Text

Draft NUREG State-Of-The-Art Reactor Consequence Analyses (Soarca) Project Appendix a Peach Bottom Integrated Analysis, W/Handwritten Notes
	ML12124A076
Person / Time
Site:	Peach Bottom
Issue date:	12/17/2009
From:	; Office of Nuclear Regulatory Research, Sandia
To:	;
References
	FOIA/PA-2011-0083
	Download: ML12124A076 (76)
	v • d • e

P/E441 Revision 1 W- 12/17/2009 1:11:00 PM NUREG - XXXX SAND2008P - XXXX State-of-the-Art Reactor Consequence Analyses (SOARCA) Project Appendix A Peach Bottom Integrated Analysis Manuscript Completed: July 2010 Date Published: XXXX Prepared by:

Sandia National Laboratories Albuquerque, New Mexico 87185 Operated for the U.S. Department of Energy U.S. Nuclear Regulatory Commission Division of Preparedness and Response to Systems Analysis Washington, DC 20555-0001

÷ %

P/E//

Revision 1 9//- 12/17/2009 1:1 1:00 PM Sandia is a multi-program laboratory operated by Sandia Corporation, a Lockheed Martin Company, for the United States Department of Energy's National Nuclear Security Administration under contract DE-AC04-94AL85000.

ii

PeE*e Revision I ?V- 12/17/2009 1:11:00 PM ABSTRACT New analyses of severe accident progression and consequences were performed to assess the results of past analyses and help guide public policy. This study has focused on providing a realistic evaluation of accident progression, source term, and offsite consequences for the Peach Bottom Nuclear Power Station. By using the most current emergency preparedness (EP), plant capabilities,' best-available modeling a s, and recent security assessments, these analyses are more detailed, integrated, and rea istic than past analyses. These analyses also consider all mitigative measures, contributing to a more realistic analysis.

Paperwork Reduction Act Statement The information collections contained in this NUREG are covered by the requirements of 10 CFR Part 50, which were approved by the Office of Management and Budget (OMB), approval number 3150-0011.

iii

Pb*E/&A L Revision 1//f - 12/17/2009 1:11:00 PM This Page Intentionally Left Blank iv

Pt ~EY/1 1 E Revision I ,12/17/2009 1:11:00 PM ACKNOWLEDGEMENTS The contributions of the following individuals in preparing this document is gratefully acknowledged.

Nathan E. Bixler Sandia National Laboratories Jeffrey D. Brewer Sandia National Laboratories Terry Brock Nuclear Regulatory Commission Shawn P. Bums Sandia National Laboratories Randall 0. Gauntt Sandia National Laboratories Ata Istar Nuclear Regulatory Commission Joseph A. Jones Sandia National Laboratories Robert Prato Nuclear Regulatory Commission Mark T. Leonard dycoda, LLC Jocelyn Mitchell Nuclear Regulatory Commission Mark Orr Nuclear Regulatory Commission Jason Schaperow Nuclear Regulatory Commission F. Joseph Schelling Sandia National Laboratories Abdul Sheikh Nuclear Regulatory Commission Richard Sherry Nuclear Regulatory Commission Charlie Tinkler Nuclear Regulatory Commission Randolph Sullivan Nuclear Regulatory Commission Kenneth C. Wagner Sandia National Laboratories v

PII AL Revision I Qa;- 12/17/2009 1:11:00 PM This Page Intentionally Left Blank vi

/P* D/ SSt L Revision I //t-12/17/2009 1:11:00 PM TABLE OF CONTENTS

1.0 INTRODUCTION

.................................................................................................... 1 1.1 Site C haracteristics .................................................................................................... .. 1 1.2 Outline of Report ....................................................................................................... 3 2.0 ACCIDENT SCENARIO DEVELOPM ENT ............................................................ 5 2.1 Accident Sequence Analysis ....................................................................................... 5 2.1.1 Sequences Initiated by Internal Events .................................................................. 5 2.1.2 Sequences Initiated by External Events .................................................................. 7 2.2 M itigative M easures ................................................................................................... 8 2.2.1 M itigation of Sequences Initiated by Internal Events ............................................ 8 2.2.2 Sequence Groups Initiated by External Events ...................................................... 9 3.0 ACCIDENT SCENARIO DEFINITIONS ................................................................ 11 3.1 Long-Term Station Blackout .................................................................................... 11 3.1.1 In itiating E vent .................................................................................................... . . 11 3.1.2 System Availabilities ............................................................................................ 12 3.1.3 M itigative Actions ................................................................................................ 12 3.1.4 Scenario Boundary Conditions ............................................................................. 13 3.2 Short-term Station Blackout .................................................................................... 16 3.2 .1 In itiating E vent .................................................................................................... . . 16 3.2.2 System Availabilities ............................................................................................ 16 3.2.3 M itigative Actions ................................................................................................ 17 3.2.4 Scenario Boundary Conditions ............................................................................. 17 3.3 Loss of Vital AC Bus E-12 ....................................................................................... 18 3 .3.1 In itiating E vent .................................................................................................... . . 18 3.3.2 System Availabilities ............................................................................................ 18 3.3.3 Mitigative Actions ................................................................................................ 19 3.3.4 Scenario Boundary Conditions ............................................................................. 19 4.0 MELCOR MODEL OF THE PEACH BOTTOM PLANT .................................... 23 4.1 Reactor Vessel and Coolant System ......................................................................... 23 4.2. R eactor C ore .......................................................................................................... . . 25 4.3 Primary Containment and Reactor Building ............................................................. 28 4.4 Ex-vessel Drywell Floor Debris Behavior ............................................................... 32 4.5 Containment Failure Model .................................................................................... 34 4.6 Radionuclide Inventories and Decay Heat ................................................................ 36 4.7 M odeling Uncertainties ............................................................................................ 37 4.7.1 Base Case Approach on Important Phenomena ................................................... 38 4.7.2 Early Containment Failure Phenomena ............................................................... 38 5.0 ACCIDENT PROGRESSION AND RADIOLOGICAL RELEASE ANALYSIS ... 41 5.1 Long-Term Station Blackout - Unmitigated Response ............................................ 41 5.1.1 Thermal Hydraulic Response ................................................................................ 43 5.1.2 Radionuclide Release ............................................................................................ 49 5.2 Long-Term Station Blackout - M itigated Response .............................................. 56 vii

Revision I - 12/17/2009 1:11:00 PM 5.2.1 Thermal Hydraulic Response ................................................................................ 56 5.2.2 Radionuclide Release ............................................................................................ 59 5.3 Short-Term Station Blackout - Unmitigated Response ............................................ 59 5.3.1 Thermal Hydraulic Response ................................................................................ 59 5.3.2 Radionuclide Release ............................................................................................ 65 5.4 Short-Term Station Blackout with Manual Blackstart of RCIC - Unmitigated Response 70 5.4.1 Thermal Hydraulic Response .................................... 71 5.4.2 Radionuclide Release ............................................................................................ 73 5.5 Loss of Vital AC Bus E M itigated Response ................................................... 75 5.5.1 Thermal Hydraulic Response ................................................................................ 76 5.5.2 Radionuclide Release ............................................................................................ 79 5.5.3 Sensitivity Analysis .............................................................................................. 79 5.6 Parametric Assessment of Selected Uncertainties ................................................... 82 5.6.1 Containment leakage prior to failure .................................................................... 83 5.6.2 Radionuclide Transport to the Suppression Pool due to SRV Seizure ................ 84 5.6.3 Atmosphere mixing in the drywell ...................................................................... 91 6.0 EMERGENCY RESPONSE ..................................................................................... 93 6.1 Population Attributes ................................................................................................. 94 6.1.1 Population Distribution ....................................................................................... 95 6.1.2 Evacuation Time Estimates ..................................... 96 6.2 W inM A C C S ........................................................................................................... . . 97 6.2.1 Hotspot and Normal Relocation and Habitability ................................................. 98 6.2.2 Shielding Factors ................................................................................................. . . 98 6.2.3 Potassium Iodide ................................................................................................... 99 6.2.4 Adverse W eather .................................................................................................... 99 6.2.5 Modeling using Evacuation Time Estimates .......................................................... 100 6.2.6 Establishing the Initial Cohort in the Calculation ................................................... 101 6.3 A ccident Scenarios ...................................................................................................... 10 1 6.3.1 Unmitigated LTSBO ............................................................................................... 101 6.3.2 STSBO with RCIC Blackstart ................................................................................ 105 6.3.3 STSBO without RCIC Blackstart ........................................................................... 108 6.4 Sensitivity Studies ....................................................................................................... 110 6.4.1 Sensitivity 1 for the STSBO without RCIC Blackstart Evacuation to 16 Miles .... 112 6.4.2 Sensitivity 2 for the STSBO without RCIC Blackstart Evacuation to 20 Miles .... 115 6.4.3 Sensitivity 3 for the STSBO without RCIC Blackstart with a Delay in Implementation of Protective Actions ................................................................................ 117 6.5 Analysis of Earthquake Impact ................................................................................... 119 6 .5 .1 S o ils R ev iew ........................................................................................................... 1 19 6.5.2 Infrastructure Analysis ............................................................................................ 120 6.5.3 Electrical and Communications .............................................................................. 124 6.5.4 Emergency Response .............................................................................................. 124 6.5.5 Development of W inM ACCS parameters .............................................................. 125 6.5.6 STSBO without RCIC Blackstart ........................................................................... 126 6.6 Accident Response and M itigation of Source Terms ................................................. 129 6.6.1 E xternal R esources .................................................................................................. 13 1 viii

Revision 12/17/2009 1:11:00PM 6.6.2 M itigation Strategies ............................................................................................... 132 6.6.3 Truncation Summ ary .............................................................................................. 135 6.7 Em ergency Preparedness Sum m ary and Conclusions ................................................ 135 7.0 O FF-SITE C O N SEQ U EN C ES .................................................................................... 139 7.1 Introduction ................................................................................................................ 139 7.2 Peach Bottom Source Term s....................................................................................... 139 7.3 Consequence A nalyses ................................................................................................ 140 7.3.1 U nm itigated Long-Term Station Blackout Sequence ............................................. 141 7.3.2 Short-Term Station Blackout w ith RCIC B lackstart .............................................. 144 7.3.3 U nm itigated Short-Term Station Blackout ............................................................. 148 7.3.4 Evaluation of SST1 Source Term ........................................................................... 153 8.0 REFEREN CES .............................................................................................................. 159 ix

P4 I I*E4 A LRevision I Wt- 12/17/2009 1:11:00 PM LIST OF FIGURES F igure 1 Site L ocation .......................................................................................................... .. 2 F igure 2 Site Photograph ...................................................................................................... .. 3 Figure 3 SOARCA Accident Scenario Selection Process ...................................................... 7 Figure 4 Reactor Vessel Cross-Section Detail and MELCOR Hydrodynamic Nodalization... 24 Figure 5 Spatial Nodalization of Reactor Pressure Vessel and Coolant System ................... 26 Figure 6 Spatial Nodalization of the Core and Lower Plenum ............................................ 27 Figure 7 Local Relative Power Fraction (RPF) and 5-Ring Radial Boundaries of Core .......... 28 Figure 8 Hydrodynamic Nodalization of the Primary Containment ................................... 29 Figure 9 Hydrodynamic Nodalization of the Reactor Building (a) ....................................... 30 Figure 10 Hydrodynamic Nodalization of the Reactor Building (b) ..................................... 31 Figure 11 Drywell Floor Regions for Modeling Molten-Core/Concrete Interactions ............ 33 Figure 12 Drywell Head Flange Connection Details ............................................................ 35 Figure 13 Drywell Flange Leakage Model versus Containment Pressure .............................. 36 Figure 14 LTSBO V essel Pressure .......................................................................................... 44 Figure 15 LTSB O Coolant Level ............................................................................................ 44 Figure 16 LTSBO Fuel Cladding Temperatures at Core Mid-plane ....................................... 46 Figure 17 LTSBO Temperature of Particulate Debris on Inner Surface of Lower Head ..... 47 Figure 18 LTSBO Lower Head Temperature ......................................................................... 48 Figure 19 LTSBO Containm ent Pressure ................................................................................ 48 Figure 20 LTSBO Environmental Source Term: Detail at Time of Containment Failure .......... 50 Figure 21 LTSBO Environmental Source Term: Long term ................................................ 51 Figure 22 LTSBO Iodine Fission Product Distribution .......................................................... 52 Figure 23 LTSBO Cesium Fission Product Distribution ........................................................ 52 Figure 24 LTSBO Tellurium Fission Product Distribution .................................................... 53 Figure 25 LTSBO Cerium Fission Product Distribution ........................................................ 53 Figure 26 LTSBO Ex-vessel Debris Temperatures ............................................................... 55 Figure 27 M itigated LTSBO Vessel Pressure ......................................................................... 57 Figure 28 M itigated LTSBO Coolant Level ............................................................................ 57 Figure 29 Mitigated LTSBO Core Temperature .................................................................... 58 Figure 30 Mitigated LTSBO Containment Pressure ............................................................... 58 Figure 31 STSBO Reactor Pressure ....................................................................................... 61 Figure 32 STSBO Reactor Vessel W ater Level ...................................................................... 62 Figure 33 STSBO Fuel Cladding Temperatures at Core Mid-plane ....................................... 62 Figure 34 STSBO Temperatures of Core Debris along Inner Surface of Lower Head ........... 63 Figure 35 STSBO Inner/Outer Surface Temperatures of Lower Head ................................... 63 Figure 36 STSBO Containment Pressure History .................................................................. 64 Figure 37 STSBO Environmental Source Term ..................................................................... 66 Figure 38 STSBO Environmental Source Term: Details for Volatile Species ...................... 66 Figure 39 STSBO Iodine Fission Product Distribution ........................................................... 67 Figure 40 STSBO Cesium Fission Product Distribution ........................................................ 68 Figure 41 STSBO Tellurium Fission Product Distribution ................................................... 68 Figure 42 Reactor Vessel Pressure: STSBO with RCIC Blackstart ........................................ 72 Figure 43 Reactor Vessel Water Level: STSBO with RCIC Blackstart ................................ 73 Figure 44 STSBO with RCIC Blackstart Environmental Source Term .................................. 74 x

SReviion 12/17/2009 1:11:00PM Figure 45 STSBO Environmental Source Term: Details for Volatile Species ...................... 74 Figure 46 Loss of Vital AC Bus E-12 Reactor Vessel Pressure ............................................ 77 Figure 47 Loss of Vital AC Bus E-12 Reactor Water Level ................................................. 78 Figure 48 Sensitivity of Station Battery Duration: Reactor Water Level - Loss of Vital AC Bus E - 12 ............................................................................................................................. 81 Figure 49 Sensitivity of Station Battery Duration: Peak Clad Temperature - Loss of Vital AC B u s E - 12 ...................................................................................................................... 81 Figure 50 Effect of Increased Containment Leakage on the Release of Iodine to the E nvironm ent ......................................................................................................... . . 84 Figure 51 Number of SRV Cycles as a Function of Time (LTSBO) ..................................... 86 Figure 52 RPV Pressure: LTSBO versus SRV Sensitivity Calculations ................................ 88 Figure 53 RPV Water Level: LTSBO versus SRV Sensitivity Calculations ......................... 88 Figure 54 Containment Pressure: LTSBO versus SRV Sensitivity Calculations .................. 89 Figure 55 Iodine Release to Environment: LTSBO versus SRV Sensitivity Calculations ........ 90 Figure 56 Cesium Release to Environment: LTSBO versus SRV Sensitivity Calculations ...... 90 Figure 57 Drywell Atmosphere Temperatures in the Baseline LTSBO Calculation ............. 91 Figure 58 Drywell Atmosphere Temperatures with Imposed Drywell Circulation ................ 92 Figure 59 Effect of Modeling Circulation Flow within the Drywell on Iodine and Cesium R elease to the Environm ent .................................................................................. 92 Figure 60 Peach Bottom 10 and 20 Mile Analysis Areas ..................................................... 93 Figure 61 Unmitigated LTSBO Emergency Response Timeline .............................................. 102 Figure 62 Duration of Protective Actions for Unmitigated LTSBO .................. 103 Figure 63 STSBO with RCIC Blackstart Emergency Response Timeline ............................... 106 Figure 64 Protective Actions for STSBO with RCIC Blackstart .............................................. 107 Figure 65 STSBO without RCIC Blackstart Emergency Response Timeline .......................... 109 Figure 66 Duration of Protective Actions for STSBO without RCIC Blackstart ..................... 109 Figure 67 Evacuation Timeline from Peach Bottom for the 10 to 20 Mile Region .................. 112 Figure 68 Sensitivity 1 STSBO without RCIC Blackstart - Evacuation to 16 Miles ................ 113 Figure 69 Duration of Protective Actions for Sensitivity 1 STSBO without RCIC Blackstart -

