore, containment venting is also an action that may be considered as a method of hydrogen control. Note that venting the containment does not reduce the flammability of the containment atmosphere, however, it reduces the j impact of a hydrogen burn. This is because the containment pressure rise when a flammable hydrogen mixture is burned in containment is a direct function of the mass of hydrogen j present in the containment. Therefore, reducing the hydrogen mass will reduce the amount  !

of energy released in a burn. The hydrogen can be reduced, through venting, to the point that there is not enough energy to fail the containment. j The main negative impact of venting the containment is obviously the radiological release of fission products to the environment. Ideally, this release would be relatively small.

However, there is also the possibility that the vent pathway cannot be re-isolated. In addition, the release of non-condensable gases during the venting leads to the potential for a future challenge of the containment pressure boundary due to a containment vacuum. If non-condensable gases are released containment isolation is re-established, and steam condenses from the atmosphere, the resulting containment vacuum could be severe enough to fall the pressure boundary due to a compressive load. The methods that may be used to vent the AP600 containment will be investigated during a later phase of the development of the severe accident management guidance.

I One method of containment venting has been identified for the AP600 design that has I sufficient capacity to prevent a challenge to containment integrity due to overpressurization I from noncondensible gases genciated during core / concrete interactions. The pathway, as I identified in Table 50-29 of the PRA, is from the containment to the RCS via either the reactor i vessel breach or the Stage 4 ADS valves; and then from the RCS to the atmosphere via the i RNS suction lines to the spent fuel pool.

I i The development of containment venting criteria and related actions for the AP600 severe I accident management guidance should be carefully chosen to mirumize the release of I radioactivity to the atmosphere. It should be noted that analyses in Appendix B of the I AP600 PRA show that containment venting is not expected to be required to prevent a I containment overpressure challenge due to noncondensible gases from core / concrete I interactions. Even in the bounding case, containment basemat failure would occur prior to I containment pressurization. If venting were judged to be necessary, the use of ADS Stage 4 I valves, in combination with the RNS suction line, may help to mimmize the release of I radioactivity to the atmosphere. 'Ihis is because ADS Stage 4 and RNS suction lines are both I connected to the hot leg, thereby bypassing the reactor vessel where large quantities of I fission product aerosols may be deposited on surfaces. Also, maxinuzing the spent fuel pool I level will enhance scrubbing of fission products prior to release to the atmosphere.

High Level Actions for AP600 Revision 3, January 1998 o:\4022w.wphlb-011498

- _. - ~ . - .

5 15 5.10 MmGATE FISSION PRODUCT RELEASES:

1In addition to the other severe accident management activities aimed at establishing or c maintaining a controlledistable core and containment state, there are several actions that can

- be taken solely for the purpose of controlling fission product releases from the plant after icore damage has occurred. The actions are dependent on the release pathway.

in the event'of leaking or ruptured steam generator tubes, fission products from the reactor

, coolant system may be released to the steam generator secondary side and subsequently to -

. the atmosphere. If the steam generator is open to the atmosphere (e.g., open relief valves or -

' MSIV), the releases can be mitigated by isolating the release pathway. If isolation of the--

- pathway is not possible or is not desired due to other severe accident management objectives, the relear,es may be reduced by either providing a large inventory of water in the steam (generator for scrubbing or by reducing the primary-to-secondary pressure differential.

-If the release pathway is from the containment the most obvious action is to isolate the release pathway. If isolation cannot be accomplished or the source is containment leakage, that is unisolatable, there are several actions that can be taken. Depressurization of the containment would decrease the driving force for the releases and would be effective if the leakage pathway is not in a " choked flow" regime. Other actions that can be taken islude use of the nonsafety-related containment spray system or the fan coolers to enhance fission

L

product removal from the containment atmosphere and limiting the reactor coolant depressurization to keep the fission products inside the reactor coolant system. Depending Eon the location of the release pathway, it may also be possible to flood the containment to a level that stops the leakage from the containment vapor space.

- Release pathways from the auxiliary building are not likely in the AP600 design since all of the emergency fluid systems are completely contained in the containment building.

However, if a release pathway from the auxiliary building can be identified, the most likely source would be from lines dimetly connected to the reactor coolant system. In this case, the most direct means of stopping the releases is to isolate the source. If this is either not

. possible or not ' desirable, then a reduction in the reactor coolant system pressure would bs -

effective in reducing the fission product releases.

15.111

SUMMARY

L

- Table 5-2 provides' a summary of the high level severe accident management strategies for.

ithe AP600 plant design. These high level strategies should be considered in the development of the AP600 Severe Accident Management Guidance by the COL applicant.-

i

) \

l s -

High 1.evel Actions for AP600 - s Revision 3, January 1998 -

(oM022w.wpf.1441H96 ?

/-

$6

5-16 Table 5-2 Summary of High Level Severe Accident Management Strategies for AP600 Other Purpose Considerations Action (Positive Impacts) (Negatiu Impacts) Equipment inject into RCS

• To restore core coohng e Creation of hydrogen

• CMT (unmediate and long term)

• Creep rupture of SC tubes

• Accumulators

+ To scrub fassion products

• IRWST

• To prevent, or delay, vessel

• NRHR failure

• CVS Inject into e Create inventory in sump

• Ex-vessel steam explosions

• Gravity Drain of IRWST Contatninent for recircuiation

• Spent Fuel System e Submerge lower head of injection into refuehng RPV to prevent failure cavity

. Cool core debris e Prevent /lunit CCl Prevent basemat melt-through

- Reduce flammable gas produ:tioit

• Prevent HPME e Reduce hasion product inventory Inget into SGs . Heat Sink

• Thermal stock of SC High Pressure:

• Cover SC tubes to prevent tubes Mam RV creep rupture

• F.P. release n ... leaking - Startup DV e Scrub fission products tubes low Pressure:

• To make SCs available to e Creep rupture ( SG - Condensate depressurtze RCS tubes (if SG is hrst Firewater depressurized, creatmg Service Water latye AP)

Depressunze RCS

• To facihtate injection into

• Short term hydrogen

• ADS

'he RCS release and burn

• Auxihar) Pressuruer

+ To estabhsh long term + Containment Spray heat transfer path pressurization e Head Vent

. To prevent HPME = CVS Letdown

• Prevent creep rupture e via SGs

• Isolate containment due to SG tube leaks

. Long term hydrogen control e Reduce fission product inventory Depressurize SGs . To facihtate injection into + Loss of SG inventory . SC PORY SGs

• SG hssion product

• Steam Dump

• To create heat transfer releases path with RCS . Creep rupture of SG

= Depressurue RCS tubes if large AP is created.

