ML15198A054

NRR E-mail Capture - (External_Sender) Supplemental Material for Today 2.206 Public Mtg

ML15198A054
Person / Time
Site:	FitzPatrick
Issue date:	06/29/2015
From:	Azulay J Alliance for a Green Economy
To:	Alexander Chereskin Plant Licensing Branch 1
References
Download: ML15198A054 (62)

Text

NRR-PMDAPEm Resource From: Paul Gunter [paul@beyondnuclear.org]

Sent: Monday, June 29, 2015 10:44 AM To: Chereskin, Alexander Cc: Azulay/Jessica; Tim Judson

Subject:

[External_Sender] Supplemental material for today 2.206 public mtg Attachments: fitz_2206_2nd-prb-mtg_FINAL_06292015_pg-statement.doc; hydrogen-generation-safety-report.pdf Follow Up Flag: Follow up Flag Status: Flagged Hi Alex, Please find attached my statement for today meeting with the PRB and the referenced supplemental document.

I can shorten my oral statement to fit the time each of us is allotted See you soon.

Paul Paul Gunter, Director Reactor Oversight Project Beyond Nuclear 6930 Carroll Avenue Suite 400 Takoma Park, MD 20912 Tel. 301 270 2209 www.beyondnuclear.org 1

Hearing Identifier: NRR_PMDA Email Number: 2238 Mail Envelope Properties (CALTCGd=seEOavsAi+4FAhxu8Azn_gaLuiEL4da45Ga7okM=1=A)

Subject:

[External_Sender] Supplemental material for today 2.206 public mtg Sent Date: 6/29/2015 10:43:51 AM Received Date: 6/29/2015 10:43:50 AM From: Paul Gunter Created By: paul@beyondnuclear.org Recipients:

"Azulay/Jessica" <jessica@allianceforagreeneconomy.org>

Tracking Status: None "Tim Judson" <timj@nirs.org>

Tracking Status: None "Chereskin, Alexander" <Alexander.Chereskin@nrc.gov>

Tracking Status: None Post Office: mail.gmail.com Files Size Date & Time MESSAGE 436 6/29/2015 10:43:50 AM fitz_2206_2nd-prb-mtg_FINAL_06292015_pg-statement.doc 61896 hydrogen-generation-safety-report.pdf 1983833 Options Priority: Standard Return Notification: No Reply Requested: No Sensitivity: Normal Expiration Date:

Recipients Received: Follow up

1 Statement of Paul Gunter, Beyond Nuclear Before the U.S. Nuclear Regulatory Commission Emergency Enforcement Petition Review Board Public Meeting As per 10 CFR 2.206 Re: James Fitzpatrick Nuclear Generating Station Docket 050-00333 Monday, June 29, 2015 Good afternoon. My name is Paul Gunter and I represent the Petitioner Beyond Nuclear based in Takoma Park, MD.

Entergys Fitzpatrick nuclear power station in Scriba, New York fits into a historic and disturbing recurring pattern of the nuclear industrys failure to comply with design performance criteria for the GE Mark I boiling water reactor containments licensing basis and the US Nuclear Regulatory Commissions failure as the regulator to require and enforce compliance of the licensing basis.

Fitzpatrick is a GE Mark I boiling water reactor as were the Fukushima Daiichi Units 1 through 5. Units 1, 2 and 3 were at power on March 11, 2011 at the time of the earthquake and tsunami and all experienced severe reactors accidents followed by catastrophic containment failure with widespread and persistent radiological contamination.

Fukushima Daiichi Units 1, 3 and 4 experienced hydrogen explosions.

The Petitioners have requested this second meeting to respond to the NRC Petition Review Boards initial recommendations to reject in part and accept in part while holding in abeyance actions requested in our

2 March 9, 2012 emergency enforcement petition as supplemented on March 13 and March 20, 2012.

The Petition Review Board rejects the Petitioners request that the Fitzpatrick operating license be immediately suspended pending a public hearing on the power reactors continued operation with the substandard and severe accident vulnerable GE Mark I pressure suppression containment. The Power Authority of the State of New York refused to make modifications with the installation of a hardened containment vent line as recommended in NRC Generic Letter 86-16 issued September 1, 1989. Now, post-Fukushima, the current operator, Entergy, continues to rely upon the unmodified, pre-existing, partially hardened, partially non-pressure bearing vent path that if used under accident conditions is highly likely to fail to high pressure steam and non-condensable explosive gases in the auxiliary housing at the Standby Gas Treatment System resulting in a radiological release at ground level.

The Petitioners respond that Generic Letter 89-16 explicitly acknowledges that the continued reliance on such pre-existing capability including non-pressure bearing vent path or duct work jeopardizes the access to vital plant areas and equipment and represents an unnecessary complication that threatens accident management strategies. The Petitioners have asserted that this same unnecessary complication represents an undue public health and safety risk.

3 The PRB rejected the Petitioners request for immediate enforcement action stating that there is no imminent threat to the public health and safety because a sequence of events like the Fukushima accident is unlikely to occur in the United States and continued operation and licensing activities do not pose an immediate threat to public health and safety.

The fact is that there have now been five severe nuclear accidents in the past 36 years demonstrating by observation that the likelihood of severe nuclear accidents in reality is greater than the NRC theoretical and industry promotional models produced since the 1970s. All of the severe accident sequences were unique to one another and unanticipated. This reality places an emphasis on the importance of regulatory enforcement to maintain NRCs purported defense-in-depth philosophy at every level including containment performance criteria for the all-important final barrier protecting the public health and safety from radiological disaster. Chapter 10 of the Code of Federal Regulation Part 50 Appendix A General Design Criterion 16 establishes the minimum requirement for containment design performance as an essentially leak tight containment structure against the uncontrolled release of radioactivity to the environment and to assure that the containment design conditions important to safety are not exceeded for as long as postulated accident conditions require.

The fact that the NRC issued Generic Letter 89-16 to the operator of Fitzpatrick nuclear power station and industry on a voluntary compliance basis deferred its enforcement obligation to maintain

4 licensing agreements for the containment performance criteria. It further deferred its commitment to maintain defense in depth at Fitzpatrick when the operator opted out of installing hardened containment vent, instead relying upon a pre-installed only partially hardened containment vent system. Given that Generic Letter 89-16 was implemented under 10 CFR 50.59, Fitzpatricks as-installed partial containment vent hardware was not inspected by NRC walk down, only a review of its design.

The Petitioners further assert that the fact that the installation of a hardened containment vent as described in Generic Letter 89-16 was installed in the Fukushima Daiichi units and failed to avert catastrophic containment failure does not justify Fitzpatrick operators decision to not install the hardened containment vent from the primary containment to a release point on the elevated emissions stack. Rather, both the multiple hardened vent failures to successfully vent explosive gases at four Fukushima Mark I units and the Fitzpatrick operators continued reliance on the pre-existing containment vent amplify the Petitioners concern with the current licensing basis vulnerability. We therefore reassert our request that the Fitzpatrick operating license be immediately suspended.

The Petitioners acknowledge that the NRC issued Enforcement Action 2012-050 Order to Modify Licenses with Hardened Containment Vents and established the mandatory compliance date for an enhanced hardened containment vent on all Mark I and Mark II reactors---including Fitzpatrick---to be no later than December 31, 2016. On June 6, 2013, the NRC issued Enforcement Action 2013-109

5 ISSUANCE OF ORDER TO MODIFY LICENSES WITH REGARD TO RELIABLE HARDENED CONTAINMENT VENTS CAPABLE OF OPERATION UNDER SEVERE ACCIDENT CONDITIONS super ceding EA 2012-050. EA 2013-109 provides for compliance dates for Phase I for the installation of a now enhanced reliable hardened containment vent on the wetwell component of the containment no later than June 30, 2018 and for Phase II compliance no later than June 30, 2019 for the installation of an optional unfiltered containment vent on the drywell component of the containment or an alternative mitigation strategy for Severe Accident Water Addition and Severe Accident Water Management that does not install a hardened vent but instead relies upon partial flood up of the drywell component while managing water addition to maintain freeboard in the wetwell so that the Phase I hardened vent remains operable to relieve an accidents high pressure, extreme temperature and non-condensable and combustible gases to the atmosphere. The wetwell vent does not have an external filter and relies upon the original designs scrubbing effect in the wetwell water to prevent radiological releases to the environment. The Petitioners now note the addition of a one and half year delay before full implementation of the Phase 1 wetwell hardened containment vent totaling up as an additional three years that Fitzpatrick will operate with the vulnerable Mark I pressure suppression containment system and the pre-existing partially hardened containment vent. The Petitioners reassert that extending the continued operation of Fitzpatrick with an unreliable containment under accident conditions represents undue risk to public health and safety in the interim and prompts the call for the suspension of the

6 Fitzpatrick operating license.

Given the history of NRC regulation, the extended delay is likely not to be the last. The Petitioners have asked for the suspension of operations with the pre-existing containment vent. The Petition Review Board has rejected a review of the requested action in part stating the staff explicitly recognized the wide variance in the reliability of the hardened vent designs among Mark I plants. The design at Fitzpatrick is one example of that variance. Therefore, the issue should be rejected, pursuant to Criterion 2 for rejecting a petition under 2.206 meaning that the raised issue has already been thoroughly reviewed by the NRC and is resolved such that the solution is application to the raised issue.

The Petitioners note that this same wide variance in the reliability of hardened vent designs includes not only Fitzpatricks half measure of the containment vent that if used under severe accident conditions will likely explode inside the adjacent building to the reactor building, it also includes the demonstrated failed vent designs at Fukushima Daiichi Units 1, 2, 3 and 4. Accordingly, the NRCs Orwellian-like interpretation of variance of reliability includes unreliable performance. The Petitioners reassert that Fitzpatricks operating license be suspended.

The Petition Review Board accepts three of the Petitioners challenges to Fitzpatricks continued operation for review then holds the request for suspension of the operating license in abeyance. Those challenges are:

7 Fitzpatrick operators claim of unlikely ignition points in the pre-existing vent line and release path that would otherwise cause a detonation of hydrogen gas generated by a severe accident; The NRC Inspection Report finding that Fitzpatricks existing plant capabilities and current procedures do not address hydrogen considerations during primary containment venting, and; Fitzpatricks mitigation strategy and current procedures do not address hydrogen considerations during primary containment venting.

In each case, the Petition Review Board references the NRC Near Term Task Forces Recommendation 5.1 to order licensees to include reliable hardened containments vents on all Mark I and Mark II boiling water reactors namely Enforcement Action 2013-109 and Task Force Recommendation 6 for a long term review by NRC to identify insights about hydrogen control and mitigation inside containment or in other buildings as additional information is revealed through further study of the Fukushima Daiichi accident.

The Petitioners have a number of concerns with the Petition Review Boards recommendation to hold the requested enforcement action in abeyance while the Fitzpatrick nuclear power plant continues to operate with a vulnerable containment structure and unaddressed safety issues that involve the large amounts of non-condensable explosive gases that would be generated under severe accident conditions and ignition sources that can result in deflagration and detonation with widespread and long lasting radiological

8 consequences that would affect large sectors of society, economy and the environment.

The matter of arriving at timely resolution to these unaddressed issues ranks high among the Petitioners concerns.

According to NRC presentations, the current challenges to the hydrogen gas problem include very little reliable empirical data on hydrogen is being reported since the Fukushima accident and any verifiable information on the chain of events at Fukushima may not be available for 10+ years.

In support of their petition, the Petitioners submit for the record Natural Resource Defense Councils technical report Preventing Hydrogen Explosions in Severe Nuclear Accidents: Unresolved Safety Issues Involving Hydrogen Generation and Mitigation. (March 2014) with findings that NRC and the nuclear industry are far from resolution by Recommendation 6.

Even after Fukushima Daiichis three devastating hydrogen explosions, the NRC has relegated its investigation of severe accident hydrogen safety issues to the lowest-priority of its post-Fukushima Daiichi accident response. The NRDC report finds that beyond adding reliable hardened containment vents to Fukushima-style reactors, it could take decades before the U.S. nuclear industry implements further hydrogen control measures.

9 A boiling water reactor like Fitzpatrick has several times more mass of zirconium in their reactor cores than larger pressurized water reactors like Indian Point Unit 3. A typical BWR core with 800 fuel assemblies would actually have more than the 76,000 kg of zirconium cited by the IAEA as typically present in a BWR core. It is the interaction of the zirconium fuel cladding with steam at high temperatures during a severe accident that generates the explosive hydrogen gas.

The NRDC technical report further finds that the NRC computer models under-predict hydrogen gas generation rates during severe accidents. Citing technical reports from Oak Ridge National Laboratory and the International Atomic Energy Agency which account for hydrogen gas generation during the evolution of a severe accident and how computer safety models under predict rates of hydrogen generation that would occur during the re-flooding of an overheated reactor core can cause hydrogen gas rates to vary by a large degree. NRDC points out that despite these reports, the NRC Near Term Task Force failed to discuss NRC computer safety models, like MELCOR, under predict such hydrogen gas generation rates thus undermining defense-in-depth with less conservative computer models. When hydrogen generation rates are underpredicted, hydrogen mitigation systems are not likely to be designed so that they could handle the generation rates that would occur in actual severe accidents.

As such, contrary to NRC and industry claims, the reliable hardened containment vent issue is not yet resolved and very likely prove as

10 troublesome to NRC and industry on holding to current implementation schedules and no more reliable than the wide variance of design of its predecessor. The NRDC report calls particular attention to severe accident scenarios where there is a rapid containment pressure increases and uncertainty for the diameter and thickness of a reliable containment vent line and more certainty for the lack of reliability of the as-built containment vent currently relied at Fitzpatrick for the next several years.

The NRDC report further illuminates that the current NRC enforcement action does not require that hydrogen be mitigated in the BWR secondary containment, also known as the reactor building, in severe accidents despite the multiple demonstrations and devastating consequence at Fukushima Daiichi. In line with the NRC defense-in-depth philosophy, hydrogen gas leakage from more than 150 penetrations in the Fitzpatrick Mark I primary containment and/or a hardened containment vent line needs to be considered and mitigated.

Severe nuclear accident hydrogen explosions remain an unresolved safety issue.

The NRDC report points out that during a severe accident, large volumes of water will be pumped into Fitzpatricks reactor core creating thousands of kilograms of steam. This large quantity of steam will initially create an inerting effect that can suppress and prevent hydrogen gas explosions. When the steam eventually condenses at some point in an accident, either naturally or by the use

11 of containment spray systems hydrogen combustion can occur with only a very small amount of energy from an electrical spark or a static electric charge, for example that caused the Hindenburg disaster.

NRDC REPORT MARCH 2014 R:14-02-B Preventing Hydrogen Explosions In Severe Nuclear Accidents:

Unresolved Safety Issues Involving Hydrogen Generation And Mitigation AUTHOR Mark Leyse NRDC Nuclear Program Consultant CONTRIBUTING EDITOR Christopher Paine Senior Nuclear Policy Adviser, NRDC

ACKNOWLEDGMENTS NRDC gratefully acknowledges the support of its work on nuclear safety from the Carnegie Corporation of New York, the Beatrice R. and Joseph A. Coleman Foundation, and the Independent Council for Safe Energy, a project of the Tides Center. The author thanks Christopher Paine, Matthew McKinzie, Jordan Weaver, Thomas Cochran, George Peridas, David Lochbaum, Gordon Thompson, and Robert Leyse for their suggestions and for reviewing this report; the author is particularly grateful to Mr. Paine for requesting that he write this report.

ABOUT NRDC The Natural Resources Defense Council (NRDC) is an international nonpro"t environmental organization with more than 1.4 million members and online activists. Since 1970, our lawyers, scientists, and other environmental specialists have worked to protect the worlds natural resources, public health, and the environment. NRDC has of"ces in New York City, Washington, D.C., Los Angeles, San Francisco, Chicago, Bozeman, MT, and Beijing and works with partners in Canada, India, Europe, and Latin America. Visit us at www.nrdc.org and follow us on Twitter @NRDC.

NRDCs policy publications aim to inform and in"uence solutions to the worlds most pressing environmental and public health issues. For additional policy content, visit our online policy portal at www.nrdc.org/policy.

NRDC Director of Communications: Lisa Benenson NRDC Deputy Director of Communications: Lisa Goffredi NRDC Policy Publications Director: Alex Kennaugh Design and Production: www.suerossi.com

© Natural Resources Defense Council 2014

TABLE OF CONTENTS I. EXECUTIVE

SUMMARY

...................................................................................................................................................................... 4 II. Hydrogen Generation in Nuclear Power Plant Accidents ............................................................................................................. 13 A. Technical

Background:

Design Basis Accidents and the Zirconium-Steam Reaction .................................................................... 13 B. Severe Accidents and the Heat Produced by the Zirconium-Steam Reaction .............................................................................. 17 C. Hydrogen Generation in Accidents: Rates and Quantities ............................................................................................................ 17 D. NRC Models Underpredict Severe Accident Hydrogen Generation Rates ................................................................................... 18 E. An Attempt to Eliminate Hydrogen Risk: Developing Non-Zirconium Fuel Cladding .................................................................... 19 III. Severe Accident Hydrogen Explosions: An Unresolved Safety Issue .......................................................................................... 20 A. The Potential Damage of Missiles Propelled by Hydrogen Explosions ......................................................................................... 20 B. Hydrogen Explosions: De"agrations and Detonations .................................................................................................................. 21 C. Limitations of Computer Safety Models to Predict Hydrogen Distribution in the Containment and Hydrogen De"agration-to-Detonation Transition ..................................................................................... 22 IV. Severe Accident Hydrogen Mitigation ............................................................................................................................................ 23 A. Hydrogen-Mitigation Strategies for Different Containment Designs ............................................................................................ 23 Case Study: Hydrogen Risks in Westinghouses Probabilistic Risk Assessment for the AP1000 and Plans for Managing an AP1000 Severe Accident .......................................................................................... 29 B. Problems with Current Hydrogen-Mitigation Strategies for Respective Reactor Designs............................................................ 30 C. Monitoring Core Degradation and Hydrogen Generation in Severe Accidents ............................................................................. 36 V. NRDCs Recommendations for Reducing the Risk of Hydrogen Explosions in Severe Nuclear Accidents .............................. 40 A. Develop and Experimentally Validate Computer Safety Models that Would be Capable of Conservatively Predicting Rates of Hydrogen Generation in Severe Accidents ....................................................................... 40 B. Assess the Safety of Existing Hydrogen Recombiners, and Potentially Discontinue the Use of PARs until Technical Improvements are Developed and Certi"ed .............................................................................. 40 C. Signi"cantly Improve Existing Oxygen and Hydrogen Monitoring Instrumentation...................................................................... 40 D. Upgrade Current Core Diagnostic Capabilities in Order to Better Signal to Plant Operators the Correct Time to Transition from Emergency Operating Procedures to Severe Accident Management Guidelines................................................................................................................................ 40 E. Require All Nuclear Power Plants to Control the Total Quantity of Hydrogen that Could be Generated in a Severe Accident .................................................................................................................................... 41 F. Require that Data from Leak Rate Tests be used to Help Predict the Hydrogen Leak Rates of the Primary Containment of each BWR Mark I And Mark II Licensed by the NRC in Different Severe Accident Scenarios ................................................................................................................................ 41 3 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

I. EXECUTIVE

SUMMARY

A s demonstrated during the March 2011 severe nuclear accident in Fukushima, Japan, accumulation and subsequent detonation of hydrogen gas produced by an overheated nuclear core reacting with steam can breach a reactors containment structures and result in widespread radioactive contamination.1 The gas is initially generated by the rapid oxidation of the zirconium alloy tubes (fuel cladding) that surround the low-enriched uranium fuel pellets in commercial power reactors (Figure 1).

When the fuel cladding enters a certain temperature range water reactor (BWR) designs, this discharge is initially into well above its typical operating temperature, the zirconium- the pressure suppression pool or wetwell portion of the steam reaction becomes autocatalytic, meaning that it primary containment.3 propagates via self-heating from the chemical reaction itself. In the March 2011 Fukushima Daiichi accidentin This produces large quantities of hydrogen in a brief period. which the cores of three GE-designed boiling water reactors This intense reaction also causes the fuel cladding to erode lost all cooling and melted downhydrogen leaked from and breach, which releases harmful levels of radionuclides the primary containments into the reactor buildings.

into the reactor vessel. The fuel cladding is the "rst line of The hydrogen accumulated in the reactor buildings and defense among multiple barriersthe reactor vessel, a steel detonated, causing large releases of harmful radionuclides and/or reinforced concrete containment, and a further, that contaminated a wide area and prompted the evacuation secondary containment in some designs2that are intended of some 90,000 people. A smaller hydrogen explosion also to prevent release to the environment of the biologically occurred in the March 1979 Three Mile Island Unit 2 (TMI-2) hazardous radionuclides produced by nuclear "ssion (see accidenta partial core meltdown of a pressurized water Figure 2). In some accident scenarios, over-pressurization reactor (PWR)that did not breach the containment.

of the reactor vessel can be exacerbated by the buildup The U.S. Nuclear Regulatory Commission (NRC) has a of hydrogen from the zirconium-steam reaction, causing checkered history when it comes to requiring measures that seals at the multiple penetrations of the vessel required for would effectively reduce the risk of hydrogen explosions reactor monitoring and control to leak hydrogen into the in the event of a severe accident at a U.S. nuclear power containment. plant. This regulatory lapse is rooted in the history of the development of commercial nuclear power in the United Figure 1: Structure of a Uranium Fuel Assembly States, when the NRCs predecessor agency, the Atomic Energy Commission (AEC), had a dual mandate: both to promote and to regulate commercial nuclear power.

As a consequence of this internal con"ict of interest, rather than consult independent scienti"c and technical institutions, the AEC entrusted two companies that designed nuclear reactorsWestinghouse and General Electric (GE) with the mission of demonstrating that in a large-pipe-break loss-of-coolant accident (LOCA), the emergency core-cooling systems for their respective reactor designs would in fact prevent overheating of the core, and hence prevent the generation of large quantities of explosive hydrogen gas.

In response to the TMI-2 partial meltdown in 1979, the NRC revised its regulations regarding the control of hydrogen in an effort to help prevent hydrogen explosions in severe nuclear accidents. In 1981, the NRC issued a requirement that Source: NRC GE-BWRs with the small-volume Mark I and somewhat larger Mark II containments operate with their atmospheres inerted To protect the integrity of the reactors cooling system, with nitrogen, to minimize the risk of hydrogen combustion.

pressure relief valves are designed to open automatically, In 1985, the NRC required installation of hydrogen igniters resulting in discharge of radioactively contaminated steam systems to burn off leaked hydrogen before it accumulates and hydrogen gas into the containment. In older boiling 4 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

Figure 2: Cutaway View of a GE Mark I Boiling Water Reactor (BWR)

This is the design that exploded at Fukushima Daiichi, Japan, in March 2011.

