ML22112A081

Abb System 80+ Design Control Document - Volume 22

ML22112A081
Person / Time
Site:	LaSalle, 05200002
Issue date:	01/31/1997
From:	ABB Combustion Engineering
To:	Office of Nuclear Reactor Regulation
Shared Package
ML20148A597	List: LD-97-014, Transmits Final Version of Sys 80+ Design Control Document (DCD) LD-97-015, Informs That ABB-CE Has Completed Review of Effective Page Listing & Sys 80+ Design Control Document Revs Dtd Jan 1997 ML20148A821 ML22112A037 ML22112A038 ML22112A039 ML22112A042 ML22112A043 ML22112A044 ML22112A045 ML22112A046 ML22112A048 ML22112A049 ML22112A050 ML22112A051 ML22112A052 ML22112A075 ML22112A076 ML22112A077 ML22112A078 ML22112A079 ML22112A081 ML22112A085 ML22112A086 ML22112A088
References
NUDOCS 9705090171
Download: ML22112A081 (1)

Text

..- - - _ - _. - _ - _ _ _ _ _ _ __

1 O

i the System 80+

standardplant

, 1 Design ControlDocument l

O Volume 22 i i i

)

i i Illll ll l O combustion Engineering, Inc.

,, . - __ _, r.- __,_

O Copyright C 1997 Combustion Engineering, Inc.,

All Rights Reserved.

Warning, Legal Notice and Disclaimer of Liability The design, engineering and other information contained in this document have been prepared by or for Combustion Engineering, Inc. in connection with its application to the United States Nuclear Regulatory Commission (US NRC) for design certification of the System 80+ nuclear plant design pursuant to Title 10, Code of Federal Regulations Part 52. No use of any such information is authorized by Combustion Engineering, Inc.

except for use by the US NRC and its contractors in connection with review and approval of such application. Combustion Engineering, Inc. hereby disclaims all responsibility and liability in connection with unauthorized use of such information.

Neither Combustion Engineering, Inc. nor any other person or entity makes any warranty  ;

or representaticn to any person or entity (other than the US NRC in connection with its review of Combustion Engineering's application) conceming such information or its use, i except to the extent an express warranty is made by Corr.bustion Engineering, Inc. to its customer in a written contract for the sale of the goods or services descnbed in this I document. Potential users are hereby wamed that any such information may be j unsuitable for use except in connection with the performance of such a written contract I by Combustion Engineering, Inc.

Such information or its use are subject to copyright, patent, trademark or other rights of Combustion Engineering, Inc. or of others, and no license is granted with respect to such rights, except that the US NRC is authorized to make such copies as are necessary for the use of the US NRC and its contractors in connection with the  !

Combustion Engineering, Inc. application for design certification.

Publication, distribution or sale of this document does not constitute the performance of engineering or other professional services and does not create or establish any duty of l care towards any recipient (other than the US NRC in connection with its review of Combustion Engineering's application) or towards any petson affected by this document.

For information address. Combustion Engineering, Inc., Nuclear Systems Licensing, 2000 Day Hill Road; Windsor, Connecticut 06095 0

System 80+ Design ContmlDocument (em) Introduction Certified Design Material 1.0 Introduction 2.0 System and Structure ITAAC -

3.0 Non-System ITAAC 4.0 Interface Requirements 5.0 Site Parameters Approved Design Material- Design & Analysis 1.0 General Plant Description 2.0 Site Characteristics 3.0 Design of Systems, Structures & Components 4.0 Reactor 5.0 RCS and Connected Systems 6.0 Engineered Safety Features 7.0 Instrumentation and Control 8.0 Electric Power 9.0 Auxiliary Systems 10.0 Steam and Power Conversion g 11.0 Radioactive Waste Management f 12.0 Radiation Protection .

13.0 Conduct of Operations 14.0 Initial Test Program 15.0 Accident Analyses 16.0 Technical Specifications 17.0 Quality Assurance 18.0 Human Factors 19.0 Probabilistic Risk Assessment 20.0 Unresolved and Generic Safety Issues Approved Design Material - Emergency Operations Guidelines 1.0 - Introduction 2.0 Standard Post Trip Actions 3.0 Diagnostic Actions 4.0 Reactor Trip Recovery 5.0 ' Loss of Coolant Accident Recovery 6.0 Steam Generator Tube Rupture Recovery 7.0 ' Excess Steam Demand Event Recovery 8.0 Loss of All Feedwater Recovery 9.0 Loss of Offsite Power Recovery 10.0 Station Blackout Recovery 11.0 Functional Recovery Guideline

[N l

camama

<Q v

the System 80+

standardplant

, .[

K Approved Design Material

'O Design & Analysis j  :

O Combustion Engineering, Inc.

ARR MWW

r System 80+ Design Control Document 19.11 Severe Accident Phenomenology and Containment Performance for the System 80+

(' PWR 19.11.1 Introduction The PRA indicates that the design improvements of System 80+ have significantly decreased the likelihood of core damage in comparison to the System 80 design. As a result of this effort, a more '

balanced design has been achieved, and the contribution to severe accident risk from loss of offsite power (LOOP) events (including station blackout) has been significantly reduced.

This section provides a description of the severe accident mitigation features of the System 80+ design i and provides a technical basis for the severe accident phenomenology modeling assumptions. In addition, it discusses containment performance of the design for selected event sequences leading to severe accidents.

19.11.2 Scope This section describes major System 80+ severe accident mitigation features. However, it is not intended to restate the basic design information found elsewhere in the Design Control Document. Instead, this  ;

section will highlight the details of various reactor systems, discuss them from the viewpoint of severe i accident mitigation and management and clarify the impact of these mitigation features on the System 80+ PRA.

Section 19.11.3 describes the System 80+ severe accident mitigation design features. The System 80+

O design features considered include (1) a large dry steel primary containment, (2) a reinforced concrete secondary containment with an annulus ventilation filtration system. (3) a reactor cavity flooding system, (4) a hydrogen mitigation system to prevent in-containment hydrogen concentration from reaching  ;

detonation levels, (5) a safety depressurization system, (6) a large reactor cavity designed for retention ,

I and cooling of core debris, (7) missile protection structures, and (8) an integrated shutdown cooling and containment spray system.

Section 19.11.4 provides a concise discussion of severe accident phenomenological issues and a technical basis for their treatment within the System 80+ PRA. Experimental data or analyses used to support severe accident phenomonology related conclusions / assumptions are identified.

Section 19.11.5 provides representative analytical assessments of the severe accident containment performance of the System 80+ design. Assessments presented in these sections are obtained from analyses performed with an enhanced version of the MAAP 3.0B Rev 16. Enhancements have been included to allow proper representation of unique System 80+ design features. Representative performance of the System 80+ containment to a typical spectrum of severe accidents is provided.

Section 19.11.6 contains the conclusions with regard to the System 80+ design's containment performance under severe accident conditions.

l 4

(

Y i

Ayewd Chaelpre Atenerial. Probeb&saic Miek Assessmorrt Pope 19.11-1

System 80+ Design Control Document 19.11.3 System 80+ Design Features for Severe Accident Mitigation 19.11.3.1 Containment Design 19.11.3.1.1 Description of the Steel Containment The System 80+ containment vessel, including all its penetrations, is a low leakage spherical steel shell which is designed to withstand the postulated Loss-of-Coolant-Accident (LOCA) or a Main Steam Line Break (MSLB) while limiting the postulated release of radioactive material to within the requirements of 10 CFR 100. Additionally, the containment vessel provides a barrier against the release of radioactive materials which may be present in the containment atmosphere following an accident.

The containment spherical shell is 200 feet in diameter and is constructed of steel plates with wall thicknesses of two inches at the anchorage region and one and three-quaner inches outside the anchorage region. The material of construction is SA537 Class 2 steel. The containment shell is supponed by sandwicidng its lower portion between the building foundation concrete and the internal structure base of a spherica: depression in an intermediate Door of the shield building. Shear bars are welded to the containment vesse M the embedded region to provide restraint against sliding. The containment is a free standing structure above elevation 91'+9". The shield building (see Section 19.11.3.2) is a reinforced concrete cylindrical building with a hemispherical dome which totally encloses the containment.

The spherical containment provides 3.34 million cubic feet of net free volume with its internal structures arranged in a manner to (1) protect the steel shell from missile threats (see Section 19.11.3.7), (2) promote mixing throughout the containment atmosphere (See Figure 19.11.3.1-1), and (3) comfortably accommodate condensible and non-condensible gas releases from design basis and severe accidents. The internal structures, which are made of reinforced concrete, enclose the reactor vessel and other primary system components. The internal structures provide biological shielding for the containment interior and missile protection for the reactor vessel and containment shell.

19.11.3.1.2 Containment Shell Pressure Lhnits In severe accident scenarios the containment vessel is the last fission product barrier protecting the public from potentially large radiation releases. Therefore, it is of paramount imponance to provide a strong containment design to meet severe accident internal pressurization challenges. To this end, several structural analyses have been performed to characterize the System 80+ containment strength. These analyses have investigated containment strengths based on design, ASME Service Level "C" and ultimate failure criteria. The results of these assessments are summarized below.

19.11.3.1.2.1 Design Basis Pressure Capacity To determine the design basis pressure capacity, the containment vessel is analyzed to determine all membrane, bending and shear stresses resulting from the specified static and dynamic design loads. In this analysis, the vessel is idealized as a three dimensional thin shell using the finite element method of analysis. The stresses and deflections produced in the shell under the applied loads are calculated with the ANSYS computer program (Reference 207).

Seismic stresses and denections are calculated using the response spectrum method in the ANSYS computer code. The frequencies of vibration, corresponding modes shapes and panicipation factors are determined using the normal mode method. Modal responses are combined as described in Regulatory Approved Design Maternet. Probab&stic Risk Assessment Page 19.11-2

System 80+ Design ControlDocument

/]

V Guide 1.92 (Reference 208). The appropriate dunping level for the applied response spectra is defined in Regulatory Guide 1.61 (Reference 209).

The containment is evaluated for buckling using a rigorous analysis as described in Article NE-3222 of the ASME Code. This analysis is performed on a three dimensional model with the ANSYS finite l element computer code using a large deflection option. The model is the same as the three dimensional model used in the stress analyses of Section 3.8.2. In the analysis the deflection under load is

. continuously used to redefine the geometry of the structure, thus producing a revised structure stiffness i during iterative load steps. By observing the rate of change in deflection per iteration, the stability of the structure can be estimated. Two design basis loading conditions are evaluated for stability of the steel containment vessel: 1) a combination of dead weight, external pressure from inadvertent containment spray actuation, and seismic loads; 2) a combination of dead weight, internal design pressure, and thermal loads using the design basis temperature of 290*F.

A third condition is considered for stability with Severe Accident conditions; a combination of dead weight, internal design pressure and thermal loads using an accident temperature of 450'F.

Based on the above evaluations, the System 80+ design basis pressure limit for containment internal I

pressurization was determined to be 53 psig. The design basis differential pressure limit for subatmospheric containment pressurizations was calculated to be -2 psid. The analyses documented in Section 6.2.1 demonstrate that (1) the peak containment pressures calculated for the limiting design basis accident is 48.34 psig which is less than the design pressure limit of 53 psig, and (2) the pressure reduction from the limiting containment spray actuation scenario will be 1.84 psid which is less than the gm differential pressure limit of 2 psid.

The loading conditions for the severe accident stability considerations are based on the temperature and pressures determined in Section 19.11.5. The temperature of 450'F is a bounding uniform temperature that the containment vessel could reach in the several days following a severe accident. The internal pressure used in the analysis is 53 psig. This pressure is selected based on the observation that the severe accident events of a station blackout with dry cavity, and a large break loss of coolant accident (LOCA) with a dry cavity, produce the consistent high temperatures (Reference Sections 19.11.5.4.1 and i 19.11.5.4.2.2 and Figures 19.11.5.4.1.2-3 and 19.11.5.4.2.2-2) in the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The peak pressure within the first several days of these events is below 68 psia (Reference Figures 19.11.5.4.1.2-2 and 19.11.5.4.2.2-1). The stability safety factor determined for the severe accident conditions is 1.9.  !

19.11.3.1.2.2 ASME Service Level "C" Stress Evaluation An evaluation was performed to determine the containment pressure that may be reached without l exceeding the ASME Boiler & Pressure Vessel Code, Service Level "C" allowable stress intensities.

l:

ASME Service Level "C" loading conditions allow material strains representative of incipient yield assuming minimum material properties and consequently provides a conservative estimate of the containment ultimate capacity.

The analyses considered a range of containment temperature value<, representative of severe accident degraded containment performance and the effects of dead weight and penetrations. These evaluations  !

were performed using a three dimensional ANSYS model of the containment spherical shell which accounts for the presence of major penetrations (equipment hatch, personnel air lock, etc.). Results of

/ this evaluation are presented in Figure 19.11.3.1-2. These calculations indicate that pressure limits (7) determir'ed in accordance with ASME Service Level "C" criteria decrease from about 145 psia at an average steel shell temperature of 290*F to 135 psia at a temperature of 450*F.

i Aweved Design Afsterint- Probabikstic Risk Assessment Page 19.11-3

System 80+ Design Contro1 Document 19.11.3.1.2.3 System 80+ Ulthnate Capacity Evaluation for PRA 19.11.3.1.2.3.1 Structural Analysis Methodology The System 80+ containment is to be constructed from high strength SA537 carbon steel. A feature of this material is that at pressures above yield the containment stress-strain curve is relatively flat (from a strain of 0.002 to 0.006)* (see Reference 210). Above 0.006 strain, the material demonstrates strain hardening. As a result of this flat stress-strain curve, once the yield point of the material is exceeded the shell may rapidly grow by up to 7.2 inches. This growth is likely to be sufficient to create a small area separation between the shell and some of the larger penetrations.

Considering the above feature of the containment material, the ultimate strength of the shell was established using an axisymmetric shell model with added local mass to represent the shell penetrations.

Ultimate containment failure was assumed to occur (due to penetration failure) once the global shell stress exceeds the yield point. The median ultimate containment strength was established by pressurizing the axisymmetric shell model until the median material yield stress was reached. For these analyses the median yield stress was conservatively set to be 10% above minimum material properties (A more realistic assessment would be 15%, see Section 19.11.3.1.2.3.2)**. Median ultimate containment failure pressures are tabulated below for a range of containment temperatures.

Median Temperature (*F) Yield Stress (psi) Failure Pressure (psia) 150 63,250 188 290 57,728 171 350 56,210 168 450 53,680 160 The 150*F to 450*F temperature range selected for the analysis was based on anticipated plant transient performance during design basis accidents, as well as " wet" and " dry" cavity severe accident scenarios (see Section 19.11.5).

19.11.3.1.2.3.2 Considerations Regarding Containment Stress / Strain Relations and Fragility in order to develop a fragility curve, it was assumed that containment failure would follow once material yield properties are exceeded on a global basis. Therefore, a fragility curve was developed which explicitly accounts for material property variations at the yield point.

Reruits of a review of test data for the mechanical properties of 1.5 to 1.75 inch carbon steel plates composed of SA537 or similar material are presented in Reference 210. Data from one hundred and twenty two tests were considered. This data sampling indicated that the mean yield stress of the material was 69.1 ksi with a standard deviation of 3,3 ksi. This implies a mean stress / minimum stress ratio of ,

1.15. To conservatively represent this data, the mean value of the shell material for the ultimate pressure This feature is common to high strength steels used in PWR designs.

Measured stress-strain curves from a NIPPON steel plate of similar material composition to SA537 indicated a yield stress of 80,000 psi.

Approved Design Motwis! . ProbabMostic Rrsk Assessment Pese 19.114

l System 80+ Design contro1 Document {

I

,m analysis was set at 110% of the ASME code minimum property for SA537 carbon steel plate. The (v) maximum material property was set at only 120% of the minimum value.  ;

Using the minimum, mean and maximum yield values defined above a series of ultimate yield strength calculations were performed at temperatures of 290,350 and 450*F. Results of these axisymmetric shell analyses are summarized in Table 19.11.3.1-1.

1 19.11.3.1.2.4 Containment Fragility Curve The above failure probability information was used in conjunction with containment shell design basis and service level "C" analysea to establish a correspondence with System 80+ strain calculations and containment failure.

The rules applied in ;onstructing the System 80+ containment fragility curve were as follows:

• The probability of containment failure while the containment material remains well within the clastic range of the shell material was defined as zero. This probability was applied to an internal pressure up to 1.5 times the design pressure (see Reference 107).

• Material strains associated with the Service Level "C" criterion and developed using the three dimensional ANSYS model, were assumed to be representative of minimum local incipient yield conditions and will consequently have a low failure potential. Under these conditions the probability of containment failure was set at 0.03.

rm

(")

• Containment failure was considered unlikely provided the predicted local stress using code specified minimum material properties is below the ASME Level "C" stress on a global shell wide basis. The pressure associated with this stress was based on the axisynunetric ultimate failure analysis discussed in Section 19.11.3.1.2.3.1 and was assumed to have a containment failure probability of 0.05.

• Containment failure due to failure of a penetration was considered likely (probability = 0.5) once the global shell stress exceeded the mean material yield stress.

For purposes of this evaluation, the oyp w was defined as 1.10* o yp , min and oyp, = 1.2

• oyp. ,; minimum properties are taken as defined by ASME code.

Using the above definition, containment failure implies a small gradual leak around the penetration. A global catastrophic failure of the containment is highly unlikely.

\

(

N.))

Anwend Design A4sterial ProbaMstic Risk Assessment Page 19.115

System 80+ oesign controlcoeument Based upon the aforementioned rules the containment fragility curve was constructed using the following tabular data:

Pressure Level Internal Pressure Failure Probability (psia)

Design 68 0.00 1.5 x Design 94 0.00 ASME Level "C" (Local 3D) 145-135 0.03 ASME Level *C" (Global) 157-147 0.05 Nominal Yield (mean properties) 172-160 0.50 Maximum deld (max. propenies) 187-174 1.00 This method was used to translate data obtained from containment stress analyses to fragility (probabilistic failure) curves at temperatures typical of both early and late containment failure. It was assumed that early failure stress curves allow greater strength because of the lower shell temperatures expected prior to containment failure. In these instances, containment failure is due to a rapid pressurization process to which the shell cannot thermally respond. The design basis accident (DBA) peak temperature (290*F) was selected as the conservative temperature for evaluation of the early containment failure.

Late containment failure includes a gradual overpressurization process that takes from hours to days; therefore, failure is expected to occur with a " hot" wall. The late containment failure fragility curve for

" wet" sequences was conservatively established assuming the 350*F peak containment environmental temperature. The dry cavity overpressurization scenario was a conservative upper bound of the median shell temperature (See Section 19.11.5).

The fragility curve generated using the pressure-failute probability points of the above table are shown in Figure 19.11.3.1-3 for a containment environmental temperature of 290*F. This curve is conservatively biased in the low pressure tail of the curve and consequently results in a modestly conservative bias within the PRA (see Appendix 19.11H). This is confirmed by comparison of the piecewise linear fragility curve developed in this section with alternate methodologies employing a lognormal containment fragility curve construction. (See, for example, Reference 111).

19.11.3.1.3 Containment Penetrations The System 80+ containment pressure boundary is made up of the containment shell and several e

mechanical and electrical containment penetrations. These penetrations include a twenty-two foot diameter equipment hatch, two ten foot diameter personnel locks, containment piping penetration assemblies to provide for the ;assage of process, service, sampling and instrumentation pipe lines into the containment, electrical penetrations for power, control and instrumentation and a fuel transfer tube.

All major penetrations were explicitly considered in the containment shell ultimate pressure capacity analyses. Minor penetrations are expected to be sufficiently strong so as not to prematurely compromise the integrity of the containment shell. Details of the containment penetrations are presented in Section 3.8.2.1.3.

The penetrations are provided with stiffeners to limit distortion of the penetration such as buckling or ovalization under severe accident conditions such that leakage is not excessive.

Aptvered Design Material- Probabilistre Risk Asssssment Page 19.11-6 i

M System 80+ Deslan ContmlDwcument

-i j , 19.11.3.1.4 . Contain==nt Penetration Seals The NRC has performed considerable research on the survivability of seals around containment penetrations with a pressurized containment building. These results are contained in References 117 and 228 through 230. The results of these tests concluded that seal degradation and failure were a function -  ;

of absolute temperature, time of exposure and the seal material.

i Electrical Penetration Assemblies (EPA) (References 117 and 229)

Seal leakage and survivability tests resulting from the exposure of typical EPAs to a high temperature (361*F) and pressure (143 psig) for 10 days indicated a negligible failure potential.

These conditions bound all " wet" reactor cavity sequences (see Section 19.11.5) and are generally ,

i representative for the low probability " dry" cavity severe accident sequences. . Consequently.

- failure of EPAs is considered to be remote and is not credited in the PRA. This is a conservative I position since failures of EPAs would result in very small containment leakage and may delay or prevent an otherwise catastrophic containment failure.

t Mechanical Penetrations (References 117 and 228)

Tests for loss of seal integrity indicated that the onset of rapid failure of seals was above 625'F provided the seal was constructed from either an ethylene-propylene (EP), neoprene, or silicon.

Seal failure was defined as the inability of the seal to maintain a high (approximately 150 psig) containment pressure. Gradual degradation of these seals was noted at temperatures in the 350

)'

to 400*F range. Detailed capabilities of various seals are summarized in Figure 9 of Reference 117. Based on this figure it can be concluded that typical EP seals will require more than 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> to fail when subjected to a sustained period of high temperature exposure. Silicon based

- seals provide for even longer high temperature stability The capability of either sealant material is sufficient to ensure containment integrity for periods of more than 1 day for all " wet" cavity sequences. These sequences comprise more than 90% of the severe accident transients. Dry cavity sequences potentially lead to containment temperatures that slightly exceed 400*F for a short time period. ,

Additional mechanical penetrations include both process (steam and water flow) penetrations and the personnel air lock (PAL). Process penetrations utilize mechanical bellow seals which will be j

1 designed to survive ASME Service Level C stresses on the containment. The PAL is designed with two double sealed doors, one located at the containment interface and the other locc xi in j the nuclear annex. The PAL is expected to maintain its leak tightness for all credible severe l' 4- accidents.

It is the intent of the penetration design to ensure that the selected seal and mounting will provide for a minimum of I day containment integrity. This will be accomplished by a combination of selecting high quality and high capability seals, protectively mounting the seal so that it is not directly exposed to the containment environment, and providing double seals (" inner" and

" outer") whenever possible. J I

As a consequence of the ABB-CE design philosophy for the System 80+, seal failures will not

, cause a failure of the containment prior to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and for all " wet" cavity sequences the probabilistic consequences of seal failures ne bounded by the assumption of catastrophic

, - containment failure once the containment stress reaches yield. Dry containment sequences that do not result in containment overpressure or basemat melt-through are assumed to fail due to l ou6n neeeuw.nesosawc niek Amument rope 1s.117 L

System 80+ Design ControlDocument temperature degradation of the seals. la order to estimate the consequences of a containment seal failure, the seal failure area was estimated to be 0.1 ft2, 19.11.3.2 Secondary Containment Design 19.11.3.2.1 Purpose of System The secondary containment consists of the containment shield building and the annulus between the steel containment vessel and the concrete shield building. The containment shield building, which houses the containment vessel and safety-related equipment, is designed to provW biological shielding and external missile protection for the containment vessel and safety-related equipment. It is a reinforced concrete structure consisting of a right cylinder and hemispherical dome. The shield building shares a common foundation base with the nuclear system annex as shown in Figure 19.11.3.2-1. In addition, the annulus ventilation and filtration system provides a mechanism for substantially reducing and/or eliminatmg fission product releases following design basis and severe accidents.

19.11.3.2.2 Description of the System As described in Section 3.8.4.1.1, the containment shield building has an inner radius of 105 feet, with the cylinder wall thickness of 4 feet up to the nuclear annex roof elevation and 3 feet above as well as a dome thickness of 3 feet and a mzximum height of 215 feet. An annular space between the containment vessel and the shield building above the 913/4 feet elevation is provided for structural separation and access to penetrations for testing and inspection.

An Annulus Ventilation System (AVS) serves the space between the primary containment and the containment shield building. The AVS does not perform any normal ventilation function. It is primarily designed to minimize and/or prevent radioactivity release following an accident. The system is capable of functioning during startup, power operation, hot standby, and hot shutdown. A description of the AVS is provided in Section 6.2.3.

Post-accident operation of the AVS produces and maintains a negative pressure zone in the annulus and passes the annulus air through liEPA filters. This mitigates the consequences of airborne products of radiation that might otherwise become an environmental hazard during and following accident sequences including those leading to a severe accident.

The AVS will filter annulus air at a minimum rate of up to 16,000 cfm. This discharge is sufficient to create a negative pressure of about -0.5 inches water gauge, with respect to the outside atmosphere following a LOCA. The AVS is a two-train system which is activated by the Containment Spray Actuation Signal (CSAS) and is designed to function during a seismic event. The system has no containment penetrations and is single failure proof. Filters are available to filter particulates leaking from the containment. Charcoal filters are available tr temove elemental and orgame iodine from any containment release. Iodine filters are more than 9'% efficient in removing these radionuclides. In addition the llEPA filters are capable of removing 99% of airborne particulates that enter the system.

The annulus ventilation system is designed such that at least 90% of the effluents leaving an intact containment will pass through the system filters.

Each train of the AVS is powered by Class IE Emergency Diesel Power. The AVS can minimize ,

radiation releases to the environment following a severe accident scenario for which the containment vessel remains intact an<f emergency power is available.

Asyveved Design Matend

• Probabktic Rosh Assessment Pope 19.118

1 Srtem 80+ Design controlDocument n

19.11.3.2.3 Impact on PRA

{}

) The presence of the secondary building and filtration / ventilation systems has been explicitly considered in the System 80+ PRA. For severe accidents that do not fail the containment, the annulus ventilation system (if available) is credited in reducing radioactive releases to the environment. This is accomplished by adjusting fission product releases in a manner consistent with the operation of the armulus filtration and ventilation system. Typical decontamination factors associated with the secondary containment active features are on the order of 10 for most radioactive isotopes. The filtration system is most effective for containment releases of iodine and organic iodides.

19.11.3.3 Cavity Flooding System 19.11.3.3.1 Purpose of the CFS The function of the cavity flooding system (CFS) is to provide a means of flooding the reactor cavity during a severe accident for the purpose of cooling the core debris in the reactor cavity and scrubbing fission product releases. The CFS is manually actuated and is designed (in conjunction with the containment spray system) to provide an inexhaustible continuous supply of water to quench the core l debris.

l 19.11.3.3.2 System Description A detailed description of the CFS can be found in Section 6.8. The CFS is designed as a manually

'/7 actuated severe accident mitigation system. Procedures and guidance for actuating the CFS are included

(__) in the System 80+ Emergency Operations Guidelines (EOGs). The CFS is designed to make use of l available containment water sources along with active and passive System 80+ design features.

The components of the CFS include the in-Containment Refueling Water Storage Tank (IRWST), the IIoldup Volume Tank (ilVT). the reactor cavity, connecting piping, valves and associated power supplies.

This system is used in conjunction with the containment spray system (see Section 19.11.3.8) to form a closed or recirculatinF water cooling system by providing a continuous cooling water supply to the corium debris. The quenching of the corium produces steam which is condensed by the containment spray flow.

The CFS takes water from the IRWST and directs it to the reactor cavity. The water flows first into the llVT by way of the four 12 inch diameter lioldup Volume Tank (IIVT) spillways and then into the reactor cavity by way of two 10 inch diameter reactor cavity spillways. A schematic drawing emphasizing the salient features of the cavity flooding system is presented in Figure 19.11.3.3-1.

The CFS valves are powered from the Class 1E 125 VDC Vital Instrumentation and Control Power System as described in Section 8.3.2.1.2.1. Each of the four holdup volume flooding valves are powered from separate Class lE channels and each of the two cavity flooding valves are powered from separate Class IE divisions (See Table 8.3.2-3). The Class 1E busses are normally supplied from offsite power sources. Upon loss of offsite power, power to the busses can be supplied by the diesel generators or the batteries. In addition, the diverse Alternate AC source (combustion turbine generator) can power these busses upon loss of all other AC power.

Once actuated, movement of the water from the IRWST source to the cavity occurs passively due to the m natural hydraulic driving heads of the system. Actuation of the CFS results in the opening of the IIVT spillway valves allowing water from the IRWST to flood the IIVT. The motive force for this flooding

('v) is gravity and the static head of water between the IRWST water level and the HVT water level.

Flooding of the liVT progresses until the water level in the IIVT reaches the reactor cavity spillway at Approved Desspn hintenal Probabastic Risk Assessment (11/96) Page 19.11-9

System 80+ Design Control Document which timc scactor cavity flooding commences. Flooding ce.ues wien water levels in the IRWST, HVT and reactor cavity equalize. Fully flooded, the reactor cavity will fill to near the 17 foot elevation. The time to fill the reactor cavity is dependent on the number of operational flood valves. The CFS has been designed to effectively flood the reactor cavity to the 5 foot level in about 30 minutes. The time to completely fill the reactor cavity to the equilibrium elevation was calculated to be about 72 minutes with two HVT spillway valves and one reactor cavity spillway valve open and about 88 minutes with one HVT spillway vahw and one reactor cavity spillway valve operational (See Figures 19.11.3.3-2 and 19.I1.3.3-3).

To ensure a rapid water delivery to the reactor cavity, while simultaneously protecting the valves from direct corium attack, the HVT spillways are located approximately 5 feet above the basemat (approximate elevation: 67.0 ft). The HVT spillways and the reactor cavity spillways are equipped with remote manual motor operated valves. The reactor cavity spillways are located low enough to ensure sufficient flooding of the reactor cavity when the IRWST water level is at its minimum. The valves are rated for submerged operation, since valve operation is typically not expected prior to submergence.

Minimum equilibration leveis were established to ensure that operation of the CFS does not compromise the minimum ECCS pump NPSH requirements. The maximum equilibration level was established so as j to avoid contact between the cavity flood water and the in-Core Instrumentation (ICI) nozzles below the reactor vessel lower head. This latter requirement was established to minimize consequences of inadvertent operation of the cavity flooding system.

Flooding of the reactor cavity is an EPRI URD evolutionary plant design requirement and serves several purposes in the overall strategy to mitigate the consequences of a severe accident. These include:

• Minimize or eliminate corium-concrete attack.

• Minimize or eliminate the generation of combustible gases (hydrogen and carbon monoxide).

• Reduce fission products released due to corium-concrete interaction.

• Scrub fission products released from the trapped core debris.

These features are discussed in detail in Section 19.11.4.3.2.

19.11.3.3.3 Role of the CFS in Accident Management The CFS is designed as a manually actuated system. The manual operation of the CFS provides a mechanism for the operator to most efficiently use plant resources and protect the general welfare of the public and allows flexibility in the incorporation of new severe accident information into the accident management process. Based on the current state of knowledge it is envisioned that the CFS will be actuated once a potential core melt condition is imminent or has been diagnosed as being in progress.

Typical indications of core uncovery include (1) core exit thermocouple (CET) temperatures in excess of 1200*F, (2) reactor vessel level monitoring system (RVLMS) readings indicative of no liquid above the fuel alignment plate, and (3) significant changes in readings of self-powered neutron detectors (SPND).

It is understood that steam explosions may pose a non-negligible threat to the cavity and containment integrity. Thus, there may be an incentive to delay actuation of the CFS until vessel breach (VB) is imminent or when the reactor' vessel lower head has failed. This issue is considered too premature to Approved Design Material hobabarstic Risk Assessment (11/96) Page 19.11-10

System 80+ Design controlDocument factor into accident management guidance at this time. Therefore, it is presently the intent of the accident

[V] management guidance to ensure that at least 5 feet of water is within the reactor cavity prior to vessel breach. To accomplish this goal, the operator must actuate the CFS prior to, or during the early phase of the severe accident progression. While actuation of the CFS before VB is presently deemed desirable, the consequences of a delayed actuation of the CFS may also achieve similar results. This situation arises as a consequence of recent experimental information regarding core-concrete interaction (CCI) which may imply that corium coolability may not be strongly dependent on the timing of water addition (before vs after vessel breach).

Thus, it is currently believed that an acceptable stable state can be achieved ex-vessel as long as the CFS has been actuated prior to VB. Actuation of the CFS after VB will also have acceptable consequences provided the corium debris does not block both cavity flooding valves. This latter condition is hi;hly unlikely especially when one considers the high relative location of the valves, and that the dominant I corium flow path is away from the wall containing the cavity flooding valves / piping.

While providing water to the reactor cavity may not immediately terminate the concrete erosion, ensuring a water filled reactor cavity will initially reduce and ultimately terminate the erosion, while l simultaneously providing scrubbing of fission products released in the CCI process.

1 Additional discussion of core concrete interaction phenomenon is provided in Section 19.11.4.2.

19.11.3.4 Hydrogen Mitigation System p The details with regard to the purpose, design, implementation, and capabilities of the System 80+

\ 11ydrogen Mitigation System (HMS) in responding to a severe accident are provided in Appendix 19.11K.

19.11.3.4.1 Purpose of the HMS During a severe accident, large quantities of hydrogen can be generated during the core degradation and melting process. While it is highly unlikely that the hydrogen generated will be sufficient to fail the containment, a Hydrogen Mitigation System (llMS) has been incorporated into the System 80+ design to provide added assurance that hydrogen concentrations will be maintained at non-detonable levels even during the most limiting severe accident. To this end, the HMS is designed to accommodate the hydrogen production from 100% fuel clad metal-water reaction and maintain the average containment hydrogen concentration limit below 10% in accordance with 10 CFR 50.34(f) for a degraded core accident.

19.11.3.4.2 System Description The HMS is a control room actuated system designed to allow controlled burning of hydrogen at low concentrations in order to preclude hydrogen concentratioe build-up to detonable levels. The system is  !

designed to prevent the average hydrogen concentration in coniainment from reaching 10% by volume during a degraded core accident by burning hydrogen throughout the containment as the local concentrations reach levels of between 4 and 6%. Burns occurring in this range are likely to be non-propagating and incomplete. Such hydrogen burns will not pose a threat to containment. They will however, simultaneously preclude the possibility of a significant combustion threat later in the accident.

3 Experimental studies performed by Acurex Corporation (Reference 143) and Sandia National Laboratories (V (Reference 134) suggest that hydrogen burning from the igniters will not jeopardize the survivability of critical plant equipment. To ensure that diffusion flames do not damage vital equipment, igniters will

~

Apswoved Design hteternal . Probabastic Risk Assessment Page 19.1111

System 80+ Design ControlDocument be located either away from such equipment or necessary radiative shielding will be provided. Igniters in the reactor coolant system (RCS) portion of the containment are separated from the containment shell by the crane wall. Ignitors positioned in the vicinity of the containmer t shell (on the outer periphery of the crane wall) are not expected to be prone to any lasting diffusion flames. However, these igniter locations will be reviewed to ensure that local heating effects are tngligible. Iflocal heating of the shell is shown to be a concern, appropriate radiative shielding will be provided between the ignition source and the shell.

Each igniter is an AC powered glow plug powered directly from a step-down transformer. Each igniter assembly consists of a 1/8" thick steel enclosure (8" H x 6" W x 8" D) which contains the transformer and all electrical connections and partially encloses the igniter. The enclosure meets National Electrical Manufacturers Association (NEMA) Type 4 specifications for water-tight integrity under various environmental conditions, including exposure to water jets. The sealed enclosure incorporates a heat shield to minimize the temperature rise inside the igniter assembly, and a spray shield to t ' duce water impingement on the glow plug from above. The igniter assembly is designed to meet Seisme Category I requirements.

The HMS consists of 80 igniters which are divided into redu . dant groups, Group A and Group B. Each group has independent and separate cowol, power, and 'gniter locations to ensure adequate coverage within the containment. The igniters are powered fram Class IE buses which receive power from Preferred Switchyard Interface I or Preferred SwitAyard Interface II (two distinct and separate sources of offsite power; see Section 8.2).

The llMS normally receives power from offsite sources. In the event of a loss of offsite power, the igniters will be powered from the emergency diesel generators. Group A igniters will be powered from the Division i diesel generator and Group B igniters from the Division 11 diesel generator. On loss of offsite power and failure of the emergency diesel generators to start or mn (Station Blackout), the igniters can be powered from the alternate AC source combustion turbine generator. Thirty-four of the igniters can also be powered from the divisional Class IE batteries (17 from Division I, and 17 from Division II) via DC-to-AC inverters.

19.11.3.4.3 Igniter Placement The hydrogen igniters are placed so as to achieve controlled hydrogen burning. Although the containment is designed to promote mixing, the igniters will be positioned in areas where hydrogen is produced most rapidly. Local areas of potentially high hydrogen concentrations will have two igniters, one from Group A and one from Group B. Considerations for igniter placement within the System 80+ containment are described in Appendix 19.llK.

The placement of the igniters within the containment considered the potential for damage to the igniters due to blowdown during a LOCA. The locations were selected to minimize the potential for damage to the igniters and to provide redundant coverage within a specific location. Section 6.2.5 shows the approximate location of the igniters within the containment and the separation between the igniters.

These igniters are designed to burn hydrogen at low concentrations and are located where hydrogen is produced or could accumulate (i.e., closed compartments or dead-ended regions) in the containment.

19.11.3.4.4 IRWST Pressure Relief Dampers Pressure relief dampers are provided in the IRWST cover to allow mixing of hydrogen in the IRWST with the rest of the containment free volume and to prevent excessive loading across the IRWST cover.

Asyvoved Design hintenal. Probabikstic Risk Assessment Page 19.11-12

System 80+ Design control Document n 2 The pressure relief dampers provide a minimum of 200 ft of vent area. This will provide sufficient flow (C') area for venting of hydrogen from the IRWST so as to maintain a low enough hydrogea concentration within the IRWST during a severe accident. In addition, this vent area is sufficient to prevent excessive loading on the IRWST cover. Appendix 19.11K contains a detailed discussion on the IRWST pressure relief dampers.

19.11.3.4.5 Role of the IIMS in Accident Management The HMS igniters are intended to be used in controlling the concentration of hydrogen within the containment once the operator confirms that an extended core uncovery is in progress. The operator will use the HMS based on specific accident management guidance which will rely on RCS and containment instrumentation such as in-vessel level monitoring instrumentation, core exit thermocouples and containment and RCS pressure indications and a direct measurement of containment hydrogen.

It is intended that igniters be activated prior to a sustained core uncovery. Once activated the igniters will produce small burns and/or diffusion flames that serve to reduce the containment hydrogen concentration and thereby prevent the potential for destructive hydrogen detonations within the containment. The specific severe accident management guidance will be developed based on ongoing NUMARC and NRC Accident Management Guidelines effort.

19.11.3.4.6 Role of the IIMS in the PRA  ;

For purposes of the PRA, operation of the HMS is considered sufficient to remove all hydrogen combustion induced threats to containment. It has been determined that the presence of HMS has a n)

( negligible impact on containment failure probability.

The PRA assumes that operation of the HMS precludes containment threatening combustion events. j Furthermore, the PPA models conservatively assume that when the HMS does not function, detonations I are credible at 10 volutce-percent hydrogen (as required by the URD and NRC). In fact, much greater hydrogen concentrations are required to initiate detonations in non-laboratory settings. The lowest Deflagration-to-Detonation transition that has been observed under ideal geometric conditions was at 15 volume percent hydrogen in a dry environment. Furthermore, detonations are typically prevented in steam-air environments.

19.11.3.5 Safety Depressurization Systern 19.11.3.5.1 Purpose of the SDS The Safety Depressurization System (SDS) is a multi-purpose dedicated system specifically designed to serve important roles in severe accident prevention and mitigation. Section 6.7 provides details of the SDS. In the context of severe accident prevention, the SDS perfonns the following functions:

• Venting of the Reactor Coolant System (RCS)

The Reactor Coolant Gas Vent (RCGV) function of the SDS provides a means of venting non-condensible gases from the pressurizer and the reactor vessel upper head to the Reactor Drain Tank (RDT) during post-accident conditions. In addition, the RCGV provides:

i i V 1. Safety-grade means to depressurize the RCS in the event that pressurizer Main Spray and Autiliary Spray systems are unavailable.

Approuwt Design Atatorial. Probabmstic Rak Assessment toge 19.11 13

System 80+ Design controlDocurnent

2. Means of venting the pressurizer and reactor vessel upper head during pre-refueling and post-refueling operations.

• Rapid Depressurization (bleed process) of the RCS.

The Rapid Depressurization (RD) function, or bleed function, provides a manual means of quickly depressurizing the RCS when normal and emergency feedwater (EFW) are unavailable to remove core decay heat through the steam generators. This function is achieved via remote manual operator control. Whenever an event, e.g., a total loss of feedwater (TLOFW), results in a high RCS pressure with a loss of RCS liquid inventory, the SDS rapid depressurization or bleed valves may be opened by the operator, causing a controlled rapid depressurization of the RCS. As the RCS pressure decreases, the Safety Injection (SI) pumps start, initiating feed flow to the RCS and restoring the RCS liquid inventory. The RD function allows for both short and long-term decay heat removal.

The rapid depressurization feature of the SDS also serves an important role in severe accident mitigation in the event a high pressure meltdown scenario develops and the feed portion of feed and bleed cannot be established due to unavailability of the SI pumps, the SDS can be used to depressurize the RCS to ensure that a High Pressure Melt Ejection (HPME) event does not occur, thereby minimizing the potential for direct containment heating following a vessel breach (VB).

19.11.3.S.2 System Description Design Requirements for Rapid Depressurization The Rapid Depressurization (RD) design requirements are summarized in Section 6.7. Of particular interest to severe accident mitigation is the capability to depressurize the RCS from 2500 to about 250 psia prior to reactor vessel melt-through.

Power to SDS Valves The power supply for each rapid depressurization valve is from a DC bus. The power is provided such that in case of a loss of offsite power, both emergency diesel generators (EDGs), the combustion turbine.

and one battery bank, a RD bleed path can be established. Each generator DC load group is provided with a separate and independent 125 volt battery charger. The battery chargers are powered from Division I and II of the Class IE Auxiliary Power Systems. Each battery is sized to supply the continuous emergency loads of its own load group for a period of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. Battery management strategies ensure battery availability of a minimum of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> following a station blackout.

19.11.3.S.3 System Performance During Severe Accidents Rapid Depressurization (RD) Evaluation The RD valve size was selected to meet both the feed and bleed and DCII severe core damage depressurization goals. The following RD valve sizing criteria were established for the worst case Total Loss of Feedwater (TLOFW) event to ensure adequate feed and bleed capability:

Criterion 1. The primary system shall maintain a two-phase mixture level two feet above the top of the core when a single feed and bleed valve is opened simultaneously with the primary safety valves and two Si pumps operational.

Approved Design Mstenal. ProbatuTostic Risk Assessment Page 19,11 14 1

l

-- - ._~ . _..- - - - .- -- -.. - - . - - - - . . - - . - - ~

I a - System 80+ oestan contM oceanent r

a Criterion 2. The primary system shall maintain a two-phase mixture' level of two feet .;

above the core when two equally sized feed and bleed valves are opened after-  !

the primary safety valves lift with four SI pumps operational. l The severe core damage depressurization goal is to ensure that the RD can depressurize the RCS from 2500 to 250 psia prior to a reactor vessel melt-through.

The ability of the RD system to accomplish these goals were validated via CEFLASH and MAAP l analyses. MAAP analyses confirmed that the RD system can be used to depressurize the RCS prior j to vessel failure provided the RD is actuated within one and a half hours following pressurizer safety  ;

valve lift during either an extended total loss of feedwater or a station blackout scenario. {

i 19.11.3.5.4 Analysis of SDS Operation During Severe Accidents 4

In a severe accident mode, the primary need for the SDS occurs when the RCS pressure is high and a  :

i core melt is in progress. This condition typically will occur in conjunction with a total loss of l

- feedwater. If safety injection is available the use of the SDS facilitates once-through-core-cooling.

i Otherwise, the SDS operation' will depressurize the RCS to a pressure below the threshold for e significant corium entrainment and cause Safety Injection Tank (SIT) water to be injected into the RCS thus extending the period of core coolability. Depressurization can also be used to reduce the  !

j RCS pressure to a point where the containment spray / shutdown cooling pumps can be aligned to inject IRWST inventory into the RCS.

Successful SDS operation resulting in " feed and bleed" heat removal will not progress to a core melt  !

scenario. In the context of this discussion, the operation of the SDS was investigated in the absence

- of a feed source (no SI or any other alternate water source). To study the capability of this system in

- this operational mode, computer simulations of various total loss of feedwater events and SDS operational schemes were investigated using the MAAP code (Reference 203). The intent of these studies was to confirm that RCS depressurization to 'about 250 psia can be achieved with timely operator actuation of the SDS. Typical RCS depressurization scenarios are presented in Figures 19.11.3.5-1 and 19.11.3.5-2 for an instantaneous total loss of feedwater with the SDS valve opened at

- the time of PSV lift and I hour after PSV lift. Both cases clearly indicate that operation of the SDS will successfully depressurize the RCS to pressures in the vicinity of the debris entrainment threshold.  ;

- These results demonstrate that should the operator fail to perform the RCS depressurization at PSV lift he can delay this action for an additional I hour and still achieve comparable results. .

s

! The System 80+ reactor cavity is designed to retain most of the ejected corium debris regardless of the RCS pressure. . However, even under this scenario, depressurizing the RCS will mitigate the DCH

load by transferring hydrogen in the RCS to more remote areas of the containment where it is less j

- likely to participate in the DCH induced containment loading. l 19.11.3.5.5 Role of the SDS in Accident Management 19.11.3.5.5.1 Feed and Bleed Cooling The RD function is performed by opening the rapid depressurization valves located on the top of the pressurizer. In situations where rapid depressurization is used to establish once-through-core-cooling O (OTCC), the Safety injection pumps can be activated to provide a continuous source of RCS inventory, Ammed DeeQn aseennet. hehehanGc Nok Aseeeement nege 19.11-16

• ' ~

-% y - ap *=v+r-$e e- y-F'g- d -r- w 1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

System 80+ oesign control Document The RD function is normally not used alone and is primarily intended for mitigating the consequences of a beyond design basis event such as a total loss of normal and emergency feedwater, or as an emergency means of RCS depressurization and pressure relief when the pressurizer main spray, auxiliary spray, and the reactor coolant gas vent system (RCGVS) functions are not available. In a severe accident environment, the RD may also be used to depressurize the RCS prior to a projected RV lower head breach. This action will add residual SIT water inventory to the RCS and drop the RCS pressure to below the anticipated corium dispersal threshold value.

The OTCC RD function is accomplished by means of a manually operated system, utilizing certain components and equipment from the following systems:

• The In-containment Refueling Water Storage Tank (IRWST) which provides a quench volume and heat sink; (see Section 6.8).

• Four Safety Injection pumps and associated direct vessel injection lines which provide the feed function; (see Section 6.3).

• Two Shutdown Cooling System heat exchangers; (see Section 5.4.7).

e Two Shutdown Cooling System pumps (see Section 5.4.7).

Opening the rapid depressurization or bleed valves results in a rapid depressurization of the RCS which allows the SI pumps to be automatically started to refill the RCS and provide cooling of the core.

Core decay heat removal, using the RD function. is accomplished by a once-through coi ng process in which water is injected directly into the reactor vessel downcomer via the Safety InjecAn System.

Once in the reactor vessel, the cooling fluid passes through the vessel downcomer to Ae lower plenum, up through the core (where decay heat is removed) and out to the hot leg, through the surge line to the pressurizer and out through the dedicated rapid depressurization bleed valves to the piping sparger in the IRWST where cooling of the bleed flow is accomplished. The volume within the IRWST allows a feed and bleed operation to be maintained for about thiny minutes before external cooling of the IRWST should be initiated. IRWST cooling is provided by the safety grade Shutdown Cooling System heat exchangers which in turn are cooled by the component cooling water system. In addition, the Containment Spray System heat exchangers may be used to cool the IRWST.

19.11.3.5.5.2 RCS Depressurization Without Inventory Makeup The results of the System 80+ PRA indicate that the frequency that an accident scenario involves a simultaneous complete loss of feedwater and loss of inventory makeup is low. Funher, in many of these sequences many systems associated with the operation of the SDS may have simultaneously failed. Nevenheless, while the SDS is no longer capable of helping to re-establish core cooling (due to lack of an inventory makeup source) the SDS can depressurize the RCS and mitigate the consequences associated with a high pressure melt ejection from the reactor vessel. Reduced RCS pressures are beneficial in failures associated with various accident processes including Direct Containment Heating (DCH), rocket failure and cavity overpressure failure. In addition, it is likely that at low pressures the potential for an "in vessel" recovery will be greater.

As a result, the operator guidance will recommend opening of the SDS valves following total loss of feedwater events at PSV lift even if RCS inventory makeup is unavailable. Analyses indicate that the Approved Design Atatorial. Probabshsuc Risk Assessment Page 19.11 16

Sy tem 80 + oeslan controlDocument DCH threshold pressure can be reached even if the operator were to delay action for one and a half hours after PSV lift. This is primarily due to the fact that the delayed SDS actuation results in steam discharge via the SDS valves which rapidly depressurizes the RCS. It should be noted that early opening of the SDS valves (at time of PSV lift) extends the time the RV lower head can be maintained intact (see Figure 19.11.3.5-1).

19.11.3.6 Reactor Cavity Design 19.11.3.6.1 Reactor Cavity Design Philosophy The System 80+ reactor cavity is configured to promote retention of, and heat removal from, the postulated core debris during a severe accident, thus, serving several roles in accident mitigation.

Corium retention in the core debris charnber virtually eliminates the potential for significant DCH induced containment loadings. The large cavity floor area allows for spreading of the core debris enhancing its coolability within the reactor cavity region.

19.11.3.6.2 Description of the Reactor Cavity Figure 19.11.3.6-1 shows a schematic of the System 80+ reactor cavity design. Important features l

of the System 80+ cavity include:

1. A large cavity volume,

2. A closed vertical instrument shaft, 1G l 3. A convoluted gas vent, I

j

4. A large recessed corium debris chamber, i l

5. A large cavity floor area,

6. A minimum concrete thickness of 3 feet from the cavity floor to the containment embedded shell, l 7. Robust cavity strength.

The significance of these features to severe accident plant performance is discussed in the following paragraphs.

19.11.3.6.2.1 Large Cavity Volume The System 80+ cavity includes approximately 32,000 cu ft. of free volume. This large volume

benefits the plant design when cavity pressurization issues are considered. Large and well vented volumes, such as those in System 80+, are not prone to significant pressurization resulting from vessel breach or during the corium quench processes. Post-accident steam cavity pressurization f analyses performed for System 80+ indicate peak cavity pressure loadings to be less than 100 psid (see Section 19.11.4.1.4.2). MAAP analyses confirm that peak cavity pressures are well below the

- 188 psid cavity design basis.

% J Doetn n00serne!* hehabeshc Rink Assessment Page 19.1117

System 80+ Design C?ntrolDocument 19.11.3.6.2.2 Closed Vertical Shaft The instrument shaft design serves an important purpose in the severe accident mitigation for System 80 + . First, by orienting the instrument shaft vertically and providing limited gas venting in this path, the possibility of corium carryover is minimized. Analyses provided in Appendix 19.11C indicate that only 10% of entrained corium could be expected to initially be carried upward into the vertical shaft even if the shaft were vented to accommodate significant gas flows. Gas /corium outflow from the top of the instrument shaft is restricted via an instmment seal table with a design strength of 200 psid. The remainder of the corium not entering the vertical shaft will be captured in a large debris retention chamber located at the base of the ICI chase (see Figure 19.11.3.6-1) or carried out of the cavity into a closed HVAC room.

19.11.3.6.2.3 Convoluted Gas Vent Escape Pathway in the design of the System 80+ containment a significant effort has been made to ensure that actual venting to the upper containment either by the vertical shaft (See Figure 19.11.3.6-2) or around the RV annulus is restricted. As discussed above, the presence of the seal table prevents upward corium discharge through the instrument shaft. Similarly, obstructions associated with the corbels and shiell plugs (beneath the hot and cold legs) serve to restrict the flow through the RV annulus. Thus, the primary steam exits via a convoluted pathway above the top of the core debris chamber and inte, an HVAC room and out through louvered vents under the refueling pool (See Figure 19.11.3.6-2). As a consequence the dominant hot gas and corium carryover pathway will be to the lower portion of the containment where the containment shell is fully protected by the crane wall (See Section 19.11.3.7).

It should be noted that this pathway provides limited resistance to gas flow, but is considered very deleterious for the entrained solid flow. As a consequence little corium is expected to be entrained in the gas flow.

19.11.3.6.2.4 Core Debris Cluunber The cavity region of System 80+ is designed to minimize debris entrainment and subsequent debris dispersal into the upper compartment of the containment. As discussed above, by maximizing debris retention and minimizing debris dispersal to the upper compartment, containment threats resulting from High Pressure Melt Ejection (HPME) processes (in particular, DCH) can be virtually ,

eliminated. l System 80+ is equipped with an offset core debris chamber designed to de-entrain and trap the debris I ejected during a reactor vessel breach. The reactor cavity debris chamber and exit shaft have been designed such that following a failure of the reactor vessel high inertia coriurn debris would de-entrain and collect in the debris chamber while the lower inertia steam / hydrogen / air mixture would negotiate a right angle turn and exit the reactor cavity via a convoluted vent path. The chamber has been sized according to ARSAP guidance (Reference 115) to hold twice the post-severe accident maximum corium volume. Once deposited in the debris chamber, the debris would be difficult to re-entrain since the retention zone would exhibit a low velocity recirculation flow pattern. Any corium  ;

negotiating :he 90 degree turn would be de-entrained by the reactor cavity concrete ceilings and seal I table structure. Using a correlation established from data obtained from HIPS tests the amount of debris expected to bypass the core retention chamber was about 10 % of the ejected mass (see Appendix 19.11B). Even if this mass were to escape the retention chamber, most of it would deposit i in a confined cavity ventilation room. The DCH contribution to this corium pathway is considered i very small. This conclusion is particularly supported by recent DCH IET tests (see Section l 19.11.4.1).  !

l Apprewel Design Matanni- Probabassric Risk Assessment Pope 19.11-18

System 80 + oesign control Document O

V Other secondary pathways for debris transport are also possible, but these are considered to be relatively minor because the gas flow patterns are adverse for corium entrainment, and flow areas are restrictive and cavity exits may be partially sealed, at least initially. These corium debris pathways include the pathway up the cavity annulus and through the nozzle cutouts or via failure of the permanent refueling pool seal upward into the refueling pool. An alternate pathway up the ICI chase is also possible should the ICI seal table fail. However, this failure is highly unlikely. None of these pathways provide a direct unintermpted pathway for the corium to the upper compartment. The upward annulus flow path requires the cavity flow pattern that would levitate corium vertically upward in a gas flow which is expected to be predominantly lateral. Once entrained vertically the corium must not be de-entrained by the corbel which blocks about 75% of the entrance to the annular region. Once in the annular region, velocities must be sustained to carry out debris in the presence of de-entraining piping structures. Funbermore, any carryout of corium debris through nozzle cutouts will aL ' reduce the fraction of debris upwardly entrained. All corium debris not upwardly entrained will not significantly impact DCH. Upflow through the instrument shaft and out a failed seal table location is theoretically a second alternate path. liowever, evaluation of the seal table structure suggests it can sustain a 200 psid load. Therefore, the potential for failure of the seal table is considered small.

19.11.3.6.2.5 Floor Area The System 80+ reactor cavity has been designed to maximize the unobstructed floor area available to the spreading of corium debris. The cavity floor is free from obstructions and comprises an area available for corium debris spreading of approximately 1000 ft2 (approximately 693 ft2 of flat floo-area plus the sloped section of the core debris chamber). This cavity floor area results in a floor (m) area / reactor thermal power ratio of 0.024 2m /Mwt. Uniform distribution of 100% of the corium debris within the reactor cavity will result in a relatively shallow debris bed (less than 10 inches in depth). For detailed System 80+ analyses of corium-concrete interactior' and reactor cavity floor erosion, see Section 19.11.4.2.2.3.2.

Experimental data appears to support the coolability of corium debris beds at least in the long term (Reference 212). The primary consideration in corium coolability is that the corium debris not be impermeable to water. Even if the debris beds are not fully coolea, panial cooling will quench the upper layers of corium and ultimately retard any concrete attack. Additional details on the core concrete interaction process and the System 80+ anticipated performance are presented in Sections 19.11.4.2.1 and 19.11.4.2.2.

The containment shell is adequately embedded in concrete in the reactor cavity area to preclude direct contact of the core debris with the containment. The level of embedment varies from 3 to 5 feet (see below). Note that since the lower shell provides no structural strength contribution, failure of the shell via melt-through has no mechanical significance. Furthermore, the gap separating the shell and the concrete is minimized by the application of grout at high pressure. Thus, significant separation of shell and concrete foundation is considered unlikely. The pathway separating the shell and concrete is therefore considered to be sufficiently torturous to preclude fission product releases to the environment.

19.11.3.6.2.6 Floor Thickness / Sump Protection p The reactor cavity is designed to satisfy the URD requirement that the minimum distance between the V floor elevation and the embedded portion of the containment shell is a minimum of 3 feet. Directly Attwoved Design Motwin!- Probah&stoc Risk Assessme,st Page 19.1119

System 80+ Design ControlDocument under the RV this distance increases to a maximum of 5 feet. An additional 15 feet of concrete is available below the liner elevation.

Assuming corium is spread evenly over the cavity floor (not including the inclined portion of the cavity debris chamber), and that the shell is assumed to be 3 feet below the floor, the minimum time to shell contact for a dry cavity erosion process will be at least 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />. Dry sequences are assumed to both fail the shell and the concrete basemat. For wet sequences penetration of the lower shell is not expected (see Section 19.11.4.2.2). See Sections 19.11.4 and 19.11.5 for additional details on these analyses.

Corium-concrete interaction analyses have been performed which demonstrate that the reactor cavity sump will not produce a premature local shell penetration (see Section 19.11.4.2). Based on the results of this study no protection is planned for the System 80+ reactor cavity sump.

19.11.3.6.2.7 Cavity Strength The reactor cavity is to be designed for 188 psid with an ACI calculated ultimate pressure of 235 psid. This cavity strength is typical of later designed PWR cavities and is relatively robust when compared to most cavity loading expected during a severe accident.

The reactor cavity has an ultimate static pressure capacity of 235 psid. The 235 psid ultimate static capacity corresponds to an actual design static pressure capacity of 188 psid. Three horizontal hoops of #18 reinforcing bars at 12" vertical spacing, three vertical rows of #18 reinforcing bars at 12" horizontal spacing, and #5 bar single leg stirrups at 12" spacing both vertically and horizontally are provided in the lower cavity wall. This reinforcing layout is designed to accommodate the severe accident pressure loading.

The lower portion of the reactor cavity has a dynamic pressure capacity of 288 psid, assuming a rectangular shape is used for the load pulse forcing function. This equates to an impulse capacity of 2

1.44 pound-seconds /in . (If a more realistic triangular forcing function is assumed, the lower reactor cavity would have a dynamic pressure capacity of 518 psid).

The concrete corbels supporting the reactor vessel will have an ultimate static pressure capacity in excess of 1,057 psid. The 1,057 psid ultimate static pressure capacity corresponds to an actual design static pressure capacity of 846 psid. Two layers of #18 reinforcing bars, with 7 bars in each layer, are provided in the bottom of each corbel. In addition, six layers of #7 bar double leg stirrups, with three stirrups in each layer, are distributed up through each corbel. It should be noted that this reinforcing layout is aim hiped for severe accident pressure loading.

The corbels hue a dynamic pressure capacity of 930 psid, assuming a rectangular shape was used for 2

the load pulse forcing function. This equates to an impulse capacity of 4.65 pound-seconds /in . (If a triangular forcing function is assumed, the corbels would have a dynamic pressure capacity of 1,370 psid).

The req'nrements of ACI 349 were used in determining the ultimate static pressure capacity and the dynamic pr-asure capacity of both the cavity and the reactor vessel support corbels (except no load factors were applied to the loads because of the highly unlikely occurrence of a severe ..;ident and the one time loading condition). As such, potential additional margins in reinforcing strength, concrete strength, and material ductilities beyond Code allowables were not used in determining the Amrowf Design afaterial Probabkssc fusk Assessment Pege 19.1120

1 System 80+ Design controlDoce,Lg h

U aforementioned static and dynamic capacities of the stmetures. The method used to determine the reactor cavity ultimate static and dynamic pressure capacity is described in Appendix 19.11L.

It is apparent that both the cavity and the corbels are very stiff structures that have natural periods of 11.5 ms and 4.5 ms, respectively. These periods are close to the 2 to 5 millisecond impulse i load duration possible for ex-vessel steam explosions (EVSE). As a result, the structures respond to a l large percentage of the dynamic load (i.e., large dynamic load factors are necessary). The corbels  !

have more strength than the lower cavity region because of the amount of reinforcing provided.

19.11.3.6.2.8 Impact of Cavity Walt Damage Calculations show that the reactor vessel and the upper cavity could continue to be supported even if the entire lower cavity walls below the corbels were either eroded by corium attack or destroyed by a steam explosion. Reinforcing steel provided between the interface of adjacent walls with the upper

, reactor cavity wall provide enough resistance through shear-friction to provide this support without relying on support from the lower cavity wall. These calculations have been performed in accordance with the requirements of ACI 349 (except without load factors applied), and, therefore, a high level of confidence is associated with this support mechanism for the reactor vessel.

19.11.3.6.2.9 Cavity Fragility Curve The cavity dynamic structural analysis was employed to establish strain based dynamic fragility curves for the reactor cavity. The fragility curve is shown in Figure 19.11.3.6-3. Since this curve is intended for response to dynamic loads, fragilities are defined in terms of the ability of a structure to

. q y survive an impulsive load.

The cavity wall fragility curve was established based on strain levels in the cavity rebar. The cavity wall impulse load presented in Section 19.11.3.6.2.7 is based on a maximum material ductility of 3 (0.5 % strain). At this level of damage, the cavity wall is expected to be extensively cracked, but otherwise, intact (see Reference 213). A cavity wall failure probability of 0.03 was assigned to this condition. As the impulse loading increases, so does the material strain and the wall failure potential.

At a material strain of 4 % the rebar is still below its ultimate stress and the stmetural displacement is about 7 inches. Wall failure under this condition was considered likely and assigned a failure probability of 0.50.

A detailed fragility curve for the corbel was not developed. The lower limit of failure as assessed in Section 19.11.3.6.2.7 was assigned a failure probability of 0.03.

19.11.3.6.2.10 Basemat Composition In order to best accommodate the overall goals of SECY-90-016 and SECY-93-087, the System 80+

basemat will be constructed of either limestone - common sand or limestone aggregate type concretes.

Either of these materials provides good resistance to concrete erosion. While non-condensible gas .

generation is non-negligible for these concretes, the large System 80 + volume allows for the luxury of using either of these materials to function as " core catchers" without posing an undue overpressure threat to the containment.

O t

^ ,__.2" Den &n Negerie!. Probabewdc Misk Assessment Pope 19.1121

System 80+ Design ControlDocument 19.11.3.6.3 Response to Severe Accidents 19.11.3.6.3.1 HPME ',wds Including DCH ne current models, supponed by available test data, predict that the System 80+ cavity design mitigates the DCH effect by limiting the amount of debris leaving the cavity as finely fragmented particles.

The estimate of the fraction of the debris able to negotiate the turn into the venical cavity shaft was established using a Sandia National Laboratories correlation for debris impingement determined from high pressure melt ejection tests (See Appendix 19.!!C). Application of this model to the System 80+ cavity geometry results in a prediction that 90% of the corium debris would be de-entrained into the debris chamber and that 10% of the debris could potentially negotiate the turn into the reactor cavity shaft.

Recent experimental data obtained from the IET (Integral Effects Tests) experiments show that even if corium dispersal ra:cs from the cavity are large (up to 100%) the contribution of the exothermic reaction and stored energy to the post HPME global containment pressurization will be negligible l provided the issuing debris flowpath will be obstructed prior to mixing in the upper containment (See Section 19.11.4.1). Thus, the precise dispersion fraction while believed to be very low for System 80+ will have only marginal impact on influencing post-VB containment threats.

• Fuel Coolant Interactions Fuel coolant interactions within the reactor cavity can produce large static and dynamic loadings within the reactor cavity, Should the loadings exceed the cavity's capability a cavity wall collapse is possible. It is believed that the loss of RV suppon is highly unlikely and even if this should occur it will not induce a containment failure (see Section 19.11.4.1.2).

As discussed above, the large cavity wall strength provides considerable robustness of the cavity to this loading. Funhermore, the collapse of the cavity wall will not necessarily induce a containment failure.

• Core Concrete Attack MAAP analyses of basemat erosion indicates that even for dry cavity conditions, corium penetration of the containment shell wall requires more than 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />. Under this condition full penetration of the basemat into the extended foundation will require about 8 days.

Wetted cavity analyses suggests that lower containment shell integrity can be assured as long as the overlying maximum heat flux from the corium into the overlying water is greater than about 200 kw/m2, 19.11.3.7 Missile Protection 19.11.3.7.1 Purpose The missile protection design features for Seismic Category I structures, systems and components of System 80+ design are described in Section 3.5. This section discusses those features of the Apoweved Design Motenal- Probabikstic Risk Assessment Page 19.11-22

System 80+ Design ControlDocument i O System 80+ reactor cavity design which are specifically designed to protect the containment from the hot corium debris and induced missiles during a severe accident.

During severe accidents, missile protection of the containment shell is primarily accomplished by the use of protective shields and barriers either near the source of a potential missile or in front of the containment shell (such as the crane wall).

During a severe accident, containment threatening missiles can be generated by a variety of sources including:

o Core debris which may be ejected from a breach in the reactor vessel.

• RV top head /CEAs resulting from in-vessel steam explosions (Alpha Mode Failures).

• Containment internal structures following a rapid flame acceleration or hydrogen detonation.

The means by which System 80+ protects the containment shell from these loadings are summarized in the following sections.

19.11.3.7.2 Protection From Hot Core Debris A multi-faceted approach is used to ensure containment integrity during a severe accident. The first emphasis in the protection of containment integrity is prevention. That is both prevention of a severe accident and should a severe accident occur, prevention of a direct challenge to the containment shell by "in cavity" retention.

Os Section 19.11.3.6 describes the cavity geometry. The cavity is arranged such that any corium debris leaving the cavity will exit via the door or louvers in the HVAC room, above the IRWST pool (see Figure 19.11.3.6-2) or via the nozzle cuouts. Corium debris released in these areas will likely interact with either the crane wall or refuelit.g pool wall and ultimately deposit in these areas. In the ]

highly unlikely event that the corium debris is projected upward out of the cavity annulus, the Head '

Area Cable Tray System (HACTS) serves to protect the containment shell from a direct corium attack of the containment shell, i 19.11.3.7.3 Protection From Missiles Generated via Top Head Failures  !

Details of the System 80+ missile protection features are presented in Section 3.5. Missiles generated via failure of the top head and top head components are considered under the general severe  ;

accident category of "in-vessel" or " alpha" mode failure. In these scenarios the upper head or control rod missile will be intercepted by a the Head Area Cable Tray System (HACTS) located directly above the RV upper head. An assessment of the consequential failure of the steel containment due to the failure of a pressurized System 80+ vessel is considered highly unlikely. Additional discussion of

" alpha" mode failures is presented in Section 19.11.4.1.1.

19.11.3.7.4 Protection Following Induced Missiles Caused by Rapid Deflagrations / Hydrogen Detonations and Ex-Vesd Steam Explosions O This section is concemed with protection of the containment shell from missiles produced either via a b steam explosion or hydrogen burn in containment. The phenomenology of the Ex-Vessel Steam Explosion (EVSE) is described in Section 19.11.4.1.2. The EVSE may occur when corium debris Anreved Design Meteriel Probehhstic Mink Assessment Page 19.1123

System 80+ Design Control Document contacts a water pool. Such processes may occur in the reactor cavity following a RV breach. While EVSEs are considered plausible, their consequences on containment integrity are small. This arises from the fact that EVSEs are not expected to be capable of damaging the reactor cavity stmetures required for support of the RV/RCS. Furthermore, all "in-cavity" structures that may be damaged by such explosions and any missiles generated by EVSEs will be confimed within the cavity and thus will not compromise containment integrity.

Rapid deflagrations and detonations have the potential for generating missiles of sufficient strength to potentially damage the steel shell. To prevent such potential challenges, care has been taken to locate potential missiles within the crane wall and to protect the steel shell with a protective barrier of at least three feet of concrete wherever practical. This barrier level is maintained in the containment with the exception of a small region above the top of the refueling pool and in restricted basemat areas beneath the corium debris chamber and the IIVT sump. There are no unintercepted missiles anticipated in regions above the refueling pool. Thus additional missile shielding is not required.

Since the IIVT sump is in a containment region free from potential missiles and isolated from corium, additional concrete in this region is not considered necessary.

19.11.3.7.5 Application of Missile Geaeration Within the PRA While the expectation is that containment failure due to missile impact on the containment structure is highly unlikely, this issue is explicitly and implicitly considered within the System 80+ PRA. Details of the containment failure phenomenology are presented in Section 19.11.4. The containment failure modes that involve missile induced containment failure are summarized below:

e Alpha mode failure considers the potential for the RV upper head or upper head component to fail the containment via missile generation. The potential for this event has been established based on results of the Steam Explosion Review Group (SERG) investigation.

e An assessment of EVSE is presented in Section 19.11.4.1.2. Results of this assessment suggest that while EVSEs are credible, they will not pose a credible threat to containment integrity via missile generation. Thus, the probability of an induced EVSE containment failure caused by a missile or water slug was therefore assessed as zero. EVSE induced containment failure due to cavity overpressure is discussed in Section 19.11.3.6.3.

e Detonations are not expected within the System 80+ containment. However. in the highly unlikely event that a detonation does occur in containment, it is conservatively assumed that a containment failure (due to missile generation, etc.) will result.

19.11.3.8 Containment Spray System 19.11.3.8.1 Purpose of the CSS The Containment Spray System (CSS) is a safety grade system designed to reduce containment pressure and temperature from a main steam line break (MSLB), loss-of-coolant-accident (LOCA) or a severe accident and to remove iodine from the containment atmosphere. Iodine removal is required so that in the event of containment leakage, activity at the site boundary due to radioactive iodine will be reduced.

The Containment Spray System is designed to provide adequate cooling of the containment atmosphere to limit post-design basis accident building temperatures and pressures to less than the Approved Desogn Materia! ProbablGstic Risk Assessment Pope 19.1124

l System 80+ Design ControlDocument l

l containment design values (53 psig and 290 'F, See Section 6.2.1). Additionally, it reduces the ,

V release of radioactive material frc.m the containment in the event of a primary or secondary break (the {

limiting events are a Loss-of-Coolant-Accident and a Main Steam Line Break) in two ways:

1. Reduction of containment pressure to nearly atmospheric pressure thereby reducing the potential leakage rate from containment; and

2. the boric acid solution minimizes the fission product iodine in the building atmosphere by the removal of iodine through the absorption of iodine by the spray droplets.

19.11.3.8.2 Systern Description t t

The CSS uses the In-Containment Refueling Water Storage Tank (IRWST) and has two independent trains (two containment spray pumps, two containment spray heat exchangers, two independent spray headers, and associated piping, valves, and instrumentation). The pumps and remotely operated 1

valves may be operated from the control room. Table 6.5-1 provides a summary of containment  ;

spray system design parameters.

The CSS provides sprays of borated water to the containment atmosphere from the upper regions Of i the containment. The. spray flow is provided by the containment spray pumps which take suction i from the IRWST. The containment spray pumps start upon the receipt of a Safety Injection Actuation Signal (SIAS). The pumps disebrge through the containment spray heat exchangers and the spray header isolation valves to ths respective spray nozzle headers, then into the containment atmosphere.

lp Spray flow to the containment spray headers is not provided until a Containment Spray Actuation ,

r Q Signal (CSAS) automatically opens the containment spray header isolation valves. The spray headers are located in the upper part of the containment building to allow the falling spray droplets time to approach thermal equilibrium with the steam-air atmosphere. Condensation of the steam by the '

falling spray results in a reduction in containment pressure and temperature.

The CSS pumps and CSS heat exchangers can be manually aligned to provide cooling of the IRWST '

during post-accident feed and bleed operations when the steam generators are not available to cool the RCS.

The CSS pumps are designed to be functionally interchangeable with the Shutdown Cooling System ,

(SCS) pumps. Though not required for normal operation or accident mitigation, inter-changeability of the pumps allows backup of the CSS pumps and increases the reliability of the containment spray function.

The CSS pumps, valves, and instrumentation are capable of being powered from the plant turbine generator (onsite power source), plant startup power source (offsite power), and the emergency  ;

generators (emergency power). Power connections are through a minimum of two independent buses so that in the event of a LOCA in conjunction with a single failure in the electrical supply, the flow from at least one containment spray train is available for containment heat and fission product removal. An independent electrical bus supplies one containment spray pump and associated valves and instrumentation.

To further increase the reliability of the containment spray function, the containment spray headers f

/* are designed to accept spray flow from an external source of water supply via a " tee" connection to .

( the spray line (see Figure 19.11.3.8-1). A description of this Emergency Containment Spray Backup System is provided in Section 6.5.5.

. a. . .  ;

h

System 80+ oesign controlDocument in case of unavailability of normal containment spray flow, the external source can supply water to the headers, allowing for containment cooling and depressurization.

19.11.3.8.3 Role of CSS in Accident Management The containment spray pumps are automatically started by an SIAS. Containment spray flow to the containment does not occur until a CSAS opens the containment spray header isolation valves. The specific sequence of pump and valve actuation depends on which power source is available. If offsite power is not available, the safeguards loads are divided between the two plant emergency diesel generators and are sequentially started after the diesel generates are running.

Once the spray pumps are started and the valves are opened, the spray water flows into the containment spray headers. These headers contain spray nozzles which break the flow into small droplets, thus enhancing the water's cooling effect on the containment atmosphere. As these droplets fall to the containment floor they absorb heat until they approach thermal equilibrium with the containment. When the water reaches the containment floor it drains to the holdup volume tank (HVT) and subsequently back to the IRWST.

Following the initiation of a severe accident, the functions of the CSS include, maintaining a low containment pressure and scrubbing fission products from the containment atmosphere. MAAP analyses demonstrate that operation of one CSS train is sufficient to assure containment integrity.

An external source of water to the sprays has been incorporated into the System 80+ contairunent design. The addition of this feature extends containment pressure control for several days. This provides additional time for the plant operators to re-establish containment heat removal and establish long-tenn containment cooling.

19.11.3.9 Hydrogen Purge Vent 19.11.3.9.1 Description of System System 80+ is equipped with two 3 inch diameter hydrogen purge vents which can be used for purposes of containment venting. The vents are intended for use in a post LOCA condition for diverting hydrogen into the station recombiners. The vents will be powered by a battery not used in the station blackout (SBO) coping guidance.

19.11.3.9.2 Potential Application An analysis of the potential application of the venting capabilities of the hydrogen purge piping was perfonned using the MAAP computer code. This analysis conservatively simulated hydrogen purge as a 0.049 ft2 (represents the area of one purge vent) equivalent area opening in the containment. A hypothetical accident management strategy was considered, whereby the hydrogen purge system is used to vent the containment once the containment pressure reaches 80 psia. The analysis results indicated that opening a small purge vent at the time the containment reaches 80 psia will enable the containment to maintain its pressure well below the containment failure threshold (see Figure 19.I1.3.9-1).

The containment venting feature is discussed here only for information purposes as it is not currently intended for use within the System 80+ accident management strategies.

Aswwwed Design afsterial.Probaburstk Risk Assessmerrt Page 19.1126

Syst m 80 + Design ControlDocument 19.11.4 Severt Accident Phenomenology )

C) j l

This section provides an overview of the severe accident methodology issues and discusses the relationship of the various postulated containment failure modes to the System 80 + PRA and the l EPRI ALWR Utility Requirements Document (URD). Specifically, this section provides support for l the PRA containment performance quantification and the resolution of SECY-90-016 and SECY-93-087 (References 114 and 116) deterministic severe accident issues.

19.11.4.1 Mechanisms for Early Containment Failure For purposes of the System 80+ PRA phenomenology discussion, early containment failure is defined ,

as containment failure prior to or within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after the core debris penetrates the reactor vessel.

The above definition of early containment failure is a relative one, driven by severe accident phenomenological processes. (For the source term and risk assessments, e..;1y containment failure is driven by the severity of the potential radiological release and population evacuation concerns. In these instances early containment failure implies a containment failure within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> of the severe accident initiation). Early failures of containment are important since these events will result in reduced warning times for initiating off-site protective measures and reduced time available for the decay and deposition of radioactive materials within the containment. The mechanisms for producing early contairunent failure cover a range of phenomenological processes. Potential early containment failure modes include containment overpressurization due to direct containment heating, hydrogen combustion and steam generation and containment structural failure due to missile generation, cavity

- overpressure, and corium debris impact on the containment steel shell.

The one hour post VB time interval chosen to represent the end of the early containment failure mode was primarily driven by a desire to separate the characteristics of a late containment hydrogen burn and an early post-VB hydrogen burn. Otherwise, the time frame associated with late and early designations are easily discernable. For the vast majority of "early" containment threats the containment challenge occurs within a few minutes of VB. Similarly, the vast majority of late containment threats occur a day or more after VB. The only exception to this rule appears to be the post-VB hydrogen burn considered under the "early" portion of the containment event tree (See Section 19.12) and the late hydrogen burn which occurs after considerable core concrete interaction.

This " late" burn can occur as quickly as 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after VB.

In designing System 80+, several containment / cavity enhancements (see Section 19.11.3) were made to existing PWR designs to minimize the risk of early containment failure. This was typically accomplished by developing the System 80 + design in accordance with the EPRI/ Utility Requirements Document (URD) for the Evolutionary PWR (Reference 7). l The following sections provide a summary overview of the early containment failure severe accident challenges, the associated phenomenological issues and quantitative assessments of the impact of these challenges on System 80+.

19.11,4.1.1 Direct Containment Heating Durittg certain severe reactor accidents, such as those initiated by station blackout or a small-break ,

O LOCA, degradation of the reactor core can take place while the reactor coolant system remains  !

pressurized, if unmitigated, core materials will melt and relocate to the lower regions of the reactor pressure vessel and ultimately melt through the RPV lower head. Once the RPV is breached,

--._.n.....-, n. r -

l

System 80+ Design ControlDocument fragmented core debris will be ejected from the RPV and transported directly to the containment atmosphere. During the ejection process, metallic constituents of the ejected material, principally zirconium and steel, exothermically react with oxygen and steam to generate chemical energy and (in the case of reactions with steam) hydrogen. Concomitant with the High Pressure Melt Ejection (HPME) process, there is the potential for hydrogen combustion and vaporization of available water.

The sensible heat loss to the containment atmosphere and its associated features are typically referred to as " Direct Containment Heating" By directly transferring large quantities of sensible energy from the corium and corium-steam reactions into the containment atmosphere, the containment may pressurize to a point where failure is possible. Since the containment threat is associated with vessel breach (VB) high containment radiation releases would accompany this type of containment failure.

This issue is of considerable concern to the present design of PWRs. Consequently, mitigation features have been factored into the EPRI Utility Requirements Document (Reference 7) and the NRC advanced reactor licensing basis (References 114 and 116). A detailed discussion of DCH and HPME aspects of vessel breach associated with the evolutionary ALWR design is presented in Reference 115. This information along with results of recent DCH related experimentation and analysis has been factored into the deterministic demonstration and probabilistic quantification of the robustness of the System 80+ containment design. These issues are discussed below in more detail.

19.11.4.1.1.1 Description of Phenomena The containment loads following an HPME event can be loosely combined under the heading of

" Direct Containment Heating" (DCH). DCH loads arise from the addition of mass and energy into the contairunent via several sources:

1. Blowdown of reactor coolant system steam and hydrogen into the containment.

O

2. Combustion of hydrogen produced prior to and during the High Pressure Melt Ejection (HPME) event.

3. Interactions between molten core debris and water on the cavity floor.

4. Transfer of sensible heat from the debris to the containment atmosphere.

As can be seen from the above, the DCH containment threat is synergistic in nature, typically involving several of the above processes. Factors affecting the above processes are discussed below.

19.11.4.1.1.2 Parameters Affecting DCH The magnitude and the occurrence of DCH is influenced by both phenomenological factors and the plant geometrical layout.

19.11.4.1.1.2.1 Phenomenological Aspects of DCH 19.11.4.1.1.2.1.1 Reactor Pressure at Time of Melt-Through The ability of gases flowing from the reactor vessel breach to fragment. entrain, or otherwise " sweep out" a significant amount of core debris from the reactor cavity into the lower compartment contaimnent volume is dependent upon gas velocity which is functionally dependent upon the reactor pressure at the time of failure, and the size of failure of the lower head.

Atyvoved Design Metodel- Probabastic Risk Ascessment Page 19.11-28

System 80 + Design ControlDocument (n) In general, the dispersal function follows an "s" shaped entrainment curve with three distinct regions.

At low RCS pressures and small RPV breach sizes, the entrainment curve is characterized by a low pressure entrainment cutoff. At RV failure pressures below this level, debris entrainment will not occur. At pressures greater than this threchold, the entrainment function monotonically increases with the RV failure pressure. Above RV failure pressures of 600 to 800 psia, the entrainment from the reactor cavity is nearly complete and relatively constant. Analyses and experiments have been performed on debris sweepout to establish details of the debris entrainment function and the RV failure low pressure threshold, in particular. This sweepout threshold pressure is a function of the failure area at vessel breach and the cavity configuration. For typical cavity configurations, a threshold pressure of 250 psi (see for example, References 115 and 216) will preclude entrainment of core debris into the upper compartment. In a similar assessment BNL estimated that the threshold vessel breach pressure can be as high as 350 psia (Reference 120). Thus, DCH can be significantly mitigated by taking steps to depressurize the RCS, or if depressurization occurs because of induced RCS piping or SG tube creep failures during core melt progression (See Reference 117).

19.11.4.1.1.2.1.2 Debris Mass Released at Reactor Failure As part of the NRC task on the Integrated Structure and Scaling Methodology for severe accidents (Reference 179) S. Levy established a basis for estimating the debris expected to be dispersed following an unmitigated station blackout scenario for a PWR with lower mounted instrumentation (see Appendix G of Reference 179). Using information based on several computer simulations a synthesized set of lower plenum conditions at VB were established.

fQ Levy noted that there is no consensus on the location or mode of vessel failure. Consequently, pre-V VB corium compositions were synthesized for two vessel failure modes. Three core melt progression scenarios derived from a station blackout were considered. Based on the review suggested DCH conditions at VB were defined.

Some minor adjustments were considered necessary in order to apply these results to System 80+.

The synthesized System 80+ pre-VB lower plenum corium composition was established by using a normalized total core inventory (so that the actual fuel, zircaloy and steel masses within the System 80+ design can be specifically considered) and a conservatively adjusted mass distribution to reflect the higher zircaloy content of the C-E System 80+ PWR. In particular, the SASM data was adjusted as follows:

1. Since C-E PWRs use very little Ag-In-Cd, significant amounts of control rod material will not occur in the ejected melt. Therefore, the mass of material associated with the molten control rod was lumped into the steel inventory.

2. As a consequence of the use of zircaloy in the fuel bundle grid and guide tube, the System 80+ melt will have considerably less steel in the melt and a greater zirconium content than in the Reference plant. To account for this feature, the SASM model was adjusted such that for high pressure scenarios the steel melt associated with the core failure (4000 Kgs) was removed from the steel melt and added to the pure molten zircaloy contribution. For low pressure scenarios 100% of the structural zircaloy (approximately 9000 Kgs) was assumed to be added into the melt as unoxidized zirconium.

(mv) 3. All zircaloy considered to be involved in eutectic formations with uranium and oxygen was conservatively assumed to be in a free metallic form.

Approved Desogn htaternie! Probabaistic Risk Assessment (11/96) Page 19.1129

i System 80+ Design Control Document l

Results of this assessment are presented in Table 19.11.4.1.1-1. Based on this review it was estimated that if VB were initiated from a high RCS pressure, the total ejected mass could range from 40 to 60 percent of the core weight. For conservatism, greater than 80% of the ejected mass is taken to be molten, with the ejected metallic constituents divided between molten zirconium and molten steel. The precise distribution and magnitude of the ejected mass was not strongly dependent upon whether the VB resulted from penetration failure or creep failure (See Reference 179, Appendix F). )

Low pressure releases of corium following VB were found to be more massive, however, a much greater fraction of the ejected mass was assumed to be composed of solid oxides. Funhermore, because of the extended VB failure time a much lower fraction of the ejected mass is unoxidized zirconium. Since the low pressure melt is not associated with significant debris dispersal this melt combination is not considered further within the context of DCH.

The high metallic content in this mixture is a conservative over-estimate and will result in bounding estimates of hydrogen production and exothermic chemical energy releases during HPME.

19.11.4.2 1.2.1.3 Debris Fragmentation Very Onely fragmented debris allows very efficient means of energy exchange with the environment.

If the debris particle is large, both the heat transfer to the surrounding gases and the rate of chemical reactions will be relatively slow and insufficient to cause a DCH threat. HPME experiments suggest corium debris will fragment into 0.1 to 10 mm particles. These particle sizes will allow efficient heat transfer and particulate oxidation (References 115 and 216).

19.11.4.1.1.2.1.4 Chemical Reaction Kinetics Chemical reactions can occur with unoxidized metals in the discharged debris. If steam is available and is well mixed with finely fragmented corium, oxidation processes will occur producing a large amount of hydrogen. This hydrogen could in turn burn, further contributing to the DCH pressure buildup. If oxygen remains in the cavity and the debris is mixed with it, the metals will oxidize, producing a large amount of energy without producing hydrogen. A comparison of the energy released during these various processes is illustrated in Table 19.11.4.1.1-2.

Recent DCH counterpart experiments performed at Sandia and ANL, fully exploring DCH consequences in realistic simulated geometries suggest that the DCH contribution to the HPME process may not signincantly contribute to a containment threat. Instead the HPME induced loadings are associated primarily with the blowdown and the post-VB hydrogen combustion which may occur immediately thereafter (References 123,189 and 190). Furthermore, the energy released during the chemical reactions appear to be retained within the solid material without significant energy transfer to the upper containment. A major reason for this conclusion is that when obstructions are properly considered, the debris either equilibrated within the cavity or was intercepted by above cavity structures which limits their interaction with the containment to one or more highly localized regions.

This results in high local temperatures in the vicinity of the corium, reduced heat transfer from the debris and minimal irnpact on global containment pressure.

19.11.4.1.1.2.1.5 Contairunent Transport and Mixing Containment pressurization from DCH can occur due to transfer of energy from the debris to the gas and from the combustion of hydrogen generated prior to or coincident with the event. For the former to be significant, it is necessary for the debris to interact with a significant fraction of the containment Approved Design Material- ProbabKustic Risk Assessment Page 19.1r40

System 80+ Design Control Document (d

c) atmosphere. Otherwise, the heat capacity of the gas which does interact with the debris will be so small that its temperature will rise significantly and relatively little energy will be transferred.

This conclusion has been confirmed by recent experiments in the Limited Flight Path and IET test series (References 144,189 and 190). Even when essentially all debris is entrained out of the reactor cavity, if it is subsequently confined to a small region adjacent to the cavity exit, relatively little pressurization was observed to occur due to heat transfer from the debris. In Reference 144 Pilch concluded that the presence of containment structures can be a " major mitigator of DCH".

In System 80+, this effect is expected to be even more significant, since the reactor cavity is designed to inhibit debris entrainment and Ance the region immediately adjacent to the cavity exit is well confined.

19.11.4.1.1.2.1.6 Water Availability The impact of the availability of water within the ALWR reactor cavity at the time of RV breach has been investigated in Reference 115. This study concludes that DCH loads would be mitigated provided the reactor cavity is " wet". (For this analysis it implies a " wet cavity" contains 60,000 gallons of water. This water inventory will fill the System 80+ reactor cavity 15 feet.) High pressure melt ejection into a water pool is treated as part of the rapid steam generation induced containment failure mode (See Section 19.11.4.1.2).

The role of water in the mitigation of DCH loads was explored experimentally as part of the IET test n program (IET Tests 8A and 8B, See Reference 190). These tests released high pressure corium into (j a 1/10

• scaled Zion reactor cavity half flooded with water. Results of these tests suggested the DCH pressurization was actually a combination of partial hydrogen burns and steam explosions / generation displaced in time, in the System 80+ PRA, the issues of "ex-vessel" steam explosions and hydrogen combustion are treated separately from DCH. DCH loads are not significant when the cavity is full of water, but the containment can be threatened by rapid steam generation, "ex-vessel steam explosion", or hydrogen burns. A discussion of "ex-vessel" steam explosions is presented in Section 19.11.4.1.2.2.

Hydrogen combustion issues are discussed in Sections 19.11.4.1.3 and 19.11.4.2.4).

19.11.4.1.1.2.1.7 HPME induced Hydrogen Generation and Combustion At VB the steam leaving the RCS will come in contact with and oxidize the molten metals in the corium melt. As a consequence of this oxidation process considerable quantities of hydrogen can be produced. This hydrogen and the hydrogen discharged from the RCS can be ignited via an auto-ignition process. The oxidation of ejected molten materials is expecte) to be high, limited by the amount of steam available to oxidize the zirconium and the time the melt is entrained in the steam flow. While complete oxidation of the zirconium is expected over time, experimental results suggest the oxidation process continues beyond the time of the DCH pressure spike. This suggests that the oxidation process during HPME is incomplete.

Experimental observations regarding combustion of hydrogen indicate that the auto-ignition process will ignite only the hydrogen leaving the reactor cavity. Hydrogen previously released to the 7 containment (if ignited at all) will likely undergo only incomplete combustion and will not

. (V significantly contribute to the containment loading at the time of VB.

Appresed Design Meteriet Probabelistic Risk Assessment Pope 19.1131

i System 80+ Design ControlDocument l

Both ANL (IET-8) and SNL (IET-5) IET experiments indicated that if the containment atmosphere is  !

inerted with steam prior to VB hydrogen combustion can be suppressed.

19.11.4.1.1.2.2 Physical / Geometrical Features Influencing DCH The presence of structures within or just outside the reactor cavity can help de-entrain debris previously entrained by the HPME process. This feature has been demonstrated by several corium simulant dispersal experiments and DCH tests performed in the SNL Surtsey and HIPS Test Facilities. The factors which govern the effectiveness of the geometrical cavity de-entrainment features include abrupt area changes, small flow turning radius, low velocity recirculation regions and intervening structures normal to the debris flight path.

In a recent series of counterpart DCH experiments performed to investigate DCH scaling, it was ,

concluded that the most important aspect to the DCH pcessurization is the presence of subcompartmentalization in the containment in the region above the reactor cavity (Reference 144).

In fact, it was noted that the details of the subcompartmentalization was not as important as the fact that some identifiable subcompartmentalization could be discerned. The presence of subcompartments restricts the amount of steam and air available to interact with the hot corium debris and hence minimizes the debris-air / steam heat removal. In practice, this feature results in the corium thermal energy (and exothermic energy) being retained in the debris or transferred to the adjacent wall structures. The DCH threat reduces to that created due to the ancillary RCS blowdown and hydrogen combustion processes.

Entrainment of corium is primarily expected to occur in the direction of the debris chamber.

Significant entrainment of debris into the cavity annulus is expected to be limited since the pathway is restricted by the RV core supporting corbels and neutron shield plugs. In addition, the dominant entraining flow stream will be perpendicular to the secondary flow stream necessary to upwardly entrain the corium. ARSAP assessment of the System 80+ cavity design estimated upward entrainment of corium debris to be less than 10% of the ejected melt stream (see Appendix 19.11B).

Furthermore, in System 80+ the de-entrainment processes associated with the debris retention chamber, results in the retention of large amounts of corium debris in the reactor cavity and a significantly smaller amount of debris in the lower containment region below the containment operating deck. Restricting the corium within these regions will significantly rMuce the ability of the corium to efficiently mix and release the energy directly to the containment atmosphere.

19.11.4.1.1.3 RCS Depressurization Prior to VB Prior to vessel breach (VB) the RCS is expected to be depressurized. Depressurization is associated with (1) a thermally induced failure of RCS piping (hot leg / surge line) or (2) operator activation of the Rapid Depressurization (RD) valves of the SDS. Both means of depressutization are assessed to be hight) likely for System 80+. A discussion of these depressurization racchanisms is presented below.

19.11.4.1.1.3.1 Thennally Induced Depressudzation As noted in Section 19.11.4.1.1.2.1.1 depressurization of the RCS prior to reactor vessel lower head failure can substantially reduce the DCH challenge to the containment. References 115 and 179 have indicated that the core uncovery and heatup process can potentially induce natural circulation flows within the RCS that can heat up the primary system hot leg. pressurizer surge line and/or the steam Approved Desiger Materino- Probab&stic Rkk Assessment Pope 19.11-32

System 80+ Design ControlDocument

(] generator tubes to the point where a creep failure of one or more of these components will occur V prior to failure of the RV lower head. This position is supported by INEL structural integrity calculations which demonstrate that at an average wall temperature of slightly greater than 1000'K (1340*F), a hot leg is likely to fail in a few minutes time due to creep rupture. This issue was studied as part of the expert clicitation to NUREG-1150 "In-Vessel Issues" (Reference 118) for several representative PWR NSSSs.

19.11.4.1.1.3.1.1 NUREG-1150 Opinions on RCS piping Failure Prior to VB In support of the NRC Reference Plant PRAs, several experts were surveyed to establish a basis for probabilistically quantifying various severe accident issues. The issue of thermally-induced RCS failure prior to VB was addressed in Reference 118. In this elicitation the experts were queried as to the probability of a thermally induced failure of a hot leg, surge line or steam generator tube following a severe accident.

Based on the expert clicitation on these issues, the following conclusions were reached regarding hot leg / surge line failure:

1. For conditions where (1) the RCS pressure is near a safety relief setpoint, (2) steam generators are dry, and (3) no significant prolonged forced flows exist in the RCS during core  ;

melting, the likelihood of an induced hot leg / surge line failure has a probability greater than 0.95. The probability that the RCS depressurization would be sufficient to decrease the RCS pressure to 600 psia was estimated to be 0.84. The equivalent probability that the RCS depressurization was below 200 psia was 0.64 (See Table C.6.1 of Reference 182). l (n)

V 2. Intermediate pressure core melt transients such as those associated with an unmitigated small LOCA with a total Loss of feedwater were not likely candidates for an induced hot leg / surge line failure. The potential for hot leg / surge line failure was estimated in Reference 118 to be only 0.13 for these sequences.

3. For transients where steam generators serve as an effective heat sink, the potential for induced hot leg failure was judged to be negligible.

While considered significantly less likely than induced hot leg failure, induced SGTRs are considered possible. The NUREG-ll50 expert elicitation panel considered that for a station blackout, induced SGTRs would occur prior to hot leg failure only 1.5 % of the time. Induced steam generator tube ruptures are of potential concern because of the possibility of creating a containment bypass condition.

It should also be noted that induced SGTR is possible for only those transients where the steam generator is allowed to dry out. If water is on the secondary side, steam generator tube temperatures will be too low to induce failure.

19.11.4.1.1.3.1.2 Applicability of the NUREG-1150 Creep FrJlure Elicitation to System 80+

A review of the NUREG-1150 documents supporting the conclusions regarding Hot Leg and surge line failure for the Reference plant large dry PWRs indicates that these conclusions can be applied to the C-E System 80+ reactor. This conclusion is based on a semi-quantitative review of the major parameters influencing hot leg / surge line failure, core melt progression and VB, and a comparison

(", of Reference plant PWRs and System 80+.

.)

Approvmf Design Atatorial !Yobabdustoc Risk Assessment Page 19.1133

System 80+ Design Control Document llot leg creep failure arises as a result of natural circulation flows, developed during the core melt progression, which transfer considerable energy from the core to the upper portion of the RCS (upper plenum, hot legs etc.). Transfer of this energy considerably raises the temperature of the hot leg even while the core is partially filled with water. This provides the opponunity for an induced hot hg/ surge line piping failure prior to VB. Thus, RCS induced depressurization represents a race between the natural circulation induced heatup / creep induced structural failure of the hot leg / surge line and the core uncovery/VB failure process. The heatup process is driven by decay heat and exothermic energy released during the zirconium oxidation process. The hot leg creep failure response is governed by the hot leg flows, PSV or SDS operation, and steam / hydrogen superheats as well as the thermal and structural properties of the hot leg / surge line material. The parallel VB process is governed by the details of the core melt progression and mode of RV failure. The similarities and differences between System 80+ and the Reference Plants (Surry/ Zion) with relation to hot leg / surge line failure and VB process are discussed below:

1. Comparison of Natural Circulation Driving Force of Reference plant and System 80+

The natural circulation driving force is strongly linked to the level of Zirconium-Water reaction and the associated exothermic energy released in the core region. The System 80+

PWR design contains approximately 30% more zirconium per MW of thermal power than does either Surry or Zion. This additional zircaloy content arises from the fact that C-E employs a high neutron economy fuel design that uses zircaloy for the construction of fuel spacer grids and control rod guide tubes, as well as, fuel cladding. Therefore, it is anticipated that the natural circulation flows between the core and the steam generator region will be of higher temperature and high flowrate than that of the Reference Plants.

2. Comparison of Thermal Hydraulic Features of Reference Plant and System 80+ Hot Legs The precise location of an creep induced RCS failure is uncenain. For scenarios where a significant through-flow is expected through the pressurizer, it is likely the RCS failure will occur in the surge line. For less dynamic flows the RCS failure may occur towards the exit of the RV hot leg nozzle either in the RV nozzle, hot leg or the connecting field weld. While the NRC in Reference 127 considered field welds as a good prospect for failure, lack of detailed information prevented any detailed analysis in this area. Hot leg failure was assumed to occur either at the exit of hot leg nozzle or the entrance to the hot leg.

Both the System 80+ and Surry RVs and hot leg nozzle are constructed of carbon steel. The lip of the nozzle on the Surry nozzle is thinner and the nozzle diameter is smaller than for System 80+.

C-E hot legs are constructed of carbon steel with a wall thickness of 4.4 inches. This differs from the Surry design which utilizes a 2.5 inch thick stainless steel pipe. For much of the temperature range of interest and for similar thermal loadings the Biot number and the characteristic heat conduction time of the two materials will be similar.

The characteristic time required to conduct heat into the hot legs is proportional to x:/a where a is the thermal diffusivity of the material and x represents the characteristic length of the structure (wall thickness). This parameter is approximately equal to 1000 seconds for both the Reference plant and System 80+ PWRs' hot legs.

ANvoved Design Material . Probabbstic Risk Assessment Page 19.1134

- - - _. . ._ _ _ . _ __ _ . _ . . _ . ~ _ _ . _ . - _ _ _ _ _

-(

-i.

Sysnm 80+ Deskn ControlDocument

. 3. Comparison of Creep Properties of Reference Plant and System 80+ Hot Leg Material

. Experimental evidence demonstrates that'the creep properties of carbon steel and stainless j steel are different. In fact, carbon steel will be susceptible to a creep failure at temperatures  !

beiow that of stainless steel. Consequently, if RCS failure occurs in the hot leg, for similar  :;

thermal loadings, the System 80+ hot leg will be more likely to fail than the Reference plant.

- 4. Comparison of Upper Plenum Designs l l'

The design of the upper plenum physically is very different from that of Surry. . Thus, different and larger hydraulic resistances can be expected for System 80+. However the  !

natural circulation flows are only weakly sensitive to this parameter (typically, natural-circulation flows are inversely proportional to the cube root of the hydraulic resistance).

'i

5. Comparison of Core Melt Progression  ;

The core progression between the Reference Plants and System.80+ is expected to be different in many details. However, the overall timing of the core melt progression will be similar. Additional zircaloy in System 80+ will likely drive the RCS to hotter temperatures as -

a result of additional energy release to the RCS via zirconium-water reaction. .J l

6. Comparison of VB Failure Mode The vessel failure mode and timing associated with both the Reference Plant and System 80+

Both designs employ lower heads v.'ith instrument O. designs are considered similar.

penetrations. Differences in vessel thicknesses and radius are not considered significant in the timing and mode of the RV failure.

7. Comparison of Surge Line Design Surge lines of both the Reference Plant and the System 80+ are designed with similar materials and dimensions. The System 80+ pressurizer relief valves are designed with a large blowdown band. This results in longer times of valve operation once the valve setpoint has been reached. A longer opening time will allow additional time for the surge line to heat up. Thus the surge line failure potential should be greater for System 80+.

While a detailed quantitative assessment of the RCS induced piping failure mechanism is not available, it is likely that the more extensive zirconium -water reactions expected for System 80+ 3 would result in higher hot leg / surge line temperatures during the melt progression. The effect of this j increased heatup is expected to be offset by the increased hot leg wall thickness. Consequently, it is j expected that the application of the NUREG-1150 expert clicitation on this subject can be applied to j the quantification of this issue for System 80+.  ;

1 It should be noted that while hot leg / surge line induced RCS failure is credited in the PRA its actual  !

impact on the analysis is small because of the high expected availability of the Rapid Depressurization Valves.

O

'O -  ;

i Approved Doets asseedst AseaugeWe med Assessment Pays 79.FF-35 L  ;; . , _ .,

System 80+ Design ControlDocument 19.11.4.1.1.3.2 Depressurization Via the SDS The RCS can be depressurized via actuation of one or aore of the SDS Rapid Depressurization (RD) valves. These valves are intended to provide th: optrator with a mechanism to depressurize the RCS to a low pressure prior to VB. Depressurization of the RCS serves to:

1. allow alternate sources of water to inject into the RCS,

2. minimize the loads imposed at the time of HPME, and

3. prolong the integrity of the RV prior to VB As discussed in Section 19.12, most transients that pressurize the RCS to the safety valve setpoint remain at that pres;ure as a result of an error on the part of the operator to not actuate the SDS when required to establish feed and bleed. For purposes of RCS depressurization, the operator can fail this initial task and still recover the SDS depressurization capability provided the SDS is open within two hours following the sustained PSV lift. Since the operator has sufficient indications that core uncovery is imminent or in progress, and a reversal of the transient through re-establishing feedwater is unlikely, a delayed operator action opening the SDS valve is considered highly likely. This recovery action has been factored into the Level 2 portion of the PRA.

19.11.4.1.1.3.3 RCP Seal Failure RCP seals typical of C-E PWRs are not expected to fail prior to VB provided the operator does not <

operate them for extended periods of time (greater than 30 minutes) without seal cooling.

19.11.4.1.1.4 Summary of Experimental Evidence 19.11.4.1.1.4.1 DCH and IIPME Experiments contributing to the current understanding of DCH have been performed at Sandia National Laboratories (SNL), Argonne National Laboratory (ANL), Brookhaven National Laboratory (BNL), and Fauske and Associates Inc.(FAI) in the United States and at Winfrith in the U.K. A summary of these experimental efforts is presented in References 115 and 179. This information is sununarized in Tables 19.ll.4.1.1-3a and 19.ll.4.1.1-3b. These tests investigated debris dispersal and DCH in test facilities with scale variations from smaller than 1:100 up to 1:10. It should a'so be noted that the vast majority of these :xperiments studied the Zion reactor cavity design. This particular cavity design is believed to have an unusually high potential for dispersing debris at relatively low RCS pressures. However, several different reactor cavity designs were experimentally investigated, panicularly with unheated debris and at the smaller scales.

While these results can not be considered directly prototypic of System 80+ (see Reference 115) due to differing cavity design, these tests do provide c6nsiderable insight into the mechanical and thermodynam:c processes associated with the HPME and DCH processes and in particular the role of geometry in limiting debris dispersal and heat transfer.

Key test observations were as follows:

1. Obstructions to debris dispersal in the cavity can substantially increase the threshold pressure required to obtain debris dispersal. Given sufficient RCS pressure, debris dispersal was Approved Design Meterial- ProbabKrtic Risk Assessment Pope 19.11-36

System 80+ Design ControlDocument l observed to be relatively complete. However, none of the tested configurations is judged to i (mV) be as resistant to debris dispersal as the System 80+ design. )

2. RCS debris dispersal pressure thresholds were clearly observed. For modest RV failure sizes (typical of an instrument tube failure) threshold pressures for debris dispersal can exceed 600 psia for non-dispersive geometries similar to the Watts Bar cavity. For large lower head i failures threshold pressures for debris dispersal were between 150 to 350 psia, depending on 1 reactor cavity design.  !

3. Cavity offset areas, or low velocity regions within the reactor cavity could efficiently collect and retain corium debris (See Reference 115).

4. The degree of subcompartmentalization within the containment will have a direct influence on DCH induced pressures. Results of the Limited Flight Path (LFP) (Reference 144) and Integrated Effects Tests (IETs) (Reference 125) performed at the SNL Surtsey facility indicate that even at the modest levels of subcompartmentalization typical of large dry PWRs, DCH Jnduced pressure load contribution will be limited (typically less than several atmospheres).

5. In the presence of steam, unoxidized metals released during a HPME can react to produce metal oxides and significant quantities of hydrogen. Furthermore, the hydrogen produced can be auto-ignited by the locally hot corium debris.

6. Evaluations of integral experiments including consideration of subcompartmentalization shows p that direct transfer of energy from the debris to the containment atmosphere can be virtually Q eliminated for reactor containment configurations including ex-cavity subcompartments capable of intercepting dispersed corium.

7. It has been observed in the IET tests that even when hot corium debris induces a local hydrogen burn in the vicinity of the reactor cavity, hydrogen previously distributed to the containment will not substantively participate in the burn process.

8. Structures in Zion above the reactor cavity are capable of dis-entraining between 90 and 95%

of the molten debris.

9. For conditions in which steam inerting is available prior to VB, hydrogen combustion during IIPME does not occur. This results in a reduced DCH load approximately equal to the steam ,

blowdown from the RCS (Reference 189).

Quantitative estimates of the DCH pressure loading for System 80+ are discussed in Section 19.11.4.1.1.5.

19.11.4.1.1.5 Quantitative Assessments of DCH Challenge for System 80+

This section provides two alternative methods for computing the System 80+ containment DCH challenge. The first method was intended to represent a bounding analysis for the C-E ALWR and an in!tially performed as part of the ARSAP program and employed parameters generally consistent widt the current System 80+ design. However, by assuming all the DCH energy transfer occurred in

/7 a single large containment volume (" Single Cell" assumption), consideration of the physical processes

(,) associated with the debris retentive cavity design were not specifically taken into account. This Approved Desbpn Motorial . Probab&stic Misk Assessment Page 19.1147

System 80+ Design controlDocument methodology has been typically shown to conservatively bound DCH experimental results. Results of this analysis are summarized below and the detailed methodology is outlined in Appendix 19.11D.

The second method used to establish DCH loads for the System 80+ plant specific design was based on the methodology recommended by Pilch et. al. (References 122 and 181). This approach is founded on results of integral DCH experiments (IET and LFP tests) conducted at ANL and Sandia National Laboratory. These tests demonstrate that containment compartmentalization external to the reactor cavity plays a major role in limiting the direct energy exchange between the molten debris and the containment atmosphere. In fact, based on recent integral experiments, the contribution to compartment pressurization associated with the debris dispersal and chemical kinetic processes was found to be negligible. While the methodelogy discussed in the previous paragraph provides a bounding assessment of DCH consequences, the Pilch based model employing two calculational cells has been demonstrated to be more realistic yet still conservative.

A quantitative estimate of the conservatism inheient in these two approaches (" Single Cell" vs. "Two Cell") was provided by Pilch in Reference 122. In chat reference the " Single Cell" and "Two Cell" DCH calculation were compared to a spectrum of DCH experiments. Results of this comparison for the "two cell" model are reproduced in Figure 19.11.4.1.1-1. In this figure the experimental results are graphed as a function of the fraction of the predicted DCH pressure rise that would be obtained from the single cell formulation. Two items should be noted. First, all tests surveyed resulted in DCH predicted pressures that were less than 52% of the predicted " single cell" calculation value.

(This is established by noting that the abscissa of Figure 19.11.4.1.1-1 is the ratio of the measured pressure to the single cell predicted value, and that the measured DCH pressure falls below a value of

.52.) Second, all efficiencies predicted by the "two cell" model were greater than the experimental observation. Thus, while the single cell DCH representation has the potential of being grossly conservative, the "two cell" DCH model is still bounding.

19.11.4.1.1.5.1 Preliminary Assessments of DCH Pressures for the C-E Evolutionary ALWR Based on the state of the art of the time, Reference 115 was charged with establishing a quantitative methodology for calculating bounding DCH pressurization for the System 80+ evolutionary PWR. As discussed in Section 19.11.4.1.1.5, this bounding estimate employed a " Single Cell" representation of the System 80+ containment. The mass discharged to containment was studied parameterically. The containment pressurization considered loadings arising from (1) RCS steam and water discharge (2) complete oxidation of rnolten zircaloy discharged (3) complete combustion of all pre-existing and HPME produced hydrogen and (4) complete transfer of all exothermic energies to the containment atmosphere. In the presence of additional lower plenum water, the complete oxidation of 10,000 kg of steel and the consequent combustion of the resulting hydrogen was also assumed. Additional details of this analysis may be found in Appendix 19.11B. Results of these analyses are summarized in Figure 19.11.4.1.1-2. These analyses indicate that to challenge a System 80+ type containment by DCH, an HPME event must involve a dry cavity containment scenario with a dispersed mass of finely fragmented corium debris in the upper atmosphere equivalent to between 40 and 50% of the total core inventory. Conversely, if the amount of debris that is available for release to the reactor cavity is not a large fraction of the core mass or if a significant quantity of water initially resides in the reactor cavity, a DCH event which could challenge containment integrity would not occur.

The System 80+ debris retentive cavity is assessed (see Appendix 19. llc) to be capable of retaining upwards of 90% of the ejected corium mass within the conf'mes of the extended cavity-debris chamber-HVAC room. Other potential pathways for corium dispersal are theoretically possible.

Approved Design MaterW

• ProbabiGstic Risk Assessment Page 19.1138

Sy' tem 80 + Design ControlDocument Oxs These include: flow out around the RV nozzles, and if catastrophically failed, the permanent refueling pool seal and instrument seal table as well. These pathways are not considered to be significant contributors to debris dispersal. To accommodate these potential pathways in a bounding manner, the present analysis can be approximately applied by assuming a 50% debris dispersal efficiency to the upper compartment and a 60% molten melt ejection. These levels are far above the level actually expected for this cavity design. Using the above assumptions the existing data from Appendix 19.11B may be approximately interpolated to yield a peak containment pressure of 125 psia.

Reference 115 also provided a " realistic" assessment of the corium discharge by assuming the mass of debris ejected into the upper containment is equivalent to 30% of the original inventory, and that the DCH event occurred without a concommittent hydrogen burn. Without the additive effect of simultaneous combustion associated with a potential hydrogen auto-ignition process DCH does not pose a credible containment threat.

19.11.4.1.1.5.2 "Two Cell" DCH Calculations for System 80+

As discussed above, results of more recent integral DCH experiments along with semi-mechanistic CONTAIN calculations have demonstrated the importance of considering subcompartments in the characterization of the DCH threat. Recent work performed by Pilch in quantifying the DCH induced failure potential for the Zion PWR noted that even for a fully dispersive cavity such as Zion the )

presence of structures at the exit of the cavity would substantially reduce DCH induced containment  !

pressurization challenges. By applying the "two cell" model representation of the Zion containment, i Pilch demonstrated a reduction in total containment loading by 30% and induced containment failure l probability reduction from 0.85 to 0.04 (See Reference 181).

(" /

This section discusses the application of the "Two Cell" DCH model to System 80+. This model was developed as a collaborative effort between C-E and ARSAP contractors. The model retains all the features of the Pilch model and includes several additional features for parametric evaluation of l DCH loadings for use in PRA. The salient features of the model are as follows: I

1. User specified oxidation of all ejected materials (zircaloy and steel), limited by RCS steam availability. l

2. Combustion of all hydrogen produced in the HPME process.

3. Separate treatment of the corium discharged and retained in the cavity (and adjacent small volumes) and the corium dispersed to the upper compartment.

Parametric features considered in the model allowed separate treatment of hydrogen in the upper compartment from that generated during HPME or that residing in the RV prior to VB. A summary of the "Two Cell" model is presented in Appendix 19.llD.

Recent experimental and analytical evidence indicates that the oxidation potential of the debris depends upon the time required to disperse the debris and the availability of an abundant steam supply. For example, if the dispersal occurs over a short time interval, the steam discharged from the vessel during this interval will not be sufficient to oxidize all the debris. In the ANL IET tests significant steam oxidation of the dispersed debris was noted, however a considerable amount of this 7 oxidation occurred shortly after the peak pressurization had subsided and therefore this hydrogen did (b not contribute to the HPME pressurization loading. To account for this incomplete oxidation an appropriate parameter was included in the model for probabilistic evaluation.

Approved Design historial Probabikstic Risk Assessment Pope 19.11-39

System 80+ Design contror Document A deterministic assessment of the DCH pressure spike was established by using a bounding interpretation of the high pressure pre-VB corium melt distribution presented in Table 19.11.4.1.1-1.

The "in-vessel" and containment hydrogen distributions and initial conditions were established by consulting MAAP predictions for a limiting transient with extended cycling relief valve (CRV) discharges to the IRWST and a LOCA with a high pressure discharges to the containment (See Section 19.11.5). A summary of the initial conditions are presented in Table 19.11.4.1.1-4. Results of these analyses are summarized in Table 19.11.4.1.1-5 for upward (cavity annulus) debris dispersal fractions equal to 0.1,0.25 and 0.5 times the ejected vessel mass. As a result of the C-E cavity design (see Section 19.11.3.6) debris dispersal of more than 10 percent of the debris into the upper compartment volume is considered high and factors greater than 0.25 are highly unlikely. This spectrum is provided in order to demonstrate the robustness of the System 80+ design to DCH pressurization loadings.

The above calculations represent conservatively biased "best estimate" calculations. The assumptions utilized in the assessment are:

1. All of the molten debris is ejected from the vessel.

2. In the SBLOCA case, 50 percent of the debris is fragmeraed and participates in DCH; in the SBO case, the corresponding value is 90 percent.

3. Of the metals (zirconium and steel) participating in DCH, 50 percent (SBLOCA) or 75 percent (SBO) is oxidized to form hydrogen.

4. As seen in the IET tests, a limited fraction of the hydrogen discharged to containment prior to VB burns. This fraction was conservctively established at 25% percent of available upper compartment hydrogen.

5. A larger fraction (50 percent) of the hydrogen released during the blowdown or produced during debris dispersal is burned.

6. All burns are adiabatic.

For the expected condition of HPME, the hydrogen combustion process is not expected to exceed pressures of 110 psia even when the ejected mass into the upper compartment is artificially increased to 50% of the total ejected mass. This value is below the containment pressure associated with ASME Service Level C allowable stresses.

19.11.4.1.1.5.3 Analyses to Support DCH mitigation via the Rapid Depressurization Valves Analyses perforn'ed to support the design of the RD valves of the SDS have been performed at the ABB{E and FAI (Reference 115). FAI analyses demonstrated that if the operator takes action to depressurize the RCS before the time the core exit temperature reaches 1200*F the RCS can be successfully depressurized to about 250 psig prior to RV breach.

Similar analyses have been performed by ABB-CE to support a plant specific assessment of the SDS valve capabilities. These analyses were performed with the System 80+ version of MAAP 3.0B.

The results of these studies are discussed in Section 19.11.3. In summary, the RD valves were found to successfully depressurize the RCS to the DCH entrainment threshold, so long as the SDS is ApprovedDesign heaterief Probabmstic Misk Assessment Page 19.11-40

i System 80+ Deslan ControlDocument actuated within two hours after a systained PSV lift for a transient with an early total loss of feedwater. . Thus, the operator is expected to have sufficient information and time to utilize the RD 1 valves for RCS depressurization should that action become necessary.

19.11.4.1.1.5.4 Quantitative Estimate of Debris Entraina==*

Scale model experiments (Reference 125) have indicated that debris can be entrained out of the cavity ,

through the RPV/ biological shield annulus as well as through the in-core instrument tunnel. For System 80+, of the debris that passes through the tunnel, very little of the debris is expected to be carried out of the cavity .into the HVAC room and from the HVAC room into the bulk of j containment. Thus, any debris participating in energy. transfer to the bulk containment must .be ,

dispersed upwards through the reactor cavity annulus. The fraction of the total flow area out of the ,

reactor cavity represented by the annulus flow area about the corbels is 25 percent. As discussed j previously, this represents an upper bound on the fraction of the debris that could be dispersed 4

upwards into the upper containment, since the upward debris motion will be limited by availability of '

t debris below the RV and entrainment will be impeded by the presence of corbels, the neutron shield

,  : plug (which obstructs more than 50% of the annulus gap) and the hot and cold legs. Initial assessments of upward debris entrainment performed by ARSAP suggested the appropriate upper limit l on debris escape from the System 80+ reactor cavity to be 10% of the ejected mass (see Appendix 19.11C).  !

19.11.4.1.1.6 Significance of DCH Cantalanwnt Thmat to System 80+

As discussed in Section 19.11.3.6, the System 80+ has been specifically designed to mitigate l O containment threats from HPME and DCH processes. System 80+ mitigation features include the availability of a safety grade Rapid Depressurization capability within the Safety Depressurization System (SDS) to reduce RCS pressure to below the debris entrainment threshold, a debris retentive

, cavity configuration with sharp turns, overhangs, flowpath offsets and a " cavity trap", and a convoluted steam discharge path from the cavity which will promote de-entrainment of the core debris within the Gvity while allowing adequate cavity steam relief.