E vacuation to 16 M iles ............................................................................................. 113 Figure 70 Sensitivity 2 STSBO without RCIC Blackstart - Evacuation to 20 Miles ................ 115 Figure 71 Duration of Protective Actions for Sensitivity 2 STSBO without RCIC Blackstart -

E vacuation to 20 M iles ............................................................................................. 115 Figure 72 Sensitivity 3 STSBO without RCIC Blackstart - Delay in Implementation of P rotectiv e A ctio n s ..................................................................................................... 117 Figure 73 Protective Action Durations for Sensitivity 3 STSBO without RCIC Blackstart -

Delay in Im plem entation of Protective Actions ........................................................ 118 Figure 74 Roadway Network Identifying Potentially Affected Roadways and Bridges .......... 122 Figure 75 Bridge along Robert Fulton Highway .............................. 123 Figure 76 STSBO without RCIC Blackstart Emergency Response Timeline (Seismic Analysis)

........................................................................................ 127 Figure 77 Protective Action Durations for STSBO without RCIC Blackstart (Seismic Analysis)

................................................................................................................................... 1 27 Figure 78 Volume Needed to Fill the Peach Bottom Reactor Building .................................... 134 Figure 79 Peach Bottom Pumping Capacity and Time ............................................................. 134 xi

,e -- , , Revision I - 12/17/20091:11:00 PM Figure 80 Conditional, i.e., assuming accident occurs, mean, latent-cancer-fatality risks from the Peach Bottom unmitigated LTSBO sequence for residents within a circular area of specified radius from the plant. The curves represent four values of dose-truncation lev el ........................................................................................................................... 143 Figure 81 Conditional, i.e., assuming accident occurs, mean, LNT, latent-cancer-fatality risks from the Peach Bottom unmitigated LTSBO sequence for residents within a circular area of specified radius from the plant. The columns show the risks from the emergency phase (EARLY), long-term phase (CHRONC), and the two phases comb in ed (T otal) ....................................................................................................... 144 Figure 82 Conditional, i.e., assuming accident occurs, mean, latent-cancer-fatality risks from the Peach Bottom STSBO sequence with RCIC blackstart for residents within a circular area of specified radius from the plant. The curves represent four choices of dose-tru n cation lev el .......................................................................................................... 14 6 Figure 83 Conditional, i.e., assuming accident occurs, mean, LNT, latent-cancer-fatality risks from the Peach Bottom STSBO sequence with RCIC blackstart for residents within a circular area of specified radius from the plant. The columns show the risks from the emergency phase (EARLY), long-term phase (CHRONC), and the two phases comb in ed (T otal) ....................................................................................................... 14 7 Figure 84 Conditional, i.e., assuming accident occurs, mean, latent-cancer-fatality risks from the Peach Bottom unmitigated STSBO sequence for residents within a circular area of specified radius from the plant. The curves represent four choices of dose-truncation leve l........................................................................................................................... 14 9 Figure 85 Conditional, i.e., assuming accident occurs, mean, LNT, latent-cancer-fatality risks from the Peach Bottom unmitigated STSBO sequence for residents within a circular area of s ecified radius from the plant. The columns show the risks from the emergenc-lp.ase (EARLY), long-term phase (CHRONC), and the two phases com b in ed (To tal) ..................................................................................................... 150 Figure 86 Conditional, i.e., assuming accident occurs, mean, LNT, latent-cancer-fatality risks from the Peach Bottom unmitigated STSBO sequence for residents within a circular area of specified radius from the plant. The columns show the dependence of risk on the size of the evacuation zone .............................................. 152 Figure 87 Conditional, i.e., assuming accident occurs, mean, LNT, latent-cancer-fatality risks from the SSTI source term for residents within a circular area of specified radius from the Peach Bottom plant. The columns show the risks from the emergency phase (EARLY), long-term phase (CHRONC), and the two phases combined (Total) ..... 155 Figure 88: Risk of a fatal occurrence of the hematopoietic syndrome due to an acute dose to the red marrow. The three curves are for the models used at the time of the Sandia Siting Study, NUREG- 1150, and in SOARCA ................................................................... 157 xii

e DfSie L Revision I 12/17/2009 1:11:00PM LIST OF TABLES Table 1 A ccident scenarios and their frequencies .................................................................... 11 Table 2 Concrete C omposition ........................................................................................... 34 Table 3 Timing of Key Events for Long-Term Station Blackout ....................................... 42 Table 4 Timing of Key Events for Mitigated Long-Term Station Blackout ...................... 56 Table 5 Timing of Key Events for the Unmitigated Short-term Station Blackout .............. 60 Table 6 Timing of Key Events for the Short-term Station Blackout with RCIC Blackstart .... 71 Table 7 Timing of key events for Loss of Vital AC Bus E-12 ............................................ 76 Table 8 Sensitivities for Loss of Vital AC Bus E-12 .......................................................... 82 Table 9 Scenarios Assessed for Emergency Response ........................................................ 94 Table 10 Peach Bottom Cohort Population Values ............................................................... 96 Table 11 Peach Bottom Shielding Factors ........................................................................... 99 Table 12 Unm itigated LTSBO Cohort Tim ing ........................................................................ 105 Table 13 STSBO with RCIC Blackstart Cohort Timing .......................................................... 108 Table 14 STSBO without RCIC Blackstart Cohort Timing .................................................... 110 Table 15 STSBO without RCIC Blackstart, Sensitivity 1 ......................................................... 114 Table 16 STSBO without RCIC Blackstart, Sensitivity 2 ....................................................... 116 Table 17 Cohort Tim ing for Sensitivity 3 ................................................................................ 119 Table 18 Description of the Potential Evacuation Failure Locations ...................................... 121 Table 19 Cohort Timing STSBO without RCIC Blackstart .................................................... 129 T able 20 M itigation Strategies ................................................................................................. 131 Table 21 Brief Source-Term Description for Peach Bottom Accident Sequences and the SST 1 Source Term from the Sandia Siting Study .............................................................. 140 Table 22 Conditional, i.e., assuming accident occurs, Mean, Latent-Cancer-Fatality Risks for Residents within the Specified Radii of the Peach Bottom Site. Risks Are for the Unmitigated LTSBO Sequence, which Has a Mean Core Damage Frequency of 3"10" 6/y r .............................................................................................................................

14 2 Table 23 Absolute, Mean, Latent-Cancer-Fatality Risks for Adult Residents within the Specified Radii of the Peach Bottom Site. Risks Are for the unmitigated LTSBO Sequence, which has a mean core damage frequency of 3-10 6/yr ........................... 142 Table 24 Conditional, i.e., assuming accident occurs, Mean, Latent-Cancer-Fatality Risks for Adult Residents within the Specified Radii of the Peach Bottom Site. Risks are for the STSBO Sequence with RCIC blackstart, which has a mean core damage frequency of 3.10 7/y r ........................................................................................................ . . . . . 14 5 Table 25 Absolute, Mean, Latent-Cancer-Fatality Risks for Adult Residents within the Specified Radii of the Peach Bottom Site. Risks are for the STSBO Sequence with RCIC blackstart, which has a mean core damage frequency of 3.10 7/yr ................. 145 Table 26 Conditional, i.e., assuming accident occurs, Mean, Latent-Cancer-Fatality Risks for Residents within the Specified Radii of the Peach Bottom Site. Risks are for the unmitigated STSBO Sequence, which has a mean core damage frequency of 3.10 7/yr.

................................................................................................................................... 14 8 Table 27 Absolute, Mean, Latent-Cancer-Fatality Risks for Residents within the Specified Radii of the Peach Bottom Site. Risks are for the unmitigated STSBO Sequence, which has a mean core damage frequency of 3"10 7/yr ............................................. 149 xiii

40g Revision 1IA*/sft - 12/17/2009 1:1 1:00 PM Table 28 Effect of Size of Evacuation Zone on Conditional, Mean, LNT, Latent-Cancer-Fatality Risks for Residents within the Specified Radii of the Peach Bottom Site.

Risks Are for the Unmitigated Short-Term Station Blackout Sequence .................. 151 Table 29 Conditional, i.e., assuming accident occurs, Mean, LNT, Latent-Cancer-Fatality Risks for Residents within the Specified Radii of the Peach Bottom Site. Risks Are for the Unmitigated STSBO Sequence and Compare the Unmodified Emergency Response (ER) and ER Adjusted to Account for the Effect of Seismic Activity on Evacuation R outes and H um an R esponse .................................................................................... 153 Table 30 Conditional, i.e., assuming accident occurs, Mean, Latent-Cancer-Fatality Risks for Adult Residents within the Specified Radii of the Peach Bottom Site. Risks Are Based on the SST1 Source Term from the Sandia Siting Study ............................... 154 Table 31 Conditional, i.e., assuming accident occurs, Mean, LNT, Latent-Cancer-Fatality Risks for Residents within the Specified Radii of the Peach Bottom Site. Risks Are for the SST1 Source Term from the Sandia Siting Study and the unmitigated STSBO seq u en c e .................................................................................................................... 154 Table 32 Conditional, i.e., assuming accident occurs, Mean, Prompt-Fatality Risks for Residents within the Specified Radii of the Peach Bottom Site. Risks Are for the SST1 Source Term from the Sandia Siting Study ............................ 156 xiv

6 Revision I 1A t - 12/17/2009 1:11:00 PM ACRONYMS ATWS Anticipated Transient Without Scram CD Core Damage CDF Core Damage Frequency CRDHS Control Rod Drive Hydraulic System CRGT Control Rod Guide Tube CST Condensate Storage Tank EP Emergency Preparedness EPZ Emergency Planning Zone ETE Evacuation Time Estimate GE HPCI IPE General Emergency High Pressure Coolant Injection Individual Plant Examination 4-9 IPEEE LPCI Individual Plant Examination of External Event Low Pressure Coolant Injection a- i) I LPI MSIV Low Pressure Injection Main Steam Isolation Valve 0-J-ý-

NRC Nuclear Regulatory Commission ORO Offsite Response Organizations PeCo Philadelphia Electric Company RAMCAP Risk Analysis and Management for Critical Asset Protection RCIC Reactor Core Isolation Cooling RHR Residual Heat Removal SAE Site Area Emergency SECPOP SECtor POPulation and Economic Estimator (Version 3.12.6)

SOARCA State-of-the-Art Reactor Consequence Analysis Project SPAR Simplified Plant Analysis Risk SRV Safety/Relief Valve TAF Top of Active Fuel UE Unusual Event VF Vessel Failure xv

Pe IE 7 I(A L Revision I D*t - 12/17/2009 1:11:00 PM This Page Intentionally Left Blank xvi

,0q t#AL Revision I li - 12/17/2009 1:11:00 PM

1.0 INTRODUCTION

' -

The evaluation of accident phenomena and the offsite consequences of severe reactor accidents has been the subject of considerable research by the U.S. Nuclear Regulatory Commission (NRC) over the last several decades. As a consequence of this resea'ch focus, analyses of severe accidents at nuclear power reactors is more detailed, integrated andrealistic than at any time in the past. A desire to leverage this capability to address, aspects of_

previous reactor accident analysis ettorts was a major motivating tactor in me genesis oi tne State-of-the-Art Reactor Consequence Analysis (SOARCA) project. By applying modem analysis tools and techniques, the SOARCA project seeks to provide a body of knowledge that will support an informed public understanding of the likely outcomes of severe nuclear reactor PO \

accidents.

The primary objective of the SOARCA project is to provide a best estimate evaluation of the likely consequences of important severe accident events at reactor sites in the U.S. civilian nuclear power reactor fleet.. To accomplish this objective the SOARCA project "girWfftilize'.

integrated modeling of accident progression and off site consequences using both state-of-the-art computational analysis tools as well as best modeling practices drawn from the collective O_,A-wisdom of the severe accident analysis community. This report documents'the analysis of the £-o Peach Bottom Atomic Power StationW the dominant but extremely low likelihood accidents that could progress to radiological release.

1.1 Site Characteristics This report describes results of the analysis of severe accident progression specific to the Peach Bottom Atomic Power Station -- a nuclear plant of the BWR/4 Mark I design located in southeast Pennsylvania. This station is located 17.9 miles south of Lancaster, Pennsylvania and 38 miles north-northeast of Baltimore, Maryland as shown in Figure 1. The site occupies 620 acres in the York and Lancaster counties of southeastern Pennsylvania and is 2.5 miles north of the Maryland-Pennsylvania state line. The plant is situated on the western shore of Conowingo Pond which is formed by the backwater of Conowingo dam, located 9 miles downstream on the Susquehanna River. The Holtwood dam is located 6 miles upstream.

The minimum exclusion distance from the center of the reactor to the site (for either Unit 2 or Unit 3) is about 2,700 ft. The minimum distance from the center of a reactor to the site boundary in a downstream direction is about 3,300 ft (from Unit 2) and in an inland direction about 3,100 ft (from Unit 2). The minimum distance across the pond from either the Unit 2 or Unit 3 reactor to the far shore of the pond (to the northeast) is 7,600 ft. The minimum distance from the stack to the site boundary is 2,350 ft. The "exclusion area," as defined in Section 100.3 of 10 CFR Part 100, includes the area within the minimum exclusion distance from the center of Unit 2 and Unit 3 reactors.

I

WIDWOSIOtAL Revision I K - 12/17/2009 1:11:00 PM 10 HA Y, LV A I 4221 *40~,2%2;I~ CCU4 MOW., I-Pech B42ottm~~2 I~

PýHSYL0 22Wk 1" l~v" t4~wW 244 , I N~' dg44 444244 RO 544.12 sw44 WM ,, 444 W444244 Figure 1 Site Location Within a 1 mile radius of the plant and on both sides of Conowingo Pond, steep sloping hills rise directly up to about 300 ft above plant grade with outcroppings of rock apparent at many locations. Because of the relatively rough terrain, much of this area is desolate with wooded areas scattered throughout, although the more gentle sloping areas are cleared and cultivated.

The site is located in a well-defined river valley, which in turn lies in rolling but not exceptionally rugged country. Maximum elevations in the immediate vicinity of the facility seldom exceed 300 ft above river level, although there are several plateau sections and hilltops reaching 500 to 800 ft above the river within 10 mi to the southwest, west, northwest, and north of the site [1] (see Figure 2).

2

P/0D EViO14tL Revision I ? 1/- 12/17/2009 1:11:00 PM Figure 2 Site Photograph.

1.2 Outline of Report Section 2 of this report briefly summarizes the method used to select the specific accident scenarios subjected to detailed computational analysis. Additional details of this method can be found in Volume 1 of this series of reports. Section 3 then describes the results of the accident scenario selection process when it was applied to Peach Bottom. Section 4 describes the key features of the MELCOR model of the Peach Bottom Atomic Power Station. Section 5 describes the results of MELCOR calculations of severe accident progression and radionuclide release to the environment for each accident scenario. Section 6 describes the way in which plant-specific emergency response actions were represented in the calculations of offsite consequences, and Section 7 describes the calculations of offsite consequences for each accident scenario. References cited in this report are listed in Section 8 0-3

DS /AL Revision 1 0r"ft - 12/17/2009 1:11:00 PM This Page Intentionally Left Blank 4

/ DA Revision I *ra - 12/17/2009 1:11:00 PM 2.0 ACCIDENT SCENARIO DEVELOPMENT Specific radiological release scenarios were selected for detailed analysis of severe accident progression, radionuclide release to the environment and estimation of their impacts on public health and safety. Selection of a scenario begins by identifying sequences of events that lead to core damage, based on plant-specific models of plant systems developed for the purpose of Probabilistic Risk Assessment (PRA). in this context, an accident sequence begins with a postulated initiating event (for example, a major disruption in offsite power, a leak or rupture of reactor coolant system piping, or an earthquake) that perturbs the steady state operation of the nuclear power plant is such as way as to induce actuation of the plant's control and safety systems. If a sufficient number of control and/or safety systems fail to actuate or operate as needed to respond to the initiating event, damage to the reactor fuel and the release of radioactive fission products would result.