Twenty-two units of this design are still operational in the U.S.

Overhead crane (for refueling)

Elevated spent fuel pool Reactor building (secondary containment):

fourth line of defense Primary containment (drywell): third line of defense Reactor pressure vessel (RPV), enclosing nuclear core: second line of defense Primary containment torus (wetwell): part of third line of defense, relieving gas pressure buildup in undersize drywell Source: NRC Reactor Concepts Manual, Rev. 0200 to explosive concentrationsin pressurized water reactor years, or even decades, before the U.S. nuclear industry (PWR) ice condenser containments and GE-BWR Mark III implements further hydrogen control measures.

containments. Multiple technical pathways exist for minimizing the By contrast, after Fukushima Daiichis three devastating risk of hydrogen explosions in severe nuclear accidents.

hydrogen explosions, the NRC decided to relegate However, in the aftermath of the Fukushima Daiichi accident, investigating severe accident hydrogen safety issues to the NRC has merely declared that severe nuclear accidents the lowest-priority and least proactive stage (Tier 3) of its are vanishingly rare events that can be either prevented or post-Fukushima Daiichi accident response. Hence, beyond sharply limited in scope, thereby avoiding any signi"cant ensuring reliable containment pressure relief vents are added buildup of hydrogen and attendant explosion risk. The reality, to obsolescent Fukushima-type reactors, it could take many however, is that merely waving a rhetorical magic wand over 5 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

Figure 3: Cutaway View of a GE Mark II BWR with Uni"ed Concrete Drywell/Wetwell Primary Containment Design This design is deployed at Limerick Units 1 and 2, Susquehanna 1 and 2, and Nine Mile Point 2.

The primary containment volume is only slightly larger than that of the Mark I.

Reactor vessel Drywell Vent pipes to wetwell Water level Wetwell Source: Containment Integrity Research at Sandia National Laboratories - An Overview, NUREG/CR-6906 6 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

the problem of hydrogen explosion risk "ies in the face 2. BWR Mark I and Mark II primary containments of a number of unresolved safety issues, including: are especially vulnerable to overpressurization and Q e xperimental hydrogen leaks.

evidence that current reactor computer In 1972, the chief nuclear safety analyst for the AEC safety models do not accurately predict the onset of rapid recommended discouraging further use of the type hydrogen generation in severe nuclear accidents, and that of primary containments used in the GE-BWR Mark I they under-predict the rates of hydrogen generation that and Mark II designs, claiming they were susceptible to occur in such accidents; overpressurization. One reason these containments are Q a n aging "eet of U.S. reactors that will increasingly operate vulnerable is that their volumes are relatively small: typically beyond the 40-year term of their initial licenses while about one-ninth and one-sixth the volume, respectively, facing severe competitive pressures from other electricity of PWR large dry containments. In September 1989, the generation technologies, creating a perilous tradeoff NRC publicly acknowledged that BWR Mark I primary between economic viability and public safety; containments might not be able to withstand the internal gas Q t he compromised ability of 40-year old containments to pressures that would build up in severe accidents. However, prevent hydrogen leakage (for example, at the seals of at the time, the NRC merely issued guidance that was not pipe and cable penetrations) under the elevated-pressure legally binding, recommending that owners of BWR Mark I conditions that are expected to occur in severe accidents; designs on their own initiative install a hardened vent to the external environment for each reactor units doughnut-Q t he apparent willingness of the NRC to accede to licensee shaped wetwellto reduce the internal gas pressure and requests to relax and defer requirements for periodic remove decay heat in the event of a severe accident.

containment pressurization and leak rate testing; and In the United States, the vents currently installed in each Q t he lack of technical readiness of U.S. power reactor BWR Mark I wetwell (see Figure 1) do not have a standardized owners to detect and control dangerous concentrations design, are not out"tted with high-capacity "lters to prevent of hydrogen in all the places where it could migrate and the release of harmful radionuclides in accidents, are not explode in a nuclear power plant. subject to NRC inspection for proper maintenance and We conclude that the NRC is failing to meet the statutory continuing operability, and do not have an independent train standard of adequate protection of the public against the of backup power sources to help ensure remote operation hazard of hydrogen explosions in a severe reactor accident. during a station blackout (i.e., a total loss of both grid-Our reasons are summarized below and set forth in more connected and backup alternating current power at a nuclear detail in the body of this report. power plant).

As overall leak-rate tests demonstrate, GE-BWR Mark

1. NRC computer safety models underpredict the rates of I and Mark II primary containments are not designed to hydrogen generation that have occurred in experiments prevent hydrogen leakage in accidents. These tests are legally simulating severe nuclear accidents. required at U.S. nuclear power plants for determining how Reports from the Oak Ridge National Laboratory (1997), the much radiation would be released from the containment OECD Nuclear Energy Agency (2001), and the International in a design-basis accident (i.e., an anticipated accident in Atomic Energy Agency (IAEA) (2011) support the conclusion which, by design, a core melt would be prevented). In overall that current computer safety models underpredict the rates leak rate testsconducted below their nominal design of hydrogen generation that may occur in severe accidents pressuresBWR Mark I and Mark II primary containments when zirconium fuel cladding and other core components have been shown to leak hundreds of pounds of air per react with steam, especially during a re-"ooding of an day. For example, in 1999, tests conducted at Nine Mile overheated reactor core. Unfortunately, the NRCs 2011 Point Unit 1 (a BWR Mark I) and at Limerick Unit 2 (a BWR Recommendations for Enhancing Reactor Safety in the 21st Mark II) found that overall leakage rates at both units Century: Near-Term Task Force Review of Insights from the exceeded 350 pounds of air per day, an amount that is less Fukushima Daiichi Accident and subsequent Fukushima than the maximum allowed leak rates. This means that in a safety review documents do not discuss the fact that the severe accident, even if there were no damage to a primary NRCs computer safety modelssuch as the widely used containment, hydrogen would leak into the secondary MELCOR code developed by Sandia National Laboratories containment (reactor building). Leak rates would increase underpredict the hydrogen generation rates that occur in as the internal pressure increased, and they would become severe accidents. By overlooking the de"ciencies of computer even greater if the seals at the various piping and cable safety models, the NRC undermines its own philosophy penetrations were damaged. (Typical BWR containments of defense-in-depth, which requires the application of have 175 penetrations, almost twice as many as typical PWR conservative models. When hydrogen generation rates are containments.)

underpredicted, hydrogen mitigation systems are not likely to be designed so that they can handle the hydrogen gas generation rates that would occur in actual severe accidents.

7 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

Figure 4: Internet Images of the Fukushima Daiichi Nuclear Power Station from the Ocean Side Before and After the March 2011 Tsunami and Hydrogen Explosions Destroyed (from Right) Units 1, 3, and 4 A plume is visible coming from a blown-out shield building panel in the side of the Unit 2 reactor, which, while still intact, also experienced a core melt.

Photo credits: top, unknown; bottom, Digital Globe 8 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

3. GE-BWR Mark I and II containments perform poorly in In a nuclear power plant accident, a mixture of leak rate tests, yet the NRC is planning to further relax hydrogen, nitrogen, and steam could leak from the primary requirements for leak rate testing. containment; as internal pressures increase and the accident BWR Mark I primary containments have failed a number of progresses, the concentration of hydrogen in the leaking overall leak rate tests; for example, Oyster Creekthe oldest mixture would increase. If there were no damage to the operating commercial reactor in the United States, which is primary containment, the quantity of hydrogen that leaked considered to be quite similar to Fukushima Daiichi Unit 1 (by weight) would be relatively small, because hydrogen is has failed at least "ve tests. In one test, Oyster Creeks primary about one-fourteenth as dense as air. However, a secondary containment leaked at a rate 18 times greater than its design containment could be breached if, for example, only 20 to 40 leak rate; if this test was conducted at the same pressure pounds of hydrogen were to leak into it, accumulate locally, as subsequent Oyster Creek tests, which seems likely, the and explode.

primary containment leaked more than 6800 pounds of air per day. Such results raise the questions: What were 4. Large-volume PWR dry containments, made of the observed pre-accident leak ratesbelow design reinforced concrete with a steel liner, are a prominent pressureof the three primary containments that leaked safety feature of many U.S. nuclear power plants; hydrogen at Fukushima Daiichi? Could there have been however, they are not necessarily invulnerable to the excessive hydrogen leakage at one or more of the primary effects of hydrogen explosions.

containments, without it becoming overpressurized? The NRC mistakenly claims that the large containment Since the Fukushima Daiichi accident, the problem of volumes of most PWRsa reactor design found in about hydrogen leakage from primary containments has still not two-thirds of the U.S. nuclear "eetwould keep the been adequately addressed. Mark II primary containments pressure spikes from potential hydrogen explosions within must also be assessed as likely to incur hydrogen leaks their design pressures. But this claim is predicated on an in severe accidents. Nevertheless, the NRC is currently uncertain and therefore misplaced assumption that hydrogen preparing to extend the intervals at which overall and local combustion would occur in the form of a de"agration, a leak rate tests must be conducted to once every 15 years combustion wave traveling at a subsonic speed relative to the (from the current 10 years) and once every 75 months (from unburned gas.

the current "ve years), respectively. This will only further However, when local hydrogen concentrations are decrease the safety margin of BWR Mark I and Mark II greater than about 10 percent by volume, it is possible for a designs. In its safety analyses to assess extending the test de"agration to transition into a detonation, a combustion intervals, the NRC overlooked the fact that BWR Mark I and wave traveling at a supersonic speed relative to the unburned Mark II primary containments are particularly vulnerable to gas. Unfortunately, in a severe accident, a hydrogen hydrogen leakage. detonation could occur within a PWR large dry containment In a severe accident, BWR Mark I primary containments if there were elevated local hydrogen concentrations, that leak excessively in tests conducted below their design especially in the presence of carbon monoxide and high pressure would leak dangerous quantities of explosive temperatures; this could cause internal pressure spikes to hydrogen gas into secondary containments; however, exceed twice the containments design pressure.

the NRC does not seem concerned about these excessive Furthermore, a local hydrogen explosion occurring inside leakage rates. A 1995 NRC report, NUREG-1493, concluded the containment could propel debris, such as concrete blocks that increasing allowable leakage rates by 10 to 100 times from internal walls, into the containment structure at high results in a marginal risk increase, while reducing costs velocities. The impact of such internally generated missiles by about 10 percent [emphasis added]. And a 1990 NRC could damage essential safety systems and severely crack a report, NUREG-1150, concluded that even if there is leakage PWRs containment.

equivalent to 100 percent of the contained gas volume per According to a 2011 IAEA report on the mitigation of day, the calculated individual latent cancer fatality risk hydrogen hazards in severe nuclear accidents, no analysis is below the NRCs safety goal. But this safety goal clearly ever has been made on the damage potential of "ying objects would not be achieved if leaking hydrogen were to detonate generated in an explosion of hydrogen. Yet we know from in the reactor buildings, as it did at Fukushima Daiichi. the Fukushima Daiichi accident that debris propelled from In March 2013, the NRC asserted that [s]ensitivity hydrogen detonations caused extensive damage to backup analyses in NUREG-1493 and other studies show that light emergency power supplies and hoses that were intended water reactor accident risk is relatively insensitive to the to inject seawater into overheated reactors. Some of the containment leakage rate because the risk is dominated debris dispersed around the site by explosions was highly by accident sequences that result in failure or bypass of radioactive, exposing personnel to higher dose rates and containment [emphasis added]. In reality, the progression setting back their efforts to control the accident.

of the Fukushima Daiichi accident was indeed affected by As nuclear safety expert David Lochbaum has noted, the leakage of hydrogen gas. The evidence suggests that Unit During design basis accidents, the response of operators 3s primary containment did not fail before hydrogen leaked and workers is primarily passiveverifying that automatic into the Unit 3 reactor building and detonated. The internal equipment actions have occurred. In essence, workers are pressure of Unit 3s primary containment actually increased observers during design basis accidents. During severe after the hydrogen explosion occurred. accidents, workers get off the bench and into the game.

9 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

The keystone of [the U.S. nuclear] industrys response to hydrogen as it is generated in an accident, before it can reach Fukushima is FLEX, an array of portable components concentrations at which combustion would threaten the moved into place by workers. Inadequate hydrogen control integrity of the less sturdy containment. In a severe accident, during a severe accident would seem to render FLEX to safely actuate hydrogen igniters, operators would need virtually useless.4 to know the local concentration of hydrogen in the vicinity of each igniter; if igniters were actuated too lateafter local

5. In the presence of the quantities of hydrogen detonable concentrations of hydrogen built upthey could generated in severe accidents, untimely ignitions from actually cause a hydrogen detonation that breached the currently installed devices for controlling the buildup of containment.

hydrogen inside some U.S. nuclear reactor containments could cause hydrogen detonations. 6. The NRC has insuf"cient requirements for monitoring Hydrogen recombiners are devices that eliminate hydrogen the quantities of hydrogen generated in severe accidents.

by combining it with oxygen, a reaction that produces steam NRC rules state that in nuclear accidents, hydrogen and heat. There are two types of hydrogen recombiners: monitors must begin to function within 90 minutes of the passive autocatalytic recombiners (PARs), which operate emergency injection of coolant water into the reactor vessel.

without electric power, utilizing catalytic surfaces to facilitate Ninety minutes could be too late in a fast-moving accident the combining of hydrogen and oxygen molecules; and scenario. In 2003, the NRC took the odd step of reclassifying thermal recombiners, which are electrically powered. both hydrogen and oxygen monitors (required for BWR In September 2003, the NRC rescinded its requirement primary containments that operate with nitrogen-inerted that most types of PWRs operate with hydrogen recombiners atmospheres) as non-safety-related equipment, meaning that installed in their containments, because it decided that the the equipment does not need to have redundancy, seismic quantity of hydrogen that would be released in design-basis resistance, or an independent train of onsite standby power.

accidents is not risk-signi"cant. Indian Point on the Hudson Furthermore, GE-BWR Mark I and Mark II designs operate River near New York City is the only nuclear power plant in with hydrogen monitors installed only in their inerted the United States that currently operates with PARs. The new primary containments, not in their reactor buildings. In the Westinghouse AP1000 design, under construction in Georgia, Fukushima Daiichi accident, hydrogen from three nuclear South Carolina, and China, is intended to operate with only units leaked into these buildings and exploded.

two PARs installed in its containment. The hydrogen removal capacity of a single recombiner unit is only several grams per 7. Operators of PWRs lack a suf"cient capability to second whereas hydrogen generation in a severe accident monitor the onset and progression of core degradation could range from 100 to 5,000 grams per second. in the event of an accident.

If a PWR still operates with hydrogen recombiners, there This insuf"cient capability limits operator knowledge of are typically only two units installed in its containment, their when to transition from emergency operating procedures mission being to reduce the quantity of hydrogen generated (EOPs)intended to prevent core damageto severe in a design basis accident. By contrast, European PWR accident management guidelines (SAMGs)intended containments typically have 30 to 60 such devices installed, to stabilize a damaged reactor core with auxiliary ad-hoc with the mission of reducing the quantity of hydrogen cooling measures while preventing signi"cant off-site generated in a severe accident. releases of radionuclide contamination. The operating Clearly, just two recombiners would not be capable of measures appropriate to preventing core damage early in eliminating, in timely fashion, the quantity of hydrogen an accident are obviously not the same as those intended to generated in a severe accident. But this is not their only contain the consequences of core damage that has already limitation. When hydrogen recombiners are exposed to occurred while forestalling further compounding events, the elevated hydrogen concentrations that occur in severe such as hydrogen explosions, that could result in a signi"cant accidents, they have a tendency to malfunction and incur loss of containment. Not knowing which regime one is ignitions, which could cause a hydrogen detonation that operating in could have severe consequences.

compromised the containment. Hence, it seems that In PWRs, core-exit thermocouplestemperature maintaining the token capacity of two recombiners actually measuring devicesare the primary equipment that would presents a net safety hazard. This is especially a problem be used to detect inadequate core-cooling and to signal with PARs, which operators would not be able to deactivate; the point at which operators should transition from EOPs at least electrically powered thermal recombiners could be to SAMGs. However, data from experiments demonstrate switched off when a hydrogen concentration reached a level that core-exit temperature measurements are neither an at which the recombiner could incur ignitions. accurate nor a timely indicator of maximum fuel-cladding The NRC requires that hydrogen igniters be installed in temperatures in the core, and hence an unreliable indicator reactor containments that are neither inerted nor designed to of the likelihood of signi"cant hydrogen production. In the withstand high internal pressuresPWR ice condenser and most realistic severe accident experiment ever conducted BWR Mark III containments. Igniters are intended to burn off in which an actual reactor core was heated with decay heat 10 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

before melting downcore-exit temperatures were measured C. Existing oxygen and hydrogen monitoring at approximately 800°F when maximum in-core fuel-cladding instrumentation should be signi"cantly improved.

temperatures exceeded 3300°F. In line with the conclusions of the NRCs own Advisory In a severe accident, plant operators are supposed to Committee on Reactor Safeguards (ACRS), the NRC should implement SAMGs before the onset of the rapid zirconium- reclassify oxygen and hydrogen monitors as safety-related steam reaction, which leads to thermal runaway in equipment that must undergo full quali"cation (including the reactor core. Clearly, using core-exit thermocouple seismic quali"cation), have redundancy, and have has its own measurements in order to detect inadequate core cooling independent train of emergency electrical power.

or uncovering of the core is neither reliable nor safe. For The current NRC requirement that hydrogen monitors be example, PWR operators could end up re-"ooding an functional within 90 minutes of emergency cooling water overheated core simply because they do not know the injection into the reactor vessel is clearly inadequate for actual condition of the core. Unintentionally re-"ooding an protecting public and plant worker safety. Following onset of overheated core could generate hydrogen, at a rate as high an accident, NRC regulations should require that hydrogen as 5,000 grams per second, and the containment could be monitors be functional within a timeframe that enables compromised if large quantities of that hydrogen were to immediate detection of quantities of hydrogen indicative of detonate, as occurred at Fukushima. core damage and a potential threat to containment integrity.

The NRC should also require hydrogen monitoring instrumentation to be installed in:

NRDCS RECOMMENDATIONS FOR 1. BWR Mark I and Mark II secondary containments; REDUCING THE RISK OF HYDROGEN

2. fuel-handling buildings of PWRs and BWR Mark IIIs; EXPLOSIONS IN SEVERE NUCLEAR and ACCIDENTS

3. any plant structure where it would be possible for A. The NRC should develop and experimentally validate hydrogen to enter.5 computer safety models that can conservatively predict rates of hydrogen generation in severe accidents.

D. Current core diagnostic capabilities require upgrading The NRC needs to acknowledge that its existing computer to provide plant operators a better signal for when to safety models underpredict the rates of hydrogen generation transition from emergency operating procedures to that occur in severe accidents. The NRC should conduct a severe accident management guidelines.

series of experiments with multi-rod bundles of zirconium The NRC should require plants to use thermocouples placed alloy fuel rod simulators and/or actual fuel rods as well as at different elevations and radial positions throughout study the full set of existing experimental data. The NRCs the reactor core to enable plant operators to accurately objective in this effort should be to develop models capable measure a wide range of temperatures inside the core of predicting with greater accuracy the rates of hydrogen under both typical and accident conditions. In the event generation that occur in severe accidents.

of a severe accident, in-core thermocouples would provide plant operators with crucial information to help them track B. The safety of existing hydrogen recombiners should be the progression of core damage and manage the accident, assessed, with the use of PARs potentially discontinued indicating, in particular, the correct time to transition from until technical improvements are developed and certi"ed.

EOPs to implementing SAMGs.

Experimentation and research should be conducted in order to improve the performance of PARs so that they E. The NRC should require all nuclear power plants to will not malfunction and incur ignitions in the elevated control the total quantity of hydrogen that could be hydrogen concentrations that occur in severe accidents. generated in a severe accident.

The NRC and European regulators should perform safety The NRC should require all nuclear power plants to analyses to determine if existing PARs should be removed operate with systems for combustible gas control that from plant containmentsand, if so, whether they should would effectively and safely control the total quantity of be replaced with electrically powered thermal hydrogen hydrogen that could potentially be generated in different recombiners that have their own independent train severe accident scenarios; and to have strategies for venting of emergency power. The latter course would require gas from the inerted primary BWR Mark I and Mark II operators to have instrumentation capable of providing containments without causing signi"cant radiological timely information on the local hydrogen concentrations releases. The NRC should also require nuclear power plants throughout the containment, so they could deactivate the to operate with systems for combustible gas control that thermal recombiners when hydrogen concentrations reached are capable of preventing local concentrations of hydrogen the levels at which the recombiners malfunction and incur in the containment from reaching concentrations that ignitions. could support explosions powerful enough to breach the containment, or damage other essential accident-mitigating 11 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

features. Hydrogen explosions are not expected to occur The rationale for this requirement is obvious: Hydrogen inside the primary BWR Mark I and Mark II containments, explosions, or hydrogen concentrations in the reactor which operate with inerted atmospheres, unless somehow building that pose a detonation risk, can severely inhibit oxygen is present. emergency response actions essential to containing the The NRC should require licensees who operate nuclear accident. Or even worse, emergency response actions power plants with hydrogen igniter systems to perform themselves, such as hooking up portable power equipment, analyses demonstrating that these systems would effectively could actually provide the spark for hydrogen explosions in and safely mitigate hydrogen in different severe accident critical areas of the plant.

scenarios. Licensees unable to do so would be ordered to The NRC should also end its practice of allowing repairs upgrade their systems to adequate levels of performance. to be made immediately before leak rate tests are conducted to evaluate potential leakage paths, such as containment F. The NRC should require that data from leak rate tests welds, valves, "ttings, and other components that penetrate be used to help predict the hydrogen leak rates of the containment. This repair before test practice obviously primary containment of each BWR Mark I and Mark II defeats the nuclear safety objective of providing an accurate licensed by the NRC in different severe accident scenarios. statistical sample of actual pre-existing containment leak The NRC should require that data from overall leak rate tests rates.

and local leak rate testsalready required by Appendix J Finally, the NRC should reconsider its plan to extend the to Part 50 for determining how much radiation would be intervals of overall and local leak rate tests to once every released from the containment in a design basis accident 15 years and 75 months, respectively. The NRC needs to also be used to help predict hydrogen leak rates for a conduct safety analyses that consider BWR Mark I and Mark range of severe accident scenarios involving the primary II primary containments are vulnerable to hydrogen leakage.

containments of each GE-BWR Mark I and Mark II licensed It also seems probable that as old reactors are kept in service by the NRC. If data from an individual leak rate test were to beyond their original licensed lifetimes, the intervals between indicate that dangerous quantities of explosive hydrogen leak rate tests should be shortened rather than extended.

gas would leak from a primary containment in a severe accident, the plant owner should be required to repair the containment.

