Text

TER of Vermont Yankee Ipe,Back End Submittal, Final Rept
	ML20100F086
Person / Time
Site:	Vermont Yankee
Issue date:	11/30/1995
From:	Vijaykumar R; SCINT-LOG
To:	; NRC COMMISSION (OCM)
Shared Package
ML20100F049	List: ML20100F061; ML20100F068; ML20100F086;
References
	CON-NRC-04-91-068, CON-NRC-4-91-68 ERI-NRC-94-111, NUDOCS 9602200087
	Download: ML20100F086 (46)
	v • d • e

.a4 4a- de ses Ama --.t. s ese i

f I

l i

l APPENDIX C VERMONT YANKEE NUCLEAR POWER STATION TECHNICAL EVALUATION REPORT J

(BACK-END) 9602200087 960209 1 DR ADOCK 0500

i ERI/NRC 94-111 TECHNICAL EVALUATION REPORT OF THE l VERMONT YANKEE INDIVIDUAL PLANT EXAMINATION I BACK-END SUBMITTAL FINAL REPORT November 1995 l

l R. VUaykumar and M. Khatib-Rahbar Energy Research, Inc.

P.O. Box 2034 Rockville, Maryland 20847 Prepared for:

SCIENECH, Inc.

Rockville, Maryland 20852 Under Contract NRC-04-91-068 With the U.S. Nuclear Regulatory Conuninsion Washington, D. C. 20555

. - - _ - . . - _ ~ - . . - . - - _ .- - -- . __

E. EXECUTIVE

SUMMARY

This Technical Evaluation Report (TER) documents the findings from a review of the back-end portion of the Vermont Yankee Nuclear Power Corporations's Individual Plant Examination (IPE) submittal of the Vermont Yankee plant. The primary intent of the review is to ascertain whether or not, and to what extent, the back-end IPE submittal satisfies the major intent of Generic letter (GL) 88-20 and achieves the four IPE sub-objectives. The review utilized both, the information provided in the IPE submittal, and additional information provided by the licensee in response to NRC questions.

The back-end portion of the IPE submittal supplies a substantial amount of information with regards to the subject areas identified in Generic Letter 88-20, and NUREG-1335..

E.1 Plant Characterization Vermont Yankee Nuclear Power Corporation operates the Vermont Yankee plant, which consists of one Boiling Water Reactor (BWR) in a Mark I containment. The rated thermal power is 1593 MWt (514 MWe). The mean containment failure pressure is 140 psig.

E.2 Licensee's IPE Process The submittal reports a Core Damage Frequency (CDF) of 4.3 x 104 per reactor year. The dominant contributors to core damage are high pressure transient sequences (34 %), followed by long term Station Black-Out (SBO) sequences (14%), Anticipated Transient Without Scram (ATWS) sequences (13 %), and loss of injection at low pressure (9%). Sequences that involve loss of containment heat removal contribute to 7% of the CDF. Containment bypass sequences contribute to about 1 % of the CDF. Unique capabilities, including the ability to inject water -

into the RPV or the containment using the diesel fire pump, and the ability to energize an emergency bus through a tie to the Vernon Hydroelectric station, keep the CDF due to SBO sequences low. Similarly, unique safety features such as 105 % turbine bypass valves and 110%

main condenser capacity, help to reduce the CDF for ATWS sequences.

The IPE was a joint utiWty-contractor effort, with ERIN Engineering, Gabor, Kenton and Associates, Inc., and Chicago Bridge and Iron, Technical Services serving as consultants. The licensee contribution was through the Yankee Atomic Electric Company (YAEC), which provides dedicated engineering services to Vermont Yankee, and is considered,by Vermont Yankee to be an extension of its staff.

The submittal uses a method of back-end analysis that is slightly different from traditional PRAs. l A large event tree method is used for the front-end analysis, and a number of accident sequence initiators are followed until core damage. A Containment Event Tree (CET) is used to evaluate the containment response. The containment response is evaluated by linking each core damage ,

sequence (DQ1 plant damge states) to the CET. The submittal makes use of the MAAP code l to evaluate the timing of the key events during the course of the accident, and to obtain the J

Vermont Yankee IPE Back-End Review ii ERI/NRC 94-111 !

l l

4 l

radionuclide release fractions. However, for evaluating the conditional probability of containment failure for energetic events (such as DCH, steam explosions, etc), the submittal makes use of results from past industry PRAs. The split fractions used for the uncertain phenomenological issues in the CET are not provided in the submittal, making it difficult to i

understand and review the CET results. The generr.1 CET has 20 top event questions which )

include information on the following-

1. Core Cooling.

2. Containment Intact (at core damage). ;

3. Isolated Containment (at core damage). .

1

4. Vessel Depressurization. :

5. In-Vessel Recovery. ;

6. Inerted Containment. 1

7. Combustible Gas Venting.

l

8. Drywell Integrity (at vessel breach).

9. Operation of Drywell Sprays.

10. Shell Integrity (after vessel breach).

11. Containment Flooding.

12. Drywell Venting. l

13. Debris Coolability. l

14. Containment Heat Removal.

15. Torus Venting.

16. Suppression Pool Scrubbing.

17. Limit Size of Failure. l

18. Drywell Overtemperature Failure l 19e Wetwell Failure. l

20. Ability of Reactor Building to Scrub Fission Products.

Some of the top events in the event tree are developed using phenomenological fault trees; others are not developed. The overall methodology employed in the Vermont Yankee IPE submittal for CET analysis is well organized. The Vermont Yankee CET includes all the relevant severe accident phenome.na applicable to BWRs with Mark I containments.

The end-states of the CET analyses are binned into radionuclide release categories based on the timing and magnitude of iodine releases. The timing of the releases is characterized as early or late, depending on the time of containment failure as calculated from the time of accident initiation (rather than from the time of core damage). The MAAP-BWR 3.0B code was the principal tool used to analyze postulated severe accidents including source terms for Vermont Yankee IPE.

E.3 Back-End Analysis The conditional probabilities of containment failure, given core damage, are 0.48 for early failure, 0.24 for late failure, and 0.01 for bypass (see Table E.1). The probability of the Vermont Yankee IPE Back-End Review iii ERI/NRC 94-111 l

9 containment remaining intact is 0.27 at Vermont Yankee. The principal mode of fission product release is by early containment failure coupled with large releases (0.219). The dominant comributors to large radioactive releases by accident type are short term SBO sequences (0.18),

followed by transients (0.14), and ATWS sequences (0.11). The dominant contributors to large releases by containment failure modes are drywell overtemperature (0.45) and shell melt-through (0.17). j lt can be seen From Table E.1 that the only major difference between Vermont Yankee and the Peach Bottom plant (NUREG-1150 analysis), is that Vermont Yankee has a slightly lower ,

conditional probability of early containment failure, and a correspondingly higher probability of I late containment failure. This difference is discussed below. l The definition of "early" and " late" releases are different. However, the differences in the !

definitions are significant only for the TW sequences (i.e., Accident Classes IIA, IIL, and IIV :

in the IPE submittal), and, to a lesser extent, for the long term station blackout sequences. All the TW sequences in the Vermont Yankee IPE submittal are classified as " late" containment failures. TW sequences and V sequences were not found to be significant contributors to core l damage in the Peach Bottom NUREG-ll50 analyses. If the TW and V sequences are removed l from the CDF profile of the Vermont Yankee IPE submittal, the remaining accident classes have a 0.53 conditional probability of early containment failure, and a 0.17 conditional probability of late containment failure. These results are then comparable with the NUREG-il50 results !

for the Peach Bottom plant. I However, it should be pointed out that there are differences in the containment failure mode between the two plants. The breakup of containment failure probabilities into failure modes in the Vermont Yankee submittal is available only for early, high releases, and not for all releases.

It appears that the failure mode in the Vermont Yankee plant is governed by drywell overtemperature after vessel breach, and not liner melt-through. The use of NUREG/CR-5823 results for conditional probabilities of liner melt-through is one of the reasons for the differences in containment failure modes between the two analyses. It appears that drywell overtemperature failure within hours after vessel breach is the dominant mode of containment failure, and it appears that the licensee has conservatively classified this failure mode as early containment

- failure for many sequences.

The licensee's process for the evaluation of containment failure probabilities and failure modes is consistent with the intent of Generic letter 88-20, Appendix I. The dominant contributors to containment failure are consistent with the insights obtained from the NUREG-ll50 analyses for the Peach Bottom plant. The licensee has considered the failure of the containment isolation system and containment bypass scenarios. Failure of electrical and mechanical penetrations at elevated temperatures was considered and ruled out. A number of sensitivity analyses have also been performed.

Vermont Yankee IPE Back-End Review iv ERI/NRC 94-111

4 Table E.1 Conditional Probability of Containment Failure: Comparison of Vermont Yankee IPE Results to Peach Bottom NUREG-ll50 Results Containment Failure Peach Bottom (NUREG-ll50) Vermont Yankec IPE CDF (per year) 4.5 x 104 4.33 x 104 Early Failure 0.557 0.478 Bypass NA 0.012 Late Failure 0.16 0.24 l Intact 0.18 0.27 No Vessel Breach 0.10 -+

l

+ -

Included as part of " Intact" containment. l NA -

Not Available. l l

E.4 Containment Perfonnance improvements Generic letter 88-20, Supplement Numbers 1 and 3 identified specific Containment Performance l Improvements (CPIs) to reduce the vulnerability of containments to severe accident challenges. I For BWRs with Mark I containments, the following improvements were identified:

Alternative water supply for drywell spray / vessel injection, Enhanced reactor pressure vessel depressurization system reliability, Implementation of Revision 4 of the BWR Owners Group EPGs, and Installation of a hardened vent.

The recommendations of the CPI program have all been implemented in the Vermont Yankee plant after a containment safety study performed by the licensee in 1986, and they are described below:

Alternative water supolv for drvwell sorav/ vessel iniection: Vermont Yankee has a capability to inject water to the drywell spray header or the RPV under station blackout and non-SBO conditions. Under non-SBO conditions, the alignment is from the river to the service water header, through the RHRSW to RHR crosstie, and into the RPV via the LPCI injection valves (or to the drywell spray header via the drywell spray valves). RHR service pumps can be used to pump the river water. However, if AC power is not available, injection is by the diesel-Vermont Yankee IPE Back-End Review y ERLINRC 94-111

. , _ _ _ _ __ _. . . . ~ _ _ _ _ _ _ -_ _ _ __ _ _ _ _ ._

driven fire pump, using an auxiliary diesel generator to power the necessary valves. Note, that

this diesel generator is different from the two emergency diesel generators which power the ,

I I

emergency buses. Although not stated in the submittal, the impact of the alternate water supply d

is expected to be significant, particularly in the prevention of shell melt-through and early containment failure,

' i 1

Enhanced reactor oressure vessel deoressurization system reliability: Vermont Yankee has

implemented a design change (circa 1986) to allow the use of the same auxiliary diesel generator

mentioned above to charge station batteries. This procedure enhances plant capabilities during j extended station blackout conditions by increasing the availability of DC control power for ADS d

valves. The licensee appears to have modelled the availability of the auxiliary diesel generator i as a source for charging the station batteries.

i Imolementation of Revision 4 of the BWR Owners Groun EPGs: Vermont Yankee has

! incorporated revision 4 of the BWROG Emergency Procedure Guidelines (EPGs). In addition, the Vermont Yankee EOPs also include procedures for using the plant capabilities described above, such as alternate injection.