Depressurize . Prevent overpressunzation + Hydrogen flammabihty

• PCCS Containment

• Mitigate containment

• Containment vacuum if . Fan Coolers fission product leakage ventmg

• Vents

. Alleviate equipment and instrumenation challenges due to harsh conditions High Levei' Actions for AP600 Revision 3, January 1998 oA4022w.wpf:1b Cll498

5-17 Ta5le a 52 Summary of High Level Severe Accident Management Strategies for AP600 (Continued) m Other Purpose Considerations Action (Positive impacts) (Negative impacts) Equirment Pressurize

• To create inert atmosphere

• Removal of hydrogen will

• Tuming off containment Contamment so that hydrogen cannot eventually be needed heat smLs:

bum e More oxygen for hydrogen Fan Coolers

• To prevent containment burn - Stop water flow over vacuum from falhng

• Possible failure to isolate containment extenor containment structure pathway used for pressunzation Intentionally bum

• Let hydrogen burn while

• Pressure and temperature

• Alternate power source hydrogen containtnent failure is not a spike for hydrogen igniters nsk; to prevent future containment challenge.

I Vent Containment

• To avoid containment

• Radiological releases

• RNS suction hne imm l failure due to:

• Potentiel future concerns RCS to spent fuel pool e

Overrressurization with containment failmg (with ADS valves or other

! Hydrogen Burn from sub-atmosphenc opening between the RCS l loads and contamment)

• No guarantee that vent pathway will be able t .

reclose.

Mitigate Fission

• To reduce releases of fusior-

• Hydrogen burn

• Contamment fan coolers Product Releaw products to atmosphere

• Containment flooding

• Containment spray

. Hydrogen buildup in lower compartments High Level Actions for AP600 Revision 3, January 1998 o;\4022w.wpf.1b-011498

.- }

1 16' LCONCLUSION-  ;

~ As' described in the response to RAI 480.212, the COL applicant is responsible for developing-l a severe accident management plan for the AP600. This severe accident management plan l

should,' as a minimum, meet the requirements of the Nuclear Energy Institute's Severe 1 Accident Issue Closure as described in Section 5.0 of NEI 9104, Revision 1 As further-described in the response to RAI 480.439, the COL applicant's severe accident management.

guidance should be based on the framework for severe accident management described in

• this report, the AP600 PRA and the severe accident management insights derived from'the- i AP600 PRA as discussed in Appendix A to this report.

t

(

S i _-

i' Conclusions Revision 3, January 1998 <

a\4022w'wp61b411496 :

[ _:

,-,e ,,

7-1 71 REFERENCES

1) Westinghouse Owner's Group Severe Accident Management Guidance, June 199_4.

2) AF600 Standard Safety Analysis Report, Section 18.9.8.1, " Development of the Emergency Operating Procedures" ,

3):

• Westinghouse Owners Group Emergency Response Guidelines, Revision la, September 1983.

'4). AP600 Probabilistic Risk Assessment, Revision 8, September,1996. [

5) Staff Pisns for Accident Management Regulatory and Research Programs, U.S.

Nuclear Regulatory Commission, SECY-89-012, January 18,1989.

- 6) Interration Plan for Closure of Severe Accident Issues, U.S. Nuclear Regulatory Commission, SECY-88-147, May 25,1988.

7) Individual Plant Examinati_on for Severe Accident Vulnerabilities - 10 CFR 50.54M, U.S. Nuclear Regulatory Commission, Generic Letter 88-20, November 23,1988.

8) Severe Accident Issue Closure Guidelines, Nuclear Energy Institute, NEI 91-04, Rev.1, December 1994.

9) NP-6780-L, Advanced Light Water Reactor U*ility Requirements Document, Volume III (ALWR Passive Plant), Chapter 1, "Overall Requirements,"

paragraph 2.3.3.9 10)- NRC Project No. 669, " Issuance of Final Safety Evaluation Report (FSER) on the-

- Electric Power Research Institute (EPRI) Requirements Document for Passive Plant Designs," from R. W. Borchardt, Office of Nuclear Reactor Regulation, August 31,1993.

11) EPRI TR-101869, Severe Accident Management Guidance Technical Basis Report, t Volume 2. Appendix K, " Debris Transport to the Lower Plenum."

12) ' EPRI TR 101869,-Severe Accident Management Guidance Technical Basis Report, Volume 2. Appendix BB, " Potential for Criticality of the Core Material Under

Recovery From Severe Accident Conditions."

References ,. . Revision 3. January 1996 (a\4022w.wpf;1b 011496

.y s

i P

73-l l

13) WCAP-13388 (Proprietary) and WCAP 13389 (Non Proprietary), AP600 i Phenomenological Evaluation Sunynaries.

14) EPRI TR 101869, Severe Accident Manazement Guidance Tec nical Basis Report,  !

Volume 2 Appendix L," External Cooling of the RPV with Debris in the Lower  !

Plenum."  !

