Text

NUREG-2236, Vol. 1, Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk Models-Duane Arnold, Chapters 1 to 8, Appendices a to C
	ML20300A225
Person / Time
Site:	Duane Arnold
Issue date:	10/31/2020
From:	Buell R, Shawn Campbell, Suzanne Dennis, Don Helton, Khatib-Rahbar M, Laura Kozak, Alfred Krall, Jose Pires, Frederick Sock; Energy Research, Idaho National Lab, Office of Nuclear Regulatory Research
To:	;
	K. Dickey
Shared Package
ML20300A219	List: ML20300A225; ML20300A236;
References
	NUREG-2236, Vol. 1
	Download: ML20300A225 (455)
	v • d • e

NUREG-2236 Volume 1 Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk Models-Duane Arnold Chapters 1 to 8 Appendices A to C Office of Nuclear Regulatory Research

AVAILABILITY OF REFERENCE MATERIALS IN NRC PUBLICATIONS NRC Reference Material Non-NRC Reference Material As of November 1999, you may electronically access Documents available from public and special technical NUREG-series publications and other NRC records at libraries include all open literature items, such as books, the NRCs Public Electronic Reading Room at journal articles, transactions, Federal Register notices, http://www.nrc.gov/readi ng-rm.html. Publicly released Federal and State legislation, and congressional reports.

records include, to name a few, NUREG-series Such documents as theses, dissertations, foreign reports publications; Federal Register notices; applicant, and translations, and non-NRC conference proceedings licensee, and vendor documents and correspondence; may be purchased from their sponsoring organization.

NRC correspondence and internal memoranda; bulletins Copies of industry codes and standards used in a and information notices; inspection and investigative substantive manner in the NRC regulatory process are reports; licensee event reports; and Commission papers maintained at and their attachments.

The NRC Technical Library NRC publications in the NUREG series, NRC Two White Flint North regulations, and Title 10, Energy, in the Code of 11545 Rockville Pike Federal Regulations may also be purchased from one Rockville, MD 20852-2738 of these two sources.

These standards are available in the library for reference

1. The Superintendent of Documents use by the public. Codes and standards are usually copyrighted and may be purchased from the originating U.S. Government Publishing Office organization or, if they are American National Standards, Washington, DC 20402-0001 from Internet: http://bookstore.gpo.gov American National Standards Institute Telephone: 1-866-512-1800 11 West 42nd Street Fax: (202) 512-2104 New York, NY 10036-8002 http://www.ansi.org

2. The National Technical Information Service (212) 642-4900 5301 Shawnee Road Alexandria, VA 22161-0002 http://www.ntis.gov Legallybinding regulatoryrequirements are stated only 1-800-553-6847 or, locally, (703) 605-6000 in laws; NRC regulations; licenses, including technical specifications; or orders, not in NUREG-series publications. The views expressed in contractor-A single copy of each NRC draft report for comment is prepared publications in this series are not necessarily available free, to the extent of supply, upon written those of the NRC.

request as follows:

The NUREG series comprises (1) technical and U.S. Nuclear Regulatory Commission administrative reports and books prepared bythe staff Office of Administration (NUREG-XXXX) or agency contractors Multimedia, Graphics and Storage & Distribution Branch (NUREG/CR-XXXX), (2) proceedings of conferences Washington, DC 20555-0001 (NUREG/CP-XXXX), (3) reports resulting from E-mail: distribution.resource@nrc.gov international agreements (NUREG/IA-XXXX), (4) brochures (NUREG/BR-XXXX), and (5) compilations of Facsimile: (301) 415-2289 legal decisions and orders of the Commission and Atomic and Safety Licensing Boards and of Directors Some publications in the NUREG series that are decisions under Section 2.206 of NRCs regulations posted at the NRCs Web site address (NUREG-0750).

http://www.nrc.gov/reading-rm/doc-collections/nuregs are updated periodically and may differ from the last DISCLAIMER: This report was prepared as an account of printed version. Although references to material work sponsored byan agency of the U.S. Government.

found on a Web site bear the date the material was Neither the U.S. Government nor any agency thereof, nor any employee, makes anywarranty, expressed or implied, accessed, the material available on the date cited or assumes anylegal liabilityor responsibilityfor any third may subsequently be removed from the site. partys use, or the results of such use, of any information, apparatus, product, or process disclosed in this publication, or represents that its use by such third party would not infringe privately owned rights.

SR-CR 10/2017

NUREG-2236 Volume 1 Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk Models-Duane Arnold Chapters 1 to 8 Appendices A to C Manuscript Completed: May 2019 Date Published: October 2020 Prepared by:

S. Campbell,1 S. Dennis,1 D. Helton,1 L. Kozak,1 J. Pires,1 F. Sock1 M. Khatib-Rahbar,2 A. Krall2 R. Buell3 U.S. Nuclear Regulatory Commission1 Energy Research, Inc.2 P.O. Box 2034 Rockville, MD 20847 Idaho National Laboratory3 P.O. Box 1625 Idaho Falls, ID 83415 Office of Nuclear Regulatory Research

ABSTRACT This report extends the work documented in NUREG-2187, Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk Models Byron Unit 1, issued January 2016, to the Duane Arnold Energy Center. Its purpose is to produce an additional set of best estimate thermal-hydraulic calculations that can confirm or enhance specific success criteria for system performance and operator timing found in the agencys probabilistic risk assessment tools. Along with enhancing the technical basis for the agencys independent standardized plant analysis risk (SPAR) models, these calculations are expected to be a useful reference to model end users for specific regulatory applications.

This report first describes major assumptions used in this study. It then discusses the major plant characteristics for the Duane Arnold Energy Center, in addition to the MELCOR model used to represent the plant. Finally, the report presents the results of MELCOR calculations for selected initiators and compares these results to SPAR success criteria, the licensees success criteria, or other generic studies.

The study results provide additional timing information for several probabilistic risk assessment sequences, confirm many of the existing SPAR modeling assumptions, and give a technical basis for a few specific SPAR modeling changes, including the following potential changes:

Degraded high-pressure injection and relief valve Criteria (non-anticipated transient without scram): A single control rod drive pump injecting at the postscram increased injection rate is sufficient for reactor pressure vessel (RPV) water inventory makeup.

Additionally, two control rod drive pumps injecting at the postscram injection rateprovide enough makeup to the RPV to facilitate a cooldown of the RPV to cold shutdown conditions. This increased injection is currently not queried in the SPAR models but could be added.

Mitigating strategies usage: If diverse and flexible coping strategies (FLEX) are not available, success of long-term cooling for these scenarios is only possible with both anticipatory venting and condensate storage tank (CST) availability. Currently, CST availability is not queried in the SPAR models. This could be added for scenarios for which no alternate injection is available. For loss-of-offsite-power scenarios, FLEX injection led to success in all scenarios that gave FLEX credit. Given the ability of FLEX to prevent core damage, this confirms that the SPAR models should have FLEX equipment added.

Emergency core cooling system injection following containment failure or venting:

Depending upon the size of containment failure, wetwell and drywell pressure will fall, potentially to the point of allowing high-pressure injection restart following its loss. This action could be added to the SPAR models.

Safe and stable end-state considerations: If the CST is unavailable, the long-term availability of high-pressure injection is questionable at best. CST should be queried when high-pressure injection systems are the source of long-term makeup. Additionally, increased postscram control rod drive hydraulic system injection is adequate for makeup. This increased injection is a candidate for inclusion in the SPAR model.

Depressurizing when reaching the heat capacity limit curve is important, since the rate of iii

seal leakage, as well as the rate of injection, is pressure dependent. This depressurization is a candidate for consideration in the SPAR models.

iv

FOREWORD The U.S. Nuclear Regulatory Commission (NRC) uses its standardized plant analysis risk (SPAR) models to support many risk-informed initiatives. A number of processes ensure the fidelity and realism of these models, including cross-comparison with industry models, review and use by a wide range of technical experts, and confirmatory analysis. This reportprepared by the staff of the Office of Nuclear Regulatory Research, in consultation with the staff of the Office of Nuclear Reactor Regulation; experts from Energy Research, Inc. and Idaho National Laboratory; and the agencys senior reactor analystsrepresents a major confirmatory analysis activity.

Probabilistic risk assessment (PRA) models for nuclear power plants rely on underlying modeling assumptions known as success criteria and sequence timing assumptions. These criteria and assumptions determine what combination of system and componentavailabilities will lead to postulated core damage, as well as the timeframes during which components must operate or operators must take particular actions. This report investigates certain thermal-hydraulic aspects of a particular SPAR model (which is generally representative of other models within the same class of plant design), with the goal of further strengthening the technical basis for decisionmaking that relies on the SPAR models. This report augments the existing collection of contemporary Level 1 PRA success criteria analyses and, as such, supports (1) maintaining and enhancing the SPAR models that the NRC develops, (2) supporting the NRCs risk analysts when addressing specific issues in the accident sequence precursor program and the significance determination process, and (3) informing other ongoing and planned initiatives. This analysis employs the MELCOR computer code and uses a plant model developed for this project.

The analyses summarized in this report provide the basis for confirming or changing success criteria in the SPAR model for the Duane Arnold Energy Center. Based on further evaluation, these results could apply to similar plants, while future analyses could apply to other design classes, as occurred in the past (see NUREG-2187, Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk ModelsByron Unit 1, issued January 2016). The staff expects to continue its focus on confirming success criteria and other aspects of PRA modeling using its state-of-the-art tools (e.g., the MELCOR computer code) as it develops and improves its risk tools.

v

TABLE OF CONTENTS ABSTRACT ................................................................................................................................. iii FOREWORD .................................................................................................................... v LIST OF FIGURES .......................................................................................................... ix LIST OF TABLES ........................................................................................................... xi ACKNOWLEDGMENTS ................................................................................................xiii ABBREVIATIONS AND ACRONYMS ........................................................................... xv 1 BACKGROUND........................................................................................................ 1-1 1.1 Confirmatory Success Criteria Project ............................................................................. 1-1 1.2 Hazard, Mode, and Radiological Source Scope .............................................................. 1-2 1.3 Issues To Be Investigated ............................................................................................... 1-2 1.4 Plant Selection ................................................................................................................ 1-3 2 MAJOR ASSUMPTIONS AND PEER REVIEW DESCRIPTION .............................. 2-1 2.1 Major Assumptions .......................................................................................................... 2-1 2.2 Description of the DAEC MELCOR Model ....................................................................... 2-3 2.3 Shakedown and Benchmarking of the DAEC MELCOR Model ....................................... 2-7 2.3.1 Steady State ...................................................................................................... 2-7 2.3.2 Comparison to Select Licensing-Basis Analysis ................................................ 2-8 2.3.3 Application of the Baseline Small Loss-of-Coolant-Accident Sequence ............ 2-8 2.3.4 Application of the Baseline FLEX Sequence ................................................... 2-11 2.3.5 Application of a Baseline Station Blackout Sequence ..................................... 2-18 2.3.6 Updated Shakedown Based upon Latest Deck Revision ................................ 2-24 3 SUCCESS CRITERIA FOR SITUATIONS WITH DEGRADED HIGH-PRESSURE INJECTION AND RELIEF VALVE CRITERIA FOR NON-ANTICIPATED TRANSIENT WITHOUT SCRAM ................................................................................... 3-1 3.1 Issue Description ............................................................................................................. 3-1 3.2 Transient Sequence ........................................................................................................ 3-3 3.2.1 Calculation Matrix Development ........................................................................ 3-3 3.2.2 MELCOR Simulation Results............................................................................. 3-7 3.3 Small Loss-of-Coolant Accident Sequence......................................................................... 3-11 3.3.1 Calculation Matrix Development ....................................................................... 3-11 3.3.2 MELCOR Simulation Results ........................................................................... 3-13 3.4 Conclusions Drawn from MELCOR Results ................................................................... 3-16 4 MITIGATING STRATEGIES (FLEX) USAGE IN LOSS-OF-ALTERNATING-CURRENT-POWER SCENARIOS ............................................................................. 4-1 4.1 Issue Description .............................................................................................................. 4-1 4.1.1 DAEC Post-Fukushima Actions Related to Mitigating Strategies ....................... 4-2 4.1.2 The Scenario Assumed for Mitigating Strategies Formulation ............................ 4-2 4.1.3 DAEC Plant Modifications To Comply with the Post-Fukushima Orders ............ 4-4 vii