) Hardened Vent: The hardened vent system has been fohnd to be beneficial in reducing the i frequency of core damage for TW sequences.

l E.5 Vulnerabilities and Plant Improvements l The submittal screened for vulnerabilities by comparing the IPE-calculated values for core damage frequency and frequency of large releases to the safety goals proposed by the NRC:

1. Core Damage Frequency < 10" per reactor year 4

2. Large Release Frequency < 104 per reactor year The CDP calculated by the Vermont Yankee IPE submittalis 4.3 x 104 per reactor year, which l

! is less than the 104 per reactor year. The submittal calculates a large release frequency (early, l 4

high releases) of 9.4 x 104per reactor year, which is nominally equal to the safety goal (as l i defined by the licensee) of 104 per reactor year. The licensee concluded that, because the IPE-i calculated frequencies are less than the safety goals, the IPE has identified no " vulnerabilities".

! As a result, no hardware modifications are deemed appropriate based on the IPE findings.

However, the licensee identified a number of potential procedural enhancements that have "the potential to enhance our defense in-depth approach." A total of 13 procedural enhancements were identified. Two of these enhancements were based on the containment analyses, however, both of these enhancements were discarded as being not appropriate for incorporation into plant

procedures. The enhancements and the reasons for their dismissal, are given below

1. Enhancement of Emergency Action Level (EAL) criteria for long-term loss of containment heat removal and long-term station blackout.

i Vermont Yankee IPE Back-Enti Review vi ERI/NRC 94-111 1.

These actions are stated to be under further consideration as a part of industry-wide effort for improving EAL criteria.

2. Expanding the use of drywell spray before RPV failure.

This strategy is stated to have been further explored by the BWROG Emergency Procedures Committee, and the appropriate guidelines are stated to be provided in the Emergency Procedure Guidelines.

E.6' Observations The following are the major findings of the Vermont Yankee IPE submittal:

No single accident sequence represents an unusually large fraction of CDP. Sequences such as SBO and ATWS are not the dominant contributors to the CDF (although they are significant contributors), owing to unique capabilities, such as the ability to inject water using the diesel fire pump, and the ability to energize an emergency bus through a tie to the Vernon Hydroelectric station. Similarly, unique safety features such as 105% turbine bypass valves and 110% main condenser capacity, help to reduce the CDF for ATWS sequences.

The conditional probability of early and late containment failures are 0.49 and 0.24, respectively. Large releases, defined as releases of greater than 10% of core inventory of iodine occurring within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after accident initiation, occur with a conditional probability of 0.22.

The principal contributors to large releases are station blackout sequences. The dominant modes of containment failure for large releases are drywell ovettemperature and shell melt-through.

Unique design features in the Vermont Yankee plant, including the alternate injection capacity, enhanced reactor depressurization system, motor-driven feedwater pumps, 105 % turbine bypass valves,110% capacity main condenser, hardened torus vent, and alternate cooling for the station service water system, all contribute to reduced CDF.

The important points of this technical evaluation of the Vermont Yankee IPE back-end analysis are summarized as follows: ;

The Vermont Yankee IPE submittal demonstrates a good understanding of the impact of severe accidents on containment failure and radionuclide releases. The separate models used in the IPE Back-End analysis are technically sound.

The licensee has addressed all phenomena of importance to severe accident l phenomenology in a BWR with a Mark I containment, j l

Vermont Yankee IPE Back-End Review vii ERI/NRC 94-111 l l

l

)

____--.-___m

1 1

The recommendations of the Containment Performance Improvement (CPI) program i have been fully implemented in the Vermont Yankee plant. ;

i The timing of fission product release is evaluated from the time of accident initiation, !

and not from the time of core damage. In many accident sequences, even though I containment failure may occur beyond 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after accident initiation, it may occur only a few hours after core damage. Thus, there is insufficient time for fission product releases to be removed by natural processes, such as deposition, and the releases associated with late containment failure may be large. However, a number of release categories, particularly those corresponding to the drywell overtemperature mode of failure (which, according to the submittal, occurs within six hours after accident initiation) are classified as early releases. Although the classification of the release timing is incorrect, the use of the second descriptor in the fission product release definition (magnitude of release) provides additional information on the characteristics of the release. Most of the releases associated with intermediate and even late containment failure (i.e., those resulting from loss of decay heat removal) are in the range of 1 to 10% of the iodine inventory, which is believed to be relatively conservative.

e The results of the containment analyses show that the only major difference between Vermont Yankee and the Peach Bottom plant (NUREG-1150 analysis), is that Vermont Yankee has a slightly lower conditional probability of early containment failure, and a correspondingly higher probability of late containment failure.

9 Vermont Yankee IPE Back-End Review viii ERI/NRC 94-111

I 4

4 l

TABLE OF CONTENTS d

l. INTRODUCTION ...................................... 1 1.1 Review Process 4

.................................... 1

1.2 Containment Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

2. CONTRACTOR REVIEW FINDINGS . . . . . . . . . . . . . . . . . . . . . . . . . . 4 l 2.1 Review and Identification of IPE Insights . . . . . . . . . . . . . . . . . . . . . 4 2.1.1 Completeness and Methodology . . . . . . . . . . . . . . . . . . . . . . 4 l

2.1.2 As-Built /As-Operated Status . . . . . . . . . . . . . . . . . . . . . . . . 4 i 2.1.3 Licensee Participation and Peer Review of IPE . . . . . . . . . . . . . 5 2.2 Containment Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 I i

2.2.1 Front End/Back End Dependencies . . . . . . . . . . . . . . .. . . . . . 5 {

2.2.2 Containment Event Tree Development . . . . . . . . . . . . . . . . . . 6 l 2.2.3 Containment Failure Modes and Timing . . . . . . . . . _. . . . . . . 14 2.2.4 Containment Isolation Failure ......................15 I

2.2.5 System / Human Response . . . . . . . . . . . . . . . . . . . . . . . . . 16 2.2.6 Radionuclide Release Categories and Characterization . . . . . . . . 16 2.3 Quantitative Assessment of Accident Progression and Containment i

Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 2.3.1 Severe Accident Progression . . . . . . . . . . . . . . . . . . . . . . . 18 2.3.2 Dominant Contributors to Containment Failure . . . . . . . . . . . . 20 2.3.3 Characterization of Containment Performance ............23

2.3.4 Impact on Equipment Behavior .....................25 l.

2.4 Reducing the Probability of Core Damage or Fission Product Release . . 26 j 2.4.1 Definition of Vulnerability . . . . . . . . . . . . . . . . . . . . . . . . 26 t

2.4.2 Plant Modifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 l

! 2.5 Responses to the Recommendations of the CPI Program . . . . . . . . . . 27 2.6 Insights, Improvements and Commitments . . . . . . . . . . . . . . . . . . . 28

3. OVERALL EVALUATION AND CONCLUSIONS . . . . . . . . . . . . . . . . . 29

4. R EFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. 31 A P PENDIX A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 3 1

i l

l Vermont Yankee IPE Back-End Review ix ERI/NRC 94-111

LIST OF TABLES Table 1 Comparison of Vermont Yankee and Peach Bottom Plant and Containment Design Features that Contribute to The Progression of Severe Accidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Table 2 Comparison of Containment Capacities . . . . . . . . . . . . . . . . . . . . . . 3 Table 3 Definition of Core Damage End States in the Vermont Yankee Submittal l .............................................. 7 ;

1 Table 4 Containment Failure as a Percentage of Internal Events CDF:

Comparison of Vermont Yankee IPE Results to Other BWR Mark I IPEs and Peach Bottom NUREG-1150 Results . . . . . . . . . . . . . . . . . . . . 21 Table 5 Vermont Yankee C-Matrix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 l

l Table 6 Relative Contribution of Various Containment Failure Modes to Early Containment Failure (and High Releases) for the Vermont Yankee Pla n t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 3 I

l l

1 1

l l

1 l

l 1

Vermont Yankee IPE Back-End Review x ERI/NRC 94-111 l

l

l l

NOMENCLATURE 1 ADS Automatic Depressurization Sys:cm ATWS Anticipated Transient Without Scram BOC Break Outside Containrt.ent BWR Boiling Water Reactor CB&I Chicago Bridge and Iron Technical Services Co.

CCI Core Concrete Interactions CDF Core Damage Frequency CET Containment Event Tree CHR Containment Heat Rejection CPI Containment Performance Improvement DCH Direct Containment Heating DF Decontamination Factor ECCS Emergency Core Cooling Systems EOP Emergency Operating Procedure EPA Electrical Penetration Assembly EPG Emergency Procedure Guideline EPRI Electric Power Research Institute EVSE Ex-Vessel Steam Explosion GE General Electric GKA Gabor, Kenton, and Associates, Inc.

IPE Individual Plant Examination IVSE In-Vessel Steam Explosion LOCA Loss of Coolant Accident LPCI Low Pressure Coolant Injection MAAP Modular Accident Analysis Program MCC Motor Control Center MSIV Main Steam Isolation Valve NRC Nuclear Regulatory Commission PDS Plant Damage State PRA Probabilistic Risk Assessment RCS Reactor Coolant System RHR Residual Heat Rejection RHRSW Residual Heat Removal Service Water RPV Reactor Pressure Vessel SBO Station Black-Out SGTS Standby Gas Treatment System SLCS Standby Liquid Control System SRV Safety Relief Valve TAF Top of Active Fuel TER Technical Evaluation Report TSC Technical Support Center YAEC Yankee Atomic Electric Company Vermont Yankee IPE Back-End Review xi ERUNRC 94-111

1. INTRODUCTION This Technical Evaluation Report (TER) documents the results of a review of the Vermont Yankee IPE Back-End submittal [1]. This TER complies with the requirements for IPE back-end reviews of the U.S. Nuclear Regulatory Commission (NRC) in its contractor task orders, and adopts the NRC review objectives, which include the following:

e To determine if the IPE submittal essentially provides the level of detail requested in the Submittal Guidance Document, NUREG-1335, o To assess the strengths and the weaknesses of the IPE submittal, e To provide a preliminary list of questions based on this limited review, and e To complete the IPE Evaluation Data Summary Sheet.

The remainder of Section 1 of this report describes the technical evaluation process employed in this review, and presents a summary of the important characteristics of the Salem Generating Station related to containment behavior and post-core-damage severe accident progression, as derived from the IPE. Section 2 summarizes the review technical findings, and briefly describes the submittal scope as it pertains to the work requirements. Each portion of Section 2 corresponds to a specific work requirement as outlined in the NRC contractor task order. A summary of the overall IPE evaluation and review conclusions are summarized in Section 3.

Section 4 contains a list of cited references. Appendix A to this report contains the IPE evaluation data summary sheets.