15) EPRI TR 101869, Severe Accident Mananement Guidance Technical Basis Report, t 3

Volume 2, Appendix 0," Steam Explosions." ,

l

- 16) EPRI TR-101869, Severe Accident Manaxement Guidance Technical Basis Report, }

Volunw 2, Appendix U, " Water Ch'erlying Cor.. Debris." l

17) Str.tus of implementation Plan for Closure of Severe Arcident Issues, Statur. of IPEs, l and Status of Severe Accident Research, U.S. Nuclear Regulatory Commission, {

January 4,1995. .

i l 4 i 1

I f

I F

r r

4 I

O' Y

Refennces h6on 3, January 1998. i a\4022w.wpl.1b 011496 I

(

, . . .-,__a---._......__-. .,_,.u...._.__..,_._-.,_._...___..._._,._.___._._

A1 APPENDIX A AP600 SEVERE ACCIDENT MANAGEMENT INSIGHTS This appendix contains a brief description of the severe accident management insights identified from the AP600 PRA that are significantly different from those for conventional plants. Each of the insights is described in relation to the principle issue or objective of the severe accident management strategy.

ADS Valves Iilydecycn Usffusim Tlames Opening the Stage 2 and 3 ADS valves to the IRWST after core damage has occurred can result in a situation where the hydrogen generated in vessel is transported to the IRWST and then to the containment through the IRWST vents. When the hydrogen exits the IRWST vents, a standing diffusion flame may be created if an ignition source (e.g., the hydrogen igidters)is available. The amount of hydrogen flowing through the Stage 2 and 3 valves can be significantly reduced if the Stage 4 valves are also used. The standing diffusion flame can radiantly heat any structures within sight of the standing flame. It has been postulated that a standing diffusion flame at the exit of the IRWST vent could threaten containment integrity.

Ilowever, detailed studies documented in the AP600 PRA [Ref. 4] for a wide range of accident sequences in which just the Stage 2 and 3 ADS valves were used indicates that containment integrity should not be challenged by this mode, liowever, not all accident sequences with a range of accident management activities were evaluated in the AP600 PRA. Thus, the development of the AP600 severe accident management guidance needs to consider the possible inclusion of a caution on leaving the ADS valves to the IRWST in an open position during the period of time where significant hydrogen generation is occurrirr On the negative side of the issue, regarding use of the ADS valves for RCS depressurization, is the ability to depressurize the RCS using only the Stage 4 ADS valves. Based on the analyses documented in the AP600 PRA, the use of only the Stage 4 ADS valves may, in some cases, lead to issues related to the effectiveness of long term core cooling. In this case, the additional relief area provided by the Stage 2 and 3 ADS valves is required to maintain the RCS at a low enough pressure.

In-Vessel Retentim cf Ccre Debris / Rextor Cavity Floating A substantial amount of experimental and analytical work has been performed to support the hypotheals that the core debris can be maintained within the reactor vessel if the reactor cavity can be initially flooded to an elevation higher than the level of core debris in the Appendix A Revake 3, January 1998 ct\4022w.wpf It> 011498

A2 reactor vessel AND if *he reactor coolant system can be depressurized. The experimental and analytical evidence show that sufficient heat transfer occurs between the core debris, the reactor vessel walls and the water t.: the outside of the walls to naintain the temperature of the reactor vesuel walls below the point where melt-through or creep failure of the vessel is physically possible. The AP600 PRA shows that for most severe accident sequences, the reactor cavity is passively flooded to, or above, the reactor vessel nozzle elevation as a result of the severe accident sequence progression. Only in the cases where draining of the IRWST fails does the potential exist for the reactor cavity to be dry or partially flooded. The i.evel 2 PRA, Revistori 8, assumes that guidance will be available in the Emergency Response Guidelines (ERGS) for FR-C.1, " Response to inadequate Core Cooling" to initiate manual flooding of the reactor cavity from the IRWST if the core exit thermocouple temperatures cannot be reduced using the strategies suggested in that guideline. The placement of the manual cavity flooding initiation in the AP600 ERGS was necemary in order to assure that the cavity would be flooded to the appropriate level prior to the first downward relocation of core material inside the reactor vessel. The rate at which the IRWST could drain into the reactor cavity, assuming only gravity, required a lead time for initiation that is prior to the time at which transition to the SAMG might occur.

In the longer term, to prevent reactor vessel failure, it is postulated that the containment water level must be increased to submerge the reactor vessel up to the elevation of the coolant loops. With the entire core in the bopom of the reactor vessel, there might be sufficient heatup of the cylindrical walls of the reactor vessel in the longer term such that the vessel wall temperature might approach the point where creep failure of the reactor vessel could occur. By submerging the entire reactor vessel up to the coolant loop level, the evidence presented in the AP600 PRA shows failure of the reactor vessel is physically unreasonable. If the entire IRWST is drained to the containment, the containment water level should be above the elevation of the loop piping.

l In both cases, the potential for reactor s essel failure is significantly reduced if the reactor coolant system is depressurized to the containment pressure. Reactor coolant depressurization is part of the FRG guidance.

Another advantage of flooding the reactor cavity / containment to slightly above the coolant loop levelis that if a LOCA exists (either as an accident initiator or as an induced LOCA caused by creep failure of RCS piping) this becomes a means to provide water to the core debris inside the reactor vessel. In this case, the reactor coolant system pressure must be reduced to the containment pressure in order for reflood of the in-vessel core debris to be successfully accomplished.

A negttive impact of flooding the containment to the level of the coolant loops was identified for the Direct Vessel Injection (DVI) line break but is also applicable to other scenarios l '

Appen.ilx A Rninon 3. January 1998 n\4022w.wptit411498 l

__ _ ~__ _ _ ,

A3 involving a break in the reactor coolant system. For the particular case analyzed in the AP600 Level 2 PRA, containment flooding reached the DVI line break location after the core ,

was substantially uncovered but before the core began to relocate downward in the reactor j pressure vessel. In this case, the amoura of hydrogen generated was maximized due to the large surface trea of overheated unreacted zircordum that was available.11 the containment water level had reached the DVI line break location either earlier or later in the accident sequences, substantially less hydrogen would be generated. While the AP600 PRA concluded that the hydrogen generation in this case did not pose a challenge to the containment integrity, this case (including other RCS break cases) should be considered further in the development of r.evere accident management guidance.