. In addition to the above features, the System 80+ cavity is designed to be floodable by the operator prior to RV lower head failure. As indicated in the NRC Draft Final Safety Evaluation Report on the EPRI Utility Requirements Document for the Evolutionary LWR, simultaneous dispersal of debris and water should ensure that the containment threat resulting from the HPME is mmtmal (Reference 161). ,

i I Thus, DCH is a credible threat only for those situations where the RCS is at the CRV setpoint prior I to VB while simultaneously the reactor cavity is dry. These conditions create a situation where the potential hydrogen combustion associated with the HPME event may be high at a time when all other DCH energy transfer awhanisms are maximized. This set of conditions is limited to a small fraction of plant damage states (PDSs). These initiate from high pressure with a CRV RCS leak rate and the CFS system malfunctions or is not actuated prior to VB. Further, this fraction is considerably reduced when one considers that CRV sequences are estimated to have a high probability of hot leg failure and a high probability that the failure will be large enough to depressurize the RCS below the DCH entrainment threshold. Funbermore, use of the RD valves also has a high probability of successfully depressurizing the RCS. Based on a current interpretation of DCH containment loading as primarily a hydrogen based threat, blowdown of the RCS prior to VB also implies re-distribution of hydrogen from the RCS into the upper compartment. Based on IET test results, this hydrogen redistribution will reduce the hydrogen available for combustion immediately after VB. Use of the RD valves thus virtually eliminates any credible DCH containment challenge. (Following VB and 4pmenweeknnoneerw Mosesane'c met Aumement rope 1s.1141 n.--- 7.- _, o*.a w - - m --- - , . . - - + , r-w.. ...n , . ~ - . . ,- c.- .--- .. e- ,

Sy' tem 80 + Design ControlDocumenj RCS blowdown, this hydrogen can potentially burn and challenge the containment as a hydrogen threat.) The percentage of potential DCH threats can therefore be reduced to a small fraction of all accident sequences. Furthermore, since the DCH peak containment pressure results in a containment challenge that is below Level C stress intensity, only a small percentage of these remaining sequences will proceed to containment failure. Following the preceding arguments one concludes that the conditional containment failure probability given a core melt condition occurs will be very small.

19.11.4.1.1.7 Application to the PRA This section discusses the quantification of the DCH induced containment threat for application to the System 80+ PRA.

19.11.4.1.1.7.1 Quantification of RCS Depressurization Parameter RCSHIGH

1. High pressure transients with successful operation of SDS or low pressure core melt scenarios.

For high pressure transients where the SDS is actuated in a timely manner or where RV failure follows low pressure RCS transients, the potential of a DCH induced containment failure will be taken as 0.0. That is. DCH induced containment failures from low RV failures under low RCS pressures is not deemed credible.

(Early containment threats following low pressure RV failure are primarily considered to result from hydrogen combustion or a steam explosion; see Section 19.11.4.1.3 and 19.11.4.1.2.2, respectively.) ,

2. High Intermediate pressure treasient depressurization and the SDS is not actuated.

l Operator actuation of the SDS prior to RV failure is included within the System 80+

l Emergency Operations Guidelines (EOG). Consequently, there is a high probability that the RD valves will be actuated in a timely manner so that any DCH threat may be averted prior to significant core uncovery.

However, f x high pressure severe accident scenarios where the SDS is either unavailable or j not activated, the probability of RCS depressurization caused by induced hot leg failure is )

high. A value for this parameter is conservatively selected. Recent information on RCS depressurization imply that the primary contributor to containment threat following HPME is not so much entrained debris as it is an induced hydrogen burn. Failure of the RCS hot leg will allow most of the hydrogen trapped in the vessel to enter the containment and hence substantially reduce any resulting DCH burn. While the lower value is retained for purposes  ;

of conservatism, the 0.95 value for DCH mitigation may, in fact, be more appropriate.

The probability of an induced RCS failure occurring as a result of a SG tube rupture in a dry steam generator (allowing potential fission product containment bypass) for sequences at the PSV pressure is estimated to be small. This estimate is based on a review of NUREG-1150 expert clicitations for RV failure phenomena in Zion and Surry and are considered boundary for System 80+. j Almwoved Design Motorial ProbabHistic Risk Assessment (11/96) Pege 19.1142 l l

1 i

'I i

Sv: tem 80+ Deslan ControlDocument 1

For intermediate pressure transients, the potential for an induced RCS hot leg failure will be conservatively neglected (See Section 19.11.4.1.1.3). The likelihood of induced steam l generator tube rupture is also assumed to be negligible. (See Appendix 19.11A) l l Quantification of DCHSTREN: DCH Caatmin==at Failure Probability  !

19.11.4.1.1.7.2 Given a high RCS pressure and that RV lower head failure occurs into a " dry" reactor cavity, the containment failure probability is conservatively based on the results of a high level decomposition of  ;

the DCH event into its principal contributors. Peak pressures were established for a variety of l conditions anxi a weighted containment . failure probability wasl established. The process was l performed separately for DCH events that are initiated ' from PDS where the RCS leak rate is governed by a cycling relief valve (CRV) and for the high and intermediate pressure state where a j continuous RCS leak is present. Results for this assessment were established using the "two cell" i DCH model discussed in Section 19.11.4.1.1.5.2.

l 19.11.4.1.2 - Rapid Steam Generation h i

19.11.4.1.2.1 In-Vessel Steam Explosions (IVSEs) i 1

19.11.4.1.2.1.1 Description of Phenomena j The concept of a fuel induced " steam explosion" within the reactor pressure vessel refers to a i

phenomenon in which molten fuel rapidly fragments and transfers its energy to the coolant resulting in steam generation, the development of shock waves and the acceleration of large RV internal masses O with possible mechanical damage and failure of the RV. As a consequence of such explosions, there was = a concern that missiles would be generated that might contact and locally penetrate the containment and allow for early radiation release to the environment. This containment failure mode was initially considered in the Reactor Safety Study (WASH-1400) as the alpha-mode failure. Recent assessments of steam explosion phenomena have suggested that IVSE "do not provide a credible threat to the integrity of either the primary system or containment" (Reference 117).

19.11.4.1.2.1.2 Parameten Affecting in Vessel Steam Explosions (IVSE)

For a steam explosion to produce a threat to the containment, the interaction process must have the following:

1. Sufficient corium mass

2. Favorable geometrical configuration

3. High energy conversion

4. Triggering mechanism.

5. Production of a sufficiently energetic missile These issues were investigated by the Steam Explosion Review Group (SERG) as they apply to 4 team explosions within the RV (Reference 126). Most members of the review group believed IVSE could

( occur but that the probability of producing a containment threatening IVSE.was on the order of 10 8

(See Table 19.11.4.1.2-1). This conclusion was reached despite the expression of differing opinions Anemd De**" ****enlet hasahane'c nina Asmment tasi rose rs.sr-n o - - . .. .. . _ __ __

1 l

l System 80+ Design Control Document i

on the basic steam explosion phenomenology (Reference 117). This failure potential assessment is an order of magnitude lower than that used for WASH-1400. In the NRC staff opinion expressed in Reference 127 the estimated probability of steam explosion has an upper limit of 0.01 and a mean of a considerably lower value.

Separately, a critical review of steam eplosion phenomena and the consequences on containment loading was discussed in Reference 128.

1 In that report, the components of an IVSE leading to containment failure were decomposed and reviewed in detail. This evaluation lead to the conclusion that the conditional probability of a steam explosion causing containment failure given a molten corium condition within the RV was on the order of 105 Similar event decomposition methods were employed by Theofanous, et. al. in estimating the potential for low pressure steam explosion induced conditional containment failure (Reference 129). Such a failure was estimated to have a probability on the order of 10d and therefore expected to be physically unreasonable to occur.

A detailed investigation of the "in vessel" steam explosion issue was also considered within Phase B of the German Risk Study (Reference 130). This study assumed a steam explosion with 10,000 Kg of corium participating with a relatively high thermal to mechanical energy conversion efficiency of 10%. Even using these conservative assumptions, the resulting loadings would be insufficient to fail the RV. As a result of this study the GRS " ruled out" the possibility of destroying both the RV and the containment as a " risk relevant accident pathway" In practice, the expert judgement developed for Reference 126 was incorporated into the NUREG-1150 Reference plant Surry PRA with a mean probability of this event (VB-ALPHA) to result in containment failure to be 0.0085 when the RCS is at a low pressure and an order of magnitude lower when the RCS meltdown occurs at high a pressure (Reference 131).

19.11.4.1.2.1.3 Summary of Experimental Evidence Large scale steam explosion experiments were conducted by Sandia National Laboratory in the Open Geometry and FITS experimental test series. The purpose of these tests were to experimentally study the magnitude and time characteristics of pressure pulses and identify the initial conditions necessary to trigger and propagate explosive interactions between water and various molten materials.

19.11.4.1.2.1.3.1 Sandia Open Geometry Experiments These experiments consisted of large scale (5 to 20 kg) fuel - coolant interaction tests. The test program was scoping in nature with the primary objective of assessing the efficiency of the fuel-coolant interaction thermal to mechanical energy conversion process. Approximately sixty tests were conducted in a minimally instrumented open vessel. The fuel simulant used was a thermitically generated iron-alumina mixture and corium. Results of the iron-alumina-water interaction tests indicated energy conversion ratios at the lower end of the observed range (0.2 to 1.5%). No energetic explosions with corium were observed.

19.11.4.1.2.1.3.2 FITS Experiments The purpose of the FITS experiments was to determine the triggering behavior, explosion threshold and to parametrically estimate the thermal to mechanical energy conversion ratio associated with l steam explosions. The FITS facility was well instrumented and the interaction chamber was closed.

Approwd Design Material . Probabmstic Risk Assessment Page 19.11-44

Sv~ tem 80+ oeskn controlDocument The FITS program lasted several years and included uti 100 experiments. Fuel masses varied between 2 and 20 Kg. The majority of the FITS experiments used thermitically generated iron-alumina, and the remaining tests used thermitically generated corium.

These tests indicated that energetic fuel - coolant interactions were possible for corium. Thermal energy conversion ratios were found to be in the 0 to 3% range with an uncenainty factor of about 2 (Reference 132). A typical plot of conversion efficiencies established from the FITS A and B tst series is presented in Figure 19.11.4.1.2-1. These tests indicate a median conversion efficiency is about 1.5%.

Parametric studies performed as pan of FITS also provided the following:

For coherent melt deliveries (that is the melt is delivered in one mass) into water at ambient temperature and pressure 32 explosions were observed out of 37 tests (Reference 132). Thus, the probability of a spontaneous steam explosion under these conditions can be established at 0.86.

Similar experiments conducted with saturated water and at ambient pressure indicated a steam explosion probability of 0.24 (4 observed explosions out of 17 tests).

The influence of pressure on the probability of a spontaneous steam explosion was established in FITS-C (Reference 132). No spontaneous steam explosions were observed for all five FCI tests l conducted at ambient water temperature and a pressure of 5 bars (75 psia), thus, experimentally supponing the position that high pressure steam explosions are extremely unlikely events.

O Additional experiments were conducted to ascenain the imponance of melt delivery on the steam h explosion process. While under cenain circumstances, coherent melt deliveries were observed to produce steam explosions, a pre-dispersed delivery of fuel debris was not.

19.11.4.1.2.1.3.3 Ispra High Pressure Experiments in Reference 126, Dr. Mayinger referred to a steam explosion test program performed by EURATOM to establish the influence of system pressure on steam explosions. While details of this test series are unknown. Dr. Mayinger noted that a general conclusion drawn from these experiments was that initiation of steam explosions at pressures greater than about 300 psia require very strong detonative triggers.

19.11.4.1.2.1.4 Significance of IVSE to System 80+

Based on a review of. available steam explosion data and analyses, it appears that sufficient information is available to conclude that the probability of containment failure resulting from a corium-coolant interaction (CCI) event is very low (on the order of 0.001 or less). Much of these assessments considered typical PWR geometries analogous to that of System 80+ and are, therefore, considered applicable to System 80+.

19.11.4.1.2.1.5 Applicability of IVSE to the PRA

- The above information is believed to be generally applicable to the System 80+ PRA. Therefore, for the purpose of System 80+ risk assessment, the containment failure caused by an IVSE was taken to O have a very small mean containment failure probability for severe accidents where the RCS fails at pressures less than 250 psig and an order of magnitude lower when the RCS fails at high pressures.

This probability is defined in the PRA as variable VB-ALPHA.

4pmen oneen nonamner . emsesasne met Aneument <ms) rese ss.11-ti

1 l

System 80+ Design Control Document 19.11.4.1.2.2 Ex-Vessel Steam Explosions l 19.11.4.1.2.2.1 Description of Phenomena Steam explosions arise from the generation of steam at a rate faster than can be acoustically or inertially relieved by the surrounding medium. Steam generation occurring at that rate will generate )

shock waves in the surrounding liquid pool and produce strong impulsive loadings on adjacent I structures. l The discharge of molten core debris into the reactor cavity region could potentially result in explosive interactions between the molten core debris and cavity water. The initiation of an explosion. if any, would occur either when the core debris initially contacts the water or when the debris penetrates the water and contacts the concrete surface at the bottom of the reactor cavity. The results of a potential steam explosion would be to generate impulse loads on the reactor cavity walls and in-cavity structures. The resultant damage to important structures was considered negligible for the PWR cavity designs analyzed in NUREG-ll50. However, EVSE induced destruction of the reactor pedestal (RV support) structure was considered in the Grand Gulf PRA (see Appendix C of Reference 180).

19.11.4.1.2.2.2 Parameters affecting EVSE Parameters affecting ex vessel steam explosions are essentially the same as those for IVSEs with the following exceptions. Ex-Vessel steam explosions occur exclusively at low pressure and typically the cavity geometry allows for steam relief. The details of the cavity / containment design will also inDuence the consequences of an EVSE event.

19.11.4.1.2.2.2.1 Containment Pressure EVSEs will typically occur at low pressure. Results of FITS experiments at ambient temperature and pressure indicated that the probability of a spontaneous EVSE given a coherent melt subcooled water l interaction was 0.86 (See Section 19.11.4.1.2.1). However, at a system pressure of only 5 bars (75 l I

psia) spontaneous steam explosions could not be triggered by a discharge of corium into a subcooled water pool. ,

1 19.11.4.1.2.2.2.2 Cavity Water Temperature The propensity for the development of a steam explosion was experimentally found to be dependent on the proximity of the water pool temperature to saturation. Results of FITS experiments indicate that when a melt interacts with a saturated water pool, the probability of an EVSE drops from 0.86 to about 0.25. Furthermore, steam explosions in saturated water typically occurred towards the top of the pool generating very low explosive forces within the pool.

19.11.4.1.2.2.2.3 Mass of Corium Involved in the Explosion The short duration of the explosion process will limit the corium mass involved in the process. The actual mass of corium that will be involved in a steam explosion is highly uncertain. Estimates of corium involvement in ex-vessel steam explosions typically consider the mass of corium injected into f the pool during the time interval in which corium initially enters the water pool and falls to the pool Door as the mass of corium involved in the steam explosion process. This position is founded 4 primarily on the experimental observation that the steam explosion can be triggered by the contact of Approwd Design Materiel. Probabnistic Risk Assessment Page 19.11-46

System (0 + Desian ControlDocumart the corium with the basemat. While water surface explosions are possible they are less'likely f particularly if the water pool is subcooled (as is expected for System 80+). ,

In System 80+, as with many PWRs, the corium ejection occurs primarily from the lower head  ;

- instrument tube failure. Following this failure the mass of molten material residing in the lower head _ l of the RPV is ejected. This ejection process involves a molten mass between 100,000 and 150,000 Ibms. During this ejection process the molten material ablates the initial hole area to a much larger j size. ' The molten mass ejection process takes between 4 and 10 seconds dependent upon RCS r pressure at VII and the details of the ablation process (See Appendix 19.llF).

i Support for the instrument tube ejection failure mode is provided by a recent review of RV lower head failure modes performed by Rempe, et. al (Reference 184). These analyses generated failure .

t maps that suggest that for a PWR with lower head penetrations, at low RCS pressures the likely RV failure mode will be that of instrument tube failure (See Appendix 19.llF). This failure mode ,

l

dominates until the RCS pressures are in the vicinity of the PSV setpoint where both penetration i

- - failure and global creep failure vie for the dominant mode.

For the System 80+ design, instrument tube failure represents an initially very small failure area. As '

a result of the ejection of molten material this small hole could ablate to a maximum discharge area of about 0.5 ft 2. These analyses are consistent with analyses provided in support of the DCH SASM  ;

program (Appendix J of Reference 179).

Estimating the mass of corium involved in any given steam explosion is not precise. However, if the i RV failure results from a single hole in the RV lower head (for example following a local creep i failure or ICI tube ejection) the maximum mass of corium involved in the explosion may be j

( .

established by assuming the explosion is initiated at the point of contact of the corium with the

~

basemat floor, and that all the corium residing in the column of melt from the top of the pool to the L basemat floor participates in the explosion process. Since some of this corium would be quenched in

. the pool prior to basemat contact and that the trigger mass and the top of the pool are separated by approximately 15 feet, this criterion for defining the corium mass involved in an explosive event is 2

considered bounding. U:ing a typical RV lower head hole size of 0.5 ft (the upper limit for an 1

ablating RV penetration hole), the mass of corium involved in the explosion can be computed as follows:

Mass of corium = (RV Hole Area)(Depth of Cavity Pool)(Corium Density)

= (0.5 sq. ft.) (15 ft) (550 lbm/ft3)

= 4125 lbm Steam explosions ocurring at intermediate hole sizes would involve smaller corium masses.

< 19.11,4.1.2.2.2.4 Shock Wave Attenuation The ability of the structure to withstand a shock or missile loading is dependent upon the structural .l response characteristics and the magnitude of the impulsive load (or kinetic energy of the missile)  ;

+ upon impact. For shock loads, the wall loadings are diminished from the initial pulse inversely as a function of the square of the distance from the explosion and via shock interactions with free surfaces  ;

of the liquid pool. The missile load is diminished by the conversion of the kinetic energy of the slug O to potential energy in raising the slug to the target elevation.

l 1

~ ~

4preved Des @pr Adecordsf.P>seetmsele AdrA Assessmarrt Pepe 79.f r-47 'l 1

l

- i

--- - . . . - -- _. . ,,-, a . .

System 80+ Design ControlDocument Large containment structures can also mitigate the impact of impulsive and shock loadings by virtue of their natural response characteristics. EVSE loads are typically on the order of 2 to 5 milliseconds.

Thus, cavity designs with significantly greater natural periods will transmit impulsive loadings inefficiently, thereby reducing its physical impact. The estimated lowest mode period of the System 80+ reactor cavity is 11.5 milliseconds. A dynamic structural analysis of the cavity suggests that the median cavity failure impulse is about 3 psi-seconds (See Section 19.11.3.6). This impulse can be related to a peak incident call pre.2sure by assuming a loading shape and duration. For a 3 millisecond triangular pulse loasi (representative of a steam explosion), this implies a peak incident pressure of about 2000 psia. A similar assessment for a three millisecond square pulse will result in an equivalent incident pressure of about 1000 psi. The inherent strength in the System 80+ cavity represented by these values is expected to be sufficient to survive potential steam explosions following VB.

19.11.4.1.2.2.2.5 Vulnerability of Containment Structure to Cavity Failure The steam explosion is a short term dynamic process acting over a period of milliseconds. Steam explosions can damage containment stmetures by either transmitting impulsive shock loadings to various containment structures or by transmitting the energy to a liquid pool and creating an energetic liquid slug.

The major concern with EVSE is the ability to cause damage to the containment either inc'imly via failure of important RCS supponing structures or generation of containment threatening missiles, or directly via dynamic loading of the containment walls. System 80+ is designed such that there is no direct contact of the containment walls and the cavity water pool. Therefore, direct contamment threats due to shock wave formation or missile generation cannot occur. Tle cxpected containment failure mode is considered an indirect one, whereby a steam explosion occurring within the reactor cavity weakens and or collapses the RV supporting structures (e.g., cavity walls, RV supports).

Failure of the RV supports may lead to excessive motions in the RCS piping which can ultimately cause failure of a containment penetration.

Stmetural evaluations of System 80+ RV supports, RCS piping md cavity design suggest that even under conditions of complete failure of the reactor cavity a subsequent failure of containment integrity is unlikely. This conclusion is a result of the following features:

1. The ability of the cavity to support the reactor vessel and the dead load of structures and equipment subsequent to corium attack, or ablation, was analyzed assuming no credit for support from adjacent structures. The results of this analysis indicated that 5' by 5' triangular shaped horizontal cross-sections of concrete remaining in each of the four corners of the lower cavity would be sufficient to maintain support of the reactor vessel and other equipment and structures on the lower cavity.

Additional calculations show that the reactor vessel and the upper cavity could continue to be supported by structures adjacent to the cavity even if the entire lower cavity wall below the corbels were either eroded by corium attack or destroyed by a steam explosion. Rebar provided between the interface of adjacent walls with the upper reactor cavity wall provide enough resistance through shear-friction to provide this support without relying on support from the lower cavity wall. These calculations have been performed in accordance with the requirements of ACI 349 (except without load factors applied), and, therefore, a high level of confidence is associated with this support mechanism for the reactor vessel (see Section 19.11.3 and Appendix 19.llL). Since this alternate load path is available for supponing the Appresed Design Matenal. ProbabMstic Risk Assessment Page 19.1148

l V  !

System 80+ oesian contrat Document i .  !

reactor vessel, further attempts to increase the strength of the lower cavity to [

accommodate severe accident pressure are not necessary. ,

i This feature of the System 80+ cavity design guarantees that steam explosion loadings in the i

reactor cavity (even those that fail the cavity lower walls) will not be sufficient to induce a failure of containment integrity.

2. Even 11 significant RV motions are postulated, motions of the RCS are restricted via several' i mechadcal restraints which prevent excessive motion of major structures such as the steam generators. if the steam generators remain well constrained (as is currently expected) piping connected to the generators will not fail. Structural integrity of RCS connected piping is also expected.

3. Should a failure of the RV supporting structure occur, and the motion of piping connected to the RCS results in a piping failure, the failure will likely be contained "in containment".

Thus, containment integrity will not be compromised. This conclusion is primarily a result of the high flexibility associated with the smaller RCS connecting piping and the tendency to 4 design piping penetrations stronger than the connecting piping. ,

19.11.4.1.2.2.3 Summary of Ex4 raal Evidence .

A discussion of steam explosion experiments is provided in Subsection 19.11.4.1.2. l :

~

In addition to these experiments, steam explosions have also been observed in SANDIA HPME l t

experiments performed as pan of SPITS and HIPS test program (Reference 158), investigating pressurized melt ejection into the water pools. This program included five flooded cavity tests. All '

tests were observed to produce steam explosion loads characterized by shon duration (several milliseconds), high amplitude pressure pulses that typically disassembled the test apparatus ,

(Reference 158). These tests injected an iron-aluminum melt into small relatively enclosed cavities.

These tests were not conducted within the framework of the Severe Accident and Scaling L

Methodology (SASM) effon and therefore were not assessed to be prototypical of steam explosion loads within PWR cavities.  ;

Additional DCH tests have been performed with flooded cavities as pan of the 1:10 scale IET DCH  ;

E program performed at Sandia (IET tests 8A and 8B). These tests injected a corium melt simulant into a one half flooded Zion cavity. Test IET-8a injected water from a vessel initially around 150 psia.

Test IET-8B was conducted from a nominal initial pressure of about 900 psia. DCH effects were clearly suppressed. Steam explosions were observed for both tests. The experiment with low l

pressure core melt injection resulted in a single delayed steam explosion raising the cavity pressure to about 600 psia. The high pressure melt ejection transient produced several smaller (200400 psi) ]

steam explosions (Reference 190). l A recent experiment performed as part of the Beta Core-Concrete Interaction Program in Germany (BETA V6.1) has produced a steam explosion that lifted a 7 ton cylinder several me'ers off its foundation (Reference 185).. While the precise details of this experiment are unavailable, loads were

- produced which were equivalent to a 3% conversion efficiency of the corium thermal energy into f-

' kinetic energy (Reference 185). A review of this test performed by G-E (Reference 186) suggested

,f that the loading that developed during Beta V6.1 were due to a rapid quasi-steady pressurization of the KWU reactor cavity. The KWU reactor cavity is relatively tight with a free volume less than (2/96) Page 19.1149 L 2 DeeQn aseeantet

• hebahneetc R6ek Assessment i

i mee -~. . > - . . , - - , _ w,

System 80+ Design ControlDocument i

1/6* ot mat of System 80+ and with minimal steam relief capability. Therefore, the KWU cavity )

design will be far more susceptible to this steam pressurization loading pattern than System 80+. l 19.11.4.1.2.2.4 Quantification of EVSE Loads This section describes alternate methods that have been proposed for use in quantifying loadings caused by EVSEs.

19.11.4.1.2.2.4.1 R. Henry Estimate of EVSE Shock Loading (Reference 169)

The steam explosion shock wave is generated from a rapidly expanding vapor mass whose growth exceeds the ability of the surrounding fluid to relieve the pressurization. Qualitatively, once formed the shock wave will rapidly attenuate as it moves away from the initial region of rapid vapor growth.

R. Henry has termed this region the interaction zone. Thus, if one were to establish the pressure in the interaction zone, then the wall loading could be established by assuming a suitable decay of the shock wave as the wave propagates toward the cavity walls.

Unlike chemical explosives, the ability of a steam expansion to support a large local pressure pulse in a free field is limited by the relative volume increase which is a decreasing function of pressure.

Reference 169 suggests that a reasonable upper magnitude for a steam explosion pressure in the steam-corium interaction zone would be about one half of the critical pressure (about 1450 psia).

These loads were noted to rapidly decay as a function of distance from the source event.

The passive ALWR has developed a simplified methodology for evaluating bounding steam explosion loadings by defining an interaction zone of with a uniform peak pressure of 1450 psia and a square law power decay and an effective duration (See Reference 169). Applying this methodology to the System 80+ cavity an effective interaction zone of about 5 feet is defined. For the System 80+

cavity geometry the resulting peak wall pressure load would reduce to about 500 psia. Experimental data suggests thesteam explosion has a rapid. nearly instantaneous, pressure rise followed by a linear time decay for a duration of about 2 to 3 milliseconds. Applying this characteristic to the calculated pyssure spike one can infer a consequential impulse of under 1 psi-seconds.

19.11.4.1.2.2.4.2 F. Moody Estimate of Steam Explosion Loadings (Reference 171)

Moody studied the significance of steam explosions to GE BWRs in Reference 171. In this study a steam explosion was defined as a rapid submerged steam formation from numercus corium droplets i that is sulficient to propel an overlying liquid mass so that it can exert an impact on target structures. l I

A simplified methodology for establishing the kinetic energy of the liquid slug and the submerged pressure spike were also established. Employing Moody's methodology to discharged corium masses between 25 Kg and 2.500 Kg of molten corium one finds the predicted submerged pressure spike to l be between 10 and 60 psi. These loads are well within the capability of the containment structures. l However, it should be noted that in defm' ing the methodology, Moody considered the maximum heat transfer from the corium to the pool to be governed by enhanced film boiling. These heat transfer j 2

rates produce steam at a far slower rate than the 30 Mw/m identified by Henry in Reference 169, as l being typical of steam explosions.

19.11.4.1.2.2.4.3 TNT Equivalent Methodology Considerable information is available on the explosive capability of TNT for use in depth charges.

O, Much of this early work is documented by Cole in a classic treatise on Underwater Explosions l

)

A14woved Design Material Probab&stic Risk Assessment Page 19.1150

, 1 l

t Sy^ tem 80 + oesign controlDocument

\

(m)

V (Reference 170). This methodology was the basis of the NUREG-il50 EVSE loading assessment for Grand Gulf pedestal integrity assessment.

By assuming the stored thermal energy within a superheated mass of corium can be related to a charge of TNT, approximate estimates of the impulse loading on various structures can be estimated l using equation 7.6 of Reference 170. This equation defines a TNTimpulse, I, (in psi-sec) as follows. 1 i

I = 1.46W "(RW ")"

where: W is the TNT weight equivalent (Ibm)

R is the radial location of the structure from the explosion source (ft)

Assuming (1) the corium to be discharged from the RV at 5040*R, and (2) the EVSE process results in a 3% thermal to mechanical energy conversion efficiency, corium induced steam explosions will 1

produce approximate potential impulse loads of between 0.5 and 9 psi-s for corium mass discharges of between 500 and 60,000 lbm (See Table 19.11.4.1.2-2). (Note that the definition of impulse is area under the transient pressure pulse, for a square pulse this is the pressure rise multiplied by the pulse duration.) This corresponds to a range of participation in the EVSE of between .15 to 18% of the System 80+ core inventory. TNT loading equivalents tend to overestimate the true loading.

Furthermore, the 3% energy conversion is representative of the upper limit of the energy conversion efficiencies noted in the FITS Tests and was observed in fewer than 5% of the FITS experiments.

19.11.4.1.2.2.5 Significance of EVSE to System 80+ l t \

V For System 80+, it is expected that the cavity flooding system will be operable and actuated prior to the reactor vessel failure. Therefore, fuel-coolant interaction (FCI) is likely following vessel breach and the possibility of " steam explosions" cannot be excluded. The estimates provided above indicate that the consequences of steam explosions following reactor accidents is highly uncertain. Impulse fragility curves established by structural analyses on the System 80+ reactor cavity indicate that pressure impAses below about 1.5 psi-sec pose no threat to the System 80+ lower reactor cavity.

(The corbel region of the reactor cavity can withstand dynamic loadings in excess of 5 psi-sec.) The lower cavity wall failure threat increases incrementally with loading. An impulse of approximately 2 psi-sec will have a cavity failure potential of under 0.10. Impulses above about 3 psi-sec have a potential for cavity failure greater than .50. Considerably larger impulses are required to fail the corbels.

Provided Henry's hypothesis on the interaction zone maximum pressure limit is accurate for free surface loadings, the maximum pressure impulse anticipated during a steam explosion is less than 1 psi-sec (below the level of containment threat). Even if Henry's estimate of the peak pressure in the interaction zone increases to 7500 psia (twice the steam critical pressure), the nominal steam explosion pulse experienced at the cavity walls will be less than 3.5 psi-sec for a triangular pulse loading of .003 second duration. At this loading the resultant lower cavity wall failure probability is about 0.50.

A similar deterministic assessment performed using the more conservative TNT equivalent approach considerably overestimates the containment threat. This assessment is dependent upon the corium o mass involved, therefore, the level of predicted containment threat depends somewhat upon the RV

() lower head failure mode. Assuming an upper bound mass involvement of 5,000 lbm (approximately 5% of the ejected mass) of corium debris instantaneously participates in a 3 per-cent efficient steam explosion event, the resulting containment threat results in an impulse load on sections of the cavity Approved Design Material Probabbstic Risk Assessment (11/96) Page 19.11-51

System 80+ Design ControlDocument walls of less than 2 psi-sec. The mean cavity failure probability for this condition is less than 0.10.

At the average corium conversion factor of 0.015, the actual threat to the cavity will become negligible.

19.11.4.1.2.2.5.1 Impact of EVSE on Severe Accident Reactor Cavity Flooding Strategy System 80+ is equipped with a manually operated reactor cavity flooding system for use during severe accidents. The intent of this System is to provide large quantities of water to the reactor cavity prior to VB so that the consequences of vessel failure can be minimized and the ensuing corium discharge may be cooled and quenched and cavity fission product releases scrubbed. Initially, the post-VB steam explosion was considered as a containment threat, but was generally dismissed as not being credible based on the facts that (1) the cavity water did not directly interface with the containment, so that induced loadings had no direct containment load path and (2) an unlikely failure of the cavity would not compromise containment integrity (either via generation of cavity missiles or induced penetration failures). The advent of the mishap in Beta test V.6 has lead to a reassessment of the EVSE threat. Based on this reassessment it was concluded that large impulsive loadings sufficient to " damage" the cavity walls can potentially be produced during an EVSE. However, detailed analyses support the initial judgements that induced containment failure is unlikely. In this context the pre-flooding of the reactor cavity prior to VB appears a useful strategy whose potential benefits are expected to outweigh its small risk.

Since the System 80+ cavity flooding is operator driven, the timing of the operation can be adjusted to minimize risk. Based on current research it is concluded that pre-flood of the reactor cavity is the most efficacious strategy. However, being operator driven, the strategy can be adjusted to coincide with advances in our understanding of the consequences of EVSE or debris coolability. Furthermore, because of the relative simplicity of the CFS design and the location of key equipment in the holdup volume, there is not expected to be significant environmental consequences of a delayed CFS actuation. While the reactor cavity will be exposed to a thermally and radioactivity hotter environment, the holdup volume equipment environment for the CFS valves will be relatively constant because of the concrete wall separating the reactor cavity from the holdup volume and the fact that for either scenario (pre-VB or post-VB flood) the CFS valves will be submerged.

19.11.4.1.2.2.6 Application of EVSE to the System 80+ PRA 19.11.4.1.2.2.6.1 Decomposition of the EVSE Process The System 80+ PRA explicitly considers the potential for Ex-Vessel Steam Explosions and their associated consequences. To establish a median containment failure probability given an EVSE occurs, the EVSE containment failure event was decomposed into the following basic events and parameters:

1. MASS: Mass of Corium involved in Steam Explosion

2. EFF , Efficiency of Steam Explosion

3. CAVF: Loading Fails Cavity

4. CF : Cavity Failure Induces Containment Failure This decomposition and quantification is discussed below:

Approved Design Material- Probab&stic Risk Assessment Page 19.11-52

i System 80+ Design ControlDocument  ;

MASS: Mass of Codum Involved in the Steam Explosion 4

(

This parameter is highly uncertain. .Four panicipating corium mass ranges were established as f follows:- (See Table 19.11.4.1.2-3 A) j

, ' Low (L): Participating Corium Mass is below 1000 lbm  ;

intermediate 1 (11): Corium Mass 1. between 1000 lbm and 5,000 lbm Corium Mass is between 5,000 lbm and 10,000 lbm Intermediate 2 (12): ]

High (H): Corium Mass is greater than 10,000 lbm

- Lower plenum conditions were established prior to VB in Table 19.11.4.1.1-1. Based on this  ;

information it is expected _ that about 120,000 lbms of molten corium mass will be ejected during VB.  !

l Estimates of the time dependent discharge _ mass for a representative lower head failure at high and intermediate pressures are presented in Appendix 19.11F. These figures show that the corium j ejection process requires less than 10 seconds and that the maximum hole in the RV will be about 0.5 j 4

ft2 (See Appendix 19.11F). During this ejection period (Reference 179) steam explosions are possible. For the quantification of the participating mass it was assumed that the EVSE mass could  ;

be established by the mass of corium in the jet spanning the height of the water-pool. The  !

distribution of masses was directly related to the fractional time that the RV hole was below a specific j area. In addition, it was assumed that there was a small probability that the total mass panicipating in the EVSE was above the value that would be calculated using the maximum hole area. The time j frame of the steam explosion is on the order of several millseconds. The mass distribution  !

panicipating in the corium melt is established based on a time-failure area relationship (See Appendix j 19.11F). i EFF: Emciency of steam Explosion 4

Data from FITS tests indicate that the median steam explosion efficiency is 1.5 % with a range of observed values between 0 and 3%. Two ranges of efficiencies will be considered. These are  :

efficiencies less than 1.5% and efficiencies greater than 1.5%. These groups will be considered I

equally probable (0.50/0.50) and quantified at the extremes of each range.

CAVF: Cavity Fails due to Loading i

This parameter provides the probability that the cavity load condition resulted in containment failure. l These conditions are summarized in Table 19.11.4.1.2-3B.

TNT loadings were established using the maximum conversion efficiency identified in each of the  !

Low and- High groupings. The_ failure rates were conservatively established by considering the j

average failure probability anticipated by the TNT equivalent model predictions, j

. CF: Cavity Failure Induces Containment Failure j P

Based on discussions presented in Section 19.11.4.1.2.2.2 above, there is support for the position that the failure of the reactor cavity will not compromise containment integrity. This is due to the fact ,

that adjacent concrete structures, external to the cavity, can provide support to the RV and corbels even 10 the lower cavity. structure carries no load, in addition, the hot and cold legs can provide i

c w_._-, . r r..,

}

System 80+ Design ControlDocument additional support to the RV. Even if the reactor vessel supports should fail, large RCS motions can be restrained via motion limiting devices on other RCS components. Furthermore, if large RCS motions were to occur, structural analyses indicate that a consequent containment failure is still unlikely. It is our best judgement that for realistic loading conditions, cavity collapse will not occur.

However, in the remote possibility of a cavity collapse sufficient structure will still remain, so that a failure of the RV sufficient to induce a subsequent failure of containment integrity is unlikely. In light of this evidence, the probability that cavity failure will cause a consequent failure of containment integrity is conservatively assigned a value.

19.11.4.1.2.2.6.2 Quantification of EVSE Fall This section intentionally blank.

19.11.4.1.2.3 Post-Vessel Breach Steam Spikes 19.11.4.1.2.3.1 Description of Phenomena Steam spikes following RV breach result from the relatively rapid pressure increase within the containment produced by both (1) the discharge of high pressure water / steam from the reactor vessel and (2) generation of steam associated with the quenching of superheated core debris. These processes can provide a very rapid (occurring in several seconds or less) stearn addition to the containment followed by a modest pressure spike. In general, pressure loadings resulting from this process will exceed containment design limits but will be well within ASME Service Level C limits (See Section 19.11.3.1). This containment challenge is discussed in more detail below.

19.11.4.1.2.3.2 Parameters Affecting Post-Vessel Breach Steam Spikes O

In the context of the PRA, Post-Vessel Breach Steam Spikes will include both the steam released into the containment following vessel breach (VB) and the vaporization of liquid during the corium quenching process. The impact of these releases is considered along with the pressurization prior to VB to establish the rapid steam generation containment challenge. Consequently, the parameters affecting the magnitude of the post RV failure pressure spike are:

l

• Containment pressure prior to VB e RCS conditions at VB

• Mass and Superheat of corium ejected into the reactor cavity e Water availability in the reactor cavity.

19.11.4.1.2.3.2.1 Estimation of Contairunent Pressure at VB The containment pressure at the time of VB is dependent on the RCS inventory discharge paths and the status of containment heat removal. In general, transients that discharge inventory through the i IRWST or bypass containment will have containment pressures very near the initial containment state ]

regardless of the availability of containment sprays. All transients that discharge into a cooled )

containment (sprays available) will have a containment pressure at VB 5 to 10 psi above the initial l value, llowever, if the RCS discharges into the containment which has lost the heat removal function )

(sprays unavailable), containment pressures prior to vessel breach can be significant. l l

l Altvoved Design Meterial . Probabkstic Risk Assessment Page 19.1154 1

1

I System 80 + - Desian controlDocument 19.11.4.1.2.3.2.2 RCS Conditions at VB I

The energy and mass associated with the RCS steam / water discharge following VB will establish the increment in containment loading due to direct mass and energy addition into the containment. This l I

containment pressurization process is analogous to the containment pressurization following design

' l basis pipe breaks.

i Mass and Superheat of Corium Debris )

19.11.4.1.2.3.2.3 Following VB, steam will be generated in the process of quenching the corium debris. In this process the stored energy from the corium is transferred to the water which in turn is vaporized.

Experimental data on corium quenching indicates that the quenching process exhibits maximum heat {

fluxes of up to 30 Mw/m2 for short time periods.

I

.19.11.4.1.2. . .324 Availability of Water i The amount of corium that can be quenched is dependent on the availability of water. If insufficient water is available, quenching will not be complete and steam generation will be limited.

i j

19.11.4.1.2.3.2.5 Contribution Due to Exothennic Reactions i

in the process of quenching, the metallic portions of the corium debris may release considerable quantities of energy as a consequence of oxidation. As a result of the rapid debris cooldown it is

- expected that oxidation will be limited to less than 50% of the molten metallic material.

4 19.11.4.1.2.3.3 Significance to System 80+ 1

The peak containment pressures resulting from rapid steam generation events following a System 80+ {

, i RV lower head breach are summarized in Table 19.11.4.1.2-4 for selected severe accident scenarios. These scenarios include a station blackout, a "V" sequence (interfacing systems LOCA) i and a Large LOCA in a containment without availability of containment sprays. These events typically span the range of interest for estimating post VB rapid steam generation pressure spikes.

For the first two scenarios, the initial containment pressure will be less than 25 psia, for the last j sequence the LOCA was assumed to result in a design basis challenge to the containment resulting in an initial pressure of 67 psia. (This assumption neglects any passive cooling of the containment due to heat transfer to the containment shell and structures within the containment. Design basis analyses and MAAP calculations suggest that these heat sinks will contribute to a reduction in containment pressure of about 20 psi in a three hour time interval prior to VB.) The containment is subsequently j

pressurized by a combined high pressure steam release and steam generation due to a rapid quenching j

of the corium debris. For this study the corium mass quenched comprised 65% of the total core mass l

(including support structure) and was initially discharged into the containment at 2800'K. The mass and mass distribution used for this study were extrapolated from results of the NRC sponsored SASM l activity presented in Table 19.11.4.1.1-1. To ensure that all steam generation modes were accounted l

' _ for. it was also assumed that 50% of the quenching debris oxidizes during the quenching process, e The resulting bounding containment pressures were established for these scenarios. Results of this analysis' are presented in Table 19.11.4.1.2-4. Analogous analyses were performed for the Large l Break LOCA. However, in this analysis containment sprays were not credited and the mass and energy of steam released from corium quenching at VB was negligible. The peak pressure calculated

) . using this methodology was below 98 psia. While these loadings are above the design basis 1

Approvent Doelpn aseeersiel* MobeMinaic Mink Assessment (2/9 51 h p 19.11-65

System 80+ Design Control Document containment loadings, they are well below the pressure limit determined using the ASME Service Level C criterion.

19.11.4.1.2.3.4 Application to the PRA Rapid steam generation (RSG) events (or steam spikes) will not result in a significant challenge to the System 80+ containment. For scenarios where (1) the primary discharge is through the IRWST. (2) the containment is bypassed or (3) the containment heat removal functions properly, the containment pressures associated with RSG will be below (or slightly above) the design pressure limits. These transients will be assumed to have no possibility of failing containment. For transients with direct steam discharge to the containment and without any containment heat removal the final containment pressure following the RSG event will be below 100 psia. This pressure level exceeds the containment design limit by about 50% and is well below Service Level C limits. NRC has indicated that the probability of failing the containment at levels below 1.5 times the design pressure is virtually zero (Reference 127). For purposes of the PRA a very small failure probability is established for this later condition.

19.11.4.1.3 Ilydrogen Combustion The production of combustible gases (principally hydrogen) within the RCS and subsequent release to the containment following a severe accident has been noted to be a potential contributor to early containment failure for many PWR and BWR designs. Typically hydrogen combustion can influence containment failure by static (deflagration) or dynamic (detonation) overpressurization missile generation and equipment failure due to thermal or pressure effects.

19.11.4.1.3.1 Deflagrations 19.11.4.1.3.1.1 Description of Phenomena A deflagration is a combustion process in which the combustion front moves at subsonic velocity with respect to the unburned gas. The pressure and temperature following a deflagration process are spatially uniform and can be conservatively bounded by the assumption of adiabatic, isochoric complete combustion (AICC). Factors that determine the type and level of combustion include the concentration of combustible gases (principally hydrogen), the concentration of the oxidant (oxygen in air) and inertents (nitrogen and steam) and the initial temperature and pressure conditions within the containment.

19.11.4.1.3.1.2 Parameters Affecting Ilydrogen Combustion 19.11.4.1.3.1.2.1 Ilydrogen Concentration This section is concerned principally with the potential for an early hy&pn combustion induced failure of the containment. Other combustibles significant to severe accident progression, such as l carbon monoxide, are not considered in this section because they will not be available until a considerabb *.Jie after VB. The concentration of hydrogen within the containment depends on (1) the amount of uydrogen produced in the RV during the early core melt, (2) how effectively the hydrogen is dispersed in the containment, (3) the threshold at which a hydrogen burn will occur, and (4) the occurrence of prior burns.

Aiywoved Design heaterial . ProbabiGstic Risk Assessment (11/96) Pope 19.1156

System 80+ Desian ControlDocument 19.11.4.1.3.1.2.1.1 "In-Vessel" Ilydrogen Production During a severe accident in an LWR, significant quantities of hydrogen can be produced "in vessel" by oxidation reactions principally between the zircaloy constituents of the core aal to a lesser extent the steel internal structural components and steam. Assessments of the level of "in-vessel" hydrogen production were developed in support of the NUREG-1150 quantification (Reference 127) and for the Severe Accident Scaling Methodology (SASM) program. These assessments relied on a wide variety of analytical and experimental sources of information applicable to PWRs. Based on these assessments the maximum median expected level of "in-vessel" hydrogen generation is less than that due to oxidation of 70% of the zircaloy mass. The zircaloy mass oxidation will likely depend on the details of the severe accident scenario with higher pressure sequences being limited to lower zircaloy oxidation typically due to the shorter residence time between core uncovery and vessel failure and the limited availability of steam. These assessments and additional supporting information regarding "in-vessel" zircaloy oxidation issues are discussed below.

SASM Review of the Station Blackout Sequence Recent assessments of zircaloy oxidation during the early stages of a severe accident progression have been established for NUREG-1150, Reference plants using RELAP/SCDAP and MELCOR/ TRAC (Appendix G to Reference 179). Based on these investigations, Reference 179 concluded that for high pressure accident sequences, the degree of zircaloy oxidation will be in the vicinity of 50% of the available zircaloy mass. Accidents where core uncovery occurs at low pressure were observed to result in oxidation levels on the order of 60%. The higher oxidation levels occurring at lower q pressures is a combined effect of the increased steaming potential associated with the passive Q discharge of the SITS, and larger lower head failure times due to reduced pressure loading on the lower head.

Assessment of flydrogen Production for NUREG-1150 Reference PWRs Reference 136 summarized "in-vessel" hydrogen production assessments for Reference plant PWRs obtained using the MARCII computer code. For the Zion PWR the "in vessel" metal water reaction (MWR) was estimated to be in the range of 47 to 52 % of the active cladding for small LOCAs and SBOs. Results for Surry were similar to that of Zion, with the indicated "in vessel" oxidation of about 50%.

Review of "In-Vessel" Zircaloy Oxidation During Severt Accident Simulations and the TMI-2 event Cronenberg (References 187 and 188) provided a comprehensive review of the "in-vessel" hydrogen generation (zircaloy oxidation) issue based on observations from USNRC funded experiments and ,

findings of TMI-2. The thrust of this effort was primarily to demonstrate that the occurrence of core blockages will not impede continued zircaloy oxidation of fuel. The review included an assessment of the LOFT FP-2 experiment, as well as related severe core melt progression experiments conducted within the smaller scale ACRR, NRU FLIIT and PBF programs. Results of these studies are sununarized in Table 19.11.4.1.3-1. These results indicate that oxidation levels during severe accidents will be limir Ae availability of steam rather than physical blelages introduced by the melting process. Large e severe accident experimental data suggest that approximately 50% of Q

O the core will be oxidized in severe accident scenario.

D

~ Appresed Design Meterket Probabnisbic Risk Assessment Page 19.1157

System 80+ Design ControlDocument  !

System 80 + Predicted "In Vessel" Ilydrogen Production In order to establish a bounding estimate of "in-vessel" hydrogen produced for the various System 80+ PDS's a scoping set of MAAP analyses were performed for representative transients spanning the range of interest for transients with either IRWST or in containment steam releases. To ensure a bounding hydrogen estimate was established the baseline case assumed the following:

1. Two sided clad oxidation was assumed after fuel rupture (FAOX=2)

2. Core blockage does not limit hydrogen production (FCRBLK=0: Blockage Model Turned Off)

3. Time to vessel failure after corium contacts lower head was set equal to 10 minutes (TTRX =

600 seconds)

Results of this study are presented in Table 19.11.4.1.3-2.

19.11.4.1.3.1.2.1.2 Hydrogen Production During IIPME An HPME event may provide an efficient mechanism for unoxidized metals within the corium to mix with the cavity water or RCS steam and produce hydrogen. Hydrogen production during the HPME will be rapid and can be quite large. Results of IET tests (Reference 189 and 190) performed to estimate DCII loadings on the containment show that provided the discharge is not steam limited, the HPME and post-IIPME process will oxidize most of the molten metals ejected from the RCS.

19.11.4.1.3.1.2.1.3 Hydrogen Mixing witida Containment O

The transport and mixing of hydrogen inside containment are critical in determining the time and nature of hydrogen combustion. Rapid mixing could result in uniform distribution of hydrogen and burns that are global in nature. Slow mixing may lead to localized burning and locally detonable mixtures. The physical processes which govern the mixing in gaseous mixtures are forced convection, natural convection and diffusion. The mixing processes are affected by the rate and amount of hydrogen released into the containment and the operability of the containment heat removal systems, such as containment sprays.

Containment design is also imponant in establishing the potential for the development of localized high hydrogen concentrations. For typical large dry containments, the concentration variation of hydrogen throughout the containment is less than 3% (see Section 19.11.4.1.3.1.3). Should isolated contaimnent regions exist, the localized hydrogen concentration could be quite high. System 80+ has been configured to promote natural circulation throughout the containment and minimize localized hydrogen accumulations by providing high point venting for all partial enclosures. Consequently, hydrogen concentration gradients within the containment are expected to be small. For additional details refer to Appendix 19.llK Local Hydrogen concentrations within the IRWST can temporarily exceed 10% by volume hydrogen.

Ilowever, this condition arises when the IRWST is saturated with water vapor and depleted of oxygen making the local environment inert to detonations.

O Anaroved Desipus Material Probabikstic flish Assessment Page 19.1158

System 80+ Design ControlDocument 19.11.4.1.3.1.2.1.4 Igniters Operator activated igniters are included in the System 80+ design package so that in the unlikely ,

event of a severe accident, the plant staff can burn off accumulated hydrogen in a controlled manner and at low hydrogen concentrations. Once igniters induce a hydrogen burn, that amount of hydrogen i

is no longer available to contribute to a large global burn, and hence the overall containment threat will be reduced. Igniter systems have been adopted by existing ice-condenser type PWR and BWR Mark III designs as a mechanism to mitigate containment threats due to hydrogen combustion

. (Reference 134). The intent of the igniter system for System 80+ is to guarantee that the uniform containment hydrogen concentration will be limited to no greater than 10 volume percent. A detailed discussion of the System 80+ igniter system is presented in Appendix 19.11K.

19.11.4.1.3.1.2.2 Presence of Inestents

- Inenents (such as nitrogen and steam) in the containment atmosphere reduce the concentrations of the  ;

active combustion components and mitigate both the potential for and severity of a hydrogen burn.

Of particular interest to hydrogen combustion is the availability of steam in the atmosphere.

Experimental investigations on small scale facilities (see also Section 19.11.4.1.3.1.3) demonstrate that steam concentrations greater than about 56 v/o can effectively inert the containment and prevent combustion. The presence of an inen containment atmosphere early in an accident can be expected only for those severe accidents involving direct discharge of the RCS inventory to the containment without first passing through the IRWST at a time when containment sprays are unavailable. Under all other conditions, hydrogen combustion will be possible provided a sufficiently large concentration of hydrogen is available in the containment atmosphere.

19.11.4.1.3.1.2.3 Availability of Oxygen The System 80+ PWR is designed to operate under standard atmospheric conditions. Thus, oxygen will be available for combustion.

19.11.4.1.3.1.3 Summary of Experimental Evidence Considerable experimental work has been performed to understand the hydrogen mixing, and combustion processes. This survey provides only the most peninent highlights of these efforts. A detailed summary of experimentation related to hydrogen mixing and combustion is presented in Appendix 19.11K.

19.11.4.1.3.1.3.1 Hydrogen Mixing Experiments An experimental study of hydrogen mixing and distribution has been performed at the Hanford Engineering Development Laboratory (HEDL) (Reference 117). A 20-m high,7.6-m diameter vessel was used to simulate the lower companment region of an ice-condenser cc~-bent under two different hydrogen-steam (or helium-steam) release conditions. Release locations were modeled to simulate hydrogen release from a postulated small pipe break or a pressurizer relief tank rt>pture disc.

The results of the tests show that:

1, the companment was well mixed during the source release period with maximum helium or p

\j hydrogen concentration differences of about 3 volume percent between points in the test compartment volume.

Ainproveet Design nieteriet Probab&serc Misk Assnsmont Pope 19.11-59

System l'O + Design ControlDocument

2. gas entrainment caused by the high velocity jet was the dominant mixing process for the test compartment during the jet release period.

3. the test compartment was well mixed by natural convection after termination of the source gas for all cases.

4. the degree of mixing was not strongly dependent on source jet release orientation.

Additional limited scope hydrogen mixing tests were performed for a small scale mockup of a large dry containment at CEA in France using a helium-steam mixture (Reference 135). The results of these experiments were similar to that found by HEDL. In particular, natural convection was sufficient to mix the containment atmosphere to within 3 volume percent.

19.11.4.1.3.1.3.2 Ilydrogen Combustion Experiments There have been numerous experimental programs on hydrogen combustion performed in test volumes ranging in size from 0.017 to 2100 m 3 The large-scale simulation of accident environment was performed at DOE's Nevada Test Site (NTS) (Reference 117). The hydrogen combustion tests at 3

NTS were conducted in a 16-m (52-ft) diameter spherical vessel whose internal volume was 2100 m (74,000 ft3).

The NTS vessel is about two orders of magnitude larger than that used in other, small-scale, experiments. One of the objectives of the NTS tests was to study hydrogen combustion behavior under simulated accident conditions in a reactor containment. Two types of tests were performed:

1. Premixed tests for simulating single burns which may occur in large open areas of a O

containment such as in a PWR dry containment.

2. Continuous injection tests for simulating continuous or intermittent hydrogen burning which may occur in containments with igniters.

The premixed tests were performed with hydrogen concentrations ranging from 5 to 13% and steam concentrations ranging from 5 to 40%. These conditions span the range of non-inerted hydrogen combustion conditions expected within the System 80+ containment. In the continuous injection tests, hydrogen flow rates were between 1 and 8 lbm/ min and steam flow rates between 0 and 62 lbm/ min. In some tests, fans and sprays were operated to simulate the plant emergency systems.

Theresults applicable to hydrogen burn phenomena in reactor containments as sununarized in Reference 117 are:

1. Primary combustion parameters, i.e., gas temperature, pressure, heat fluxes and burn fractions, increase with increasing hydrogen concentration.

1

2. Steam acts as a diluent and reduces gas temperature and pressure excursions.

3. Increasing the steam fraction in the continuous injection tests tends to inhibit combustion, resulting in a shoner burn time, smaller burn fraction and lower pressure rise.

4. Operation of fans and sprays enhances turbulence and promotes faster burn.

Approved Design Atatorial- hobabaistic Risk Assessment Page 19.11-60

l System 80+ Design c ntwt Document l

5. Spray operation results in lower peak pressure rise at the end of the combustion period. This (Vn) is due to quenching of the gas and removal of steam by condensation.

NTS experiments did not include assessments of complete steam inerting. However, smaller scale experiments such as those discussed in Reference 136 clearly demonstrate steam inerting with steam environment concentrations in excess of 56%.

19.11.4.1.3.1.3.3 Igniters Effectiveness Experiments The use of deliberate ignition strategies for controlling hydrogen in post-accident PWRs was investigated in the early 1980's. The emphases of these tests were to (1) determine if lean mixtures of hydrogen can be reliably ignited. (2) establish what pressures are generated by deliberate ignition and (3) ascertain the effects on equipment and instrumentation caused by the temperature and pressure induced by the deliberate burn. An overview of the igniter test programs is provided below. An expanded discussion of this topic can be found in Appendix 19.llK.

19.11.4.1.3.1.3.3.1 Small Scale Experiments Several small scale test programs have been carried out to support the feasibility of deliberate ignition as a hydrogen control strategy. These tests included experiments performed by Livermore (LLNL),

Sandia, Fenwall and the U.S. Bureau of Mines, AECL-Whiteshell, EPRI-ACUREX (See References 133,137, and 143). The results of these experiments indicated that ignition can be initiated at about 4% hydrogen concentration when the mixture is agitated, as by a fan cooler. Under quiescent conditions, hydrogen burns require hydrogen mole fractions closer to 8%. In addition, these tests

~]

(V noted that hydrogen burns at low concentrations were inefficient. As the hydrogen concentration increased to about 9% nearly complete combustion of available hydrogen was observed.

19.11.4.1.3.1.3.3.2 FITS Experiments (Reference 162)

Hydrogen combustion experiments were performed at the Sandia FITS facility. The purpose of these tests was to clearly define the combustion boundaries for a hydrogen-steam-air mixture in both quiescent and turbulent environments. These tests indicated that increasing the partial pressure of steam acts to reduce the pressure increase resulting from the burn. Specifically, the maximum pressure was observed to be between 40 and 90% of the AICC calculated maximum pressure values for steam concentration in excess of 40% by volume (v/o). Furthermore, for deflagrations of hydrogen concentrations below 10% by volume the actual pressure was typically less than 50% of the AICC calculated value.

19.11.4.1.3.1.3.3.3 NTS Experiments The effect of location on glow plug igniter performance was investigated under large scale conditions in the Nevada Test Site (NTS) tests. Igniters at four locations were examined: top, bottom, center, and test vessel equator. For the continuous injection tests, hydrogen and steam were released at locations about 6 to 8 ft. above the bottom center of the test vessel. The test results showed that:

1. Glow plugs could ignite mixmres down to 5.3% by volume hydrogen and 4.2% by volume l steam during quiescent, bottom ignition in premixed combustion tests. Top ignition location was less effective than lower ignition locations. Flame quenching on the vessel dome could

("}

inhibit flame propagation.

Approved Design Material. Probabmstic Risk Assessmerrt (11/96) Page 19.11-61

Sy~ tem 80+ Design ControlDocument

2. During the continuous injection tests, the "best" igniter location appeared to be in non-stagnant regions above the hydrogen release point.

3. During the continuous injection tests, the turbulence promoted by fans and sprays caused hydrogen to be dispersed throughout the entire test vessel. Therefore, the time of ignition was delayed when the preactivated igniter was located in the upper portion of the vessel.

19.11.4.1.3.1.4 Significance of Early IIydrogen Burn to System 80+

19.11.4.1.3.1.4.1 Deterndnistic Evaluation of Peak Containment Pressure Following a Ilydrogen Burn Reference 7 contains a set of design requirements for ALWRs which are designed to limit the threat to containment integrity from a post-severe accident hydrogen combustion event. The ALWR hydrogen control guidance initially required ensuring that ".. the hydrogen gas concentration in l containment does not exceed 13% under dry conditions for an amount of hydrogen equivalent to that generated by oxidation of 75% of the active fuel cladding surrounding the active fuel." In a later revision to this guideline the hydrogen gas concentration requirement was reduced to 10% and the equivalent oxidation level was increased to 100% of active fuel clad. In the current System 80+

design, without the use of igniters, the containment is sufficiently large so that oxidation of 75% of l the active fuel clad will result in a maximum uniform hydrogen concentration about 10% by volume.

System 80+ includes 56,655 lbm of zirconium in the active core. The corresponding oxidation of 100% active fuel clad equivalent will result in a maximum global average hydrogen concentration of l about 13.13% by volume in dry air. With igniters operational, the hydrogen concentration in containment will be well below 10 percent.

The significance of early hydrogen burns on System 80+ is evaluated deterministically in accordance l with the guidance of SECY-90-016 and SECY-93-087 (References 114 and 116). Specifically, an l analysis has been performed for the System 80+ design assuming a hydrogen burn based on the complete combustion of hydrogen produced by oxidizing 58,500 lbm of the System 80+ active l zircaloy cladding material. This corresponds to greater than 100% oxidation of the active fuel cladding in the System 80+ core. A consistent set of containment hydrogen challenges were considered by incrementally adding steam to the containment atmosphere and the resultant mixture was assumed to undergo adiabatic isochoric complete combustion (AICC) (See Appendix 19.llE for a description of the burn model). The post-burn containment pressure trajectory as a function of steam concentration is presented in Figure 19.11.4.1.3-1. In these analyses at steam concentrations greater than about 45%, the hydrogen / steam / air mixture was below the flammability limit. These analyses predicted that the most probable post-burn pressure would be about 99 psia, with the maximum possible pressure below 102 psia. Artificially extending the calculation beyond the flammability limit l to the 54% steam concentration (universal steam inerting concentration), the maximum burn pressure, j assuming AICC, would be 109 psia.

l It should be noted that burns occurring below 8% by volume hydrogen will be incomplete.

Furthennore, combustion of hydrogen outside the flammability region is not probable. The conservatism associated with the application of the AICC methodology was established by comparing normalized burn pressure rises predicted using the Appendix 19.11E methodology and results of various hydrogen burn experiments (See Figure 19.llE-1).

Based on the bounding results of the deterministic evaluation of the containment hydrogen threat complete combustion of the hydrogen produced due to 100% oxidation of the zircaloy cladding in the Approved Design Matertaf. ProbabHistic Risk Assessment (11/96) Page 19.11-62

l System 80 + Design ControlDocument \

i active fuel region will result in a peak containment pressure of less than 103 psia. This value is

\

below ASME Service Level C limits of about 140 psia and is well below the containment ultimate failure pressure of 168 psia (See Section 19.11.3.1).

It should further be noted that the above demonstration ignores the availability of igniters. When )

igniters are considered, the hydrogen combustion contribution to containment pressure loading will be smalli 19.11.4.1.3.1.4.2 Mixing within the System 80+ Containment -

The impact of nonhomogeneous hydrogen distributions were established for the ALWR in Reference 149. ' In this analysis a nodal representation of the ALWR containment was subjected to a forced

?

hydrogen production representing an equivalent 75% clad oxidation during a Station Blackout (SBO).

l ;

This analysis indicated that the vented IRWST hydrogen concentrations are only 2% by volume greater than the overall containment concentrations. These results are consistent with predictions of

_ System 80+ mixing analyses presented in Appendix 19.11K.

I - System 80+ has been designed to facilitate a chimney type natural circulation flow pattern between the steam generator housing " riser" and the containment region outside of the crane wall

("downcomer"), between each floor. This flow pattern promotes containment mixing and will minimize containment concentration gradients.

1 1

19.11.4.1.3.1.5 Application to the PRA in order to establish the probability of a hydrogen deflagration induced containment failure associated with various Plant Damage States (PDSs), the AICC model (Appendix 19.11E) was used. The l quantification of the hydrogen containment threat in the PRA is based on best estimate assessments I I

with regard to hydrogen availability and ignition conditions at or prior to vessel breach.

1. Hydrogen Generation Based on Section 19.11 4.1.3.1.2.1.1 it is assumed that hydrogen production within th: RCS will be as follows:

- For all scenarios where the PDS results in a high or medium pressure sequence the ,

s maximum hydrogen production within the vessel prior to VB is bounded by that l hydrogen which would be produced by 75% oxidation of the active cladding (See  !

Table 19.11.4.1.3-2).

- For PDSs that are initially at low pressure, or high pressure sequences which depressurize to below the -- SIT setpoint prior to VB, the maximum hydrogen production within the RCS is bounded by the equivalent of 100% oxidation of the active cladding.

- High and medium pressure melt ejection events are considered to increase the potential post-VB carly containment hydrogen production to a level equal to 100% of the oxidation of the active cladding.

O The selection of these values should conservatively bound expected hydrogen production rates prior to vessel breach.

Awowed w aneww noensmaemek Ammmer is tiss> rose ts.s1-s2 e 47- *- ,-,, -, y -- .,_.w

Sy~ tem 80 + Design ControlDocument This approach is generally consistent with the NRC position expressed in the Draft Final Safety Evaluation Report on the EPRI URD which states that, "a 75 percent-equivalent cladding reaction ... is a reasonable design basis for hydrogen generation for severe accidents in which the reactor pressure vessel remains intact."

It should also be noted that ISLOCAs and SGTRs that could potentially lead to core damage will not release significant quantities of hydrogen into containment and therefore do not have the potential to develop a containment threatening hydrogen burn upon vessel breach.

2. Hydrogen Burns Prior to VB / Igniter Actuation Hydrog- burns prior to vessel breach are only considered if igniter actuation has been credited. Igniters are expected to burn off hydrogen once a hydrogen concentration of 5 to 7 v/o is achieved. Thus, if hydrogen igniters are actuated and function properly, no containment threatening hydrogen burn can occur.

The operator is instructed to actuate igniters for transients with sustained core uncovery.

Igniter burns should produce pressure spikes less than that associated with a 50% core wide oxidation. As discussed below, burns at this hydrogen level pose a negligible containment threat. l

3. Post-VB Hydrogen Bura Pressures l

Post-VB hydrogen burn containment pressures depend upon the following factors: l l

1. RCS steam discharge path prior to VB l

2. IRWST subcooling

3. Availability of Containment Heat Removal Prior to Burn For transients that discharge steam into the IRWST, or if the RCS inventory is discharged directly into the containment and the containment heat removal (CHR) is partially functionirg (at least one containment spray pump and an associated heat exchanger), the hydrogen burn wid be aomed to be initiated f om the maximum flammability limit (See Figure 19.11.4.1.3-1). This results in ini'ial pressures between 30 and 40 psia.

Transients that result in significant steam nr, charge into the containment without availability of CHR will be assumed to have an inert hydrogen mixture and will not burn within the early hydrogen burn event. Instead this hydrogen is allowed to accumulate in containment for potential ignition along with additional hydrogen sources during the late hydrogen burn scenario.

19.11.4.1.3.2 Ilydrogen Detonation 19.11.4.1.3.2.1 Description of Phenomena  !

Detonations a'e combustion waves in which heating of the unburned gases is caused by compression '

from shock waves. The pressure loads developed during detonations are essentially dynamic loads (impulses) and can result in very short duration and localized pressure spikes many times greater than that of a deflagration initiated from similar conditions. As a result of these large loadings, Approwcf Design Matenet Probabbste Risk Assessment (11/96) Page 19.11-64

~

l 4

Sy tem 80+ Design ControlDocument (a'") detonations, if they should occur, may potentially pose. a threat to containment integrity and to the contin, ' operation of mitigative equipment.

19.11.4.1.3.2.2 Parameters Affecting Hydrogen Detonation Two classes of hydrogen detonations are typically distinguished: (a) detonation via direct initiation by high explosives and (b) Deflagration-to-Detonation Transition (DDT) resulting from an energetic burn in a confined obstructed geometry. Hydrogen detonations are influenced by (1) hydrogen concentration, (2) presence of inertents, (3) the ignition source and (4) system geometry (scale and configuration).

19.11.4.1.3.2.2.1 Ilydrogen Concentration Experimental evidence has indicated that under favorable geometrical conditions a hydrogen detonation in dry air is possible at values of hydrogen concentration as low as 9.5 v/o. Detonations actually produced at these low hydrogen concentrations require a hot, dry mixture and the use of explosive charges (See Reference 132). Based on this observation, the National Research Council reached the conclusion that mixtures of 9 to 11 v/o hydrogen might be detonable. In practice l detonations at this low hydrogen concentration are not considered credible in a post severe accident ,

LWR environment. Even at hydrogen concentrations of 13% by volume a substantial energy source l would be required to directly initiate a detonation (See Section 19.11.4.1.3.1.2.2).

Another mechanism for producing a detonation involves flame acceleration. Flame acceleration l l

p)

(

occurs due to turbulence induced by fans, structural roughness, obstacles, or changes in geometry.

Flame acceleration is only important for mixtures that can be classified as highly flammable. Flame  ;

acceleration which results in sonic propagation of a detonation front undergoes a deflagration to i detonation transition (DDT) and requires concentrations greater than 12% in dry air. The lowest  !

I concentration for which DDT has been observed is 15% (See Reference 138), and even then only in dry air and with ideal geometric conditions.

19.11.4.1.3.2.2.2 Ignition Source Direct initiation detonation of lean hydrogen mixtures (below 13 v/o) in an open containment would require a trigger of more than 10 MJ (See Figure 19.11.4.1.3-2). In contrast the energy required to l initiate a deflagration is more than 10 orders of magnitude lower than that for detonation. Therefore.

withcut an appropriate energy source hydrogen detonations are not possible.

19.11.4.1.3.2.2.3 Steam Inerting of Containment The presence of steam in the containment atmosphere can decrease the potential for, and severity of a hydrogen detonation. Experiments performed to date suggest that volumetric steam concentrations greater than about 30% will render even a stoichiometric mixture of hydrogen and oxygen in a non-detonatable state.

19.11.4.1.3.2.2.4 Geometry 1

Geometrical features can have an important influence on the potential for hydrogen detonation. In i

(_') hydrogen mixtures which spontaneously undergo DDT, the ability of the system to detonate is )

kJ dependent on the level of confinement and presence of obstacles. Typically, open geometries are not  ;

l l

l Approved Design hteterW .11obabbstic Risk Assessment (2/95) Page 19.11-65 I

i

System 80+ Design ControlDocument favorable for the onset of detonation. Favorable geometries (such as confined areas containing obstructions with limited venting) can promote detonation.

19.11.4.1.3.2.3 Summary of Experimental Evidence Numerous studies have been performed to investigate the parameters affecting hydrogen detonation.

19.11.4.1.3.2.3.1 Small Scale Ilydrogen Detonation Experiments Small scale hydrogen detonation experiments include tests conducted by Atomics International (Al, see Reference 137), and tests performed by Sandia at the MINIFLAME facility (Reference 136). The AI tests investigated detonations in a 40 ft long,1.25 ft diameter shock tube filled with various mixtures of hydrogen and air. ' water spray was also included in the test facility in order to assess the impact of containment spray. Without sprays available detonation was observed at H2 levels of about 20%. Use of a water spray delayed the onset of detonation and decreased the efficiency of the detonation process.

The MINIFLAME facility is a 1:12.6 scale model of the FLAME facility (see below). These tests were limited in scope and studied the detonation potential of hydrogen-air mixtures containing 20 and 30% hydrogen mole fractions. Qualitatively, the MINIFLAME test results were similar to that of FLAME with the exception that at the smaller scale DDT was not observed during the 20% hydrogen test series.

19.11.4.1.3.2.3.2 FLAME Experiments The FLAME (Flame Acceleration Measurements and Experiments) Facility was designed and constructed for the USNRC to study hydrogen combustion problems associated with accelerated flames transition to detonation and combustion in simulated containment geometries. The facility is a large rectangular channel 30.5 m in length. The experiments specifically investigated several effects that have been observed to be important to hydrogen detonation in small scale tests; hydrogen concentration, obstacles in the path of the combustion front and the degree of transverse venting.

FLAME tests studied hydrogen concentrations between 12 and 30 v/o (near stoichiometric conditions).

The conclusions form the FLAME tests were as follows (See Reference 138):

1. The reactivity of the mixture as determined by the hydrogen concentration is the most important variable governing DDT. For very lean mixtures no significant flame acceleration and no transition to detonation was observed. The lowest hydrogen concentration found to result in a DDT occurred at 15% in a test with obstacles present and no transverse venting.

2. The presence of obstacles in the path of the flame front greatly increases flame speeds and overpressures. In fact, FLAME tests without obstacles did not result in DDT for hydrogen mixtures up to near stoichiometric conditions.

3. Large degrees of transverse venting reduce flame speeds and overpressures.

DDT results from the FLAME facility have been used by Shennan and Berman (Reference 139) to develop a qualitative risk ranking scheme for estimating the likelihood of a detonation in containment during a severe accident. This work was applied to the Bellefonte nuclear power plant with a large dry containment (Reference 139) and was used in the NUREG-ll50 analysis of Sequoyah (ice Approved Design Atatenal . Probabastic Itish Assessment (11/96) Page 19.11-66

l l

l System 80+ Deslan contra cocument

( condenser PWR). The application of this ranking scheme to the System 80+ is discussed in Section V 19.11.4.1.3.1.4.1.

19.11.4.1.3.2.3.3 BMFT DDT Experiments (Reference 140)

This experimental effort involved a three test series with a total of 30 tests. The primary objective of these tests was to determine the influence of steam on DDT.

The hydrogen and steam concentrations in the experiments varied from 14 to 35 v/o and 0.4 v/o to 33 v/o. respectively. Of the thirty combustion experiments only 5 were cbserved to undergo DDT. The lowest hydrogen concentration DDT observed was 18 v/o in a 1.2 v/o steam environment. As steam concentrations increased the hydrogen concentration at the onset of DDT also increased. No DDT was observed as the steam presence in the mixture increased to 30 v/o steam.

19.11.4.1.3.2.4 Significance of Hydrogen Detonation to System 80+

The potential for a direct hydrogen detonation, or a deflagration to detonation transition in the System 80+ is discussed in this section.

19.11.4.1.3.2.4.1 System 80+ Ranking of Deflagration to Detonation Transition Potential The System 80+ containment consists of a large dry containment with an In-Containment Refueling Water Storage Tank. The detonation potential for this containment configuration has been evaluated e in a semi-quantitative fashion using the Sherman / Berman DDT detonation Ranking Scheme (see i Reference 139). This procedure is based on the assumption that the likelihood of DDT can be expressed as a function of two variables; one based on the reactivity of the mixture, and a second based on the flame acceleration potential of the volume through which the flame propagates, The mixture reactivity or intrinsic flammability is based on the detonation cell width, which is related to the hydrogen concentration. The flame acceleration potential is based on the containment internal configuration. For System 80+, this ranking was performed without consideration of the HMS. If igniters are considered, the mixture reactivity will be controlled to sufficiently low levels so as to preclude a detonable mixture.

The classification procedure for the System 80+ design is a three step process. In the first step intrinsic flammability is classified for various containment regions by classifying their maximum expected hydrogen concentrations according to the Sherman / Berman criteria (see Table 19.11.4.1.3-4). In the second step the geometrical features of the various regions are compared against the Sherman / Bennan geometric classifications (See Table 19.11.4.1.3-5). In the last step of the process, the intrinsic flammability ranking and the geometric class rankings are combined to obtain a DDT likelihood ranking from Table 19.11.4.1.3-6. Application of this methodology to System 80+ suggests that for hydrogen concentrations typical of early severe accident containment failure scenarios, local hydrogen concentrations would be below 15 v/o even accounting for hydrogen stratification. (Note that at 100% active clad zirconium oxidation, the global hydrogen concentration in a dry atmosphere will be below 13% by volume and the expected local maximum hydrogen concentration would be below 15 v/o.) That would rank the hydrogen mixture as either class 4 (DDT possible but not observed) or class 5 mixtures (unlikely to undergo DDT). (Lower rankings of mixture class were possible under certain circumstances for the IRWST however, these conditions O

V were associated with high steam content and the mixture was considered inert to detonation 3 A similar ranking of containment geometric features show the containment to contain either class 3,'4 or 5 configurations. Geometric class 3 structures (which were most conducive to DDT) were limited to Annrewed Deeipo neesernet. Probabnesic Meh Assesw~ -I Page 19.11-67

l l

Design ControlDocument fyatem 80+

the steam generator enclosures. Ceometric class 4 structures were associated with the reactor cavity, letdown and regenerative heat exchanger rooms, HVAC header and the IRWST. Such geometries are unfavorable to DDT. Mapping the flammability and geometric classifications on the Table 19.11.4.1.3-6 matrix indicates that the System 80+ containment to be primarily a class 5 containment. This classification implies that the potential for a DDT is highly unlikely to impossible.

For selected accident sequences with significant hydrogen discharges to the IRWST the local mixture classification within the IRWST may formally increase, producing an overall resultant class 4 detonation ranking. This would imply that in a dry atmosphere these mixtures can potentially detonate, but the process is unlikely. The presence of modest amounts of steam expected in the IRWST would likely render the mixture inert to detonation. Since the IRWST is expected to be steam inerted (and oxygen starved), this ranking is likely overly pessimistic, and the mixture is closer to a class 5 system.

It should be noted that the Sherman / Berman Ranking Scheme was developed for dry air-hydrogen mixtures. The addition of steam has a profound effect on the detonation potential. Even small amounts of steam (on the order of 1 volume percent) will be sufficient to increase the minimum l detonatable hydrogen concentration to above 15 v/o. Furthermore, above 30% by volume steam concentrations, hydrogen mixtures will be inert to detonations. These features are also not fully considered in the current ranking procedure.

19.11.4.1.3.2.4.2 Direct Detonation ofIlydrogen Within the System 80+ Containment A second source of hydrogen detonation can arise from direct ignition of a flammable mixture.

Direct ignition detonation typically requires an explosive charge within a highly flammable containment atmosphere. Reference 132 compared the energy required for a detonation with ignition sources typically available in PWR containments. This figure is reproduced as Figure 19.11.4.1.3-2.

From this figure it can be clearly seen that containment ignition sources have energies which are more than three orders of magnitude lower than that necessary to detonate a 13 v/o dry hydrogen mixture in an unconfined geometry. On the other hand all ignition sources (even those of 10 orders of magnitude lower strength) are sufficient to cause a deflagration.

Based on the above work and supporting analyses presented in Reference 137, the possibility of detonation within the System 80+ containment is considered remote. Direct initiation of a hydrogen detonation would be improbable within the System 80+ containment while initiation of a deflagration during a severe accident is virtually certain. Similarly, an assessment of the intrinsic flammability and geometric features of the System 80+ containment indicates the potential for DDT is highly unlikely to impossible.

19.11.4.1.3.2.4.3 Role of Ilydrogen Mitigation System For severe accident application, the purpose of the hydrogen igniter is to respond to NRC concerns (References 114 and 116) with regard to hydrogen control during a severe accident. Specifically, the installation of hydrogen igniters is intended to satisfy 10CFR50.34(f)(2)(ix) " Additional TMI-Related Requirements". This rule requires "a hydrogen control system that can safely accommodate hydrogen generated by the equivalent of a 100 percent fuel-clad metal water reaction. The system must also ensure that uniformly distributed hydrogen concentrations in the containment do not exceed 10 percent by volume . . ." A detailed description of the hydrogen igniter system can be found in Section 6.2.5 and in Appendix 19.llK. It is expected that the hydrogen risk due to detonation is negligible even without the presence of the HMS, as indicated via the Sherman / Berman Ranking assessment. The ApprovedDesign Material.Probabkstic Risk Assessment (11/96) Page 19.1168

System 80 + Design controlDocument n

(\> ) inchision of the HMS is explicitly directed at meeting the requirement that the containment atmosphere be controlled to below 10 volume percent hydrogen.

19.11.4.1.3.2.5 Application to the PRA As discussed above the potential for hydrogen detonation within the System 80+ containment is remote. This is particularly so when considering early containment failure process since oxidation processes associated with core concrete attack are not considered and the mixture class will be confined to class 5 conditions (See Section 19.11.4.2.3). In developing the PRA the hydrogen combustion events were quantified as follows:

Conditional probability that a hydrogen burn would either be initiated as or become a detonation are defined as follows:

• For accident scenarios where the steam concentration is expected to exceed 30 v/o, detonations are not considered credible. Because of the large steam release associated with the HPME, DCil events are not considered precursors to detonations.

• For hydrogen concentrations below 10 v/o in dry air, detonations within the containment are considered impossible. Thus, detonations are not expected for situations where igniters are functioning and early pre-vessel breach hydrogen burns occur in the containment.

• For conditions where the global hydrogen concentration is expected to be above 10 v/o in dry p air and steam concentrations are below 30 v/o steam (i.e containment heat removal is successful), the probability that a hydrogen burn becomes a detornation is considered to be C/ highly unlikely to impossible.

• For conditions where significant accumulation of hydrogen in the IRWST is expected and steam inerting cannot be guaranteed, the probability that a potentially containment threatening detonation occurs is considered unlikely. This is considered a conservative position since detonations in even minimally inerted or sprayed regions are not expected until hydrogen concentrations approach 20 volume percent.

It will be assumed in the PRA that the occurrence of a detonation will fail containment. This is also a very conservative position. While the ensuing pressure spike occurring following a detonation is very large compared to a deflagration pressure rise, the detonation spike is nonuniform and of very short duration (typically less than 10 ms) and consequently may not pose a threat to large structural components, and the containment stmeture. This is particularly true of the IRWST. While the outer walls of the IRWST is defined by the containment walls, the actual containment shell is separated from the water pool and sandwiched in between two layers of concrete each approximately six feet thick. When subjected to large detonation loadings, this arrangement may result in extensive cracking of the IRWST enveloping concrete, however, actual failure of the containment is not considered likely. Furthermore, any missiles generated during a hypothetical IRWST detonation will be intercepted by the crane wall and not pose a threat to the containment.

( I v

Appromt Design Matenal. Probabbstic hsk Assessment Page 19.11-69

Design ControlDocument Srtem 80+

19.11.4.1.4 Other Early Containment Failure Mechanisms 19.11.4.1.4.1 Direct Shell Attack via Corium Impingement 19.11.4.1.4.1.1 Description of the Phenomena This failure mechanism considers the containment failure potential resulting from a high pressure RV discharge of highly energetic corium debris interacting with the stainless steel containment shell.

Failure of the steel shell is assumed to be small and localized to the points of corium impingement.

19.11.4.1.4.1.2 Application to System 80+ Design The System 80+ containment has been designed to provide adequate protec: ion of the containment l steel plate from debris and/or missile attack. In the lower portion of the containment below the 92'-9" elevation. the steel shell is imbedded in a minimum of 3 ft of concrete (See Section 19.11.3.3).

' Above the lower compartment floor, the crane wall provides a 5 ft thick (minimum) concrete barrier separating the potential escaping core debris from the lower portions of the containment shell. The upper containment shell is partially protected from corium and RV generated missiles by the head area cable tray system (HACTS) located above the Reactor Vessel top head. HACTS is primarily designed to withstand a rod ejection event. This should provide some capability to serve as a shield for smaller particulate corium debris that may be generated following an HPME.

The remainder of the containment shell surface which is either not directly imbedded in concrete or separated via a missile shield is located in a small ponion of the upper containment elevation where missile generation is not expected and energetic missile contact is highly unlikely due to the large vertical distance the missile would have to travel. Even if the upper shell were unprotected, the corium debris will have insufficient kinetic energy to cause shell penetration. Scoping calculations for a large corium debris particle 6 inches in diameter released from the vessel at a 200 ft/ sec velocity l following an HPME will have a maximum kinetic energy at shell contact of under 2.5 x 10' ft-lbf.

This energy level is well below the approximate one million ft-lbf required for this size missile to penetrate the shell.

19.11.4.1.4.1.3 Application to the PRA The probability that corium debris could be ejected from the RV and reach the upper containment shell with sufficient energy to cause a localized containment failure was established via engineering judgement as follows:

1. For high pressure RV lower head failures, (RCSHIGH) the conditional probability of containment failure due to direct corium impingement was assumed to be very small.

2. For low and intermediate pressure RV lower head failures containment shell failure due to direct shell attack was not considered credible.

It should be noted that this failure mechanism does not include containment failure via combustion induced missile generation. This failure mechanism is included in the discussion of hydrogen detonation (See Section 19.11.4.1.3).

O Approsed Design Atatedal Probab&sbc frisk Assessment (11/961 Page 19.1170

Sv tem 80 + oesian controlooeumont T

19.11.4.1.4.2 Cavity Overpressure Failure 19.11.4.1.4.2.1 Description of the Phenomena Following a HPME, large quantities of steam and corium are discharged into the lower portion of the reactor cavity. This discharge can potentially challenge the integrity of the reactor cavity and thereby threaten containment integrity. Cavity overpressurization can potentially result in a structural failure I of the reactor cavity and associated RV supports. Failure of the RV supports can produce excessive .l motions in the RCS and steam generators potentially failing a containment penetration or producing an i unisolable breach in piping exiting the containment.

Potential sources of cavity overpressurization include the EVSE event and the energetic failure of the RV lower head. The EVSE induced failure of the cavity and or reactor internal supports is considered in Section 19.11.4.1.2. This section considers localized cavity pressurization induced by steam pressurization of the reactor cavity space immediately upon RV lower head failure.

19.11.4.1.4.2.2 Significance to System 80+

System 80+ is expected to withstand cavity pressurization events following RV lower head failure.  !

This capability of System 80+ arises from the robustness of the System 80+ reactor cavity design i which includes (1) a high reactor cavity wall strength and (2) a large reactor cavity volume. j The post severe accident cavity pressurization performance of the System 80+ design was evaluated analytically for a simulated high pressure superheated steam blowdown following a postulated breach in the RV lower head. Analyses were performed using the ABB-CE DDIF Mod 7 (Reference 141) cavity pressurization computer code. In this analysis a multi-compartment representation (see j Figure 19.11.4.1.4-1) was assembled to provide a detailed simulation of the reactor cavity.  !

Pressurizations were established using a spectrum of RV lower head failure sizes ranging from the i equivalent of a lower head instrument tube failure to a large creep failure of the RV lower head.  !

Results of these indicate System 80+ cavity loadings to be below 100 psid. j MAAP analyses for similar transients indicate that the cavity pressure rise associated with a best-estimate HPME event caused by a single ICI tube failure, will be under 20 psi. For either evaluation, i predicted loads are below the cavity wall design pressure values of approximately 188 psid (ultimate strength of 235 psid) arxl consequently will not challenge cavity or containment integrity. l 19.11.4.1.4.2.3 Application to the PRA f The cavity overpressurization induced containment failure is not considered a credible threat to containment integrity. However, for the purpose of completeness this failure mechanism has been  ;

included in the PRA supporting logic models with a very small probability.

19.11.4.1.4.3 Rocket Induced Containment Failure  ;

i 19.11.4.1.4.3.1 Description of Phenomena  !

i The issue of rocket induced containment failure was formally addressed in the Oconee Level 3 PRA performed by NSAC (Reference 217). In ti.is assessment, Battelle Columbus reviewed the potential l l for containment failure due to an in-containment reactor vessel " lift.off" following the failure of the  :

RV lower head. The rocket analogy resulted in the authors of Reference 217 identifying rocket l  ;

(2/95) Page ta.1171 Annrowed Dee&n aineeniel. NebebBreic $Nuk Asseesnoont

Srtem 80+ De~ign ControlDocument induced containment failure as the "Satum V" failure mode. While Battelle Columbus staff does not '

believe this failure mode to be credible, they could not discount the possible failure mode by way of analysis. However, a low conditional failure probability was assigned following a high pressure plant damage state (PDS).

Recently, the German evaluation of the rocket containment threat was performed as part of Phase B to the German Reactor Risk Study (Reference 130). The German assessment considered the failure mode of their RV integral lower head to be an instantaneous and complete circumferential failure at the height of the corium upper surface. This results in a RV lower head failure area of approximately 190 ft2. The RV loading due to this instantaneous failure was established using RELAP 5/ MOD 3 l calculations (Reference 205). The resulting impulsive loadings were considered sufficiently energetic l to propel the RV as a rocket into the wall of the upper containment with sufficient energy to cause a  !

localized containment failure. Specifically, the study concluded that at " internal pressures higher than 8 MPa (1160 psia) it can no longer be excluded that the containment will also be damaged" Based on the probabilities reponed in Reference 130 it appears that the conditional containment failure i probability associated with RV lower head failure at high pressure was small. j It is interesting to note that this failure mode was included in the German Risk Study whereas the alpha mode failure ("in-vessel" steam explosion induced failure of the containment) was considered incredible and therefore was not.

1 19.11.4.1.4.3.2 Methodology This Section Intentionally Blank.

19.11.4.1.4.3.3 Assessemnt of Rocket Induced Failure Processes This Section Intentionally Blank.

19.11.4.1.4.3.4 Quantification This Section Intentionally Blank.

19.11.4.1.4.3.5 Significance to System 80+

A review of the System 80+ reactor cavity and lower head design suggests that this failure mechanism is not viable for this plant design. This conclusion is based on the fact that (1) the RV lower head failure mode will be predominately governed by instrument tube failures or modest creep RV failures and (2) the likelihood of the RV depressurizing well below 1000 psia prior to VB was very high for transients with a cycling relief valve at the onset of core damage.

19.11.4.1.4.3.6 Application to the System 80+ PRA For completeness the rocket failure mode will be included in the supporting logic model for the System 80+ PRA.

O Approved Design Ataterial.Probabaistic Risk Assessment Page 19.1172

Syztem 80 + Design ControlDocument (v ) 19.11.4.1.4.4 Synergistic Issues Many early containment failure mechanisms are a result of several containment threatening processes occurring simultaneously. For the System 80+ PRA synergistic effects are typically considered under the umbrella of Direct Containment Heating (See Section 19.11.4.1.1).

Synergism between the hydrogen burn and steaming following VB can be established by estimating hydrogen burn pressures at the uppermost de-inerted steam pressure (see Section 19.11.4.1.3).

Missile threats to the containment are considered under the phenomenological source of the missile.

For example missiles generated by hydrogen burns / detonations, IVSE and EVSE are considered within their respective phenomenological section.

19.11.4.1.4.5 Loss of Containment Isolation Prior to Core Melt 19.11.4.1.4.5.1 Description of the Phenomena During power operation, the containment is required to be closed. However, in rare instances procedures may be violated or common cause valve failures may result in loss of containment isolation during plant operation. Severe accidents initiated from this condition progress in the presence of a compromised fmal fission product barrier and may release considerable quantities of fission products early into the environment.

p 19.11.4.1.4.5.2 Application to the System 80+ Design l LJ System 80+ is designed so that loss of containment isolation is highly unlikely. Preventive features in the System 80+ design to aid in maintaining containment isolation include:

1. use of double isolation valves for all containment penetrations,

2. use of diverse means of powering isolation valves, and

3. selection of isolation valve failure position consistent with its safety related function.

Detailed information on the Containment Isolation System may be found in Section 6.2.4.

In the unlikely event of a loss of containment isolation preceding a severe accident, steam released from the RCS will pressurize the containment and drive out some of the initial containment air early in the transient. This feature leads to an interesting feature of this event. If an early steam discharge is immediately followed by spray actuation and successful containment heat removal, the pressure within containment may actually go subatmospheric (by less than 1 psig) for a period of many hours, thus, minimizing the environmental releases to that release during the early steam / air discharge. As a result of this containment vacuum, the resulting radiation releases would be only marginally greater than releases from an intact containment. Hydrogen burns may be more likely during this scenario due to a low steam content in the containment and a smaller noncondensible gas content.

n 19.11.4.1.4.5.3 Application to the PRA l

/ \

i'

' ' ' Containment isolation failures are considered as early breaches of containment. In these transients, the containment will lose noncondensibles and steam (and airborne radionuclides) from the initiation Approved Design Materie!. hobabHistre Risk Assessment (11/96) Page 19.1173

Syctem 80 + Design ControlDocument of the containment transient. As a result of the hole in the containment, the containment pressurization will be low.

Three characteristic plant responses can be expected for this transient. First, without containment sprays, radionuclide releases will enter the environment with little scrubbing. In a second instance, the containment spray function is available without the heat rer4 oval function. In this scenario, all noble gases will be completely released to the environment ard iodine and cesium releases will be considerably scrubbed due to the scrubbing action of the containment sprays. In the final scenario, the full containment heat removal system (sprays and associated heat exchangers) functions. This last scenario is rather unique in its fission product release characteristic. Since noncondensibles are driven out of containment early in the severe accident (while radionuclide releases are relatively low),

the operation of containment heat removal using containment sprays will ultimately condense the containment steam. and cool the containment atmosphere. Since the containment has a smaller and cooler non condensible gas componet, a panial vacuum is created within the containment. This vacuum, while not indefinite, can retain fission products without any leakage into the environment for about 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> depending on the initial scenario (see also Section 19.11.5).

19.11.4.1.4.6 Containment Bypass 19.11.4.1.4.6.1 Description of the Phenomena NUREG-1150 (Reference 142) identified containment bypass as an imponant contributor to the large, early releases of radionuclides for the Zion and Surry PWRs. The principal contributors to these severe accidents are steam generator tube ruptures (SGTRs) with stuck open MSSVs or ADVs and interfacing-system LOCAs (ISLOCAs). Should these events progress into severe accidents, the radiation releases to the environment would be large and energetic and would pose a significant radiation exposure to the general public.

19.11.4.1.4.6.2 Significance to System 80+

19.11.4.1.4.6.2.1 ISLOCAs The core damage frequency associated with System 80+ intersystem LOCAs is estimated to be very small. The low probability of these events is associated with the fact that the System 80+ design incorporated much of the EPRI URD guidance in designing to limit ISLOCAs. In panicular, much of the connecting piping for the RCS has been designed to meet the ultimate rupture strength criteria required in SECY-90-016 and considerable piping that was previously routed outside of containment is now within the containment envelop. To further reduce the possibility of ISLOCA, interfaces between the RCS and connecting systems include, as appropriate, design features to leak test valves, indicate valve position and alarm high pressure in low pressure lines.

A detailed inv'estigation of the sources of ISLOCAs has been reponed to NRC in Reference 145.

This report investigated the source of potential ISLOCAs for the System 80+ which include:

• Safety injection System o Shutdown Cooling System o Chemical and Volume Control System Alpproved Design Matenal- Probatasuc Risk Assessment page 19.1g.y

System 80+ Design ControlDocument

• Process Sampling System 19.11.4.1.4.6.2 Steam Generator Tube Rupture -

A Steam Genmtor Tube Rupture (SGTR) can provide a significant pathway for radionuclide release from the RCS to the environment. In System 80+, considerable effon has been expended to both reduce the potential for and consequences of a steam generator tube rupture. Improvements to System E9+ to gevent and mitigate SGTRs include:

• Steam generator tubes made of thermally treated Inconel 690, which has favorable corrosion resistance propenies including superior resistance to primary and secondary stress corrosion cracking,

• A deaerator in the condensate /feedwater system for the removal of oxygen, t

• Condensate system with a full flow condensate polisher to remove dissolved and suspended impurities, -

• Main condenser with provisions for early detection of tube leaks, and segmented design permitting the repair of leaks while operating at reduced power,

• Lower operating temperature, which reduces the potential for stress corrosion cracking of the steam generator tubes,

• N-16 radiation monitors, one per SG, provide a quick indication that a SGTR has occurred.

1 The SGTR precursor to severe accidents can be quite imponant to public risk. While these transients ]

can potentially be very serious threats to the public. most SGTRs (including those resulting in severe core damage) will be such that environmental radiation releases will be small. This is due to (1) secondary water that is available to the SG secondary side will produce a favorable environment (cool and low steaming rate) within the primary side of the steam generator tubes for fission product ,

plateout, and (2) when the secondary side water level covers the broken tube elevation most iodine '

and cesium that leave the primary side will be " scrubbed out" in the secondary side water pool.

19.11.4.1.4.6.3 Application to the PRA l 19.11.4.1.4.6.3.1 ISLOCAs The dominant ISLOCA sequence involves the combined failure of check and isolation valves in the RilR line resulting in a catastrophic failure of this line outside of containment. This ISLOCA will typically deposit RCS inventory into a w;tenight area of the auxiliary building. Sufficient RCS inventory will be lost to the auxiliary building prior to substantial core damage so that the ISLOCA 4

break location will be covered by several feet of water. This water will serve to scrub fission product releases from the ruptured RHR pipe prior to entering the environment. The PRA assumes a decontamination factor consistent with the pool scrubbing correlations developed by Powers (Reference 197).

ANwonnf Des > A0eteriel.wmsic Misk Assessment Pope 19.r175

_ __ ._ _ __l

System 80+ Design ControlDocument 19.11.4.1.4.6.3.2 SGTR The PRA considers SGTRs due to both SGTR initiating events and thermally induced SGTRs. The consegmnces of SGTR events resulting from an initial SGTR are established based on details of the plant damage state (PDS) prior to core damage. Induced SGTRs can only occur when the RCS is at the CRV serpoint with the SG tubes uncovered and no water inventory in the steam generator.

Induced SGTR would represent a very small fraction of the PDSs and was therefore not explicitly considered in tw ' seline PRA.

19.11.4.2 L,- Sntainment Failure Late containment failure refers to those severe accident scenarios where containment failure occurs more than I hour after VB and more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after event initiation. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> definition of late containment failure is consistent with the deterministic containment integrity goal identified in the draft SER of the EPRI URD (Reference 161).

The deterministic long term containment performance goal recommended by the NRC is defined in References 114 and 116. The containment performance goal is directed at ensuring that the containment will maintain its role as a reliable, leak-tight barrier for approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following the onset of core damage. Furthermore, following this period, the containment should continue to provide a barrier against the uncontrolled release of fission products. This section discusses the ability of System 80+ to meet these NRC containment performance goals.

Four potential mechanisms for late containment failure are identified for System 80+. These cre:

1. Gradual Containment Overpressurization O

2. Basemat Melt-Through

3. Temperature Induced Penetration Seal Failure

4. Delayed Combustion These failure mechanisms, and their impact on containment performance and ' heir role in the System 80+ PRA are discussed in the following sections.

19.11.4.2.1 Gradual Overpressurization Without containment heat removal, the containment would fail by overpressurization due to the addition of steam and possibly noncondensable gases into the containment atmosphere. This pressurization process is typically gradual, taking two or more days to reach the containment ultimate failure pressure. While the containment failure is energetic, the relatively long time to containment breach allows considerable time for recovery actions, as well as providing time for fission product sources to decay and non-volatile fission product components to deposit themselves within the containment.

O Asyvoved Designs Material Probabikstic Rosh Assessment Page 19.1176

System 80+ Design ControlDocument O

'L) 19.11.4.2.1.1 Steam Overpressurization 19.11.4.2.1.1.1 Description of the Phenomena 19.11.4.2.1.1.1.1 Containment Failure Before Vessel Breach ,

This category of containment failure arises when the containment heat removal function is irrecoverably lost and cooling of the RCS with a breach (either due to pipe mpture or open SDS Valve) is facilitated. The probability of containment failure prior to VB is calculated to be negligible.

Scenario 1: Containment Failure with SDS Valve dischage into the IRWST This scenario consist: of an extended tota'. loss of feedwater event (TLOFW) where Feed and Bleed core heat removal is successful and containment heat removal is unavailable due to failure of containment spray heat exchangers. In this transient the SI pumps will inject IRWST inventory into the RCS and the RCS discharges steam generated in the cooling process into the IRWST. The outcome of the once-thru-core-cooling (OTCC) process is to maintain core temperatures at acceptable ,

levels so long as makeup inventory is available. Once the IRWST reaches saturation, steam produced in the IRWST will be discharged into and pressurize the containment. Without restoration of the containment heat removal function, the containment will fail and the IRWST liquid will flash, causing the Si pumps to cavitate. Without restoration of primary side inventory control, the core will slowly uncover and begin to melt. l Scenario 2: Containment Failure Following Primary Side Pipe Ruptures i

in this scenario a large RCS primary side pipe rupture occurs which allows the discharge of superheated and saturated steam directly into the containment. Core heat removal, if available, will typically involve steaming of the corium debris and pressurization of the containment. In this scenario however, the RCS discharge is deposited into the containment directly. Thus, the IRWST is only heated via the collection of condensed steam. This scenario will result in a containment damaging condition in advance of reaching saturation conditions in the IRWST. Thus, contairunent ,

depressurization is not expected to result in flashing of the IRWST water and therefore core' heat l removal will continue until the IRWST is depleted. j 19.11.4.2.1.1.1.2 Containment Failure Following Vessel Breach System 80+ employs a unique cavity design to trap corium debris in the reactor cavity (See Section 19.11.3.6) and a manually actuated cavity flooding system to arrest corium-concrete attack and cool the corium debris on the reactor cavity floor. The intent of these design features is to allow the  ;

reactor cavity to serve as a repository of most, if not all, the post-accident corium debris. As a i consequence of this core debris cooling process, steam will be generated, if active core heat removal systems (containment sprays) are unavailable, the steam addition will pressurize the containment to the point of failure.

1 19.11.4.2.1.1.2 Parameters Affectig Steam Overpressurization Steam overpressurization of the containment is influenced by the ability of the debris to produce

/4 steam and the ability of the containment active systems to condense steam. Analyses demonstrate that

\ availability of one train of the containment spray system will be suGicient e control containment pressure well below the ultimate pressure threshold.

44wenniDeskn Notoria! ProbabEnsic Mink Assessment Page 19.1177 j

System 80+ Design ControlDocument 19.11.4.2.1.1.3 Significance to the System 80+

System 80+ has been designed with a very flexible and reliable containment spray system.

This system includes an engineering safeguards containment spray system with the ability to interchange pumps and heat exchangers between the containment spray and shutdown cooling systems. Furthermore, in the event of loss of the engineering safeguard CS system, the System 80+

spray capability is backed up by an independent external system that is connected to the containment main spray headers. This system can be made operational in a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> time frame following the onset of core damage.

MAAP analyses confirm that maintenance of the containment spray heat removal function will prevent containment overpressure failure. Assuming minimal CCI occurs in the reactor cavity and best estimate model parameters, MAAP calculations for a representative sample of severe accident scenarios, predict that when containment heat removal is unavailable, System 80 + containment failure will not occur for more than two days following the onset of core melt (See Table 19.11.4.2.1-1 and Section 19.11.5). This long time to failure, even in the absence of heat removal is a consequence of several System 80+ design features. These include (1) the spherical shell containment design which provides a large free volume for condensable and non-condensable gas accumulation, (2) the presence of a large quantity of passive heat sinks (both steel and concrete) and (3) a CFS which is capable of circulating more than 500,000 gallons of initially subcooled water over the core debris. A detailed description of these transients can be found in Section 19.11.5.

19.11.4.2.1.1.4 Application to the PRA For purposes of the baseline System 80+ PRA, the containment overpressure transients initiated by a O

loss of containment heat removal were assumed to be irrecoverable and containment failure was considered to occur between 141 (ASME Level C) and F , psia based on 350*F steel shell temperature (see Section 19.11.3.1). The 350*F temperature limit was selected as being a l conservative upper bound of the steel shell temperature in this time frame for severe accident l transients with a " wet" cavity. Since all gradual overpressure transients require time frames of more I than I day prior to containment failure, recovery of many failed systems or actuation of alternate  !

cooling systems is highly likely. These recovery actions are considered in performing the System l 80+ Level 2 sensitivity studies. ,

1 19.11.4.2.1.2 Overpressure via Steaming in the Presence of Non-Condercables 19.11.4.2.1.2.1 Description of the Phenomena  !

Severe accidents leading to substantial core concrete interaction may also contribute to the containment overpressure process via the concrete destruction process. However, containment overpressure failure under these conditions is a result of combined pressurization of the containment atmosphere due to steam and non-condensible gases. For this process to be a threat to containment, the containment sprays must be unavailable and significant core concrete interaction must occur.

Two types of steam pressurization are distinguished in this section. The first case is containment ovetpressure under conditions where the cavity will ultimately dry out. The second -ase is associated with the potential for significant CCI in the presence of a fully flooded cavity.

Approved Design Atatorial- Probabarstic Risk Assessment Page 19.1178

System 80 + Design control oocument 19.11.4.2.1.2.2 Parameters Affecting Overpressurization (v)

The contribution of non-condensible gases to containment failure is a function of the degree of core concrete attack, the distribution of corium within the contairunent and the constitur.a. of the basemat and structural concrete.  ;

l 19.11.4.2.1.2.2.1 Core - Concrete Attack

'the concrete destruction process can release potentially large quantities of non-condensable gases to ,

the containment. These gases arise from the dehydration (release of H 0) 2 and decarboxylation (release of CO2) processes associated with the heatup of concrete. In practice, two types of concretes are common to LWRs constructed in the United States. These are: limestone / common sand concrete and basaltic concrete. A few reactors have used pure limestone concrete. Properties of these concretes and limestone concrete as obtained from Reference 155 are summarized in Tables 19.11.4.2.1-2 and 19.11.4.2.1-3. For purposes of gas generation, these concretes are distinguished primarily by the level of bound carbon dioxide within the concrete aggregate. Limestone / common sand concrete has carbon dioxide levels of more than 20 wt %, while basaltic concrete has only trace amounts of carbon dioxide (1.5 wt %). Limestone concrete has a high carbon dioxide content and a correspondingly high latent heat of fusion.

From Table 19.11.4.2.1-4, it can be seen that non-condensable gases evolve from concrete at three temperature levels associated with the thermal decomposition process. At concrete temperatures greater than 212*F, the free water in the concrete is evaporated. If corium is available, this water l will react with the metallic phase of the melt and be reduced to hydrogen. The total amount of

( hydrogen released from this process is equivalent to about 0.22% of the weight of concrete affected.

Free water released due to thermal decomposition in areas not in contact with the corium melt corresponds to about 2 wt % of the concrete attacked. Bound water is typically released at higher concrete temperatures in the vicinity of 700*F. As with the free water, H 2O liberated from the concrete will be released as hydrogen (approximately 0.3 wt % of concrete). It is expected that release of water bound in the concrete will occur only in the vicinity of the corium melt. The last step of the gas evolution process involves the decarboxylation of concrete (that is the release of carbon ,

dioxide). This release will occur in the vicinity of the corium concrete attack and will be dependent l on the specific concrete being eroded.

in addition to non-condensible and steam by-products of CCl, delayed corium debris quench in the presence of large amounts of water has the impact of increasing the corium energy production. This will ultimately allow large quantities of unoxidized metals to oxidize, thereby releasing considerable chemical energy into the CCI process and debris. At the time of quench this energy will be released to the overlying water and enhance the containment pressurization.

19.11.4.2.1.2.2.2 Corium Distribution The gas evolution due to corium-concrete attack is directly related to the amount of corium in contact and/or close proximity to the core debris. As discussed above, concrete not in close contact with the corium debris will not be heated to sufficiently high levels to complete the dehydration process or begin the decarboxylation process.

O AMrowest Desigus neoenriel

• Probebshstic Rink Assessment Page 19.1179

System 80+ Design controlDocument 19.11.4.2.1.2.3 Significance to System 80+

An estimate of the level of non-;ondensible gas evolution from concrete can be established for System i 80+ using the following boundirg assumpuons:

1. All cavity concrete releases both free and bound water. For wet cavity scenarios, basemat water releases are assumed to enter the containment as hydrogen. Sufficient unoxidized corium constituents (principally zirconium, iron and chromium) are assumed available to reduce water molecules into a metallic oxide and hydrogen. Hydrogen generated in this manner may be capable of entering the containment potentially increasing the containment hydrogen concentration to levels corresponding to 100 % (or more) core-wide zirconium water reaction (See Section 19.11.4.2.4).

For dry cavity scenarios, hydrogen generated during the concrete decomposition process will likely undergo auto-ignition as the hydrogen gas leaves the corium bed. This implies the potential for a frequent lower concentration hydrogen burns.

2. All decomposed basemat concrete also releases carbon dioxide to the containment (releases are based on a standard limestone / common sand concrete).

3. During a 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> interval, the maximum concrete erosion depth is 10 feet.

Based on these assumptions the maximum amount of non-condensables expected to be evolved during the concrete thermal decomposition will yield about 3650 lbm-moles of hydrogen and about 5240 lbm-moles of carbon dioxide. The resulting partial pressure contributions due to these non-condensables are about 0.1 psi and 13.5 psi for the hydrogen and carbon dioxide gases, respectively.

These results suggest that while non-condensible gas evolution will contribute to the containment overpressurization process, containment failure primarily due to non-condensable gas evolution is highly unlikely. In fact, significant non-condensable gas pressure contribution would require destruction of more than 5 million pounds of a limestone / common sand concrete.

The primary impact of extended CCI is associated with the enhanced exothermic energy release due to the delayed quench. MAAP analyses of System 80+ with a minimum heat transfer coefficient of about 200 Kw/m2(FCHF =.02) indicate that as a corcequence of the delayed corium quenching, the integrated steam released to containment results in an accelerated steam pressurization process.

Subject to these conditions, the time for Level C stress conditions to develop in the containment will be reduced from about 65 hours7.523148e-4 days <br />0.0181 hours <br />1.074735e-4 weeks <br />2.47325e-5 months <br /> to between 40 and 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> following core uncovery.

19.11.4.2.1.2.4 Application to the PRA The System 80+ PRA differentiates between contaimnent overpressure failure due to primarily steam addition and that caused by a combination of steam and non-condensible sources. Scenarios of concern to containment failure involve severe accidents with both concrete attack and no containment heat removal with limited available water sources. These transients typically result in containment pressures under 120 psia. The probability of an overpressurization containment failure due to these sequences is small. Thus, failure represents a race between various modes of containment failure.

Containment overpressure failure caused primarily by non-condensible gas evolution is not considered a serious containment threat.

Asyvend Design Material- Probabasuc ifisk Assessment Page 19.11-80

System 80+ Design controlDocument For the condition that significant CCI occurs in the presence of a full cavity, but without containment v heat removal, two containment failure outcomes are possible. These are that CCI fails the basemat (See Section 19.11.4.2.3) or that the containment fails by overpressurization. The latter is believed to be more likely and of greater safety significance. The likelihood of a basemat containment failure in the presence of significant water is considered highly unlikely. Containment failure due to overpressurization can occur and the time frame of the failure will be in the 40 to 60 hour6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> time j interval following core uncovery.

19.11.4.2.2 Basemat Melt-Through 19.11.4.2.2.1 Description of the Phenomena Basemat melt-through refers to the process of concrete decomposition and destruction associated with l a corium melt interacting with the reactor cavity basemat. The accident progression is slow (taking j from several days onward to penetrate the reactor cavity basemat and foundation) and provided the corium melts through to the containment subsoil, the corium release to the enviromnent is negligible.

Once in contact with the subsoil, most of the corium is expected to vitrify into a relatively impermeable substance. For some small number of System 80+ sequences the containment breach may include a pathway into the subsphere Si pump room. Under these circumstances, the basemat melt-through will respond as a filtered above ground release.

In existing PWRs and BWRs, basemat melt-through has demonstrated the potential for undermining and ultimately failing the reactor cavity walls, which in turn may induce a containment failure via the failure of a penetration. Should this situation develop, the RCS displacements may be sufficiently large to cause failures of containment penetrations. These failures are not considered credible for

~

System 80+, however should they occur they would produce above ground radiation releases.

19.11.4.2.2.1.1 Overview of the Concrete Decomposition Process LWR cavity basemats are constructed of concrete. The precise constituents of the concrete mix vary from reactor to reactor and typically reflect a concrete mixture that is indigenous to the plant site.

Three general types of concretes have been used in reactor cavity basemat constn ction: limestone concrete, limestone conunon sand concrete and basaltic concrete.

Concrete components consist of cement, sand and aggregate. The aggregate has the largest influence on which of the above concrete categories apply. It is common (and economical) to obtain concrete materials from sources in the same general area as the plant site. However, the selection and use of concrete in the cavity basemat construction can have a noticeable impact on the severe accident progression.

A comparison of the major properties of the various concrete types can be found in Table 19.11.4.2.1-2 and 19.11.4.2.1-3. These tables are based on information provided in Reference 203.

An overview of the concrete decomposition process is presented in Section 19.11.4.2.1.2.2.1.

i Anwewed Design hionerinh ProbaMbstec Rak Assessment Page 19.1181

System 80+ Design ControlDocument 19.11.4.2.2.2 Parameters Affecting Basemat Melt-Through 19.11.4.2.2.2.1 Concrete Properties Several types of concrete have been used in the construction of nuclear power plants. The concretes vary as to their enthalpy of decomposition and bound gas content. As a result of these differences, the concrete type used in the cavity basemat construction can impact the overall accident performance including affecting the rate of basemat erosion, liberation of noncondensable and combustible gases and concrete water release.

Concrete decomposition is a thermally driven process. The energy required to decompose concrete results from the energy required to bring the concrete temperature to a point where many of the chemical bonds in the cement and the aggregate can be broken and the gaseous products be liberated.

Since the composition of concrete varies, the temperature at which significant decomposition starts and the enthalpy of decomposition will also vary among concrete types. This results in different corium-concrete attack erosion profiles. In general, of the three common types of concretes used in reactor cavity basemat construction, limestone concrete has the largest enthalpy of decomposition and basaltic concretes have the lowest (see Table 19.11.4.2.1-2). Consequently, for similar core concrete attack situations basaltic concrete basemats are predicted to exhibit more pronounced erosion.

The general concrete composition is also important from the perspective of containment pressurization during severe accidents either via ideal gas pressurization or via the addition of large quantities of combustible gases into containment. Concretes with a large limestone content may be capable of producing significant quantities of carbon dioxide / carbon monoxide when subjected to core concrete attack. Both species of gas can contribute to the containment pressure as a non-condensible ideal gas.

Carbon monoxide is combustible and may contribute to a late combustion pressure spike.

All concretes contain about 5% water by weight. Thus, dehydration of concrete can release potentially significant quantities of steam which may be added to the containment atmosphere as water vapor and/or hydrogen.

19.11.4.2.2.2.2 Corium Mass and Distribution Within the Reactor Cavity The erosion of the basemat concrete is a thermally driven process. That is, heat transferred to the basemat and the subsequent heatup of the concrete is the driving mechanism for the various concrete decomposition and melting processes. Since the corium mass in the cavity also defines the cavity heat load the greater the corium mass the more energy available for concrete erosion.

19.11.4.2.2.2.3 Debris Bed Coolability Debris coolability has been assessed for ARSAP in Reference 150 in support of the URD. Based on this assessment, it was concluded that the availability of a water source and a floor area of at least 0.02 square meter per Megawatt of reactor power will be sufficient to guarantee long term debris coolability for the evolutionary ALWR, This assessment is based on (1) review of experimental data which suggests that the final state of the corium debris within the cavity would consist of a mixture of fragments and a relatively continuous, but porous and cracked, phase that would be distributed uniformly over the basemat and (2) an assessment of the heat removal mechanisms from the corium surface which guarantees that core debris in this configuration would be able to remove the expected 0.5 Mw/m 2produced within the debris bed in the long term.

Approved Design heaterial ProbabKsuc Risk Assessment Page 19.1182

System 80+ Deslan ControlDocument Experiments pertinent to debris coolability are summarized in Table 19.11.4.2.2-1. Additional details

- on these experiments as they relate to the ALWR are presented below and in Reference 150. q 19.11.4.2.2.2.3.1 Debris Configuration  !

It has been shown by several investigators that the 1orphology of quenched debris depends upon the relative amounts of liquid debris and water present Breakup of debris jets can occur if the water depth is sufficient. Otherwise, channeling and accumulation of debris can occur. Small paniculate ,

debris breakup (less than 1 mm) is typically not conducive to debris cooling in that packed debris ,

i beds of low porosity exhibit a steam / water counter-current flow phenomenon which makes water penetration difficult. Conversely, high porosity beds of modest decay pow:- typical of that ,

associatedwith decay heat at times greater than 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after shutdown, should b. .aily coolable by .

an overlying water pool. Experimental evidence indicates that a mixture of both particulate and a

- continuous phase occur. {

r t

~ Experiments of panicular note are simulated corium drop experiments performed by Benz (Reference 150) as well as the Corium Water Thermal Interaction (CWTI) and Corium-Coolant Mixing (CCM) l experiments performed by Spencer (Reference 148). In the Benz experiments molten steel or uranium -

dioxide changes were dropped into an interaction vessel containing excess water and the resultant debris fragmentation was measured. Based on these experiments the smallest average particle  ;

diameter was about 2 mm with more than 60% of the debris being greater than 4 mm. l l

i The CWTI tests covered a range of experimental conditions. Of panicular interest were tests CWTI-7 through CWTI-10 which investigated the fragmentation of a uranium zirconium oxide and stainless C) steel mixture which entered a water filled interaction vessel in circular jet. An examination of the debris indicated that the oxide debris was in the form of an internally porous (about 50% porosity) mass.

In the CCM experiment, the presence of deeper water pools resulted in a greater extent of melt break-up and particulate formation giving rise to the collection of loosely bound debris and internal ,

porosity. Characteristic panicle sizes ranged between 1 and 5 mm. ,

i Based on these tests, ARSAP (Reference 150) concluded that for prototypic debris and representative debris / water volumes, debris fragmentation would be limited and the majority of the debris will form a continuous porous slab.

Recent experiments conducted by NRC and EPRI suggest the potential for a continuous crust to form  :

at the upper ponion of the corium melt. In these tests where crusts were observed the heat transfer appeared to be impacted by its presence. The WETMET and WETCOR experiments (Reference 191 i

and 192) indicated that prior to crust formation heat transfer from the corium debris would proceed at a rate commensurate with nucleate boiling. Once a crust forms the heat flux from the upper surface )

was observed to reduce to a stable, heat transfer between 300 and 400 kw/m2 . l l

The MACE test series conducted by EPRI (Reference 193) also indicated a stable crust format on. l These tests demonstrated high initial heat fluxes (about 3.5 Mw/m2 ) followed by a decrease in heat removal from 600 Kw/m2 down to about 150 kw/m 2. The reduction in heat transfer was attributed to the development of an upper crust that separated from the corium melt as the corium simulant quenched. The ability of the crust to anchor on the test section sidewalls, and the influence of the V anchored crust configuration on the test results are still under investigation as part of the MACE l program. i Anmed Denn anesenw. nasasanese men aneem ent assi res, rs.t m l

System 80+ Design Control Document The formation of thick stable crusts may not be prototypic of a reactor simulation. Several points in the MACE test are of issue here. First, while the MACE facility is considered a "large scale" facility (between 4 and 9 ft2 ), the dynamics of the facility were observed to be influenced by the sides of the containment vessel which apparently provided extra support to the crust. This resulted in an anchored crust as the test progressed which allowed a void to develop between the melt and the crust. The actual prototypical core melt will cover an area of approximately 700 square feet. In this regard, MACE should be considered small scale and highly non-prototypical of an actual core melt sequence.

Second, the crust formation process in MACE is magnified by a test feature which removes power from the region as it solidifies. Unlike decay products which would be retained in the frozen crust the solidification process reduces the decay heat delivered to that material. This behavior is expected to enhance crust stability.

Third, the actual System 80+ design will employ a flooded cavity with 15 feet of water. Thus, with any additional system pressurization the crust will be subjected to a distributed mechanical load in excess of 7 psi. While crust formation is possible, it is likely that the process is both local and transitory. A cycling process whereby corium crust insulates the melt should increase the pool temperature thereby decreasing the crust thickness and improving l' eat transfer. Furthermore, in a severe accident, the weight of water will guarantee that the crust and the pool are in intimate contact and that crust cracking should be expected.

19.11.4.2.2.2.3.2 Debris Bed IIeat Transfer Heat removal from the debris will be governed by the debris configuration. Experimental observations of cooling of particle beds indicate that for larger particle sizes (greater than about 3 mm) the heat removal rate from a particle bed are relatively independent of depth to 100 cm and can be bounded by the flat plate CHF limit (see Figure 19.11.4.2.2-1). This rate of heat removal was analytically found to be sufficient to guarantee corium coolability (See Reference 150).

The coolability of thick oxidic debris slabs have been demonstrated in large scale magma experiments conducted at Grimsvolth (Reference 151). In this test water was poured on unconfined magma and the magma was observed to solidify over time via water ingression to a depth of over 14 m.

Corium coolability has also been studied in experiments with continuously heated simulated corium debris beds. In the SWISS (Sustained Water Interaction with Stainless Steel) program, a 45 kg charge of molten stainless steel was poured into a crucible with a limestone concrete basemat. The effects of instantaneous and delayed water cooling was studied. The SWISS tests indicated that the overlying 2

water pool could remove heat from the debris at a sustained rate of 0.8 Mw/m . This was less than the 1.2 Mw/m 2generated in the debris and consequently the downward erosion of concrete was not stopped. The lack of coolability in SWISS was largely attributed to the facility's small scale and the stable metallic crust which formed at the upper surface. Surface stability of stainless steel prevented cracking and any subsequent water ingression which limited the potential surface heat flux. Sustained core-concrete interaction oxidic melt tests are being conducted as part of NRC WETCOR tests and EPRI MACE test series. To date, results of only one WETCOR test (WETCOR-1) and two MACE tests (including one scoping experiment and one test of the first test matrix point) have been performed. WETCOR-1 tests simulated the corium charge with a 70 lbm mixture of alumina and calcium oxide heated in a 12 inch crucible. Results of this test were reponed in Reference 152.