4.2 Station Blackout Sequence .............................................................................................. 4-6 4.2.1 Calculation Matrix Development .........................................................................4-6 4.2.2 MELCOR Simulation Results ...........................................................................4-10 4.3 Loss-of-Main-Feedwater Sequence ...............................................................................4-14 4.3.1 Calculation Matrix Development ....................................................................... 4-14 4.3.2 MELCOR Simulation Results ........................................................................... 4-18 4.4 Conclusions Drawn from MELCOR Results ................................................................... 4-22 5 EMERGENCY CORE COOLING SYSTEM INJECTION FOLLOWING CONTAINMENT FAILURE OR VENTING................................................................. 5-1 5.1 Issue Description ............................................................................................................. 5-1 5.2 Station Blackout Sequence ............................................................................................. 5-3 5.2.1 Calculation Matrix Development ........................................................................ 5-3 5.2.2 MELCOR Simulation Results ............................................................................5-5 5.3 Loss-of-Main-Feedwater Scenario ................................................................................5-10 5.3.1 Calculation Matrix Development ...................................................................... 5-10 5.3.2 MELCOR Simulation Results .......................................................................... 5-12 5.4 Conclusions Drawn from MELCOR Results .................................................................. 5-16 6 SAFE AND STABLE END-STATE CONSIDERATIONS .......................................... 6-1 6.1 Issue Description .............................................................................................................6-1 6.2 Station Blackout Sequence ............................................................................................. 6-2 6.2.1 Calculation Matrix Development ........................................................................6-2 6.2.2 MELCOR Simulation Results ........................................................................... 6-4 6.3 Loss-of-Main-Feedwater Scenario ..................................................................................6-7 6.3.1 Calculation Matrix Development ........................................................................6-7 6.3.2 MELCOR Simulation Results ........................................................................... 6-8 6.4 Conclusions Drawn from MELCOR Results ..................................................................6-11 7 APPLICATION OF MELCOR RESULTS TO SPAR MODEL ................................... 7-1 8 CONCLUSIONS ....................................................................................................... 8-1 9 REFERENCES ......................................................................................................... 9-1 APPENDIX A MELCOR VERSIONS.......................................................................... A-1 APPENDIX B CONTAINMENT VENTING.................................................................. B-1 APPENDIX C CHAPTER 3 FIGURES......................................................................... C-1 APPENDIX D CHAPTER 4 FIGURES......................................................................... D-1 APPENDIX E CHAPTER 5 FIGURES ......................................................................... E-1 APPENDIX F GRADUAL OVERPRESSURE FAILURE MODES AND LOCATIONS IN MARK I, MARK II, AND MARK III CONTAINMENT SYSTEMS .................................................................. F-1 APPENDIX G CHAPTER 6 FIGURES ......................................................................... G-1 APPENDIX H EVENT TREES ..................................................................................... H-1 viii

LIST OF FIGURES Figure 2-1 Recirculation Line Coolant Temperature during Controlled Depressurization of the RCS ....................................................................................................................2-14 Figure 2-2 RPV Pressure (Case 1) ......................................................................................... 2-16 Figure 2-3 RCIC Flow (Case 1) .............................................................................................. 2-16 Figure 2-4 Drywell Pressure (Case 1) .................................................................................... 2-17 Figure 2-5 Wetwell Water Temperature (Case 1) ................................................................... 2-17 Figure 2-6 FLEX Pump Flow (Case 1) ................................................................................... 2-18 Figure 2-7 Wetwell Water Temperature (NRC) ...................................................................... 2-22 Figure 2-8 Containment Pressure (NRC) ...............................................................................2-22 Figure 2-9 Vessel Water Levels (NRC) ..................................................................................2-23 Figure 2-10 FLEX Pump Flow (NRC) ...................................................................................... 2-23 Figure 2-11 RPV Pressure (Case 1, Updated) ........................................................................ 2-25 Figure 2-12 RCIC Flow (Case 1, Updated).............................................................................. 2-25 Figure 2-13 Drywell Pressure (Case 1, Updated) .................................................................... 2-26 Figure 2-14 Wetwell Water Temperature (Case 1, Updated) .................................................. 2-26 Figure 2-15 FLEX Pump Flow (Case 1, Updated) ................................................................... 2-27 ix

LIST OF TABLES Table 1-1 Major Plant Characteristics for DAEC .................................................................... 1-3 Table 2-1 Major Assumptions in the MELCOR Calculations .................................................. 2-1 Table 2-2 Structures Included in the DAEC MELCOR Model ................................................ 2-3 Table 2-3 Systems Included in the DAEC MELCOR Model ................................................... 2-4 Table 2-4 Other Components Included in the DAEC MELCOR Model................................... 2-5 Table 2-5 Operator Action Surrogates Included in the DAEC MELCOR Model ..................... 2-5 Table 2-6 Default MELCOR Modeling Values ........................................................................ 2-5 Table 2-7 Comparison of MELCOR-Predicted Steady-State to Plant Conditions .................. 2-7 Table 2-8 Boundary Conditions for LOOP/SLOCA Validation Calculation ............................. 2-9 Table 2-9 Boundary Conditions for the FLEX Validation ...................................................... 2-13 Table 2-10 Boundary Conditions for the SBO Validation ....................................................... 2-14 Table 2-11 Timing of Important Events for SBO Validation .................................................... 2-20 Table 3-1 PRA Sequences of Interest for DepressurizationTRANS ................................... 3-4 Table 3-2 Calculation MatrixHPI and SRV Criteria for Non-ATWSTRANS ..................... 3-4 Table 3-3 Initial and Boundary ConditionsHPI and SRV Criteria for Non-ATWS TRANS ..................................................................................................................3-5 Table 3-4 Timing of Significant Events and the Maximal Peak Cladding Temperature Reached in the TRANS-30 with Nominal CRDHS Injection ...................................3-8 Table 3-5 Sensitivity Study MatrixHPI and SRV Criteriafor Non-ATWS ...........................3-10 Table 3-6 PRA Sequences of Interest for DepressurizationSLOCA ................................. 3-11 Table 3-7 Calculation MatrixHPI and SRV Criteria for Non-ATWSSLOCA ................... 3-12 Table 3-8 Initial and Boundary ConditionsHPI and SRV Critera for Non-ATWS SLOCA................................................................................................................. 3-12 Table 3-9 Timing of Significant Events and the Maximal Peak Cladding Temperature Reached in the 1.8-Inch Recirculation Line SLOCA Cases .................................3-14 Table 3-10 Sensitivity Study MatrixHPI and SRV Criteria for Non-ATWS........................... 3-15 Table 4-1 SBO Sequence of Interest for FLEX-Based Diverse Injection................................ 4-6 Table 4-2 Calculation MatrixMitigating StrategiesSBO ................................................... 4-7 Table 4-3 Initial and Boundary ConditionsMitigating StrategiesLOOPGR .................... 4-10 Table 4-4 LOOPGR Results ................................................................................................ 4-10 Table 4-5 Sensitivity Study MatrixMitigating StrategiesSBO ......................................... 4-13 Table 4-6 LOMFW Sequence of Interest for FLEX-Based Diverse Injection .........................4-15 Table 4-7 Calculation MatrixMitigating StrategiesLOMFW-25 ....................................... 4-15 xi

Table 4-8 Initial and Boundary ConditionsMitigating StrategiesLOMFW ......................... 4-17 Table 4-9 LOMFW Results and Key Timings ......................................................................... 4-18 Table 4-10 Sensitivity Study MatrixMitigating StrategiesLOMFW...................................... 4-20 Table 5-1 Calculation MatrixECCS InjectionSBO Sequence ............................................ 5-3 Table 5-2 Initial and Boundary ConditionsECCS InjectionSBO Sequence.......................... 5-5 Table 5-3 LOOPGR Results .................................................................................................... 5-5 Table 5-4 Sensitivity Study MatrixECCS InjectionSBO Sequence .................................... 5-8 Table 5-5 Calculation MatrixECCS InjectionLOMFW Sequence..................................... 5-10 Table 5-6 Initial and Boundary ConditionsECCS InjectionLOMFW Sequence ................ 5-11 Table 5-7 LOMFW Results .................................................................................................... 5-12 Table 5-8 Sensitivity Study MatrixECCS InjectionLOMFW Sequence ............................ 5-14 Table 6-1 Calculation MatrixSafe and StableSBO Sequence ........................................... 6-2 Table 6-2 Initial and Boundary ConditionsSafe and StableSBO Sequence ...................... 6-4 Table 6-3 LOOPGR Results .................................................................................................... 6-4 Table 6-4 Sensitivity Study MatrixSafe and StableSBO Scenario. .................................... 6-6 Table 6-5 Calculation MatrixSafe and StableLOMFW Sequence ..................................... 6-7 Table 6-6 Initial and Boundary ConditionsSafe and StableLOMFW Sequence ................ 6-8 Table 6-7 LOMFW Results ...................................................................................................... 6-9 Table 6-8 Sensitivity Study MatrixSafe and StableLOMFW Scenario ............................. 6-10 Table 7-1 Mapping of MELCOR Analyses to the DAEC SPAR (8.50) Model ........................... 7-1 Table 7-2 Potential Success Criteria Updates Based on DAEC Result.................................... 7-2 xii

ACKNOWLEDGMENTS This report is the result of the efforts of many members of the U.S. Nuclear Regulatory Commission staff and the staff of its contractors, Energy Research, Inc., and Idaho National Laboratory. Furthermore, the report benefited greatly from the contributions of senior risk analysts and other selected agency staff members in specific areas of the project. The authors would especially like to recognize the support from Mahesh Chawla, James Corson, Ron Harrington, Tarek Zaki, and Joseph Staudenmeier. The authors also appreciate the assistance provided by the licensees staff at the Duane Arnold Energy Center.

xiii

ABBREVIATIONS AND ACRONYMS ac alternating current ADAMS Agencywide Documents Access and Management System ADS automatic depressurization system AIP alternate injection procedure (EOP)

ANS American Nuclear Society AOP abnormal operating procedure ASP accident sequence precursor ATWS anticipated transient without scram BWR boiling-water reactor C Celsius CD core damage CDF core damage frequency CDS condensate system CFR Code of Federal Regulations CRDHS control rod drive hydraulic system CST condensate storage tank DAEC Duane Arnold Energy Center dc direct current ECCS emergency core cooling system ED emergency depressurization EDG emergency diesel generator ELAP extended loss of ac power EOP emergency operating procedure ESF engineered safety feature ESFAS engineered safety features actuation system F Fahrenheit FLEX diverse and flexible coping strategies FSG FLEX support guideline HCL heat capacity limit HCV hardened containment vent HCVS hardened containment vent system HPCI high-pressure coolant injection HPI high-pressure injection IORV inadvertent open relief valve IPE individual plant examination ISG interim staff guidance LCO limiting condition for operation LOCA loss-of-coolant accident LOCHS loss of condenser heat sink xv

LODCA loss of vital dc bus A LODCB loss of vital dc bus B LOIAS loss of instrument air system LOMFW loss of main feedwater LOOP loss of offsite power LOOPGR loss of offsite power grid related LOOPPPC loss of offsite power plant centered LOOPWR loss of offsite power weather related LORWS loss of river water system LPCI low-pressure coolant injection LPCS low-pressure core spray LPI low-pressure injection MAAP modular accident analysis program MFW main feedwater MLOCA medium loss-of-coolant accident MSIV main steam isolation valve MSL main steamline NCV noncited violation NEI Nuclear Energy Institute NPSH net positive suction head NRC U.S. Nuclear Regulatory Commission PB Peach Bottom PCPL primary containment pressure limit PCS power conversion system PCT peak clad temperature PID proportional-integral-derivative PRA probabilistic risk assessment RCIC reactor core isolation cooling RCS reactor coolant system RHR residual heat removal RPS reactor protection system RPV reactor pressure vessel RWCU reactor water cleanup SAMP severe accident management procedure SBO station blackout SC success criterion/criteria SDP significance determination process SEP site emergency plan SFP spent fuel pool SLC standby liquid control SLOCA small loss-of-coolant accident xvi

SNL Sandia National Laboratories SP suppression pool SPAR standardized plant analysis risk SRV safety/relief valve TAF top of active fuel TRANS transient UFSAR updated final safety analysis report UHS ultimate heat sink WW wetwell xvii

1 BACKGROUND 1.1 Confirmatory Success Criteria Project The success criteria for system performance and operator timing in the U.S. Nuclear Regulatory Commissions (NRCs) standardized plant analysis risk (SPAR) models are largely based on historical analysis, such as that in NUREG/CR-1150, Severe Accident Risks: An Assessment for Five Nuclear Power PlantsFinal Summary Report (NRC, 1990), and NUREG/CR-4550, Analysis of Core Damage Frequency from Internal Events Methodology Guidelines (NRC 1987). Licensees have used a variety of methods to determine success criteria, including conservative design-basis analyses and more realistic best estimate methods. Consequently, in some situations, plants that should behave similarly from an accident sequence standpoint have different success criteria for specific scenarios. In addition, concerns periodically arise when reviewing licensee sequence timing and success criteria analyses in the course of performing event or condition risk assessments that could be better resolved with an updated set of thermal-hydraulic success criteria calculations. For these reasons, this report investigates particular success criteria and sequence timing issues of interest for the boiling-water reactor (BWR)/4 Mark 1, using the Duane Arnold Energy Centers (DAECs) model. This report continues work previously documented for other plant type and scenario pairings in NUREG-1953, Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk ModelsSurry and Peach Bottom, issued September 2011 (NRC, 2011a); NUREG/CR-7177, Compendium of Analyses to Investigate Select Level 1 Probabilistic Risk Assessment End-State Definition and Success Criteria Modeling Issues, issued May 2014 (NRC, 2014a); and NUREG-2187, Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk ModelsByron Unit 1, issued January 2016 (NRC, 2016a).