1.1 Review Process The technical review process for back-end analysis consists of a complete examination of Sections 1,2, and 4 through 7 of the IPE submittal. In this examination, key findings are noted; inputs, methods, and results are reviewed; and any issues or concerns pertaining to the submittal are identified. The primary intent of the review is to ascertain whether or not, and to what extent, the back-end IPE submittal satisfies the major intent of Generic Letter (GL) 88-20 [3]

and achieves the four IPE sub-objectives. A draft TER based on the back-end portion of the l submittal was submitted to the NRC in November 1994. A list of questions and requests for additional information was developed to help resolve issues and concerns noted in the examination process, and was forwarded to the licensee. The IPE submittal [1] for the Vermont Yankee plant provided an abbreviated description of the process used by the licensee for the Containment Event Tree (CET) analyses in the back-end portion of the submittal. During a meeting with the NRC, the staff felt that these issues would be best resolved by direct conversation with the licensee and Yankee Atomic Energy Corporation (YAEC) personnel.

Hence, a conference call with the licensee was set up on May 2,1995. The methodology used by the licensee was clarified in the conference call, a brief summary of which is provi&d in Reference [12]. The licensee provided written responses to other outstanding RAIs [13), which Vermont Yankee IPE Back-End Review 1 ERI/NRC 94-111 l

were also reviewed. The final TER is based on the information contained in the IPE submittal l

[1], additional information provided by the licensee during the conference call [12] and the licensee responses to the NRC Requests for Additional Information (RAIs) [13].

1.2 Containment Analysis

! Vermont Yankee Nuclear Power Corporation operates the Vermont Yankee plant, which consists i of one Boiling Water Reactor (BWR)in a Mark I containment. The rated thermal power is 1593

! MWt (514 MWe). The Mark I containment of the Vermont Yankee plant is described in Section 4.1 of the submittal, and displayed in Figures 4.1-1 through 4.1-5. The drywell is a steel pressure vessel with a spherical lower portion 62 ft. in diameter, and a cylindrical upper portion

33 ft. in diameter. The steel vessel is enclosed in a reinforced concrete biological shield, as shown in Figures 4.1-2 and 4.1-4. The drywell internal design pressure is 56 psig and the i design temperature is 281 *F. The top of the drywell is capped with a bolted /gasketed head, and sealed with O-rings.

The drywell floor area is 117.5 m ,2 and this is composed of the area inside the pedestal, and the area outside the pedestal, but inside the shell. A 3 ft. access opening exists in the pedestal wall.

Two sumps,78 ft8 in volume, are located outside the pedestal wall.

The suppression chamber is a torus-shaped, leak-tight steel pressure vessel, with a diameter of 98 ft. Eight vent pipes connect the drywell to the suppression chamber vent header and its ninety-six downcomer pipes. Twelve vacuum breakers relieve gas from the wetwell vapor space l to the drywell. Tables 1 and 2 provide a comparison of containment features between the l

Vermont Yankee plant and the Peach Bottom plant, another GE plant with a Mark-I containment l [2]. It can be seen that the containment features are comparable between the two plants. In addition, the following plant-specific features are important for accident progressi'o n in the Vermont Yankee plant:

A hardened containment vent pipe 8 inch. in diameter is provided for heat removal and venting for sequences that entail loss of containment heat removal. The vent pipe connects one of the vacuum breaker lines to the Standby Gas Treatment exhaust line, which in turn discharges to the plant stack. The vent is self-initiated by opening a i

single rupture disc at approximately 59i3 psig. The vent line is equipped with the rupture disc and one normally open, remote manual gate valve. After the containment is depressurized, the gate valve is used to manually isolate the vent path. If periodic venting is necessary, operators can reopen the vent path using the manual gate valve.

Vermont Yankee has a capability to inject water to the reactor vessel or the drywell spray header or the RPV under station blackout and non-SBO conditions using the diesel fire pump. A plant modification was made to enhance the capability by allowing the use of an auxiliary diesel generator to power the AC-operated valves needed to accomplish injection.

Vennent Yankee IPE Back-End Review 2 ERI/NRC 94-111

Vermont Yankee Emergency Operating Procedures (EOPs) have incorporated revision 4 of the Boiling Water Reactor Owners Group (BWROG) Emergency Procedure Guidelines (EPGs), including training on these procedures.

Table 1 Comparison of Vermont Yankee and Peach Bottom Plant and Containment Design Features that Contribute to The Progression of Severe Accidents Feature Vermont Peach Bottom Yankee i Power Level, MW(t) 1,593 3,293 Volume of Suppression pool, m 2 1,925 3,.480 1 1

Free Volume of Drywell, m' 3,800 4,502 l l

Volume of Wetwell Air Space, m' 3,%5 3,738 Volume of Drywell Sump (s), m' 4.4 6.1 S. Pool Water Vol./ Power, m8 /MW(t) 1.2 1.1 Containment Volume / Power, m'/MW(t) 4.3 2.5 Table 2 Comparison of Containment Capacities Containment Region Vermont Yankee Peach Bottom Containment Design Pressure 0.49 MPa (56 psig) 0.49 MPa (56 psig)

Failure Pressure 1.06 MPa (140 psig) 1.09 MPa (150 psig) l i

Table 1 shows that the ratios of containment free volume-to-power and suppression water volume-to power are larger (by 60% and 10%, respectively) in the Vermont Yankee plant in i comparison to the Peach Bottom plant, and thus provide larger margins in response to severe accidents.

l Vermont Yankee IPE Back-End Review 3 ERl/NRC 94-111

i

2. CONTRACTOR REVIEW FINDINGS The present review compared the Vermont Yankee IPE submittal to the intent of the Generic Letter (GL) 88-20, according to the guidance provided in NUREG-1335. The responses of the licensee were also reviewed. The findings of the present review are reported in this section, and :

follow the structure of Task Order Subtask 1. i 2.1 Review and Identification of IPE Insights i

2.1.1 Comoleteness and Methodology . i l

The IPE submittal contains a substantial. amount of information in accordance with the !

recommendations of GL 88-20 and NUREG-1335. l The methodology employed in the Vermont Yankee IPE submittal for the back-end evaluatioa l is clearly described, and the IPE is logical and consistent with GL 88-20. The submittal uses '

a method that is slightly different from traditional PRAs. A large event tree method is used for the front-end analysis, and a number of accident sequence initiators are followed until core ,

damage. The containment response is evaluated by linking each accident sequence (gg plant I damage states) to the Containment Event Tree (CET). Nevertheless, the level I core damage

{

sequences are grouped into accident sequence bins as a means for providing insights into the results, and as an aide for defining split fraction " rules" for the CET analysis. All sequences in an accident bin are evaluated similarly in the CET.

Probabilistic quantification of severe accident progression involved development of a small event tree. The CET includes a number of nodes that question the availability of containment systems.

In addition, the CET also includes a probabilistic evaluation of severe accident phenomenology.

The results of the CET analyses lead to a number of end-states, which were in turn binned into a small number of release categories, based on similarities in source term characteristics (magnitude and timing of releases).

2.1.2 As-Built /As-Onerated Status The IPE team performed a walk-through of the Vermont Yankee reactor building. The purpose l of this walk-down was to observe the reactor building layout to support deterministic calculations using the MAAP code for fission product retention in the secondary building. The walkdown was performed by members of the Safety Assessment Group of the Yankee Atomic Electric Company (YAEC), the Vermont Yankee Operations Department and Corporate Engineering, and consultants from Gabor, Kenton, and Associates. Insofar as the containment systems are concerned, the IPE appears to model the Vermont Yankee configuration.

Vermont Yankee IPE Back-End Review 4 ERI/NRC 94-111

2.1.3 Licensee Particination and Peer Review of IPE The Vermont Yankee IPE effort was a joint utility-consultant effort, with most of the work performed by engineers from YAEC, which provides dedicated engineering services to Vermont Yankee, and is considered by Vermont Yankee to be an extension of its staff.. The consultants included one individual from ERIN Engineering and Research, Inc., who focused on the containment phenomenological analyses, and another from Gabor, Kenton, and Associates, who developed and exercised the Vermont Yankee MAAP model. In addition, one consultant from Chicago Bridge and Iron Technical Services Company (CB&I) performed the analyses to evaluate the ultimate strength of the containment. An in-house review of all aspects of the analysis was performed by Vermont Yankee and YAEC personnel, and a high level review was performed by the consultant from ERIN Engineering. It is stated in the submittal that all the review comments were addressed as part of the submittal, and all potential errors or modelling deficiencies were resolved to the satisfaction of the reviewers.

2.2 Containment Analysis This section provides a review of PDS binning, CET analyses, release category definitions, severe accident analyses, and the containment structural analyses in the submittal. ,

2.2.1 Front End/Back End Deoendencies 1 The results of the front-end event trees are accident sequences and their frequencies. There are a large number of such accident sequences, and hence, the end-states of the front-end event tree are conveniently binned into core damage end-states. As in the submittal (page 4-72), the functional characteristics that define the accident bins are the following:

e Initiating event type Transients i Small LOCA l Medium LOCA Large LOCA ATWS Vessel Rupture ISLOCA (including LOCAs outside containment) e Containment status prior to core damage Containment Intact Containment Failed Containment Vented Vermont Yankee IPE Back-End Review 5 ERI/NRC 94-111

RPV Pressure at the onset of core damage High Low e Other system failures Time of HPCI/RCIC Failure Time of less of DC-1 and DC-2 Failure of Vapor Suppression Function However, a difference in the methodology used for containment analysis in the Vermont Yankee IPE submittal should be noted. A small event tree /large fault tree method is used for the front-end analysis, and a number of accident sequence initiators are followed until core damage. The containment response is evaluated by linking each accident sequence (Det plant damage states) to the CET. Nevertheless, the I.evel I core damage sequences are grouped into accident sequence bins as a means for providing insights into the results, and as an aide for defining split fraction " rules" for the CET analysis. The submittal does not clearly mention the cutoff frequency that was used to determine the number of Level 1 sequences that were considered further for back-end analyses.

Table 3 provides a list of accident bins and their CDFs for use in the back-end analyses. The dominant contributors to core damage are transient sequences (such as those initiated by loss of feedwater, loss of condenser vacuum, etc.) with core damage at high pressure (34 %), followed by lonh term SBO sequences (14%), ATWS sequences where core damage occurs after containment ~ failure (13 %), and loss of injection at low pressure (9%). Sequences that involve loss of containment heat removal contribute to 7% of the CDF. Containment bypass sequences contribute to about 1 % of the CDF.

The binning process appears to be reasonable, but it is not clear how all the (several thousand) front-end sequences were linked with the containment event tree.

2.2.2 Containment Event Tree Develooment Probabilistic quantification of severe accident progression for the probabilistically significant accident bins was performed using CErs. The methodology employed in the Vermont Yankee IPE submittal involved development of a small CEr, and use of plant-specific MAAP results or results obtained from literature such as NUREG-Il50 to quantify the CET split fractions.