This test indicated an initial short period of intense heat removal (1.5 Mw/m2 ) followed by a longer period of reduced heat removal of about 0.4 Mw/m 2. The reduced heat removal was attributed to a stable crust that formed above the corium. Reference 193 suggests that at this small scale stable crusts may be expected and therefore the results are not prototypical of large scale reactor melts.

Approved Design Material. Probabilistic Risk Assessment Page 19.1184

Sy~ tem 80+ Design ControiDocument The MACE tests simulate the corium debris as a mixture of UO 2

, ZrO 2

and Zr. To date, the MACE V tests have provided mixed results regarding debris coolability. While the MACE scoping test only established a maximum stable heat flux of 0.6 Mw/m2 which decayed in time, it was noted that the details of the test facility may have contributed to providing an insulating debris surface. When the 2

crust was not present during the test, heat fluxes were in excess of 2 Mw/m . The MACE scoping test involved a corium charge of about 300 lbm over an area slightly less than I square foot. The collapsed depth of the debris was initially 15 cm. The crust stability was aided by the sidewall design.

By the end of the test, a 2 - 5 cm thick crust had formed (Reference 193). l The most recent MACE test involved 960 lbm of simulated corium concrete attack (Test MIB) in a 4 square foot test facility. The test indicated substantial debris quenching and a long duration vigorous heat removal of 2 Mw!m 2was observed. Six hours into the test, concrete erosion was noted to be between 15 and 20 cm and the erosion rate had reduced to 1 cm/hr. At this time corium quenching was observed. A power reduction step was investigated in order to establish the debris erosion rates 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after shutdown. As with the previous MACE test an anchored bridge crust formed during the experiment. This crust appears to have separated from the melt as downward erosion progressed.

This behavior is considered a facility design issue and will not be prototypical of actual reactor scales.

During the initial contact the heat transfer from the crust allowed a heat flux of upwards of 600 Kw/m2 As the melt receded from their crust this heat flux decreased in time.

19.11.4.2.2.2.4 Melt Spreading The ability of the corium melt to spread within a water pool was investigated by Greene (Reference n 157). These experiments were used to establish a correlation between a nondimensional spreading Q thickness against a nondimensional spreading number. Applying typical ALWR geometric data into this correlation (see Reference 150), suggests that the spreading of the corium debris can be expected to be relatively complete for the ALWR.

Reference 150 also indicates that even if full spreading is not realized, the ability to remove heat via the sides of the debris bed would enhance debris coolability. Therefore, while full debris spreading is expected, it is not required in establishing corium coolability.

To support the assessment of coolability by the ARSAP Program, the MELTSPREAD-1 computer program (Reference 204) was used to calculate the spreading of core materials inside the cavity of various advanced reactors following a localized lower head failure. MELTSPREAD-1 models the transient spreading of reactor materials over a concrete or steel lined concrete substrate accounting for melt interactions with both the substrate and overlaying water. These analyses assumed the cavities were flooded with water. The released corium was calculated to spread to form a layer having a uniform upper surface over the full cavity.

19.11.4.2.2.2.5 Debris Power The debris power has been noted to have considerable impact on the debris coolability, and the concrete erosion rate and penetration profiles. These items are discussed below.

Debris Coolability Based on debris bed heat and simulated corium - concrete attack experiments, the ability to quench V corium debris is strongly dependent on the heat production rate within the corium pool (ST Section 19.11.4.2.2.2.3 above). Typically, an overlying pool of water at atmospheric conditions has been Approved Design Aceterial. ProbabEshc Risk Assessment (2/95) Pope 19.11-85

Design ControlDocument System 80+ _

2 observed to sustain a heat flux on the upper corium surface of between 0.3 and 0.8 Mw/m . (This 2

heat removal rate is less than the approximately 1 Mw/m associated with the flat plate pool boiling CliF.)

Erosion Rate The concrete destruction process is thermally driven. As a consequence, the greater the thermal power, the more rapid erosion is expected. Erosion rates expected for large dry PWRs are 0.08 to 0.14 cm/ min for a dry cavity attack and 0.035 cm/ min for a " wet" cavity attack of an uncoolable debris bed (See for example, Reference 117). MAAP analyses performed for representative System 00+ Station Blackout Scenarios indicate dry cavity concrete erosion rates will be on the order of .17 cm/ min for the early dry cavity attack, to .07 cm/ min for the longer stable erosion period.

Erosion Profile The Beta experiments performed by KfK (References 159 and 160) have experimentally investigated Core-Concrete interaction for large simulated corium melts at various power levels. These tests allow introduction of sustained inductively heated melts into a large concrete crucible. The crucible was designed so as to allow radial spreading of the corium within the basemat. The Beta tests investigated several parameters related to corium-concrete attack including the effects of debris power, and debds constituents on concrete erosion. Test results clearly indicate a strong dependence of the downward concrete heat flux (which for these tests is directly related to the corium power) and the basemat radial erosion profile. At high powers. Beta tests performed with various concretes suggest that a very effective downward heat transfer mechanism develops and very little radial spreading is obs :rved. At lower power levels, a more aggressive radial concrete attack is noted.

Based on a review of the low power corium concrete attack data for the Beta facility, it appears that the ratio of downward to radial erosion would be about 2:1 carly in the transient and increase to well above that value as the core-concrete attack continues. Typically, nominal values of axial / radial erosion are observed in experiments to be closer to 5:1 for short duration tests. Core concrete experiments lasting several days for silica based concretes suggest that the axial / radial erosion ratio diminishes to 1.3:1 for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Limestone concretes are expected to show larger long term ,

differences in axial and radial erosion. It should be noted that the Beta tests used an iron-aluminum oxide mixture as the melt simulant. This results in the oxidic layer overlying the metal layer in the CCI process. This melt composition resulted in a more aggressive axial attack than would be l expected for a prototypical corium melt where the lighter metallic phases would overlay the oxidic 1 components.

19.11.4.2.2.3 System 80+ Specific CCI Investigations Several plant specific evaluations of CCI have been performed to better quantify the anticipated core concrete interaction processes associated with System 80+, Results of these tasks are summarized i

)

below. l 19.11.4.2.2.3.1 MAAP Evaluation of Core Concrete Interaction Corium driven concrete erosion has been studied parametrically using MAAP 3.0B. MAAP models  ;

CCI phenomenology using the DECOMP subroutine (Reference 155). The studies performed for  ;

System 80+ have been directed towards quantifying the concrete erosion progression following a CCI scenario with various imposed upper crust-water heat flux limits.

l Altvowed Design Atatoria! Probabikstic Risk Assessment page 19.11.sg l

System 80+ Design ControlDocurnent (n

k/

To perform this study, MAAP 3.0B Rev 16 was exercised so as to simulate a controlled concrete erosion and heat flux condition. Heat fluxes from the upper crust to the overlying water pool were limited by controlling the containment pressure at a constant level (by simulating an induced containment failure at low pressure) and by varying the MAAP FCHF parameter to control the pool boiling heat flux. By properly controlling these parameters, maximum nucleate boiling heat flux limits can be specified at the corium-water interface.

The base transient analysis for this evaluation was a station blackout scenario. In this scenario the core melt progresses rapidly and RV failure occurs in about 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. These calculations conservatively assumed that 100% of the corium was involved in the CCI process (the energetics allowed for volatile fission products to be released from the melt prior to CCI). This is a very conservative position since it is expected that a significant amount of core debris (on the order of 30%

of initial inventory) will remain in the reactor vessel after vessel breach as pan of the peripheral core bundles or crusted "in vessel" debris. Furthermore, for high pressure VB sequences, an additional 10% of the corium released at VB will be ejected out of the reactor cavity. Results of this assessment is presented in Table 19.11.4.2.2-2 for limestone / common sand concrete. These studies indicate that even when 100% of the core interacts with the cavity basemat, basemat erosion can be both permanently arrested within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and the concrete erosion be maintained below 3 feet (the minimum basemat thickness above the embedded containment shell) provided the heat fluxes from the melt to the overlying water pool exceed approximately 150 kw/m2 (FCHF >.02). As FCHF is reduced to .01 (approximately 80 kw/m2), CCI is predicted to erode 3 feet of concrete in about 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> for limestone /CS concrete. At this level of heat removal the transient is progressive and will not arrest (See Figure 19.11.4.2.2-2). At this rate of concrete ercsion full basemat penetration in the p containment subsoil is estimated to occur in 194 hours0.00225 days <br />0.0539 hours <br />3.207672e-4 weeks <br />7.3817e-5 months <br /> (8 days).

(~ 19.11.4.2.2 3.2 ANL System 80+ Calculations I

ANL has performed System 80+ concrete erosion calculations employing the most recent version of CORCON-MOD 3 Version 2.26 (Reference 201). This code has been developed by the NRC for the explicit purpose of computing concrete erosion rates and profiles during severe accidents. Unlike the previous analyses, the CORCON-MOD 3 study computed heat transfer to the upper crust via mechanistic heat transfer models which allowed for consideration of growth and depletion of the crust. These models allowed the code to select the most appropriate upper surface heat flux based on  :

the thickness and surface temperature of the corium crust. It is tacitly assumed that the corium crust l and the corium melt are in contact and that the melt is impermeable to water ingression. Futhermore, the corium melt is assumed to be in the form of a continuous layered slag. The melt composition was based on basemat attack involving 100% of the molten core with a 75% equivalent zircaloy oxidation prior to concrete attack. The decay energy driving the CCI process is associated with a vessel breach at 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, and accounts for the release of volatile fission products. The ANL study considered corium-concrete erosion in limestone, limestone / common sand and basatic concretes. The basemat area subjected to erosion was based on an equivalent area of 693 ft2, Results of this analysis indicate that the average basemat depth will not erode by significantly more than 3 feet in a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period following initiation of CCI regardless of the basemat composition.

These results are presented in Table 19.11.4.2.2-3. Note that CORCON provides deterministic radial crosion predictions as well. Over the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> interval radial erosion is predicted to be approximately equal to axial erosion.

/'~Ti V Struaural analyses indicate that integrity of the lower cavity walls are not required for the support of the scactor vessel. Therefore, radial erosion of concrete will not threaten containment integrity. Peak Anwmd D# sips Material Probab&ste Risk Assessmerrt Pope 19.11-87

System 80+ Design ControlDocument erosion profiles for a representative CCI transient with limestone / common sand, concrete and corium-water heat fluxes predicted by CORCON-MOD 3 are presented in Figures 19.11.4.2.2-3 and 19.I1.4.2.2-4.

Deterministic calculations were also performed to establish the concrete erosion profile within the 2

cavity sump. The cavity includes a small shallow sump (one foot deep and about 16 ft n area). The sump is located such that the depth of concrete between the bottom of the sump and the containment shell is about 3.2 feet. Corcon analyses of concrete erosion in a sump geometry predicts the downward erosion into concrete for a 24-hour interval to be between 2.3 and 3.4 feet.

19.11.4.2.2.4 Significance to System 80+

The System 80+ reactor cavity has been designed with a large basemat area (consistent with the URD) and a Cavity Flood System (CFS) (See Section 19.11.3.6) to ensure the presence of water in the reactor cavity following severe accident scenarios.

The basemat penetration scenario for System 80+ is considered to be relatively benign because of the high likelihood of an overlying water pool, the large surface basemat area for corium spreading and the ample depth of the reactor cavity basemat foundation (more than 20 feet). Furthermore, in the long term (> 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after scram) energy production rates within the corium should enable the corium to be coolable even at the lower experimentally observed values of debris heat removal (See Table 19.11.4.2.2-4) typical of heat removal from a molten pool without crust / melt separation.

MAAP analyses performed by parametrically varying the level of the pool boiling critical heat flux from a nominal value of about 0.8 Mw/m 2 (FCHF = .1) down to below .10 Mw/m2 (FCHF=.01) ,

show that erosion will increase as the debris heat removal limits are decreased. These analyses further indicate that even for 100% complete corium-basement attack, the initial penetration of the lower spherical shell (located between 3 and 5 feet below the basemat) will not occur in a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period for heat removal rates above ~.2 Mw/m . This value is well below the expected heat 2

removal capability of the overlying water pool and that typically observed in experiments with crust formation but without the separation of the crust and the melt. As the heat removal is artificially diminished to below .2 Mw/m 2the potential increases for local penetration of the shell plate within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the onset of core damage.

The above MAAP analysis results were obtained by parametrically varying the corium upward heat Dux. This was accomplished by adjusting the MAAP pool boiling heat flux multiplier, Fenp. To independently confirm these results a CORCON-MOD 3 analysis of the basemat attack scenario was performed. This analysis provided a deterministic calculation of the core-concrete attack due to an impermeable corium morphology. This analysis demonstrates that penetration of the lower shell can be delayed for more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after uncovery.

Penetration of the containment shell by corium may theoretically provide a release mechanism for fission products to the environment. However, since the gap between the containment shell and foundation is small, the peripheral corium/ concrete mixture will likely solidify in the crevice between the shell and the foundation and seal off any potential pathway from fission product release. It is envisioned that the corium/ concrete mixture would likely spread out underneath the shell as it continues the attack the basemat, significant flow of the corium to ground level is unlikely. The gap between the shell and the reinforced concrete is filled with a grout at high pressure and thus would provide a formidable barrier to fission product release. Therefore, fission product releases from such an event are considered to be primarily confined to below ground and consequently will have minor radiological consequences to the public. Furthermore, even if the gap is not perfectly closed, the more Approved Design Atatenal. Probabikstic flask Assessment Page 19.1188

System F0+ Design controlDocument

[3 volatile releases will be confined to the upper regions of the containment and above the overlying V water pool and thus should be protected from environmental release via the same crusting mechanism which prevented the initial corium coolability.

The subsphere design of System 80+ incorporates an offset "below reactor cavity" room, which hypothetically, can be penetrated. Since the corium debris is displaced about 12 feet laterally from the Si pump room, no significant consequences of radial concrete erosion is predicted since radial erosion is predicted to be self limiting. Radial erosion is expected to be less than 6 feet at the elevation of the SI pump room. In the remote possibility that such a corium penetration condition develops, any subsequent containment blowdown into this region will result in an above ground filtered radiation release from the containment. This failure mechanism is explicitly considered in the PRA.

Basemat erosion can theoretically undermine the cavity wall foundation and cause a subsequent collapse. This situation was studied in the Grand Gulf PRA (see NUREG-1150, Reference 182). The potential for basemat erosion to cause a failure of System 80+ cavity wall has been structurally evaluated and is considered remote. This is a consequence of several System 80+ cavity design features. First, the sloping character of the debris trap confines the corium radial attack away from a major supporting wall. Second, structural analyses of the System 80+ reactor cavity shows that the reactor vessel and upper cavity load can be supported without any structural contribution of the lower i cavity walls below the 73 foot elevation. Thus, even the remote possibility of cavity collapse will not compromise containment integrity, 19.11.4.2.2.S Application to the PRA p/

i V in the preliminary version of the System 80+ PRA (Reference 146), it was explicitly assumed that as a consequence of the cavity design, the availability and actuation of the CFS was sufficient to prevent a basemat melt-through scenario. While there is Feneral agreement that water will retard the corium progression into the concrete basemat, there is not yet conclusive proof that a deep accumulation of corium will be fully coolable by an overlying water pool. It is expected that the ongoing MACE (Melt / Debris and Coolability Experiment) program will correct the test shortcomings and shortly provide this information to confirm the existing PRA position. Until that time, future PRA assessments of System 80+ will allow for the potential for basemat failure in the presence of large quantities of water.

Based on a review of Sandia and EPRI debris coolability experiments, it was concluded that the median stable corium-water heat flux was about 0.5 Mw/m 2 (w th an uncertainty of about .2 Mw/m2 )

provided that the corium crust and the molten material do not separate. As discussed above, the probability of the low heat fluxes observed in the MACE experiments are not considered prototypical.

The likelihood that the corium-water heat transfer is below 0.10 Mw/m2 (preventing corium quench and causing ultimate basemat failure) is taken to be small. It should be noted that while these low heat transfer sequences may progress to basemat melt-through, they will do so very slowly and in a well scrubbed environment.

Dry cavity melt-through scenarios can occur if the CFS is disabled or not actuated. Dry cavity sequences comprise a small fraction of the System 80+ PDSs. These sequences can result in:

1. Basemat melt-through to the containment subsoil f^)

v

2. Corium penetration into the subsphere A/4vond Design htaterial. Probabestsc Stak Assessment Pope 19.11-89

}

System 80 + Design ControlDocument

3. Corium erosion of cavity wall concrete, causing an induced containment failure.

For purposes of the PRA radiological release calculations, basemat melt-through scenarios into the containment subsoil will be assigned a benign fission product release classification (See Section 19.11.4.3). Failures into the subsphere or reactor cavity wall failures will be considered as potential atmospheric releases. Detailed computer simulations of the basemat erosion process indicate that radial penetration of corium into the SI room is highly unlikely. Similarly, structural analyses indicate that complete cavity wall erosion will not cause a failure of RV to be supponed.

Consequently, no induced above ground containment failure is anticipated. For completeness this failure mode is retained for the PRA and is quantified with a small conditional probability.

19.11.4.2.3 Temperature Induced Failure of Containment Penetration Sealant During dry cavity corium attack sequences, the containment atmosphere has the potential to undergo a gradual, but significant temperature transient. Analyses of typical System 80+ accident scenarios suggest that sustained temperatures in excess of 450*F can develop throughout the containment within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after accident initiation. At these temperature levels several common penetration scalants (e.g., Nitril Neoprene) will begin to degrade and, dependent on penetration design, can potentially result in a premature localized containment failure. Through penetration design involving multiple seals and by specifying the specific sealant at the time of actual equipment procurement, use of the best material available will be ensured and containment integrity will be maintained even in the presence of considerable basemat erosion.

19.11.4.2.3.1 Significance to System 80+

Specific clastomers for use in the System 80+ penetrations have not been finalized. To minimize the 0

risk of thermal degradation of the penetration sealant causing excessive containment leakage, a multiple seal penetration design will be used where practical and the best possible sealant available at the time of equipment procurement will be selected.

19.11.4.2.3.2 Application to the PRA This failure mechanism is included for purposes of completeness and to allow it to be considered in PRA sensitivity studies to be conducted at a later time.

19.11.4.2.4 Delayed Combustion 19.11.4.2.4.1 Description of the Phenomena Combustion events can occur late in a severe accident scenario due to the production of significant quantities of hydrogen and/or carbon monoxide. Delayed burns that significantly threaten containment can occur during transients where (1) previous hydrogen burns have not occurred and (2) a significant corium-concrete interaction has occurred which resulted in the oxidation of much of the unoxidized metal in the corium thereby producing hydrogen and carbon monoxide.

A delayed combustion event can occur anytime in a severe accident once a sufficient quantity of hydrogen / carbon monoxide is generated and the containment atmosphere is not inened. The most conimon scenario where a delayed hydrogen burn can occur is when a hydrogen rich, steam inened containment is sprayed with water. This process is typically operator initiated and can result in a hydrogen combustion event at pressures just below the steam inening limit. Because of the large Appnen<1 Design afsterial. Probabmstic Risk Assessment Page 19.1190

System 80+ Design ControlDocument (g) amount of steam and carbon dioxide initially available, the combustion event is far more likely to be a deflagration than a detonation. According to the NRC Final SER on the URD (Reference 161), the late hydrogen burn issue can be addressed by considering combustion of the hydrogen equivalent of 100% oxidation of the RCS zirconium. Results of analyses presented in this section indicate that pressures generated during this event will be below the containment Service Level C and are well below the ultimate containment failure pressure.

19.11.4.2.4.2 Significance to System 80+

As discussed in Section 19.11.4.1, System 80+ is equipped with igniters to burn off hydrogen at low concentrations. These igniters have been demonstrated effective in steam environments and therefore, when actuated early in the transient they should fully eliminate any significant hydrogen induced containment threat.

In the event that a significant accumulation of combustible gases develop without the occurrence of early smaller inrns, a single large burn corresponding to the ignition of the hydrogen equivalent of 100% oxidation of the zircaloy active cladding, initiated at a system pressure just below the inerting containment steam concentration, will produce an AICC burn pressure of below 103 psia (See Section 19.11.4.1.3). Burns in this range pose a small, but finite threat to containment imegrity.

19.11.4.2.4.3 Application to the PRA A delayed hydrogen burn capable of threatening containment is considered credible only if no O

C

. previous burns have been assumed. The presence of early burns via deflagration or diffusion flames is assumed to consume sufficient hydrogen to make a large containment threatening burn impossible.

In the PRA this implies that early operator actuation of the hydrogen igniters will prevent a late containment threatening burn. i l

Since quenching of the corium debris will produce hydrogen, as will the concrete attack process, the potential for a high level of hydrogen is assumed.

For purposes of PRA quantification, situations where the igniters are actuated early during the uncovery sequence and operated continuously, a containment threatening hydrogen burn was not considered credible.

For scenarios where igniters were not actuated and no prior burns occurred, a late containment burn is highly likely. The zircaloy oxidation level and pressure peak associated with the resultant burn was established for conditions with and without the occurrence of prior burns in containmem and with and without the potential of core-concrete interaction. Prior burns occurring in the containment implies that some of the potential available hydrogen inventory has been removed in a non-containment threatening manner. Thus, the hydrogen available for a later burn is reduced. The existence of core ,

concrete attack will introduce additional quantities of hydrogen into the containment. To characterize l i

the late hydrogen burn scenario bounding estimates of hydrogen availability were assumed for the various containment hydrogen conditions. The minimum late burn was assumed to consume 1923 lbm of hydrogen (75% oxidation of active fuel cladding). This condition was considered to occur for those situations where a prior hydrogen burn had occurred in the containment and no CCI was )

predicted. The maximum hydrogen burn was assumed to be equivalent to 150% oxidation of the total (p) zircaloy cladding. This hydrogen equivalent can be achieved by complete oxidation of all the core  ;

V zircaloy inventory with the addition of oxidized steel. This situation was predicted to occur for all  !

scenarios where prior burns have not occurred and CCI is considered to be in progress. For the late l

Amromt Design Material- Probabaste Risk Assessment il1/961 Page 19.11-91 l

}

System 80+ Design ControlDocument hydrogen burn scenario, all burns are assumed to be initiated once the hydrogen / steam / air concentration re. aches the minimum flammability limit and are calculated via AICC methods (See Appendix 19.llE). This results in maximum containment pressure initial conditions. A summary of the hydrogen burn pressures and containment failure probabilities associated with the various containment hydrogen conditions is presented in Table 19.11.4.2.4-1.

19.11.4.3 Fission Product Release, Transport, and Retention The consequences of the severe accident scenario are dependent on the amount of fission products that ultimately are released from the fuel rods into the environment. This infonnation, along with meteorological conditions and site demographics will determine the man-rem equivalent doses (event consequences) at various off-site locations possible during the various severe accident scenarios. It is a goal of the URD that the ALWR cumulative probability of releases greater than 25 rem one half mile from the reactor site to be less than 104/ year.

19.11.4.3.: Models for Fission Product Release and Depletion Two fission product release calculations are used to support the assignment of System 80+ source term for various release classes. Both models are generally consistent with the advanced source term philosophy. In one approach, direct calculation of fission product release and distribution are established based primarily on predictions from the System 80+ version of MAAP 3.0B Rev 16 (Reference 203). The models governing fission product release are contained in MAAP subroutines FPRATP and METOXA, MAAP also contains models that simulate all significant fission product transport and deposition due to both natural depletion and engineered safeguards systems. These models are contained in MAAP subroutines FPTRAN, FPTRNP. The MAAP calculations performed utilize nominal fission product modeling assumptions. Additional sensitivity calculations were performed on selected transients to better understand the sensitivity of fission product releases to MAAP modeling assumptions.

The second approach is an adaptation of the XSOR (Reference 240) approach to fission product assessment. In this approach the ZISOR source tern generation program was modified to reflect System 80+ design features and update input to be consistent with the current research on fission product release, retention and deposition. The adapterion program which modifies ZISOR to reflect System 80 + feaiine hu been named S80SOR. Information supporting the development of S80SOR can be found in References 168 and 194 to 202. A .lescription of S80SOR is presented in Appendix 19.11J.

Because of the ikxibility and ease of use of S80SOR, this code was used as the primary mechanism for quantifying 'ission product releases. MAAP analyses were used to (1) establish the appropriate energy at varias release times (which is input to S80SOR and also the MACCS radiation dispersion program) (2) estabihh duration and temporal characteristics of the release and (3) provide guidance as to the magnitude of the release and its sensitivity to fission product modeling assumptions.

19.11.4.3.2 Advanced Source Term The System 80+ fission product representation is based on features associated with the advanced source term (Reference 168). The phenomenological features of the advanced source term are highlighted below and discussed with reference to S80SOR and MAAP.

Approwd Design Material- ProbabHrs6c ksk Assessment (11/96) Page 19.11-92

System 80+ Design ControlDocument  !

i This section provides the phenomenological background supporting assumptions employed in defining  !

the source term environment releases used in the System 80+ MACCS 1.5 consequence evaluation.

In this presentation the fission product source term release discussion has been divided into discussions on fission product release (including RCS transport and revaporization) and the "in containment" deposition process. In establishing S80SOR source terms the general recommendations associated with the Reference 168 have been adopted, with a limited number of System 80+ specific additions and modifications. System 80+ MAAP analyss including advanced fission product release,  !

transport and deposition models were used to provide confirmation of S80SOR release class l predictions. l 19.11.4.3.2.1 Fission Product Release 19.11.4.3.2.1.1 Fission product Release from the Core 19.11.4.3.2.1.1.1 Application to S80SOR Predictions Fission product release from the core has been evaluated by Brookhaven based on data from fuel meltdown experiments and the NRC NUREG-1150 Source Term Code Package (STCP) predictions (Reference 198). This evaluation provided expected inventory release fractions for a molten core  !

(FCOR) for use in an XSOR type code package.

In the BNL/NUREG IISO assessment, the core fission product releases were subdivided into nine fission product release groups (See Table 19.11.4.3.2-1) and the releases were subdivided into two

(~'% physical categories: releases with low core-wide zircaloy oxidation and with high core-wide zircaloy V oxidation. Mean and median fractional releases are summarized in Table 19.11.4.3.2-2. The high and low oxidation categories were observed to have a marginal impact on fission product releases in the noble gas, iodine and cesium groups. A noticeable impact was noted for the elements Te, Sr, Ba, i and Ru. These FCOR factors are considered applicable to System 80+ and were therefore used as input to the S80SOR FCOR input matrix.

19.11.4.3.2.1.1.2 Appkation to MAAP Calculations /Modeling Fission product releases are modeled in MAAP subroutines FPRATP and METOXA. Fission product releases from the core can be computed via either the steam oxidation (Cubicciotti) model or by NUREG-0772 models (Reference 155). Tellurium bonding to Zr can be approximated in MAAP through user input by setting ITEREL=0 and preventing "in-vessel" Te releases. The effect of zirconium oxidation on Te releases has been parametrically investigated using MAAP. Use of the i default models in MAAP predict higher "in-vessel" release fractions of I, Cs and noble gases and a lower release of tellurium. 1 19.11.4.3.2.1.2 Fission Product Retention in the RCS 19.11.4.3.2.1.2.1 Application to S80SOR Predictions Fission products released from the fuel during core damage events will be affected by physical and chemical processes during their transport through the RCS which in turn affects the retention of aerosols in the RCS. Retention of fission product aerosols in the RCS can have an important effect on the ultimate source term.

.%-  ; Desiper Meterial Probabalstic Riot Assessment Pope 19.1193

l l

System 80+ Design ControlDocument i

Thermodynamic analysis and experimental evidence indicate that iodine, cesium and the less volatile radionuclides released from the fuel during core damage accidents in LWRs will behave primarily as 1 aerosols. A substantial fraction of these aerosols deposit on RCS surfaces or within water reservoirs, especially for sequences with long residence times. l Experimental evidence of aerosol RCS retention processes is provided by the LACE and Marviken  ;

aerosol transport tests and the INEL severe core damage test series and LOFT test FP-2 (Reference 154), in general, the experiments consistently demonstrated high levels of fission product deposition within the RCS with significant levels of deposition noted within the first few meters of the source.

Based on NUREG-1150 expert judgement clicitation, fission product release from the RV (FVES) was classified for various PWR sequences as shown in Table 19.11.4.3.2-3. The expert elicitation indicated that high pressure sequences were estimated to have nearly complete fission product retention (Iow releases to containment) while for low pressure sequences about 50% of the fission products released from the core were retained in the RCS. Table 19.11.4.3.2-3 is consistent with the summary of the fission product transmission / retention in the RCS was provided by Reference 195.

The complete isotopic distribution of fission product transmission characteristics may be found in Reference 195. The FVES factors defined in Table 19.11.4.3.2-3 are considered applicable to the System 80+ evolutionary PWR and were consequently maintained in S80SOR.

19.11,4.3.2.1.2.2 Application to MAAP Calculationsalodeling The MAAP code models "in vessel" fission product transport in subroutine FPTRNP. Details of FPTRNP can be found in Reference 203.

19.11.4.3.2.1.3 Fission Products Released During IIPME 19.11.4.3.2.1.3.1 Applicable to S80SOR IIPME occurs when the reactor vessel lower head fails while the RCS is at high pressure. In past PRAs for existing PWRs, HPME releases have been credited for rapidly introducing considerable quantities of fission products directly into the containment upper atmosphere. The estimated l quantification for this process has been presented in Table 5.17 of Reference 194. Discharges of volatiles (noble gases, cesium and iodines) from the reactor vessel are assumed to be similar for NUREG-Il50 Reference Plants and System 80+. However, since the System 80+ includes a debris retentive cavity. HPME discharges for this design are expected to have lower dispersal fractions than for the other plants. Since detailed information on fission product distribution for System 80+ is not available, the HPME fission products released for the Te, Sr, Ba, Ru, La and Ce groups were conservatively applied to the System 80+ source term. The HPME discharge fraction (FDCH) for S80SOR are presented in Table 19.11.4.3.2-4.

19.11.4.3.2.1.3.2 Application to MAAP CalculationsStodeling The role of DCH induced containment failure is negligible for the System 80+ PWR as discussed in Section 19.11.4.1. Consequently, MAAP analyses investigating the System 80+ post-VB aerosol content following HPME events were not performed. All release class assessments of fission product releases from containment follo ving a DCH induced containment failure are established solely via the S80SOR methodology.

Approved Design Material- Probabmstic Risk Assessment (11/96) Page 19.11-94

Sv tem 80+ oestan contrat Document =

19.11.4.3.2.1.4 In Vessel Revaporizati : < maa*=

Because of their low vapor pressures, ce:tain fission products such as Csl, CsOH, etc. may condense to aerosol form after being released from the high temperature fuel and " plate - out" in low  ;

temperature regions of.the RCS and containment. ' This process of "in vessel" fission product _

retention was discussed in Section 19.11.4.3.2.1.2. For those conditions in which the deposited  ;

aerosol would be on a dry, uncooled surface, energy generated by the fission product decay may be .l f

capable of reheating the deposited fission products to sufficiently high temperature such that '

revaporization may occur. The significance of the revaporization process typically depends on the' level'of fission products retained in the vessel prior to vessel breach, the temperature of the RCS j piping and the ability of the damaged RV to " flush" the residual fission products from the RCS. j i

The volatility of the fission products depends on its local temperature. The greater the temperature of i i

the surface upon which the fission product resides and the greater the RCS steam flows, the greater will be the extent of revaporization. The elements considered candidates for revolatilization include, iodine, cesium and tellurium.

t 19.11.4.3.2.1.4.1 Application to S90SOR ,

Expert clicitation obtained for the NUREG-1150 Reference Plants on this issue are considered applicable to System 80+. Specifically, the experts agreed that revolatilization is enhanced for conditions where the RCS has two holes in the plant (one created at VB and one associated with the  !

initial' accident). Under these conditions, high velocity flow patterns can be set up in the RCS, thus j q increasing the transpon of volatilized fission products from the cere and RCS piping into the '

Q containment. Transients considered subject to these high flushing flows following vessel breach include LOCAs, transients with stuck open PSV or RDS valves and certain SGTRs. Significant i revolitalization during transients with cycling relief valve discharges was considered unlikely.- ,

19.11.4.3.2.1.4.2 Application to MAAP Calculations /Modeling P Revaporization is modeled in MAAP in a mechanistic way via use of group speciSc vapor pressures.

Classical mass transfer relations are used to compute revaporization rates; chemical reactions between deposited fission products and the constituents of the steel are neglected. In general, MAAP predicted '

revaporization behavior is consistent with advanced source term predictions. However, MAAP predicted revaporization rates can be affected by user input and in particular the estimate of the "not-through insulation" heat losses. Large heat losses reflect a good ability to reject heat and decrease the potential for revolatilization. The System 80+ base MAAP model will establish "not through insulation" heat losses based on System 80 heat losses. It should be noted that MAAP results are only used to qualitatively confirm the appropriateness of the S80SOR selected timing and containment energy issues. Thus, modifications to the details of MAAP revolitalization modeling will not impact  ;

PRA consequence predictions.

19.11.4.3.2.1.5' Fission Product Releases due to Core-Concrete Interaction (CCI) ,

' Aerosols are generated from the interactions of molten core material with concrete. As concrete is ablated, water vapor and carbon dioxide (mainly in limestone aggregate) are released and sparge through the melt. Sparging releases the volatile arxl refractory radionuclides as well as inert aerosols.

'Ihe advanced source term establishes fission product releases from the results of CORCON MOD 2 and VANESA computer code results. CORCON-MOD 2 computes the gas evolution from the concrete while VANESA computes the vaporization' release of fission products and other melt know anson anoeuw . neseen,ere mas aseeeson.or is rises rose rs.s1.ss l

Sy ~ tem 80 + Design Control Docu*nent l

constituents into the gas bubbles and the aerosol formation at the debris surface. Factors that effect I

the vaporization release du- to CCi idade ti:e type of concrete and the existence and stability of an upper crust on the corium demis.

19.11.4.3.2.1.5.1 Application to S80SOR Quantification of vaporization release in a dry cavity is based nn the expert judgement developed for NUREG-1150 Reference plants. This information is presented in Reference 198 and for purposes of completeness is reproduced in Table 19.11.4.3.2-5 for limestone / common sand concrete. A review of these releases performed by Osetek (Reference 202) indicated that these releases are between a factor of 5 to several thousand times greater than one would predict based on available CCI data. This overconservatism is further magnified for situations where CCI is predicted but an overlying water pool is predicted to cool the pool and create a crust on the upper portion of the melt. This effect was conservatively neglected in the S80SOR source term.

19.11.4.3.2.1.5.2 Application to MAAP Calculations /Modeling Releases of fission products during CCI are modeled by MAAP in subroutine METOXA. Scrubbing of released fission products in an overlying water pool, if any. is calculated by subroutine POOLDF.

These subroutines are discussed in detail in Reference 203.

19.11.4.3.2.1.6 Ex-Vessel Revaporization Releases Experimental results of fission product speciation tests suggest that at least 95% .t t'.s iodine entering the containment will be in the form of Csl (See Section 19.11.4.3.2.2). Csl will exist primarily in the form of aerosols for typical containment temperatures and will ultimately settle out from the containment atmosphere via natural deposition processes. Active fission product removal processes, such as sprays will provide rapid removal of fission products from the containment atmosphere. Once the iodine enters the containment, however, additional reactions can occur that will affect its ultimate importance to public dose. Once removed from the containment atmosphere in particulate form (as CsI), the iodine will dissolve in containment water pools or plate out on wet surfaces in its ionic form

[I]. Subsequently, iodine behavior within the containment will depend upon time and the acidity (pH) of the water. Because of the presence of other dissolved fission products, radiolysis is expected to occur within the cavity and IRWST water lowering the pH of the respective water pools. Without adequate pH control, the dissolved iodine will slowly be converted to elemental iodine and be re-released into the containment atmosphere as elemental iodine. Organic iodine will also be produced slowly over time from reaction of the elemental iodine with carbon bearing compounds. Organic iodides represent approximately 0.15% of the released iodine inventory. When pH control is available and the pH is maintained at a value greater than 7, very little (less than 1%) of the dissolved iodine will be converted to elemental iodine. Elemental iodine and organic iodine compounds are gaseous and will be transported from the containment in much the same manner as noble gases.

Elemental iodine is soluble and can be removed from the containment atmosphere via operation of sprays.

The vaporization temperature of CsOH is about 440*F. Thus, for several delayed containment overpressure sequences, a significant quantity of CsOH can revaporize and be available for release upon containment failure. This feature was not specifically modeled in XSOR, but was predicted by MAAP. To account for this release, MAAP calculations were used to establish late releases of Cs for conditions where the containment temperature exceeds 300*F.

Approved Design Marwiel. Probab&stic Risk Assessment Page 19.1196

System 80+ Design Control Document g

19.11.4.3.2.1.6.1 Application to S80SOR i] t The ability for natural depletion and the engineered safeguards to remove fission products from the containment environment is dependent upon the airborne form of the fission products. This is particularly true for cesium (Cs) and iodine (1). Experimental evidence presented in Reference 154, suggests that airborne Cs will exist almost entirely as a water soluble particulate aerosol. Iodine will exist as a mixture of particulate iodine, primarily Csl (97%), elemental iodine (2.85%), and organic l iodine (0.15%). NUREG-1465 provides similar values for this distribution: Csl (particulate) 95%,

and I/H1 organic (gaseous) 5%. The control of the pH is provided via trisodium phosphate dodecahydrate baskets located in the holdup volume. This placement assures that a pH of 7 or greater is maintained in the containment water pools and limits the evolution of elemental iodine. The presence of organic iodines is limited to 0.15% of the containment iodine.

NUREG-1465 further indicates that all other source term constituents (with the exception of noble gases) are overwhelmingly particulate under the conditions of interest.

For purposes of post-accident iodine control and to minimize corrosion of the stainless steel in the  ;

containment, the pH of the water recirculated through the IRWST and thus of the containment spray i solution, is maintained at a minimum of 7.0. This is accomplished by dissolution of trisodium phosphate dodecahydrate stored in baskets in the IRWST holdup volume (see Section 6.5.3.2). As the RCS loses inventory, water will accumulate in the holdup volume. This water accumulation will j be sufHcient to inunerse and dissolve the trisodium phosphate dodecahydrate in the water. This water is ultimately mixed with the IRWST and the high pH water is distributed throughout the containment i (7 via use of sprays. A pH of 7.0 can be achieved in less than 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> following spray actuation (see Gl Section 6.5.3.2).

In S80SOR, the organic and elemental iodines are assumed to comprise 5% of the containment iodine release. If sprays operate elemental iodine will be scrubbed from the atmosphere, leaving only .15%

of the iodine source assumed to be in a gaseous state. If sprays do not function,5% of the initial iodine source will be assumed to be in the containment atmosphere in the gaseous form. The distribution used to describe the gaseous iodine content is based on the Reference 194 expert clicitation.

19.11.4.3.2.2 Fission Product Removal In Containment I

Following a severe accident, the containment environment can potentially contain signincant quantities of noble gases, cesium and iodine and to a lesser extent tellurium. Trace amounts of other l radionuclides may also be present. The distribution of fission products remaining in the atmosphere as the accident progresses is dependent upon the chemical form of the various fission products, the precise pathway the various species take to enter the containment, the time after release, the existence of additional sources of fission products (RCS revaporization or CCl) and the presence of active engineered safeguards (containment sprays) to scrub fission products from the containment atmosphere.

Noble gases cannot be scrubbed from the containment atmosphere, and are relatively insoluble in water. Thus, once released to the containment, the only mechanism for changing the quantity of these gases is via the decay chain. Cesium and iodine are considered to be primarily in the form of

(_)v water soluble particulates. Thus, aerosol removal will be influenced by the natural depletion processes associated with sedimentation and diffusiophoresis, and to a lesser degree thermophoresis and will be significantly affected by the operation of containment sprays and passage through water Approved O* sign Material

• Probabikstic Risk Assessment (11/96) Page 19.1197

Design ControlDocument Srtem 80+

pools. Typical decontamination factors (DFs) associated with the use of sprays have median values ,

between 30 and 50. Passage of scrubbable fission products through the IRWST pool or a flooded cavity will have a decontamination factor of about 50, dependent upon pool temperature and depth, if the pool is deep and highly subcooled and between 6 and 10 if the pool is deep and near saturation.

These models are discussed below.

19.11.4.3.2.2.1 Effectiveness of Containment Sprays Sprays are effective in reducing the airborne concentration of elemental and paniculate iodines as well as other particulates, such as cesium. The reduction in airborne radioactivity within containment by a spray system as a function of time is expressed as an exponential reduction process, where the spray removal coefficient, lambda, is taken to be relatively constant over a large time interval. Typical sprays are capable of reducing the concentration of airborne activity by about 2 orders of magnitude for a time period of about 30 minutes. Once the bulk of the radioactivity has been removed, the spray becomes considerably less effective in reducing the remaining fission products.

The spray model used in S80SOR is scaled from the DF used for the Zion reference plant PRA. The scaling factor is conservatively taken to be proportional to the spray particulate removal coefficient, lambda, A.

Lambda, A, is related to the system spray parameters as follows (see Section 6.5.3.3):

h"23 hF V (3}

where:

h = full height of spray droplets V = containment building volume F = spray flow rate e/d is the ratio of a dimensionless collection efficiency factor to the average spray droplet diameter.

Typical values of particulate spray A's vary from 2 to 15 per incur. Overall spray removal coefficients including hydroscopic effects can increase the fission product removal lambda to be in excess of 70 per hour.

19.11.4.3.2.2.1.1 Application to S80SOR As a result of the greater flow to volume ratio inherent in the System 80+ spray system, spray decontamination factors and distributions were scaled upward by a ratio of 1.2 for all spray conditions.

19.11.4.3.2.2.1.2 MAAP Modeling Assumptions MAAP modeling of the aerosol removal capability of the sprays can be performed deterministically by providing the input values to all the parameters associated with A. In the MAAP analyses the sprays include 1000 micron droplets with a user input modeling collection efficiency of 0.02.

Approved Design Material Probabdistic Risk Assessment Page 19.11-98 I

System 80+ Design ControlDocument l 1

O 19.11.4.3.2.2.2 Pool Scrubbing Processes ,

Water pools provide an excellent means for scrubbing fission products. System 80+ utilizes this scrubbing concept in two facets of the design. First, all fission product releases discharged into the IRWST will be scrubbed by either a subcooled or saturated water pool which provides an average scrubbing depth of about 6 feet. Second, if the CFS has been actuated prior to VB all fission products released to the reactor cavity will be scrubbed in a water pool approximately 15 feet in depth. The effective decontamination factors (DFs) for pool scrubbing of overlying water pool are based on the work of Powers (Reference 197). The fission product scrubbing correlations developed ,

by Powers is provided in Reference 197 (See Figure 19.11.4.3-1). Scrubbing of fission products l L within the IRWST was considered to be similar to the scrubbing associated with the Grand Gulf Suppression pool "Downcomer Vents" (see Reference 200). For conservatism it was assumed that all scrubbing occurred as a result of large bubble releases in saturated water pools instead'of the more effective subcooled water pools. This assumption provided a conservative median pool scrubbing DF applied to IRWST discharges of 6.8.

19.11.4.3.2.3 Significance of Natural Deposition Processes A review of LACE (LWR Aerosol Containment Experiments) experiments LA2, LA4 and LA6 has shown that removal of aerosol particles from containment via natural mechanisms in steam atmospheres can be significant (Reference 199). During these three tests aerosols were injected into a preheated steam saturated atmosphere with either pre-existing or delayed leaks. By comparing the actual leakage to that would be expected without natural deposition mechanisms considered, it was

[ found that natural settling had accounted for a reduction of aerosol leakage by between 5 and 30. '

\ Specific values were dependent on the status and timing of the leak. It was concluded that for low leakage steel containments over a time period of 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />, natural aerosol removal process can reduce '

the total fission product leakage by more than a factor of 10.

19.11.4.3.2.4 Fission Product Retention and Filtering in the Secondary Containment The amulus ventilation system (AVS) filtration subsystems are used in System 80+ to reduce the radioactive aerosols and iodine released during the various postulated accidents. This system is designed as an Engineered Safety Feature (ESF). The AVS can provide considerable help in controlling fission product releases for certain severe accident scenarios where the containment remains intact. This is expected to involve approximately 90 per cent of the severe accident sequences. For much of the remaining events the ESF can serve as a useful filter for the early containment leakage portion of the event, up until the time of containment failure.

The System 80+ AVS is located in the secondary containment. For conditions where power is available to operate the filtration system, considerable quantities of fission products can be removed from the atmosphere. The AVS includes high efficiency particulate air (HEPA) filters in tandem with a charcoal absorber bed. The HEPA filters are designed to remove a minimum of 99% of the particulates entering the system. The charcoal absorber bed is designed to remove a minimum of 95% of elemental iodine and about 95% of organic iodines from the fission product releases. Ten percent of the annulus in-leakage can bypass the AVS filters. Operation of the annulus filtration and ventilation system will enable approximately 90% of the fission products released from the containment to be filtered. The remainder of the fission products are assumed to bypass these filters.

g) g" Filtration through the AVS was not considered for scenarios where the containment building is assumed to fail or for "V" sequences.

Anwovent Design Me0erant . Probahnseic RM Assessment (2195) Pe9e 19.11-99

Syst'm 80 + Design ControlDocument 19.11.4.3.3 Significance of DF Modeling to System 80+

System 80+ is designed to minimize fission product release to the containment atmosphere by passing all discharges from the pressurizer safety valves and RDS valves through piping submerged into a subcooled IRWST water pool. The effectiveness of fission product removal via overlying water pools can be significant. The Reactor Safety Study (WASH-1400) assumed the equivalent decontamination factor (DF) for a subcooled water pool to be 100, while saturated water pools were not credited for decontamination. More recent experimental evidence suggests that pool DFs can be larger for subcooled pools and that saturated pools (with lower DFs) can also significantly contribute to decontamination.

The cavity flooding system is also allowed to direct the IRWST liquid into the cavity to submerge, and cool the corium debris and scrub fission product releases should they occur.

The containment spray system is intended to both cool the containment atmosphere and scrub the atmosphere of fission products. This system has been designed to be highly reliable since it serves the combined heat removal function of the fan cooler / containment spray system of conventional PWRs. Sprays have been demonstrated to be highly effective in scrubbing particulate fission products and elemental iodine from the containment atmosphere.

In System 80+ pool scrubbing of fission products is assumed in the reactor cavity (Post VB) during CCI and for all IRWST discharges. Spray decontamination is also explicitly considered for System 80 + .

19.11.4.3.4 Application to the PRA The PRA estimates of the environmental releases from the containment are based on a combination of MAAP calculations and S80SOR assessments. MAAP models approximately incorporate all the above fission product release, retention and atmospheric depletion processes (with the exception of releases during DCH, which are not currently modeled but will play little role in System 80+). This information is used to adjust S80SOR predictions. System 80+ S80SOR airborne concentrations are applied to MACCS 1.5 and population dose estimates are established.

19.11.4.3.5 Summary In order to provide a realistic and comprehensive source term estimate for System 80+, the simplified XSOR approach adopted by NRC contractors for Reference Plant consequence analysis was modified and applied to System 80+ as S80SOR. Use of the S80SOR codes in establishing fission product releases provides a scrutable means of evaluating source terms and allows rapid source term evaluations for a large number of release classes. For the System 80+ PRA, approximately 40 release classes passed the final screening.

As was previously discussed, the role of MAAP in this arena was primarily to (1) provide information with regard to source term energetics and release timings, and (2) provide a deterministic basis for comparing S80SOR predictions.

19.11.4.4 System 80+ Severe Accident Management Issues This section discusses two specific aspects of Severe Accident Management for the System 80+

evolutionary PWR. These are:

Approved Design Material Probabkskc Risk Assessment Page 19.11-100

A System r0+ Design ControlDocument

/3 V 1. Equipment availability requirements for the management of recoverable and irrecoverable severe accidents, and

2. Severe Accident Management Guidance.

The focus of the equipment availability discussion is to define the minimum equipment required to be available to the reactor operator so that for scenarios where sufficient plant inventory and heat removal resources are available, he may maneuver a severely damaged plant into a safe stable shutdown condition. Similarly, a smaller equipment list is identified for conditions where the core damage sequence is considered irrecoverable. In this instance, the goal of the residual equipment would be to aid the operator in maintaining containment integrity. Qualification issues associated with survival of this equipment in these severe accident environments are also discussed.

An EPRI/NUMARC/ Owner's Group funded industry program is currently underway to establish accident management guidance (AMG) for the spectrum of existing PWRs and BWRs operating in the United States. This work is still underway for ABB-CE operating plants. Since many similarities exist with the existing ABB-CE PWR designs, the accident management programs for System 80+

and the existing PWRs are expected to be conceptually similar. However, because of this large ongoing ABB-CE AMG activity and in light of the fact that detailed NRC review of this program will occur independent of the System 80+ licensing effort, development of a prescriptive System 80+

specific procedure is considered premature at this time. This section will address itself to the general structure and key elements of the System 80+ AMG. Specifically, this section includes Severe Accident Guidance for the operation of evolutionary severe accident mitigation equipment such as the Rapid Depressurization valves, hydrogen igniters and the Cavity Flood System (CFS) and their i interface with the System 80+ Emergency Operations Guidelines (EOGs). Additional detail on this j subject can be found in Appendix A to the EOG.

19.11.4.4.1 Equipment Availability for Recoverable Beyond Design Basis Accidents Following the accident at TMI, the NRC issued several Regulatory requirements directing operating plants and those to be constructed to ensure that an adequate equipment set (including instrumentation) is available to the plant operating staff so that if adequate plant resources are available following the initiation of a beyond design basis transient, the plant may be maneuvered into a safe stable state (see Section 7.5.1.1.7).

Recoverable severe accident scenarios may arise frora any of a number of core damage sequences with recovery of vital equipment (e.g. power buses, SI pumps, etc.) or correction of misdirected operator actions within sufficient time to preclude vessel breach. These scenarios are typically categorized as events resulting in inadequate core cooling (ICC). This guidance was captured in Regulatory Guide 1.97 and was applicable to all operating PWRs and BWRs. The ICC instrumentation is summarized in Chapter 3. In addition. future large dry PWRs were required to also address additional regulations contained within 10CFR50.34(f) and associated applicable guidance contained within letters SECY-904i6 and SECY-93-087. These documents require that a reasonable level of assurance be provided to demonstrate that sufficient instrumentation and equipment will survive the consequences of a severe accident and will be available to the operator so that he may recover from and trend severe core damage sequences, including those scenarios which result in 100% oxidation of the active fuel cladding.

q s

') In order for the operator to utilize previously available equipment or make necessary assessments to take mitigative action following an inadvertent onset of core damage, the operator must have AMweved Des &rt Matenleh Probab6stic Misk Assessmerrt (11/961 page 19.11.to1

Syatem 80+ Design ControlDocument available, at the very minimum, instrumentation necessary for ensuring that vital safety functions (i.e., RCS inventory control, core heat removal, reactivity control and containment integrity) are successfully being accomplished, and the required equipment necessary to maintain the plant in a safe stable state.

System 80+ is designed to reduce the frequency of reaching a core damage condition to a very low level. Therefore, when one considers reccvery from a severe accident, it should be recognized that numerous safety systems and non-safety systems have either mechanically failed or otherwise have become inoperable. Thus, recovery from these low probability accident scenarios typically requires recovery of highly reliable vital equipment that have already failed or are otherwise unavailable.

Therefore, recovery from severe accidents will be more likely to occur for the slower core uncovery transients (such as, loss of feedwater ri$ 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> battery depletion) than fos large LOCAs when core uncovery and the onset of the core melt progression are rapid. It should be further be noted that the System 80+ PRA conservatively neglects the potential for "in-vessel" recovery.

It is the purpose of this section to demonstrate compliance of the System 80+ design with equipment survivability subsections of 10CFR50.34(f), SECY-90-016 and SECY-93-087.

19.11.4.4.1.1 Definition of Safety Functions In the midst of a core damage sequence, operators are confronted with multiple failures of essential safety equipment and/or operator errors which have resulted in a damaged core condition. If the operator is to effectively cope with this plant condition and protect the general welfare of the public, he must be provided with an equipment subset that he can be trained to use and interpret, with the -

ultimate goal of achieving an "in-vessel" safe stable state. As discussed above. in this context a safe stable state requires:

1. RCS Inventory Control

2. RCS licat Removal

3. Reactivity Control

4. Containment Integrity 19.11.4.4.1.1.1 RCS Inventory Control The goal of the RCS inventory control safety function is to assure that a continuous and inexhaustible supply of water can be delivered to the RCS so that the core region will be covered. Inventory control is primarily provided via the System 80+ SI System (see Section 6.3). Should the SI system not be available and the RCS has depressurized below about 200 psia, inventory control can also be provided via a realigmnent of the containment spray or shutdown cooling system pumps to operate in an injection mode. This later method of inventory control was not credited in the PRA as a success path in conjunction with Rapid Depressurization valve actuation.

19.11.4.4.1.1.2 RCS IIcat Removal Successful RCS heat removal requires that a pathway be developed to reject heat from the RCS. ,

Typical RCS heat removal pathways following a severe accident scenario will probably be through the steam generators via the establishment of EFW to at least one steam generator or Once Through Core Asyvend Design Meteriel- Probab&stic Risk Assessment Page 19.11 102

l l

System 80+ Deskn ControlD:cument  !

Cooling (OTCC), where the operator feeds liquid inventory in the RCS via Sl and bleeds off steam d and/or water (also known as, Feed and Bleed). Once a sufficiently low pressure has been established in the RCS, long-term heat removal can also be accomplished via the Shutdown Cooling System using a either SCS or CS pumps and associated heat exchangers.

19.11.4.4.1.1.3 Reactivity Control j Since core recovery may occur with a nearly intact core geometry, it is important that the core be i prevented from achieving criticality. A return to criticality under these circumstances will likely strain the meager plant inventory and heat removal capabilities and compromise the establishment of a safe stable state. Reactivity control is provided by insertion of control rods and assuring the delivery ,

of sufficiently borated water into the RCS. Reactivity control is typically assured early in the transient via insertion of control rods.

19.11.4.4.1.1.4 Containment Integrity l Containment integrity is necessary to prevent significant radioactivity releases to the environment.

l Given that the highly reliable containment isolation systems function, containment integrity for the System 80+ containment requires that pressure and temperature challenges within the containment  ;

have a low probability of causing containment failure. If partial operation of one train of containment sprays can be guaranteed, most containment threats can be averted. If sprays are non-functional for an ,

"in-vessel" recoverable sequence and the RCS continues to reject heat to the containment, containment-failure cannot be averted unless the containment heat removal function is restored. For "in vessel" I p recoverable sequences with sprays available, the only containment threat is that associated with

V hydrogen combustion. Analyses show that even under these adverse circumstances the conditional containment failure threat associated with hydrogen combustion is very small.

l 19.11.4.4.1.2 Instrumentation / Equipment Requirements in Support of "in-Vessel" Recovery To enable the operator to have the opportunity to maneuver the plant from a core damage state to a safe stable state where the core is indefinitely retained "in-vessel", the operating staff requires the use of a set of vital equipment and key instruments. The vital equipment is necessary to ensure that adequate inventory and heat removal can be provided to the RCS, reactivity control is maintained and that containment heat removal via sprays is functional. Instrumentation is required to allow the operator to confirm and trend the results of actions taken. This section defines the "short list" of instrumentation and equipment, its potential severe accident operating environment, and identifies the manner in which the operator will be expected to use this data.

19.11.4.4.1.2.1 RCS Inventory Control in its simplest view, success of the inventory control safety function ensures that the core is covered and cooled. In conjunction with successful RCS and containment heat removal a covered core can be retained in a safe stable state indefinitely. In order to achieve inventory control the operator must have an inexhaustible source of water and a pathway to deliver the water to the RCS. In order for the operator to monitor his use of scarce plant resources, instrumentation must be available to confirm thi.t the inventory control function is being accomplished and the resulting observable behavior is as cxpected.

Invento y control can be established in many ways. The selection of the method of inventory control I will be based on the initiating event and the plant resources available at that time. Typical Annremf Den &n hierariel. hobahneeic Risk Assessment Page 19.11 103 l

1

)

____________s

System 80+ Design ControlDocument mechanisms for inventory control include (1) isolation of the leak (if possible) and/or (2) delivery of water to the RCS. Potential pathways for delivery of water for the RCS makeup are:

1. SI system via injection of IRWST water,

2. Shutdown Cooling System (Iow pressure delivery), and under certain circumstances

3. CVCS via charging (this provides a high pressure injection).

For inventory control to be successful, the required pump must be powered and functional, the inventory water source must be continuously available, the necessary piping from the suction to RCS discharge mt.st be open and the RCS pressure must be below the discharge head of the pump and the delivery must be of sufficient capacity to match RCS boiloff.

Once a recovery pathway has been selected, sufficient instrumentation must be available to the operator so that he may trend the recovery, and confirm the appropriateness of his actions. For System 80+ the core recovery function can be monitored either directly (through level measurements) or indirectly (through temperature measurements) depending on the status of the transient prior to recovery and the details of the initiating event. The devices for monitoring the inventory control function include:

1. RVLMS (Reactor Vessel Level Monitoring System), which includes two HJTC probes and two separate and redundant differential pressure sensors.

2. CETs (Core Exit Thermocouples)

3. Cold / Hot Leg RTDs (Resistive Temperature Devices)

The two IUTC sensors, the CETs and the RTDs are included in the System 80+ Inadequate Core Cooling Instmmentation package and satisfy the intent of NUREG-0737,Section II.F.2 (see Section 7.5.1.1.7).

In addition to monitoring instrumentation sufficient equipment must exist so as to ensure inventory delivery to the RCS (see also 19.11.4.4.1.2.2).

The HJTC probes are designed to monitor the RV collapsed liquid level above the fuel alignment plate. This level is sensed by a high temperature difference between two thermocouples, one of which has an electrically heated junction (IUTC) the other is unheated (UHJTC). Once covered with water the IUTC temperature drops to within several degrees of the unheated thermocouple and hence a positive indication of water level is established. These probes can be used to confirm the presence of water in the upper plenum and hence that the core is covered and cooled at the very least, via a two phase mixture.

Temperature sensing devices (such as, CETs, RTDs and the unheated junction of each HJTC probe

[UHJTC) devices) indirectly measure liquid inventory by monitoring its effect on steam temperature.

In essence the thermocouples serve a combined role of indicating both RCS inventory control and heat removal. Sustained increasing UlUTC, CET and/or RTD temperatures are indicative of an uncontrolled core heatup and inadequate inventory. Conversely, if temperatures in the RCS are trending downward, core recovery is likely in progress.

Approved Design Material Probabmstic Risk Assessment Page 19.11-104

System 80 + Design ControlDocument 1

,m In addition to the above level / tempetature monitors, RCS pressure instrumentation should also be j (v} available to ensure that the operator selection of the inventory source is compatible with a subcooled j or saturated condition. RCS pressure instrumentation will also enable the operator to better j understand the course of the transient by using both the RCS pressure and core exit temperature to arrive at an estimate of the departure of the system from a saturated thermodynamic condition.

Instrumentation for use in monitoring RCS inventory is relatively robust and can be expected to survive a wide range of beyond design basis conditions. Thermocouples and RTDs are expected to  !

provide useful information to the operator until their respective temperature limits are exceeded; about 2300'F for Type K thermocouples typically procured for "in-vessel

• applications and 750*F for RTDs. Measured temperatures in this range are associated with significant core uncovery and should encompass a wide range of recoverable severe accidents. (RTDs are actually functional to 1000*F; however, signal processing will not be directly available to the operator at temperatures in excess of 750' F.). The availability of all these trending instruments may decrease as the event unfolds and core degradation proceeds. Based on MAAP 3.0B evaluations of a typical core melt progression, it is expected that the hot leg RTDs will be overranged shortly after core uncovery. In practice, these devices will still be functional after core uncovery provided the sensing element does not exceed approximately 1000*F. After considerable core degradation, loss of core geometry will also be associated with failure of CETs (which pass through the core) and the likely failure of hot leg RTDs and the portion of the IUTC located in the System 80+ upper plenum. However, even under severe core damage condition with clad oxidation limits up to 100% of the active clad, many UHJTCs will survive the recoverable severe accident due to the remote location of the upper RVLMS UHJTCs in the upper head / upper guide structure region of RV and its low flow environment which both shields the upper IUTC probe from high temperature steam and protects it from a highly convective / radiation p)

( environment associated with the RV regions below the upper guide structure support plate. Thus, for the complete gamut of severe accidents, indication of RV inventory can be reasonably expected.

While survival of the UIUTCs may continue following VB, they provide no useful frction at that time.

19.11.4.4.1.2.2 RCS Heat Removal j The heat removal pathways to be utilized following a severe accident condition will vary based upon the initiating transient, and the current availability of inventory sources and heat sinks. The potential mechanisms for RCS heat removal include:

1. Heat removal via the Steam Generator

2. Once Through Core Cooling (OTCC) or Feed and Bleed

3. Shutdown Cooling via Residual Heat Removal The overall goal of removing heat generated in the primary system and transferring the energy to an l ultimate heat sink can be accomplished via several avenues. However, the selection of the optimum approach for a given scenario will depend upon many factors including whether or not the RCS leak is isolable, how soon in the transient the recovery can proceed, the RCS pressure at the time of l l

equipment recovery and equipment availability.

73 Heat removal via steam generators is the preferred mode of recovery and depressurization provided V the RCS is intact or has a small leak. For these scenarios, the operator will use the steam generators to reduce the RCS pressure to the shutdown cooling entry condition and initiate shutdown cooling.

Approved Design Matenial- Prob.ebmstic Misk Assessment Page 19.11-105 '

l

System 80+ Design Control Document l

l This requires that sufficient instrumentation be available for the operator to control RCS pressure, temperature and SG level. These instruments are expected to be available during the course of a severe accident.

For events where SG heat removal has been lost and cannot be teetablished (such as a TLOFW), the operator has the option of converting the TLOFW event into a medium LOCA by opening the Rapid Depressurization valves. The purpose of this action is to reduce RCS pressure so that the SI, (if available) and eventually the SITS will inject into the RCS. Once the RCS is depressurized, the SIS (if available) will provide permanent inventory control. This cooling method is referred to as either Feed and Bleed or Once Through Core Cooling. For Feed and Bleed to be established in this manner requires both an inventory source (Feed) and a steam relief path (" Bleed"). The bleed path may be established remotely by operator via the opening of Rapid Depressurization valves or the bleed path may pre-exist as a result of an RCS piping failure.

An indication of RCS pressure is necessary to confirm that SI can deliver against the system pressure.

Following a TLOFW event, operation of the RD valves is stipulated in the EOGs to occur prior to core damage. Without operation of the RD valves, a TLOFW would maintain the RCS at high pressure while depleting the RCS inventory, preventing SI inventory makeup until a " creep induced" failure of RCS piping develops. In either event adequate pressure relief is expected so that available SI pumps can begin to inject into the RCS and potentially terminate the core melt progression.

If a pre-existing or " creep induced" steam relief path develops, RCS heat removal requires use of the Si to provide sufficient inventory to cover and cool the core. In this circumstance RCS pressure will be monitored to assure that an RCS pressure sufficiently below the SI shutoff head and valve positions indicative of an open delivery path exist.

The success of the RCS heat removal process can be monitored via any temperature sensing equipment including the CETs, RTDs and the unheated junction thermocouples of the HJTC probes.

19.11.4.4.1.2.3 Reactivity Control Following recovery from a severe accident, the core geometry may be sufficiently intact so that reactivity control may be required to ensure the nuclear chain reaction remains permanently shut down. To establish reactivity control, control rods must be inserted and a borated water source is needed. Boration can be provided to the RCS via either the CVCS system (through charging) or the Si system (via injection of IRWST water). Reactivity control is confirmed via control rod position indicators, and instrumentation associated with inventory delivery.

19.11.4.4.1.2.4 Containment Integrity System 80+ is robust to most containment challenges. Successful operation of the spray system eliminates the risk of containment failure due to overpressure transients. If the RV is to remain intact, the only remaining risk of containment failure is associated with a hydrogen burn.

l Deterministic analyses performed for System 80+ demonstrate that even when subjected to an AICC hydrogen burn associated with the oxidation of 100% of the active cladding, the resulting pressure rise will be far below that of the containment's ASME Service Level C rating. Use of igniters further reduce this risk. The HMS has been qualified in accordance with the requirements of 10CFR50.34(f). To ensure a high reliability of the HMS, overall system operability requirements are also included in the plant technical specifications.

Approved Design Matenet- Probabaistsc Risk Assessment Page 19.11 106

I I

Sy~ tem 80 + Design ControlDocument n

( j.) 19.11.4.4.1.3 Summary of Required Instrumentation and Equipment A summary of the minimum instrumentation and equipment necessary to function during a severe accident, consistent with 10CFR50.34(f), is presented in Tables 19.11.4.4-1 and 19.11.4.4-2. l Instrumentation that will be useful in helping an operator recover from a severe accident include:

1. RCS Temperature Monitoring via either HJTC probe UliJTCs, Hot and Cold Leg RTDs, or CETs,

2. RCS Pressure Monitoring via either RCS or Pressurizer Pressure Indicators,

3. SG Water Level indicator,

4. IRWST Water Level Indicator,

5. Containment Pressure Indicator,

6. Containment Temperature Indicator,

7. Containment 11ydrogen Concentration Monitor, and O

(V 8. Containment Radiation Monitor.

Included it: the instrument system are the instrument sensor and its associated cables, terminals and junction boxr.s.

Items 1 thru 3 represent instruments that are required only for "in-vessel" recovery sequences. These instruments are not required to survive the post-VB containment atmosphere. The IRWST water level, containment temperature and pressure sensors and containment radiation and hydrogen monitoring will continue to provide useful information to the operator even after VB and should have a reasonable expectation of survivability in a post-VB environment.

Equipment that should be able to function in the severe accident environments include:

1. Containment penetrations, airlock, hatch seals, electrical / mechanical penetrations.

2. Containment Sprays / Spray }{eader, heat exchanger and Piping and associated valves and heat sinks.

3. SDS valves and Actuation Circuitry of this system is intended to be activated prior to core uncovery.

4. SIS and EFWS including valve position Indicators and/or Flow indicators for water delivery flow paths 'to RCS, containment and steam generator (for "in-vessel" recovery sequences).

k/ 5. liydrogen Mitigation System, including igniters, IRWST vents, associated cabling, transformers and power sources.

Aptwomnt Design nesterial 94obabnstic Risk Assessment (2/95) l' age 19.11 107

i System 80+ Design ControlDocument

6. Cavity Flooding System including all valves, actuators and valve position indicators. This system is to be actuated prior to VB. l 1

While availability of additional equipment would be useful and is expected for most severe accident l scenarios, its use in severe accident mitigation is not essential to the operator.

l 19.11.4.4.1.4 Severe Accident Instrumentation Survivability Severe accidents are very low probability events. Accordingly, in SECY-93-087 (Reference 116), the NRC has recommended to the Commission that this equipment need not be subject to the environmental qualification requirements of 10CFR50.49, quality assurance requirements of 10CFR50 Appendix B; and the redundancy / diversity requirements of 10CFR50 Appendix A. This position has been subsequently accepted by the ACRS. It is practical to define the capabilities of the instrumentation required to achieve a safe shutdown and to establish a qualification regimen that would provide reasonable assurance that there is a high likelihood that vital equipment / instrumentation would operate during the vast majority of severe accidents.

19.11.4.4.1.4.1 Approach to System 80+ Equipment Survivability Section 3.11 and Appendix 3.11A present the environmental conditions for meeting the equipment qualification requirements of 10CFR50.49 and 10CFR50 Appendices A and B. While these instmment qualification conditions do nc h~md the locus of all severe accident damage states, there is considerable evidence that the conservative nature of the Design Basis LOCA and Main Steam Line Hreak Appendix B, Class IE environments results in reasonable assurance that the instrumentation will survive a recoverable severe accident. This assertion is generally valid even when the hypothetical, 10CFR50.34 (post TM1 requirements) 100% cladding oxidation requirement is considered.

It is the intent of this section to define the internal vessel and containment envirotunents associated with recoverable severe accidents (with consideration of a potential 100% cladding oxidation) and to demonstrate that the System 80+ Class IE qualified nuclear equipment is expected to perform adequately in the resulting recoverable (as well as, unrecoverable) severe accident environment. This assessment is based on the following:

1. Severe Environment Experiments demonstrate the ability of a wide spectrum of design basis event (Class IE) qualified equipment to survive severe thermal environments, including the effects of hydrogen burns and zirconium oxidation.

2. Some of the equipment / instruments needed by the operator are expected to be available due to their location outside the containment building which limits the exposure to the severe accident environment.

3. For selected equipment, severe accident survival will be enhanced for System 80+ by providing appropriate thermal radiation equipment protection, siting instructions and requirements which better enable the equipment to function in harsh environments.

4. Analytical evaluations of expected and bounding severe accident environments.

The observations are discussed in detail below.

A lvvoved Design Material. Probabikstic Risk Assessment page 19.11 108

1 1

' System 80+ Design ControlDocument i

19.11.4.4.1.4.2 Equipment Survivability Experiments in assessing the survivability of instruments and equipment exposed to a severe accident environment i the following environmental parameters are normally considered: l

1. Temperature i

2. Pressure

3. ' Moisture / humidity 1 J

4. ~ Radiation field In addition, timing of the event (short spike, versus steady source) is also important. Following TMI- l 2, several test programs were performed to investigate the survivability of equipment exposed to environments with one or more adverse environmental conditions. j o NTS Experiments (EPRI) (Reference 117) i A large scale hydrogen burn test program was undertaken by EPRI at the Sandia National Laboratory Nevada Test Site (NTS). The NTS is a 74,000 ft3 dewar. Deflagrations of hydrogen concentration up to 13 volume-percent were studied. These tests included i i

experiments which exposed nuclear-qualified safety equipment to hydrogen burns of varying p severity in a large vessel. The safety equipment samples tested in the EPRI-NTS tests were powered and their operation was monitored during and after exposure to hydrogen burns.

( Tests included large single burn temperatures of 2000*F and pressures in excess of 100 psia.  !

For continuous ignition tests the temperature chamber was between 420'F and 800*F for a l' period of 10 to 20 minutes. Equipment studied included pressure and temperature transducers, instrument cables and associated connectors, valves, switches, containment penetrations and glow plug igniters. The authors of Reference 231 concluded that, "The study showed that equipment qualified to operate under LOCA conditions should be able to operate during and after high temperature spikes produced by hydrogen burns... Despite substantial external damage to the cables, only those with pre-existing defects or cumulative damage from many burns failed." No degradation of operability of equipment was noted in 99.6% of the post-test checks (Reference 117).

e Sandia Central Receiver Test Facility (CRTF) (Reference 1J'"

i A series of equipment survivability tests, simulating one of se most severe NTS experiments were performed at the CRTF. These tests investigated operational and thermal responses of a nuclear qualified pressure transmitter, solenoid valve and three brands of nuclear qualified cable. In the first test series, all equipment was unaged. Consistent with the NTS tests, all equipment functioned during and after testing.

l A second series of CRTF tests specifically investigated etfects of aging on nuclear qualified cables and pressure transmitters. Tests included exposure to heat fluxes three times as severe

- ._ as that experienced by a 13% hydrogen burn. All cables maintained their electrical integrity

/ during exposure with only one failure out of thirty (30) noted during post exposure insulation

[s testing. Tested transmitters functioned properly throughout the tests.

Ammar Danon nenuter. nosasmer met anusment rese ss.:s. sos a._ -. ._ - -

System 80+ Design ControlDocument

• Severe Combined Environment Test Chambers (SCETCh) (References 117,229, and 232).

These tests extended the qualification of nuclear qualified pressure transmitters and cables by exposing them to a simulated LOCA/ hydrogen burn environment in a large dry PWR (References 229 and 232). Experimental conditions were established by hydrogen burn analyses performed for Zion and TMI-2. These plants represent high power density large dry PWRs with potential hydrogen concentrations similar to that of System 80+. The SCETCh included a simulation of the computed environment via simulation of burn heat flux, pressure pulse, humidity and oxygen concentration. Environments associated with a single burn and those predicted to be associated with multiple burns (as identified by HECTR calculations of deliberate ignition) were simulated. Typical peak burn temperatures simulated reached 1200*F and lasted approximately 20 seconds.

SCETCh Sincle Burn Test

1. Cable Tests Cable Survivability tests were performed by maintaining a LOCA environment (approximately 185'F corresponding to a 30 volume percent steam mixture) for 4.4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. At that time a simulated burn was initiated (the burn lasted approximately 20 seconds). Following the burn the LOCA envirorunent was resumed for another 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. Inspection of the cable after the test confirmed that the cable is capable of surviving a single hydrogen deflagration initiated from a saturated steam environment.

Since burns are limited by the steam concentration, burns superimposed at initial temperatures greater than about 250*F are unlikely for System 80+ due to mixture flammability considerations.

2. Transmitter Tests Tests similar to that described above were conducted for a Barton 763 pressure transmitter. This transmitter is similar to most of the nuclear qualified pressure trans-mitters available in the nuclear industry. Results of these tests demonstrated the ability of the pressure sensor to survive a combined LOCA/ burn environment.

SCETCh Multiple Burn Tests These tests were intended to demonstrate the response of this equipment with a deliberate ignition environment, characterized by multiple hydrogen burns. A simulated environment with 59 individual low concentration hydrogen burns was defined. The results indicated that multiple burns could elevate the equipment tempereture to failure.

The pressure transmitter was found to survive about 20 repetitive simulated calculated burns prior to failure.

• IICOG 1/4 Scale Test Facility (References 222 thru 224)

These tests were performed by the BWR Hydrogen Control Owner's Group (IICOG) to both validate the llCOG igniter system and to establish anticipated containment environments for severe accidents where a hydrogen igniter system is activated. Additional details of this test program can be found in References 222 and 223. These tests are of considerable interest to Approved Design Materies Probabikstic Risk Assessment Pege 19.11-110

System 80+ Design ControlDocument System 80+, since the 1/4 scale experiments included tests with hydrogen discharge directly

(") to a suppression pool (analogous to the System 80+ IRWST) and employed hydrogen release rates generally prototypical of System 80+ (See Appendix 19.11K). Operation of hydrogen igniter system (HIS) was not observed to result in discrete repetitive pressure and temperature spikes, as was initially predicted via computer simulations. Instead, the hydrogen igniter system consumed the evolved hydrogen continuously with only marginal pressere and temperature excursions. Typical containment environments indicated that caainment temperatures (even in the vicinity of igniters) were typically below 350*F. In the NRC SER on the HCOG experiments (Reference 224), it was noted that thermal conditions measured as close as 15 inches above and 6 inches laterally away from the igniter were no more severe than recordings several feet away. This observation was further supported by a test which included a thermocouple measurement I foot above the pool surface, directly above an active sparger. The temperature response did not exceed 425'F as a result of pool flames.

This suggests that sustained high temperatures will not be established in regions of localized combustion. These results indicate that the local influence of igniters for a full scale system would be less than 5 feet (4 times the 1.25 foot localized influence observed).

• Qualification Testing for Nuclear Qualified Instrumentation Duke Power Company has previously selected and designed equipment to survive environments with anticipated hydrogen burns (Reference 225). Survivability of cables was established via a combination of experimentation and analysis. Cables investigated included ,

~

core exit thermocouple (CET) cables, RTD signal cable and hydrogen igniter cables.

(] l V CET Cable Survivability Analysis l

LOCA qualified cables are validated for an 8-hour exposure at 346'F. Analyses of a hydrogen burning transient indicate that cables will not exceed temperatures greater than 385'F at the outer stainless steel sheath of the insulated cable and that the layer of insulation underneath the armor was 338'F and is thus enveloped by the ice condenser PWR LOCA qualification temperature. CET cables are typically similar to other lower compartment cables.

RTD Cables RTD signals are typically transmitted via two cables; one supplied by the vendor which attaches directly to the device and a signal transmission cable supplied by the purchaser.

RTD cables supplied by Duke were established to survive a 6-hour exposure to 346*F LOCA temperatures. The cable was also observed to survive a temperature excursion representative of a hydrogen burn. Duke tests were not adequate to demonstrate survivability of the ver. dor supplied cable. However, tests performed for the Sequoyah Nuclear Power Plant (Reference 226) indicated that cable was capable of surviving repeated exposure to temperatures of 1400*F without impairment of its dielectric strength. This test program was reviewed and accepted by NRC.

HIS Cables n

U Cables currently used for typical existing hydrogen igniter systems are constructed of high temperature reinforced mica, and are overall glass braid encased. These cables are designed Approved Design historial- ProbabMstic Risk Assessment Page 19.11 111

System 80+ Design ControlDocument for operation during a 45-minute continuous burn at 1200'F. Under these exposure conditions, cable temperatures did not exceed 700*F. This indicates this type of cable is robust for its application and has a substantial margin for survivability. Igniter c_sles used for System 80+ will also be expected to perform under these design conditions.

19.11.4.4.1.4.3 Comments Regarding Expected Containment Emironments for Unrecoverable and Recoverable Severe Accidents For purposes of ensuring equipment / instrument survivability during severe accidents, two severe accident environments are defined. These are classified as pre-vessel breach (pre-VB) and post-vessel breach (post-VB). In the pre-VB environment, the RV lower head is considered to be intact. This condition is a prerequisite for "in vessel" recovery. The pre-VB environment is applied to all equipment necessary to achieve and maintain a safe shutdown of the PWR and consists of two components; one in vessel (internal to the RV) and one ex-vessel (associated with the containment during the time frame the RV lower head is intact). The post-VB environment is typically associated with a more restncted instrument list and a containment environment which may be more harsh than earlier in the sequence (that is, sustained higher temperature, pressure and radiation fields).

Whereas the role of the equipment and environment prior to VB was safe shutdown, post-VB the required equipment is intended to mitigate and/or prevent containment failure.

Temperature / pressure environments have been established in System 80+ based on a survey of MAAP analyses performed to support the PRA. All environments are associated with 100%

humidity. These environments and associated instruments are discussed below. Radiation environments are discussed in Section 19.11.4.4.1.4.5.

19.11.4.4.1.4.3.1 Pre-VB Severe Accident Environment 19.11.4.4.1.4.3.1.a Equipment and Instrumentation Required for Safe-Shutdown The equipment and instrumentation required for achieving and maintaining a safe-shutdown condition reside at various positions within the System 80+ plant and include locations (a) within the RV, (b) inside the containment and (c) inside the subsphere/ nuclear annex. The equipment / instrumentation identified in Table 19.11.4.4-1 and -2 (minimum instrument / equipment lists) are located as follows:

Equipment located within the RV

• UlDTC of HJTC probes Equipment located within the Containment and attached to the RCS via instrument tubing / piping

• RCS pressure transmitters or pressurizer pressure transmitters

• Safety Depressurization System (Rapid Depressurization valves and piping)

Equipment located within the containment, but not directly connected to the primary system,

• SG water level pressure transmitters

• High level Radiation Monitors Approved Design Materiet - hababinishc Risk Assessment Page 19.11-112

Deslan ControlDocument l

4 System 80+

e. Hydrogen Igniters  ;

e- Containment Temperature RTDs o Cavity Flooding System e

Containment Isolation System  :

t 1

e ~ Containment Penetrations i

Instmmentation/ Equipment located in Subsphere/ Nuclear Annex IRWST Water Level Transmitters i

e Hydrogen Monitors j i -e Containment Pressure Transmitters j

e SI, EFW, CS Systems 1

e Post Accident Sampling System (PASS) 19.11.4.4.1.4.3.1.b "In-Vessel" Environment Prior to VB 0

v MAAP analyses of System 80+ have been used to estimate the "in-vessel" thermodynamic conditions  ;

, prior to VB for a spectrum of severe accidents. To maximize hydrogen generation in the reactor vessel, MAAP parameters were set to:

I

1. Turn off blockage model

2. Use "two-sided" oxidation model

3. Extend time of vessel breach j f

in these analyses, oxidation levels reached 70% of the active cladding (see Table 19.11.4.1.3 2).

Based on these calculations, peak pre-VB temperatures varied significantly around the RCS. _ Of particular concern to equipment survivability are the temperatures in the region of the HJTC probe UHJTCs and the RCS and pressurizer pressure taps. As a result of the remote location of the upper portion of the HJTC probe UHJTCs, and the massive nature of the upper head internal structures, temperatures are expected to be below 1600*F. regardless of the severe accident transient. In the above calculation, the oxidation of the zircaloy was limited by availability of water within the reactor vessel. Extrapolating the results of the base analysis to accommodate a water source sufficient to oxidize 100% of the active zircaloy cladding, critical temperatures in the RCS were established. For

- high pressure RCS scenarios, water is expected to remain in the loop seal. Thus, temperatures in the cold legs will remain below 700'F. Temperatures in the pressurizer are found to be transient i dependent. For transients with flow through the pressurizer (SDS activated or PSV cycling) the peak pressurizer temperature prior to VB-will be between 1000*F and 1200*F. For all other transients

/7 pressurizer temperatures are expected to be below 700*F. .

U l Aduseovest Deepe asseerdet-hetehissafe Adsk a-==eent pope vs.Tr.11.1 i

_.._ , _ . _ , - i

System 80+ Design Control Document In addition to instrument interfaces, the SDS also interfaces with the RV. The Rapid Depressurization valves are positioned approximately 20 feet away from the top of the pressurizer.

Both regions tend to be isolated from the very high temperature core environment that may accompany a core melt and result in high expected availability for the equipment well into a degraded core scenario. Thus, valve temperatures environments prior to operation are likely to be low, due to the poor convective environment in the dead ended piping and the relatively large thermal capacity of the valve and piping.

The peak local RCS temperatures are typically associated with gross core disruption, core relocation and high temperatures of the RCS hot legs or surge line. At these times, structural temperatures in the vicinity of the hot leg / surge line are expected to be sufficiently large so that for high pressure accident scenarios mechanical failure of RCS connecting piping is imminent. " Creep induced" rupture can rapidly depressurize the RCS to near containment pressures and mitigate the RCS thermal environment. This induced depressurization may allow re-introduction of SI (if available). For certain scenarios, this may provide sufficient coolant to terminate the transient and arrest the accident "in vessel". Even following this limiting sequence RCS temperature / pressure trending is expected to be available via the upper head UHJTC and RCS pressure measurements.

As a result of the above analyses maximum "In-Vessel" thermal-hydraulic conditions during a recoverable severe accident are presented in Table 19.11.4.4-3.

19.11.4.4.1.4.3.1.c "In Containment" Environment Prior to VB During the "In-Vessel" degradation process associated with a severe accident, the containment is likely to become the recipient of the lost RCS inventory and much of the hydrogen produced during the core heatup. (For SGTR events and "V" sequences, much of the steam and hydrogen produced during the transient can bypass the containment.) In order for equipment to survive a recoverable severe accident the components of the required systems must survive both the "In-Vessel" and

" containment" environments (where applicable). MAAP analyses of containment environments for a spectrum of System 80+ transients with a functioning igniter system indicates that regardless of the event initiation Pre-VB containment pressure and temperature conditions are bounded by the design basis equipment qualification defined in Section 3.11 provided the region is not in the immediate l vicinity of an igniter and/or a hydrogen source (See Table 19.11.4.4-4). A summary of pre-VB local and global containment conditions can be found in Tables 19.11.4.4-5A and B. These conditions apply for the full spectrum of recoverable severe accidents at locations away from dominant hydrogen Dow paths and about 10 ft. from the igniters.

19.11.4.4.1.4.3.1.d Pre-VB Contaimnent Environment Associated with 100% Cladding Oxidation In accordance with 10CFR50.34(f)(2)(ix)(c), future PWRs are required to provide reasonable assurance that equipment required to achieve and maintain a safe shutdown condition be available throughout a recoverable severe accident scenario and survive the environmental conditions attendent with the release of hydrogen generated by the equivalent of a 100% oxidation of the active fuel cladding. In practice, achieving this limit is prevented by the unavailability of a water source, which is also associated with core heatup. It is the intent of this requirement to demonstrate the robustness of the equipment to survive a severe accident. The ability of the "in vessel" equipment to survive the 100% oxidation thermal / hydraulic environment is addressed in Section 19.11.4.4.1.4.3.1.b.

Approved Design Material ProbabHistic Risk Assessment i11/96) Page 19.11-114

System 80+ Design ControlDocument

(] This section defines the containment environment associated with the combustion of hydrogen l V resulting from the equivalent of 100% oxidation of the active fuel cladding for bounding accidents where (1) igniters are functioning (local burning scenario), (2) igniters are artificially defeated early in ,

the accident (condensation induced global burn), and (3) containment temperature increases resulting  !

from energy releases associated with the exothermic zirconium - water reaction. l l

Case 1: Igniters Function to Control Hydrogen Concentration in this analysis, hydrogen is generated in the RCS until the equivalent 100% of the active cladding is oxidized. This hydrogen is released as it is generated and depending on the release location, either directed towards the IRWST and/or containment. To realistically model the igniter placement, a detailed MAAP 4 simulation of System 80+ containment was constructed. A discussion of the resulting analyses performed with this model is presented in Section 7.2 of Appendix 19.llK.

Results of these analyses were in qualitative agreement of observations made during the HCOG 1:4 scale Mark 111 igniter system experiment. These experiments demonstrated that a functioning igniter system was able to consume sufficient hydrogen so as to render the burning process benign except in local regions immediately adjacent to hydrogen sources. In the vicinity of the hydrogen sources, HCOG data indicated a continuous hydrogen consumption with local igniter effects dissipating about 1.25 foot from the active igniter (this corresponds to approximately 5 feet at full scale). MAAP 4 analyses of the HCOG data were not performed. However, MAAP 4 analyses of the System 80+

igniter system indicated similar trends to that observed in HCOG. That is, 1

p 1. containment temperatures away from hydrogen source regions were benign (below 330*F).

(' 2. burning occurred at low hydrogen concentrations with long term hydrogen concentrations controlled near 5 volume percent.

3. contairunent pressures during igniter operation could be maintained below 50 psia.

Thus, environmental conditions at positions away from hydrogen source (e.g., SG compartments, IRWST and IRWST vents) are bounded by existing design basis Class IE EQ procedures (see Appendix 3.11 A).

Global igniter environments in the presence of a functioning igniter system will not threaten equipment survivability. However, development of diffusion flames (as experimentally observed in HCOG experiments) and location of equipment in regions of active burning can produce severe thermal environments for important post-accident equipment and instrumentation. Consequently, instruments required for achieving and maintaining safe shutdown conditions (Tables 19.11.4.4-1 and

2) will have transmitters located away from hydrogen sources and positioned at least 10 ft, from an adjacent igniter (that is, twice the scaled distanced observed in the HCOG tests for igniter local influence). Furthermore, if necessary, equipment / instruments will be radiatively shielded from thermal radiation of potential diffusion flames that may result from continuous hydrogen consumption.

Case 2: Igniters inerted Prior to Global Hydrogen Burn in this scenario, the igniters are assumed to electrically and mechanically function. However, steam

' ~N released earlier in the transient (such as a large LOCA without Si and without containment heat removal) is sufficient to inert the burning process and render the igniters completely ineffective, later on in the accident scenario it is assumed that 100% of the active cladding has been oxidized, AMvoved Design Materie! Probab&stic Risk Assessment Page 19.11 115

4 1

l System 80 + Design ControlDocument and the resulting hydrogen is mixed within the containment. Following that time, the containment sprays are recovered and the containment atmosphere is suddenly de-inerted. It is further assumed that the de-inerting of the containment atmosphere results in a global combustion.

In assessing the effect of the de-inerting process, the following assumptions are made:

1. 100% cladding oxidation

2. Mixture burns at the minimum flammability point (see Figure 19.11.4.1.3-1)

3. Mixture combustion completeness is 50% (see Reference 227) based on hydrogen and steam concentrations Based on the above assumptions, global combustion, following a deflagration, can produce short duration burn temperature / pressure spikes below 590*F and 90 psia respectively. Burn times vary slightly throughout the containment, with typical burn times in the vicinity of important equipment expected to be approximately 30 seconds.

Based on these assumptions, the limiting global hydrogen burn can be approximated by a temperature pulse initiated at a stable temperature of 250'F rising to 600*F over 30 seconds and rapidly decaying over the next 10 seconds to 250*F.

This quantification is expected to significantly overestimate the thermal and pressurization consequences resulting from the de-inerting process. Data obtained at Whiteshell (Reference 19 of 19.11K) suggests controlled combustion in a condensing environment will be a benign process, characterized by continuous hydrogen consumption with very limited environmental consequences.

Case 3: Containment Temperature Rise Resulting From Exothermic Energy Releases Following the Zirconium - Water Reaction Process The purpose of this assessment is to assess the impact of the exothennic energy release of a severe accident resulting in 100% oxidation of the active fuel cladding, on the containment environment.

MAAP-3B analyses provide a mechanistic evaluation of the integrated core uncovery-containment heatup and pressurization process. A review of a wide spectrum of these analyses indicated that oxidation with the RV will be limited based on water availability, with the typical levels of zircaloy oxidation falling within 30 to 70% of the active fuel cladding. In order to comply with 10CFR50.34(f), it was required that the consequences of extending the zircaloy oxidation process to include 100% of the active clad be considered. This was accomplished by extrapolating MAAP 3.0B analyses assuming a sufficient water source existed to extend the zircaloy oxidation process to a 100%

zircaloy cladding equivalent. In this analysis it was further assumed that water interacting with the zircaloy clad will result in the evolution of hydrogen which is released from the RV at the extrapolated upper plenum gas temperature and adiabatically added to the containment atmosphere.

The resuhing peak temperature remains below the existing Design Basis EQ (see Figure 19.11G-2).

Deta!!s of this calculation may be found in Appendix 19.11G.

19.11.4.4.1.4.3.2 " Post-VB" Severe Accident Envirotunent Section 19.11.4.4.1.4.3.1 identified the pre-VB severe accident environment for those instruments required to achieve and maintain a safe-shutdown condition. Should insufficient equipment be available to terminate the severe accident while the corium resides within the reactor vessel ("in-Asyweved Design Atatoriet Probabikstsc Misk Assessment Page 19.11 116

System 80+ Design ControlDocument (J

K-

) vessel"), a breach of the lower head will occur, resulting in the relocation of the corium within the containment ("ex-vessel"). At this point in the event, the accident management strategy shifts from "in-vessel" corium coolability to that of ensuring containment integrity. This goal requires a smaller list of equipment for use by the operator. Instruments required post-VB are:

• IRWST water level sensor o liydrogen monitor

• Containment pressure sensor

• Containment temperature sensor

• 11igh radiation level monitor For accidents which proceed beyond vessel breach, it is the intent of the post severe accident containment monitoring to provide the operator with a status of the containment integrity, an indication of containment airborne radiation and hydrogen combustion potential. This information may be used by the operator and technical support center (TSC) staff to aid in defining venting strategies, and the extent of off-site evacuation. To perform this task, the instrumentation required by the operator includes (1) the containment pressure monitor, (2) radiation monitoring via either the in-containment high level radiation sensors or the Post Accident Sampling System (PASS) and (3) the hydrogen monitor. All required sensing capabilities can be performed using equipment external to the n containment and hence are expected to survive well into the severe accident scenario, including post

(") containment failure. While use of the containment temperature, when available can provide additional information, it is not considered essential to these actions. The trending of the success of operator actions to control containment integrity may be followed via use of the containment pressure monitors  ;

(which provide a direct indication of the approach to containment failure) and venting strategies can I be formulated using information obtained through radiation, hydrogen and pressure monitoring. l Equipment required post-VB include:

• Containment Spray System (including flow and valve position sensors)

• Shutdown Cooling System (as backup to Containment Spray)

The post-VB temperature / pressure environment is dependent upon the characteristics of the transient ,

initiator and event timings. Based on MAAP analyses performed for the PRA (see Section 19.11.5),

the potential accident environments mostly fall into two categories: events with containment sprays functional and events with cavity flooding activated. The event characteristics are as follows:

Category 1: Events with Containment Sprays Functional Temperature < 250*F (with short duration spikes to 300'F)

Pressure < 40 psia These events comprise 90% of the Plant Damage States (PDSs).

(7 1

(_/

Approved Design Material- Probabinistic Risk Assessment Pege 19.11117

System 80+ Design ControlDocument Category 2: Events with Containment Sprays Disabled and Cavity Flooding system Activated Prior to VB Temperature < 330*F Pressure < 80 psia These values apply for containment conditions 20 or more hours after event initiation (typical event times exceed 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />, see for example Section 19.11.5).

The minimum mission time for the equipment is selected consistent with SECY-93-087, approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, for those transients where containment failure is anticipated (i.e. Category 2 events). The existing design basis EQ presented in Appendix 3.11A conservatively bounds the severe accident environments with the exception of potential global burns associated with condensation induced combustion in a high hydrogen content environment. This later environment is defined in Section 19.11.4.4.1.4.3.1d and is also considered applicable for post-VB equipment survivability.

19.11.4.4.1.4.4 Assessment of Equipment / Instrument Survivability Following a Severe Accident The temperature / pressure survivability requirements for the Table 19.11.4.4-1 and 2 instruments / equipment is detailed in Tables 19.11.4.4-5A through 5F. These tables provide the containment and, if applicable, "in-vessel", thermal conditions associated with the severe accident and hydrogen burn environments defined in the previous sections along with supplemental severe accident equipment procurement andlocation requirements. These items are discussed further in the following sections. For convenience, the equipment / instrument survivability environments have been divided into the following classes.

1. Instruments with sensing elements residing within the RCS

2. Instruments interfacing with the RCS, not residing in the containment l l

3. Instruments located within the containment

4. Instruments / equipment located primarily in the subsphere or nuclear annex l l

The instruments / equipment residing on these lists are discussed below. l 19.11.4.4.1.4.4.1 Instruments With Sensing Elements Residing Within The RCS The only instruments in this category are the UlUTCs of the RVLMS. While other instruments (such as the CET and hot leg RTDs) will survive most severe accidents, the upper probes of the HJTC string are likely to survive the complete spectmm of recoverable severe accidents. This information l is summarized in Table 19.11.4.4-5A. This instrument is useful for accident trending prior to VB.

Survival of the UlUTCs Post-VB is not required.

Reactor Vessel Level Monitoring System (RVLMS)

The RVLMS consists, in part, of two probes with heated and unheated junction thermocouples.

These probes are part of the ICCI package. The IUTC probes measure inventory above the fuel i Approved Design Material Prebebmstic Risk Assessment Page 19.11118

System 80+ Design ControlDocument gs alignment plate. The temperature difference between the heated and unheated junction thermocouple pairs is a direct indication of the presence or absence of liquid inventory. As a leve; monitoring instrument, this instrument provides useful information as the core uncovers and provides confirmation of core recovery. The individual unheated junction thermocouples may also trend the progression of core degradation by monitoring the gas temperature in the reactor vessel upper plenum.

The IUTC probes utilize heated and unheated junction Type K thermocouples. Unlike the CET, the RVLMS thermocouple string is top mounted and does not pass through the core. In accordance with the RVLMS design requirements, several of these thermocouples are calibrated for operation up to 1800*F. Consequen,1y. these instruments will continue to function far into the core degradation process. While net providing a direct indication of core degradation, the probes provide valuable trending information to the operator. These thermocouples are characterized by the vendor to survive beyond 2000*F. Therefore, many of these thermocouples (particularly those located towards the upper part of the string above the UGSSP) will likely survive the 1600*F "in-vessel" upper / head environment following a recoverable severe accident.

Since the llJTC string is top mounted, its junction boxes, and leads will be routed away from active igniters. Therefore. exposure to high temperature diffusion flames are not expected.

19.11.4.4.1.4.4.2 Instruments / Equipment Interfacing with the RCS Instrument / Equipment residing in this category includes the RCS and pressurizer pressure sensors, the SG level monitor and the Rapid Depressurization valves. The operating time frames and  ;

/]

V environments for these instruments are summarized in Tables 19.11.4.4-1, -2 and 19.11.4.4-5B, l !

respectively.

• RCS / Pressurizer Pressure Sensors / SG Level Monitors i 1

For the operator to appropriately utilize the plant's resources he must be able to assess the  !

equipment limitations and operate the equipment properly and trend consequences of his i actions. To this end it is expected that the operator may need an indication of l RCS/ pressurizer pressure, and SG level.

Monitoring RCS pressure is necessary in trending the RCS depressurization following operator actions taken to either establish feed and bleed conditions or to confirm the pressure is sufficiently low to enter shutdown cooling. l 1

In the event that the operator must depressurize the RCS via the steam generator, the water I level in the SG should be tracked to assure the presence of SG secondary side inventory. To accomplish this task the operator must rely on the SG level monitors.

All pressure transmitting devices are located outside of the RCS boundary with the only direct interface being a long length of small diameter tubing connecting the RCS to the high pressure side of the pressure transmitter. The sensor tap is typically filled with low velocity fluid.

This length of pipe provides sufficient heat loss and thermal capacitance to maintain the fluid c temperature in the vicinity of the sensor to acceptable levels. Therefore, the "in-vessel" environment will not significantly influence instrument operation. l Approved Design Materte!- Probab&stic Risk Assessment (2/95) Page 19.11 119 1

i

Syrtem b0 + Design controt,0ccument All tr rtsducers, cables and associated signal conditioning discussed above are contained within the 10CFR50 Appendix B design basis instrument qualification. Typical instrument cables have been tested by Duke Power Company and have been shown to withstand a combined LOCA and hydrogen burn. Transdeers will be located beyond the outside of the cranewall and positioned away from hyd ogen igniters so as to minimize any effects associated with localized burning or direct thermal radiation. If necessary, these transducers may be radiatively shielded from the potential flame source.

The survival of DB EQ Class IE pressure sensors was studied as part of an industry wide instrument survivability test program. Based on results of several high temperature burn experiments (see Section 19.11.4.4.1.4), pressure cells (including associated electronics) have been demonstrated to be robust to single and multiple (up to 20) high temperature hydrogen burns. For recoverable scenarios there is a high confidence in the availability of this consplete equipment set.

While detailed testing of transmitters has not been performed, the design basis EQ (Class IE) rating is indicative of a similarly high level of thermal protection for the sensitive electronics package. Once a final transmitter is selected for use in System 80+, analyses can be performed to demonstrate the ability of the thermal protection to maintain the electronics pachage below its rated capability during a condensation induced global hydrogen burn (see Section 19.11.4.4.1.4.3. Id).

• SDS Rapid Depressurization Valve Following a complete and irrecoverable total loss of feedwater event, the operator is iristructed via the EOG to actuate the rapid depressurization valves and maintain inventory control and heat removal via feed and bleed. If S1 is unavailable for the inventory feed operation, the operator is still instructed to perform this operation so that SITS can inject into the RCS. Thus, the EOGs direct actuation of the RD valves prior to the onset of core uncovery.

While further delayed actuation of the RD valves is unlikely, conditions at the SDS valves will remain below its design basis qualification temperature of 700*F for a considerable time into the core melt eveni.

A TLOFW event that requires RD valve actuation will result in valve actuation either (a) prior to core uncovery or (b) under conditions where most of the hydrogen produced in the vessel has not been released from the RCS. 'nius, the Rapid Depressurization valves are not required to survive the 10CFR50.34(f) hypothetical hydrogen burn. Nonetheless, survival of the RD valves is considered likely. To ensure that a prolonged " feed and bleed" event is possible, the rapid depressurization valves will be designed to fail "as is".

19.11.4.4.1.4.4.3 Instrumer2ts/ Equipment Located in Containment The key instruments / equipment primarily located in the containment required for severe accident recovery and/or trending include:

O

~

44 wowed Design Matena!. Probabaistic Risk Assessment Page 19,11 120

1 i

- Svstem 80+ Deelen ControlDoewrest l Y - Instrurrants .!

d' '

e Containment temperature sensor . ]

l e High level radiation monitor I i

. Equipment ~

e. Hydrogen Mitigation System (igniters) l o Containment Isolation System

~!.

e- ~ Cavity Flooding System

e. Containment Penetrations The' capabilities and requirements for these instruments / systems are summarized in Table ,

t 19.11.4.4-5C.

o Containment Atmospheric Temperature Sensor Containment temperature sensors for System 80+ will provide indication of containment  !

temperature with a range from 0 to 403'F. Survivabili yt of these instruments at much higher  :

temperatures is expected. These sensors may be used to supplement or verify containment l 0 pressure measurements, however, their direct importance to supporting recoverable severe accident scenarios is considered small. These instruments are considered part of the System 80+L post-accident monitoring system and are designed in accordance. with Category 2 of Regulatory Guide 1.97. Sensors are located in the periphery of the containment and will be located at least 30 feet away from direct ignition sources. These instruments can be expected  ;

to survive the severe accident containment environment. i In selecting the above sensor for "in containment" use, the containment temperature sensor will be capable' of surviving a Category I containment environment (See Section  :

19.11.4.4.1.4.3.2) for an extended time period and a Category 2 environment for a minimum 4 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

> These specifications will ensure survivability of the containment RTD following global "in containment" hydrogen burns and provide a minimum of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of instrument operation for those transients where containmer.: failure is imminent. Since the utility of the containment temperature is primarily for trardmg and confirmation, requiring qualification of this instrument to the ASME service level C" ultimate pressure operating environment is not '!

~ deemed essential. As a goal of the System 80+ procurement effort, a high priority will be ,

l placed on obtaining containment RTDs _with as close to this capability as practical.

l r

Typical RTDs' are expected to be capable of achieving and surpassing these supplementary requirements. Typical platinum based RTDs can survive temperatures well in excess of j' 600'F. ~ Recent EQ tests performed for ice condenser PWRs and Mark III BWRs indicate the

.Q potential for ' instruments to survive traditional post DB EQ environments. . As disccssed in l

.( / : .;

l Appment Osmen accessent. AsestaWWe AWA h- page 79.f f.72f .

i

System 80+ Design ControlDocument '

Section 19.11.4.4.1.4.2, typical vendor supplied RTD cables have been qualified for repetitive exposure to 1400*F temperature sources (Reference 226). For Mark III BWRs the HCOG has qualified Weed RTDs to a 440'F,90 psia environment.

• 11igh Level Radiation Monitor 10CFR50.34(f) requires that the operating staff be capable of trending containment high level radiation throughout the severe accident. The high level radiation monitor resides outside the cranewall. Placement restrictions will be placed upon the monitors so that the monitor and cables are located at least 10 feet from active igniters and, if necessary, will be shielded from potential diffusion flames.

With the exception of the limiting global hydrogen burn, the positioning of the radiation monitor, will be such that its expected severe accident thermal environment is close to (and typically less than) the DB EQ envelop. As a result of the multiplicity of ways to establish containment radiation levels throughout the transient, survival of this equipment following a global hydrogen burn will not be required. In particular, failure of "in containment" high level radiation monitoring can be supplemented by radiation measurements from sensors located within the subsphere or plant site and by direct containment air sampling by the Post Accident Sampling System (PASS). The PASS is designed to sample from a containment temperature up to 350*F and containment pressure corresponding to ASME service Level C containment stresses. Therefore, PASS is expected to operate during the later portions of a severe accident and aid in core damage assessment. This later assessment may be delayed since the PASS may not be on line for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following the initiation of the accident.

Ilowever, due to the low probability of failure of the high level radiation monitor and its potential backup capability, additional precautions to ensure high temperature, high pressure survival beyond the DB EQ is not required.

• Containment Isolation System The CIS is actuated early in an accident sequence. Proper operation of this system guarantees containment isolation associated with isolatable containment penetrations. Since this system requires actuation only once in a sequence, the required bounding environment is the same as that used for DB EQ.

• Containment Penetrations Contaimnent penetrations for System 80+ are discussed in Section 3.8. Containment penetrations include:

1. Equipment Hatch

2. Personnel Air Lock

3. Refueling Pool Fuel Transfer Tube

4. Mechanical Penetrations (e.g. process lines)

5. Electrical Penetrations Astwoved Design Motorint Probabikstic Risk Assessment Page 19.11 122

System 80+ Design ControlDocument (n) Containment penetrations will be mechanically designed to withstand service Level "C" V pressures. Furthermore, mechanical containment penetrations will be afforded high temperature protection by providing them with sealant material that would guarantee a minimum " low-leak" seal for a time period of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following the onset of a sustained high temperature (350'F) in the containment.

In practice, containment penetration capabilities have a high likelihood of exceeding these requirements. A discussion of the expected penetration capabilities based on Sandia conducted industry tests for penetration designs similar to that expected to be used for System 80+ is presented in the following paragraphs.

• Equipment Hatch The System 80+ Equipment Hatch is designed with a double "O" ring seal. These seal designs have been experimentally tested by Sandia. Seals have been observed to provide virtually leak free service for simulated containment environments of at least 450'F for silicon rubber double "O" ring seals and up to about 600*F for ethylene propylene (EP) based seals.

• Personnel Air Lock The Personnel Air Lock (PAL) is sealed using double door inflatable seals located on doors at either end of the PAL. Existing PWRs typically employ PAL door seals of an inflatable seal design. Inflatable seals used for nuclear plant applications are constructed from EPDM E603- ,

60 material, reinforced with Kelvar. The inflation pressure of these seals for System 80+ is  !

!p) expected to be above 90 psia (manufacturer's recommendation is 30 psi above containment

'" I design pressure). Based on an inflatable seal survivability test program conducted at Sandia National Laboratory, it was noted that inflatable seals maintained very low leakage for containment pressures in excess of 150 psia and temperature of up to 350'F for seals aged with a cumulative 2 x 10 8rad radiation dose. Under these conditions, no seal material l deterioration was noted. Thus, these experiments provide confidence that the present generation of inflatable seals will remain intact for all severe accident sequences where the containment spray or CFS is actuated. At higher containment temperatures the inner PAL door seal may ultimately fail. Regardless of the PAL door seal design, the lower j temperatures expected in the vicinity of the outer PAL door, located beyond the shield I building, will assure continued leak tightness of this penetration well beyond the goal of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

• Refueling Pool Fuel Transfer Penetration )

A typical RP fuel transfer penetration is presented in Figure 3.8-2 Sheet 7. The "in-containment" portion of the penetration consists of a blind flange sealed with a double "O" ring seal. The capabilities of this seal arrangement and associated test results have been discussed for the Equipment Hatch.

• Mechanical Penetration Mechanical penetrations include main steam /feedwater flow penetrations and hot / cold process piping. These penetrations are sealed with steel bellows. Typically these bellows are

(]/

m, designed to survive 5000 cycles of DB worst case loadings. Using standards of the Expansion Joint Manufacturers Association (EJMA), a minimum factor of safety of 4 times the internal Asyvened Doslyn Mataniel- hobabilistic thsk Assessment Pope 19.11-123

System 80+ Design controlDocument design pressure is typically allowed for the burst pressure. Thus, considerable margin will exist between the bellows failure pressure and the severe accident containment failure pressure for System 80+.

• Electrical Penetrations Three vendors of nuclear qualified electrical penetrations provide products in the United States. These include, Westinghouse, Conax and D. G. O'Brien. Typical EPAs currently manufactured by these vendors were tested for severe accident leak tightness. The testing reflected their current application only, so that all EPAs were not tested to similar conditions.

Of the three, only the D. G. O'Brien and Conax EPAs were tested to pressures in excess of 100 psia. Based on these tests the D. G. O'Brien EPA was found to be capable of maintaining its integrity for greater than ten days when the " simulated" containment environment was 361*F and 155 psia. The Conax EPA was tested for 8 days in a 700'F, 135 psia environment. While the inside EPA seal was damaged at these high temperatures, the outer seals of the EPA were subjected to much lower temperatures (<340*F), and remained intact. Consequently, no significant leakage past the EPA occurred. Both the Conax and the D. G. O'Brien EPAs utilize a dual containment seal. Based on these tests and the similarity in seal design, either the D.G. O'Brien or the Conax EPA will adequately perform during System 80+ severe accident threats.

Other EPAs would also likely survive the System 80+ environment provided the design follows the guidance of IEEE-317-1976 and IEEE-323-1974. Use of EPAs other than those discussed above should be evaluated for their ability to provide performance comparable to, or better than, that observed with the Conax and D.G. O'Brien EPAs.

In summary, an evaluation of the System 80+ penetration seal designs indicates that the penetration seals are expected to survive well beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following even the more challenging low probability severe accidents. This capability results from:

1. Use of dual seals interior and exterior to the containment for the PAL doors, and EPAs which ensure one " leak tight" seal for all credible con:ainment environments:

2. Use of EP based (or equivalent) double "O" ring seals for the equipment hatch and fuel transfer tube flange, which ensures high temperature leakage resistance of the penetration; and

3. Metallic bellow seals, external to the containment shell, for all mechanical process penetrations, which are expected to survive containment pressures above those associated with ASME Service Level C.

• Cavity Flooding System The purpose of the CFS is to pre-flood the reactor cavity prior to VB to accommodate enhanced cooling of the corium debris. The System 80+ AMGs and EOG functional guidance instructs the operator / Technical Support Center (TSC) to flood the reactor cavity whenever a sustained core uncovery is anticipated. This pre-VB flood will occur in advance of significant corewide oxidation. Thus, the bounding environment for CFS operation is Approved Design htatorial Probabilistic Misk Assessment Page 19.11-124

System 80+ oesign controlDocument expected to be within the *>B EQ envelope. Since system actuation will occur in advance of -p s significant corewide oxi/.ation, the CFS will not be subject to the 10CFR50.34(f) hypothetical  ;

global burn (see C,ection 19.11.4.4.1.4.3). t The location of CFS valves within the IRWST and Holdup Volume Tank walls suggests that valve mechanical operation will not be influenced even if a global burn were to occur. As an  :

added precaution, the CFS cables will be routed at least 10 feet from active igniters.

Since actuation of the CFS will not damage any plant equipment or significantly complicate  :

accident accovery, the operator and/or TSC has a high probability of performing this task in accordance with the EOGs/AMGs.

e Hydrogen Igniters  ;

The purpose of the HMS igniters is to control the hydrogen concentration to leven velow that possible for a localized hydrogen detonation. A detailed description of the HMS igniters are presented in Appendix 19.11K. The design of the igniter system precludes special placement or routing of cables. Therefore, the HMS igniters and cabling must be capable of surviving its own operation. This will require demonstrating that hydrogen igniter cables can survive i sustained operation of igniters. For the ice condenser PWRs the igniter cables can withstand j a 45 minute 1200*F burn and remain operating. System 80+ HMS cabling and connectors 1 will also be qualified to these standards. This qualification will provide a reasonable level of confidence of its ability to function in a severe accident environment.

~ MAAP analyses indicate that operation of the HMS igniters for a period of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> in a post-severe accident atmosphere will be sufficient to control the System 80+ hydrogen concentration below 10 volume percent.

19.11.4.4.1.4.4.4 Instruments /Equipraent residing outside of Containment i

The key instruments / equipment primarily located out of the containment and required for either severe i accident recovery and/or event trending are: l Instruments e Containment hydrogen monitor  !

e IRWST water level sensor l

' e Containment pressure sensor e _ Post Accident Sampling System (PASS) l Equipment e Safety Injection System o Emergency Feedwater System o Containment Spray System

.^w.:: Design nieseniet

• Probahnsnic Misk Assessment Page 19.11125

System 80+ Design Control Document

• Shutdown Cooling System The severe accident environment for these items are summarized in Table 19.ll.4.4-5D and SE.

• Containment Hydrogen Monitor Ilydrogen monitors can play a useful role in accident management. Hydmgen monitors sample the containment atmosphere and establish estimated hydrogen conantrations employing sensing devices outside of containment. The hydrogen monitors will be capaDie of measuring hydrogen concentrations up to 15 volume percent. Since these devices are located in a "non-harsh" environment instrument failure prior to containment failure is unlikely.

The hydrogen monitoring system will be required to be capable of sampling the containment atmosphere up to the ASME Service Level C pressure and atmospheric temperatures of 350*F. This requirement is in excess of the existing DB EQ.

• Containment Pressure Indication The availability of a containment pressure measurement during a severe accident is primarily a concern when "in-vessel" recovery actions are not expected to be successful. This instrument can provide information required for emergency planning purposes as well as information to the operator in support of accident management and potential auxiliary equipment needs. The containment pressure sensor is capable of monitoring pressures in excess of 200 psia.

ABB-CE's response to Appendix B of 10CFR50 requires that the contai:unent pressure cells O

survive design basis events. Design basis events involve temperature and humidity profiles typical of a severe accident. For example, the design basis qualification for post LOCA requires that safety related equipment survive long term exposure to high humidity and high temperature conditions where the temperature can exceed 300*F for tens of hours.

Furthermore steamline breaks require the ability of the instrument to survive short term exposure to 400*F temperatures. While these temperatures do not bound the full range of severe accident environments, they do encompass the majority of the accident states. Even the most limiting states are only marginally more limiting. For wet cavity severe accident sequences the containment temperature will not exceed 350*F.

The containment pressure transducer is located in a "non-harsh" envitonment. Consequently, instrument failure prior to containment failure is unlikely.

• IRWST Water Level The IRWST water level will be monitored by a differential pressure cell located outside of containment. This device is not subject to the harsh environments associated with severe accident harsh environments.

• Post Accident Sampling System (PASS)

The PASS is intended to sample the post accident containment environment and provide g information with regard to the airborne and sump activities and chemical composition. For W severe accident applications, PASS will be capable of sampling from containment atmospheres Alvvoved Design nesteria! Probabilistic Risk Assessment Page 19.11126

i i l System 80+ . Deslan controlDocument .

8 4

with temperatures up to 350*F and pressures typical of ASME Service Level C stresses, i' ,

4 e Safety injection System (SIS) i The SIS is required for inventory control for all LOCAs and TLOFW events which proceed j i

- to " feed and bleed." Consequently, the SIS must. be available for recoverable ac:ident sequences. This system is not required once a VB condition has occurred. - Since the SIS is not located in the containment, it is not subjected to hydrogen burn consequences.

o Containment Spray System l

The CSS must be available at all times in a non-isolable severe accident sequence that does l' not bypass containment. Since the CSS takes suction from the same containment to which it discharges, containment absolute pressure is not a direct concern and will not interfere with system capabilities. All active components of the CS are located outside of containment. The

' CSS is restricted to suction water temperatures below 350'F, to minimize cavitation. These requirements are consistent with the existing System DB EQ.

e Shutdown Cooling System.

The CSS and SCS employ identically-designed pumps which can be interconnected to either j system. . Therefore, if necessary, the SCS pumps may backup unavailable CS pumps. i l

e Emergency Feedwater System. i i

When available, the EFW provides RCS heat removal.- All active components of the EFW  !

I are located outside containment. The EFW System is not required once a VB has occurred.

I i .

19.11.4.4.1.4.5 Radiation environments of Severe Accident Equipment

. Radiologically, the qualification approach for System 80+ includes both a Level 1 and a Level 2 l component (In this context, Level 1 and Level 2 refer to radiological exposure levels as described in Section 3.11) with the Level 2 actually corresponding to a recovered core melt. Therefore, for equipment qualified to Level 2 there is no distinction in terms of radiological qualification between the Design Basis LOCA and recoverable severe accidents. For non-recoverable severe accidents (those proceeding to the "ex vessel" phase as analyzed in the PRA) the post-accident radiation environments will be more severe than the qualification levels; radiological survivability for such events is discussed below.

19.11.4.4.1.4.5.1. Survivability of Equipment in Post-VB Accident Environments ,

I Assessments have been made of the survivability of equipment beyond the Level 2 qualification level described in Section 3.11. This issue of survivability applies to severe accidents which are non-recoverable (i.e., those which have either failed the lower reactor vessel head or would be expected to

' do so). A study was.made of radiation exposures levels for such events to determine the time-frame

- over which the design basis Level 2 qualification levels would not be exceeded, and these are

presented below:

Anneewed Deep neenerner. Mosesmear mea Asseesment rene 1s.11 127

System 80+ Design ControlDocument Time Available to Integrated Dose Limit When "Ex-vessel" Exposure is included Oualification Time at Level 2 For Containment Atmosphere For 1RWST Water 180 days 180 days 30 days 100 days 100 days 10 days 4 days 4 days I day 3 days 3 days 0.8 day 1 day I day 0.5 day The IRWST water values are for gamma radiation; the beta radiation equivalency times would be slightly less, but these are relatively less important since gamma radiation is the major issue for recirculating IRWST water. The reason the containment atmosphere doses for the Level 2 qualification and the non-recoverable core melt are the same (i.e., exposure durations are the same) is that the small increase in the releases to the containment atmosphere for the non-recoverable core melt (as compared to the DBA) are more than compensated for by the best estimate spray removal coefficients characteristic of more realistic severe accident assessments. (This is discussed more fully in Sections 15.6.5.4 and 15.6.5.5 which describe a " PAG Evaluation" case, a non-recoverable severe accident with containment and containment systems intact; i.e., sprays operating).

In performing these time equivalency assessments for the IRWST water, activity has been added directly from the reactor coolant system; i.e., no hold-up in the containment atmosphere has been credited. For the containment atmosphere assessments, conservatively low removal rates have been used, with the DBA assessment (corresponding to Level 2) being more conservative than the non-recoverable severe accident assessment. To estimate the atmosphere loading for the non-recoverable severe accident case, a decontamination factor (DF) of 10 was used for the reactor cavity water overlying the core debris, liowever, no credit was taken for the impediment to mixing of the reactor cavity water with the IRWST water due to in-flow from the hold-up volume; this was assumed to be instantaneous. Decontamination due to overlying water pools is shown on Figure 19.11.4.3-1. For a reactor cavity pool depth of 200-300 cm, a median DF value of 10 is a minimum.

Sprays are important not only in removing decay power and maintaining containment integrity, but they are also important for keeping radioactivity in solution and away from equipment that might otherwise be exposed by radioactive sediments. Dry sedimentation is unlikely to occur in any case because of steam condensation, but nevertheless, spray operation will ensure that accumulation of radioactive sediments on equipment will not occur to the point where equipment survivability is affected. Estimates where beta radiation levels in deposited sediments could exceed qualification levels (corresponding to beta radiation levels in the containment atmosphere with sprays operating) would be of the order of one to three days, the time-frame of containment failure without sprays.