As noted, this analysis uses the DAEC model. The staff chose this plant because, although it has a lower power, it is reasonably representative of the BWR/4 Mark 1. Specifically, DAEC is generally similar to the following other plants:

Browns Ferry Units 1, 2, and 3

Brunswick Units 1 and 2

Cooper

Dresden Units 2 and 3

Hatch Units 1 and 2

Fermi Unit 2

Hope Creek Unit 1

FitzPatrick

Monticello

Nine Mile Point Unit 1

Oyster Creek

Peach Bottom (PB) Units 2 and 3

Pilgrim

Quad Cities Units 1 and 2

Vermont Yankee 1-1

However, all of these plants have design, operational, and licensing differences that should be considered before applying the results of this study to them.

1.2 Hazard, Mode, and Radiological SourceScope As of model version 8.50, the DAEC SPAR model includes Level 1 at-power internal events, internal flooding, internal fire, tornado, and seismic initiators. These are all considered potentially within the scope of this project, although actual modeling may vary. Conversely, other hazards, Level 2 and Level 3 probabilistic risk assessments (PRAs), and the spent fuel pool (SFP) are all outside the project scope.

1.3 Issues To Be Investigated This report is not intended to comprehensively confirm all success criteria within the chosen plants SPAR model but rather to focus on particular success criteria and sequence timing issues of interest to the significance determination process (SDP) and the accident sequence precursor (ASP) program, namely, those that have either been central to past analyses or that are expected to be central in upcoming analyses. It is often the case that modeling assumptions important to particular event or condition assessments are not also important in the baseline PRA, so it should be understood that examination of an issue here does not necessarily mean that it is a risk-significant issue in the overall plant risk. However, the types of assumptions that are made when determining plant success criteria can have a significant impact on the calculated risk profile and, therefore, on the outcome of the agencys risk-informed activities, such as SDP and ASP insights (i.e., green versus white findings).

From a spectrum of possible issues to be investigated, and in consultation with the NRCs risk analysts, researchers selected four issues (or categories of issues), as follows:

degraded high-pressure injection (HPI) and relief valve criterion for non-anticipated transient without scram (ATWS) scenarios

mitigating strategies (namely diverse and flexible coping strategies (FLEX)) usage in loss of alternating current (ac) power and otherscenarios

emergency core cooling system (ECCS) injection following containment failure or venting

safe and stable end-state considerations Each of these issues is the topic of a specific section of this report. Each section starts by describing the basic issue or set of issues, lays out the calculations performed to investigate the issue(s), provides the results of those simulations, and draws conclusions with respect to PRA modeling.

The details of the scenarios to be considered appear later, but an example of a real-world situation that might benefit from the investigations in this report is the failure of the automatic condensate storage tank (CST) switchover for high-pressure coolant injection (HPCI) and reactor core isolation cooling (RCIC). During 2015, a relay at DAEC necessary to perform this function was in a degraded state, leading to a very low safety significance noncited violation (NCV) (NCV 05000331/2015004-02), as documented in the associated NRC integrated 1-2

inspection report (NRC, 2015a). The dominant (yet still small) contributor to the risk assessment was a small loss-of-coolant accident (LOCA), followed by failure of all HPI sources and the failure to depressurize and use low-pressure sources. There are fundamental mission time considerations embedded in this and most risk assessments. For instance, if a more restrictive end-state definition were used (in lieu of the notional 24-hour determination currently used in the SPAR model), would other initiators (namely, transients) now experience core damage for this same set of events? If so, and if the increase in core damage frequency (CDF) were large enough to warrant consideration of recovery in the risk assessment, would use of the FLEX equipment (assuming there was an operational basis1 for its deployment) have provided a viable alternative success path from the perspective of sequence timing and success criteria?

1.4 Plant Selection Based on input from the NRCs risk analysts, the authors determined that the BWR Mark I would be the best subject design class to pursue, in light of the relative importance of issues to be investigated and the vintage and breadth of contemporary confirmatory analyses. The authors surveyed the suite of operating BWR Mark I plants, weighing characteristics such as thermal power level; SPAR internal events station blackout (SBO) contribution; SPAR model scope, design, and operational considerations (e.g., similarity of cross-tying capabilities, number of trains of emergency power); and the utilitys engagement in risk-informed activities.

Ultimately, the authors determined that DAEC provided the best mix of these characteristics, despite having the lowest power level of all operating BWR/4 Mark I plants. Table 1-1 Major Plant Characteristics for DAEC shows the major plant characteristics for DAEC.

Table 1-1 Major plant characteristics for DAEC Characteristic Value Owner/operator NextEra Design type General Electric BWR/4 Mark I Power level 1,912 megawatts thermal (MW(t))

HPI and makeup systems RCIC HPCI Control rod drive hydraulic system (CRDHS)

Reactor water cleanup (RWCU) system (not an injection system)

Safety and safety/relief Eight total valvestwo per steamline,2 encompassing:

valves (SRVs) - two Dresser Maxiflow spring-loaded safety valves, one each on steamlines B and C

- six Target Rock SRVs, four with automatic depressurization system (ADS) function and two with low-low setpoint function Low-pressure injection Core spray (LPI) systems Low-pressure coolant injection (LPCI) mode of reactor heat removal (RHR)

Containment systems Suppression pool cooling (SPC) mode of RHR Containment spray mode of RHR Hardened containment vent system (HCVS) 1 What represents an operational basis for deployment will depend, in part, on application-specific guidance that the NRC is developing.

2 Figure 5.1-1, Sheet 1, in the final safety analysis report (FSAR) shows these valves, discussed in FSAR Section 5.2.2.4 (DAEC, 2005) .

1-3

Table 1-1 Major plant characteristics for DAEC (continued)

Characteristic Value Other wetwell (WW) and drywell venting paths Volumes in cubic meters (m3):

Drywell free * ~3,680 m3 [130,000 cubic feet3(ft3)]

volume

Suppression pool * ~1,670 to 1,740 m3 (440,000 to 460,000 gallons) water volume * ~1,514 m3 (400,000 gallons) (both tanks combined) *

CSTs water inventory Licensed method for 4-hour coping time, based on NUREG-1776, Appendix B (NRC, 2003) compliance with Title 10 of the Code of Federal The initial actions are the same for 10 CFR 50.63 and FLEX, based on Regulations the licensees integrated plan in response to EA-12-049 (NRC, 2012a).

(10 CFR) 50.63, Loss of All Alternating Current Power (the SBO rule)

The value cited here is from page 6.3-8 of the UFSAR. DAEC actually has two CSTs that are always interconnected. The technical specification limit on CST inventory is significantly lower that this value and relates to CS suction requirements (level 3.4 meters [11 feet] in one tank or 2.1 meters [7 feet] in both tanks).

Safety valves discharge directly to the drywell and have no restrictions. The SRVs discharge into the suppression pool through a discharge pipe on each valve. The SRVs are nitrogen operated. The solenoids controlling the nitrogen supply are powered from the 120-volt (V) instrument ac bus. On loss of power from one bus, the load can be manually transferred to the alternate essential bus. On the receipt of a containment isolation signal, the nitrogen supply isolation valves close, and the basic valve logic does not permit reopening until the isolation signal is cleared. Isolation override circuitry and separate control switches for the isolation valves defeat the isolation logic and provide safety-grade power to the isolation valves to allow opening. The two non-ADS SRVs include a low-low setpoint function that modifies the automatic opening and closing relief set points following any SRV opening at its normal steam pilot setpoint to mitigate the induced high-frequency loads on the containment and thrust loads on the SRV discharge lines (see UFSAR Sections 5.4.13.2 and 7.6.5).

More information about DAECs design and operation appears throughout the remainder of the report and, in particular, in Section 2.3.5 The environmental report associated with license renewal (DAEC, 2008a) contains a dated (circa 2008) synopsis of the DAEC PRA development history and the current (at that time) estimated risk profile (e.g., dominant initiators, Fussel-Vesely importance measures).

1-4

2 MAJOR ASSUMPTIONS AND PEER REVIEW DESCRIPTION 2.1 Major Assumptions Assumptions made during the conduct of this study are documented throughout this report. For example, assumptions related to particular calculations are discussed in the section where those calculations are documented. Table 2-1 collects major assumptions into one table.

Table 2-1 Major assumptions in the MELCOR calculations Category Assumption Comments General A core damage This selection has been previously justified for this type surrogate of peak nodal of MELCOR analysis (see Section 2 of NUREG-2187 temperature equal to [NRC, 2016a]).

1,204 degrees Celsius (degrees C)

(2,200 degrees Fahrenheit [degrees F])

is used.

Wetwell water is well The wetwell model is not set up to capture thermal mixed within each stratification. However, the SRV outlet is low in the azimuthal node. wetwell, so thermal stratification is not expected to be significant in the scenarios modeled in this report because of mixing induced by SRV operation.

Power conversion The turbine and condenser are not modeled in detail.

[steam] system (PCS) is They are simply modeled as a heat/energy sink for not modeled in detail. steam passing through the steamlines.

Unless otherwise stated, A train of feedwater/condensate is needed for the a loss of feedwater also condenser to be available long term, since the results in an eventual condenser tubes will eventually be covered and steam loss of the PCS for condensation would not be effective.1 pressure control.

The CRDHS injection The CRDHS pump is able to inject at an increased rate rate is not increased by but the postscram increase is commonly discounted in default after a scram. analyses. A nominal injection rate is assumed by default of a single CRDHS pump operating at the prescram rate of 9.61 m3/hour (hr) (42.3 gallons per minute (gpm)).

LPCI and CRDHS Code-automatic modeling assumes these pumps are operated in batch turned off at Level 8 and on at Level 2. This logic is mode. regarded as modeling operator action, which is desirable to assume and credit for numerical convenience. Only enhanced CRDHS rates are given this control.

1 Unless otherwise stated, the PCS is not immediately made unavailable upon a loss of main feedwater (LOMFW). Instead, turbine bypass valves modulate closed until the main steam isolation valves (MSIVs) shut on low main steamline pressure. This MSIV closure signal was found to be not plant-actual (at DAEC, this signal is only active when the turbine is running), but the behavior it elicits; namely, the eventual loss of the condensers ability to condense steam, is thought to be. However, there is some uncertainty as to when the PCS would be lost, and the convention for the licensees PRA is to assume it is immediately unavailable.

Throughout this document, a number of sensitivity calculations include a loss of the PCS occurring simultaneously with the loss of feedwater.

2-1

Table 2-1 Major assumptions in the MELCOR calculations (continued)

Category Assumption Comments The 18-inch drywell and It is assumed that venting through the old drywell or wetwell vents are wetwell vents opens a flowpath directly to the reactor assumed to fail directly building because of a ductwork failure. The old vents into the reactor building. are unhardened and could therefore leak or rupture when demanded.

The net positive suction The NPSH available for RCIC is approximated using head (NPSH) available the equation = ( )

to RCIC/HPCI is approximated using where the loss term is derived using conditions given in dynamic wetwell the UFSAR (NPSH is 7.86 meters (25.8 feet) when conditions wetwell water temperature is 76.7 degrees C postsimulation. (170 degrees F), the wetwell water level is 3.083 meters (10.116 feet), and it is at atmospheric pressure). For HPCI, the same loss term is used with a plant-actual for .

Core modeling Axial power profile is derived from information provided by NextEra on a per-assembly basis for middle of cycle.

Bypass flow is assumed This refers to the flow that does not transit the core to be 15%. inside the fuel assembly channel boxes.

The core nodalization This is standard MELCOR modeling practice (see for consists of 10 axial example NUREG/CR-7110 [NRC, 2013b]). Given the levels, 5 radial divisions. large amount of effort required to change the nodalization, this was not investigated in a sensitivity analysis.