12 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

II. HYDROGEN GENERATION IN NUCLEAR POWER PLANT ACCIDENTS A. TECHNICAL BACKGROUND: DESIGN located in the reactor core as long as a suf"cient "ow of coolant is maintained.8 BASIS ACCIDENTS AND THE ZIRCONIUM-U.S. nuclear power plants are referred to as light water STEAM REACTION reactors because they use ordinary water (H2O), as opposed In typical operating conditions at a nuclear power plant, to heavy water (2H2O or D2O), as a coolant. In a boiling highly pressurized coolant6 water is pumped through the water reactor like those that suffered hydrogen explosions reactor coolant system7 piping into the reactor pressure at Fukushima, the coolant exits the reactor core as a steam-vessel where it "ows between the fuel rods, carrying away water mixture. Water droplets are removed in a steam heat produced by the "ssion (splitting) of uranium (235U) dryer located above the core, and then the steam passes atoms in the fuel. The coolant waters temperature exceeds through the steam line to the main turbine, which powers an 500°F; nonetheless, it still provides cooling for the fuel rods electric generator, and is condensed back into water before reentering the core (see Figure 5).

Figure 5: Schematic Diagram of Heat Removal from a Boiling Water Reactor (BWR)

Heat is removed during normal operation by generating steam, which rises to the top of the reactor vessel (1), and is then used directly (red line) to drive a turbine (2) that spins an electrical generator. When a reactor shuts down, however, the core continues to produce heat from radioactive decay. This decay heat is removed initially by bypassing the turbine and delivering the steam directly to the condenser (3), which is cooled by water pumped from lakes, rivers, or ocean (green), with the condensed steam (blue) returning to the reactor as coolant (4). When steam pressure drops to approximately 50 pounds per square inch, the residual heat removal (RHR) system (5) is used to complete the cool-down process. Water in the normal coolant recirculation loop (6) is diverted from the recirculation pump to the RHR pump which sends it through a supplementary heat exchanger and back to the reactor.

Multiple electrically controlled pumps and valves are dependent on external sources of electricity for safe operation in the critical period following reactor shutdown. In a severe accident, drywell containment (7) is designed to vent (8) excess radioactive steam pressure into a wetwell suppression chamber (9) half "lled with water, which operators, in turn, can vent to the atmosphere through Reliable Hardened Vents (10) to relieve excess pressure. Currently, such vents do not "lter radioactive aerosols and gases.

Source: NRC Reactor Concepts Manual, Rev. 0200, pages 3-7, with additional explanatory features by NDRC 13 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

In a pressurized water reactor the coolant typically Reactor cores have tens of thousands of uranium fuel rods, circulates to and from the reactor in two to four closed bundled together into fuel assemblies. For example, each primary loops, where it is maintained at a pressure high reactor at Indian Point Energy Center near New York City has enough to prevent the water from boiling. Each primary loop 87 metric tons of fuel contained in 193 fuel assemblies (each has a steam generator (heat exchanger) where the coolant with 204 fuel rods), or almost 40,000 fuel rods. The cladding heats and boils water circulating through a secondary loop of the fuel rods is made of zirconium alloy.9 The fuel cladding maintained at a lower pressure than the primary loop is a thin tube, typically with a diameter of less than half an producing pressurized steam to spin the main turbine and inch, sheathing small cylindrical uranium-dioxide fuel pellets generate electricity (see Figures 6 and 7). stacked one on top of the other. The active fuel region of Both reactor types have main condensers to condense the the fuel rods (the length of the cladding containing the fuel steam back into water after it exits the turbines; this water pellets) is approximately 12 feet long.

is pumped back to the reactor pressure vessel (in a BWR) or In sum, a reactor core contains large amounts of zirconium steam generator (in a PWR). The main condensers of both metal that can react with steam at high temperatures to BWRs and PWRs rely on vast amounts of water, drawn from produce vast quantities of hydrogen gas. In the event of a local water body such as a lake, river, or ocean. This water a design basis accident,10 BWR and PWR emergency core may be returned directly to the local water body at elevated cooling systems are designed to inject and circulate water temperatures, sometimes damaging the local ecology; through the reactor core to prevent the fuel rods from alternately, cooling towers may be deployed to remove heat overheating when the normal reactor cooling system ceases from this water. Roughly two-thirds of the thermal energy to function. The respective emergency core cooling systems produced by a nuclear reactor is not converted into electricity are required to mitigate a number of postulated design-basis but rather is discharged to the environment as waste heat. accidents, including the worst-case scenario envisioned Figure 6: Simpli"ed Schematic Diagram of a Westinghouse Pressurized Water Reactor (PWR) with Three Intersecting Heat Transfer Heat Loops PWR designs typically have two to four primary loops and a corresponding number of steam generators and main coolant pumps.

Water in the primary loop is maintained by the pressurizer at around 2250 pounds per square inch, about twice the pressure of a BWR. Weak points in this system from a radiation containment perspective are the numerous valves and penetrations of the reactor vessel required to control and cool the reactor; the seals of the main coolant pumps, which must be actively cooled and are prone to leakage; and the thousands of small-diameter, thin-walled primary loop steam tubes in the steam generators, which are prone to erosion and leakage into the secondary loop. The tertiary loop can be open, returning heated water from the turbine condenser directly to a local river, lake, or bay; or closed, utilizing one or more wet (evaporative) or dry (fan-driven air) cooling towers (not shown) to recycle the tertiary coolant in a semiclosed loop (makeup water must be added to the system due to evaporative losses).

Source: The Westinghouse Pressurized Water Reactor Nuclear Power Plant, page 4 14 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

by regulators: a large-pipe-break loss-of-coolant accident within 60 seconds13 due to the absence of coolant. The fuel (LOCA). Note that the March 2011 Fukushima Daiichi cladding would be heated by the residual heat in the fuel and accident in Japan is considered a beyond design basis by decay heating (the radioactive decay of "ssion products),

accident11 or a severe accident that exceeded the design which at the beginning of an accident would generate parameters of the plant. about 7 percent of the thermal power produced during In a hypothetical large-pipe-break LOCA at a PWR, the normal operation. The decay heat decreases as the accident largest pipe in the reactor coolant system would break, progresses yet remains a signi"cant heat source for the causing a rapid discharge of coolant; the core would be either duration of the accident.

partly or completely emptied of water. The reactors power If local fuel-cladding temperatures were to approach would shut down within seconds, because the absence of 1800°F, the cladding would incur additional heating from the coolant, which is also a neutron moderator,12 and the the exothermic (heat-generating) reaction of its zirconium rapid insertion of control rods would stop the "ssion chain content with the steam present in the reactor core. This reaction. A control rod is a rod, plate, or tube containing a chemical reaction is variously referred to as a metal-water neutron-absorbing material used to control the power of reaction, zirconium-steam reaction, or zirconium a nuclear reactor by preventing further "ssions. However, oxidation. The latter term is used because the zirconium-the maximum local temperature of the fuel cladding would steam reaction produces zirconium dioxide (ZrO2), in increasefrom approximately 600°F to more than 1000°F addition to hydrogen and heat.14 Figure 7: Layout of a Westinghouse Four-Loop Pressurized Water Reactor (PWR)

The reactor has four steam generators and four main coolant pumps (the fourth pump is hidden by the perspective of the drawing).

All these components are massive.

To set the scale, the interior of the reactor vessel is about 15 feet wide by 40 feet high. U.S. examples include Indian Point Units 2 and 3 (New York), Vogtle Units 1 and 2 (Georgia), Comanche Peak Units 1 and 2 (Texas) and Diablo Canyon Units 1 and 2 (California).

Source: NRC Reactor Concepts Training Manual, Pressurized Water Reactor Systems, Section 4-1 15 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

Figure 8: Cutaway View of French N4 Standardized PWR Design, Based on Westinghouse Technology but with a Double-Walled Primary Containment Structure (1)

Reactor pressure vessel (2) and primary coolant loop piping are shown in red; main steam lines (in blue) are shown coming from the top of the steam generators (3),

shown in light green. These are supplied by the feedwater system (dark green piping), which also cools the spent fuel pool (4) and main coolant pump seals (dark green). The turbine building (5) encloses a steam-driven turbine generator unit (in purple) with a rated output of 1500 MWe. The tertiary cooling loop for the turbine steam condenser is not shown.

16 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents 1

3 4

3 2

2 Source: University of New Mexico Libraries Exhibition Nuclear Engineering Wall Charts

commences in a severe accident, maximum local fuel-The NRCs 2011 Near-Term Task Force Review of Insights cladding temperatures increase rapidlytens of degrees from the Fukushima Daiichi Accident states that an important Fahrenheit per second. Thermal runaway is what leads to aspect of the NRCs approach to safety through defense- a partial or complete meltdown. After thermal runaway in-depth is the mitigation of the consequences of severe commenced in the TMI-2 accident (plausibly at about accidents, including the mitigation of the hydrogen that 1832°F [1000°C]), within a few minutes, maximum local fuel-would be generated in such an accident. However, the cladding temperatures would have reached the melting point Near-Term Task Force report discusses neither the rates of of zirconium, which exceeds 3300°F.22 hydrogen generation that could occur nor the total quantity In the March 2011 Fukushima Daiichi accident, the of hydrogen that could be generated in severe accidents. respective reactor cooling systems of Units 1, 2, and 3 Given that in the Fukushima Daiichi accident, hydrogen reportedly survived the earthquake more or less intact.

explosions caused large radiological releases, this must be However, the plant incurred a loss-of-offsite power, considered a major weakness in the NRCs report and its then "ooding from the tsunami caused its backup diesel continuing regulatory response to the lessons learned from generators to fail, and backup batteries were depleted within the Fukushima accident. about eight hours. The latter were insuf"cient in any case to power emergency core-cooling pumps once the steam-If the emergency core cooling system is to prevent the fuel driven backup pumps became inoperative. Hence, the three cladding from overheating in a large-break LOCA, it must units lost the ability to remove their reactors decay heat. This overcome the heat from three primary sources: 1) the residual caused the coolant water to boil away and uncover the fuel heat stored in the fuel, 2) the heat from radioactive decay, and rods in the cores of the three units, exposing them to steam.

3) the heat generated by the zirconium-steam reaction. Once the fuel rods were uncovered, decay heating caused cladding temperatures to increase to the point at which their zirconium content rapidly reacted with the steam and B. SEVERE ACCIDENTS AND THE HEAT generated large quantities of hydrogen gas.

PRODUCED BY THE ZIRCONIUM-STEAM The NRC needs to consider that not all severe accidents REACTION would be relatively slow-moving station-blackout accidents caused by natural disasters, like the Fukushima Daiichi Practically speaking [zirconium] oxidation runaway comes accident. Fast-moving accidents could also occur; for indue to the heat of the oxidation reaction increasing example, a large-pipe-break LOCA could rapidly transition generally faster than heat losses from other mechanisms. into a severe accident, because of thermal runaway. A

[I]f peak [fuel-cladding] temperatures remain below 1000°C meltdown could commence within 10 minutes of the onset

[1832°F], you will probably escape the runaway [oxidation], of such an accident.23 but if you get to 1200°C [2192°F], you will probably see the oxidation light up like a 4th of July sparkler (literally thats what it looks like) as it looks like) as it goes into the rapid C. HYDROGEN GENERATION IN ACCIDENTS:

oxidation regime.15 Randall O. Gauntt, Sandia National Laboratories RATES AND QUANTITIES It should be noted that in an unmitigated BWR severe accident The Three Mile Island Unit 2 (TMI-2) accident, which the entire Zircaloy inventory of the reactor would eventually occurred in March 1979, was a small-break LOCA16 that oxidize (either in the reactor vessel or on the drywell "oor),

transitioned into a severe accidenta partial meltdown generating as much as 6000 [pounds] (2722 kg) of hydrogen because there was inadequate cooling of the core. Decay (plant speci"c value).24 heating caused local fuel-cladding temperatures to increase Sherrell R. Greene of Oak Ridge National Laboratory up to the point at which the cladding began to rapidly react with the steam present in the reactor core, which in turn In a reactor accident, fuel-cladding temperatures, plant produced more heat. operator actions, and other factors would affect hydrogen Robert E. Henryan Argonne National Laboratory nuclear generation rates and the total quantity generated.

safety expert,17 suggested that in the TMI-2 accident, when In a PWR accident in which the maximum fuel-cladding local fuel-cladding temperatures reached about 1832°F temperature at any point in the core does not exceed (1000°C), the heat produced by the zirconium-steam 2200°F (the regulatory fuel-cladding temperature limit for reaction was approximately equal to the heat produced by design basis accidents25), hydrogen generation is predicted radioactive decay,18 and that from [that] point on, the core to occur at rates from 1 to 50 grams per second;26 similar was in a thermal runaway state.19, 20 Henry stated that rates would occur in a BWR design basis accident. A safety

[t]he [zirconium] oxidation rate increase[d] with increasing analysis conducted for Indian Point Unit 3 (a large PWR) temperature, which [led] to an escalating core heatup rate. found, reassuringly, that after a design basis LOCA, it would Therefore, the core damage was generally caused by the take a total of 23 days for the hydrogen concentration in the

[zirconium] cladding oxidation [emphasis added].21 containment to reach 4 percent of the containments volume Once thermal runaway (runaway zirconium oxidation) (the lower "ammability limit).27 17 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

However, in a severe PWR accident, the picture changes molten core with concrete (out of which containment "oors dramatically: hydrogen generation could occur at rates from are made).41 A safety study for the PWRs at Indian Point 100 to 5,000 grams per second28 (two orders of magnitude discusses a case in which interaction of a molten core with a greater than in a design basis accident), and similar rates concrete containment "oor would generate more than 2721.5 would occur in a severe BWR accident. An OECD Nuclear kg of hydrogen.42 Energy Agency report states, a rapid initial [hydrogen]- If a molten core interacted with concrete, carbon source occurs in practically all severe accident scenarios monoxide (which, like hydrogen, is a combustible gas) would because the large chemical heat release of the [zirconium]- also be generated. Depending on different accident scenarios, steam reaction causes a fast self-accelerating temperature concrete types, and geometrical factors affecting the molten excursion during which initially large surfaces and masses core-concrete interaction, the quantities of carbon monoxide of reaction partners are available.29 generated could vary greatly; concentrations could differ by If an overheated reactor core were re-"ooded with water, up to several volume percent in the containment.43, 44 up to 300,000 grams of hydrogen could be generated in 60 seconds.30 In this scenario, according to one report, between 5,000 and 10,000 grams of hydrogen could be generated per D. NRC MODELS UNDERPREDICT SEVERE second.31 (In the TMI-2 accident, re-"ooding of the uncovered ACCIDENT HYDROGEN GENERATION RATES reactor core by the emergency core cooling system caused a A 2001 OECD Nuclear Energy Agency report advises that spike in the hydrogen generation rates; it has been estimated high hydrogen generation rates must be taken into account that approximately 33 percent of all the hydrogen produced in risk analysis and in the design of hydrogen mitigation occurred during re-"ooding.32) systems. However, the same report notes that computer The total quantity of hydrogen that could be generated in a safety models used by regulators underpredicted the actual severe accident is different for PWRs and BWRs. Considering rates of hydrogen generation that occurred in two sets of hydrogen generated only from the oxidation of zirconium:

experiments simulating severe accidents: the CORA tests and if the total amount of the zirconium in a typical PWR core, LOFT LP-FP-2.45 (The CORA and LOFT LP-FP-2 experiments approximately 26,000 kilograms (kg), were to chemically react were conducted to investigate accidents that lead to a with steam, this would generate approximately 1150 kg of meltdown of the reactor core. LOFT LP-FP-2 was conducted hydrogen; if the total amount of zirconium in a typical BWRs with an actual nuclear reactor, 1/50th the volume of a full-core, approximately 76,000 kg, were to chemically react with size PWR, designed to represent the major component and steam, this would produce about 3360 kg of hydrogen.33 system response of a commercial PWR. LOFT LP-FP-2 was Large BWR cores typically have about a 58-percent greater an actual core meltdownthe most realistic severe accident initial uranium mass than large PWR cores,34 and this larger experiment conducted to date; it combined decay heating, mass is divided into approximately 45 percent more fuel severe fuel damage, and the quenching of zirconium fuel rods than in a PWR. However, these differences alone do not cladding with water.46) Computer safety models also failed to account for the fact that BWR cores have almost three times predict hydrogen generation in the initial QUENCH facility the mass of zirconium in their cores than PWRs.35,36 BWR experiments.47 This indicates that computer safety models cores have signi"cantly more zirconium mainly because, also underpredict the hydrogen generation rates that would unlike PWRs, BWR fuel assemblies have channel boxes occur in severe accidents.48 surrounding the fuel rods. The mass of each BWR assembly A 1997 Oak Ridge National Laboratory (ORNL) report states channel box is greater than 100 kg.37 Thus a BWR core with that hydrogen generation in severe accidents can be divided 800 fuel assemblies would actually have more than the into two separate phases: 1) a phase that runs from when 76,000 kg of zirconium cited by the IAEA as typically present the fuel cladding is still intact through the initial melting of in a BWR core.)

the fuel cladding, which accounts for about 25 percent of The total quantity of hydrogen generated in a severe the total hydrogen produced; and 2) a phase after the initial accident can vary widely: The Fukushima Daiichi accident, melting of the fuel cladding, in which there is additional which resulted in three meltdowns, most likely generated melting, relocation, and the formation of uranium-more than 3,000 kg of hydrogen per affected unit; the zirconium-oxygen blockages, which accounts for about 75 amount produced in the TMI-2 accident is estimated at percent of the total hydrogen generated (as indicated in about 500 kg.38 In a severe accident, hydrogen would also analyses of the BWR CORA-28 and -33 tests).49 be generated within the reactor vessel from the oxidation According to the 1997 ORNL report, computer safety of non-zirconium materials: metallic structures and boron models predict hydrogen generation rates reasonably well carbide (in BWR cores).39 In the TMI-2 accident, the oxidation for the "rst phase, in which the fuel cladding remains intact, of steel accounted for approximately 10 percent to 15 but predict hydrogen generation rates for the second phase percent of the total hydrogen generation.40 In a case in which much less robustly. The 1997 ORNL report stresses that it the molten core penetrated the reactor vessel, hydrogen is obvious that computer safety models need to accurately would be generated from the oxidation of metallic material predict hydrogen generation rates when the fuel cladding is (chromium, iron, and any remaining zirconium) during no longer intact, especially because most of the hydrogen direct containment heating and also from interaction of the 18 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

generation occurs in that phase.50 In 2010, according to an article in Nuclear Engineering A 2011 International Atomic Energy Agency (IAEA) report International, a type of silicon carbide fuel cladding with a states that computer safety models underpredict the rates of triplex design57 was still in the early stages of development hydrogen generation that would occur during a re-"ooding and testing the article opines that developing such cladding of an overheated reactor core.51 The report cautions that, is a high-risk, but potentially high-payoff58 venture. It in different scenarios, re-"ooding could cause hydrogen remains to be seen if triplex silicon carbide would be a generation rates to vary to a large degree and that predictions suitable replacement for zirconium alloy as a fuel-cladding need to consider the possible range of outcomes in order material; there are a number of problems with silicon carbide to help prepare for severe accident hydrogen risk. In the cladding that still need to be resolved.

BWR CORA-17 test, which simulated the re-"ooding and One problem is that during typical reactor operation the quenching of an overheated core, approximately 90 percent fuel pellets in silicon carbide cladding would have higher of the hydrogen generation occurred during re-"ooding.52 temperatures than they do when sheathed in zirconium. This Unfortunately, recent reports do not explicitly state would occur for two reasons: First, after extended irradiation, the extent that computer safety models under-predict silicon carbide has a lower thermal conductivity than hydrogen generation rates during the re-"ooding and zirconium alloy,59 meaning less of the fuels heat would pass quenching of an overheated corei.e., a percentage value through the cladding and into the coolant. Second, the thin of the under-prediction has not been provided. However, gap between the fuel pellets and the cladding would not be presentation slides from a 2008 European meeting state that closed early in the "rst fuel cycle as occurs when zirconium the total amount of hydrogen under re"ooding remains cladding is used.60 Both of these phenomena would prevent highly underestimated in [the] CORA-13 and LOFT LP- the pressurized water from cooling the fuel pellets in silicon FP-2 experiments [emphasis added]. In fact, regarding carbide cladding as effectively as it does when the fuel pellets recent computer simulations of LOFT LP-FP-2, the same are sheathed in zirconium cladding.

presentation slides state: High temperature excursions with A second problem is that an effective means of extended core degradation and enhanced hydrogen release hermetically sealing the ends of silicon carbide fuel-cladding observed in the test during re"ood was not reproduced due rods has not yet been developed.61 If the fuel-cladding rods to the lack of adequate modeling53 [emphasis added]. were not hermetically sealed during reactor operation, "ssion Despite these reports dating back to 1997, the NRCs 2011 products would escape from the fuel rods and enter the Near-Term Task Force report on insights from the Fukushima coolant water.

Daiichi accident failed to mention, much less discuss, the A June 2012 Nuclear Energy Advisory Committee report fact that the NRCs computer safety modelssuch as the lists additional problems with silicon carbide fuel cladding, widely used MELCOR code developed by Sandia National such as a lack of ductility (the ability to bend, expand or Laboratoriesunderpredict the hydrogen generation contract without breaking) compared with currently used rates that occur in severe accidents. By overlooking the cladding types. The report also speculates that within four de"ciencies of computer safety models, the NRC undermines years further research and experimentation should con"rm its own philosophy of defense-in-depth, which requires whether or not such problems can be resolved. If the the application of conservative models.54 When hydrogen problems are resolved, in-reactor testing of silicon carbide generation rates are underpredicted, hydrogen mitigation fuel cladding could take an additional 10 to 20 years.62 systems are not likely to be designed so that they could Hence, even if all were to go well, it could take more than handle the generation rates that would occur in actual two decades before silicon carbide fuel cladding is ready for severe accidents. commercial use. There is certainly no reason to expect that zirconium alloy fuel cladding will ever be widely replaced in the aging U.S. "eet of nuclear power plants, which are facing E. AN ATTEMPT TO ELIMINATE HYDROGEN obsolescence in the 2025-2050 timeframe.

RISK: DEVELOPING NON-ZIRCONIUM FUEL CLADDING Perhaps the most effective way to help prevent hydrogen explosions in severe accidents would be to develop fuel cladding that does not generate large quantities of hydrogen when the core overheats in such accidents. Zirconium alloy cladding could possibly be replaced with silicon carbide, molybdenum alloys, molybdenum-zirconium alloys, or iron-chromium-aluminum alloys.55 Silicon carbide is perhaps the most promising alternate; in the design basis accident temperature rangebelow 2200°Fsilicon carbide is far less reactive than zirconium with steam,56 generating much less hydrogen.