Therefore, equipment survivability for such an event (non-recoverable severe accident without sprays) is consistent with containment survivability. Furthermore, the "in-containment" equipment / instruments useful to the operating staff at this time include only the high level radiation monitor and containment temperature sensor. The high level radiation monitor is backed up with the PASS. PASS provides for an "ex-containment" monitoring of the airborne radiation via sampling of the containment atmosphere, and is therefore not subject to beta radiation from deposited sediments within the containment. The containment temperature sensor while useful is not essential for operator guidance / action under conditions of approaching containment failure (see Section 19.11.4.4.1.4.3.2).

On the other hand, with sprays operating, sedimentation in the unsprayed region is less than one percent of sedimentation without sprays, and equipment qualification levels based on activity airborne would be bounding.

Aryveved Design htaternet hobabinistic Misk Assessment Page 19.11 128

. ~ - ... , _. - _ . . . . - .. . - - - ..- - - .- . - . .

4 System 80+ Deshn contmlDocument .l i

I

. - I A summary of the integrated dose qualification time for equipment required for recoverable and non-d recoverable severe accidents are presented in Table 19.11.4.4-6. -l 19.11.4.4.1.5 Su==ary

\l

~

8

' A review of the instrumentation and systems required to mitigate a severe accident was performed.

Based on this review a short list of critical instruments and equipment necessary for severe accident ,

mitigation and ' event trending was identified. . Survivability requirements for this equipment were -l reviewed from the standpoint of recoverable and irrecoverable accidents. It was concluded that with -  !

minor exceptions, existing Design Basis Class IE equipment qualification methods are sufficient to l provide a reasonable level of assurance that this equipment will function during a severe accident. In j order to address 10CFR50.34(f), supplemental severe accident equipment instrument l procurement / placement requirements were identified. i t

19.11.4.4.2 Accident MT Guidance The System 80+ design is robust to severe accidents. While accident management is required it is the philosophy of ABB-CE (and the System 80+ design team) that the surest way of dealing with a severe accident is by means of its prevention. To this end the Emergency Operations Guidelines (

(EOGs) will fully deal with all aspects of the System 80+ design with the exception of those rare  ;

events that result in significant core damage. Since the EOGs are rooted in a functional framework, j j

maintaining safety functions will simultaneously direct the operator to perform those measures that are l also necessary for accident recovery.

The Accident Management Guidance, per se, will be a tool for use primarily in the event of an '

irrecoverable accident and will be focused primarily at protecting the public from radiation releases.

The robustness of the System 80+ design gives the Technical Support Center (TSC) time to consult F the AMG and formulate and implement a strategy for ensuring containment integrity and maximizing i fission product retention in the containment.

For additional information on Severe Accident Management Guidance, see Appendix A to the System l 80+ EOGs.  !

4 The hierarchal goals of the System 80+ accident management effort are as follows: .

r f

1. Enable the plant operating staff to alter the course of a potential core damage sequence and recover without significant fuel damage. j l 2. Enable the plant staff to respond to an accident scenario leading to core damage that will }

result in "in-vessel" arrest of the melt progression and minimize radiation releases to the l public. j i

3. If insufficient equipment is available to arrest the melt progression the plant resources should be directed at prolonging "in vessel" retention of the corium and protecting all potential j radiation release barriers (establish containment integrity).  ;

l.

4. Given a severely damaged core *in vessel" and potentially "ex-vessel", the plant staff will l C . minimize potential radiation releases by scrubbing fission products from the containment j atmosphere and ensuring adequate cooling water is provided to submerge the corium debris.  ;

l l

t- Anwe=* an w annaw. n.mme m,* amm ,e no rs.tr.us  ;

f i

I

System 80+ Design ControlDocument 19.11.4.4.2.1 B1G for Severe Accident Sequences with "In-Vessel" Corium Retention The primary role of the AMGs for System 80+ for severe accident sequences when RV failure can be prevented is to instruct the operator to utilize his resources to re-establish RV inventory and RCS heat removal, control containment integrity (primarily hydrogen control) and to take actions to minimize environmental releases. Actions to re-establish inventory control and RCs heat removal are typically covered within the functional portion of the System 80+ EOGs. Additional guidance is also provided in Appendix A to the EOGs. This section primarily deals with those actions that influence containment integrity issues and are beyond the scope of EOGs.

19.11.4.4.2.1.1 Control of Containment Integrity The EOGs are written to cope with reactor accidents where hydrogen generation is expected to be well below 4 v/o in the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following the event. Under these circumstances the operator is instructed to control hydrogen concentration below this 4 v/o flammable limit via use of recombiners.

The presence of hydrogen poses some damage potential for non-vital in-containment equipment, but even burns occurring at this level pose no credible containment threat. The severe accident realm begins when core damage approaches about 20% of core-wide oxidation. While serious containment threats still do not exist, it is prudent for the operator to be aware of the seriousness of this level of hydrogen in containment and take prudent aggressive actions for hydrogen control. Specific guidance on the operation of the igniters following events with inadequate inventory control is provided in the EOGs.

While the operator cannot readily measure core-wide oxidation, the operator can rely on indirect symptoms of the event progression to establish whether or not the plant is in a potential severe accident scenario. Typically this will become apparent when the operator confirms lost RCS inventory control and heat removal and expects this condition to last for more than several minutes.

Under these circumstances the EOG requires the operator to activate igniters. This action would likely occur prior to core uncovery and therefore, the igniters are expected to burn off the hydrogen at lower concentrations. Continuous operation of igniters would guarantee that global hydrogen  ;

concentration would not exceed about 6 v/o This hydrogen level is sufficiently low so as to remove potential containment and environmental hydrogen threats. ,

1 In addition to controlling hydrogen, the operator will also be instructed to take appropriate actions to I

prevent an ensuing severe accident from inducing a steam generator tube failure. Operator actions to accomplish this task are generally consistent with those aircady required in the EOGs. Induced steam generator tube ruptures can be prevented so long as water is available to the secondary side of the steam generator. Efforts will be directed at restoring this flow path if it unavailable. However, this )

action is fully consistent with restoring the RCS heat removal function as well and will therefore have l I

no practical impact on the EOG.

19.11.4.4.2.1.2 Minimize Fission Product Release to the Environment This requirement is not considered in the EOG. If large fission products are released to the containment and the containment spray system has not been automatically actuated as a result of the accident sequence, the operator should periodically operate sprays to " wash" the containment atmosphere of radionuclides (elemental iodine, in particular).

O Approved Design Material- ProbabMrstic Risk Assessment Page 19.11-130

i l

System 80+ oeskn controlDocument

-19.11.4.4.2.2 AMG for "Ex-Vessel" Sequences The goal of responding to severe accidents with expectation of core relocation into the containment

("ex-vessel") is essentially the same as those identified in the above section, that is, to maintain the integrity of all remaining fission product barriers (e.g. the containment and intact steam generator tubes) and to minimize releases of fission products to the environment.

19.11.4.4.2.2.1 Maintain Containment Integrity In a severe accident sequence that results in vessel failure, several potential containment threats can develop. It is the goal of this phase of accident management to:

1. Establish long term containment integrity, or if that is not possible,

2. Delay the time of containment failure and reduce the subsequent radiation release at containment failure.

A summary of the major anticipated actions expected of the plant staff are summarized below.

Actions are divided into two categories: actions taken prior to VB and action taken post-VB. .

19.11.4.4.2.2.1.1 Actions Taken Prior to VB

• Actuation of Rapid Depressurization Valves Probabilistic severe accident analyses of various PWRs, including System 80+, clearly show that the threat to containment integrity is reduced if the RV fails at low pressure. Low pressure failure of the RV will enhance the retention of corium debris in the reactor cavity and eliminate an HPME induced containment threat such as DCH, or Rocket failure.

Therefore, the operator should depressurize the RCS via the RD function when either;

1. an unrecoverable total loss of feedwater has occurred, and Feed and Bleed cannot be implemented due to lack of a water source. (For System 80+ this action will depressurize the RCS to the SIT setpoint while simultaneously adding additional water to the RCS.) ,

or,  !

l

2. the core is uncovered at high pressure (> SIT pressure), thermocouple and/or containment hydrogen readings suggest significant core damage has occurred and no inventory water source is currently or anticipated to be available in a short time. 1 1

Operation of the RD valves prior to core uncovery is expected (see Appendix A to the EOGs).

• - Actuation of Igniters l

Severe accidents, by their very nature will be associated with considerable hydrogen evolution l from the core. To control this threat the operator /TSC will be directed to turn on the HMS I O igniters for transients which he has lost inventory control and observes core exit temperatures d in excess of 700*F. These transients will be characterized by a loss of inventory with no inventory makeup source available. The action to turn on the HMS igniters is included in the j

]

i Annreved Deskprt nearerin!. Probabnatic Misk Assessmerst Page 19.11131

I System 80+ Design ControlDocument inventory control " Continuing Actions" section of the functional portion of the System 80+

EOGs. j e Actuation of Cavity Flood System The CFS provides an operator initiated mechanism to flood the reactor cavity and thereby l establish cooling to the trapped molten core. The CFS will be actuated in the time period l

following core uncovery and prior to vessel breach. Operator indications of core uncovery can, for example, include the following:

1. Indication of no level above the fuel aligrunent plate by the RVLMS or CET i temperature indicative of a superheat condition ~700'F.

2. RCS makeup unavailable as identified by either a high pressure in the RCS or unavailability of key safety equipment.

Premature operation of the CFS will not affect utilization of ECCS nor will it unduly complicate post accident clean up should the event be arrested within the reactor vessel.

l 19.11.4.4.2.2.1.2 Actions Taken Post-VB e Establish External Spray Flow Following a severe accident where containment pressure control is lost the operator should regain pressure control with existing equipment. If that is not feasible in a reasonable time ,

frame (less than about 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />) the TSC should take the necessary actions to establish the i alternate (external vessel) containment spray capability. Establislunent of spray flow by 24 l hours following the onset of core uncovery will extend containment integrity for several days while alternate means of establishing containment heat removal via repair of plant CHR and support systems can be implemented.

e Vent to Containment Annulus System 80+ has two 3-inch pipes from the hydrogen recombiner system which can be used to vent to the containment annulus from the control room. This vent size has the potential to maintain contairunent pressure in the vicinity of 100 psia. This is not a desired mode of i

pressure control since it is associated with considerable releases of fission products. However, should internal and external sprays be unavailable, a last means of prolonging containment integrity and controlling the fission product release will be to open these vents. Containment venting can also be used in conjunction with external spray to both extend containment integrity and mitigate the vent fission product release.

19.11.4.4.2.3 Surnmary System 80+ has been designed so that the probability of the plant experiencing a severe accident is remote. The AMG for System 80+ is intended to aid the plant operating staff to cope with these ,

b yond design basis events, should they occur. The functional approach inherent in the ABB-CE  !

unergency procedures allows the basic EOG to be the foundation for the "in-vessel" aspects of the i AMG. This guidance has been further supplemented by Severe Accident Management guidance )

l Attwoved Desigrt Material- Probabikstic Risk Assessment Page 19.11-132 l

System 80+ oesign controlDocument (9

associated with the EOG. Actions discussed in this section for responding to an "Ex-vessel" condition V are directed at maintaining containment integrity and minimizing fission product releases.

19.11.5 System 80+ Containment Perfonnance Analyses 19.11.5.1 Introduction .

This section provides a quantitative description of the System 80+ containment performance for selected severe accident sequences. Analyses were carried out to (1) quantify the transient plant response and (2) determine the long term containment performance characteristics including fission product release fractions for several severe accident sequences. The analyses were performed using an enhanced version of the Modular Accident Analysis Program (MAAP), MAAP 3.0B, Rev.16.03 (Reference 203).

19.11.5.2 Modifications to MAAP 3.0B Quantitative severe accident analyses are performed using a System 80+ version of MAAP 3.0B Rev 16.03 (Reference 203). Code modifications performed were required to simulate unique design features of System 80+ These models included:

1. The addition of an In-Containment Refueling Water Storage Tank (IRWST) i 4 2. A Cavity Flooding System model O

g 3. Changes to the Engineered Safety Features Systems to accommodate new ESF system line-ups

4. Detailed reactor cavity volume model

, The IRWST model utilizes certain pieces of the quench tank model in MAAP 3.0B. This was a logical model strategy since the IRWST receives fluid discharge from the Pressurizer Safety Valves and Rapid Depressurization Valves, as would the quench tank in a conventional PWR. The model was developed to include all appropriate liquid and gas flow paths and considers hydrogen acrumulation and combustion in the IRWST freeboard space, as well as, fission product scrubbing of the safety and SDS valve discharge in the IRWST water pool.

Cavity flooding was simulated employing a hydraulic model connecting the IRWST, Holdup Volume Tank (HVT) and Reactor Cavity. All flows into and out of these volumes wem considered in the model formulation. Once actuated, the flooding of the reactor cavity is a passiv's process driven by the density heads developed in the IRWST and HVT.

The System 80+ engineered safety features systems line-ups are similar to those used on contemporary ABB-CE PWRs. The introduction of the IRWST into the evolutionary System 80+

design required modifications / additions to the containment suction and RHR heat removal models.

In order to accommodate the cavity flood model several code modifications were necessary to the reactor cavity model to both represent new flow paths and more rigorously consider reactor cavity volume distribution.

These models were typically verified by reviewing code changes and comparing predicted results to alternate hand and/or computer calculations.

M:w Design Ateserial. Probabeshic Riek Assessment Page 19.11133

System 80+ Design ControlDocument ,

19.11.5.3 System 80+ MAAP Model A plant specific MAAP parameter file was developed to represent System 80+. The base model used in the analyses considered the most current System 80+ design input (Reference 214) and included the appropriate selection of MAAP modeling parameters as identified by EPRI (Reference 215). In order to ensure as realistic a plant response as possible input parameters were typically selected based on their best estimate values.

As a consequence of the above procedure, the analyses presented in this section are considered to be close to "best estimate" simulations of the System 80+ severe accident sequences. For instances where conservative bounds on selected parameters were sought (such as hydrogen generation) separate analyses were performed with adjusted model parameters (see for example Sections 19.11.4.1.3 and 19.I1.4.2.3).

19.11.5.4 Transient Analyses The analyses selected for presentation in this section were chosen to provide a fundamental understanding of the System 80+ transient response under various severe accident scenarios.

Sequences with relatively large frequencies which result in relatively large contribution to the radiological releases were selected for illustration purposes. These include station blackout scenarios, large break LOCAs. small break LOCAs. total loss of feedwater scenarios, steam generator tube ruptures and the V sequence.

19.11.5.4.1 Station Blackout Sequences The station blackout (SBO) sequences consist of a total loss of all AC power, including those from emergency diesel generators and the alternate combustion turbine / generator. The only power that may be available is the station battery power. Only one of the SBO sequences presented here assumes availability of battery power. The Cavity Flooding System may also be assumed to be either operational or not operational. Three cases are presented: Case I considers an SBO sequence with a flooded cavity (wet cavity) and no battery power; Case 2 deals with an SBO sequence with no cavity flooding (dry cavity) and no battery power; and Case 3 is an SBO with battery power available and cavity flooding (wet cavity).

19.11.5.4.).1 Station Blackout Sequence with Battery Power Unavailable and Cavity Flood l System Actuated This station blackout sequence sists of a loss of all AC power. Station batteries are assumed unavailable during this accident enario. It is also assumed that the operator floods the reactor cavity prior to vessel breach to ensure debris quenching and debris coolability following a potential failure of the RV lower head. The unavailability of containment heat removal results in an overpressure containment failure more than 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> after the initial Loss of Offsite Power (LOOP) condition.

This transient is designated as LOOP-9E in the PRA.

19.11.5.4.1.1.1 Dynamic Response In this SBO scenario the loss of all AC power causes the control rods to drop into the core terminating the nuclear chain reaction. Since batteries are assumed unavailable, effective core cooling as well as RCS pressure and inventory control cannot be achieved.

I I

Attwoved Design Matenal- Probabilistic Risk Assessment Pope 19.11 134 u

l i

System 80+ Design controlDocument l n

19.11.5.4.1.1.1.1 Primary and Secondary System Response 1 (v )

The SBO results in unavailability of all engineered safety features systems. As a result of unavailability of feedwater to the steam generators approximately one hour into the event the steam generators dry out and heat removal from the RCS is lost. Loss of heat removal results in a repressurization of the RCS to the Primary Safety Valve (PSV) serpoint pressure (See Figure 19.11.5.4.1.1-1). The cycling of the PSVs allows for an unreplenished loss of RCS inventory and incipient core uncovery prior to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> (See Figure 19.11.5.4.1.1-2). Without any engineered safety features systems operational the fuel rapidly heats up, melts, relocates to the lower plenum and fails the RV lower head. The RV failure mechanism is assumed to initially be failure of a single lower head penetration, opening an initial 0.052 ft radius hole in the RV lower head. A summary of the MAAP predicted sequence of key events and their timings is provided in Table 19.11.5.4.1.1-1. A summary of key parameters is provided in Table 19.11.5.4.1.1-2.

19.11.5.4.1.1.1.2 Containment Performance The containment response during the SBO demonstrates the passive plant capabilities of System 80+.

The lower containment temperature and pressures for this event are presented in Figures 19.11.5.4.1.1-3 and 19.11.5.4.1.1-4, respectively. Pressures and temperatures in other containment locations are similar. In the System 80+ design passive heat removal from the containment atmosphere is accomplished through heatup of the following heat sinks:

1. IRWST Inventory (4.1 million Ibm)

(yh 2. Internal Structural Concrete (200,000 ft2surface area)

3. Internal Steel (gratings, polar crane, etc.)

4. Containment Shell and heat transfer to the Secondary Containment For the SBO scenario, discharges from the primary system are ducted via the pressurizer pressure relief piping into the IRWST. During the early transient, steam discharged into the IRWST is ultimately condensed. Therefore, containment pressures remain near initial conditions until the IRWST reaches saturanon conditions. At that time the IRWST water begins to boil, adding steam mass into the containment atmosphere. With containment heat removal systems assumed to be unavailable, the steam addition is seen to directly result in a small containment pressure increase. At vessel breach, a rapid (but modest) containment pressurization is observed. This is due to the release of considerable quantities of steam and corium that are discharged into the reactor cavity, it it expected that the operator will actuate the cavity flood system prior to vessel breach. The large floor area available for spreading the corium within the cavity results in a high confidence that the corium remaining within the cavity will be quenched. (For these analyses the corium heat removal rate at the upper corium surface is limited to about 35% of the Zuber pool boiling heat flux.) Thus, the primary containment threat under these conditions becomes the gradual overpressurization of the containment due to vaporization of the water covering the corium. In the absence of containment heat removal, the steam will continue to gradually heat up and pressurize the containment atmosphere to the point of containment failure. Based on MAAP analyses of the containment pressure response the O

C' time required for the containment atmosphere to reach ASME Service Level C Limits will be about 60 hrs from the onset of the SBO (See Figure 19.11.5.4.1.1-3). Containment temperature variation during this heatup process is illustrated in Figure 19.11.5.4.1.1-4. As can be seen containment Approwd Design Atatorial . Probabikstic Itisk Assessment Page 19.11 135

i System 80+ Desigs ControlDocument temperatures are generally below the levels at which rapid degradation of the penetration sealant would be induced.

Figure 19.11.5.4.1.1-5 shows the basemat erosion for this sequence. Due to timely flooding of the cavity which quenches the corium, the basemat erosion is seen to be relatively small.

19.11.5.4.1.1.1.3 Fission Product Releases A summary of fission product releases is provided in Table 19.11.5.4.1.1-3 19.11.5.4.1.2 Station Blackout Sequence with Battery Power Unavailable and Cavity Flood System Unavailable This station blackout sequence consists of a loss of all AC power with the station batteries assumed unavailable. It is also assumed that the operator fails to actuate the CFS and RV failure occurs in the presence of a dry cavity. Plant RCS responses for this transient are the same as those presented in Section 19.11.5.4.1.1.1. This transient is designated as LOOP-9F.

RV head failure occurs at about 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. Initially, the RV lower head failure results in the deposition of a limited water mass into the reactor cavity. The sources of this inventory are the residual lower plenum liquid and the SIT inventory. The cavity remains wet and the debris is cool until the time of cavity dryout, about 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> (See Figure 19.11.5.4.1.2-1).

A summary of MAAP predicted sequence of key events and timing is provided in Table 19.11.5.4.1.2-1. A summary of key parameters and a summary of fission product group concentrations are provided in Tables 19.11.5.4.1.2-2 and 19.11.5.4.1.2-3, respectively.

Containment pressure and temperature responses are presented in Figures 19.11.5.4.1.2-2 and 19.11.5.4.1.2-3, respectively.

The dryout of the cavity results in an uncooled corium debris bed and significant core-concrete interaction. The unavailability of corium cooling in the reactor cavity results in an aggressive basemat erosion and an associated release of non-condensable gases. High temperatures in the containment may also attack containment penetration seals. As a result of the multiple attacks on containment integrity during these scenarios, the precise mechanism for containment failure is uncertain. Potential containment failures may be caused by either:

1. Basemat melt-through into the containment subsoil

2. Basemat melt-through into an SI pump room in the subsphere of the containment building

3. Basemat melt-through induced reactor cavity wall collapse

4. Temperature induced seal failure

5. Overpressure due to a combination of processes including corium concrete attack, concrete outgasing and containment atmosphere heatup.

Detailed deterministic evaluation of these failures modes are presented in Section 19.11.4.2. Based on that assessment the most likely containment failure mode is item 1 above, (subsoil melt through) followed by item 2 (S1 pump room failure). Containment failure due to items 3, 4 or 5 are Asnprowmf Design hteteria!* ProbabMistic Risk Assessment Page 19.11136

l l

System 80+ Design ControlDocument O/ considerably less likely. These failure mechanisms are discussed below with reference to MAAP SBO analyses.

l l

19.11.5.4.1.2.1 Basemat Melt-through Scenarios l As a result of the System 80+ design, the release of corium into a permanently dry cavity is considered small. Under these circumstances an unmitigated corium concrete attack is expected to continue until either the basemat is penetrated and vitrifies in the basemat subsoil or the SI pump l room in the auxiliary subsphere is penetrated. MAAP analyses provide an approximate timing of the basemat melt-through. Based on this failure mode it is estimated that basemat penetration of about 15 feet will require about 200 hours0.00231 days <br />0.0556 hours <br />3.306878e-4 weeks <br />7.61e-5 months <br />. If eight hours of battery power were available, basemat melt-through could be delayed at least an additional 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br />.

The radial penetration of the corium is difficult to ascertain. Based on the Beta core concrete interaction experiments it appeared that initially the coriura attack into the concrete would erode laterally at a rate of between 20 to 50% of the downward erosion rate. Conservatively assuming that these wall erosion rates are constant, corium entry into the SI pump room will be delayed beyond 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> following the initiation of corium concrete attack. It should be noted that experiments suggest lateral erosion rates rapidly become asymptotic, potentially eliminating the possibility of SI room penetration. The different consequences of the basemat erosion scenarios are significant in that they lead to different treatments in the PRA. A complete basemat penetration into the containment subsoil is considered to have negligible radiological consequences to the surrounding communities. Whereas, the corium penetration into the auxiliary building SI room is considered to be a partially filtered

,m above ground radiological release.

Radial erosion of the concrete basemat may potentially cause the collapse of the lower Reactor Cavity walls. However, as discussed in Section 19.11.3.6.2.8, even if the entire cavity walls below the corbels were eroded by corium attack, the reactor vessel and upper cavity could continue to be supported via reinforcing steel provided between the interface of adjacent walls with the upper cavity wall.

19.11.5.4.1.2.2 Containment Overpressure Failure For the SBO scenario where the IRWST is not actuated to flood the reactor cavity long term pressurization of the containment can come from a variety of sources, including:

1. Boiling of water in the IRWST prior to RV failure

2. Non-Condensable gases (CO,CO2 ,H 2 ) generated via Core-Concrete interaction

3. Release of residual steam / water inventory in the RV at the time of lower head failure Based on a review of MAAP analyses, containment integrity will not be compromised for this sequence.

19.11.5.4.1.2.3 IIigh Temperature Failum of Penetration Seals The high containment temperatures associated with dry cavity basemat attack sequences will challenge O)

( the performance of containment penetration seals. While specific penetration sealant materials have not been specified for System 80+, at temperatures above 450F even high quality seals will begin to Approved Design Matersa!- Probab&sDC Risk Assessment Page 19.11-137

System 80+ Design ControlDocument degrade with continuous exposure to a hostile environment. Typical seal lifetimes under these environmental conditions will be between 50 and 500 hours0.00579 days <br />0.139 hours <br />8.267196e-4 weeks <br />1.9025e-4 months <br />. Appropriate selection of penetration sealants for System 80+ will eliminate this mechanism as a contributor to plant risk.

19.11.5.4.1.3 Station Blackout Sequence with Battery Power Available and Cavity Flood System Actuated For this sequence, subsequent to a loss of all AC power, the station battery power is assumed to be avaihble for up to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. During this time period battery power is primarily directed towards maintaining auxiliary feedwater flow to the steam generators. Prior to battery depletion, the operator is assumed to flood the reactor cavity to ensure debris quenching following a potential failure of the RV lower head. Subsequent to battery depletion, due to the assumed unavailability of containment heat removal, an overpressure containment failure is predicted to occur after 80 hours9.259259e-4 days <br />0.0222 hours <br />1.322751e-4 weeks <br />3.044e-5 months <br />. This sequence is designated as SBOBD-E in the PRA.

19.11.5.4.1.3.1 Primary and Secondary System Response This SBO scenario results in the unavailability of all engineered safety features systems with the exception of the auxiliary feedwater (AFW) system which is powered by a steam turbine and electrically controlled via inverters. As a result of core heat removal via the steam generators, the RCS pressure is maintained below 2250 psia during the time period of auxiliary feedwater availability (see Figure 19.11.5.4.1.3-1). Approximately ten hours into the event (almost two hours after all AFW is lost), the steam generators (SGs) dry out and heat removal from the RCS via the SGs is lost (see Figure 19.11.5.4.1.3-3). Loss of heat removal results in a repressurization of the RCS to the PSV serpoint pressure (see Figure 19.11.5.4.1.3-1). The PSVs cycle open and close to remove the decay heat from the RCS. The cycling of the PSVs without RCS makeup results in sustained loss of RCS inventory and incipient core uncovery at about 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> (see Figure 19.11.5.4.1.3-2). Witha01 any engineered safeguards operational, the fuel rapidly heats up, melts, relocates to the lower plenum and fails the lower head of the reactor vessel (RV). As before, the RV failure mechanism is assumed to be a failure of a single lower head penetration initially, opening an initial 0.052 ft. radius hole in RV lower head.

A summary of the MAAP predicted sequence of key events and their timings is provided in Table 19.11.5.4.1.3-1. Additionally, a summary of key parameters and a summary of fissi n product group concentration are provided in Tables 19.11.5.4.1.3-2 and 19.11.5.4.1.3-3, respectively.

19.11.5.4.1.3.2 Containment Performance The containment performance during this SBO sequence demonstrates the passive plant capabilities of System 80+ under best-estimate conditions. The lower compartment pressure and temperature variation for this event are presented in Figures 19.11.5.4.1.3-4 and 19.11.5.4.1.3-5, respectively.

Pressures and temperatures in other containment locations are similar.

For the SBO scenario, discharges from the primary system are ducted via the pressurizer pressure relief piping into the IRWST. During the early part of the transient, the IRWST water remains ,

l subcooled since there is no significant discharge from the RCS. However, once the battery is depleted at about 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, the RCS heat removal is accomplished by PSV discharge into the IRWST.

During the early stages of this discharge, steam discharged into the IRWST is condensed due to thesubcooling in the IRWST water. Therefore, the containment pressures remain near initial conditions until the IRWST reaches saturation conditions.

l AMweved Design hestenal ProbabMstic Risk Assessment Pege 19.11-138

System 80+ Design controlDocument At that time the IRWST water begins to boil, adding steam mass into the containment atmosphere.

V Without containment heat removal (containment sprays unavailable, this steam addition is seen to directly result in a small containment pressure increase at about 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (see Figure 19.11.5.4.1.3-4). At reactor vessel breach (about 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br />), a rapid containment pressurization is observed. This is due to the release of considerable quantities of steam and corium that are discharged into the reactor cavity.

The operator floods the cavity prior to vessel breach. The large floor area available for corium spreading within the cavity facilitates the quenching of the corium in the presence of cavity flooding.

Thus, the primary containment threat under these conditions is the gradual overpressurization of the containment due to vaporization of the water covering the corium. In the absence of containment heat removal, the steam formed in this vaporization process will continue to gradually heat up and pressurize the containment atmosphere. Based on MAAP analyses, the containment pressure is seen to remain below ASME Service Level "C" pressure limit for about 75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> (see Figure 19.11.5.4.1.3-4). Containment temperature variation shown in Figure 19.11.5.4.1.3-5 demonstrates that the containment temperatures are generally below the levels which would induce rapid degradation of the penetration sealant.

Core concrete interaction (CCI) occurs subsequent to vessel breach. However, since the auxiliary feedwater flow was available for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> and timely flooding of the cavity was initiated, the basemat erosion is seen to be very small (less than one inch) in Figure 19.11.5.4.1.3-6.

19.11.5.4.1.3.3 Fission Product Releases

(" ) A summary of fission product group concentrations in the containment atmosphere at the times of vessel breach and containment failure are provided in Table 19.11.5.4.1.3-3.

19.11.5.4.2 Large Break LOCA 2

This sequence consists of a smaller large cold leg break (0.5 ft ) coupled with a failure of the containment sprays, as well as unavailability of IIPSI, LPSI, and charging pump flows. The cavity flooding system (CFS) is operational to flood the reactor cavity in the first transient analyzed but is unavailable in the second. These sequences are designated as LL-3E and LL-3F, respectively.

19.11.5.4.2.1 Large Break LOCA with Wet Cavity

)

The initiating large LOCA involves a rapid depressurization of the primary system along with a rapid l drop in reactor vessel water level. Water inventory is rapidly depleted from the RCS and as a result l of the addition of accumulator water at 650 psia, a two phase level develops just above the top of the i active core. In this scenario, the operator actuates the cavity flood system prior to vessel breach.

Active enginected safeguards are unavailable with the exception of auxiliary feedwater. Coolant is quickly lost out the break and the core uncovers after 0.5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. Significant clad oxidation occurs following core uncovery followed by core melt and then reactor vessel failure occurring at 1.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />.

A sununary of event timings is shown in Table 19.11.5.4.2.1-1 and selected parameter values are provided in Table 19.11.5.4.2.1-2.

19.11.5.4.2.1.1 Primary and Secondty System Response i p l V in this transient, a 0.5 ft 2LOCA develops at time 0.0. The system rapidly depressurizes to under 50 l psia (Figure 19.11.5.4.2.1-1). Accumulators discharge as the pressure falls below the accumulator l I

Approveef Design historia!- Probabmstic Risk Assessmerrt Page 19.11-139

System 80+ Dc-ign ControlDor:: ment setpoint of about 650 psia and are empty at 781 seconds.

The response of the RV level to this event is presented in Figure 19.11.5.4.2.1-2. MAAP predicts the two phase level to rapidly fall to near the top of the core. Discharge of the SITS temporarily replenishes vessel inventory. A sustained core uncovery ultimately occurs at about 0.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> into the event.

Core uncovery is followed by rapid zircaloy-water oxidation. The fuel is predicted to rapidly heat up and melt. Support plate failure is predicted to occur at 6100 seconds and RV lower head failure occurs shortly thereafter.

For this specific scenario, the secondary side of the steam generator remains full of liquid inventory (Figures 19.11.5.4.2.1-3 and -4). The SG associated with the broken RCS Loop then serves as a heat source and transfers small amounts of energy to the primary side steam. The other SG serves as a heat sink where plated out fission products keep the SG at its safety relief serpoint.

19.11.5.4.2.1.2 Containment Response Core concrete attack initiates at reactor vessel failure. In this analysis, the CFS is assumed to be actuated prior to vessel failure. The interaction of the molten corium and cavity water raises the containment pressure in a steady, linear manner until a peak of 156 psia at just under 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> after the break. Containment pressure and temperature responses are presented in Figures 19.11.5.4.2.1-5 and 19.11.5.4.2.1-6, respectively.

Core concrete mteraction (CCI) initially occurs at RV failure and continues for several hours. The maximum concrete erosion depth is 0.25 ft.

19.11.5.4.2.1.3 Fission Product Releases A summary of fission product releases is presented in Table 19.11.5.4.2.1-3.

i 19.11.5.4.2.2 Large Break LOCA with Dry Cavity In this scenario, the operator fails to actuate the cavity flooding system and reactor vessel failure occurs in the presence of a dry cavity. A summary of event timings is shown in Table 19.11.5.4.2.2-I and selected parameter values are provided in Table 19.11.5.4.2.2-2. I I

19.11.5.4.2.2.1 Primary and Secondary System hesponse )

The reactor vessel response is the same as that described for the large LOCA event in Section l 19.I1.5.4.2.1.1.

19.11.5.4.2.2.2 Containment Response The interaction of the molten corium and cavity water raises the containment pressure in a monotonic manner. The containment pressure and temperature at 80 hours9.259259e-4 days <br />0.0222 hours <br />1.322751e-4 weeks <br />3.044e-5 months <br /> are 68 psia (Figure 19.11.5.4.2.2-1)  ;

and 380 *F (Figure 19.11.5.4.2.2 2), respectively. Spikes in the pressure trace correspond to burns l precipitated by either hydrogen igniters or hydrogen combustion in the vicinity of the hot core debris.

l l

Approved Design Materia! . Probabdtsti$ Risk Assessment Page 19.11140

System 80+ Design ControlDocument

,m Concrete attack is predicted to be monotonically increasing throughout the event and reaches 100 inches of basemat at the analysis end time of 80 hours9.259259e-4 days <br />0.0222 hours <br />1.322751e-4 weeks <br />3.044e-5 months <br /> (Figure 19.11.5.4.2.2-3). Extrapolating the erosion predictions suggests a basemat melt-through into the extended foundation will occur in about 8 days.

19.11.5.4.2.2.3 Fission Product Releases A summary of fission product releases is presented in Table 19.11.5.4.2.2-3.

19.11.5.4.3 Small Break LOCA The accident initiator is a small LOCA (0.02 ft2) coupled widi the unavailability of safety injection.

Containment sprays as well as auxiliary feedwater are assumed to be available. The cavity flooding system (CFS) is operational to reflood the core in the first transient analyzed but is unavailable in the second. These sequences are designated as SL-11E and 11F.

19.11.5.4.3.1 Small Break LOCA with Wet Cavity 2

This sequence is initiated by a small (0.02 ft ) cold leg break. In this scenario, the operator actuates the cavity flood system prior to vessel breach. Loss of cooling water inventory drops the primary system pressure to the low pressurizer pressure reactor trip setpoint and scrams the reactor at 19.7 seconds. Main feedwater is automatically run back upon reactor trip to match the reactor power.

Emergency core cooling water is unavailable, creating rapid boil-off of coolant inventory resulting in

/] core uncovery at 1.06 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. Zirconium oxidation begins shortly thereafter and rises dramatically at

(_) 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> resulting in 1718 pounds of hydrogen produced in the vessel prior to vessel breach. The fuel heats up and slumps into the lower head, with reactor vessel failure occurring at 3.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. A summary of event timings is shown in Table 19.11.5.4.3.1-1 and. selected parameter values are provided in Table 19.11.5.4.3.1-2.

19.11.5.4.3.1.1 Primary and Secondary System Response After the initiation of the event, the system depressurizes to the SIT pressure serpoint. Here the introduction of SIT water helps the core to maintain pressure (Figure 19.11.5.4.3.1-1) at 500 psia and two phase level (Figure 19.11.5.4.3.1-2) at around 13.5 ft. Initial core uncovery is at 1.06 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

The core is partially recovered by SIT injection.

Core uncovery is followed by rapid zircaloy-water oxidation. The fuel is predicted to rapidly heat up and melt. Support plate failure is predicted to occur at 3.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and RV lower head failure occurs shortly thereafter.

The secondary side of the steam generators remain full of liquid inventory (Figures 19.11.5.4.3.1-3 l and -4). The SG associated with the broken RCS loop cycles between the secondary side valve setpoint of 1200 psia and 900 psia (Figure 19.11.5.4.3.1-5) while the other SG cycles in a very tight l band about the relief valve setpoint (Figure 19.11.5.4.3.1-6).

19.11.5.4.3.1.2 Containment Response

-[k Containment sprays are actuated shortly after initiation of the transient when the containment pressure reaches the actuation setpoint. The IRWST initially is observed to drop in level as CFS is actuated l

and the IRWST water is sent to the holdup volume and reactor cavity. The IRWST level  !

i l

ANveved Dneipn htenerint hobabnistic Rink Assessment (11/96) Page 19.11141 1

l Sy' tem 80 + Design Control Document i

subsequently rises as RCS inventory is condensed and returned to the IRWST. A final surge in the IRWST level occurs at vessel breach when the SITS discharge the remainder of their inventory into l the reactor cavity. The IRWST reaches an equilibrium level at after vessel failure (Figure ,

19.I1.5.4.3.1-7).

Containment spray operation maintains a peak pressure of less than 20 psia in containment. Basemat crosion in the cavity is predicted to be negligible as is hydrogen production.

19.11.5.4.3.1.3 Fission Product Releases A summary of fission product releases is presented in Table 19.11.5.4.3.1-3.

19.11.5.4.3.2 Small Break LOCA with Dry Cavity In this scenario the operator fails to actuate the cavity flooding system. A summary of event timings is shown in Table 19.11.5.4.3.2-1 and selected parameter values are provided in Table 19.I1.5.4.3.2 2.

19.11.5.4.3.2.1 Primary and Secondary System Response The reactor vessel response is the same as that for the wet cavity of 19.11.5.4.3.1.

19.11.5.4.3.2.2 Containment Response Containment sprays are actuated shortly after initiation of the transient when the contairunent pressure reaches the actuation setpoint. The IRWST level dips as containment sprays and ECCS are actuated.

The level gradually increases as the condensed primary system inventory and SI liquid is collected from the break. (Figure 19.11.5.4.3.2-1). Note that since the CFS is not actuated, the IRWST level is isolated from the SIT discharge into the reactor cavity that follows vessel breach.

Containment spray operation maintains a peak pressure to less than 20 psia (Figure 19.11.5.4.3.2-2) and containment temperature to 130*F (Figure 19.11.5.4.3.2-3).

Basemat crosion in the cavity (Figure 19.11.5.4.3.2-4) is predicted to increase monotonically beginning at the time of reactor cavity liquid dryout (10.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />). About 3.3 feet of erosion is indicated by 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

19.11.5.4.3.2.3 Fission Product Releases A summary of fission product releases is presented in Table 19.11.5.4.3.2-3.

19.11.5.4.4 Total Loss of Feedwater This sequence consists of two scenarios entailing a complete loss of both main and auxiliary feedwater to the steam generator coupled with a failure of containment sprays. The cavity flooding system (CFS) is operational to flood the reactor cavity in one of the scenarios analyzed in the section but is not available in the other scenario.

O Anwowed Design Material . Probab&stic RM Assessment Pope 19.11142

1 System 80+ Deelan ConeralDeconsent l i

19.11.5.4.4.1 Total 14ss of Feedwater with a Wet Cavity l i

i in this scenario, the loss of all main and auxiliary feedwater is assumed to occur at time zero. The l

- reactor cavity flooding system is actuated early in the event. Active engineered safeguards are j unavailable in this scenario. A summary of event timing is shown in Table 19.11.5.4.4.1-1 and .  ;

selected parameter values are provided in Table 19.11.5.4.4.1-2.  ;

i Pdmary and Sarandary Systen Response

{

19.11.5.4.4.1.1

')

Following the loss of both main and auxiliary feedwater at time zero, the operators trip the reactor  :

coolant pumps at ten minutes into the transient. At approximately 2100 seconds into the transient, the i

steam generators dryout and the primary system begins to repressurize. Soon after steam generator dryout, the primary system reaches 2500 psia and the pressurizer primary safety valves begin to  ;

[ cycle. The loss of RCS inventory through the primary safety valves causes the core to uncover at approximately 4400 seconds into the transient. The response of RV level in this event is presented in -l Figure 19.11.5.4.4.1-1.  !

4 .

l

Core uncovery is followed by rapid zircaloy - water oxidation. Th fuel is predicted to rapidly heat l up and melt. Support plate failure is predicted to occur at approxinutely 8500 seconds and RV lower- l head failure is artificially forced to occur 900 seconds later. .

- 1 t

. 19.11.5.4.4.1.2 Ca=*=lan==* Response  !

~

In this analysis, the cavity flooding system (CFS) is assumed to be actuated prior to vessel failure.

4 v

.f) The interactions of the molten corium and cavity water raises the containment pressure in a steady,

. linear manner until the containment fails at approximately 75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> onto the transient.  ;

i 19.11.5.4.4.1.3 Fission Product uh  ;

A summary of fission product releases is presented in Table 19.11.5.4.4.1-3.

19.11.5.4.4.2 Total less of Feedwater with a Dry Cavity In this total loss of feedwater scenario, the operator fails to actuate the cavity flooding system and reactor vessel failure occurs in the presence of a dry cavity. A summary of event timings is shown in Table 19.11.5.4.4.2-1 and selected parameter values are provided in Table 19.11.5.4.4.2-2.

7 19.11.5.4.4.2.1 7.Ry and Secondary Systen Response The reactor vessel response is essentially the same as that for the wet cavity case discussed in Section 19.11.5.4.4.1.

19.11.5.4.4.2.2 Canemin==nt Response The interaction of the molten corium and the cavity water (originating from the safety injection tank inventory .and the small amount of remaining RCS inventory) along with the presence of various

' aaWa=ible gases causes the containment pressure to rise in a monotonic manner. The containment pressure at 80 hours9.259259e-4 days <br />0.0222 hours <br />1.322751e-4 weeks <br />3.044e-5 months <br /> is approximately 70 psia (Figure 19.11.5.4.4.2-1). This scenario g results in a basemat melt-through.

Approwd Des @n apasordof. Messem6io msk Assessment Aspe 79.f f 743

System 80+ Design ControlDocument Concrete attack is predicted to be monotonically increasing throughout the event and reaches l approximately 90 inches of basemat at the analysis endtime of 80 hours9.259259e-4 days <br />0.0222 hours <br />1.322751e-4 weeks <br />3.044e-5 months <br />. Extrapolating the erosion predictions suggests a basemat melt-through into the extended foundation will occurs in approxi.nately 8 days.

19.11.5.4.4.2.3 Fission Product Releases A summary of fission product releases is presented in Table 19.11.5.4.4.2-3.

19.11.5.4.5 Steam Generator Tube Rupture with Stuck Open MSSV In this sequence a steam generator tube rupture (SGTR) event is analyzed with a failure of RCS coolant make-up systems, except for the safety injection tanks (SITS). The rupture of two tubes in one generator is modeled. Charging and safety injection flows are assumed to be unavailable with no main and auxiliary feedwater to either steam generators. The containment spray system is assumed to be available during the transient for containment pressure and temperature control.

19.11.5.4.5.1 Primary and Secondary System Response Due to the RCS pressure decrease caused by the tube ruptures, the reactor trips on low pressurizer pressure. The rupture of the tubes coupled with no RCS make-up flow results in a rapid depressurization of the primary system (See Figure 19.11.5.4.5.1-1), with a concomitant decrease in primary system inventory (see Figure 19.11.5.4.5.1-2). As the RCS depressurization continues beyond 600 psia, the SITS start injecting fluid into the primary side. This causes a temporary decrease in RCS mass reduction. Subsequent to emptying of the SITS, the RCS inventory steadily decreases due to termination of SIT flow and continued break flow.

As a result of flow out from the SGs via the stuck open MSSVs, both SGs dry out quickly (at about 9 to 12 minutes) as seen from Figure 19.11.5.4.5.1-3. The dryout of the SGs results in the loss of the normal heat sink for RCS heat removal. Consequently the RCS heats up and begins to rapidly pressurize (see Figure 19.11.5.4.5.1-1). This pressurization causes the PSVs to open up and relieve RCS mass and energy into the IRWST. The PSVs cycle open and close to remove the decay heat.

The continued operation of the PSVs coupled with primary to secondary break flow depletes the RCS inventory as seen from Figure 19.11.5.4.5.1-2. Subsequently the fuel cladding heats up and hydrogen is generated within the core due to zirconium-water chemical reaction. The fuel rod heat-up results in core damage and ultimately in the absence of RCS coolant make-up, the reactor vessel fails.

Prior to vessel failure, the operator activates the cavity flooding system.

A summary of MAAP predicted key event timings and a summary of key transient parameters are provided in Tables 19.11.5.4.5.1-1 and 19.11.5.4.5.1-2, respectively.

19.11.5.4.5.2 Containment Performance The pSV discharge is ducted via the pressurizer pressure relief piping into the IRWST. The dit, charge of steam into the IRWST heats up the IRWST water. Subsequent to vessel breach the containment atmosphere heats up and is pressurized due to the release of steam and corium from the reactor vessel (see Figure 19.11.5.4.5.1-4). The containment continues to be pressurized due to generation of steam within the cavity. This pressurization is terminated at about 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> when containment sprays are actuated on high containment pressure. Subsequently the containment pressure and temperature decrease to their initial value (see Figures 19.11.5.4.5.1-4 and 19.11.5.4.5.1-5).

Asvwwd Des @ Material Probabmsts lusk Assessment (2/95) Page 19.11144

4 i

t Sy tem 80 + Design controlDocument Figure 19.11.5.4.5.1-6 shows that the cavity basemat erosion is insignificant (less than 1 inch) during I

this transient. This is due to adequate quenching of the core debris in the reactor cavity.

19.11.5.4.5.3 Fission Product Releases A summary of fission product group concentrations in the containment atmosphere at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after vessel breach is provided in Table 19.11.5.4.5.1-3.

19.11.5.4.6 V Sequence The dominant System 80+ V Sequence consists of an intersystem LOCA (ISL) irUtiated from a full l 1 shear break in the 16" diameter SCS line occurring within the containment building subsphere. This  !

i event is identified in the PRA as PDS 17.

l In this event all ECCS systems are operable. The failure of the SCS pipe outside of containment .

results in a gradual transfer of ECCS inventory from the containment to the subsphere. This l ultimately results in failure of the ECCS function due to the unavailability of a water source. Details l

' of this transient are discussed below.

19.11.5.4.6.1 RCS Response Characteristics  ;

[

The intersystem LOCA represents a large LOCA initiated outside of containment. Consequently the l ,

RCS response is similar to that of the large LOCA discussed in Section 19.11.5.4.2. In this case the j Shutdown Cooling System line break is equivalent to 1.4 square feet. This larger failure area results O in a more rapid RCS response. The ECCS maintains the core covered until the IRWST is depleted and suction is lost to the ECCS pumps. In this event a sustained core uncovery begins at 7700 t seconds (see Figure 19.11.5.4.6.1-2 and Table 19.11.5.4.6-1). Core support plate failure occurs at 13,800 seconds and failure of the reactor vessel is predicted to occur shortly thereafter.

The large failure area results in a rapid system depressurization to near atmospheric pressure which is sustained for the duration of the transient (Figure 19.11.5.4.6.1-1). A summary of key transient parameters is provided in Table 19.11.5.4.6-2.

19.11.5.4.6.2 Containment Response Characteristics The ISLOCA releases all the RCS and containment liquid inventory into the building subsphere.

Once the RV fails the corium is assumed to fully drop into the dry reactor cavity. Core concrete attack begins immediately. Concrete erosion will ultimately lead to a basemat failure. However, the bypass pathway provides a more direct means for releasing fission products to the environment.

These MAAP analyses do not credit the water accumulation expected in the subsphere ECCS rooms

, to scrub fission products leaving the RCS. Furthermore, detailed revolatilization models including the large length of SCS piping are likewise not considered in this demonstration.

19.11.5.4.6.3 Fission Product Releases MAAP predicted fission product releases for the V sequence are sununarized in Table 19.11.5.4.6-3.  !

Awevent Dee&n nennonio! Prebebassic Nok Assessment (11j96) rege 19.11145 I

Syntem 80+ Design Control Document 19.11.5.5 Summary Thermal-Hydraulic responses for various representative System 80+ severe accident sequences have been presented along with potential consequences and competing failure modes. These analyses provide information regarding characteristic transient behavior regarding System 80+ response a spectrum to severe accident sequences. The results demonstrate the robustness of the System 80+

containment design to withstand the long term containment challenges.

19.11.6 Summary and Conclusions The severe accident mitigation features of the System 80+ have been described along with their impact on the phenomenological response of the plant to beyond design basis accidents. This report demonstrates that the System 80+ design is robust and is capable of mitigating the consequences of a wide spectrum of severe accident scenarios while maintaining containment integrity and minimizing radiation releases to the general public.

Bounding deterministic calculations indicate that early containment challenges associated with vessel breach phenomena and hydrogen combustion result in peak loadings below the ASME Service Level C containment limit and hence provide a high degree of confidence that containment integrity can be maintained. Steam explosion loadings have also been quantified deterministically. These assessments suggest that the System 80+ cavity design can withstand impulsive loadings associated with a steam explosion involving 5 to 10% of the ejected corium mass without serious damage to the reactor cavity. Further structural analyses confirm that the System 80+ design is sufficiently strong such that even in the event of a complete loss of load carrying carr.~oitity of the reactor cavity, a consequential indirect breach of containment will not occur. The conditional failure probability of the containment due to this loading was assessed to be very low.

Additional early containment loadings associated with "in-vessel steam explosions", and RV rocket failure were assessed probabilistically. Based on this assessment, these containment failure modes were found to have a negligible contribution to the conditional containment failure probability.

Late containment failure was assessed deterministically using the MAAP 3.0B. Based on these studies it was concluded that for transients without containment heat removal, containment overpressure failure will not occur until after 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br /> following the initiation of the severe accident scenario. This slow pressurization response allows ample time for the operating staff to re-establish alternate containment cooling pathways and avert containment failure.

Deterministic basemat meh-through scenarios were performed using CORCON-MOD 3. These analyses assumed that 100% of the corium debris was cooled within the reactor cavity as a " layered impermeable media". Under these circumstances a local below ground penetration of the containment shell in the area of the basemat will be delayed for more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the onset of core melt.

Furthermore, this penetration is not considered to be significant since the local melt-through of the shell does not compromise the containment strength and is expected to only marginally increase fission product leak +.ge, if at all.

Basemat penetration into the plant extended foundation (soil) will be delayed for upwards of 8 days.

The System 80+ PWR has been designed to withstand beyond design basis events, with features such as a large containment, a large robust reactor cavity with thick concrete walls and floors, an in-containment refueling water storage tank for cavity flooding, and a rapid depressurization system Asywwed Design Material Probabmstic Misk Assessment Page 19.11146

Syntem 80+ Design ControlDocument for the reactor coolant system. Therefore, even considering the remote possibility that a core melt

(

condition develops, the System 80+ design is sufficiently robust to ensare that the operating staff has-adequate time to mitigate the event progression and minimize radiation releases to the environment.

i 1

i

^ , .: 'Dee@ Meenviel. PrebeMisDic Risk Assessment Page 19.11147

Syotem 80+ Dnign ControlDocument l Table 19.11.3.1-1 Axisymmetric Ultimate Stress Pressure Values h Temperature Yield Stress Pressure (psia)

('F) 290 minimum 157 mean 172 maximum 187 350 minimum 153 mean 168 maximum 182 450 minimum 147 mean 150 maximum 174 O

O Arreved Design Material ProbabMstic Risk Assessment (2/95) page 19.11.g4g

System 80+ Design ControlDocument

)

[V. Table 19.11.4.1.1-1 Melt Composition at VB Following a Station Blackout (Based on Reference 179)

IIigh Pressure With High Pressure With VB Penetration Low Pressure Creep Failure Failure Failure Total Mass Ejected (%) 40 34 63 Fraction of Ejected Mass 0.815 1.00 0.445 in a Molten State Molten Mass Composition (KGs)

Steel 16,000 8,500 28,700  !

Zr 15,000 15,000 13,000 UO2 24,000 34,300 5,000 ZrO2 0.00 0.00 0.00 Solid Mass Composition (KGs)

Steel 0.00 0.00 0.00 UO2 12,200 0.00 59,100 l

ZrO2 0.00 0.00 0.00

• Total Core Mass = 168,000 KGs (L.@Aing lower support structure)

O Annremed Desigre Meterie!. hebebnistic Miek Assessmerrt Page 19.11 149

System 80+ Design ControlDocument Table 19.11.4.1.1-2 Comparison of Various Exothermic Reactions Associated with DCH Processes l

IIeat of reaction per unit Reaction mass of reactant (hD/Kg) Reference Zr +2110 --> ZrO 2+ 211 2 6.74 169 2

0.43 169 Fe + 110 2 --> FeO + 112 0.98 169 3Fe + 4 H2 O --> 4H2 + Fe304 4.2 169 2Cr + 3 II2 0 -> 3112 + Cr203 11 178 2 + 1/2 O 2 --> 1I2 0 1.04 i

O 1

l I

1 O

Ap ' sed Design Material

• Probabmstic Risk Assessment Page 19.11150

System 80+ oesign controlDocument 2

m)

(J Table 19.11.4.1.1-3A Summary of Low Temperature Debris Dispersal Simulant Experiments Plant i Laboratory Simulation Scale Description ANL Zion These tests were performed in support of the IDCOR Reference design effon. The low. temperature experiment investigated the effects of containment geometry outside the reactor cavity on debris dispersal of corium into the Zion contamment. In these tests the configuration of the Zion reactor cavity and instrument tunnel were mocked up along with the seal table and the biological shield in the lower containment compartment inside of the crane wall. Wood's metal was chosen to simulate the corium. High speed movies of the cavity "sweepout" process showed that a large fraction of the debris is initially transponed as a large wave moving along the instrument tunnel surface ,

towards the containment.

Sandia Zion 1:10 Debris dispect tests were conducted with and without internal structures. V/ater wa used to simulate the corium debris and both air and he'ium were used to simulate the reactor vessel blowdown. The se expt timents provided experimental data on the entrainment dresho d and entrainment fraction and cavity n flow distribution. Wi6out internal structures the Zion cavity was found to be higby dispersive. The presence of structures in the cavity was n.ted to interfere with debris entrainment.

Flow mapping within the reactor cavity revea'ed that a high velocity gas boundary layer is formed along the bottom of the  !

reactor cavity.

The dominant sweepout mechanism for these expenment was due to a film entrainment.

BNL Zion 1:42 Tests were performed to si'pport NRC DCH scaling Surry methodology assessment program. Three

• representative" Watts Bar reactor cavities were investigated: Zion (IDCOR Type A Cavity), Surry (IDCOR Type D Cavity) and Watts Bar (IDCOR Type C Cavity). The corium was simulated by both water and Wood's metal. The driving fluid for the tests consisted of Nitrogen and Helium. For each cavity type a characteristic entrainment function was developed and basic information i regarding the entrainment process was observed. Zion  ;

experiments largely confirmed findings of larger scale melt ,

dispersion and DCH experiments. That is that the Zion cavity  !

is highly dispersive.

N

\

V) l AMweved Deshn Moserief nkobabniseic Riot Assessmerst Page 19.11 151

System 80+ oesign controloocument Table 19.11.4.1.1-3A Summary of Low Temperature Debris Dispersal Simulant Experiments (Cont'd.)

Plant Laboratory Simulation Scale Description Winfrith Sizewell 1:25 Simulant dispersal tests were performed using a 1:25 scaled mock-up of the Sizewell reactor cavity. Debris dispersal simulations were conducted with water (as the "corium" simulant) and air or helium as the blowdown fluid. Results of the scaled Sizewell tests were comparable to those obtained by Sandia for the 1:10 Zion cavity blowdown simulations.

Winfrith Sizewell 1:25 Winfrith performed a series of steady flow gas-corium dispersal experiments. Both air and belium were used as the driving fluid and five similar debris fluids were employed. The experiments were initiated with debris fully spread on the cavity floor prior to initiating the entraining gas flow. Experiments were typically conducted under quasi-steady flow conditions for about 10 seconds. Results of these experiments suggested that the entrainment criterion is dependent upon the Euler Number (Eu)

FAI Zion 1:50 Pressurized Wood's metal injection into a series of Millstone 3 to experimental models simulating Zion and Millstone 3 cavities 1:100 including cavity obstructions. Tests indicated that lower cavity and lower compartment design can be used to minimize the dispersal of debris to the upper compartment during HPME events.

Winfrith Parametric 1:132 Winfrith conducted a series of equivalent steady flow circular to geomeny entrainment/ dispersal experiments at scales ranging 1:21 from 1:132 to 1:21. The purpose of these experiments was to help identify the appropriate scaling parameters and dimensionless variables needed to define entrainment and debris dispersal processes.

O Anoroved Design Material Probabaistic Risk Assessment Page 19.11152

l System 80+ Design ControlDocument Q Table 19.11.4.1.1-3B Summary of DCH/HPME Experiments b

Plant Laboratory Test Series Simulation Scale Description /Results ]

SNL JETA-B - -- Iron-thermite tests to investigate high pressure discharge of hydrogen type saturated molten debris. Tests considered non-prototypical of severe accident reactor performance.

SNL  !!IPS - ZION SPIT SPITS consisted of high pressure scoping liigh SERIES (1:20) experiments. Tests were conducted with Pressure HIPS SERIES and without simulated reactor cavities.

Steammg (1:10) lilPS test series simulated HPME into Tests Zion-like cavities with and without internal structures. Test indicated that Zion-like cavity is in:ffective in holding up corium debris.

SNL SURTSEY: ZION 1:10 Tests injected 20 to 80 kg masses of iron DCH thermite in a reactor cavity / containment Test structure. Larger scale melt ejection tests indicated energy exchange efficiencies between the debris and the atmosphere to be about 30%.

'~'

/N ANL CWTl - ZION 1:30 Tests indicated that core debris could be

() Corium Water effectively removed by structures in the lower compartment.

Thermal Interaction ,

SNL SURTSEY: SURRY 1:10 Tests studied the effects of LFP compartmentalization in the containment, (Limited by placing a concrete slab in the path of Flight Path) dispersing debris. The presence of a concrete slab was effective in de-entraining corium debris, and reducing DCH loading.

ANL Counterpart ZION 1:40 Small scale counterpart test to the SNL Test IET experiments. Purpose of these tests was to provide data for scaling DCH processes. Specific features of the test include experimental studies regarding steam inerting and the role of pre-existing hydrogen in the containment.

SNL SURTSEY: ZION 1:10 Integrated effects test investigated the IET effect of simulated subcompartment (Integral structures on DCH. lower compartment Effects Test) stmetures were noted to significantly de-entrain debris and substantially reduce (7, containment loadings due to DCH.

t j

%/

~

4prowd Design Materiet Probabmstic Misk Assessment (11/96) Page 19.11153

System 80+ Design ControlDocument i

Table 19.11.4.1.1-4 Initial Conditions for "Two Cell" DCII Pressure Calculation l

Small LOCA Small LOCA Station Parameter!!1 Without Sprays With Sprays Blackout l

Mass of UO2 in Lower Plenum (Ibm) 77200 77200 77200 Mass of Zirconium in lower Plenum (Ibm) 33000 33000 33000 Mass of Steel in lower Plenum (Ibm) 26500 26500 26500 Mass of Steam in RCS at CRV Pressure 15900 1590) 48260 (lbm)

RCF Pressure Prior to VB (psia) 750 750 2500 RCS Temperature Prior to VB (*F) 700 700 900 Mass of Hydrogen in RCS (Kg) 50 50 470 Containment Pressure (psia) 35 20 20 Containment Temperature (*F) 215 135 100 Mass of Hydrogen in Containment (Ibm) 1455 1455 530 til lower plenum inventory is equal to about 37% of the core inventory including structure l Table 19.11.4.1.1-5 Predicted HPME Pressures Using "Two Cell" DCH Model s

l Parameter Predicted IIPME Pressures Fraction of Ejected Debris Entering Upper Compartment 0.10 0.25 0.50 l

Small LOCA with Sprays (psia) 58 62 68 l

l Station Blackout (psia) 89  % 106 O

Approved Desbon Material- Probabaistic Risk Assessment (2/95) Page 19.11-154

l l

System 80+ Design control Document n

V Table 19.11.4.1.1-6 Conditional Containment Failure Probability Associated with DCH This Table Intentionally Blank Table 19.11.4.1.2-1 Summary of Subjective Containment Conditional Failure Probability Due to "In-Vessel" Steam Explosion Investigator Best Estimate Upper Limit 4

Bankoff < 10 d .10 Bohl/ Butler 3x10 Briggs < 10-2 Catton 5x10-3 Cho WASH-1400 very conservative. Failure very unlikely.

d 10-2 Coorradini 10 Cybulskis 10 d 10-2 l Fauske Vanishingly small ( ~0)

Ginsberg 4x10-3 4x10-2 Mayinger No endangerment of FRG/PWR containment. l 4

Squarer 10-5 10 4 d Theofanous < 10 < 10 WASII-1400 10-2 10-1 l

-()

N)

AMwevoef Design Moseriel Probab&stic Risk Assessment Page 19.11 155

System 80+ oesign controlDocument Table 19.11.4.1.2-2 TNT Equivalent Loadings for Various Mass Discharges into a Subcooled Liquid Pool (Efficiency = 3%, Initial Superheat = 5040*R)

Corium Mass Involved in Explosion (LBM) Impulse Load (psi-sec) 500 0.44 5,000 1.89 10,000 2.92 20,000 4.52 30,000 5.83 60,000 9.03 Table 19.11.4.1.2-3A Probability Distribution for the Corium Mass Involved in EVSE This Table Intentionally Blank Table 19.11.4.1.2-3B Cavity Failure Probability for Various Combinations of Mass and Efficiency This Table Intentionally Blank Table 19.11.4.1.2-4 Steam Induced Containment Pressure Spike for System 80+ Following Vessel Lower Head Breach Typical Scenario Containment Pressure Following Breach

1. Station Blackout < 67 psia (Design Basis)  !

2. "V" Sequence LOCA < 67 psia (Design Basis)

3. Large LOCA 98 psia (w/o Cont. Sprays Available) l i

l l

l l

9l Approved Design Material-14obabsslic Risk Assessment Page 19.11-156 i

System 80+ Design control Document O Table 19.11.4.1.3-1 Summary of Experimental Data on Zircaloy Oxidation and Hydrogen g

v Generation Boiloff Oxidation Steam Above Test Time Consumed Minimum at High in Test Method Zircaloy Liquid Tempera- Zircaloy or Test of Test Hydrogen Oxidationm Level turesI 'l Oxidation Eventill Environment Termination Generatedm (%) (%) (sec) (%)

PBF ST Rich Reflood 172 75 75 600 = 16 PBF 1-1 Starved Slow 64 28 28 600 = 100 PBF13 Starved Slow 59 26 26 1120 = 100 PBF 1-4 Starved Slow 86 38 38 750 = 100 NRU Starved Slow 44 11 15 250 = 100 FLIIT-2 NRU Starved Slow 240 68 89 1800 = 94 FLHT-4 NRU Starved Slow 340 86 100 3000 = 83 FLHT-5 ACRR Starved Slow 38 33 33 570 = 86

)

s_/ DF-4 LOFT Rich Reflood 862 49 56 300 = 38 i FP-2 TMI-2 Rich Reflood 4.6E+5m 45 67 - -

l 333 All Table data based on Reference 188.

121 Amount of hydrogen generated (in grams) due to oxidation of Zircaloy only; does not include H 2 from oxidation of stainless steel or other sources.

m Test bundle inventory (core inventory for TM1-2). l l

(/ 183 Above 1700 K.

W Reads as 4.6 x 10. 5 Annreweet Design Mateniel Probabaisaic Misk Assessment Page 19.11 157

I System 80+ Design ControlDocument l l

Table 19.11.4.1.3-2 System 80+ Bounding "In Vessel" Ilydrogen Production Estimates Hydrogen Pmduced t21 Scenario PDSUI (fc of Active Clad)

1. Station Blackout with Stuck Open PSV 118 68

2. Station Blackout with Battery Depletion 242 38

3. Totalless of Feedwater 243 71

4. Small LOCA without SI 199/201/212 62

5. Medium LOCA without SI 18/20 41

6. Large LOCA without SI 1/3 36 til Plant Damage State Identifier (21 Ratio of active cladding to total zircaloy inventory s0.75 Table 19.11.4.1.3-3 Summary of PRA Assumptions for System 80+ Early Burn Event This Table Intentionally Blank Table 19.11.4.1.3-4 Classification of Mixture Detonability (from Reference 139)

O Ilydrogen Mole Fraction Mixture Class (Volume Percent) Comments 1 24 To 30 Highly detonable 2 21 To 24 Less detonable than Class I mixtures l l

3 15 To 21 Observed to undergo DDT in favorable i geometries l 4 13.5 To 15 Detonations can propagate in mixture but DDT l not obsened 5 ,

Iesj Than 13.5 Difficult to detonate O

Apprend Design Materlat . Probab&stic Risk Assessment Page 19.11-158

System 80+ Design ControlDocument i

Table 19.11.4.1.3-5 Classification of Geometric Features Conducive to DDT l (from Reference 139)

Geometric Class Description 1 L.arge Partially Confined Geometry with Obstacles in the Path of Expanding Unbumed Gases.

Example: A Large Tube with Obstacles and Ignition Going from an Open to Closed End.

4 2 Geometry is Similar to CLASS 1 but Tube May be Open at Both Ends or Transverse Venting is Allowed.

3 Geometries that Yield Moderate Flame Acceleration.

Example: Open Tubes without Obstacles.

4 Large Volumes with Few Obstacle and Significant Venting Transverse to Flame Path 5 Unconfined Geometry r

Table 19.11.4.1.3-6 Dependence of Sherman/Berman Result Class"3 on Mixture and l Geometry Class i Geometric Mixture Class Classm 1 2 3 4 5 1 1 1 2 3 4 2 1 2 3 4 5 3 2 3 3 4 $$$ME$idire; 4 3 4 4 NNlsyW$ $5kNMC . '

5 4 5  % I ' S d ' a$M$i Sl, f^ih k ,

Result Class 1: DDT is highly likely Result Class 2: DDT is likely Result Class 3: DDT may occur Result Class 4: DDT is possible, but unlikely Result Class 5: DDT is highly unlikely to impossible Note: Shaded area corresponds to the System 80 + design range. l I" Hydrogen accumulation in the IRWST (Geometric Class 4) may result in lower mixture classes than indicated in the above table. However, because of the high steam content and low oxygen content associated with the IRWST vapor space, the resultant detonation class is considered to be 5 (DDT is highly unlikely to impossible).

323 Selected regions in the containment with a low probability of hydrogen accumulation may have a lower

~

geometric class. However, the resultant class rank is still expected to be in the range of 4 to 5 (unlikely or impossible to detonate).

.%,; Designs Aseeen\el-Walc Rick Assessmeret (11/96) Po9e 19.11159

SyTtem 80+ Design ControlDocument Table 19.11.4.1.4-1 Rocket Induced Failure Probability for High and Intermediate Pressure Sequences This Table Intentionally Blank Table 19.11.4.2.1-1 Time to Containment Failure for Various Severe Accident Challenges (CFS Actuated)

Transient PDSm Time to Core Time to Level C Time to Ultimate Uncovery (Hours) PressureA Failure Pressurem (Hours) (Hours) 118 1.9 64 75 Station Blackout Station Blackout 242 12.1 > 65 -

with Battery Depletion 243 1.25 62 72 Total less of FW W/O Feed and Bleed 0.47 50 60 Medium LOCA 1 Without HPSI Small LOCA '01 1.05 65 ---

Without ilPSI ,

1 A Plant Damage State ILatifier j A ASME Service Level C pressure at 350'F = 141 psia; Ultimate failure pressure (Probability of Failure

= 0.50) = 168 psia Table 19.11.4.2.1-2 Comparison of Properties of Common Concretes Limestone / Common l Property Units Basaltic Limestone Sand Avg. Specific Ileat J/Kg/K 913 979 903 l Melting Temperature K 1450 1750 1500 Energy Absorbed in J/Kg 269 E+3 1735 E+3 1150 E+3 Endothermic Chemical Reactions Latent Heat for J/Kg 555 E+3 760 E+3 560 E+3 Concrete Melting I

Asywoved Design Material. Probabastic Risk Assessment Page 19.11-160

System 80+ Design ControlDocument Table 19.11.4.2.1-3 Comparison of Concrete Constituents Mass Fraction by Weight Limestone / Common Component Basaltic Limestone Sand SiO2 0.5484 0.036 0.358 Ca0 0.0882 0.4540 0.313 CO2 0.015 0.357 0.2115 H20-FREE 0.0386 0.0394 0.027 H20-BOUND 0.0200 0.0200 0.020 OTliER 0.2898 0.0936 0.0705 Table 19.11.4.2.1-4 Gas Evolution During the Thermal Degradation of Concretel "

(3 V Gas Release Fran Concrete Temperature Range Free Water 180 - 280*F Chemically-Bound 660 - 950*F )

Carbon Dioxide 1000 - 1800'F l

O Ill Oxidation processes within the corium melt may result in the chemical reduction of water releases to hydrogen and the carbon dioxide releases to carbon tronoxide.

.^;;...d Desiger nieterini Mmtic Risk Assessmeert Page 19.11-161

System 80+ Design ControlDocument Table 19.11.4.2.2-1 Summary of Debris Coolability Investigations Debris Scale Configuration Comments Experiment ial BENZ-ISPRA 10 cm Continuous Observed fragmentation with excess water 50 cm Fragmented AML-CWTI 21 cm Continuous, some Observed enhanced surface area, debris fragments porous SNL 22 cm Continuous, cracked Inferred water ingression on quench SNL-SWISS 21 cm Continuous Observed stable crust, metallic melt, high power ANL 25 cm Continuous, cavern Observed stable crust attached to sidewall ANL-ACE 50 cm Continuous Observed crust collapse onto degris surface GRIMSVOTN 90 m Deeply fissured Observed large lava field cooled and cracked MAGMA to 12 m depth TMI-2 6m Continuous, some Inferred lower plenum heat flux fragments corresponding to CHF MACE Scoping 30 cm Continuous, some Observed crust attahed to sidewall with fragments periodic breakup WETCOR-1 32 cm Continuous Crust anchored to facility. Corium simulant mixture of Al203and CaO MACEIB 50 cm Continuous Stable crust with periodic breakup. Long term cooling was approached, however complete debris quench was not achieved.

Simulant was 950 lbm mixture of UO2 ,

ZrO2 and Zr.

I'l Table extended from Reference 150 Table 19.11.4.2.2-2 Effect of Degraded IIcat Transfer on Corium Debris Coolability Limestone / Common Sand Concrete FCHF 0.10 0.05 0.02 0.01 Maximum Erosion Distance (ft) 0.025 0.28 3.15 6 Time Concrete Attack Ends (hr) 3.5 6 25 > 5001 O

til Time to erode 3 ft of concrete = 18 hrs Anoroved Design Material Probabmstic Risk Assessment Page 19.11-162

System 80+ Design ControlDocument D Table 19.11.4.2.2-3 Summary of ANL CORCON-MOD 3 Erosion Studies

~Q Peak Axial Erosion Peak Radial Erosion @ 24 Hrs

@ 24 lits (ft) (ft)

Limestone 1.3 1.3 Limestone / Common Sand 2.1 2.2 Basaltic 2.9 3.05 Table 19.11.4.2.2-4 Surface Heat Flux From Corium Debris Required to Concrete Erosion at Various Times After Reactor Scram (100% of Corium Involved in Concrete Attack)

Time After Scram Decay Heat Only @iw/m2) Decay Heat Plus Chemical 2

Reactions"3 Ofw/m ) _

3 hrs 0.448 0.89 6 hrs 0.39 0.58 12 hrs 0.315 0.315 24 hrs 0.270 0.270 DI Contribution due to chemical energy addition is approximate Table 19.11.4.2.4-1 Summary of Late Hydrogen Burn Conditions Containment Cond!! ion l Hydrogen Fraction of Available Active Clad Peak Pressure Containment Early Burn or (Ibm) OxidizedHI (psia) Failure Probability DCil CCI Y N 1923 0.75 94.2 7.04X104 Y Y 2564 1.00 103.0 .00588 N N 3250 1.25 125.2 .01894 N Y 3846 1.50 140.0 .0276 h

G/

Di Active clad conservatively bounded by 58.500 lbm of zircaloy.

Approvent Desigrr Atatorial. Probabnistic Misk Assessmerrt Page 19.11 163

System 80+ Decign ControlDocument l Table 19.11.4.3.2-1 XSOR Radionuclide Grouping for NUREG-1150 Reference PWRs Group Elements I Xe,Kr 2 1,Br 3 Cs,Rb 4 Te,Sb,Se 5 Sr 6 Ru,Rh,Pd,Mo,Tc 7 1 a,Zr,Nd,Eu,Nb Pm,Pr,Sm,Y 8 Ce,Pu,Np 9 Ba Table 19.11.4.3.2-2 Mean and hiedian Values for Fission Product Releases from the Core l Into RCS (FCOR) (from Reference 194)

Conditions FCORH1 NG I Cs Te Sr Ba Ru La Ce 0.92 0.75 0.62 0.33 0.006 0.009 0.005 0.0001 0.00015 PWRs High Zr Oxidation (0.83) (0.71) (0.61) (0.36) (0.07) (0.08) (0.02) (0.004) (0.02) low Zr 0.9 0.69 0.58 0.19 0.004 0.006 0.002 0.0001 0.00015 Oxidation (0.8) (0.6) (0.55) (0.3) (0.07) (0.08) (0.01) (0.004) (0.02) p) Mean values are shown in parenthesis Table 19.11.4.3.2-3 Mean and Median Values for Fission Product Transmission Within l RCS (FVES) (from Reference 194)

FVES"3 NG I Cs Te Sr Ba Ru La Ce Setpoint Pressure 1.0 0.09 0.04 0.03 0.03 0.03 0.03 0.03 0.03 (0.2) (O.19) (O.15) (0.15) (O.15) (O.15) (O.15) (O.15)

High & Intermediate 1.0 0.41 0.29 0.25 0.24 0.24 0.24 0.24 0.24 Pressure (0.4) (0.36) (0.3) (0.3) (0.3) (0.3) (0.3) (0.3)

Low Pressure 1.0 0.52 0.40 0.33 0.33 0.33 0.33 0.33 0.33 (0.55) (0.48) (0.4) (0.4) (0.4) (0.4) (0.4) (0.41)

O Di Mean values are shown in parenthesis.

Approved Design Matenial Probabdistic Risk Assessment (2/95) Page 19.11-164

Sy~ tem 80+ Design ControlDocument Table 19.11.4.3.2-4 Mean and Median Values of Fraction of Fission Products Species

( Product Present in the Melt Participating in HPME that is Released to Containment in a Direct Containment Heating Event (FDCH)

(from Reference 194) l RCS FDCHi2 PressureUI at Vessel NG I Cs Te Sr Ba Ru La Ce Breach 11 1.0 0.094 0.94 0.025 0.007 0.009 0.015 0.006 0.003 (1.0) (0.80) (0.80) (0.16) (0.06) (0.07) (0.07) (0.02) (0.02)

I 1.0 0.94 0.94 0.016 0.003 0.006 0.01 0.004 0.004 (1.0) (0.80) (0.80) (0.16) (0.05) (0.07) (0.06) (0.02) (0.02)

Ul II & I refer to high (> 2000 psig) and intermediate (< 1300 psig) RCS pressure, respectively.

823 Mean values are presented in parenthesis.

Table 19.11.4.3.2-5 Mean and Median Values for the Fractions of Radionuclide Group I l Released During Core-Concrete Interaction (FCCI) for PWRs l (from Reference 198) l G

h FCCIVI Zirconium Cavity Content in the Condition t23 MeltI23 I,Cs Te Sr Ba Ru La Ce D 11 1.0 0.56 0.05 0.04 2x104 8x10 d lx102 (0.52) (0.15) (0.13) (0.004) (0.015) (0.02)

D L 1.0 0.5 0.05 0.03 2x104 7x104 9x10d (0.45) (0.13) (0.11) (0.004) (0.015) (0.01)

W 11 1.0 0.24 0.02 0.02 3x104 4x104 4.5x10d (0.30) (0.11) (0.10) (0.002) (0.002) (0.01)

W L 1.0 0.23 0.009 0.01 3x104 3x104 4x104 (0.28) (0.09) (0.07) (0.002) (0.002) (0.01)

/

"I Mean values are presented in parenthesis.

I21 D & W refer to dry and wet cavity respectively.

I'l 11 & L refer to high and low Zirconium content in the melt.

Anwoved Design Meterial. Probabdistic Rdk Assessment (2/95) Page 19.11165

System 80+ Design ControlDocument l Table 19.11.4.3.2-6 Mean and Median Values for the Fraction of Radionuclide Group I Retained in RCS Released into Containment After Vessel Failure g

(FREV)

Conditions FREV"1 I Cs Te 0.04 0.02 0.

One opening after vessel breach (0.1I) (0.05) (0.04) 0.13 0.095 0.

Two openings after vessel breach (0.22) (0.20) (O.12)

I'l The mean values are shown in parenthesis.

Table 19.11.4.4-1 Minimum List Of System 80+ Instrumentation Required For Severe Accident Mitigation And Recovery Required Required Instrument Pre-Vessel Breachul Post-Vessel Breach UIUTCl21 Yes No RCS Pressure or PZR Pressure Yes No SI Flow Yes No EFW Flow Yes No SG Water Level Yes No IRSWT Water Level Yes Yes 11ydrogen Monitors Yes Yes Radiation Monitor Yes Yes Cont. Pressure Yes Yes Cont. Temperature Yes Yes CS Flow Yes Yes 1I Instruments required in this column are used to achieve a safe plant shutdown as per 10CFR50.34(f).

I:3 Functionability required for thermocouples located in upper guide structure only.

Approved Design Material- Probab&stic Risk Assessment (2/95) Page 19.11 166

]

System 80+ Design Control Document r

\. Table 19.11.4.4-2 Minimum List of System 80+ Equipment Required For Severe Accident Mitigation And Recovery Operation Required Operation Required System Pre-VB Post-VB Safety injection (SI) Yes No Emergency Feedwater System (EFW) Yes No Containment Isolation Yes No l ,

Safety Depressurization System Yes No Cavity Flooding System Yes No Hydrogen Mitigation System (Igniters) Yes Yes Containment Penetration Integrity Yes Yes Containment Spray (CS) Yes Yes .

Shutdown Cooling System (SCS) Yes Yes Table 19.11.4.4-3 Maximum "In-Ve:.sel" Pressure / Temperature Conditions Prior to VB RCS Location Temperature Pressure Comments l Upper / Head (above < 1600*F <2500 psia UHJTCS located within this l

( UGSSP)DI region.

Cold legs (suction / < 700'F <2500 psia RCS Pressure l discharge)

Pressurizer <700*F for LOCAs <2500 psia Pressurizer pressure tap and Rapid l Depressurization valve interface

< 1200'F for with this region. l Transients with PSV l cycling or SDS open ill Upper Guide Structure Suppon Plate.

Table 19.11.4.4-4 Maximum Containment Pressure / Temperature Conditions Prior to VB i

Transient Containment Temperature Containment Pressure l I

"In Containment" Release < 300'F <75 psia l' Sequence

• Bypass /SGTR" Release Sequence < 250* F <30 psia l i

t O

l Anwesed Deekn nietene! Probabaseic Mink Assessment (2,95) Page 19.11-167

Srtem 80+ oesign controlDocument Table 19.11.4.4-5A System 80+ Instrument / Equipment Survivability for Instruments Located Within the Primary System Required for Safe-Shutdown Bounding Accident Environment Instrument Severe Accident Comments "In-Vessel" Containment Procurement /

Placement Temp Press Temp Press Ilydrogen Considerations

('F) (psla) (*F) (psia) Burn UlDTC 1600 2500 < 300 < 75 Note ! Thermocouples to be Consistent with a functional above ceramically insulated 2000'F. Type K,TC.

Cables to be capable Cables to be routed at of surviving a least 10 ft from active limiting hydrogen igniters and, if burn (see Note 2) and necessary, radiatively igniter operation. protected from diffusion flames.

Note 3 O

Notes:

(1) Expected bounding temperature spike from 250'F to 590'F for 30 seconds, pressure <100 psia.

[2] Survivability required for temperature spike from 250'F to 600'F for S0 seconds, pressure < 100 psia.

[3] Contaimnent conditions within existing DB EQ.

A15veved Design MaterW Probabin*stic Misk Assessment Page 19.11-168

System 80+ oesign controlDocument Table 19.11.4.4-5B System 80+ Instrument / Equipment Survivability for Instruments /

(]

V Systems Attached to the RCS Required for Safe Shutdown Bounding Accident Envitunment Instranent/

"in-Vessel" Containment m

"^ " """"*

i System n we.iement/ Placement (Note 5) =

g. g Considerations Tesup Press Temp Press Hydrogen

('O (psla) ('O (psia) Burn RCS < 700 2500 < 300 < 75 Note 1 Sensor cables to be DB EQ Bounds typical  !

Pressure required to survive "in- "in-vessel" and I

Measurement contamment" hydrogen contamment environ-

burn. (See Note 2.) ments.  ;

(Note 4)

See Note 3 for placement NTS tests indicate  !

restrictions. ability of DB EQ pressure transmitters see note 8 and cables to survive single and a limited '

number of multiple high temperature <

hydrogen burns.

Pressurizer < l200 2500 < 300 < 75 Note 1 Same as above. Same as above.

Pressure for Measurement 'CRV*

,\ &

(Note 4) SDS Transients

<700 all Other Transients (Note 9)

SG Water --- - < 300 < 75 Note 1 Same as above. Same as above.

Level

. SDS Rapid < 700*F 2500 < 300 < 75 Notes 6 & 7 Operation of SDS Temperatures within Depressuriza- depressurization valve is pressurizer will tion Valves included in EOG as an continue to be low action to be taken prior to prior to significant core  ;

case uncovery. damage. Delayed actuation is still possible even in the ';

event of severe core damage.

ANwevent Dee&n neeenrief. hobabnishic Alek Assessment Page 19.11 169

System 80+ Design ControlDocument Table 19.11.4.4-5B System 80+ Instrument / Equipment Survivability for Instruments /

Systems Attached to the RCS Required for Safe Shutdown (Cont'd.)

Notes:

1. Expected bounding temperature spike from 250'F to 590*F for 30 seconds, pressure < 100 psia.

2. Survivability required for a temperature spike from 250*F to 600*F for 30 seconds, pressure < 100 psia.

3. Placement restrictions on pressure cells and cables:

• Imre transmitters beyond outer crane wall.

• Transmitters & cables to be positioned at least 10 feet from igniters and, if necessary, radiatively shielded from potential diffusion flames.

4. Post accident RCS pressure can be tracked via either RCS or pressurizer pressure transducer; therefore, survival of only one of these sensors is required.

5. "in-Vessel" temperature environments refer to thermal steam conditions within the RCS. Temperatures at the transmitter are significantly lower due to thermal capacitance of the imbedded metal structure, lines or pressure taps and the heat losses in the long length (between 20 to 80 feet) of piping connecting the RCS to the transmitter or valve.

6. No hydrogen burn requirement is stipulated for SDS rapid depressurization valves. This is a consequence of:

• SDS valve actuation is included in the EOG as an action to be taken prior to core uncovery.

• Even if significant case uncovery occurs for transients where .SDS operation is required, most hydrogen produced during core degradation is trapped within the RCS and is unable to cause a burn threat to the SDS Rapid Depressurization Valves.

7. SDS rapid depressurization valves fail on *as is" condition.

8. Containment conditions within existing design bases EQ.

9. "CRV* refers to cycling relief valve.

O Approved Design Material Probabikstic frisk Assessment Page 19.11-170

System 80+ oesign contrat Document Table 19.11.4.4-5C System 80+ Instrument / Survivability for Instruments Located Within (nL') the Containment Required for Safe-Shutdown and/or Containment Integrity Bounding Accident Environment Instrument Severe Accident Comments Procurement / Placement Temperature Pressure Hydrogen Considerations

('F) (psia) Burn Containment < 350 < 100 Note 1 Sensor to be procured 1. Operability of Temperature with a minimum typical platinum Sensor operating range of 0 to based RTDs 400*F. exceed a 500'F sensing capabi.

Pressure limit to be added lity, with to procurement capability to specification. function to above 1000'F.

See Note 3. 2. DB EQ is expected to provide accept-able performance for this instrument.

3. Typical RTD l vendor cables j can survive 1 repeated 1400*F temperature spikes.

liigh Level < 350 < 100 Note 4 See Note 3. Required by Radiation 10CFR50.34(f).

Monitor 1

0 Apperoved Design Meteriel . Probabnistic Misk Assessment Page 19.11171

System 80 + Design ControlDocument Table 19.11.4.4-5C System 80+ Instrument / Survivability for Instruments Located Within the Containment Required for Safe-Shutdown and/or Containment Integrity Notes:

1. Expected bounding temperature spike from 250*F to 590'F for 30 seconds, pressure < 100 psia.

2. Survivability required for temperature spike from 250*F to 600'F for 30 seconds, pressure <100 psia.

3. Device and cables to be located at least 10 feet away from igni:ers and, if necessary, radiatively shielded from potential diffusion flames.

4. Survival from a hydrogen burn is likely for this instrument, but is not required due to redundancy available for radiation assessments. This redundancy arises from:

e event history which trends core damage up until the time of potentially destructive hydrogen burn e on-line sampling of the radiative environment via the PASS system (which is available within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following the event), see Table 19.11.4.4-5D and e indirect radiation monitoring via radiation detection devices located in the subsphere, nuclear annex and site.

O I

l l

Ol1 Altwoved Design Motorial MbabEstic Misk assessment Page 19.11172 l

t

System 80+ Design controlDocument O Table 19.11.4.4-5D System 80+ Instrument / Survivability Requirements for Instruments / Located Outshde of Containment Required for Safe-Shutdown or Containment Integrity Required For Severe Accident lastrument Safe-Shut- Bounding Accident Procurement / Comments down or Environment Placement 1 Cont. Considerations Integrity IRWST Water Yes Post-VB: Pressure limit toe Water level to be I.wel Ps140 psiaUl added to specifications. sensed offIRWST T s350'F external to containment.

Containment Yes Post-VB: None. Pressure sensor to be Pressure Ps 140 psia"I procured at 4 times T s350*F- design pressure.

DB EQ provides confidence of sensor operation at high containment tem-peratures.

Hydrogen Yes Post-VB Sampling lines of the hy- -

Monitor Ps140 psia drogen monitor will be J T s350'F procured to allowing sampling at pressure up to 140 psia.

Post Accident Yes P s 140 psia None. System located entirely Sampling T s 350*F in subsphere and System nuclear annex.

Instrument system available for radiological monitoring within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of a severe accident.

Flow Monitors Yes Not influenced None. -

St EFW CS, by Containment SDCS Thermal Environment I

O 111 Temperatures / Pressures refer to monitoring ranges, not instrument exposure.

^

r..: Doelptr nieterief P\robabnistic Mick Assessmeert Page 19.11 173  ;

I

r l

System 80+ Design Control Document Table 19.11.4.4-5E System 80+ Equipment Survivability Requirements for Equipment / Located Outside of Containment Required for Safe-Shutdown or Containment Integrity Required For Bounding Severe Accident l Equipment / Safe- Containment Procurement / Comments l System Shutdown Accident Placement Environment Considerations Safety injection Yes Pre-VB: None. System required for "in P=75 psia! I vessel" recovery scenario T < 330*F only.

Emergency Yes Not Applicable None. System required for "in vessel" recovery scenario Feedwater System only Yes Pre-VB: None. Containment spray is a Containment P=140 psia r21 closed system and can Spray System T = 350*F deliver against any "in containment

• pressure provided suction temperature is below 400*F.

Shutdown Cooling Yes Pre-VB: None. SCS pumps are identical System P= 140 psia to CS pumps.

T =350'F I'l Refers to pump suction conditions.

(21 Refers to pump suction / header discharge conditions.

l A5npromi Design Meterial Probabmstic Risk Assessment page 19, y g.174

System 80+ oesign controi Docwnent x

Table 19.11.4.4-5F System 80+ Equipment Survivability Requirements for Equipment / Located Inside Containment Required Bounding Severe Accident Equipment / For Safe- Containment Procurement / Comments System Shutdown Accident Placement Environment Considerations l Containment No Design Basis EQ None. System activated early in Isolation System Environment the event well in advance of a sustained core uncovery.

Cavity Flooding No P=75 psia CFS limiting CFS is to be activated in System T = 300*F operating conditions advance of significant core are with DB EQ uncovery and well in envelope, advance of VB.

Positioning of CFS valves in hold-up volume and lower containment protects  ;

valves from harsh thermal i enviromnent well post VB.

Containment No P= 140 psia Containment it is expected that the ,

Penetration T = 350'F penetrations will be penetration designs will far 1 including Hydrogen designed to exceed exceed the stated require-

/ burn service level C failure ment.

pressure.

IEEE standards for Penetrations will be electrical penetrations designed to survive a provide high temperature minimum of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (> 350*F) integrity for ,

at the limiting more than 10 days. (See I pressure and Section 19.11.4.4.1.4.4.3) temperature.

Hydrogen Yes P=75 psia Igniter system will be Limiting igniter ,

Mitigation T = 1200'F designed to survive environment based on l System (Igniters) for 45 minutes its expected continuous high operation. concemration hydrogen burns.

l (D

\,

Approvent Design Atatoriel Probekibseic Risk Assessment Page 19.11175 l 1

System 80+ Design Control Document Table 19.11.4.4-6 Summary of Effective Integrated Dose Times for Severe Accident Mitigation Equipment and Instrumentation g

InstrumentiSystem Days of Operation At ill Days of Operation At t21 Level 2 "In-Vessel" Dose Maximum Dose System:I33 SIS 100 N/A EFW 3 N/A SDS 3 N/A CFS 3 N/A CIS 3 N/A CS 100 10t4)

SDCS l_00 10'l Containment Penetrations 15 ~ 10fdl/100ts.61 Instrumentation:

UllJTC Probes of RVLMS 180 N/A RCS 180 N/A PZR Pressure 3 N/A SG Water Level 3 N/A IRWST Water level 180 180 liydrogen Monitoring System 100r71 igotsj liigh Level Radiation 180 Backup with PASS Containment Pressure 180 180sj t Containment Temperature 180 180sj t 131 level 2 dose refers to dose due to coolant activity, gap releases and early core melting.

[21 NUREG-1465 dose due to gap and "carly in-vessel", "ex-vessel" and ' late in-vessel"

13) Instrumentation associated with these systems are qualified consistently with the intended function of the specific system.

143 Based on dose within the sump.

151 Based on airbome radiation dose.

I'l Location dependent.

I73 Equipment qualification per Reg. Guide 1.7 (See Section 3.11).

Approved Design Matenial. PrebabMstic Risk Assessment Page 19.11-176 l

l 1

System 80+ Design ControlDocument I

Summary of MAAP Predicted Key Event Timings for

( Table 19.11.5.4.1.1-1 System 80+

j Plant Accident Sequence: LOOP-9E j Plant Damage State: 243 Event

Description:

Station Blackout with Wet Cavity ,

Time (seconds) Event Timings  !

i 0.0 Accident Initiation 0.0 Reactor Trip 6919.3 Core Uncovery 12432.6 Core Support Plate Failure 12492.4 Reactor Vessel Failure 226800.0 Containment Reaches ASME level "C" Pressure ,

j (63 hrs)

Table 19.11.5.4.1.1-2 Summary of Key Parameters ,

1 C Plant Accident Sequence: LOOP-9E O) Plant Damage State: 243 Event

Description:

Station Blackout with Wet Cavity Parameter Value Mass of hydrogen generated in vessel (Ibm) 1405 Mass of hydrogen remaining in vessel just prior to 970 Vessel Breach (Ibm)

Primary system pressure at Vessel Breach (psia) 2450 Maximum predicted concrete crosion at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (ft) 0.22 Maximum predicted concrete erosion at 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> (ft) 0.22 Containment pressure at Vessel Breach (psia) 17 Containment pressure at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (psia) 64 Containment temperature at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (*F) 286

'r\

f Annreved Deshpn nieneriet - Probabnistic Misk Assessment Page 19.11-177

System 80+ Design ControlDocument Table 19.11.5.4.1.1-3 Summary of Fission Product Group (FPG) Concentrations Plant Accident Sequence: LOOP-9E Plant Damage State: 243 Event

Description:

Station Blackout with Wet Cavity FPGUI FPGUI Concentration in Containment Concentration in Containment component Atmosphere following Vessel Atmosphere at Containment Failure Breach (fraction of initial inventory) (fraction of initial inventoty) 1 Nobles 0.96 0.98 2 CSI + RBI 0.099 3.1 x 10-3 3 TEO2 0.00 0.00 4 SRO 0.008 2.5 x 10-s 5 MOO 2 0.0119 1.2 x 104 6 CSOl{ + 0.127 4.4 x 10-3 RBOli 7 BAO 0.0086 2.7x 10-7 8 LA2O3 + 9.92 x 104 8.5 x 104 PR203 +

ND203 +

SM2O3 +

Y203 9 CEO2 0.0062 1.1 x 10-a 10 SB 0.17 0.16 11 TE2 0.54 2.3 x 10-5 O

l'I Fission Product Group Approved Design Metennt Probab&stic Risk Assessment Page 19.11-178

System 80+ Deslan controlDocument r

h' Table 19.11.5.4.1.2-1 Summary of MAAP Predicted Key Event Timings for System 80+

Plant Accident Sequence: LOOP-9F Plant Damage State: 241 Event

Description:

Station Blackout with Dry Cavity Time Event Timings (seconds) 0.0 Accident Initiation 0.0 Reactor Trip 6938.3 Core Uncovery 12581.5 Core Support Plate Failure 12661.3 Reactor Vessel Failure

= 8 days (approx.) Containment Failure via Basemat Melt-through Table 19.11.5.4.1.2-2 Summary of Key Parameters O

'L/

Plant Accident Sequence: LOOP-9F Plant Damage State: 241 Event

Description:

Station Blarhat with Dry Cavity Parat.eter Value Mass of hydrogen generated in vessel (Ibm) 1405 Mass of hydrogen remaining in vessel just prior to 970 Vessel Breach (Ibm)

Primary system pressure at Vessel Breach (psia) 2450 Maximum predicted concrete erosion at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (ft) 2.6 Maximum predicted concrete erosion at 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> (ft) 5 Containment pressure at Vessel Breach (psia) 16 Containment pressure at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (psia) 42 l l

Containment temperature at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (*F) 330

]

AnnreM Deskm nennend habnMEiene hink Assessment P.ge 19.11 179

System 80+ Design ControlDocument Table 19.11.5.4.1.2-3 Summary of Fission Product Group (FPG) Concentrations Plant Accident Sequence: LOOP-9F Plant Damage State: 241 Event

Description:

Station Blackout with Dry Cavity FPGI 'I FPGill Concentration in Containment Concentration in Containment component Atmosphere following Vessel Atmosphere at Containment Failure Breach (fraction of initial (fraction of initial inventory) inventory) 1 Nobles 0.98 N/A 2 CSI + RBI 0.096 N/A 3 TE02 0.00 N/A 4 SRO 0.0018 N/A 5 MOO 2 0.0108 N/A 6 CSOH + 0.127 N/A RBOH 7 BAO 0.0053 N/A d N/A 8 LA203 + 3.09 x 10 PR203 +

ND203 +

SM2O3 +

Y203 9 CEO2 0.0011 N/A 10 SB 0.072 N/A 11 TE2 0.114 N/A O

fil Fission Product Group Attwend Design Material Prchabilistic Risk Assessment Page 19.11 180

l l System 80+ Design ControlDocument Table 19.11.5.4.1.3-1 Summary of MAAP Predicted Key Event Timings for System 80+

Plant Accident Sequence: SBOBD-E Plant Damage State: 244 Event

Description:

Station Blackout with Battery Depletion at 8 hrs (Reactor Cavity " Wet")

Time Event Timings (hrs) 0.0 Accident Initiation 0.0 Reactor Trip 8.0 AFW Stops due to Depleted Battery 12.0 Core Uncovery Begins 14.8 Lower Core Support Plate Fails 14.8 RV Lower Head Fails 14.82 SIT Water Depleted Containment Failure

, Table 19.11.5.4.1.3-2 Summary of Key Parameters

)

Plant Accident Sequence: SBOBD-E  !

i Plant Damage State: 244 Event

Description:

Station Blackout with Battery Depletion at 8 hrs (Reactor Cavity " Wet")

Parameter Value Mass of hydrogen generated in vessel (Ibm) 1380 Mass of hydrogen remaining in vessel just prior to 1151 l Vessel Breach (Ibm) f i

Primary system pressure at Vessel Breach (psia) 2450 Maximum predicted concrete erosion at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (ft) < 0.1 Maximum predicted concrete erosion at 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> (ft) < 0.1 Containment pressure at Vessel Breach (psia) 16 1

Containment pressure at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (psia) 36 l

Containment temperature at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (*F) 230 l

D.

l l

WM Design niew Pr um tics Riek Assessment P09e 19.11-181 u '

System 80+ Design ControlDocument Table 19.11.5.4.1.3-3 Summary of Fission Product Group (FPG) Concentrations Plant Accident Sequence: SBOBD-E Plant Damage State: 244 Event

Description:

Station Blackout with Battery Depletion at 8 hrs. (Reactor Cavity

• Wet")

FPG'll FPGII Concentration in Containment Concentration in Containment ,

component Atmosphere at Vessel Breach Atmosphere following Containment (fraction of initial inventory) Failure (fraction of initialinventory) 1 Nobles 0.933 N/A 2 CSI + RBI 0.044 N/A 3 TEO2 0.00 N/A 4 SRO 0.0003 N/A 5 MOO 2 0.0135 N/A 6 CSOII + 0.023 N/A RBOH 7 BAO 0.0031 N/A 8 LA2O3 + 1.77 x 10-5 N/A PR203 +

ND203 +

SM2O3 +

Y203 9 CEO2 5.95 x 10 -5 N/A 10 SB 0.125 N/A 11 TE2 0.005 N/A O

l'I Fission Product Group ,

Asnproved Design Meterial ProbabMsn'c Rhk Assessment Page 19.11-182

System 80+ Design ControlDocument ,

[ \

' C 1- Table 19.11.5.4.2.1-1 Summary of MAAP Predicted Key Event Timings for ,

System 80+

Plant Accident Sequence: LL-3E Plant Damage State: 14 Event

Description:

Large Break LOCA Without SI; Containment Sprays Unavailable and Cavity Flooded Prior to Vessel Breach Time Event Timings (seconds) 0.0 Accident initiation  !

1.2 Reactor scram

= 1.2 Accumulators begin to discharge 781.0 Accumulator discharge complete 1894.6 Core uncovery begins 6113.3 Support plate fails 6173.1 Reactor vessel failure 210267.3 (58.4 hrs) Containment failure ,

i C

Table 19.11.5.4.2.1-2 Summary of Key Parameters Plant Accident Sequence: LL-3E Plant Damage State: 14 Event

Description:

Large Break LOCA Without SI; Containment Sprays Unavailable and Cavity Flooded Prior to Vessel Breach Parameter Value Mass of hydrogen generated in vessel Obm) 840 Mas: of hydrogen remaining in vessel just prior to < 20 Vessel Breach Obm)  !

Primary system pressure at Vessel Breach (psia) < 50 l l

Maximum predicted concrete erosion at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (ft) = 0.25 Maximum predicted concrete erosion at 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> (ft) = 0.25 Containment pressure at Vessel Breach (psia) 32 Containment pressure at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (psia) 100 Containment temperature at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> ('F) 320 ,

m  !

l Anerend Design hestene! Probahnishc Risk Assessment Page 19.11 183 i

System 80+ Design ControlDocument Table 19.11.5.4.2.1-3 Summary of Fission Product Group (FPG) Concentrations)

Plant Accident Sequence: LL-3E Plant Damage State: 14 Event

Description:

Large Break LOCA Without SI: Containment Sprays Unavailable and Cavity Flooded Prior to Vessel Breach FPG'll FPGl83 Concentration in Containment Fraction Leaked to Atmosphere at component Atmosphere at Vessel Breach 24 Ilts After Vessel Breach (fraction (fraction of initial inventory) of initial inventory) 1 Nobles 0.98 0.949 2 CSI + RBI 0.52 6.42 x 104 3 TEO2 0.00 0.00 4 SRO 1.597 x 104 0.004.}

5 M002 6.5 . 6.048 x 104 6 CSOli + 0.52 1.09 x 10-3 RBOli 7 BAO 0.017 1.526 x 10'5 8 LA2O3 + 5.78 x 104 3.073 x 10 4~

PR203 +

ND2O3 +

SM2O3 +

Y203 9 CEO2 4.38 x 104 3.136 x 104 10 SB 0.207 3.07 x 10-3 11 TE2 0.165 1.75 x 10-5 O

til Fission Product Group ANwaved Design Material Probabaistic Risk Assessment Page 19.11184 1

i k

t System 80+ Design ControlDocument

/3 Q Table 19.11.5.4.2.2-1 Summary of MAAP Predicted . Key Event Timings for System 80+

Plant Accident Sequence: LL-3F Plant Damage State: 11 Event

Description:

Large Break LOCA Without Sl; Containment Sprays Unavailable and Reactor Cavity Dry Time Event Timings (seconds) 0.0 Accident initiation .

1.1 Reactor scram

= 1.1 Accumulators begin to discharge 785.3 Accumulator discharge complete 1836.4 Core uncovery begins 6100.1 Support plate fails 6160,1 Reactor vessel failure 8.3 days Contamment fails due to basemat melt through (estimated)

Table 19.11.5.4.2.2-2 Summary of Key Parameters Plant Accident Sequence: LL-3F Plant Damage State: 11 Event

Description:

Large Break LOCA Without Sl; Containment Sprays Unavailable and Reactor Cavity Dry Parameter Value  !

Mass of hydrogen generated in vessel (Ibm) 840 Mass of hydrogen remaining in vessel just prior to < 20 Vessel Breach (Ibm)

Primary system pressure at Vessel Breach (psia) < 50 )

Maximum predicted concrete erosion at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 4  ;

(ft)

Maximum predicted concrete erosion at 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> (ft) = 6.7 Containment pressure at Vessel Breach (psia) = 35 Containment pressure at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (psia) = 48 Containment temperature at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> ('F) = 330 O

(/ l 4

4proweef Desdyre Aferordet.habeemsele Ask Assessment Pope r9.7 7185

I System 80+ oesign contro/ Document Table 19.11.5.4.2.2-3 Summary of Fission Product Group (FPG) Concentrations h Plant Accident Sequence: L13F Plant Damage State: 11 Event

Description:

Large Break LOCA Without SI; Containment Sprays Unavailable and Reactor Cavity Dry l l FPG'l Concentration in Containment Concentration in Containment FPG*3 component Atmosphere at Vessel Breach Atmosphere at Containment Failure (fraction of initial inventory) (fraction of initial inventory) 1 Nobles 0.986 N/A 2 CSI + RBI 0.67 N/A 3 TEO2 0.00 N/A 4 SRO 0.0043 N/A 5 MOO 2 3.38 x 10 4 N/A 6 CSOli + 0.68 N/A RBOli 7 BAO 0.0195 N/A 8 LA203 + 6.17 x 104 N/A PR2O3 +

ND203 +

SM2O3 +

Y203 9 CEO2 1.7 x 10-3 N/A 10 SB 0.227 N/A 11 TE2 0.181 N/A O

l'I Fission Product Group Approssd Oesign htsterial Probabikstic Risk Assessment Page 19.11186

System 80+ Design ControlDocument .

D Summary of MAAP Predicted Key Event Timings for

%). Table 19.11.5.4.3.1-1 System 80+

Plant Accident Sequence: SL-11E Plant Damage State: 201 Event

Description:

Small Break LOCA Without SI, Cavity Flooded Prior to Vessel Breach Time Event Timings (seconds)

, 0.0 Accident initiation 19.7 Reactor scram 569.5 Containment sprays on 3816.7 Initial core uncovery begins

= 7200.0 Accumulators begin to discharge 11454.5 Suppon plate fails 11514.5 Reactor vessel failure 11559.4 Accumulator discharge complete

- . . Containment failure pri: vented v

4 Table 19.11.5.4.3.1-2 Summary of Key Parameters l

Plant Accident Sequence: SL-11E Plant Damage State: 201 Event

Description:

Small Break LOCA Without S1, Cavity Flooded Prior to Vessel Breach Parameter Value Mass of hydrogen generated in vessel (Ibm) 1768 Mass of hydrogen remaining in vessel just prior to < 20 l Vessel Breach (lbm)

Primary system pressure at Vessel Breach (psia) = 400 Maximum predicted concrete erosion at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (ft) O Maximum predicted concrete erosion at 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, 0 (ft) (estimated)

Containment pressure at Vessel Breach (psia) = 16 Containment pressure at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (psia) = 15

]

Containment temperature at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (*F) = 110

,) ,

1 Anwwvent Design Mosenin!. ProbnMiittic Misk Assessment Page 19.11-187 l

System 80 + Design Control Document Table 19.11.5.4.3.1-3 Summary of Fission Product Group (FPG) Concentrations Plant Accident Sequence: SL-1IE Plant Damage State: 201 Event

Description:

Small Break LOCA Without SI, Cavity Flooded Prior to Vessel Br ach FPG'lI FPGl31 Concentration in Containment Concentration in Ccatainment component Atmosphere at Vessel Breach Atmosphere following Containment (fraction of initialinventory) Failure (fraction of initial inventory) 1 No'aes 0.98 N/A 2 CSI + RBI 0.002 N/A 3 TEO2 0.99 N/A 4 SRO 0.003 N/A 5 MOO 2 0,007 N/A 6 CSOli + 0.002 N/A RBOli 7 BAO 0.004 N/A 8 LA203 + 3.15 x 104 N/A PR203 +

ND203 +

SM2O3 +

Y2O3 9 CEO2 0.0027 N/A 10 SB 0.026 N/A 11 TE2 0.31 N/A O!

I'I Fission Product Group. )

Anwmd orsign statew - embasastic tusk Assessment rage 1s.11188 l

i

System 80+ Design controlDocument im b) Table 19.11.5.4.3.2-1 Summary of MAAP Predicted Key Event Timings for System 80+

Plant Accident Sequence: SL-!!F Plant Damage State: 209 Event

Description:

Small Break LOCA Without SI, Reactor Cavity Dry Time Event Timings (seconds) 0.0 Accident initiation 17.8 Reactor scram Auxiliary feedwater on MSIVs closed 597.4 Containment sprays on 3836.5 Sustained core uncovery begins

= 7200.0 Accumulator discharge complete 4

12316.0 Support plate fails 12382.3 Reactor vessel failure 12425.7 Accumulator discharge complete Table 19.11.5.4.3.2-2 Summary of Key Parameters Plant Accident Sequence: SL-ilF Plant Damage State: 209 Event

Description:

Small Break LOCA Without SI, Reactor Cavity Dry Parameter Value Mass of hydrogen generated in vessel (Ibm) 1704 Mass of hydrogen remaining in vessel just prior to < 20 Vessel Breach (thm)

Primary system pressure at Vessel Breach (psia) = 400 Maximum predicted concrete erosion at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (ft) = 3.3 Maximum predicted concrete erosion at 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> (ft) 7.0  ;

l (estimate)

Containment pressure at Vessel Breach (psia) = 16 Containment pressure at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (psia) = 16 l Containment temperature at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (*F) = 120 AMweved Desiptr Motorial hobabmsNc Mick Assessmerrt Page 19.11189

System 80+ Design controlDocument Table 19.11.5.4.3.2-3 Summary of Fission Product Group (FPG) Concentrations Plant Accident Sequence: SL-!!F Plant Damage State: 20;

Event

Description:

Smah Break LOCA Without St. Reactor Cavity Dry FPGD3 FPG"3 Concentration in Containment Concentration in Containment component Atmosphere at Vessel Breach Atmosphere at Containment Failure (fraction of initial inventory) (fraction of initial inventory) 1 Nobles 0.98 N/A 2 CSI + RBI 9.7 x 10 4 N/A 3 TEO2 0.00 N/A 4 SRO 1.02 x 10-2 N/A 5 MOO 2 1.287 x 10 3 N/A 4 N/A 6 CSOH + 7.92 x 10 RBOli 7 BAO 0.005 N/A 8 LA203 + 1.13 x 10-3 N/A PR203 +

ND203 +

SM203 +

Y203 9 CE02 1.01 x 10-2 N/A 10 SB 0.035 N/A 11 TE2 0.728 N/A l

l U3 Fission Product Group Altvoved Design Material Probabinstic Risk Assessment Page 19.11 190 l

System 80+ Design controlDocument i

O

() Table 19.11.5.4.4.1-1 Summary of MAAP Predicted Key Event Timings for System 80+

Plant Accident Sequence: LOFW-9E Plant Damage State: 243 Event

Description:

Total less of Feedwater with Wet Cavity Time Event Timings (seconds) 0.0 Accident Initiation 22.5 Reactor scram 2126.0 Steam generator dryout 4397.0 Initial core uncovery 8491.0 Support plate fails 9391.0 Reactor vessel failure Table 19.11.5.4.4.1-2 Summary of Key Parameters f Plant Accident Sequence: LOFW 9E Plant Damage State: 243 Event

Description:

Total Loss of Feedwater with Wet Cavity Parameter Value Mass of hydrogen generated in vessel (lbm) 1500 Primary system pressure at Vessel Breach (psia) 2500 Maximum predicted concrete erosion at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (ft) < 0.25 Maximum predicted concrete erosion at 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> (ft) < 0.25 Containment pressure at Vessel Breach (psia) = 30 Containment pressure at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (psia) = 70 Containment temperature at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (*F) 270 Gi

)'

^;; ;.: Design Materiel Probahnstic Misk Assessment Page 19.11191

System 80+ Design ControlDocument Table 19.11.5.4.4.1-3 Sununary of Fission Product Group (FPG) Concentrations Plant Accident Sequence: LOFW-9E Plant Damage State: 243 Event

Description:

Total Loss of Feedwater with Wet Cavity ypctsi FPGl33 Concentration in Containment Fission Products Leaked to component Atmosphere at Vessel Breach Atmosphere following Containment (fraction of initial inventory) Failure (fraction of initialinventory) 1 Nobles 0.98 0.99 2 CSI v RBI 0.125 3.1 x 10-3 3 TEO2 0.00 0.00 4 SRO 0.0047 2.5 x 10-8 5 MOO 2 0.0032 1.2 x 104 6 CSOH + 0.086 4.4 x 10-3 RBOH 7 BAO 0.0027 2.7 x 10-7 8 LA203 + 5.58 x 10d 8.3 x 10 4 PR203 +

ND203 +

SM2O3 +

Y203 9 CEO2 0.005 1.15 x 10.s 10 SB 0.123 0.16 11 TE2 0.48 2.3 x 10-5 O

I'l Fission Product Group A S4weved Design Motenal Probab&stic Risk Assessment Page 19.11 192

System 80+ Design control Document Table 19.11.5.4.4.2-1 Summary of MAAP Predicted Key Event Timings for System 80+

Plant Accident Sequence: LOFW-9F Plant Damage State: 241 Event

Description:

Total Loss of Feedwater With Dry Cavity Time Event Timings  !

l (seconds) 0.0 Accident Initiation 21.6 Reactor scram 2175.0 Steam generator dryout 4456.7 Initial core uncovery begins 8104.7 Support plate fails 9004.7 Reactor vessel failure Table 19.11.5.4.4.2-2 Summary of Key Parameters i I

,9 Plant Accident Sequence: LOFW.9F

() Plant Damage State: 241 j Event

Description:

Total Loss of Feedwater With Dry Cavity l Parameter Value Mass of hydrogen generated in vessel (Ibm) 1320 Primary system pressure at Vessel Breach (psia) 2500 f Maximum predicted concrete erosion at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (ft) = 1.5 Maximum predicted concrete erosion at 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> (ft) = 4.5 Containment pressure at Vessel Breach (psia) < 20 Containment pressure at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (psia) 44 Containment temperature at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (*F) 320 O

AMweved Desipus Motonial. Mmeic Risk Assessment Page 19.11133

System 80+ Design ControlDocument Table 19.11.5.4.4.2-3 Sununary of Fission Product Group (FPG) Concentrations h Plant Accident Sequence: LOFW-9F Plant Damage State: 241 Event

Description:

Total loss of Feedwater With Dry Cavity FPGI83 FPGlil Concentration in Containment Concentration in Containment component Atmosphere at Vessel Breach Atmosphere following Containment (fraction of initial inventory) Failure (fraction of initial inventory) i Nobles 0.955 N/A 2 CSI + Rbl 0.0939 N/A 3 TEO2 0.00 N/A 4 SRO 0.0039 N/A 5 MOO 2 0.0016 N/A 6 CSOH + 0.052 N/A RBOH 7 BAO 0.002 N/A 8 LA203 + 2.99 x 104 N/A PR203 +

ND203 +

SM203 +

Y203 9 CEO2 0.004 N/A 10 SB 0.0788 N/A 11 TE2 0.4168 N/A lll O.

Fission Product Group ]

Amand Design unterw. Probasastic Risk Assessment Page 1s.11 1se

Sy^ tem (0 + Design ControlDocument r'

(, Table 19.11.5.4.5.1-1 Summary of MAAP Predicted Key Event Timings for System 80+

Plant Accident Sequence: SGTR-15A Plant Damage State: 184A Event

Description:

SGTR with Isolation Failure (No SI)

Time '

(seconds) Event Timings 1 0.0 Accident Initiation 18.4 Reactor Trips 3927 Core Uncovery Begins 9072 Support Plate Fails 9132 RV IAwer Head Fails 9202 Accumulator Water Depleted Table 19.11.5.4.5.1-2 Summary of Key Parameters )

i i

O Plant Accident Sequence: SGTR-15A b; Plant Damage State: 184A l Event

Description:

SGTR with Isolation Failure (No SI)

Parameter Value Mass of hydrogen generated in vessel (Ibm) 1913 Mass of hydrogen remaining in vessel just prior to 150 Vessel Breach (Ibm)

Primary system pressure at Vessel Breach (psia) 2450 l

Maximum predicted concrete erosion at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (ft) < 0.1 j Maximum predicted concrete erosion at 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> (ft) < 0.1 Containment pressure at Vessel Breach (psia) 15 Containment pressure at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (psia) 15 Containment temperatutt at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (*F) 105 l

r

(

\

Amwoweet Design Meterte!- Probab6Gsalc Mith Assessment Page 19.11 195 l

System 80+ Design controlDocument Table 19.11.5.4.5.1-3 Summary of Fission Product Group (FPG) Concentrations Plant Accident Sequenct: SGTR-15A Plant Damage State: 184 A Event

Description:

SGTR With Stuck Open MSSV/No St FPGl3 FPG'1l Concentration in Containment Fission Products Leaked to component Atmosphere at Vessel Breach Atmosphere 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after Vessel (fraction of initial inventory) Breach 1 Nobles N/A 0.938 2 CSI + RBI N/A 0.453 3 TEO2 N/A 8.5 x 10 4 4 SRO N/A 2.2 x 10-3 5 MOO 2 N/A 6.4 x 10-2 6 CSOH + N/A 4.38 x 10-3 RBOH 7 BAO N/A 2.2 x 10 3 8 LA203 + N/A 6 x 104 PR203 +

ND203 +

SM2O3 +

Y203 9 CEO2 N/A 7.9 x 104 10 SB N/A 0.18 11 ) TE2 N/A 0.0054 O

fil F ssion Product Group Apswowd Design Material Probabikstic Rhk Assessment Page 19.11196

System 80+ Design ControlDocument i

V Table 19.11.5.4.6-1 Summary of MAAP Predicted Key Event Timings for System 80 +

Plant Accident Sequence: ISI-F Plant Damage State: 17 Event

Description:

Large Break LOCA Without Sl; Containment Sprays Unavailable and Reactor Cavity Dry Time Event Timings (seconds) 0.0 Accident Initiation 1.4 Reactor scram

= 1.4 Accumulators begin to discharge 90 Accumulator discharge complete 7700 Sustained core uncovery begins 13881 Support plate fails 13940 Reactor vessel failure Table 19.11.5.4.6-2 Summary of Key Parameters Plant Accident Sequence: ISL-F Plant Damage State: 17 Event

Description:

Large Break LOCA Without SI/ Containment Sprays Unavailable and Reactor Cavity Dry Parameter Value Mass of hydrogen generated in vessel (Ibm) 820 Mass of hydrogen remaining in vessel just prior to < 20 Vessel Breach (lbm)

Primary system pressure at Vessel Breach (psia) < $0 Maximum predicted concrete erosion at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 3.4 (ft)  ;

Maximum predicted concrete crosion at 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> (ft) =4 l Containment pressure at Vessel Breach (psia) = 15 j Containment pressure at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (psia) = 15 Containment temperature at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (*F) = 220 C

i Approved Design Matwiel- Probabnituc Misk Assessment Page 19.11 197

System CO + Design C?ntrolDocument Table 19.11.5.4.6-3 Summary of Fission Product Group (FPG) Concentrations l

l Plant Accident Sequence: ISL-F Plant Damage State: 17 I Event

Description:

Large Break LOCA Without SI/ Containment Sprays Unavailable and Reactor Cavity Dry l ITGil l FPGill Concentration in Containment Fission Products Leaked to component Atmosphere at Vessel Breach Atmosphere 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after Vessel (fraction of initial inventory) Breach (fraction of initial inventory) 1 Nobles N/A 0.999 2 CSI + RBI N/A 0.9 3 TEO2 N/A 0.00 4 SRO N/A 0.0144 5 MOO 2 N/A 0.0035 6 CSOli + N/A 0.909t21 RBOli 7 BAO N/A 0.029 8 LA2O3 + N/A 2.19 x 10-3 PR203 +

ND203 +

SM2O3 +

Y2O3 9 CEO2 N/A 0.0124 10 SB N/A 0.44 11 TE2 N/A 0.199 Ill Fission Product Group I21 Platcout in SDC lines and pool scrubbing by water at pipe exit not included.

Approwwd Design Material- Probabarstic flisk Assessment Page 19.11198

System 80+ Design Contro: Document

( L- g- -

/ l C i .

-y

/ W '

~

Q' f} ( [

/, / .P

,w

='

/ .

l

) - - 7

. f.- .

i

=B / r, i

Il I  ; n w e

W ~

I

' Y%, .. bmit m f -

\

o s

- u .

s  % ,, _ ..2 A

O " '

1 ca: il-;'

> u U j

e .I T-

. ~,,_ m n ~

\l ,

', % l m ,

m T .