The CET is illustrated in Figure 4.5.1 (page 4.5-16) of the submittal. The CET was quantified using the RISKMAN computer code. Some top events in the CET focus on system success or failure. These system top events are similar to the top events in the front-line event trees, and are developed using fault trees provided in Section 3 of the submittal. Other top events in the CET focus on the probability of various postulated severe accident phenomena (e.g., steam explosions, hydrogen burus) which can threaten the integrity of the RPV, containment, or reactor Vermont Yankee IPE Back-End Review 6 ERI/NRC 94-111

i j !

m

. a o

Definition of Core Damage End States in the Vermont Yankee Submittal i R Table 3

< Frequency >

E Subclass Definition

(% of CDF)

[ t Transient with Loss ofInjection. RPV at High Pressure

I.5E4 (34 %)

IA Ieng Term Station Blackout

6.0E-7 (14 %)

$8 BL i Short Term Station Blackout

8.76E-8 (2%)

?" BE

m. IC ATWS' 4.3E-8 (1 %) ,

Transients with Loss of Injection, low Pressure

3.9E-7 (9 %)

E ID :

Early Station Blackout . Ioss of DC* 1.7E-7 (4%)

IED I

Tranients with Delayed loss of DC Power

4.3E-8 (1 %)

IEC l Transients with Loss of Containment Heat Removal

3E-7 (7%) l IIA !

Transient Events Where Main Condenser and RHR Fail. Torus Vent Opened 1.3E4 (3 %)

IIV i

LOCA with Loss of Injection. RPV at Iow Pressure

1.3E4 (3 5)

IDC LOCAs* 8.6E-7 (2%)

IIID ;

ATWS

a _ --* 5.6E-7 (13 %)

IVA ATWS Sequences with RCS Failure

2.6E-7 (6%)

IVL ,

Interfacing Systems LOCA and Break Outside Containment 4.3E-7(1 %)

V

Containment Intact Prior to Core Damage ;

+ Containment Failed Prior to Core Damage h

e O

i

- . . -. - -=- - - . - . - - .-- _. . - _ . - -

building. The licensee, in response to the NRC team RAls, stated that a small event tree /large fault tree methodology was used in the IPE [12]. In addition, the licensee indicated that most of the top events related to phenomenological uncertainties were developed using fault trees.

Other top events were concerned with availability or recovery of support systems, ECCS, containment safeguards, etc. These top event nodes were not developed using fault trees, instead

~

the results of the front-end analyses, and the specific features of the CET computer code were used for the quantification process. The RISKMAN code allowed the licensee to develop certain

" rules" that assured the proper quantification of the nodes. No mention was made of the fault trees in the IPE submittal. However, the phenomena treated in these fault trees are discussed qualitatively in the submittal. The general CET has 20 top event questions which include information on the following:

CC: Core Cooling. This top event is used to determine which sequences from the front-end analyses need to be further evaluated in the CET. CC success means that no core damage has occurred, and when CC succeeds, all other top events in the CET are bypassed. However, success of node CC does not mean that the containment is intact. There are sequences in the front-end analyses where containment fails due to loss of containment heat removal, but injection systems such as Feedwater, Condensate, or CRD can cool the core. Even though the containment has failed, these sequences are not evaluated in the CET because the releases are judged to be small.

CI Containment Intact. This top event determines whether the containment is intact or failed at the beginning of the CET. CI is set to failure when containment heat removal is failed in the front-end event tree, and for some ATWS sequences where the reactor power overwhelms the suppression pool and leads to containment failure.

IS Isolated Containment. Failure ofisolation can result in a release path to the reactor building or to the environment. Containment isolation can fail in two ways:

1. Failure of containment isolation valves,

2. Pre-existing failures of hatches, Electrical Penetration Assemblies (EPAs) or other penetrations.

The success criteria for IS is defined as no opening in any line, hatch or penetration with an ,

equivalent size of greater than 2 inches in diameter. This success criteria is based on estimates of the magnitude of release. Openings smaller than 2 inches are assumed to be small enough to preclude further attention in the CET.

VD: Vessel Depressurization. There are two possible benefits of RCS depressurization after core damage. First, depressurization permits the use of low pressure injection systems which were previously unable to inject, thereby possibly arresting core damage within an intact RPV. Even if core damage is not arrested in-vessel leading to the failure of the RPV, the resulting containment pressurization is expected to be less threatening if the RPV fails at low pressure.

This node is also used to account for SRV reclosure after core damage, even if RPV Vennont Yankee IPE Back-End Review g ERI/NRC 94111

depressurization was accomplished before core damage. Reclosure could occur due to (a) loss of nitrogen, (b) loss of de power supply, (c) high containment pressure, or (d) harsh environment in the Reactor Building that leads to failure of SRV sensors and power cabling.

VR In-Vessel Recovery. This top event consiers recovery of core cooling and arrest of core damage prior to vessel breach. The success of the VR node means that some core damage has occurred, but that the RPV is not breached. VR failure means that core debris has failed the RPV bottom head or penetration.

Systems that could be used for injection to the RPV must have been unavailable in the front-line event tree in order to get to this node in the CET. Thus, Top Event VR depends on the following :

a. Ability to use previously unsuccessful injection systems due to success of RPV depressurization, ,

b. Use of RPV injection systems that were not credited in the front-line event trees, i.e., ,

service water injection to the RPV via the RHRSW-to-RHR crosstie, or j

c. Recovery of support systems (especially ac power) whose failure caused failure of RPV injection in the front-line event tree.

In response to an NRC team question, the licensee provided the split fractions for this node for various accident sequences (Table 3.3.5.1 of the IPE submittal), and described how the dependencies were treated [12]. As an example, for the station blackout sequence, the licensee had found that all the support systems had failed, and recovery was not possible within the time frame considered for the licensee analyses. For other sequences, the licensee stated that the basic event probabilities for the recovery of previously unsuccessful injection systems, recovery of support systems, and for the use ofinjection systems that were not credited in the front-end analyses, were all available from the results of the front-end analyses [12].

The licensee referred to supporting calculations, and stated that the AC power recovery after core damage, but before vessel breach, was not credited in the IPE analyses [1,12]. The licensee also stated that injection of alternate sources of water was not relevant to SBO sequences, and provided the values for the basic event probabilities for this event for other sequences (see Table 3.3.5.1 of the submittal).

int Inerted Containment. Under normal operating condition, the Mark I containment is inerted with nitrogen. When the containment remains inerted with nitrogen, insufficient oxygen is present to cause hydrogen burns even at elevated hydrogen concentrations. However, in the unlikely event that the containment is not inerted (for instance, under the 24-hour Technical Specification LCO), there is potential for hydrogen burns. Other potential sources of air (oxygen) intrusion into the containment during a severe accident include (a) opening of the Torus-to-Reactor-Building vacuum breakers due to subatmospheric pressure in containment, (b)

Verrnont Yankee IPE Back-End Review 9 ERI/NRC 94-111

leakage of air into the containment nitrogen system, and (c) operator error which causes purging of the containment atmosphere with air. The licensee analyzed these scenarios and judged them to be sufficiently improbable and has excluded them from the CET.

GV Combustible Gas Venting. Significant amounts of hydrogen may be produced during in-vessel oxidation of the zircaloy cladding during a severe accident. For sequences where core damage occurs, if the containment atmosphere is not inerted (failure of Top Event IN), a hydrogen burn can occur and can threaten containment integrity. Although procedures exist in the Vermont Yankee EOPs for combustible gas venting, Technical Support Center (TSC) 1 concurrence is required before operators can perform combustible gas venting. However, since !

combustible gas venting may be required soon (within I hour) after accident initiation, the licensee assumes failure of venting procedures. In addition, combustible gas venting may be ;

required even if the core damage is arrested in-vessel (Top Event VR succeeds), since significant !

amounts of hydrogen may be produced in the early stages of core damage. j DIt Drywel/ Integrity. Top Event DI considers drywell failure due to energetic events that occur at or around the time of vessel breach. Success of the DI node implies that no significant drywell leakage develops as a result of the energetic phenomena. DI failure means that drywell failure occurs as a result of energetic phenomena, including:

1. Direct cmtainment heating,

2. Missiles generated from vessel breach,

3. In-vessel or ex-vessel steam explosions,

4. Vapor suppression failure at RPV failure which can occur due to stuck-open drywell-to-wetwell vacuum breakers, or due to containment flooding which covers the vacuum breakers with water. In the absence of RPV failure, vapor suppression failure could result from SRV discharge to the suppression pool while at elevated pool water temperature or low pool water level, and

5. Recriticality of core debris following control blade melting after relocation of core material.

The licensee stated that [12] this node was developed using a fault tree, and all the dependencies listed above, have been considered in that fault tree.

SD: Spray Drywell. This top event questions the availability of early drywell sprays to inject water before RPV failure occurs. If this node is considered successful, then water will be present on the drywell floor at the time of RPV failure, which decreases the likelihood of drywell shell melt-through by molten debris. Vermont Yankee EOPs restrict the operator's use of drywell sprays in order to prevent drywell implosion. Thus, for most of the severe accident sequences simulated with MAAP, either the Drywell Spray Initiation Limit was not satisfied, Vermont Yankee IPE Back-End Review 10 ERl/NRC 94-111

or else no EOP symptom (for drywell spray) is present. The licensee stated that considerable analyses went into the treatment of drywell sprays and their recovery [12]. They were assumed i to be unsuccessful under all severe accident conditions. The licensee arrived at this conclusion I after a review of all EOPs and after a discussion with the operators. Hence in the CET quantification, it is assumed that drywell sprays fail for all sequences. ,

l SI ShellIntegrity. This top event considers the failure of the drywell shell when in contact with !

core debris in the drywell pedestal region after RPV failure. SI is bypassed when early drywell !

failure occurs. Drywell shell melt-through is dependent on the following factors:

1. The mode and timing of RPV breach,

2. The temperature and quantity of debris released from the RPV, and

3. The availability of water in the pedestal region of the drywell at the time of RPV failure (and afterwards). In addition, the effectiveness of water in cooling the debris and the '

drywell shell is also considered. ;

1 This node was developed using a fault tree [12]. For the Vermont Yankee plant, the vertical l distance between the drywell floor and the bottom edge of the drywell-to-wetwell downcomers j is approximately one foot. According to thc submittal, the height of the core debris on the drywell floor will be between 1 and 7 inches, depending on the mass of the core discharged from the RPV, and assuming uniform debris spread on the pedestal floor. This allows for an overlying water pool of between 5 and 11 inches to cool the debris. Based on results from NUREG/CR-5823, the licensee assumes that shell melt-through can be prevented as long as water is present overlying the debris, and sufficient water (1,000 gpm) can be provided to the drywell floor to form the overlying pool. However, it appears that the licensee has misinterpreted the NUREG/CR-5823 results, since the only source of water onto the drywell floor is by injection into the (breached) RPV, and there is no other source of water to the drywell floor. NUREG/CR-5823 does not consider water addition after core relocation onto the drywell floor, and thus the results are not applicable if water is not present on the drywell floor.

If the water supply cannot be provided, it is assumed that shell melt-through will occur.