19 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

III. SEVERE ACCIDENT HYDROGEN EXPLOSIONS:

AN UNRESOLVED SAFETY ISSUE In the Fukushima Daiichi accident, hydrogen detonated in Such extreme pressure spikes could cause a PWR large and seriously damagedthe reactor buildings housing Units dry containment to fail. There are also other safety analyses 1, 3, and 4, causing large radiological releases. The hydrogen with worrisome results. For example, analyses conducted explosion that occurred in the Unit 1 reactor building also for Indian Point Units 2 and 3 about three decades ago caused a blowout panel in the Unit 2 reactor building to found that peak pressures caused by hydrogen explosions open, which resulted in a loss of secondary containment could exceed the estimated failure pressure of Indian Points integrity.63 Actually, from a strict technical perspective, containmentsapproximately 126 pounds per square inch secondary containment integrity was lost the moment the gauge72 (psig) or 141 pounds per square inch absolute73 "ooded emergency diesel generators failed to supply backup (psia).74 For certain severe accident scenarios, peak pressure power. Maintaining secondary containment integrity requires spikes were predicted to be 160 psia, 169 psia, about 157 psia, (a) an intact reactor building structure, and (b) a standby gas and 180 psia or greater.75 (Some nuclear safety experts believe treatment system to "lter releases from the intact structure the accuracy of containment failure pressure estimates is to the atmosphere and maintain the structure at a lower questionable; according to one, Experimental data on the pressure than ambient pressure (thus ensuring, in the case ultimate potential strength of containment buildings and of small leaks, that outside air leaks in rather than inside air their failure modes are lacking.76) leaking out). Flooding of the emergency diesel generators by the tsunami took away (b) hours before the explosion took away (a).64 A. THE POTENTIAL DAMAGE OF MISSILES As discussed in the preceding sections, the zirconium- PROPELLED BY HYDROGEN EXPLOSIONS steam reaction will generate large quantities of hydrogen In a severe accident, a local hydrogen explosion within the in severe accidents. When it reaches a suf"cient local containment could propel debris, such as concrete blocks concentration inside the containment, this hydrogen will from disintegrated compartment walls, at extremely high explode if exposed to an ignition source, of which there are speeds. The impact of such debris (internally-generated many, given the amount of electrical equipment and wiring missiles) could compromise essential safety systems and located inside the containment. In the TMI-2 accident, even breach the containment, especially if it were made of a hydrogen explosionprobably initiated by an electric steel.77 If a PWR large dry containment made of reinforced spark65occurred in the containment (a PWR large dry concrete with a steel liner78 were struck by a missile propelled containment). The TMI-2 accident explosion did not breach by a hydrogen explosion, the containment would be more the containment; however, the integrity of either a PWR ice likely to incur cracks than to experience gross failure. Yet condenser containment or a BWR Mark III containment this is mere speculation: According to a 2011 IAEA report, could be compromised by an explosion of the quantity of no analysis ever has been made on the damage potential of hydrogen generated in the TMI-2 accident, because such "ying objects, generated in [a hydrogen]-explosion.79 containments have substantially smaller volumes and lower An Institute of Nuclear Power Operations (INPO) report, design pressures than PWR large dry containments.66,67 published in November 2011 thoroughly documents how in The fact that a hydrogen explosion did not breach the Fukushima Daiichi accident, internally generated missiles TMI-2s containment does not preclude the possibility that and missiles from secondary containments, propelled by if a meltdown were to occur at another PWR with a large hydrogen explosions, caused a considerable amount of dry containment, a hydrogen explosion could breach the damage and set back efforts to control the accident.80 The containment, exposing the public to a large radiological report states:

release. Nonetheless, the NRC 2011 Near-Term Task Force report on insights from the Fukushima Daiichi accident [D]ebris from the explosion struck and damaged the cables claims that the pressure spike of potential hydrogen and mobile generator that had been installed to provide explosions would remain within the design pressure of PWR power to the standby liquid control pumps. The debris large dry containments.68 However, according to NRC safety also damaged the hoses that had been staged to inject analyses,69 conducted a decade ago, hydrogen explosions seawater into Unit 1 and Unit 2. ... Some of the debris inside PWR large dry containmentsof the quantity of was also highly contaminated, resulting in elevated dose hydrogen generated from zirconium-steam reactions of rates and contamination levels around the site. As a result, 100 percent of the active fuel-cladding lengthcould cause workers were now required to wear additional protective pressure spikes as high as 114 pounds per square inch (psi)70 clothing, and stay times in the "eld were limited. The to 135 psi71over twice the design pressure of a typical PWR explosion signi"cantly altered the response to the event large dry containment. and contributed to complications in stabilizing the units.81 20 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

B. HYDROGEN EXPLOSIONS: hydrogen concentration was 8.1 volume percent87 causing a rapid pressure increase of approximately 28 psi in the DEFLAGRATIONS AND DETONATIONS containment.88) A famous instance of a hydrogen de"agration In a severe accident, water pumped into the reactor core to occurred on May 6, 1937, when the hydrogen-"lled dirigible cool the fuel rods would heat up and produce thousands Hindenburg ignited while landing at Lakehurst, NJ and of kilograms of steam, which would enter the containment collapsed into a smoldering mass of twisted wreckage on the through pressure relief valves or a break in the cooling system ground within a matter of seconds.

circuit. At different points in an accident the presence of In a severe reactor accident, hydrogen could randomly large quantities of steam in the containment would have de"agrate when its concentrations were at 8.0 volume an inerting effect, either helping to prevent or completely percent or lower, because only a small quantity of energy is preventing hydrogen combustion if the steam concentration required for igniting hydrogen; sources of random ignition were 55 volume percent82 or greater. (If hydrogen combustion include electric sparks from equipment and static electric were to occur, the presence of steam would help reduce its charges.89 It has been postulated that in the TMI-2 accident, intensity.83) However, after enough steam condensed and the hydrogen de"agration was initiated by a ringing this would be inevitable at some point in an accident, either telephone90 and in the case of the Hindenburg, by the buildup naturally or by the use of containment spray systems84 of a static electric charge on its specially-coated outer skin.

either local or global hydrogen combustion could occur. In one sense, random or in some instances deliberate In a dry atmosphere of hydrogen and air, the lower ignition of hydrogen at relatively low concentrations "ammability limit of hydrogen is a concentration of 4.1 is bene"cial, in that it can prevent the hydrogen from volume percent.85 If hydrogen concentrations were from 4.1 building up to more dangerous detonable concentrations.

to about 8.0 volume percent, hydrogen combustion would Unfortunately, in a severe accident, the average hydrogen be in the form of a de"agration with a relatively slow "ame concentration in the containment could reach 7.0 to 16.0 speed.86 A de"agration is a combustion wave traveling at a volume percent, or higher; local concentrations could be subsonic speed relative to the unburned gas. (In the TMI- much higher. In a dry atmosphere of hydrogen and air, with 2 accident, a hydrogen de"agration occurred when the hydrogen concentrations above about 10.0 volume percent, Table 1: Calculated Hydrogen (H2) production Due to 75% Zirconium-Water Reaction Note that all the predicted containment hydrogen concentrations (far right-hand column) are above the combustion threshold of 4.1 volume percent, and most are above temperature-dependent detonation thresholds of 11.6 and 9.4 volume percent hydrogen, at 68°F and 212°F, respectively.

Source: D. W. Stamps et al., Sandia National Laboratories, Hydrogen-Air-Diluent Detonation Study for Nuclear Reactor Safety Analyses, NUREG/CR-5525, January 1991, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML071700388) 21 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

"ames can accelerate up to and beyond the speed of sound: C. LIMITATIONS OF COMPUTER SAFETY this phenomenon is termed de"agration-to-detonation MODELS TO PREDICT HYDROGEN transition.91 A detonation is a combustion wave traveling at a supersonic speed (greater than the speed of sound) relative DISTRIBUTION IN THE CONTAINMENT to the unburned gas. Hydrogen combustion in the form of AND HYDROGEN DEFLAGRATION-TO-detonations occurred in the Fukushima Daiichi accident. DETONATION TRANSITION Higher temperatures and/or the presence of carbon In a September 2011 meeting of the Advisory Committee on monoxide could increase the likelihood of a de"agration- Reactor Safeguards (ACRS), Dana Powers, senior scientist at to-detonation transition. In a dry hydrogen-air mixture, Sandia National Laboratories, expressed concern over the the lower concentration limits at which de"agration-to- fact that hydrogen detonations occurred in the Fukushima detonation transition can occur is 11.6 volume percent Daiichi accident and stated that in experiments, detonations at temperature of 68°F; at 212°F, the lower concentration areextraordinarily hard to get.96,97,98 Consequently, limit falls to 9.4 volume percent.92 And in the presence computer safety models (codes) derived from these of 5.0 volume percent of carbon monoxide (generated experiments have limitations in predicting the hydrogen if a molten core interacts with a containments concrete distribution and steam condensation that would occur in the "oor), 10.0 volume percent of hydrogen can detonate at containment in different severe accident scenarios.

approximately 68°F.93 A 2007 OECD Nuclear Energy Agency report states, One safety expert has concluded that within the large Further work in code developmentand code user geometries of PWR-containments a slow laminar de"agration training, supported by suitable complex experiments, is would be very unlikely. In most cases, highly ef"cient necessary to achieve more accurate predictive capabilities combustion modes must be expected.94 In a small-break for containment thermal hydraulics and atmospheric gas/

LOCA, large quantities of steam could enter the containment steam distribution. As a result of the code assessment, the well before hundreds of kilograms of hydrogen were modeling of the following three phenomena appeared to be released into the containment. In such a scenario, thermal the major issues: condensation, gas density strati"cation, and strati"cation could prevent the hydrogen from mixing jet injection [emphasis added].99 with the steam.95 In scenarios in which large quantities of Computer safety models also have limitations in predicting steam were present in the containment, the hydrogen could the phenomenon of hydrogen de"agrations transitioning reach high concentrations because the inerting effect of the into detonations; as well as the maximum pressure loads steam could prevent the hydrogen from igniting at lower the containment would incur from detonations, in different concentrations. After the steam condensed, a de"agration scenarios. Westinghouses probabilistic risk assessment could transition into a etonation. for its new and supposedly passively safe AP1000 reactor design, under construction in Georgia and South Carolina, observes that the phenomenon of hydrogen de"agration-Table 2: Release Paths in LWR Containments to-detonation transition is complex and not completely understood and that the maximum pressure loads from detonations are dif"cult to calculate.100 The Fukushima Daiichi accident demonstrated that the NRC needs to conduct more realistic hydrogen combustion experimentsperhaps in facilities on the same scale as actual reactor containments, at elevated temperatures and with the large quantities of hydrogen that are produced in severe accidents.

Source: Containment Integrity Research at Sandia National Laboratories:

An Overview, Sandia National Laboratories, NUREG/CR-6906/ SAND2006-2274P, July 2006 22 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

IV. SEVERE ACCIDENT HYDROGEN MITIGATION A. HYDROGEN-MITIGATION STRATEGIES Table 3: U.S. Power Reactor Containment Structures, FOR DIFFERENT CONTAINMENT DESIGNS by Type Over the course of six decades, the NRC and its predecessor agency, the Atomic Energy Commission, have licensed six basic types of reactor containments (see Table 3), but within each type there are numerous design and construction differences (see Table 4) that translate into a wide and highly uncertain range of capacities to contain a severe reactor accident.

PWRs with Large Dry Containments and PWRs with Subatmospheric Containents The NRC does not require the owners of PWRs with large dry containments (52 out of 53 such units are currently operational in the U.S.), or the owners of PWRs with sub-atmospheric containments, maintained at an internal pressure below atmospheric pressure ("ve out of seven such units are currently operational in the U.S.) to mitigate the Source: NUREG/CR-6906/SAND2006-2274P, July 2006 hydrogen that would be generated in severe accidents. The agency assumes that the large containment volumes of such PWRs are suf"cient to keep the pressure spikes of potential In September 2003, the NRC likewise rescinded its hydrogen de"agrations within the design pressures of the requirement that PWRs with large dry containments and structures.101 PWRs with sub-atmospheric containments operate with One hydrogen mitigation strategy for these types of hydrogen recombiners installed in their containments. It containments would be to mix the hydrogen entering decided that the quantity of hydrogen produced in design-the containment using its fan coolers; this would reduce basis accidents would not be risk-signi"cant and that local hydrogen concentrations and mix the hydrogen with hydrogen recombiners would be ineffective at mitigating the steam, which has an inerting effect.102 A second hydrogen quantity of hydrogen produced in severe accidents104 when mitigation strategy for such PWRs would be to use hydrogen hydrogen generation could occur at rates as high as 5.0 kg per recombiners, safety devices that eliminate hydrogen in an second.105 accident by recombining hydrogen with oxygena reaction In the United States, if such PWRs still have hydrogen that produces steam and heat. There are two types of recombiners, there are typically two of them in each recombiners: passive autocatalytic recombiners (PAR), which containment, to mitigate the quantity of hydrogen produced operate without electric power, and electrically powered in a design basis accident. For example, Indian Points thermal recombiners. The hydrogen removal capacity for containments each have two hydrogen recombiner units.106 one hydrogen recombiner unit is only several grams per To help mitigate hydrogen in a wide range of severe accident second.103 scenarios, a group of European nuclear safety experts have recommended that such PWRs have from 30 to 60 hydrogen recombiner units distributed in their containments.107 However, even 60 hydrogen recombiner units would not be capable of eliminating all of the hydrogen generated in some severe accident scenarios within the timeframe required to prevent a hydrogen explosion.

23 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

Table 4: U.S. PWRs Classi"ed by Containment Construction Type Source: NUREG/CR-6906/SAND2006-2274P, July 2006 24 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

Figure 9: Typical PWR Large Dry Containment Designs Left: Large dry steel primary containment with reinforced-concrete shield. Right: Containment constructed with post-tensioned concrete with steel liner (e.g., Palisades).

Steel primary containment Reinforced-concrete shield building 2.5 feet thick 25 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

PWRs with Ice Condenser Containments and BWR Mark III ice condenser containments and BWR Mark IIIs because their The NRC requires that PWRs with ice condenser containments have relatively low design pressures,109 which containments (nine such units are currently operational in makes them more vulnerable to hydrogen exlosions.

the U.S.) and BWR Mark IIIs (four are currently operational Such containments could be compromised by an in the United States) operate with hydrogen igniters installed explosion of the quantity of hydrogen that was generated in their containments in order to mitigate the hydrogen in the TMI-2 accident.110 Hydrogen igniters are intended to that would be generated in the event of a severe accident.108 manage the quantity of hydrogen that would be generated Hydrogen igniters are intended to burn off hydrogen as it is by a zirconium-steam reaction of 75 percent of the fuel-generated in an accident, before it reaches concentrations claddings active length,111 which is considerably less than the at which combustion would threaten the integrity of the quantity of hydrogen generated at each melted-down unit at containment. Hydrogen mitigation is essential for PWRs with Fukushima-Daiichi.

Table 5: U.S. BWRs by Containment Construction Type A Mark I plant, Vermont Yankee, is missing from the NRCs compilation.

Source: NNUREG/CR-6906/ SAND2006-2274P, July 2006 26 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

Figure 10: Typical PWR Ice Condenser Steel Containment with Concrete Shield Building (e.g., Sequoyah)

Shield Hydrogen igniters building dome Containment spray system Steel primary Concrete shield containment building wall Top of ice bed Ice condenser Steam generator Ice condenser Vapor barrier Accumulator Ventilation fan and equipment Reactor vessel Steel liner Reactor cavity Sump Source: NUREG/CR-6906/SAND2006-2274P, July 2006 27 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

BWR Mark I and BWR Mark II Such containments, if not inerted, could easily be The NRC requires that BWR Mark Is (23 such units are compromised by an explosion of the quantity of hydrogen currently operational in the U.S.) and BWR Mark IIs (eight generated in the TMI 2 accident. A year after the Fukushima such units are currently operational in the U.S.) operate with accident, in March 2012, the NRC ordered the installation primary containments that have an inerted atmosphere112 of reliable hardened vents in BWR Mark I and Mark II to help prevent hydrogen combustion. An inerted containments by December 31, 2016.116 A hardened vent containment atmosphere is de"ned as having less than could help control hydrogen in a severe accident but its 4.0 percent oxygen by volume.113 primary purposes are to remove heat from and depressurize Nitrogen is used to inert BWR Mark I and Mark II primary BWR Mark I and Mark II containments, which due to their containments because nitrogen is inexpensive and nontoxic. small volumes are more susceptible than other containment Such containments are relatively small, so deinerting and designs to failure from overpressurization in an acident.

inerting for outages between fuel cycles can be achieved In September 1989, the NRC issued non-legally within hours; these processes are also inexpensive.114 binding guidance to all owners of BWR Mark I facilities, If BWR Mark I and Mark II primary containments were recommending117 that hardened vents be installed.118 The not inerted, they would be extremely vulnerable to hydrogen NRC does not require that hydrogen be mitigated in the explosions in severe accidents, because of their relatively secondary containments of BWR Mark I and Mark II units.

small volumes.115 Figure 11: Cross-section View of a Typical BWR Mark III Figure 12: BWR Mark II Reinforced Concrete Containment Containment (e.g., Perry, Riverbend) (Limerick Units 1 and 2)

Freestanding steel primary containment (red) with lower Drywell inerted with nitrogen (orange) is connected by suppression pool (blue) and concrete shield building) has a low pressure relief pipes (red) to wetwell (green). Waterline is in design pressure rating (15 psig), requiring that credit be given blue.

to the use of hydrogen igniters and containment sprays to meet containment requirements.

Source: NNUREG/CR-6906/SAND2006-2274P, July 2006 Source: NNUREG/CR-6906/SAND2006-2274P, July 2006 28 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

CASE STUDY: Hydrogen Risks in Westinghouses Probabilistic Risk Assessment for the AP1000 and Plans for Managing an AP1000 Severe Accident Currently four Toshiba-Westinghouse AP1000 units are under construction in South Carolina and Georgia. The NRC purports to have more stringent safety requirements for the AP1000, that re"ect the Commissions expectation that future designs will achieve a higher standard of severe accident performance than currently operating light water reactors.119 And Westinghouse has touted the AP1000 as having, in the event of a severe accident, a far lower probability of breaching its containment than currently operating nuclear power plants. However, Westinghouses probabilistic risk assessment (PRA) for the AP1000 erroneously claims that it would not be possible for a hydrogen detonation to occur in the AP1000s containment if the hydrogen concentration were less than 10.0 volume percent. A hydrogen detonation could compromise the containment and thus cause a large radioactive release. In fact, Westinghouses PRA assumes that the containment would fail in all cases, in which hydrogen de"agrations transitioned into detonations.120 Westinghouses PRA for the AP1000 states that [s]ince the lowest hydrogen concentration for which de"agration-to-detonation transition has been observed in the intermediate-scale FLAME facility at Sandia [National Laboratories] is 15 percent,121 and [NRC regulation] 10 CFR 50.44 limits hydrogen concentration to less than 10 percent, the likelihood of de"agration-to-detonation transition is assumed to be zero if the hydrogen concentration is less than 10 percent.122 Westinghouse does not consider that the lower concentration limits at which de"agration-to-detonation transition can occur, at temperatures of 68°F and 212°F, are 11.6 and 9.4 volume percent of hydrogen, respectively.123 According to a 1998 Brookhaven National Laboratory report: Most postulated severe accident scenarios are characterized by containment atmospheres of about 373K [212°F] However, calculations have shown that under certain accident scenarios local compartment temperatures in excess of 373K [212°F] are predicted.124 It is perplexing that Westinghouses PRA for the AP1000 as well as the NRCs regulations for future water-cooled reactors rely on outdated assumptions that the phenomenon of hydrogen de"agration-to-detonation transition cannot occur below hydrogen concentrations of 10.0 volume percent: in 1991, Sandia National Laboratories reported that, in an experiment, de"agration-to-detonation transition occurred at 9.4 volume percent of hydrogen.125 The previous year, the same information was reported at the NRCs Eighteenth Water Reactor Safety Information Meeting.126 In a September 2011 Advisory Committee on Reactor Safeguards meeting, Dana Powers, a senior scientist at Sandia National Laboratories, expressed concern over the fact that hydrogen detonations occurred in the Fukushima Daiichi accident and stated that in experiments, detonations areextraordinarily hard to get.127 However, neglecting to reassess hydrogen-combustion safety issues for the AP1000 after Fukushima, the NRC went ahead and issued licenses for two AP1000s in February 2012.

Paradoxically, two of the AP1000 containments safety deviceshydrogen igniters, and passive autocatalytic hydrogen recombiner (PAR) units when they malfunction and behave like ignitersprovide ignition sources that are capable of causing hydrogen detonations. In a severe accident, hydrogen igniters must be actuated at the correct time, because, as Peter Hoffman wrote in the Journal on Nuclear Materials: [t]he concentration of hydrogen in the containment may be combustible for only a short time before detonation limits are reached.128 If AP1000 operators were to actuate the hydrogen igniters in an untimely fashionafter a local detonable concentration of hydrogen developed in the containmentit could cause a detonation. This especially could occur because Westinghouses emergency response guidelines for the AP1000 are "awed: Operators are instructed to actuate hydrogen igniters when the core-exit gas temperature exceeds 1200°F. Westinghouse maintains that the core-exit temperature would reach 1200°F before the onset of the rapid zirconium-steam reaction of the fuel cladding,129 which leads to thermal runaway in the reactor core; however, experimental data demonstrates that this would not necessarily be the case.

Westinghouse and the NRC, which approved the AP1000 design, both overlooked dataavailable for more than a quarter centuryfrom the most realistic severe accident experiment conducted to date (LOFT LP-FP-2), in which core-exit temperatures were measured at approximately 800°F when maximum in-core fuel-cladding temperatures exceeded 3300°F.

In LOFT LP-FP-2, when core-exit temperatures were 800°F, the rapid zirconium-steam reaction of the fuel cladding had already occurred and the reactor core had started melting down. Hence, relying on core-exit temperature measurements in an AP1000 severe accident could be unsafe: In a scenario in which operators re-"ooded an overheated core simply because they did not know the actual condition of the core, hydrogen could be generated at rates as high as 5.0 kg per second. If operators were to actuate hydrogen igniters in such a scenario, it could cause a hydrogen detonation.

Westinghouses general description of the AP1000 states that [PARs] control hydrogen concentration following design basis events.130 However, in the elevated hydrogen concentrations that occur in severe accidents, PARs are prone to malfunctioning and behaving like hydrogen igniters. This is a problem: AP1000 operators would not be able to switch off PARs, because they operate without electrical power. If the AP1000 containments PAR units malfunctioned and incurred ignitions after a detonable concentration of hydrogen developed in the containment, it could cause a detonation.131 This could occur in a number of severe accident scenarios, especially those in which the AP1000 containments hydrogen igniter system was not operational,132 enabling local detonable concentrations of hydrogen to develop in the containment.