For the DVI line break case with reflooding of the core through the DVI line break location, AP600 also predicted the potential for diffusion flames in the CMT room. While the AP600 PRA concluded that the creation of these diffusion flames would not challenge containment integrity, this should be considered further in the development of severe accident management guidance.

Even though the PRA assumes that the initiation of cavity flooding and reactor coolant system depressurization is part of the ERGS,it should also be included in the AP600 SAMG since the SAMG should provide another attempt to accomplish actions to bring the plant to a controlled stable state after core overheating has begun when the ERG actions may have failed. The development of the AP600 severe accident management guidance needs to consider both savity flooding to a level above the elevation of the core debris in the reactor vessel te prevent r,hort term reactor vessel failure and cavity floo: ling to the reactor coolant loop level to prevent long term reactor vessel failure. The development of the AP600 SAMG also needs to consider the depressurization of the reactor coolant system to the containment pressure.

Induced Steam Generatw Tube Rupture The AP600 PRA analyses show that the reactor coolant loop layout promotes strong full circuit natural circulation flows after core uncovery if the reactor coolant system pressure is at or near its nominal full power value. If the reactor coolant system pressure is high and the secondary side of the steam generator (s) is dry, the steam generator tubes can heat to a temperature where creep failure of the tubes is possible. In this case,it is postulated that the RCS piping in the vicinity of the reactor vessel nozzles will fail prior to the time that the SG tubes reach the temperature required for creep failure. However, due to uncertainties in the modelling, it is prudent to provide SAMG guidance to take steps to further preclude the possibility of induced tube rupture. These actions are to inject water into the SG secondary side and to depressurize the reactor coolant system.

Appendix A . Renskm 3, Jamary 1998 a \4022w.wpf Itw011498

A-4 ,

Due to the strong natural circulation flows after core uncovery in the AP600 design, extra care must be taken if the SG secondary side must be depressurized to utilize a low pressure source of water injection to the SG secondary side. Depressurization of the steam generator secondary side will increase the stresses on the steam generator tubes and can shorten the time required for creep failure of the tubes to occur. Thus, the development of the AP600 SAMG should consider the necessity for a caution or limitation on steam generator secondary side depressuritation for situations where the reactor coolant system pressure is above the steam generator secondary pressure.

If the reactor coolant system pressure is at or near its nominal full power value, flooding the containment above the level of the reactor coolant loop piping may result in a condition where creep failure of the stcam generator tubes becomes more likely. In this case, the water on the outside of the reactor vessel and the reactor coolant piping may prevent or delay creep failure of those portions of the reactor coolant pressure boundary. If the steam generator secondary side is dry and natural circulation flows remam strong, the steam generator tubes will continue to heat up. Without reactor vessel or reactor coolant pipe creep failure to relieve the reactor coolant system pressure (and the stresses on the steam generator tubes), the steam generator tubes become more susceptible to creep failure. The development of the reactor cavity / containment flooding strategies for the AP600 SAMG should consider a caution or limitation on flooding to the reactor coolant loop level when the reactor coolant system pressure is high and the steam generator secondary side is dry.

The AP600 PRA indicates that most of the accident scenarios in which the RCS is at high pressure at the time of core overheating and downward relocation is a result of a total failure of the instrumentation and control system. Accident management should consider strategies to maintain steam generator tube integrity until the instrumentation and control system functions can be recovered. The priority for verifying and mitigating steam generator tube challenges after instrumentation and control power is recovered should also be considered in the development of the AP600 SAMG.

Hydrogen Igniter Opatim Hydrogen igniters are installed in the AP600 containment to continually burn hydrogen as it is released to the containment, thereby preventing the accumulation of hydrogen to levels that could challenge the integrity of the containment. All of the analyses in the AP600 PRA assume that the igniters either operate successfully for the duration of the accident or, if failed, are failed for the duration of the accident. In the case where the igniters are initially failed, the hydmgen accumulates in the containment and can reach concentration that, if ignited, could challenge the integrity of the containment. If the hydrogen igniters become available and are " turned on" after significant core damage hrs occurred, they could be an ignition source for burning the accumulated hydrogen. The development of the AP600 Appendix A Rms6on 3. January 199s a\4322w.wyllt41149s

A5 severe accident management guidance should address considerations for use of the hydrogen igniters when they are not operating at the time core overheating begins.  ;

1 Considerations for recovery of a failed hydrogen igniter function should include recovery of I the normal ac power supply as well as powering the igniters from other sources induding i offsite ac powstr, onsite non essential diesel generators, or non-Class 1E batteries via de to-ac I inverters.

Pcuive Cmtainment Cwling in the AP600 design, the ultimate heat sink for heat rejection from the containment to the atmosphere is via the containment passive cooling. Ileat is transferred from the vapor inside the containment, through the containment wall to the natural convective air currents on the outside of the containment shell. To enhance the heat removal capability when the core decay heat is high, a passive containment cooling system distributes water, via gravity drain from a tank, over the conta%cnt dome. Under this arrangement, the vapor inride the I containment rises to a tene cua vchere the heat rejection is equal to the heat generation.

In the case where the passive containment cooling water is available, the containment pressure will equilibrate at a level below the design basis pressure for the containment, if the passive cooling water is not available, a higher containment pressure will be established at equilibrium due to the higher containment temperatures required for the same heat rejection rate. The AP600 PRA analysis of the containment performance shows that there may be a minor threat to containment integrity at this higher containment pressure. Ilased on the conservative contairunent fragility curves presented in Section 42 of the AP600 PRA, there is a containment failure probability of about 1.0 E-03 at the predicted peak containment pressure for the case with no PCCS available. The predicted equilibrium pressure is well below the lower bound contairunent failure pressure from the containmer.t fragility curve.