CF Containment Flooding. Vermont Yankee EOP procedures direct the operator to flood the containment to the Top of Active Fuel (TAF) when RPV level cannot be restored and steam cooling is insufficient to cool the core. The EOPs are based on the assumption that a large LOCA or RPV rupture exists, and that the only way to submerge the core is by raising ,

containment water level to above TAF. Containment flooding is accomplished by pumping I water into the containment (via injection to the RPV and leakage out the RPV breach) from external sources. The only external supply sufficient to flood the containment is the river, and l the river water is pumped into the RPV via the RHRSW-to-RHR crosstie. In addition, containment flooding also requires that the drywell be vented. Top Event CF considers the injection of water via RHRSW only. Drywell venting is treated in the next top event, DV. In the CET, Top Event CF is asked whenever the RPV fails and the containment is not failed.

Vermont Yankee IPE Back-End Review 11 ERI/NRC 94-111

DVt Drywell Vent. Success of the containment flooding (Top Event CF) implies that water is being injected into the RPV and that the operator controls containment water level such that the core remains submerged. Drywell pressure will increase due to decay heat, and possible combustible gas production. Drywell pressure must be controlled to prevent containment overpressure failure. EOPs specify use of drywell venting to control drywell pressure as part :

of the containment flooding procedure. '

OD: Quench Debris. The submittal assumes that containment failure can be prevented by ,

flooding and quenching debris. Successful quenching of the debris can prevent the following i two containment failure modes:

1. Drywell overtemperature failure. The temperature of the drywell atmosphere can be l controlled by cooling the core debris. The drywell head seal can fail due to elevated i temperature if the debris is not cooled. In addition, cooling of the debris can also :

prevent revaporization of fission products deposited on surfaces in the RPV and drywell. This minimizes fission product release.

2.. Containment overpressure failure. The attack of the drywell floor concrete can be limited by cooling the core debris, thereby limiting the amount of noncondensible gas i I

generated by concrete erosion. Without such cooling, the containment can fait due to high pressure from noncondensible gases.

The licensee stated that this top event was developed using a fault tree, and provided the split fractions for the success path for several accident sequences [12). Two sources of water to the containment floor are the drywell sprays (Top Event SD), or injection to the RPV and drainage out of an RPV breach (Top Event CF). Thus, OD is assumed to be successful when either SD or CF is successful.

l HR Heat Removal. Top Event HR questions the success of the RHR System.

TV: Torus Vent. This top event is asked after failure of containment heat rejection. TV considers use of the hard-piped torus vent as an alternative to the RHR Sy!, tem for containment heat removal. Success for Top Event TV requires that a vent path be open from the torus airspace, and that the operator uses this path to control containment pressure. While drywell venting can also accomplish the decay heat removal function, torus veriting is the preferred venting mode because it results in fission product scrubbing.

SP: Suppression Pool Scrubbing. Top Event SP considers the potential for a release to bypass the suppression pool due to stuck-open vacuum breakers. Failure of this node involves a release into the drywell (e.g., LOCA or RPV failure) along with a stuck-open vacuum breaker. Without suppression pool scrubbing, the release from opening of the torus vent (or from containment failures located in the wetwell airspace) will be much higher than it would be with suppression pool scrubbing.

Vennont Yankee IPE Back-End Review 12 ERI/NRC 94-111

LS: Limit Size ofFailure. Top Event LS is used to establish the size of the containment failure.

The two subsequent top events, DR and WW, establish the failure location. The success of Top Event LS means that the failure is limited to a small size, defined as an area less than about 0.2 l

square feet. Small failures will prevent further pressurization of containment, but will not cause a rapid depressurization. The failure of Top Event LS means that a large failure occurs, which results in a rapid depressurization of containment.

DRt Drywell. This top event evaluates the possibility of overtemperature or overpressure failure !

of the drywell. Top Event DR and the next top event, WW, are used to account for the !

probability of different containment failure locations. The containment failure location is i important because it affects the scrubbing of fission products. The success of top event DR l means that no significant leakage from the drywell occurs, which means that the failure must be located in the torus. The failure of top event DR means that the drywell fails, and the resulting release is assumed to be out the drywell head.

WW Wetwell. Top Event WW is used to partition the torus failures into those which occur in the torus airspace (which preserves the suppression pool's ability to scrub fission products), and !'

those which occur in the wetwell below the waterline (which are assumed to drain the suppression pool and may jeopardize scrubbing). Success of top event WW means that the failure occurs in the torus airspace, and that the wetwell water remains available for scrubbing.

WW failure means that the failure results in draining of the water from the wetwell.

RB Reactor Building. This top event is used to assess the ability of the reactor building to decontaminate releases to the environment by retaining fission products. To be considered by this top event, the containment failure size / location is first established by top events IS, LS, DR, and WW. Also, fission product decontamination is considered for sequences with successful drywell venting (DV success), since the drywell vent is assumed to discharge into the reactor building. RB is bypassed for cases where the release from containment is via a large failure at the drywell head (e.g., DI failure, OD failure, or IN and GV failure). It is assumed that the reactor building would provide little retention of fission products for such a large release.

The effectiveness of the reactor building is influenced by a number of factors, including:

~

1. The size and location of containment failure, 2.. The availability of water, due to flooding or from fire sprays, to scrub the fission products,

3. The ability of the SGTS system to remove fission products, and

4. Other phenomena, such as hydrogen combustion events, which can occur in the reactor building.

Vermont Yankee IPE Back-End Review 13 ER1/NRC 94111

i This top event was developed using a fault tree. Success of this top event is assumed to lead to a reduction in the magnitude of source term release by one category. For instance, a "High" release will be reduced to " Medium" (and so on) by the success of this node.

The overall methodology employed in the Vermont Yankee IPE submittal for CET analysis is well organized. The Vermont Yankee CET includes most of the relevant phenomena for BWRs with Mark I containments. The IPE utilizes a small (20 node) event tree, and some of the top events are developed using fault trees. The CET top event split fractions and the basic event probabilities are provided in Table 3.3.5.1 of the submittal, but their bases and references are not provided in the submittal. However, the overall results do not indicate substantial deviance from other IPEs and PRAs.

In summary, the CET analyses performed by the licensee are extensive, and consider all phenomena of importance to severe accident progression in BWRs with a Mark I containment.

2.2.3 Containment Failure Modes and Timine The plant-specific evaluation of the ultimate capacity of the Vermont Yankee Mark I containment is described in Section 4.4 of the IPE submittal. CB&I performed a limited assessment of the ultimate strength of the containment. The assessment was based on a comparison of the key features of the Vermont Yankee containment to those of the Peach Bottom Mark I containment, which was analyzed by CB&I [3]. These results were further supplemented by information available from other studies, in order to develop the containment ultimate strength profile. The containment structural capacity was analyzed within the following four categories:

1. At relatively low temperatures (< 500*F), the containment is challenged by pressure loads only. The most probable containment failure modes are wetwell vapor space rupture, wetwell water space rupture, vent line bellows failure, and drywell head leakage. The mean failure pressure is calculated to be 140 pig, and the failure location is judged to be the wetwell airspace.

2. At intermediate temperatures (500*F s Temperature s 900*F), the containment failure mode will most likely be leakage due to potential seal degradation. The silicone rubber seals are expected to fail at 700 F. A failure pressure of 88 psig was assessed for high temperatures, and failure is expected to occur at the drywell head.

3. For temperatures greater than 900'F, the drywell is expected to fail without any appreciable pressure loads. The failure locations are judged to be tears in the drywell shell at restraint points, and at the drywell head flange.

4. The fourth mode of containment failure is by dynamic loading that occurs at high suppression pool temperatures, high containment pressures and high SRV flow rates.

If the suppression pool temperatures exceed 260*F, and if substantial power is produced in the core and discharged into the suppression pool, then the torus is assumed to fail.

Vermont Yankee IPE Back-End Review 14 ERI/NRC 94-111

- _ _ . . . - . . = . - - . .- . . -. .- . . - .- , .-. .

In summary, the submittal appears to analyze all relevant potential containment failure modes.

All applicable containment failure modes from Table 2.2 of NUREG-1335 have been considered in the analyses. The containment capacities are provided as point estimates, and no probabilistic distributions are provided for the containment fragility.

The licensee considered the performance of mechanical and electrical seals at elevated temperatures. A review of NUREG/CR-3234 was performed, and the licensee concluded that the outer seal integrity is not challenged even at high temperatures (e.g.,1800*F). For mechanical penetrations, the effect of thermal expansion on pipe penetrations and purge / vent valves, and loss of seal resiliency (especially for drywell head, equipment hatch, personnel hatch, and CRD removal hatch) were evaluated based on the information presented in NUREG/CR-1037. The results of this review indicated that the limiting failure location at elevated temperatures was the drywell head.

2.2.4 Containment Isolation Failure In the Vermont Yankee IPE submittal, containment isolation failure is treated in the front-end (system analysis) event trees, and is discussed in Section 3.2.31 of the submittal. The containment isolation node is developed using a fault tree. The focus of the containment isolation analyses is on the following penetration lines:

Drywell equipment drain sump lines, Drywell floor drain sump lines, Drywell and torus vent lines, Drywell and torus purge supply lines, and Torus vacuum relief system.

The submittal does not provide the conditional probability of containment isolation failure, however, Table 3.3.5.1 indicates that the calculated probability for failure to isolate containment is approximately 0.005.

Containment bypass was also analyzed as a part of the IPE. The probable occurrence of Interfacing Systems LOCA (ISLOCA)in pipelines with high pressure-to-low pressure interface, arranged with check valves or isolation valves, was analyzed. After a review of the Vermont Yankee plant systems, the following lines were considered for further analyses:

LPCI discharge piping, LPCS discharge piping, and Vermont Yankee IPE Back-End Review 15 ERI/NRC 94-111

RHR shutdown cooling suction piping.

Fault trees for the analysis of ISLOCA in these three lines are provided in Section 3.2.36 of the submittal. In addition, LOCAs outside containment in the main steam, feedwater, HPCI, and RCIC lines are evaluated in Section 3.1.1.11 of the submittal. The calculated CDF for the bypass sequences is 4.3 x 104 per reactor year for the Vermont Yankee submittal.

2.2.5 System / Human RescotlE Four operator actions can be identified in the Level 2 (back-end) analyses, and they are listed below, together with the associated basic event probability:

Operator fails to align RHRSW for in-vessel injection (0.22),

Operator fails to implement EOP for containment flooding using RHRSW (0.015),

Operator fails to open drywell vent path to support containment flood procedures (0.035), and Operator fails to control containment vent after rupture disc actuates (0.01).

2.2.6 Radionuclide Release Catenories and Characterization The results of the CET analyses lead to an extensive number of end-states, which are in turn binned for source term analyses. Outcomes of the CETs are classified into a reasonable number of release categories, which are based on similarities in accident progression and source term characteristics.

As discussed in Section 4.7 of the submittal, only two characteristics were identified as having I the greatest impact on fission product release at Vermont Yankee, and they are the following:

Timing of Release late (L) -

Greater than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after accident initiation Intermedirae (I) -

6 to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after accident initiation Early (E) -

Less than 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after accident initiation Magnitude of Release High (H) -

Greater than 10% of Csl inventory Medium (M) -

I to 10% of Cslinventory Low (L) -

0.1 to 1% of Cslinventory Low-low (LL) -

Less than 1% of Cslinventory Vermont Yankee IPE Back-End Review 16 ERI/NRC 94-111

1 The timing of release is determined by the following factors:

The time from accident initiation to core damane: For Class I and III sequences, core damage i occurs about one hour after accident initiation, and RPV failure occurs after one additional hour.