29 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

Figure 13: Typical PWR Subatmospheric Reinforced The Uncertain Performance of Different Concrete Containment with Steel Liner (e.g., Diablo Containment Designs in a Severe Accident Canyon, North Anna, Surrey, Beaver Valley)

Is Likely to Vary Widely Figure 14 compares the calculated design pressure (in pounds per square inch above sea level atmospheric pressure, or psig) of the six main types of U.S. commercial reactor containments with their net free volume in millions of cubic feet. BWR Mark I and II have a nominally strong pressure rating, due to their use of pressure-suppression pools, but very low free volume. The BWR Mark III and PWR ice condenser designs have the lowest design pressures of the group as well as moderate volumes, while the two other PWR containment designs have the largest volumes along with comparatively high design pressures.

The actual safety situation is more complex than re"ected in this "gure. In reality, no two reactor containments, even at the same facility, are exactly alike, and units of the same type can vary widely in their design and construction details. Predictions of local failure mechanisms, which could lead to signi"cant leakage in an accident even before overall design pressures are exceeded, depend on the availability of accurate as- built information (geometry and material properties) at structural discontinuities (e.g.,

near containment doors or pipe and cable penetrations).

Even if this information is available (not typical for actual containments), the prediction, a priori, of local failures is at best an uncertain proposition.... Any evaluation of the capacity of an actual containment must be based on the entire system, including mechanical and electrical penetrations and other potential leak paths.

Source: NUREG/CR-6906/SAND2006-2274P, July 2006 Source: NUREG/CR-6906/SAND2006-2274P, July 2006, p. xvii B. PROBLEMS WITH CURRENT HYDROGEN- states that in a severe accident, steam typically would be present in the containment, yet the quantity of steam would MITIGATION STRATEGIES FOR RESPECTIVE be unpredictable because of condensation, which would be REACTOR DESIGNS facilitated by containment spray systems. Detonations would PWRs with Large Dry Containments and PWRs with most likely be initiated through de"agration-to-detonation Subatmospheric Containments transition, yet direct detonations could perhaps be possible As noted above, the NRC does not require owners of at higher temperatures.134 PWRs with large dry containments and PWRs with sub- Hydrogen recombiners would be prone to malfunctioning atmospheric containments to mitigate the hydrogen by incurring ignitions in the elevated concentrations that would be generated in severe accidents; however, that occur in severe accidents. This would be a serious in severe accidents, it would be possible for the pressure problem: A recombiners unintended ignition could cause a spikes of hydrogen explosions to exceed the design detonation.135 pressures of such containments. The NRC has reported PARs could be advantageous in station-blackout that hydrogen detonations could occur in PWRs with accidentsa complete loss of grid-supplied and backup large dry containments and PWRs with sub-atmospheric on-site alternating current powerbecause they operate containments. For example, a 1990 NRC letter to plant without either external power or plant operator actuation; owners states that in severe accidents, local and global however, there is no way to prevent such recombiners from hydrogen detonations could occur in PWRs with large dry or self-actuating or to shut them off in elevated hydrogen sub-atmospheric containments.133 concentrations. Plant operators would be able to control Furthermore, a 1991 report by Sandia National the operation of electrically powered thermal hydrogen Laboratories cautions that in severe accidents, in which recombiners; yet operators should be cautious about 75 percent of the fuel-cladding active length oxidized, actuating thermal recombiners in an accident. Plant detonable concentrations of hydrogen could develop in dry operators should actuate thermal recombiners only if hydrogen-air mixtures in such containments. The report hydrogen concentrations are low and should deactivate them 30 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

Figure 14: Typical Containment Volume and Design Pressure for U.S. Nuclear Plants As a general rule, low volumes make it more likely that design basis pressures will be exceeded in a severe accident.

Source: NUREG/CR-6906/SAND2006-2274P, July 2006 if hydrogen concentrations increase to dangerous levels. Of PWRs with Ice Condenser Containments and course, to soundly make such decisions, operators would BWR Mark III Containments need to ascertain local hydrogen concentrations throughout The NRC requires that PWRs with ice condenser the containment, which would be especially dif"cult in the containments and BWR Mark IIIs operate with hydrogen course of a fast-moving and/or chaotic accident scenario. igniters installed in their containments in order to mitigate Among the PWRs in the United States that still have the hydrogen that would be generated in the event of a severe hydrogen recombiners installed, only one has PARs (Indian accident.140 However, hydrogen igniters should be used only Point Unit 2); the others have thermal recombiners in cases where the effects of their use are entirely predictable, typically two units in each containment. In Europe, some and predictions must indicate that the containment would PWRs have from 30 to 60 PARs installed and distributed in not be threatened by any potential de"agrations arising from their containments to help mitigate hydrogen in the event the deliberate ignition of hydrogen.141 of a severe accident.136 This is puzzling, given that such Safety experts have questioned the safety of using igniters recombiners would be prone to behaving like igniters to mitigate hydrogen at certain times in some severe accident malfunctioning by incurring ignitionsin elevated hydrogen scenarios. For example, an OECD Nuclear Energy Agency concentrations.137 report published in August 2000 states, The main question in After intensive deliberation, European regulators decided the application of the igniter concept is its safety orientation.

not to require igniters in PWRs (those without ice condenser The use of igniters should reduce the overall risk to the containments) because [u]ncertainties were identi"ed with containment and should not create new additional hazards respect to, among other aspects, hydrogen distribution and such as a local detonation.142 combustion behavior.138 In line with the reasoning behind Another paper, published in 2006, states that [w]ith early this decision, it seems that European regulators should ignition, the hydrogen will be eliminated by slow combustion also be hesitant about allowing PWRs to operate with PARs without high thermal and temperature loads, but with installed in their containments, because unintended ignitions late ignition, hydrogen detonation transition will quickly from such recombiners would be neither predictable nor occur with high local thermal and pressure loads which will preventable in a severe accident. threaten the integrity of the containment.143 Another problem with hydrogen recombiners is that in a A 1990 NRC letter to plant owners cautions that hydrogen severe accident, cesium iodide particles transported through igniters would be prevented from operating in station them could be converted into volatile iodine, producing an blackouts at PWRs with ice condenser containments and additional source term of radiation exposure.139 31 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

Figure 15: Prestressed concrete containment vessel In a severe accident, water already present or pumped (PCCV) at the Ohi Unit 3 reactor in Japan into the reactor core to cool the fuel rods would heat up and produce thousands of kilograms of steam, which would A 1:4 scale model of a prestressed concrete containment enter the drywell of the primary containment. The water in vessel (PCCV) at the Ohi Unit 3 reactor in Japan, undergoes a the wetwells suppression pool is intended to condense the massive rupture in a 2001 Sandia Laboratory test at 3.63 times steam and help absorb the heat released by the accident to its design pressure (Pd), or 206.4 psig. The pressurized model reduce the pressure in the primary containment; as the steam had experienced leak rates in earlier tests, indicating functional pressure builds up in the drywell, steam vents downward failure at 2.4 times Pd. into the wetwell through pipes, which terminate underwater in the suppression pool. (Without the condensation of the steam in the suppression pool, the relatively small primary containments of BWR Mark Is and Mark II units (often termed pressure suppression containments) would quickly fail from overpressurization.

However, the generation of suf"ciently large quantities of non-condensable hydrogen gas in a severe accident could overwhelm the capacity of the primary containment. For example, there could be a severe accident scenario at a BWR Mark I in which there is a rapid accumulation of steam in the drywell and non-condensable gas (nitrogen149 and hydrogen) in the wetwell; in such a scenario, the primary containments pressure could rapidly increase up to the venting and failure levels.150 Early BWRs Perform Poorly in Containment Leak-Rate Tests, Even When Liberal Test Protocols Allow Pretest Repairs to Supposedly As Found Condition of Seals and Valves Source: NNUREG/CR-6906/SAND2006-2274P, July 2006 BWR Mark I and Mark II primary containments are designed to limitnot preventhydrogen leakage in accidents. In overall leak rate tests151conducted below design pressure BWR Mark IIIs. If hydrogen were not burned off, it could such containments leak hundreds of pounds of air per day.

reach detonable concentrations; if power were then restored, For example, in 1999, tests conducted at Nine Mile Point the igniters could cause a hydrogen detonation.144 Unit 1, a BWR Mark I, and Limerick Unit 2, a BWR Mark II, BWR Mark I and BWR Mark II Containments found that overall leakage rates at both units were in excess of Hydrogen generation is a serious problem for the small- 350 pounds of air per day,152, 153 which is actually less than the volume, inerted BWR Mark I primary containment, because maximum allowed leak rates.

hydrogen is non-condensable at the temperatures expected This means that in a severe accident even if there were in a nuclear power plant.145 In a BWR severe accident, no damage to a primary containment, hydrogen would hundreds of kilograms of non-condensable hydrogen gas leak into the secondary containment (the reactor building);

would be generated (potentially exceeding 3,000 kg146) at leak rates would increase as the internal pressure increased rates as high as 5,000 to 10,000 grams per second if there were and would become even greater if the seals at the various a re-"ooding of an overheated reactor core.147 This would piping and cable penetrations were damaged. (Typical BWR increase the internal pressure of the primary containment. containments have 175 penetrations, almost twice as many If enough hydrogen were generated, the containment would as typical PWR containments.)154 likely "rst leak excessively before failing catastrophically from Regarding reactor containments and hydrogen leakage, a overpressurization. 2011 IAEA report states:

A BWR Mark I primary containment is made up of a [N]o containment is fully leak tight, [hydrogen] will leak drywell shaped like an inverted lightbulb, which contains the to the surrounding areas, which often have the function reactor vessel, and a steel wetwell (also called a torus) shaped of secondary containment. Hence, there is a certain like a doughnut, which surrounds the base of the drywell. risk that combustion may occur outside the primary The drywell and wetwell are connected by large pipes. The containment. This may lead to combustion loads exerted wetwell is half "lled with water (typically about 790,000 on the containment from outside. Usually, containments gallons148)and is sometimes referred to as a suppression have considerable margin against loads from inside, as pool. A BWR Mark II primary containment also has a drywell they are in principle designed to carry the pressure loads and wetwell (concrete), but these are shaped and oriented from a large break LOCA. The pressure bearing capability from their BWR Mark I counterparts. for loads from outside can be substantially less155 32 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

In an accident, a mixture of hydrogen, nitrogen, and Remarkably, the current 10-year requirement already steam would leak from a BWR primary containment; as represents a loosening of the original leak-test intervals, internal pressures increased and the accident progressed, which stood at 2.0 to 3.3 years prior to 1995, depending the concentration of hydrogen in the leaking mixture on the particular nature of the test.165 In its safety analyses would increase. If there were no damage to the primary to assess extending the test intervals, the NRC has simply containment, the quantity of hydrogen that leaked (by overlooked the fact that BWR Mark I and Mark II primary weight) would be relatively small, because hydrogen is about containments are vulnerable to hydrogen leakage. Moreover, 14 times less dense than air.156 However, a BWR secondary as reactors approach and exceed their originally-licensed containmentwhich has a design pressure of approximately lifetimes of 40 years, one might intuitively conclude that the 3.0 psig157could be breached if, for example, between 20 need for containment leak rate testing is actually increasing, to 40 pounds of hydrogen were to leak into it, accumulate not diminishing, in order to gauge the impact of aging locally, and explode. penetration seals and isolation valves on containment In a severe accident, it is highly probable that the seals integrity under a range of accident scenarios, including at the penetrations of BWR Mark I and Mark II primary severe accidents.

containments would become degraded (of course, some Local leak rate tests of containment penetrations penetration-seals could already be degraded by material are supposed to be conducted as as-found tests, aging before the accident occurred.) A 1984 report from meaning that the penetrations are not supposed to be Brookhaven National Laboratory advises that severe repaired immediately before testing; however, NUREG/

accident risk estimates should consider [t]he potential for CR-4220 reports that all of the NRC Senior Inspectors for containment leakage through penetrations prior to reaching containment systems [who] were contacted and asked to estimated containment failure pressures. The report relate their experience with containment isolation system further notes it is highly probable that the leakage of BWR performance.166 They stated that:

Mark I and Mark II primary containments would prevent [R]eported leakage rates often do not represent true overpressurization, and that [f]ailure of non-metallic seals leakage rates. Utilities are generally allowed to perform for containment penetrations (primarily equipment hatches, some minor repair on a valve prior to recording its as-drywell heads, and purge valves) are the most signi"cant found condition for a leakage test. Similarly, major repair sources of containment leakage.158 BWR drywell heads, (such as completely rebuilding a valve) is permitted prior which have diameters between 30 to 40 feet, would most to recording a valves as-left condition at the end of its likely incur the highest leak rates in the containment as leakage test.167 internal pressures increased.159 Containments have had leaks, exceeding allowable leakage Hence, around 1985 when NUREG/CR-4220 was rates, that lasted for many monthsprimarily from large published, it was a common practice for utilities to make penetrations, such as the purge and vent valves, [main steam minor repairs on valves immediately before recording isolation valves, for BWRs only], and valves inadvertently left their as-found leak rates. The local leak rate tests that are open.160 In fact, BWR Mark I primary containments have intended to measure leakage rates at containment isolation failed a number of overall leak rate tests; for example, Oyster valves are termed Type C tests. In September 1995, the Creekthe oldest operating commercial reactor in the U.S., NRC extended Type C test intervals from two years to "ve which is considered to be quite similar to Fukushima Daiichi years. Interestingly, the failure rates of Type C as-found tests Unit 1has failed at least "ve tests.161 have decreased by about one order of magnitude since the In one test, Oyster Creeks primary containment leaked at test intervals for such tests were increased in 1995.168 Such a rate that was 18 times greater than its design leak rate;162 signi"cant improvements beg the question: since 1995, to if this test was conducted at 35 psig, the same pressure as what degree have valves been repaired immediately before subsequent Oyster Creek tests,163 which seems likely, the recording their as-found leak rates?

primary containment leaked at a rate in excess of 6800 NUREG/CR-4220 states that one of the NRC Senior pounds of air per day.164 Such results beg the question: what Inspectors indicated that Types B and C tests [local leak rate were the pre-accident leak ratesbelow design pressureof tests] are performed before Type A [overall leak rate test],

the three primary containments that leaked hydrogen at enabling repairs to be made sothat the Type A test can be Fukushima Daiichi? passed easily.169 Since the Fukushima Daiichi accident, the problem of In a March 2013 ACRS meeting, an ACRS member similarly hydrogen leakage from primary containments has not been observed that [i]f they did all their preparations perfectly, adequately addressed. (Mark II primary containments would they would never fail.170 It is clear that overall leak rate tests also incur hydrogen leaks in severe accidents.) In fact, the and local leak rate tests would provide a far more accurate NRC is currently preparing to reduce the frequency of both assessment of pre-existing containment leak rates if repairs local and overall leak rate testing from once every "ve and were not allowed to be made immediately before testing.

once every 10 years, respectively, to once every 75 months A report from the Electric Power Research Institutes and 15 years, respectively. (EPRI), Risk Impact Assessment of Extended Integrated 33 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

Table 6: Historical Reactor Containment Integrated Leak Rate Test (ILRT) Failures Even with Test Protocol Allowing Pre-Test Repairs (circa 1985)

Source: P.J. Pelto et al., Reliability Analysis of Containment Isolation Systems, Paci"c Northwest Laboratory, NUREG/CR 4220, June 1985, available at: NRCs ADAMS Documents, Accession Number:

ML103050471 Leak Rate Testing Intervals,171 has been used by the NRC to In a severe accident, any primary containment in a help justify the extension of testing intervals.172 However, this condition that would cause it to fail a leak-rate test would report overlooked the fact that in severe accidents, BWR Mark leak dangerous quantities of explosive hydrogen gas into a I and Mark II primary containments leak explosive hydrogen reactor building, even at below design pressure; however, the gas into secondary containments. A second major problem NRC does not seem concerned about excessive leakage rates.

with EPRIs report is that its list of overall leak rate test failures A 1995 NRC report177 concluded thatincreasing allowable does not include the majority of test failures reported in leakage rates by 10 to 100 times results in a marginal risk NUREG/CR-4220. NUREG/CR-4220 lists a total of 60 overall increase, while reducing costs by about 10 percent178 (integrated) leak rate tests that failed before March 1985;173 [emphasis added]. And a 1989/1990 NRC report179 concluded in fact, NUREG/CR-4220 also reports that when considering that even if there is a containment leakage of 100 percent per the results of local leak rate tests that failed with excessive day, the calculated individual latent cancer fatality risk is leakage rates, the number of overall leak rate tests that failed below the NRCs safety goal.180 Clearly, this safety goal would is a total of 109.174 not be achieved if leaking hydrogen were to detonate in By contrast, EPRIs report lists a total of nine containment secondary containments, as it did at Fukushima Daiichi.

leakage or degradation events that occurred before March In March 2013, the NRC stated that [s]ensitivity 1985.175 Regarding its methodology for assessing the risk analyses in NUREG-1493 and other studies show that light impact of extended test intervals, EPRIs report states water reactor accident risk is relatively insensitive to the The "rst step is to obtain current containment leak rate containment leakage rate because the risk is dominated testing performance information. This information by accident sequences that result in failure or bypass of is used to develop the probability of a pre-existing leak in containment181 [emphasis added]. The progression of the the containment using the Jeffreys Non-Informative Prior Fukushima Daiichi accident was certainly affected by the statistical method [emphasis added].176 Clearly, the NRC leakage of hydrogen gas. In fact, it is possible that Unit 3s needs to review a large portion of the existing data that EPRI primary containment did not fail before hydrogen leaked overlooked and reassess the risk impact of extended test into the Unit 3 secondary containment and detonated.

intervals.

34 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

The internal pressure of Unit 3s primary containment It is important to consider that in the Fukushima Daiichi actually increased after the hydrogen explosion occurred. accident, the particular design of the installed vents may The explosion occurred on March 14 at 11:01 am, then have caused the accident to be worse than it would have been at 12:00 pm the primary containments pressure started without their use: The INPO report of November 2011 states increasing from 52.2 psia to 53.7 psia, at 4:40 pm the pressure that it is postulated that the hydrogen explosion in the Unit started decreasing from 69.6 psia, and at 8:30 pm the pressure 4 reactor building was caused by hydrogen from Unit 3.194 started increasing from 52.2 psia.182 In the Fukushima Daiichi Unit 3 and Unit 4s containment vent exhaust piping was accident, the BWR Mark I primary containments of Units 1, interconnected, so hydrogen may have been vented from 2, and 3 incurred internal pressures that exceeded the loads Unit 3 to Unit 4s secondary containment,195 where it they were designed to sustain. According to an INPO report detonated.

published in November 2011, the highest recorded internal In severe accidents, spent fuel pools are vulnerable to the pressures in the primary containments of Units 1, 2, and 3 hydrogen explosions that can occur in BWR Mark I and Mark were approximately 1.7, 1.7, and 1.4 times greater than their II secondary containments. Spent fuel pools, which store fuel design pressures, respectively.183 (In the accident, hydrogen assemblies after they are discharged from the reactor core, leaked from the primary containmentsaccording to INPO: are located in the secondary containment of these designs, most probably at the penetrations184of Units 1, 2, and 3 elevated about 70 to 80 feet above ground level. If a spent fuel and detonated in the secondary containments of Units 1, 3, pool were compromised by a hydrogen explosion, it could and 4.) The NRC has stated that in the circumstances of the cause large radiological releases.

Fukushima Daiichi accident, it is reasonable to conclude that Some thought initially that the explosion that occurred in BWR Mark IIs would also incur devastating consequences, Fukushima Daiichi Unit 4 at 6:00 am on March 15, 20113.63 because Mark II containment designs are only slightly larger days after the March 11, 2011 earthquakecould have been in volume than Mark I containment designs185 and also use caused by the detonation of hydrogen gas generated by the wetwell pressure suppression.186 reaction of steam with the zirconium cladding of fuel rods stored in the spent fuel pool. Subsequent investigations Reliable Hardened Vents indicated that this was not the case.

In an attempt to resolve the problems of BWR Mark I and However, according to a 2012 ORNL paper, the hydrogen Mark II primary containment overpressurization and decay that detonated could have come from the Unit 4 pools fuel heat removal, in March 2012, the NRC ordered that reliable assemblies reacting with steam: If there were a loss of spent hardened vents be installed in BWR Mark Is and Mark IIs by fuel pool cooling, the water in the pool would be heated by December 31, 2016.187 (As stated above, in September 1989, the fuel rods decay heat until it reached the boiling point; the NRC had tried to solve the same problems by issuing then the water would boil away, uncovering the fuel rods.

non-legally binding guidance to all the owners of BWR Mark ORNL computer analyses found that in this scenario, a Is, recommending188 that hardened vents be installed in Mark total of 1,800 kg to 2,050 kg of hydrogen could have been Is.189) The NRCs order stipulates a number of performance generated. The analyses also found that 150 kg of hydrogen objectives and features that a new design of a hardened vent an amount that could have caused the Unit 4 explosion must have; for example, shall include a means to prevent would have been generated 3.63 days after the accident inadvertent actuation.190 commenced if the initial water level in the pool were 4.02 It could be dif"cult to design a hardened vent that meters (at the top of the active length of the fuel rods).196 would perform well in scenarios in which there were rapid The NRC does not require that hydrogen be mitigated in containment-pressure increases. A 1988 report by the the secondary containments of BWR Mark I and Mark II sites Committee on the Safety of Nuclear Installations report states in severe accidents. This is a problem, because hydrogen that [f ]iltered venting is less feasible for those sequences could leak into secondary containments and explode, as resulting in early over-temperature or overpressure occurred in the Fukushima Daiichi accident. The Fukushima conditions. This is because the relatively early rapid increase Daiichi accident demonstrated that BWR Mark I secondary in containment pressure requires large containment containmentsessentially ordinary industrial buildings penetrations for successful venting.191 This indicates that a with design pressures of approximately 3.0 psig197cannot reliable hardened vents piping will likely need a diameter withstand hydrogen explosions. (BWR Mark II secondary and thickness greater than what has been voluntarily containments also have low design pressures.) In line with installed at BWR Mark I containments in the United States.192 the NRCs approach to safety through defense-in-depth,198 If a hardened vent were designed for passive operation by the Fukushima Daiichi accident scenario of hydrogen means of a rupture disk, in place of a remotely or manually leaking from overpressurized primary containments and/

actuated valve, venting would occur if a predetermined or hardened vent systems should be considered as likely to threshold pressure were reached. A reliable passive venting occur again, in the event of a severe accident at either a BWR capability could be bene"cial in severe accident scenarios Mark I or BWR Mark II.

that have rapid containment pressure increases. However, a 1983 Sandia National Laboratories manual cautions that it may be dif"cult to design vents that can handle the rapid transients involved in a severe accident.193 35 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

C. MONITORING CORE DEGRADATION high in low-pressure accidents, like large-break LOCAs, and when there are high drywell temperatures.204 AND HYDROGEN GENERATION IN SEVERE In the Fukushima Daiichi accident, plant operators did not ACCIDENTS know the actual condition of the reactor cores of Units 1, 2, In a severe accident, plant operators would need equipment and 3. In a December 2011 article, Saloman Levya former that effectively monitored evolving conditions; information, GE engineer-manager for BWRs205stated his judgment such as temperatures in the reactor core and hydrogen that in the Fukushima Daiichi accident, plant operators concentrations in the containment, would help them manage should have recognized that water level measurements were an accident and implement hydrogen mitigation. Without unreliable and that reactor and containment pressures as accurate and prompt core and containment diagnostics, well as the wetwell water temperature would be superior plant operators would not be able to properly manage indicators of the state of the core. According to Levy, The an accident. Unfortunately, some of the current methods reactor and the containment pressures will rise faster when of monitoring core and containment diagnostics are hydrogen is produced. Increased reactor and containment inadequate. pressure rates and wetwell [water] temperature rises con"rm accelerated core melt.206 Yet what Levy recommends is not Monitoring Core Degradation a solution to the problem of identifying the correct time In a severe accident involving a PWR, the primary tool used to transition to SAMGs in a BWR severe accident, because to detect inadequate core cooling and uncovering of the the rapid zirconium-steam reaction would have already core would be coolant temperature measurements taken commenced by the time operators con"rmed an accelerated with core-exit thermocouples (temperature measuring core melt.

devices) at a point above the active length of the fuel rods.