I '

4

% AM 3ne:. \ \'

. Y Y j'} 'M

/7 c .

'T'~  !

/

1 Systein 80+ Containment Intemal Structure Arrangement Figure 19.11.3.1-1

_^ _ _: Deelen Asesenial Probabnistic Misk Assessment PW 1911*199 l I

i

I System 80+ Design Control Document O

145 143 -

d g 141 -

9d M

M

$'139-137 -

135 , ,

290 330 370 410 450 CONTAINMENT TELIFERATURE, F l

l Pressure Limit Basco on ASME Service Level "C" Criteria Figure 19.11.3.1-2 l

A44weved Design Material Probab&stic Risk Assessment Page 19,11200

System 80+ Design ControlDocument I

w/

1.2 1.0 -

0.8 - CONTAINMENT TEMPERATURE a 290 *F 4

Wm.

B

> 0.6 -

t::

N 0.4 -

0.2 -

EO ' ' ' ' '

' 50 70 90 110 130 160 170 190 CONTAINMENT PME88URE, PSIG l

Fragility Curve for System 80+ Figure 19.11.3.1-3 J

Apprewd Design Mehmiel Probabnis6c Misk Assessment Page 19.11-201

i System 80+ Design ControlDocument l

1 i

O' N T-issu j --

i i

tl...

E L:"

s-l.

1 egage e - <r .-< m

\,,,,,,,*,,,_,, ,

_ / - --. == /  : S = ::::= m ,.

~, n **"

. X. f-::  :

f, ', ==e==s .ns . =v N . - - . - 7

, ./W 1

y.. .. .4

~~ ,=

4' .

1

i. . G ^l ii c' pe s ==< .4 4

re m.e e s eaeu< ,,m . , . g-a en.= ls-  ?. e6 m

n. -=

m [! ~ l:~

. e- J-1 '

. a ;;

d

.,i

g. .F . ge., '

5 an=

t.

7 v r/,

2

==. =s -. -

i

%, - i

• $ Ej D11. 8 . Ilh .? . .d m '

,g m w s

rK

=

._ . ,Iw ,,_.N y y NMA .% .N 3 a *== s r,..

~

y',.1,**.*,.g:y

- .s 1-12  ; ,.,  :.f_,_; ti;*

.p

~.

1 .::lll",

-.d' - '

S. P. - - '

' N. .-

i., e '.::"lld a'a **

?;* ,,,...w ,e'****' C l,l*"* l* """ '"lT%

., 'J

.< a.y

- - s . .l.. n,Q., a an

~~.*=

1; i en,

- 1

.$ W

~

• L I .I  ::

, Ks.s.44 i a . ..

% 3945 #,p. . . .w<=fferu j/

W =--"..m

@:,.' i= w' %,%c N.:

n -

u . . ff  :- l::-- =};% - ""

.g

. '.. <l'-

.'* ,,..=, . A.shks. .

e.

• • • "..,:r--.4m

.:,:;, r, .

. .s*; '.f.

;'.f,'

y %..l L },*'f, ,

-4

• :a .,

.i, . .

.?

-~

@* '.[. a .

c ,',.-).., k

. , , r. y

. u,...,. ,,, ;. .,. ;. ..,..

I Elevation View of System 80+ Containment Shell and Shield Building Figure 19.11.3.2-1 Appesved Desen Afsterial Probab5st,ic Rank Assessment Page 19.11202

System 80+ Design ControlDocument O I  := C.  ;.

L f ..

c.

.v-u 1 l

/

I

/

"y

\ ~~

. C "[

N m's M t.

Lt-J b j l "ji,{.y;;*,.

Mh 5 3_

5SI. Nil rw -

. Oj!ply Y i.t.

a>. . ifs:-

9 llk*c."

]

l

,0 il y/ Wi?

I y1/

\../

.::M. "

W ' in # 55 5:?...

.fhiN!! ),

f DJ #

!!i.: - J 9:pi .

/\

/ $

i I ..

o .

\  !

IRWST Spillway and Cavity Rooding System Figure 19.11.3.3-1

_(]

Des # Mew. % tic Risk Assessment Page 19.11-203

System 80+ Design ControlDocument

_C O 9i O

- 43 K.

- O O

O O

~

A v

. c'

_. O O

<D A

4 -

.c Y -

-a

{ .4 g

g o - 8 p k o

~

.a C O b c ~

M -O O O

,! >. O

• N E-s M

n -

1 ~

k: .c g - -

.-. o ~

X -

I ' I

• 4'3e iaia 4s iii:igaga agig.. .,igQ .g,,, =o o.

N O. O.

CO O +O.n oogo..*o.o o.

05o.d3o.6 o.

m oWo.ad'

. o. M. o C4 O o.-*o.

o *o.NoC7

. O. o.

• • *-* e .-* .-s -t w

1 1 ( {

(U) 19 2 !aH Predicted CFS Performance (2 HVT Spillways; I RC Spillway) Figure 19.11.3.3-2 AppronniDesign Material.Probabaistic Risk Assessment Page 19.11204

' ;t , ! , ,i I ' 3 ! il . -

n

%+ pg piee s, e1 _

m O

0 0

0 _

,8 -

m

,0

,0

_ 0

,6

)

, s

(

y ,0 l

i v

,0 0

e i

a ,4 n

C ,

, i r T O

t o ,

k c n a ,

. a e ,

T R ,

_ e ,0

,0 T m 0

. S l u ,2

. W o R

I V ,

. p _

u ,

d ,

l ,

o H

{- - - - - ~ 2: I: { - - 2 - h- -~ 0 d.000000 - 000000,00000000 7854321 9878 54321 01 234 _

1 i1 t 1 1 1 2 - - - - .

D G' % a. 4h y Z O

w ag.

g e 5a it5 5{yS {= -@ v- -

w k1kf y[ 5 yEll' 3% { _, 8. -

y

+

System 80+ Design ControlDocument O

3000_ _

2500 ;

m -

Q. C v52000 _

Lil -

a:  :

Q_ -

~

1500 _ r S.,

1000 f --

E.

j 500 ' '

%4 1 2

,......., ,,,,,,,,, ,,,,,,,,, ,,,,,,,,,i,,,,,,,,,

0 0 1 2 3 4 5 TIME HR 1

1 1

l l

1 l

RCS DepressuriUtion with SDS actuation at PSV Lift; Instantaneous Total Loss of Feedwater Figure 19.11.3.5-1 Ol !

A$\ proved Design Meterial Probabnisuc Risk Assessment Page 19.11206 I

5 L

System 80+ Deskn ControlDocument r

O 1 3000_

2500 : -9 V F , .

U) -

o_ .

vi2000 w

~  !

O' 1 ~

~

1500 : -

O i

~_ '

1 1000 }

~_

4 500 } g W l 00 ''''1 2 3 4 5 i TIME HR i

. RCS Depressurization with SDS actuation at PSV Lift + 1 Hour; Figure 19.11.3.5-2 lastantaneous Total Loss of Feedwater ANwedDee&n Atesord.hebaMFeeic Aink Assessment Page 19.11207 g e vw - aw- e

System 80+ Design controlDocument e

_p -

.. e ..

. a

,, l.* .

is.

o

, '* 4 i .. . .

/a .', .

I i . c . ...!!er\

• y

• _ ER. fMG C. ,15 6

, j , ,

g

.. 'la;,mg- . i .

dMMs*-+-

SW * **

.'e g\ h Ih j ' **8 " d .*

.. .h h $ -

.- n

,ess

. .c ,

.. N te ts Q . .a sg E96634  %

s v ~

.: . .. , . . .a.. . . lle / l

. pg]g nm . , n s v. ag.- - - - - -- . .

u -.. ..

L . .- 3~_..a n -/-7y-a , . .

Vl d

a syne y

c", 7c a

cza a

+

e ,a

,s. 3i . ..

_ i 4 ,_

Ms *

. ,, l

' !_*AT..i . c f '

l L_, ' . . . . .

-. ~

,, /. .. u w en.

g ..'

- * ^?-

1.. .

I =._ _ .

System 80+ Reactor Cavity with Core Debris Chamber Figure 19.11.3.6-1 Appresed Design Material . Probabniistic Risk Assessment page g9.1120g

System 80+ oesten controloccument ,

i 1

t 9

i o

i, SHOWING GAS / STEAM PATHWAY

. /

4 SiOLOGICAL ,

b [p

_ khhhhhV 6_k -

ICI CHASE VENTILATION

'* > ROOM

<*M

[ H d

<1-- g REACTOR g g ' --f> '

SHIELD VESSEL PLUG A

T 3%2 AhtiB7- y HVAC -

g^ VENTS l CORSEL +

A 7 i

O  % 4  %

--- r>

> r---------

I 4

DESRl8 CHAMBER 1 l

> DOMINANTCORluM PATHWAY ,

?

---

f> SECONDARY COfuuM PATHWAY l

> DOMINANTGA8 PATHWAY m===> SECONDARY GAS PATHWAY f I

t System 80+ Reactor Carky Schematic Figure 19.11.3.6-2 i

Annrevent Doetro Aseterstal Probabnistic Miek Assessment . Page 19.11209

m w x

o  %

i  ! 3 F n =

1 5 o 2 +

P.

. , 1.00 E

3 y 0.90 -

S

• 0.80 -

1. S P # 0.70 -

5  ? E

/

i E am 0.60 -

f a

3 1 / Cavity o 0.50 -

/ ~ v.it

> /

G 0.40 -

/

25 /

l E 0.30 - /

e /

l 0.20 -

7

[ , / <r-- Corbel 0.10 -

/

I 0.0 ' J ~ ~* ' ' ' ' ' ' ' '

e 2g 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 5.5 6.0 7.0 j.

, =

a '

n 9 Impulse (psi-sec.) 8 F

w E

=

w w g

O El b 3 o _ ~

O O O

' System 80+ Design crneralDocument

' f\

\

l e ._ _. ,

EXTERNAL MOSE WATER SOURCE

/

6T

-- EC $ -.

& POWER S0tstCE  !

ELBC FLANGE M lMSkSSS N

SL498 SPOOL PECg

< C00eWCTIOtt gewST PE.L/ CSS ECSSS LEADER TEE CONNECTtoes to , 1 ,

O ' '-

<e N

e

< Skes7 l l A A oo l l CS m ADER l o I Skees Sk448 ax  :*:

Ske87 k

SI-STE se

{; Sb164 T

CS w o,,,,, _ j ,,,,,

CostTAsasENT CS Otvits0st t IS SHOWIL TE ECSS$ CAtl SE CoseECTED TO EITHER CS DIVISe006.

i

/ Conceptual Design of Emergency Containment Spray Backup Systein Figure 19.11.3.8-1  ;

4 lmre d Deek o neesertied ProbaNiirsic Riek Assessment Pope 19.11211

system 80+ D**'""C*""'*"""'"'

O 240 i 200

}

U ~

O. -

ui160 w

[.

Z  :

O. -

120 --

~

Vent Open

~

me 80

}

~

/

7 40

~

~teitesete eteeeet iitest eetttie it t et t i TIME HR i

l Effect of Vent Opening on Containment Pressurization Figure 19.11.3.9-1 Approved Desiger Material . Promstic Risk Assessment Po901911212

System 80+ Design ControlDocument

O ,

l l

i i

1 a

4 i

1.0 . . . . . . . . .

t-

• 0.9 1

0.8 O.7 -

0.6 - -

e o l 2 0.5 '

e 6. -

& 0.4  ;- -

e sit!/1FP.WC TESTS

( , 0.3 a SN(TF-1 TEST -

,e e FAI/scit-4 Test 0.2 - -

0.1

, l I 0.0 ' "- '- ' '- '- ' ' '-

0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 i

Measured l

.i j

1 i

I Coenpedson of "Two Cell" DCH Model to Expedinatal Data Figure 19.11.4.1.1 1 AnwwwodDeslyn Aieenrief Probahnieeic Mhk Assessannt - Pope 19.11-213

'l l

I

System CO + Design ControlDocument '

I

._w _

O 250  ;

y' ... ....... . . .... . ... ... . .. . . .

N , (D

~

.g,$g _. . . .. . ... .. . . . . .

a N @

e 100 -- * ****** ** ** ** *

$g . . .. .

Typical Corium dispersci Medion Corium dis pers al NURIC-5809 NUREG-1150

- h' [

0 1.0 0.0 0.0 0.4 0.2 0.0 Fraction of Core Ejected

@Cere release f rom RCS not credible

• Dry Covity No RCS Water

@ Syelem 80+ Ultimate Pressure Copobility + Dry Covity RCS water

• run Cavity RCs water

@ system so+ stres. Levei e S 8est estimate Dry cavity wieri RCs water G Upper bound OCH toeding based on Ref. 4.3 ossumptions (Ory covity no RCS wolor 50% dispereal of elected meH Bounding Estimates of ALWR Containment Responses to DCil Figure 19.11.4.1.1-2 App.'ond Design Materto! Probabilistic Risk Assessment Page 19.11214

. System 80+ Deskn controlDocument

- (~) ' t v

i 1

i 4

1 J

d This Figure Intentionally Blank 4 .

5 1 1

l l

l l

l i

i I

l Expert Elicitation Quantification for Core FJection Fraction Figure 19.11.4.1.1 3 1'

(Draft B:4551. Vol. 2: "In-Vessel Issues")

^L. ; W A6esenlaf hobahnloaic Rick Assessment Pope 19.11-215 vi y ~ * -- . * -=

System 80+ Design ControlDocument O

This Figure Intentionally Blank O

Decomposition Tree for Quantification of DCIISTREN for PDSs: Figure 19.11.4.1.14A Leak = CRV; CAVT = Dry; CHR = any Asyweved Design MaterW . Probab&stic Risk Assessment Pope 19.11216

h System 80+ oesign controloccument ,

d I

This Figure Intentionally Blank I

/

f L

i l

)

-[ Decounposition Tree for Quantification of DCHSTREN for PDSs: Figure 19.11.4.1.1-4B V Lenk = not CRV; CAVT = Dry; CHR = CSU 1

?;;.:.::Deenpn hintonint.ProbeMeeic Rick Assessment Pope 19.11217 l l

l

System 80+ Design controlDocument O

This Figure Intentionally Blank O

l l

\

1

)

l Decomposition Tree for Quantification of DCHSTRFE for PDSs: Figure 19.!! .4.1.1-4C Leak = not CRV; CAVT = Dry; CHR = CSA j i

l l

Approved Design Materiel- Probabkstic Risk Assesstnent Pope 19.11-218 l

System 80+ Design controlDocument LO 4

I 30 . . . . . . . KlMfe g . . t....g ..

< ' o

! O DESRIS CONYUtS W -

OtAutTCM acto -- Q c - O FITS A Sgntgs s g k -  ;

e FITS a SEA:Es * -

2 p= _ , -

g m=

e a

g w

l .

/ 8 ** -- I a -

/ -

o

O W==4:-

LW /

/ -

=

W' . > 0 - O

,w

~

/

C2 $

W 7 D J

/ o O .i - L J J x

c. o a w 4

X w og . <......f . . , . . . . . . o.g

10 10 0 I

COOLANT MASS / FUEL MASS f

d 1

4 Explosion Conversion Ratio and Debris Diameter as a Function of Figure 19.11.4.1.2 1 lt

, Coolant to-Fuel Mass Ratio i'

Annreved Design niedersel* Probabnistic Misk Assessment pagegg.11219 w . . . , . . , , , , , . - - - - . --

System 80+ Design Control Doctanent O

This Figure Intentionally Blank O

I EVSE Decomposition Event Tree Figure 19.11.4.1.2-2 Attwaved Destyn Acatorial. ProbabiGstic lbsk Assessment Page 19.11-220

System 80+ De:ign ControlDocument 1

i 14 . 115

• 8 s e

' seconsPtsfs -

110 I ***** "

• 12 -

asAxecues -

105 -

P00sSLE Penaanss , g

' commseATicess pnessuns i g 10 -

\' 100E

, p ammaami r g

. ~

a H En.

' - 1 W8 -

' =

4 5

d u . n.b O '

NO -

$5 FLAaseAaiuTV Last '

4 ' ' ' ' '

M 0 5 10 15 20 25 30 35 40 45 50 55 80 VOLUME % STEAM

- 105 % ACTIVE CLAD l

+ POST BURN PfWSSURE

• Fe ausa48 Lgry LagT (BASED ON ZIRCALOY MASS = 58,500 LBM)

I i

System 80+ Combustion Potential Figure 19.11.4.1.3-1

.[

.%- ; Destgre A9eteniel.ProbeMineic stisk Assessment Pope 19.11-221

l l

System 80+ D: sign ControlDocument j l

O l

REQUIRED ENERGY FOR DETONATION  :

AT13%Mt AT1M H2 PLANAR CHARGE SPtWRICAL CHARGE CONMNED TUSE UNCOtmMdED 2 OADERS OF94,

.- 12 KY ARC OVER3 ORDERS OF

moNrfuoE 4e9 V AMC

[Nh watoEns

~

O I soser Rs ,

l I

.c_

MATCH 1

)

1 08 101 1 02 108 1 04 106 10s' io7 gos ice into 10 1 1 012 1058 1 l

aoutassecono i

I l

l Comparison of Ignition Source Energies with Source Required for Figure 19.11.4.1.3-2 Detonation Approved Design Meterial Probabastic Risk Assessment Page 19.11222

)

System 80+ Deskn ControlDocument

.- S J

CONTAINMENT '.

I 13 12 11 10 16 h h8) q

@ 8- d b- O i

Q O -O- 4 O --

l 2

D~ " *

-o

%d (IGEND

@ L0%ER CAMiY @ WAU(WAY TO LOWER COMPT.

@ @ 1/2 RC ANNULUS @ HOLDUP VOLUME

@ 10 CHASE @ IRWST FREE BOARD 5 CORE DEBRIS, CHAMBER 9 CO$iAINMENT Note: circles correspond to flovpaths and squares correspond to nodal volumes l

4

/N Figure 19.11.4.1.4 1

.t )' Nodal Model of System 80+ Reactor Cavity

%)

l

^ -.:. Design n0eseriel.Probahnieeic Nok Assessment Page 19.11-223

System CO + Design controlDocument G

This Figure Intentionally Blank O

Supporting Logic Model for Rocket Induced Containment Failure Figure 19.11.4.1.4-2 Approved Design Material

• Probab&stic Risk Assessment Pope 19.11224

System 80+ ' Design ControlDocument 7 i I l

\

]1 l

l l

l

)

I This Figure Intentionally Blank l

- f  !

f I

9 4

RV Leading Due to Instantaneous Decompression of a Gennan-PWR Figure 19.11.4.1.4-3

? - ::Dee@n Mosenlet ProbabdNasic Miek Assessment page 19.11225

System 80+ Deeign ControlDocument O

4 10 _

~

O

- @ Data range m 3 g Mfor plate flat CHF E

10 -

- 4

.a  !

L CHF Zuber 3 _

d 10 cm O W eatinghous e's X

C deep bed data C Mixture b, G 0,25

} 10 2

m - o, Mixture e p -

E d.38-0.385 N 30 cm QMixtured6 0.53

]

>- O Barleon-Werie- 1 c: 100 cm thermocouple, Q depth 8 cm 10 4 Trenberth-S tevens, 19 cm l

- depth

- Lipinski (numbers designate ,

bed deptti) g i I l1 I I If I I I(

2 0.1 1 10 10 PARTICLE DIAMETER (MM)

Comparison of Dryout Ileat Flux Data Figure 19.11.4.2.2-1 Altwowd Design Material . Probabmstic Risk Assessenent Page 19.11226

. _ ._ . ~ _ _ . .__ . _ . _ . _ . . _ _ _ . _ _ _ . _ _ _ . . _.-

,A il

• ' System 80+

. Des 4pr contmlw~rt g

~, t t

e

< i 1120_ ..

W e

F h@ l

• i 1.D

100 ~_

.e J '80 :.

g 3 rur.o.oi-1

. . a. _

60 -

4 4

" .l j

~

R:.HF: D. 02- i

. _ c,

-40 _

=

_____ m e

e t

20 :

e T

.e 0

[ _

0 ' ' ' ' ' ' ' ' d ' ' ' ' ' ' ' h $ ' ' ' ' ' 'M ' ' ' ' ' ' ' b d ' ' ' ' ' ' ' 7 0 -

TIME- 'HR 1

l

1

.A

[ Predicted hat Erosion Depths for Systen 80+: MAAP Sensitivity se dy Figure 19.11.4.2.2-2  !

i 2

1 I

, 4penent Deakn neesendal- hebannIrate niek ^=~==--t -

page ss.11227 -

v.

~ ~ 4- ..n',- .,.,' . . ,

System 80+ Design controlDocument O

'25 - , ,

n 1* -

E E

z' .

Q 0.15 -- -

m

• O x

w S

2 0.50 -

X

< 0.25 -

2 ,

o- l l ,

3 s is 21 27 TIME, hours CORON-MOD 3 Predicted Radial and Axial Erosion Profiles for the Figure 19.11.4.2.2-3 System 80+ Basemat Approwd Desigro Material Probab&stic Risk Assessment p,y gg g g,,,y

System 80+ Design ControlDocument

()

V l

i I i '

6 8 5o 4 1

E E

g o.7s-m B

a E l g 0.50 - -

O * .

(/ 1 3 o.25 --  %

A hY. i g f i-3 9 1s 21 27 TIME, hours

_'Vj CORON-MOD 3 Predicted Heat Flux at the Corium-Water Interface: Figure 19.11.4.2.2-4 Limestone / Common Sand Concrete Approved Design Material Probabmste Risk Assessment Page 19.11229

System 80+ Design ControlDocument O

9 . . .

i 8 - 90% Ouantile -

90% Confidence 7 -

6 -

C S -

C

- ce c

~~

4 -

SO*/* co#0*p, 3 -

0 -

50 *l* 0o8 2 -

10% Ouantile 1 -

90% Confidence -

100 200 300 400 500 Pool Depth (cm)

Decontamination Factor for a Saturated Water Pool Overlying a Corium Figure 19.11.4.3-1 Debris Bed Approved Desbyer Material . Probabistlc Risk Assessment Page 19.11-230

System 80+ Design ControlDocument (s S) 3000_

2500

w. t.

a.  :

vi2000 w

Z O. _

1 1500 _ l

_ 1 (m.

- i b

1000 1

500 : _

I

~

i 1

0~'i$''N''N''Nt1N 0

TIME HR

.A 4 RCS Pressure vs Time: Plant Accident Sequence LOOP-9E; Plant Figure 19.11.5.4.1.1-1

(

N- / Damage State 243; Station Blackout with Wet Cavity

^ Pete 19.11-231

. a-.= Design hinteriel* Probabhiraic Risk Assessment

System 80+ Design ControlDocument O'l 1

1 30_ _

~

1 1

_ i

_ i

^

25 -

~

J 20 L1J .

~

J _

15 :

e i ,

10:

t 5:

~

0 45 75 30 60 0 ' ' ' ' ' ' ' '1 5 TIME HR RCS Two Phase Level vs Time: Plant Accident Sequence LOOF 9E; Figure 19.11.5.4.1.1-2 Plant Damage State 243; Station Blackout with Wet Cavity

% sed Design Mated Probabaistic Risk Assessment Page 19.11232

l ',

l l

i System 70 + Deskn ControlDocument

-O .

i 240_ _

200 : _

m _

i

. O_ -

vi160 y  : ASME SERVl0E LEVEL C oc  : /

, c_ _

120 3

/ ,

' (v]

4 80 _

i /

40

/

_ i

1

.c j

1 0

0 ' ' ' ' ' ' ' ' '1 $ ' ' ' ' ' ' ' b d ' ' ' ' ' ' ' k $ ' ' ' ' ' ' ' b d ' ' ' ' ' ' ' ) 5 TIME HR l

l l

l 1

r%

-t UIMainab Pressure vs Time: Plant Accident Sequence LOOP-9E; Figure 19.11.5.4.1.1-3

)

L/ PM t Dessage State 243; Station Blackout with Wet Cavity l

1 womt oneipo asenerier. hosasaiseic Riek Assessmorrt . Pese 19.11-233 z- l

)

l

]

System 80+ Design ControlD2cument O

600 500 :

L1_ -

~

2- 400 -

LJ  :

2 300 _

i 9

200 :

~

J

~

100 _f 0

't'1$''N''d''d''h 0

TIME HR Containment Temperature vs Time: Plant Accident Sequence Figure 19.11.5.4.1.1-4 LOOP 9E; Plant Damage State 243; Station Blackout with Wet Cavity Approved Design Material- Probebiustic Risk Assessment Page 19.11-234

l J

l System 80+ Design ControlDocument l I

%/- ,

480_ _

j 400 :

Z

~

E320 Q_ -

u)  :

O _-

240 _

C  :

(~ -

~

160 _

l

\

80 :

0 11

5" ' N , %

0 1 N'N

- TIME HR l

l l

l I

\

)

. <"]

.' l Cavity Concrete ltrosion vs Time: Plant Accident Sequence LOOP-9E; Figure 19.11.5.4.1.1-5 -

' /- Plant Damage State 243; Station Blackout with Wet Cavity 1

i Anwoweef Den &n nesseria! E.4ehnweic Risk Assessment Page 19.11-235

? I

l

. l Design ControlDocument Ntem 80+

1 I

O 1

480_ _

400 Z  :

E320 Q.

LtJ  :

O -

240 : _

i 9

~

160 s

80 7 MMMUM DISTANCE

-/ [- TO EMBEDDED LINER 0fhd"kd''bd''bd''100 0

TIME HR

~

Cavity Concrete Erosion 55s Time: Plant Accident Skuence LOOP-9F; Figure 19.11.5.4.1.2-1 Plant Damage State 241; Station Blackout with Dry Cavity Approved Des # MaterW- ProbabHistic R Assessment Page 19.11-236

System 80+ Deskn ControlDocument a

g .

%/ ,

240_ _

200 : .

V) _

G. ~

vi160 La)

_ AStIE SERVICE LEVEL C

%  : l r

Q. _

~

120 _

~ .

80 : .

X 40 _

0 0 ' ' ' ' ' ' ' ' b ' ' ' ' ' ' ' N ' ' ' ' ' ' ' N ' ' ' ' ' ' ' N ' ' ' ' ' '1 c 3 TIME HR

i. Containment Pressure vs Time: Plant Accident Sequence LOOP-9F; Figure 19.11.5.4.1.2 2 Plant Damage State 241; Station Blackout with Dry Cavity

%..J Detion neesord. hobahniraic Risk Assessment Page 19.11237

System 80+ Design Control Document O

600_ _

500 u..

a.400

s _ f N b C of i

300 _

G 200 :

I 100 :>

? , ,,,,,,,,, ,,,,,,,,, ,,,,,,,,, ,,,,,,,,,

O,,,,,,,,20 O 40 60 80 100 TIME HR 1

1 1

1 I

1 l

Containment Temperature vs Time: Plant Accident Sequence Figure 19.11.5.4.1.2-3 LOOP-9F; Plant Damage State 241; Station Blackout with Dry Cavity l

l AMuowd Desigr, Material ProbabMstic Risk Assessnus,t Page 19.11-238 l

I

System 80+ .

Design Control Document rs N

3000_

2500 } q c.

vi2000 w

a:  : -

o_ _

1500 l

0 .

E

~

1000 _

~

500 0''M''kd''bd''bd''100 0

TIME HR

/m RCS Pressure vs Time: Plant Accident Sequence SBOBD-E; Plant Figure 19.11.5.4.1.3-1

\s) Damage State 242; Station Blackout with Battery Depletion and Wet Cavity .

Approved Des > Materiel Probabnistic stisk Assessment Page 19.11239

L System 80+ Design contrat Document O

30_ _

~

25 ~ l

^

wI 20 -

a  :

^

15 _

-~_

E O

10 :

~

5:

~

~

lII it i 1 I I t tttt I It t t t t t t tt t t t t t i i t t t 9 g gggg g ggg O 60 80 100 0 20 40 TIME HR i

1 l

RCS Two Phase Level vs Time: Plant Accident Sequence SBOBD-E; Figure 19.11.5.4.1.3-2 Plant Damage State 242; Station Blackout with Battery Depletion and Wet Cavity Wond Design Material Probabaistic Risk Asse* mm.,t p,y, y9, y y.24n I

Sy? tem 80+ Design ControlDocument (3

N) 45.0 _

.37.5

~

t 30.0 _Y 22.5 : _

i _

\ -

15.'O  :

7.5 :

~

0'0 O 20 40 60 80 100 TIME HR I l

t

(%) SG Water Level vs Time: Plant Accident Sequence SBOBD-E; Plant Figure 19.11.5.4.1.3 3 l Damage State 242; Station Blackout with Battery Depletion and Wet Cavity ,

^

...::Dee> ntesen\e!- Probabniaale Riek Assessment (2196) Page 59.11-241 ,

l Systerrs 80 +- ,

Design Control Document I

O' 240_ _

~

200 _

cn -

o_  :

vi160 y  : ASME SERVICE LEVEL C e

a_

/ /

120

/ h 80 i

l

/

40 . ,

0'''bd''kd''bd''bd''100 0

TIME HR Containment Pressure vs Time: Plant Accident Sequence SBOBD-E;- Hgure 19.11.5.4.1.3-4 Plant Damage State 242; Station Blackout with Battery Depletion and Wet Cavity Approved Desigru Material Probab&stic Risk Assessenerrt Page 19.11-242

' System 80+ Deskn ControlDocument

't 600_ _

~

500 _

u_. -

~

1 E

400 -

uJ  :

'~

E

/

/

/

300 _

1

/

i l

/ .

200 : o

/

_f

~

100 1

I 0

0 ' ' ' ' ' ' ' ' h.d ' ' ' ' ' ' ' kd ' ' ' ' ' ' ' b d ' ' ' ' ' ' ' b d ' ' ' ' ' ' '10 0 TIME HR 1

1 1

l l

l

[\ Containment Temperature vs Time: Plant Accident Sequence Figure 19.11.5.4.1.3-5 SBOBihE; Plant Damage State 242; Station Blackout with Battery Depletion and Wet Cavity Approvent Desiger Meteria!* Probebmetic Rick Assessment Page 19.11-243

System 80+ Derign CEntrolDocument O

480_ _

~

400 _

Z  :

E320 D.

LLI  :

O -

240 : -

~

~

160 _

_ l 80 _

i 1

0 0 ' ' ' ' ' ' ' ' hd ' ' ' ' ' ' kd ' ' ' ' ' ' ' 6d ' ' ' ' bd YOO TIME HR 1

l Basemat Erpsopm vs Time: Plant Accident Sequence SBOBD-E; Plant Damage State 242; Station Blackout with Battery Depletion and Wet Cavity Figure 19.11.5.4.1.3-6 9l Approwd Design Meterial Probabaistic Rbsk Assessment Pag < 19.11-244 l

l

System 80+ oesian controlDocument -

p (V

3000_

~

• 'Cr\()

t.~ _

1 m _

o.

vi2000 w

tr  :

ct -

1500 ! l n  :

v  :  ;

1

~

1000 .

I 1

500 1

W ,,,,, ,,,,,,,,, ,,,,, .... .... ,,,,,,,,,

0 40 60 80 100 0 20 TIME HR  :

i 4

p, RCS Pressure vs Thnc Nnt Accident Sequence Lle3E; Nnt Damage Figure 19.11.5.4.'2.1 1 1

(%

State 14; Large Break LOCA with Wet Cavity Annreweef Deshpn Mosenini- Probabnisaic Rick Assessment Pn9e 19.11-245

l l

Design ControlDocument

$Y**

O 30 25 b

D~ t' J go w

d

.s 15 0

10 _.

2

~

5 _

''' '''i l'''' 'iii ''ii 00 20 40 60 80 100 TIME HR RCS Two Phase Level vs Time: Plant Accident Sequence LL-3E; Plant Figure 19.11.5.4.2.1-2 Damage State 14; Large Break LOCA with Wet Cavity AnoroM Design Material ProbabHistic Risk Assessment Page 19.11246

I System 80+ Design controlDocument

.j -

s 45.0 _ _

37.5 '~

u. 30.0 ~-

r

~ 22.5 ) _

- 1 O -i_

' ~

15.0 _

7.5 l 1

I

~'''' '''' '''' '''' ''''

0'0 O 20 40 60 80 100 TIME HR i

1 1

l j

,-~.

SG Broken Loop Water Level vs Time: Plant Accident Sequence Figure 19.11.5.4.2.1-3 (v ) LL-3E; Plant Damage State 14; Large Break LOCA with Wet Cavity l

l i

ApprovedDee@ Atential.Probabaistic Misk Assessment Pope 19.11247 j I

System 80+ Design ControlDocument O

42_ _

35 N

~

\

t 28 : _

21  :

~

14 _

^

7

,1 ,t 1 '

0 N','1 ','N',,N't, ' ' ' ' N ' ' ' ' ' ' '1 @

0 TIME HR SG Unbroken Loop Water Level vs Time: Plant Accident Sequence Figure 19.11.5.4.2.1-4 LL-3E; Plant Damage State 14; Larfe Break LOCA with Wet Cavity Approved Design Material Probabmstic Risk Assessment page y9,yy.g4g

System 80+ Deskn ControlDocument im (J~

240 _

200 :

U) -

CL ASME SERVICE LEVEL C LIMIT ui160 w

Z  : /.

o_ _

~

120 _

N.)T ~

80 : .

4 40

'd 4

0'''bd''kd''bd''bd''100 0

TIME HR

,~.

Containment Pressure vs Time: Plant Accident Sequence L1-3E; Plant Figure 19.11.5.4.2.1 5

( )

A/ Damage State 14; Large Break LOCA with % et Cavity Approvenf Desiger ninterin! habebnistic Misk Assessment Page 19.11-249

System 80+ Design ControlDocument O

i 600 -

500 :

LL. ~

~

U-2 400 -

w  :

I N

3oo

7

~

I x O

200 :

~

100 _

0'''N''N't 0 ' ' ' ' ' N ' ' ' ' ' ' f N ' ' ' ' ' ' '1 N TIME HR Containment Temperature vs Time: Plant Accident Sequence LL-3E; Figure 19.11.5.4.2.1-6  ;

Plant Damage State 14; Large Break LOCA with Wet Cavity 4 I

1 Approved Design Material- ProbabHistic Risk Assessment Page 19.11250 l

l System 80+ Design controlDocument f

J

/

>U 1

l l

240_ _

200 _ 4 cn -

r

a. -

~

ui160 :

w ASME SERVICE LEVEL C cr Q.

/

120 _

O o

~

80 _

X ,

y  :

E 7

X 40 f

~

1 O ' ' ' ' ' ' ' ' N ' ' ' ' ' ' ' k d ' ' ' ' ' ' ' b d ' ' ' ' ' ' ' M ' ' ' ' ' ' '1 'g o O ,

TIME HR l l

. ,nx j  ; Comalmnent Pressure vs Time: Plant Accident Sequence LL-3F; Plant- Figure 19.11.5.4.2.2-1 s Damage State 11; Large Break LOCA with Dry Cavity l

l Appnnent Design Matenin!- Probahnisaic Risk Assessment page gg,g1 25p

System 80+ oesign controlDocument O

600_ _

500 _ ~

La_ -

$400 to  : 7 H  : /

_ L /

300 : -

~

200 _

100 _ .

~.

fI ti t t I i t t i ffitif f 1 I1 f tI t it i1 t 1 i f ffI I t ttt I i I OfO 20 40 60 80 100 l TIME HR l l

l l

Lower Compartment Gas Temperature vs Time: Plant Accident Figure 19.11.5.4.2.2-2 Sequence LL-3F; Plant Damage State 11; Large Break LOCA with Dry ,

Cavity AMwoved Design Material Probabaistic Risk Assessment Page 19.11-252 l

1

1 l

l Deskn ControlDocument l System 80+

O 1480_ _

400 : _

Z E 320 :

Q. -

~

LtJ Q -

_ a 240 -

/^)l

\

Gi .

160 :

I -

80 _ /

i

.0 N d ' k d ''b d '' 8 d 1 0 0 0

TIME HR N .

'] Cavity Concrete Ernsion vs Time: Plant Accident Sequence LL-3F;. Figure 19.11.5.4.2.2-3

[~ Plant Damage State 11; Large Break LOCA with Dry Cavity -

?;, ...:M neeserief hebahnsenc Mink Assessment . Page 19.11-253

i System 80+ Design control Document 23

[

0 3000_ _

~

2500 l@

v) -

o_  :

vi2000 w

o_  :

CL -

1500 :

i 1000 t

500 : _

i hh . . -= .+ -

TIME HR RCS Pressure vs Time: Plant Accident Sequence SL-11E; Plant Damage Figure 19.11.5.4.3.1-1 State 201; Small Break LOCA with Wet Cavity Approvecf Design Materk! ProbabiRstic Rhk Assessment Page 19.11-254

l l

System 80+ Design ControlDocument O

30_ _

25i _

lZ E 1 20 to ~_

_a _

15 : '

73  :

v  : 1 I

10 :

~

1 1

5:

,,,,,,,,, ,,,,,,,,, ,,,,,,,,, ,,,,,,i,,

0 , , , , , , , , ,1 0 20 30 40 50 1 0

TIME HR I

1 i

i i

RCS Two Phase Level vs Time: Plant Accident Sequence SL 11E; Plant Figure 19.11.5.4.3.1-2 i

Damage Staic 201: Small Break LOCA with Wet Cavity I l

Ipproved Des # Metenim! hebaMiede Risk Assessment Page 19.11-255

System 80+ Design controlDocument O

45.0 _ _

37.5 _

se t 30.0 _

22.5 : -

15.0 ! _

7.5 :

~t tI ii t t t i I f f f i i it I t i f I eI t ni eatt I eiet it i t t t t I i O 10 20 30 40 50 TIME HR SG Broken Loop Water Level vs Time: Plant Accident Sequence Figure 19.11.5.4.3.1-3 SL-11E; Plant Damage State 201; Small Break LOCA with Wet Cavity Approved Design Material- Probabilistic Risk Assessment Page 19.11256 l

Design ControlDocument Qstem 80+ ,

ex

'l Q)\

i 42

~

35 _

(

[ 28 _

21  :

,q: .

i J-s v _

14 :

~

7 0

0 ' ' ' ' ' ' ' ' i d ' ' ' ' ' hd ' ' ' ' ' ' ' bd ' ' ' ' ' ' id ' ' ' ' ' ' ' 50 TIME HR

( ') SG U4roken Loop Water Level vs Time: Plant Accident Sequence Figure 19.11.5.4.3.1-4

() StellE; Plant Dominge S*. ate 201; Small Break LOCA with Wet Cavity

~

&Deeger 80esenial hebeN8lseic Mick Assessonent Pete 1911-257

System 80+ Design ControlDocument O'

i 1800_

1500 :

Ui1200 CL [h f

900

/ /

i G

600 :

~

300 0

0 ' ' ' ' ' ' '1' d ' ' ' ' ' ' ' bd ' ' ' ' ' ' ' bd ' ' ' ' ' ' ' kd ' ' ' ' ' ' ' 5 0 TIME HR SG Broken loop Pressure is Time: Plant Accident Sequence ClellE; Figure 19.11.5.4.3.1-5 Plant Ihamage State 201; Small Break LOCA with Wet Carity

.%.. 2 Destgre Monwint hobaMhintic Risk Assessmerrt Page 19.11258

System 80+ Des > controlDocument (O

v 1500_ _

1250

%: , - - = :.we::: m Ui1000-_

O_ _

750 f O i 500 ! _

~

250 _

I iiii.. ii sini iii, iiiiiiini viiiiiiin einisinie O 30 40 50 0 10 20 TIME HR O SG Unbroken Loop Pressure vs Time: &nt Accident Sequence Figure 19.11.5.4.3.1 4 d' SI-11E; mnt Damage State 201; Small Break LOCA with Wet Cavity

^

-- :Desbre Manninlet.Prohahnealc Met Assessmerit Popepg.1125g

System 80+ Design ControlDocument O

60_ _

50 _

~

t 40 _

~

30 _

L_

~

9 20 _

1 1

~ l 10 -

\

1

~

' tit atini tit ionie, i,,,,,,,, ,,,,,,,,, ,,,,,,,,,

Q 0 10 20 30 40 50 TIME HR l

1RWST Water Level vs Time: Plant Accident Sequence SL-11E; Plant Figure 19.11.5.4.3.1-7 thmage State 201: Small Break LOCA with Wet Cavity ,

i l

Wed Des > Meteriet frobab5stic IUsk Assessmeout Page 19.11-260

g g y y g. M ConVd m t

[\

L) 60_ _

~

~

-50 _

~

t 40 ~_ _

~

30 _

-(% -

~

20 _

10 :

~

^

0 0 ' ' ' ' ' ' ' '1 d ' ' ' ' ' ' ' h d ' ' ' ' ' ' ' 3 d ' ' ' ' ' ' ' 50 TIME HR IRWST Water Level vs Tiene: Plant Accident Sequence SL-11F; Plant Hgure 19.11.5.4.3.2-1

\ Dantage State 209; Smiall Break LOCA with Dry Cavity m , mm a. ,e  !*M 1911-261

• l System 80+ Design controlDocument O

240_ _

200 :_

V) -

a.

vi160

t. J

_ ASME SERVICE LEVEL C cr  : / -

1 -

120 :

~

80

~

40 _

~ -

i --- -

g ___ _ ._

0''''d''N''N''M''N 0 1 TIME HR Containment Pressure is Time: Plant Accident Sequence SL-IIF; Plant Figure 19.11.5.4.3.2-2 Damage State 209; Small Break LOCA with Dry Cavity J

Mmf Des &n Materlaf-P\robabKstic Risk AssessnreM pay ,gg,yg.ggy

System 80+ Design ControlDocument

/

I

.C '

i 2

a 600 -

i 500 ~

_ i

_ i r

~

2- 400 -

w  : i H _

l H. l 300 !

o V

4 -

200 }

1 dQ; M .da _ k 100 -

i i i.it isi inesie. I inittii nii'*te niinini TIME HR J

Containment Temperatur vs Time: Plant Accident Sequence SL 11F; Figure 19.11.5.4.3.2-3 Plant Damage State 209; Small Break LOCA with Dry Cavity Wooit J>4-fneserief-Moheeseele Ads & Assessmoret Pope 79.FF-263 l

l

System 80+ _

Design ControlDocument I

l 480 400 ~ _

z :_

E320 Q_

t.o  :

o _

~

240 _

160 :

80 :

i /

0 i

/

0 i d ' ' ' ' ' ' ' 2d ' ' ' ' ' ' 3d ' ' ' ' ' ' 4d ' ' ' ' ' 50 TIME HR Cavity Concrete Erosion vs Time: Plant Accident Sequence SL-11F; Figure 19.11.5.4.3.2-4 Plant Damage State 209; Small Break LOCA with Dry Cavity Anwoved Des % Material- hobabastic Misk Assessment Page 19.11264

t i

System 80+. Mn coned Manent  !

f

-d I i

30_  !

. t

_ t I

p,,- . _ _ . . . _ _ . ... . ._ ____.._ _ ..._____ __  !

I _  ;

> 20 LL) y ,

i ta  :

J r

15  ;

i h

1 10 .

I I

i 5 :-

l

.- i 0 to u.ti.u.

.i.u.a.u.g.3.;_u.i.u.gt_u:.u.1 .3;_u tqi 0

TIME HR 4-Reacter Vessel Water Level: Plant Accident Sequence LOFW.9E; Plant Figure 19.11.5.4.4.1-1 d Dessage State 243; Loss of Feedwater with Wet Cavity w w nengard . habeMineic het Assesseront f***191I*265 e

System 80+. Design controlDocument i i

O; 240_ _

f.

200 :

(A -

O_-

g160 -

ASME SERVICE LEVEL C or  : /

a _

120

~

80 : _

i /

/

40 .

9 0

0 ' ' ' ' ' ' ' ' hd ' ' ' ' ' ' ' kd ' ' ' ' ' ' bd ' " ' ' ' ' 8 d ' ' ' ' ' ' '10 0 TIME HR Containment Pressure: Plant Accident Sequence LOFW-9E; Plant Figure 19.11.5.4.4.2-1 Damage; State 241; Loss of Feedwater with Dry Cavity Asapresed Design Materiel- PIrobein\Gstic Risk Assessment P*9e 19.11-266

system so+ o.e casua oocamart 1

7 v .

1 l

1 1

3000_ _

1 l

2500 '

li M

lP en -

c.  :

vi2000 W  :

cr  :

0- )

i 1500 O ,

i 1000 lbe 500 } _

0 40 50  ;

0 -10 20 30 TIME HR i

I I

( RCS Pressure vs Time: Plant Accident Sequence SGTR-12A; Mant Daanage State 218; SGTR with Stuck Open MSSV, No SI, and Wet Figure 19.11.5.4.5.1-1 .

Cavity .;

i Anorevent Doeipre nieterial. Probehmeh'c thlek Assessmerrt [11% Page 19.11267 '

i System 80+ Design ControlDocument i

l 30_ _

25 i _

~

toI 20 -

a  :

15 :

i_

9 10

k 5:

visitisi, iiiiiiiin inviiiini 00 iiiiiiiin 10siiiniini 20 30 40 50 TIME HR RCS Two Phase Level vs Time: Plant Accident Sequence SGTR 12A; Figure 19.11.5.4.5.1-2 Plant Damage State 218; SGTR with Stuck Open MSSV, No SI, and Wet Cavity .

ANwoM Design nieseniel . Probabaiseie Risk Assessment Page 19.11468

System 80+ Design controlDocument

,3

! )

K./

45.0 _

37.5 '- _

l

[ 30.0 _

l l

22.5 l

_ l

(~] -

t i ss .

i 15.0 _

~

7.5 _

7'''' '''' '''' '''' ''''

0~0 50 0 10 20 30 40 TIME HR l

( SG Bn> ken Loop Water Level vs Time: mnt Accident Sequence Figure 19.11.5.4.5.1-3

'v'

)

SGTR-17A; Plant Damage State 184; SGTR with Stuck Open MSSV, No SI, and Wet Cavity AMwovent Design Afsterial- hobabnstic Risk Assessment page 19.11 269 Q.

. System 80+ Design ControlDocument O,

i 240_ _

~

200 _

(f) -

O_

vi160 g  :: ASME SERVICE LEVEL C Z

O_

[

~

120 _ i

i i_

O 80 _

I

~

40 _

l 0i'ikd,'N''N''N't 0 r'N TIME HR Cen^ainment Pressure vs Time: Plant Accident Sequence SG'I11-15A; Figure 19.11.5.4.5.1-4 Plant Damage State 184A; SGTR with Stuck Open MSSV, Nu SI, and Wet Cavity

~

AnvovetDesipre Ataterte! ProbatMstic Misk Assessment Page 19.11-2M

system so+ o aian c a trar o a m t l

1 V ,

600_ _

l 500 _

4 u_. -

U-

h 400 -

w  :

w -

1 300 i

( i l x  :

200 ! ,

100 5 0 ' ' ' ' ' ' ' 1' d ' ' ' ' ' ' ' hd ' ' ' ' ' ' ' 3d ' ' ' ' ' kd ' ' ' ' ' ' ' 5 0 0

TIME HR l

Contain nent Teenperature vs Tirne: Plant Accident Sequence Figure 19.11.5.4.5.1-5

's~ SGTR.15A; Plant Dennage State 184A; SGTR with Stuck Open MSSV, No SI, and Wet Cavity i

W & Agogerief Probahniseic stiek Asseesnsent P&9019 Il'NI '

r. -

System 80+ Design ControlDocument 1

0 480_ _

400 !

z.

E 320 :

Q. -

w  :

o _

240 :  !

_. I 160 :  ;

80 :  !

\

i

^

0 l 0 ' ' ' ' ' ' ' '1 d ' ' ' ' ' ' ' hd ' ' ' ' ' ' ' bd ' ' ' ' ' ' kd ' ' ' ' ' ' ' SO HR  !

TIME l

i Cavity Concrete Erosion vs Time: Plant Accident Sequence SGTR-17A; Figure 19.11.5.4.5.1-6 Plant Damage State 184; SGTR with Stuck Open MSSV, No SI, and l Wet Cavity Appromed Desipre Afsterie! Probab&istic Risk Assessmerrt Page 12.11272 I

i

i system so+ o ian cansra oocum.nr  ;

+

3000_  :

i 250.0 _

m _

L i vi2000 w -

.o:  : ,

o_ - _

~

1500 _

O  :

C  :

_ l 1000 _

I

_ i

. i i

500 !

m.1 ,i... ......, ....... ....... ,,,,,,,

TIME HR i

l

!A)>

s RCS Pressure vs Time: Plant Accident Sequence ISleF; Plant Damage State 17; % Sequence and Dry Cavity ,

Figust 19.11.5 A.6.1-1 w wr oosion neererter. presesniseic niek Asseesment rare 19.11-272 l

System 80+ Design controlDocument -

t 1

I l

30~ _

25' '_7 i

wJ 20 -

J -

15 ,

10 __1 y ,

5 _

mei iniii einisinii siiiiiiii iiiiiiiii siistiivi 0 20 30 40 50 0 10 TIME HR RCS Two Itase Level vs Time: Plant Accident Sequence ISleF; Plant Figure 19.11.5.4.6.1-2 Damage State 17; % Sequence and Iky Cavity hivrosed Deskus NoterW ProbaMistic Risk Assessment pay, py, y g.g74

system 80+ oesian contra oocument  ;

i

(] Effective Page Lisung Appendix 19.11A-1 i

Pages Date i,il 1/97 ,

?

iii 2/95  :

19.11A-1 through 19.llA-4 Original  ;

i t

a i

I

\

s  ;

s I

i 1- l h

t 8 '.

,i f

i.

I I'

b ,

.(

11/9 7) Pope L E 5

% _; Den $ neewW. hebeMEeaic Mek Auenment

.- . .. - _ - . ~ _ . - - ._

System 80+ oesian contret Document f Appendix 19.11A Representative Calculations Regarding a System 80+

Thermally Induced Steam Generator Tube Creep ,

Failure in the Presence of a Steam Generator Partially Filled with Liquid .

i r

t Contents Page l.0 Introduction .... ............... .. ......... ...... .. 19.11 A-1 i i

2.0 Background . .. ...................... ................. 19.llA-1

\ 19.11 A-1

\ 3.0 Estimate of Minimum Water Level . . . . . . . . . ....................

4.0 References ....... ........ ........ ................... 19.llA-3 Figures 19.llA-1 Average Wall Temperature Versus Repture Time for Steam Generator Tube (inconel 600)(Reference A1) .......................... . 19.11 A-4 l

l 1

l l

i

.tg l

Anwered Designe niesenial hobeMNetic Mash Assessment (2/95) Pope blii i

i

System 80+ Design ControlDocument 1.0 Introduction This calculation estimates the minimum water level required in the secondary side of the steam generator that ensures the steam generator tube temperatures will be below tcmperatures associated with creep rupture.

2.0 Background Maintenance of the integrity of the steam generator tubes is of major importance to ensuring the integrity of the containment boundary and preventing or minimizing fission product releases to the environment.

The primary cause of induced steam generator tube failure is the heating of the steam generator via hot gases (superheated steam and hydrogen) generated in the core during the core melt progression. For this heating to be a threat to steam generator integrity. the process must occur at high RCS pressures and reach SG tube temperatures in excess of about 1100*K (1520*F). At this temperature creep rupture would fail an inconel steam generator tube in about 12 minutes when the RCS is near the relief valve setpoint pressure (see Figure 19.llA-1).

At lower temperatures, SG tube failure is still possible, however, the resulting long times to creep failure would typically be associated with a prior failure of the RV (e.g., vessel breach) that relieves the creep threat to the SG tube.

3.0 Estimate of Minimum Water Level

\ This section estimates the minimum water level required on the secondary side of the steam generator sufficient to maintain the primary side SG gas temperature to below 1000*K (1340*F). At this temperature, the creep failure process will not result in an induced failure prior to VB.

To proceed with this calculation, the following assumptions are made:

1. The secondary side water on the outer surface of the SG tube will be nucleate boiling with a 2

resulting heat transfer coefficient of about 10,000 Bru/hr/ft f.p,

, 2. The core average power is at the 1 % decay heat level, and the exit steam temperature is 2400*F.

2

3. For explosive boiling conditions the maximum energy released to steam is - 30 MW/m ,

i Two cases are analyzed. In the first case the core boils quiescently driven by the core decay heat. In the second case a pump restart is assumcd and a rapid steam generation event occurs in the core following the rapid quenching of superheated core debris.

Case 1: Quiescent Core Boildown in this scenario the core inventory boils away due to decay heat. The resulting steam released is further heated as it passes through the uncovered core region. Approximate core exit steam temperatures are on the order of 2400*F. Because of the low steam release rate (< 100 lbs/s) the resulting SG tube primary side heat transfer coefficient will be about 1 Bru/hr/ft2 f p, p

d Enreved Doeten Moneria!

• hobahnetic Rink Assessment Pope 19,11A-1

System 80+ Design ControlDocument The quasi-static steam generator tube temperature can be established in the wetted and unwerted portions of the secondary side. An energy transfer coefficient U can be defined as:

U=[Ih,+ 1k, + 1] (AI) h, where; 2

hpis the tube side heat transfer coefficient (Bru/in/ft /'F)

K, is the tube wall thermal conductivity (~ 12 Bru/hr!ft/*F) 6 is the tube wall thickness (~ 0.08 ft) 2 h, is the secondary side heat transfer coefficient (Bru/hr/ft j.p)

One can show that as long as the water in the steam generator is sufficient to keep the secondary system saturated the temperature drop across the tube wall will be under 10*F and the mean temperature of the stuun generator tubes will be under 550*F for wetted conditions.

The calculation for a partially wet steam generator is more complicated since the heat transfer and steam temperatures will depend on the steam ger.erator secondary side inventory. If it is assumed that the steam generator is filled with water to the 10 foot elevation and that the overall U is low (due to low primary side steam flow), the steam temperature will decrease from the steam generator entrance condition as given by T:(Z) - T' - exp - UrD' Z (A2)

T,,o - T, W,C, (See for example Reference A1.)

where; D, is the tube diameter.

W, is the superheat steam through flow per SG tube C, is the specific heat Z is the axial distance along the tube T is approximately the SG secondary side temperature T,,o, T,(Z) are the primary side steam generator conditions at the SG entrance and at position Z O

AMvered Design Material Probabhhsuc Risk Assessment Page 19.11A-2

e,

. System 80+ Deslan ControlDocument

( Using values typical of a quasi-static steam generator condition:

t hr-ft2 .p lbm U a 1.2 , D, = .054ft, W, a .006 Bru s  ;

Btu CP = 0.6  !

lbm *F, T'a 550*F, T .o s - 2400*F ,

i then T, (7) = 550'F + 1900 e'*62 When T,(Z = 9) = - 2194* F ,

While this temperaove is high, since the heat transfer coefficients on both sides of the tube are low (~ '

1 Bru/hr ft 2/'F) ,he resulting SG tube temperature can be estimated by establishing the primary to secondary side b.:at flux and evaluating the tube surface temperature. The energy flux from the SG gas to the tube wal! is :

q'" = h,

• AT = h, (T, - T,) = h, AT - 992 Btu /hr-ft 2 i

2

( Since N is utablished as low (~ 1 Bru/hr-ft ..F) and h,=l/U  !

( l AT = T,(Z) - T = 992*F l This results in T ,i = 1102*F. For the tube:

T.,, - T ,3 1

• q'" .083

• 992 - 6.86*F K, 12  ;

Thus, the average SG wall temperature is -1205'F. This temperature is sufficiently low so that SG creep failure is not a concern.

Case 2: RCP Restart Condition in this case considerable stored energy is removed from a severely overheated core. This evaluation differs from that of Case 1 in that large steam flows are generated and the heat transfer to the SG tubes is two orders of magnitude higher than that of the quasi-static case. The analysis is otherwise the same.

2 j In this case steam is assumed to be generated at the maximum rate of 30 Mw/m . This leads to a core 2

steam flow rate of about 450 lbm/s and av overall heat transfer of about 350 Btu /hr ft *F. Substituting these values in equation A2 the calculavd steam temperature at the exit of the liquid cooled region is below 800*F. This is well below any creep rupture threat to the tubing.

.4.0 References n

d A.1 Kreith, F.,

• Heat Transfer, International Textbook Company, N.Y.,1%8.

s- - . _ . , ,,.,,,. ,

i

Ms4$

e,o + O2T noee.$oC33~

- : 3r 3 :3:::E - :: 5iE:i-i

7:3-0 0

1 O

N' t

n i

%N

lle nc -

'N .,,,,,,,

I - '

u . -

B . -

l aC o ' ~

cl ,' -

i in ke 0 hci7c8. -

' 1 eN9 - '

.s .,'%

1 '

T 0 la nn

)

0oo s

. 6ii l ai t t -

N '

r u

en

.s ,N d -

nrE -

oe ct t h ,'

- o n

I I n S .

' h

(

f:

e -

' N e R -

1 m

- ' it e

.N 'N

' r u

O

' t p

u NN R

e 1 N-Nr i

'us PaaPpPa a '

0

.- s MMuM '

e NP l r

a 4

8u6 1

- .N i t

n -

- .N -

N f e

r e

.N

' f .

i sN

- D 1 0

-  : : 3: E: - -  ::4 :: EEE:1:: :E-

- 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 6

1 5 4 3 2 1 1 0 9 1 1 1 1 1 3

g.0 a mua)aEq)y=m3 g0muQ>(

. )

>* 3 % s E i. 3 esT ? aE .g g.Pn $ >C E g < ,a E x ',E g H g a m 0R 5 l g g g ,M m2a e:5J.

O h k gi , gg . 'P g I'I=h g#a3~ a4 9 ' .6L

l J' l system 80+ oeston coneet oocumart

-i

( ,

Effective Page Listing  ;

Appendix 19.11B' ,

t Pages Date .  !

i,ii 1/97 iii Original  ;

4 19.I1B-1 11/96 19.11B-2 through 19.118-7 Original l 1

i l

l 1

I I

i i

1 o  !

l

- ANwered W A6eneniet- ProbaMiinkt Riek Assessmorrt (1/97) PopeI,E i

1 Sy' tem 80+ Design ControlDocument I

Appendix 19.11B )

'.vf') j Bounding Analyses for DCH for the C-E Evolotionary PWR d

l Contents Page l

1.0 Methodology . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . .... 19.11B-1 1.1 Formulation of the Governing DCH Equations . . . . . . . . . . . . . . . . . .... 19.1IB-1 2.0 Initial Conditions . . . . . . . . . . . . . .......... .......... ..... 19.1IB-2 3.0 Description of the Analytical Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19.1IB-3 4.0 Description of Analyses . . . . . . . . . . . . . . . . . . . . ..... ........ 19.llB-3 4.1 Case 1: DCII Pressurization Following a IIigh Pressure VB from a Dry RCS into O

i, a Dry Reactor Cavity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19.11B-4

(,/ 4.1.2 Cases with Water Present .......................... ......... 19.118-4 5.0 Results . . ..................... .......... .... ....... 19.11B-4 i i

i 6.0 References .......................... ...... .......... 19.11B-5 Tables i

19.1IB-1 Containment Pressure vs. Core Fraction . . . . . . . . . . . . . . . . . . . . . . 19.1IB-6 Figures i i

19.1IB-1 Bounding Estimates of ALWR Containment Responses to DCH ....... 19.1IB-8 i

n K./ j l

l Annreved Design Mesorial- Probabnistic Rink Assessment Page B 1

l

Syster:180+ Design ControlDocument 1.0 Methodology l This appendix describes the methodology and assumptions supporting the bounding analyses discussed in Section 19.11.4.1. These analyses were originally performed for ARSAP and are fully discussed in '

Reference B5.

1.1 Formulation of the Governing DCH Equations The DCH process represents a containment challenge arising from a combination of thermodynamic processes associated with the high pressure melt ejection (HPME) events. In essence these processes combine to transfer energy initially in the RCS water and debris, along with chemical energy associated with oxidation of the metallic content of me core debris and hydrogen combustion, to the containment atmosphere. In combination these processes can transfer considerable energy to the containment resulting in a credible containment threat. The formulation employed in Reference B5 is based on a total energy balance for the RCS, debris, containment atmosphere system. The resulting equation governing the bounding DCH calculation is as follows: ,

AU,,, + AU,,, = + AUp + Q,, + Q,c (BI)

Where the internal energies and energy inputs are as follows:

AU., = M.C ., (Tr - T i)

AU,,, = M,,, C.,, (T, - T ) + M , acs C,,, (Tr - Tacs)

AUp = Ma Cv.t (Tu - T,) + M ,2 Cv,z, (Tu - T,) + Mz,e Cv.uc (Tu - T,)

Q,, is the oxidation energy added to the debris during the HPME hat,Zr " N su2 Z Az,, ,,,

Qo , ,, = Mr Qr .

Q,a is the energy released via combustion of all pre-existing hydrogen and hydrogen produced during the HPME.

Q,u = Mz, AHea In the above relationships:

M is the mass of the i* component (i = a = (air), s = (steam), UO , Z, and Z,02 )

3 2 C,,, is the specific heat at constant volume for the i* component Q2,, i = heat of reaction of Zirconium with water per unit mass Qr.. = heat of reaction of Fe with water, and AH,u is the heat of combustion.

\

Annrewd Destyrt Moseniel- hobabnistic Mick Assessmeert (11/96) Page 19.118-1

System 80+ Design ControlDocument These values are defined as follows:

• C .uo2 = 333 J/Kg-K

• C.,z, = 356 J/Kg-K

• C .o2 = 660 J/Kg-K r C,,,,, = 1760 J/Kg-K

• C,.2,02 = 645 J/Kg-K

• C .s2 = 750 J/Kg-K

• C,.w = 663 J/Kg-K

• Heat of zirconium reaction with water = 5.51E8 J/Kg-mol Zr0:(at 2500*K)

• Heat of hydrogen oxidation = 2.40E8 J/Kg-mol H2O (at 2500'K)

• Heat of iron oxidation = 4.113E8 J/kg-mol Fe 023

• Steam properties from Reference B2 and B4 The above values were taken at 1500K, unless otherwise stated, from MAAP User's Guide, Ref. B1).

T, and T iare the initial and final temperatures of the containment atmosphere.

Once equation B1 is solved for the equilibrium final temperature, the containment pressure is established from ideal gas relationships using the initial mass of the containment air and steam.

P, =

M, R, T' + M, R, T' (B2)

V, V, Where:

Pr is the total containment pressure V, is the containment volume R,, R, are the gas constants for steam and air respectively.

2.0 Initial Conditions Initial conditions for the DCil analysis assumed a saturated RCS at 2000 psi and an initial containment at 17 psia and 170*F (350*K). These conditions are typical of high pressure VB conditions where the RCS steam discharge is condensed in the IRWST. Other parameters used in the analysis include:

Containment free Volume = 3.3 x 10' ft5 RCS Volume = 14,000 ft2 Apswovmf Desiger historial-Probab&stic Risk Assessment Page 19.118-2

i I

Sy' tem 80+ Design ControlDocument d Full core inventory consisted of 112,000 Kg (247,000 lbm) of UO2, 33,000 Kg (72,765 lbm) of Zirconium and 10,000 Kg (22,000 lbm) of steel.

For analyses where the lower head included residual water the residual water mass was set at 43,300 kg I (95.470 lbm). For analyses where the cavity was assumed pre-flooded prior to VB, the cavity water mass 1 was assumed to be 227,000 kg (500,000 lbm). This corresponds to a fully flooded System 80+ reactor l cavity. )

l With minor exceptions, these values are typical for the System 80+ Standard Design. j 3.0 Description of the Analytical Program The equations and inputs identified in ections 1.0 and 2.0 were entered into a spreadsheet. The spreadsheet program has the capability of varying the following:

• Core debris initial temperature

• Containment initial temperature

• Fraction of core ejected  ;

• Amount of steel ejected

• Fraction of ex vessel hydrogen reacting

• Fraction of steel oxidizing

• Initial amounts in containment O

• Amount of water in the cavity ,

d_

• Amount of water in the reactor vessel Amount of steam in the reactor vessel.

{

1 The term " fraction of core ejected" means the fraction of the core which is participating in the energy transfer to the contairanent atmosphere. The core could be ejected from the vessel, but its participation in further energy transfer could be inhibited by the cavity configuration, access to reactants, particle dynamics, etc. The three cases discussed in Section 19.11.4.1 of the main report were run for varying fractions of the core ejected to illustrate sensitivity to the performance of the reactor cavity.

4.0 Description of Analyses A spreadsheet program was used to analyze three high pressure DCH scenarios:

• Case 1: Dry RCS and a dry reactor cavity

• Case 2: RCS with residual lower plenum inventory and a dry reactor cavity 1

• Case 3: RCS with residual lower plenum inventory and a fully flooded reactor cavity.

These cases are described in more detail below. Spreadsheet results are presented in Figure 19.11B-1. l C\

V k ..: Desips acener\iet

• hobahniselc Rink Assessmerrt Pope 19.1184

fystem 80+ oesign controloceument 4,1 Case 1: DCII Pressurization Following a High Pressure VB from a Dry RCS into  :

a Dry Reactor Cavity This case addresses a VB failure scenario where no liquid water is in the RCS or the reactor cavity (steam in the RCS was assumed to be present). All the heat from the cooldown of the core debris materials and from chemical reactions was assumed to be transferred to the containment atmosphere.

The initial composition of the containment atmosphere was determined by starting with the pressure and temperature obtained from the MAAP code for a representative System 80+ station blackout sequence just prior to reactor vessel meltthrough. The initial amounts of oxygen and nitrogen were determined assuming a temperature of 80*F prior to the start of the accident sequence.

The heat sources were computed by summing the sensible heat of cooling from the initial temperature of the melt to the final temperature of the core materials and adding the heat due to chemical reactions.

The soarces of the sensible, or stored, heat were the fuel, the zirconium oxide from the in vessel oxidation fraction, the unoxidized zirconium, and the steel. The heats of reaction of zirconium oxidation in steam to form hydrogen and of subsequent hydrogen burning in oxygen was also considered.

Oxidation of the steel was not considered in this case because of the assumed absence of water available to oxidize it to any great extent. The initial debris temperature was taken at 25M*K. The heat sinks were considered to be the nitrogen and water vapor initially in the containment and tl e oxygen remaining after the hydrogen burn. The process was assumed to be a constant volume process in thermodynamic equilibrium.

The final temperature was obtained by a trial and error solution as the temperature where the heat sinks equal the heat sources. The final pressure was obtained by smiing the partial pressures of the constituents in the gas phase at the f5al temperature.

4.1.2 Cases with Water Present Two cases were analyzed where water was present: one where water and steam in the RCS were assumed to codisperse with the core debris at the time of meltthrough, but where no water existed in the reactor cavity (Case 2); and another identical case, except that 227,000 kg of water were assumed to exist in the reactor cavity at the time of meltthrough (Case 3). In each case, the RCS water was assumed to be the liquid in the lower head and the steam in the remaining RCS volume.

The heat sources were identical to those of the dry case, except that the oxidation of steel was allowed.

The heat sinks were also identical, with the addition of the effect of the additional water. If the heat balance indicated that liquid water remained in the system at the equilibrium condition, saturation properties were used to determine the final temperature and internal energies. If the heat balance indicated that no water remained, a separate area of the spreadsheet was used to calculate the final condition, using superheat properties that were calculated starting with the saturation properties at the given pressure. The solution was obtained by assuming an initial temperature, which affected the pressure, which affected the steam, saturation properties, and heat sources and heat sinks were established by iteration until a convergent solution was obtained.

5.0 Results Results of the analyses are graphically presented in Figure 19.1IB-1.

Attwoved Design Matedet Probabnishc Risk Assessment Page 19.1184

i

' System 80+ Deakn controlDocument l 6.0 References  !

.. . .. i B 1,' Fauske and Associates, Inc., Technical Report 16.2-3, MAAP (3.0) Modular Accident /malysis l Program User's Manual - Vol II, Atomic Industrial Forum, Bethesda, MD, February 1987.

I B2. E. A. Avallone, and T. Baumeister, Eds., Marks' .c'andard Handbook for Mechanical Engineers, Ninth Edition, McGraw-Hill Book Company, No a York,1978.

B3. R. H. Perry, et al., Eds., Chemical Engineers' Handbook, Fourth Edition, NcGraw-Hill Book )

Company, New York,1%3. i

)

B4, J. H. Keenan and F. G. Keyes, Thermodynamic Properties of h.,m, John Wiley and Sons, New York,1936.

I.

B5. DOE-ID-10271, " Prevention of Early Containment Failure due to HPME and DCH for Advance LWRs," Carter, J. C., et. al., March,1990.

]

l J

Svatem 80+ Design ControlDocument Table 19.11B-1 Containment Pressure vs. Core Fraction This Table Intentionally Blank O

I l

l l

O Approved Deshptr Matenia!- Probataistic Risk Assessmerrt Page 19.118-6

. - _ . _ _ ~ _ . . . _ - _ . . _ - . . _ - . - _ . - . _ . . _ _ . . . . . - . . _ ,

4 i

~.); _

Sysempre 80+ Deshtru CorreralDocurnorrt .

?

• J.

'.h

' n '.

I g h

i k

l

. 1 t-4 t'

250 Q  :

+

200' - - *4- * * * -- -

i

~

a g 150 -

1 -

i 1

e  :' @ l

" i 100 - - * * *

• b ~

4

,o -..................... ................ ..... . .......... -

I Typical Corium visp.rsal W.dian Corium disp.rsoi NUREC-5809  !

4 NUREG-1150 '

-0 i 1.0 0.8 0.6 0.4 0.2 0.0 4

Fraction of Cu.

• Tected  ;

e c.,. ,. .... ,,. =cs . ~ ..i.i.

, , , , ,,,,,, ,, ,c , ,,,,,

..w,. co pobility + ,,, c . ,;, y a cs w oe. ,

j

@ s ret.m so+ ultimet. Pr

• ruit cavity acs weier

, @ syst m so+ sir... L...I c t

l i

4 1

Bounding Esthmates of ALWR Containneemt Responses to DCH Figure 19.115 1 W Des @e AspeamW. AseeMgrale det d-guest @ F3.f f3 7 ' ,

r -- ,- w- , , . . - - , . , - - - -

. - - ~ - , ~ ~

___ _ _ . . -- . . .. . . - - - . - .~ .-. . .. .

i i

O System 80+ Design ControlDocument  ;

I. 'j]

M Effective Page Listing l Appendix 19.11C  ;

i Pages Date i i, ii 1/97 i lii Original 19.11C-1 through 19.11C-4 Original  ;

19.I1C-5 11/96 19.11C-6,19.11C-7 Original I l

f i I s

7 4

I i e

i  !

6 ll '

t t ,

[

f F

f L

I r

f l

. Approved Dee> Aieternief.ProbeMiraic Mink Assessment (1/97) PopeI,R

Sy-tem 80 + Design ControlDocument Appendix 19.11C (O7 Assessment of the De-Entrainment Capability of the System 80+ Reactor Cavity 4

Contents Page 1.0 Experimental Observations and Correlations Supporting Debris De-Entrainment Models .......................... ................... 19. llc-1 2.0 Example Calculations of Debris Removal by Proposed Design Features .... .. 19.11C-2 2.! Comment on Debris Trapping ....... ..... ... ............. 19.11C-2 2.2 Calculation of Debris Dispersal Fraction . . . . . . . . . . . . . . . . . . . . . . . . . . 19.1 IC-4 2.3 Consideration of Debris Re-Entrainment . . . . . . ..... ...... ... . 19.11C-4

[N 2.4 Effect of Vent Space by the Reactor Vessel . . . ..... .. . ....... 19.11C-5 O

3.0 References . . ... . ...... ... . ... .... ..... . 19.11C-5 Figures 19.11C-1 Fraction of Drops of Diameter D that Fail to Make the Turn for Various Gas Density po. (for Zion Configuration) . ... ... ........... 19.11C-6 19.11C-2 Schematic of APWR Reactor Cavity and in-Core Instrument Chase Configuration ............. ... ........ .. ........ 19.11C-7 il

\

Anwoved Des & Meterd Probahnstic Risk Assessment Page a

i System 80+ Design ControlDocument  ;

i 1.0- Experimental Observations and Correlations Supporting Debris De-

_ Entrainment Models  ;

~

Models have been developed by Sandia (Reference C1) for estimating the likelihood of debris particles ,

not deflecting with a flow passage direction change and thus impacting a structure. These models relate  ;

the particle size, velocity, size of flow passage and severity of direction change to estimate the trajectory ,

of the particle, as follows: l a= I In [ l + AW _W._ [ _W._

AW L L

-1] a ] (C1) where A=$[.I]#1C o (C2) 4 d. pt In the above equations, W is the length of the shaft entrance (that is, the apenure through which the particles travel as they turn to leave the reactor cavity), L is the cavity height, a is the fraction of  :

particles failing to make the turn, and C, is the panicle drag coefficient.  :

i Details .of the model derivation are presented in Reference C1. These relationships were developed to  !

predict HIPS test results that included the effect of debris impingemen6 on a scaled Zion seal table structure overhanging the instrument chase entrance into the lower containment volume.

These Sandia models predict that the majority of the entrained debris impacts structures. Figure 19.1IC-1 is taken from Reference C1 and provides the results of the model in terms of a, the fraction of drops of 3

diameter d which fail to make the turn, for various values of gas density, po, (to account for variations

due to temperature). As can be seen from Figure C-1, particles larger than about I mm (10'3 m) are 3 sufficiently massive that most fail to make the turn at the initial blowdown pressure. Later in the i blowdown when the flow velocity is reduced, the particle size which cannot deflect is reduced. But, if the particle impacts in an area where the stream velocity is relatively high and the debris does not freeze instantly, there is a possibility that the panicle would re-entrain. The entramment criterion based on the l Kutateladze number could be used to make this assessment if the state of the debris and the local velocity were known. It should be noted that Sandia has estimated that 1 mm panicles would give up approximately one-half of their heat within a few meters flight (Reference C2). Thus a portion of the deb.a should be solidified or near freezing at the time of impact. Debris retention by the reactor cavity has been one of the most intensely studied effects in the DCH experiments conducted to date. Most of the small scale experiments and the SURTSEY 1

10 scale experiments have also been performed with the Zion Nuclear Plant geometry, so their results are not directly applicable to the System 80+

. configurations. This geometry is not expected to retain much debris in the reactor cavity, and the test results performed by the industry and the national laboratories have confirmed this expectation.

Based on the work of IDCOR and tests conducted by Spencer at Argonne National Labs (ANL)

(Reference C3) on the Zion reactor cavity and instrument tunnel design including external overhanging structures, it is expected that most of the debris would exit the cavity, but would impact the seal table e and be redirected to the contairunent floor. Tests conducted at Sandia as part of the HIPS test series with 4p < a ,, asses,w. emnemasse m a m-- e rue. rs. r rc-r

Syotem 80 r Design ControlDocument containment arrangement scaled to Zion showed only a small amount retained in the cavity and another small amount retained by the overhang. The test facility was not designed to investigate the amount of debris that may have been redirected to the floor or the influence of other structures that would have been encountered in the lower containment or other effects of compartmentalization.

Experiments of very small scale have been performed by Brookhaven National Labs on two plant geometries other than Zion. These are the Surry and Watts Bar Nuclear Plants. Both of these plants appear to have better debris retention characteristics than Zion. Although neither represents the cavity design characteristics proposed for ALWRs by ARSAP, the Surry cavity and instrument tunnel do contain some of the features of the recommended design. Most notable is the inclusion of a 90 degree turn; however, the turn is not offset in the ceiling of the cavity as it would be in the ALWR configuration.

In these tests the cavity walls were protected as concrete spalling was expected to preclude attachment under prototype conditions. While the majority of the debris was dispersed from the cavity, the results did indicate that some debris was retained in the molten state within the main shaft and dripped back into the cavity. An important obserwion was made with regard to a second smaller vertical shaft which is located upstream near the first. Debris did not disperse through this second shaft until late in the test, suggesting that material was projected to the end of the cavity and that some accumulation of debris in the cavity end apparently occurred before the entrained debris could be passed through the offset shaft.

2.0 Example Calculations of Debris Removal by Proposed Design Features Figure 19. llc-2 shows the layout of the ALWR cavity design as proposed by ARSAP. These features are similar to those employed in the design of the C-E System 80+ reactor cavity. The important features of the design are the large cavity volume, the vertical instrument shaft, the cavity floor passage height (and hence the cross sectional area for flow across the cavity floor), and a large volume which forms an offset beyond the instrument shaft. These characteristics of the passageway are the most important and effective practical design features that can be incorporated consistent with other issues which must also be accommodated in the design.

2.1 Comment on Debris Trapping Based on information provided in the previous sections, the expected particle size and the fraction of the particles expected to deflect directly into the vertical shaft can be estimated. The remaining debris is expected to enter and be retained in the offset volume at the end of the cavity. The recommendation made by ARSAP for this offset volume is that its size should be at least twice the volume of the total inventory of core material. The debris entering this volume is expected to collect, at least temporarily, and thus to be de-entrained. The potential for material to be re-entrained can be qualitatively evaluated.

The results of this evaluation do not represent the entire reduction attributable to geometry as they do not include any downstream effects of the passageway and structures in the lower containment volume.

The initial conditions for the analysis of the end of cavity trap geometry effectiveness are:

Primary System Conditions:

Pressure = 17.2 MPa (2500 psia)

Temperature = 866 K (1100*F)

Mass of flydrogen = 245 kg (540 lbm)

Approwd Design Metenie! ProbabBistic Risk Assessment Page 19.11C-2

,. . .. - . . . . ~ . _ -_ . .

-. . . - -.= -

i System 80+ Deelan ControlDocument a Initial Reactor Hole = 0.3 m (1 ft.)' diameter  ;

. Debris Conditions: ,

i Total Vessel Debris ~ = 140,000 kg E

Fuel = 100,000 kg l.

s, Zirconium = 30,000_kg (A portion of zirconium will have reacted in-vessel) .

Steel = 10,000 kg l

Density = 7,000 kg/m3  !

t

. Reactor Cavity Dimensions (see Figure C-2) l Length = 16.5 m (54 ft.) .j

.)

+

. Width = 4.57 m (15 ft.)

. Height '= 3.05 m (10 ft.)

3 Trap Volume = 42.5 m (1500 ft.3) '!

o  :

1  !

Instrument Shaft Offset = 3.05 m (10 ft.) j

-Shaft Entrance Dimensions-

.1 Length = 1.83 m (6 ft.)

i Width = 1.83 m (6 ft.) .,

-I Initial Pressure = 0.34 MPa (50 psia).

The amount of hydrogen remaining in the reactor vessel just before vessel failure contributes about 15 %

. of reactor pressure. Calculation of critical flow of the two component gas from the vessel yields a mass flow rate of 1,312 kg/s (2,887 m/sec). Using the above dimensions the gas velocity at the point of entrainment in the cavity is predicted to be 117 m/s (384 ft./sec) and this compares to a minimum 3

entrainment velocity that is.approximately 67 m/s (219 ft./sec) for the gas density of 0.8 kg/m .

Therefore, entrainment will occur in this case. Henry (Reference C4) has developed an equation for

. estimating the entrainment rate for HPME conditions.- Based on this work, the entrainment rate per unit j surface area:

Anwoved ass > assender. Mete 6erde AM Assessment Aspe 79.f fCJ -

c W e.-

• Syntem 80+ Design ControlDocument

. (C3)

MD 10.4 LP L A 0.25

= E, [ c )0.5 p A, P, A, Where Mois the entrainment rate in mass units; A, is the surface area of the debris, Eo is the entrainment coefficient and has a value of about 0.1, and U, is the velocity of the gas in the cavity.

Initially the entrainment rate is estimated to be 54,000 kg/s (119,000 lbm/sec.). The time until the debris is pushed from the cavity area into the trap is given by 10.4 LP L A 0 0.25 t=[ c J .5 p (C4)

Where t is the time, L pis the length of the passageway, L is the effective length of debris, A, is the cross-sectional area of the cavity flow passage, P, is the reactor vessel pressure, and A, is the surface area of debris, assumed to be the horizontal area of the cavity (see Reference C4 for details of development).

For the given conditions the time to move the debris into the offset volume as illustrated in Figure

19. llc-2 is 1.29 s. Total entrainment is estimated at 54,000 kg, since the entrainment rate will drop significantly as material is displaced over the 1.29 seconds. The mean stable particle size is calculated using the critical Weber number to be 1.1 mm.

2.2 Calculation of Debris Dispersal Fraction In this example, it is assumed that the gases initially entering the cavity at 866 K (1100*F) will approach equilibrium with the entrainea debris (2500 K). This value is estimated to be roughly 2000 K, and therefore the velocity of the two-phase mixture will increase as it proceeds toward the instrument shaft as the gas is heated. Equations C1 and C2 can now be used to predict the fraction of entrained debris which fails to deflect. If W = 1.83 m (6 ft.) and L = 3.05 m (10 ft.), then Equation Cl becomes:

a = 7.02 in [ t + 0.142; l.6 + .4] a ] (CS)

Solving for a gives a fraction of approximately 0.90 or 90% of the entrained debris that does not make the turn into the instrument shaft and impacts the trap. Thus about 5.4 metric tonnes (10% of 54,000 kg of entrained debris) enters the instrument shaft as entrained debris and about 134,000 kg is initially collected in the end volume (includes 86,000 kg " pushed" into offset volume as a liquid mass and trapped).

2.3 Consideration of Debris Re-Entraintnent Debris that enters the trap may not remain there indefinitely. Displacement will depend on the local velocity into the trap. Much of the discharge stream will be deflected as back pressure builds up in the trap. Thus, local velocities are likely to be below the entrainment threshold and displacement is not expected to be rapid.

Astvoved Design Material- Probab&stic Risk Assessment Page 19.11C-4

. ... - - - . -._ ~ . - - - .. . -.- - --- . - - - -

System 80+ Deslan ceneralDocument i

2.4 Effect of Vent Space by the Reactor Vessel i j To date only one small scale experiment (HIPS-8C) has been reponed with a vent space around the debris 4 generator (Reference C5). Almost one third of the debris was collected in the test trap above the gap.

J Although this suggests that substantial material may pass directly into containment by the vessel, there are several factors in real plant designs that prevent a large mass of debris from dispersing via the vessel  :

path. First, the path by the vessel is small and complex compared to the simple gap of the small scale  ;

test. The tonurous nature of this path will limit the flow through it, if it is open at all. Second, real

. plants will have insulation on the reactor vessel. When vessel failure occurs, the volume between the ,

insulation and the vessel will be pressurized forcing the insulation outward and upward. Thus, the insulation is likely to first block the gap and then jam into it. Lastly, the region above the reactor vessel typically is designed with panially restricted communication with the upper containment by the placement

" of a missile shield which covers the refueling canal and is held in place against the blowdown forces.

. Bypass of the vessel is, therefore, not expected to contribute significantly to DCH.  ;

- r Even if some of the debris was diverted to the bypass path, the required dominance of the design vent ,

area would limit the bypass debris fraction to an estimated maximum of 10 - 30%. Moreover, the missile .

' shields would tend to retain this debris and the parallel flowpath would reduce velocities to and through the instrument shaft, thereby decreasing the fragmentation and transpon along that path. Thus, even if the expected bypass blockage does not occur, the System 80+ design features will mitigate DCH i

sufficiently to preclude containment failure.

3,0 References O C.1 J. V. Walker, " Reactor Safety Research Semi-Annual Report," NUREG/CR-5039, SAND 87-2411, July-December 1987.

t C.2 D. C. Williams, et al., " Containment Loads Due to Direct Containment Heating and Associated 1 E Hydrogen Behavior: Analysis and Calculation with the CONTAIN Code," NUREG/ i

.. CR-48%, SAND 87-0633, May 1987. $

!. l C.3 R. E. Henry, et al., " Technical Support for Issue Resolution," IDCOR Technical Repon 85.2,  ;

< Atomic Industrial Forum, July 1985. ,

C.4 R. E. Henry, " Modifications for the Development of the MAAP-DOE Code Volume IV: Fission i Product Release During High Pressure Melt Ejection," DOE /ID-10216, November 1988.

C.5 M. Pilch, et al., "The Influence of Selected Containment Structures on Debris Dispersal and a Transpon Following High Pressure Melt Ejection from the Reactor Vessel," NUREG/

CR-4914, SAND 87-0940, September 1988.

l l

)

, I Anreeeef Dee@n aseenrief hebebassic Riek Assessment (11/961 Page 19.11C-5

System 80 + Design ControlDocument N.

. . . ,C3 -

...- O

.......a.......;.........;....1.....1.........*.... ............L.........*..

. y-

• .Q.

. O .

. . W

........ ...... . . ...... ........ ......... .. .. O

. A

:. V V

.. M.

. ...g.... ..

,O -

g .

c5

.O

. . . . i e-

. . N

. 1 . t , t . t . t . I , t , t , t ,

'C3

,. n. O

- O. O. n. a. w. m.

O O O O O O O O O 1/1-ici1)/  ;

Fraction of Dmps of Diameter D that Fail to Make the Turn Figure 19.11C.1 l for Various Gas Density Pc, (for Zion Configuration)

\

Anusved LMskn Meterud . nnawhakuc Rhh Assessnumt Page 19.11C-6 1 l

Syst

m 20+ D: sign ControlDocument lO SEALED j ENCLOSURE l /

• l

._ n 1

cmas l C -

i REACTOR l PRESSURE VESSEL O

i

, l l

l i

l i

NOTE: FIGURE IS TO ILLUSTRATE SCOPE OF EPRI REQUIREMENTS AND IS NOT INTENDED TO BE THE FINAL DESIGN.

Ace (CAVITY EXIT) n AndREFUELING SEAL) s i

Schematic of APWR Reactor Cavity and In-Core Instrument ChasI Figure 19.11C-2 Configuration Apnprowd Design Matwie! Probabnstic Misk Assessment Page 19.11C-7 l

system 80+ oesion contrat oocument

] Effective Page Listing Appendix 19.11D Pages Date

~ '

i,ii 1/97 ,

iii Original 19.llD-1 through 19.llD-7 11/% '

h f

i O

4 d

e I

(

^ ... :Desigur Moennie!* ProhnNiiche Risk Assessment (13 7) Pope 1. M

System 80+ oesign controlDocument Appendix 19.11D I

i l

Two Cell Adiabatic Equilibrium Model i

)

for Direct Containment Heating Contents Page 1.0 Overview of the *Pilch DCH Model" . . . . ...... ......... .. .... 19.11D-1 1 2.0 Extensions of the Pilch Models . . . . . . . . . . . . . . . . . . . . ..... .. .. 19.11D-1 3.0 References ... ......... .... .. ........ .... ... . .. 19.11D-2 l 1

i Tables 19.llD-1 Sample input File . . . . . . . . . . . . . . . . ........... . 19.11D-3 19.11D-2 Sampic Output File . ....... ... ............ ........ 19.l lD-4 l

i I

d 1

i G

Anwoved Design Atatoriel. Probabnistic Risk Assessment Page M

System 80+ Design controlDocument _

{} 1.0 OveMew of the "Pilch DCH Model" A model was neloped to assess the peak containment pressures resulting from Direct Containment l

Heating (DCR; and related loading mechanisms. This model was based on the two cell adiabatic equilibrium model proposed by Pilch (Reference D1). The features of the Pilch model are discussed briefly below along with several extensions to the Pilch model which have been incorporated.

For the two cell model the containment free volume is divided into the " lower subcompartment" and the

" upper dome compartment." The premise of the Pilch two cell model is that DCH occurs independently l in the subcompartment and upper dome. The total energy imparted to the containment atmosphere is the sum of the subcompartment and the upper dome contributions. Heating of the local containment atmosphere by the debris internal energy is limited by the relative heat capacities of the containment atmosphere and debris.(i.e. the debris and atmosphere are allowed to come into thermal equilibrium within a region).

The model considers energy addition to the containment atmosphere from blowdown of the steam and hydrogen in the RCS, from the thermal energy of the dispersed debris, from chemical reactions between steam and unoxidized metals in the debris and from combustion of hydrogen (pre-existing in the containment atmosphere, released from the RCS during blowdown and produced from the metal-water 4

reactions during the blowdown).

In the model the mass of molten debris in the reactor vessel lower head at vessel failure, the fraction ejected from the vessel and the fraction disperd from the cavity are inputs. In addition, the fractions G of the debris which are dispersed from the cavity in o the lower subcompartment and into the upper dome h are input.

The two cell model is consistent with recent DCH experimental simulations which demonstrate the importance of obstructions in limiting the ability of the corium to directly transfer its energy with the bulk containment atmosphere (See for example References D2 through D4). The recent experiments have also l indicated that the generation of hydrogen is influenced by the availability of steam to the particulated debris and that participation of hydrogen in the DCH process is to a large extent dependent on the proximity of the debris to the available hydrogen.

2.0 Extensions of the Pilch Models Several extensions were made to the Pilch model for the purpose of performing parametric sensitivity analysis.

These included:

1. The ability to specify the fraction of pre-existing hydrogen in the containment which burns during se DCII event. (The Pilch model assumes that 100% of the pre-existing hydrogen in contairunent is burned during the DCH event).

2. The ability to specify the fraction of hydrogen in the blowdown stream from the RCS and produced from metal-water reaction during the blowdown which is burned. (The Pilch model assumes that 100% of the hydrogen released from the vessel and produced during the blowdown O is burned during the DCH event).

Atiproved Doelptr Motoriet - Probabnistic Misk Assessmorrt (11/96) Pope 19.110-1

l Syatem 80+ oesign controlDocument

3. The ability to specify the fraction of the metals in the debris ejected from the reactor vessel which are not dispersed from the cavity which are oxidized. (The Pilch model assumes that none of the metals in the non-dispersed debris are reacted).

4. The ability to specify the frac' ion of the metals in the debris ejected from the reactor vessel which are dispersed from the cavity which are oxidized. (The Pilch model assumes that 100% of the metals in the dispersed debris are reacted).

5. The ability to limit the oxidation of debris retained in the cavity based on the availability of steam in the blowdown stream from the reactor vessel.

6. The computer code also allows the user to insert a subroutine which defines the containment fragility curve which when supplied the peak containment pressure from the DCH event calculates the probability of containment failure.

Table 19.1ID-1 contains a sample input for the model. Table 19.11D-2 shows the model output.

3.0 References l DI. Pilch, M., " Adiabatic Equilibrium Models for Direct Containment Heating," 19th Annual Water Reactor Safety Meeting, October,1991.

D2. NUREG/CR-4914. "The influence of Selected Containment Structures on Debris Dispersal and l Transport Following HPME from a Reactor Vessel," Sandia, September,1987.

D3. Spencer, B.W., et. al., "Results of Direct Containment Heating Integral Experiments at 1/40 th Scale at Argonne National Laboratory." paper to be presented,1992.

l D4. Blanchat, T.K., et. al., "The Sandia integral Effects Test Series," paper to be presented,1992.

O Altvoved Design Material- Probab&stic Itisk Assessn'ont (11/96) Page 19.11D-2

Sy' tem 80 + Design ControlDocument Table 19.11D-1 Sample Input File (a)

Run Title Sample Input l MDEB Mass Molten Debris (KG) 67200.00 l TD0 Initial Debris Temperature (K) 2600.00 l FMUO2 Mass Fraction Debris UO2 0.564 l FMZR Mass Fraction Debris ZR 0.242 l FMZRO2 Mass Fraction Debris ZRO2 0.00 l FMSS Mass Fraction Debris Stainless Steel 0.194 l FEJECT Fraction Molten Debris Ejected from RPV 1.00 l FDISP f raction Debris Dispersed from Cavity 0.1 l CD Molar Heat Capacity of Debris (J/kgmole.K) -1.00 l CV Molar ficat Capacity of Gas (j/kgmole.K) 2.7E4 l VOLI sub. Compartment Volume (M**3) 923.00 l VOL2 L pper Dome Volume (M**3) 9.45E4 l

^

r N, VOLRCS RCS Free Volume (M"3) 396.00 l PCO initial Containment Press (PA) 1.72E5 l TCO Initial Containment Temp (K) 361.00 l PRC50 Initial RCS Pressure (PA) 1.72E7 l TRCSO Initial RCS Temp (K) 627.00 l f Nil 2CO Moles H2 in Cont. Initially (kg-Mole) 110.00 l NH2R0 Moles H2 in RCS Initially (kg-Mole) 250.00 l FDMRC I ract Dispersed Metal Oxidized Blowdown 1.00 l l FNDMRC Fract Non-Dispersed Metal Oxidized BD 0.5 l FLAGMW > 0 Limit Mw Reaction If RCS Steam Limit 1.00 l EBURNC Fraction Containment H2 Burned 0.00 l EBURNR Fraction RCS and M/w React H2 Burned 1.00 l FAI Fract CAV Flow to 1.ower Compt (area fract) 0.9 l l

l l

1 I

g]

Approved Desiger Material. Probab&stic Risk Assessment (11/96) Page 19.110-3

System 80+ Design controlDocument Table 19.11D-2 Sample Output File Run Title Sample Output l

MDEB Mass Molten Debris (kg) 6.72E +04 l

TD0 Initial Debris Temperature (k) 2.60E+03 l

Mass Fraction Debris UO2 5.64E-01 l FMUO2 Mass Fraction Debris ZR 2.42E-01 l FMZR FMZRO2 Mass Fraction Debris ZRO2 0.00E+00 l

Mass Fraction Debris Stainless Steel 1.94E-01 l FMSS j FEJECT Fraction Molten Debris Ejected from RPV 1.00E+00 Fraction debris dispersed from Cavity 1.00E-01 l FDISP CD Molar Heat Capacity of Debris (j/kgmole-k) -1.00E +00 l

CV Molar Heat Capacity of Gas (j/kgmole-k) 2.70E +04 l

VOLI Sub-Compartment Volume (M"3) 9.23E+02 l

VOL2 Upper Dome Volume (M**3) 9.45E+04 l

VOLRCS RCS Free Volume (M**3) 3.96E+02 l

PC0 Initial Containment Press (PA) 1.72E+05 l

TCO Initial Containment Temp (K) 3.61 E +02 l

PRCS0 Initial RCS Pressure (PA) 1.72E +07 l

TRCSO Initial RCS Temp (K) 6.27E+02 l

NH2C0 Moles 112 in Cont. Initially (kg-mole) 1.10E +02 l

NH2R0 Moles H2 in RCS Initially (kg-mole) 2.50E+02 l

FDMRC Fract Dispersed Metal Oxidized Blowdo n 1.00E+00 l

FNDMRC Fract Non-Dispersed Metal Oxidized BD 5.00E-01 l

l FLAGMW > 0 Limit MW Reaction if RCS Steam Limit 1.00E+00 EBURNC Fraction Containment H2 Burned 0.00E +00 l

EBURNR Fraction RCS and M/W React H2 Bumed 1.00E +00 l

FAI Fract CAV Flow to lower Compt (Area Fract) 9.00E-01 l

O Approved Dessgru Matenal Probablustic Risk Assessenent (11/96) Page 19.11D4

Sy* tem 80 + Design ControlDocument

()

Table 19.11D-2 Sample Output File (Cont'd.)

Internal Code Variable (described in the source listing shown in Attachment 3) Sample Value GAMMA 1.30793 l VOLT 95423.0 l FV1 0.967272E-02 MWSS 55.3858 NUO20 140.373 NZR0 178.277 NZRO20 0.000000 .

1 NSSO 235.382 NFE0 174.182 l NCR0 42.3687 l

NNIO 18.8305 NDO 554.032 5468.45

() NCO NB 1306.61 FNH2C0 0.201154E-01 FNH2R0 0.191335 ND 55.4032 NUO2 14.0373 NZR 17.8277 NZRO2 0.000000 NSS 23.5382 NFE 17.4182 NCR 4.23687 NNI 1.88305 UDTD 0.154742E +09 UDTC 0.109668E +0S CD 64214.1 O

i s

v) PSI PS11 0.194486E-01 0.%5044E.Ol Astwoved Design Meterial- Probabbstic Risk Assessment (11/96) Page 19.110-5 I

SyOtem 80+ Design C'introlDocument Table 19.11D-2 Sample Output File (Cont'd.)

Internal Code Variable (described in the source listing shown in Attachment 3) Sample Value PSI 2 0.237577E-02 UC0 0.533010E+11 DELEB 0.221196E+11 DELET 0.796562E+ 10 NH2ZR 196.104 NH2FE 95.8003 NH2CR 34.9542 NH2MWU 326.859 NH2MW 326.859 NH2 686.859 DELER 0.123692E+ 11 FNH2 0.101380 DELEH 0.167594E+ 12 DELEHP 0.140754 E+ 12 ETA 0.938457 ETAH2 0.950905 DELUB 0.203623E+ 11 DELUT 0.733277E+ 10 DELUR 0.113865E + 11 DELUH 0.156325E+ 12 DELUHP 0.131290E+ 12 PP1VNC 306385.

PPlVilC 836885.

PP1VPC 751926.

PP2VNC 298114.

PP2VHC 802569.

PP2VPC 721781.

O Astwowd Design Motorial. Probataistic Risk Assessment (11/96) Page 19.11Lh6

Sy' tem 80+ oeskn controlDocument Table 19.11D-2 Sample Output File (Cont'd.)

CE System 80+ Case SBO-01 Peak Pressures-MPA-(psia) l No H2 Complete H2 Panial H2 l Combustion Combustion Combustion i Volume Model 0.31 ( 44.) 0.84 (121.) 0.75 (109.) .,

2 Volume Model 0.30 ( 43.) 0.80 (116.) 0.72 (105.) [

i' Efficiency 0.94 0.95 0.95 Peak Average Temperatures (K)

No H2 Complete H2 Partial H2 l Combustion Combustion Combustion i Volume Model 519. 1418. 1274.

2 Volume Model 505. 1350. 1223.

O 1

l l

l O

\

Anprod Design A0eserW Mobanireic hink Assessment (11/96) Page 19.11D-7

System 80+ Design ControlDocument Effective Page Listing Appendix 19.11E

-Pages Date i, ii 1/97 iii Original 19.11E-1,19.11E-2 Original 19.11E-3 11/%

19.11E-4,19.11E-5 Original f

a a

f%

U

.s AmrowetDee&rt beenerief hebeMistic Mink Assessment (1/97) Pope li

System r0+ oesian contrat oocument l 4

O U

Appendix 19.11E Methodology for the Calculation of i i

Containment Pressure Following a Hydrogen Burn  !

1 Contents Page 1.0 Introductioa . . . . . . . . . . ..... ......... ....... .......... 19.llE-1 2.0 Calculation of Combustion Flame Temperature .......... ........... 19.1lE-1 l 3.0 Calculation of Containment Pressure ............................. 19.11E-2 4.0 Implementation ........................... ............... 19.11E-3 A

5.0 Comparison of AICC Model to Experiment . . . . . . ............. ..... 19.1IE-3 6.0 Smnmary ................ ..... . . ..... . ........... 19.llE-3 7.0 References . . ............. ........... .. ...... .. ... 19.11E-3 Tables 19.1IE-1 Volumetric Specific lieat Capacity for flydrogen Combustion Calculation . . . 19.llE-4 Figures 19.llE-1 Comparison of Normalized Pressure Rises for Different Test Facilities .... 19.llE-5 o i f

+

. Annrownf Desiger Material Probabaiseic Risk Assessmorrt Page a

System 80+ Design ControlDocument 1.0 Introduction This appendix describes the methodology employed for the calculation of pressure in the containment following an arbitrary hydrogen burn. This calculation is based on the Adiabatic Isochoric Complete Combustion (AICC) models described in Reference E1. Calculations using this model were obtained from a LOTUS spreadsheet adaptation of the combustion equations to be described below.

2.0 Calculation of Combustion Flame Temperature in this analysis it is assumed that the combustion process is adiabatic and occurs at constant volume (isochoric process). In addition it is tacitly assumed that the process is complete. That is all hydrogen available for combustion is consumed in the burn. A summary description of the symbols used in this analysis can be found at the end of this section.

In this analysis it is assumed that the containment atmosphere consists of air (oxygen and nitrogen),

hydrogen and steam. The concentration of these components is considered arbitrary. Physical limits on these values (due to availability of the components and the completeness of combustion) are considered in the application of the model and interpretation of the results.

The first law of thermodynamics for a reacting, adiabatic constant volume system can be written as follows:

C)

V

{

reactarus N i U,- {

products

, 0, (E1) where:

U,(T) =

• C, ,(T)dT (E2)

Ta N,, i are the number of moles of each reactant / product U,(T) is the internal energy per mole at temperature T C,,i(T) is the temperature dependent specific heat at constant volume of species i Rearranging the above relationships one can demonstrate that

{

producis . T.

4 C,,,(T)dT = N

• AH n2 (E3) where; Nn2 is the moles of hydrogen consumed in the combustion process, and AH is the enthalpy of formation of water per mole of water produced (or hydrogen consumed)

Anwered Design historiet - hobabiliselc Rock Assessment Pope 19.11E 1

System 80+ Design ControlDocument This equation is solved by considering the specific volume of nitrogen, oxygen and steam to be linear in temperature, integrating with respect to temperature and solving the resultant quadratic relationship for T f(the burn flame temperature). The relationship used to represent Cy ,i are presented in Table 19.1lE-1.

5 Bru

'Ihe enthalpy of formation of water is equal to about 1.04 x 10 ,

Ibm-mole *R The resulting equation for the flame temperature becomes:

{ S, ' (Tf2 - T,2) + ,Cl,3(T f

-T,) - N

• AH (E4)

Rearranging terms equation E4 becomes:

[ ,( ')]Tr + [ i ,,iCT, - (N

• AH + 3 T,2 (ES)

+ { ,C[,i T,) = 0 solving for T,,

T= -b+/b2 - 4ac (E6) f where, 1

dC".

a = 3{, N,( dT )

b={3C*v.i 6

e= NH2* AH +2 1{ ,( dT )T,2 + ,C

• T, y,i 3.0 Calculation of Containment Pressure in the AICC model all the available hydrogen is consumed. The containment pressure is calculated based on the mass of the reactants in the atmosphere, and the adiabatic flame temperature (T,). Assuming the containment gases behave as an ideal gas the resulting pressure becomes:

p, M o2 Ro ,M mmMmo R R V, V, V, Approved Design Material ProbaMistic Rkk Assessment Page 19.11E-2

Design control Document  ;

Sy tem 80 +

1

(~) 4.0 Implementation v l The AICC model was entered into a LOTUS 1-2-3 spreadsheet. Calculations were confirmed via hand calculations and predictions of other AICC based models (See Section 19.11.5). l 1

5.0 Comparison of AICC Model to Experiment l 1

The AICC modeling of the combustion process will maximize the burn flame temperature and resultant containment pressure. The conservatism associated with AICC model can be demonstrated by comparing AICC predictions with experimental data. Figure El shows a comparison of combustion data obtained from various scaled " dry atmosphere" burn experiments with the AICC calculation performed with the ABB-CE model and by the research group at the University of Pisa (Reference E2). As can be seen by this comparison the AICC model vastly overpredicts hydrogen burn pressures at hydrogen concentrations below 8% by volume. At higher concentrations the AICC model is observed to overpredict the combustion pressure rise by about 10%.

6.0 Summary This appendix described the C-E hydrogen combustion used in the assessment of hydrogen burn induced containment threats. Comparisons with data indicate the conservatism associated with the AICC model varies from about 10% in predicted pressure at high hydrogen concentrations to more than 100% at smaller hydrogen concentrations.  :

7.0 References  !

)

1 El. Campbell, J., " Thermodynamics of Internal Comhntion Engines," J. Wiley and Sons,1980, New York I

E2. " Hydrogen Deflagration Tests in the Hydro-SC Facility," M. Caracassi, F. Fineschi, Proceedings of the Third Workshop on Containment Integrity, NUREG/CP-0076, August,1986 l

A Anwesed Design Material ProbabaEstic Mish Assessment (11/96) Page 19.11E-3 ,

Design Contral Document System 80+

Table 19.11E-1 Volumetric Specific Heat Capacity for Ilydrogen Combustion Calculation C,,, = C',3 + ( d)7 C'v) dC*a.

Species,i

( dT ) X i()'

(Btu /lbm-mole /'R) (Brullbm-mole /'R')

N 4.536 68.95 O2 4.54 83.2 HO 4.55 113.4 2

0 O

Ainnmvwt Desiger Materini Probabastic Risk Assessmerrt popey9,yyg4

Syr:sm 80+ Design controlDocument O

^L

_ ._ In 298 4

Po

.A 4 , AotAaATec,860CHomic .'

sURN o c ALCut Af soas 4N o, .

3 ,- j.

A as # ts

! / A

• • 4 o l 2. -

/

/

e a r. HYDRO-SC

• oo

/ 6 V.G.E.S.

1 / + ,

• e ACUREX lO . '. .o '

a riT s

, s (NTS _

5 7 9 11 H2 %

4 ABB-CE Hydrogen burn calculation Comparison cf Normalized Pressure Rises for Different Test Facilitics Figure 19.llE-1 AW D**4ps Mosenia! Probahnetic RM Assessment Page 19.11E-5 i

system 80+ oesian comrat occament Effective Page Listing j j Appendix 19.11F l t

l. Pages Date i- 1, ii 1/97 I

iii Original i

19.llF-1,19.11 F-2 Original [

19.llF-3 11/% l 19.I1F-4 through 19.11F4 Original l l

1

O 4

J 9

i i

i Annmed Deeque nieterM habebnisk Mink Assessmorrt (1/97) Pope L E

Sv' tem 80+ Deslan ControlDocument (Gj - Appendix 19.11F i i

Reactor Vessel Lower Head Failure Area l Contents Page i

1.0 Introduction ............................................. 19.11F-1 2.0 Failure Mode Analyses . . . . . . . . . . . . ... .......... .......... 19.11F-1 3.0 Calculation of RV Failure Area ........ ............. ......... 19.11F-1 i 3.1 Equations Governing the Ablation Process . .......... ...... . 19.11F-1 4.0 Calculation of Mass Ejection Profile . ........................ 19.11F-2  :

5.0 Application of the Ablation Model to System 80+ . . . . . . . . . . . . . . . . . . . . . 19.11F-3 6.0 References ........................ .... ....... ....... 19.11F-3 Figures 19.11F-1 Westinghouse Instrument Guide Tube Failure Map at Maximum Radial Gap .......................................... . 19.11F-4 19.11F-2 RV Failure Area versus Time (RCS Pressure = 2500 PSIA) ......... 19.11F-5 19.11F-3 RV Failure Area versus Time (RCS Pressure = 1200 PSIA) . . . . . .. .. 19.11F-6 i

i J

w/

l I j

Appred Dem>n nietario! = hebebnirsic Mak Assessment Pagehil l 1

1

System 80+ Design ControlDocument M

V 1.0 Introduction The purpose of this appendix is to present the basis for establishing the RV failure area at vessel breach.

This appendix has two parts. Part I discusses work performed on RV lower head failure analysis conducted by Rempe, et al (References F1 and F2) at INEL. Part 2 of this appendix provides a calculation of the RV failure area following a failure of a System 80+ ICI nozzle.

2.0 Failure Mode Analyses Detailed structural calculations have recently been performed by Rempe, et. al. to ascertain the significance of the potential modes of RV lower head failure. This evaluation performed detailed evaluations of the various modes oflower head failure subjected to typical severe accident lower plenum loadings. Lower head failure modes studied included tube ejection, tube rupture and lower head global i rupture. The tube ejection and tube rupture failure modes would initiate as a well de3ned initial hole size. The failure mechanics associated with lower head global rupture was not ederessed. These evaluations produced a set of failure maps for the various failure modes. Figure 19.llF-1 presents a representative failure map for a typical PWR lower head with instrument penetrations. Failure maps are presented as a function of the inside RPV wall temperature and the system pressure. As would be expected RV failure was predicted to occur at higher RPV temperatures and higher RCS pressures. 'Ihe tube ejection failure mode is also noted % be far more likely to occur than lower head global rupture.

This is particularly true for RCS pressures below about 2500 psia. Consequently, global failure of the RV was not considered a significant contributor to lower head failure.

3.0 Calculation of RV Failure Area As discussed above, the most likely mode of lower head failure is caused by the failure / ejection of an ICI tube. This failure mode initiates as a small hole (the size of the ICI tube outer diameter) and grows in size due to thermal ablation of the lower head in the vicinity of initial hole. The mathematical description of the dynamics of this process was initially developed for the MAAP computer program (Reference F3).

This work was confirmed by analyses performed by F. Moody as part of the NRC severe accident scaling methodology (SASM) effort (Reference F4). In the following paragraphs, this model is applied to the System 80+ reactor, and the transient RV failure area is computed.

3.1 Equations Governing the Ablation Process Details of the ablation model are left to References F3 and F4. The ablation model assumes that the issuing corium transfers energy at the periphery of the ICI tube hde, melting the adjacent steel. This process continues until all the molten corium has been discharged from the vessel.

The energy balance for this process can be reduced to the following equation:

hA,(Tp - Tp ,) - PsAs [C,(T,,, - T,) + y,] dr .

(pi) dt Anwered Dee> hennedel Probahnetic Misk Assessment Page 19.11F-1

System 80+ Design Control Document

where, h is the heat transfer coefficient between the molten debris and its entst A, is the area at the periphery of the ablating hole C, is the specific heat of steel p, is the density of steel Tp,Tp,, are the temperatures of the molten and solidified fuel respectively T,,T,,, are the temperatures of the molten and solid steel Rearranging equation F1 and solving for the rate of growth of the failure hole ( ) one obtains:

dr , h(Tp - T p, ,) -B (F2) dt p,(C,(T,,, - T,) + y,)

For typical corium and steel conditions and using tepresentative values of h, values of B can be shown to be on the order of 0.05 sec-!

The hole area, A(t), can then be expressed in terms of the initial ICI radius, r o, and parameter B as follows:

A(t) = x (r, + Bt)2 (F3) 4.0 Calculation of Mass Ejection Prortle Once the area is established, the instantaneous mass flow rate, W(t), can be established as:

W(t) = pp A(t) V (F4) where:

pp is the density of the corium and, V is the ejection velocity For high pressure ejection scenarios, the molten mass discharge process occurs at constant RCS pressure.

Then, using the Bernoulli equation the discharge velocity of the lower plenum melt through the ablating area can be established as follows:

Va (Pacs - Pc) (FS)

1. F AMweved Design Meteria! . ProbabGstic hk Assessment Page 19,1IF-2

System 80+ Design ControlDocument

()

/m Pacs and Pc are pressures in the RCS and containment, respectively.

The cumulative mass discharged, to time t, AM(t) is obtained by integrating W(t) over time.

AM(t) - 97 Vr[r o2t + r,Bt 2.BY j (F6) 3 5.0 Ap,olication of the Ablation Model to System 80+

Applying equations F1 through F6, one can establish representative System 80+ hole ablation profiles and temporal mass distribution profiles for various RCS discharge pressures. For System 80+, R s

.05 ft. The results of this study are summarized in Figures 19.11F-2 and 19.11F-3 for pre-VB RCS discharge pressures of 2500 psia and 1200 psia, respectively.

6.0 References F1. NUREG/CR-5642, Light Water Reactor Lower Head Failure Analysis (DRAFT), December, 1990.

F2. NUREG/CR-5642, ECG-2618, " Light Water Reacter Lower Head Failure Analysis (DRAFT),"

December,1991.

F3. MAAP 3.0B, Rev 16.03, Fauske and Associates, Inc.

F4. NUREG/CR-5809 (EGG-2659), "An Integrated Structure and Scaling Methodology for Severe  !

Accident Technical Issue Resolution," November,1991.

I I

l 0)

ApprowdDee&n A0esenel-Meic Alek Assessment (11/96) Pope 19.11f.3

System 80+ Design ControlDocumqt O

2,800 , . , , , , , , ,

Lower head globar rupture (lower smit) .

E 2,600 -

---

Tube ejection (lower limit)

- -Tube rupture power umit) e 2,400 -

• - -- -

• Tube ejection (upper limit)

3 g 2,200 - .

$. 2,000 -

Region Tube Ejedion .

orTube Rupture E

1,800 Dominates Head 3 - .

y 1,600 -

p::: pf gxl e

[

0 2 4 6 8 10 12 14 16 18 20 l System pressure (MPa) l l

i l

l Westinghouse Instnanent Guide Tube Failure Map Figure 19.11F-1 l st Maximum Radial Gap  ;

. _a nu I

n ,, ,,r. w,r r su,~

F Syster1180 + Desem controlDocument

.,,m .

t t

(

u O -

r

. I t I 1

.-..~................[...I 7-

[ 0) f t .

f sf i l (D

..._.._.e.. . . . . . _ - . . _ .

j - --------

i s

. ._. - . . . . _ , . . . N

- + - -_ to g I V C

\

O o 1

_ L. .._ -- to e #  !

w l

O '

' .E

- t H

- _ l. ._._ , -. .- co

- - - N

. . . - ~ -- -- r-

3. .. . .-

1 i

i i

i i o

(D 40 t to N v-- O d 6 6 6 6 d (343) eeJy eJniled AH

)- RV Fallu Aren versus Tiene (RCS Pressure = 2500 PSIA) Hgure 19.llF-2 W Deeen neeenrW.hebeMireic Aink Assessment Page 19.11F.S

=  %

< 1 i E E F S l' a  %

i t o y a

+

0.5 k $  !

• E l .

i n,4 - .. ._ . + .- .L . - a.

9 R.

o m

N 3 - , -

i 1

> u.

. g,. i j

i 0.3 + -- -- -+ -

j m i e e

.  ; s 5 i 3

u

, i.

8 2 j , _

i

X 2

0.2 -- 5 -

+- -1 - - + - - - - ^ -

3 m ,

u. >  !

C -I I

-+

0.1 +

i-- - - - - > -

i

/ I i  ; .

0  ?

a A

=

I 0 1 2 3 4 5 6 7 8 9 10 e=

" 9

. Time (seconds) =

~

{ m D 8

a

= 3 O _ _ -_ _

O O

System 80 + Design ControlDocument s

f j Effective Page Listing l

. Appendix 19.11G l s

f 4 i Pages Date -

i,li 1/97 l ill Original .

5 i 19.11G-1 through 19.11G-5 Original  :

i i

i 1

i 4

r 1

i l

\

t I

4 l

t I

1 i

i l

1 l

d 4

1 L . ::Dow neenew. hosesmaec mek Anusment ttis7) rese 1. a

.\

Sy' tem C0+ Design ControlDocument

. Appendix 19.11G 4 Calculation of the Effect of 100% Oxidation

{

of the Active Claddirg on "In Vessel" and Containment Temperature i

i 1

Contents Page 1.0 Introduction ... ... ............. .... ....... ...... 19.11G-1 2.0 Background ... ........... ....... .... . . ........... 19.11G-1 3.0 MAAP "in Vessel" Conditions in the RV Outlet Plemun . . . . . . . . . . ...... 19.1IG-1 (3

q) 4.0 MAAP Predicted Containment Conditions . . . . . . . . . . . . . . . ....... 19.1IG-1 I

j 5.0 Analytical Extrapolatina of MAAP Results ..... ................... 19.11G-2 6.0 Summary and Cer ;1usion . . . . . . . . . ........... .. ..... .. .. 19.11G-2 i

Tables 19.11G-1 Containment Temperature Prior to Vessel Breach for System 80+ LOCA . 19.11G-3 l Figures 19.1IG-1 MAAP 3B Predicted Upper Plenum Gas Temperatures . . ..... .. 19.11G-4 19.11G-2 Comparison of Extrapolated Environment to Design Basis EQ Envelope ............. ..................... . 19.11G-5

.n Anwowed Doespn New6ef

• Mohabastic Riek Assessment Page M

System 80+ Design ControlDocument 1.0 Introduction This appendix provides an assessment of "in vessel" and containment temperatures for a limiting condition associated with 100% oxidation of active cladding in System 80+. This information is provided in accordance with the intent of the 10CFR50.34(f) equipment survivability assessment.

2.0 Background During typical severe accident scenarios core heatup is associated with lack of inventory in the reactor vessel (RV). Once cladding temperatures exceed 1800'F the zirconium begins to aggressively react with the RV steam environment, releasing energy and producing hydrogen. Due to the low heat carrying capability of the steam / hydrogen gas, most of this energy remains in the fuel and surrounding structures. '

The zirconium-steam reaction is ultimately arrested "in vessel" as a result of the physical limitation of steam. During this process the peak gas temperature in the upper plenum (the RV regionjust above the fuel alignment plate) is less than 1900*F for all accident scenarios surveyed. Temperatures in the upper '

head, which is separated from the upper plenum by the Upper Guide Structure Support Plate, (UGSSP) will be below 1200*F. For these cases a maximum of 73% oxidation of the active cladding occurred, limited by water availability. As a result of the inability of MAAP to continue the metal water reaction in the absence of water and the difficulty of preventing a rapidly quenched core in the presence of water, a bounding extrapolation of existing MAAP analyses was performed to assess both the "in vessel" gas and containment conditions should the oxidation process be hypothetically extended to 100% oxidation of the active cladding.

3.0 MAAP "in Vessel" Conditions in the RV Outlet Plenum MAAP parameter "TGUP" represents the gas temperature in the RV upper plenum. Figure 19.11G-1 presents a plot of TGUP as a function of the percentage of the core-wide active cladding oxidized for a spectrum of severe accident scenarios. Since MAAP analyses could not be extended beyond the 73%

limit, the TGUP result was conservatively extrapolated to the required 100% active clad oxidation condition. Figure 19.1IG-1 shows this extrapolated temperature to be less than 2500*F. This temperature actually occurs in the presence of a fuel " hot spot" in excess of 4000*F. The lower gas temperature is a combined result of:

1) The core exit flow is based on the sum of several parallel flowpaths. Gas flows in the periphery of the core lose considerable energy to the core shroud which is below 1000*F. This gas flow will mix with the hotter fluid stream exiting the central core.

2) The " hot spot" is a local condition and does not consume the entire core.

3) In order to equalize pressure drop through the core, the outer assemblies with a higher density (lower temperature) drive more fluid mass flow than the " hotter" core central region. Thus, cooler regions are preferentially fed.

4.0 MAAP-Predicted Containment Conditions O Containment conditions predicted by MAAP were reviewed for a spectrum of LOCAs. Predicted h '

temperatures at the time of vessel breach are presented in Table 19.11G-1 as a function of the percentage of cladding oxidation. This table suggests that the ability of the passive heat sinks to absorb energy and ANuovent Design neateniel PrnA=k=%c Rink Assessment Page 19.11G.1

System 80+ Design ControlDocument the timing of the energy release are the dominant contributors to the containment temperature at the time of vessel breach. The majority of energy associated with the zirconium-steam reaction is contained within the reactor vessel.