In the SOARCA Program, accident sequences that have an estimated frequency greater than lx 10-6 per year of reactor operation1 are retained as candidate sequences for further evaluation.

Section 2.1 summarizes the methods used to identify these sequences and the screening process for retaining candidate sequences. Additional information can also be found in Volume 1 of this report.

Once candidate accident sequences are identified, realistic opportunities for plant personnel to respond to the observed failures of control and safety systems are evaluated. Possibilities for mitigation included the licensee's emergency operating procedures (EOPs), severe accident management guidelines (SAMGs) and mitigation measures developed specifically for response to security concerns that arose from the events of September 11, 2001. The manner in which mitigation measures were evaluated for each accident sequence is described in Section 2.2.

The end result of this process was a list of accident scenarios (i.e., event sequence plus options for mitigation), which were subjected to detailed analysis of radionuclide release to the environment (described in Section 5) and offsite radiological consequence (Section 6).

2.1 Accident Sequence Analysis An accident sequence is initiated by either an internal event (e.g., equipment failure2 , spurious control system signal or operator error) or external events (e.g., floods, fires, and seismic events).

Sections 2.1.1 and 2.1.2 describe the method used to identify sequences initiated by internal and external events, respectively.

2.1.1 Sequences Initiated by Internal Events The sequences generated by internal events and the availability of containment systems were identified using the NRC's plant-specific standardized plant analysis risk (SPAR) models, I lx 101 per reactor-year for sequences involving bypass of the containment pressure boundary or a perceived possibility of a large-early release.

2 For historical reasons, offsite equipment failures that result in failure of connections to the station's electric power grid are considered an 'internal event.'

5

ED IS/'AL R mim/t 12/17/2009 1:11:00 PM licensee PRAs, and other risk information s rces (see Fi're 3). The core-damage frequencies calculated from the current SPAR models

similar to th calculated in utility PRAs. The following process was used to determine the scenarios for further analyses:

1. Candidate accident sequences were identified in analyses using plant-specific, SPAR models (Version 3.31).

a. Initial Screening- Screened out initiating events with low CDFs (<107 ) and sequences with a CDF <10-8. This step eliminated 4% of the overall CDF.

b. Sequence Evaluation- Identified and evaluated the dominant cutsets for the remaining sequences. Determined system and equipment availabilities and accident sequence timing.

c. Sequence Grouping- Sequences determined to have similar equipment availabilities (i.e., details of individual component or support system failures might differ, but the functional capability of key systems was similar) and result in a similar time for the onset of core damage were aggregated into a single

'sequence group.'

2. Containment systems availabilities for each sequence were assessed using system dependency tables which delineate the support systems required for performance of the target front-line systems and from a review of existing SPAR model system fault trees.

3. Core-damage sequences from the licensee PRA model were reviewed and compared with the scenarios determined by using the SPAR models. Differences were resolved during meetings with licensee staff.

4. The screening criteria (CDF < 10.6 for most scenarios, and < 10-7 for containment bypass sequences) were applied to eliminate sequences from further analyses. J ;;. o This process provides the basic characteristics of each scenario. However, it is necessary to have more detailed information about scenario than is contained in a PRA model. To capture the additional sequence details, further analysis of system descriptions and a review of the norimal and emergency operating procedures (EOPs) were conducted.

The initial pass through this process identified only one sequence at Peach Bottom that survived the frequency threshold criteria. The sequence is initiated by the failure of vital AC Bus El 2, which disables several (but not all) trains of safety equipment. The estimated frequency of this sequence was initially found be above the l x, 0-6/reactor-year threshold. As a result, the sequence was forwarded for an assessment of mitigative measures (see Section 2.2.1) and detailed analysis of accident progression and radiological release. However, later in time, the SPAR model was found to incorrectly represent certain features of this sequence and its frequency was reduced below the screening criterion. Further, the MELCOR analysis performed for this sequence determined that it would not, in fact, result in core damage. In spite of both of these late conclusions on the characteristics of this sequence, the analysis results provided unique insights into the effectiveness of small-capacity, non-safety related equipment in the plant to mitigate certain accident sequences, and it was retained in this report.

6

DE/ )I L Revision I 12/17/2009 1:11:00PM iVLrsion,3.31 icensee lPEEEs EI Level 1 Models PrvosRs Identify I Group Screen on I7 7*Assess Analysis of Core-Dr.aageg Core-DamaDge C amgeoe-ni --- Containment Miv ISequeequences Frequency*7 I*Systems Status Measures

~ Quality Assurance and Technical Review Figure 3 SOARCA Accident Scenario Selection Process.

2.1.2 Sequences Initiated by External Events Detailed characteristics of the particular failures resulting from external events, such as fire, flooding or major seismic activity) are more difficult to systematically evaluate due to the lack of external event PRA models industry-wide. The external event sequences selected for analysis in the SOARCA project are representative of those that might have been observed to contribute to the core damage frequency in industry assessments of a wide spectrum of seismic, fire and internal flooding initiating events. Although these sequences were derived from a review of past studies such as NUREG- 1150, individual plant examination for external event (IPEEE) submittals, and other relevant generic information, they do not represent particular accident sequences derived from any specific study.3 Various data sources and assessments were examined to identify the dominant contributors to core damage due to sequences initiated by external events. The dominant sequences were then reviewed to select a set of representative external event sequences that were deemed to be applicable to the Peach Bottom. The information from other studies was used to supplement the external event sequence descriptions with information about containment safeguards status and to estimate the sequence frequency.

No attempt was made to match the selected representative dominant external event sequences to actual sequence frequencies from one source; nor was any criterion used to capture a certain percentage of total external events CDF. Rather, the insights from other studies were used to select representative sequences. Special care was taken to preserve the (perceived) relative importance of external events CDF versus internal events CDF. In addition, dated or superseded 3 "External events" in this document refer to all other events at-power than those modeled routinely as internal events in a SPAR model. External events include internal flooding and fire, seismic events, extreme wind, tornado and hurricane related events, and other events that may be applicable to a specific site. The assessment is based on readily available information to NRC/RES analysts at the time of preparation of this report (such as NUREGs, SPAR-EE models, IPE and IPEEE submittals). The nature, vintage, and variety of the information may require a quantitative evaluation, supplemented with a suggested CDF for a representative dominant sequence. 4, .

7

P ( E ItRevision 1 4'ft- 12/17/2009 1:11:00 PM information available (e.g., seismic hazard curves, internal fire frequencies and methodology, the internal flooding analyses) was updated to avoid undue conservatisms.

Seismic-initiated sequences were found to be the most restrictive in terms of the ability to successfully implement onsite mitigative measures and offsite protective actions. In addition, the seismic-initiated sequences were found to be dominant contributors to the external event core damage and release frequencies. As a result, representative external event sequences were assumed to be initiated by a moderate to large seismic event which leads to wide-spread damage to important plant support systems (primarily electric power sources).

This process identified two sequences groups which met the screening criteria of 1x10-6 per reactor-year for containment failure events and 1x 10- /reactor-year for events that have the potential to result in significant early releases to the environment:

" long-term station blackout - lx10-6 to 5x10 6/reactor-year

short-term station blackout - lx10- 7 to 5x10-7 /reactor-year 4 2.2 Mitigative Measures The site-specific mitigation measures assessments were performed during visits to the Peach Bottom site in May 2007 and were supplemented by follow-up telephone conferences and emails with the licensee later in 2007. The licensee senior reactor operators, PRA analysts, and other licensee staff were provided the initial conditions and subsequence failures for each of the sequence groups being analyzed. The operator and plant response was subsequently evaluated to develop timelines for operator actions and equipment lineup or setup times for the implementation of the available mitigation measures. The resulting boundary conditions were used to develop the MELCOR boundary conditions that included operator actions and applicable mitigation measures.

Mitigation measures considered in the SOARCA analyses include the licensee's emergency operating procedures (EOPs), severe accident management guidelines (SAMGs), and mitigation measures and strategies incorporated into plant capabilities in response to the terrorist events of September 11, 2001.

2.2.1 Mitigation of Sequences Initiated by Internal Events . _,

As mentioned earlier, the M COR analysis described in Section 5.5 demonstrated that ttbi' sequence group did not resuttin core damage, even without crediting mitigation measures codified in 10CFR50.54(h . The analysis included application of the standard plant procedures, including the operation of RCIC and the low-flow control rod drive hydraulic system (CRDHS) as aW injection source.%he SPAR model conservatively identified this sequence as having the potential for core damage. The MELCOR analysis in Section 5.5 provided a detailed evaluation of the effectiveness of the available plant systems and operating procedures without crediting additional mitigation capabilities.

This 7 g scenario does not meet the SOARCA screening criterion of I x 10.6 per reactor-year; however, it was analyzed in order to assess the risk importance of a lower frequency, higher consequence scenario.

8

P/ D/lE/ LRevision I ?/ft 12/17/2009 1:11:00 PM 2.2.2 Sequence Groups Initiated by External Events It was noted earlier that the initiating event for external event sequences was assumed to be a seismic event, because it was judged to be limiting in terms of how much equipment would be available to mitigate as well as constrain offsite response. Fewer mitigation measures are expected to be available for a seismic event than for an internal fire or flooding event. For these sequence groups, the seismic PRAs provided information on the initial availability of installed systems. Next, judgments were made concerning the general state of the plant to judge the availability of mitigation measures codified in 10CFR50.54(hh)and the additional time to implement mitigation measures and activate emergency response centers (e.g., Technical Support Center and Emergency Operations Facility).

Seismic events considered in SOARCA result in loss of offsite and onsite AC power, and, for the more severe seismic events, loss of DC power. Under these conditions, the turbine-driven RCIC system is an important mitigation measure. BWR severe accident mitigation guidelines (SAMGs) include starting of the RCIC without electricity to cope with station blackout conditions. This is known as RCIC 'black-start.' IOCFR50.54(hh) mitigation measures have taken this a step further and also include long-term operation of RCIC without electricity (RCIC black run), using a portable generator to supply indications such as reactor pressure vessel level indication to allow the operator to manually adjust RCIC flow to prevent RPV overfill and flooding of the RCIC turbine. For the long-term station blackout sequence, RCIC can be used to cool the core until battery exhaustion. After battery exhaustion, black run of RCIC can be used to continue to cool the core. MELCOR calculations are used to demonstrate core cooling under these conditions.

The external events PRA does not describe general plant damage and accessibility following a seismic event. The damage was assumed to be widespread and accessibility to be difficult, consistent with the unavailability of many plant systems. For the long-term station blackout, it was judged that the seismic event would fail the Condensate Storage Tank, which is the primary water reservoir for RCIC, and that RCIC would initially be fed from the torus. MELCOR calculations showed that several hours would be available before torus temperature and pressure conditions precluded this. It was judged that this would be sufficient time to identify or arrange for another water reservoir for RCIC, such as the cooling tower basin (a large low lying reinforced concrete structure). At the time of the Peach Bottom site visit, the licensee had not procured the required portable equipment. Furthermore, the associated mitigative procedures were still being developed.

Mitigation measures codified in IOCFR50.54(hh) include portable equipment such as portable power supplies to supply indication, portable diesel-driven pumps, and portable air bottles to open air-operated valves, together with procedures to implement these measures under severe accident conditions. At the time of the Peach Bottom site visit, the licensee had not purchased any portable injection equipment However, their plans to address the IOCFR50.54(hh) mitigation measure iscussed nd the functional requirements of the equipmen .

The mitigation measures inclueT ie possibility of bringing in equipment from offsite (e.g., fire trucks, pumps and power supplies from sister plants or from contractors, external spray systems),

but it did not quantify the types, amounts, and timing of this equipment arriving and being implemented.

9

Revision I #1ft" 12/17/2009 1:11:00 PM Fsnally,itn n m tve measu~erxe~sp~onse. First: using extmp ater spry w*;ith ccn;'entinal firefighting equipmert to scnub--an-Qng" " a.a,-oteaedn *..

beWjiiuformd-asarat-sdy t purehased-equipment for spray-n tfi'S* , no multi-unit accident sequences were selected for the SOARCA project. This was beyond the scope of the project and u, beyond the screen criterialfor internal event sequences. Therefore, the mitigation measures ssessment for al events was performed assuming that the operators only had to miti ate an accident at one reactor, even though Peach Bottom isaa -

two-unit site.

I~§vo K<I'J 10

I 1 Revision I Artitt - 12/17/2UU9 1:11 :UU P Mc 3.0 A, [0 DEFINITIONS Only one scenario met the screening critrj,,a.yfowever, for reasons described in Section 2.0, three were examined with deterministic c calculations. These scenarios are listed in Table 1. It was noted in Section 2.1.1 that one o& T-se scenarios, internal event: loss of a vital AC bus E- 12, was determined to have a frequency below the screening criterion following a careful review of and update to the SPAR model for Peach Bottom. Further, preliminary MELCOR calculations for this scenario clearly demonstrated the sequence can be mitigated without crediting mitigative actions using equipment and procedures called for in 10CFR50.54(hh). Although this particular sequence does not result in offsite radiological consequences, results of the MELCOR calculations of accident progression offer useful information on the importance of small-capacity, non-safety related equipment in mitigating certain accident sequences. Therefore, the results of these calculations are retained and presented in this report although the scenario would not result in damage to the reactor core.

The long- and short-term station blackout scenarios can both result in core damage and radionuclide release to the environment. A detailed description of these scenarios is, therefore, provided in Sections 3.1 and 3.2, respectively. Both sections include a discussion of available mitigation measures. A description of the loss of AC Bus E-12 scenario is given in Section 3.3.

Table 1 Accident scenarios and their frequencies Frequency Scenario Description (per Reactor Year)

Long-Term Station Blackout 1x 10-7 to 5x 10-o VShort-Tem Station Blackout lx10- to 5x10-7 i Loss of Vital AC Bus E-12 -5x10" 7 3.1 Long-Term Station Blackout The long-term station blackout is initiated by a moderately large earthquake (0.3-0.5 pga). It has an estimated frequency of 1x 10 6 to 5x10 6/reactor-year which meets the SOARCA screening criterion of 1x 10-6/reactor-year.

Section 3.1.1 describes the initial status of the plant following the seismic event. The key system availabilities normally accessible during the course of the accident are summarized in Section 3.1.2. The pertinent mitigative measures available to address the accident progression are described in Section 3.1.3. Section 3.1.4 describes various scenarios based on the success of the mitigative actions. In particular, mitigated scenarios are defined where the mitigative actions are successful. Unmitigated scenarios are also defined where certain key mitigate measures are not successfully implemented.

3.1.1 Initiating Event The long term station blackout scenario is a composite of several similar sequences that differ only by their initiating event. The initiators can be a large seismic event or an internal fire or flood. The seismic event is the largest contributor to the composite frequency of this sequence, II

S/ AD/

AL Revision I "rt - 12/17/2009 1:11:00 PM and is used as the basis for defining consequential events and conditions at the plant. Damage caused by the earthquake is assumed to result in a total loss of offsite power. In addition, onsite AC power is unavailable, with all diesel generators failing to start or run as needed. The diesel generators have a shared configuration between the two units, which causes any power failure to affect both units. This analysis considers only the response of failures at one of the two units, however.

3.1.2 System Availabilities Immediately following the initiating event, specifically the loss of vital AC power, reactor scram and containment isolation would occur. The 'station blackout line' from the hydroelectric station downstream of the plant site is also assumed to fail due to structural damage to the dam and electric station components. The station batteries are available for four hours following loss of AC power, allowing components and systems powered by DC power to operate for this four hour period. This duration of DC power assumes operators successfully follow procedural actions to shed non-essential loads from the emergency DC bus. As a result, high-pressure coolant injection from reactor core isolation cooling (RCIC) and/or high pressure coolant injection (HPCI) would be available for the first four hours following the loss of AC power.