ECCS operation Setpoint for RCIC/HPCI In earlier versions of the MELCOR deck, there was a turbine trip on low low primary side pressure trip setpoint of 1.03 MPa reactor pressure vessel (150 pounds per square inch, differential (psid))

(RPV) pressure is between the wetwell and RPV steamlines (taken from reduced to UFSAR Table 15.0-6, p. 124/141). This was changed 0.52 megapascal (MPa) in later versions of the deck, since it did not appear to (75 pounds per square agree with what is in the emergency operating inch, gauge (psig)). procedures (EOPs) (they state that RCIC is available down to RPV pressure of 1.03 MPa [150 psig]). In addition, the RCIC system description gives an RPV pressure of 0.52 MPa (75.0 psig) as the trip setpoint for the RCIC turbine. Even though a differential pressure setpoint is more realistic, the RCIC system description and the PB precedent were followed with a trip setpoint of 0.52 MPa (75.0 psig).

Injection of the ECCS The pump is either throttled full open or is secured as pumps is operated in RPV water level reaches a lower and upper level batch mode with an setpoint (by default, Level 2 and Level 8, respectively).

expanded upper bound. Unless otherwise stated, the upper bound is expanded per EOP-1 recommendation to be just below the steamlines.

RCIC/HPCI pumps trip The flooded main steamline trip occurs when the water on high steamline level. level rises to approach the bottom of the horizontal run of the main steamline piping. This piping layout is not plant specific to DAEC. This trip is meant to capture the uncertainty associated with turbine operation with high water content in the steamlines.

2-2

2.2 Description of the DAEC MELCOR Model The DAEC model used for this analysis is based on the as-built, as-operated plant, as understood from information compiled from discussions with plant operation and engineering staff, site visits, and a review of plant documentation and operating procedures. Where information about DAEC was unavailable, the model uses applicable data from a PB MELCOR model.2 All calculations used MELCOR 2.2.9541. The MELCOR input deck used for the calculations described in this report was under active development throughout the project. This was to correct code errors, improve logic, and better reflect the as-operated plant. APPENDIX A to this report describes the code version used for each of the calculations performed for this report. In general, all of the calculations described in Chapters 3-6 used Revision 7, with minor changes made as needed.

The following tables (Tables 2-2 through Table 2-6) present a high-level capturing of the structures, systems, components, and operator action surrogates that are represented in the DAEC MELCOR model developed for this project. Understand that MELCOR simulates the thermal-hydraulic and post-core-damage behavior of the plant, in terms of the major structures, systems, components, and actions that affect this response. The MELCOR model is somewhat like the software used to support nuclear power plant simulator functionality, except that, in the case of typical MELCOR models, there is more capability in modeling the response after fuel heatup and less capability with respect to modeling support systems, normal operation, and the human-machine interface. Throughout these tables, the term relevant refers to things that are known to the MELCOR model (and thus relevant) such as RPV water level, versus things that are not known to the MELCOR model (and thus are not relevant), such as high filter/demineralizer differential pressure.

Table 2-2 Structures included in the DAEC MELCOR model Structures Comments Drywell Includes drywell walls and floor, pedestal, pedestal doorway, CRDHS removal hatch, CRDHS hydraulic pipe openings, primary vacuum breakers, main vents, normal leakage path, liner/flange failure path, and old vents.

Suppression pool Includes a pool of water, hardened vent, vacuum breakers, inlet for RCIC/HPCI/SRVs, RCIC/HPCI/RHR suction.

Reactor building Includes all levels, all major rooms, the main equipment hatch, the rail bay door, blowout panels, normal leakage, and overpressure failure (does not include the capability to analyze refueling configurations or steamline breaks).

SFP Only modeled as a tank of water with the ability to specify a volumetric heat generation rate for instances where SFP cooling would be failed (thus allowing a simplistic model of the steam generation rate for an extended loss of pool cooling occurring in conjunction with a reactor accident).

2 NUREG/CR-7110, State-of-the-Art Reactor Consequence Analyses Project, Volume 3, Peach Bottom Integrated Analysis, Revision 1, issued May 2013, used the same model.

2-3

Table 2-3 Systems included in the DAEC MELCOR model Systems Comments Nuclear steam supply Includes RPV, recirculation loops, jet pumps, core (excluding system neutronics modeling), dryers/separators Main steam Simplifiedincludes main steam isolation valves (MSIVs), flow restrictors, turbine bypass valves, abstraction of the turbines, main condenser including the hotwell, and the condensate system3 RCIC Includes emergency makeup function by modeling steam extraction and suppression pool discharge, injection from CST or suppression pool and associated depletion of water source, pump curve, control functions to mimic manual and automatic modes of operation, relevant automatic initiation logic, relevant automatic isolation logic, relevant turbine trip logic, relevant pump throttling logic, and relevant additional trip logic HPIC Includes emergency makeup function by modeling steam extraction and suppression pool discharge, injection from CST or suppression pool and associated depletion of water source along automatic switchover, pump curve, control functions to mimic manual and automatic modes of operation, relevant automatic initiation logic, relevant automatic isolation logic, relevant turbine trip logic, relevant pump throttling logic, and relevant additional trip logic CRDHS Includes pump curve and injection sources for each train; also includes option for increased postscram injection rate from one or two pumps RWCU To include normal operation suction from the bottom head and recirculation loops, return to the feedwater lines, basic differential pressure and temperature of system, relevant isolation signals, and relevant trip signals Containment spray mode of Includes pump curve and injection sources for each train RHR LPCI mode of RHR Includes pump curve and injection sources for each train and the ability to model the loop select logic for RHR injection Shutdown cooling mode of N/A, not used RHR Suppression pool cooling Simplifiedeach RHR train includes one heat exchanger, which mode of RHR removes heat from the water at a calculated rate ADS See SRVs in Table 2-4 Wetwell sprays Includes pump curve and injection sources for each train of RHR Drywell venting Includes the old, nonhardened 18-inch vent to the reactor building.

Wetwell venting Includes both the old, nonhardened wetwell 18-inch vent and the hardened wetwell vent path being used for Order EA-13-109 compliance4 (the hardened vent to the environment)

Reactor protection system Most but not all reactor trip signals (i.e., signals generated by (RPS) unmodeled aspects such as neutronics) are modeled.

Engineered safety features All relevant ESF actuation system (ESFAS) logic is modeled.

(ESFs) 3 Note that NRC training material provides a convenient pressure drop estimate of 55 psig between the RPV steam dome and the turbine control valves (NRC, 2002).

4 Based on (NextEra, 2014b), this vent is designed to remove 191.2 megawatts (MW) at a wetwell pressure of 0.37 MPa (53 psig), via a 25.4-centimeter (10-inch)-diameter pipe.

2-4

Table 2-4 Other components included in the DAEC MELCOR model Components Comments SRVs Valves modeled individually or in banks to cover the four relevant functions described in Section 5.4.13.2 of the DAEC UFSAR Main steamline (MSL) flow N/A restrictors MSIVs Includes an assumption on default closure time of 4 seconds, reflecting typical design considerations (long enough for RPS to trip the reactor to minimize a power/pressure transient but short enough to minimize inventory loss)

FLEX pump injection Includes pump curve, injection, and level control logic CST Simplifieda tank of water that automatically refills until reactor trip to mimic the condenser and feedwater systems that control CST level during normal operation Reactor building vent Includes the ability for user to open the reactor building vent damper damper located at the top of the reactor building Table 2-5 Operator action surrogates included in the DAEC MELCOR model Operator Actions Comments Heat capacity thermal limit Includes logic to automatically mimic manual operator actions to walk depressurization down the heat capacity limit (HCL) curve5 Controlled 55.6 Includes logic to automatically mimic manual operator actions to degrees C/hr (100 degrees depressurize at a cooldown rate of 55.6 degrees C/hr F/hr) depressurization (100 degrees F/hr)

Drywell and wetwell venting Includes logic to mimic operator action to vent the drywell and wetwell and maintain a user-defined target pressure band RCIC throttling Includes logic to throttle RCIC injection rate to maintain a desired level band RCIC/HPCI expanded level Includes logic for RCIC batch injection using an expanded level band control that assumes operator action to secure the pump just before level reaches the steamlines.

Table 2-6 Default MELCOR modeling values Modeling Area Parameter Value1 Reactor coolant system (RCS)

Operating pressure 7.172 MPa (1,040 psig)

Vessel free volume 297.92 m3 (10,521 ft3)

Level 8 (Hi Level) 14.059 meters (211 inches above TAF2)

Normal water level 13.652 meters (191 inches above TAF2)

Level 2 (LoLo Level) 11.735 meters (119.5 inches above TAF2)

Top of active fuel (TAF) 8.914 meters (29.25 feet)

Balance of plant Initial CST water volume 1,185.6 m3 (313,200 gal) 9.61 m3/hr (42.3 gpm) 1 All elevations are relative to the bottom of the RPV.

2 The TAF referenced here is a pre-uprate level of 28.74 feet (8.761 meters).

5 The calculations below use the summary HCL curve in EOP-2; however, the alternate HCL curves were provided.

2-5

Table 2-6 Default MELCOR modeling values (continued)

Modeling Area Parameter Value1 RHR heat exchanger water 29.4 degrees C (85 degrees F) temperature ECCS/ESF Lowest SRV relief setpoint 7.65 MPa (1,110 psid)

ADS activation 10.325 meters (33.87 feet) (Level 1)

Default RCIC level on/off 11.735 meters/13.957 meters (38.50 feet/45.79 feet)

Default HPCI level on/off 11.735 meters/13.907 meters (38.50 feet/45.63 feet)

RCIC trip setpoints:

- Flooded MSL Water in line rises above 2.3 meters (7.5 feet)

- Loss of ac/dc power

- Low MSL pressure 1.001 MPa (145.2 psid)

- High turbine exhaust 0.345 MPa (50 psig) in the wetwell pressure

- Low wetwell water level Disabled

- High wetwell water 121 degrees C (250 degrees F) temperature HPCI trip setpoints:

- Flooded MSL Water in line rises above 2.3 meters (7.5 feet)

- Loss of ac/dc power

- Low MSL pressure 1.036 MPa (150.3 psid)

- High turbine exhaust 0.965 MPa (140 psig) in the wetwell pressure

- Low wetwell water level Disabled

- High wetwell water 121 degrees C (250 degrees F) temperature HPCI suction swap-over to -12.910 meters (42.356 feet) torus on high wetwell water level RCIC injection rate 90.8 m3/hr (400 gpm)

HPCI injection rate 681.4 m3/hr (3,000 gpm)

FLEX FLEX pump injection rate Follows a provided pump curve FLEX pump shutoff head 0.758 MPa (110 psig)

Containment Initial drywell temperature 44.72 degrees C (112.5 degrees F)

Initial wetwell temperature 30.8 degrees C (87.5 degrees F)

Initial wetwell level -13.037 meters (-42.772 feet)

Other operator actions Containment venting Primary containment pressure limit (PCPL) setpoints requirement: .467 MPa (53 psig)

Anticipatory for hardened containment vent (HCV): 0.170 MPa (10 psig)

Anticipatory 18-inch drywell and wetwell vents: 0.205 MPa (15 psig) 1 All elevations are relative to the bottom of the RPV.

2-6

2.3 Shakedown and Benchmarking of the DAEC MELCOR Model 2.3.1 Steady State Before performing a MELCOR calculation, it is considered modeling best practice to perform a preaccident steady-state calculation to allow the problem to settle down to a steady state that adequately agrees with normal operations. Table 2-7 presents a number of DAEC plant-specific parameters and how MELCOR compares at the end of the 300 seconds steady-state calculation.

Table 2-7 Comparison of MELCOR-predicted steady-state to plant conditions.

Plant Parameter MELCOR Value Reference Reactor thermal power, MW(t) 1,912 Updated Final Safety 1,912 Analysis Report (UFSAR)

Figure 15.0-3 (DAEC, 2005)

RPV dome pressure, MPa 7.172 UFSAR Figure 15.0-3 7.172 (DAEC, 2005)

RPV Dome temperature, kelvin (K) - - 560.7 Saturation temperature at RPV dome 560.7 Steam tables; 560.7 pressure, K 7.172 MPa Steam flow rate, kilograms per second 1,052.3 UFSAR Figure 15.0-3 1,048.6 (kg/s) (DAEC, 2005)

Feedwater flow rate, kg/s 1,049.7 UFSAR Figure 15.0-3 1,047.2 (DAEC, 2005)

CRDHS flow rate, kg/s 2.646 UFSAR Figure 15.0-3 2.64 (DAEC, 2005)

Heat loss from cleanup/demineralizer, 2.7 UFSAR Figure 15.0-3 2.7 MW(t) (DAEC, 2005)

Feedwater temperature, K 495.0 UFSAR Figure 15.0-3 495.1 (DAEC, 2005)

Downcomer water temperature, K 551.5 UFSAR Figure 15.0-3 553.2 (DAEC, 2005)

Core channel flow rate, kg/s 6,173.9 UFSAR Figure 15.0-3 5,261.6 Core bypass channel flow rate, kg/s (for the sum) (the MELCOR sum is 914.8 6,176.4) (DAEC, 2005)

Total recirculation pump flow rate, kg/s 2,670.1 UFSAR Table 5.1-1 2,660.5 (28,035 gpm) (DAEC, 2005) per pump)

Total flow entrained into jet pumps, kg/s 3,503.8 Previous two items 3,513.2 Pressure drop across the core, bar-d 3.96 (57.4 UFSAR p. 15.3-56 3.96 psid) (DAEC, 2005)

Downcomer water level (above 13.652 Modular Accident 13.652 vessel bottom), meters Analysis Program (MAAP) variable ZWNORM 2-7

2.3.2 Comparison to Select Licensing-Basis Analysis Licensing-basis accident analysis can be helpful for ensuring that PRA-related MELCOR calculations show the expected general trends and thus for identifying errors or important omissions in the modeling. Only qualitative or semiquantitative comparisons are appropriate, in that licensing-basis analysis deliberately employs initial and boundary conditions that attempt to envelope the plants response and thus deviate from the best estimate plant response.