In many cases, a predetermined core-exit thermocouple MONITORING FOR THE PRESENCE OF measurement would be used to signal the time for PWR OXYGEN AND HYDROGEN operators to transition from emergency operating procedures The NRC requires that BWR Mark I and Mark II units (EOP) to severe accident management guidelines (SAMG).

operate with oxygen monitors installed in their primary The NRCs Near-Term Task Force report states that EOPs containments in order to con"rm that the containment typically cover accidents to the point of loss of core cooling remains inerted during operation. In a severe accident, if a and initiation of inadequate core cooling (e.g., core exit primary containment were to become de-inerted, severe temperatures in PWRs greater than 649 degrees Celsius [1,200 accident management strategies, such as purging and degrees Fahrenheit]).199 venting, would need to be considered.207 Experimental data indicates that core-exit thermocouple The NRC also requires that all licensed plants operate measurements would not be an adequate indicator for with the ability to monitor hydrogen concentrations in when to safely transition from EOPs to SAMGs.200 Two of the their containments. However, in 2003, the NRC reclassi"ed main conclusions from experiments are: 1) that core-exit hydrogen monitors (and oxygen monitors) as non-safety-temperature measurements display in all cases a signi"cant related equipment,208, 209 meaning that this equipment does delay (up to several hundred seconds) and: 2) that core-exit not have to undergo full quali"cation (including seismic temperature measurements are always signi"cantly lower (up quali"cation), does not have redundancy, and does not to several hundred degrees Celsius) than the actual maximum require onsite (standby) power.

cladding temperature.201 In an experiment simulating a severe In severe accidents, hydrogen monitors would be used accidentLOFT LP-FP-2core-exit temperatures were to help assess the degree of core damage that had occurred measured at approximately 800°F when in-core fuel-cladding and to help with accident management. For example, BWR temeratures exceeded 3300°F.202 Mark IIIs use hydrogen monitors to help guide emergency In a severe accident, plant operators are supposed to operating procedures: Hydrogen igniters would not be used implement SAMGs before the onset of the rapid zirconium-In scenarios in which hydrogen reached concentrations that steam reaction, which leads to thermal runaway in would threaten containment integrity if the hydrogen were to the reactor core. Clearly, using core-exit thermocouple combust.

measurements in order to detect inadequate core cooling BWR Mark I and Mark IIs operate with hydrogen monitors or uncovering of the core would be neither reliable nor installed in their inerted primary containments yet do safe. For example, PWR operators could end up re-"ooding not have such monitors in their secondary containments.

an overheated core simply because they did not know the David Lochbaum of the Union of Concerned Scientists actual condition of the core. Unintentionally re-"ooding an has cautioned that [t]he inability to monitor hydrogen overheated core could generate hydrogen, at rates as high as concentrations could cause [plant] operators to not vent effectiveness.203

[BWR Mark I and Mark II] reactor buildings, thus leading Core-exit thermocouples are not installed in BWRs. In a to ignitions resulting in loss of secondary containment severe accident involving this type of reactor, plant operators integrity. He states further that without the ability to monitor are supposed to detect inadequate core cooling or uncovering hydrogen, operators could preemptively vent the reactor of the core by measuring the water level in the reactor core.

buildings when it was not necessary to do so, which would However, after the onset of core damage BWR reactor water also cause radioactive releases.210 level measurements are unreliable; and can read erroneously 36 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

In 1983, the NRC issued an order requiring that in a severe Despite Fukushima Daiichis three devastating hydrogen accident, hydrogen monitors function within 30 minutes explosions, the NRC has relegated severe-accident hydrogen after coolant water is injected into the reactor vessel; in 1998, safety issues to the least proactive stage of its post-Fukushima the NRC determined that the 30-minute requirement can be regulatory responses to the accident (termed Tier 3). NRDC overly burdensome and imposed a 90-minute requirement, believes that the NRC should reconsider its approach and instead.211 The NRC seems to believe that all severe accidents promptly address severe accident safety issues involving would be slow-moving station-blackout accidentsa hydrogen. In this section we outline a number of safety complete loss of grid-supplied and backup onsite alternating initiatives that the NRC should pursue to reduce the risk of current powerlike the Fukushima Daiichi accident; it does hydrogen explosions in severe accidents.

not consider that fast-moving accidents are also possible.

Figure 16: Cutaway View of PWR Pressure Vessel and Core of Korean Standard Nuclear Power Plant Plus (KSNP +)

Deployed at Shin-Kori 1 and 2; Shin-Wolsong 1 and 2, South Korea.

Two-Loop PWR design based on U.S.

Combustion Engineering System 80 +.

To control the reactor, dozens of control rod extensions (2) must penetrate the vessel closure head (3) via nozzles (1) so that control rods can be withdrawn or inserted to control the "ssion reaction in nuclear fuel assemblies (8).

Highly pressurized water in the primary cooling loop enters the reactor vessel at (7) and exits at (5), the site of coolant temperature measurements that are supposed to guide operator actions in an accident.

Source: econtent.unm.edu/cdm/search/collection/nuceng 37 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

Figure 17: GE Boiling Water Reactor (BWR) Model 6 Reactor Vessel Note that control rod blades on the bottom must be hydraulically driven upward into the core, rather than dropping from above as they do in a PWR.

Source: USNR Technical Training Center Reactor Concepts Manual: Boiling Water Reactor (BWR) Systems, www.nrc.gov/reading-rm/basic-ref/teachers/03.pdf 38 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

Figure 18 Source: Reactor Concepts Manual, Boiling Water Reactor Systems, USNRC, Technical Training Center, www.

nrc.gov/reading-rm/basic-ref/teachers/03.pdf 39 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

V. NRDCS RECOMMENDATIONS FOR REDUCING THE RISK OF HYDROGEN EXPLOSIONS IN SEVERE NUCLEAR ACCIDENTS A. DEVELOP AND EXPERIMENTALLY C. SIGNIFICANTLY IMPROVE EXISTING VALIDATE COMPUTER SAFETY OXYGEN AND HYDROGEN MONITORING MODELS THAT WOULD BE CAPABLE OF INSTRUMENTATION CONSERVATIVELY PREDICTING RATES The NRC should reclassify oxygen and hydrogen monitors OF HYDROGEN GENERATION IN SEVERE as safety-related equipment that has undergone full ACCIDENTS quali"cation (including seismic quali"cation), has redundancy, and has its own independent train of emergency The NRC needs to acknowledge that its existing computer electrical power. These recommendations are in accordance safety models underpredict the rates of hydrogen generation with the conclusions of the NRCs Advisory Committee that occur in severe accidents. The NRC should conduct a on Reactor Safeguards (ACRS), which stated that [t]he series of experiments with multi-rod bundles of zirconium experience at Fukushima showed that essential reactor and alloy fuel rod simulators and/or (actual) fuel rods as well as containment instrumentation should be enhanced to better study the full set of existing experimental data. The NRCs withstand beyond-design basis accident conditions and objective in this effort should be to develop models capable that [r]obust and diverse instrumentation that can better of predicting with greater accuracy the rates of hydrogen withstand severe accident conditions is needed to diagnose, generation that occur in severe accidents.

select, and implement accident mitigation strategies and monitor their effectiveness.212 The NRC should require that, after the onset of a severe B. ASSESS THE SAFETY OF EXISTING accident, hydrogen monitors be functional within a HYDROGEN RECOMBINERS, AND time frame that enables timely detection of quantities of POTENTIALLY DISCONTINUE THE USE OF hydrogen indicative of core damage and a potential threat PARS UNTIL TECHNICAL IMPROVEMENTS to containment integrity. The current requirement that hydrogen monitors be functional within 90 minutes of the ARE DEVELOPED AND CERTIFIED injection of coolant water into the reactor vessel is clearly Experimentation and research should be conducted in order inadequate for protecting public and plant worker safety.

to improve the performance of PARs so that they would not NRDC supports the Union of Concerned Scientists request malfunction and incur ignitions in the elevated hydrogen to the NRC regarding hydrogen-monitoring instrumentation.

concentrations that occur in severe accidents. Some The NRC should require that hydrogen monitoring experimentation and research has already been conducted; instrumentation be installed in 1) BWR Mark I and Mark II however, the problem of PARs incurring ignitions in elevated secondary containments, 2) the fuel handling buildings of hydrogen concentrations remains unresolved. PWRs and BWR Mark IIIs, and 3) any other plant structure The NRC and European regulators should also perform where it would be possible for hydrogen to enter.

safety analyses to determine if existing PARs should be removed from plant containments. It is possible such analyses would "nd that removing PARs would help improve D. UPGRADE CURRENT CORE DIAGNOSTIC safety in the event of a severe accident. Until PARs are CAPABILITIES IN ORDER TO BETTER SIGNAL developed that do not pose a risk of ignitions in elevated hydrogen concentrations, the NRC and European regulators TO PLANT OPERATORS THE CORRECT should also review whether to replace PARs with electrically TIME TO TRANSITION FROM EMERGENCY powered thermal hydrogen recombiners. However, this could OPERATING PROCEDURES TO SEVERE prove costly, and thermal hydrogen recombiners would not ACCIDENT MANAGEMENT GUIDELINES function in a station-blackout accident unless provided with The NRC should require plants to operate with their own independent train of emergency power.

thermocouples placed at different elevations and radial In a severe accident, plant operators would be able to positions throughout the reactor core to enable plant turn off thermal recombiners in order to prevent them operators to accurately measure a wide range of temperatures from operating in elevated hydrogen concentrations.

inside the core under both typical and accident conditions.

However, to safely operate thermal recombiners, operators In the event of a severe accident, in-core thermocouples would be required to have instrumentation providing would provide plant operators with crucial information to timely information on the local hydrogen concentrations help them track the progression of core damage and manage throughout the containment.

the accidentfor example, indicating the correct time to transition from EOPs to SAMGs.

40 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

E. REQUIRE ALL NUCLEAR POWER PLANTS F. REQUIRE THAT DATA FROM LEAK RATE TO CONTROL THE TOTAL QUANTITY OF TESTS BE USED TO HELP PREDICT THE HYDROGEN THAT COULD BE GENERATED IN HYDROGEN LEAK RATES OF THE PRIMARY A SEVERE ACCIDENT CONTAINMENT OF EACH BWR MARK I The NRC should require all PWRs (with large dry AND MARK II LICENSED BY THE NRC IN containments, subatmospheric containments, and ice DIFFERENT SEVERE ACCIDENT SCENARIOS condenser containments) and BWR Mark IIIs to operate with The NRC should require that data from overall leak rate tests systems for combustible gas control that would effectively and local leak rate testsalready required by Appendix J and safely control the total quantity of hydrogen that to Part 50 for determining how much radiation would be could potentially be generated in different severe accident released from the containment in a design basis accident scenarios (this value is different for PWRs and BWRs). The be used to help predict hydrogen leak rates from the primary NRC should also require the same for BWR Mark I and Mark containment of each BWR Mark I and Mark II licensed by II unless it is demonstrated that venting (without causing the NRC under different severe accident scenarios. If data signi"cant radiological releases) their inerted containments from an individual leak rate test indicates that dangerous would effectively and safely control the hydrogen generated quantities of explosive hydrogen gas would leak from a in severe accidents. Systems for combustible gas control primary containment in a severe accident, the plant owner also need to effectively and safely control the total quantity would be required to repair the containment.

of hydrogen that could potentially be generated at all times NRDC also recommends that the NRC require that overall throughout different severe accident scenarios, taking into leak rate tests and local leak rate tests be conducted without account the potential rates of hydrogen generation.

allowing repairs to be made immediately before the testing of Additionally, the NRC should require all PWRs and BWR potential leakage paths, such as containment welds, valves, IIIs to operate with systems for combustible gas control "ttings, and components which penetrate containment.213 that would be capable of preventing local concentrations Additionally, NRDC recommends that the NRC reevaluate of hydrogen in the containment or other structures its plan to extend the intervals of overall and local leak rate from reaching levels that would support combustions, tests to once every 15 years and 75 months, respectively.214 de"agrations, or detonations that could cause a loss of (There are two types of local leak rate tests; Type B is containment integrity and/or necessary accident mitigating required at least once every 10 years.) The NRC needs to features.

conduct safety analyses that take into account the relatively Furthermore, the NRC should require licensees of PWRs greater vulnerability of BWR Mark I and Mark II primary with ice condenser containments and BWR Mark IIIs (and containments to hydrogen leakage. It is probable that the any other nuclear power plants that would operate with intervals between leak rate tests would need to be shortened hydrogen igniter systems) to perform analyses demonstrating rather than extended.

that their hydrogen igniter systems would effectively The NRC also needs to consider that in the past it was a and safely mitigate hydrogen in different severe accident common practice to make repairs to valves immediately scenarios. Licensees unable to do so should be ordered to before conducting as found local leak rate tests. Clearly, upgrade their systems to adequate levels of performance.

such tests do not provide accurate assessments of preexisting containment leak rates. The NRC needs to investigate whether repairs have been recently made immediately before conducting as found tests. More important, the NRC needs to fully integrate into its regulatory role the fact that in the Fukushima Daiichi accident, hydrogen leaked from the primary containments of Units 1, 2, and 3 and detonated in the secondary containments of Units 1, 3, and 4, causing large radiological releases.

41 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

ENDNOTES 13 In a PWR, fuel rod temperatures could exceed 1830°F within 60 seconds; at a BWR, fuel rod temperatures could exceed 1830°F within 1 In this report we frequently refer to severe nuclear accidents:

three minutes.

i.e., accidents in which there is severe damage to the reactor corefor example, a partial core meltdown. A severe nuclear accident could 14 The equation for the reaction is written as Zr + 2H2O ZrO2 +

be caused by a natural disaster, mechanical failure, or plant operator 2H2 + energy. The energy (heat) generated by the reaction is about errors. The accidents at Three Mile Island Unit 2, Chernobyl Unit 4, and 6.5 megajoules per kilogram (kg) of Zr reacted.

Fukushima Daiichi Unit 1, 2, and 3 were all severe accidents.

15 Randall O. Gauntt, Sandia National Laboratories, email to Jason 2 As nuclear safety expert David Lochbaum has noted, Secondary Schaperow of NRC, Re: Cladding Behavior Under Steam and Air containment is designed to have limited leakageinto the reactor Conditions, January 31, 2000, available at: www.nrc.gov, Electronic building. The secondary containment leak test entails starting the standby Reading Room, ADAMS Documents, Accession Number: ML010680338.

gas treatment system. This system features fans, ductwork, dampers, and "lter trains that draw air from the reactor building and refueling "oors. 16 In the TMI-2 accident, cooling water was discharged from the pilot-This "ltered air is discharged via an elevated release point. The "lter trains operated relief valve, which was stuck open.

are tested periodically to see if they remove over 99% of the radioactive 17 Robert E. Henry held research positions at Argonne National particles from the discharge stream. Note to author from David L.

Lochbaum, nuclear safety expert with the Union of Concerned Scientists, Laboratory during the decade leading up to the TMI-2 accident and was 01-06-2014. associate director of the Reactor Analysis and Safety Division at Argonne when he became involved in the evaluation of the TMI-2 accident, as 3 Since hydrogen is a noncondensable gas, it will accumulate in the part of a group formed by the Electric Power Research Institutes Nuclear air space above the water surface of the suppression pool. When the Safety Analysis Center (NSAC).

differential pressure between the drywell and wetwell gets too great, vacuum breakers open automatically to transport hydrogen gas from the 18 Robert E. Henry, presentation slides from TMI-2: A Textbook in wetwell into the drywell, where it can accumulate or leak out into the Severe Accident Management, 2007 ANS/ENS International Meeting, surrounding reactor building. November 11, 2007; seven of these presentation slides are in Attachment 2 of the transcript from 10 C.F.R. 2.206 Petition Review Board Re:

4 Note to author from David L. Lochbaum, nuclear safety expert with Vermont Yankee Nuclear Power Station, July 26, 2010, available at:

the Union of Concerned Scientists, January 6, 2014. ADAMS Documents, Accession Number: ML102140405, Attachment 2.

5 This request to the NRC was "rst made by the Union of Concerned 19 Robert E. Henry, presentation slides from TMI-2: A Textbook in Scientists. Severe Accident Management.

6 Typical operating BWR and PWR coolant pressures are approximately 20 It is acknowledged that runaway oxidation occurred in the TMI-2 1000-1050 pounds per square inch (psi) and approximately 2250 accident; however, the temperature at which it commenced is unknown, psi, respectively. See International Atomic Energy Agency (IAEA), because there is no thermocouple data from the hot spots of the Assessment and Management of Ageing of Major Nuclear Power fuel assemblies. NRDC does not intend to present Robert E. Henrys Plant Components Important to Safety: BWR Pressure Vessels, postulation that runaway oxidation of zirconium cladding by steam IAEA-TECDOC-1470, October 2005, p. 7; and IAEA, Assessment and commenced at 1832°F in the TMI-2 accident as evidence that a runaway Management of Ageing of Major Nuclear Power Plant Components reaction did in fact commence at 1832°F.

Important to Safety: PWR Pressure Vessels, IAEA-TECDOC-1120, October 1999, p. 5. 21 Robert E. Henry, presentation slides from TMI-2: A Textbook in Severe Accident Management.

7 The NRCs de"nition of the reactor coolant system: The system used to remove energy from the reactor core and transfer that energy either 22 NRC, Feasibility Study of a Risk-Informed Alternative to 10 CFR directly or indirectly to the steam turbine. See www.nrc.gov/reading-rm/ 50.46, Appendix K, and GDC 35, June 2001, available at: ADAMS basic-ref/glossary/reactor-coolant-system.html. Documents, Accession Number: ML011800519, p. 3-1.

8 Typical operating BWR and PWR coolant temperatures are 540°-550°F 23 Peter Hofmann, Current Knowledge on Core Degradation and 540°-620°F, respectively. See IAEA, Assessment and Management Phenomena, a Review, Journal of Nuclear Materials 270, Nos. 1-2 (April of Ageing of Major Nuclear Power Plant Components Important to Safety: 1, 1999), p. 205.

BWR Pressure Vessels, IAEA-TECDOC-1470, October 2005, p. 7; and 24 Sherrell R. Greene, Oak Ridge National Laboratory, The Role of IAEA, Assessment and Management of Ageing of Major Nuclear Power BWR Secondary Containments in Severe Accident Mitigation: Issues and Plant Components Important to Safety: PWR Pressure Vessels, IAEA- Insights from Recent Analyses, 1988.

TECDOC-1120, October 1999, p. 5.

25 The regulation 10 C.F.R. § 50.46(b)(i) stipulates that in a postulated 9 For consistency, this report will use the term zirconium to refer to all design basis accident, [t]he calculated maximum fuel element cladding the various types of zirconium alloys that make up fuel cladding. Zircaloy, temperature shall not exceed 2200°F.

ZIRLO, and M5 are particular types of zirconium alloy fuel cladding. In a LOCA environment, the oxidation behavior of the different fuel cladding 26 E. Bachellerie et al., Generic Approach for Designing and materials, with various zirconium alloys, would be similar because of their Implementing a Passive Autocatalytic Recombiner PAR-System in Nuclear shared zirconium content. Power Plant Containments, Nuclear Engineering and Design 221, Nos.

1-3 (April 2003), p. 158 (hereinafter Designing and Implementing a PAR-10 The NRCs de"nition of a design basis accident: A postulated accident System in NPP Containments).

that a nuclear facility must be designed and built to withstand without loss to the systems, structures, and components necessary to ensure public 27 Atomic Energy Commission, Safety Evaluation Report for Indian health and safety. See www.nrc.gov/reading-rm/basic-ref/glossary/design Point Nuclear Generating Unit No. 3, Docket No. 50-286, September basis-accident.html. 21, 1973, available at: www.nrc.gov, Electronic Reading Room, ADAMS Documents, Accession Number: ML072260465, p. 6-10.

11 The NRC states that beyond design basis accident is a term used as a technical way to discuss accident sequences that are possible but 28 E. Bachellerie et al., Designing and Implementing a PAR-System in were not fully considered in the design process because they were NPP Containments, p. 158.

judged to be too unlikely. (In that sense, they are considered beyond the 29 OECD Nuclear Energy Agency, State-of-the-Art Report on Flame scope of design basis accidents that a nuclear facility must be designed Acceleration and De"agration-to-Detonation Transition in Nuclear Safety, and built to withstand.) See www.nrc.gov/reading-rm/basic-ref/glossary/ NEA/CSNI/R(2000)7, August 2000, available at: www.nrc.gov, NRC beyond-design basis-accidents.html. Library, ADAMS Documents, Accession Number: ML031340619, p. 6.38 12 The coolant water slows down or moderates the kinetic energy (hereinafter Report on FA and DDT).

of the neutrons produced by "ssion, enabling a self-sustaining "ssion 30 E. Bachellerie et al., Designing and Implementing a PAR-System in reaction in the uranium isotope 235U, which makes up about 4 percent of NPP Containments, p. 158.

the uranium in the fuel.

42 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

31 J. Star"inger, Assessment of In-Vessel Hydrogen Sources, in 49 L. J. Ott, Advanced BWR Core Component Designs and the Projekt Nukleare Sicherheitsforschung: Jahresbericht 1999 (Karlsruhe: Implications for SFD Analysis, p. 4.