Additionally, manual control of the safety/relief valves (SRV) would be available. No other plant systems would function.

3.1.3 Mitigative Actions An unmitigated MELCOR calculation was performed for the long-term station blackout scenario assuming manual actions to mitigatethe loss of vital safety systems are limited to those currently implemented in emergency operating procedures. The effects of additional mitigative actions and equipment that are being installed at the plant were then examined in a separate "mitigated" calculation. Results of the unmitigated calculation are described in Section 5.1; results of the separatejmitigated accident scenario are described in Section 5.2.

Three operator actions were credited in the unmitigated long-term station blackout calculation.

First, operators are assumed to open one SRV to begin a controlled depressurization of the reactor vessel approximately one hour after the initiating event. This action is prescribed in station emergency procedures to prevent excessive cycles on the SRV. The target reactor vessel pressure is at, or above, 125 psi, which would permit continued operation of RCIC (or HPCI if necessary). Second, operators are assumed to take manual control of RCIC approximately two hours after the initiating event. This involves local manipulation of the position of the (steam) throttle valve at the inlet to the RCIC turbine to reduce and control turbine speed. This action flow reduces and stabilizes coolant flow from the RCIC pump to maintain reactor vessel level at within a prescribed range. The third action is manual opening of a containment vent path, when containment pressure reaches unacceptably high levels. In the current analysis, a 16-in (hard-pipe) vent path is assumed to be opened when containment pressure exceeds 24 psig.

This value was selected based on the decision logic shown in plant emergency procedures. Local control of the vent line isolation valves would be accomplished by assembling necessary, portable air and electric power supplies.

12

P/D E/(IAL/ Revision I Vra/t- 12/17/2009 1:1 1:00 PM The mitigated long-term station blackout calculation credits one additional manual action. First, a portable AC power supply is assumed to be connected (through an inverter) to the DC bus delivering power to at least one SRV and to essential control room instrumentation (primarily reactor vessel pressure and level indication.) The precise time this action is completed is not important, provided it occurs before power from station batteries is exhausted four hours after the initiating event. If, for some reason, this action is not successful, and the RCIC pump were to trip (off), coolant makeup could be provided through low-pressure injection lines by means of a portable diesel-drive pump.

3.1.4 Scenario Boundary Conditions Section 3.1.4.1 lists the sequence of events to be prescribed in the unmitigated long-term station blackout calculation. Section 3.1.4.2 summarizes the sequence of events in the mitigated long-term station blackout calculation which credits one additional manual action.

3.1.4.1 Unmitigated Cases One unmitigated case was considered. The first case did not credit the mitigation measures of a portable pump called for under IOCFR50.54(hh). However, the RCIC black run together with use of the portable power supply to provide level indication and SRV control were included.

The second case was analyzed without the RCIC black run and the portable power supply to quantify the benefit of these 10CFR50.54(hh) mitigation measures. The times shown below are how long after the initiating event, which is a seismic event.

Unmitigated Case Event Initiation and Initial Plant Response

AC power fails (loss of offsite power, coupled with failure of all diesel generators)

Reactor trips

Reactor and containment isolate

DC power (station batteries) functional

RCIC auto-initiates when level drops to low-level setpoint (time to be predicted by MELCOR) (Water source: Torus)

" Operator takes manual control of RCIC at the end of its first cycle (which is after about an hour) 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

Initiate RPV depressurization by opening 1 SRV (target RCS pressure is 125 psi) 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months

" Battery power exhausted

" SRV re-closes

" RCIC continues to operate at a fixed (constant) flow rate until RCIC steam line floods 13

VA0D/iAL Revision I (14ft - 12/17/2009 1:11:00 PM 3.1.4.2 Mitigated Case The following is the time-line for this sequence group. The mitigated case credits all the mitigation measures codified in IOCFR50.54(hh), including the portable pump. The times shown below are how long after the initiating event, which is a seismic event.

lar I Event Initiation and Initial Plani Response At vOr fe e ""'3

" LOOP and SBO occurs due to a seismic event, recovery of offsite power is not expected during the mission time

Reactor shuts down. RCS and containment are isolated.

CRD, ECCS, SLC, Condensate, Containment Cooling and Containment Spray Systems L-0d P are not available.

Loss of all AC power due to seismic event, DC power available without chargers, EDGs do not automatically start. C .

HPCI and RCIC are both ia-itle initially. HPCI is secured early in the event, and RCIC is used to maintajn RCS llel and can be black started to provide continued use until steam supply is los psi of main steam pressure)

Control Room receives indication that plants-i -a.SBO condition requiring operator to enter SE-11, Station Blackout Procedure

Without any operator action, HPCI and RCIC auto start and operate to maint in RPV lev el. " p ' ,

Cooling tower basin is assumed to be undamaged, contains -3 billionýW gallons o water 15 minutes

Initial Operations assessment of plant status complete

HPCI might auto-start in response to initial transient, will be secured

RCIC will be operatteT'lakeup for boil-off and to maintain RPV level

In accordance wit SE-11 perations initiates the following mitigation measures:

- Attempt to lineup the Conowingo hydroelectric dam (SBO Line) as an alternative offsite power source

- Attempt manual start o0 EDGs§)

- DC load shedding initia do

- Operation of SRVs using station battery for RCS pressure control (RCIC steam line drains can be used as an alternative) 50 minutes J

Emergency Operations Facility manned (Th EOF ilocated in the Philadelphia area, far away from the plant. Therefore, the timing shojuld4iot be affected by the seismic event.)

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

Hydroelectric dam power supply (SBO Line) assumed to be unavailable due to initiating event

" Manual start of EDGs assumed to fail due to initiating event 14

Revision I - 12/17/2009 1:11:00 PM

DC Load shedding completed, battery life extended to an estimated 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (Bateries typically last for approximate 2 to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months under normal loading conditions\cj.jIending on life cycle of battery. At the beginning of its life, the battery duration is 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . At the end of its life, the battery duration is 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The licensee suggested that battery duration of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months would be reasonable due to the minimal expected loading.

RPV depressurization is initiated using 1 SRV. The target RCS pressure is 125 psi.

1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months The Emergency Operations Facility (EOF) is operational. The EO reviews actions taken by Operations and determines the availability of the remote y ocated pump and station pumper truck stored outside o1the Protected Area. Actions recommended by the EOF include the following:

- Use portable power supply for operating SRVs and for RPV level indication.

- Perform RCIC black-start. i,.I

- Use port sel driven pump (250 psi, 500 gpm) to provide makeup to RCS, -. V' 9 ,-,Hotwe T, d other locations. However, no water source and no hotwell for CS t connect to RCS and containment. \' j --------

- SGTS

",k air supply to manually operate containment vent valves (vent into

- sortable pump available to provide spray to primary or secondary containment leakage pathway.

- Use pumper truck in place of portable diesel driven pump.

1.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months ... " , "k*

17 Operators assesad concur with EOF recommendations. Operators prioritize recommendations asedon plant conditions and begin implementation. r 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months k k0,6" -14..+ ,

Technical Support Center manned (Because of the magnitude of the event, loss of v'&.

causeway and other potential infrastructure failures, and multiple emergency responders located on both sides of the river, a 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months delay in minimum manning of TSC was assumed.)

2.25 hours2.893519e-4 days 0.00694 hours 4.133598e-5 weeks 9.5125e-6 months 0 Technical Support Center operational 3.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months

" Portable DC power supply connected to continue operating SRV to depressurize RPV

" Portable air supply to manually operate containment vent valves (vent into SGTS) in place and ready for operation. Rupture disc on vent line set at - 30 psi.

" RCIC black-started to limit use of site batteries and to continue providing makeup to RCS before 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months

Portable diesel-driven pump available.

15

VU I LRevision I rd - 12/17/2009 1:11:00 PM 3.2 Short-term Station Blackout The short-term station blackout is initiated by a large seismic event (0.5 - 1.0 pga). It is more severe than the long-term station blackout and has an estimated frequency of 1x10-7 to 5x107/reactor year. Although the scenario does not meet the SOARCA screening criterion of 1x 10-6 per reactor-year, it was retained in order to assess the risk importance of a lower frequency, higher consequence scenario.

Section 3.2.1 describes the initial status of the plant following the seismic event. The key system availabilities normally accessible during the course of the accident are summarized in Section 3.2.2. The pertinent mitigative measures available to address the accident progression are described in Section 3.2.3. Section 3.2.4 describes various scenarios based on the success of the mitigative actions. In particular, mitigated scenarios are defined where the mitigative actions are successful. Unmitigated scenarios are also defined where certain key mitigat$ measures are not successfully implemented. If I V.-

3.2.1 Initiating Event The short-term station blackout is initiated by the same spectrum of events that lead to the long-term station blackout. The most frequent initiators are large seismic event or an internal fire or flood. The seismic event is the largest single contributor to the composite frequency of this sequence, and is used as the basis for defining consequential events and conditions at the plant. Damage caused by the earthquake is assumed to result in a total loss of offsite power. In addition, all diesel generators failing to start or run as needed, rendering all onsite AC power unavailable. Again, the diesel generators have a shared configuration between the two units, which causes any power failure to affect both units. This analysis considers only the response of failures at one of the two units, however. Additionally, the earthquake results in failure of DC power.

3.2.2 System Availabilities Immediately following the initiating event, specifically the loss of vital AC power, reactor ram and containment isolation would occur. The 'station blackout line' from the hydroelect c station downstream of the site is also assumed to fail due to structural damage to the dam an electric station components (Ig is well beyond the design basis earthquake for the hydro-stat.) The major difference between this scenario and the long-term station blackout (Section 3 is that vital DC power from station batteries is also not available. Thus a total loss of all onsite and offsite electrical power occurs immediately following the initiating event, rather than several hours later, thereby disabling all plant equipment that depends on control or motive power from normal or emergency electrical sources for start-up and operation. This includes steam-driven emergency coolant makeup systems (RCIC and HPCI) and manual control of reactor pressure relief valves, which were available for a few hours in the long-term station blackout.

An unmitigated MELCOR calculation was performed for the short-term station blackout scenario assuming actions to mitigate the event are not feasible. Results of this calculation are described in Section 5.3.

16

OL EtLf14f Revision lIA - 12/17/2009 1:11:00 PM 3.2.3 Mitigative Actions A separate calculation was performed for a permutation of the short-term station blackout scenario in which operators are assumed to manually actuate ("black start") the steam-driven RCIC system. This action involves local, manual opening of normally-closed valves to admit steam from the main steam lines into the RCIC turbine and pump discharge valves to direct water into the reactor vessel. These actions are assumed to occur very soon after the initiating event (in 10 minutes), thereby preventing the reactor water level from decreasing below the top of active fuel. However, manual actions necessary to regulate steam flow into the RCIC turbine are not credited in this scenario. As a result, the system effectively operates at a constant flow rate equivalent to the rated capacity of the system. This flow rate is greater than the rate required to makeup for evaporative losses and, after an initial decrease, reactor water level gradually rises above nominal and eventually over-fills the reactor vessel 5. In this context, 'over-fill' means the reactor water level rises to the elevation of the main steam line nozzles, allowing water to spill into the steam lines, causing them to flood with water. The steam extraction line for the RCIC turbine connects to the main steam line at a low elevation [adjacent to the inboard main steam isolation valves (MSIVs).] Therefore, water spilling over into the main steam lines blocks or flows toward the RCIC turbine, causing the system to cease functioning. Results of the short-term scenario with RCIC black start are described in Section 5.4.

3.2.4 Scenario Boundary Conditions Section 3.2.4.1 lists the sequence of events to be prescribed for two the unmitigated short-term station blackout calculations. No mitigated cases were performed.

3.2.4.1 Unmitigated Cases Two unmitigated cases were considered. The unmitigated cases case did not credit the mitigation measures of a portable pump called for under IOCFR50.54(hh). However, the RCIC black start was considered in case one and case two did not credit any injection.

Unmitigated case one (RCIC black start)

Event Initiation and Initial Plant Response

AC power fails (loss of offsite power, coupled with failure of all diesel generators)

Reactor trips

Reactor and containment isolate

DC power (station batteries) fails

" Operator black starts RCIC

RCIC continues to operate at a fixed (constant) flow rate until RCIC steam line floods If electric (control) power was available, the RCIC system would cycle on/off to maintain reactor level between a minimum and maximum setpoint. Without these control signals, or an independent means of monitoring reactor water level and manually controlling coolant flow rate (i.e., turbine speed), the system is assumed to run at full capacity after it is started.

17

DfS I LRevision 1 12/17/2009 1:11:00 PM Unmitigated case two (no injection)

Event Initiation and Initial Plant Response

" AC power fails (loss of offsite power, coupled with failure of all diesel generators)

" Reactor trips

Reactor and containment isolate

DC power (station batteries) fails 3.3 Loss of Vital AC Bus E-12 The scenario is initiated by the loss of vital AC Bus E- 12. It was initially estimated to have a frequency above the SOARCA screening criterion of 1x10-6/reactor-year. However, after further review of the SPAR model and comparison with the licensee's PRA, the scenario was determined to have a CDF below the screening criteria. Since the MELCOR analysis provided unique insights into the response of the plant to an internal event sequence, the MELCOR analysis was retained.

Section 3.3.1 describes the initial status of the plant following the initiating event. The key system availabilities normally accessible during the course of the accident are summarized in Section 3.3.2. The pertinent mitigative measures available to address the accident progression are described in Section 3.3.3. Section 3.3.4 describes various scenarios based on the success of the mitigative actions. In particular, mitigated scenarios are defined where the mitigative actions are successful. Unmitigated scenarios are also defined where certain key mitigate measures are not successfully implemented.

3.3.1 Initiating Event The initiating event for this scenario is failure of vital AC bus E-12 to provide power to associated plant equipment.

3.3.2 System Availabilities Loss of one vital AC bus disables some plant equipment, but not all. For example, power to the instrument and control air system would be lost, and the inverters that charge the station batteries would not function. However, other AC buses would direct motive power to the residual heat removal (RHR) and core spray pumps, permitting use of low-pressure coolant injection. One of the two control rod drive hydraulic pumps would also remain available.

Steam-driven injection systems (high pressure coolant injection and reactor core isolation cooling) 6 operate as long as station batteries deliver DC power to control system components.

Station batteries also facilitate manual control of SRVs. When battery power is depleted, high 6 Although RCIC is available in all the standard plant analysis risk cut sets for this sequence, high pressure coolant injection (HPCI) is disabled due to independent failures in some of them. Availability of HPCI is not important in this sequence and is neglected.

18

Q~D /I (

Revision I /f - 12/17/2009 1:11:00 PM pressure coolant injection, RCIC, and SRV controls are assumed to be lost. Injection flow from these sources terminates coincident with the loss of DC power, and any open SRV re-closes.

The shutdown cooling mode of residual heat removal would not be available due to loss of power to certain valves needed to align the system for that configuration. However, the system can be aligned to operate suppression pool cooling and/or drywell sprays.

Duration of DC power is treated as an uncertain parameter in this scenario. The licensee probabilistic risk assessment (PRA) uses a value of two hours, which is the minimum (tech spec) value and represents the worst possible condition: i.e., 'old' batteries (maximum tolerable voltage degradation) and no load shedding. New batteries (maximum voltage) are expected to have an eight hour lifetime without loading shedding. A reasonable estimate for the 'average' value of battery duration (taking into account battery age and the effectiveness of actions to shed non-essential DC loads) is four hours. As described in Section 5.5.3, a precise value is not particularly important, provided battery duration is greater than three hours.

3.3.3 Mitigative Actions This event was shown tole satisfactorily mitigated without crediting any of the security-related-mitigative actions mentioneiin- Section 3.1.3. As such, no additional mitigative analysis Ford-3.3.4 Scenario Boundary Conditions Section 3.3.4.1 lists the sequence of events to be prescribed in the unmitigated loss-of-vital AC Bus E-12 accident scenario. Section 3.3.4.2 summarizes the sequence of events in the mitigated case.

3.3.4.1 Unmitigated Cases A set of parametric unmitigated cases was considered. The unmitigated cases did not credit the mitigation measures of a portable pump called for under I OCFR50.54(hh). However, controlled RCIC operation until the station battery exhaustion and 1-pump of CRDHS injection were credited. The parametric cases varied the station battery life and other critical cooling functions.