The shakedown calculations used Revision 5 of the DAEC MELCOR model with MELCOR 2.2.9541. In the process of performing these scenarios, minor modifications and corrections were made to the deck. Revision 6 of the DAEC model incorporated these changes, described below.

2.3.3 Application of the Baseline Small Loss-of-Coolant-Accident Sequence Section 3 addresses the modeling and analysis of sequences involving use of the small LOCA (SLOCA) equipment in more detail. Here, the SLOCA scenario that is analyzed from the UFSAR is considered as one means of validating the DAEC MELCOR model.

2.3.3.1 Baseline Sequence Narrative Coincident with the initiation of the break, a complete loss of offsite power (LOOP) is assumed to occur. Reactor coolant begins to exit the vessel rapidly into the drywell at the critical mass flux, and the reactor vessel water level begins to drop, as does the reactor pressure. The reactor is assumed to scram immediately. The emergency diesel generators (EDGs) start on the LOOP condition, and all loads are stripped off the essential ac buses. The nonessential buses are lost, leading to a loss of feedwater and a recirculation pump coastdown.

As the RPV level reaches the various level setpoints, ECCS systems are actuated (the actuation on high drywell pressure is conservatively ignored to delay injection), vessel isolation signals are generated, and LPCI loop select logic actuates to determine which recirculation loop is broken and, depending upon the assumed break size, either successfully selects the nonbroken loop (for larger breaks) or the broken loop (for smaller breaks). If the plant had previously been operating in single loop recirculation mode, loop select logic would trip the running recirculation pump and effect a short-time delay to allow it to coast down before it selects the broken recirculation loop. The reactor level continues to drop and uncovers the fuel, which begins to heat up.

Once the EDGs are up to speed, the output breaker closes on the essential ac buses, and the low-pressure ECCS pumps (and other essential loads) are sequenced onto the buses, the pumps start, and their minimum flow bypass valves open 10 minutes into the transient. The ADS actuation logic initiates on the lowering RPV level and ECCS pumps running, the ADS 2-minute time delay expires, and the valves open. Once the reactor pressure decreases to the respective permissive setpoints, the injection valves for core spray and LPCI (based upon the chosen loop-by-loop select logic) open and allow injection to begin to the RPV, which occurs 10 minutes into the transient. The injection refills the lower vessel plenum area, the water level inside the core shroud rises, and the fuel stops heating up. Water level is maintained at the top of the jet pumps and long-term recovery mode is entered.

2-8

At this point, operators activate the RHR heat exchanger in the operating RHR loop. One RHR pump at 1,090 m3/hr (4,80 gpm) is realigned so that flow goes through the heat exchanger before returning to the suppression pool. The other RHR pump is shut down. This configuration is maintained throughout the accident. The core spray pump injection to the vessel is maintained at 704.1 m3/hr (3,100 gpm).

2.3.3.2 Other Licensee Analysis Assumptions of Note An SLOCA is defined in the UFSAR as one that does not, of itself, depressurize the RCS to allow LPI but requires the use of ADS. The break size of the SLOCA varies from 9.3 cm2 (0.01 ft2) to 93 cm2 (0.1 ft2) to cover the range of small breaks.

The loss of Division II of 125V direct current (dc) is the limiting single failure for this event. This results in the loss of HPCI, B and D RHR (LPCI) pumps, and the B core spray pump. The remaining two RHR pumps are those that inject to the recirculation loop. The LPCI loop select logic determines which recirculation loop is broken and closes the chosen recirculation line. For breaks less than 465 cm2 (0.5 ft2), the selection logic is assumed to fail, and injection is, conservatively, to the broken loop.

2.3.3.3 MELCOR Analysis and Comparison to Licensee Analysis Table 2-8 includes the general boundary conditions for the LOOP scenarios. The primary difference between the two simulations described here is the break size (9.3 cm2 [0.01 ft2] and 65 cm2 [0.07 ft2]). Following the licensee approach, in the case of the smaller break, the loop selection logic is assumed to fail and injection is to the broken loop.6 The UFSAR provides no figures or timing of events for this accident and so a more qualitative comparison is made as to the MELCOR models ability to match the utilitys conclusions of a safe and stable state following the accident.

Table 2-8 Boundary conditions for LOOP/SLOCA validation calculation System Condition RCS 100% (full power)

Reactor successfully trips on first-in RPS signal or loss of offsite ac.

An SLOCA occurs at time zero (break sizes of 9.3 cm2 [0.01 ft2] and 65 cm2 [0.07 ft2]).

Balance of Offsite power is lost at time zero.

plant Turbine trip occurs upon loss of feedwater or loss of ac.

Feedwater and condensate fail at time zero.

MSIV closure occurs upon loss of offsite ac.

6 To achieve this in the current model, the B and D pumps were used instead of the actually available A and C pumps. This is a result of the way in which the MELCOR model was constructed with loop select logic in only one line. Since these pumps are identical, it is of little consequence.

2-9

Table 2-8 Boundary Conditions for LOOP/SLOCA Validation Calculation (continued)

ECCS/ESF EDGs start successfully and low-pressure ECCS is sequenced onto the buses.1 ECCS actuation is on level only.

ESF signals successfully perform their functions.

HPCI is unavailable.

RCIC is unavailable.

CRDHS and standby liquid control (SLC) are unavailable upon loss of offsite ac.

One train of LPCI/core spray is available (only A and C LPCI pumps).

Containment Suppression pool cooling is unavailable.

Nominal drywell and wetwell initial conditions are present.

Other ADS is actuated on low level.

operator actions 1 Technical specifications call for a diesel generator start and load-on in less than 10 seconds.

For the first calculation, a 65-cm2 (0.07-ft2) break occurs simultaneously with a LOOP. Upon loss of ac, the reactor scrams and MSIVs close. Feedwater, condensate, and recirculation pumps are also lost. Because of the break in the recirculation line, there is a 300 kg/s loss of coolant from the RCS and the water level in the RCS falls. The level reaches TAF at 165 seconds and bottom-of-active fuel at 290 seconds. The fuel begins to heat up, reaching a peak cladding temperature (PCT) of about 606.7 degrees C (1,224 degrees F).

EDGs are assumed to be available and are therefore up and running 10 seconds after the loss of power. LPCI is then actuated on the low RPV level but is unable to inject because of the still-pressurized RCS. The delay for ADS actuation is satisfied at 224 seconds and brings down the RCS pressure rapidly. RHRin LPCI mode7begins injecting at 370 seconds (6 minutes) drawing from the wetwell. The RCS is reflooded, and the fuel is cooled, averting cladding oxidation and damage.

Since operator action in throttling the LPCI injection is not considered, the flow rate into the vessel is much greater than that coming out of the break and back into the wetwell. The wetwell water level exceeds the high-level trip setpoint of the RHR pumps at 74 seconds and LPCI injection stops. Water continues out of the break and refills the wetwell until the code-automatic RHR recovery setpoint is reached and LPCI injection resumes until, again, the pumps are tripped on low suction level. This cycle continues until the calculation is terminated at 6,040 seconds (1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and 4 minutes). The reactor has reached a safe and stable state at this point and results generally agree with what the UFSAR describes.

For the second simulation, a 9.3 cm2 (0.01 ft2) hole is considered for the SLOCA. The results of this calculation are similar to those of the previous calculation with a few minor differences. The smaller hole size causes a slower progression of the accident. By the time ADS actuates at 647 seconds, the Downcomer water level has not yet reached the TAF. LPCI injection begins at 880 seconds (15 minutes) and the peak cladding temperature reaches 435 degreesC 7 The FSAR refers to the injection of both LPCI and low-pressure core spray (LPCS). However, only a single train of RHR is available, and so only one mode of injection (LPCI or LPCS) is possible. The calculations here have used the LPCI mode of low-pressure ECCS injection, since it has the lower shutoff head (1.36 MPa

[197 psid] versus 1.82 MPa [264 psid] for LPCI) and injection is conservatively further delayed. However, this choice should not make much difference for this scenario.

2-10

(815 degrees F). Without operator action to throttle the RHR pumps, the same trip/recovery cycle is seen here, and the reactor is in a stable state.

The start of LPI in the two cases above are 6 and 15 minutes, which agrees with the 10 minutes given in the UFSAR.

2.3.4 Application of the Baseline FLEX Sequence Section 4 addresses the modeling and analysis of sequences involving use of the FLEX equipment in more detail. Here, a baseline FLEX-usage scenario is considered as one means of validating the DAEC MELCOR model.

2.3.4.1 Baseline Sequence Narrative This section will focus on the notional timeline (from NextEra, 2013a) associated with the accident progression and mitigation, as an introduction to the sequence of interest. The sequence is covered in more detail in subsequent sections. All times are referenced to the initiating event (a LOOP), which takes place at time zero.

Following loss of all ac power and normal access to the ultimate heat sink (UHS) at time zero, and a subsequent declaration of an extended loss of ac power (ELAP), the operators will initiate a controlled depressurization of the RCS using SRVs at a rate of 44.4-55.6 degrees C/hr (80-100 degrees F/hr) and maintain a pressure band of 1.03-1.37 MPa (150-200 psig). They then perform load-shedding actions (within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months ) to extend the battery life of the safety-related station batteries. During this time, RCIC (or HPCI if RCIC is unavailable) provides core makeup from either the CST or the suppression pool (depending on availability but with preference given to the CST). Before depletion of the batteries (in 4-8 hours), a portable diesel generator will power station battery chargers.8 During this same time window (and before assumed RCIC failure), the reactor will be manually depressurized9 further to allow LPI, and a portable diesel-driven pump will be aligned to inject water into the RPV. The source of water for this pump will be the circulating water pit,10 with makeup from the Cedar River, as needed.

8 More specifically and based on 2016 communications with plant staff as part of this project, dc load shedding will begin within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after the loss of all ac power and will be completed within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months of the loss of ac power. This reduced dc load allows the 1D1 battery (e.g., supply to RCIC) to be available for 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months and the 1D2 and 1D4 (e.g., supply to HPCI) to be available for 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months . Before depletion, FLEX strategies align a portable 480V generator to the normal battery chargers. The normal battery chargers are sized to recharge the batteries concurrent with carrying the full dc load in roughly 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . There was no review of recharge time under FLEX strategies, as the portable generators are assumed available for charging.

9 Based on (NextEra, 2013a), safety-related pneumatic accumulators would accomplished this, in combination with either (1) a portable diesel generator providing dc power through the station battery chargers or (2) a portable battery cart used to directly provide dc power to the valves (per severe accident management procedure (SAMP)-707).

10 If external flooding prevents the laying of temporary hoses for this purpose, the main turbine condenser system hotwell will be used (NextEra, 2015a).

2-11

During the period of 8 to 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months ,11 the containment will be vented using a hardened vent (and anticipatory venting may occur before that), operated from either the main control room or a remote operating station in the 1A3 switchgear room, to prevent containment failure. APPENDIX B includes more detail about these venting actions. Table 2-1 (in NextEra, 2013a) provides the manual actions required to operate the HCVS. This is also the general time window when charging capacity will be established for batteries in portable communications equipment and refueling of portable equipment will be initiated.

In the longer term (notionally 24-72 hours), equipment will be brought in from the National SAFER [Strategic Alliance for FLEX Emergency Response] Response Center to restore power to a 4,160V essential bus and to restore access to water from the Cedar River. Containment venting during this period would use an onsite portable diesel generator to power the needed 480V bus and compressed gas bottles would provide motive valve power.

Attachments 5 and 6 of (NextEra, 2013a) include a full list of systems credited and instruments needed for core cooling.