Forschungszentrum Karlsruhe, FZKA-6480, 2000).

50 L. J. Ott, Advanced BWR Core Component Designs and the 32 OECD Nuclear Energy Agency, In-Vessel Core Degradation Code Implications for SFD Analysis, p. 4.

Validation Matrix: Update 1996-1999, report by an OECD NEA Group of 51 IAEA, Mitigation of Hydrogen Hazards in SA, p. 14.

Experts, October 2000, p. 13.

52 OECD Nuclear Energy Agency, In-Vessel Core Degradation Code 33 IAEA, Mitigation of Hydrogen Hazards in Severe Accidents in Nuclear Validation Matrix: Update 1996-1999, report by an OECD NEA Group of Power Plants, IAEA-TECDOC-1661, July 2011, p. 10 (hereinafter Experts, October 2000, p. 210.

Mitigation of Hydrogen Hazards in SA).

53 G. Bandini et al., Presentation Slides, Progress of ASTEC Validation 34 This estimate is based on that fact that large BWR cores and large PWR cores have up to approximately 800 and 200 fuel assemblies, on Circuit Thermal-Hydraulics and Core Degradation, 3rd European respectively (see NRC, Boiling Water Reactors (located at: http://www. Review Meeting on Severe Accident Research September 23-25, 2008, nrc.gov/reactors/bwrs.html) and NRC, Pressurized Water Reactors pp. 24, 28 (located at: http://www.sar-net.org/upload/4-5_bandini_

(located at: http://www.nrc.gov/reactors/pwrs.html)); and recent designs ermsar2008_1.pdf ).

of BWR and PWR fuel assemblies have up to approximately 190 kg and 54 Charles Miller et al., NRC, Recommendations for Enhancing Reactor 480 kg of initial uranium mass per assembly, respectively (see NRC, Safety in the 21st Century: The Near-Term Task Force Review of Insights Certi"cate of Compliance No. 1014, Appendix B, Approved Contents and Design Features for the Hi-Storm 100 Cask System, (available at from the Fukushima Daiichi Accident, SECY-11-0093, July 12, 2011, ADAMS No: ML13351A189), pp. 2.39, 2.44). Hence, large BWR cores and available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession large PWR cores are estimated to have a total of approximately 152,000 Number: ML111861807, p. 3.

kg and 96,000 kg of initial uranium mass, respectively. 55 Burton Richter et al., Report of the Fuel Cycle Research and 35 BWRs and PWRs have up to approximately 800 and 200 fuel Development Subcommittee of the Nuclear Energy Advisory Committee, assemblies in their cores, respectively. NRC, Boiling Water Reactors June 2012, p. 5.

(located at: http://www.nrc.gov/reactors/bwrs.html) and NRC, Pressurized Water Reactors (located at: http://www.nrc.gov/reactors/ 56 A.P. Ramsey, T. McKrell, and M.S. Kazimi, Silicon Carbide Oxidation pwrs.html). in High Temperature Steam, Advanced Nuclear Power Program, MIT-ANP-TR-139, 2011, abstract.

36 Recent designs of BWR and PWR fuel assemblies have on the order of 96 and 264 fuel rods per assembly, respectively. Hence BWR and 57 A triplex cladding design consists of three layers of material PWR cores can have up to approximately 76,800 and 52,800 fuel rods per surrounding the nuclear fuel: an inner layer of dense silicon carbide for core, respectively; so BWRs cores can have approximately 45 percent "ssion gas retention, a central composite layer of wound silicon carbide more fuel rods. NRC, Certi"cate of Compliance No. 1014, Appendix "bers to enhance mechanical performance, and an outer environmental B, Approved Contents and Design Features for the Hi-Storm 100 Cask barrier coating to enhance corrosion resistance. See Ken Yueh, David System, (available at ADAMS No: ML13351A189), pp. 2.39, 2.44. Carpenter, and Herbert Feinroth, Clad in Clay, Nuclear Engineering International (January 2010), p. 14-15.

37 Yasuo Hirose et al., An Alternative Process to Immobilize Intermediate Wastes from LWR Fuel Reprocessing, WM99 Conference, 58 Ken Yueh, David Carpenter, and Herbert Feinroth, Clad in Clay, February 28-March 4, 1999. Nuclear Engineering International (January 2010), p. 14.

38 Jae Sik Yoo and Kune Yull Suh, Analysis of TMI-2 Benchmark 59 A 2011 Idaho National Laboratory report states that the thermal Problem Using MAAP4.03 Code, Nuclear Engineering and Technology conductivity of silicon carbide can exceed the value of zirconium before 41, No. 7 (September 2009), p. 949. irradiation. Extended irradiation tends to lower the [thermal] conductivity to a value half to one-third that of zirconium. See George Grif"th, Idaho 39 IAEA, Mitigation of Hydrogen Hazards in SA, p. 6.

National Laboratory, U.S. Department of Energy Accident Resistant SiC 40 Report by Nuclear Energy Agency Groups of Experts, OECD Nuclear Clad Nuclear Fuel Development, INL/CON-11-23186, October 2011.

Energy Agency, In-Vessel and Ex-Vessel Hydrogen Sources, NEA/

60 David M. Carpenter, Gordon E. Kohse, and Mujid S. Kazimi, An CSNI/R(2001)15, October 1, 2001, Part I: B. Clément (IPSN), K. Trambauer Assessment of Silicon Carbide as a Cladding Material for Light Water (GRS), and W. Scholtyssek (FZK), Working Group on the Analysis and Reactors, Advanced Nuclear Power Program, MIT-ANP-TR-132, Management of Accidents, GAMA Perspective Statement on In-November 2010, abstract.

Vessel Hydrogen Sources, p. 15 (hereinafter: In-Vessel and Ex-Vessel Hydrogen Sources, Part I). 61 Electric Power Research Institute, Silicon Carbide Provides Opportunity to Enhance Nuclear Fuel Safety, EPRI Progress Report, 41 IAEA, Mitigation of Hydrogen Hazards in SA, p. 6.

September 2011, mydocs.epri.com/docs/CorporateDocuments/

42 Power Authority of the State of New York, Consolidated Edison Newsletters/NUC/2011-09/09d.html.

Company of New York, Indian Point Probabilistic Safety Study, 62 Burton Richter et al., Report of the Fuel Cycle Research and Vol. 8, 1982, available at: ADAMS Documents, Accession Number:

Development Subcommittee of the Nuclear Energy Advisory Committee, ML102520201, p. 4.3-10.

June 2012, p. 6.

43 The volume percent of the carbon monoxide in the containment is the 63 INPO, Report on the Fukushima Dai-ichi Accident, p. 24.

volume of the carbon monoxide in the containment divided by the volume of the containment multiplied by 100. 64 The author is indebted to David Lochbaum of the Union of Concerned Scientists for raising this point.

44 IAEA, Mitigation of Hydrogen Hazards in SA, p. 47.

65 E. Studer et al., Kurchatov Institute, Assessment of Hydrogen Risk in 45 Report by Nuclear Energy Agency Groups of Experts, OECD Nuclear PWR, [undated], p. 1.

Energy Agency, In-Vessel and Ex-Vessel Hydrogen Sources, Part I, p. 9.

66 Allen L. Camp et al., Sandia National Laboratories, Light Water 46 T.J. Haste et al., Organisation for Economic Co-Operation and Reactor Hydrogen Manual, NUREG/CR-2726, August 1983, p. 4-107.

Development, Degraded Core Quench: A Status Report, August 1996,

p. 13. 67 PWR ice condenser and BWR Mark III containments have volumes of approximately 1.2 x 106 cubic feet and 1.3 x 106 cubic feet, 47 L.J. Ott, Oak Ridge National Laboratory, Advanced BWR Core respectively; PWR large dry containments have a volume of approximately Component Designs and the Implications for SFD Analysis, 1997, p. 4.

2.2 x 106 cubic feet. PWRs with ice condenser containments and 48 LOFT LP-FP-2 was conducted in the Loss-of-Fluid Test Facility at Idaho BWR Mark IIIs have containment design pressures of approximately National Engineering Laboratory in July 1985. The CORA and QUENCH 20 psig and 15 psig, respectively; PWR large dry containments have a tests were conducted at Karlsruhe Institute of Technology in Germany in design pressure of approximately 53 psig. See M.F. Hessheimer et al.,

the 1980s and 1990s. Containment Integrity Research at SNL, NUREG/CR-6906, p. 24.

43 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

68 Charles Miller et al., Recommendations for Enhancing Reactor Safety 87 Kahtan N. Jabbour, NRC, letter regarding Turkey Point Units 3 and 4, in the 21st Century: The Near-Term Task Force Review of Insights from exemption from hydrogen control requirements, December 12, 2001, the Fukushima Daiichi Accident, p. 42. Attachment 2, Safety Evaluation by the Of"ce of Nuclear Reactor Regulation, Turkey Point Units 3 and 4, available at: www.nrc.gov, NRC 69 These analyses were conducted for different PWRs, which have Library, ADAMS Documents, Accession Number: ML013390647, p. 4.

containments with different free volumes and different quantities of fuel cladding (active length) in their cores; the containments of these PWRs 88 W. E. Lowry et al., Lawrence Livermore National Laboratory, Final also have different design pressures and estimated failure pressures. Results of the Hydrogen Igniter Experimental Program, NUREG/CR-Therefore, the results of these analyses do not directly apply to all 2486, February 1982, p. 4.

PWRs. However, they do provide a general idea of the magnitude of the 89 IAEA, Mitigation of Hydrogen Hazards in SA, p. 35.

pressure spikes that a PWR containment might be expected to incur if an explosionof the quantity of hydrogen generated from a zirconium-steam 90 OECD Nuclear Energy Agency, Report on FA and DDT, p. 1.2.

reaction of 100 percent of the active fuel cladding lengthwere to occur 91 IAEA, Mitigation of Hydrogen Hazards in SA, p. 33.

in the event of a severe accident.

92 D.W. Stamps et al., Sandia National Laboratories, Hydrogen-Air-70 T.G. Colburn, NRC, letter regarding Three Mile Island Unit 1, license Diluent Detonation Study for Nuclear Reactor Safety Analyses, NUREG/

amendment from hydrogen control requirements, February 8, 2002, CR-5525, January 1991, available at: www.nrc.gov, NRC Library, ADAMS , Safety Evaluation by the Of"ce of Nuclear Reactor Documents, Accession Number: ML071700388, p. 43.

Regulation, Related to Amendment No. 240 to Facility Operating License No. DPR-50, Three Mile Island Unit 1, available at: www.nrc.gov, NRC 93 OECD Nuclear Energy Agency, Carbon Monoxide-Hydrogen Library, ADAMS Documents, Accession Number: ML020100578, p. 5. Combustion Characteristics in Severe Accident Containment Conditions:

Final Report, NEA/CSNI/R(2000)10, 2000, p. 18.

71 Kahtan N. Jabbour, NRC, letter regarding Turkey Point Units 3 and 4, exemption from hydrogen control requirements, December 12, 2001, 94 Helmut Karwat, Igniters to Mitigate the Risk of Hydrogen , Safety Evaluation by the Of"ce of Nuclear Reactor ExplosionsA Critical Review, Nuclear Engineering and Design 118, Regulation, Turkey Point Units 3 and 4, available at: www.nrc.gov, NRC 1990, p. 267.

Library, ADAMS Documents, Accession Number: ML013390647, p. 3. 95 IAEA, Mitigation of Hydrogen Hazards in SA, p. 113.

72 Pounds per square inch gauge is the value of a given pressure 96 Advisory Committee on Reactor Safeguards, 586th Meeting, relative to the atmospheric pressure at sea level (14.7 pounds per square September 8, 2011, available at: ADAMS Documents, Accession Number:

inch). ML11256A117, p. 95.

73 Pounds per square inch absolute is the value of a given pressure 97 A number of hydrogen combustion experiments have been conducted relative to a vacuum (0.0 pounds per square inch). at Sandia National Laboratories; for example, such experiments were 74 Power Authority of the State of New York, Consolidated Edison conducted in the 1980s at the FLAME facilitya rectangular channel Company of New York, Indian Point Probabilistic Safety Study, Vol. 100 feet long, 8 feet high, and 6 feet wide. M.P. Sherman et al., Sandia 8, 1982, available at: www.nrc.gov, NRC Library, ADAMS Documents, National Laboratories, FLAME Facility: The Effect of Obstacles and Accession Number: ML102520201, p. 4.2-1 and Appendix 4.4.1, p. 14. Transverse Venting on Flame Acceleration and Transition to Detonation for Hydrogen-Air Mixtures at Large Scale, NUREG/CR-5275, available at:

75 Power Authority of the State of New York, Consolidated Edison ADAMS Documents, Accession Number: ML071700076, abstract.

Company of New York, Indian Point Probabilistic Safety Study, Vol.

8, 1982, available at: www.nrc.gov, NRC Library, ADAMS Documents, 98 Most experiments investigating the lower hydrogen concentration Accession Number: ML102520201, p. 4.3-22, 4.3-23. limits at which de"agration-to-detonation transition occurs have been conducted in detonation tubes; such tubes have been 39 to 70 feet long 76 M.F. Hessheimer et al., Containment Integrity Research at SNL, and about 11 to 17 inches in diameter. OECD Nuclear Energy Agency, NUREG/CR-6906, p. 28; the source of this quote is NRC, Severe Report on FA and DDT, p. 3.5.

Accident Risks: An Assessment or Five U.S. Nuclear Power Plants, NUREG-1150, Vol. 3, January 1991, Appendix D, Responses to 99 OECD Nuclear Energy Agency, International Standard Problem ISP-47 Comments on First Draft of NUREG-1150, p. D-22. on Containment Thermal Hydraulics: Final Report, NEA/CSNI/R(2007)10, September 2007, p. 7.

77 IAEA, Mitigation of Hydrogen Hazards in SA, p. 61-62.

100 Westinghouse, AP1000 Design Control Document, Rev. 19, Tier 78 M. F. Hessheimer et al., Containment Integrity Research at SNL, 2 Material, Chapter 19, Probabilistic Risk Assessment, Sections 19.41 NUREG/CR-6906, p. 8. to 19.54, June 13, 2011, available at: www.nrc.gov, NRC Library, ADAMS 79 IAEA, Mitigation of Hydrogen Hazards in SA, p. 62. Documents, Accession Number: ML11171A409, p. 19.41-2.

80 Institute of Nuclear Power Operations (INPO), Special Report on the 101 Charles Miller et al., Recommendations for Enhancing Reactor Nuclear Accident at the Fukushima Daiichi Nuclear Power Station, INPO Safety, SECY-11-0093, p. 42.11-005, November 2011, p. 9, 12, 21, 24, 25, 32, 37, 79, 85, 86, 96. 102 OECD Nuclear Energy Agency, SOAR on Containment Thermal 81 Institute of Nuclear Power Operations (INPO), Special Report on the Hydraulics and Hydrogen Distribution, 1999, p. 18.

Nuclear Accident at the Fukushima Daiichi Nuclear Power Station, INPO 103 OECD Nuclear Energy Agency, Report on FA and DDT, p. 1.6.11-005, November 2011, p. 9.

104 NRC, Notice Regarding Eliminating the Hydrogen Recombiner 82 The volume percent of the hydrogen in the containment is the Requirement, Federal Register 68, No. 186 (September 25, 2003), p.

volume of the hydrogen in the containment divided by the volume of the 55419.

containment multiplied by 100.

105 E. Bachellerie et al., Designing and Implementing a PAR-System in 83 IAEA, Mitigation of Hydrogen Hazards in SA, p. 35. NPP Containments, p. 158.

84 IAEA, Mitigation of Hydrogen Hazards in SA, p. 63. Containment 106 Indian Point Energy Center, License Renewal Application, Technical spray systems are typically located inside the roof dome of PWR Information, 2.0, Scoping and Screening Methodology for Identifying containments and are designed to spray cool water to condense the Structures and Components Subject to Aging Management Review and steam and reduce internal gas pressure within the containment. See Implementation Results, p. 2.3-61.

Figure 8.

107 E. Bachellerie et al., Designing and Implementing a PAR-System in 85 IAEA, Mitigation of Hydrogen Hazards in SA, p. 34. NPP Containments, p. 159.

86 IAEA, Mitigation of Hydrogen Hazards in SA, p. 33.

44 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

108 In January 1985, the NRC began requiring plant owners to install 126 NRC, Proceedings of the U.S. Nuclear Regulatory Commission hydrogen control systems in the containments of such designs. See NRC Eighteenth Water Reactor Safety Information Meeting, NUREG/CP-Policy Statement, Combustible Gas Control in Containment, Federal 0114, Vol. 2, April 1991. S.B. Dorofeev et al., Evaluation of the Hydrogen Register, Vol. 68, No. 179, September 16, 2003, p. 54124. Explosion Hazard, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML042250131, p. 328.

109 PWRs with ice condenser containments and BWR Mark IIIs have containment design pressures of approximately 20 psig and 15 127 Advisory Committee on Reactor Safeguards, 586th Meeting, psig, respectively. See M.F. Hessheimer et al., Containment Integrity September 8, 2011, available at: ADAMS Documents, Accession Number:

Research at SNL, NUREG/CR-6906, p. 24. ML11256A117, p. 95.

110 Allen L. Camp et al., Sandia National Laboratories, Light Water 128 Peter Hofmann, Current Knowledge on Core Degradation Reactor Hydrogen Manual, NUREG/CR-2726, August 1983, p. 4-107. Phenomena, a Review, Journal of Nuclear Materials 270, Nos. 1-2 (April 1, 1999), p. 208.

111 NRC Policy Statement, Combustible Gas Control in Containment, Federal Register 68, No. 179 (September 16, 2003), p. 54124. 129 Westinghouse, AP1000 Design Control Document, Rev. 19, Tier 2 Material, Chapter 19, Probabilistic Risk Assessment, Appendix 112 In December 1981, the NRC began requiring plant owners to operate 19D, Equipment Survivability Assessment, June 13, 2011, available BWR Mark Is and Mark IIs with inerted primary containments. See NRC at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number:

Policy Statement, Combustible Gas Control in Containment, Federal ML11171A416, p. 19D-3.

Register, Vol. 68, No. 179, September 16, 2003, p. 54123.

130 Westinghouse, AP1000 Design Control Document, Rev. 19, Tier 113 Federal Register 68, No. 179 (September 16, 2003), p. 54141.

2 Material, Chapter 1, Introduction and General Description of Plant, 114 IAEA, Mitigation of Hydrogen Hazards in SA, p. 74. Section 1.9, June 13, 2011, available at: www.nrc.gov, NRC Library, 115 BWR Mark I and Mark II primary containments have volumes of ADAMS Documents, Accession Number: ML11171A337, p. 1.9-80.

approximately 0.28 x 106 cubic feet and 0.4 x 106 cubic feet, respectively; 131 K. Fischer, et al., Hydrogen Removal from LWR Containments these are about one-eighth and one-sixth the volumes, respectively, by Catalytic-Coated Thermal Insulation Elements (THINCAT), Nuclear of typical PWR large dry containments. See M.F. Hessheimer et al., Engineering and Design 221 (January 2003), p. 146.

Containment Integrity Research at SNL, NUREG/CR-6906, p. 24.

132 Westinghouse quali"es that the AP1000 containments hydrogen 116 NRC, Order Modifying Licenses with Regard to Reliable Hardened igniter system, if operational during a severe accident, will burn hydrogen Containment Vents, EA-12-050, March 12, 2012, available at: www. as soon as the lean upward "ammability limits are met [emphasis nrc.gov, NRC Library, ADAMS Documents, Accession Number: added]. See Westinghouse, AP1000 Design Control Document, Rev.

ML12054A694. 19, Tier 2 Material, Chapter 19, Probabilistic Risk Assessment, Sections 117 See NRC, Installation of a Hardened Wetwell Vent, Generic Letter 19.41 to 19.54, p. 19.41-4.

89-16, September 1, 1989, p. 1. Generic Letter 89-16 states that the 133 NRC, letter to all licensees holding operating licenses and Commission has directed the [NRC] staff to approve installation of a construction permits for nuclear power plants, except licensees of BWR hardened vent under the provisions of 10 CFR 50.59 [Changes, Tests, Mark I plants, Completion of Containment Performance Improvement and Experiments] for licensees, who on their own initiative, elect to Program, Etc., July 6, 1990, available at: www.nrc.gov, NRC Library, incorporate this plant improvement. ADAMS Documents, Accession Number: ML031210418, p. 1.

118 NRC, Installation of a Hardened Wetwell Vent, Generic Letter 89- 134 D.W. Stamps et al., Sandia National Laboratories, Hydrogen-Air-16, September 1, 1989, p. 1. Diluent Detonation Study for Nuclear Reactor Safety Analyses, NUREG/

119 NRC Policy Statement, Combustible Gas Control in Containment, CR-5525, January 1991, available at: www.nrc.gov, NRC Library, ADAMS Federal Register 68, No. 179 (September 16, 2003), p. 54128; and see Documents, Accession Number: ML071700388, p. 53-p. 54.

NRC Policy Statement Severe Reactor Accidents Regarding Future 135 K. Fischer et al., Hydrogen Removal from LWR Containments Designs and Existing Plants, Federal Register 50, No. 153 (August 8, by Catalytic-Coated Thermal Insulation Elements (THINCAT), Nuclear 1985), p. 32138-32150. Engineering and Design 221 (January 2003), p. 146.

120 Westinghouse, AP1000 Design Control Document, Rev. 19, Tier 136 E. Bachellerie et al., Designing and Implementing a PAR-System in 2 Material, Chapter 19, Probabilistic Risk Assessment, Sections 19.34 NPP Containments, p. 159.

to 19.35, June 13, 2011, available at: www.nrc.gov, NRC Library, ADAMS 137 OECD Nuclear Energy Agency, Report on FA and DDT, p. 1.6.

Documents, Accession Number: ML11171A405, p. 19.34-4.

IAEA, Mitigation of Hydrogen Hazards in SA, p. 66.

121 M.P. Sherman et al., Sandia National Laboratories, FLAME Facility:

138 Eckardt, Bernd A., Michael Blase, and Norbert Losch, Containment The Effect of Obstacles and Transverse Venting on Flame Acceleration hydrogen control and "ltered venting design and implementation, and Transition to Detonation for Hydrogen-Air Mixtures at Large Scale, Framatome ANP, Offenbach, Germany (2002), p. 3-4.

NUREG/CR-5275, April 1989, available at: ADAMS Documents, Accession Number: ML071700076, p. 2. 139 Sonnenkalb, Martin, and Gerhard Poss, The international test programme in the THAI Facility and its use for code validation, 122 Westinghouse, AP1000 Design Control Document, Rev. 19, Tier EUROSAFE Forum, Brussels, Belgium (2009), pp. 16-17.