In those cases where no containment failure is predicted to occur, that conclusion is predicated on the assumption that the drains at the bottom of the arumlus outside the primary containment are open. If these drains are not open, the water flowing over the containment dome could accumulate in the bottom of the annulus and block the natural convection eir flow over the outside of the containment shell.

Therefore, the AP600 SAMG should consider that containment failure due to overpressurization is not expected te o cur. The AP600 SAMG should address considerations for assuring that the drains at the bottom of the annulus outside of the primary containment steel shell are open.

Appendix A ReyWon 3, January 1998 oA4022wupf it411498

A6 The AP600 PRA does not provide detailed analyses of the containment performance if the reactor vest,el fails and the core is ex-vessel. If the core is quenched and cooled by water in the reactor cavity, the containment performance should be nearly the same as for the in-vessel core since only decay heat and in vessel chemical heat additions are possible.  !

However, if core concrete interactions generate an additional heat load for the containment and add noncondensible gases to the containment, severe accident management strategies for j diagnosing and dealing with flammable gases and containment pressure that can challenge l the containm mt need to be considered. In general, this is r,everal tens of hours after the i accident initiation and therefore would have a relatively low priority compared to other  ;

severe accident management strategies for AP600. l l

i Water Loners Tram Contsnment in the case where the containment cannot be completely isolated, the ability to successfully accomplish several of the r,cvere accident management strategies may be challenged. For the case where the isolation failure is above the flooded up containm"nt water level, steam would escape to the atmosphere rather than remain in the closed cycle passive containmelit cooling. In this case, the containment water level would gradually decrease. If the isolation failure is below the flooded up containment water level, the water would be directly lost from the containment. In this case, the containment water level may decrease more rapidly, depending on the size of the unisolated breach in the containment.

If the containment water inventory is not replenished at a rate equal to that being lost, the ability to continue accident management strategies is challenged. In particular, the ability to use the PRHR or NRilR from the IRWST would eventually be lost. At some other point in time, the ability to keep the reactor vessel cooled and thereby prevent vessel failure would be lost. Ultimately, the ability to cool any ex vessel core debris would be lost and ablation of the concrete basemat would begin.

Tims, monitoring the containment water level and having the ability to replenish the containment water inventory needs to be addressed in the AP600 SAMG.

I Contsnment Venting I

l Analyses in the PRA show that the containment integrity due to overpressurization will not I be challenged due to:

I.

l.* Steam generated from ex vessel water during in vessel retention

1.

• Steam generated from recovery of the in-vessel core debris with water .

l-. Steam generated following reactor vessel failure where the reactor cavity cannot be

. l~ . flooded to assure in-vessel retention Ap, vih A Revision 3. January 1995

. a\4022w.wpf,1t>411496 .

s ir fr- *r ,w- r- m ,yg vn- =_ g w.. r .. is __ _, ._ ._ __ _ . _ ___.m___._m___ _ _ . , , _ _ _ _ _ _ _ _ _ . _ . _ _.__.,________.____m_.

AJ l

• Severe accident phenomena that are postulated to occur at reactor vessel failure <

1* Steam and noncondensible gas generation from core / concrete interactions i

I To provide an added level of protection against loss of containment integrity, one method of I contalrunent venting has been identified for the AP600 design that has sufficient capacity to I prevent a challenge to containment 'ntegrity due to overpressurization from noncondensible i gases generated during core / concrete interactions. The pathway, as identified in Table S0-29 I of the PRA,is from the containment to the RCS via either the reactor vessel breach or the i Stage 4 ADS valves; and then from the RCS to the atmosphere via the RNS suction lines to I the spent fuel pool.

I I The development of containment venting criteria and related actions for the AP600 severe I accident management guidance should be carefully chosen to minimize the release of I radioactivity to the atmosphere. It should be noted that analyses in Appendix 13 of the I AP600 PRA show that contaltunent venting is not expected to be required to prevent a I containment overpressure challenge due to noncondensible gases from core / concrete I interactions. Even in the bounding case, containment basemat failure would occur prior to I containment overpressurization. If venting were judged to be necessary, the use of ADS I Stage 4 valves, in combination with the RNS suction line, may help to minimize the release of I radioactivity to the atmosphere. This is because ADS Stage 4 and RNS suction lines are both I connected to the hot leg, thereby bypassing the reactor vessel where large quantities of I fission product acrosols may be deposited on surfaces. Also, maximizing the spent fuel pool I level will enhance scrubbing of fission products prior to release to the atmosphere.

Nonsgety-related Cmtainment Spray A nonsafety-related containment spray system is included in the AP600 design. It is clearly stated in Section 6.5 of the AP600 SSAR that the spray system is not to be used until the ,

plant emergency response organization has transitioned to the AP600 Severe Accident Management Guidance and that guidance will be provided in the AP600 SAMG for the initiation and termination of the nonsafety-related containment apray provided by the fire pro . , system.

Evaluations of the impact of containment spray operation have been performed and a number of limitations have been defined as follows:

a The containment spray should not be used until the core exit thermocouples remain above 1200'F and the control room staff has completed the applicable Emergency Response Guidelines and subsequently transitioned to the SAMG.

Appendix A Revision 3, January 1998 n\40:2w wpf.11411598

. - . _ _ . _ _ . -_- = - _ - -

A8

• The use of a containment radiation setpoint for containment spray initiation of 10,000 R/hr or less is not recommended since this is not indicative of a severe accident.

• Intermittent use of the spray is discouraged due to the potential for decreased reliability of the system components.

• The decision for initiation of the containment spray must consider the potential for a i

hydrogen burn due to the de-inerting effect of ti.e spray on the containment flammability.

• The containment spray termination criteria should consist of the following:

- Containment radiation is significantly reduced.

- The volume of fire water pumped into contairment is less than 300,000 gallons such that the containment water level is less than 109'. This precludes excessive flooding of the containment and avoids potential adverse impacts to the containment air mixing flow pattems such that hydrogen buildup in the lower compartments is not a concern.