The only exceptions are the "long-term" station blackout st.quences, where the time of core damage is delayed by the time for battery depletion (4-8 hours). The release time for these SBO sequences is classified as intermediate or late.

The time of containment failure: For Class II, IllD and IV sequences, containment failure occurs before core damage. In addition, core damage occurs within one hour after containment failure.

Thus, the release time is determined principally by the time of containment failure, and is classified as late for Class II and early for Class IIID and IV sequences.

The magnitude of release depends on the following factors:

1. Reactor buildine effectiveness: The effect of the reactor building is to reduce the release to the environment. High releases become medium, medium releases become low, and low releases become low-low. >

2. Containment failure mode: Containment failure modes which involve suppression pool bypass result in higher releases than failure modes where the release is scrubbed by the ;

suppression pool.

3. Containment failure < ire: The size of containment failure can affect the release magnitude, especially for wetwell airspace failures with suppression pool scrubbing.

4. Availability of water for debris coolina: The availability of water to quench and cool the debris is a significant factor that affects Core Concrete Interactions (CCI) releases, especially for drywell failures.

5. Tvoe of core damane: The Level 1 endstate class plays a role in determining the magnitude of releases.

Generic Letter 88-20 states that "any functional sequence that has a core damage frequency greater than or equal to 104 per reactor year and that leads to containment failure which can !

result in a radioactive release magnitude greater than or equal to the BWR-3 or PWR-4 release i categories of WASH-1400," or "any functional sequences that contribute to a containment bypass frequency of 104 per reactor year," should be reported. Table 4.6-3 of the submittal provides a listing of the top one hundred core damage sequences leading to radionuclide release. From ,

this table, it can be seen that there are no release categories identified as having frequencies I greater than 104 per reactor year and having Csl releases comparable to the BWR-3 category of WASH-1400 [4]. In addition, there are no bypass sequences that have a CDF of 10r7 per reactor year. Two bypass sequences (a large break and a small break in the LPCI/RHR piping in the reactor building) have a CDF exceeding 10-8 per reactor year. The submittal goes beyond

)

i Verrnout Yankee IPE Back-End Review 17 ERl/NRC 94-111 4

the reporting requirements, and has reported all sequences with Csl releases greater than 0.1 %

and release frequency greater than 3.9 x 104 per reactor year. In addition, all bypass sequences with release frequencies greater than 104 are also reported. A list of all these sequences is found in Table 4.6-3 of the submittal. Hence, it appears that the IPE submittal has met or l exceeded the requirements for reporting the radionuclide releases set by Generic Letter 88-20.

Two points are to be noted. First, the submittal has determined that only Csl source terms are necessary to be reported for the purposes of the IPE. This appears to be consistent with the NRC's recent position on IPE reporting requirements. However, source terms associated with other radionuclide species are important for development of a fuller understanding of severe accident behavior. The other note pertains to the definition of the timing of releases. The time of release is evaluated from the time of accident initiation, and not from the time of core damage. In many accident sequences, even though containment failure may occur beyond 24 l hours after accident initiation, it may occur only a few hours after core damage. Thus, there is insufficient time for fission product releases to be removed by natural processes, such as deposition, and the releases associated with late containment failure may be large. It appears that some of the release bins classified as " late" should really be classified as "early" or

" intermediate". However, a number of release categories, particularly those corresponding to j the drywell overtemperature mode of failure (which, according to the submittal, occurs within j six hours after accident initiation) are classified as early releases. Although the classification i of the release timing is incorrect, the use of the second descriptor in the fission product release I definition (magnitude of release) provides additional information on the characteristics of the release. Most of the releases associated with intermediate and even late containment failure (i.e., those resulting from loss of decay heat removal) are in the range of 1 to 10% of the iodine inventory, which is believed to be relatively conservative.

2.3 Quantitative Assessment of Accident Progression' and Containment Behavior 2.3.1 Severe Accident Progression i

MAAP-BWR 3.0B was the principal tool used to analyze postulated severe accidents at Vermont Yankee. The actual MAAP input file is not provided in the submittal. More than 70 MAAP calculations were performed for Level 2 analyses. Table 4.2.1 of the submittal provides a brief summary of the analyses performed and key results. A discussion of MAAP results for five sample, important, accident sequences is provided in Section 4.6 of the submittal. A review of the five accident sequences discussed in Section 4.6 of the submittal is provided in this section.

l l

Class IA sequences refer to accident sequences that involve loss of coolant makeup with the RCS I

at high pressure. The timings of key events calculated using MAAP are as follows:

Core Uncovery 0.65 hours7.523148e-4 days 0.0181 hours 1.074735e-4 weeks 2.47325e-5 months l Core Damage 1.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months RPV failure 3.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Containment Failure 16.9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months Vermont Yankee IPE Back-End Review 18 ERI/NRC 94-111 l

l l . - _

The MAAP results for drywell pressures and temperatures are shown in Figures 4.2.1 and 4.2.2 of the submittal. The drywell pressure increases to more than 70 psig at vessel breach, but increases slowly after vessel breach, rising to 88 psig over a period of nearly 13 hours1.50463e-4 days 0.00361 hours 2.149471e-5 weeks 4.9465e-6 months . It appears that either containment flooding or drywell sprays were used to limit containment pressurization in the late phase of the accident.

Class ID sequences refer to accident sequences that involve loss of RPV makeup, depressurization of the RPV, but with no low pressure injection available. The following timings were calculated using the MAAP code:

Core Uncovery 0.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months Core Damage 1.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months RPV failure 2.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months Containment Failure 26.9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months Containment pressurization after vessel breach is slow (4 psig/ hour), and containment failure occurs late in the accident scenario .

Class Il sequences refer to accident sequences that involve loss of containment heat removal, and are similar to the TW sequences as defined in WASH-1400. The following timings were calculated using the MAAP code for this class of sequences:

Core Uncovery 52.1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Core Damage 54.8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months RPV failure 57.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Containment Failure 51.8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Class III sequences refer to large LOCA sequences. The key event timings for this class of accident sequences, calculated using the.MAAP code, are the following:

Core Uncovery 0.02 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Core Damage 0.38 hours4.398148e-4 days 0.0106 hours 6.283069e-5 weeks 1.4459e-5 months RPV failure 1.1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Containment Failure 3.51 hours5.902778e-4 days 0.0142 hours 8.43254e-5 weeks 1.94055e-5 months Class IV sequences are ATWS transients, and involve containment failure prior to core damage.

The timings of various events calculated by MAAP for this sequence class are provided below, and appear to be comparable to results calculated in NUREG/CR-4624 [5] for the Peach Bottom plant:

Core Uncovery 0.67 hours7.75463e-4 days 0.0186 hours 1.107804e-4 weeks 2.54935e-5 months Core Damage 1.24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months RPV failure 4.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Containment Failure 0.67 hours7.75463e-4 days 0.0186 hours 1.107804e-4 weeks 2.54935e-5 months Vermont Yankee IPE Back-End Review 19 ERI/NRC 94-111

The audit of MAAP calculations for the five important accident sequences indicate that there are differences between the MAAP results and those reported in the literature, especially for the time of containment failure (from the time of vessel breach). The differences appear to be due to the treatment of MCCI and heat transfer from core debris to an overlying pool of water.

Some important phenomena, such as liner attack and meltthrough, ex-vessel steam explosions, DCH, etc., are not modelled by MAAP, and this is realized by the licensee; however, they are treated probabilistically, using results available in the literature.

A number of sensitivity calculations were performed, both for'the purpose of evaluating severe accident phenomena, and for evaluation of source terms. However, it is not clear what uncertain phenomena were investigated by the sensitivity analyses listed in Table 4.2.1. The number of sensitivity analyses performed is very limited, and many of the recommended sensitivity analyses in the EPRI document [6] were not performed. The lack of sensitivity analyses for severe accident simulations is one of the shortcomings of the submittal.

2.3.2 Dominant Contributors to Containment Failure Table 4 shows a comparison of the conditional probabilities of the containment failure modes provided in the Vermont Yankee IPE submittal, together with the results of the IPE submittals for the Fitzpatrick and Pilgrim plants, as well as the NUREG-1150 study for Peach Bottom [7].

Table 5 provides the C-matrix for the Vermont Yankee plant. From a review of Table 4, it is seen that the 'only major difference between Vermont Yankee and the Peach Bottom plant (NUREG-1150 analysis), is that Vermont Yankee has a slightly lower conditional probability of early containment failure, and a correspondingly higher probability of late containment failure.

This difference is discussed below.

The core damage profile in the Vermont Yankee IPE submittal is somewhat different from the Peach Bottom plant. The definition of "early" and " late" releases are also different. However, the differences in the definitions are significant only for the TW sequences (i.e., Accident Classes IIA, IIL, and IIV in the IPE submittal), and, to a lesser exten'., for the long term station blackout sequences. All the TW sequences in the Vermont Yankee :.PE submittal are classified as " late" containment failures (see Table 5 of this review). TW sequences and V sequences were not found to be significant contributors to core damage in the Peach Bottom NUREG-1150 analyses. If the TW and V sequences are removed from the CDF profile of the Vermont Yankee IPE submittal, the remaining accident classes have a 0.53 conditional probability of early containment failure, and a 0.17 conditional probability of late containment failure. These results are then comparable with the NUREG-1150 results for the Peach Bottom plant.

However, there are containment failure mode differences between the two plants. The breakup 1 of containment failure probabilities into failure modes in the Vermont Yankee submittal is available only for early, high releases, and not for all releases. It appears that the failure mode in the Vermont Yankee plant is governed by drywell overtemperature after vessel breach, and not liner melt-through. The use of NUREG/CR-5823 [8] results for conditional probabilities of liner melt-through is one of the reasons for the differences in containment failure modes between Vermont Yankee IPE Back-End Review 20 ERI/NRC 94-111

m ilo E

Y a.