2 Material, Chapter 19, Probabilistic Risk Assessment, Sections 19.41 140 In January 1985, the NRC began requiring plant owners to install to 19.54, June 13, 2011, available at: www.nrc.gov, NRC Library, ADAMS hydrogen control systems in the containments of such designs. See NRC Documents, Accession Number: ML11171A409, p. 19.41-4.

Policy Statement, Combustible Gas Control in Containment, Federal 123 D.W. Stamps et al., Sandia National Laboratories, Hydrogen-Air- Register, Vol. 68, No. 179, September 16, 2003, p. 54124.

Diluent Detonation Study for Nuclear Reactor Safety Analyses, NUREG/

141 Helmut Karwat, Igniters to Mitigate the Risk of Hydrogen CR-5525, January 1991, available at: www.nrc.gov, NRC Library, ADAMS ExplosionsA Critical Review, Nuclear Engineering and Design 118, Documents, Accession Number: ML071700388, p. 43.

1990, p. 268.

124 G. Ciccarelli et al., Brookhaven National Laboratory, The Effect of 142 OECD Nuclear Energy Agency, Report on FA and DDT, p. 1.10.

Initial Temperature on Flame Acceleration and De"agration-to-Detonation Transition Phenomenon, NUREG/CR-6509, May 1998, available at: 143 Xiao Jianjun, Zhou Zhiwei, and Jing Xingqing, Safety www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: Implementation of Hydrogen Igniters and Recombiners for Nuclear Power ML071650380, p. 1. Plant Severe Accident Management, Tsinghua Science and Technology 11, No. 5 (October 2006), p. 557.

125 D.W. Stamps et al., Sandia National Laboratories, Hydrogen-Air-Diluent Detonation Study for Nuclear Reactor Safety Analyses, NUREG/

CR-5525, January 1991, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML071700388, p. 43.

45 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

144 NRC, letter to all licensees holding operating licenses and The Limerick Unit 2 test was conducted at 44.0 psig; it is assumed that construction permits for nuclear power plants, except licensees of BWR the test was conducted at 70°F. The density of air at 70°F and 1 atm is Mark I plants, Completion of Containment Performance Improvement 0.07495 pound per cubic foot. At 1 atm, there would be 28,411 pounds Program, Etc., July 6, 1990, p. 1. of air in the primary containment; at 44.0 psig (3.99 atm), there would be 113,475 pounds of air in the primary containment. The overall leakage 145 Hydrogen gas condenses to a liquid at approximately -423°F at the rate is 0.3272 percent of the containment airs weight (371 pounds) atmospheric pressure at sea level (14.7 psia).

per day. For information on the 1999 Limerick Unit 2 test, see Exelon, 146 IAEA, Mitigation of Hydrogen Hazards in SA, p. 10. Limerick Generating Station Units 1 and 2: Technical Speci"cations 147 J. Star"inger, Assessment of In-Vessel Hydrogen Sources, in Change RequestType A Test Extensions, Attachment 1, Evaluation of Projekt Nukleare Sicherheitsforschung: Jahresbericht 1999 (Karlsruhe: Proposed Change, p. 3.

Forschungszentrum Karlsruhe, FZKA-6480, 2000). 154 NRC, Regulatory Effectiveness Assessment of Option B of 148 NRC, NRC Information Notice 2006-01: Torus Cracking in a BWR Appendix J: Final Report, November 2002, available at: NRCs ADAMS Mark I Containment, January 12, 2006, available at: www.nrc.gov, Documents, Accession Number: ML023100201, p. 2.

NRC Library, ADAMS Documents, Accession Number: ML053060311, 155 IAEA, Mitigation of Hydrogen Hazards in Severe Accidents in , p. 1. Nuclear Power Plants, IAEA-TECDOC-1661, July 2011, p. 61.

149 Nitrogen is used to inert BWR Mark I and Mark II primary 156 The density of hydrogen at 68°F and 1 atm is 0.005229 pound per containments. cubic foot; the density of air at 70°F and 1 atm is 0.07495 pound per cubic 150 T. Okkonen, OECD Nuclear Energy Agency, Non-Condensable foot.

Gases in Boiling Water Reactors, NEA/CSNI/R(94)7, May 1993, p. 157 Sherrell R. Greene, Oak Ridge National Laboratory, The Role of 4-5. For a 3300-megawatt thermal BWR Mark I, in scenarios in which BWR Mark I Secondary Containments in Severe Accident Mitigation, hydrogen would be produced from a zirconium-steam reaction of Proceedings of the 14th Water Reactor Safety Information Meeting at the 40 percent, 70 percent, and 100 percent of all the zirconium in the reactor National Bureau of Standards, Gaithersburg, Maryland, October 27-31, core (equivalent to the quantity of hydrogen that would be produced from 1986, Exhibit 6.

a zirconium-steam reaction of 72 percent, 126 percent, and 180 percent, 158 G.H. Hofmayer et al., Containment Leakage During Severe Accident respectively, of the active fuel cladding length), if the total quantity Conditions, BNL-NUREG-35286, CONF-8406124-13, 1984, p. 6, 7, 8.

of noncondensable gases (including nitrogen) were to accumulate in the wetwell, the primary containments pressure would increase up 159 G.H. Hofmayer et al., Containment Leakage During Severe Accident to 107 psi, 161 psi, and 215 psi, respectively. See T. Okkonen, Non- Conditions, BNL-NUREG-35286, CONF-8406124-13, 1984, p. 4.

Condensable Gases in Boiling Water Reactors, p. 6.

160 A.K. Agraual et al., An Estimation of Pre-Existing LWR Containment 151 Appendix J to Part 50, Primary Reactor Containment Leakage Leakage Areas for Severe Accident Conditions, BNL-NUREG-34212, Testing for Water-Cooled Power Reactors, requires preoperational CONF-840614-35, 1984, p. 3.

and periodic leak rate tests for BWR Mark I and BWR Mark II primary 161 P. J. Pelto et al., Reliability Analysis of Containment Isolation containments. Leak rate tests are required for determining how much Systems, Paci"c Northwest Laboratory, NUREG/CR-4220, June 1985, radiation would be released from the containment in a design basis available at: NRC Library, ADAMS Documents, Accession Number:

accident: an accident in which a meltdown would be prevented.

ML103050471, p. 8.3.

152 The following calculation is done by assigning the net free air 162 Oyster Creeks design leak rate is 0.5 percent of the primary volume of Oyster Creeks Mark I primary containment301,300 cubic containment airs weight per day; in one overall leak rate test, Oyster feetto NMP-1. (At Oyster Creek, the minimum wetwell net water Creeks primary containment leaked at a rate of 9.0 percent of its airs volume is 82,000 cubic feet.) See GPU Nuclear Corporation and PLG, weight per day. See P.J. Pelto et al., Reliability Analysis of Containment Inc., Oyster Creek Probabilistic Risk Assessment: Level 2, Volume 1, Isolation Systems, NUREG/CR-4220, p. 8.5. See also NRC, Oyster June 1992, available at: NRC Library, ADAMS Documents, Accession Creek: Issuance of Amendment to Facility Operating License, September Number: ML060550287, p. 3.5. The typical design pressure of a BWR 1996, available at: NRC Library, ADAMS Documents, Accession Number:

Mark I primary containment is 58.0 pounds per square inch gauge (psig);

ML011300129, Enclosure 1, Amendment No. 186, p. 4.5-10.

see M.F. Hessheimer et al., Containment Integrity Research at SNL, NUREG/CR-6906, July 2006, p. 24. The Nine Mile Point Unit 1 test was 163 NRC, Oyster Creek: Issuance of Amendment to Facility conducted at 35.0 psig; it is assumed that the test was conducted at Operating License, September 1996, available at: NRC Library, 70°F. The density of air at 70°F and 1 atmosphere pressure (atm)14.696 ADAMS Documents, Accession Number: ML011300129, Enclosure 1, pounds per square inch absolute (psia)is 0.07495 pound per cubic Amendment No. 186, p. 1.0-5.

foot. At 1 atm, there would be 22,582 pounds of air in the primary 164 The net free air volume of Oyster Creeks Mark I primary containment; at 35.0 psig (3.38 atm), there would be 76,329 pounds of containment is 301,300 cubic feet. (At Oyster Creek, the minimum air in the primary containment. The overall leakage rate is 0.5045 percent wetwell net water volume is 82,000 cubic feet.) See GPU Nuclear of the containment airs weight (385 pounds) per day. For information on Corporation and PLG, Inc., Oyster Creek Probabilistic Risk Assessment:

the 1999 Nine Mile Point Unit 1 test, see NRC, Nine Mile Point Nuclear Level 2, Volume 1, June 1992, available at: NRC Library, ADAMS Station Unit No. 1Issuance of Amendment Re: One-Time Extension of Documents, Accession Number: ML060550287, p. 3.5. The typical design Primary Containment Integrated Leakage Rate Test Interval, Attachment pressure of a BWR Mark I primary containment is 58.0 psig. See M.F.

2, Safety Evaluation, March 2009, available at: NRC Library, ADAMS Hessheimer et al., Containment Integrity Research at SNL, NUREG/CR-Documents, Accession Number: ML090430367, p. 4, 14. 6906, July 2006, p. 24. The test was conducted before March 1985 (when 153 The net free air volume of Limerick Unit 2s Mark II primary NUREG-/CR-4220 was completed). NUREG-/CR-4220 does not state what containment is 379,071 cubic feet. (At Limerick Unit 2, the minimum pressure the test was conducted at; however, it is highly probable that the wetwell net water volume is 118,655 cubic feet.) See NRC, Limerick test was conducted at 35.0 psig, the pressureassociated with a design Generating Station Units 1 and 2Issuance of Amendments Re: basis loss-of-coolant accidentused for subsequent Oyster Creek tests.

Application of Alternative Source Term Methodology, Attachment 3, It is assumed that the tests were conducted at 70°F. The density of air at Safety Evaluation, August 2006, available at: NRC Library, ADAMS 70°F and 1 atm is 0.07495 pound per cubic foot. At 1 atm, there would be Documents, Accession Number: ML062210214, p. 32. The design 22,582 pounds of air in the primary containment; at 35.0 psig (3.38 atm),

pressure of Limerick Unit 2s primary containment is 55.0 psig; there would be 76,329 pounds of air in the primary containment. The see Exelon, Limerick Generating Station Units 1 and 2: Technical overall leakage rate is 9.0 percent of the containment airs weight (6870 Speci"cations Change RequestType A Test Extensions, Attachment pounds) per day. For information on the Oyster Creek test, see P.J. Pelto 1, Evaluation of Proposed Change, February 2007, available at: NRC et al., Reliability Analysis of Containment Isolation Systems, NUREG/

Library, ADAMS Documents, Accession Number: ML070530296, p. 4. CR-4220, p. 8.5.

46 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

165 In September 1995, the NRC revised its regulations to extend the 182 Institute of Nuclear Power Operations (INPO), Special Report on the overall (Type A) leak rate test interval from about 3.3 years to 10 years; to Nuclear Accident at the Fukushima Daiichi Nuclear Power Station, INPO extend the interval for Type B local leak rate tests, intended to measure 11-005, November 2011, p. 96.

leakage at penetrations (except for airlocks), from 2 years to a maximum 183 Institute of Nuclear Power Operations (INPO), Special Report on the of 10 years; and to extend the interval for Type C local leak rate tests, Nuclear Accident at the Fukushima Daiichi Nuclear Power Station, INPO intended to measure leakage at isolation valves, from 2 years to 5 years.11-005, November 2011, p. 11, 17, 24, 27, 29, 31.

After 1995, plant owners requested and received approval for one-time 5-year extensions to the 10-year interval requirement of the Type A test 184 Institute of Nuclear Power Operations (INPO), Special Report on the for about 94 reactors. In recent years, the NRC has been preparing to Nuclear Accident at the Fukushima Daiichi Nuclear Power Station, INPO extend Type A test intervals to once every 15 years and extend Type 11-005, November 2011, p. 20.

C test intervals to once every 75 months. In the proposed revisions, a 185 BWR Mark I and Mark II primary containments have volumes of preoperational Type A test would be required for new reactors, and a approximately 0.28 x 106 cubic feet and 0.4 x 106 cubic feet, respectively.

second test would be required within 4 years. If the "rst two tests were See M.F. Hessheimer et al., Containment Integrity Research at SNL, successful, one test would be required every 15 years. Extensions of NUREG/CR-6906, p. 24.

Type B and Type C test intervals would be permitted if two consecutive tests were successful. See NRC, Letter Regarding Regulatory Guide 186 NRC, Order Modifying Licenses with Regard to Reliable Hardened 1.163, Performance-Based Containment Leak-Test Program, March 20, Containment Vents, EA-12-050, March 12, 2012, available at: www.

2013, available at: NRC Library, ADAMS Documents, Accession Number: nrc.gov, NRC Library, ADAMS Documents, Accession Number:

ML13067A219, p. 2. See also Advisory Committee on Reactor Safeguards ML12054A694, p. 3.

(ACRS) 602nd Meeting Transcript, March 7, 2013, p. 10, 31-32. 187 NRC, Order Modifying Licenses with Regard to Reliable Hardened 166 P.J. Pelto et al., Reliability Analysis of Containment Isolation Containment Vents, EA-12-050, March 12, 2012, available at: www.

Systems, NUREG/CR-4220, p. 4.6. nrc.gov, NRC Library, ADAMS Documents, Accession Number:

ML12054A694.

167 P.J. Pelto et al., Reliability Analysis of Containment Isolation Systems, NUREG/CR-4220, p. 4.7. 188 NRC, Installation of a Hardened Wetwell Vent, Generic Letter 89-16, September 1, 1989, p. 1. Generic Letter 89-16 states that the 168 ACRS 602nd Meeting Transcript, March 7, 2013, p. 32-33. Commission has directed the [NRC] staff to approve installation of a 169 P.J. Pelto et al., Reliability Analysis of Containment Isolation hardened vent under the provisions of 10 CFR 50.59 [Changes, Tests, Systems, NUREG/CR-4220, p. 4.7. and Experiments] for licensees, who on their own initiative, elect to incorporate this plant improvement.

170 ACRS 602nd Meeting Transcript, March 7, 2013, p. 16.

189 NRC, Installation of a Hardened Wetwell Vent, Generic Letter 89-171 EPRI, Risk Impact Assessment of Extended Integrated Leak Rate 16, September 1, 1989, p. 1.

Testing Intervals, 1009325, Revision 2-A, October 2008.

190 NRC, Order Modifying Licenses with Regard to Reliable Hardened 172 ACRS 602nd Meeting Transcript, March 7, 2013, p. 37-39.

Containment Vents, EA-12-050, March 12, 2012, available at: www.

173 P. J. Pelto et al., Reliability Analysis of Containment Isolation nrc.gov, NRC Library, ADAMS Documents, Accession Number:

Systems, NUREG/CR-4220, p. 8.3. The manuscript of NUREG/CR-4220 ML12054A694, Attachment 2, p. 1.

was completed in March 1985.

191 R. Jack Dallman et al., Filtered Venting Considerations in the 174 Local leak rate tests (Type B and C tests) are typically performed United States, Committee on the Safety of Nuclear Installations (CSNI) before an overall leak rate test. This implies that the leak rates noted in Specialists Meeting on Filtered Vented Containment Systems, May 17-an [overall leak rate test] are smaller than the actual case. An additional 18, 1988, Paris, p. 3.

review of as found leakages from Type B and Type C tests was 192 The piping of hardened vents currently installed at U.S. BWR Mark I performed A total of 49 [overall leak rate test] reports were identi"ed plants is typically 8 inches in diameter.

for which the Type A [overall leak rate] test did not fail but with the consideration of Type B and C as found leakage would be classi"ed as 193 Allen L. Camp et al., Light Water Reactor Hydrogen Manual, a failure. To simplify the analysis these 49 failures are added directly NUREG/CR-2726, p. 2-66.

to the results presented above. Thus a total of 109 [overall leak rate test] 194 INPO, Report on the Fukushima Daiichi Accident, p. 34.

failures are identi"ed. Of these failures, 55 were for BWRs and 54 were for PWRs. See P. J. Pelto et al., Reliability Analysis of Containment 195 INPO, Report on the Fukushima Daiichi Accident, p. 33-34.

Isolation Systems, NUREG/CR-4220, p. 8.6. 196 Juan J. Carbajo, Oak Ridge National Laboratory, MELCOR Model of 175 EPRI, Risk Impact Assessment of Extended Integrated Leak Rate the Spent Fuel Pool of Fukushima Daiichi Unit 4, 2012, p. 1-2.

Testing Intervals, 1009325, Revision 2-A, October 2008, p. A-3. 197 Sherrell R. Greene, Oak Ridge National Laboratory, The Role of 176 EPRI, Risk Impact Assessment of Extended Integrated Leak Rate BWR Mark I Secondary Containments in Severe Accident Mitigation, Testing Intervals, 1009325, Revision 2-A, October 2008, p.v. Proceedings of the 14th Water Reactor Safety Information Meeting at the National Bureau of Standards, October 27-31, 1986, Gaithersburg, 177 NRC, Performance-Based Containment Leak-Test Program, Maryland, Exhibit 6.

NUREG-1493, September 1995.

198 The NRCs de"nition of defense-in-depth: An approach to designing 178 NRC, Regulatory Effectiveness Assessment of Option B of and operating nuclear facilities that prevents and mitigates accidents Appendix J: Final Report, November 2002, available at: NRC Library, that release radiation or hazardous materials. The key is creating multiple ADAMS Documents, Accession Number: ML023100201, p. 3. independent and redundant layers of defense to compensate for potential 179 NRC, Severe Accident Risks: An Assessment for Five U.S. Nuclear human and mechanical failures so that no single layer, no matter how Power Plants, Final Summary Report, NUREG-1150, Vols. 1 and 2, June robust, is exclusively relied upon. Defense-in-depth includes the use 1989 and December 1990. of access controls, physical barriers, redundant and diverse key safety functions, and emergency response measures. See www.nrc.gov/reading-180 NRC, Regulatory Effectiveness Assessment of Option B of rm/basic-ref/glossary/defense-in-depth.html.

Appendix J: Final Report, November 2002, available at: NRC Library, ADAMS Documents, Accession Number: ML023100201, p. 6. 199 Charles Miller, et al., Recommendations for Enhancing Reactor Safety in the 21st Century: The Near-Term Task Force Review of Insights 181 NRC, Letter Regarding Regulatory Guide 1.163, Performance-Based from the Fukushima Dai-ichi Accident, ML111861807 (2011), p. 47.

Containment Leak-Test Program, March 20, 2013, available at: NRC Library, ADAMS Documents, Accession Number: ML13067A219, p. 1.

47 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

200 Robert Prior et al., OECD Nuclear Energy Agency, Committee 209 In 2003, oxygen monitors were reclassi"ed from Category 1 to on the Safety of Nuclear Installations, Core Exit Temperature (CET) Category 2, and hydrogen monitors were reclassi"ed from Category 1 Effectiveness in Accident Management of Nuclear Power Reactor, NEA/ to Category 3. The NRC states, In general, Category 1 provides for full CSNI/R(2010)9, November 26 2010, p. 128-129. quali"cation, redundancy, and continuous real-time display and requires on-site (standby) power. Category 2 provides for quali"cation but is 201 Robert Prior et al., Core Exit Temperature (CET) Effectiveness in less stringent in that it does not (of itself) include seismic quali"cation, Accident Management of Nuclear Power Reactor, p. 128.

redundancy, or continuous display and requires only a high-reliability 202 Robert Prior et al., Core Exit Temperature (CET) Effectiveness in power source (not necessarily standby power). Category 3 is the least Accident Management of Nuclear Power Reactor, p. 49-50. stringent. It provides for high-quality commercial-grade equipment 203 ACRS, Review and Evaluation of the Nuclear Regulatory that requires only offsite power. See NRC, Regulatory Guide 1.97, Commission Safety Research Program: A Report to the U.S. Nuclear Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Regulatory Commission, NUREG-1635, Vol. 10, April 2012, p. 11. Plant and Environs Conditions During and Following an Accident, Revision 3, May 1983, available at: www.nrc.gov, NRC Library, ADAMS 204 IAEA, Generic Assessment Procedures for Determining Protective Documents, Accession Number: ML003740282, p. 1.97-4.

Actions During a Reactor Accident, IAEA-TECDOC-955, August 1997, p.

25, 26. 210 David Lochbaum, UCS, letter regarding installing hydrogen monitoring instrumentation in BWR Mark I and Mark II secondary 205 See Salomon Levy, How Would U.S. Units Fare? Nuclear containments as well as in the fuel handling buildings of BWR Mark Engineering International (December 7, 2011). The journals Author Info IIIs and PWRs, to David L. Skeen, NRC, Deputy Director, Division of states that Dr. Levy was the manager responsible for General Electric Engineering, Of"ce of Nuclear Reactor Regulation, January 20, 2012, p. 2.

(GE) BWR heat transfer and "uid "ow and the analyses and tests to support [GEs] nuclear fuel cooling during normal, transient, and accident 211 NRC Policy Statement, Con"rmatory Order Modifying Post-analyses from 1959 to 1977. TMI Requirements Pertaining to Containment Hydrogen Monitors for Arkansas Nuclear One, Units 1 and 2, Federal Register 63, No. 192 206 Salomon Levy, How Would U.S. Units Fare? Nuclear Engineering (October 5, 1998), p. 53466-53467. NRC, Regulatory Guide 1.7, Control International (December 7, 2011). Levy makes a point of saying that of Combustible Gas Concentrations in Containment, Revision 3, March his observations are not intended to be criticisms of the actions of the 2007, available at: www.nrc.gov, NRC Library, ADAMS Documents, Fukushima Daiichi plant operators. Accession Number: ML070290080, p. 6.

207 NRC Policy Statement, Combustible Gas Control in Containment, 212 ACRS, Review and Evaluation of the Nuclear Regulatory Federal Register 68, No. 179 (September 16, 2003), p. 54126. Commission Safety Research Program: A Report to the U.S. Nuclear 208 NRC Policy Statement, Combustible Gas Control in Containment, Regulatory Commission, NUREG-1635, Vol. 10, April 2012, p. 11.

Federal Register 68, No. 179 (September 16, 2003), p. 54126-54127. 213 Appendix J to Part 50, Primary Reactor Containment Leakage Testing for Water-Cooled Power Reactors.

214 NRC, Letter Regarding Regulatory Guide 1.163, Performance-Based Containment Leak-Test Program, March 20, 2013, available at: NRCs ADAMS Documents, Accession Number: ML13067A219, p. 2.

48 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

Natural Resources Defense Council 40 West 20th Street New York, NY 10011 212 727-2700 Fax 212 727-1773 Beijing Chicago Los Angeles Bozeman San Francisco Washington www.nrdc.org www.nrdc.org/policy www.facebook.com/nrdc.org www.twitter.com/nrdc 49 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents Printed on recycled paper