Other transients will discharge inventory into the IRWST and therefore will not result in a temperature excursion (T < 150*F).

5.0 Analytical Extrapolation of MAAP Results Based on the above information, a methodology was developed for conservatively estimating the resulting temperature in the containment following a plant condition where the time of ve;sel breach is artificially extended. This methodology assumes that the zircaloy oxidation proceeds until 100% of the active clad has reacted, and water is continuously available for reacting with the zirconium. Ilowever, this process proceeds without any associated core cooling. The containment temperature, shown in Figure 19.1IG-2, was calculated assuming that:

1) the initial oxidation level was equal to 50% of the active cladding.

2) the time of the oxidation occurs at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> into the transient. This is typical of MAAP calculated pre-VB times for representative LOCAs.

3) the core remains uncovered during the exteaded oxidation phase. This is accomplished by providing a hypothetical water source covering the bottom 25% of the fuel. This oxidation results in a steam release of 9.6 lbm/sec.

4) the hydrogen generated during the oxidation process exits the RV at 2500*F (see Figure 19.11G-1).

5) the initial containment conditions for this calculation corresponds to the pre-vessel breach MAAP containment temperature associated with a large LOCA (230*F).

6) the hydrogen entering the containment mixes with the air and steam and adiabatically raises the containment temperature.

6.0 Summary and Conclusion An analysis was performed to establish the containment environmental consequences of the exothermic energy release associated with a recoverable severe accident which results in the oxidation of the equivalent of 100% of the active clad. The results of this analysis show that:

1) in order to oxidize 50% of the active cladding (about 29,000 lbm), the chemical reaction requires that 11,445 lbm of steam must be generated and interact with the zirconium.

2) the 11,445 lbm of steam will produce 1270 lbm of hydrogen. This hydrogen flows through the core and upper plenum and is assumed to exit into the containment at 2500*F.

3) the added enthalpy assochted with the introduction of 1270 lbm of hydrogen at 2500*F will adiabatically raise the temperature of the containment to 335'F.

Approwmf Design Material Probabbstic Hisk Assessment Page 19.11G-2

Svstem 80+ Design Control Document im

4) the oxidation process described in the analysis requires 20 minutes to complete.

5) assuming a lower bound containment heat transfer coefficient of 5 BTU /Hr/ft2 j.F (lower than the minimum Tagami heat transfer coefficient typical of this contair. ment condition, see Figure 6.2.1-

33) a temperature decay response is calculated (See Figure 19.11G-2).

6) the transient response presented in Figure 19.11G-2 does not exceed the design basis environmental qualification envelope (Figure 3.11 A-6), hence equipment survivability is expected for this extrapolation of a recoverable severe accident.

This analysis indicates that the resulting containment temperature transient is bounded by the existing ,

System 80+ design basis environmental qualification envelope.

Table 19.11G-1 Containment Temperature Prior to Vessel Breach for System 80+ -

LOCA Cladding Oxidized Temperature 32 % 230*F 48% 220*F 64 % 200'F l

t l

't I

,(%()

. ~

I 1

l 1

l W 00098 nintena!* Probabniseic Riink Assessment Page 19.11G 3 l

Sy-tem 80 + oesign controloocument i

e!

i 3000 J

EXTRAPOLATED BOUNDING g UPPER PLENUM TEMPERATURE i3 2500 -

\

i 5

t 3

E 2000 -

E x i2 X 4

X X a

>=

$ 1500 -

0 X

X 1000 O 20 40 60 80 100

% ACTIVE CLADDING OXIDIZED MAAP 3B Predicted Upper Plenum Gas Temperatures Figure 19.llG-1 ,

Approomt Design Atatonial- ProbablGsaic Risk Assessnwt Page 19.11G4

V"'** 80 + Design controlDocument 300 -

+ seununs w DESIGN BASIS 350 -

< EQ 340 -

330

,u. 320 -

ui E

M 310 -

m 300 -

H gen -

I 280 - j 240 -

l 220 -

' ' ' f f I i i 200 0 5 10 15 20 25 30 35 40 45 TIME, MNUTES Compadson of Extrapolated Environment to Design Basis EQ Envelope Figure 19.11G-2 WM bl9" A**terd

• ProbeMkrtre Risk Assessment p,y, yy, y yy.$

.. . . . .. . . - . . . . . _ _ . -- .. . . - . .. _ . . . . . - . . - . . . - - . . ~ . . . . .

i 1

l t

System 80+ Design ControlDocument s Effective Page Listing  !

Appendix 19.11H j l Pages Date

' i,ii 1/97 j iii Original I

19.11H-1,19.11H-2 Original 19.1IH-3 11/%

19.11H-4 Original 1

i .

?

1 1

i l0 -

4-f i

i O

G Pn ...: Deegn heetonial- hebeMbehic thek Assessment (1/97) Pagei.E

(

Sy~ tem 80 + Design controlDocument

'(] Appendix 19.11H Comments on the Construction and Application of the System 80+

I Containment Fragility Curve i

Contents Page 1.0 Introduction .......... . ... ...... ....... ......... 19.11H-1 2.0 Comparison of C-E Fragility Curve with the Methodology of Reference H1. . .. 19.llH-1 3.0 Impact on Hydrogen Burn Failure Potential . . . . . . . . . . . . .......... 19.11H-3 O

\v 4.0 Impact on DCH, Containment Failure Potential . . . ....... . ..... ... 19.1IH-3 1

5.0 Impact on Rapid Steam Generation ..... . ...... ... .. .... .. 19.11H-3  !

l 6.0 Reference . . . . . . . . . ..... ................. .. ... ..... 19.11H-3 Tables 19.1IH-1 Comparison of Estimated Fragility Curve Methods ........ ...... 19. llH-4 i

i

)

I s'

{

t AMwoment Deden n000eriel Prebebentic Rok Assessment Page M ,

I

System 80+ Design ControlDocument ,

O 1.a 1 trea ciie- i The construction of the containment fragility curve used in tbc PRA is described in Section 19.11.3.1.2.4.

The construction is based on general guidance used in the suppon of NUREG-IISO. In estimating failure, it was assumed that once the material yield point is reached using an axisymmetric shell model described in Sections 19.11.3.1.2.3.1 and 19.11.3.1.2.3.2, the containment will fail. .

The above procedure has been biased to provide a conservative estimate of the containment failure probability. This conservative bias arises from the following assumptions and procedures:

1. All properties are evaluated at high mean shell temperatures. It is expected that during most containment challenges to which the fragility curve is applied, the average containment shell temperature will be between 150'F and 250'F. This temperature range is based on the fact that the PRA contairunent challenges with sprays operational will maintain a cool containment atmosphere. For those transients where sprays are unavailable, the shell temperature prior to burn will be less than 250*F to ensure the containment atmosphere is not inened. While burn l temperatures can be high, their shon duration (less than 30 seconds) and the large mass of the steel shell results in only minor increases in the mean shell temperature. This assumption conservatively biases the median containment strength calculation from 2% to 10%.

I

2. In the fragility curve construction, the median material yield stress was taken to be 1.10 times the minimum expected yield stress. Material data discussed in Reference 210 (see Section 19.16) indicates that the median shell stress is actually 1.167 times the minimum yield stress. The O difference between these values was taken to approximately account for effects of material U variations and modeling uncenainties, i

3. The fragility curve used in the PRA assumed a linear fit between the points defined in the table in Section 19.11.3.1.2.4. This procedure overestimated the failure probability of the shell in the tail region of the fragility curve below the 3% failure point (in the pressure region between 94 and 145 psia). The fragility curve challenges for System 80+ were mostly confined to containment pressure below 145 psia. The highest containment challenge noted for the very low probability high pressure direct containment heating (DCH) event resulted in a pressure of 151 psia (see Figure 19.ll.4.1.1-4A).

2.0 Comparison of C-E Fragility Curve with the Methodology of Reference  !

H1 i

An alternate snethod of defining a fragility curve may be established by defining a logarithmic standard  !

deviation for material propenies and for modeling uncertainty. Given a failure pressure calculated from mean material propenies a mean failure pressure probability curve can be developed. The methodology is generally analogous to the seismic strength analysis employed in Section 19.7.5. For the ultimate pressure fragility curve, the true mean containment failure pressure (@ 290*F) based on the Reference 210 data would be 180.7 psia (166 psig). The 4ta factor based on the variation in the material yield point is 0.09. Material uncertainty in this range is typically consistent for fragility analyses. In order to account for other undefin" propeny variations which are associated with the imperfect experimental mode hg of a real strue . - (variations in plate thickness, boundary conditions, welds, O

b residual stresses, etc.) the material une.nainty is combined with a second factor of equal value (0.09).

This factor is equivalent to the 'deha" parameter of Reference Hl. This selection conservatively bounds 1 i

the value of 0.05 used in that reference for this parameter, in addition, Reference H1 also suggests the Annwed Design heateriet habeMeoc Mook Assessment Pege r9.11H-1 l

System 80+ Design ControlDocument l l

use of a modeling uncertainty of 0.05 for a spherical shell geometry (see Reference H1, page 57). This  !

selection is typically associated with the use of simplified Reference III modeling equation 5.81.  ;

Calculations of pressure which result in the nominal yield stress used in the System 80+ analyses were based on use of the ANSYS computer code. Therefore, the variability factor is not considered applicable, but was retained for conservatism. (In fact, Reference H1 indicates that ANSYS calculations tend to j underpredict structural capability by approximately 10%. This bias, as well as bias associated with the high temperature material property selection, provides additional conservatism which is not reflected in the above statistical treatment.)

Following the procedure identified in Reference Ill, a combined coefficient of variation, #, for the

pherical shell model was found to be

2

1. = (0.09)2 + (0.09)2 + (0.05)2 and # = 0.137 For illustration purposes a combined standard deviation of 0.135 was selected for evaluating the fragility curve.

Assuming the fragility curve to be a log-normal distribution, the coefficient of variation, #, is as follows:

1. = In (P,/P,) / K, A fragility curve explicitly accounting for material and modeling uncertainties can then be evaluated as follows:

P, = P, exp (- K, #)

l where; j l

P,: pressure with x probability of containment failure  !

I P: median failure pressure K,: coefficient associated with x probability of containment failurs  :

I

1. combined standard deviation The results of this curve construction and the data used for the System 80+ PRA fragility estimates are presented in Table 19.1111-1.

Using the current PRA values, the failure probability is significantly exaggerated in the low pressure ,

region below 140 psia. Both methods yield similar results around 145 psia. Failure probabilities computed using the beta method are somewhat higher than that used for the PRA in the pressure range from 145 to about 160 psia.

A review c,f these differences illustrates that for the region of the fragility curve below about 145 psia, the % consequence of the use of the System 80+ PRA curve is to conservatively bias the overall shell l fWure probability. As discussed below, containment fragility curves are used in evaluating three i pantainment threats: hydrogen burn, DCll, and rapid steam generation.

AMweved Design hinswrd hobabihstic Rink Assessment Pope 19.11H 2 l

1

System 80+ Design ControlDocument 3.0 Impact on Hydrogen Burn Failure Potential liydrogen burn failure probabilities are shown in Tables 19.11.4.1.3-3 and 19.11.4.2.4-1. For early hydrogen burns the largest expected pressure threat was estimated to be below 106 psia. This was classified as having a containment failure probability of 0.006. Using the beta method, the probability is virtually zero.

A review of the late hydrogen burn sequences produce similar conclusions. The late hydrogen burn pressure ranges are defined for three cases as 103,125.2, and 140 psia. This results in containment failure probabilities of 0.006, 0.0184, and 0.0276. Using the beta method, the failure probabilities would be lower for the first two cases (less than 0.001) and about the same for case 3.

4.0 Impact on DCH Containment Failure Potential The DCII containment threat is evaluated in Section 19.11.4.1. Figures 19.11.4.1.1-4 (a through c) illustrate the use of the fragility curves and bounding pressures used in the quantification process. For all DCli events that result from :n intermediate pressure reactor vessel failure, the largest containment threat is below 120 psia, and, therefore, use of the existing PRA model results in fragility estimates that are consistcntly biased high. For the high pressure reactor vessel DCH, containment pressure threats are distributed between 99 and 151 psia; fewer than 2% of those threats are above 145 psia. The net effect on using the existing PRA approach would produce higher DCII conditional containment failurc probabilities than that using a beta approach.

5.0 Impact on Rapid Steam Generation Rapid steam generation issues are discussed in Section 19.11.4.1.2. Table 19.11.4.1.2-4 indicates that the high st containment threat is 98 psia. This produces a small conditional containment probability using the existing fragility curve. The beta developed curve would indicate this failure probabili.ty to be zero.

6.0 Reference 111. NUREG/CR-2442," Reliability Analysis of Steel Containment Strength," Greimann.L.G., et. al.,

Ames laboratory, June,1982 K .-:='Dee4pn Meter 6et ProbahnGsde Risk Assessment (11/96) Pope 19.11H-3

System 80+ Design ConvolDocunsent i

Table 19.11H-1 Comparison of Estimated Fragility Curve Methods e

Linear Approximation used Probability of Failure in System 80+ PRA Combined Beta Method Pressure (psla) Pressure (psia) 0.00 94 0.001 95.2 124 0.005 100 130.9 0.01 106 135.8 0.02 125 138.5 0.03 145 143.4 0.05 157 147.5 0.10 158 154.1 0.25 163.6 166.09 0.50 172 130.7 O

O AW Design Material. Probabastic Risk Assessment page yg.yput

i System 80+ Design ControlDocument I l

] Effective Page Listing Appendix 19.11J l i

l Pages' Date j i, ii 1/97 l lii Original '

19.11J-1 through 19.11J-10 Original i 19.1IJ-11 11/96 l 19,11J-12 Original O l i

l l

I i

i i

l

1 Sy tem 80+ Design ControlDocument m

'()

Appendix 19.11J l

1 Description of S80SOR 1 System 80+ Source Term Methodology 1 1

l Contents Page 1.0 Description of the S80SOR Computer Code . . . . ........ . . . . . . . . . . . 19.1 IJ-1 2.0 Overview of the S80SOR Computer Code . . . . . . . . . . . . . . . . . . . . . . . . . 19.1 1 J- 1  ;

3.0 Description of S80SOR ................. ..... . . . . . . . . . . . . . 19.1 1J- 1 3.1 Summary of Source Term Variables ............... .......... .. 19.113-3  ;

3.1.1 FCOR ...................... ... ........ ....... .... 19.11J-3 l 3.1.2 FVES ................................................19.liJ-4 l I

3.1.3 FCONV (i) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ....... . 19.11J-4 f 3.1.4 XSGl>XOSG ......................... . . . . . . . . . . . . . . 19.11J-5 3.1.5 19.11J-5

( ~

DFE (i) ............. ....................... .........

3.1.6 DFSC ........................ . . . . . . . . . . . . . . . . . . . . . - . 19.1 1 J- 5 l 3.1.7 DST ... .......... ......... ..... . . . . . . . . . . . . . . . . . . 19.11 J-5 l 3.1.8 FPA RT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19.1 1 J -6 3.1.9 FCCI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19.1 1 J -6 3.1.10 FCONC . . ................................ . . . . . . . . . . . 19.11 J-7 3 .1.1 1 D F L . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ......... .. 19.11J-7 3.1.12 FLATE . . . . . . . . . . . . . . . . . . . -. . . . . . . . . . . . . . . . . . . . . . . . . . . . 19.1 1 J-8 3.1.13 LATEI ................... . . . . . . . . . . . . . . . . . . . . . . . . . . . 19.1 1 J - 8 3.1.14 LATECS . . . . ............................ . .......... 19.11J-9 3.1.15 FI LTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19.1 1 J-9 3.2 Consideration of Basemat Melt-Through (BMT) . . . . . . . . . . . ........... 19.11J-9 3.3 Comraents Regarding Bypass Sequences . .. .......... ......... .. 19.11J-9 4.0 Distribution Sampling Methodology . . . . ... . ............... .. 19.11J-10 l

l 5.0 Energetics and Duration of Releases . . . . . . . . . . . . . . . . . . . . . . . . . . 19.1 1 J- 10 6.0 References . . . . . . . . . . . . . . . . . . ..... ................. 19.11J-10 Tables Page 19.11J-l isotopes in Each Radionuclide Release Class . . . . . . . . .... ..... 19.1IJ-12 19.111 2 Comparison of System 80+ and Zion Spray System Features . . . . .... 19.1IJ-12

<.J i Anmrevost W A0ererlief hebehensic Mink Assessment Pege M l

Srtem 80+ Design ControlDocument 1.0 Description of the S80SOR Computer Code This appendix describes the methodology for computing the source term used in the System 80+

consequence analysis. The source term is more than the fission product release fractions for each radionuclide class; it also contains information about the timing of the release, the height of the release, and the energy associated with the release. This methodology is based on the new source term methodologies and represents an adaptation and extension of the XSOR genre source term evaluation tools to the System 80+ evolutionary ALWR (References J1 and J10). An overview of the methodology follows. Additional supportive information on source term phenomenology may be found in Section 19.11.4.3.

2.0 Overview cf the S80SOR Computer Code 580SOR is a fast mnning, parametric computer code used to calculate the source terms for each System 80+ release class. As with the other XSOR codes used for Reference Plant evaluation (Reference J1),

S80SOR does not mechanistically calculate the behavior of the fission products by application of first principles of chemistry, thermodynamics, and heat and mass transfer. However, S80SOR does provide a framework for considering the essential elements in the deterministic prediction of the fission product releases, transport and deposition found in the more detailed codes that do consider these quantities.

Furthermore, much of the information contained within the new source term methodology (Reference J2) is included in the code structure and its application.

A d The primary purpose of the S80SOR computer code is to use accident sequence information (and plant damage state definitions) to establish the timing and magnitude of fission product releases from the containment following a core damage sequence. This information is typically represented as a table of 60 radionuclides required by MAACS (Reference J3). The 60 radionuclides (also referred to as isotopes, or fission products) considered in the consequence calculation are not dealt with individually in the source term calculation. Some different elements behave similarly enough, both chemically and physically in the release path that they can be considered together. The 60 isotopes are placed in nine radionuclide classes as shown in Table 19.1IJ-1. It is these nine classes that are treated individually in the source term analysis.

Timing information and energy releases are established based on System 80+ MAAP calculations performed for the various accident sequences comprising the release class. MAAP calculations were also used in adjusting the estimation of very late fission product releases and establishing cesium revaporization effects.

As noted above, to properly adapt the base XSOR code to S80SOR several code modifications were required. These modifications were established to allow consideration of evolutionary plant design features (such as the IRWST and secondary building filtration system) and to include a broader range of transients including intact containment and basemat melt-through scenarios. Code additions were also necessary to upgrade some aspects of the XSOR codes with improved knowledge in the areas of fission product release, transport and deposition.

3.0 Description of S80 ',OR (O

'0 Since the largest consequences generally result from accidents in which the containment fails before vessel breach (VB) or about the time of VB, the nomenclature and structure of S80SOR reflect failure at VB.

Anwownf Des &n h9eteriel Prmatic Mieh Assessment Page 19.11.1-1

l I

Sy~ tem 80 + Design controlDocument l l

An early release occurs before, at, or a few tens of minutes after VB, and a late release occurs several (six to eight) hours to several days after VB. In general, the early release is comprised of fission .

products that escape from the fuel while the core is still in the RCS, that is, before VB, and is often referred to as the RCS release. The late release includes fission products released from the core materials post-VB during Core Concrete Interaction (CCI), and material released from the fuel before VB that  ;

deposits in the RCS or the containment and is revolatilized after VB.

For situations in which the containment fails many hours after VB, the "early" release equation is still used. After both releases are calculated in S80SOR, they are combined into the late release, and the early release is set to zero. For radionuclide class i, the early (or RCS) release is calculated from the following equation:  ;

ST(i) = {(FCOR(i) * [1-XSG(i)]

• FVES(i)

• FCONV(i))/(DFE

• DFSC) + DST

• FDCH(i)} l l

• FILTP(i) + FCOR(i)

• XSG(i)

• XOSG(i) (J1) and, STL(i) = {(1-FCOR(i))

• FPART

• FCCI(i)

• FCONC(i)/DFL + DLATE

• FLATE(i)}

• FILTP(i) + LATEI

• FILTP(i) + LATECS

• FILTP(i) (J2) ,

l Both equations are valid for most release classes and accident sequences. The tenn LATEI applies only  !

i for the iodine radionuclide class. LATECS represents the inclusion of a MAAP based estimate for establishing revaporization of cesium. As sequences change the value and interpretation of several I variables may also change.

The meaning of the terms in the equations above is as follows:

ST = fraction of the radionuclide in the core at start of accident released to l environment as part of RCS release; FCOR = fraction of the radionuclide in the core released to the vessel before VB; FVES = fraction of the radionuclide released to the vessel that is subsequently released to the containment; FCONV = fraction of the radionuclide in the containment from the RCS release that is released from the containment in the absence of any active mitigating effects; j I

DFE = decontamination factor for the RCS releases (sprays);

DFSC = decontamination factor associated with SOS /PSC discharges to IRWST; DST = fraction of core radionuclide released to the environmen: due to DCH at VB; FDCH = fraction of radionuclide in the portion of the core involved in DCH that is released to the containment at VB; STL = fraction of the radionuclide in the core at the start of the accident released to environment as part of the CCI release; Appmved Des @n Matertini Probabinistic Risk Assessment Page 19.1132

System 80+ Desian ControlDocument

/~T .

(j FPART = fraction of the core participating in the CCl; FCCI = fraction of the radionuclide in the core material at the start of CCI subsequently  ;

released to the containment; FCONC = fraction of the radionuclide in the containment from the CCI release released from the containment in the absence of any mitigating effects; DFL = decontamination factor for the late releases (sprays);

DLATE = fraction of core radionuclide released to the environment due to revolatilization from the RCS late in the accident; i

FLATE = fraction of core radionuclide remaining in the RCS that is revolatilized late in the accident; ,

LATEI = fraction of core iodine in the containment that assumes a volatile form and is -

released late in the accident; LATECS = fraction of the core cesium that is revolatilized late and released at containment failure; FILTP(i) = fraction of fission products removed by the System 80+ annulus filtering and l ventilation system; and XSG/XOSG = fraction of fission products entering the SG that enter the environment (SGTR  !

only).

The above expression is relatively flexible and is intended to consider a wide variety of release classes.

The elements of these equations are discussed in added detail in the following sections.

1 l

3.1 Summary of Source Term Variables j l

Since many of th: variables in equations J1 and J2 have significant levels of uncertainty, they are typically represented by a probability distribution. Much of this information regarding the distribution has been established based on expert judgement performed for the NUREG-ll50 Reference Plant Evaluation. This information has been used and/or modified where necessary to establish distributions j that are representative of System 80+, i 3.1.1 FCOR l

FCOR is the fraction of the fission products released from the core to the vessel before vessel failure. i The experts' PWR elicitation in this area is considered consistent with System 80+. 1 The value used in each sample observation is obtained directly from the experts' aggregate distributions (Referc::cca J4 and 35). There are separate distribution for each fission product group for two cases: )

high and low in-vessel zirconium oxidation. All transients with the exception of medium and large j

,] LOCAS were considered to be typical of high zirconium oxidation.

i I

l l

AmarewestDeep Alessnief Weic Misk Assessment Pope 7A ff.#-J

______n

Sy~ tem 80 + Design controlDocument 3.1.2 FVES ,

FVES is the fraction of the fission products released to the vessel failure. As for FCOR, the value used in each sample observation is cbtained directly from the expens' aggregate distribution, and there are separate distributions for each fission product group.

There are four cases: RCS at system setpoint pressure, RCS at high or intermediate pressure, RCS at low pressure, and V sequence.

The V sequence FVES contribution was considered overly conservative for application to System 80+.

Based on work perfonned by SWEC for EPRI (Reference 39) and observations supported by LACE experiments, the plateout of fission products in the RHR lines should provide a minimum decontamination factor of 10 even in the absence of a flooded break. If the break were to be below a deep pool, the decontamination factor would be further increased by a factor of 6.

3.1.3 FCONV FCONV is the fraction of the fission products in the containment from the RCS release that is released from the contaimnent in the absence of mitigating factors such as sprays. This parameter reflects the natural deposition processes occurring within the containment following fission product release.

FCONV was evaluated primarily from expert panel elicitation on this issue for the Zion PWR. The large amount of surface area in the System 80+ containment suggests that these values may be biased low (i.e.,

in the conservative direction). Despite this bias, the base parameter distributions were obtained directly from cases I through 4 of Reference J4.

If the contah ment failure happens a day or more after the start of the accident, FCONV used for XSOR over-estimates fission product deposition. Therefore, none of these distributions were used for very late FCONV estimate. These very late failures occur either due to long-term overpressurization or basemat melt-through (BMT). For very late failures, the long tine period allows the natural removal processes to reduce the concentration of the fission products in the containment atmosphere, so the fraction of the fission products released before or at VB remaining airborne at the time of containment failure is very small. For System 80+ this value was set at 104 (two orders of magnitude greater than that used in ZISOR). This level of attenuation is consistent with deterministic MAAP calculations. For intact containment sequences, the noble gas release was set at 0.005 (maximum leakage of 0.5 v/o per day).

FCONV was also set at 104for other radionuclides. In order to treat the below-grade basemat failure consistent with the deterministic assessment of CCl, it was assumed that the melt-through sequence results in an increased containment leakage condition. This resulted in setting the release to be 4 times that of the intact containment. This factor considers the possibility that fission products will leak through the containment shell 2 days prior to breach of the shell. Once the shell is breached by the corium melt (and while the melt still resides within the basemat), a potential leakage path may develop between the shell and the foundation. The resulting fission product leakage was assumed to be equivalent to the above ground leakage tluough the intact containment shell (0.005).

The radionuclides explicitly considered in the expert evaluation of CONV were xenon, iodine, cesium and tellurium.

O Anwoved Dessen A9steriar. Probab&stic Risk Assessment Page 19.1r.M

i

}

i Systers 80+ Deslan ConkelDocument l I

3.13 . XSGUXOSG 4

These parameters consider the fission product transport through the steam generator.and to the  ;

environment following an XSG(i) event. For all events other than an SGTR, XSG(i) is set equal to 0.0. 1 For a steam generator tube rupture XSGL(i) and XOSG(i) are established based on the NUREG-1150 l probability distribution for these parameters. These values are based initially on computer analysis of

. large dry PWRS (Reference J6) and should also apply to System 80+.

i

. 3.1.5 DFE i,

1 DFE represents the decontamination factor DF for early releases. For System 80+ the DF is associated l with operation of the containment sprays.

The spray effectiveness is established by adjusting the Zion large dry data from XSOR to account for i differences in plant design associated with spray flows, droplet fall heights and plant size.  !

A comparison of Zion and System 80+ parameters governing spray effectiveness (See Table 19.11J-2), .-

indicates that the spray fission product removal rate for the System 80+ design is about 20% larger than  ;

i 1 that of Zion. To account for this feature, DFE was adjusted by multiplying the Zion spray scrubbing I factor by 1.2. f

.l l

3.1.6 'DFSC DFSC represents the decontamination factor associated with direct release of fission products into the s System 80 F IRWST pool. The IRWST is designed to serve as a repository of discharges from the RCS

for conditions when the PSV is challenged or when the SDS valves are actuated (for example, for feed and bleed operation).

{

l The RCS discharges into the IRWST occur under between 2 to 10 feet of water (with on average depth .

of greater than 6 feet) and therefore, the discharge will be scrubbed prior to entering the containment l environment.

IRWST scrubbing was established based on the downcomer vent scrubbing distribution for Grand Gulf BWR (Reference J11). The scrubbing distribution is conservatively selected based on large bubble discharge into a saturated pool with a vent submergence of less than 6 feet. The median DF for this distribution was 6.8. A review of design details of the IRWST discharge spargers suggests that the scrubbing for System 80+ will be twice as effective. For all non-IRWST discharges, DFSC is set equal to 1.0.'

3.1.7. DST DST is the fission product release (in fraction of the original core inventory) from the fine core debris particles that are rapidly spread throughout the containment in a DCH event at VB.

'Ihis parameter was initially set by a panel of experts based on review of DCH debris dispersal experiments for highly dispersive cavity designs typical of Zion.

~

In this elicitation, the reactor vessel pressure melt ejection discharge was established for two RCS ,

conditions at VB: I Anemed oneon aneenner. nonawee men Aemen, ant enon rs.111s

, - . a. .

System 80+ Design ControlDocument

1. High pressure ejection from the RCS (RCS pressure > W, ia)

2. Intermediate pressure ejection from the RCS (RCS pressure between 200 psia and 1000 psia)

VB failures at RCS pressures <200 psia were considered by the panel to not result in debris dispersal.

The expert panel judgement is considered overly conservative when one considers the design of the System 80+ cavity. The intent of this cavity is to be debris retentive.

Significant upward ejection of debris into the containment atmosphere is not considered credible. The System 80+ cavity is capable of apturing more than 90% of the debris at vessel breech (i.e., less than 10% of the debris is ejected into the upper compartment). A reduced DCH source was not credited in the base System 80+ analysis. A fictor was developed for establishing the sensitivity of uncertainties in this model to System 80+ source term predictions it should be noted that the DCH source term is of limited duration and is significant only when containment failure is coincident with the release. Expert judgement for the Sequoyah and Zion risk assessment establishes the DCH source term in containment a few hours after VB to be negligible.

To model DCH for System 80+, the ZISOR DCH term was reduced by a factor of two. This factor of 2 reduction still results in a bounding estimate of the DCH source term contribution.

3.1.8 FPART 1

FPART is the fraction of the core leaving the vessel and not participating in high pressure melt ejection (HPME) that panicipates in CCI. The value of this variable is set at 0.05. Five percent of the core is estimated to remain in the vessel indefinitely and is not available to participate in CCI under any circumstances; S80SOR subtracts this 5% from FPART.

3.1.9 FCCI FCCI is the fraction of the fission products present in the core material at the stan of CCI that is released to the containment during CCI. The expert elicitation provided distributions for four cases that depended upon the fraction of the zirconium oxidized in the vessel and the presence or absence of water over the core debris during CCI.

There are separate distributions for each fission product group. A recent review of the release of the low volatile elements during CCI has been performed by EPRI (Reference J7). This report concluded that the CCI releases established by the expert panel " grossly overestimate the low volatile products during MCCI

• events" Release mates for limestone / common sarid and limestone aggregates were demonstrated to be between a factor of 5 to several thousand lower than that used in the Reference plant PRA's and recommended in Reference J2. This effect was treated in S80SOR as a parametric reduction factor. For the System 80 +

base case analyses this factor was taken as 1.0.

O Altrowd Desten Meterial. Probabastic Risk Assessment Page 19.11./-6

r Syitem 80+ Design ComrolDocument l

3.1.10 FCONC . j FCONC is the fraction of the fission products released to the containment from the CCI that is released 2

from the containmen.:. The expert elicitation resulted in distributions for FCONC for the following cases: i

1. Early Containment Leak  !

2. Early Containment Rupture f I

3. Late Containment Rupture J i

4 Containment ruptures were defined to be 7 ft2 holes in containment, while a containment leak implied a i e

small 0.1 ft 2hole in containment. For S80SOR, large ruptures were assumed for all events with the i exception of the containment bypass sequences which was assumed to constitute a leak. -

The FCONC parameter distribut!0n was applied only for sequences where containment failure occurs within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of the initiation of core damage. Since the CCI release is of limited duration (several hours) at late times only a very small fraction of these fission products are expected to remain in the

> containment atmosphere at the time of containment failure (CF). MAAP calculations suggest that for System 80+ containment failure due to CCI related phenomena will occur only in the 40 to 60 hour6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> time frame. This fraction was estimated internally to be in the order of I x l@ for all nuclides except the  !

noble gases. This implies that for this condition all CCI releases are removed from the containment atmosphere prior to containment failure. Intact containment fission product releases are based on an FCONC of 10d(This value is in general agreement with MAAP and two orders of magnitude greater ,

than the ZISOR expert judgement).

4

! This value is used to characterize the release if an above ground failure occurs. For basemat melt-through conditions tre above ground failure is established by assuming penetration of the basemat shell

. will result in a fission product release rate equal to twice the design basis leakage rate.

FCONC is applied to the low volatile radionuclides (strontium, lanthanum, cerium and barium) and tellurium. l t

3.1.11 DFL ,

DFL is the decontamination factor (DF) for late releases. For System 80+ DFL can be due to either the containment sprays, or a pool of water over the core debris during CCI.

The variable for the late spray DF i DFSPC, and the variable for the pool scrubbing DF is VPS. For i non-bypass accidents, DFL is the larger value of DFSPC and VPS. As with DFE, DFL is set equal to VDF when used for a V Sequence.

3.1.11.1 DFSPC DFSPC is the DF for the sprays for late releases. There is a single distribution used for DFSPC, which ,

is based on the Zion PRA and scaled to reflect System 80+ geometry and spray flows. The distribution applies to all species except the noble gases, Appeweed posen a4wur - feaureic Ad Assesament page 19. 7 f./ 7

Syntem 80+ Design ControlDocument 3 1.11.2 VPS VPS is the pool scrubbing Di and is cbtained from a correlation developed by Powers (Reference 38).

3.1.12 FLATE FLATE accounts for the release of radionuclides from the RCS late in the accident. Like DST, it is a fraction of the original core inventory.

Fission products deposited in the RCS before VB may reven to a volatile form after the vessel fails and make their way to environment. This term considers only revolatilization from the RCS. Revolatilization from the containment is considered to be significant only for iodine, and is included in the LATEI variable. The expert panel provided distributions for the fraction of the radionuclides remaining in the RCS that are revolatilized. The amount remaining in the RCS is a function of FCOR, FVES. The expens concluded that whether there was effective natural circulation through the venel was important in determining the amount of revolatilization. Thus, there are two cases: one large hole in the RCS, and two large holes in the RCS. The experts provided separate distributions only for iodine, cesium, r.xi tellurium.

Revolatilization is not possible for the inen gases as they would not deposit, and the expert elicitation concluded that it is negligible for radionuclide classes 5 through 9.

FLATE is computed in the following manner: the value from the aggregate expens' distribution is applied to the fraction of the radionuclide remaining in the RCS to obtain the fraction of the core inventory released to the containment by this mechanism. This is multiplied by the appropriate FCONC value to determine the fraction that is potentially available to escape to the environment.

The NUREG-1150 studies concluded that the tellurium value for FCONC is considered to be appropriate for revolatilized material.

3.1.13 LATEI LATEl accounts for iodine in the containment that may assume a volatile form, such as elemental iodine or methyl iodide (organic), and be released late in the accident. The primary source of this iodine is radiolysis of iodine within the water in the reactor cavity and the IRWST. This term is added to the late distribution for the fraction of iodine in the containment that is convened to volatile forms.

The method of calculating the amount of iodne remaining in the containment dependr trpon FCOR, FVES, FCCI, and other variables.

Depending on IRWST pH control, late iodine releases can represent up to 5% of the iodine inventory released to the containment. Late releases are assumed to occur in the forms of elemental iodine and organic iodides. These forms of iodine are gaseous and, therefore, will not settle within the cont.avnent.

FLATEI for non-spray conditions was conservatively established from the initial expen elicitation. This results in a median re-evolution of iodine of 0.05 of the initial inventory.

O' hywosed Design Material FYobabinstic Itisk Assessment Pope 19.11.i.s

System 80+ Design Control Document 3.1.14 LATECS (Vn)

I '.fECS has been added to S80SOR to account for late revaporization of cesium hydroxide (CsOH) into the containment atmosphere as the atmosphere and surrounding surfaces heats up. This value was assessed via a review of late overpressure failure MAAP predictions for System 80+. These analyses indicated a revolatilization fraction of .1 % of the ecsium inventory. This large fraction reflects the large System 80+ volume, high temperatures in the System 80+ containment at failure (due to an assumed high level of RCS insulation) and the low vapor pressure of CsOH.

3.' 15 FILTP FILTP represents additional scrubbing afforded via the annu us ventilt. tion system following a core damage sequence when the containment remains intact. This parameter is not sampled and is applied to all releases from the intact containment for sequences where power L, available to operate the annulus ventilation system.

The features of the System 80+ annulus ventilation system include:

1. Charcoal bed filters for ren oval of demental iodine and organic iodide

2. I{ EPA Filters The removal capability for all releases with the exception of noble gases is a minimum of 0.95. Noble 77 gases are unfiltered and approximately 10% of the leakage is expected to bypass the filter units.

V Therefore, the overall efficiency cf the filter is 0.9 x 0.95 = 0.855, or a DF= 6.9.

3.2 Consideration of Basemat Melt-Through (BMT)

Basemat melt-through transients that proceed into the containment extended foundation are considered to be benign events. First, the time to penetrate into the subsoil is about I week. Once the foundation is penetrated, the soil wall significantly decontaminate the release as the gases slowly pass througL the wet soil with a typically low driving pressure.

The BMT release class is approximately quantified by taking the release to be four times the design basis leakage.

3.3 Conunents Regardmg Bypass Sequences The "V" sequence and SGTR with an open secondary valve represent releases that bypass containment and associated settling and scrubbing processes. Category V sequences pass through considerable lengths of piping and many V sequences are expected to be submerged underneath at least 5 feet of saturated water.

A review of V sequence modeling was conducted by SWEC. These studies indicate that the release of

_ radionuclides via the V sequence is considerably lower than that predicted by the NUREG-1150 expert elicitation. For Surry, retention in the V sequence lines was found to have an effective DF of about 12 (V) (Reference J9). This is supported by LACE test observations which apparently found the V sequence release to be a more like a viscous liquid, than an aerosol. The System 80+ V sequence is expected to Annroved Deslyn heaterial- Probab5stic Risk Assessment Page 19.11.1-9

System 80+ Design ControlDocument also be scrubbed via an overlying water pool. The effect of scrubbing was assessed as an additional equivalent DF of 6 (see Reference J9).

< 4.0 Distribution Sampling Methodology l

When evaluated as part of the integrated risk analysis, S80SOR is run in the " Sampling mode" That is, most of the variables in the release fraction equations are determined by sampling from distributions for that variable, and the value for each variable varies from observation to observation. Most of these distributions are based on judgement for the Zion expert panel (Reference J4).

For each variable in Equations 31 and J2, a distribution is usually provided for the nine radionuclide release classes defined in Table J, although release classes are sometimes grouped together. For example, for FCOR, the experts provided :eparate distributions for all nine classes; whereas for other variables, they stated that classes 5 through 9 should be considered together as an aerosol class. The distributions for the nine radionuclide classes are assumed to be completely correlated. That is, a single Latin Ilypercube Sample (L11S) variable applies to each variable in the release fraction equation, and it applies to the distributions for all nine radionuclide classes. For example, if the random variable provided by the LIIS for FCOR is 0.777, the 77.7th percentile value is chosen from the iodine distribution, the cesium distribution, the tellurium distribution etc., for FCOR. Sampling distributions are provided independently for each distribution sampled. Each distribution is sampled 200 times.

For the source term analysis, the LilS provided only a random number between 0.0 and 1.0 for each variable to be sampled. The actual distributions are in a data file read by S80SOR before execution. The variables provided by the LIIS are used to define quantiles in the variable distributions; the values associated with these quantiles are used as variable values in S80SOR.

All fission product groups within a variable are completely correlated, while there exists no correlation between variables. That is, selection of a quantile within a variable is assumed applicable to all fission product groups within that variable. On the other hand, sampling between variables, say for example, FCOR and FVES are completely uncorrelated.

5.0 Energeti<.s and Duration of Releases Information regarding the energetics of the fission product release was established with MAAP calculations for various release classes. Containment failure at high pressures were very energetic whereas failure of containment due to loss of isolation would result in low energy releases.

Release durations were based on a review of MAAP analyses along with details of the release class. In the PRA release classes that fail containment where tracked for 24 hrs after containment failure. If the containment is anticipated to ren:ain intact releases were tracked for a period corresponding to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after VB.

6.0 References J1. NUREG-il50, " Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants,"

June,1990.

J2. NUREG-1465, " Accident Source Terms for Lightwater Power Plants," 1992.

O Approved Design Materist Probabnistic Risk Assessment Page 19.11.1-10

Design controlDocument Srtem_80 +

T J3. NUREG/CR-5667, EGG-2634, "INEL Personal Computer Version of MACCS 1.5," Jones, K.R., et. al., INEL, December,1990

()

J4. NUREG/CR-4551, SAND 86-1309, Vol 2, Rev.1 Part 4 " Evaluation of Severe Accident Risks:

Quantification of Major Input Parameters: Experts Determination of Source Terms," Sandia National Laboratories, June,1992.

J5. NUREG/CR-5747, BNL-NUREG-53389, " Estimate of Radionuclide Release Characteristics into Containment Under Severe Accident Conditions," Nourbakhsh, H.P., January,1992.

J6. NUREG-1150, Vol 2, " Severe Accident Risks: An Assessment of Five Nuclear Power Plants:

Appendices," USNRC, October,1990.

J7. DOE /ID-13177-2, " Low Volatile Fission Product Release During Severe Accidents," Osetek, D.J., October, i992.

18. NUREG/CR5901, "A Simplified Model of Aerosol Scrubbing by a Water Pool Overlying Core Debris Interacting with Concrete," Powers, D., December,1992.

19. J. Metcalf. et. al.." Fission Product Transport in the Reactor Coolant System for a Spectrum of the LOCA scenarios," International Seminar on Fission Product Transport Processes in Reactor Accidents, Dubrovnik, Yugoslavia.

J10. NUREG/CR-5360, "XXSOR Codes User Manual," Murfin, W.B., et. al. (DRAFT).

(V) J11. NUREG/CR-4551, Vol 2, Rev 1, Part 6 " Evaluation of Severe Accident Risks: Grand Gulf Unit 1: Appendices," SNL, December,1990.

i s

Appremed Desspn heatorial- Robabiaistic Risk Assessment (11/961 Page 19.11.111

System 80+ Design ControlDocument Table 19.11J-1 Isotopes in Each Radionuclide Release Class Release Class Isotopes Included

1. Inert Gases Kr-85, Kr-85M, Kr-87, Kr-88, Xe-133, Xe-135

2. lodine 1 131, I 132,1-133, 1-134,1-135

3. Cesium Rb-86, Cs-134, Cs-136, Cs-137

4. Tellurium Sb-127, Sb-129, Te-127. T3-127M, Te-129. Te-129M, Te-131M, Te-132

5. Strontium Sr-89, Sr-90, Sr-91, Sr-92

6. Rutheniun: Co-58, Co-60, Mo-99, Tc-99M, Ru-103, Ru-105, Ru-106, Rh-105

7. Lanthanum Y-90, Y 91, Y-92, Y-93, Zr-95, Zr-97, Nb-95, La-140, La-141, La-142, Pr-143, Nd-147, Am-241, Cm-242, Cm-244

8. Cerium Ce-141. Ce-143, Cc-144, Np-239, Pu-238, Pu-239, Pu-240, Pu-241

9. Barium Ba 119, !b 140 Table 19.11J-2 Cornparison of System 80+ and Zion Spray System Features item System 80+ Zion Containment Volume 3.34x106 ft3 2.6 x106 ft3 Spray Flowu l 5000 gpm 2600 gpm ,

Droplet " fall height" 85 fir 21 100 ft 01 Note that noble gases cannot be scrubbed via sprays. However, sprays were considered a factor in the delayed evolution of elemental and organic cutaneous from the contamment sump.

(21 See Section 6.5.3.

44romt Desiers Material- Probabinistic Risk Assessment Page 19.11J12

-. . . . . .-. .. - , . = . - . . ._ .. .. - .

I System 80+ __

Desian controlDocument i Q Effective Page Listing Appendix 19.11K  :

1 Pages Date i, ii 1/97 iii - iv Original 19.11K-1 through 19.11K-15 Original ,

19.11K-16 2/95 19.11K-17 through 19.11K-30 Original 19.11K-31 11/96  ;

19.1IK-32 through 19.11K-39 Original I

6 l

l l'

(O J

l I

\

\-

Y

^;,- a= Deepe hannonial Severe AccMents (1/97) Pope 1. E I

I

. m r - , , - r y ,mr -

1 I

Sy-tem 80 + Design Control Document  ;

/ )

( Appendix 19.11K N

l Hydrogen Mitigation System l l

Contents Page I

i I

1.0 Introduction ..................................... ...... 19.11K-1 2.0 Background . . . . .......... ......................... ... 19.11K-1 )

1 3.0 Hydrogen Concentration . . . . . . . . . . . . . . . . . . . ................ 19.11K-1 4.0 Experimental Research Related to Hydrogen Combustion ... . ... ... 19.11K-2 4.1 Flammability Limit for Detonation ................. ........... 19.11K-2 4.2 ' Hydrogen Mixing and Distribution Experiments . . . . .... .. ....... . 19.11K-3 4.3 Hydrogen Control Via Deliberate Ignition Systems ........ . . ....... 19.1 IK-6 b 5.0 Hydrogen Igniter Placement Guidelines for System 80+ . . . . . . . . . . . . . . 19.11 K-1 1 5.1 HMS Design Goals . . . .... ... ... .. .... ...... .. ... 19.11K-11 5.2 HMS Placement Criteria . . .................... .... . . . . . . 19.11K-12 6.0 Hydrogen Mitigation System ... . . ... .. ....... . . . . . . . 19.11K-14 6.1 Igniter Placement ...... ....... .... . . . . . . . . . . . . . . . . . . . 19.1 1 K- 14 6.2 Igniter Power Supply . . . . . . . . . .............. .. . . . . . . . . 19.11 K- 14 6.3 IRWST Pressure Relief Dampers ..... ... ....... . . . . . . . . . . . . 19.1 1 %- 15 6.4 Igniter Accessibility and Maintenance . . . .. . ... . ............. 19.11K-15 7.0 Igniter System Verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19.1 1 K- 16 )

7.1 Construction of Plant Model .. . .... ....... . . .. ...... . 19.11K-16 7.2 Methodology ........ ..... ......... .... . . ... .. . 19.11K-17 7.3 Results of Calculations . . . . . . . . ....... . .. ..... .. . .. . 19. l lK-18 7.3.1 Model Verification Cases . ........... ..... . . . ........ 19.11K-18 1 7.3.2 Small Break LOCA Cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19.1 I K-18 l 7.3.3 Station Blackout with SDS Activation . . . . . . . . ..... . . . . . . . . . . . . . 19.11 K- 19 7.4 Summary of Analyses .............. . ........ . . . . . . . . . . 19.11K-20 8.0 Hydrogen Detonation Issues ........ . . . . . . . . , . . . . . . . . . . . . 19.1 1 K-20 8.1 Detonation and Containment Survivability . . . . . . ........ . ...... 19.11K-20 j 8.1.1 ' Containment Detonation Loading . . . . . . . . . . . . . . . . . ........ ... 19.11K-21 8.2 Condensation Induced Detonation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19.11K-21

.'*pwed Des # Mereniet

• Sewere AccWents Popesii

System 80+ Design ControlDocument Contents (Cont'd.) Page 9.0 Conclusions . . . . . . . . . . . . . . . . . . .... . . . . .. . 19.11K-22 10.0 References . . ..... ...... ....... .. . .... ... . . . . . 19. l l K-22 Tables 19.1IK 1 Sherman/Berman Ranking . . . . . ....... . . . . 19.1IK-25 19.11K-2 Summary of Pertinent Igniter Test Information . . . . . . . ... . . . 19.11K-26 19.1 IK-3 Summary of Specific Igniter Placement and Design Crheria for System 80+ 19.11K-30 19.1IK-4 System 80+ Hydrogen Igniter Locations , ... . . . . . . . . . . 19.11K-35 19.11K-5 System 80+ Hydrogen Concentration Cases: Global Containment Values .19.11K-38 19.11K-6 System 80+ Hydrogen Concentration Cases: Peak Hydrogen Concentration 19.11K-39 19.llK-7 Local liydrogen Detonation Pressures: TNT Equivalent . .. . . . 19.11K-39 O

O Alywosed Design Material Severe Accidents page jv

r __ _ _ _ __ _ _ _ _. _ _ - _ _._ _ _

Syiterrr 80+ Design ControlDocument 1.0 Introduction The appendix describes the purpose, design, implementation and capabilities of the System 80+

Hydrogen Mitigation System (HMS) in responding to a severe accident. Additional detail on the HMS can also be found in Section 6.2.5. ,

i 2.0 Background  !

l The accident at TMI-2 revealed that severe accidents can release large quantities of hydrogen to  ;

containment. This hydrogen can accumulate and undergo combustion potentially threatening both the  ;

survivability of safety equipment and containment integrity. As a consequence of these observations the l NRC identified beyond-design-basis hydrogen control as an Unresolved Safety Issue (USI A-48). This issue covers hydrogen control measures for recoverable degraded-core accidents for all Mark I, II and HI boiling water reactors and pressurized water reactors with an ice condenser containment. At that time,  :

PWRs with large dry containments were excluded from USI A-48 and the issue for large dry PWRs was  !

investigated as Generic Issue 121 (GI 121). USI A-48 was resolved by an amendment to the 10 CFR  ;

50.44m, " Hydrogen Control Systems," which required the subject reactor to implement a hydrogen j control system capable of " accommodating an amount of hydrogen equivalent to that generated from the  ;

reaction of 75% of the fuel cladding with water, without loss of containment integrity." Further, the NRC reaffirmed its policy that the " prevention of excessive radiation doses to the public can best be i

assured by maintaining a leak tight containment and that this, in turn, can be provided by assuring that there is structural integrity with " margin" and that sufficient equipment will be available to establish and maintain safe shutdown. The regulation was based on a hydrogen concentration of 13% by volume as O the lower limit for a hydrogen detonation to initiate. No active system was required to prevent detonation if it could be demonstrated that the hydrogen concentration for this level of oxidation remained below 13 % by volume. For future plants, this issue was folded into the Containment Performance Improvement (CPI) Program and was defined in SECY-88-147W, SECY-90-016 Wand SECY-93-087W.These features were incorporated into the Code of Federal Regulations as Post-TMI rule 10 CFR 50.34(f)*. In promulgating this regulation for advanced LWRs, the hydrogen control requirement was further tightened ,

such that the plants would be able to accommodate the amount of hydrogen equivalent to that generated from the reaction of 100% of the fuel active cladding with water and maintain the hydrogen concentration ,

m contamment to below 10% by volume hydrogen.  ;

I l 3.0 Hydrogen Concentration i

The Systera 80+ containment structure was sized to accommodate the hydrogen requirements of the EPRI Utility Rgtirunents DocumentW These requirements were consistent with the guidance in 10 CFR

. 50.44. Conwquently, the System 80+ containment volume was designed to contain greater than 3 million che leet. Scoping calculations of the hydrogen concentration resulting from a 75% oxidation i of the fre, 9.dding resulted in a containment volumetric hydrogen concentration of 10.2% In the l context M 0.c eatlier regulation, System 80+ , by design, passively eliminated the hydrogen detonation ,

threat. Several years later the hydrogen detonation threat was redefined. The upper limit of oxidation to be accommodated by the containment increased from 75 to 100% of active cladding while simultaneously, the minimum detonation limit for hydrogen was decreased from 13 % to 10% by volume.

As a result of this redefinition of the hydrogen source, the System 80+ containment hydrogen

]

concentration increased to 13.6% by volume. Thus, in order to meet the requirements set forth in 10 i g CFR 50.34(f), an active means of hydrogen control by the addition of a hydrogen igniter system was l implemented for the System 80+ design.

C A Dee> atenerinh Probahainsic Rink Assessmerrt Pope 19.11K-1 I

, -- . . , .- .- - . _ . . - - _ - ______l

Srtem 80+ Design controlDocument 4.0 Experimental Research Related to Hydrogen Combustion $

This section provides an overview nummary of the key experimental results used to guide the development of a hydrogen igniter system for System 80+. Since the existing System 80+ containment design is sufficiently robust to withstand containment threats associated with deflagrations (see Section 19.11), the primary goal of the deliberate ignition system required by 10 CFR 50.34(f) is to preclude the potential for a detonation. Therefore, this review has concentrated on experiments that provided information on:

1) limits on detonability and the Likelihood of detonation,2) hydrogen mixing and distribution, and 3) effectiveness and performance of deliberate ignition systems in hydrogen control.

This information was used to define design criteria and performance goals for the System 80+ hydrogen igniter system.

4,1 Flammability Limit for Detonation The System 80+ hydrogen igniter system provides a means of hydrogen control so that a hydrogen detonation within containment is averted even following a very low probability severe core damage event.

For perspective, the following briefly reviews the current state of understanding of hydrogen detonation limits.

Studies regarding tee estimation of the lower detonability limit for hydrogen-air and hydrogen-air-steam mixtures have not as yet completely defined this event. There are two ways in which a detonation can occur in a detonable mixture; one is direct ignition and the other is flame acceleration. . Based on estimates of the energy needed to ignite a detonable mixture at 13% by volume hydrogen, the National Academy of Sciences (NAS) noted that direct ignition detonation within the containment is unlikelyN.

The second means of detonation, flame initiation and acceleration, can occur due to turbulence, changes in geometry, obstacles and wall roughness. This process is termed Deflagration-to-Detonation Transition (DDT).

As late as the 1950's the lower detonability limit of a hydrogen-air mixture was estimated to be 18 % by volume hydrogen. However, much of the experimentation used to support this value were small scale and employed relatively uncomplicated geometries (i.e., spheres, circular tubes, etc.). As larger facilities ,

were used for experimentatioc and a wider range of geometries were tested, evidence suggested that the l actual detonability limit was lower than the 18% by volume previously reported by Lewis (7) and others. l Further, the importance of geometric features (size, obstacles, vents etc.) on detonation began to become l

more apparent.

In the mid-1980's, DDT tests were conducted by Sandia National Laboratory in the FLAME 31 and MINIFLAME 32 facilities to investigate the role of flame acceler non on producing detonations in reactor I geometries. The FLAME facility consists of a 1:2 scale model of the upper plenum volume of a PWR ice condenser containment. These tests investigated DDT for hydrogen concentrations between 12% and 30% by volume and included several parametric studies regarding the importance of obstacles and transverse venting on DDT. For all geometries tested no significant flame acceleration was noted at hydrogen concentrations of 12%. DDT was first observed at 15% hydrogen for tests with obstacles l present and no transverse venting. At the 25 to 30% hydrogen concentration, DDT was observed without j 1

the presence of obstacles. Smaller scale experiments were performed at the MINIFLAME facility.

Because of the smaller size, DDT wat ot observed at hydrogen concentrations of 20%.

Recently, with a carefully configured geometry Dorofeev0 D succeeded in achieving a DDT at a hydrogen concentration of only 12.5 % by volume.

AMuoved Design Material Pro)sb&stic Risk Assessment Pope 19.11K 2

Srtem 80+ Design control Document

,m

( ) Much of this experimental evidence has been reviewed and evaluated. An independent review of the hydrogen detonation issue by the National Academy of Sciences

• concluded that a hydrogen concentration of 13 % by volume is a reasonable lower limit for expected hydrogen detonability in a PWR containment atmosphere with small quantities of steam. More recently, ShepardM, concluded that a conservative lower bound for the hydrogen concentration would be 10% by volume.

As these experiments indicate, the lower limit for detonation appears to be conservatively bounded by about 10% by volume hydrogen. This lower limit then replaced the previous 13% by volume considered in evaluating existing igniter systems for operating plants.

From its inception, the System 80+ design philosophy has been to overwhelm a potential problem by design. An early goal of the System 80+ design was to demonstrate that significant core damage (equivalent to 75% zircaloy oxidation) would not result in a detonable hydrogen concentration. In this effort a lower bound global hydrogen concentration of 10% by volume was achieved. This led, in part, to the large 3.4 million cubic feet System 80+ containment design. Thus, for all accident scenarios with a core melt probability above 104, detonation was precluded by design. The purpose of the ignition system is to meet regulatory guidance which requires that active systems preclude a hydrogen detonation in an unrecoverable core melt sequence. The9 events have a cumulative occurrence frequency of less than 10r6 per year.

Application to PWRs One important outcome of the Sandia FLAME experiments was the development of the Sherman/Berman* 13) qualitative detonability likelihood criteria. In this system, the authors rated the

[]

V detonation potential on a 5 point scale, with I being most detonable and 5 being virtually undetonable.

The mixture detonability was based on two parameters: the detonation cell width (which is directly related to hydrogen concentration), and the physical plant geometry. A review of all internal compartments and mixture reactivities for System 80+ suggests that System 80+ is a Class 4 containment. This rating implies containment conditions are not conducive to DDT and that the potential for a detonation is unlikely to impossible. For completeness a summary of the Sherman/Berman geometrical ratings for System 80+ is presented in Table 19.11K-1.

4.2 Hydrogen Mixing and Distribution Experiments The ability of hydrogen to mix throughout the containment is important to ensure that locally high concentrations will not develop. Overall resul., of hydrogen mixing experiments suggest a propensity for good mixing within various containment volumes. However, mixing was found to be dependent on the relative location of the source hydrogen to the volume under concern. On microscopic levels, mixing at the point of the source is expected to produce very localized large concentration gradients.

The primary processes which govern the mixing of gaseous mixtures are forced and natural convection.

The release of hydrogen and steam from the reactor system in the form of a jet flow would cause forced convective mixing. Buoyancy forces will induce natural convecting flows. During an accident it is expected that mixing will be promoted by a combination of forced and natural convection. The degree of mixing is dependent upon the hydrogen / steam release rate, fluid movement and turbulence introduced due to the flow.

A ASqvownf Design Material Probabbstic Risk Assessment Pope 19.11K.3

Syotem 80+ Design ControlDocument Ifanford Engineering Development Laboratory (IIEDL) Mixing Tests"*

Tests were performed to establish the hydrogen-steam / helium-steam mixing capability within the lower compartment of an ice condenser containment. The test facility consisted of a 20 m high,7.6 m diameter vessel. While results of these tests are not directly applicable to large dry PWR containments, some level of commonality does exist. Key observations from the HEDL program include:

1. The compartment was well mixed during the source release period with the maximum helium or hydrogen concentration differences of about 3% by volume between points in the test compartment. This results in a peak concentration to average concentration ratio of less than 1.15.

2. Gas entrainment due to the high velocityjet was the dominant mixing process during the release period. Mixing levels were independent of the orientation of the source jet.

3. After termination of the source, the containment mixing was supported by the natural circulation process.

Nevada Test Site (NTS) Continuous Injection Tests"8 The Nevada Test Site facility was used to study hydrogen combusaon and mixing phenomena in a large scale (2100 m3 ,75,000 ft 3) spherical shell. As part of this test program continuous injectior experiments were included to study the hydrogen mixing process in the presence and absence of combustion.

• liydrogen Mixing in the Absence of Combustion At low injection rates of pure hydrogen (about 0.4 kg/ minute) and a quiescent atmosphere, the NTS facility was observed to fill with hydrogen from the top down. The location of the source was important to the gross hydrogen mixing process. In the absence of mixing fans, the volume located above the hydrogen source was observed to have a hydrogen concentration twice that of the volume below the source. The mixing process was markedly improved by the operation of water sprays and uniform vessel conditions were established "immediately".

Additional NTS experiments demonstrated that even in initially quiescent atmospheres, the injection of large quantities of steam along with the hydrogen (even at low hydrogen injection rates) would rapidly produce a well-mixed mixture within the facility.

• Ilydrogen Mixing During Continuous Combustion In this experiment, hydrogen and steam injection rates were 1.9 kg/ min and 30 Kg/ min, respectively, and the atmosphere was initially quiescent with a steam concentration of 30%. The injection process caused a rapid dispersion of hydrogen into the containment upper dome.

Ignition occurred at the top of the facility. Shortly thereafter, the flame became attached to the hydrogen source. At that point incoming hydrogen was efficiently consumed and global hydrogen concentrations were reduced.

CEA-SACLAY liydrogen Simulant Mixing Experiment"*

A series of light gas mixing experiments were performed by the Commissariat a l'Energie Atomique in O

Saclay, France. 'Ihe purpose of this investigation was to estimate the potential for hydrogen stratification Approved Design Material Probabidistic Risk Assessment Page 19.11K 4

'?

i j

Srtem 80+ Dessen controweeumont l within the containment following a severe accident. These experiments were conducted on a small scale f test apparatus with a volume of 240 ft3 and a height of 7.5 ft. Helium was selected as a simulant mixing  ;

gas. The test conditions and facility were scaled according to prototype Froude and Reynolds numbers. l The Reynolds number for the injected flow varied from 300 to 10,000 and bounded typical System 80+ j i

hydrogen release rates.

All experiments were conducted with the helium source located at the floor of the facility. The facility i was instrumented to monitor the gas concentration axially throughout the scaled contamment. The j transitory mix.ng process was then measured as a function of several driving parameters including the [

source. injection Reynolds number. These results suggest that the hydrogen mixing process is very i effective over a wide range of Reyncids nembers. Asymptotic concentration gradients resulted in [

6 maximum-to-average concentration ratios of typully less than 1.07. Transitory mixing was also shown to quickly approach equilibrium, with maximum-to-3verage concentration ratios of approximately 1.15 ten minutes after the cessation of the injection. j HDR"7'38 Hydrogen Mixing Expedments  !

The HDR is a decommissioned reactor facility in Germany. Over the past decade this facility has been used for a wide variety of large scale reactor experiments. Recently, the HDR has been utilized to l investigate hydrogen mixing pher.cni.ers. Unlike the experiments described above which were single volume tests, the HDR containment is a complex building with 72 sub-compartments and over 300 ,

interconnecting flowpaths. Consequently, this facility was intended to provide experimental data on the long term gas transport behavior in a large scale, multi-compartment facility in the presence of steam under natural convection conditions. The total volume of HDR is 11,300 m3 with a height of 60 m.

Several HDR experiments were performed. For safety, hydrogen gas injection was simulated by a 85/15 helium / hydrogen mixture. While all HDR experiments are not readily available for review, several findings from the experiments are worthy of note. j e importance of Injection Location HDR tests El1.2 and Ell.4 illustrated the importance of injection location on hydrogen mixing and stratification. Both experiments consisted of small break LOCAs with a delayed hydrogen

! release. In test E11.2 the hydrogen and steam sources were located at the 23 m elevation, while for test Ell.4 the sources were located much lower in the containment at the +2 m  ;

elevation. Results of test E11.2 indicated that the hydrogen distributed itself into two regions.

Below the gas source the hydrogen simulant (" gas") concentration remained very low (below 5 %

i by volume) while above the source " gas" concentrations exceeded 20% by volume. Once this  ;

stratification occurred, the HDR atmosphere could not be homogenized by operational measures.

In test Ell.4, the low position of the gas release resulted in good mixing of the hydrogen (See Figure 4.2-3) with typical local concentration gradients of the hydrogen indicating a maximum-to- ,

average concentration ratio of less than 1.2. A similar conclusion is reached even when the concentration gradient in the region above the 23 m source elevation is considered. t 4

The impact of a simulated large LOCA with gas injection at the 13 m elevation was studied in ,

i Test T31.5. This experiment indicated the potential for an initially stratified mixture to develop  !

in HDR with higher hydrogen concentrations in the dome. However, the difference in hydrogen concentration was small After about 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> the dome and source elevations had hydrogen concentrations within approximately 40% of one another, with a ratio of maximum to containment average of about 1.2. . After 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> the initially stratified mixture reached near uniformity, ,

, L :ouw aneeend-nosasawne nu Aue.mmt reen, ts. r ux-s ll -

_ -. __ _ _ _ . m. - . _. . _ . . , _ . - . ,_ _ __ .

System 80+ Design ControlDocument

• Effect of Spray on Hydregen Concentration Test Ell.2 indicated the effect of spraying into a stratified mixture can cause a significant increase in the local hydrogen concentration in the gas rich region at the expense of a depletion of the gas in the low concentration region. In essence, spraying could in that limited situation make a bad situation worse. This behavior was a result of a quiescent steam condensation driven flow to the upper compartment which due to the poor natural convective patterns in the HDR and initial stratified behavior could not readily re-mix with the rest of the containment. Similar testing performed for an initially well mixed situation is designated test E11.4. For this test the condensation process resulted in a uniform gradual rise in the gas concentration throughout the containment.

NUPEC Hydrogen Distribution Test"8)

A hydrogen distribution test facility has been developed by the Nuclear Power Engineering Corporation (NUPEC) to study hydrogen distribution in prototypical containments. The test facility is a 1/4 linearly-scaled steel containment with 25 compartments, with each compartment representing a room in the actual containment. The NUPEC containment vessel has a volume of 1600 m3 , a diameter of 10 m and a height of 20 m. Hydrogen gas was simulated by helium. Thirty five experiments, including steam injection tests, were conducted through March of 1992. Helium concentration was measured in every compartment and in several places within the upper dome. Details of these tests are currently unavailable. However, based on preliminary information and summary reports from the experimenters the following conclusions were drawn:

1. Several mixing loops were formed by natural convection. These flows were sufficient to prevent local " gas" concentration hot spots provided the source of injection was the lower compartment.

2. Helium gas sampling in the dome, whose volume is 70% of the total facility volume, showed almost complete uniformity.

3. Containment spray operation enhances natural convection processes.

4.3 Ilydrogen Control Via Deliberate Ignition Systems Considerable experimentation has been performed to investigate the efficacy of using igniters to control the hydrogen concentration in hydrogen-air-steam mixtures. The overall goal of these tests was to validate the hydrogen igniter system design selected for use in the ice condenser PWR and General Electric Mark 111 BWR containments. These tests were conducted at varying scales with various degrees of simulation. Most tests focused on the GMAC-7G glow plugs. Table 19.1IK-2 summarizes the most significant of the igniter tests performed in the United States. Additional supportive tests were also performed in Europe and Japan.

The test program provided valuable insights into the mechanisms associated with hydrogen burning including information associated with hydrogen placement and combustion efficiency. From these experiments it was concluded that igniters can limit hydrogen concentrations to the range of 4% to 7%

by volume. Further, several general guidelines were developed for igniter placement which were adopted in the System 80+ Hydrogen Mitigation System design (See Section 5 of this Appendix).

AMunnd Design Materini. Probabkshc Risk Assessment Page 19.11K-6

l Srtem 80+ Design ControlDocument l 1

I o  !

I i SNL Fits (l9 Tests V  !

These tests consisted of a series of 239 hydrogen-air-steam experiments performed at Sandia National 3

Laboratory's (SNL's) 5.6 m Fully Instrumented Test Site (FITS). These experiments addressed the flammability limits of combustible atmospheres that might occur inside containment during severe accidents. Tests investigated mixture responses for hydrogen-steam-air mixtures with volume concentrations up to 70% by volume hydrogen and about 56% by volume steam.

These tests were highly successful in defining the hydrogen-air-steam flammability triangle. In addition to the limit criteria, tests also investigated combustion completeness issues, effects of mixture temperature and the resultant burn pressure rise. Pertinent conclusions from this program include:

1. Hydrogen-air-steam mixtures are inert to combustion provided the steam concentration exceeds 52 %.

2. Pressures predicted using assumptions of Adiabatic Isochoric Complete Combustion (AICC) bound experimental predictions.

3. Combustion of high % by volume hydrogen mixtures (up to 30% by volume) was consistently observed to result in a deflagration. No detonations were observed in 70 experiments performed at hydrogen concentrations greater than 13% by volume.

SNL VGES (

• Tests lO The Variable Geometry Experimental System (VGES) combustion chamber is used extensively at SNL l

Q for studies of closed-volume deflagrations of hydrogen-air mixtures. The purpose of these experiments was to establish igniter performance and to determine the effect of diluents and water sprays on hydrogen deflagration. Igniter designs studied included: exposed 300 W photolamp filament, a 30-J raised spark gap, the GMAC 7G standard glow plug, and the TAYCO Model 193-3442-4 helical igniter. This later l device is currently used for existing deliberate ignition systems.

Approximately 100 tests were performed. Primary observations with regard to igniter performance include:

1. Peak combustion pressures were observed to rise rapidly as the hydrogen concentration reached 5 to 8%. Predictions of these burns via AICC methods, suggest the combustion pressures are bounded by AICC.

2. Igniter performance was found to have a significant influence on all hydrogen concentrations below 8% by volume.

3. Ideal gas inerting via nitrogen and carbon dioxide were considered in various mixtures. Based on these studies the diluent mixture for CO2 sufficient to inert the mixture was 54%.

4. Tests of igniter performance in the presence of a water spray and high velocity mixture flowrates 2

suggest that direct spray impingement greater than 531/m min can defeat the glow plug.

n

.k )

v Apunrowd Desigrs hinterial- Probahmstic Risk Assensneerst Pope 19.11K-7

System 80+ Design ControlDocument NTS "* Tests A series of tests to investigate hydrogen combustion in a large scale facility were conducted by EG&G at the Nevada Test Site (NTS). These tests investigated hydrogen mixing and survivability of safety related equipment in postulated degraded core accident hydrogen burn environments. Tests included burns in pre-mixed mixtures and continuous injection hydrogen sources. Approximately 40 experiments were performed. For pre-mixed tests, the mixture composition was varied over a range of 5 to 13%

hydrogen and 4 to 40% steam. Ignition for these tests was initiated by a GMAC 7G glow p!t.g, located at various positions within the vessel. The NTS vessel was 15.85 m in diameter, with a volen.e of 2048 3

m.

Test results provided considerable practical information on igniter performance and placement. Tests clearly indicated that combustion completeness is directly correlated with igniter placement. Location of igniters towards the top of the vessel limited upward burning and shifted the flammability limit to that of downward burning which requires higher hydrogen concentrations. It was also noted that the glow plug could effectively ignite hydrogen mixtures as low as 5.2 % by volume provided steam concentrations are low. Ignition above 8% by volume hydrogen consistently resulted in complete combustion.

LLNL"M Ilydrogen Igniter Experimental Program This program consisted of an NRC directed effort to investigate the effectiveness of glow plugs as effective deliberate ignition sources in hydrogen: steam: air mixtures. Approximately 100 experiments 3

were performed. Tests were conducted at a pressure of 1.4 MPa in a vessel with a 0.3 m free volume.

The facility investigated the GM AC 7G glow plug which was positioned at various locations within the test vessel.

These experiments provided additional confirmation that AICC prediction methods would effectively bound hydrogen burn pressures for hydrogen burns up to 16% by volume hydrogen. Further, hydrogen ,

burns could be achieved at concentrations as low as 6% and that co.mplete combustion was expected at hydrogen concentrations of 8% by volume. These igniter tests also noted that the GMAC 7G glow plug consistently ignited mixtures at surface temperatures between 700 and 800*C, with higher temperatures  :

necessary to ignite steam-laden mixtures, and "showed no appreciable deterioration throughout the series l of tests". l Experiments also confirmed that som concentrations in excess of 50% by volume can effectively inert )

the combustion process. Tests performed in this test series investigated the combustion characteristics j of an initially steam inerted mixture as the mixture condensed. These tests were performed with a 10%

hydrogen concentration while the glow plug was activated. The condensation process was noted to result l in the :onsumption of hydrogen without a consequent discrete pressure rise.

Whiteshell "A Tests I The Electric Power Research Institute (EPRI) sponsored a series of over 300 pre-mixed hydrogen combustion tests at the Whiteshell Nuclear Research Establishment in Pinawa, Manatoba. The program was focused on confirming the effectiveness of a deliberate ignition system in controlling hydrogen during a severe accident.

Tests were conducted in a 17 liter quasi-spherical facility. Two types of glow plugs were studied: the GMAC 7G glow plug and the Tayco Model 193-3442-4 helical igniter.

Approved Design Meterial- Probabnish Risk Assessment Page 19.1r?-8 l

System 80+ Design controlDocument

,y

('" ) These tests showed that either of the igniters could effectively ignite dry hydrogen-air mixtures in quiescent conditions at 5.5% by volume. Hydrogen concentrations down to 4.5% by volume were ignitable under turbulent conditions. Further, mixtures with as much as 55% by volume steam were ignited in both quiescent and turbulent tests.

Essentially complete combustion was indicated for hydrogen mixtures containing greater than 9% by volume hydrogen. Combustion completeness was noted to also be dependent upon the steam concentration; a significant reduction in combustion completeness was observed for steam concentrations greater than 30%.

The Whiteshell experiments also investigated combustion in an initially inerted steam environment subject to steam condensation. In this experiment an initially inerted steam-hydrogen-air mixture was cooled to bring the mixture into the flammable range. Ignition was typically observed to occur once the mixture passed through the deflagration ignition limit. These ignitions occurred well in advance of any potential detonation.

ACUREX "9 Tests The Acurex Corporation conducted a series of intermediate scale hydrogen combustion experiments. The program was conducted in a 17.83 m3 vessel. Both pre-mixed and continuous hydrogen injection tests were performed. The specific objectives of these tests were to investigate the effects of different hydrogen and steam injection rates, igniter location, water sprays and fogs on deliberate ignition.

These tests concluded that location of the igniter can affect the effectiveness of the deliberate ignition

()

(N system injection of hydrogen above the igniter location can result in the hydrogen bypassing that igniter.

Igniters located near the top wall of the vessel would ignite, however, only after the hydrogen concentration reached the hydrogen concentration sufficient for downward flame propagation. The presence of sprays tended to produce longer burns with a smaller pressure rise.

ITEWAL "* Tests The Fenwal tests were performed for Westinghouse Electric Corporation and several utilities to determine the effectiveness of glow plug igniters in a deliberate ignition system. The test facility was a small scale 3.8 m 3spherical vessel. Tests included dry and wet hydrogen-air mixtures with both pre-mixed and continuous injection hydrogen sources. Hydrogen concentrations ranged from 5% to 12% by volume, with steam concentration up to 40% by volume. All tests were conducted with a GMAC 7G glow plug.

At low hydrogen concentrations, the effect of sprays and fans were to increase the hydrogen combustion pressure rise. This is presumably a result of increased mixing within the facility. At hydrogen concentrations of approximately 8% by volume, the hydrogen burn was essentially complete.

The tests indicated that upward burns would propagate at hydrogen concentrations as low as 4% by volume; at 6.5% the burn will propagate sideways and at 8.5% the burn propagates in all directions.

NUPEC "l 33)llydrogen Igniter Tests NUPEC has embarked on the Containment Integrity Project for proving the reliability of Reactor

(_)

\d Containment Vessels. This project has been ongoing since June 1987. This program includes both large (270 m3 ) and small (5 m )3 combustion experiments. Small scale tests were performed to investigate hydrogen combustion phenomena and flame transition phenomena. Results from these tests were Anwoved Design A9eterial- Probabinistk ILisk Assessment Pope 19.11K-9

I S,ctem 80 + Design Control Document 1

generally consistent with earlier data obtained from similar programs in the United Stato. Large scale test data will simulate multi-compartment features of an actual plant.

1 University of PISA # Hydrogen Igniter Tests l This test series was directed towards establishing deflagration characteristics and examining the 3

capabilities of igniters for hydrogen control. Tests were conducted in the 0.5 m Hydro-SC facility at l the University of Pisa. Tests employed glow plug igniters and included hydrogen concentrations from 4% to 16% by volume with and without spray injection. The Hydro-SC tests confirmed the results of i

similar experiments performed in the United States. The test further indicated that the igniter performed 1 its function in the pre ence of water sprays.

Mark III "'J3484W Demonstration Test l

The Hydrogen Control Owners Group (HCOG) sponsored a 1/4-Scale Mark III Containment Combustion l Hydrogen Program to determine the thermal environment to which critical plant equipment in the Mark III containment may be subjected as a result of hydrogen combustion following a severe accident. The tests were conducted by the Factory Mutual Research Corporation. The facility was designed using  ;

Froude Number scaling techniques to simulate the details of the containment systems having an important l impact on the modeling of the combustion phenomenon. These features .;ncluded a simulation of the i HCOG deliberate ignition system, a model of the SRV sparger geomeay and suppression pool, l containment sprays and fan coolers. The test simulated three types of transient hydrogen releases.

Hydrogen could be released via a simulated Automatic Depressurization System (ADS), a stuck open relief valve into a sparger, or a LOCA event directly into the containment.

The experimental program, in essence, was a scaled demonstration of the efficacy and practicality of a (

distributed deliberate ignition system for use in degraded core and severe accident hydrogen control. l Prior to the onset of this program the experimenters believed that the igniter system would primarily I control hydrogen accumulation via a series of discrete deflagrations. It was also recognized that steady l diffusion flames may develop for certain scenarios. Instead, the test program indicated that the dominant mode of combustion was the diffusion flame. Unburnt hydrogen was controlled to levels equivalent to 4.5% to 5% by volume on a dry basis. Diffusion flames were observed to be anchored to the surface i of the suppression pool. No significant pressure excursions were noted. Consequently it was concluded that "the occurrence of successive deflagrations do not appear possible as a major mechanism of hydrogen i consumption if a distributed ignition system is activated in the containment volume"

, Tests were performed using two hydrogen release histories typical of core degradation associated with l a severe accident. These profiles were scaled to represent an initially rapid hydrogen release over 1600 l seconds with a hydrogen release rate peak in the range of 0.24 to 0.48 kg/sec. A residual hydrogen release rate was also modeled with prototypic constant production rate of 0.07 kg/sec for 11,200 seconds.

These values are generally typical of a realistic core degradation process in System 80+. In this design hydrogen will be rapidly released during a core degradation process over a period of about one half hour.

In this time between 30 and 50 percent of the core can be oxidized and hydrogen release rates can be on the order of 0.26 to 0.43 kg/sec. Thus, hydrogen release rates typical of the test are in close agreement for a similar driving function for System 80+.

Tests with Hydrogen Released Through the Suppression Pool  !

l I

Several experiments were performed with hydrogen released through the suppression pool. In these circumstances the original ignition was observed at the HCU floor (ceiling above the suppression pool).

O\!

Approveef Design Motorial ProbabMstic frisk Assessment Page 19.11K-10 j i

Sy: tem l'O+ Design controlDocument The flame ultimately anchored to the suppression pool surface as a steady diffusion flame. As oxygen depleted from these regions the flame was observed to lift to the HCU floor. Several aspects of these test observations are consistent with System 80+. First the IRWST in System 80+ is expected to ultimately be an oxygen depleted region. Consequently, diffusion flames on the pool surface per se are not expected. However, anchoring of diffusion flames at the exit of the IRWST vents is expected.

Should the flame lift from the IRWST vents, the flame will expand into the SG chimney areas and be transported to the upper containment as a hydrogen depleted mixture. Diffusion flames were observed to maintain the containment concentration to about 5% by volume. Steam concentrations during these tests were about 10% to 15% by volume.

Impact of Reduction in Igniter Availability" HCOG test S-13 investigated the importance of the number ofigniters on the overall system performance.

In this experiment only 18 of the 48 simulated system igniters were powered. Based on a comparison of S-13 to its counterpan experiment, the HCOG investigators concluded that " deactivation of 29 .

igniters had no significant effect on .... combustion phenomena".

Observations Regarding Mixing" HCOG cxperiments resulted in " excellent" hydrogen mixing both before and after hydrogen ignition.

A review of the data showed no evidence of localized hydrogen accumulations.

5.0 Hydrogen Igniter Placement Guidelines for System 80+

0 Thts section summarizes the goals and guidance used in establishing the design for the System 80+

Hydrogen Mitigation System (HMS). The HMS consists of a system of igniters installed in the containment to promote the combustion of hydrogen in a controlled manner so as to maintain the average containment hydrogen concentration below the threshold value for potential detonation.

5.1 HMS Design Goals j The cost effectiveness of HMS for existing large dry PWRs (Zion and Surry) has been studied by the NRC(s). Based on these studies the hydrogen igniters were not found to be a cost-effective accident mitigation measure for either plant. This conclusion was based on several factors including low zircaloy content in the core (limited hydrogen production potential), and relatively low core damage frequency for these plants and requirements associated with the "Backfit Rule" (10 CFR 50.109). Even stronger arguments regarding the " low cost-benefit" of the HMS can be advanced for System 80+. System 80+

has a low core melt frequency and a low conditional containment failure probability. However, the HMS  ;

is included in the plant design basis since System 80+ is an evolutionary ALWR.

A number of high level design goab were established in the design of the System 80+ HMS. These goals were established so that the scope of the HMS would be clearly defined. The HMS design goals include-I

1. The igniter system is designed such that the global hydrogen concentration will be below 8% by volume and local hydrogen concentrations for containment volumes away from the hydrogen Q source can be maintained below 10% by volume. In the event no detonations occur, containment  ;

N.)  !

Innrennt Design Motoriel- Pt"" tic Misk Assessment Page 19.11K-11 1

I l

System 80+ Design ControlDocument integrity is assured since the peak AICC burn pressures is below the ASME service Level C limit for the System 80+ containtent (See Section 19.11.4).

2. In the event local concentrations in containment sub-volumes or small rooms exceed 10% by volume near the hydrogen source, the resulting mixture is either: not detonable (either via steam inening or oxygen depletion) or, a detonation in the region will not result in a threat to containment integrity.

The first criteria limits the global threat to the containment to well within the structural capability. The second goal is intended to ensure that containment integrity is not compromised on a local basis.

Based on limited testing of the Mark Ill igniter system, the above goals appear to be easily achievable, and in fact, the actual System 80+ HMS is expected to limit hydrogen concentrations to an average of 5% to 7% by volun:e.

5.2 HMS Placernent Criteria In order to design the HMS several issues were addressed to ensure that the system is reliable, maintainable, and cost-effective. Additional placement criteria were established based on observations of igniter and hydrogen distribution experiments described in Section 4 above. The HMS design criteria are summarized in Table 19.llK-3 and are briefly discussed below.

Reliability The issue of reliability includes system availability issues such as alternate power supplies, and redundancy. Details of the Igniter System can be found in Section 6.2.5. To ensure the HMS is highly reliable, the following criteria were established:

1. Igniters should be available in redundant pairs.

Igniters are to be placed, in general, in regions with at least one pair of igniters in each designated region where hydrogen control is desired. Paired igniters will be powered from separate power supply divisions. The intent of the redundant system is to control containment hydrogen concentration with only one-half of the HMS igniters operational.

2. HMS power will be diverse and redundant.

This is accomplished by providing power to the HMS igniters via offsite power, emergency diesels and the combustion turbine generator. A minimal subset of the HMS igniters (approximately 34 igniters) is to be powered off Class IE Division batteries. Sufficient power is available in the station batteries to ensure operation of one4talf of the HMS igniters for a period of four hours. As identified in Item 1, partial operation of the HMS will be adequate to accomplish the System 80+ hydrogen control objective of preventing a potential detonation within the containment following a severe accident.

Maintainability Experience on the Duke Ice Condenser PWR units have demonstrated that cost-efficiency of the HMS will be associated with ability of the plant staff to maintain and test the igniters. The System 80+

igniters have been located with consideration of maintainability. Maintainability criteria are associated with locating igniters in accessible (and low radiation) areas and on existing walls, assuring that all Approved Design Mstwief Probab&stic hsk Assessment Pope 19.11K-12

System 80 + Design ControlDocument

()

,~

igniters can be tested and replaced without excessive manpower costs, limiting igniter placement in the

' IRWST, and designing IRWST igniters to be removable for testing and maintenance without requiring IRWST entry.

Technical Placement Criteria The above criteria provide overall guidance in t' e general manner in which the HIS igniters are to be placed. In this section the specific criteria for placement of the igniters within the containment are defined along with a brief discussion of the basis.

1. Flowpath Requirements The System 80+ igniter placement guidelines are defined in Table 19.11K-3. Several criteria specifically relate to the placement of the igniters with respect to the system flowpaths and sources. These criteria require the placement of igniters along dominant flowpaths, abcve hydrogen sources, along secondary flowpaths, and at multiple burn levels above likely burn locatiens.

These criteria are generally derived from a combination of engineering judgement supported by j experimental evidence and plant analyses. Hydrogen ignition tests discussed above have generally i indicated that to be most effective igniters should be above the hydrogen source. This will  ;

maximize the hydrogen consumption while maintaining the global hydrogen concentration in the containment low. This was observed in the Mark III 1:4 scale experiments as well as the large p scale NTS facility.

\

In addition the above criteria also suggest the importance of identifying and providing ignition sources along important flow paths. The primary need for igniting these regions is to aid in the consumption of hydrogen which, either due to the initial igniter location or local steam inerting effects, is not initially burned. This hydrogen will be transponed to upper containment regions.

In the System 80+ design, the dominant flowpath for hydrogen transport in containment will be up through the " chimney" created by the steam generator enclosures. Secondary flowpaths may also develop which connect the reactor cavity to the upper containment through the reactor cavity annulus and manway. Thus, ignition sources are to be provided along these paths.

2. Consideration of Enclosed Spaces Enclosed spaces may become regions of high hydrogen concentration. Typically, enclosed regions are a concern if they can become the source of a hydrogen release. All such enclosed spaces in the System 80+ containment are vented. In order to ensure detonable hydrogen accumulations do not develop, all System 80+ enclosed spaces are supplied with a minimum of one pair of igniters.

3. Igniter Spacing and Location Below Ceilings General rules for igniter spacing and placement were established based on a review of existing hydrogen ignition data. These mies were: -

/%

AMrmed Design hiatuniel* Probabnistic Misk Assessment Page 19.11K-13

Srtem 80+ Design ControlDocument e Igniters can be separated by 50-75 feet This allows a single igniter pair placement per floor in the steam generator compartment and minimizes the number of igniters required in the upper dome. NTS tests demonstrate that the hydrogen concentration in large open regions can be controlled by a single 3

igniter. The typical volume in the NTS test facility was about 75,000 ft with a diameter of about 50 feet.

e Igniters should be located at least 10 feet below the ceiling This criteria encourages upward burning and maximizes the per igniter hydrogen consumption in the vicinity of the source. This recommendation is based on observations in various hydrogen ignition tests which noted that upward burning occurred at lower hydrogen concer.trations than either sidewards or downwards burning. Consequently, when feasible igniters should be placed many feet below obstructions (such as ceilings).

Typically,10 feet is expected to be sufficient to allow upward combustion alone to consume hydrogen at a sufficient rate.

6.0 Hydrogen Mitigation System This section provides details of the HMS igniter design, placement and operation. The HMS is designed to accommodate the hydrogen production from 100% active fuel clad metal-watar reaction and limit the containment average hydrogen concentration to 10% in accordance with 10 CFR 50.34(f) for a severe accident. A detailed description of the System 80+ HMS is provided in Section 6.2.5.

6.1 Igniter Placement The System 80+ containment utilizes eighty (80) shielded GMAC model 7G thermal igniter glow plug controlling hydrogen in approximately forty containment regions. This igniter glow plug has been extensively tested, and is incorporated in the igniter system for the GE Mark Ill containment and several Westinghouse PWRs with ice condenser containments. Each igniter is powered by a 120/14 V step-down transformer designed to provide a minimum surface temperature of 1700*F.

The level of igniter coverage provided within the System 80+ containment is consistent with the 90 igniters employed in the Grand Gulf design and the 68 established for the Sequoyah ice condenser PWR.

Igniter systems designs for Zion and Surry large dry PWRs included 76 igniters. Table 19.llK-4 sununarizes the System 80+ igniter placement. Detailed three-dimensional placement drawings for these igniters are presented in Figures 6.2.5-6 through 6.2.5-9.

6.2 Igniter Power Supply in order to assure high igniter availability, the igniters are powered from several independent Class IE power sources. All eighty igniters may be powered via (1) offsite power source, (2) emergency diesel generators, and (3) alternate AC power source (combustion turbine generator). A minimten of 34 igniters can be powered from station batteries (17 each via cach emergency bus as identified in Taole 19.1IK-4).

The station batteries can provide four hours of power for operation of these igniters. As discussed in l Section 7.0, MAAP analyses suggest that approximately two (2) hours of igniter operation is sufficient to burn off enough hydrogen to limit the global containment hydrogen concentration to below 10% by vohime for a 100% active fuel clad oxidation severe accident scenario.

Approsed Design Material- ProbaMastic Risk Assessment Page 19.11K-14

System 80+ Deslan ControlDocument 6.3 IRWST Pressure Relief Dampers In addition to the igniter placement and power supply, another essential feature of the HMS is the IRWST pressure relief dampers. The pressure relief dampers are located in the IRWST cover for overpressure protection. These are also used to aid in the removal of hydrogen from the IRWST so that the hydrogen passing through the tank may be burned elsewhere. A description of the IRWST pressure relief dampers is provided in Section 6.8.2.2.4. These consist of four vents connecting the IRWST with the lower containment. The vents are located within the steam generator wing walls, and provide a total free flow area of 200 ft2, a

The 200 ft2 vent area is considered sufficient to maintain the hydrogen concentration in the IRWST freeboard space to about 10% by volume during a severe accident, except for short durations when the concentrations could be at a slightly higher value. However, the steam and oxygen concentrations within the IRWST for these shon durations would be such that even at these higher hydrogen concentrations, the steam, air and hydrogen mixture is not likely to be detonable.

The selection of the 200 ft:IRWST vent area is based on maximizing the venting capability of the IRWST while simultaneously minimizing the adverse impact of larger vents on plant safety and operational aspects, Specific factors that were of concern in limiting the vent size include:

I. Cleanliness and Boration of IRWST Water Leakage through the vents and/or failure of the vents to remain closed can introduce contaminants / debris and unborated water into the IRWST. Increased IRWST vent size could O. exacerbate this threat. Limiting the total IRWST vent size and designing the dampers to prevent water from entering the IRWST pool via the dampers, ensure that water enters the IRWST

,_ through the Holdup Volume Tank (HVT). This will result in accurate monitoring of unidentified

! containment leakage and utilization of trisodium phosphate baskets in the HVT for pH control

during design basis accidents. j

[ 2. Maximize Equipment Laydown Space and Accessibility

Increased IRWST vent size can adversely impact maintenance operations by minimizing the laydown space available and restricting personnel accessibility at the 91 +9 elevation. Therefore, 4

the IRWST vent size was minimized to reduce the impact on maintenance operations.

3. Minimize Humidity Loads on the Containment

, The IRWST vents also allow water evaporated from the IRWST pool surface to enter the containment atmosphere. This process will increase the humidity level in the containment and consequently increase the potential for material corrosion. Therefore, the IRWST vent size was minimized to reduce this potential.

6.4 Igniter Accessibility and Maintenance All hydrogen igniters have been evaluated for required access for testing and maintenance. The most

. inaccessible igniter locations are in the containment dome. These igniters can be reached from the polar

! crane with a temporary scaffolding / ladder arrangement. Igniters in the steam generator cubicles are placed to allow access from existing platforms. Igniters in the IRWST utilize tubes in the IRWST cover

, to allow the igniter assembly to be retracted to the 91 +9 elevation for testing and maintenance without Somed omeon anemier nosasnune mek Auenamt rese re.11x.ss

System 80+ Design ControlDocument requiring IRWST entry. Igniters are generally located 7 to 10 feet above floors to allow easy access without impeding personnel passage or becoming a personnel safety hazard.

7.0 Igniter System Verification This section summarizes the MAAP 4 containment analyses performed to assess the System 80+ HMS.

The MAAP 4 code was used to study hydrogen mixing and combustion in the System 80+ containment.

The study assessed the potential for hydrogen build-up in the containment and to calculate the best-estimate response of the HMS.

MAAP 4

• contains a state-of-the-art lumped parameter model for containment thermal-hydraulics. The model was specially constructed to simulate na: cal circulation in advanced light water reactor containments. Key elements of the model used for the hydrogen calculations for System 80+ are as follows:

e Mechanistic, semi-implicit models for gas, water, and energy transport between control volumes, o models for both unidirectional and counter current flowC* through containment junctions, e stable treatment of water-solid regions; these can develop in System 80+ calculations if the IRWST pool is sub-nodalized or if the cavity flooding system is activated, e flexible modelling of containment heat sinks, and

• advanced modelling of hydrogen combustion. Both non-global burns initiated by the hydrogen igniters and global burns are treated using a single, unified framework. This model has been successfully compared to a great variety of experiments".

7.1 Construction of Plant Model l A detailed (23 control volumes,35 junctions, and 37 heat sinks) containment model was constructed.

Considerable effort was taken to minimize artificial mixing which can be caused by the limitations inherent in lumped parameter containment codes.

Calculations were performal using the number and location of the igniters presented in Table 19.11K-4.

2 In addition the MAAP 4 simulations employed an IRWST vent area of 200 ft ,

A recent intemational Standard Problem (ISP-79) tested the ability of various lumped parameter codes to predict hydrogen concentrations in the HDR containment during experiment Ell.2. The results indicated that all the codes tended to over-predict mixing"": whereas, very little hydrogen was measured below the elevation at which the hydrogen was injected, the codes predicted substantial mixing.

Part of this tendency to over-predict mixing is a consequence of inherent assumptions used in lumped parameter codes, i.e. the fact that control volumes are assumed to be well-mixed can lead to numerical diffusion. Ilowever, these problems can at least be minimized by careful constmetion of the containment model. For example, the effects of numerical diffusion were reduced in this study by employing a relatively large number of nodes.

O Apyweved Design Material Probabmstic Risk Assessment (2/9 51 Page 19.11K 16

System 80+ Design ControlDocument More important, in the original System 80+ model it was observed that a null transient (no source of mass or energy to the containment) resulted in persi tent gas flow rates on the order of 1 kg/sec or more.

This was found to be caused by the assumption of uniform density in each node if the node boundaries of inter-connected nodes were defined in such a way that they overlapped. By adjusting the control volume boundaries and junction elevations slightly, these

• phantom flows" were reduced to less than 1 gram /second during null transients.

To confirm the success of the renodalization effort, a special case of the System 80+ model was created that eliminated reactor vessel convective heat transfer to the reactor cavity and which established a large return flow path from the refueling pool area to the lower companment region. The former was done to climinate (physically reasonable) gas flows through the cavity which are caused by the " chimney" effect that vessel heating creates in the cavity. The second change allows the large hydrostatic heads which develop between the steam generator compartments and the upper compartment and refueling pool area (caused by convective heating and the introduction of hydrogen) to cause return flows which do not involve the lower cavity region. Both changes were intended to mimic the HDR situation. For this case, a high degree of stratification was calculated to be maintained between the bulk of containment (above the hydrogen injection point) and the lower reactor cavity (which lies below). This is analogous to the behavior observed in experiment Ell.2 and affords added confidence in the results of the MAAP 4 calculations.

The use of a large number of control volumes also allowed the igniter placement relative to the hydrogen igniter points to be represented in a detailed fashion.

/3 7.2 Methodology V

A special version of MAAP 3.08, which modelled features specific to the System 80+ design, was used ,

in the PRA to calculate primary system and containment response daring severe accidents (see Section 19.11.5). To avoid the need to modify MAAP 4 to represent the special features of the System 80+

primary system, hydrogen and steam flow rates, and energy transfer rates from the primary system were i calculated with MAAP 3.0B and these were then fed into the MAAP 4 containment model, i The procedure used to perform a calculation consisted of several steps:

1. A calculation was made using the standard MAAP 3.0B model for System 80+. Steam and hydrogen flow to the containment as well as convective energy transfer between RCS heat inks and the containment were stored in a file as functions of time.

2. For these calculations, approximately 2400 lbm of hydrogen, equivalent to reacting 100% of the active cladding (total zirconium mass of 55,656 lbm), was introduced into containment. To generate the full 2400 lbm of hydrogen in the core, it was necessary to increase the MAAP-predicted hydrogen generation by a factor between 1.5 and 1.75, depending on the accident sequence. To accomplish this in a manner which would not unduly distort the containment response, the period of core damage was extended by adding a " residual" to the calculated hydrogen release curve. The hydrogen release rate during this period was set equal to the average MAAPcalculated hydrogen release over the period of core damage

(~ 0.2 kg/sec), and the length of the " residual" was determined by the total additional hydrogen n mass that was needed to bring the in-vessel oxidation to 100 percent of the active cladding. No

) steam was released during this interval, i.e. the reaction was assumed to be steam-limited during (O this time, and vessel failure was assumed to occur at the end of this extension.

Approwest Design Matene!- ProbebDste Risk Assessment Pope 19.11K 17

System C0 + Design controlDocument

3. These quantities were then fed into the MAAP 4 containment model, Cases with igniters operational and igniters disabled were considered separately. Hydwgen combustion in control volumes not containing igniters was suppressed; this is gain conservative with respect to hydrogen concentrations, since combustion initiating at an igniter could easily propagate into horizontally-adjacent or higher nodes having hydrogen concentrations in excess of about 6 percent %

4. At vessel failure, the entire debris mass was released to the cavity (node 1) over a 10 second interval. The hydrogen, steam, and water present in the RCS at vessel failure in the MAAP 3.0B calculations were released into the cavity over a 30 second interval. The intent was to capture approximately the impact of the blowdown on the steam concentiations. Finally, the portion of the accumulator water that was still in the accumulators at vessel failure in the MAAP 3.0B calculation was released to the cavity over a 60 second interval.

The accident sequences represented were a station blackout (SBO) with activation of the safety depressurization system and a small break LOCA (SBLOCA) with no safety injection and no safety depressurization system activation. Contaimnent spray and igniter availability were varied in all three sequences. That is, some of the sequences are "SBO-like" with regard to the primary system, but containment sprays and igniters may still be available. Debris dispersal was not modelled in these hydrogen distribution calculations, and activation of the cavity flooding system was not considered.

7.3 Results of Calculations Several calculations were performed. To some degree, this reflects changes in the IRWST vent area and location and the number and location v igniters that occurred while the analyses were being performed.

A variety of sensitivity calculations were also run.

A few of the key calculations are summarized in the subsections below. Key results of the base cases are presented in Tables 19.llK-5 and 19.llK-6.

7.3.1 Model Verification Cases As discussed above, two cases were run to verify the containment nodalization. The first was the null transient. This case was designed to show that persistent flow would not develop in the absence of heat or mass addition to containment. All of the containment nodes were initialized to the same pressure, temperature, and humidity. The heat sinks were also initialized to the same temperature. Further, the IRWST was initialized without water to prevent evaporation from driving flow. As expected for this case, the contaimnent quickly reached equilibrium, and gas flow was stopped.

The second case was an attempt to approximately simulate llDR-like experimental conditions in System 80+ to demonstrate the ability of the model to predict global stratification. As discussed previously, in this case there was no convective heat input to containment, and the hydrogen / steam source was introduced in a node above the cavity. The upper portion of containment was calculated to be fairly well mixed, while the cavity contained a much lower hydrogen concentration.

7.3.2 Small Break LOCA Cases In these cases the primary system behaved as it would during a small break LOCA. Steam and hydrogen were released continuously to the lower steam generator area via a broken pipe. At vessel failure, a small ANweved Destyn ntatorial. Probabilistic Risk Assessment Pope 19.11K 18

System 80 + Design controlDocument (n)

~

mass of remaining hydrogen in the reactor vessel was released to the reactor cavity. The total hydrogen released was equivalent to reacting 100% of the active fuel cladding.

1. In the case without igniters available, there were no hydrogen burns. Prior to vessel failure, the hydrogen concentration in the bulk of containment was about 10% by volume. In the node that contained the SBLOCA, a hydrogen concentration peak of 11 % by volume was observed. The IRWST behaved similar to the bulk of containment. There were no hydrogen concentration spikes at vessel failure. After vessel failure, the containment mixed fairly well to obtain a 8%

by volume hydrogen concentration everywhere.

j 2. In the case with igniters available, a total of 500 kg of hydrogen was burned. Prior to vessel failure, the hydrogen concentration outside the SBLOCA node was sustained at 6% by volume.

In the node which contained the break peaks as high as 9% by volume were observed, while the sustained concentration was closer to 7 % by volume. Prior to vessel failure, the IRWST behaved

( similar to the bulk of containment. At vessel failure there were no hydrogen concentration spikes. The hydrogen in the bulk of containment then mixed to a uniform 5% by volume level; however the concentration in the IRWST remained at 6% by volume.

3. In the case with igniters and containment sprays available, a total of 600 kg of hydrogen was burned. The sprays were started shortly after the SBLOCA occurred; water from the IRWST was sprayed into the dome at a rate of 200 kg/sec. The hydrogen concentration behavior was similar to the non-spray case, with two exceptions. In the node containing the SBLOCA the peaks never exceeded 7% by volume and the sustained value was 6% by volume; and the IRWST

~N concentration followed the node with the break rather than the bulk of containment. This is (V attributed to the large sustained inter-node flows driven by the effect of the sprays.

7,3.3 Station Blackout with SDS Activation In these cases the primary system behaved as it would during an extended SBO. Steam and hydrogen were released continuously to the IRWST via an open SDS valve. The valve was opened at the time of the first pressurizer safety valve actuation, i.e., well before the core became uncovered. At vessel failure, a small quantity of remaining hydrogen in the RCS was released to the reactor cavity. The total hydrogen released was equivalent to reacting 100% of the active fuel cladding.

l

1. In the case without igniters available, there were no hydrogen burns. Prior to vessel failure, the hydrogen concentration in the bulk of containment built up to about 11% by volume. In the nodes directly above the IRWST, the hydrogen concentrations were as high as 15 % by volume, and peaks of 31% by volume were observed in the IRWST. After vessel failure, containment nodes mixed to obtain a final hydrogen concentration of between 8% by volume and 9% by volume. The cavity, however, maintained a concentration of 5% by volume.

2. In the case with igniters available, a total of 700 kg of hydrogen was burned. Prior to vessel failure, the hydrogen concentration outside the IRWST built up to about 5% by volume. In the IRWST, peak values of just above 15% by volume were observed, with an average value of I about 10% by volume. After vessel failure, containment hydrogen levels dropped to I approximately 4% by volume everywhere in containment.

Combustion at the igniters served to limit the hydrogen concentrations in the IRWST. In the (A") M AAP model, this requires that steam concentrations be below about 55% by volume and oxygen concentrations be above 5% by volume. Both of these requirements can potentially limit igniter AssuonniDesign Ataternal hobabastic Msk Assessment Page 19.11K 19

._ j

System 80+ Design ControlDocument effectiveness. Of course, if the IRWST does become inerted, there is no threat posed by hydrogen build-up, assuming that the igniters remam operational when the atmosphere becomes de-inerted later.

Iland calculations indicate that, for all practical purposes, the lower set of IRWST spargers would be utilizedjust as effectively as the upper set. Since the lower set of spargers are near the bottom of the tank, it was assumed in these analyses that the bulk of the IRWST would heat uniformly.

This would also be promoted if the containment sprays were in operation, since they draw from near the bottom of the tank, or if IRWST cooling is effective.

3. In the case with both igniters and sprays available, a total of 700 kg hydrogen was burned. As soon as the sprays were started, the containment began to mix vigorously, and a hydrogen concentration of 4% to 5% by volume was rapidly achieved. IRWST hydrogen concentration was sustained at 9% by volume. After vessel failure, the entire containment mixed to a constant 4% hydrogen concentration in all nodes.

7.4 Summary of Analyses if igniters are provided in the containment, hydrogen concentrations outside the IRWST are less than about 10% by volume at all times. As expected, hydrogen concentrations are lower than this away from the control volumes containing the IRWST vents and the primary system break, if any. If sprays are in operation, hydrogen concentrations are limited to 9% by volume. This is attributed to the incra e in effectiveness of the igniters at low steam concentrations and the more effective inter-node nJxing promoted by the operation of the sprays and local combustion.

Igniter effectiveness in the IRWST is sensitive to both steam and oxygen concentrations. Both are considered somewhat uncertain, but the uncertainties act in a direction that would make the mixture non-flammable so as to not present a threat. In these calculations, combustion in the IRWST was limited by oxygen availability. Natural convection of oxygen to the IRWST was induced by the competing effects of hydrogen injection to the IRWST and convective heating of the containment atmosphere above the IRWST. The calculated flow rates were sufficiently high to maintain combustion at a level that would limit hydrogen concentrations to below approximately 10% by volume.

8.0 Hydrogen Detonation Issues This section addresses ancillary concerns associated with the design and operation of the System 80+

llMS.

8.1 Detonation and Containment Survivability As discussed in Section 3.0 of this appendix, even without the availability of an IIMS, the accumulation of high concentrations of hydrogen in the System 80+ containment is unlikely due to its large free volume. Further, the basic geometric features of System 80+, are at worst " neutral" to the onset of a detonation via the DDT process and more likely are not conducive to DDT. Based on the simplified Sherman and Berman Ranking Scheme a DDT condition is unlikely. This conclusion is particularly true for situations with high steam availability in the containment atmosphere. Consequently, detonation within the System 80+ containment is not considered credible. Further issues associated with the ability of the major containment structures to survive local detonation loadings are presented below.

Asyvevent Design hteteriel />obab&stic Rusk Assessment Page 19.11K-20

System 80+ Design controlDocument 8.1.1 Containment Detonation Loading During a severe accident, the RCS will release hydrogen at a relatively low point in the containment.

All releases to the IRWST and late hydrogen releases via the reactor cavity will enter the bulk containment at or slightly above the 91'-9" elevation. For direct containment releases via the RCS hydrogen will tvpically enter the containment below the 115 foot elevation. These elevations are sufficiently low so as to promote a well mixed containment atmosphere throughout the event.

Consequently, concentration gradients are only expected in the vicinity of the source.

Sources of hydrogen are typically limited to RCS piping including pressurizer surgeline, and IRWST vents. These sources are located within the crane wall. Consequently, the potential for locally detonable mixtures will be in the vicinity of the lower crane wall, pressurizer compartment and the lower portion of the steam generator companments. An assessment of local detonation loadings for these structures have been performed using the approximate TNT equivalent methodology defined in References 32 and

33. In this analysis, the potential energy release associated with the detonation of a cloud of hydrogen is related to an equivalent TNT point charge and the TNT detonation characteristics are scaled for considention of the propenies of the propagating medium (compared to dry air) and distance of the

s. ucture in question from the point source. In this evaluation the hydrogen gas cloud is assumed to be 50 ~; 5 dameter. The loadings were evaluated 25 feet from the point source. Local hydrogen concentrations from 10 to 15% by volume were considered. Estimated peak pressures, pulse durations and integrated impulse are presented in Table 19.llK-7.

The net impulse loading associated with localized detonations, while sufficient to cause damage to the walls of the internal structures, are not expected to compromise the structural integrity of the massive suppons residing within the IRWST. Sim.e all potential detonations are anticipated within the crane wall, the generated shock loadings will not directly impinge upon the containment shell. Therefore, no threat to containment integrity is anticipated. Funher, the lower mode response frequencies of the containment shell are more than an order of magnitude lower than that associated with the impulse. Thus, dynamic damping of any imposed loading is expected.

Confirmation of the above conclusion is provided by dynamic structural analyses for steel containments performed by Ames Laboratory". These analyses included investigations of spherical containments of similar design to System 80+. Specifically, the analyses indicated that containment integrity is maintained for dynamic impulses as high as 0.69g psi-sec. This value is higher than the bounding detonation loads presented in Table 19.llK-7.

8.2 Condensation Induced Detonation l

One serious concern with regard to the operation of igniters, is the potential system response following a rapid spray induced condensation of steam late in a severe accident scenario. This situation may arise l as a consequence of spray tecovery in a sequence where the steam inening prevented proper operation l of the igniters. Thus, high hydrogen: air concentrations, will develop along with low steam concentration. Ignition of this mixture is vinually assured via the HMS.

Experimental evidence to date does not justify condensation induced detonation. Hydrogen combustion experiments performed in the presence of a condensing environment indicate that igniters will initiate combustion in the form of a deflagration as the mixture passes through the mixture flammability limit.

While these experiments are not prototypical of System 80+, it is believed to be generally applicable to reactors provided the condensation process is over a several minute, as opposed to several second, time interval. Intervals of several minutes are nearly quasi-steady from the viewpoint of combustion initiation.

? , A DeeQrr asesenief. hebebneaic Misk Assessment Pege 19.11K-21

System 80+ Design ControlDocument Analyses performed for System 80+ confirm that for the " worst case" limiting assumptions of a localized condensation from a minimum inserted steam state, to a potentially detonable state indicate the system will take over 3.5 minutes prior to becoming minimally detonable. Consequently, deflagrations have sufficient time to precede detonations.

The issue of condensation induced detonation has been investigated by Nourbakhsh et al". This investigation concluded that if an initially steam inerted hydrogen-air-steam environment is slowly (on the order of several minutes) brought into a flammable range by spray conde sation of steam and if ignition sources are present, the inerted region passes through a weakly flammable mixture prior to entering the detonation region. Consequently, it was concluded that a detonation is highly unlikely under these conditions.

9.0 Conclusions A large number of hydrogen igniters are installed within the System 80+ containment based on specific igniter placement guidelines. MAAP 4 analyses have determined that operation of these igniters helps to maintain the hydrogen concentrations below detonable levels throughout the containment during limiting severe accident sce narios. Potential detonation issues have also been addressed. The results of evaluations indicated that (a) condensation induced detonation is highly unlikely, and (b) in the unlikely event of a detonation, the bounding System 80+ hydrogen detonation loads are lower than the detonation loads that would threaten the containment integrity. Therefore, it is concluded that the System 80+

containment design would accommodate limiting severe accident scenarios involving significant hydrogen generation without creating conditions that would threaten its integrity.

10.0 References

1. 10 CFR 50.44, " Standards for Combustible Gas Control System in Light Water Cooled Power Reactors."

2. SECY-88-147, " Integration Plan for Closure of Severe Accident Issues," May 25,1988.

3. SECY-90-016. " Evolutionary Light Water Reactor (LWR) Certification Issues and Their Relationship to Current Regulatory Requirements," January 12, 1990.

4. SECY-93-087, " Policy, Technical, and Licensing issues Pertaining to Evolutionary and Advanced Light Water Reactor (ALWR) Designs," April 2,1993.

5. 10 CFR 50.34(f), " Additional TMI Related Requirements "

6. EPRI, " Utility Requirements Document."

7. B. Lewis, G. Von Elbe, Combustion, Flames and the Explosion of Gases Academic Press, New York,1961.

8. NUREG/DR-5662, " Hydrogen Combustion, Control and Value Impact . Analysis for PWR Dry Containments," Yang, J.W., et al., May 1991.

O Attwoved Design Afstenial IVobab&stic Risk Assessment Page 19.11K 22

-.y i ' System 80+ Design ControlDocument i

-F

9. NUREG/CR-5275, Sherman, et al., " FLAME Facility; The Effects of Obstacles and Transverse

' Venting on Flame ~ Acceleration and Transition to Detonation for Hydrogen-Air Mixtures at Large  ;

Scale," April 1989.  ;

10. NUREG-1370, Appendix G, " Technical Aspects of Hydrogen Control and Combustion in Severe  !

j Light Water Reactor Accidents," (A report prepared by the Committee'on Hydrogen Combustion, l Energy-Engineering Board, Commission on Engineering and Technical Systems ' National .

Research Council) National Academy Press,1987.  !

O -

i 11. Dorofeev, S. " Experimental Results and Analysis on Hydrogen Combustion Behavior," CSARP meeting, Bethesda, MD, May 1993. _{

12. Shepard, J. E., Hydrogen Concentration Limits for Proposed New Designs of Nuclear Power  ;

Plants, Paper Prepared for the NRC, January 5,1990.  !

13. Berman, M., Sherman. -M., "The Possibility of Local Detonations During Degraded Core ,

Accidents in the Bellefonte Nuclear Power Plant," Nuclear Technology, Vol 81, p63, April 1988. j t

14. NUREG/CR-5567, "PWR Dry Containment issue Characterization," Wang, J. W., August 1990. ,

( ]

15. Goldstein, S., Forestier, A., "On Two Aspects of Hydrogen Risk," Proceedings of the Third -j

j. Workshop on Containment Integrity, NUREG/CP-0076, August 1986.

16. ' NEA/CSNI/R(93)/4, International Standard Problem 29, " Distribution of Hydrogen Within the HDR Containment Under Severe Accident Conditions," February 1993.

17. Valencia, L.A., " Hydrogen Distribotion Tests Under Severe Accident Conditions at the Large

- Scale HDR Facility," Nuclear Engineering and Design, Volume 140.

I

18. "Recent Results of NUPEC's Hydrogen Distribution Test," Ogino, M., CSARP Review Meeting, Bethesda, Maryland, May 1993.  ;

< 1

19. NUREG/CR-5079, " Experimental Results Pertaining to the Performance of Thermal Igniters,"

Carmel, M., October 1989.

20. EPRI-NP-5254, " Effectiveness of Thermal Ignition Devices in Rich Hydrogen-Air-Steam j Mixtures," Tamm, H., et al., July 1987. l

21. NUREG/CP-0120, " Overview of NUPEC Containment Integrity Program," Takunu, K., Fifth Workshop on Containment Integrity, May 1992.

22. NUREG/CP-0076, " Hydrogen Deflagration Tests in HYDRO-SC Facility," Fineschi, et. al.,

Proceedings of the Third Workshop on Containment Integrity, August 1986. 1 l

23. Tamanini, F., et al., " Hydrogen Combustion Experiments in a 1/4 Scale Model of a Nuclear i Power Plant Containment," 22nd Symposium on Combustion,1988.

'24. SAND 92-0541, " Loads from the Detonation of Hydrogen-Air-Steam Mixtures," Tieszen, S. R.,

et al., July 1992.

1 W W M

• Melt hbk Aseeeeneant Pace 19.11K.23 l

_ - - _ _ _ _ _ . - _-.__ . - . - , i

System 80+ Design ControlDocument

25. APR-NP-7045M, " Hydrogen Combustion Experiments in a 1:4 Scale Model of a Mark HI Nuclear Reactor Containment: Final Report: Volume I: Test Program and Review,"

Tamanini, F., et al., January 1988.

26. APR-NP-7044M, " Hydrogen Combustion Experiments in a 1:4 Scale Model of a Mark III Nuclear Reactor Containment: Scoping Test Report," Hosler, J., Haugh, J., July,1986.

27. NUREG-1417, " Safety Evaluation Report: related to Hydrogen Control Owner's Group Assessment of Mark 111 Containments," USNRC, October,1990.

28. Fauske and Associates Inc., MAAP 4 User's Manual, draft, March 1992.

29. M. Epstein and M. A. Kenton, " Combined Natural Convection and Forced Flow Through Small Openings in a Horizontal Partition, With Special Reference to Flows in Multi-compartment Enclosures," Journal of Heat Transfer, Ill, pp 980-987, November 1989.

30. M. G. Plys and R. D. Astleford, Modifications for the Development of the MAAP-DOE Code-Volume III: A Mechanistic Model for Combustion in Integrated Accident Analysis, Task 3.4.5, DOE /ID-10216, Vol. 3, November 1988.

31. OECD Nuclear Energy Agency. International Standard Problem 29 Distribution of Hydrogen within the HDR Containment Under Severe Accident Conditions, Final Comparison Report, NEA/CSN1/R(93)4, February 1993.

32. NUREG/CR-2462, " Capacity of Nuclear Power Plant Structures to Resist Blast Loadings," R.

G. Kennedy, et al., September 1983.

33. Cole, R. H., Underwater Exnlosions, Princeton University Press, Princeton, New Jersey,1948.

34. NUREG/CR-2442, " Reliability Analyses of Steel Containment Strength," Griemann, L. G., et al., Ames Laboratory, June 1982.

35. NUREG/CR-5982, BNL-NUREG-52354, " Effectiveness of Containment Sprays in Containment Management," Nourbakhsh, H. P., et al., May 1993.

O AppesvedDesign Acetonal Probab6sbic Stish Assessment Page 19.11K-24

System 80+ Design ControlDocument

/

Table 19.11K-1 Sherman/Berman Ranking Region Description RankUI 1 Containment upper dome 4,5 2 Volume inside crane wall and above refueling pool 3,4 3 Annular region outside crane wall above 115 ft elevation 3,4 4 HVAC distribution header 3 5 Reactor cavity 3 6 Cavity ventilation room 3,4 7 Reactor cavity annular gap 2 8 Refueling pool 4 9 Steam generator compartments 2,3 10 Pressurizer compartment 2 11 Holdup vohime 3 12 Letdown heat exchanger room 3 m

ll 13 Regenerative heat exchanger room 3 14 Volume inside crane wall between 91-9 and 115-6 elevations 3 l

UI Ranking Criteria:

l Class 1: Large partially confined geometry with obstacles in the path of expanding unburned gases l (geometry typically closed at one end).  !

Cass2: Similar geometry to class 1, but

• room

• may be open at both ends or transverse venting is available Class 3: Open regions without obstacles A

h Class 4: Large volumes with few obstacles and significant venting Class 5: Unconfined geometry fu . ; Deodon nietania! habeMnuaic Rink Assessment Page 19.11K-25

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ J

System 80+ Design ControlDocument Table 19.IIK-2 Summary of Pertinent Igniter Test Information h Test Series Volume Glow Mixture (M )

S Plug Experimental Findings Tested SNL FITS H 2/ Air / Steam 5.6 Y Fully lastrumented Test Facility (FITS)

Test Objectives:

Assess Combustion Characteristics and Flammability Limits of Severe Accident Containment Atmospheres Results:

1. Deflagrations Observed for Hydrogen: Air Mixtures with Up to a Greater Than 30% by Volume Hydrogen Concentration.

Note: More Than 70 Hydrogen-Air Burns Were Observed at Concentrations Greater Than 13& by Volume without the Initiation of a Detonation.

2. Detailed Flammability Curve Developed for 112 Air-Steam Mixtures. Tests Indicated That Steam Concentrations Greater Than 52% By Volume Inserted Burning

3. AICC Predicted Pressures Bounded Observed Prusurization VGES H;/ Air 5.1 Y Variable Geometry Experimental System (VGES)

Results:

1. Predicted AICC pressures bounded all observed hydrogen burns (hydrogen concentration tested up to 24% by volume)

2. Igniter location is imponant for the ignition of hydrogen-air mixtures below 8% by volume. At these lower concentrations movement of igniter upward reduced burn completeness in the volume since flame propagated upward.

3. A GM-AC Glow Plug needed a surface temperature of about 1330 F to ignite a lean hydrogen-air ' mixture

4. Water sprays greater than about 401/m 2/ min can render an unshielded glow plug ineffective. Glow plug performance can be assured by shielding the plug from direct water impingement.

O AMwoved Desbyn Atatenal. ProbatAstic Risk Assessenent Page 19.11K.26

l 4

Sy't m 80+ Design controlDocument

('T V Table 19.11K-2 Sununary of Pertinent Igniter Test Information (Cont'd.)