2 ,

h Table 4 Containment Failure as a Percentage of Internal Events CDF: Comparison of Vermont Yankee IPE Results to y Other BWR Mark I IPEs and Peach Bottom NUREG-1150 Results R-Containment Failure Fitzpatrick IPE Peach Bottom Pilgrim Vermont Yankee NUREG-1150 IPE IPE y

a

$- CDF (per year) 1.9 x 104 4.5 x 104 5.8 x 10-5 4.3 x 104 Early Failure 60 56 22 48 w

~

Bypass NA NA <1 1 Late Failure 26 16 61 24 Intact 3 18 1 27' No Vessel Breach 11 10 16 NA NA - Not Available

- Includes Both Intact Containment and No Vessel Breach Cases I_

h

=

l Vermont Yankee C-Matrix

~

Table 5 C

PL Release Category g PDS (% of Total CDF) laae Containment Intermediate Early Containment Intact Total w Failure Containment Failure Failure

0.735 g IA (34) 0.001 0.003 0.258 1.0 IBE (2) 1.0 1.0 r Plant IBL (14) 1.0 1.0 IC (1) 0.256 0.743 1.0 m.

g ID (9) 1.0 1.0 ce h

IIA (7) 1.0 1.0 Damage IIV (3) 1.0 1.0 y IIIA (0.1) 0.254 0.746 1.0 ,

1 IIIB (0.6) 0.322 0.678 1.0 l IIIC (3) 1.0 1.0 1.0 1.0 I State IIID (2)

IVA (13) 1.0 1.0 IVL (6) 1.0 1.0 V (3.5) 0 0 1.0 0 1.0 Totals 0.23 0.04 0.49 0.24 1.0 Includes Containment Bypass ,

m w

W C

l i

l l

the two analyses. It appears that drywell overtemperature failure within hours after vessel breach is the dominant mode of containment failure, and it appears that the licensee has conservatively classified this failure mode as early containment failure for many sequences. In summary, the licensee classification of containment failure timing, although incorrect, leads to l

conservative results, particularly in the case of drywell overtemperature failure.

i

. 2.3.3 Characterization of Containment Performance The MAAP code was used to calculate several accident progression parameters (e.g., peak pressums from quasi-static overpressurization at RPV failure). Several important phenomena, j such as ex-vessel steam explosions, Mark I shell failure, direct containment heating, recriticality 1 during core melt progression, and melt impingement induced failure, were treated

probabilistically using results from NUREG-1150, NUREG/CR-5423, and industry analyses.

The containment analyses performed for the IPE submittal are detailed, and all important modes of containment failure have been considered. However, the contribution of various containment l failure locations to the various containment failure modes are provided only for early, high I releases (Figure 4.6-15b of the submittal). The results are listed in Table 6 for understanding of the Vermont Yankee containment failure profile.

l

! In addition to the base case CET analyses, a number of sensitivity calculations have.been performed as a part of the IPE submittal. Sensitivity analyses have been performed for the following parameters:

1. RPV Depressurization: All accident sequences are assumed to be depressurized by the operator, or they are assumed to be not depressurized. The CET results show a small decrease in release frequency for the depressurization study, and vice-versa.

1 Table 6 Relative Contribution to Early Containment Failure Mode (with High Release) for the Vermont Yankee IPE Containment failure Mode Conditional Probability

, Drywell Overpressure (Early) 0.12 Liner Meltthrough 0.17 Wetwell Overpressure (Early) 0.11 Drywell Vent 0.09 :

Bypass 0.05 Drywell Overtemperature 0.45 Vennent Yankee IPE Back-End Review 23 ERI/NRC 94-111

2. Increased Credit for RHRSW: The credit for operator action to inject RHRSW into the RPV was increased by a factor of 3. The total release frequency showed only a small reduction, but the early/high release frequency showed a reduction of 10%.

3. Combustible Gas Venting: The baseline CET model takes no credit for operator action to vent combustible gases. However, assigning a split-fraction of 1.0 for operator action to vent combustible gases was found to lead to no change in the total release frequency, but a small reduction in early/high releases.

4.

hiv. Eneractic Drvwell Failures: The failure probability of drywell due to energetic events was first increased by a factor of 10, and then decreased by a factor of 10. No increase in total release frequency and early/high release frequency was observed for the former case, and a 10 % reduction in the calculated frequency of early/high releases was noted for the latter case.

5. Drvwell Sorav: Increased credit for operator action to initiate drywell sprays was found to have no effect on the release frequency, and was found to lead to a small reduction of the early/high release frequency.

6. Shell Integrity: The baseline CET analyses use a value of 2.1 x 10d for the failure probability of the shell when in contact with debris with overlying water, and assumes that the shell failure probability was 1.0 if the pedestal floor was dry. One sensitivity analysis was performed to reduce the probability of shell failure for the dry case to 0.1.

The early/high release frequency was found to reduce by 60%. The other sensitivity study assumes that the presence of water will not prevent shell failure. This assumption was found to lead to an increase of the early/high release frequency by 10%.

7. Containment Flooding: The containment flooding procedure (operator action to flood containment with RHRSW to accomplish debris submergence, and associated drywell venting) was assumed to fail. This led to a decrease in early/high release frequency.

8. Drvwell Vent: The drywell venting procedure (operator action to flood containment with RHRSW to accomplish debris submergence, and associated drywell venting) was assumed to fail. This led to a decrease in early/high release frequency.

9. Debris Ouench and Drvwell Head Failure: The split fraction assigned to the coolability j of deb:is was increased to 1, and decreased to 0. The early/high release frequency l reduced by 10% for the former case, and increased by 50% for the latter case. I

10. Torus Vent: The torus venting action was assumed to be always successful, and always failed. The results showed that a " perfect" vent decreases total releases by 10% and early releases by 5 %. In contrast, complete failure of venting was found to lead to a fivefold increase in release frequency.

Vermont Yankee IPE Back-End Review 24 ERI/NRC 94-111

. _ _ . _ _ _ _ . . . _ _ _ _~

3 2.3.4 Imoact on Eauinment Behavior Section 4.6.1 (page 4.6-1) of the submittal provides a discussion of equipment survivability under severe accident conditions. The submittal states that research studies and tests of equipment survivability were reviewed for cables, EPAs, electrical connections, solenoid valves, MOVs, motor-driven pumps, and MCCs. The reactor building is estimated to experience temperatures between 100 to 200 F in worst cases, and most components can survive this environment for tens of hours. Localized environments associated with Class V events (ISLOCA and break outside containment) were found to be the most severe, and equipment survivability for these events is accounted for in the quantification of the event trees. The licensee had also found that cable connections (terminal links) were weak links exhibiting high failure rates at 200*F, and they were removed from safety systems. Special attention was paid to the performance of the following equipment located inside the containment:

e Inboard MSIV pilot solenoid valves e MSIV drain line Motor-Operated Valves (MOVs) e 3RV pilot solenoid valves e HPCI and RCIC inboard isolation MOVs e RHR shutdown cooling MOV e Cabling, connections and electrical penetrations In addition, attention was paid to the following components in the reactor building:

e HPCI and RCIC pumps e Instrumentation (primary containment and RPV pressure / level) e ECCS injection valves (including RHRSW to RHR cross-tie valves and " alternate injection valves")

e Drywell vent valves e RHR, RHRSW and core spray motor-driven pumps e Outboard MSIV pilot solenoid valves e Motor control centers e Cabling, connections and electrical penetrations Vermont Yankee IPE Back-End Review 25 ERI/NRC 94-111

A review of industry test data was performed to establish the equipment survivability limits.

Results from plant-specific MAAP calculations were reviewed in order to establish the environmental conditions. If equipment was not expected to survive the accident conditions predicted by the MAAP code, the equipment was assumed to be failed in the fault trees.

2.4 Reducing the Probability of Core Damage or Fission Product Release 2.4.1 Definition of Vulnerability The submittal screened for vulnerabilities by comparing the IPE-calculated values for core damage frequency and frequency of large releases to the safety goals proposed by the NRC:

1. Core Damage Frequency < 104 per reactor year

2. Large Release Frequency < 104 per reactor year The CDF calculated by the Vermont Yankee IPE submittal is 4.3 x 104 per reactor year, which is less than the 10d per reactor year NRC safety goal. The submittal calecir.tes a large release frequency (early, high releases) of 9.4 x 104 per reactor year, which is nominally equal to the NRC safety goal of 104 per reactor year. The licensee concluded that, because the IPE-calculated frequencies are less than the safety goals, the IPE has identified no " vulnerabilities".

At a result, no hardware modifications are deemed appropriate based on the IPE findings.

2.4.2 Plant Modifications As stated in Section 6.2.1 of the submittal, the licensee considers that no hardware modifications are necessary based on the results of the IPE. However, the licensee identified a number of pote;.aal procedural enhancements that have "the potential to enhance our defense in-depth approach." A total of 13 procedural enhancements were identified. Two of these enhancements were based on the containment analyses, however, both of these enhancements were discarded as being not appropriate for incorporation into plant procedures. The enhancements and the reasons for their dismissal, are given below:

1. Enhancement of Emergency Action I.evel (EAL) criteria for long-term loss of containment heat removal and long-term station blackout.

These actions are stated to be under further consideration as a part of industry-wide effort for improving EAL criteria.

2. Expanding the use of drywell spray before RPV failure.

This strategy is stated to have been further explored by the BWROG Emergency Procedures Committee, and the appropriate guidelines are stated to be provided in the Emergency Procedure Guidelines.

Vermont Yankee IPE Back-End Review 26 ERI/NRC 94-111

l i

2.5 Responses to the Recommendations of the CPI Program Generic Letter 88-20, Supplement Numbers 1 and 3 [9,10] identified specific Containment Performance Improvements (CPIs) to reduce the vulnerability of containments to severe accident challenges. For BWRs with Mark I containments, the following improvements were identified:

Alternative water supply for drywell spray / vessel injection, Enhanced reactor pressure vessel depressurization system reliability.

Implementation of Revision 4 of the BWR Owners Group EPGs, and Installation of a hardened vent.

The recommendations of the CPI program have all been implemented in the Vermont Yankee plant after a containment safety study performed in 1986 [11], and they are described below:

Alternative water sunolv for drvwell sorav/ vessel iniection: Vermont Yankee has a capability to inject water to the drywell spray header or the RPV under station blackout and non-SBO conditions. Under non-SBO conditions, the alignment is from the river to the service water header, through the RHRSW to RHR crosstie, and into the RPV via the LPCI injection valves I (or to the drywell spray header via the drywell spray valves). RHR service pumps can be used I to pump the river water. However, if AC power is not available, injection is by the diesel- l driven fire pump, using an auxiliary diesel generator to power the necessary valves. Note, that l this diesel generator is different from the two emergency diesel generators which power the emergency buses. Although not stated in th:: submittal, the impact of the alternate water supply is expected to be significant, particularly in the prevention of shell melt-through and early containment failure.

Enhanced reactor oressure vessel deoressurization system reliability: Vermont Yankee has implemented a design change (circa 1986) to allow the use of the same auxiliary diesel generator mentioned above to charge station batteries. This procedure enhances plant capabilities during extended station blackout conditions by increasing the availability of DC control power for ADS valves.

Imolementation of Revision 4 of the BWR Owners Group EPGs: Vermont Yankee has incorporated revision 4 of the BWROG Emergency Procedure Guidelines (EPGs). In addition, the Vermont Yankee EOPs also include procedures for using the plant capabilities described above, such as alternate injection.

Hardened Vent: The hardened vent was discussed in Section 2.1.2. The hardened vent system has been found to be beneficial in reducing the frequency of core damage for TW sequences.

Vermont Yankee IPE Back-End Review 27 ERI/NRC 94-111

_. . ._ . -- - . - - - ~ - - - - - - - -. . - - . - - _ - -

2.6 Insights, Improvements and Commitments Section 6.0 of the submittal provides a list of plant-specific safety features identified by Vermont l Yankee Nuclear Power Corporation from the IPE submittal, and a list of plant improvements made. The submittal does not identify any particular insights, but provides a brief summary of major findings. The specific safety features that reduce the CDF and probability of releases include the following:

Vernon Tic: A dedicated tie line to the Vernon Hydroelectric station can be used to energize one l emergency bus, and greatly reduces the risk of extended station blackout accidents in the plant.