Unmitigated Cases Event Initiation and Initial Plant Response

Loss of all AC-powered injection except 1 CRDHS pump

Reactor trips

Reactor and containment isolate

DC power (station batteries) functional

RCIC auto-initiates when level drops to low-level setpoint (Water source: CST)

When level rises to operating range, operator takes manual control of RCIC to maintain RPV level 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

Initiate RPV depressurization by opening 1 SRV (target RCS pressure is 125 psi) 19

PDJ IAL Revision I /a'ft - 12/17/2009 1:11:00 PM 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months

" Battery power exhausted

SRV re-closes

" RCIC continues to operate at a fixed (constant) flow rate until RCIC steam line floods Parameters Varied in Sensitivity Calculations

" Not opening SRV

Not taking manual control of CRDHS

" Maximize CRDHS flow by opening valve

Include SLC injection flow

Battery life of 2, 3, 4, and 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 7'2;,

3.3.4.2 Mitigated Case The following is the time-line for this sequence group. T mitigated case credits all the 10CFR50.54(hhb) itigation measures including the portable pump. The times shown below are how long after the il~tge wic .

Event Initiation -

Division IV DC power lost

Nitrogen supply to Containment Isolation lost CA/-

MSIVs close on loss of Instrument Air

RCIC starts on low level and operates for period of time batteries are available

1 CRD pump operating at 110 gpm

Control Room receives alarm that DC chargers are not available requiring operator to -

enter SE-13, Loss of DC power

Without any operator action, CRD and RCIC are operating maintaining the core covered

Drywell spray is available, but neglected because it is not necessary

Shutdown cooling mode of RHR is not available because the needed valve alignment could not be done due to the power failure

SLC is available, but neglected because its cooling injection flow of 50 gpm is not necessary 15 minutes

Initial Operati = ssessment of plant status complete

RCIC operating,naintaining RCS level

In accordance with SE-13, DC load shed initiated 50 minutes

Technical Support Center manned (Primary function would be to review initiating event, plant status, and operator action to provide guidance on alternative mitigative measures.)

EOF manned (Primary function would be to review initiating event, plant status, and operator action to provide guidance on alternative mitigative measures. The primary 20

I*,1oi 12/17/2009 1:11:00 PM users of SAMGs a EDMGs re the TSC s/upervisors who are trained on SAMGs and EDMGs.)

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

DC load shedding complete extending battery life to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . (Baft s typically last for j '

approximate 2 to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months under normal loading c ns de ýg or in 'cycJ-of-battery. At e Be n s uration is ours. At the end of its life, the batte ion is hours.)

Also available, opening CRD throttle valve to increase flow from 110 gpm to -140 gpm without depressurization. (The increased flow rate of 140 gpm is an estimate provided by -

the licensee.) 44, ,

1.25 hours2.893519e-4 days 0.00694 hours 4.133598e-5 weeks 9.5125e-6 months 1 "

Technical Support Center operational 1.5 houIrs Manual controlled depressurization using 1 SRV TSC and/or EOF reviews actions taken by operations and determined the availability of the remotely located equipment. Recommend the following actions:

- portable power supply to ensure long-term DC to hold SRV open and provide level indication (allows management of RCIC)

- RCIC blackstart

- portable diesel driven pump (250 psi, 500 gpm) to makeup to RCS, Hotwell, CST, etc

- portable air supply to manually operate containment vent valves (vent into SGTS)

- portable diesel driven pump to inject into drywell via RHR and RCS "

- portable ump to provide spray to primary or secondary containment leakage )\,)

patwh.yOa ," ,_

- pumper truck can be used in place of portable diesel driven pump 1.75 ho urs 0 Operations staff assesses and concurs with TSC and/or EOF's recommendations.

n fr ý ý'A 1 A A' ý A,,

ptl)Iat 1u13 Ktat p11i01 L1L I%,

RX0IIIII1CAIaL 011 uauv ullL 01 C0nt11U1L %113 all%":u 1 implementation.

2.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months Manual operation of RCIC to sustain RCS level after battery depletion

Use of a portable DC power supply to operate SRV to depressurize RPV and to allow makeup with the portable pump @ - 500 gpm.

dý 21

P LAE Revision I Vq- 12/17/2009 1:11:00 PM This Page Intentionally Left Blank 22

PfE 40WL Revision I - 12/17/2009 1:11:00 PM 4.0 MELCOR MODEL OF THE PEACH BOTTOM PLANT This section provides a summary of the MELCOR model of the Peach Bottom Atomic Power Station. A comprehensive description of the model is available in separate documentation [3].

The i/LCOR Peach Bottom model was originally generated for code assessment applications wit code version 1.8.0 at Brookhaven National Laboratories. The model was subsequently ad pted by J. Carbajo at Oak Ridge National Laboratories to study differences in fission product source terms predicted by MELCOR 1.8.1 and those generated for use in NUREG- 1150 using the Source Term Code Package (STCP) [4]. In 2001, considerable refinements to the BWR/4 core nodalization were made by Sandia National Laboratories to support the developmental assessment and release of MELCOR 1.8.5. These refinements concentrated on the spatial nodalization of the reactor core (both in terms of fuel/structural material and hydrodynamic volumes) used to calculate in-vessel melt progression.

These developments culminated in the re-assessment of radiological source terms for high burnup core designs and a comparison of their release characteristics to the regulatory prescription outlined in NUREG-1465 [5]. These calculations addressed a wide spectrum of postulated accident sequences, which required new models to represent diverse plant design features, such as:

" modifications of modeling features needed to achieve steady-state reactor conditions (recirculation loops, jet pumps, steam separators, steam dryers, feedwater flow, CRDHS, main steam lines, turbine/hotwell, core power profile),

" new models and control logic to represent coolant injection systems (RCIC, HPCI, RI-IR LPCS) and supporting water resources (e.g., CST with switchover), and

" new models to simulate reactor vessel pressure management (safety relief valves, safety valves, ADS, and logic for manual actions to affect a controlled depressurization if torus water temperatures exceed the heat capacity temperature limit).

Subsequent work in support of other U.S. NRC research programs motivated further refinement and expansion of the model in two broad areas. The first area focused on the spatial representation of primary and secondary containment. The drywell portion of primary containment has been sub-divided to distinguish thermodynamic conditions internal to the pedestal from those within the drywell itself. More importantly, considerable refinements have been added to the spatial representation and flow paths within the reactor building (i.e.,

secondary containment). The second area has focused on bringing the model up to current "best practice" standards for MELCOR 1.8.6.

4.1 Reactor Vessel and Coolant System

-'7 Excluding the core region, the reactor pressure vessel is represented by sc~uen control volumes,

.e flow paths and 24 heat structures. Nodalization for the core region between the core top guide and the bottom of active fuel are described in detail in Section 4.2. Figure 4 provides a 23

P//tL Revision I Yr(/* - 12/17/2009 1:11:00 PM reactor vessel nodalization detail comparing MELCOR modeling features to actual vessel design.

Control volumes are indicated by "CV" followed by the three-digit control volume number, and flow paths are indicated by "FL" followed by the three-digit flow path number.

745. in .FL3.6 "

-- 731, in Main Stro3 in Steam 658.5 i. { CV355

.............. 3 Main Stea in s-t635.

B., CV F370 F35 steam shroud: I . F35 FL355 245 in OD 675i

,o....211.....

FR dwatcr 498, 5 in - Feedwater CV1

FL376 CV3 0 RVwall 251 in diaeF35 i 'i i

-- 171 ,, in Suton,,olow -A F1.31C .............

i!*: 4

~l: Suction FL311 flow.

-

CV350S Top of Jet Die0w1 FL3 86 - --FL 3 87 Pu mps Recirculation Nozzles -- 211 -l6in Recirc-A Rcr-

.......... *FL382 FLi383 Outle inf Figure 4 Reactor Vessel Cross-Section Detail and MELCOR Hydrodynamic Nodalization 24

f DE/SIUAL Revision I idta. 12/17/2009 1:11:00 PM Figure 5 is a schematic representation of the MELCOR control volumes and flow paths for the reactor coolant system, including:

reactor recirculation piping,

main feedwater and steam lines, and

connections to emergency coolant injection and heat removal systems.

Collectively, these ancillary systems permit the model to properly calculate steady state, as well as a wide variety of transient conditions. To optimize numerical performance of this model, some consolidation of parallel lines or trains of certain systems has been made. For example, the four main steam lines have been represented by two parallel "lines," one of which represents the single steam line containing the lead (i.e., lowest set point) SRV, the second represents the composite geometry of the remaining three lines. Isolating the steam line with the lead SRV permits the proper geometry (internal volume, structural surface area, etc.) to be represented for fission product transport from the reactor to the suppression pool during accident sequences in which fuel damage begins while the reactor vessel is at high pressure and pressure relief is accomplished by SRV operation.

4.2 Reactor Core In MELCOR, the region tracked directly by the COR Package model includes a cylindrical space extending vertically downward along the inner surface of the core shroud, from the core top guide to the reactor vessel lower head. It also extends radially outward from the core shroud to the hemispherical lower head in the region of the lower plenum below the base of the downcomer, preserving the curvature of the lower head from this point back to the vessel centerline.

The core and lower plenum regions are divided into concentric radial rings and axial levels.

Each core cell may contain one or more core components, including fuel pellets, cladding, canister walls, supporting structures (such as the lower core plate and control rod guide tubes),

non-supporting structures (such as control blades, the upper tie plate and core top guide) and (once fuel damage begins) particulate and molten debris.

The spatial nodalization of the core is shown in Figure 6. The entire core and lower plenum regions are divided into six radial rings. As shown in Figure 7, rings one, two, three, four and five represent 112, 160, 200, 168 and 124 fuel assemblies, respectively. The radial distance between each of the five rings is not uniform. The radius of each ring was defined in a way that preserves the radial power distribution in the Unit 2 core, based on plant operating data from four recent and consecutive operating cycles. Radial ring 6 represents the region in the lower plenum outside of the core shroud and below the downcomer. Ring 6 exists only at the lowest axial

'levels' in the core model.

25

I AL Revision I - 12/17/2009 1:1 1:00PM

>21 u M4613 I o9-o

-- -------------

so SI z IF

. , .,

, . ....

Lil--

E I)

}~

III Figure 5 Spatial Nodalization of Reactor Pressure Vessel and Coolant System 26

PgID E( I /A L Revision I - 12/17/2009 1:11:00 PM I

9.630 .

9.304 m -

8.923 m 8.542 m -

8,161 M -

F~

IF2,7~J~13 F11 1:

f......

............... .........

7.780 . -

7,399.m - .....

.......................

7.018.m -

6.637 .

6.256 m 5.875 m 5.494 - =

5.267. -

3.088 mn 2.490. -

1.892.m -

1.295 O.Om -

CVH Nodalization accompanying BWR/4 Core Nodalization COR Nodalization Figure,6 Spatial Nodalization of the Core and Lower Plenum 27

P DA Revision I - 12/17/2009 1:11:00 PM radius > (nr) v 0

0.153 0.305 0.458 0.610 0.763 0.915 1.068 1,220 1.373 1.525 3-cycle average 1.678 RPF 1.830 1.223 1,983 1.313 2.135 1,275 2.288 0.746 RING 5 124 (m,) 0.295 764 Figure 7 Local Relative Power Fraction (RPF) and 5-Ring Radial Boundaries of Core The core and lower plenum are divided into 17 axially-stacked levels. The height of a given level varies, but generally corresponds to the vertical distance between major changes in flow area, structural material(s) or other physical features of core (and below core) structures. Axial levels I through 5 represent the open space and structures within the lower plenum. Initially, this region has no fuel and no internal heat source, but contains a considerable mass of steel associated with the control rod guide and in-core instrument tubes. During the core degradation process, the fuel, cladding and other core components displace the free volume within the lower plenum as they relocate downward in the form of particulate or molten debris.

Axial level 6 represents the steel associated with fuel assembly lower tie plates, fuel nose pieces, the lower core plate and its associated support structures. Particulate debris formed by destroyed fuel, canister and control blades above the lower core plate will be supported at this level until the lower core plate yields. Axial levels 7 through 16 represent the active fuel region. All fuel is initially in this region and generates the fission and decay power. Axial level 17 represents the non-fuel region above the core, including the top of the canisters, the upper tie plate and the core top guide.

4.3 Primary Containment and Reactor Building The primary containment of the BWR Mark I design consists of two separate regions: a

'drywell' and 'wetwell.' As shown in Figure 8, each region is explicitly represented in the 28

1/E0 4('/,

Revision I*A/t - 12/17/2009 1:11:00 PM MELCOR model with distinct hydrodynamic control volumes, flow paths and heat structures to preserve the geometric configuration and major functional features of the Mark I design; e.g.,

steam pressure suppression, fission product scrubbing and surface deposition. The drywell is further divided into four connected volumes to account for non-uniformities in the temperature and composition of the atmosphere during late phases of a severe accident.

CV202 FL903 .

1(DW head I flange failure) 0N N

C 11 hyd.

CRDchase pipe .- CV200 FL910 FL017 i CV205 (Wetwelt Hard-Pipe vent (DW nominal leakage) to atmosphere)

\ FLo14

,.Personnel FL0151/

CRD remova.*ý FL022 FL023 vacuum breaker (RB-VWV I (RB-'W vacuum breaker t ruscornerroom) CV220 CV220 to NE torus corner room)

FL904 FL021u (OW tiver <

melt-through)

Figure 8 Hydrodynamic Nodalization of the Primary Containment The internal volume, airflow flow pathways and structures of the reactor building are modeled in considerable detail as illustrated in Figure 9 and Figure 10. The reactor building fully encloses the primary containment, and participates in the release pathway of fission products to the environment released from the containment, by offering a large volume within which an airborne radionuclide concentration can be diluted by expansion into and mixing with the building atmosphere.

29

P/D E ##,L Revision I //- 12/17/2009 1:11:00 PM Figure 9 Hydrodynamic Nodalization of the Reactor Building (a) 30

P/D E$SIO/L Revision 19(/t- 12/17/2009 1:11:00 PM CV455 CV490 Figure 10 Hydrodynamic Nodalization of the .Reactor Building (b) 31

Revision 1 ft - 12/17/2009 1:11:00 PM The airborne concentration of fission product aerosols within the reactor building is attenuated by gravitational settling and other natural deposition mechanisms 7. The building is, therefore, occasionally referred to as a secondary containment, in spite of the fact that it has a negligible capacity for internal pressure.

4.4 Ex-vessel Drywell Floor Debris Behavior The drywell floor is sub-divided into three regions for the purposes of modeling molten-core/concrete interactions. The first region (which receives core debris exiting the reactor vessel) corresponds to the reactor pedestal floor and sump areas (CAV 0). Debris that accumulates in CAVO can flow out through an open doorway in the pedestal wall to a second region representing a 900 sector of the drywell floor (CAV 1). If debris accumulates in this region to a sufficient depth, it can spread further around the annular drywell floor into the third region (CAV2). This discrete representation of debris spreading is illustrated in Figure 11.

Two features of debris relocation within the three regions are modeled. The first represents bulk debris 'spill over' or movement from one region to another. A control system monitors the debris elevation and temperature within each region, both of which must satisfy user-defined threshold values for debris to move from one region to its neighbor. More specifically, when debris in a cavity is at or above the liquidus temperature of concrete, all material that exceeds a predefined elevation above the floor/debris surface in the adjoining cavity is relocated (6 inches for CAV 0 to CAV 1, and 4 inches for CAV 1 to CAV 2). When debris in a cavity is at or below the solidus temperature of concrete, no flow is permitted. Between these two debris temperatures, restricted debris flow is permitted by increasing the required elevation difference in debris between the two cavities (more debris 'head' required to flow).

The second control system manages debris spreading radius across the drywell floor within CAVI and 2. Debris entering CAV 1 and CAV 2 are not immediately permitted to cover the entire surface area of the cavity floor. The maximum allowable debris spreading radius is defined as a function of time. If the debris temperature is at or above the concrete liquidus temperature, then the maximum transit velocity of the debris front to the cavity wall is calculated (i.e., results in 10 minutes to tamsvrsp-CAV 1 and 30 minutes-totmnyrse CAV 2). When the debris temperature is at or below the cAncrete solidus, thedebfis front is assumed to be frozen and lateral movement is precluded (i.e.d ebris veloitys 0 m/s). A linear interpolation is performed to determine the debris fronttlocy~attemperatures between these two values.