Test Volume Glow Series Mixture 3

(M ) Plug Experimental Findings Tested NTS II 2/ Air / Steam 2048 Y Nevada Test Site (NTS) 4 Test Objective: r Study hydrogen mixing and ignition processes

' and the survivability of safety related equipment in a large scale facility associated with burns in a hydrogen-air-steam tnixture Results:

1. Combustion completeness is associated

' with igniter placement at hydrogen concentrations below 7% by volume

2. Glow plugs could effectively ignite mixtures down to 5.2% by volume hydrogen

3. Ignition above 8% by volume was i

associated with complete combustion d

LLNL II 2/ Air / Steam 0.3 Y LLNL Experimental program Test Objective:

Evaluate use of the GIV AC 7g glow plug as a j j

deliberate ignition source for hydrogen-air-steam mixtures. ,

1 Study combustion phenomenology and effects of l steam and water fogs.

Results: 1 1

1. AICC predictions bounded pressures for all bums including hydrogen concentrations up to 16% by volume in dry air.

2. 11ydrogen bums were achieved at concentrations above 6% by volume.

Complete burns occuned at 8% by volume.

3. Volumetric steam concentrations in  ;

excess of 50% can inert the burning q process.

s Page 19.11K-27 i

?;;z.-- Deelptr Meteriel ho%bnishc Rink Assessment i

i i

System 80+ Design Control Document Table 19.11K-2 Sununary of Pertinent Igniter Test Information (Cont'd.)

Test Volume Glow Series Mixture 3 (M ) Plug Experimental Findings Tested i

4. Condensation tests with 10% by volume hydrogen did not result in a noticeable burn even though the igniter consumed the hydrogen as condensation proceeded below the 50% threshold.

5. GM ac 7g glow plug consistently ignited mixtures at surface temperatures between 700 and 800'C and showed no significant deterioration.

Whiteshell 11/

2 Air / Steam 17 liter Y Test Objective:

Confirm effectiveness of a deliberate ignition system in controlling hydrogen released during a severe accident.

Results:

1. For dry hydrogen-air with more than 5.5% By volume under quiescent conditions. Dry concentrations as low as 4.5% By volume could be ignited under turbulent conditions.

2. Presence of steam reduces combustion completeness

3. Steam condensation experiments indicated that deflagrations will occur prior to reaching a detonable condition Acurex 17.8 Test Objective:

Investigate effects of hydrogen and steam flowrates, igniter location and water sprays on the deliberate ignition of flammable containment atmospheres.

Results:

1. Locatior, of i;ititer effected completeness and tining of combustion. Both location of igoters at the bottom and top of the facility provided discrete bums with gre.ner magnitude. Location of igniters at the mid-span resulted in continuous low pressure burning of hydrogen.

l AMweved Design Material Probabustic Risk Assessment Page 19.11K 28

-- ~_.. . -

System 80+ Design ControlDocument Table 19.11K-2 Summary of Pertinent Igniter Test Information (Cont'd.)

Test Volume Glow Series Mixture (M') Plug Experimental Findings Tested Fenwal Test Objective:

Test of the performance and durability of the gm ac 7g glow plug-shield system to act as a deliberate ignition system. Hydrogen conditions ranged from 5% - 12% by volume.

Results:

1. At low concentrations (4% by volume) burns propagate downward at 6% by volume burns propagate sideways at 8.5% by volume burns proceed in all directions MarkIII Test Objective:

Provide a scaled demonstration for the O applicability of a deliberate ignition system to the h Mark III BWR contamment.

Results:

1. The igniter system was capable of maintaining the hydrogen concentration in the containment to 4% - 5% by volume (on a dry basis) even with the oxygen level reduced to 7.2% By volume, regardless of the magnitude of the hydrogen release.

2. Ignition pressure transients were modest, with no pressure excursions and ignition usually occurred at containment average hydrogen levels of I % - 2%

O L)

Anwend Desipre a0etene!

• Probahnesic Rink Asseesanwrt Page 19.11K 29

l

Sy~ tem 80 + Design controlDocument Table 19.11K-3 Summary of Specific Igniter Placement and Design Criteria for System 80+

No. Criteria Basis Notes Priority

1. Igniters placed along dominant System 80+ is designed with a single i A,I 2 natural circulation flow pattern dominant chimney flowpath with the SG pathway. enclosares and interior crane wall serving as the low density riser and the outer crane annulus serving as the denser fluid return downcomer. The natural circulation pattern is driven by very low pressure differentisls. Since almost all the hydrogen will flow through this pathway dominant regions in the upflow portion of the chimney are required to have igniters.

Dominant flowpath confirmed via detailed thermal hydraulic analysis.

2. Igniters are placed in vicinity Typical expected sources of hydrogen A,B 1 and above hydrogen sources. include all RCS primary piping, non-isolable connecting piping and IRWST vents

3. Igniters located in closed and Dead regions allow potential for hydrogen C 7 less well vented regions. to accumulate.

4. Multiple levels of burning in Multi-leveled burning will minimize the G 3 dominant flow paths. risk of localized steam inerted regions from preventing hydrogen combustion at the igniters.

Multi-leveled burns also allow burning off of additional hydrogen that was not previously burned due to incomplete combustion at lower levels.

This method will also result in higher temperatures in the dominant upflow paths and increase circulation through the multi-leveled flow paths.

5. Axial spacing of multi level NTS data suggests that igniters can 4 ignitets based on floor spacing. control hydrogen concentration in volumes with vertical heights greater than 50 feet.

This distance is typically larger than the system 80+ floor separation.

/

O Approved Design Motwiel < Probab&stic Mk k Asseswent Page 19.11K-30 l

System 80+ Desian controlDocument Table 19.11K-3 Summary of Specific Igniter Placement and Design Criteria for System 80+ (Cont'd.)

No. Criteria Basis Notes Priority

6. Highly reliable power source Operating experience suggests that igniter F,J 16 for minimum igniter set. failures may occur during plant operation.

Therefore, power to both the minimum and supplemental hydrogen set should be highly reliable to provide, reasonable assurance that performance goals are achieved.

7. Igniter locations supported by This criteria provides redundancy of E 13 an igniter pair in the same igniters for each general vicinity.

general vicinity.

8. All igniter pairs are powered Imss of power to one igniter set will not E 17 via independent power sources. compromise regional coverage.

9. Igniters located with reasonable To assure a functional and maintainable 9 expectations of maintainability system igniters are usually located on and surveillance. walls or surfaces accessible for surveillance.

G

10. No more igniters placed than System 80+ is designed with a large 10 reasonably necessary. containment volume. Therefore, to meet the general guidance of controlling hydrogen to below 10 v/o global, it is required that only 25% of the hydrogen produced by a 100% oxidation of zircaloy active cladding be removed by the igniters.

Sherman-Berman assessment of detonability within system 80+ is low and hydrogen control for purposcs of preventing detonability would have limited risk significance.

I1. Limited use of igniters in Igniters in the IRWST can play a role in IRWST. hydrogen control for those circumstances when the hydrogen content in the IRWST is combustible. For most severe accident situations the IRWST hydrogen will be non-combustible or only weakly combustible due to the lack of oxygen or steam inerting. The number of igniters in the IRWST should be limited. This is important since maintainability and testing in IRWST difficult. l d

Anrewed Denipur heeseriel ProbnM0eme Mick Assessmerrt (11/96) . Pege 19.11K-31

Symtem 80+ Design control Document Table 19.11K-3 Summary of Specific Igniter Placement and Design Criteria for System 80+ (Cont'd.)

No. Criteria Basis Notes Priority All igniters placed about 10 Experimental data (Fenwal test") indicates H 6 12.

feet below a solid surface upward burning to initiate between 4 and (ceiling, etc.). 6 v/o H . Imtion of igniters several 2

feet below solid floors enables more efficient use of the igniter to control concentration at the lower end of the flammability range.

NTS data indicates combustion efficiency is higher away from walls and when hydrogen concentration is below 7% by volume. Based on NTS (volume 75,000 ft') with one igniter located near a wall, combustion completeness at 7% by volume is on the order of 30% to 50%).

Average sustained concentration Experimental data on hydrogen mixing J 14 13.

of containment hydrogen with a suggests that H2 concentrations in volumes minimal ignition system be less above the system release point, will be than 8% by volume. reasonably well mixed typically with a max / avg concentration gradient of under 1.3.

Igniter system should be Maintenance of H2concentrations below J 15 14.

capable of burning off 10 v/o on a global average provides sufficient hydrogen to render reasonable confidence that a local the hydrogen concentration in detonable mixture in a severe accident the containment atmosphere to environment (under 13 v/o) will not below 10 v/o (global average)in occur. Therefore, detonation threats to less than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> following containment would be unlikely.

complete oxidation of the zircaloy active clad.

15. No igniters near PSV/SDS PRA does not consider a simultaneous 12 piping. All releases from the failure of the PSV/SDS valves and PSV/SDS channel into IRWST. downstream piping. Probability of about 10' per year.

16. With the exception of the dome NTS experiments indicate that a single 5 region igniters in the dominant igniter can effectively control hydrogen flowpaths will cover a volume concentration in a 75,000 ft' sphere. This of less than 50,000 ft'. placement criteria is within the experimental data base.

O\i 1

1 Approved Design atatonin!- Probabilistic Bish Assessment Page 19.11K-32 j l

i

1 1

l l

Sy' tem 80+ Design ControlDocument O

b Table 19.11K-3 Summary of Specific Igniter Placement and Design Criteria for System 80+ (Cont'd.)

i No. Criteria Basis Notes Priority l l

This placement provides coverage for D 8  !

17. Igniters to be placed at positions associated with flow areas which are not expected to be smaller secondary flow bydrogen rich. However, their presence patterns, will contribute to increased hydrogen .

combustion and assure all potential flowpaths will have igniter capability regardless of anticipated flowpaths.

18. Multiple levels of burning in increases effectiveness of igniters that 18 secondary flow paths. burn at low concentrations Notes: <

l A. This criteria is interpreted as requiring the placement of igniters above each of the 2 bot legs, 4 rep discharge legs and 4 RCP suction legs and pressurizer surge line. Additional placement may niso be required in vicinity of DVI lines, charging and letdown, shutdown cooling, and sit lines. Only line sizes i sufficient to be considered a small LOCA considered. For PSV/SDS operation hydrogen source to the i containment will Mocated at IRWST vents (above ground floor 91-9" elevation and in vicir,ity of overflow O pipe in holdup volume). Post VB hydrogen source to the containment is via the vessel breach scenario.

This introduces hydrogen into the reactor cavity. Thus, igniters will be located in reactor ca vity and at the dominant exits of the reactor cavity (assuming flooded cavity). (I Required; 3 ignner. per location selected for backup).

B. Because of close proximity of primary coolant piping and safety / control lines, one location may be covered by more than one igniter.

I C. All enclosures in the system 80+ containment are vented. These include the regenerative heat exchanger room and letdown heat exchanger room. These rooms are located low in the containment and are in direct proximity to a small bore piping hydrogen source. A pair of igniters is located in each heat exchanger room for conservatism. The pressurizer housing represents a vented tunnel with more than 100 ft2area vent located towards the top of the compartment. Using criterion 2 an igniter will be located at the exits of the housing. Additional igniters within the housing are not necessary. For post VB release the hydrogen released following VB is vented to the lower compartment via the cavity cooling ventilation room. This room is well vented. However, an igniter will be placed in this area because it represe,'its a hydrogen source to the containment via criterion 2. A small region of containment adjacent to the pressurizer housing appears poorly vented and should be fitted with igniters due to criterion 3. In order to ensure a dominant chimney flow pattern the hvac header is poorly vented (leaving the low resistance pathway through the RCS grated regions). Thus, igniters will be located in the hvac header region.

D. These igniters are not part of minimal set and need not be supplied with battery power.

E. Pairs located in the same general region, but may be separated by distance.

F. All igniters can be powered off offsite source, diesel generators, combustion turbine generator or batteries.

A minimum set will be powered off batteries to conserve battery power for prolonged igniter use during station blackout r.ccuario.

Appreweef Deekn nietaria!- Probabeistic Rest Assessment Page 19.11K-33 ,

1

Syntem 80+ Design contrat Document Notes (Cont'd.)

G. Multilevel burning is particularly important to keep lower hydrogen concentrations where combustion completeness is expected to be low.

II. NTS data indicates hydrogen control in large open volumes can be performed with a single igniter. Igniter location has some impact on combustion completeness and flammability limits.

I. If necessary uiditional igraters will be added to covct breaks in RCS connecting piping f

J. Minimal igniter set includes 30 igniters.

K. An exception to this rule is expected to be the dome igniters which are to be suspended 10 to 15 feet below the dome inner s arface.

O O

Astwoved Design Maternel ProbabAstic Risk Assessment Page 19.11K 34

l l System 80+ oesign controrDocument

[

V Table 19.11K-4 System 80+ Hydrogen Igniter locations Tag No. Location Elevation Azimuth Radius (Centerline) (Degrees) (ft.& in) 1AUl Reactor Cavity ICI Area 70' + 0" 22 13'-0" lb Reactor Cavity ICI Area 70* +0" 314 13'-1" ,

2au l IRWST Area 87' + 9" 44 44'-11" 2bul IRWST Area 87' + 9" 316 44'-11" 3aH3 IRWST Area 87' + 9" 224 44'-11" T

3bH1 IRWST Area 87' +9" 136 44'-11*

4a MAVEC Area 89' + 6" 355 28'-2" 4bl81 MAVEC Area 89' + 6" 351 35'-8" Sau l MAVEC Vent Outlet 100' +0

• 16 43 '-7 "

Sb MAVEC Vent Outlet 100' + 0" 342 44' 1" 6a El. 91+9 HVT Area 99' + 0" 154 42'-6"

^ 6bul El. 91+9 HVT Area 99' +0

• 206 42 '-6 *

(

7au l El. 91 +9 Steam Gen. 2 100' + 0" 58 43 '-2 "

Wing Wall 7b El. 91 +9 Steam Gen. 2 100' +0" 76 49 * -0 "

Wing Wall Sa El. 91+9 Steam Gen. 2 100* +0" 104 49 '-0 "

Wing Wall 8bul El. 91 +9 Steam Gen. 2 100' +0" 122 43 '-2 "

Wing Wall 9att i El. 91+9 Steam Gen. I 100' +0" 238 4 3 '-2 "

Wing Wall 9b El. 91 +9 Steam Gen. I 100' +0" 256 4 9 '-0" l

Wing Wall 10a El. 91+9 Steam Gen. I 100' +0" 284 49'-0" Wing Wall 10bul El. 91 +9 Steam Gen. I 100* +0" 302 43 '-2 "

Wing Wall lla Letdown Hx Rm. 100* +0" 151 64 '-8 "

11b Letdown Hx Rm. 100' +0" 178 56'-1" 12a Regen. Hx Rm. 100' +0" 199 59 '- 1 "

12b Regen. Hx Rm. 100' +0" 206 62 *-8 " i Annrevent Deedgre hieseniet . habehdetic Misk Assessment Pope 19.11K-35

l System 80+ Design controlDocument 1

Table 19.11K-4 System 80+ Hydrogen Igniter locations (Cont'd.) 0 Tag No. Location Elevation Azimuth Radius j (Centerline) (Degrees) (ft.& in) i 13alil El. 91+9 HVAC Dist. 105' +0* 30 82'2*

Header j 13b El. 91 +9 HVAC Dist. 105' + 0* 75 82 '-2

• Header 14a El. 91 +9 HVAC Dist. 105' +0* 120 82 '-2

• Header 14 bill El. 91+9 HVAC Dist. 105' + 0* 165 82 '-2

• IIcader 15al1 El. 91+9 HVAC Dist. 105' +0

• 210 82 '-2

• Header 15b El. 91+9 HVAC Dist. 105' + 0

• 255 82'-2

• Header 16a El. 91 +9 HVAC Dist. 105' +0

• 300 82'-2

• Header 16btil El. 91+9 HVAC Dist. 105' + 0* 345 82'-2

• Header 17ati l El.115+6 0.D. Crane Wall 125' +0' 25 69'-4

• 17b El.115 +6 0.D. Crane Wall 125' +0* 66 69 '-4 "

18a El 115+6 0.D. Crane Wall 125' + 0* 114 69'-4

• 18b El. I15+6 O.D. Crane Wall .125' + 0

• 152 69 '-4

• 19a El.115 +6 0.D. Crane Wall 125' + 0* 205 69'-4

• 19btll El.115 +6 0.D. Crane Wall 125' +0* 246 69'-4

• 20a El.115+6 0.D. Crane Wall 125' +0* 294 69 '-4 "

20b El.115+6 0.D. Crane Wall 125' + 0* 335 69 *-4

• 21a El. I15+6 Grating Ilatch 123 ' + 6' 346 43'-l

• Area 21b El.115+6 Grating Hatch 123 ' + 6' 13 43 '.1 "

Area 22afI l Steam Gen. 2 Area 126' + 3" 66 46'-3

• 22b Steam Gen. 2 Area 126' + 3 " 54 23 '-6

• 23a Steam Gen. 2 Area 126' +3' 114 46'-3

• 23b!'l Steam Gen. 2 Area 126' + 3" 127 23'-6" 24ali l steam gen.1. Area 126' + 3

• 294 46 * -3 "

Approved Design Material Probab&stic Risk Assessment Page 19.11K-36

System 80+ Design ContmlDocument O

Table 19.11K-4 System 80+ Hydrogen Igniter Locations (Cont'd.)

1 Tag No. Location Elevation Arimuth Radius (Centerline) (Degrees) (ft.& in) 24b Steam Gen.1 Area 126' + 3" 307 23'-6" 25a Steam Gen.1 Area 126' + 3 " 247 46 '-3 " ,

25btll Steam Gen.1 Area 126' + 3" 234 23'-6" i 26atti Steam Gen. 2 Area 164' +0" 66 46 '-3 " ,

26b Steam Gen. 2 Area 164* +0* 43 28 '-7 " g 27a Steam Gen. 2 Area 164' + 0" 114 46'-3 "

27 bill Steam Gen. 2 Area 164' +0" 137 28'-7" 28all ! Steam Gen.1 Area 164 ' + 0

• 294 46*-3" 28b Steam Gen.1 Area 164' + 0* 317 28'-7" 29a Steam Gen.1 Area 164' +0

• 246 46*3" 29 bill Steam Gen.1 Area 164' + 0

• 223 28'-7" 30alli Refuel Cavity 154 ' + 0" 45 22'-6"

(

( 30b Refuel Cavity 154' + 0

• 315 22 '-6 "

31a Refuel Cavity 154' + 0" 135 22'-6" 31bl I Refuel Cavity 154' +0

• 225 22'-6" 32all i Pressurizer 188' + 10" 227 46'-9" 32bil l Pressurizer 188' + 10" 248 50'-9"  !

33a Pressurizer 188' + 10" 216 M'-8" 33b Pressurizer 188' + 10" 252 64 '-8 "

34all l El.146 !.D. Crane Wall 200' + 0

• 40 M '-8 "

34b El.146 I.D. Crane Wall 200' + 0" 77 64 '-8 "

35a El.1461.D. Crane Wall 200* +0* 125 M*-8" 35b l'1 El.1461.D. Crane Wall 200' +0" 175 64 '-8 "  ;

36a El.1461 D. Crane Wall 200* +0" 310 64 '-8 "

36b El 1461.D. Crane Wall 200' +0" 355 M '-8

• 37a Cont. Dome 237' +0" 0 56'-7" 37b Cont. Dome 237' +0" 45 56'-7" 38a!ll Cont. Dome 237' + 0" 90 56'-7" 38b Cont. Dome 237' +0

• 135 56*-7" Pu. 3 Dengt bienwief Probabnissic Mink Assessment Page 19.11K-37 ,

Sy~ tem 80 + Design controlDocument Table 19.11K-4 System 80+ IIydrogen Igniter Locations (Cont'd.)

Tag No. Location Elevation Azimuth Radius (Centerline) (Degrees) (ft.& in) 39a Cont. Dome 237' +0" 180 56'-7" 39b Cont. Dome 237' +0" 225 56'-7" 40a Cont. Dome 237' + 0" 270 56'-7" 40bH I Cont. Dome 237'+0" 315 56'-7 "

l [1] Denotes igniters that are expected to be powered by Class 1E batteries, in addition to offsite power source, diesel generators, or alternate AC combustion turbine generator. All igniters can be powered off batteries.

Table 19.11K-5 System 80+ IIydrogen Concentration Cases:

Global Containment Values Maximum Dome Maximum Dome Ilydrogen Time to Burn 270r21 kg Pressure Temperature Burned sec(from Ty Case Pa *K kg sec(from first H2 burn)

,'ers 2.75x105 385 0 N/A g

^* 2.80x105 400 500 I'I*

Igniters 5.0x10 0 A l.0x10d Igniters,' 2.25x105 375 600 4.5x103 Spray

+ '

2.30x105 375 0 N/A No SBO + SDS, 9*8*I 2.25x105 380 700 Igniters 1.5x103 SBO + SDS, l 5 l Igniters, 2.30x10 380 700 43 Spray i I

\

l l

l O

(21 Hydrogen mass to be burned to maintain containment global I ydrogen concentration below 8% by volume.

AMromHf Design Materief- Probabbatic flish Assessment Page 19.11K 38

i l

System 80+ oesign controlDocument

/~

-( Table 19.11K-6 System 80+ Hydrogen Concentration Cases:

Peak Hydrogen Concentration Peak H2 Fraction Steam Case Lower Generator i Cavity Dome Compt #2 (low) IRWST  :

SLOCA, No Igniters 0.09 0.10 0.10 0.12 0.10 ,

SL.OCA, Igniters 0.06 0.0# 0.06  ;

0.06 0.06 0.07 21 SLOCA. Igniters, Spray 0.06 0.05 0.06 0.06 0.06 SBO+SDS, No Igniters 0.11 0.11 0.15 0.14 0.31 t

SBO+SDS, Igniters 0.05 0.05 0.05 0.05 0.15lU 0.10t21 0.04 0.05 0.05 0.09 SBO+SDS, Igniters, Spray 0.05 )

til Spikes (2) Average Value O Table 19.11K-7 Local Hydrogen Detonation Pressures: TNT Equivalent Hydrogen Peak Pressure (psia) Pulse Duration (msec) Impulse k

% by Volume (psi-sec) 10 230 6.5 0.478 13 280 7 0.578 15 310 7.7 0.668 l

[\

U AMvowenf Dee$ Mosenel Probabestic Misk Assessment Pope 19.11K-39

Sy~ tem 70+ onstan controlDocument O s ' rec'ive e se ' isti =

Appendix 19.11L r

Pages Date j i,ii 1/97 iii Original 19.11L-1,19.111 2 2/95 19.11L-3 Original l

l O

O

' Appreweef W nietenet* Prebebbene Mek Assessmerrt (1/97) Page i. &

i Sy tem 80+ Design controlDocument

' Appendix 19.11L (nJ t Reactor Cavity Ultimate Static and Dynamic l Pressure Capacity Calculation Methodology f

Contents Page  ;

1.0 Introduction 19.11L-1

.... ......................... ............. l 2.0 Calculation Methodology .......... ..... .... .... ....... 19.11L-1 l

l l

l

V ANwownf Deekps noeneniel.hobahnneic Mink Assessmerrt Pope R

Sy, tem 80+ Design ControlDocument 1.0 Introduction This Appendix presents the basic steps used in determining the System 80+ reactor cavity ultimate static and dynamic pressure capacity including the corbels which support the reactor vessel. The loads used to determine an initial design and subsequently the ultimate capacity of the reactor cavity are obtairmi from the Ex-Vessel Steam Explosion event in Section 19.11.4.1.2.2.

2.0 Calculation Methodology The following steps outline the approach and procedure used in determining the System 80+ reactor cavity ultimate static and dynamic pressure capacity inclwiing the corbels which support the reactor vessel.

1. Given a static ultimate capacity of 225 psid, the reactor cavity stresses, forces and moments are l l determined, f

2. Reinforcing patterns are determined using ACI-349, ' Code Requirements for Nuclear Safety Related Concrete Structures."

3. The actual ultimate static capacity is determined based on actual reinforcing steel provided: 235 psid l

4. The actual design static pressure capacity based on actual reinforcing steel is determined using a typical load factor of 1.25, neglecting any other load combinations: 235/1.25 =188 psid l S. The maximum resistance of the structure R,,, is determined by calculating a Dynamic Increase Factor (DIF) based on ACI 349, Appendix C. The reinforcing steel is assumed to take all of the pressure load. DIF = 1.1 R,, = 235(1.1) = 259 psid l

6. The ductility ratio, p., is determined using ACI 349, Appendix C. p,= 3.0

7. The reactor cavity is then checked to ensure that the actual ductility can reach at least p, = 3.0. l The reinforcing is carrying the total load and a typical reinforcing stress-strain curve is used. l

8. The natural period of the structure, T, is determined by modal analysis using a finite element code. The concrete is assumed to be created below the reactor vessel support corbels, elevation 62'+0" to 73' +6".Above elevation 73' +6", the reactor cavity forms a complete hoop and is assumed to be uncracked. This is appropriate for the dynamic pressure loading since the pressure pulse in the water filled lower cavity will strike the walls before any loading is realized in the upper cavity area. T = 0.0114 seconds.

9. The dynamic pressure capacity of the reactor cavity, Fi , is determined by the following expression:

R, F, = 7 Reference 1. [Biggs)

N.

^42 Deefps neeseriel Probahnseic het Asseesment 42/9 61 Page 19.11L-1

System 80+ Design, Control Document Fi = Dynamic Pressure Capacity l R. = Maximum Resistance of the Structure,259 psid X = Dynamic Load Factor (DLF),0.90 The Dynamic Load Factor, X, is determined from charts of ductility ratio, p, plotted against t,/T.

to is the load duration which was given to be 0.005 seconds. A rectangular shaped forcing function was given.

Fi = 288 psi

10. The impulse capacity, I., of the cavity is de: ermined based on a rectangular shaped forcing function.

1 = F xi to = (288 psi) x 0.005 sec = 1.44 psi- sec

11. The static pressure capacity of the reactor vessel support corbels is determined. The predic:ed reactor cavity water level is at elevation 79'+0" which is above the bottom of the corbels but below the reactor vessel. The pressure loadings are only a concern for the submerged structure where an in liquid shock wave would propagate outward from the Fuel Coolant Interaction (FCI) steam explosion event. Above the water surface, the shock waves would propagate much slower and would be a lower magnitude. Therefore, the pressures on the structures and components above the water surface are not considered.

12. Forces and moments are determined on the corbels considering dead weight of the reactor vessel O

l and the 235 psid static ultimate pressure capacity of the lower cavity applied to the bottom of the corbels.

13. Reinforcing patterns are determined using ACI-349. Additional reinforcing is required in the bottom of the corbels due to the Severe Accident upward forces only. This reinforcing is included in the 5) stem 80+ design.

14. The actual ultimate static capacity is determined based on actual reinforcing steel provided.1,057 l psid

15. The actual design static pressure capacity based on actual reinforcing steel is determined using l a typical load factor of 1.25, neglecting any other load combinations. 1057/1.25 = 846 psid

16. The dynamic capacity of the corbels is determined in the same manner described for the reactor cavity.

t, = duration of the event 0.005 seconds R. = Maximum Resistance of Corbels l = DIF(1,057 psid) = 1.1(1,057) = 1,163 psid p = 2.3 Average of ductility for concrete in shear (1.6) and reinforcing bars (3.0) in ACI 349 AMwoved Design Afsterial- Probahnstic RM Assessment (2/95) Page 19.11L 2

.= . .- .- -

Sy' tem 80+ Design controlDocument q

(Note: Regulatory Guide 1.142 identifies a ductility of s1.3 when shear is carried by a j combination of concrete and stirrups or bent bars. The Regulatory Guide addresses design basis load combinations whereas this evaluation is for Severe Accident conditions. For the Severe Accident condition, the shear is carried completely by shear friction tension bars and stirrups but the concrete does resist shear in friction. The actual ductility ratio would be closer to the ductility ratio of reinforcing bars alone,3.0. The use of the average of the ACI ductility ratios for concrete and stirrups,1.6, and reinforcing bars alone. 3.0, is determined to be appropriate.)

T = Natural period of the corbels determined by hand from the following expression 2r M T =

K M = Mass including structures and reactor vessel 1

K = 3 EI,,,/D Reference 2. [Blevins] l l

E = Modulus of Elasticity for Concrete ]

I l ery = Effective moment of inertia considering reinforcing steel and cracked concrete l per ACI 349 L = Distance from support at wall to point of load application y X = 1.25 Dynamic load factor for rectangular f.~ Mg function Reference 1. [Biggs]

F = R,/X = 930 psi Dynamic Pressure Capacity

17. The impulse capacity Ico, of the cavity is determined based on a rectangular forcing function.

I co = F x ta = (930 psi) x 0.005 sec = 4.65 psi- sec

18. The ability of the structure to support the reactor vessel after concrete ablation from corium attack or pressure destruction of the lower cavity wall is evaluated. The dead load acting on the lower cavity walls is determined including equipment and structures. The corium attack or pressure loading is assumed to have taken out all of the walls except for a 5 ft. by 5 ft. triangular section at the corners in the lower cavity. The remaining corners are sufficient to maintain support of the rector vessel.

An evaluation is peiformed to consider the complete destruction of the lower cavity walls, including the corners. The reactor vessel is still sufficiently supported by shear friction action developed in the surrounding structure.

References 1, Introduction to Structural Dynamics, by John M. Briggs, McGraw-Hill,1964.

2. Formulas for Natural Frequency and Mode Shapes, By Robert D. Blevins, Van Nordstrand -

g Reinhold Company,1979.

Amarewed Desipre Afeteriinf Pro 6a6mstic Ask Assessment Pape r9. 7 Fr4

- System 80+ Deslan contrat Docummt ,

, 19.12 Coneninenent Response Analysis f

This Section Intentionally Blank. ,

1 d

r t

i l

i I

l t

t 4

j  :

r

[

i

(  ?

t

+

4 i  !

t t

l l

l i >

4 l

2 ..

1 I

r i

r t

i

,g i

\

i w coeon annaw nosasarate mas Asm=,a,e rare ss.s2  ;

i

System 80+ Deslan controlDocument i i

t s

19.13 Consequence Analysis '  !

This Section Intentionally Blank.

o 7-s i

I 4 1

^

4 a e

}

)

a t

F d )

i h

a s

a w Deep neeenaw. meic mk aseeesmene p,,,yy.g3.g w + 4+- .~ .. - --- - w .m

Sy-tem 80+ oestan controloccament  !

19.14 Containment Response Sensitivity Analyses f i

This Section Intentionally Blank. ,

l t

i l

}

l

\

i E

I

-l t

1 l

I i

.i l

l l

l I

l I

J 1

r (

W W niennoinf = Probahnfreic Miek Asseesneant Page 19.14-1

System 80+ Design ControlDocument

• 19.15 Summary of PRA-Based Design Insights This section summarizes the PRA-based insights for the System 80+ design. The System 80+ PRA was performed to satisfy the objectives required for the Advanced Light Water Reactor design certification PRA. These objectives, as they relate to the System 80+ design, are:

l

• To assess, as realistic as possible, the risk profile of the proposed design in terms of the frequency of severe core damage accidents and their consequences.

• To develop better understanding and insights about the design strengths and relative weaknesses beyond those identified through deterministic analyses.

• ' To support pre- and post-certification regulatory activities which include Design Acceptance .

Criteria (DAC); Inspection, Testing, Analyses, and Acceptance Criteria (ITAAC); Reliability Assurance Program (RAP); and technical specifications.

Since the System 80+ PRA is being used to support the pre- and post-cenification activities, the insights '

gained regarding the risk contributors are very useful. Therefore, the following useful information and insights are summarized in this section of the report:

• liow PRA insights influenced the design.

• What design features were added to or deleted from the design as a result of PRA insights.

V

• liow it was determined if there were any vulnerabilities in the plant design from internal or external events.

• Ilow the PRA was used to develop an appropriate balance of prevention and mitigation in the design.

• liow to use the models, information, and results of the design for verifying some of the key assumptions of the PRA.

• liow to use insights from the uncenainty, importance, and sensitivity analyses to suppon various activities such DAC, RAP, ITAAC, and technical specifications.

• Ilow to use insights from the external events analyses, shutdown and low power risk analyses to l support pre- and post-cenification activities.

The special features that are incorporated into the System 80+ design to prevent and mitigate accidents are summarized in Section 19.15.1. Insights about the System 80+ design gained from the internal events risk profile and the external events risk profile are summarized in Sections 19.15.2 and 19.15.3, respectively. Shutdown and low-power operation are included as part of the System 80+ PRA, and the insights gained from the risk associated with these modes of operation are summarized in Section 19.15.4.

The use of PRA in the design process is summarized in Section 19.15.5. Risk significant SSCs for consideration in the D-RAP and other activities are identified in Section 19.15.6. The use of PRA results and insights to support certification and follow-up activities is summarized in Section 19.15.7. Significant PRA-based safety insights for the System 80+ design are summarized in Table 19.15-1.

l l

? ,--..J Deeen neesenie!- Probabannic Mink Assessment Page 19.15-1

System 80+ Design ControlDocument During the detailed design phase for System 80+, site specific information and system design details will become available. ((Tbc COL applicant should update the PRA using the final design information and site specific information. As deemed necessary, the update should include the shutdown risk evaluation and the internal fire and f'ood evaluation. Based on site specific information, the COL applicant should also re-evaluate the qualita ive screening of external events. If any site specific vulnerabilities are found, the applicable external everc(s) should be included in the updated PRA [ COL ltem 19-6))]3

((In updating the internal fire evaluation, the COL applicant should verify the details and layout of critical components and the fire suppression systems. [ COL ltem 19-3]l The applicant should also evaluate the potential effect of the fire suppression systems on the behavior of other systems. [ COL Item 19-3))

((In updating the internal flood evaluation, the COL should evaluate the interaction of the potential internal flood sources and the details of the layout of the critical components [ COL Item 19-3))]'.

19.15.1 Special Design Features System 80+ is an evolutionary Advanced Light Water Reactor (ALWR). ABB C-E designed the System 80+ using PRA extensively in the design process to identify areas for improvement and to monitor progress toward meeting risk reduction goals. Using the Standard System 80 design as the starting point, the System 80+ design evolved into System 80+. The changes were made to make the plant safer, more available, and easier to operate. Therefore, the System 80+ design contains features that reduced risk, when compared with existing generation of commercial nuclear power plants. Table 19.15.1-1 summarizes the System 80 + evolutionary features that affect safety and compares them to similar features of System 80.

The features summarized in Table 19.15.1-1 contributes to risk reduction, some more than others. These features are either preventative or mitigative. The purpose of the preventative features is to minimize or reduce the initiation of plant transients, arrest or terminate the progression of plant transients once they occur, and prevent core damage. Likewise, the purpose of the mitigating features is to mitigate severe accidents and the consequences of core damage.

19.15.1.1 Design Feature for Preventing Core Damage The following briefly describes the major features that were incorporated into the System 80+ design to limit plant transients and to prevent severe accidents from occurring.

Larger Pressurizer The reason for designing a larger pressurizer volume in the System 80+, as compared the existing generatior, of commercial nuclear power plants, is to make the plant response to transients slower and ,

more resilient. The larger pressure volume helps maintain a higher pressurizer pressure and water level j following a turbine trip. It also helps prevent emptying the pressurizer following overcooling transients.

For certain transient events, the rise in pressurizer pressure will be moderate and consequently the l primary safety valves will not be challenged.

O 8

COL information item; see DCD Introduction Section 3.2.

Approwd Design A4ateria!- Probab&stic Misk Assecament Page 19.15-2 i

I

l System 80+ Design ControlDocument ,

l

( ) A larger pressurizer volume also helps to lower the peak pressure that can be reached following an

Anticipated Transient Without Scram (ATWS) event. The primary bases for increasing the pressurizer volume are:

• To prevent the draining of the pressurizer and uncovering of the heaters following a reactor or a turbine trip.

• To prevent water level surges that cause liquid or two-phase flow to reach the primary safety valves following a feedwater line break or a loss of load transient.

• To prevent the lifting of the primary safety valves following certain transient events.

• To increase the margin for a Safety injection Actuation Signal (SIAS) during a reactor or turbine trip.

• To minimize the fluctuation of the pressurizer during transient events.

Larger Steam Generaton The larger than existing steam generators of System 80+ are designed to make the plant response to ,

transients slower and more resilient. The increased heat transfer area of the steam generators provides j a 10% tube plugging margin, which helps increase the availability of the steam generator secondary heat I removal. The increased downcomer volume and the 20% increase in steam generator inventory help n reduce the fluctuations during transients and increase the boil-off time to dry out the steam generators.

() The time required to dry out the secondary inventory of the steam generators is approximately 50%

longer for System 80+ than the dry out time for System 80. The improved steam generator tube materials and the reduced hot-leg temperature are designed to help reduce the frequency of steam generator tube ruptures.

Shutdown Cooling System (SCS)/ Containment Spray System (CSS)

In addition to their long-term decay heat removal function, the SCS pumps are designed to perform residual heat removal injection and cooling of the In-containment Water Storage Tank (IRWST). In the residual heat removal injection mode of operation, the SCS is used (in conjunction with the Rapid Depressurization System) as a backup to the Safety injection System (SIS) to inject borated water into the reactor core. To provide operating flexibility, the design pressure of the SCS is much higher for System 80+ than Standard System 80. The SCS pumps can also be used as backup to the CSS pumps to perform IRWST cooling during " feed and bleed" operations (beyond design basis events). The two-train redundancy for each of these systems, coupled with the interchangeable SCS and CSS pumps, enhance the availability of these systems.

Multiple Independent Connection to Grid and Turbine / Generator Runback Capability The System 80+ design includes a main switchyard for incoming and outgoing electric power and a separate and independent backup switchyard that is tied to the grid at some distance from the main switchyard, in addition, the System 80+ turbine generator system and the associated buses are designed to runback to maintain hotel load on a loss of grid event. These features are intended to reduce the frequency of Loss of Offsite Power (LOOP) events and station blackout events.

Approwd Desipn Material- Probabmstic Risk Assessment Page 19.15-3

System 80+ Design ControlDocument Separate Startup and Emergency Feedwater System The use of a non-safety related Startup Feedwater System (SFWS) for normal startup and shutdown operations helps reduce the demands on the Emergency Feedwater System (EFWS). In addition, the SFWS provides an independent means of supplying feedwater to the steam generators for removing heat from the Reactor Coolant System (RCS) during emergency conditions when the main feedwater is not available (the SFWS is automatically actuated upon loss of main feedwater and prevents the need to actuation the EFWS).

Improved Control Room Design The System 80+ control room design (Nuplex 80+"")) is intended to improve existing control rooms while maintaining their strengths. In that respect it is an evolutionary design that is expected to provide more and better information to the operator than the Standard System 80 design.

Improved Normally Operating Component Cooling Water System (CCWS)

The Component Cooling Water System (CCWS) is a closed-loop system that provides cooling water to remove heat from plant systems, components, and structures. Heat from the CCWS is rejected to the ultimate heat sink through the open-loop Station Service Water System (SSWS). Each of these systems consists of a separate and redundant division. Each division contains two pumps: one is normally operating, while the other pump is in standby and starts automatically if the operating pump trips. This configuration eliminates the demand failures of pumps and valves that were found to be significant contributors to risk in the System 80 design with standby CCWS/SSWS configurations.

Facilities Designs Facilities are designed to provide physical separation of systems or trains of system that perform redundant safety-related functions. This increases the availability of systems due to their protection from failures associated with internal fires, internal floods, and similar common-cause failures. This contributes to risk reduction when compared to existing plant designs.

Safety Injection System (SIS) with Direct Vessel Injection The primary function of the Safety injection System (SIS) is to inject borated water into the RCS for l inventory and reactivity control during severe accidents such as Loss of Coolant Accidents (LOCAs) and .

I ATWS. The SIS can be used in conjunction with the Rapid Depressurization System for " feed and bleed" operation. For continuous long-term post-LOCA (large) cooling of the reactor core, the SIS pumps are realigned to provided simultaneous hot-leg and direct vessel injection (DVI) to prevent boron crystallization. The following are major evolutionary characteristics of the System 80+ SIS:

• Four high-pressure 100% capacity pumps.

• Four safety injection tanks (SITS).

• Direct vessel injection (pumps take suction from the IRWST and deliver borated water to the reactor vessel downcomer via the DVI lines). l O

t Nuplex 80+ is a trademark of Combustion Engineering, Inc.

Apprend Desogn historia! Probabmstic Risk Assessmerrt Pege 19.154

Sv tem 80+ oestan controloccament e1 Elimination of need for low pressure pumps.  !

e~ Elimination of need to realign pump suction. j e Hot side injection into each hot-leg.

e Capability to test pumps at design flow.

e . " Feed and bleed" cooling of the RCS (in conjunction with the Safety Depressurization System (SDS) for beyond design basis events).  ;

These evolutionary characteristics help reduce the unavailability of the System 80+ SIS to levels below '

those for the existing generation of commercial nuclear power plants. This was achieved by reducing ,

or eliminating several contributors to SIS unavailability. For example: (1) a four-train (as compared to a two-train) SIS, reduces the contribution to the system unavailability that is due to outages for testing, repair and maintenance; (2) the elimination of the low-pressure pumps eliminates the failures to start 4 I

- for these pumps; (3) the clinun. tion of the need to realign the suction of the pumps eliminates the contribution of the failure to do so; (4) the provision for cold-leg DVI increases the time for SIS response during a small break LOCA.

Safety Dw __M= Systen (SDS)

The Safety Depressurization System (SDS) consists of two sub-systems: (1) the Reactor Coolant Gas Vent System (RCGVS) and (2) the Rapid Depressurization System (RDS) or bleed system. The RCGVS provides a safety-related means of venting non-condensible gases from the pressurizer and the reactor vessel upper head. Likewise, the RDS provides a manual means of rapidly depressurizing the RCS so 1

that the SIS can deliver borated water to the reactor core, when long-term decay heat removal fails via the Shutdown Cooling System or via the steam generator secondary heat removal. Rapid depressurization of the RCS is manually accomplished and is often exercised in conjunction with the " feed" function which is provided by the SIS. This is a significant risk reduction feature added to the System 80+ design.

Emergency Feedwater Systeen (EFWS)

The Emergency Feedwater System (EFWS) provides an independent safety-related means of supplying feedwater to the steam generators during the early phase of secondary heat removal in the event that both the main feedwater and the startup feedwater are lost. The EFWS consists of two divisions, each of which is aligned to deliver feedwater to its respective steam generator. Each division contains a motor-driven train and a turbine-driven train. The steam required to operate the turbine-driven pump is supplied from the associated steam generator that feedwater is delivered to, and the cross-connect of steam supply to the EFWS turbine pumps is not a design characteristic. For station blackout sequences, the turbine-driven trains of the EFWS are available to remove decay heat from the RCS. Because of the redundancy and diversity of the emergency feedwater trains, this system is a significant contributor to risk reduction.

Two Ennergency Diesels and Standby Combustion Turbine Each of the two divisions of class 1E AC power is supplied with emergency standby power from an emergency diesel generator (DG). -Each DG is provided with a dedicated 125 VDC battery. The emergency DGs start and load automatically following a LOOP event. In addition to the two emergency DGs, the System 80+ design has an alternate standby onsite AC power source. This is a non-safety combu!, tion turbine power source provided to cope with station blackout scenarios. The alternate power

. Wreses semp assesnimo nsaanalsaic med Assessmemt pape 19.f 5 5

System 80+ Design ControlDocument source is independent and diverse from the DGs. Once started, the combustion turbine is manually loaded to power one division of class IE AC loads when the associated DG is unavailable.

Vital Battedes Six independent and separate 125 VDC batteries are included in the System 80+ design, in comparison to four batteries for the System 80 design. For System 80+, each battery can supply the continuous emergency load of its own load group for a period of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. In addition, the batteries provide a station blackout coping capability assuming manual load shedding or the use of a load manage unt program.

This permits operating the instmmentation and control loads associated with the turbine-dn.en emergency feedwater pumps for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

In-Containment Refueling Water Storage Tank Sufficient borated water is stored in the In-Containment Refueling Water Storage Tank (IRWST) to meet all post-accident safety injection pumps and containment spray pumps operation requirements. The volume of borated water is also sufficient to flood the refueling pool during normal refueling operations.

The IRWST eliminates the need for switching over from injection mode to recirculation mode during emergency core cooling operations and therefore, eliminates failures associated with switch-over in existing commercial nuclear power plants.

19.15.1.2 Design Features for Mitigating Consequences of Core Damage The following briefly describes the major features that were incorporated into the System 80+ design to mitigate severe accidents and the consequences of core damage.

Large Spherical Steel Contalmnent The most important advantages of this feature are listed below:

• Enhanced containment atmospheric mixing and dilution of post accident hydrogen gases reduces ,

the potential for developing detonable concentrations of hydrogen under severe accident  !

conditions.

• High containment pressure capacity values are several times higher than the design pressure.

(The containment pressure capacity is sufficiently large that the containment loads associated with early challenges, e.g., hydrogen combustion and direct containment heating, are at or below Service Level C value.) This assures an extremely low probability of containment failure for l such challenges, the high-pressure capacity also significantly delays the time of release for late ccntainment failure challenges.

In-Containment Water Storage System This system performs water collection, delivery, storage, and heat sink functions inside the containment during normal operation and accident conditions. It comprises the IRWST, the Holdup Volume Tank (HVT), the Steam Relief System (SRS), and the Cavity Flooding System (CFS). Containment spray water, RCS breakflow, and condensed water on containment structures will drain first into the HVT, and eventually to the IRWST through spillways connecting the IRWST and HVT. The IRWST provides water J for steam condensation and fission product scrubbing before vessel breach, and water for reactor cavity l flooding through the CFS. The in-containment water storage system is, therefore, significant for severe l

)

Approved Design Material Probabastic Risk Assessment Page 19.15-6 l

Srtem 80+ Design Control Docunsn, ijs accident progression in its ability te reduce containment pressure (through steam condenntion), to reduce fission product release (through pool scrubbing), and to reduce the probability of core concrete interaction through cavity flooding.

Safety Depressurization System (SDS)

In addition to the core damage prevention function, discussed earlier, the Rapid Depressurization System (RDS) of the SDS also serves a mitigative function. Specifically, actuation of the RDS prior to the core debris penetrating the vessel, can reduce or eliminate the potential for direct containment heating and large hydrogen cor.tbustion events at vessel breach and, thus, reduce the probability of early containment failure.

The RDS also reduces fhe amount of fission product release associated with reactor vessel breach at high pressure, since the RDS flow is discharged directly into a sparger network in the IRWST and not into the containment atmosphere.

Reactor Cavity Design for Corium Disentrainment The reactor cavity of the System 80+ design minimizes debris dispersal to the upper compartment of the containment after.a high pressure vessel breach, and thereby reduces the potential for containment failure caused by direct containment heating. The path from the cavity to the upper containment is convoluted so that the corium will be disentrained and removed from the atmosphere before reaching the upper containment region. This design feature reduces the quality of corium available for dispersal into the Q upper compartment and, therefore, the pressure rise associated with direct containment heating. In  ;

V conjunction with the high containment pressure capacity for the System 80+ design, the retentive cavity j design serves to further reduce the probability of containment failure as a result of direct containment j heatmg. j i

Reactor Cavity Design for Debris Coolability Another feature of the reactor cavity that is important to severe accident progression is the ability to quench and cool core debris in the cavity. The flow area in the System 80+ design meets the EPRI debris spreading criterion to enhance the potential for debris cooling. In addition, the reactor Cavity Flooding System (CFS) is designed to flood the reactor cavity in the event of a severe accident for the purpose of covering the core debris with water and maintaining a long-term debris coolability. The CFS also serves to scrub fission products. The CFS is designed to flood the reactor cavity in the event of a )

severe accident using water from the HVT portion of the containment water storage system. l l

Hydrogen Mitigation System  !

The System 80+ design incorporates a deliberate ignition system to maintain containment hydrogen concentrations below a detonable limit. The system uses igniters and is manually remote controlled.

Because of the proven design of the glow plug igniters and the reliability of the electrical distribution system used in the System 80+ design, the Hydrogen Mitigation System (HMS) is a significant risk reduction contribu:or to containment failure.

A l

\

L/ l l

Apnarowd DesJon Material Probab5s6c Rosk Assessment Page 19.15-7 l

System 80+ Design ControlDocument 19.15.2 Internal Events Risk Profile Insights 19.15.2.1 Core Damage Frequency of the Level I PRA The Level I portion of the System 80+ PRA addresses the internal (and the external) initiators of accident sequences which lead to core damage. Core damage is assumed to occur if the collapsed level in the reactor has decreased such that the active fuel in the core is uncovered and a temperature of 2200*F or higher is reached in any node of the core as defined in best-estimate thermo-hydraulic calculations. The methodology for the Level I portion of the PRA for internal events complies with the recommendations of the PRA Key Assumptions and Groundrules of EPRI ALWR Requirements DocumentM. The small event tree /large fault tree (fault tree linking) approach was used to evaluate core damage frequency.

Generic industry data, as presented in the EPRI ALWR Requirements DocumentM, was used to perform the PRA. The methods used for the external events evaluation are summarized in Section 19.15.3. The core damage frequency for internally initiated events is summarizel in Section 19.15.2.1.1. The dominant accident sequences and their major contributors to core damage frequency for internal events are summarized in Section 19.15.2.1.2. In Section 19.15.2.1.3, the impact of several System 80+ design features, as they relate to the reduction of core damage frequency for internal events, are presented.

Finally, the insights drawn from the uncertainty, sensitivity, and importance analyses are presented in Section 19.15.2.1.4.

19.15.2.1.1 Core Damage Frequency by Initiating Events For the System 80 design, loss of offsite power ar.d station blackout dominates the core damage frequency profile. This is followed by the LOCAs and then transients. The contribution by ATWS is relatively small. For the System 80+ design, the LOCA categories of initiating events dominate the core damage frequency profile. This is followed by the transient category of events and SGTR category of events.

The contribution from loss of offsite power (including station blackout) is relatively small because of the following features that were incorporated into the design:

• Multiple independent connections to the grid.

• Turbine-generator runback capability to maintain hotel loads.

• Alternate standby AC source (combustion turbine).

• Six vital 125 VDC batteries.

The contribution from ATWS is also relatively small.

19.15.2.1.2 Domhumt Accident Sequences for Internal Events The general assumptions that were made in developing the accident sequen :s are outlined below.

Assumptions that are applicable to specific accident sequences are outlined under the appropriate initiating event.

• Except for a large or medium Loss of Coolant Accident (LOCA), a reactor trip is the primary means of reactivity control for all initiating events.

• For accident sequences that include failure of containment heat removal or failure to cool the O

IRWST, it was assumed that the CVCS can provide an alternative source of borated water to Aptwaved Design Material

• Probab&stic Itisk Assessment Page 19.154

System 80+ Deslan controlDocwnent replenish the IRWST inventory. Some IRWST inventory (in the form of steam - flashing) will be lost after the containment fails.

e The list of initiating events analyzed during power operation was assumed to be complete and comprehensive. This list was generated based on initiating events addressed in previous PRAs, guidance from the PSA Procedures Guide, and features which are unique to the System 80+  !

' design.

)

e- For those accident sequences which include inoperable systems / components due to loss of rower  ;

i to the system / components, it was assumed that certain operator recovery actions cauld be performed to restore power to the affected systems / components, and conseques/Jy prevent core  :

damage.  !

e It was assumed that, in general, mechanical failures of components cannot be repaired within the j 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time. As a result, mechanical failures are assumed to be non-recoverable and i are therefore not credited as a means of preventing core damage.

e For all initiating events, except large and medium LOCAs, it was assumed that the preferred means of removing decay heat from the reactor is via the steam generator (s). If decay heat  ;

cannot be removed via this means, then " feed and bleed" is an alternate means of accomplishing this function.

e-  : Steam removal from the secondary side is the preferred means of removing decay heat from the

( reactor core during the short-term phase of decay heat removal. Because of the diverse and redundant paths available for steam removal, failure to accomplish this function is assumed to be an extremely low probability event (when compared to failure of other functions on the event trees). Hence, failure of this function is not explicitly modeled in the event trees, e For transient and small LOCA sequences where long-term decay heat removal is accomplished via long-term emergency feedwater delivery, it was conservatively assumed that the Emergency Feedwater Storage Tank (EFWST) inventory would need to be replenished within the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time.

The dominant accident sequences due to internal initiated events and their contributions to the core damage frequency for the System 80+ design are presented in Table 19.15.2-2. The dominant accident sequences are described below.

Loss of Feed Flow Events The following assumptions were made for the loss of feed flow accident sequences.

e. Following a reactor trip, it was assumed that the RCS pressure will not increase to the lift

- pressure of the Primary Safety Valves. Hence, consequentird PSV induced LOCA was not modeled.

I e: The Startup Feedwater System can be used to deliver feedwater to the steam generators following a reactor trip. Because this system is connected to the main feedwater system it was assumed to F be also unavailable following a loss of main feedwater event.

t W W Mstnennf

• hohehWB8(t Rink A0000sneerst Page 19 r$-9 N ,

y .. '{

. 6:4 %.4 N l. -

. , _ _ ~ , _ _ ____e - .._ . . _ - . . _ _, , - _ - _ a

System 80+ Design CrntrolDoeument Four dominant accident sequences were identified for loss of main feedwater flow events, LOFW-9, LOFW-4, LOFW-8, and LOFW 5.

• LOFW-9 is an accident sequence which involves loss of main feedwater to the steam generators followed by failure of the Emergency Feedwater System (EFWS), and failure of the Safety Depressurization System (SDS) to perform bleed operation. The EFWS is the preferred means available for removing decay heat via the steam generators. If the EFWS fails then once-through cooling or " feed and bleed" is the alternate means of removing decay heat from the reactor core.

However in this sequence, the " bleed" portion of " feed and bleed" fails and consequently core damage occurs. The dominant contributors to this sequence are: (1) common cause failure of EFW distribution line check valves, (2) common cause failure of EFW pump discharge check valves, (3) common cause failure of the " bleed" valves, and (4) onerator fails to initiate " feed and bleed".

• LOFW-4 is an accident sequence which involves loss of main feedwater to the steam generators followed by successful deliver of emergency feedwater to the steam generators, failure of long-term decay heat removal, and failure of " feed" operation. Long-term cooling provides continued decay heat removal, once the initial cooldown by the EFWS is completed. However for this sequence, long-term cooling fails and " feed and bleed" becomes the other alternative for removing decay heat from the reactor core to prevent core damage from occurring. Because the

" feed" portion of " feed and bleed

• also fails core damage eventually occurs. The dominant contributors to this sequence are: (1) common cause failure of the safety injection line check valves, (2) independent failure of the CST makeup valve (check or manual), and (3) operator fails to align CST to EFW storage tanks.

• LOFW-8 is an accident sequence that is similar to LOFW-9 except that the " bleed" portion of

" feed and bleed" fails instead of " feed" The dominant contributors to this sequence are: (1) common cause failure of the EFW distribution line check valve, (2) common cause failure of the EFW pump discharge check valve, (3) common cause failure of safety injection line check valves, (4) common cause failure of the safety injection line motor operated valves, and (5) common cause failure of the safety injection pumps.

• LOFW-5 is an accident sequence that is similar to LOFW-4 except that the " bleed" portion of

" feed and bleed" fails instead of " feed" The dominant contributors to this sequence are: (1) common cause failure of the SCS suction valves, (2) independent failure of the CST makeup valve (check or manual), (3) operator fails to initiate " feed and bleed", (4 common cause failure of " bleed" valves, (5) operator fails to align CST to EFW storage tanks.

Steam Generator Tube Rupture (SGTR) Events The following assumptions were made for Steam Generator Tube Rupture (SGTR) accident sequences.

• The representative SGTR event was assumed to be a complete severance of a single tube.

Multiple tube ruptures are less likely than a single tube rupture. In addition, the success criteria of the systems called upon to respond are substantially the same as those for a single tube rupture. Therefore, multiple tube ruptures are not addressed separately.

• Following a turbine and reactor trip, the secondary side pressure may increase to the lift pressure of the first bank of Main Steam Safety Valves (MSSVs).

Approved Design Atatoriet.ProbalnGstic Risk Assessment Pope 19.15-10

Srtem 80+ Design ControlDocument b

V Five dominant accident sequences were identified, SGTR-17, SGTR-9, SGTR-16, SGTR-12, and SGTR-8.

• SGTR-17 is an accident sequence which involves a stea;.. generator tube rupture event followed by failure of the Safety Injection System (SIS) and the inability to aggressively cooldown the secondary side of the plant to initiate shutdown cooling injection. Failure of SIS results in loss of the preferred way of making-up and controlling the lost RCS inventory. By aggressively cooling down and depressurizing the RCS, the SCS can be used to provide the necessary makeup to the reactor core. Therefore, a failure of SIS and failure to establish aggressive cooldown results in core damage. The dominant contributors to this sequence are: (1) common cause failure of the safety injection line check valves, (2) common cause failure of safety injection line motor operated valves, (3) common cause failure of safety injection pumps to start or run, and (4) operator fails to perform aggressive cooldown.

Aggressive Secondary Cooldown (ASC) has a significant impact on the core damage frequency contribution for SGTR. Therefore, the emergency operating procedures for responding to as SGTR should specifically address ASC. This should include procedural steps for early identification of the failure of safety injection and specific steps for instituting the cooldown by opening the ADVs and ensuring that EFW is being delivered to both generators. The procedure should also specify that even if ASC is in progress, the ruptured steam generator should be isolated when the RCS temperature and pressure have decreased to the point at which there is reasonable assurance that the MSSVs on the ruptured generator will not lift. The procedures should direct the operator to continue the ASC using only the good generator. The procedures fq should also include all steps needed to align the SCS pumps for injection once the appropriate

() temperature and pressure limits have been reached.

• SGTR-9 is an accident sequence which involves a steam generator tube rupture event followed by failure of RCS pressure control, failure to isolate the ruptured steam generator, and failure to re-fill the IRWST. Following the tube rupture event, the SIS successfully provided the necessary makeup to the RCS. Also, the EFWS delivered feedwater successfully to the intact steam generator for decay heat removal via the steam gen:rator. However for this sequence, RCS pressure control is not provided, the ruptured steam generator is not isolated, and re-filling of the IRWST is also not accomplished. As a result, core damage eventually occurs. The dominant contributors to this sequence are: (1) faih're of the main steam safety valves to re-seat, (2) operator fails to throttle safety injection pumps, u.4 (3) operator fails to align CVCS to re-fill IRWST following SGTR.

• SGTR-16 is an accident sequence which involves a steam generator tube rupture event followed by failure of the SIS and failure of the SCS to inject borated water into the RCS. Once SIS fails, an aggressive cooldown of the secondary side is successfully accomplished. The aggressive cooldown also decreases the RCS pressure so that the SCS pumps can be used to provide the necessary makeup to the RCS. However for this sequence, the SCS fails to provide the necessary makeup and consequently core damage occurs. The dominant contributors to this sequence are:

(1) common cause failure of the safety injection line check valves, (2) common cause failure of the safety injection to start or run, and (3) operator fails to align SCS for injection.

• SGTR-12 is an accident sequence which involves a steam generator tube mpture event followed O

V by failure of the EFWS and the SDS. Following the SGTR event, the SIS provides makeup for the lost reactor coolant (through the rupured tube). However, the removal of decay heat via the l

i intact steam generator is not accomplished because the EFWS fails to deliver feedwater to the Approved Design Material- Probabdistic Risk Assessment Page 19.1511

System 80+ Design ControlDocument steam generator. Although the removal of decay heat via the steam generator is lost (the preferred means), " feed and bleed" would then be used as the alternate means of removing decay heat from the RCS. However for this sequence, the SDS which provides the " bleed" portion of

" feed and bleed" also fails and consequently core damage occurs. The dominant contributors to this sequence are: (1) common cause failure of the EFW distribution line check valves, (2) common cause failure of the EFW pump discharge check valves, (3) operator fails to initiate

" feed and bleed", and (4) common cause failure of the " feed and bleed" valves.

• SGTR-8 is an accident sequence which involves a Steam Generator Tube Rupture event followed by an unisolable leak in the ruptured steam generator and failure to maintain secondary heat removal. Unisolable leak results in :he increase in the level and, subsequently, pressure in the ruptured steam generator rises. Theefore, failure to maintain secondary heat removal results in loss of decay heat removal from the reactor core. This scenario leads to core damage. The dominant contributors to this sequence are: (1) common cause failure of the Atmospheric Dump Valves (ADVs) and (2) failure of the Condensate Storage Tank (CST) discharge manual and check valves to open.

Small LOCA Events The following assumptions were made for the small Loss of Coolant Accident (LOCA) sequences.

• The break size is not large enough to remove decay heat from the core. Therefore, the removal of decay heat via the secondary side is required.

• If the Safety hijection System (SIS) fails to control and maintain RCS inventory, it was assumed that the Shutdown Cooling System (SCS) can be used to provide RCS inventory control provided an aggressive depressurization of the RCS is performed.

Three dominant accident sequences were identified for small Loss of Coolant Accident (LOCA) events, SL-11, SL-10, and SL-4.

• SL-Il is an accident sequence which involves a small break loss of coolant followed by failure of SIS and failure to aggressive cooldown the secondary side. To mitigate a small LOCA, makeup of the lost reactor coolant must be provided. Normally the SIS provides this function, but for this sequence it fails. The other line of defense would be to aggressively cooldown the secondary side and use the SCS pumps to provide the needed makeup. Aggressive cooldown also fails and the lost coolant is not restored. Consequently, core damage occurs. The dominant contributors to this sequence are: (1) common cause failure of the safety injection line check valves, (2) common cause failure of the safety injection line motor valves, (3) common cause failure of the safety injection pumps to start or run, and (4) operator fails to perform aggressive cooldown following a small LOCA.

Aggressive Secondary Cooldown (ASC) has a significant impact on the core damage frequency contribution for small LOCA. Therefore, the emergency operating procedures for responding to a small LOCA should specifically address ASC. This should include procedural steps for early identification of the failure of safety injection and specific steps for instituting the cooldown by opening the ADVs and ensuring that EFW is being delivered to both generators. The procedures should also include all steps needed to align the SCS pumps for injection once the appropriate temperature and pressure limits have been reached.

Approved Design Meterial Probabmsuc Stisk Assessment Page 19.15-12

h System 80+ Dessen controlDocument

, i t

o'  !

"(

. SL-10 is an accident sequence which involves a small break loss of coolant followed by failure of the SIS and failure of the SCS to provide injection. Makeup of the lost reactor coolant must j be provided to mitigate a small LOCA. Normally this function is provided by the SIS, but for l this sequence, it fails. Aggressive cooldown of the uMwy side is then accomplished  ;

successfully In cooling down the secondary side, RCS pressure also decreases and the SCS

. would then be aligned to inject borated water into the RCS. Although aggressive cooldown was '

successful for this sequence, the SCS fails to provide the necessary makeup and consequently core -

i damage occurs. The dominant contributors to this sequence are: (1) common cause failure of the safety injection line check valves, (2) common cause failure of the safety injection line motor -  !

valves (3) operator fails to align SCS for injection, and (4) common cause failure of the safety injection pumps to start or to run.-

.

• SI 4 is an accident sequence which involves a small break loss of coolant followed by failure of long-term decay heat removal and failure of the SDS For this sequence, the SIS provided the l

. necessary makeup to the RCS and the EFWS successfully provided feedwater to the steam i generators during the first phase of plant cooldown. Long-term decay heat removal would l normally be initiated to continue the plant cooldown process, but this function is not  !

accomplished in this sequence. " Feed and bleed" is the next alternative. However, the failure j i

of the SDS causes the " bleed" portion to be unsuccessful and consequently core damage occurs.

The dominant contributors to this sequence are: (1) common cause failure of the SCS/CCW l valves, and (2) failure of the " bleed" valves. {

i Medium LOCA Events  :

I The following assumptions were made for the medium LOCA sequences.

i e A reactor trip is not required to mitigate a medium LOCA event.  ;

t

• The break size is large to remove decay heat from the reactor core. Therefore, the removal of l

- decay heat via the secondary side is not required.

t i

• SIT injection is not required for RCS inventory control and prevention of significant core damage for a medium LOCA. .

Two dominant accident sequences were identified for medium LOCA events, ML2-3 and ML1-3. (To facilitate the definition and evaluation of the Plant Damage States (PDS) for the containment response ,

analysis, the medium LOCA category of events was split into two separate events bases on the estimated j in-vessel pressure at the time of the onset of core damage.)  ;

.?

4

• ML2-3 is an acesdent sequence which involves a medium LOCA event followed by failure of the

+ sis. Failure of the SIS during the early phase of the medium LOCA (i.e., during direct vessel injection) results in failure to provide makeup to the reactor core and also to remove heat from the core. Failure of the SIS during the latter phase of the medium LOCA (i.e., simultaneous hot-  !

leg and direct vessel injection) results in boron crystallization which blocks flow through the core

, and consequently core damage occurs. The dominant contributors to this sequence are

(1)  ;

common cause failure of the hot-leg isolation valves, (2) common cause failure of the safety

. injection line check valves, (3) common cause failure of hot-leg check valves, (4) operator fails to initiate hot-leg injection, and (5) common cause failure of the safety injection line motor valves. ,

< 4preved assen aanseder. Assamarale med Assessmeet peps 19.75-7J

l l

System 80+ Design ControlDucument

• ML1-3 is an accident sequence which is similar to ML2-3, except that the in-vessel pressure at the onset of core damage is less than the in-vessel pressure associated with ML2-3 sequence.

Large LOCA Events The assumptions for the large LOCA sequences are similar to the first two assumptions for the medium LOCA sequences and at: therefore not repeated.

Two dominant accident sequences were identified for large LOCA events, LL-3 and LL-4.

• LL-3 is an accident sequence which involves a large loss of coolant followed by failu.e of the SIS. The inventory of the Safety Injection Tanks (SITS) discharges into the RCS to provide the instantaneous makeup required following the rapid depressurization of the RCS caused by the large LOCA. The S!S then fails to provide its function. Failure of the SIS during the early phase of the medium LOCA (i.e., during direct vessel injection) results in failure to provide makeup to the reactor core and also to remove heat from the core. Failure of the SIS during the latter phase of the medium LOCA (i.e., simultaneous hot-leg and direct vessel injection) results in boron crystallization which blocks flow through the core and consequently core damage occurs.

The dominant contributors to this sequence are: (1) common cause failure of the safety injection line check valves, (2) common cause failure of the safety injection line motor valves, (3) common cause failure of the hot-leg check valves, (4) common cause failure of hot-leg isolation valve, and (5) operator fails to initiate hot-leg injection.

• LL-4 is an accident sequence which involves a large loss of coolant followed by failure of the SITS. The required instantaneous makeup of reactor coolant is not provided and consequently core damage occurs. The dominant contributors to this sequence are: (1) common cause failure of safety injection line check valves, and (2) common cause failure of SIT discharge check valves.

Vessel Rupture Event This event is defined as any breach of the primary pressure boundary that causes loss of reactor coolant in excess of the capacity of the SIS. If this event were to occur, it is assumed that it would lead directly to core damage and there are no sequences with mitigating system failures associated with it.

Other Transient Events The following assumptions were made for transient accident sequences other than loss of main feedwater flow.

• The Startup Feedwater System or the Emergency Feedwater System can be used to deliver feedwater to the steam generators following a reactor trip.

• Following a reactor trip for a loss of condenser vacuum initiating event, the RCS pressure may approach the lift pressure of the Primary Safety Valves (PSVs). Hence, consequential PSV induced LOCA for loss of condenser vacuum was modeled. Other Transients are those non-LOCA events other than loss of main feedwater in which a process parameter penurbation leads to a reactor trip. Four dominant accident sequences were identified for Other Transient events, TOTH-4, TOTH-12, TOTH-5, and TOTH-9.

Approved Desiger Material ProbabiusW Risk Assessmerrt Page 19.15-14

i

System 80+ Dessen contmlDocument 1

i

• TOTH-4 is an accident sequence which involves a transient other than loss of main feedwater

- followed by failure of long-term decay heat removal and failure of the SIS. The EFWS is used ,

during the early phase of plant cooldown to remove decay heat from the RCS. Once SCS entry conditions are met, long-term decay heat removal is normally initiated to continue the cooldown  ;

process. This function is not accomplished for this sequence because of failure of the SCS during  :

initiation or during operation and makeup to the emergency feedwater storage tanks is not .j provided. Without the added makeup the EFWS cannot continue the decay heat removal process. l

. Failure of long-term decay heat removal using the SCS and the EFWS would then cause operator to initiate " feed and bleed". However for this sequence, the SIS also fails and " feed" cannot be

[

accomplished. As a result, the decay heat removal process is terminated and core damage eventually occurs. The dominant contributors to this sequence are: (1) common cause failure of <

safety injection line check valves, (2) independent failure of CST make-up valve (check or  ;

manual), and (3) operator fails to align CST to EFW Storage Tanks.

t

• TOTH-12 is an accident sequence which involves a transient, failure of the primary safety valves

- (PSVs) to re-seat, and failure of the safety injection system (SIS). Because of the pressure  !

transient associated with this event, the primary safety valves open to relieve primary pressure.

However, the valves do not re-seat as required and a PSV induced LOCA occurs. The SIS would  !

provide make-up for the lost RCS inventory under these conditions, but the SIS fails and 1

j consequently core damage eventually occurs. The dominant contributors to this sequence are:

(1) failure of the PSVs to re-seat, (2) common cause failure of the safety injection line check  :

valves, (3) common cause failure of the safety injection line motor operated valves, and (4)  !

common cause of the safety injection pumps to start or to run.  :

4 4

• TOTH 5 is an accident sequence which involves a transient other than loss of main feedwater j

- followed by failure of long-term decay heat removal and failure of the SDS. This sequence is

!. similar to TOTH-4, except that " bleed" fails instead of " feed". The dominant contributors to this sequence are: (1) common cause failure of the SCS suction valves, (2) failure of the CST make-up valve (check or manual), (3) operator fails to initiate " feed and bleed", (4) common cause failure of the " feed and bleed" valves, and (5) operator fails to align CST to EFW Storage Tanks. ,

t I

• TOTH-9 is an accident sequence which involves a transient other than loss of main feedwater l followed by failure of the EFWS, the Startup Feedwater System (SFWS), and the SDS. The i- inability to deliver feedwater to the steam generators terminates the preferred means of removing decay heat. " Feed and bleed" operation then becomes the next alternative for removing heat from i' the core. Both the " feed" portion and the " bleed" portion must function for this operation to be successful. For this sequence, the SDS also fails to provide " bleed" and therefore all mean of removing decay heat from the core is lost. Consequently, core damage eventually occurs. The dominant contributors to this sequence are: (1) common cause failure of the EFW distributionline check valves, (2) common cause failure of the EFW pump discharge check valves, (3) failure of i the startup feedwater pump to start, and (4) operator fails to initiate " feed and bleed". ,

Antidpated Transients without SCRAM (ATWS) Events The following assumptions were made for Anticipated Transient without Scram (ATWS) accident sequences. [

'. '* It wu assumed that if the peak RCS pressure resulting from an ATWS event exceeds the ASME level C stress limits, the'RCS pressure boundary will be breached and the SIS isolation check valves will be deformed so that they will not open.-

hemed oeew neeen,nar. Presasaruc aime Au ume,t rene rs.ss.ts

._ _ . _ - , _ _ _. - _ _ . _ . .. ~ . __ -, ,

Design ControlDocument System 80+

• Sufficient negative Moderator Temperature Coefficient (MTC) will preclude the RCS peak pressure from exceeding the level C stress limits.

• It was assumed that at least three of the four primary safety valves must open to prevent the RCS pressure from exceeding the level C stress limits.

• Once the RCS pressure is relieved, the PSVs should re-close. It was assumed that if any PSV fails to re-close, reactor coolant will be lost through the stuck open PSV and the leak is equivalent to a medium LOCA.

• Because of the high differential pressure between the primary and secondary sides, a consequential steam generator tube rupture may occur following an ATWS event.

Two dominant accident sequences were identified for ATWS events, ATWS-29 and ATWS-9.

• ATWS-29 is an accident sequence which involves a transient without scramming the reactor in conjunction with an adverse Moderator Temperature Coefficient (MTC). For this sequence, the MTC is not negative enough to reverse by reactivity feedback the increasing temperature and pressure of the RCS. As a result the reactor vessel eventually fails.

o ATWS-9 is an accident sequence which involves ATWS followed by successful delivery of emergency feedwater to the steam generators, failure to deliver borated water to the RCS, and failure of " bleed" operation. Failure to borate the RCS prohibits the ability to decrease the teactivity, and therefore reactivity control cannot be accomplished. The failure of " bleed" prevents the depressurization of the RCS to allow the injection of borated water by the safety injection pumps. The dominant contributors to this sequence are: (1) operator fails to initiate boron delivery via the CVCS, (2) operator fails to initiate " feed and bleed", and (3) common cause failure of the " bleed" valves.

Loss of Offsite Power (LOOP)/ Station Blackout (SBO) Events The following assumptions were made for Loss of Offsite Power (LOOP) and Station B;ackout (SBO) accident sequences.

• A loss of offsite power event includes loss of the two offsite power sources (switchyards), and the turbine / generator does not nm back and maintain hotel loads such that actuation of the emergency power source is required.

• Best estimates analyses show that the increase in RCS pressure following a LOOP event is well below the lift pressure of the PSVs. Therefore, a LOCA due to failure of the PSVs to rescat is not modeled.

• If AC power (alternate AC source or offsite power) cannot be restored within 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />, station I blackout with complete depletion of the batteries will occur and core damage will also occur. {

Three dominant accident sequences were identified for LOOP /SBO events, LOOP-9, LOOP-8, and SBO.

• LOOP-9 is an accident sequence which involves a loss offsite power followed by failure of the EFWS, and failure of the SDS. For this sequence, the primary safety valves open and re-seat as required following the plant trip. Because the EFWS has failed, the removal of decay heat Approved Design Material Probab&stic Risk Assessment Page 19.15-16 I

+

System 80+ Deslan contratDocument .

i j

~

from the reactor core via the steam generators cannot be accomplished. " Feed and bleed" would be the next means of removing decay heat, but the SDS also fails. " Bleed" is not accomplished  !

because of SDS failure. As a result, all means of removing decay heat from the core is now lost  !

i and core damage eventually occurs. The dominant contributors to this sequence are: (1) common cause failure of the EFW distribution line check valves, (2) common cause failure of the EFW j pump discharge check valves, (3) operator fails to initiate " feed and bleed", and (4) common l cause failure of the " bleed" valves, c

• LOOP-8 is an accident sequence which is similar to LOOP-9, except that the " feed" portion of l

" feed and bleed" fails instead of " bleed". The dominant contributors to sequence LOOP-8 are:

(1) common cause failure of the EFW turbine- driven pumps, (2) common cause failure of the j

emergency diesel generators to operate, (3) common cause failure of the emergency diesel  :'

generators on demand, and (4) common cause failure of the EFW distribution line check valves.

~

• SBO is treated as a special LOOP event. For this event, the offsite power sources, the onsite ,

, emergency diesel generators, and the alternate AC source are unavailable. Therefore, the only y

mitigating system available is the EFWS, using the turbine-driven pumps. After eight hours the' ,

batteries would be depleted if an AC power source is not restored. _Once the batteries are {

depleted, long-term decay heat removal would be terminated and core damage eventually occurs. 1 The dominant contributors to this sequence are: (1) common cause failure of the emergency diesel ,

generators on demand, (2) failure to start and load standby AC source, (3) common cause failure ]

of DG sequencers, and (4) failure of the emergency diesels to start and load. j l

Loss of HVAC Events I l

The following assumptions were made for Heating, Ventilation and Air-Conditioning (HVAC).

• The loss of one division of HVAC was assumed to be any failure in one of the two divisions of HVAC that is not restored before a critical temperature is exceeded in a room containing temperature sensitive electrical and electronic equipment. The temperature sensitive equipment is assumed to fail and cause the loss of control for the associated division of safety related systems. Consequently, one division of safety related systems would be unavailable to perform their functions.

l One dominant accident sequence was identified for loss of HVAC events, LHV-5. )

I i

• LHV 5 is an accident sequence which involves loss of one division of HVAC followed by failure of long-term decay heat removal and failure of SDS. The Emergency and Startup Feedwater j systems are used to remove decay heat from the RCS until shutdown cooling entry conditions are met. Once shutdown cooling conditions are met, the SCS would then be used to remove decay heat. However for this sequence, the SCS fails either during initiation or during operation and i the EFWS cannot continue to remove decay heat because makeup to the Emergency Feedwater Storage Tanks is not provided. Failure of the feedwater and shutdown cooling systems causes ,

the preferred means of removing decay heat to be lost. " Feed and bleed" would then be the

' alternate means of removing decay heat from the core. The SDS is used to provide the " bleed"  !

function in the " feed and bleed" operation, but this system also fails. Failure of both the j preferred and the alternate means of removing decay heat eveno 11y causes core damage to ,

occur. . The dommant contributors to this sequence are: (1) coirft .a cause failure of the " bleed" l

!~

Anweeeer Daegpe nannuner . hosesnee\r nuek Aneumont rose 1s.15-17 l

Sy= tem 80 + Design ControlDocument valves, (2) operator fails to initiate " feed and bleed", (3) failure of the SCS suction valve, (4) failure of the CST makeup valve (check or manual), and (5) operator fails to align CST to EFW Storage Tanks.

Large Secondary Side Break (LSSB) Events The following assumptions were made for Large Secondary Side Break (LSSB) accident sequences.

• The location of an LSSB event (inside containment or outside containment) is not modeled because plant and operator responses with respect to core damage prevention will be similar.

o It was assumed that there is a potential for return to power if the rod with the most negative reactivity worth is stuck outside the core and the RCS is not borated.

One dominant accident sequence was identified for LSSB events, LSSB-9.

e LSSB-9 is an accident sequence which involves a Large Secondary Side Break event followed by failure of the EFWS and failure of the SDS. For this sequence, the EFWS fails to deliver feedwater to the intact steam generator. If decay heat cannot be removed via the steam generator, the " feed and bleed" would be the next alternative. Both the " feed" portion and the " bleed" portion must operate successfully to remove decay heat. The SDS which performs the " bleed" operation also fails in this sequence. The removal of decay heat from the core is therefore terminated and core damage eventually occurs. The dominant contributors to this sequence are:

(1) common cau~ failure of the EFW distribution line check valves, (2) common cause failure of the EFW pump discharge check valves, (3) operator fails to initiate " feed and bleed", and (4) common cause failure of the " bleed" valves.

19.15.2.1.3 Risk-Reduction Design Features The System 80+ possesses several features, as described in Section 19.15.1.1, that are beneficial to reducing the frequency of core damage. The major reductions in core damage frequency (CDF), when compared with System 80, are associated with:

o LOOP /SBO events, l

e Transient (IAss of Main Feedwater and Other Transient) events, e Steam Generator Tube Rupture events,

• Small LOCA events, and e ATWS events.

The following features of the System 80+ design are the major contributors to the reduction of the core damage frequency (with respect to the System 80 design) for the above categories of internally initiated events.

I

• LOOP /SBO - multiple offsite power sources, alternate standby AC power source, dedicated batteries for each emergency diesel generator, four trains of emerg, %dwater (two with  !

turbine-driven pumps), and turbine-generator capable of running back h + - loads.

Awmd Des 4n meew- Prosasmsuc msk Assessment page ss.ss-ss i

I a

~~ _- - _ _ .. . .- .- . - - . - - - - _ . - . -

C System 80+' Design Coneol Document l

! i I

(

/

o' ' Transients - four trains of emergency feedwater (two with turbine-driven pumps), redundant q sources of emergency feedwater, high reliable normally ' runnmg Component Cooling  !

Water / Station Service Water systems, separate Startup Feedwater System (actuated before .l EFWS), tusine generator capable of running back to hotel loads, two redundant and diverse j Emergency Feedwater Actuation Systems, and once through cooling capability (" feed and bleed"). j e Steam Generator Tube Rupture - four trains of Emergency Feedwater System (two with turbine-  ;

driven pumps), four trains of safety injection, and once through cooling capability (" feed and l

. bleed").

I e Small LOCA -In-containment Refueling Water Storage Tank (eliminated the need for switch-over I

- of pump suction), four trains of Emergency Feedwater System (with two turbine <triven pumps),

four trains of Safety Injection System, and once through cooling capability (" feed and bleed").

'* A'IWS - larger pressurizer, larger steam generators, Safety Depressurization System, and diverse protection system.  ;

19.15.2.1.4' Insights from &e Uncertainty, Sensitivity, and Importance Analyses  ;

i 19.15.2.1.4.1 Insights from the Uncertainty Analysis  !

The major insights from the uncertainty analysis are listed below.

1. The majority of the major contributors to the dominant accident sequences have relatively small l uncertainties (i.e., error factor less than 10) associated with them. l i

2. A few of the major contributors to the dominant accident sequences have relatively large I uncertainties (i.e., error factor of 10 or greater). The contributors with large uncertainties include hardware failures such as common cause failure of the safety injection pumps, common l cause failure of the emergency DG sequencers, independent failure of the CST manual makeup  !

valve, and vessel rupture. The human errors with large uncertainties include operator fails to  !

initiate " feed and bleed", operator fails to perform aggressive secondary side cooldown following  ;

SGTR, operator fails to perform aggressive cooldown following a small LOCA. and operator l fails to align CVCS to fill IRWST following SGTR. I i

3. The hardware failures and human errors with large uncertainties associated with them are the )

major contributors to the uncertainty associated with the calculated core damage frequency for i l

internal events.

I 19.15.2.1.4.2- Insights from lavel I Sensitivity Analyses Several cases of sensitivity analyses were preformed for the System 80+ design to determine what impact, if any, the following issues would have on the core damage frequency. The sensitivity insights are summarized below.

Overall Operator Ermr Rate The probability that the operator fails to perform a specified task was determined using the SHARPN methodology. It has been shown in previous PRAs that the core damage frequency can be sensitive to

- human error probt.bilities. As a result, a sensitivity was performed to determine the impact on the core 4peeent oneon annenM . nesesawc niet aseenement n e e ts.rs-rs

System 80+ Design ControlDocument damage frequency for internal events. All operator error probabilities and non-recovery probabilities were increased by a factor of 10 and the total core damage frequency for internal events was then requantified. The results for this case show that the core damage frequency for the System 80+ design is somewhat sensitive to operator error probabilities.

Control Room Response Several types of operator actions are performed during the progression of an accident sequence. Actions  !

are performed inside the control room as well as outside the control room. An issue has arisen regarding the capability of the operator to perform mitigating actions outside the control room once an accident or transient has occurred. To address this issue, a sensitivity analysis was performed which credited only the operator actions that took place from the control room. The results show that the core damage frequency for the System 80+ design is extremely sensitive to operator actions which are performed outside the control room during the progression of an accident.

Motor-Operated Valve Failure Rate A large number of motor-operated valves are used in safety-related systems of the System 80+ design.

In general, these valves are required to change position in order for the systems to perform their safety-related functions. There has been a concern that the failure rates of motor-operated valves have been underestimated. Consequently, a sensitivity analysis was performed to address this issue. The results for this case show that the core damage frequency for internal events is not highly sensitive to the failure rates of motor-operated valves.

SITS for Medium LOCA For the System 80+ PRA, a best-estimate thermo-dynamic analysis was performed to confirm the belief l that the Safety Injection Tanks (SITS) were not needed to prevent core damage following a medium LOCA event. In previous PRAs, it was assumed that three of the four SITS must inject to prevent core i damage from occurring following a large or medium LOCA event. This assumption is included only in 1 the large LOCA model and not in the medium LOCA models, and a sensitivity analysis was therefore performed to address this issue. There were no measurable changes in the core damage frequency when  ;

the SITS were credited for preventing core damage following a medium LOCA event. The System 80+

design is not sensitive to this issue.

Feasibility of Aggressive Secondary Side Cooldown For small LOCAs and Steam Generator Tube Ruptures (SGTRs), it was assumed that if safety injection was not available for inventory control, the RCS could be depressurized via a rapid cooldown of the secondary side then aligning the SCS pumps to provide injection for RCS inventory control. This assumption was based on analyses for the System 80 plants documented in CEN-239CO 80 A confirmatory analysis was performed to demonstrate that these analyses are applicable to the System 80+

design. Ilowever, the impact on core damage if aggressive cooldown is not feasible still remained an issue and was therefore addressed via sensitivity analysis. The results indicate that the core damage frequency for internal events is not highly sensitive to the ability to perform aggressive cooldown of the l secondary side following a small LOCA or SGTR event. 1 O

Asyveved Design Atoterial* Probab&stic Risk Assessment Page 1915-20 A

Sy: tem 80 + Design ControlDocument Q RCP Seal Failure Following Station Blackout Event With a loss of station AC power (Station Blackout), cooling water to the seals of the Reactor Coolant Pump (RCP) will be lost. The NRC has postulated in their evaluation of Station Blackout <5D that under these conditions, the seals will begin to degrade and gross seal leakage on the order of several hundred gallons per minute may occur. The CEOG contends that this in not credible for pumps used in C-E plants (50. A sensitivity analysis was performed to assess the impact on core damage frequency if there is a finite probability that the System 80+ RCP seals will fail following a Station Blackout (SBO) or loss of cooling water event.

In the System 80+ PRA, SBO is defm' ed as a Loss of Offsite Power (LOOP) with demand failure of both emergency diesel generators and failure of the standby AC power source. If following an SBO, RCP failures occur, core damage can be prevented if offsite power is restored and the injection pumps are started before the core is uncovered. The available time to recover offsite power is a function of the RCP seal leak rate. For this sensitivity analysis, it was assumed that the RCP seal leak rate was such that the time available to recover offsite power before the core would become uncovered was one hour.

Loss of component cooling water, as an initiating event, will also result in the loss of cooling water flow to the seals of two of the four RCPs.

The modeling and quantification of the effects of RCP seal failure on core damage frequency show that the core damage frequency for internal events is not sensitive to RCP seal failure following a SBO or loss of cooling water event.

(3

() Components Unavailable Due to Maintenance Components in safety-related systems are periodically tested per technical specification requirements. In some cases, the components may be unable to perform their safety-related function during the test. In addition, if the component is found to be failed during the test, it is taken out of service for maintenance.

While the component is out of service for maintenance, it is unable to perform its safety-related function.

Component unan%bility due to test and maintenance was included in the System 80+ PRA models.

A sensitivity analysis was performed to evaluate the impact on core damage frequency if it was assumed that all components were able to perform their safety-related function while in test and that no maintenance was performed on safety-related equipment while the plant was at power.

The results show that the core damage frequency for internal events did not change.

Adverse MTC An ATWS is an event in which an anticipated transient occurs but the reactor is not shutdown by automatic insertion of the control rods. One factor that influences the progression of an ATWS event is the Moderator Temperature Coefficient (MTC). If the MTC is more positive than a calculated critical value, the peak RCS pressure will exceed the level C stress limit pressure and a non-mitigatable LOCA is assumed to occur. For System 80+, the critical MTC was calculated to be -0.30E-4 Ap/*F. For MTC values more positive than -0.30E-4 Ap/*F, the peak RCS pressure will exceed the level C stress limit pressure if less than three PSVs open. For System 80+, it has been determined that the MTC value should be less than -0.30E-4 Ap/*F for 99% of the core life. The dominant ATWS core damage

[U sequence is (ATWS occurs) AND (MTC is adverse). A sensitivity analysis was performed to assess the impact on core damage frequency if the MTC was found to be adverse over a larger fraction of the core life.

Alvvoud Design Afsteniel Probahnktic Risk Assessment Page 19.15 2r

1 l

System 80+ Design controlDocument l l

The results indicate that the System 80+ core damage frequency for internal events is not very sensitive to the adverse MTC probability.

1 Loss of Offsite Power Frequency l

In past PRAs, the core damage frequency attributable to LOOP has been greater in both absolute value and relative contribution to the total. There are a number of reasons for the reduction in the core damage frequency contribution for LOOP for System 80+. These include: (1) the capability of the main turbine / generator to runback and pickup hotel load on loss of offsite power, (2) two separate switchyards for incoming power (3) a four train EFW system with two 100% capacity turbine driven pumps (4) six vital 125 V DC batteries and (5) a standby combustion turbine which can backup the emergency diesel generators.

Based on the first three features, a LOOP initiating event was defined as a loss of site power which required the startup and loading of the emergency diesel generators. A sensitivity analysis was performed to determine the impact on the core damage frequency if the LOOP frequency was increased by an order of magnitude. The results indicate that the System 80+ overall core damage frequency is somewhat sensitive to the frequency of LOOP.

An additional LOOP sensitivity analysis was performed to evaluate the effect of changing the base case value for Loss of Grid frequency. For this case, the change in core damage frequency is not significant, j Vessel Rupture Vessel rupture was originally evaluated in WASil-1400%. It is typically defined as a rupture of the vessel or a large LOCA in excess of the ECCS capabilities. Vessel rupture is assumed to directly lead to core damage. This event and its initiating frequency have essentially been accepted as is since WASH-1400 because it has little impact on the overall core damage frequency for existing plants. With current materials and current manufacturing methods, it has been questioned as to whether or not vessel rupture is a credible event for an ALWR. A sensitivity analysis was therefore performed to evaluate the impact on plant core damage frequency if vessel rupture was assumed not to be credible. As expected, the core damage frequency for internal events would decrease.

Conunon Cause Failures The System 80 + plant core damage frequency for internal events is dominated by common cause failures.

It has been contended tbst with: (1) complete divisional separation, (2) improved staff training, and (3) improved maintmance techniques and proper selection of components; the potential for common mode failure can be essentially eliminated. A sensitivit) analysis was performed to evaluate the impact on plant core damage frequency for the assumption that all ammon mode failures except for diesels and batteries were eliminated. The results of this analysis show a modest decrease in the core damage frequency.

Combining the assumptions that vessel rupture is not credible and that common mode failure of equipment other than the diesel generators and batteries are not credible would further decrease the core damage frequency. The combined impact of these two assumptions on core damage frequency would be significant.

SGTR Operator Error Failure Rates Several operator actions are required to mitigate a Steam Generator Tube Rupture (SGTR) event. These actions are performed to minimize the leakage of reactor coolant to the secondary side, to isolate the Approved Desigrr Materiet Probabnistic Risk Assessment Page IR15 22

System 80+ Design controlDocument

,a

(") ruptured generator, and to control the level and pressure of the ruptured steam generator. By performing the operator actions when required, plant cooldown will occur in a timely manner and the integrity of the secondary side will be maintained (i.e., prevent a steam generator bypass condition from occurring).

Seven sensitivity analysis cases were performed to evaluate the impact of operator error rates on SGTR core damage frequency. The first case involved increasing the error rates of operator actions associated with steam generator tube rupture (SGTR) by a factor of 10, collectively. The second through the seventh case also involved increasing the operator error rates by a factor of 10, but on an individual basis. The impact of operator error rates on the overall core damage frequency for internal events was also evaluated for each of the seven sensitivity cases.

The results for Case 1 indicate that the SGTR core damage frequency would be affected significantly by the cumulative effects of the increased operator error rates. For Case 2, the SGTR core damage frequency would also show a significant increase. The result for each of the other sensitivity cases shows that there would be an insignificant increase in the SGTR core damage frequency. It is thus concluded that the SGTR core damage frequency is highly sensitive to the cumulative effect of increasing the operator error rates by an order of magnitude. The SGTR core damage frequency is also highly sensitive to an increase in the operator error rate for failing to perform aggressive secondary cooldown by an order of nugnitude. It is also concluded that except for failure to perform aggressive secondary cooldown, the SGTR core damage frequency is insensitive to an increase of a factor of 10 to the individual operator error rate.

The results for Case 1 also indicate that the overall core damage frequency for internal events would increase, and the increase is due to the cumulative effect of increasing the operator error rates associated (V] with SGTR by an order of magnitude. For Case 2, the operator error rate for failing to perform ,

aggressive secondary cooldown was increased by an order of magnitude. Due to this change, the overall j core damage frequency also increased. The results for the other sensitivity cases show that the core j damage frequency for internal events would increase slightly. It is therefore concluded that the overall l core damage frequency for internal events is sensitive to the cumulative effect of increasing the operator l error rates associated with SGTR by an order of magnitude. It is also concluded that the overall core damage frequency is sensitive to an increase of an order of magnitude to the operator error rate foi failure to perform aggressive secondary cooldown.

19.15.2.1.4.3 Insights from the Importance Analyses importance analyses were performed at the system level and the component level for the System 80+

design. At the system level, the risk achievement and risk reduction measures of importance were calculated for the mitigating systems of the System 80+ design. The risk achievement worth is expressed as the ratio giving the factor by which risk increases due to the system of concern not being available.

Likewise, the risk reduction worth is a measure of the risk that would be reduced by decreasing the unavailability of the system to zero (i.e., the system is always operating or is operable when demanded).

Some insights gained from the system level importance analyses are listed below:

1

• The systems that would adversely impact (increase) the overall core damage frequency for internal events the most include the Electrical Distribution System, the Emergency Feedwater System, the Safety injection System, and the Component Cooling Water / Station Service Water 7m Systems.

(

Lj

)

Alvvoved Design htsterial Probabbstic Risk Assessment Page 19.15 23 l

System 80+ Design Control Document

• The system that would be the most beneficial (i.e., system with a high reliability) in reducing the overall core damage frequency for internal events is the Emergency Feedwater System followed by the Safety Injection System and then the Safety Depressurization System.

Several importance measures were also calculated for the basic events of the System 80+ PRA. The calculated component imponance measures are:

• Fussell Vesely - The Fussell-Vesely importance gives the risk associated with a given component or event. This imponance measure determines how much the component is contributing to the overall core damage frequency.

• Birnbaum - The Birnbaum importance measures the difference in core damage frequency with and without the occurrence of an event. The Birnbaum gives the increase in risk associated with the failure of a component.

• Criticality - The Criticality imponance measure gives the core damage frequency that the system failure is a result of the failure of a critical component.

• Risk Achievement Worth - The Risk Achievement Worth is expressed as a ratio giving the factor by which risk increases due to a component not being available.

• Risk Reduction Worth - The Risk Reduction Worth is a measure of the risk that would be reduced by reducing the unavailability of the component of interest to zero.

• Uncertainty Importance - The Uncenainty Importance is the measure of the standard deviation about the mean frequency. By reducing the uncertainty of a given event, the uncertainty of the overall core damage frequency will also decrease. This importance measure identifies those events whose uncertainty contributes the most to the overall core damage frequency.

The importance measures are calculated to analyze how each basic event influences the overall core damage frequency and to analyze how the events ranks against one another.

The following general insights are provided for the component importance measures:

• Of the top fifty components listed, with respect to risk achievement wonh, common cause failures are the most important category, followed by initiatic events, then independent faults, and then human errors.

• Because of the redundancy and diversity of the mitigating systems, independent faults are not the most important (high risk achievement wonh) events that would adversely impact the core damage frequency for internal events.

• Conunon cause failures of Electrical Distribution System components are important (high risk achievement worth) events. These events include: (1) common cause failure of the 125 VDC class 1E buses, (2) common cause failure of the 480 VAC load center transformers, (3) common cause failure of the 4.16 KV class 1E buses, (4) common cause failure of 480 VAC class 1E load centers, and (5) common cause failure of 480 VAC motor control centers.

• Conunon cause failures of the distribution line check valves and the pump discharge check valves O

in the Emergency Feedwater System are also important (high risk achievement worth) events.

Amroved Design MaterW Pmbabbstic Risk Assessment Page 19.15-24

System 80+ Design ControlDocument n)

(V

• Several operator errors also have high risk achievement worth. Such events include: (1) operator falls to initiate hot-leg injection, (2) operator fails to align the CST to the Emergency Feedwater Storage Tanks (3) operator fails to reclose ADVs on ruptured SG-2, and (4) operator fails to initiate " feed and bleed".

• The most important (high risk achievement worth) independent faults are associated with failure of the CST valves. These valves are used primarily to provide makeup to the emergency 1 feedwater storage tanks in order to continue and maintain the decay heat removal from the reactor core.

• Loss of main feedwater is the most important (highest risk reduction worth) event in terms of reducing the core damage frequency for internal events.

• Conunon cause failure of the safety injection line check valves (which are used during safety injection, SCS injection, and shutdown cooling operations) is the next important event in terms of risk reduction.

• Operator errors also play a big part in reducing the core damage frequency for internal events.

The most important operator errors in terms of risk reduction worth are: (1) operator fails to initiate " feed and bleed", (2) operator fails to provide aggressive secondary cooldown following a Steam Generator Tube Rupture event, and (3) operator fails to provide aggressive secondary cooldown following a small LOCA event.

p 19.I5.2.2 Analysis of Containment Perfonnance and Source Tenns - Level II PRA

'%J ,

The objective of the containment response analysis is to ascenain the likelihood, magnitude, and timing j of radiological releases to the environment following a severe accident. In order to determine the consequences of an accident, each of the accident sequences identified as leading to core damage in the Level I PRA is further analyzed to determine if it will lead loss of containment integrity, and if so, the nature ofits associated release. The mode and timing of the containment failure and the nature of the releases are affected by the physical phenomena of the accident. The combinations of these physical phenomena define specific event sequence with unique consequences. These combinations of consequences are the potential Plant Damage States (PDSs) resulting from the accident. The parameters used to define the PDSs are based on factors that have the greatest effect on the public and include the following:

• Source term magnitude and isotopic content.

• Energy of the release.

• Duration of the release.

• Waming time for evacuation.

Based on the qualitative evaluation of the containment response phenomena for System 80+ design, a  ;

set of PDS prmrameters and their associated values were defined. Several possible combinations of parameter values for the PDS parameters were noted, all of which were not physically possible.

-O b

Therefore, a set of rules were developed and applied to delete the combinations that were physically impossible. In order to ascertain the information for mapping the core damage sequences into the 4 I

appropriate PDS, six containment safeguard states were developed. These containment safeguard states

.^u :: Design Mesenie!- hobahninaic Miek Assessment Pope 1A15-25

System 80+ Design ControlDocument were linked with the dominant core damage sequences to form plant accident states which contained enough information to be mapped directly into the PDSs.

To provide some initial insight into the potential severe accident progression, the relative split of the PDSs be' ween parameter values for major parameters was ' htated and summarized below (the percentages presented are based on the core damage frequency co,. cibution and not sequence count):

RCS Pressure at Core Damage Approximately 18% of the PDSs are low pressure sequences,47% are medium pressure sequences, and 35% are high pressure sequences. Of the high pressure sequences,26% have a cycling relief valve release rate and 9% have a small LOCA release Ibe.

Core Melt Timing Approximately 77% of the sequences resulted in core damage within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> (early). Sequences resulting in core damage between 8 and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> account for 21%. Only one PDS with two sequences had core damage after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. This PDS accounts for approximately 2%.

Cavity Condition The cavity was not flooded in only 8% of the sequences. For the remaining 92% of the sequences, the cavity was flooded.

Containment Spray Status For 81 % of the sequence, the Containment Spray System was available. The Containment Spray System was not available for the remaining 19% of the sequences.

Release Point Approximately 37% of the sequences resulted in initial releases directly to the containment. Initial releases were to the IRWST for 46% of the sequences. Approximately 17% of the sequences resulted in initial releases through the steam generators. The containment bypass sequence has a negligible contribution :o the core damage frequency.

19,15.2.2.1 Contalmnent Failure Frequency The residte from the containment response analysis e how that the System 80+ containment is robust and quiie capabte of accommodating recre accident challenges. The Conditional Containment Failure Probability (CCFP) is shown to be small. Combining the CCFP with the core damage frequency calculated from the Level I portion of the PRA results in a very low frequency of containment failure from severe accidents.

The insights and leading contributors to containment failure are summarized in Section 19.15.2.2.2.

O Approved Design Atatorint

• 14cbabnistic Risk Assessment l' age 19.15 26

Sy: tem 80+ Deslan controlDocument r

i 19.15.2.2.2 Dominant Contributors to Containment Failure U

The majority of containment failures involve late containment failures. Containment isolation failure is the next dominant failure mode followed by early containment failures and containment bypass failures i respectively.

Late Containment Failures The leading contributor to containment failure following a severe accident is " Late Containment Failure".  :

The major contnbutor to this failure mode includes base mat melt-through. All dry cavity cases result in containment failure and a very small percentage of the wet cavity cases are assumed to result in  ;

containment melt-through. i CoWainment Isolation Failures Containment isolation failures are the second largest contributor to the frequency of containment failure.

Early Containment Failures Early containment failures are the third largest contributor to the frequency of contamment failure. The major contributors to this failure mode include rapid steam generation and steam explosions, missile or rocket impingement, hydrogen burns, and direct containment heating.

Containment Bypass The containment bypass sequences are virtual non-contributors to the overall frequency of containment failure. The majority of the frequency for this failure mode is caused by the Interfacing System LOCA sequence.

19.15.2.2.3 Fission Product Release Characteristics The insights regarding the relative significance of the various fission product release classes are provided below.

Release Classes The release classes with frequencies above a certain screening value were considered for further evaluation. A noted exception to the screening is the containment bypass release class. This release class is caused by an Interfacing System LOCA. Although the frequency of this release class is less than the screening value, it is retained for further evaluation. The release classes that were eliminated from further evaluation represent a small fraction of the total core damage frequency.

Release Characteristics Each of the end-points of the Containment Event Tree (CET) uniquely specifies the status of the containment following a severe accident, whether it is intact or breached, and if breached, the mode of containment failure. The status of the various phenomena which have the potential to affect the source tenn characteristics is also uniquely specified for each end-point of the CET. As a result, each end-point j-} of the CET represents a distinct release class which can be fully characterized by the following parameters:

C :f Des @n A$ssonist. Mohs 6dssaic Adsk Assessnesnt Pepe FR r5 27

' Sy~ tem 80 + Design ControlDocun'ent

• Frequency of occurrence.

• !sotopic content and magnitude of the release.

• Energy of the release.

• Time of the release.

• Duration of the release.

• 1.ocation of the release.

Release class RC4.36L has the highest release fractions for the radionuclide groups. This release class represents a SGTR and containment isolation failure followed by a dry cavity and the containment sprays being unavailable. Other release classes with high release fractions include RC4.30E (similar to RC4.36L, except that the containment sprays are available) and RC4.22E (similar to RC4.36L, except that the containment sprays are available and the cavity is flooded).

19.15.2.2.4 Insights from Level II Sensitivity Analyses The results from the containment response analysis show that the System 80+ containment is robust and quite capable of accommodating severe accident challenges. To assess the impact of certain assumptions that were made in performing the containment response analysis, the Level 11 portion of the PRA, several sensitivity analyses were performed. These analyses determined what effect certain assumptions may have on the containment failure modes and associated conditional failure probabilities.

The major insights from the Level 11 sensitivity analyses are presented below:

e liydrogen ignitors are provided to prevent the build-up of hydrogen inside the containment following a severe accident. l{owever, the conditional probabilities for the various contaimnent failure modes are insensitive to the availability of the hydrogen ignitors following a severe accident.

• The System 80 + containment characteristics do not favor deflagration to detonation transition and the release classes are not sensitive to deflagration to detonation transition.

• Late containment failure releases are somewhat sensitive to low heat transfer rate from the corium to the cavity water. This release class is also very sensitive to the amount of water that is discharged to the cavity by the Cavity Flooding System following a severe accident.

• Late containment failure releases are sensitive to the recovery of containment heat removal following a severe accident.

• The conditional probabilities for System 80+ release classes are not sensitive to temperature induced creep failure of the RCS piping and the depressurization of the RCS, using the Safety Depressurization System.

• The frequency of containment isolation failure releases is mildly coupled to the reliability of the Containment Isolation System (CIS). A very reliable CIS would result in a very low frequency for containment isolation failure releases.

Approved Design Statorial Probabbstic Stisk Assessment Page r9.15-28

Sy' tem 80 + Design ControlDocument n

l I 19.15.2.3 Release Consequences Assessment - Level III PRA v

The characteristics of the release classes deterrnined by the containment response analysis are the primary input to the consequence analysis which calculates the risk measures, including:

• The whole-body dose at 300 meters from the reactor,

• The whole-body dose at one half mile from the reactor, and

• Whole-body dose vs. distance.

, The Complementary Cumulative Distribution Functions (CCDFs) for the above risk measures were generated. The total CCDF for the whole-body dw at 300 meters represents the total frequency of exceeding a given whole-body dose at a radius of 300 meters from the reactor. The total CCDF for the whole-body dose at or.e-half mile represents the total frequency of exceeding a given whole-body dose at a radius of one half mile from the reactor. In addition to 300 meters and one-half mile, whole-body doses were calculated for distances at four miles,11 miles 25 miles, and 60 miles from the reactor.

The large offsite-release goal adopted by Combustion Engineering for the System 80+ Standard Design ,

is:

"In the event of a severe accident, the dose beyond a one-half mile radius from the reactor shall not exceed 25 rem. The mean frequency of occurrence for higher offsite doses shall be less than once per p million reactor-years, considering both internal and external ev 'nts."

LJ This goal is consistent with the ALWR large offsite release goal established by EPRI in the ALWR Utility Requirements Document (7) .

The frequencies with which a whole-body dose of 25 rem is exceeded at one-half mile and 300 meters are less than the goal of 1.0E-6 per year. The System 80+ Standard Design meets the large offsite release goal with substantial margin.

19.15.2.3.1 Dominant Contributors to Risk As mentioned in the previous section, risk measures at various distances from the reactor were calculated for the System 80+ design. The dominant contributors to the whole-body dose at 300 meters and one-half mile measures are identified by release class. The dominant contributors are described below.

Dose at 300 Meters The dominant release classes for a whole-body dose of 25 Rem at a distance of 300 meters from the reactor include RC4.36L, RC4.30E, RC4.22E, RC3.4E, RC3.1E, and RC2.5M. A description for each of these release classes is provided below.

• RC4.36L covers the releases associated with a containment isolation failure with vaporization releases and re-vaporization releases for sequences in which the core damage occurs after 24 m hours. Scrubbing of in-vessel fission products is not successful and scrubbing of vaporization

/ and re-vaporization releases is not accomplished.

A/yweved Des % Matommt ProbahnTestic IUsk Assessment Page 19.15-29

System 80+ Design Control Document The dominant PDS for this release class is characterized by a Steam Generator Tube Rupture with successful safety injection and successful operation of the Emergency Feedwater Water System.

Ilowever, the ruptured steam generator is not isolated and RCS pressure control is also not established, and the leakage from the primary side to the secondary side remains high. The inventory of the IRWST is not replenished and is therefore depleted in approximately 25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br />.

Core damaged is assumed to occur once the IRWST is depleted followed by vessel failure approximately one hour later. For this PDS, the cavity is dry and the Containment Spray System is unavailable due to depletion of the IRWST inventory. Releases occur via the unisolated ruptured steam generator.

The releases for this PDS were assumed to start at the time of core damage and continue for approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The release to the environment was assumed to occur at an elevation of 19.7 meters above grade.

• RC4.30E covers the releases associated with a containment isolation failure with vaporization releases and re-vaporization releases for sequences in which core damage occurs within the first eight hours. In-vessel scrubbing is not successful, but scrubbing of the vaporization and re-vaporization releases is successful.

The dominant PDSs for this release class are PDS184A and PDS181 A. PDS184A is characterized by a Steam Generator Tube Rupture with failure of safety injection and failure of aggressive secondary cooldown. For this release claw, it is assumed that the ruptured steam generator is not succesdully isolated. Core damage is x.sumed to occur within four hours after the initiating event with vessel failure occurring within the next hour. The Containment Spray System is available and the cavity is flooded. The releases are via the unisolated ruptured steam generator.

PDS181A is similar to PDS184A, except that the cavity is not flooded. The releases for this class are t.ssumed to start at the time of core damage and last for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The release to environment is assumed to occur at an elevation of 19.7 meters above grade.

• RC4.22E covers the releases associated with a containment isolation failure with vaporization releases but no re-vaporization releases for sequences in which core damage occurs within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after the initiating event. Scrubbing of in-vessel fission products is successful as well as scrubbing of vaporization releases.

The dominant PDS for this release class is PDS184A which is described above. The releases for this class were assumed to start at the time of core damage and last for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The release to the environment was assumed to occur at an elevation of 19.7 meters above grade.

• RC3.4E covers the releases associated with an early containment failure with vaporization releases but not re-vaporization releases for accident sequences in which core damage occurs within the first 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after the initiating event. The scrubbing of in-vessel fission products is successful as well as the scrubbing of vaporization releases.

The dominant PDSs for this release class include PDS235, PDS20, PDS3, and PDS85. The releases for PDS85 and PDS20 are bounded by the releases for PDS3. Therefore, this release class is dominated by PDS235 and PDS3. PDS235 is characterized by a loss of main feedwater and failure of the Emergency Feedwater System. The

• bleed" ponion of " feed and bleed

• also fails for this PDS. Core damage is assumed to occur within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after the initiating event AIxproved Design historial . tvobabastic Risk Assessment Page 19.15-30

System 80+ Design controlDocument

(") followed by vessel failure within the next hour. The Containment Spray System is available and the cavity is flooded for this PDS.

PDS3 is characterized by a large LOCA with failure of safety injection. Core damage is assumed to occur within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after the initiating event, followed by vessel rupture an hour later. For PDS3, the Containment Spray System is also available and the cavity is also flooded.

The releases for this release class were assumed to start at the time of containment failure which occurs immediately after vessel failure and last for a very short period. The release to the environment is assumed to occur at an elevation of 16.6 meters above grade.

• Release class RC3.lE covers the releases associated with an early containment failure with successful in-vessel fission product scrubbing and no vaporization or re-vaporization releases for sequences in which core damage occurs within the first eight hour following the initiating event.

The dominant PDSs for this release class include PDS235, PDS3, and PDS85. The releases for PDS85 are bounded by the releases for PDS3. Therefore, this release class is dominated by PDS235 and PDS3. PDS235 is characterized by a loss of main feedwater and failure of the Emergency Feedwater System. The " bleed" portion of " feed and bleed" also fails for this PDS.

Core damage is assumed to occur within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after the initiating event followed by vessel failure within the next hour. The Containment Spray System is available and the cavity is flooded for this PDS.

3 PDS3 is characterized by a large LOCA with failure of safety injection. Core damage is assumed (d to occur within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after the initiating event, followed by vessel rupture an hour later. For PDS3, the Containment Spray System is also available and the cavity is also flooded.

l l

The releases for this release class were assumed to start at the time of containment failure, and i the releases to the envhoument were assumed to occur at an elevation of 16.6 meters above grade (

l level.

l

• Release class RC2.5M covers the releases associated with a late containment failure with vaporization releases but no re-vaporization releases for sequences in which core damage occurs within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> time frame. In-vessel fission product scrubbing was successful but scrubbing of the vaporization releases is not successful.

The sole contributor to this release class is PDS242. PDS242 is characterized as a station blackout transient with successful operation of emergency feedwater until the batteries are depleted at 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. Core damage is assumed to occur at 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> with vessel failure at 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />. Containment spray is not available and the cavity is not flooded. The containment will fail due to basemat melt through. There is a small chance that the melt through will be into the  ;

subsphere.

The releases for this release class were assumed to start at the time of containment failure at 65 hours7.523148e-4 days <br />0.0181 hours <br />1.074735e-4 weeks <br />2.47325e-5 months <br /> and continue for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The release to environment was assumed to occur at grade.

g Dose at One-Half Mile

\ 1 V Three dominant release classes were identified for the whole-body dose of 25 Rem at a distance of one-half mile from the reactor. These release classes include RC4.36L, RC4.30E, and RC4.22E. A Alvwored Des 4pn Materinh Probabkstic Misk Assessmotst Page 19.15-31

Sy~ tem 80 + Design ControlDocument description for each of the dominant release classes is provided above in the sub-section on " DOSE AT 300 METERS".

19.15.2.3.2 Insights from Level III Sensitivity Analyses The results of the consequence analysis were compared with the NRC's health objectives and risk goals.

The comparison shows that the System 80+ design meets the NRC's large release guidelines and by implication the health objectives are also met. For the base case consequence analysis, releases due to containment isolation failure were the dominant contributors to whole-body dose at distances (i.e., 300 meter and one-half mile) from the reactor. To assess the impact of certain assumptions that were made in performing the consequence analysis, which is the level III portion of the PRA, several sensitivity analyses were performed.

The major insights from the Level III sensitivity analyses are pruented below:

• The risk measures for whole-body doses at 300 meters and one-half mile from the reactor are relatively insensitive to the location of the release point (i.e., whether the release occurs at the top of the containment building or at grade level).

• The overall risk of the System 80+ design, as characterized by the risk measures described in this report, is relatively insensitive to containment bypass releases that are not scrubbed prior to their release into the environment.

• The reliability of the containment isolation function can have a significant impact on the overall risk of the System 80+ design.

• The risk measures at 300 meters and one-half mile are somewhat sensitive to basemat melt-through that occurs more frequently than currently anticipated.

• Because of enhanced features and improvements incorporated into the System 80+ design, the frequency of Interfacing System LOCA is several orders of magnitude lower than existing PWRs.

Because of this low frequency, containment bypass releases are not major contributors to the risk of the System 80+ design. However, the overall risk of the System 80+ design is sensitive to the frequency of Interfacing System LOCA if it were to increase by several orders of magnitude.

• The risk of the System 80+ design is sensitive to the isotopic content that is used to characterize the various release classes.

• The risk of the System 80+ design is slightly sensitive to the concrete ablation rate.

19.15.3 External Events Risk Profile Insights I

The external events analyses for the System 80+ design included both qualitative and quantitative analyses. Bounding site characteristics were used for the quantitative analyses to minimize potential future restrictions on plant siting. The qualitative external events evaluation involved the following: (1) identification of the external events to be considered. (2) grouping of events with similar plant effects and 1 consequences, (3) establishment of screening criteria to eliminate events that are insignificant contributors to risk, and (4) identification of events that require further quantitative evaluation. Based on the qualitative evaluation, most of the external events were eliminated from further quantitative evaluation.

Approved Desbyn Meterial Probabastk: Misk Assessment rege 19.15-32

System 80+ Design ControlDocument Four external events (tornado, fire, flood, and seismic) were identified as having the potential to induce

'j system failures and therefore required further quantitative evaluation. ,

The major findings and insights obtained for tornados, fires, floods, and seismic events are provided in Sections 19.15.3.1,19.15.3.2,19.15.3.3, and 19.15.3.4, respectively.

19.15.3.1 Insights from the Tornado Strike Analysis For the System 80+ PRA, the following assumptions were made for the tornado strike accident sequences.

• It was assumed that offsite power will be lost for more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and the plant will rely on '

the emergency diesel generators during this period.

• . The turbine / generator will be unable to run back and pickup hotel loads following a tornado strike.

• The alternate AC power source was conservatively assumed to be unavailable following a tornado strike.

• The Station Service Water System (SSWS) intake structure was assumed to be vulnerable to accumulation of debris due a tornado strike event and was included in the models. The protection of the SSWS intake structure against the accumulation of debris due to a tornado strike could prevent or minimize the loss of suction to the SSWS pumps. ((The COL applicant should re-O evaluate the vulnerability of the SSWP intake to tornado-generated debris [ COL Item 19-1))]m,

• Safety related stmetures outside the nucicar island will not be destroyed by a tornado strike.

• The air intake for the emergency diesel generator rooms was assumed to be protected from tornado and tornado generated missiles.

• The Condensate Storage Tank is unavailable to provide makeup to the Emergency Feedwater Storage Tanks.

Three dominant accident sequences were identified for tornado strike events: TRND-4, TRND-SBO, and TRND-5.

• TRND-4 is an accident sequence which involves a tornado strike event followed by successful opening and rescating of the primary safety valves, failure of decay heat removal, and failure of the SIS. For this sequence, the EFWS is used to remove decay heat from the RCS until shutdown cooling entry conditions are met. 001 shutdown cooling entry conditions are met, the SCS would be aligned for decay heat removal, liowever, the SCS fails to perform its function and consequently the only other means of removing decay heat from the core is via " feed and bleed" operation. In order for " feed and bleed" to be successful both the

• bleed" portion and the

" feed" portion must operate. In addition to SCS failure, " feed" also fails for this sequence. This results in the termination of decay heat removal and consequently core damage occurs. The dominant contributors to this sequence are: (1) common cause operating failure of the emergency O

V 8

COL information item: see DCD Introduction Section 3.2.

AMwevent Doespr' a0enenief = hebaeaiseic Nek Assessmerrt Page 19.15-33

System 80+ Design ControlDocument diesel generators, (2) operating independent failure of the emergency diesel generators. The diesel generators will be included in D-RAP.

• TRND-SBO is an accident sequence which involves a tornado strike event followed by station blackout with battery depletion. For this accident sequence, the emergency diesel generators also fail and the only mitigating system available is the EFWS, using the turbine-driven pumps. After eight hours of operation, the batteries would be depleted and long term decay heat removal would be terminated. Consequently, core damage occurs. The dominant contributors to this sequence are: (1) blockage of the station service water intake structure due to tornado generated debris, (2) common cause failure of the emergency diesel generators, and (3) independent demand failures of the emergency diesel generators.

• TRND-5 is an accident sequence which involves a tornado strike event followed by failure of long-term decay heat removal and failure of the SDS. This accident sequence is similar to TRND4, except that " bleed" fails instead of " feed". The dominant contributors to this accident sequence are: (1) blockage of the station service water intake structure, (2) failure of the operator to initiate " feed and bleed", (3) common cause operating failure of the emergency diesel generators.

The major insight gained from the tornado strike evaluation is that the single most dominant contributor to core damage is caused by blockage of the intake structure. Blockage of the intake structure for the station service water pumps is caused by tornado generated debris. Blockage would result in loss of cooling water to the emergency diesel generators and all safety-related motor-driven pumps. The EFWS, using the turbine-driven pumps, would be the only means of removing decay heat from the core until the batteries are depleted.

19.15.3.2 Insights from the Fire Ris'k Assessment A qualitative fire risk assessment was performed for the System 80+ design. The evaluation addressed each of the fire areas defined, except the containment area and the control room area. Each fire area was analyzed to assure that in the event that all the active equipment in the area affected by a fire were rendered inoperable, redundant systems, trains, or channels would be available in another fire area. This would enable safe shutdown to be achieved and maintained.

The following assumptions were made in performing the fire scoping assessment.

• Because of the enhanced features of the System 80+ control room design, a fire in the control room is assumed to be an insignificant contributor to core damage due to internal fires.

• It was assumed that the materials used in the control room panels do not independently support combustion.

• The energy sources coming into the control room panels was assumed to be limited to low power voltage, to the maximum extent practicable. Such limited energy sources practically eliminates potential ignition sources within the panels. A significant portion of the control and indication signals are interfaced to the main control panel via fiber optic cables.

• If a fire occurs inside the main control room and the operator determines that the control room should be evacuated, it is assumed that the operator will trip the reactor and transfer control to the Remote Shutdown Room prior to evacuation.