- 1he measured containment water level is greater than 108'6".

h i m 3.Je w y W 9s

^Pgi ,

B-1 APPENDIX B SAMG RAls AND RESPONSES

1. "" 3 1=4 "8 2

a[E$),rfid.cii4,3

l l

l NRC REQUEST FOR ADDmONAL INFORMATION Illi

• !L I

Revision 1 {a

\

l Ouestion: J SO.p12 Identify and discuss actions that would be required to prevent or mitigate uncontrolled fission product releases after l 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> due to (a) long term non-condensible gas generation. (b) depletion of coolant inventory due to normal leakage and early bypass sequences. (c)1ste containment bypass (temperature-induced SGTR), and (d) depletion of PCSS water inventory, Respor.se:

As discussed in the response to RAI 720.55 and RAI 720.56, Westinghouse has developed a framework and a set of high level strategies for severe accident management. This work is documented in *Franework for AP600 Severe l Accident Management Guidance". WCAP44944rDemnbee4993 13914, revision 1 November 1996, liigh level strategies te diagnose potential fission product release pathways and then to prevent, terminate and/or mitigate those fission product releases are identified and discussed in WCAP4494413914. The high level strategies presented in WCAP439913914 are applicable to all of the items outlined in this question.

Westinghouse believes that the development of the framework for a severe accident management program for the AP600 plant design, including the identification of high level strategies provides a sufficient basis for the development of the detailed AP600 Severe Accident Management Guidance by the COL applicant.

, 480.212(RI) 1

_ _ = . _ - . - - . . .. __ _ - - _. -. -

NRC REOUEST FOR ADDITIONAL INFORMATION -

m.-

l Question 480.439 '

Westinghouse responses to RAls 720.54 and 720.$$ (May 1993) indicated that numerous accident management strategies or related EOP changes would be adopted for AP600, and that additional accident management strategies would be evaluated and integrated into the AP600 accident management plan if found to be effective. WCAP 13913

• Pramework for AP600 Severe Accident Management Guidance"(Dec 1993) was subsequently submitted, but does not provide a complete or carrent accounting of the critical PRA insights and accident management strategies that would need to be further evaluated by a COL applicant as part of their development of an accident management program many of which have been developed or refined subsequent to issuance of the topical report. Examples of the insights or strategies that the COL applicant would need to address as part of their plant-specific implementation of accident management include:

e initiation of reactor vessel cavity floodhg a

use of fan coolers for fission product removal e

use of igniter to control hydrogen

. reclosing of the ADS valves to control hydrogen diffusion flames and fission products ,

a makeup to the containment for long term cooling makeup to the passve containment cooling system (PCS) strategies for reflooding a damaged core which is retained in-vessel a

use of pottable battery chargers to backup batteries

' identification and use of additional supplies of borated water a

strategies to enhance or restore flow through the PCS anralus a

use of a firewater pump for injection into .he steam enerators e

use of existing penetrations to vent containment Furthermore, the response to RAI 720.56 (May 1993) indicates that the completion of the development of the severe accident management guidance for AP600 is part of the man-machine interface specification. However, neither this specification nor a COL action item describing the necessary actions on the part of the COL applicant have been subnutted te, our knowledge. (The March 1996 response to RAI 480.212 indicates that the COL applicant will develop plant-specific severe accident guidance based on WCAP 13913, but WCAP 139) 3 is incomplete as discussed above, and a clear commitment or COL action item has not been provided to assure that thfa will be done).

i 480.439-1 L

NRC REQUEST FOR ADDITIONAL INFORMATION i t Please provide the following additional information to assure that all severe accident insights / strategies to be addressed by the COL appheant are iden6fied and that a process and commitment for performing the necessary plant-specific actions is established:

a) A complete accounting (e g., annotated list) of severe accident insights / strategies that the COL applicant will be responsible for addressing as part of their plant specific implementation of accident mar.agement, b) A description of the scope and objectives of each strategy, includmg whether the strategy is to be incorporated into the Emergency Operating Procedures (EOPs) or the Severe Accident Management Guidance (SAMG), and where in these documents this information is or will be located, and c) A descriphon of the process by which the insights / strategies to be addressed by the COL applicant will be communicated to the COL applicant, and a conesponding COL acuon item addressing this commitment.

Response

Le overall severe accident management philosophy and high level strategies applicable to AP600 are described in WCAP.13914, Revision 1.

• Framework ior AP600 Severe Accider.t Management Guidance," November 1996. The overall philosophy and high level strategies described in the previous version of WCAP.13913 and WCAP-13914 has been reviewed following the completion of ti,e AP600 PRA. De severe accident management insights identified from the AP600 PRA have been incorporated into WCAP 13914, revision 1. Rus, WCAP 13914, revision 1, is a valid basis upon which a COL applicant can develop Severe Accident Management Guidance.

As discussed in WCAP 13914, revision 1. the AP600 Severe Accident Management duidance should be similar in content and structure to the generic Westinghouse Owners Group Severe Accident Management Guidance (WOG SAMG) that forms the basis for Severe Accident Management Guidance at existing plants. The COL applicant should use the generic WOG SAMG and the information in WCAP 13914, 'ncluding the PRA insights described in Appendix A of that WCAP, to develop the AP600 Severe Accident MarWEement Guidance. This process will address the example insights and/or strategies delineated in this RAI. The evaluation of the applicable accident management strategies by the COL applicant will include a determination of the appropriate guidance set (e.g.,

Emergency Response Guidehnes versus Severe Accident Management Guidance) where the stintegy will reside.

Chapter 19 of the AP600 SSAR will include a COL item that commits the Combined License applicants to developing a severe accident management program.

480.439 2 3 Westiflghouse L

NRC REQUEST FOR ADDITIONAL INFORMATION l~ %

Response Revision 1

~

Ouestion 720.55 The unique design of the AP600 may provide a passive method to both present and mitigate severe accidents with a minimum of human intervention. The insights to effective accident management plans can be developed from the success enteria developed from the PRA's assessment of containment performance. Provide a description of Westingbuse's planned use of the AP600 PRA to identify and assess accident management measures.