2.3.4.2 Other Licensee Analysis Assumptions of Note Other assumptions of note in the licensee analysis include the following:

Recirculation pump seal leakage under SBO conditions is 4.1 m3/hr (18 gpm) per pump at rated pressure (NRC, 2014b and NextEra, 2016).

FLEX Support Guideline FLEX-AB-100 indicates that the timeline for switchover from RCIC to FLEX injection could be much later if the suction source were not from the suppression pool. While the CST is the preferred source of RCIC/HPCI injection, it is not seismically qualified. Hence, analyses and timelines appear to assume injection from the wetwell.

2.3.4.3 MELCOR Analysis and Comparison to Licensee Analysis The FLEX validation calculation follows the boundary conditions outlined in Table 1. There are two separate MELCOR calculations that differ in the switchover from RCIC to FLEX injection at 4 and 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , referred to as Case 1 and Case 2, respectively, to cover the range of switchover times described in (NextEra, 2013a).

11 Based on EA-12-049 Integrated Plan, it is stated that venting may start as early as 3.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months (estimated time for containment pressure to reach 0.069 MPa [10 psig]) but no later than 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months (associated with a containment pressure of 0.37 MPa (53 psig)), and periodically thereafter. Whereas the EA-12-049 Integrated Plan describes venting as occurring in 8-16 hours, it was clarified with plant staff in September 2016 that the apparent conflict has to do with the availability of details about the HCVS design when the FLEX Integrated Plan was developed, as well as occasional reference to industry-generic information. With the final design, 3.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months is the time that anticipatory venting would be expected, if trying to maintain a pressure of 0.069 MPa (10 psig). Meanwhile, if no anticipatory venting were performed, then the primary containment pressure limit of 0.37 MPa (53 psig) would nominally be reached at 13 hours1.50463e-4 days 0.00361 hours 2.149471e-5 weeks 4.9465e-6 months .

2-12

Table 2-9 Boundary conditions for the FLEX validation System Condition RCS 100% (full power).

Reactor successfully trips on first-in RPS signal or loss of offsite ac.

Nominal1 recirculation pump seal leakage.

Balance of Offsite power is lost at time zero.

plant EDGs fail.

DC power is available indefinitely by recharging from portable diesel(s).

Turbine trip occurs upon loss of feedwater or loss of ac.

Feedwater and condensate fail at time zero.

MSIV closure occurs upon loss of offsite ac.

ECCS/ESF ESF signals successfully perform their functions.

CST is unavailable.

HPCI is unavailable.

RCIC is available.

CRDHS and SLC are unavailable upon loss of ac power.

LPCI/core spray are unavailable upon loss of ac power.

Containment Suppression pool cooling is unavailable.

Nominal drywell and wetwell initial conditions are present.

Other Actions related to RPV depressurizationafter 30 minutes, the RCS is operator depressurized by the SRVs at a rate of 55.6 degrees C/hr(100 degrees actions F/hr).

Actions related to containment venting: operators vent containment via the hardened vent to maintain a pressure band of 7-10 psig per site emergency plan (SEP) 301.3 to maintain RCIC. A pressure band of 45-53 psig is used upon loss of RCIC.2 Actions to align alternate injection via a FLEX pump: before loss of RCIC (assumed at 4 and 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ), operators depressurize the RCS to allow for LPI.3 1 In this context, this means 4.1 m3/hr (18 gpm)/pump at the lowest SRV pressure setpoint (loss-of-ac scenarios).

2 SEP 301.3 directs operators to maintain a pressure of 5 to 10 psig in an ELAP to maintain RCIC/HPCI injection. It also states that, if the purpose is instead containment integrity, a 45 to 53 psig band is directed. Hence, upon loss of RCIC, it is assumed that operators would switch to this higher pressure band, since the FLEX pump is the injection source.

3The depressurization logic used here is that built for a walkdown of the Graph 4 curve in the EOPs.

Up until 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , the two MELCOR calculations are identical. Upon a LOOP, all ac-dependent pumps (e.g., condensate, feedwater, recirculation, RHR) are unavailable. Because of the assumed 4.1 m3/hr (18 gpm) per pump recirculation pump seal leakage, the water level in the RCS begins to fall, reaching Level 2 at 7 minutes. Thirty seconds later, the delay for RCIC initiation is satisfied, and it begins to inject into the RPV from the wetwell (HPCI and CST are assumed unavailable). Injection continues until the pump is tripped upon reaching Level 8.

RCIC automatically restarts when the RCS level reaches Level 2. Until the initiation of RPV depressurization at 30 minutes, the RPV pressure cycles on the SRVs.

Abnormal Operating Procedure (AOP) 301.1 directs operators to begin a controlled cooldown of the reactor at a rate of 44.4-55.6 degrees C/hr (80-100 degrees F/hr) within 30 minutes of the accident with a target pressure of 1.03-1.38 MPa (150-200 psig). This pressure band is meant to extend the life of the RCIC.

2-13

572 Coolant temperature 100F/hr 482 392 Temperature [C]

Temperature [F]

302 212 122 32 time [hr]

Figure 2-1 Recirculation line coolant temperature during controlled depressurization of the RCS Before RCIC failure (on high wetwell temperature if injecting from the wetwell; or on CST depletion or high backpressure if injecting from the CST), operators will align the FLEX pump and depressurize the RPV. This is expected to occur 4-8 hours into the accident. At 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , MELCOR results show the wetwell temperature at around 105 degrees C (221 degrees F). For Case 1, at 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , the following events occur simultaneously: RCIC is tripped, a controlled depressurization begins according to Graph 4 of EOP-2, and the FLEX pump is started. The FLEX pump is unable to inject until RPV pressure falls below 0.758 MPa (110 psig), which occurs 9 minutes later. The same three events occur in Case 2 at 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

SAMP-708 directs operators to throttle FLEX pump injection to maintain RPV level. It is not indicated whether the level would be held at a constant value or modulated between, for example, Level 8 and Level 2, as is the case with RCIC/HPCI injection. Originally, logic for throttling the FLEX pump with a proportional-integral-derivative (PID) controller was used to maintain Normal RPV level. However, preliminary calculations revealed that the overshooting that is typical of a PID controller led to overfilling the RCS and spilling water out of the SRVs into the drywell. Hence, the injection is now dictated by a trip/reset of the pump at 485/303.5 centimeters (191/119.5 inches) (Normal and Lo levels). This tight band attempts to follow the assumption that the FLEX pump valves would be throttled to maintain a relatively constant level.

This tight band is supported MAAP calculations were run with similar logic for the B.5.b pump (thought by the staff to be the same as the FLEX pump).

2-14

In an ELAP scenario, AOP 301.1 directs operators to use the hardened vent in accordance with SEP 301.3 to maintain a drywell pressure of 0.03-0.07 (5-10 psig) (a pressure band of 0.05-0.07 MPa (7-10 psig) is maintained code-automatically12), with the intention of extending RCIC/HPCI injection from the wetwell. If the venting purpose is instead containment integrity, SEP 301.3 requires a 0.31- to 0.37-MPa (45- to 53-psig) pressure band. Hence, upon loss of RCIC, it is assumed that operators would switch to this higher pressure band since FLEX is the injection source. For Case 1, the pressure does not reach 0.07 MPa (10 psig) before the switchover to the FLEX pump at 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , and the first demand for venting is at 14.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months when the pressure reaches 0.37 MPa (53 psig). This is consistent with the timeline in (NextEra, 2013a) for opening the hardened vent at 8-16 hours. Figure 2-4 shows the five venting cycles.

In Case 2, drywell pressure reaches 0.07 MPa (10 psig) at 5.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months and the hardened vent opens. When the valves open, the wetwell and drywell pressure decrease initially. However, once the wetwell has become saturated, the pressure begins to rise with the rising wetwell temperature. Pressure never falls back below the 0.05 MPa (7 psig) closing setpoint, and it is not until injection is switched to the FLEX pump at 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months that the hardened vent is closed because of the increased target pressure.

The bulk wetwell water in Case 2 reaches 121 degrees C (250 degrees F) right around 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

However, the water temperature in one of the three wetwell nodes reaches 121 degrees C (250 degrees F) around 7.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . This is in line with FLEX-AB-100, which assumes wetwell temperature will reach this temperature at 7.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months if RCIC suction is on the wetwell.

It is worthwhile to compare these results with similar calculations from the utility. The utility provided no calculations that directly relate to the FLEX actions. However, a 2011 report by DAEC gives an assessment of SBO coping capability under various specified assumptions. The DAEC MAAP calculation has similar boundary conditions to the first of the staffs calculations (Case 1). In the MAAP simulation, RCIC injects from the wetwell until 3.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months , when the wetwell temperature reaches 93.3 degrees C (200 degrees F), at which point the RPV is depressurized to allow injection from the B.5.b pump (thought by the staff to be the same as the FLEX pump). Figure 2-2 through Figure 2-6 graphically display the results from the staffs MELCOR calculation.

A primary difference in the boundary conditions of the MAAP and MELCOR calculations lies in the depressurization of the RCS. In the case of MAAP, operators depressurize to 3.45 MPa (500 psig) at 15 minutes, 2.07 MPa (300 psig) at 30 minutes, and 1.38 MPa (200 psig) at 2.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months . This contrasts with the more rapid 55.6 degrees C/hr (100 degrees F/hr) depressurization in MELCOR. This difference does not appear to have a measurable impact on RCIC injection.

In the drywell, there is a slightly faster pressurization in the staffs calculation than in the licensees, caused by the higher water temperature in the staffs results. The cause of this difference is likely multifaceted but, in general, there is good agreement on the wetwell conditions.

There was also agreement between the injection rates of the alternative injection from the B.5.b and FLEX pumps. It is not clear what the injection criteria for DAEC were, but the overall flow rate is similar to that calculated by MELCOR.

12 The AOPs/SAMPs call for a 0.03-0.07 MPa (5-10 psig) pressure range but also direct operators to limit offsite releases. It is thought that a range of 0.05-0.07 MPa (7-10 psig) fulfills both these requirements.

2-15

Calculations end at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months with the plant in a stable, shutdown state. No attempt is made to model the long-term (phase 3) FLEX strategies in which offsite equipment is brought in from the Regional Response Center.

1500 RPV Pressure 1000 Pressure [psia]

500 0

0 5 10 15 20 25 30 time [hr]

Figure 2-2 RPV pressure (Case 1) 30 2.4E+05 RCIC injection 25 2.0E+05 Mass Flow Rate [kg/s] Mass Flow Rate [lbm per hour]

20 1.6E+05 15 1.2E+05 10 7.9E+04 5 4.0E+04 0 1.0E+00 0 5 10 15 20 time [hr]

Figure 2-3 RCIC flow (Case 1) 2-16

80 CVH-P.202 70 60 50 Pressure [psia]

40 30 20 10 10 15 20 25 time [hr]

Figure 2-4 Drywell pressure (Case 1)

CVH-TLIQ.221 Temperature [C]

CVH-TLIQ.222 Temperature [F]

CVH-TLIQ.223 25 time [hr]

Figure 2-5 Wetwell water temperature (Case 1) 2-17

Mass Flow Rate [kg/s]

Mass Flow Rate [lbm per hour]

25 time [hr]

Figure 2-6 FLEX pump flow (Case 1) 2.3.5 Application of a Baseline Station BlackoutSequence Sections 4 and 5 of this document address the modeling and analysis of sequences involving SBO in more detail. This section considers a baseline SBO coping scenario as one means of validating the DAEC MELCOR model.

2.3.5.1 Baseline Sequence Narrative This section will focus on the notional timeline from the extended SBO MAAP analysis associated with the accident progression and mitigation, as an introduction to the sequence of interest. Subsequent sections cover the sequence in more detail. All times are referenced to the initiating event (SBO), which takes place at time zero.

Following loss of all ac power and normal access to the UHS at time zero, but in the absence of a declaration of ELAP and subsequent FLEX invocation, RCIC provides core makeup from the CST. The operators manually depressurize the reactor in accordance with AOP 301.1. Initially, full RPV emergency depressurization (ED) is assumed not to occur because of the caution in AOP 301.1 to maintain RPV pressure above 200 psi. The B.5.b pump is aligned for LPI and dc power is extended by use of the technical support center diesel generator. At 16.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months , the RCIC turbine trips on high backpressure. Shortly thereafter, at 17.8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , the containment is vented upon reaching 53 psig, which allows the B.5.b pump to continue injecting into the RPV.