Approved Design Meterief habsbelisuc Risk Assessment Page 19.15-34

System 80+

">-- conoot Doenament \

-e it was assumed that sufficient instrumentation and controls are provided at the remote shutdown panel to bring the plant to safe shutdown should the main control room need to be evacuated.

e ' Equipment that does not have dedicated instrumentation and controls at the Remote Shutdown Panel can be controlled via the operator's module, and procedures are in place to instruct the operator how to control this equipment.

e Instrumentation and controls are provided at the Remote Shutdown Panel for the CCWS and SSWS to ensure that the Emergency Feedwater System, Safety Injection System, Containment

Spray System, and the Shutdown Cooling System can perform their functions.

e It is assumed that a control room fire will not impact the instrumentation and controls located at the remote shutdown panel or the equipment itself which is required to place the plant in cold shutdown.

e The main control room and the remote shutdown room are located at different elevatioe and in different fire areas. . Since the main control room ventilation system is separate frora the ventilation system for the remote shutdown room, and the stairwells connecting these rooms are pressurized, it was assumed that smoke, hot gases, or fire suppressants cannot migrate from one room to the next.

e Both the remote shutdown room and the main control room are protected by 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> fire walls and 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> fire doors. It is therefore usumed that a fire that originates in an area outside the main O contrei room area will not threaten the habitability of the control room. Only fires that originate inside the control room may force its evacuation.

e All fire barriers which provide separation between the two divisions are rated for at least 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.

It was assumed that all fire doors and penetrations within the fire barriers are maintained during power operation to prevent the propagation of fire from one area to the next.

e it was assumed that only the equipment within the fire area will become inoperable due to the fire. Redundant safety related equipment in the other division will not be affected by the fire.

e For the purposes of this analysis, it was conservatively assumed that a fire within one of the two divisions would disable all safety-related equipment in the affected division.

The reliabilities of the fire detection and suppression systems are assumed to be at least 80% and

%%, respectively.

Ahhough fire brigade action to suppress fires was not modeled in the scoping fire risk evaluation, the capabilities of the plant fire brigade are important to maintaining a low fire risk. ((The COL applicant should maintain a well trained and prepared fire brigade. [ COL ltem 9-5))]m l A quantitative assessment of the risk due to internal fires can not be made at this time because detailed design information for cable routing and the fire detection and fire suppression system is not presently available. However, a scoping evaluation is performed to assess the risk due to internal fires. Two types of fires were considered in the scoping evaluation: (1) a fire in an area which could disable safety-related A

8 COL infonnation item: see DCD Introduction Section 3.2.

Ameever os.4pn as.a w o neaemmese mee 4 nt - tr/sn esee rs.rs-as

System 80+ Design controlDocument equipment in that area and which has the potential for initiating a transient, and (2) a fire in an area which by itself could disable safety-related equipment but would require the penetration of a fire barrier in order to initiate a transient.

Although a detailed quantitative analysis of internal fires was not performed at this stage of the System 60+ design, a scoping estimate of the risk due to fire was calculated by using a conservative scoping value for fire event frequency and by assuming that the effects on plant systems would be the same as a loss of one division of component cooling water / station service water. Using this approach, the sequence ofimportance involves an internal fire followed by failure oflong-tr.rm decay heat removal and failure of RDS.

Based on the robust seal design for the RCPs used in the System 80+ design and on the results of tests and operating experience, ABB-CE asserts that the RCP seals will not fail on loss of seal injection and seal cooling. However, in the interests of completeness, an assessment of a postulated fire induced RCP seal LOCA was included as part of the quantitative fire scoping evaluation. The scoping value for core damage frequency associated with the postulated fire induced seal LOCA was calculated. The potential risk due to a postulated fire inside containment was also assessed.

The following insights were drawn from the internal fire scoping assessment:

• The consequences of internal fires at the plant are bounded by a fire tant would disable all the safety-related equipment in the division where the fire originated.

• The propagation of a fire from one division to the next is prevented by the divisional separation of redundant safety-related equipment with a 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> fire barrier which is maintained during power operation. The fire barriers will be included in D-RAP.

• In order to minimize or eliminate control room fires, the control room panel specifications must be met. These specifications prohibit the use of neoprene, limit the use of PVC, and prohibit the use of materials that would independently support combustion. The energy sources coming into the control room panels must be limited to low voltage.

• A control room fire is not a dominant contributor to the overall core damage frequency due to internal fires.

• Instrumentation and controls are provided at the Remote Shutdown Panel to ensure that the plant can handle a transient from the Remote Shutdown Room.

• Because the main control room is continuously pressurized, the entry of smoke, hot gases, dirt, and fire suppressants originating from outside the main control room will be prevented.

• The main control room utilizes a ventilation system which is separate from the rest of the control building. Therefore, the migration of smoke, hot gases, and fire suppressants that originate in areas outside the main control room such as the electrical equipment areas to the control room will not occur via the ventilation system or any other means.

Separate ventilation systems are provided for each of the divisional separated building.

Therefore, a fire in one division cannot migrate to the next division via the ventilation system.

Appromt Design historial . Probab&stic Misk Assessment Page r9. r546

System 80+ Design Control Document

• Although ABB-CE asserts that the RCP seals will not fail on loss of seal injection and seal

('") cooling due to tb robust seal design, an assessment of a postulated fire-induced RCP seal LOCA was included as part of the quantitative fire scoping evaluation. This evaluation indicates that a fire-induced RCP seal LOCA is not a dominant contributor to the estimated scoping core damage frequency utimate for internal fires.

• Deterministic evaluations indicate that there is no credible fire inside containment that could damage redundant trains of safe shutdown equipment. A . coping assessmen; indicates that the risk associated with a postulated fire inside containment is not a significant contributor to the overall scoping estimate of risk for internal fires.

19.15.3.3 Insights from Internal Flood Analysis The System 80+ plant design emphasizes the elimination and minimizatic< .-otential flood sources within safety-related areas as a means of flood protection. For example, station service water and component cooling water heat exchangers are located outside the Nuclear Annex. Water-cooled components within the Nuclear Annex are cooled by Component Cooling Water, with the exception of IIVAC equipment which is cooled by chilled water systems. These cooling water systems are closed systems with a defined volume of water. The safety related cooling water systems are separated by division with no open cross connections, thus eliminating the possibility of a single pipe break from flooding one division and the other division being lo;t due to loss of pressure boundary integrity.

Condenser circulating water is also located outside of the Nuclear Annex. These features reduce in-plant cooling water to a limited volume which can be easily accommodated to limit the extent of flooding.

(pj The System 80+ control complex is protected from flooding in that no water lines are routed above or through the control room or computer room. Water lines routed to HVAC air handling units, around the control room, are contained in rooms with curbs which prevent any potential water leakap from entering the control room or computer room.

Protection from external flooding is provided by elevated building entrances. Secondary flooding sources located in the Turbine Building are confined to that building. Entrances from the Turbine Building to the Nuclear Annex are sufficiently elevated to allow operator action to isolate a break in the Condenser Circulating Water System before the water level from the Turbine Building flood reaches the Nuclear Annex entrance. Lengths of high energy and moderate energy piping have been minimized by equipment location. Equipment is located in quadrants around the spherical containment to minimize the lengths of piping runs. The subsphere provides further close proximity of equipment to reduce piping runs from Containment.

Flood barriers have been integrated into the design to provide further flood protection while minimizing the impact on maintenance accessibility. The primary means of flood control in the Nuclear Annex is provided by the structural wall which serves as a barrier between redundant divisions of safe shutdown systems and components.

Each half of the subsphere is compartmentalized to separate redundant safe shutdown components to the extent practical, while maintaining accessibility requirements. The subsphere, which houses the front line safety systems is compartmentalized into quadrants, with two quadrants on either side of the divisional structural wall. Flood barriers provide separation between the quadrants, while maintaining equipment

( ) removal capability.

d ANweved Design Matenial. Probabistic Risk Assessment Page 19.15-37

System 80+ Design ControlDocument In performing the flooding scoping assessment, the following assumptions were made.

• The possible sources of internal flooding within the Nuclear Annex and Reactor Building are located below elevation 70+0.

• It was assumed that the primary means of flood control in the Nuclear Annex and Reactor Building is provided by the divisional wall which serves as a barrier between redundant divisions of safety related equipment.

• It was assumed that the flood barrier that separates the redundant divisions of safety-related equipment will not fail due to flooding.

• It was assumed that there are no doors or passageways connecting the divisions of safet) related equipment up to elevation 70+0.

• The equipment within the Component Cooling Water Heat Exchanger structure was assumed to be divisionally separated by a wall such that a flood in one division will not affect the other division.

• An internal flood may occur due to rupture of the pipes connected to the water source, and failure of the water storage facility.

• Rupture of the water storage facility is assumed to be catastrophic, resulting in spillage of all its contents immediately.

• The worst credible flooding source was assumed to affect all safety-related equipment in the affected division. The worst credible flood source will affect only one division.

• Administrative procedures are in place to maintain the barriers during power operation.

• Flooding was assumed to occur from only one of the various sources of internal floods within the Nuclear Annex. No cascading effects of the flood sources are assumed.

• It is assumed that the frequency of an internal flood during power operation is no worse than one in a hundred plant years.

• It was assumed that a failure of the Circulating Water System or the main condenser large enough to cause flooding in the Turbine Building can be detected and the flooding source isolated.

Administrative procedures are in place to isolate the flooding source.

• The major piping penetrations between the Nuclear Annex and the Turbine Building are asstuned to be sealed and located above the maximum flood level associated with flooding of the Turbine Building.

• There are no safety-related components located in the Turbine Building. Therefore, it was assumed that flooding of the Turbine Building will be limited to non-safety-related equipment.

• All entrances from the Turbine Building to the Nuclear Annex were assumed to be located ab&

the maximum flood level for the Turbine Building.

Attwoved Destgre Materwel Probab&istic Risk Assessment Page 19.15 38 f

p Sy2 tem 80+ g oestan canwatDocument A

Although a detailed quantitative analysis of internal floods was not performed at this stage of the System

,G 80+ design, a scoping estimate of the risk due to flood was calculated by using a conservative scoping value for the flooding event frequency and by assuming that the effects on plant systems would be the same as a loss of one division of component cooling water / station service water. Using this approach, the sequence of importance involves an internal flood followed by failure oflong-term decay heat removal and failure of RDS.

Based on the robust seal design for the RCPs used in the System 80+ design and on the results of tests and operating experience, ABB-CE asserts that the RCP seals will not fail on loss of seal injection and seal cooling. However, in the interests of completeness, an assessment of a postulated flood induced RCP seal LOCA wu included as part of the quantitative flood scoping evaluation.

Based on the above assumptions made for the flooding evaluation, the following flood insights were derived for the System 80+ design:

e The divisional flood barrier between redundant divisions of safety-related equipment is an important design feature which ensures that flooding of both divisions of safety-related equipment will not occur.

e Maintaining the flood barrier is also important in ensuring that the core damage frequency due to internal floods will remain as low as the current value. The flood barriers will be included in D-RAP.

e The divisional separation of redundant safety-related equipment in the Component Cooling Water

. Heat Exchanger structure and the Station Service Water Pump structure is also an important design feature. This ensures that flooding of both divisions of Component Cooling Water Heat Exchangers and station service water pumps will not occur.

e By maintaining the flood barriers for the various flood zones, flooding will not propagate from one flood zone to the next within the Nuclear Annex.

e All the major flood sources within the Nuclear Annex are located below the 70+0 elevation.

Flooding of equipment located above this elevation will not occur.

e All safety-related structures are designed to withstand the static and dynamic forces of flooding.

Therefore, the structural wall between the Nuclear Annex and the Turbine Building will not fail, e Based on the assumption regarding the location of penetrations between the Nuclear Annex and the Turbine Building, a flood in the Turbine Building will not propagate to the Nuclear Annex and affect the operability of safety-related equipment.

o Provided the interface requirements are met by the applicant, flooding in the Turbine Building will have no impact on plant safety.

e It is important to locate all entrances from the Nuclear Annex to the Turbine Building above the maximum flood level of the Turbine Building. This will ensure that the propagation of flood water from the Turbine Building to the Nuclear Annex will not occur,

• Since the plant grade is sloped away from safety-related structures, flooding of these structures from Turbine Building sources will not occur.

Approved Des @n Adseerdab Asestasale JIdsk Assessment Page 79.75 System 80+ Design ControlDocument

• Although ABB-CE asserts that the RCP seals will not fail on loss of seal injection and seal ,

cooling due to the robust seal design, an assessment of a postulated flood-induced RCP seal LOCA was included as part of the quantitative flood scoping evaluation. This evaluation indicates that a flood induced RCP seal LOCA is not a dominant contributor to the estimated scoping core damage frequency estimate for internal floods.

19.15.3.4 Insights from the Seismic .Wrgin Analysis In the seismic margin analysis, the following assumptions were made:

e A seismic initiator hierarchy tree was developed to represent the order of impact for the various seismic initiators. It was assumed that the orde , f impact in terms of severity is as follows:

1. Seismically induced Gross Structural Collapse

2. LOCA in Excess of ECCS Capability

3. Seismkally induced Medium LOCA

4. Seismi: ally induced Small LOCA

5. Seismically induced ATWS

6. Seismically induced Loss of Site Power

7. Seismically induced Transient e it was assumed that if one component fails to operate due to a seismic event, all similar component (s) in that system would also fail (one-fail-all-fail).

e All random (independent) component failures and human errors with low probabilities were deleted from the initial seismic fault trees in accordance with the guidelines provided by the NRC.

e The High Confidence Low Probability of Failure (HCLPF) acceleration values for the component and structural failures in the seismic event trees and fault trees were calculated using design specific response spectra and the Conservative Deterministic Failure Margin (CDFM) approach presented in EPRI NP-6041-SLn6 e it was assumed that a seistnic event would not significantly alter the stress level nor the time available in which the operator actions required to mitigate the consequences of such an event need to be performed. Thus, the seismic margin analysis used the same human error rates as those used in the internal events analysis.

e it was assumed that solid state switching devices and robust electro-mechanical relays will be used ,

in the Nuplex 80+ protection and control systems. Use of these devices and relays either eliminates or minimizes the mechanical discontinuities associated with these devices.

l Approved Desigrr Materie!- Probabaistic Rush Assessment Page 19.15 40 i

6 System 80+ Deslan conualDoewnent \

t e The structures housing the' Station Service Water (SSW) pumps and the Component Cooling Water (CCW) heat exchangers was assumed to be as strong as the interior structure of the nuclear annex.

~

e Seismically induced gross structural collapse of the nuclear annex interior structure was assumed to result in the failure of all safety equipment and lead directly to core damage. j e Seismically induced failure of shield building structure was assumed to result in damge to the control room due to falling concrete. This was assumed to cause a transient, and failure of the responding safety systems if control was not transferred to the remote shutdown panel. ,

e It was assumed that the seismically induced failure of the shield building structure would not directly result in failure of the remote shutdown panel.

. e it was &mM that the dominant seismic failure mode for the containment shell is vertical rotation / overturning. This failure mode was assumed to result in failure of all safety equipment  ;

and breach of containment integrity. j i

e It was conservatively assumed that seismically induced failure of the supports for any major RCS component, such as the RCPs or the steam generators, would result in failure of all RCS piping attached to the component due to excess motion of that component. Given the one-fail-all-fail assumption, it was further assumed that all like components, i.e. RCPs, would fail at the same time. In addition, it was conservatively assumed that as a direct result of the piping failures, the Safety injection System would be unable to provide sufficient makeup flow for RCS reactivity control.

e Under the one-fail-all-fail assumption, it was assumed that seismically induced failure of a major RCS pipe would result in failure of all equivalent RCS piping. This would result in a LOCA in Excess of ECCS Capacity.

e Consistent with the above two assumptions, it was assumed that there were no seismically induced large LOCA sources.

!- e It was assumed that the occurrence of a seismic event did not automatically result in loss of offsite power or failure of the standby combustion turbine regardless of the "g" level.

o The System 80+ Class IE electrical distribution system is provided with protection schemes l which conform to the requirements ofIEEE STD-741-1986. The protective schemes are designed to isolate faulted equipment from the rest of the system to minimize the effect of the fault and to maximize the availability of the remaining equipment. The basic schemes consist of ground fault protection, instantaneous overcurrent and timed overcurrent protection. In developing the -

SMA models, it was assumed that the seismic failure of equipment in the Electrical Distribution System were "open circuit" failures. Implicit within this assumption is the assumption that if a

" hot short" failure were to occur, the appropriate circuit interrupter (s) would open on overcurrent to prevent " backward" propagation of the fault.

• Seismically induced sliding of the nuclear island structure is assumed to result in severing of all piping or cabling into the nuclear island. This was conservatively assumed to lead directly to core damage.

Ameneef Deekn anesed.nesehanate met Aseeenment (2/95) neue 1s.15-41

.w, - -- +- , ers--.mm- -, w,

System 80+ Design Control Document e Seismically induced sliding of the CCW Heat Exchanger Building was assumed to result in severing of CCW piping to the nuclear island for both divisions of CCW. This results in loss of all CCW.

The following dominant sequences were identified for the seismic event.

• The dominant contributor to the plant HCLPF is seismically induced gross structural failure of the containment vessel which was assumed to lead directly to core damage and containment failure. Because this sequence leads directly to containment failure, the operability of the containment safeguard systems is of no importance.

• The second domiramt contributor to the plant IICLPF is a seismically induced LOCA in Excess of ECCS Capacity caused by a seismically induced failure of the RCP supports.

• In addition, there are three sequences where the contribution to the plant HCLPF due to " mixed cutsets", which contains both the seismic failures and random or independent failures, is potentially significant. These three sequences are described below.

1. The sequence SEIS-SBO is a seismically induced station blackout which is initiated by a scismically induced loss of site power and failure of both diesel generators and the standby combustion turbine. It was assumed that offsite power can not be restored within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of a seismic event which results in a loss of offsite power. It is also assumed that the turbine-generator will be unable to runback and pick up hotel loads following a seismic event which results in a loss of offsite power. Therefore, the diesel generators and standby combustion turbine are important to maintaining the safety of the plant following a seismic event. The station batteries and the turbine-driven Emergency Feedwater (EFW) pumps can be used to deliver emergency feedwater flow for approximately 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. At this time, the batteries will be depleted and the turbine-driven EFW pumps will fail due to loss of control power resulting in core damage.

2. Sequence EQA-15 is a seismically induced ATWS early in core life when the MTC is greater than -0.3. The peak RCS pressure for an ATWS with an MTC greater than -0.3 would exceed 3200 psia which would result in failure of the Safety injection System (SIS) check valves and failure of piping resulting in a small LOCA. This leads directly to core damage. For this sequence, it was assumed that a seismic event initiates a transient that requires a reactor trip but the trip does not occur due to seismically induced deformation or shifting of the upper guide structure preventing the CEAs from inserting.

3. Sequence EQA-9 is a seismically induced ATWS later in core life when the MTC is less than -0.3. The sequence involves a seismically induced ATWS with successful operation of EFW system but failure of the charging system to provide boron for long term reactivity and failure to depressurize the RCS using the Safety Depressurization System (SDS). The failure to depressurize results in inability to use the SIS for reactivity control. As with the sequence EQA-15, the seismically induced failure to trip is most likely due to a seismically induced deformation or shifting of the upper guide structure preventing the CEAs from insening. The primary cause of failure to depressurize the RCS is failure of the operator to initiate safety depressurization in preparation for feed and bleed cooling.

Anwowd Design Meteriel . Probahnstic Risk Assessment Page 19.15-42

System 80+ Design ControlDocument

• EQT-7 is a seismically induced Transient with failure of the EFW system to deliver emergency s feedwater flow, successful feed and bleed cooling and failure of containment heat removal (failure to cool IRWST). EQLP-8 is a seismically induced Loss of Site Power with failure of the EFW system to deliver emergency feedwater flow, successful depressurization of the RCS but failure  ;

of the SIS to provide feed. EQA-10 is a seismically induced ATWS with failure of the EFW system to deliver emergency feedwater flow. Seismically induced failure of the common wall between the Emergency Feedwater Storage Tanks (EFWSTs) and diesel generator rooms would result in the EFWST inventory being drained into the diesel generator room and flooding out the diesel generator. This would result in loss of the EFW and the diesel generator.

19.15.4 Shutdown and Low-Power Operation Risk Insights ,

A study of the risk associated with the low power and shutdown modes of operation was performed. The scope of this assessment included the evaluation of both internal events occurring during low-power and ,

shutdown modes of operation.

Event trees were developed and quantified for loss of Decay Heat Removal (DHR) and loss of coolant  !

inventory as initiating events during Modes 4 through 6. The core damage frequencies associated with l loss of offsite power, fire, and floods were also quantified. In quantifying the core damage frequency I

(CDF), emphasis was placed on the human errors because they have been shown, in earlier studies, to

, be dominant contributors to shutdown risk. The system failure probabilities were evaluated using l modifications to the fault trees. j l

- The results obtained from the shutdown and low-power risk evaluation are summarized in Section 19.15.4.1. Similar to the PRA that was performed during power operation, insights were gained for the shutdown risk evaluation. Such insights are summarized in Section 19.15.4.2. The general assumptions that were made in developing the accident sequences for the shutdown risk assessment are outlined below.

• Modes 2 and 3 were not considered in the shutdown study because the plant configuration is very similar to Mode I and therefore the effects are enveloped in the Mode 1 analysis.

• The end point of the event trees is the establishment of Decay Heat Removal (DHR) path or a

" feed and bleed" path.

• Containment heat removal has been neglected because of the lower decay heat load than at full power and heat removal can be accomplished with the containment coolers or containment venting before containment over-pressurization.

• No credit was given for the use of the steam generators as a DHR path (it was assumed that they were always unavailable).

• No credit was given for the use of the SITS as a source of coolant even though they are available during certain stages of the shutdown.

• During Modes 6 with the head detensioned but ncA retcoved and during Modes 5 with reduced

~

inventory, it is assumed that a " bleed" path is required tor " feed and bleed".

• No credit is given for recovery from operator errors by additional personnel in the control room. ]

• Reduced inventory was conservatively modeled as mid-loop operation.

L ::Doelpn Menenle!* Probahnnec Miek Assessment Page 19.1543 l l

-- - - - _ - - __- N

Syctem 80+ Design ControlDocument

• No credit was taken for the reduction on decay heat after refueling when one third of the fuel elements and approximately half of the fission products have been replaced with fresh fuel.

• Nozzle dams are assumed to be installed before steam generator maintenance which is assumed to occur every refueling.

• No credit has been given for the availability of the third and fourth Safety Injection (SI) pump or the secorA diesel generator. Although this equipment is permitted to be out of service during an outage, it is actually available much of the time.

• Initiating event frequencies were based on historical occurrences and were not adjusted for improved instrumentation, training or other advancements.

• Loss of offsite power from fires during shutdown modes of operation is negligible because of plant procedures and practices with regard to activities in the operating switchyard (if the second is unavailable).

• The LOCAs are assumed to be sufficiently small that a " bleed" path is required for a " feed and bleed" operation.

• The initiating events and associated core damage scenarios considered in the fire risk analysis are limited to the Loss of Decay Heat Removal, and Loss of Coolant Accident.

• Within a division, fire separation is maintained between the systems that comprise the alternate shutdown success paths.

• Fires that have not reached the severe level cause no damage to equipment in a fire area. Severe fires damage all equipment in a fire area. Severe fires can occur only through the failure of all fire suppression actio6(:).

• Propagation of fires between divisions, quadrants, or fire areas is assumed to be impossible.

• Restoration of the fire damaged equipment is impossible in the time frame of the event.

• No credit was given for installed automatic suppression equipment.

• Flood barriers have been integrated into the design to provide further flood protection while minimizing the impact on maintenance accessibility. The primary means of flood control in the Nuclear Annex is provided by the structural wall which serves as a barrier between redundant divisions of safe shutdown systems and components. At the lowest elevation, this structural wall contains no doors or passages, and the limited penetrations through the wall are sealed. This design confines floodwater to one division up to elevation of 70+0. Preliminary determination of major flood volumes such as the Component Cooling Water and Emergency Feedwater Systems show that the volume of water contained in one division of these systems would not rise above elevation of 70+0 should a large uncontrollable break occur. Thus, the other division is unaffected.

• Each half of the subsphere is compartmentalized to separate redundant safe shutdown components to the extent practical, while maintaining accessibility requirements. The subsphere, which houses the front line safety systems is compartmentalized into quadrants, with two quadrants on Approved Desiptr Material ProbaMstic Risk Assessment 111/96) Pne 19.15-44

Srtem 80+ Design ControlDocument

[m) either side of the divisional stmetural wall. Flood barriers provide separation between the U quadrants, while maintaining equipment removal capability. Emergency Feedwater (EFW) pumps i i

are located in separate compartments within the quadrants with each comparunent protected by flood barriers. Flood barriers also provide separation between electrical equipment and fluid mechanical systems at the lowest elevation within the Nuclear Annex. Elevated equipment pads prevent equipment from being inundated in the event of flooding.

• Flood protection is also integrated into the floor drainage systems. The floor drainage systems  ;

are separated by division and Safety Class 3, Seismic Category I valves which prevent backflow of water to areas containing safety-related equipment. Each subsphere quadrant contains its own separate sump equipped with redundant Safety Class 3, Seismic Category I sump pumps and associated instrumentation. These pumps are also powered from the diesel generator in the event of loss of offsite power. The Nuclear Annex also has its own divisional separated floor drainage system, having no common drain lines between divisions. Floors are gently sloped to allow good drainage to the divisional sumps. Floor drains are routed to the lowest elevation to prevent flooding of the upper elevations. The lower elevation in each division has adequate volume to collect water from a break in any system without flooding the other division. In addition, potential discharge of fixed fire suppression systems and fire hoses is considered in the sizing of floor drains to preclude flooding of areas should the fire protection systems be initiated.

19.15.4.1 Results Reduced inventory operation during mode 5 (Mode SR) is the leading contributor to the internal risk. I Loss of DllR is the dominant initiator for accident sequence in this mode of operation. (This mode of I r3 y) operation and sequence were also identified in earlier PRAs as being the dominant contributors to CDF.)

Internal events occurring during modes 6E and 61 are the second leading contributors to CDF. During mode 6E or 61, the IRWST is empty and therefore not available as a source of coolant for any makeup or feed and bleed operation. LOCA is the dominant initiator for accident sequences in this mode of operation because the capability to provide makeup to the core is limited. The third leading contributors to CDF occur during Modes 4,5, and 6F (IRWST full). Loss of offsite power is the dominant initiator for accident sequence during this mode of operation because of the long time interval spent in this configuration and the need to restore AC in about two hours.

Loss of Offsite Power (LOOP) is the leading contributor to CDF for internally initiated events during low-power and shutdown modes of operations. Even with requirements for two switch-yards and two standby generators to be available during shutdown, the risk was not negligible. Loss of DHR was the second largest initiating event type in terms of contribution to CDP.

Fires dominate the total internal and external CDF during shutdown and low-power operations. The CDF due to flooding was mcde!:d n part of the LOCA risk.

The CDF for low-power and shutdown events was compared with those for power operation. The CDF for low-power and shutdown modes is a significant contributor to the System 80+ total CDF. The CDF for shutdown and low-power events is significantly less than the EPRI goal of 1.0E-05 per year. The total System 80+ CDF is also less than the EPRI goal.

The dominant sequences leading to core damage during low-power and shutdown modes are: (1) Loss

/ j of DIIR in reduced inventory (2) LOOP in Modes 4,5, and 6F is the second largest sequence, and (3) v LOCAs in Modes 6E, and 61 when the IRWST and SIS is not necessarily available.

Aptwoved Design Atatonini hobab&stic Risk Assessment Page 19.1545

System 80 + Design controlDocument The results of this study were compared with other shutdown PRAs. In all the studies, loss of DHR during reduced inventory is the largest single contributor. The lower total CDF for System 80+ is due to design improvements. The System 80+ has a two-train Shutdown Cooling System (SCS) that can also be used to feed coolant from the IRWST in a LOCA or during reduced inventory operations. The Containment Spray System (CSS) pumps are available as backup to the SCS pumps. The System 80+

has a four-train Safety Injection System (SIS) and a new technical specification requires that two trains be available during most shutdown modes. This coupled with an IRWST gives added LOCA protection and a DHR path using feed and bleed.

This study was performed as a part of the System 80+ design process and had an impact on the design.

For example, the cross-connect valves for the CSS were replaced with MOVs which resulted in an improvement in the restoration of DHR. This PRA has been used to help develop technical specifications. For example, a new technical specification for two SIS trains to be available in modes when the IRWST is available is being considered.

19.15.4.2 Insights The insights from the low-power and shutdown modes of operations are listed below. Genetal insights are provided as well as more specific insights as they relate to the type of initiator.

General Insights The general insights for low-power and shutdown modes of operation are listed below.

• The initiating event frequencies are higher than Mode 1 operation because of the greater opportunity for operator errors during outages. Operator training and management control of plant configuration is important to reducing shutdown events and risk.

• The operation and maintenance personnel must have the procedures, training and spare parts to restore DHR in a timely manner. SCS operation is the true end-state for shutdown sequences.

• Most systems are manually started or aligned in shutdown modes. Training is especially important because the operator must be able to cope with the plant in an unplanned configuration.

• The concept of defense in depth applies to shutdown modes as well as Mode 1. The more ways that the operator can maintain coolant inventory and remove decay heat, the lower the risk. The presence of SIS capability in shutdown is an example of added defense in depth.

Loss of DIIR Insights The major insights from the loss of decay heat removal during low-power and shutdown modes of operation are listed below:

• Reduced imentory is the most critical operation. The operator should be aware of this and plant activities should be scheduled accordingly. Use of nozzle dams is encouraged as a method of limiting the time spent in this mode.

• The operator must have procedures and training to align the SCS train to the IRWST and use it to makeup inventory or do a feed and bleed operation.

Approved Design Materraf. Probabikstic Risk Assessment Page 19.1546

Sy' tem 80 + Design ControlDocument Failure of the standby SCS train far either DHR or feed operation is dominated by failure of l]

V' control valves and MOVs. An aggressive %dve testing and maintenance program on the SCS and CSS would reduce shutdown risk.

I

• The use of the CVCS to makeup inventory is an important recovery action in reduced inventory operation. It also acts as a temporary cooling tecimique. The operator should have procedures and training on its use.

• Safety injection in conjunction with bleed is an important means of removing decay heat during shutdown modes. llaving two of the four SIS trains available during most shutdown modes is an important new technical specification.

• The CSS pumps are used as backup to the SCS pumps. The operater must therefore be properly trained in performing the procedure (s) to align the CSS pumps for operation if the SCS pumps should fail. Apam, valve maintenance and testing is important for shutdown risk reduction.

LOCA Insights The major insights for LOCAs during low-power and shutdown modes of operation are listed below:

• SN Mijection is an important means of makeup following a LOCA. Therefore, the development of appropriate procedures and the training of the operator to perform these procedures are necessary and important in mitigating LOCA events during low-power and shutdown modes of

,m operation.

('" )

• The dominant failure mode for SCS injection is failure of control valves and MOVs. A valve maintenance program is important. ,

• The use of the SIS to provide injection during a LGCA is important. Since manual actuation is required, trainmp and procedures are required to properly accomplish this task.

• The Chemical and Volume Control System (CVCS) is another important means of makeup following a LOCA and with proper training and procedures this system will most likely be available when required.

• For LOCAs located in the containment, the IRWST acts as a sump and makes the coolant available for injection. Procedures are needed to ensure that flow paths are maintained during the outage.

LOOP Insights The insights for loss of offsite power during low-power and shutdown modes of operation are listed below: l

• The new tecimical specification for having two of the three standby and emergency generators available reduces the CDF.

f

(~]

( ,/

• The reliability of the two switchyards is important to risk reduction for LOOP. Procedures to control maintenance in both these areas at the same time should be considered.

Asywoved Design afsterial Probab&s6c Rask Assessment (2/95) Page 19.15 47

System 80+ Design ControlDocument

• Because of the nature of LOOP events, the importance of restoring a source of AC to the nuclear facility must be emphasized.

Fire Risk Insights The major insights for fire events occurring during low-power and shutdown modes of operation are listed below:

• The frequency of fires in outages is high because of the maintenance activities and can be reduced by training.

• The owners of the facility must maintain a well-trained and prepared fire brigade.

• Availability of mitigating equipment following fires can be maximized if separation is maintained between equipnes within a quadrant. This will increase the nmnber of success paths available for responding to the event and result in a decrease in risk.

Flooding Risk Insights The major insights for flooding events that occur during low-power and shutdown modes of operation are listed below:

• In order to maintain the validity of the assessment of the level of flooding risk associated with the System 80+ design, separation must be maintained between systems comprising the alternate success paths within a quadrant. Separa: ion between success paths implies not only separation between their major components but also separation between the associated power supplies.

19.15.S Use of PRA in the Design Process Probabilistic Risk Assessment (PRA) was used extensively in the System 80+ design process. PRA was used to confirm that the System 80+ design complied with the applicable risk goals, and to select among the alternate design options.

The insights t .ed from past PRAs, especially the System 80, were used to identify vulnerabilities in l operating plants. This information was then used to incorporate features in the System 80+ design that reduced or eliminated these vulnerabilities. PRA was then used to confirm the risk reduction associated with these improvements. Examples are the risk reduction for LOOP /SBO, SGTR, transients, small LOCA, and ATWS accident sequences.

i Another use of the PRA in the System 80+ design process, which was also of a confirmatory nature, was l to demonstrate compliance with applicable risk goals.

The system 80+ PRA was also used to evaluate design alternatives. The major design options are cited below.

Component Cooling Water System Configuration Early in the program, System 80+ had a standby, safety-related Essential Component Cooling Water l System and Essential Service Water System for cooling safety-related loads. Demand failure of the pump l and valves in these systems were found to be significant risk contributors. As a result, the System 80+  ;

I Astrowed Design Material. hebabKstic Rosk Assessment Page 19.15-48

Sy: tem 80+ Design ControlDocument n

design was changed to a normally operating Component Cooling Water System (CCWS) and a Station

(}* Service Water System (SSWS) where the non-safety loads can be shed when required. The selected CCWS and SSWS have two divisions with two pumps in each division. One pump in each division is normally operating and the second pump is in standby and will start if the operating pump in the same division trips. A subsequent evaluation was also made to determine if the standby pumps had to be automatically loaded on the emergency diesel generators and started following a LOOP event. The evaluation indicated that there would be no significant risk impact if the standby pumps were aligned to the emergency diesel generators following a LOOP event but were not started unless the previously operating pump fails to restart. Thus larger and consequently less reliable emergency diesel generators were not required.

Emergency AC Power Configuration The System 80+ design includes two emergency diesel generators which provide power to the safety related loads following a LOOP event. In addition, there is also a standby alternate AC power source (combustion turbine) which can be aligned to either division of the safety related 4.16 KV buses in the event of a failure of one of the emergency diesel generators. The alternate AC power source is sized to provide power to a set of non-safety loads which, from an operational stand-point, is desirable following a LOOP event. PRA was used to compare two configurations of emergency power: (1) two emergency diesel generators plus a combustion turbine, and (2) four emergency diesel generators. The comparison indicated that the four diesel generator configuration was slightly, but not significantly, more reliable than the configuration which included two diesels and a combustion turbine. However, the four diesel generator configuration did not provide power to the permanent non-safety loads. In addition, the four p diesel generator configuration would have a significant impact on plant size, cost, and layout because of

(/ the need for two additional divisions of diesel support systems such as cooling water, starting power, and )

fuel supplies.

Evaluation of Design Alternatives

. The System 80+ PRA was also used to evaluate the expected risk reduction from 27 Design Alternatives.

The selected alternatives were based on the Design Alternatives evaluated for Limerick and Comanche Peak, and on the results of other assessments such as NUREG/CR-4920 and the System 80+ P.RA. The design alternative analysis used a bounding technique. It was assumed that each design alternative worked perfectly and completely eliminated the accident sequences that the design alternative addressed. This approach maximizes the benefits associated with each design alternative. The twenty-seven design alternatives are listed below:

1. A maintenance practice that inspects 100% of the tubes in a steam generator.

2. Secondary side guard pipes that extend from the containment to the MSIVs. The guard pipes would prevent depressurization of the secondary side if a main steam line break event should occur upstream of the MSIVs. The guard pipes would also guard against or prevent j consequential multiple steam generator tube rupture following a main steam line break event.

3. An improved DC battery and EFWS design alternative that allows for decay heat removal during a station blackout event by using the batteries and the turbine-driven pumps of the EFWS for the time period that is required (without any failure).

/ \

kJ 4. An improved DC battery design alternative that is capable of maintaining the associated loads for a 12-hour duty cycle following a station blackout condition.

i AS4wownf Dnipn Meterial Probabastic Misk Assessment Pope r9.15-49 l

l 1

System 80+ Design controloccument

5. An auxiliary spray system design alternative that always depressurizes the primary system (during SGTR events) with sufficient speed to ensure that the SCS would always remove decay heat.

6. A high pressure safety injection system design alternative that eliminates all sequences with high pressure failures.

7. A perfect safety depressurization system that quickly depressurizes the prtmary system so that the safety injection pumps can effectively provide coolant to the reactor core for decay heat removal.

8. A design alternative which assumes that two of the four motor driven safety injection pumps are replaced with two diesel pumps. This would reduce the common cause failure of all four motor driven safety injection pumps. The risk associated with station blackout would also be reduced.

9. An IRWST design alternative that consists of an additional ground level tank of borated water and pumping device to provide makeup to the IRWST, especially for SGTR events.

10. A standby emergency power source alternative design that consists of three diesel generators.

One of the diesel generators is used as a swing unit or is used during refueling when one diesel generator is unavailable due to maintenance,

11. An alternate AC source (gas turbine) that is completely protected from tornados.

12. An alternative design that uses fuel cells along with an HVAC system which is capable of removing the heat generated by the fuel cells.

13. Portable generators that can be brought in and hooked up to the emergency feedwater turbine driven trains after the batteries are depleted.

14. A system of relief valves that prevents any equipment damage from a primary pressure spike following an ATWS event.

15. A poison (* ink") injection system tbt is used to shut down the plant and which is diverse from the mechanical rods.

16. An alternative design that consists of a third diverse Plant Protection System.

17. A perfect containment spray system that prevents high pressure containment failures caused by slow steam pressurization.

18. A filtered vent design that prevents all slow high pressure containment failures.

19. An ideal concrete composition that prevents basemat melt-through.

20. A reactor vessel exterior cooling system that prevents vessel melt-through and direct containment heating.

21. An ideal hydrogen (112 ) ignitor that would prevent releases associated with containment failures from hydrogen burns or explosions.

Atyveved Desegrr Atatonie! Probabilistic Rask Assessmerrt Page 19.15-50

i i

System 80+ Design ControlDocument i

)

22. Passive autocatalytic recombiners that would combine molecules of hydrogen and oxygen gases

[]

v mto water.

23. An alternative design that scrubs the discharge of the main steam safety valves and the atmospheric dump valves to remove most of the fission products following a steam generator tube rupture event.

24. An alternative design that monitors containment isolation. Addition of redundant and diverse limit switch to each containment isolation valve is included. l

25. A cavity cooling design alternative that uses the existing SCS heat exchangers in the IRWST to  ;

i cool the reactor vessel cavity under natural circulation.

26. A flocdable rubble bed in the bottom of the vessel cavity as an alternate design to cool the debris bed and remove heat. The rubble bed would remain dry until the corium enters the bed. This would minimize the potential for the steam explosion.

27. An alternative design that consists of a ceramic lined crucible with cooling located in the vessel cavity. 1 19.15.6 Risk Significant SSCs for Consideration in the RAP and Other Activities Table 19.15.6-1 presents a list of risk significant Systems Structures and Components (SSCs) that should be included in the D-RAP as described in Section 17.3. ((The COL applicant should consider inclusion l n

(-) of these SSCs in their D-RAP and operations reliability assurance process [ COL Item 19 7))f!) These SSCs were selected based on their risk importance as determined in the Level 1 analyses, the Level 2

)

l analyses, the Level 3 analyses, the shutdown risk evaluation, the internal fire and flood evaluation, and the seismic margins evaluation. For the Level 1 analyses and the shutdown risk analyses, systems and components were included as risk significant if their Risk Achievement Worth (RAW) was greater than )

or equal to 5.0 or their Risk Reduction Worth (RRW) was 1.10 or greater. SSCs with a RAW between 1 2.0 and 5.0 were selected if their RRW was greater than 1.05. For the Seismic Margins Assessment, l a SSC was included if it was a dominant contributor to the Plant HCLPF. For the Level 2, Level 3, and  ;

internal fire and flood analyses, items were included based on engineering judgement. SSCs were also included in the list if specific engineering commitments were made by the system designers. Table 19.15.6-1 contains three columns. The first column identifies the system, structure or component. The second column presents the rationale (basis) for including the SSC in the D-RAP (i.e., RAW > 5.0, Level 2 considerations, engineering judgement, engineering commitment, etc.). The third column briefly describes the item and any associated insights. The third column also identifies any test interval or maintenance assumptions that were used in the PRA. I l

Table 19.15.6-2 presents a list of important Operator Actions selected from the PRA. These operator l actions were selected based on their risk importance as determined in the Level I analyses, the Level 2 )

analyses, the Level 3 analyses, the shutdown risk evaluation, the internal fire and flood evaluation, and )

the seismic margins evaluation. For the Level 1 analyses and the shutdown risk analyses, operator  ;

actions were included as important if their Risk Achievement Worth (RAW) was greater than or equal to 5.0 or their Risk Reduction Worth (RRW) was 1.10 or greater. Operator actions with a RAW between 2.0 and 5.0 were selected if their RRW was greater than 1.05. For the Seismic Margins Assessment,

/ l

\

v] i 8 COL information item; see DCD Introduction Section 3.2.

I Atproved Design nistorial. Probahnstic Risk Assessment Pege 19.15-51 l

l I

i

Design Control Document yttem 80 +

an operator action was included if failure to perform that action could result in a lower overall clant HCLPF value. For Level 2, Level 3, and internal fire and flood analyses, items were included based on engineering judgement.

((The COL applicant is responsible for developing all plant procedures. These procedures include, but are not limited to, the normal operating procedures, system operating procedures, maintenance l procedures, emergency operating procedures and severe accident procedures. The Emergency Operations Guidelines (EOGs) provide guidance to the COL applicant for developing the detailed Emergency l Operations Procedures. Appendices to the EOGs provide guidance on severe accident procedures and emergency operating considerations during shutdown operations. In developing and implementing procedures, training and other human reliability related programs, the COL applicant should consider the information on risk important operator actions presented in Table 19.15.6-2 [ COL Item 19-8))fD.

((In the severe accident management procedures, the COL applicant should include procedures for the use of the Cavity Flood System, the Hydrogen Mitigation System, and the Emergency Containment Spray Backup function of the CSS [ COL Item 19-8))]'.

((The COL should develop procedures for manually aligning the Alternate AC power supply when one of the two emergency diesel generators is unavailable during a loss of offsite power [ COL Item 19-8))]'

19.15.7 Use of PRA to Support Certification Activities The System 80+ PRA results and insights are used in support of pre- and post-certification activities.

The majority of the insights are identified during the pre-certification stage of the design. As a result, this has lead to further improvements in the design to eliminate or minimize potential vulnerabilities during the review process. The following activities include the use of PRA insights in support of design certification process.

e Understanding of the design robustness to severe accidents - PRA insights are used to develop an in-depth understanding of the robustness and tolerance of the System 80+ design to severe accidents initiated by events which are either internal or external to the plant systems, e Importance of operator interface with the design - PRA insights are used to identify risk significant human errors associated with the System 80+ design. By characterizing the risk significant human error, new operating procedures can be developed or existing procedures refined to provide better training to plant operators.

e Development and implementation of other programs - the PRA results and insights were used to systenutically identify the key assumptions, major operator actions, and risk significant components that characterize the "present" risk of the System 80+ design. This information was used to support such programs as: (1) Design Acceptance Criteria (DAC), (2) Inspection, tests, analyses, and acceptance criteria (ITAAC), and (3) Reliability Assurance Program (RAP).

The PRA for the System 80+ design provides adequate models and associated data to effectively support the above mentioned certification activities.

O COL information item; see DCD Introduction Section 3.2.

Amrwed Desiger Meterial Probabbatic Risk Assessment /; .196) Page 19.15 52

System r0+ Deslan controlDocumeut

() Tabic 19.15-1 Significant PRA-Based Safety Insights for System 80+

Insight Disposition 1, ((The COL applicant should perform a seismic walkdown to ensure that (( COL Item 19-4 the as-built plant conforms to the assumptions in the System 80 + PRA - Section 19.7.5.3))l based seismic margins analysis and to assure that seismic spatial systems interactions do not exist.

Details of the seismic walkdown will be developed by the COL applicant.))1

2. ABB-CE will maintain a list of the SSC HCLPF values used in the (( COL Item 19-4 System 80+ Seismic Margins Assessment in the D-RAP. Section 19.7.5.3))'

((The COL Applicant should compare the as-built SSC HCLPFs to those assumed in the System 80+ seismic margins analysis (SMA). Deviations from the HCLPF values or assumptions in the SMA should be evaluated by the COL Applicant to determine if aiy vulnerabilities have been introduced.))'.

3. ABB-CE will maintain a list of risk significant SSCs in the D-RAP D-RAP

4. ((The COL will maintain an operation reliability assurance process based (( COL Item 17-3 on the system reliability information derived from the PRA and other Section 17.3.1))3 Q sources.

l l

he COL Applicant should incorporate the list of risk important systems, (( COL ltem 19-7 structures and components (SSCs) as presented in Table 19.15.6-1 in its Section 19.15.6))'

D-RAP and operation reliability assurance process.))UI.

5. Integrity of divisional separation between redundant safety-related Addressed in all equipment is a key assumption in the System 80+ fire and flood risk safety-related analyses. This divisional separation, which is extended also in the service structures and systems.

water and component cooling water structures, prevents fires and floods from propagating from one division to the other.

Dere are no doors or passageways connecting the divisions of safety- Certified Design related equipment up to elevation 70+0. Material J

6. The control room has its own dedicated ventilation system. This Certified Design eliminates the possibility of smoke, hot gases, and fire suppressants. Material originated in areas outside the main control room, to migrate via the ventilation system to the control room.

i

7. Separate ventilation systems for each division eliminates the possibility of Certified Design srnoke, hot gases, and fire suppressants migrating from one division to Material another.

O LJ COL information item: see DCD Introduction Section 3.2.

Adaprend Design Metenle! . NebeNiittic Mina Assessment (1/97) Page r9.15-53

System 80+ Design ControlDocumarrt Table 19.15-1 Significant PRA-Based Safety Insights for System 80+ (Cont'd.)

Insight Disposition

8. There at : no sources of " unlimited

• external flooding in the reactor Cenified Design buildig The interfacc between the CCWS and the ultimate heat sink Material (throug! the Service Water System) is located in a separate structure outside ' he reactor building.

The se als for the underground pipe chase (contains CCW piping) between Cenified Design the roclear annex and the CCW building will be capable of withstanding Material L intemal flood from a pipe break in the CCWS/SSWS building (e.g.,

service water).

9. Consequential flooding of safety related plant structures from Turbine Sections 3.4 &

Building sources is prevented by the following design features: (a) plant 10.4.1.3 grade below openings to safety related structures; (b) openings to safety related structures above the maximum flood level for the Turbine Building; and (c) site grade such that water would flow away from structures where safety related equipment is located.

10. Electrical separation between the two safety-related divisions is Addressed in a!!

maintained. safety-related systems

11. All drains are divisionally separated. Certified Design Material Drains within a division, drain to the lowest level which has adequate volume to collect water from a break in any division. The drains are Sections 3.4 & 9.3.3 sized to handle the potential discharge of fixed fire suppression systems and fire hoses.

12. ((During plant shutdown operation, the integrity of fire and flood barriers (( COL ltem 19-9 between areas in same division, such as quadrants, where systems Section 19.8.1.2))'

comprising the alternate shutdown success paths are located, should be maintained. This will require configuration control of fire / flood barriers for shutdown operation by the COL applicant.))'

((The COL applicant should incorporate in its configuration control (( COL ltem 19-9 program a requirement that, during modes 4,5, and 6, the water tight Section 19.8.1.2))'

flood doors and fire doors will be maintained closed on at least one quadrant within the subsphere (containing either an SCS or CSS pump) to help prevent common-mode failures from internal floods or fires. The SCS or CSS pump in this quadrant shall be operable. If the flood or fire doors to this quadrant must be opened for reasons other than to permit normal access, a fire watch will be established for the affected door.))'

O

' COL information item; see DCD Introduction Section 3.2.

Approved Oessgn Matenia! Probabbstic Mask Assessment Page 19.15-54

System 80+ Design ControlDocument Table 19.15-1 Significant PRA-Based Safety Insights for System 80+ (Cont'd.)

i Insight Disposition [

13. The grid system for System 80+ will incirte at least two preferred Certified Design power cir <s, each having sufficient capacity. They will be Material continuo .ly energized and available to provide power to safety related ,

loads. The two designated offsite power transmission iires shall be designed and routed to minimize, to the extent practicable, the likelihood i of their simultaneous failure. These circuits shall be routed to ensure no i single event, such as a tower falling or a line breaking can simultaneously 1

affect both circuits in a way such that neither can be returned to service.

The two offsite power circuits shall terminate at two switchyards that are i

physically separate and electrically independent to the extent practicable,

14. ((During plant shutdown, risk can be minimized by appropriate outage (( COL ltem 19-9 management, administrative controls, procedures, and operator knowledge Section 19.8.1.2))1  ;

of plant configuration. This will be an important COL applicant activity.))'

15. Divisional separation exists also between redundant charging pumps and Figure 1.2-4 i their power supplies and redundant trains of instrument air. Sections 8.3.1.1.2.1  !

& 9.3.1.2.1 l

16. ((The COL applicant will develop procedures for manually aligning the (( COL Item 19-8))l O alternate AC power supply (combustion turbine) when one of the two diesel generators is unavailable during a loss of offsite power event.))3 Breakers between the Permanent Non-Safety (PNS) and the class IE Certified Design buses will be interlocked so that a PNS bus cannot be aligned to a class Material IE bus that is being powered by an EDG,

17. To provide sufficient diversity and defense in depth to mitigate all Certified Design postulated accidents, even assuming a common cause failure within the Material Plant Protection System, the System 80+ Instrumentation and Control j System provides the Manual Hardwired ESFAS Actuation System for controls. For display, there are Hardwired Key Indications of Critical Function Status during post accident monitoring.

i I

i I COL information item see DCD Introduction Section 3.2.

^

.u-.2 Design a000enial Probahnede Alek Assessment Pope 19.15-55

System 80+ Design controlDocument  !

1 Table 19.15-1 Significant PRA-Based Safety Insights for System 80+ (Cont'd.) Ol i

Insight Disposition l

18. One function of the Rapid Depressurization System (RDS)(or bleed system) is to provide a safety-grade means of rapidly depressurizing the RCS manually from the control room so that the Safety injection System (SIS) can be actuated, when the long-term decay heat removal fails. This is an imponant feature added to the System 80 + design that helps reduce the failure probability of long-term decay heat removal and plant risk with respect to operating reactor designs.

The following are some imponant aspects of the RDS as represented in  !

the PRA: l 1

The RDS valves are motor-operated and will not reclose on high Certified Design contamment pressure. Material ,

The RDS valves fail as is and therefore they are not subject to Certified Des;gn automatic reclosing upon battery depletion. Material The functions of the RDS are to provide a " feed and bleed" I cooling capability in conjunction with the SIS, and to provide the capability to depressurize the RCS during a severe accident to minimize the potential for High Pressure Melt Ejection (HPME). ]

ABB-CE will provide EPG guidance for use of the RDS Emergency Operations for " feed and bleed" cooling. Guidelines (EOGs)

Procedures will be provided for use of the RDS for EOGs depressurization of the RCS during a severe accident.

The RDS valves are qualified for design basis accident Section 3.2 conditions.

((The reliability of the RDS is imponant. The COL will ensure Section 16.3/3.4.18 the reliability of the RDS.))l O

8 COL information item: see DCD Introduction Section 3.2.

7p m,y u,w. rmsasastic nah Assessment

• l f

l Sy-tem 80+ oestan controlDocument

_/ Table 19,15-1 Significant PRA-Based Safety Insights for System 80+ (Cont'd.) i Insight Disposition i

19. De following are some imponant aspects of the Shutdown Cooling System (SCS) as represented in the PRA:

1 The SCS has two separate and redundant divisions, each with the Cenified Design heat removal capacity to cool the RCS to cold shutdown Material j conditions.  ;

The SCS and Contamment Spray System (CSS) pumps are Cenified Design  !

designed to be independent but identical and functionally Material  ;

interchangeable. Either pump in a division can provide flow to eithe- the CSS header or the SCS heat exchanger.

With the SCS heat exchanger bypass throttle valves failed open, Section 5.4.7.3 j there is adequate flow through the SCS heat exchanger to achieve cooldown over an extended time period.

During plant shutdown operation, the SCS can be aligned to the Cenified Design I I

IRWST to provide RCS inventory makeup or to perform a " feed Material and bleed" operation.

Instrumentation and controls are provided in the Remote Cenified Design Shutdown Panel to ensure that the SCS functions can be Material performed even when the main control room cannot be used due to a fire.

The SCS discharge valves are capable of opening with a delta p Cenified Design equti to the SCS pump shutoff head. This capability is needed Material for SCS injection from the IRWST to the RCS following an Aggressive Secondary Cooldown (ASC).

The SCS piping outside of containment has an ultimate strength Cenified Design in excess of the normal RCS pressure of 2250 psi. Material The SCS pumps can be aligned to take suction from the In- Cenified Design Containment Refueling Water Storage Tank (IRWST). The SCS Material pumps can also be aligned to discharge to the IRWST via the SCS heat exchangers.

The SCS can be aligned to provide IRWST cooling. This backs Cenified Design up the CSS capability for providing IRWST cooling. Material 1

I L wi Dee&n Maannin!= Probahmehic stina Assessment Page 19.15-57 Wsw----e- w-ri--g --- y w

System 80+ DesLqn ControlDocument Table 19.15-1 Significant PRA-Based Safety Insights for System 80+ (Cont'd.)

Insight Disposition

19. (Continued)

The valve isolating the SCS pump suction from the IRWST is Cenified Design capable of passing flow in either direction. This is required so Material that the SCS pump can draw suction from the IRWST to back up the appropriate CSS pump and the CSS pump can draw suction from the RCS to back up the SCS pump.

With the SCS pumps aligned to the IRWST, the pumps' NPSH is Cenified Design adequate to prevent pump cavitation and failure if the IRWST Material inventory is saturated.

The SCS pump motor in each division is not powered from the Cenified Design same Class IE 4.16Kv bus as the CSS pump motor in the same Material division.

20. The following are some imponant aspects of the Safety injection System (SIS) as represented in the PRA:

Four redundant trains are arranged in two divisions so the two Certified Design SIS divisions are completely physically separated from each Material other.

Each SIS pump train has an independent suction line connection Cenified Design to the IRWST. Material The two SIS divisions are completely physically separated from Cenified Design i cach other outside containment. Material Safety injection for " feed and bleed

• is an important backup Section 16.3/3.5.3 .

I decay heat removal method during shutdown operation. A new technical specification was added requiring two of the four SIS l trains to be available during most shutdown modes.

Instrumentation and controls for trains 3 and 4 are provided in Certified Design the Remote Shutdown Panel to ensure that the SIS functions can Material be performed even when the main control room cannot be used due to a fire.

l

21. The following is one important aspect of the CSS as represented in the Cenified Design PRA: In addition to its design basis capabilities, the CSS provides the Material capability to cool the IRWST during accidents requiring " feed and bleed

• operation.

The CSS pumps' NPSil is adequate to prevent pump cavitation and Certified Design failure if the IRWST inventory is saturated. Material 1

AMvond Design Material

• hrobab&stic Risk Assessmerrt page 19, g5.Sg

System 80+ Design ControlDocument Table 19.15-1 Significant PRA-Based Safety Insights for System 80+ (Cont'd.)

Insight Disposition  ;

22. The following are some imponant aspects of the Electrical Distnbution System (EDS) as represented in the PRA:

The EDS includes features intended to reduce the frequency of loss of offsite power (LOOP) events and station blackout (SBO) events.

The turbine generator system and its associated buses Section 7.7.1.1.6 are designed to run back to maintain " hotel

• load on a loss of load.

The run back feature of the turbine generator system D-RAP will be included in the D-RAP.

The two emergency diesel generators are provided with Section 8.3 dedicated 125V DC batteries (DC Division Batteries).

Therefore they can stan and load without the emergency channel batteries.

In addition to the two emergency DGs, the System 80+ Cenified Design

[,') design lias an alternate standby onsite AC power source. Material V This is a non-safety combustion turbine power source which is independent and diverse from the DGs.

The two EDGs are physically and electrically isolated Cenified Design from each other. Material Each of the six independent load group channels and divisions of Certified Design 125 V DC Vital Insttumentation and Control Power is provided Material with a separate and independent class 1 E 125 V battery (2 Division Batteries and 4 channel Batteries). Each battely is sized to supply the continuous emergency load of each own load group for a period of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

The six independent and separate class 1-E 125 V DC batteries Section 8.3 permit operating the I & C loads associated with the turbine-driven emergency feedwater (EFW pumps for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, assuming '

manual load shedding or the use of a load management program.

This enhances the Station Blackout (SBO) coping capability of the System 80+ design.

Each Emergency Diesel Generator (EDG) has a complete and Cenified Design l separate fuel oil storage system. The storage system has Material ,

sufficient fuel to permit EDG operation for no less than 7 days.  !

Each EDG has two dependent air staning systems. Cenified Design l 9j 1

Anmpseet Deekn a000enial Prebeb6 soc }tkk Assessment Page 19.15-59 8

System 80+ Design ControlDocument Table 19.15-1 Significant PRA-Based Safety Insights for System 80+ (Cont'd.)

Insight Disposition

23. The following are some imponant aspects of the Station Service Water System (SSWS) and the Component Cooling Water System (CCWS) as represented in the PRA:

Each of these systems (i.e., CCWS and SSWS) has two Cenified Design redundant and separate safety related divisions with heat Material dissipation capacity to achieve and maintain safe shutdown.

Each division has two pumps. The two CCW Heat Exchanger Buildings (one per division) and the SSW Structure are seismic category 1 structures (and the divisional walls of the SSW structure are pan of the structure).

The Station Service Water Pump structure will be designed such Cenified Design that an internal fire or internal flood on one side of the divisional Material Interface wall will not affect the other division (e.g., by propagation or by causing failure of the divisional wall).

Typically during normal operation one SSW and one CCW pump Sections 9.2.1.2.2, in each division are running with the second pump of SSW and 9.2.1.2.2.2 &

CCW in standby. The standby pump will automatically start if 9.2.2.2.1.2 the running pump in that division trips. This configuration reduces the demand failures of pumps and valves which were found to be significant contributors to risk in current generation plants with standby CCWS/SSWS designs.

The supply and return lines in one division of the SSWS are Cenified Design completely separated from the supply and return lines of the Material redundant division.

SSWS valves in the supply and return lines are locked in the Figure 9.2.1-1, desired position so that only actuation of the pumps are required Sheets 1 & 3 to place a division in service.

The ESF actuation System signals isolate the non-safety related Cenified Design ponion of the CCWS following an accident condition, except for Material cooling for the RCPs, IAS compressor coolers, charging pump motor coolers, and charging pump miniflow heat exchangers.

O Approved Design Materia!- ProbabMistic Risk Assessment Page 19.15-60

System 80+ Design ControlDocument

,q C/ Table 19.15-1 Significant PRA-Based Safety Insights for System 80+ (Cont'd.)

Insight Disposition

24. The following are some imponant aspects of the Emergency Feedwater System (EFWS) as represented in the PRA:

The EFWS is a dedicated safety system that has two separate and Cenified Design redundant divisions. Each division has two diverse 100% Material capacity EFW pumps, one motor operated and one turbine driven. Redundancy, diversity and separatbn between divisions are imponant features reducing the failure probability of the secondary side heat removal.

The EFW pumps in one division can supply feedwater to the SG Cenified Design in the other division through a pipe having at least two normally Material closed isolation valves installed.

Each EFW Storage Tank (EFWST) can be supplied by gravity Cenified Design flow from the Condensate Water Storage Tank (CST). This Material source is isolated by at least two normally closed isolation valves.

The EFW turbine-driven pump in each division is supplied steam Cenified Design ,

from the SG in its division via a pipe connection located Material

(

v upstream of the MSIV. i For SBO sequences that do not credit the Alternate AC Source, Section 10.4.9.1.2 the turbine driven EFW pumps are the only safety system available for removing decay heat. Their operation, however requires DC power supplied by batteries. No room cooling or other AC source is required for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

25. The In-Containment Refueling Water Storage Tank (IRWST) is an Cenified Design  !

imponant design feature which helps reduce the System 80+ risk with Material i respect to operating reactor designs. Imponant characteristics are: (a) located inside containment; (b) the CSS and /or SCS can be aligned to cool the IRWST contents using the CSS or SCS heat exchangers respectively; (c) no valve changeover is required for the recirculation mode of emergency core cooling; (d) IRWST inventory can be made up from the BAST: and (c) in conjunction with remote manual valve operation, provides source of water for flooding the Reactor Cavity in severe accidents.

/n t

.j Apyweved Design Material Probabmstic Risk Assessment Page 19.15-61

System 80+ Design ControlDocument Table 19.15-1 Significant PRA-Based Safety Insights for System 80+ (Cont'd.)

Insight Disposition

26. Aggressive Secondary Cooldown (ASC), which involves cooling of the Certified Design RCS by opening the ADVs and ensuring that EFW is being delivered to Material both steam generators given failure of safety injection, has a significant impact on the core damage frequency contribution for small LOCAs and SGTR. Given a small LOCA or SGTR with failure of Safety Injection, the SCS can be aligned to provide the injection function if the RCS is depressurized to the SCS pump shut off head.

ABB-CE will provide EPG guidance for the use of the EFWS, and the EOGs TBS or ADVs for ASC and the alignment of the SCS for injection operation.

27. The following are features of the System 80+ control room design which were assumed to minimize risk from fires in the control room:

The materials in the control room pan:!s do not independently Section 7.7.1.3.1 support combusion.

The energy sources coming into the control panels are limited to Section 7.7.1.3.1 low power voltage to the maximum extent practical, thus practically eliminating potential ignition sources within the panels.

A significant portion of the control and indication signals are Certified Design j interfaced to the main control panel via fiber optic cables. Material

28. Sufficient instrumentation and controls are provided at the Remote Certified Design Shutdown Panel to bring the plant to safe shutdown in case the main Material ,

control room must be evacuated. Indication and control are provided for l EFW, SCS, ADVs, SIS, RDS, CCWS, and SSWS.

Equipment that does not have dedicated instrumentation and controls at Section 7.4 the Remote Shutdown Panel can be controlled via the operator's module.

This provides the ability to control most plant functions, albeit on a limited basis, from the Remote Shutdown Panel.

I I

l 1

O i i

l Approved Design Material ProbaMilstic Risk Assessment Page 19.15-62 l l

System 80+ oesign controlDocument s Table 19.15-1 Significant PRA-Based Safety Insights for System 80+ (Cont'd.) f l

i Insight Disposition l l

29. A control room fire will not impact the instrumentation and controls located at the Remote Shutdown Panel, or the equipment which is required to place the plant in cold shutdown, due to the following features l of the System 80+ design: l The main control room and the remote shutdown room are Certified Design located at different elevations and in different fire areas. Material The main control room ventilation system is different from the Cenified Design ventilation system for the remote shutdown room. Material

]

The stairwells connecting the main control room and the remote Section 9.4, Figures shutdown room are pressurized, thus not allowing smoke, hot 1.2-5A through 1.2-9  ;

gases and fire suppressants to migrate from one room to the other.

The main control room is continuously pressurized to prevent the Cenified Design entry of smoke, hot gases, din and fire suppressants from other Material aTeas.

[ 30. All fire barriers which provide separation between the two divisions are Certified Design G rated for at least 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. Material ,

1 It was assumed that all fire doors and penetrations within the fire barriers D-RAP  ;

are maintained with high reliability during power operation to prevent the propagation of fire from one area to the next.

31. The possible sources of internal flooding within the Nuclear Annex and Cenified Design Reactor Building are located below elevation 70+0. Material

32. (( Solid state switching devices and electro-mechanical relays resistant to (( Sections 7.1.1.7, relay chatter will be used in the Nuplex 80+ protection and control 7.2.1.1 & 7.3.1.1 systems.))' Use of these devices and relays either eliminates or COL ltem 19-10 minimizes the mechanical discontinuities associates with similar devices at (Relay Chatter operating reactors. Resistance)))I

33. The Stanup Feedwater System (SFWS), a non-safety related system, can Sections 10.4.7.2.3 &

be used to deliver feedwater to the SGs following a reactor trip. The 10.4.7.2.4 SFWS pump is powered from the Permanent Non-Safety (PNS) bus and Figure 8.3.1-1 can be powered by the AAC. The SFWS pump can be aligned to the CST or the deaerator storage tank. With alignment to either storage facility, the NPSH for the pump is adequate to prevent pump cavitation and failure.

l O

8 COL information item; see DCD Introduction Section 3.2.

I Apprewet Des $ aGeenrint- Probahniseic Riek Assessment Page 19.15-63 l

j

System 80+ Design ControlDocument Table 19.15-1 Significant PRA-Based Safety Insights for Systern 80+ (Cont'd.) i l

l Insight Disposition ,

1

34. There will be a diverse RCP seal injection capability using a positive Certified Design i displacement pump that is diverse from the CVCS and can be powered Material j l

from either the EDG or the AAC. l The attemative positive displacement seal injection pump is located in Figure 1.2-5A such a manner as to minimize its vulnerability to internal floods and fires that could also affect the primary means of providing RCP seal cooling or RCP seal injection.

35. An emergency containment spray backup function provides a means of Cenified Design supplying water to the containment spray header from a station AC Material independent external source.

The design of the ECSBS shall include the following design features: (1) Sections 6.5.5 and an 8-inch diameter " tee" connection to each of the containment spray 19.11.3.8 recirculation lines (2) an extension of 8-inch diameter Class 2 piping from the " tee" connection from each of the containment spray recirculation lines to the exterior of the Nuclear Annex, (3) external connections for temporary hookup of an external source of water that are located at or near grade, (4) a portable pumping source (e.g., fire truck) that is independent of site AC power buses. (This pumping device will be capable of supplying sufficient flow to the containment spray header at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after a severe accident to provide sufficient heat removal capability via the spray droplets to prevent the containment pressure from exceeding the service level C pressure), and (5) all necessary hoses, fittings and spool pieces would be stored with the pumping device or at or near the

" tee" Connections.

((The detailed system design and location of all associated valves and (( COL ltem 19-5 connections should take into account expected radiation levels and Sections 19.11.3.8 and shielding requirements for any required local operator actions)).1 6.5.5))!

((The specific flow rate for the pumping device will be determined as part (( COL ltem 19-5 of the detailed desi;n))'. Sections 19.11.3.8 and 6.5.5))!

(( Detailed procedures for use of the system will be developed by the COL applicant))i. (( COL Item 19-8 Sections 19.15.6))'

36. There is a Hydrogen Mitigation System (HMS) utilizing ignitors to Certified Design control hydrogen during a severe accident. Material

((The accident management procedures will address use of the HMS))l. (( COL Item 19-8 Section 19.15.6))2 O

3 COL information item; see DCD Introduction Section 3.2.

Approved Design Material Probabaistic Risk Assessment Page 19.15-64 w

Sv' tem 80+ Design ControlDocument 3

(V Table 19.15-1 Significant PRA-Based Safety Insights for System 80+ (Cont'd.)

Insaght Disposition

37. The Hydrogen purge Vent to the annulus is not credited in the PRA. EOGs  ;

flowever, the use of this vent could decrease the late contamment failure probability.

38. Each half of the subsphere is compartmentalized to separate redundant Certified Design ,

safe shutdown components, to the extent practicable while maintaining Material accessibility requirements. The subsphere, which houses the front line safety systems is compartmentalized into quadrants, with two quadrants on either side of the divisional structural wall. Flood barriers provide -

separation between quadrants, while maintaining equipment removal capability Emergency feedwater pumps are located in separate compartments within the quadrants with each compartment protected by flood barriers. Flood barriers also provide separation between electrical equipment and fluid mechanical systems at the lowest elevation within the Nuclear Annex.

Elevated equipment pads prevent equipment from being inundated in the Section 3.4.4.1 event of flooding.

There are three-hour fire barriers as well as flood barriers between Certified Design quadrants in the subsphere. Material Within each division, there are two Class IE 4.16 KV switchgears. Section 9.5.1.14 These are separated by three-hour fire barriers and are arranged to be associated with one of the subsphere quadrants. Power cables from the diesel generator room in a given division to their associated switchgear are fully separated, and the cables from the switchgear to their associated pumps are fully separated.

I

39. Flood protection is integrated into the floor drainage systems. The floor Certified Design l drainage systems are separated by division and Safety Class 3, Seismic Material Category 1 valves which prevent backflow of water to areas containing ,

safety related equipment. Each subsphere quadrant contains its own  !

separate sump equipped with redundant Safety Class 3, Seismic Category I sump pumps and associated instrumentation. These pumps are also powered from the diesel generators in the event of loss of offsite power. ,

The Nuclear Annex also has its own divisionally separated floor drainage l system, having no common drain lines between divisions. l Floors are gently sloped to allow good drainage to the divisional sumps. Section 9.3.3 l Floor drains are routed to the lowest elevation to prevent flooding of the upper elevations. The lowest elevation in each division has adequate volume to collect water from a break in any system without flooding the other division. In addition, potential discharge of fixed fire suppression systems and fire hoses is considered in the sizing of floor drains to preclude flooding of areas should the fire protection systems be initiated.

C L. A Denien aereeniel- hebahneeic Mish Assessment Pope 19.15-65

Design ControlDocument j System 80+

Table 19.15-1 Significant PRA-Based Safety Insights for System 80+ (Cont'd.) 9I Insight Disposition l

40. ((The COL should maintain a well trained and prepared fire brigade)).8 Section 19.15.3.2

41. The System 80+ low pressure systems which interface with the RCS are Certified Design protected against ISLOCA by a combination of increases in the piping Material pressure limits and autoisolation capability based on pressure sensors.

42. ((The COL applicant should consider the information on risk important (( COL ltem 19-8 operator actions from the PRA in developing and implementing Section 19.15.6))!

procedures, training and other human reliability related programs))!.

43. ((During detailed design phase, the COL applicant should update the PRA (( COL Item 19-6 using the final design information and site specific information. As Section 19.15))'

deemed necessary, the COL applicant should update the PRA, including the shutdown risk evaluation, and the intemal fire and flood evaluation.

Based on site specific information, the COL applicant should also re-evaluate the qualitative screening of extemal events. If any site specific susceptibilities are found, the applicable external event should be included in the updated PRA.))'

44. The structure tnat houses the combustion gas turbine must have a HCLPF Section 19.7.5.3 of at least that of the gas turbine itself, or must be designed in such a manner so that failure of this structure foHowing a seismic event up to HCLPF of the gas turbine will not affect the operability of the gas turbine.

45. During the HFE V&V, the risk significance of tasks impacted by findings Supports Certified will be considered in the fmding resolution process. The resolution Design Material process will qualitatively confirm that the findings, as dispositioned, will not lead to a risk-significant increase in error potential from that represented in the HRA, or additional risk-significant errors not modeled in the HRA. (" Human Factors Engineering Verification and Validation Plan for NUPLEX 80+", NPX80-IC-VP790-03, Section 8.1)

46. No water lines are routed above or through the control room and the Section 3.4 computer room. HVAC water lines contained in rooms around the control room are located in rooms with raised curbs to prevent leakage from entering the control room.

47. A reactor cavity flood system is provided to enhance the coolability of Certified Design ex-vessel core debris. Material

(( Procedures for use of the cavity flood system during a severe accident (( COL ltem 19-8 will be developed by the COL applicant as part of their plant-specific Section 19.15.6))!

severe accident management procedures.

The reliability of the cavity flood system and associated valves is D-RAP, important. The COL applicant will ensure the reliability of the cavity Table 19.15.6-1 flood system.))!

8 COL information item; see DCD Introduction Section 3.2.

Approved Desigre Atatorial Probabekstic Risk Assessment Page 19.15-66

i Sv' tem 80+ Design ControlDocument m

Table 19.15-1 Significant PRA-Based Safety Insights for System 80+ (Cont'd.)

t Insight Disposition ,

48. Containment integrity is important to reduce the risk to the public. The D-RAP, major containment penetrations (equipment hatch, personnel airlocks and Table 19.15.6-1 fuel transfer tube) will be designed to assure that they will not fail up to ASME service level "C" for the containment shell. Penetrations will be designed and sealant materials will be selected to ensure that the seal and mounting will provide a minimum of I day containment integrity.

49. The reliability of the MSSVs, ADVs, and MSIVs is important. ((The D-RAP, COL applicant will ensure the reliability of these components))l. Table 19.15.61

50. Flood barriers separating the flood zones in the nuclear annex, the CCWS Certified Design Heat Exchanger buildings and the SSWS pump structure are designed to Material withstand water pressure generated by internal flooding .

Flood barriers, including water tight doo s and penertations, will be D-RAP, addressed in the operation reliability assurance process. Table 19.15.61 i

i I

I I

o 1

3 COL information item; see DCD Introduction Section 3.2.

Anarend Des &n Aseterd. Phnbabnistic Mick Assessment Page 19,15-67

System 80+ oesign controlDocument l

Table 19.15.1-1 Major System 80+ Preventive and Mitigative Design Features Type of Feature Design Feature Preventive Transient Prevention Larger pressurizer Larger steam generators High-pressure Shutdown Cooling System (SCS) - functionally interchangeable SCS and Containment Spray System (CSS) pumps Multiple independent connections to the grid and turbine-generator runback capability Dedicated Startup Feedwater System (SFWS)

Improved control room design Improved normally operating Component Cooling Water System (CCWS)/ Station Service Water System (SSWS)

Transient Mitigation /

Severe Accident Four train Safety injection System (SIS) with direct vessel injection Prevention Safety Depressurization System (SDS)

Four train Emergency Feedwater System (EFWS)

Two emergency diesel generators and a standby alternate AC source (combustion turbine)

Six vital batteries In-containment Refueling Water Storage Tank (IRWST)

Cross-connected CSS and SCS trains improved control room design Mitigative Large spherical containment Reactor cavity designed for corium disentrainment Reactor cavity designed for debris coo! ability IRWST and SDS liydrogen Mitigation System (HMS) e Approwd Dessen Material Probab&stic Risk Assessment Page 19.15-68

Sy' tem 80 + Design ControlDocument Table 19.15.2-1 Comparison of Core Damage Frequency Contributions by Initiating Event This Table Intentionally Blank.

Table 19.15.2-2 Core Damage Frequency Contributions for Dominant Accident Sequences by Initiating Internal Event This Table Intentionally Blank.

Table 19.15.2-3 Major Contributors to the Uncertainty of CDF (Internal Events) for System 80+

, This Table Intentionally Blank.

Table 19.15.2-4 Summary of System 80+ PRA Sensitivity Analysis Results l This Table Intentionally Blank. l Table 19.15.2-4A Summary of Steam Generator Tube Rupture Sensitivity Analysis This Table Inten' vn ity Blank.

Table 19.15.2-5 System Importance for System 80+ PRA for Internal Events (Sorted by Risk Achievement Worth)

This Table Intentionally Blank.

Table 19.15.2-6 Component Importances for System 80+ PRA for Internal Events (Sorted by Risk Achievement Worth)

This Table Intentionally Blank. l Table 19.15.2-7 Overall Containment Failure Modes This Table Intentionally Blank.

Table 19.15.2-8 Containment Failure Modes for Early Core Damage Sequences p

d This Table Intentionally Blank.  ;

l AnaveM Desen hieserial . Probahnistic Mink Assessment Page 19.15-69

System 80+ Design ControlDocument Table 19.15.2-9 Containment Failure Modes for Mid Core Damage Sequences This Table Intentionally Blank.

Table 19.15.2-10 Release Parameter Data for System 80+ Release Classes This Table Intentionally Blank.

Table 19.15.2-11 Release Fractions by Release Class This Table Intentionally Blank.

Table 19.15.2-12 Summary 01 Containment Response Sensitivity Analysis Results for System 80+

This Table Intentionally Blank.

Table 19.15.2-13 Summary of Sensitivity Results of Risk Consequences for System 80 + g This Table Intentionally Blank.

Table 19.15.3-1 Core Damage Frequency Contributions for Dominant Accident Sequences by Initiating External Event This Table Intentionally Blank.

Table 19.15.3-2 Fire Ignition Sources and Frequencies by Applicable Fire Areas This Table Intentionally Blank.

Table 19.15.41 Frequency of Core Damage for Shutdown Events This Table Intentionally Blank.

Table 19.15.4-2 Core Damage Frequency Contribution by Initiating Event This Table Intentionally Blank.

i AMsreved Design Material- Probabilistic flisk Assessment page 19.15 70 l

i

System 80+ Design control Document I

'V Table 19.15.4-3 Core Damage Frequency Contributions for Dominant Accident Sequences by Initiating Internal Event During Shutdown &

Low-Power Operation This Table Intentionally Blank.

Table 19.15.4-4 Comparison of Shutdown PRAs This Table Intentionally Blank.

Table 19.15.5-1 Summary of the Risk Reductions of the Design Afternatives This Table Intentionally Blank.

O I

WWW Afessnist.Weic AlsA Assessmoret p,9, yp,75 7y

Sy~ tem 80 + Design Control Document Table 19.15,6-1 Risk Significant SSCs for Inclusion in the D-RAP SSC Rationale Insights and Assumptions SYSTEM: Emergency RAWI 'l > 5.0 The EFWS is used for secondary side heat removal Feedwater System following a transient or small LOCA. The EFWS consists (EFWS) of two trains, one per steam generator (SG). Each train has two 100% capacity redundant and diverse pumps, one motor driven and one turbine driven. Each train has its own EFW storage tank which can be refilled from the condensate storage tank or the demineralized water makeup system. There is a cross connect between the two trains on the discharge side of the pumps. The cross-connect line is isolated by two normally closed manual isolation valves.

In the PRA, only unscheduled maintenance was assumed.

Maintenance unavailability was assigned at the subtrain level.

Component: EFW RAW > 5.0 The EFW pumps deliver EFW to the SGs for secondary Motor driven pumps (CCF) side decay heat removal. Each train has one 100%

capacity motor-driven pump powered from the appropriate vital 4.16 KV bus. Consistent with current practices, the EFW pumps are assumed to be tested on a quarterly basis with unscheduled maintenance performed on failure.

Maintenance unavailability is covered by the subtrain level maintenance unavailability (see above).

Component: EFW RAW > 5.0 The EFW pumps deliver EFW to the SGs for secondary Turbine driven pumps (CCF) side decay heat removal. Each train has one 100%

capacity turbine-driven pump powered by steam derived from its associated SG. Consistent with current practices, the EFW pumps are assumed to be tested on a quarterly basis with unscheduled maintenance performed on failure.

Maintenance unavailability is covered by the subtrain level maintenance unavailability (see above).

Component: EFW RAW > 5.0 Consistent with current practices, these check valves are pump discharge check (CCF) assumed to be tested on a cold shutdown basis with valves maintenance performed on failure.

Component: EFW RAW > 5.0 These check valves are assumed to be tested on a cold distribution line check (CCF) shutdown basis with maintenance performed on failure.

valves Component: EFW RAW > 5.0 These valves must open to deliver EFW to the respective distributionline AC (RAW) SG in the event of a transient. These valves are also used motor operated valves to control EFW flow to the SGs during long term EFW usage. Consistent with current practices, these valves are assumed to be tested on a quarterly basis with unscheduled maintenance performed on failure. The maintenance unavailability is covered by the subtrain maintenance unavailability.

Amroved Design Meterial Probabastic frisk Assessment Page 19.15-72

Sy~ tem 80 + Deston controlDocument Table 19.15.6-1 Risk Significant SSCs for Inclusion in the D-RAP (Cont'd.)

SSC Rationale Insights and Assumptions Component: EFW SM A, Flood The EFWSTs provide the inventory for the EFW system.

Storage Tank (EFWST) Seismic failure of the wall between the EFWST and the adjacent DG room would result in flooding of the DG room with failure of the DG and the loss of EFW inventory. Each EFWST also represents a potential flood source for the subsphere for its associated division.

?

Component: SMA If the EFW system is used for extended time periods, the Condensate Storage Tank CST provides a source to replenish the EFWST inventory.

(CST) Seismic failure of this tank would preclude extended EFW usage following a seismic event.

~

Component: EFW RAW > 5.0 No specific assumptions on test or maintenance intervals storage tank inlet valves (CCF)

Component: EFW RAW > 5.0 The motor-driven EFW pump circuit breakers must close motor driven pump (CCF) to provide power to the motor-driven EFW pumps. The breakers breakers are tested at the same time the motor-driven pumps are tested.  ;

Cosnponent: EFWST RAW > 5.0 No specific assumptions on test or maintenance intervals. l O fill line manual isolation '

( valve between CST and EFWSTs l Component: EFWST RAW > 5.0 No specific assumptions on test or maintenance intervals.

fill line check valve between CST and EFWSTs I

1 i

I i

i U') ,

Anwevoet DeeQn Atenwiel . Probabanaic hink Assessment Pope 19.15-73 l i

System 80+ oesign controloccument Table 19.15.6-1 Risk Significant SSCs for Inclusion in the D-RAP (Cont'd.)

SSC Rationale Insights and Assumptions SYSTEM: Electrical RAW > 5.0 The EDS is provided to supply AC and DC electrical Distribution System power necessary for normal plant operation and mitigation (EDS) of abnormal events. The EDS consists of two portions, the non-class IE portion which provides power to equipment needed for normal operation and equipment not needed for safe shutdown, and the class IE portion, consisting of two class IE divisions which provides power to equipment needed to establish and maintain safe shutdown. During normal operation, station power is provided from the grid via one of two offsite power circuits with automatic transfer to the second source on the permanent non-safety buses if the first source is lost. There are manual transfer capabilities to power the IE buses directly from the reserve auxiliary transformers. If the grid is lost, the turbine generator can runback and pick up hotel load. If this is unsuccessful, AC power to the class IE loads can be supplied by the two emergency diesel generators (1 per class IE division). Selected non-class IE loads on the permanent non-safety bus can be powered from the standby combustion turbine. The standby combustion turbine is capable of supplying all the loads on the permanent non-safety bus plus all the safety loads on one of the two class IE buses.

Component: 125 VDC RAW > 5.0 The class IE 125 VDC buses provide safety grade control class IE vital buses (CCF) and instrumentation power. These buses are continuously energized and faults are detected on occurrence.

Unscheduled maintenance is performed on failure.

Component: 480 VAC RAW > 5.0 "Ihe class IE 480 VAC load centers provide 480 VAC class 1E load center (CCF) power to the 480 VAC Motor Control Centers (MCCs) for transformers safety related 480 VAC loads. The load centers are supplied with power from the 4.16 KV buses via the load center transformers. The load center transformers are continuously energized and faults are detected on occurrence. Unscheduled maintenance is performed on failure.

Component: 480 VAC RAW > 5.0 The class IE 480 VAC load centers provide 480 VAC class IE load centers (CCF) power to the 480 VAC Motor Control Centers (MCCs) for safety related 480 VAC loads. The load centers are continuously energized and faults are detected on occurrence. Unscheduled maintenance is performed on failure.

O Approved Design Material Probab&s6c Risk Assessment Page 19.15-74

Sy tem 80 + Design ControlDocument O

V Table 19.15.6-1 Risk Significant SSCs for Inclusion in the D-RAP (Cont'd.)

SSC Rationale Insights and Assumptions Component: 480 VAC RAW > 5.0 The 480 VAC class IE MCCs provide power to the class IE Motor Control (CCF) various 480 VAC safety loads. The 480 VAC MCCs are Centers normally energized with the breaker (s) or contactors to the safety load (s) open to remove power from the load. The load would be energized by closing the breaker (s) or contactors. Faults in the MCCs are detected on occurrence and unscheduled maintenance is performed on failure.

Component: 4.16KV RAW > 5.0 The 4.16KV buses provide the AC power to AC-powered class IE Buses (CCF) safety related loads. 4.16KV power for the pump motors is provided directly from the 4.16 KV buses. 480 VAC power is provided to the load centers via load center transformers. The 4.16 KV buses also indirectly provide power to the vital DC buses via the battery chargers which are powered from 480 VAC vital MCCs. The 4.16 KV buses are continuously energized and faults are detected on occurrence. Unscheduled maintenance is performed on failure.

Component: 4.16KV RAW > 5.0 The 4.16 KV Permanent Non-Safety (PNS) bus provides Permanent Non-Safety (CCF) 4.16KV power and 480 VAC power via stepdown O buses transformers to the permanent non-safety loads. The 4.16 KV PNS bus is continuously energized and faults are detected on occurrence. Unscheduled maintenance is performed on failure.

Component: 125 VDC RAW > 5.0 The 125 VDC batteries provide 125 VDC power to the 125 class IE vital batteries (CCF) VDC vital buses in the event that AC power is unavailable.

During normal operation, the battery chargers maintain a floating charge on the batteries. Consistent with current standard practices, the battery terminal voltage is assumed to be verified every 7 days.

Componem: RAW > 5.0 The EDGs supply 4.16 KV power to the Class IE loads in Emergency Diesel (CCF) the event tint offsite power is not available following a Generators (EDGs) transient or accident. The EDGs are assumed to be tested on a monthly basis. Unscheduled maintenance is performed on failure.

Component: RAW > 5.0 The Engineered Safety Features Component Control Emergency Diesel (CCF) System has the load sequencers for the vital 4.16 KV Generator Load buses. They protect the DG from overload and also prevent Sequencers vital buses from all loading at once if offsite power is lost and regained. The load sequencers are implemented in the Programmable Imgic Controllers (PLCs). The PLCs have internal diagnostic tests on a continuous basis and failures are annunciated. Maintenance is performed on failure.

O V

^ Pege 19.15 75

,- 2 Desson hieennle! PraA=Am= tic Misk Assessment

l System 80+ Design ControlDocument Table 19.15.6-1 Risk Significant SSCs for Inclusion in the D-RAP (Cont'd.)

SSC Rationale Insights and Assumptions Component: RAW > 5.0 These breakers connect the EDGs to the 4.16 KV vital Emergency Diesel (CCF) buses. These breakers are assumed to be tested in Generator Supply conjunction with the monthly EDG tests.

Breakers to 4.16KV class IE buses Component: Alternate Engineering The Alternate AC (AAC) source will supply 4.16 KV AC source (Combustion Judgement power to the permanent non-safety bus in the event that Turbine) offsite power is unavailable. In addition, the AAC source can also supply power to one division of Class IE loads if the EDGs are unavailable. No specific assumptions were made as to testing and maintenance intervals for the AAC.

Component: DG room RAW > 5.0 The DG room ventilation system is temperature actuated.

venti;auw fans (CCF) Based on operating experience information, it is anticipated that the DG room ventilation system will be actuated when the DGs are started for their monthly testing. Thus, the DG room ventilation fans are assumed to be effectively tested on a monthly basis in conjunction with the DG test.

Component: DG room RAW > 5.0 The DG room ventilation system is temperature actuated.

ventilatim dampers Based on operating experience information, it is anticipated that the DG room ventilation system will be actuated when the DGs are started for their monthly testing. Thus, the DG room ventilation dampers are assumed to be effectively tested on a monthly basis in conjunction with the DG test.

Component: EDG air Engineering Each EDG is assumed to have two independent air starting starting system Judgement systems. The starting capability of these systems is assumed to be tested in conjunction with the monthly EDG test. The replenishment capability of the starting air system is constantly verifiable because the starting air compressors must function to supply air to the starting air tanks due to leakoff and EDG panel usage.

Component: EDG fuel Engineering Each EDG has a complete and separate fuel oil system.

oil storage systems Judgement These fuel oil systems were assumed to be inspected, tested and maintained consistent with current practices.

Component: Turbine Engineering The turbine generator system is designed to be capable of generator Judgement running back to and maintaining

• hotel" load following a loss of load.

O Approwd Desmn Matertial Probabikstic flisk Assessment Page 19.15-76 1

r-1

)

l Syrtem C0+ Deslan ControlDocument  ;

i

\

F Table 19.15.6-1 Risk Significant SSCs for Inclusion in the D-RAP (Cont'd.)

SSC Rationale Insights and Assumptions ' l 1

SYSTEM: Component RAW > 5.0 The CCWS is a closed loop system that provides cooling - 1 Cooling Water (CCWS) water flow to remove heat released from plant systems and

/ Station Service Water components. The CCWS also provides cooling water flow

. (SSWS) Systems for decay heat removal from the SCS during shutdown  ;

cooling and from the CSS flow during contamment spray j operation. The CCWS rejects the heat to the SSWS via the CCWS heat exchangers. The SSWS is an open loop system, which takes suction from the ultimate heat sink,'

passes the flow through the CCWS heat exchanger to remove the heat from the CCWS, and then discharges the heated water to the ultimate heat sink. The CCWS and SSWS each consist of two divisions. Each division of  ;

SSWS and CCWS have two 100% capacity pumps. One pump in each division is normally operating and the other pump is in standby. If the operating pump trips, the standby pump would be started. Each division also has two 100% capacity SSWS/CCWS heat exchangers with one in service and the other in standby. Manual valve alignment is required to valve in the standby heat exchanger. Pump and heat exchanger maintenance is performed on the pump or heat exchanger that is in

\ standby. The SSWS and CCWS are in operation during normal power operation and faults in operating equipment are detected on occurrence.

Component: CCWS RAW > 5.0 These valves open to provide CCWS flow through the inlet flow control valves (CCF) shutdown cooling heat exchanger during shutdown cooling to SCS heat exchangers operation. It was assumed that, consistent with current practices, these valves were tested on a quarterly basis and unscheduled maintenance performed on failure.

Component: Service Tornado Strike The SSWS uses a common intake structure for both Water intake Structure Evaluation divisions. The intake structure is that sttucture in which the SSWS draws suction from the ultimate heat sink. The SSWS intake structures are required to meet Reg Guide 1.27 requirements. In the event of a tornado strike on site, the tornado might deposit sufficient debris in the intake structure to cause blockage of the intake structure. If complete blockage occurs, all SSW flow will be lost.

Provisions should be inceipuided to protect the intake structure against the accumulation of sufficient debris to block the structure.

l Component: CCWS SMA The CCWS surge tanks are located in the upper levels of .

surge tanks . the nuclear annex at elevation 170+0. Seismic failure of l these tanks could lead to loss of all CCW inventory with subsequent failure of CCW.

a Aspe==r Desen assender mesaearsic Ask Assessssent Aspe 79.75 77

System 80+ Design ControlDocument l

Table 19.15.6-1 Risk Significant SSCs for Inclusion in the D-RAP (Cont'd.)

l SSC Rationale Insights and Assumptions i Component: CCWS SMA The CCWS heat exchanger buildings are separate from the heat exchanger building nuclear annex building. Seismically induced differential sliding of these buildings could result in failure of the CCWS piping from the heat exchanger buildings to the nuclear annex with consequential failure of the CCWS.

Component: SSWS SM A, Fire. The SSWS pump building is a Seismic Category I pump building Flood structure which houses the SSWS pumps for both divisions.

This structure is outside the CESSAR-DC scope. It was assumed that this structure would have divisional separation equivalent to that in the nuclear annex such that the propagation of internal floods or fires from one division to the other is prevented. It was also assumed that this Seismic Category I structure has a seismic strength equivalent to the nuclear annex structure.

SYSTEM: Safety RAW > 5.0 The function of the SI system is to inject borated water into Injection (SI) System the RCS to provide RCS inventory control in response to a LOCA or an SGTR. The Si system also provides inventory injection for feed and bleed cooling in conjunction with the RDS.

Component: SI pumps RAW > 5.0 The SI pumps are required to provide RCS inventory (CCF) control in response to LOCAs, SGTRs, and situations requiring RCS feed and bleed cooling. The SI pumps also provide long term reactivity control via the injection of borated water. Consistent with current practices, the SI pumps were assumed to be tested quatterly. Unscheduled maintenance is performed on failure.

Component: SI pump RAW > 5.0 The SI pump motor circuit breakers are normally open and motor breakers (CCF) must close to provide power to the Si pump motors. The breakers are tested at the same frequency as the SI pumps.

Component: Si pump RAW > 5.0 Consistent with current practices, these check valves are discharge check valves (CCF) assumed to be tested on a fuel cycle basis with maintenance performed on failure.

Component: Safety RAW > 5.0 The SI DVI MOVs must open to provide injection flow to injection Direct Vessel (CCF) the DVI lines to provide RCS inventory makeup.

Injection (DVI) line Consistent with current practices, these valves are assumed mosor operated valves to be tested on a quarterly basis with maintenance performed on failure.

Component: DVI line RAW > 5.0 This includes all the SI check valves in the DVI line inside check valves (CCF) contamment. These valves must open for injection flow to reach the reactor vessel. The test interval was assumed to be one fuel cycle. Maintenance is performed on failure ,

and only when the plant is shutdown.

Approved Desigrs Atatorial Probabilistic Risk Assessment Pope 19.15-78

System 80 + Design ControlDocument

( )

v Table 19.15.6-1 Risk Significant SSCs for Inclusion in the D-RAP (Cont'd.)

SSC Rationale Insights and Assumptions _

Component: flot leg RAW > 5.0 These check valves are in the hot leg injection lines.

Injection line check (CCF) These valves must open to provide hot leg injection to valves prevent boron crystallization after initial response to large and medium LOCAs. The test interval for these check valves was assumed to be one fuel cycle. Maintenance on these valves is performed on failure and only when the plant is shutdown.

Component: liot leg RAW > 5.0 The hot leg injection MOVs must open to provide hot leg injection line motor- (CCF) injection to prevent boron crystallization after initial operated isolation valves response to large and medium LOCAs. Consistent With current practices, these valves are assumed to be tested on a quarterly basis with maintenance performed on failure.

Component: SIT RAW > 5.0 In the event of a LOCA, these valves must open for the discharge check valves (CCF) SIT inventory to inject into the RCS. These valves are assumed to be tested once a fuel cycle during plant refueling. No scheduled maintenance is performed on these valves while the plant is at power.

n Component: Safety RAW > 5.0 The SITS provide a source of inventory for passive

) Injection Tanks (SITS) (CCF) injection into the RCS in response to large and medium LOCAs and during aggressive secondary cooldown for SCS injection for small LOCAs. SIT pressure and level are monitored on a routine basis, but the tanks are inspected and tested only on a fuel cycle basis and all maintenance is performed while the plant is shutdown.

SYSTLM: Engineered RAW > 5.0 The ESFAS provides the signals to actuate equipment in Safety Features the front line safety systems following a transient or Actuation System accident. The System 80+ ESFAS was assumed to be as (ESFAS) reliable as the System 80 ESFAS. The analysis of the System 80 ESFAS assumed the system was tested on a monthly basis with maintenance performed on failure. For System 80+, most of the ESFAS logic is automatically tested continuously with alarms if problems are detected.

In addition, a full channel functional test is performed periodically to verify that the ESFAS is operable, and to confirm that the automatic testing is functioning properly.

Component: ESFAS SMA Solid state switching devices and electromechanical relays relays will be used in the NUPLEX 80+ protection and control systems. Solid state switching devices are immune to mechanical switching discontinuities. Robust electromechanical relays are selected for NUPLEX 80+

applications such that inherent mechanical contact chatter is within the requisite system performance criteria.

AMwoved Desbyn nieterkt Prchab&stic Risk Assessment Page 19.15-79

System 80+ Design controlDocument Table 19.15.6-1 Risk Significant SSCs for Inclusion in the D-RAP (Cont'd.)

SSC Rationale Insights and Assumptions SYSTEM: Reactor Engincenng The RPS provides the signals to trip the reactor following a Protection System (RPS) Judgement transient or accident. Failure to trip the reactor results in an ATWS. The System 80+ RPS was assumed to be as reliable as the System 80 RPS. The analysis of the System 80 RPS assumed the system was tested on a monthly basis with maintenance performed on failure. For System 80+,

most of the RPS logic is automatically tested continuously with alarms if problems are detected. la addition, a full channel functional test is performed periodically to verify that the RPS is operable, and to confirm that the automatic

testing is functioning properly.

I SYSTEM: Control Engineering The plant is operated from the main control room. The Room Judgement, Fire control room contains sufficient instrumentation displays Evaluation and controls to allow the operators to control the plant during normal operating conditions and to respond to transients and accidents.

Component: Control Engineering The control panels contain the instrumentation displays and Panels Judgement, Fire equipment controls needed to control the plant during Evaluation normal operation and during transient or accident conditions. Materiais which do not independently support combustion are used m the control panels to minimize the potential for fires in the control panels propagating to affect multiple channels.  ;

Component: Control Engineering The control room has its own dedicated ventilation system.

room ventilation Judgement, Fire This eliminates the possibility of smoke, hot gases, and fire j Evaluation suppressants originating in areas outside the control room i l

migrating to the control room via the ventilation system SYSTEM: Remote Engineering The Remote Shutdown Panel has sufficient instrmnentation Shutdown Panel Judgement, Fire and controls to bring the plant to safe shutdown if the main l 1

Evaluation control room must be evacuated.

^

SYSTEM: Shvidown RAW > 5.0 The function of the SCS is to cool the RCS from shutdown Cooling Syvevi (SCS) cooling entry conditions to cold shutdown conditions. In the event of a small LOCA with failure of the SI system, the SCS can be aligned to provide injection if the RCS is depressurized to below the SCS pump shutoff head. j Component: Pressure RAW > 5.0 The SCS suction Motor Operated Valves (MOVs) are Interlocks for SCS (CCF) interlocked so that they can not be opened if the RCS suction valves pressure is greater than the shutdown cooling entry pressure. Common cause failure of these interlocks would prevent the SCS suction MOVs from opening.

O Approwd Design Atatorial- Prn^mmtic itisk Assessment Page 19.15-80

System 80+ Design ControlDocument X)

(V Table 19.15.6-1 Risk Significant SSCs for Inclusion in the D-RAP (Cont'd.)

SSC Rationale Insights and Assumptions Component: SCS RAW > 5.0 The SCS suction MOVs must open in order to start suction MOVs (CCF) shutdown cooling. These valves are located inside contamment, are interlocked on RCS pressure and are part of the RCS pressure boundary. Therefore, these valves can not be tested at power. Consistent with current practices, these valves are tested on a cold shutdown basis and maintenance is performed only wnen the plant is shutdown.

Component: SCS RAW > 5.0 The SCS suction isolation MOVs must open in order to suction isolation MOVs (CCF) establish shutdown cooling. These valves are interlocked on RCS pressure, like the suction MOVs, but they are outside containment and are not part of the RCS pressure boundary. It was assumed that these valves could be tested on a quarterly basis.

Component: SCS RAW > 5.0 These check valves must open to establish shutdown discharge check valves (CCF) cooling flow. These check valves are assumed to be tested on a cold shutdown basis consistent with current practices.

Maintenance is performed on failure.

m RAW > 5.0 The SCS heat exchanger flow control valves must open in

[d T Component: SCS heat exchanger flow control valves.

(CCF) order for SCS flow to pass through the heat exchangers to reject the core heat to the CCW and SSW systems. These valves were assumed to be tested on a quarterly basis and maintenance performed on an as needed basis.

Component: SCS Shutdown Risk The SCS pumps recirculate the RCS fluid through the SCS pumps Analysis heat exchangers to cool the RCS from shutdown cooling entry conditions to cold shutdown conditions and to maintain cold shutdown conditions. The SCS pumps can be backed up by the CSS pumps during shutdown cooling.

The SCS pumps can be used to back up the CSS pumps.

The SCS pumps can also be aligned to inject to the RCS if the RCS is depressurized to the SCS pump shutoff head.

The SCS pumps were assumed to be tested on a quarterly basis consistent with current practices.

Component: SCS/ CSS Engineering in order to use the SCS pumps to backup the CSS pumps Crossover Valves Judgement, or to use the CSS pumps to backup the SCS pumps, the Shutdown Risk SCS/ CSS suction and discharge crossover valves must be Assessment opened. These valves were assumed to be tested on a quarterly basis with maintenance performed on an as needed basis.

(3 Approved Design Materiet - hobabiGsuc Misk Assessment (11/96) Page 19.15-81

l Design ControlDocument ysfem 80+

Table 19.15.6-1 Risk Significant SSCs for Inclusion in the D-RAP (Cont'd.)

SSC Rationale Insights and Assumptions SYSTEM: Rapid RAW > 5.0 The RDS consists of two trains, each containing two Depressurization System MOVs in series, that provides a discharge path fmm the (RDS) top of the pressurizer to the IRWST. The primary function of the RDS is to provide a means of depressurizing the RCS in the event of a severe accident with the RCS at high pressure to prevent a High Pressure Melt Ejection. De RDS also provides the ' bleed" capability for feed and bleed (or once through) cooling of the RCS.

Component: Rapid RAW > 5.0 The RDVs must open for feed and bleed cooling, or for Depressurization Valves (CCF) depressurization of the RCS during a severe accident.

These valves are inside containment and are part of the (RDVs)

RCS pressure boundary so they can not be tested at power.

Rese valves are tested on a fuel cycle basis and maintenance is performed on these valves only when the plant is shut down and depressurized Component: RDV RAW > 5.0 ne RDV valves are 480 VAC motor operated valves inverters (CCF) which are powered from the 125 VDC class IE vital buses via dedicated inverters. Failure of the inverters would result in failure of the RDVs to open. Rese inverters are co:!tinuously energized and failures are indicated.

Maintenance is performed on failure.

SYSTEM: Containment RAW > 5.0, The CSS provides contamment temperature and pressure Spray System (CSS) Level 2 control following accidents such as LOCAs and steam line breaks inside containment. The CSS also provides containment temperature and pressure control follow ~ing a severe accident.

Comnonent: level 2 The CSS pumps deliver spray flow from the IRWST to the Corninment Spray spray headers. Tbc CSS pumps are assumed to be tested pumps on a quanerly basis with unscheduled maintenance performed on failure. The SCS pumps can be used to backup the CSS pumps, and the CSS pumps can be used to backup the SCS pumps.

Component: low Shutdown Risk The LTOP valves my a provide RCS overpressure Temperature Evaluation, protection during low temperature operations. These valve Overpressure (LTOP) RAW > 5.0 also provide a ' bleed" path for feed and bleed cooling valves during low temperature low pressure conditions with the shutdown cooling system valves open. It was assumed that these valves are tested and maintained consistent with current practices.

SYSTEM: Emergency Level 2 The function of the ECSBS is to provide an independent Containment Spray self contained means of supplying water to the containment Backup System (ECSBS) spray header for containment heat removal during emergency conditions where the CSS and SCS pumps are not available.

Appoved Des &rr Materiel Probabnstic Risk Assessmerrt (11/96) Page 19.15-82 s

Sv~ tem 80+ oesign controlDocument P

O V Table 19.35.6-1 Risk Significant SSCs for Inclusion in the D-RAP (Cont'd.)

SSC Rationale Insights and Assumptions Component: CS header level 2 A "T' connector is provided in each CS pump recirculation "T" line outside containment so that the CS headers can accept i spray flow from an external source.

Component: ECSBS level 2 The ECSBS will have an independent pumping device that pumping device is capable of delivering sufficient flow to the containment ,

spray headers at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the onset of a severe l accident to prevent the pressure in contamment from exceeding level C pressure limits. No specific assumptions were made about the testing or maintenance of this pumping device.

SYSTEM: StartUp Engineering The function of the stanup feedwater system is to provide Feedwater System Judgement feedwater flow during low power /startup/ shutdown conditions. The startup feedwater system can backup the EFWS.

Component: Startup Engineering The startup feedwater pump is used to provide feedwater  ;

feedwater pump Judgement flow during low power /startup/ shutdown conditions. The  !

startup feedwater pump can act as a backup to the EFW j i

pumps. No specific assumptions were made as to the test

/ interval or the maintenance frequency for this pump.

SYSTEM: Main Steam RAW > 5.0 The Steam Removal System consists of the main steam line '

System and associated valves up to the turbine control valves. The valves in this system include those which provide for containment isolation following a steam line break or an SGTR and those which provide steam removal during a cooldown of the plant.

Component: RAW > 5.0 These valves provide a controllable means of releasing Atmospheric Dump (CCF) steam from an SG to the atmosphere to prevent challenging Valves (ADVs) the MSSVs. These valves were assumed to be tested on a quanerly basis.

Component: Main Engineering The MSIVs provide containment isolation following a Steam isolation Valves Judgement steam line break. The MSIVs are also used to isolate the (MSIVs) (CCF) ruptured Steam Generator (SG) following an SGTR once the RCS pressure has been reduced to the point at which the MSSVs will not lift. The MSIVs are assumed to have a partial stroke test on a quarterly basis with a full stroke test on a cold shutdown basis. Maintenance is performed only when the plant is shutdown.

Component: Main Engineering The MSSVs are the code safety valves for the SGs.

Steam Safety Valves Judgement Failure of the MSSVs to open could result in j (MSSVs) overpressurization of the SGs. If the MSSVs are challenged following an SGTR and fail to rescat, they g

,g j provide a direct release path to atmosphere. The MSSVs v are not tested at power. They were assumed to be tested consistent with current practices.

hvowevenf skeign A00senin! hobebnesic Mbsk Assessment Pope rA r$-8.1

System 80+ Design ControlDocument Table 19.15.6-1 Risk Significant SSCs for Inclusion in the D-RAP (Cont'd.)

SSC Rationale Insights and Assumptions Component: Turbine Engineering Following a turbine trip, the turbine bypass valves open to Bypass Valves (TBVs) Judgement discharge steam directly to the condenser, bypassing the turbine, to avoid unnecessary reactor trips and to prevent opening of the Pnmary Safety Valves and the Main Steam Safety Valves. The turbine bypass valves are air operated valves that f closed on loss of air. These valves are interlocked ,,; that they do not open on turbine trip if the condenser is not available. No specific assumption was made as to the test and maintenance intervals for these valves.

SYSTEM: Reactor Coolant System (RCS)

Component: Primary RAW > 5.0 The PSVs are the code safety valves for the RCS. Failure Safety Valves (PSVs) of one of these valves to rescat following a challenge such (CCF) as an ATWS would result in LOCA. The PSVs cannot be tested at power. It was assumed that the PSVs are tested consistent with current practices. All PSV maintenance is performed while the plant is shutdown and depressurized.

Component: Reactor SMA Failure of the RCP suppons during a seismic event could Coolant Pump (RCP) result in excessive RCP motion with the potential for suppons failure of multiple RCS cold legs during the seismic event.

Seismically induced failure of the RCP supports was the second dominant contributor to the plant IICLPF.

SYSTEM: Chemical RAW > 5.0 The primary function of the CVCS is to provide RCS and Volume Control chemistry and volume control during normal power System (CVCS) operation. The charging subsystem provides a mechanism for injecting boron for long term reactivity control following an ATWS, and a mechanism for refilling the IRWST. The charging subsystem also provides the RCP seal injection function.

Component: Charging Engineering The normal function of the charging pumps is to provide pumps Judgement RCS volume control during normal operation. The charging pumps also provide RCP seal injection flow. The charging pumps can provide boron injection capability for long term reactivity control following an ATWS and can provide IRWST inventory makeup flow. During normal operation, one charging pump is running and the other is in standby. If the operating pump fails, the standby pump will be staned, and unscheduled maintenance would be performed on the failed pump.

O AMwomed Design aseterial . Pvt.babbstic Risk Assessment rege rg. rS-84

Sy= tem 80+ oesign controlDocument

(T V

d Table 19.15.6-1 Risk Significant SSCs for Inclusion in the D-RAP (Cont'd.)

SSC Rationale Insights and Assumptions t

Component: Dedicated Engineering The dedicated seal injection pump is a positive seal injection pump Commitment displacement pump whose function is to provide seal ,

injection flow to the RCP seals in the event that RCP seal r

cooling is unavailable due to the combined unavailability of the CCW/SSW system, concurrent with any charging pump failing to provide seal injection flow. The PRA did not include any specific test or maintenance assumptions for this pump.

SYSTEM: Hydrogen Engineering The function of the HMS is to burn the hydrogen released Mitigation System Judgement in containment during a severe accident in a controlled (HMS) (Level 2) manner. The HMS consists of two redundant trains of hydrogen igniters. Igniters are powered from either the station batteries or from the vital AC buses. The HMS is tested on a fuel cycle basis and maintenance is performed while the plant is shutdown. .

Component: Hydrogen Engineering The hydrogen igniters are tested on a fuel cycle basis and  :

Igniters Judgement maintenance is performed while the plant is shutdown.

(Level 2)

, SYSTEM: Cavity Flood Engineering In the event of a severe accident, the CFS provides a

'\ System (CFS) Judgement means of flooding the reactor cavity with water to cool the (Level 2) corium. The cavity is flooded from the IRWST by opening the holdup spillway valves from the IRWST to the Holdup Tank (HUT) and by opening the cavity spillway valves from the HUT to the cavity.

Component: Holdup Engineering The holdup spillway valves provide the means of flooding Spillway Valves Judgement the HUT from the IRWST. The cavity is flooded from the (Level 2) HUT via the cavity spillway valves. The holdup spillway valves can not be tested at power because opening the valves would result in an unwanted flooding of the HUT.

Therefore, the holdup spillway valves are tested on a fuel j cycle basis when the plant is shutdown. Maintenance is  ;

performed on these valves only when the plant is f shutdown.

Component: Cavity Engineering The cavity spillway valves provide the path for flooding the l Spillway Valves Judgement cavity from the HUT, which is flooded from the IRWST l (Level 2) via the holdup spillway valves. During normal power I operation, the HUT is empty. Thus, in the PRA it was  ;

assumed that the cavity spillway valves could be stroke tested on a quarterly basis.

i i

ANwesed Deelen Atosonia!- Probabnisaic Rink Assessment Page 19.15 85

System 80+ Design ControlDcqument Table 19.15.6-1 Risk Significant SSCs for Inclusion in the D-RAP (Cont'd.)

SSC Rationale Insights and Assumptions NUCLEAR ANNEX:

Component: Fire Fire Risk Three hour rated fire doors are provided for each fire zone Doors Evaluation to prevent the propagation of fire from one fire zone to another. All fire doors are normally closed and their positions are indicated in the control room. If a fire door must be held open for maintenance access or other reason, a fire watch is maintained at the affected fire door. No specific asst.mptions were made in the PRA as to the maintenance for the fire doors.

Compnent: Flood Flood Risk Flood doors are provided for each flood zone in the Doors Evaluation Nuclear Annex subsphere area to prevent the propagation of an internal flood from one flood zone to another. These flood doors are normally closed and their positions are indicated in the control room. If a flood door must be held open for maintenance access or other reason, a watch is maintained at the affected flood door. No specific assumptions were made in the PRA as to maintenance for the flood doors.

Component: Floor Engineering Flooding from the Radwaste Building and Turbine Building Drain Sump Discharge Judgement, through the floor drain sump pump discharge lines to the Check Valves Flood Nuclear Annex is prevented by the reverse flow check valves located at each of the sump pump discharges.

The check valves on the Reactor Building Subsphere floor drain sump pumps and Diesel Generator Building floor drain sump pumps are Safety Class 3. These valves are reverse flow tested quarterly as specified in the IST plan.

The check valves on the discharge of the Nuclear Annex radioactive floor drain sumps, CVCS area floor drain sumps, and non-radioactice floor drain sumps are non.

safety related. These valves should also be reverse flow tested on a quarterly basis.

SYSTEM: Containment Component: Level 2, SMA The containment shell is the primary barrier preventing Containment shell release of radioactive material following a core damage accident. Also, seismically induced overturning / sliding of the containment shell was found to be the dominant contributor to the plant level HCLPF value in the SMA.

Component: IRWST/ Engineering The HUT /IRWST screens prevent trash and debris from HUT screens commitment entering the HUT and the IRWST and potentially blocking the suction lines for the safety pumps or the cavity flood valves. These screens are assumed to be inspected and cleaned on a fuel cycle basis. They are indirectly tested during the quarterly safety injection pump tests.

Apprend Design Meteria! /WobabHistic Risk Assessment Page 19.16-86

l l

Sy tem 80+ oesien controlDocument b V Table 19.15.6-1 Risk Significant SSCs for Inclusion in the D-RAP (Cont'd.)

I SSC Rationale Insights and Assumptions Component: Level 2 Containment integrity is important to reduce the risk to the  !

Containment penetration public. The major containment penetrations (equipment l seals hatch, personnel airlocks and fule transfer tube) will be designed to assure that they will not fail up to the ASME service level 'C" pressure for the contamment shell.

Penetrations will be designed and sealant materials will be selected to ensure that the seal and mounting will provide a minimum of I day contamment integrity.

Containment failure from high temperatures due to a dry cavity contribute little to public risk in the System 80+

PRA. Consequently, the penetrations are not specifically designed to the low probability dry cavity scenario, llowever, to maximize containment integrity, the penetration design process will consider high quality and high capability seals as well as double seals (inner and outer) as applic:.ble.

1 (q) til For SSCs which contain (CCF) following ' RAW > 5.0", the RAW is based on common cause

, gpg failure of two or more of the specified SSCs.

% -.:: Doelpn n00teriel- ProbeM>rtic hink Asseesneent Pope 19.1547

System r0 + Design Control Document Table 19.15.6-2 Important Operator Actions from the PRA RAW'1 l RRM1 Important Operator Action Source Operator fails to initiate liot Leg injection level 1 > 5.0 < l .1 Operator fails to align EFWSTs to CST Level 1 > 5.0 < l .1 Operator fails to initiate RCS heat removal via level 1 > 5.0 > 1.1 Feed and Bleed Cooling Operator fails to initiate SCS for long-term decay Level 1 > 5.0 < 1.1 heat removal Operator fails to align SCS pumps for RCS Level 1 > 5.0 < 1.1 injection following aggressive secondary cooldown Operator fails to perform aggressive secondary level I < 5.0 >1.05 cooldowe (permitting injection via SCS) after SGTR Operator faais to perform aggressive secondary level 1 < 5.0 >1.05 cooldown (permitting injection via SCS) after small LOCA Operator fails to reclose ADVs on ruptured SG Level 1 > 5.0 < 1.1 Operator failr. to align CVCS to refill IRWST Level 1 < 5.0 > 1.0 following an SGTR Operators fail to align AAC to Vital AC buses level 1 Medium Medium following loss of offsite power and failure of (Engineering (Engineering EDGs Judgement Judgement)

Operator fails to initiate cavity flooding Level 2 liighl31 Hight 31 Operator Fails to Depressurize RCS prior to Level 2 High 133 liigh (31 Vessel breach using RDVs j Operator fails to initiate Ilydrogen Mitigation Level 2 Mediumill Medium t))

System Operator fails to align emergency backup level 2 Mediumill Mediuml31 containment spray system for use.

Operator fails to isolate an isolatable LOCA and Shutdown Risk > 5.0141 < g ,1I41 isolate containment during shutdown operations Evaluation Operator fails to initiate feed using SCS during Shutdown Risk > 5.0 l'1 > l .11 'l shutdown operations Evaluation Operator fails to stan and load standby AC Shutdown Risk > 5.0! 'l > 1.1t41  ;

source during shutdown operations Evaluation Operator fails to isolate an Isolatable leak /LOCA Shutdown Risk > $.0i 'l >1.1141 during shutdown operations. Evaluation i

Approved Des}por Meterial . Probabbstic Misk Assessment Pope 19.15-88

System 80+ Design ControlDocument bw/ Table 19.15.6 2 Important Operator Actions from the PRA (Cont'd.)

Important Operator Action Source RAW'l RRg2)

Shutdown Risk > $.0t41 > g,gl41 Operator fails to start standby SCS train during shutdown operation Evaluation Shutdown Risk > 5.0t41 > g ,gl41 Operator fails to initiate feed using the SIS during mode 5 operations Evaluation l

> 5.0 *3 < l .05t41 Operator fails to restore SCS train given that Shutdown Risk leak /LOCA is isolated Evaluation Operator fails to restore DHR in 73 hours8.449074e-4 days <br />0.0203 hours <br />1.207011e-4 weeks <br />2.77765e-5 months <br /> given Shutdown Risk > 5.O l'1 < l .11 'l loss of DHR in mode 6 with refueling pool full Evaluation and IRWST empty.

Operator fails to recover DHR within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Shutdown Risk < 5.0141 > 1.05ldi following loss of DHR with successful boiloff Evaluation makeup using the CVCS Operator fails to use the CVCS to makeup Shutdown Risk < 5.0t41 >1.05tdl  !

inventory in mode 5 Evaluation Operator fails to suppress fire during shutdown Shutdown Risk < 5.0 l'1 >1.05'l 1 operations Evaluation I'l RAW = Risk Achievement Worth 121 RRW = Risk Reduction Wotth D1 The RAW and RRS values were not calculated for Operator actions in the level 2 analyses.

Qualitative importances were assigned based on engineering judgement.

141 The RAW and RRW values presented for the Shutdown Risk Evaluation are event tree branch point RAW and RRW values and include contributions from both operator errors and equipment p)

'\_

failures.

.% .: Des # a000eriel* Prmtic Rank Assessment Pope 19.15-89

l System 80+ Design ControlDocument O

This Figure Intentionally Blank O

Relative Contributions of Internal Events to Total CDF Figure 19.15.2-1 l

Alywoved Design Materint hobahnstic illsk Assesserrent Pope 19.15-90

Sy tem 80+ Design controlDocument O

3 i

This Figure Intentionally Blank I

l O c -' c - > > >> >> 2-2

System 80+ Design ControlDocument O

This Figure Intentionally Blank O

Total CCDF of WB Dose @ 300 Meters for All RCs Figure 19.15.2-3 AMweved Design Moserid. Probabdistic Risk Assessment Page 19.15-92

System 80+ oestan contrat Document .

l

) i I

f 4

]

1 1

)

i o

J This Figure Intentionally Blank  !

t r l

\

l l

)

i 4

l 4

I 1

l l

l l

i

.p i Total CCDF of WB Dose e 1/2 Mile for all RCs - Figure 19.15.2-4 A i l

L .. Denton nanerw hohesanee ank Assenement rene ts.1s s2 l

l

System 80+ Design Control Document O

This Figure Intentionally Blank O

DOSE vs. Distance for Various Exceedance Probabilities Figure 19.15.2-5 Approwd Design Material hobahnstic Risk Assessment Page 19.15-94