. Alternate Infection: The Vermont Yankee plant has the capability to inject river water to the ,

RPV or to the containment (through drywell sprays). A diesel-driven fire pump can be used to inject water, using an auxiliary diesel generator to power the necessary valves. The ability to inject water under SBO conditions is a sigmficant safety feature. ,

Reactor Depressurization System: Multiple sources of nitrogen for the operation of ADS, and the availability of the auxiliary diesel generator to charge. the batteries under SBO conditions, -

together improve the availability of ADS. Operation of ADS allows the operation of low-head j ECCS systems and the low-head fire water pump.

l Motor-Driven Feedwater Pumps: The Vermont Yankee plant has a motor-driven feedwater l pump, and if AC power is available, high pressure injection can be provided using the feedwater l system, even if the MSIVs are closed.

j High Turbine Bypass capacity: The Vermont Yankee plant has turbine bypass valves capable of removing 105 % of the rated steam flow. This high capacity is an important mitigating feature in an ATWS scenario. t l

Hardened Torus Vent: The hardened vent is an important mitigating feature for TW sequences.

Alternate Cooling: An alternate cooling system (for the RHR service water system) has been identified, and in this mode, water is aligned from the cooling tower basin to the suction of the (

RHRSW pumps. The alternate cooling system provides heat removal for the RHR system, cools !

circulating pumps that are needed for the operation of the main condenser, and cools pumps i needed for ECCS injection.

A number of plant improvements were made prior to, and in conjunction with, the IPE analysis. ,

They include the replacement of the uninterrupted power supply for the LPCI injection valves, improvement of the SRV and MSIV pneumatic components, replacement of instrument air compressors, upgrade of RHRSW MOVs, and some changes in control power configuration to l make use of the Vernon tie. Improvements based on the IPE submittal, were discussed in i Section 2.4.2 of the TER. No plant modifications based on the back-end analyses are planned.

l Vermont Yankee IPE Back-End Review 28 ERl/NRC 94111 l l

l l

i

3. OVERALL EVALUATION AND CONCLUSIONS 4

The back-end portion of the Vermont Yankee IPE submittal pmvides a substantial amount of information in regard to the subject areas identified in Generic Leser 88-20 and NUREG-1335.

4 The PRA methodology used for the back-end analysis is basically sound, capable of identifying plant-specific vulnerabilities to release of radionuclide material, and includes all key phenomenological issues. The following are the major findings of the Vermont Yankee IPE l; submittal:

i

No single accident sequence represents an unusually large fraction of CD. Sequences i

such as SBO and ATWS are not the primary contributors to the CDF (even though they l do contribute to the CDF), owing to unique capabilities, such as the ability to inject 2

water using the diesel fire pump, and the ability to energize an emergency bus through

a tie to the Vernon Hydroelectric station. Similarly, unique safety features such as l 105% turbine bypass valves and 110% main condenser capacity, help to reduce the CDF for ATWS sequences.

!

The containment analyses do not indicate an unusually poor performance for a BWR i with a Mark I containment. The conditional probability of early and late failures are O.49 and 0.24, respectively. Large releases, defined as releases of greater than 10%

j of core inventory of iodine occurring within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after accident initiation, occur with a conditional probability of 0.22.

j The principal contributors to large releases are station blackout sequences. The i dominant modes of containment failure for large releases are drywell overtemperature l and shell melt-through. l

Unique design features in the Vermont Yankee plant, such as the alternate injection 1 I l capacity, enhanced reactor depressurization system, motor-driven feedwater pumps, 105 % turbine bypass valves,110% capacity main condenser, hardened torus vent, and

]'

, alternate cooling for the station service water system, all contribute to reduced CDF and I i

frequency of releases.

4 The important points of this technical evaluation of the Vermont Yankee IPE back-end analysis are summarized as follows:

I

The Vermont Yankee IPE submittal demonstrates a good understanding of the impact

! of severe accidents on containment failure and radionuclio?. releases. The models used in the IPE Back-End analysis are technically sound.

The licensee has addressed all phenomena of importance to severe accident phenomenology in a BWR with a Mark I containment.

Vennont Yankee IPE Back-End Review 29 ERI/NRC 94-111

4 I The recommendations of the Containment Performance Improvement (CPI) program have been fully implemented in the Vermont Yankee plant.

The timing of fission product release is evaluated from the time of accident initiation, and not from the time of core damage. In many accident sequences, even though containment failure may occur beyond 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after accident initiation, it may occur only a few hours after core damage. Thus, there is insufficient time for fission product releases to be ren:cved by natural processes, such as deposition, and the releases associated wit h thte containment failure may be large.' However, a number of release categories, particularly those corresponding to the drywell overtemperature mode of failure (which, according to the submittal, occurs within six hours after accident initiation) are classified as early releases. Although the classification of the release l

timing is incorrect, the use of the second descriptor in the fission product release '

def'mition (magnitude of release) provides additional information on the characteristics of the release. Most of the releases associated with intermediate and even late containment failure (i.e., those resulting from loss of decay heat removal) are in the range of 1 to 10% of the iodine inventory, which is believed to be relatively conservative.

e The results of the containment analyses show that the only major difference between Vermont Yankee and the Peach Bottom plant (NUREG-1150 analysis), is that Vermont Yankee has a slightly lower conditional probability of early containment failure, and a correspondingly higher probability of late containment failure.

l 1

I l

Vermont Yankee IPE Back-End Review 30 ERl/NRC 94-111

4. REFERENCES

1. " Vermont Yankee Nuclear Power Station Individual Plant Examination (IPE)," Vermont Yankee Nuclear Power Station, December 1993.

2. USNRC, " Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants," NUREG-1150, Vols. I and 2, December 1990.

3. Chicago Bridge and Iron, "An Investigation of High Temperature Accident Conditions for Mark-I Containment Vessels," January 1986.

4. USNRC, " Reactor Safety Study - An Assessment of Accident Risks in U.S.

Commercial Nuclear Power Plants," WASH-1400 (NUREG-75/014), October 1975.

5. R. S. Denning et al., "Radionuclide Release Calculations for Selected Severe Accident Scenarios, BWR, Mark I Design," NUREG/Cr-4624, BMI-2139, Vol.1, July 1986.

6. Gabor, Kenton & Associates, Inc., " Recommended Sensitivity Analyses for an Individual Plant Examination Using MAAP 3.0B," EPRI TR-100167,1991.

7. " Evaluation of Severe Accident Risks: Peach Bottom, Unit 2," NUREG/CR-4551, Vol.

4, Rev.1, December 1990.

8. T. G. Theofanous, et al., "The Probability of Liner Failure in a Mark-I Containment," NUREG/CR-5423, August 1991.

9. NRC Letter to All Licensees Holding Operating Licenses and Construction Permits for Nuclear Power Reactor Facilities, " Initiation of the Individual Plant Examination for Severe Accident Vulnerabilities - 10 CFR 550.54(f)," Generic letter 88-20, Supplement No.1, dated August 29, 1989.

10. NRC Letter to All Licensees Holding Operating Licenses and Construction Permits for l Nuclear Power Reactor Facilities, " Completion of Containment Performance Improvement Program and Forwarding of Insights for Use in the Individual Plant Examination for Severe Accident Vulnerabilities - Generic Letter No. 88-20 Supplement No. 3 - 10 CFR 550.54(f)," Generic I.etter 88-20, Supplement No. 3, dated July 6, 1990.

11. Vermont Yankee Nuclear Power Corporation, " Vermont Yankee Containment Safety Study," August 1986.

12. Memorandum from R. Vijaykumar (Energy Research, Inc.) to Roy Woods (U. S.

Nuclear Regulatory Commission) dated May 5,1995.

Vermont Yankee IPE Back-End Review 31 ERI/NRC 94-111

13. " Vermont Yankee Individual Plant Examination, Response to NRC Request for Additional Information," Attachment A to Letter from James J. Duffy (Vermont Yankee Nuclear Power Corporation) to the United States Nuclear Regulatory Commission, dated October 27,1995.

l Vermont Yankee IPE Back-End Review 32 ERI/NRC 94-111 l

l l

APPENDIX A IPE EVALUATION AND DATA

SUMMARY

SHRET BWR Back-End Facts Plant Name l

Vermont Yankee Nuclear Power Station j Containment Type Mark I .

Unique Containment Features None found for the Vermont Yankee containment. However, plant-specific features of importance to severe accident progression include the following:

Vernon Tie: A dedicated tie line to the Vernon Hydroelectric station can be used to energize one emergency bus, and greatly reduces the risk of extended station blackout accidents in the plant.

Alternate Injection: The Vermont Yankee plant has the capability to inject river water to the RPV or to the containment (through drywell sprays). A diesel-driven fire pump can be used to inject water, using an auxiliary diesel generator to power the necessary valves. The ability to inject water under SBO conditions is a significant safety feature.

Reactor Depressurization System: Multiple sources of nitrogen for the operation of ADS, and the availability of the auxiliary diesel generator to charge the batteries under SBO condi ens, together improve the availability of ADS.

Operation of ADS allows the operation of low-head ECCS systems and the low-head fire water pump.

Motor-Driven Feedwater Pumps: The Vermont Yankee plant has a motor-driven ,

feedwater pump, and if AC power is available, high pressure injection can be pmvided using the feedwater system, even if the MSIVs are closed.

High Turbine Bypass Capacity: The Vermont Yankee plant has turbine bypass valves capable of removing 105 % of the rated steam flow. ,

Hardened Torus Vent: The hardened vent is an important mitigating feature for TW sequences.

Vermont Yankee IPE Back-End Review 33 ERI/NRC 94111

Alternate Cooling: An alternate cooling system (for the RHR service water system) has been identified, and in this mode, water is aligned from the cooling tower basin to the suction of the RHRSW pumps. The alternate cooling system provides heat removal for the RHR system, cools circulating pumps that are needed for the operation of the main condenser, and cools pumps needed for ECCS injection.

Unique Vessel Features None found .

Number of Plant Damage States 14 Containment Failure Pressure 140 psig (mean)

Additional Radionuclide Transport and Retention Structures Reactor building structures Conditional Probability 'Ihat the Containment Is Not Isolated Not provided Important Insights, Including Unique Safety Features See Section 4 of the review.

Implemented Plant Improvements Imorovements made orior to the issuance of the Generic Letter 88-20 Alternative water supply for drywell spray / vessel injection, Enhanced reactor pressure vessel depressurization system reliability, Implementation of Revision 4 of the BWR Owners Group EPGs, and Installation of a hardened vent.

A number of procedural modifications are under cor. sideration.

Vennont Yankee IPE Back-End Review 34 ERI/NRC 94-111

.J l

C-Matrix See Table 5 of the review.

1 l

l l

l

. 1 0

1 I

i l

l l

i l

l Vermont Yankee IPE Back-End Review 35 ERUNRC 94-111 i I

j i

)

- _ _ _ _

ML20100F086

Text

SUMMARY

SUMMARY

Navigation menu

Search