TAF is reached at 18.8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months and RPV ED (using four SRVs) occurs at 19.1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Core damage is not reached by the end of the simulation at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2-18

2.3.5.2 MELCOR Analysis and Comparison to Licensee Analysis The SBO accident scenario follows the conditions listed in Table 2-10, which is extracted from the MAAP scenario. There, the partial controlled depressurizations are to occur at 0.25, 0.50, and 2.50 hours5.787037e-4 days 0.0139 hours 8.267196e-5 weeks 1.9025e-5 months . The opening of the SRV is to be controlled such that system pressure falls to and then remains at 500, 300, and 200 psig at the respective times. According to the PB input deck (Sandia National Laboratories [SNL], 2014b), the RCIC turbine trips at a wetwell pressure of 42 psig.

Table 2-10 Boundary Conditions for the SBO Validation System Condition RCS 100% (full power).

Reactor successfully trips on loss of offsite ac.

Nominal1 recirculation pump seal leakage.

Balance of plant All ac and dc power is lost at time zero.

Turbine trip occurs upon loss of ac.

Feedwater and condensate fail at time zero.

MSIV closure occurs upon loss of offsite ac.

ECCS/ESF ESF signals successfully perform their functions.

HPCI is unavailable.

RCIC is available; its electrical requirements are satisfied indefinitely.

CRDHS and SLC are unavailable.

LPCI/core spray are unavailable.

Containment Suppression pool cooling is unavailable.

Nominal drywell and wetwell initial conditions are present.

Other operator Actions related to RPV depressurization: partial controlled actions depressurizations occur at prescribed times; rapid depressurization occurs at vessel water level -64 centimeters (-25 inches).

Actions related to containment venting: operators will depressurize containment using the hardened vent if the pressure exceeds 0.37 MPa (53 psig).

Actions to align alternate injection via a low-pressure pump: operatorswill align the pump, assumed to be able to inject as soon as depressurization actions appropriately lower the vessel pressure.

Table 2-11 compares the timings of important events, as predicted by the utilitys and staffs calculations. Figure 2-7 through Figure 2-10 graphically display the results for the MELCOR simulation.

The MELCOR calculations give similar results, but there is a timing difference from the MAAP calculations. Figure 2-7 shows the temperature of the wetwell water according to the present calculation. When RCIC is not injecting, the SRV being used for the controlled depressurization discharges into CV221, which models one sixth of the wetwell. The water temperature of CV221 accordingly cycles with RCIC activity and shows a sizable periodic increase over the temperature of the water of CV222, which models one-half of the wetwell. The containment pressure also cycles markedly with RCIC activity (Figure 2-8) in a way that the utilitys calculation does not reflect. These observations suggest that, in the present calculation, the nodalization of the wetwell, set up to include less than perfect homogenization of the wetwell water, contributes to the overall more rapid containment pressurization in the present calculation. Of course, there are probably more mundane reasons for the difference, including different volumes or water inventories for the wetwell in the MELCOR versus the utilitys models that cannot be ruled out 2-19

without more details of the utilitys model. In any case, the timing differences between the two calculations appear to be caused by the faster wetwell pressurization in the present calculation.

This faster pressurization leads to RCIC carrying out one less duty in the present calculation.

This also leads to further differences in time for the events that follow. More particular comments refer to the other figures, as follows.

Figure 2-9, showing water level in the vessel, is qualitatively similar to the MAAP calculation but includes a possible discrepancy of the elevation difference between the set points at which RCIC is turned on and off (between LoLo and Hi Levels, or roughly 2 meters for the MELCOR calculation versus roughly 10 unknown units for the utilitys calculation). In the present calculation, after the FLEX pump first begins to inject, the water level initially rises very high in the vessel in a way that the utilitys calculation does not reflect.

Neither calculation predicts cladding temperatures approaching core damage, but the utilitys calculation shows a pronounced peak in the cladding temperature around the time of the rapid depressurization that the MELCOR calculation does not predict. This appears to be caused by a drop in water level that is at or below the 2/3 core height, resulting in a higher heatup than that of the MELCOR calculations where the water level remains above this threshold.

Figure 2-10 Indicates that the FLEX pump included in the MELCOR calculation has roughly twice the flow rate of the B.5.b pump that the utilitys calculation includes. Since the B.5.b pump is shown briefly to become deadheaded, the FLEX pump may also be a pump of higher head, but this possibility was not investigated quantitatively. No attempt was made to adjust the FLEX pump injection rate in the MELCOR model to more nearly resemble the B.5.b pump rate of the utilitys MAAP model since the FLEX pump as represented in the MELCOR model is known to be consistent with the actual pump at the plant.

The MELCOR model appears to credit greater initial CST water inventory than does the utilitys model (which may be assuming the technical specification minimum inventory). The difference is inconsequential in these calculations because neither calculation predicts CST depletion.

Table 2-11 Timing of important events for SBO validation Event Time (in hours except Remarks as noted)

Utility NRC Initiation of transient 0.0 0.0 Trip of all electrical pumps, MSIV closure, start of recirculation pump leakage at nominal rate of 4.1 m3/hr (18 gpm) per pump.

Beginning of RCIC - 0.13 NRC: 30 seconds after Downcomer water injection, suction from level attains Level 2.

the CST Utility: Start time indistinguishable in the figure since the start time is so close to 0.

Controlled 0.25 0.25 With one SRV; target pressure 500 psig.

depressurization Controlled 0.50 0.50 With one SRV; target pressure 300 psig.

depressurization Controlled 2.50 2.50 With one SRV; target pressure 200 psig.

depressurization End of RCIC injection ~15.0 12.43 2-20

Table 2-11 Timing of important events for SBO validation (continued)

Event Time (in hours except Remarks as noted)

Utility NRC RCIC turbine trip on high 16.3 13.87 Trip caused by high wetwell pressure of 42 psig.

backpressure For the NRC, this trip occurs while RCIC is idle.

Beginning of first period 17.8 15.80 Caused by high wetwell pressure of 53 psig.

of containment venting Water level falls below 18.8 16.01 TAF End of first period of ~18 16.06 The vent is reclosed around 45 psig, too high to containment venting reenable the RCIC turbine.

Rapid depressurization 19.1 16.33 Four SRVs are held open; initiated when Downcomer water level attains

-64 centimeters (-25 inches).

Beginning of second ~19.0 16.36 NRC: open at 0.37 MPa (53 psig).

period of containment venting Beginning of LPI ~18.7 16.39 Utility: B.5.b pump.

NRC: FLEX pump.

Water level rises above ~19 16.61 NRC: last of several times at which level rises TAF above TAF.

End of second period of ~19 16.72 NRC: close at 0.34 MPa (48.7 psig) instead of containment venting 0.31 MPa (45 psig) (restart error associated with the double back from 17.81 hours9.375e-4 days 0.0225 hours 1.339286e-4 weeks 3.08205e-5 months ).

No more demands for venting as of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

NRC only: close all - 17.22 NRC: for solution of numerical problems.13 SRVs NRC only: reopen two - 18.39 NRC: for solution of numerical problems.14 SRVs End of calculation 24.0 24.0 13 Numerical difficulties in the code required a restart at 16.72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to alter the time steps of the calculation.

As a result, the hardened vent was inadvertently closed at 16.72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months because of a reinitialization of the trip function. This error was not noticed for some time, and when it was noticed, it was left uncorrected since it does not significantly change the results. (The vent closed at 0.34 MPa (48.7 psig) instead of 0.31 MPa (45 psig). Had the pressure ever reattained the opening setpoint, the vent would have opened, and subsequently reclosed, correctly.)

14 The time-steps change proved ineffective in fixing the calculational issue; therefore, at 17.22 hours2.546296e-4 days 0.00611 hours 3.637566e-5 weeks 8.371e-6 months , all the SRVs were closed. This intervention allowed the code to pass the problematic time, and, over the time that it was enforced, induced so small a repressurization of the vessel that the FLEX pump was not affected. Two SRVs were reopened at 18.39 hours4.513889e-4 days 0.0108 hours 6.448413e-5 weeks 1.48395e-5 months , and in that configuration, the problem ran uneventfully to its planned end time at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2-21

Temperature [C]

CVH-TLIQ.221 Temperature [F]

CVH-TLIQ.222 CVH-TLIQ.223 25 Figure 2-7 Wetwell water temperature (NRC) 0.552 0.414 Pressure [MPa]

Pressure [psia]

0.276 Wetwell Drywell 0.138 53 psig 45 psig 0 5 10 15 20 25 time [hr]

Figure 2-8 Containment pressure (NRC) 2-22

Figure 2-9 Vessel water levels (NRC) 45 350000 40 300000 35 Mass Flow Rate [kg/s]

250000 Mass Flow Rate [lbm per hour]

30 25 200000 20 150000 15 100000 10 50000 5

0 0 5 10 15 20 25 time [hr]

Figure 2-10 FLEX pump flow (NRC) 2-23

2.3.6 Updated Shakedown Based upon Latest Deck Revision The MELCOR input deck used for the calculations described in this report was under active development throughout the project. A number of modifications were made to correct input errors, improve the performance of system logic, or reflect feedback received from internal and external stakeholders on plant design and operations (see Appendix A). The version of the deck that was used for the aforementioned shakedown and benchmark calculations was Revision 5 (with minor alterations that were rolled into Revision 6), while the version used for the calculations in the subsequent sections of this report was Revision 7. Most of the modifications made between these revisions were such that the changes to the benchmarks should be minimal. However, a recalculation of the FLEX Case 1 benchmark scenario from Section 2.4.4 using Revision 7a of the deck is provided here. The discussion below centers on the primary differences between the original and updated calculation and the changes to the model that influenced them.

There were two rather significant changes made to the wetwell models going from the Revision 5 to the Revision 7 MELCOR decks. First, the wetwell Downcomer was split from a single control volume to three separate volumes. The modification was motivated by unrealistic flow behavior between the wetwell volumes. This change led to more efficient mixing between the three wetwell volumes.15 The second modification affecting the wetwell was the initial wetwell water temperature. A unit conversion error caused the Revision 5 initial water temperature to be 317.5K versus the intended 304.0K. As a result, the wetwell water temperature reaches a peak value of 148 degrees at 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months with the corrected value versus 14 hours1.62037e-4 days 0.00389 hours 2.314815e-5 weeks 5.327e-6 months in the original calculation.

Also contributing to the difference in pressure and temperature in the wetwell and drywell is the subtle difference in RPV pressure. The pressure is maintained at 50 psid (per EOP-1 direction) above the wetwell pressure rather than at 50 psig. This leads to less heat transfer to the wetwell and a slower pressurization.

The flow rate of the FLEX pump was also altered going from Revision 5 to Revision 7a, with a vendor-provided pump curve offering more pressure-dependent injection rate information. A tighter level band also led to more rapid cycling of the pump.

15 This new nodalization was validated against test data from the Monticello BWR, as seen in (NRC, 1984).

2-24

1500 RPV Pressure 1000 Pressure [psia]

500 0

0 5 10 15 20 25 30 time [hr]

Figure 2-11 RPV pressure (Case 1, updated) 30 2.4E+05 RCIC injection 25 2.0E+05 Mass Flow Rate [kg/s] Mass Flow Rate [lbm per hour]

20 1.6E+05 15 1.2E+05 10 7.9E+04 5 4.0E+04 0 1.0E+00 0 5 10 15 20 time [hr]

Figure 2-12 RCIC flow (Case 1, updated) 2-25

CVH-P.202 Pressure [psia]

Figure 2-13 Drywell pressure (Case 1, updated)

CVH-TLIQ.221 Temperature [C]

CVH-TLIQ.222 Temperature [F]

CVH-TLIQ.223 Figure 2-14 Wetwell water temperature (Case 1, updated) 2-26

Mass Flow Rate [kg/s]

Mass Flow Rate [lbm per hour]

25 Figure 2-15 FLEX pump flow (Case 1, updated) 2-27

3 SUCCESS CRITERIA FOR SITUATIONSWITH DEGRADED HIGH-PRESSURE INJECTION AND RELIEF VALVECRITERIA FOR NON-ANTICIPATED TRANSIENT WITHOUT SCRAM 3.1 Issue Description Following certain initiating events, coincident with degraded HPI capabilities (i.e., loss of RCIC and HPCI), operators will use alternate HPI capabilities to maintain the RPV level (e.g.,

CRDHS, SLC). If there is insufficient capability to maintain the RPV level above a specified level band1 or insufficient blowdown capacity in the suppression pool, and an LPI system is available, operators will manually initiate the automatic depressurization system (the automatic function having been inhibited very early in the EOPs for a non-ATWS condition). This initiation will open up multiple SRVs to depressurize the RPV and allow for LPI. This function applies to both ATWS and non-ATWS sequences, but the focus in this section is on the non-ATWS applications. Conversely, if sufficient alternate HPI capability and suppression pool capacity are available, operators will proceed with a normal cooldown and depressurization to achieve low-pressure conditions. The rate of cooldown will depend on the adequacy of injection to maintain the level but will not exceed 55.6 degrees C/hr (100 degrees F/hr). In the intermediate case, where HPI is sufficient for maintaining the level but insufficient for supporting a plant cooldown, operators will try to maintain RPV pressure within a 200-psig band and may close the MSIVs as a means of buying additional time for restoration of HPCI or RCIC.2 Note that some natural plant cooldown and depressurization may occur during this period. The above situations are covered by the EOPs (most notably EOP-1), along with alternate injection procedures

([AIPs] 406 and 4073).