Response (Revision 1):

Prevention and mitigation of accidents, including severe accidents, have been an integral part of the design process for the AP600. A significant objective in the passive plant design is preventmg accidents from progressing to core damage. Additional features to protect the plant fission product boundaries in the event of a core damage accident have also been included in the AP600 design. The derivations of the design features are diverse; some features are derived from generic severe accident analyses, and others have been derived from AP(00 accident analyses. Specific design features have beer, incorporated into the AP600 plant as a result of generic severe accident phenomenological insights from previous severe accident work. An example of such a design feature is the lower containment layout, which provides for submerging the reactor vessel with a minimum water discharge to containment. There are also accident management features incorporated into the AP600 based on key fmdmgs from the AP600 PRA. Examples of AP600 features from the PRA include manual operation of the reactor coolant depressuriaation system and the passive RHR system upon detection of high core exit temperatures, and manual orcrations to flood the reactor cavity with water from the IRWST if it has not drained automatically into the reactor vessel.

As part of the development of a comprehensive accident management plan for the AP600, a systen.atic review of the Level 1 and Level 2 PRA results is being canied out to identify and documes.* potential accident management insights. These insights relate to the prevention of core damage, mitigation of core damage, protection of fission product boundaries, and mitigation of fission product releaves. Prior to the beginning of the systematic review, guidelines were developed to estabbsh the scope and conduct of the review of the various segments of the PRA.

An existing Westinghouse data base of accident management insights, which were derived from insights identified in a number of PWR IPE studies and from NRC research, is being reviewed for applicability to ti AP600.

Additionally, insights identified and documented during the Westinghouse development of generic severe accident management guidance for the Westinghouse Owners Group (for operating Westinghouse PWRs) will be reviewed for applicability to the AP600. A number of accident management insights have already been ichntified and documented as part of the AP600 severe accident phenomenological evaluations; these are documented in WCAP.

13388.

Based on the insights identified, candidate accident management strategies will be developed. Additional severe accident evaluations and analyses, when appropriate, will be carried out to determine the feasibility and effectiveness of candidate accident management strategies. All candidate accident management strategies will be evaluated by a small team of senior ?RA experts and AP600 designers. Accident management strategies found to be effective will be integrated into the AP600 accident management plan. Initially, the candidate accident management strategies will be used to develep high level severe accident management guidance (see also the response ) Q720.56).

720.55(RI) 1 m....m.-_m m_-.----

NRC REQUEST FOR ADDITIONAL INFORMATION

p Response Revision 1 This approach results in a complete and comprehensive integration of the AP600 PRA and severe accident sensiderabons into the AP600 accident management plan which includes plant design features, symptom based emergency response guidelines, and severe accident management guidance. The development of the AP600 emergency response guidehnes is discussed in the response to Q720.54, and the severe accident management guidance is discussed in more detail in the response to Q720.56. Also, the approa:h takes madmum advantage of the ongoing work in severe accidents by both the industry and the NRC.

PRA Rewsion: NONE 720.55(RI) 2 Westinghouse

NRC REQUEST FOR ADDITIONAL INFORMATION Response Revision 3 Ouestion 720.56 De AP600 PRA does not indicate how the accident management issues discussed by SECY $9-012 will be implemented. Describe Westinghouse's planned approach ior assuring that each of the five elements of accident management defined in SECY 89-012 will be appropriately addressed by the vendor and licensee. Identify the respective responsibih6es of Westinghouse and the licensee for addressing each of the five elements, and any methods and/or guidance that are expected to be used in this process.

Respont.e (Revision 3):

ne AP600 plan for addressing the severe accident management program requirements discussed in SECY 89-012 l ls based on the current efforts by Westinghouse on behalf of the Wesunghouse Owners Group (WOG) to develop l severe accident rnanagement guidance (SAMG) for the cunent generation of operating plants. From the standpoint of potential severe accident phenomena and potential challenges to the plant fission product boundaries, the ANCO response to severe accidents is bounded by that of the current generation of Wesunghouse PWRs. Thus, the engeing Wes6nghouse Owners Group preger :- &m' p generic severe accider.i management guidance has direct applications to the development of AP600 plant severe accident management response guidance. It-esepeeted4 hat j the The respective responsibihties of Westinghouse and the licensee for addressing each of the five elements of SECY 89-012 will4 e+imilar t the :npe::= rap =:iti!in; cf ^: "'=:ingh::: Owner: G:;.;p =d de4.eensees it i: :=: : operatingt **t*-E;I ;CFM4i mic7iMIitie*-arc summarized in the following paragraphs.

ReframewerMor4 hem" am:: seedentia***teme*ste!&= he k ; & :'ap:d =d da:::nentedin-WGAP-4791HPrernetary) =d "lGAP-4414 C:ca ": priataryh--h4ramewerL d :;r:-: N!;dn c d!=;nie ef+evere

= id:" m:= rem *&+equirementer h&ip :d nrweiere40- S: d=i++en4naltent-F;;=n, Sr i=h Se mun b eeeempli h:d in =.. =:!&" m=:gn:::, =d : =r.mry e' panSk v: : gin ft: A N E x v::: = :ih :

==:;= - ' C ph:icn-of f: &v:'epr;" ef ^: x:::: x:i&-: manag: =: guid== fn the-ARE b pr. :

ef f: == m=hinenntesh:: hv:'qr:^: 7:^2ess, l Westinghouse has developed high level accident management guidance for AP600 based on the Westinghouse i Owners Group Severe Accident Management Guidance, and the analyses and results of both the AP600 SSAR and l the AP600 PRA. His high level guidance addresses differences in AP600 severe accident management strategies, l compared to those documented in the WOG S AMG, as well as severe accident management insights identified during l the performance of the AP600 PRA. Dese AP600 high level severe accident management strategies are documented I in WCAP 13914, *Fremework for AP600 Severe Accident Management Guidance *, Revision 1. November 1996.