7 The building is also equipped with a ventilation system with aerosol and charcoal filters, which would greatly aid in reducing an airborne radioactive release. However, these systems would not be available during the particular accident scenarios examined in this work, due to loss of electrical power or other equipment failures.

32

÷fD EIc/AL Revision I X/ft - 12/17/2009 1:11:00 PM 6.706 m FLOOR EQUIV PERIMETER CAM AREA RADIUS RATIO 0 29.92 3.086 0.95 "1 22.75 2.691 0.94 0.62 2 68.25 4.661 1.72 1.08 Figure 11 Drywell Floor Regions for Modeling Molten-Core/Concrete Interactions.

Full mixing of all debris into a single mixed layer is assumed in each of these debris regions.

The specific properties for concrete composition, ablation temperature, density, solidus temperature and liquidus temperature are specified. The concrete composition represented in the MELCOR model is listed in Table 2. The drywell floor concrete includes 13.5% rebar.

Other key user-defined concrete properties are selected to match defaults for limestone common sand concrete and include:

0 initial temperature of 300 K

liquidus temperature of 1670 K 3

S ablation temperature of 1500 K

density of 2340 kg/mi 0 solidus temperature of 1420 K

emissivity of 0.6 33

/ED/If/AL Revision I/Y- 12/17/2009 1:11:00 PM Table 2 Concrete Composition Species Mass Fraction A120 3 0.0091 FC20 3 0.0063 CaO 0.3383 MgO 0.0044 CO 2 0.2060 SiO 2 0.3645 H 2 Oevap 0.0449 H2Ochem 0.0265 4.5 Containment Failure Model Peach Bottom has a Mark I containment (Figure 8) that consists of a drywell and a toroidal-shaped wetwell, which is half-full of water (i.e., the pressure suppression pool.) The drywell has the shape of an inverted light bulb. The drywell head is removed during refueling operations to gain access to the reactor vessel. The drywell head flange is connected to the drywell shell with 68 bolts of 2 '/2" diameter (Figure 12). The flanged connection also has two

%/" wide and 1/2/" thick Ethylene Propylene Diene Methylene (EPDM) gaskets. The torque in the 2 '/2" diameter bolts range from 817 to 887 ft-lbs [18][19]. An average bolt toque of 850 ft-lbs was used in this study.

The 68 drywell head flange bolts (see Figure 12) are pre-tensioned during reassembly of the head. This pretension also compresses the EPDM gaskets located in the head flange. During an accident condition, the containment vessel may be pressurized internally. The internal pressure would counteract the pre-stress in the bolts. At a certain internal pressure, all the pre-stressing force from the bolts would be eliminated, and the EPDM gaskets would be decompressed.

Further increase in the internal pressure would result in leakage at the flanged connection.

The EPDM gasket manufacturers recommend a maximum squeeze (compression) of 30 percent for a static-seal joint. The gaskets recover about 15 percent of the total thickness after the compressive load is removed from the flange. However, the licensee engineers informed the SOARCA personnel that the gaskets for the reactor vessel head flange are squeezed to 50 percent to have a metal to metal contact to ensure no leakage at design pressure of 56 psi. In addition, the gaskets are exposed to constant temperature and radiation which contribute to early degradation. For this reason, the gaskets are replaced during each reassembly of the reactor vessel head. Based on this information and actual observations, the PBAPS licensee engineers recommended a gasket recovery of 0.03 inch.

34

P/D E/f JL Revision 1*4 - 12/17/2009 1:11:00 PM

-V-5~

I-0 I-.

51 Lb 5.

0 I- EPDM 51 51 5.

5.

51 8

-6DIA. U -

.2BOLTS Area = Ab Figure 12 Drywell Head Flange Connection Details.

Based on the gasket recovery of 0.03 inches, the actual gap was determined at various internal pressures as:

Elongation in the bolt = ALb = ALbI - 0.03 inch where: N -rco rý , Vx- cb,- -&

Lb = length between the bolt head and nut (Figure 12) = 37.56 inches ,',

2 stress area of the bolt [16] = 4.0 in Ab = Tensile 1rlb -vL (S-,

E=28.0x 106 psi ALbI = 0.0054 inch .)*C 0 Leakage areas for different internal pressures are shown in Figure 13. The reactor vessel head flange does not leak until the internal accident pressure is 0.660 MPa (i.e., P/PD = 1.25 or 81 psig). Thereafter there is a gradual increase in the leakage area.

At high temperatures (>755 K, or >900 0 F), upward and radial thermal growth of the drywell would lead to binding of small and large penetrations against the biological shield wall and failure. In addition, radial growth of the containment may also cause the seismic stabilizers to punch through the upper portion of the drywell at high temperatures [17]. This observation is consistent with the results of the previous studies which show that the drywell is likely to fail at 35

P/fDJSIfA L Revision I 1?*ft- 12/17/2009 1:11:00 PM the low pressure range of 0-65 psig [17]. Therefore, it can be concluded that the drywell is likely to fail under any appreciable pressure load at temperatures of 900°F or greater.

Finally, the containment can fail by drywell liner melt-through containment failure (see relevant discussions in Sections 4.4 and 4.7.2).

Peach Bottom Drywell Flange Leakage Area 1)*

.

PDasign = 0.529 MPa (77 psia) , /

0.09 1 T4JAý 0.08

...... .... .. ... ... ... .. i. ... ... .. . .. . . . . .. . . . .. . . . . . . .. .. . . . . . . . . . . . . . . . . . .. . . . .. .

0.07 4-E 0.06 ...... ..

E 0.05 0.04

. 0.03 I- - - - - --

L -- -- - -i -- - -

0.02

. . . . ..

. . .. ... . . . . . . . . . ..... . . . .... . . . .

0.01 rV 0.00 1.0 1.5 2.0 2.5 3.0 3.5 e-Pressure ratio (P/PDosign)

Figure 13 Drywell Flange Leakage Model versus Containment Pressure 4"".

4.6 Radionuclide Inventories and Decay Heat One important input to MELCOR is the initial "ir

- . 1>s in the fuel and their associated decay heat. The values are important to the timing of initial core damage and the location and concentration of the initial radioactive source. The radionuclides in a nuclear reactor come from three primary sources: (1) "fission products" are the result of fissions in either fissile or fissionable material in the reactor core; (2) actinides are the product of neutron capture in the initial heavy metal isotopes in the fuel; and (3) other radio-isotopes are formed from the radioactive decay of these fission products and actinides. Integrated computer models such as the TRITON sequence in SCALE exist to capture all of these inter-related physical processes, but they are intended primarily as reactor physics tools [15]. As such, their standard output does not provide the type of information needed for MELCOR [8]. It is important to note that changes to the TRITON sequence in SCALE were not needed for this analysis. The BLEND3 post-processing software extracts output from the TRITON sequence and combines it in a way aA-?0 _'ý which makes it useful for MELCOR [8].

A Global Nuclear Fuel (GNF) I Ox 10 (GE-14C) fuel assembly was used as a typical fuel element ) ý 4 for Peach Bottom analysis. Information regarding assembly dimensions, enrichments and ,

operating characteristics were obtained from the licensee (with permission from the fuel vendor)

"-'V-36

/P# 4 AL Revision 1 12/17/2009 1:11:00 PM and used for a realistic evaluation. Twenty-seven different TRITON runs were performed to model three different cycles of fuel at 9 specific power histories. The specific power histories ranged from 2 MW/MTU to 45 MW/MTU which bounded all expected BWR operational conditions. For times before the cycle of interest, an average specific power of 25.5 MW/MTU was used. For example, for the second cycle fuel, the fuel was burned for its first cycle using 25.5 MW/MTU, allowed to decay for an assumed 30 day refueling outage and then 9 different TRITON calculations were performed with specific powers ranging from 2 to 45 MW/MTU.

The BLEND3 code was applied to each of the 50 core nodes 8 in the MELCOR model using average specific powers derived from data for three consecutive operating cycles and appropriate nodal volume fractions. Once new libraries for each of the 50 nodes in the model were 6"e generated, the final step in the procedure was to deplete each node for 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . The decay heats, masses and specific activities as a function of time were processed and applied as input data to MELCOR to define decay heat and the radionuclide inventory.

4.7 Modeling Uncertainties The primary objective of the SOARCA project is to provide a best estimate prediction of the likely consequences of important severe accident events at reactor sites in the U.S. civilian nuclear power reactor fleet. To accomplish this objective, the SOARCA project utilizes integrated modeling of the accident progression and off-site consequences using both state-of-the-art computational analysis tools as well as best modeling practices drawn from the collective body of knowledge on severe accident behavior generated over the past 25 years of research.

The MELCOR 1.8.6 computer code [8] embodies much of this knowledge and was used for the accident and source term analysis. MELCOR includes capabilities to model the two-phase thermal-hydraulics, core degradation, fission product release, transport, and deposition, and the containment response. The SOARCA analyses include operator actions and equipment performance issues as prescribed by the sequence definition and mitigative actions. The MELCOR models are constructed using plant data and the operator actions were developed based on discussions with operators during site visits. The code models and user-specified modeling practices represent the current best practices.

Uncertainties remain in our understanding of the phenomena that govern severe cident progression and radionuclide transport. Consistent with the best-estimate appr ach in SOARCA, all phenomena were modeled using 'best estimate' characterization of uncert n phenomena and events. Important severe accident phenomena and the proposed approach to odeling them in the SOARCA calculations were presented to an external expert panel during apublic meeting sponsored by the NRC on August 21-22, 2006 in Albuquerque, New Mexico. A summary of this approach is described in Section 4.7.1. These phenomena are singled out because they are important contributors to calculated results and have uncertainty.

The two other topics, steam explosions and drywell liner melt-through on a 'wet' drywell floor have been previously included in lists of highly uncertain phenomena. Section 4.7.1 briefly 5 radial rings by 10 axial levels 37

PD 1AL Revision I X/t- 12/17/2009 1:11:00 PM describes them and offers a summary of the significant research that led the SOARCA program to neglect their inclusion.

Finally, a systematic evaluation of phenomenological uncertainties for a particular sequence is a separate task and not discussed in this report. The task will evaluate the importance and impact of alternative settings or approaches for key uncertainties.

4.7.1 Base Case Approach on Important Phenom 65-1 A ' onducte mStianit Alb acter New M e

-on August 21-22, 200 [1-0 . Thireview focused primarily on best modeling practices for the application of the severe nuclear reactor accident analysis code MELCOR for realistic evaluation -

of accident progression -source termind cffc .zegue.*r-e. The scope of the meeting also included consideration o potential enhancements to the MELCOR code as well as consideration of the SOARCA project in general.

The review was conducted by five panelists with demonstrated expertise in the analysis of severe accidents at commercial nuclear power plants. The panelists were drawn from private industry, the Department of Energy national laboratory complex, and a company working on behalf of German Ministries. The review was coordinated by Sandia National Laboratories and attended by Nuclear Regulatory Commission staff. A discussion of the important uncertain modeling practices and their baseline approach are further discussed in Jolume H, ,,_ *4dR _

PfacfiT-sŽA separate task in the SOARCA program is planned to address the importance of uncertainties in these modeling parameters.

4.7.2 Early Containment Failure Phenomena The objective of SOARCA is to perform best-estimate evaluations of the accident progression and consequences from the most likely severe accident sequences for specific plants. Two phenomenological issues not included in the best-estimate approach used in SOARCA include (1) alpha-mode containment failure and (2) drywell liner melt-through in the presence of water leading to containment failure. These severe phenomena leading to an early failure of the containment were included in some of UEG-1 150 o quantify the risks from nuclear reactors.

The alpha-mode event is characterized by the supposition that an in-vessel steam explosion might be initiated during core meltdown by molten core material falling into the water-filled lower plenum of the reactor vessel. The concern was that the resulting steam explosion could impart sufficient energy to separate the upper vessel head from the vessel itself and form a missile with sufficient energy to penetrate the reactor containment. This of course would produce an early failure of the containment building at a time when the largest mass of fission products is released from the reactor fuel. In the following years, significant research was focused on characterizing and quantifying this hypothesized response in order to attempt to reduce the significant uncertainty. A group of leading experts ultimately concluded in a position paper published by the Nuclear Energy Agency's Committee on the Safety of Nuclear Installations that the alpha-mode failure issue for Western-style reactor containment buildings ..

38 k6 V

P/D I J/L Revision I /) - 12/17/2009 1:11:00 PM can be considered resolved from a risk perspective, posing little or no significance to the overall risk from a nuclear power plant.

The issue of Mark I drywell shell (liner) melt-through at Peach Bottom was assessed by the NUREG-1 150 molten core-containment interaction panel. The results of experthas panel elicitation sponsored 150, the NRC NUREG-1 are reported in Reference [12]. There response was uncertain.

of were two schools Since the completion of thought on this issue and hence the V/Y\-

analytical and experimental programs to address and resolve this so-called "Mark I Liner [14]. Attack" It was issue. The results of an assessment of the probability [13]

of and NUREG/CR-6025 Mark I containment failure by melt published in NUREG/CR-5423 attack of the liner were concluded that, in the presence of water, the probability of early containment failure by melt-attack of the liner is so low as to be considered physically unreasonable.

39

P/D V Revision I 9'ft - 12/17/2009 1:11:00 PM This Page Intentionally Left Blank 40

PjD Eo IO/L Revision I /I1 2 /17 / 2 00 9 1:11:00 PM 5.0 ACCIDENT PROGRESSION AND RADIOLOGICAL RELEASE ANALYSIS This section describes the MELCOR accident progression analysis for the internal and external event scenarios described in Section 3.0. Version 1.8.6 of the MELCOR severe accident analysis code was used the accident progression and radiological release calculations.

5.1 Long-Term Station Blackout - Unmitigated Response The unmitigated scenario event progression for the LTSBO accident progression analysis assumes that the operators follow the actions dictated in Special Event Procedure SE- 11 [4].

This document provides guidelines for managing the plant with degraded AC power sources.

Initial operator actions would concentrate on assessing plant status. Successful reactor scram, containment isolation and automatic actuation of RCIC for reactor level control would be verified. These checks would take approximately fifteen minutes. Additionally, one or more SRVs would cycle to control the reactor pressure vessel (RPV) pressure.

Special Event Procedure SE- 11 requires the immediaje-a ignm of the 'station blackout line' from Conowingo Dam in the event of failure of site power combined with the failure of all diesel generators to start. When this fails to pr6vide AC power to the plant, which is what was assumed to occur for the MELCOR analysis, the operators are directed to de-energize all unnecessary DC loads. By removing as many unnecessary loads as possible from the DC bus, the station battery lifetime is extended. This load shedding would not affect or disable control logic to the RCIC, high pressure injection cooling, main control room instrumentation, or SRV control.

The load shedding is expected to begin fifteen minutes into the event, and take approximately fifteen minutes to complete. Plant system engineers estimate the effect of load shedding would be to extend station battery duration from two to four hours.

One consequence of station blackout is the loss of cooling to the RCIC and HPCI corner rooms.

Heat losses from system piping and equipment to the room atmosphere would cause these areas to overheat. In such an event, step H-5 in the Special Event Procedure SE- 11 is applicable. It directs operators to block open doors to these rooms, and facilitate cross ventilation which would slow the rate of room heat up. These actions are assumed to successfully prevent system isolation from high temperature for the maximum four hour period of system operation9 . The Special Event Procedure SE-11, step H-7, directs the operators to monitor the inventory in the Condensate Storage Tank (CST) and take actions to refill the tank via gravity feed from other sources if necessary. Long-term viability of the Condensate Storage Tank (CST) is therefore assumed in the MELCOR calculations.

The calculated timing of key events that follow from all these actions is listed in Table 3. The time at which core damage begins strongly depends on the duration of station batteries. The 9 Heat loss from RCIC (or HPCI) systems to their enclosure comer rooms is not explicitly represented in the MELCOR model.

41

P#DEbO(0 Revision I t -12/17/2009 1:11:00 PM difference in time between loss of DC power and the onset of core damage increases as battery lifetime increases due to gradual reductions in decay heat levels with time. In the absence of effective manual intervention, core damage eventually proceeds to melting and relocation of core material into the reactor vessel lower head, reactor vessel lower head failure, and release of molten core debris to the drywell floor.

Table 3 Timing of Key Events for Long-Term Station Blackout Event LTSBO with (Time in hours unless noted otherwise) C pwer Station blackout - loss of all onsite and offsite AC power 0.0 Low-level 2 and RCIC actuation signal 10 minutes Operators manually open SRV to depressurize the reactor vessel 1.0 RPV pressure first drops below LPI setpoint (400 psig) 1.2 Battery depletion leads immediate SRV re-closure 4.0 RCIC steam line floods with water - RCIC flow terminates 5.2 Downcomer water level reaches top of active fuel (TAF) 9.0 First hydrogen production 9.2 First fuel-cladding gap release 10.1 First channel box failure 10.6 First core cell collapse due to time at temperature 11.0 Reactor vessel water level reaches bottom of lower core plate 11.6 SRV sticks open due to cycling at high temperatures 11.7 First core support plate localized failure in supporting debris 13.4 Lower head dries out 14.9 Ring 2 CRGT Column Collapse [failed at axial level 1] 17.5 Ring 1 CRGT Column Collapse [failed at axial level 1] 17.6 Ring 5 CRGT Column Collapse [failed at axial level 2] 17.7 Ring 3 CRGT Column Collapse [failed at axial level 1] 18.1 Ring 4 CRGT Column Collapse [failed at axial level 2] 19.0 Lower head failure 19.5 Drywell head flange leakage begins 19.5 Hydrogen burns initiated in drywell enclosure region of reactor building 19.5 Refueling bay to environment blowout panels open 19.5 Hydrogen burns initiated in reactor building refueling bay 19.7 Refueling bay roof overpressure failure 19.7 Drywell liner melt-through initiated and drywell head flange re-closure 19.7 Hydrogen burns initiated in lower reactor building Door to environment through railroad access opens due to overpressure 19.7 19.7 IC,ri Time Iodine release to environment exceeds 1% of initial core inventory Calculation terminated /96 42

Revi ion 1, 12/17/2009 1:11:00P The absence of water on the drywell floor in a transient scenario like s ation blackout'° allows "- -f core debris ejected from the reactor vessel after lower head failure to pread laterally across the floor and contact the drywell wall. Past calculations have predicted well liner melt-through to occur relatively soon after vessel failure (within 30 minutes.) Fissio product release from the containment to the reactor building and (with a very short delay) to te environment will bem at I d ,,m -

depending on the this point in time. Several release points to the environment are possible, response of the reactor building. Past calculations have shown hydrogen combustion leads to near-simultaneous opening of the refueling bay blow-out panels and the railroad doorway at grade level. Blowout panels into the turbine building and personnel access doorways out of the reactor building might also open. The dominant flow path for fission products to the environment, however, is expected to be through the refueling bay blowout panels"1 .

5.1.1 Thermal Hydraulic Response When plant conditions are stabilized, Special Event Procedure SE-II calls for a controlled depressurization of the reactor pressure vessel (RPV) to 125 psig using the instructions in the RC/P leg of Trip Procedure T-101. Depressurization would be accomplished by opening one or more SRVs or, if necessary, by manually opening other steam vent pathways, such as main steam line drains. The cooldown rate would be limited

12 to less than 100°F/hr. A controlled

depressurization is

initiated at one hour by opening a single SRV. As shown in Figure 14, this results in a stable pressure of approximately 125 psig . Reactor vessel pressure remains near this pressure for approximately two hours, while active DC power permits an SRV to hold in the open position. Four hours into the scenario, however, DC power from the station batteries is exhausted and the solenoid valve regulating control air to the SRV operator closes, causing the SRV itself to reclose13 . SRV closure causes reactor vessel pressure to gradually increase back to its automatic (safety) lift setpoint. Reactor vessel pressure subsequently cycles about its lift setpoint for the next 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months .

During this same time frame (i.e., the first 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of the accident scenario) reactor vessel water level is also undergoing significant changes (refer to Figure 15.) The hydraulic transient immediately following reactor scram and isolation results in a gradual decrease in water level due to coolant evaporation and discharge through a cycling SRV to the suppression pool. RCIC automatically starts 10 minutes after the initiating event and begins to restore reactor water level.

Two hours into the scenario, operators take manual control of RCIC and maintain level within the indicated range of +5 to +35 inches, i.e., 16 ft above top of active fuel (TAF).

10 As opposed to a loss-of-coolant accident (LOCA), where reactor coolant effluent accumulates on the drywell floor.

A stable flow of air into the building is expected through the open railroad doorway, upward through the open equipment hatches from grade level to the refueling bay and into the environment through the open blowout 12The target value of RPV pressure provides some margin above the RCIC isolation pressure of 75 psig.

13 Loss of control air pressure to the valve operator might take a few minutes to effect valve position, but this short time is ignored in this analysis.

43

(/EJ4gCAL Revision Ir/ft - 12/17/2009 1:1 1:00 PM 1400 1200 1000

- 800 600 400 200 0

0 2 4 6 8 10 12 14 16 18 20 22 24 time [hr]

Figure 14 LTSBO Vessel Pressure 800 700

_' 600

-" 500

.x 400 U) 300 o 200 1--

100 0

0 2 4 6 8 10 12 14 16 18 20 22 24 time (hr)

Figure 15 LTSBO Coolant Level 44

Re 12/17/2009 1:11:00PM When DC power from the station batteries expires four hours into the scenario, RCIC turbine speed is assumed to remain fixed at its last position. [Electric (DC) power is required to move the turbine inlet throttle valve (open or close), and the loss of power simply leaves the valve in its last controlled position.] As a result, RCIC continues to deliver coolant flow at approximately the same flow rate it had at the time DC power expired. However, closure of the SRV at 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months means coolant losses from the reactor vessel are temporarily terminated. Therefore, the reactor vessel level begins to rise (i.e., coolant injection continues, but losses are terminated.) A continuous rise in level is evident in Figure 15 between 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and approx. 5.2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

At 5.1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , the water level in the reactor vessel increases above the elevation of the main steam line nozzles. Water subsequently spills over into the main steam lines causing the steam line to the RCIC turbine to flood within a few minutes. The resulting termination of RCIC operation at 5.2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months causes the reactor water level to stabilize. Approx. 50 minutes later the average water temperature in the reactor vessel increases to saturation. When that occurs (6.0 hours0 days 0 hours 0 weeks 0 months ), the reactor vessel pressure is 900 psia and increasing. Increasing reactor vessel pressure causes a slight increase in the effective level of water in due to decreasing average coolant density 14. At 6.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , reactor vessel pressure returns to the SRV lift pressure and coolant losses through the cycling SRV resume. Without any form of coolant makeup, the reactor water level continuously decreases at a rate of 10 ft/hr. Nine hours into the scenario, the reactor water level reaches TAF.

At approximately twelve hours, the level decreases below the bottom of the lower core plate: By the time the plant has been without power for fifteen hours, the entire inventory of water in the reactor vessel evaporated (see Figure 15 and Table 3).

The thermal response of fuel in the core is illustrated in Figure 16, which shows the calculated temperature of fuel cladding across the core mid-plane. Cladding temperatures begin to rise at the top of the core when the mixture level decreases below approximately two-thirds of the core height. Within two hours, the mixture level is approaching the bottom of the core and fuel temperatures, and the extent of Zircaloy cladding oxidation, are sufficiently high to cause fuel at the top of the core to fragment and relocate toward the lower core plate as rubble.

In the midst of the core damage process, the cycling SRV is discharging a mixture of steam and hydrogen (from clad oxidation) to the suppression pool. The temperature of these gases increases along with the average temperature of fuel and debris near the top of the core. By 11.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , the temperature of gases discharged through the SRV exceeds 1000 K. Thermal expansion of valve internal components above this temperature results in valve seizure. The valve is assumed to seize in the open position after 10 cycles above 1000 K. This occurs at 11.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months , and results in rapid depressurization of the RPV (see Figure 14) and a sharp decrease in mixture level (see Figure 15.)

14 The density of saturated water decreases by 4-5% as pressure increases from 900 psia to 1150 psia. This causes the entire body of water within the core shroud to expand slightly, resulting in an increase in effective (swollen) water level.

45

IfI'AL Revision I 1*/fr - 12/17/2009 1:11:00 PM 3000 S I I Cladding Temperatures 2500 at Core Mid-plane

-Ringl 1

-Ring 2 2000 -Ring 30

-Ring 4 a)

I...

I Ring 5 4-(U I- 1500 a) Indicates intact fuel no

0. ogrpresent at this location E

a) S I I II I- 1000 + . . . - - .- --. - -

- - - --

- - - - -

500 i L - -

0 0 2 4 6 8 10 12 14 16 18 20 22 24 time [hr]

Figure 16 LTSBO Fuel Cladding Temperatures at Core Mid-plane Particulate and molten debris accumulate near the bottom of the core until 13.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , when the lower core plate yields, releasing core debris into the reactor vessel lower head. The interaction between hot debris and residual water in the lower head increases the rate of coolant evaporation, as indicated in Figure 15 by the increase in (negative) slope of the "in-shroud" water level. It also causes the temperature of debris submerged below the lower plenum mixture level to decrease to near-equilibrium conditions. This is evident in Figure 17, which shows the calculated temperature of debris along the inner surface of the lower head. When residual water in the lower plenum is completely evaporated at 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months , debris temperatures begin to increase.

Heat transfer from debris to the inner surface of the lower head causes the lower head temperature to increase as well. This is illustrated in Figure 18, which depicts the calculated temperature on the inner and outer surfaces of the lower head across all five rings of the MELCOR model. Because reactor vessel pressure is relatively low during this heat up, the failure of the lower head is more strongly influenced by thermal rather than mechanical stresses. 15 Failure of the lower head (at 19.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months ) results in the rapid ejection of over 100 metric tons of core debris onto the floor of the reactor pedestal in the drywell. The composition of this debris 15The inner surface temperature of the nadir of the lower head (MELCOR rings 1-3) is above the melting point of steel at the time failure occurs.

46

/ EAI/L Revision I PAr/ - 12/17/2009 1:11:00 PM (at the time of head failure) is a mixture of molten stainless steel (-30% by mass), unoxidized Zirconium (-1 1%) and particulate debris containing U0 2 and metallic oxides (remainder).

2500 Debris Temperatures Lower core plate failure on Inner Surface of L.H. Lower head

--......... .... .... .......... failure 2000 + -Ring 2

-Ring 3

- Ring 4 1500 I-

Ring 5 I-0 Indicates permanent loss of debris at this location CL

..

....

. ... .. . ...

...

....... . .. .

E 1000 I--

500 Lower head dryout i-0 0 5 10 15 20 25 30 time [hr]

Figure 17 LTSBO Temperature of Particulate Debris on Inner Surface of Lower Head Prior to the time at which the reactor vessel lower head fails, thermodynamic conditions in the containment are governed by the gradual release of hydrogen through the SRV to the torus. The large quantity of hydrogen (over 1300 kg between 10 and 19 hours2.199074e-4 days 0.00528 hours 3.141534e-5 weeks 7.2295e-6 months ), combined with the small free volume of the containment, result in significant increases in pressure. The containment pressure history is shown in Figure 19. Thirteen hours after the initiating event (8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months after the loss of all coolant injection), the containment pressure increases above the design pressure of 56 psig. Immediately prior to lower head failure (19.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months ), containment pressure exceeds 76 psig.

47

P/D E Revision I Irat- 12/17/2009 1:1 1:00 PM 2200 2000 1800 1600 1400 1200 E

a) 1000 800 600 400 0 5 10 15 20 25 30 time [hr]

Figure 18 LTSBO Lower Head Temperature 120 100

'B 80 0.

I.. 60 (0

U) 1~

0~ 40 20 0

0 10 20 30 40 50 time [hr]

Figure 19 LTSBO Containment Pressure 48

P(D E(l fL Revision I 1tr/ft - 12/17/2009 1:11:00 PM Soon after debris is released onto the reactor pedestal floor, it flows laterally out of the cavity through the open personnel access doorway and spreads out across the main drywell floor.

Lateral movement and spreading of debris across the drywell floor allows debris to reach the steel liner at the outer perimeter of the drywell within 10 minutes. Five minutes later, thermal attack of the molten debris against the steel liner results in liner penetration and opening of a release pathway for fission products into the basement (torus room) of the reactor building. The combined leakage through the drywell head flange and the ruptured drywell liner results in a rapid depressurization of the containment to approximately 25 psig, then a gradual long term depressurization, primarily through the opening in the drywell liner16. Before drywell liner melt-through occurs, hydrogen leaks through the drywell head flange and accumulates in the j j-.7 reactor building refueling bay1 7 . Within a few minat j ammable mixture develops and is assumed to-ignite. The resulting increase in pressur%within the building causes the blowout 0)

"

panels in the side walls of the refuelir g byto ope, creating a release pathway to the

./ - / I"_J

-Following drywell liner melt-througgh (several minutes later), hydrogen is released from the

ýdrywell into the basement of the buildin A/.e., torus room), and is transported upward through open floor gratings into the ground lev of the reactor building. Flammable mixtures quickly develop in these regions, which ar6 ssumed to ignite. The pressure rise within the building at J th-i we-rlocation causes several doorways within the building to open, including the large equipment access doorway. This large opening at grade level, coupled with the open blowout panels in the refueling bay (at the top of the building) create an efficient transport pathway for material released from containment to the environment. That is, a vertical column of airflow is created within the building, whereby fresh air from outside the building enters through the open ;*.,9

.,4A equipment doors at grade level, rises upward through the open equipment hatches at every /,4 intermediate floor within the building, and exits through the blowout panels at the top of the O--

building. As will be shown in the next section, this 'chimney effect' reduces the effectiveness of 4-)

the reactor building as an area for fission product retention. A , PSI CM, 5.1.2 Radionuclide Release )

The release of radionuclides that immediately accompanies c ntainment failure is shown in Figure 20. This release occurs in two steps, due to sequentia breaches in the containment ',

boundary by two distinct failure modes. The first appearanc of significant release to the COw,,

environment begins at 19.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , when leakage through the drywell head flange begins. The CO-*t,,,

leak area associated with this failure mode is relatively small. Therefore, the leak rate is low and the initial radionuclide release to the environment is relatively slow. Within 15 minutes, however, a larger leak area develops due to melt-through of the drywell liner. A sharp increase in the release rate is shown in Figure 21 (at 19.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months ), when this second failure mode occurs.

6 16 Reduction in drywell internal pressure' cause the drywell head flange leak pathway to reclose.

17 The precise leak pathway includes intermediate transport through the drywell head flange to the drywell head enclosure. Leakage from the enclosure into the refueling bay occurs through gaps in the concrete shield blocks on the refueling bay floor. This complex leak pathway is explicitly represented in the MELCOR model.

49

PIDVAL ' Revision I /Ot- 12/17/2009 1:11:00 PM The long-term release of radionuclides to the environment is shown in Figure 21. Following the

'puff release that accompanies containment failure, a steady and gradual increase in the total quantity of radionuclides released to the environment is observed. The gradual, long-term increase in release is caused by two processes. First, molten corium-concrete interactions (MCCI) on the drywell floor drive the residual quantity of volatile fission products from fuel debris, and release a relatively small fraction of all non-volatile species. Second, the combination of high drywell atmosphere temperatures generated as a byproduct of MCCI and heating of reactor vessel internal structures due to decay heating of deposited radionuclides results in a late revaporization release of volatile species from within the containment and reactor coolant system. The latter is described in greater detail below.

1.E+00 1.E-01 0

1 .E-02 1.E-03 0

1.E-04 1.E-05 1 .E-06 19 19.25 19.5 19.75 20 20.25 20.5 20.75 21 time [hr]

Figure 20 LTSBO Environmental Source Term: Detail at Time of Containment Failure 50

PfE//fAL Revision I Pf// 12/17/2009 1:11:00 PM 1.E+00 1.E-01 ......... ...................

... ... . . ... .... ... * .""