1 It is the responsibility of the COL applicant to develop the AP600 Severe Accident Management Guidance, based l on the infonnation contained in WCAP-13914.

De accident management issues discussed in SECY 89-012 cover a broad range of accident management activities includ;ng the symptom based emergency operating procedures, and the utility site emergency plan. De severe accident management issues discussed in SECY49-012 must interface with both of these. For the AP600, the interface with the symptom based emergency operating procedures will be similar to the interface for the current generation of operating plants (i.e., the transition from emergency operating procedures to severe accident y g, 720.56(usH

NRC REQUEST FOR ADDITIONAL. INFORMATION Response Revision 3 management guidance). While the site emergency plan is expected to te simphfied for the AP60), the interface between the emergency plan and the severe accident management guidance, on a broad scale, is very similar to that for the current generation of operating plants. Dat is, the severe accident management guidance must fit the emergency response team responsibilities and authorities. includmg the chain of command. While generic sympto:n-based emergency operating guidehnes exist to establish a concise interface, the site emergency plan is developed by each COL applicant, based on specifics ofits emergency response organization and interfaces with federal, state and kcal government agencies. Hus, the severe accident management program for the AP600 cannot totally address the issues discussed in SECY 89 012. Issues, such as overall decision making responsibility and duties and responsibihties of individuals in the emergency response organizatior wd training, are interfaces with the COL applicam site emergency plan that can be addressed only in the combmed license application.

De following is a high level discussion of the method in which Westinghouse will address each of the severe accident management issues discussed la SECY 89-012 for the AP600:

Accident Managernent Procedures his element refers to the consideration of generic accident management strategies identified by the NRC to enhance the ability to cope with the severe accident scenarios that tend to dominate risk in PRAs for the cunent generation of operating plants. Dese strategies have been identified in several NRC reports, including NUREG/CR 5474 and NUREG/CR 5781. De applicability of the strategies identified in NUREG/CR 5474 for AP600is discussed in the response to RAI 720.54, ne applicability of the strategies identified in NUREG/CR 5781 is part of the insights evaluation discussed in the response to RAI 720.55. As discussed in the responses to RAls 720.54 and 720.55, the applicable NRC strategies are funher considered in the development of either genene symptom based emergency operating procedures or generic severe accident management guidance, as appropriate.

Training for Severe Accidents Training is within the scope of the COL applicant emergency plan. Thus, the specific detailr of severe accident management training are in the scope of the combined bcense application.

Accident Management Guidance l Westinghouse will-develop has developed high level generic severe accident management guidance for the AP600 l that provides a framework for meanwAliagnosing plant conditions during a severe accident and a high Icvel set of strater.ies for responding to those plant conditions. De Westinghouse Owners Group severe eccident management I guidance, being-developed for the current operating plants, mil be acd z. c was used as the Lasis for defining the I high level AP600 severe accident management guidance documented in WCAP 13914, Revision 1, From the standpoint of potential severe accident phenomena and challenges to the plant fission product boundaries, the Al%00 l severe accident response is bounded by the current generation of Westinghouse PWRs. De AP600 high level severe l accident management guidance wiheerperate incorporates thore insights from the AP600 PRA and other applicable l sources, as described in the sesponse to RA1720.55, he high level severe accident managemer.1 guidance developed l for the AP600;ft Fedac provies a means for diagnosing challenges to the plant fission praduct boundaries, for respondmg to challenges with appropriate strategies, and for returning the plant to a controlled, rtable condition. The 720,56(R3) 2 Y Westingh0use

NRC REQUEST FOR ADDITIONAL INFORMATION Response Revision 3 l high level severe accident management guidance wlbalwulerefy also identifies potential negative impacts (e.g.,

increased challenge to a fission product boundary) ofimplementing each of the strategies contained in the guidance.

Finallyr 4he-twiir :: nill *4 nta+n-4*fe: .=!: c!=:4 :: 1: ::pected-plant-respn;; der mp!::n n'atson-of-e parteewlar44relegy,-%: ;;;;;; :::i&-' m:n g: :-: g;ihn:: ni!i-ehe+densiy-e4tmi::d ::: of compviation:! cids e****htinit.g :=:: dS4etermet+af4devaluatic :-! Sc gnitude+f+ome<44he+egatwe4m;was-em einied l ni^ : r!:m:::::n-of : gdfee+4rategy, De detailed severe accident management guidance will be developed I by the COL appheant, based on the high level severe accident management strategies documented in WCAP 13914.

Instrumentation ne severe accident management guidance relies upon the diagnosis of challenges to fission product boundaries and l the diagnosis of a controlled, stable state. W::: ngh :::wthdenufyrin4he The AP600 severe accident management l guidance, should identify primary and secondary instrumentation indications for those key parameters needed for dragnosis. His approach is consistent with the approach taken in the Westinghouse Owners Group severe accident management guidelines for current operating plents. Where appropriate, the severe accident management guidance l will should identify methods for inferring the parameters needed for diagnosis from other instrumentation readings.

l During the development of the AP600 severe accident management guidance by the COL applicant, any insights regarding instrumentation (particularly with regard to instrumentation survivability and readout range) will4e i deewmeetceend should be further evaluated.

Decision.htaking Responsibilities llased on information developed during the Westinghouse Owners Group severe accident management guidance program, the decision making responsibilities during a severe accident should not change significantly from those already specified in the utihty site emergency plan for existing plants. De only significant difference introduced by severe accident management guidance is the broader responsibility for the plant technical support staff to provide recommended actions to the control room staff after core damage has occurred. The tools available to the technical support staff for this broader responsibility are the severe accident management guidance derived from the AP600 generic severe accident management guidelines. Considerations related to decision-making responsibilities during an accident, including sesere accidents, are in the scope of the combined license application.

PRA Revision: NONE 720.56(R3) 3 1