.. *...

... .".* * ...

... ~

. *.....i 0

it,

..... . .

... .. . .. . . .. . S TLC ~

0) 1.E-02 0

.. ............................

i ... ...... ..... ......... ...

C.) 1 .E-03

d*,! i ! !! ! * :! !! !! !! ! !I!! !! ! ! ! T e*

4- ....::..:::.:.,::.

....:...

.. ::.......:

. .... !::::. : .. ..:..:!:. :E*!!i:1 : ..... .................. :[:. . ........i*

0 1 .E-04 Cu

.2 W

1.E-05 1 .E-06 0 5 10 15 20 25 30 35 40 45 50 time [hr]

Figure 21 LTSBO Environmental Source Term: Long term Figure 22 depicts the fraction of the initial iodine inventory that is captured in the suppression pool, deposited or airborne within the reactor pressure vessel (RPV), in the drywell, and released to the environment as a function of time. Similar information is shown in Figure 23 for cesium, Figure 24 for tellurium, and Figure 25 for non-volatile cerium.

Collectively, these figures provide useful information about the mobility of different radionuclide species and temporal changes in their spatial distribution. For example, next to noble gases, iodine is the most volatile radionuclide group. In the SOARCA calculations, iodine is assumed to be transported in the form of CsI, which vaporizes at relatively modest temperatures for a severe accident. As a result, CsI is released from fuel during the early phases of in-vessel core damage progression and a significant fraction remains airborne due to relatively high temperatures of structures within the reactor vessel. Airborne iodine is efficiently transported to the wetwell through the operating SRV. In particular (see Figure 22),

approximately 60% of the initial core inventory of iodine is discharged to the suppression pool during the blowdown of the reactor vessel that accompanies SRV seizure at 11.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months . During the succeeding eight hours, the majority of CsI that remains deposited on reactor vessel internal structures after RPV blowdown evaporates from their surfaces due to decay heating, and is also carried into the suppression pool.

51

1(AL Revision I ýrA- 12/17/2009 1:11 :00 PM 0.9 0.8 0

0.7 w

- 0.6 0

0.5

- 0.4 o 0.3 C

0

, 0.2 LL 0.1 0

0 10 20 30 40 50 time [hr]

Figure 22 LTSBO Iodine Fission Product Distribution 0.9 0.8 Cesium Distribution o 0.7

> 0.6 .... .... z . Deposited/Airborne ...

within RPV ,,

o 0.5 pt

. 0.4 .- Captured in Suppression Pool 0

- 0.3 0

0.2 ILL -nv Release to

~~~~~~

A - - -D y eln giilenvironment 0.1 (1.8%) _7 \ -

0 0 10 20 30 40 50 time [hr]

Figure 23 LTSBO Cesium Fission Product Distribution 52

P/ROECýIc(AL Revision 1 VIr(ft - 12/17/2009 1:11:00 PM 0.9 0.8 Captured

( in Suppression Pool 0

. 0.7 Tellurium Distribution 0.6 0

Q 0.5 Deposited/Airborne

-E 0.4 -f- within RPV

'4-a 0.3 -I o

T 0

o0.2 .....

...... Drywell Release to LL environment (2.4%)

0.1 0

0 10 20 30 40 50 time [hr]

Figure 24 LTSBO Tellurium Fission Product Distribution 0.0014 0.0012 0

a-

> 0.001 0 0.0008 E 0.0006 4a-0 r 0.0004

,.

u. 0.0002 0

0 10 20 30 40 50 time [hr]

Figure 25 LTSBO Cerium Fission Product Distribution 53

Revision 1 94 - 12/17/2009 1:11:00 PM A small fraction (few percent) of iodine enters the drywell atmosphere at 11.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months (i.e., during RPV blowdown) due to incomplete scrubbing in the suppression pool. The high flow rate, combined with the high non-condensable (hydrogen) fraction of carrier gas, reduces scrubbing efficiency during this brief period of iodine transport to containment. This iodine initially deposits on drywell surfaces, but revaporizes when corium-concrete interactions begin after lower head failure. Late revaporization of the small amount of iodine in the drywell is the primary source of iodine to the environment.

Temporal changes in the spatial distribution of cesium (Figure 23) differ from those observed for iodine. First, a much larger fraction of the cesium inventory remains deposited on in-vessel structures during the early phase of in-vessel damage progression than is observed for iodine.

When reactor vessel blowdown occurs at 11.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months , a significant, but smaller, fraction of cesium is airborne in the vessel atmosphere. Therefore, a smaller quantity is promptly swept into the wetwell following SRV seizure. In contrast to iodine, for which nearly 60% of the initial core inventory is swept into the suppression pool during RPV blowdown, less than 20% of the cesium inventory is transported to the torus at the same time. Revolatilzation and transport of deposited cesium to the suppression pool prior to vessel breach is also less than that observed for iodine. Approximately 33% of the cesium is transport to the pool prior to lower head failure, whereas nearly 90% is observed for iodine.

These differences in iodine and cesium behavior can be attributed to differences in the physical properties of their dominant chemical forms. As mentioned earlier, iodine is transported as CsI.

The cesium contribution to CsI represents only 6% of the total cesium inventory. The vast majority (approx. 90%)18 of the cesium inventory is transported in the form of cesium molybdate (Cs 2 MoO 4 ). Cesium molybdate is less volatile than the iodide and remains deposited on in-vessel structures at significantly higher temperatures. The in-vessel temperature history calculated for the long-term station blackout creates a thermal environment that promotes the evaporation of Csl relative to that of Cs 2MoO 4. Therefore, iodine is preferentially transported to the torus, but cesium remains deposited on in-vessel structures.

The suppressed mobility of cesium compared to iodine also affects the ultimate quantity transported to environment. Because the amount of cesium swept into the suppression pool during reactor vessel blowdown at 11.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months is a small fraction of the total core inventory, carry-over into the drywell atmosphere (due to inefficient pool scrubbing) is negligible.

Therefore, the amount of cesium in the drywell atmosphere at the time of containment failure (19.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months ) is also very small. In contrast to the iodine release, which is dominated by an early

'puff' release immediately accompanying containment failure, the cesium release is characterized by a small, protracted release that begins after containment failure. The primary mechanism for this long-term release is the slow revolatilization of cesium deposited on RPV internal surfaces.

The behavior of tellurium (Figure 24) is similar to that described above for iodine, and is not described in further detail here. Release of the heavy non-volatile species (cerium, for example) differs substantially from the trends described above for volatile species. As indicated in

'8 The remaining fraction is cesium located in the fuel-cladding gap.

54

PFIDEJO'KifL Revision I 7 /.- 12/17/2009 1:11:00 PM Figure 25, the release of these radio-elements does not begin until after vessel breach, when MCCI occurs on the drywell floor. Release of cerium and other non-volatile species (La and Ru, for example) from fuel debris begin soon after vessel breach when MCCI is most aggressive. As indicated in Figure 26, the temperature of ex-vessel debris decreases significantly as it spreads across the drywell floor from its initial point of arrival in the reactor pedestal. This greatly reduces the rate at which the non-volatile species are released.

3000 Ex-vessel Debris Temperatures 2500 - - CAV In-pedestal i

-CAVI: Quarter-floor outside doorway

_CAV2: Remainder of DW floor 2000 +

SF Q.

-- - - - - - - - - - - - - - - - -

1500 E * - - - - - - - I-- - - - - -

1000 1

I

--- - - - - - - - - - - - - - - - - - - - - - - - - -

500 0

0 10 20 30 40 I50 va time [hr]

Figure 26 LTSBO Ex-vessel Debris Temperatures 55

P(DE~fI~AL Revision I J 12/17/2009 1:11:00PM 5.2 Long-Term Station Blackout - Mitigated Response The key events for LTSBO with mitigative actions (discussed in Section 3.1.3) are listed in Table 4.

Table 4 Timing of Key Events for Mitigated Long-Term Station Blackout Mitigated LTSBO Event with 4 hr (Time in hours unless noted otherwise) dc power Station blackout - loss of all onsite and offsite AC power. 0.0 Automatic reactor scram and containment isolation 0.0+

Low-level 2 and RCIC actuation signal 10 minutes Operators manually open SRV to depressurize the reactor vessel 1.0 RPV pressure first drops below LPI setpoint (400 psig) 1.2 Operators take manual control of RCIC; flow throttled to maintain level 2.0 within range (+5 to +35 in)

Portable electric generated positioned, started and connected to remote panel 1.0 to 4.0 Station batteries depleted 4.0 Operators position, align and start portable pump to replace RCIC as injection 4.0 to 10.0 source High suppression pool temperature isolation signal for RCIC 10.0 Calculation terminated 24 5.2.1 Thermal Hydraulic Response Like the unmitigated case, the operator manually opens a safety/release valve (SRV) to reduce pressure in the reactor pressure vessel (RPV). When the station batteries are exhausted, a portable power supply is engaged to sustain the open safety/release valve (SRV) in the mitigated case. This maintains the reactor pressure vessel (RPV) at a stable pressure at or above 125 psig as directed in the Special Event Procedure SE- 11. This is shown in Figure 27.

The coolant level history for the mitigated long-term station blackout is plotted in Figure 28.

The core temperature history for the mitigated long-term station blackout is shown in Figure 29.

No plot was included for the long-term station blackout lower head temperature history because the mitigated case does not result in core damage. The curve would be 'flat-line' at nominal shutdown conditions. The containment pressure history for the mitigated long-term station blackout is shown in Figure 30. The operator actions are labeled in the plot.

56

PDEc41AL Revision 1 12/17/2009 1:11:00 PM 1400

-- Operator manually iI I 1200 -,opens 1 SRV -- "RPV Pressure i I I i Ii 1000 CL 800 I i i I I i

...... .

i I I i i I 600 IL.

i I i i i Ii 400 .'.. Station batteries exhausted;

', portable power supply engaged to sustain open SRV 200 - - - -- - - I- - -

0 0 2 4 6 8 10 12 14 16 18 20 22 24 time [hr]

Figure 27 Mitigated LTSBO Vessel Pressure 700 600

-* 500 400 300 200 0

100 0

0 2 4 6 8 10 12 14 16 18 20 22 24 time (hr)

Figure 28 Mitigated LTSBO Coolant Level 57

P(D E/Clt#

Revision 1 12/17/2009 1:11:00 PM 1000 Max imum Cladding Temperature in Core 900 800

. .. ... ... ... ...i ... ..

. ......

700 I I F F . . .... . -...

CL -------------

E 600 F I I IF I I I 500 i I F i I I -

AMW [ I I i ] I I I I

't'UU 0 2 4 6 8 10 12 14 16 18 20 22 24 time (hr)

Figure 29 Mitigated LTSBO Core Temperature 30 Containment Pressure Operator opens . '

25 containment vent

... -" --

F F F F F I

" 20

- F F F I F CL ,Drywell 2 15 F : ijretywe

&10

~ ~ ~~

........... ~ ~ ~ ~ ~.......

~ ~ ~. ...... ra

.. o...

.. ........

...l se ..... ..............

5 , F cperator re-closesn containment vent U

0 2 4 6 8 10 12 14 16 18 20 22 24 time [hr]

Figure 30 Mitigated LTSBO Containment Pressure 58

PIDEISIO Revision 1 (r,.( 12/17/2009 1:11:00PM 5.2.2 Radionuclide Release No plots were included for the iodine fission product distribution history, cesium fission product distribution history, barium fission product distribution history, cerium fission product distribution history, or environmental release history of all fission products resulting from mitigated long-term station blackout because the mitigated case does not result in core damage. All of the curves would be 'flat-lines' at nominal shutdown conditions.

5.3 Short-Term Station Blackout - Unmitigated Response The general response of plant equipment and operating personnel to the STSBO closely resembles the 'unmitigated' LTSBO scenario. Therefore, the reader is referred to Section 5.1 for a description of the actions plant personnel would take in response to this type of event. A key difference, however, is the early failure of DC power, which significantly reduces the time available for intervention, and accelerates the timeline of damage progression.

The accelerated event chronology is evident in Table 5, which indicates the onset of core damage (measured as the first time at which fuel cladding fails) occurs approximately one hour after the initiating event in the short-term scenario, whereas the same condition occurs eight hours later in the long-term scenario where station batteries (DC power) ensure coolant makeup for four hours' 9 . Late phases of in-vessel damage progression also proceed at a relatively rapid pace due to the higher levels of energy retained in the core. For example, reactor vessel dryout occurs approximately one hour after core debris relocates into the lower plenum in the short-term scenario, whereas it takes nearly five hours in the long-term scenario. As noted later, these differences have a relatively minor impact on the quantity of activity released to the environment; but it does impact the time at which a release begins, and therefore may impact the assessment of offsite consequences.

5.3.1 Thermal Hydraulic Response The initiating event causes a prompt failure of all AC and DC power supplies to plant equipment and instrumentation. Reactor control blades, MSIVs and containment isolation valves would all move to their fail-safe positions (inserted and closed). Isolation of the reactor coolant system causes reactor pressure to rise to the set point of the SRVs, which open, directing coolant to the pressure suppression pool. As shown in Figure 31, reactor pressure is maintained at approximately 1120 psia, as the SRV with the lowest set point cycles open/closed for approximately two hours 2. Actions taken by plant operations personnel to manually reduce reactor pressure and prevent frequent cycling of the SRVs are assumed to not be successful.

This is because control power to necessary equipment (e.g., SRV solenoid control valves) would not be available and manual actions to open alternative steam relief paths are assumed to be inhibited by obstacles preventing access to plant equipment (a result of the severity of the initiating event.)

19 The delayed time to the onset of core damage in the long-term station blackout is not proportional to the duration of DC power or coolant makeup due to the non-linear change in core decay heat with time.

20 A second SRV periodically opens during the first 45 minutes of the transient, when decay heat levels remain high. However, after this point in time, only one valve is cycling.

59

P/ DE/IO/ Revision I 12/17/2009 1:11:00PM Table 5 Timing of Key Events for the Unmitigated Short-term Station Blackout Time Event (hr)

Station blackout - loss of all onsite and offsite AC power 0.0 Low-level 2 and RCIC actuation signal 10 minutes Downcomer water level reaches top of active fuel 0.5 First hydrogen production 1.0 First fuel-cladding gap release 1.0 First channel box failure 1.2 Reactor vessel water level reaches bottom of lower core plate 2.0 SRV sticks open due to excessive cycling 2.0 RPV pressure decreases below LPI set point (400 psi) 2.3 7 First core support plate localized failure in supporting debris 2.6 Lower head dries out 3.5 .. - --

Ring 5 CRGT Column Collapse [failed at axial level 2] 5,5-Ring 3 CRGT Column Collapse [failed at axial level 2] 5.8 Ring 1 CRGT Column Collapse [failed at axial level 1] 5.9 Ring Ring 42 CRGT CRGT Column Column Collapse Collapse [failed

[failed at at axial axial level level 1]

1] /6.1 6.1 Lower head failure (yield from creep rupture) 7.9 Drywell liner melt-through (leakage into torus room 9greactor building) 8.2 iK' -

Refueling bay to environment blowout panels open/ 8.2 Hydrogen burns initiated in torus room (basen)eft) of reactor building 8.2 ' -- ,

Door to environment through railroad acceps/opens due to overpressure 8.2 Blowout panels from RB steam tunnel to'furbine building open 8.2 Steel roof o over-pressure 8.4 V~eiedsaLorul througj- wa-L-ro-"io> j "11.1 Time oU e -release to environment exceeds 1% , 8.5 CalCulation terminated 48.0 Two hours after the initiating event, the (single) cycling SRV sticks in the open position, causing a rapid depressurization of the reactor coolant system 21. The continuous discharge of steam 21 The time (or cycle) at which an SRV would fail to reclose is determined by calculating the cumulative 1 probability of failure, based on the total number of cycles and the probability of failure on demand. The latter is taken from the Individual Plant Examination (IPE) for Peach Bottom, which reports a value of 3.7E-3 per demand. This value is larger than the industry average value of 8E-4/demand reported in NUREG/CR-6928, and is assumed to be representative of plant-specific performance. In the MELCOR 60

ML12124A076

Text

1.0 INTRODUCTION

1.0 INTRODUCTION

Navigation menu

Search