For the relevant PRA sequences, assumptions are made regarding what high-pressure capabilities are needed to maintain the level, when operator action is required, and how many ADS valves must open to reach conditions where LPI sources (e.g., low-pressure CS) in conjunction with any available HPI sources (e.g., CRDHS) can provide adequate inventory control and decay heat removal before core damage. The relevant success criteria in many PRA models originated from design-basis analyses, and in the case of many models, have been refined over time to remove conservatism. However, there are a number of related modeling assumptions (e.g., water level representation used for the operator cue for manual actuation) and scenario definition characteristics (e.g., amount of credit for CRDHS), that, when combined with the accepted variability in computational modeling and user effect, can result in different analyses predicting different requirements for substantively similar designs or conditions.

1 In these circumstances, operators are not permitted to initiate ADS before reaching +0.38 meter

(+15 inches) RPV level and must initiate ADS before reaching -64 centimeters (-25 inches) RPV level. If the RPV is still at high pressure and there is no expectation for recovery of additional HPI capability, then initiation is more likely to happen early. Conversely, if the system is nearing the low-pressure shutoff head and level is dropping slowly, then late action is more likely.

2 On keeping the MSIVs open (to dump decay heat out of containment) versus closing them (to limit inventory loss), if HPI is lost and the RPV level is dropping, then an EOP-1 contingency will dictate efforts to maintain the level, including closure of the MSIVs if warranted. This action is implicit, as one means to stabilize pressureat DAEC, this means of stabilizing pressure is trained on but not explicitly called out in the EOPs.

Note that if the crew loses control of the RPV level (low), then there is an automatic MSIV closure at

+1.6 meters (+64 inches).

3 The site provided these additional procedures following the November 2016 site visit.

3-1

For this reason, the sequence timing and success criteria assumptions for ADS relief valve criteria for non-ATWS sequences periodically become important aspects of an event or condition assessment.4 To investigate this issue, the approach will be to quantitatively address the variability around a point estimate that would arise from reasonable alterations to the boundary conditions and underlying modeling for this particular scenario. Factors of interest in this regard (based on previous SDP-related examinations) include items that would have both a positive and negative influence on core heatup:

number of SRVs participating in the depressurization or degraded performance of one or more valves (e.g., caused by vibration-induced valve stem/piston damage or degradation of the N2 accumulator in cases with loss of instrument air), noting that 4 of 6 SRVs at DAEC have ADS functionality

SRV discharge path characteristics that affect flow rate and depressurization

HPI failure to run, as opposed to failure to start

credit for CRDHS flow before and after depressurization, including the following:

- normal post trip flow

- enhanced flow using one train

- enhanced flow using two trains

credit for additional alternate injection from standby liquid control

source and achieved flow of LPI (e.g., delivered CS flow +/- 10percent)

manual actions taken before ADS to stabilize RPV pressure/level (e.g., manual closure of MSIVs) or to pursue a normal plant cooldown, or both

automatic, as opposed to manual, initiation of ADS (i.e., failure to inhibit automatic actuation)

timing of manual actuation (e.g., near the top of the allowable level band versus near the bottom)

decay heat formulation in the MELCOR model (e.g., +/- 10 percent)

recirculation pump seal leakage Manual reactor depressurization using the SRVs appears in the following SPAR v8.50 main event trees:

inadvertent open relief valve (IORV)

loss of condenser heat sink (LOCHS) 4 Examples of events that led to this situation include the 2015 inspection and enforcement activities for Dresden (NRC, 2015c) and Oyster Creek (NRC, 2015e).

3-2

loss of vital dc bus A (LODCA)

loss of vital dc bus B (LODCB)

loss of instrument air system (LOIAS)

loss of main feedwater (LOMFW)

loss of offsite power (LOOP)

loss of river water system (LORWS)

medium loss-of-coolant accident (MLOCA)

SLOCA

general plant transients (TRANS)

Manual reactor depressurization using the SRVs also appears in some transfer event trees.

From model quantification, the following sequences are most affected by less reliable operator-enacted depressurization or multiple ADS SRVs being unavailable:

LOMFW-62

LOOPxx-35

LOIAS-71

TRANS-52-35 All of these sequences are variations on a theme, wherein the reactor is successfully shut down, 4,160V ac power is available, SRVs successfully reseat (if demanded), HPI fails, manual reactor depressurization fails, and core damage ensues. (The transient initiator involves a consequential or coincidental LOOP.) CRDHS is not considered as an alternate adequate source of injection alone, given the failure of RCIC/HPCI, as it is in the general TRANS (without LOOP) analogous sequence.

From this, and from the inspection of the various event trees, three sequences are selected for further consideration here. The first (TRANS-30) is selected as a non-LOCA case with success of HPI. The second (TRANS-49) is selected as a variation of the sequences that were found to be important above but with consideration of CRDHS. The third (SLOCA-25) is selected as a LOCA case.

3.2 Transient Sequence 3.2.1 Calculation Matrix Development Table 3-1 describes the PRA sequence that is the focus of this section.

Table 3-1 PRA sequences of interest for depressurizationTRANS PRA Seq. Event Description TRANS-30 Initiator General plant transient occurs (e.g., unexpected reactor trip).

/RPS Reactor is successfully shut down.

/OEP Offsite power is available.

/SRV SRVs successfully reclose (if demanded).

PCS Power conversion system fails (e.g., operator fails to maintain feedwater injection).

MFW Main feedwater fails (e.g., operator fails to maintain feedwater injection).

HPI High-pressure injection fails (meaning RCIC and HPCI are both unavailable).

3-3

Table 3-1 PRA sequences of interest for depressurizationTRANS (continued)

PRA Seq. Event Description

/DEP Manual depressurization of the reactor occurs (e.g., two of six SRVs opened by operator).

CDS Condensate system fails (e.g., operator fails to maintain condensate injection).

/LPI LPI succeeds (namely one train of LPCI or one train of core spray succeeds).

/SPC Suppression pool cooling late succeeds (namely, at least one train of RHR provides suppression pool cooling).

OK Core damage is averted.

TRANS-49 Initiator General plant transient occurs (e.g., unexpected reactor trip).

/RPS Reactor is successfully shut down.

/OEP Offsite power is available.

/SRV SRVs successfully reclose (if demanded).

PCS Power conversion system fails (e.g., operator fails to maintain feedwater injection).

MFW Main feedwater fails (e.g., operator fails to maintain feedwater injection).

HPI High-pressure injection fails (meaning RCIC and HPCI are both unavailable).

DEP Manual depressurization of the reactor fails (e.g., five of six SRVs fail to open).

CRD CRDHS fails to provide makeup (meaning that either train fails).

CD Core damage Table 3-2 provides the calculation matrix for the subsequent MELCOR calculations, while Table 3-8 provides the calculation boundary and initial conditions. A discussion of the key modeling assumptions made for these calculations follows.

Table 3-2 Calculation matrixHPI and SRV criteria for non-ATWSTRANS Case Sequence CRDHS Manual actions Method of RPV Timing of No. of

to stabilize depressurization ADS SRVs level/pressure initiation during (MSIV closure) ADS

1. Based Nominal1 Manual N/A +38 1

2. around (6 minutes) centimeters 2 TRANS- (+15 30 inches)

3. -64 1

4. centimeters 2

(-25 inches)

5. Automatic +38 1

6. (16 minutes on centimeters 2 low level) (+15 inches)

7. -64 1

8. centimeters 2

(-25 inches)

9. 1-train, Early manual Follow the HCL N/A N/A maximized2 closure curve

10. (10 minutes) ED 3-4

Table 3-2 Calculation matrixHPI and SRV criteria for non-ATWSTRANS (continued)

Case Sequence CRDHS Manual actions Method of RPV Timing of No. of

to stabilize depressurization ADS SRVs level/pressure initiation during (MSIV closure) ADS

11. Early manual Follow the HCL closure curve

12. (20 minutes) ED

13. Automatic Follow the HCL (none) curve

14. 2-trains, Early manual N/A maximized3 closure (10 minutes)

15. Early manual closure (20 minutes)

16. Automatic (none)

17. Based 1-train, Early manual N/A N/A N/A around maximized closure

18. TRANS- Automatic 49 (none)

19. 2-train, Early manual maximized closure

20. Automatic (none) 1 With this HPI capacity, level will drop too quickly to prompt timely actions with regard to pursuing a normal plant cooldown.

2 With this HPI capacity, level is maintained but is not sufficient to facilitate a normal plant cooldown. ED is required, however, when the wetwell water temperature rises and RPV pressure reaches the action is required region of the HCL curve (Graph 4 in the EOPs).

3 With this HPI capacity, level is maintained and is sufficient to facilitate a normal plant cooldown at a rate of 44.4-55.6 degrees C/hr (80-100 degrees F/hr). Hence, ED is never required.

Table 3-3 Initial and boundary conditionsHPI and SRV criteria for non-ATWSTRANS These conditions are in addition to the generic modeling conditions from Table 2-6 and the calculation-specific conditions from Table 3-2.

System Condition RCS 100% (full power).

Reactor successfully trips on first-in RPS signal.

No recirculation pump seal leakage.

Number of SRVs availablesee Table 3-2.

Balance of plant Offsite power remains available.

Support systems are available unless specified otherwise.

Turbine trip occurs at the time of reactor trip.

Feedwater and condensate fail at the time of turbine trip.

MSIV closuresee Table 3-2.

Condenser is assumed available to explore MSIV closure time; in subsequent chapters, the condenser is not available.

3-5

Table 3-3 Initial and boundary conditionsHPI and SRV criteria for non-ATWSTRANS (continued)

These conditions are in addition to the generic modeling conditions from Table 2-6 and the calculation-specific conditions from Table 3-2.

System Condition ECCS/ESF ESF signals successfully perform their functions.

HPCI and RCIC are unavailable.

CRDHSsee Table 3-2.

SLCavailable, but not used.

LPCI/core sprayone train of LPCI is available for RPV injection.

Containment Suppression pool coolingone train is available.

Nominal drywell and wetwell initial conditions (see Table 2-6).

Other operator LPCS may need to be disabled per EOP-1, if other actions low-pressure systems are available.

Actions to stabilize level/pressuresee Table 3-2.

Timing of manual ADS initiationsee Table 3-2.

The initiating event in each of these cases is an unanticipated reactor trip. The preferred sources of HPI, RCIC, and HPCI are unavailable, and only a single train of RHR is available by sequence definition.

Since the usual sources of HPI are unavailable, operators employ alternate means of injection, in this case CRDHS pumps. AIP 407 directs operators to start both pumps if available and raise the output to maximum. While the CRDHS pump is able to inject at an increased rate, the postscram increase is commonly discounted in analyses. The series of scenarios described in Table 3-2 shows the number of pumps available and the overall rate of injection. A nominal injection rate assumes a single CRDHS pump is operating at the prescram rate of 11.54 m3/hr (42.3 gpm). The maximized injection rate depends on the number of pumps operating and the RPV pressure (high pressure: 40.2 m3/hr (177 gpm) with one pump or 68.1 m3/hr (300 gpm) with two pumps; low pressure: 51.1 m3/hr (225 gpm) with one pump or 79.5 m3/hr (350 gpm) with two pumps).

As mentioned in the opening paragraphs of this section, operator action to depressurize the reactor will depend on the amount of HPI available and its sufficiency to support the inventory loss expected during the depressurization. In the cases within this section, the three levels of CRDHS injection (nominal injection, single train maximized, and two trains maximized) fell within the three situations described in the opening paragraph (insufficient HPI, enough injection to maintain level, and enough injection to support a reactor cooldown, respectively).

Given a nominal injection rate, the injection is insufficient to maintain the RPV level and thelevel falls rather quickly. MSIVs close on low RPV level, and operators take action to depressurize the RPV by ADS after level reaches +38 centimeters (+15 inches) and before it reaches -64 centimeters (-25 inches), with the two ends of the spectrum explored in the calculationmatrix.

The number of ADS valves available is also explored here with either one or two of the four total ADS valves available for emergency relief.

When a single train of CRDHS is injecting at the maximum rate, the makeup is sufficient to maintain level but may not be enough to facilitate a normal reactor cooldown. MSIVs remain open unless operators manually close them to limit inventory losses. Operators try to maintain RPV pressure within a 200 psig band. When the action is required region of the HCL curve (Graph 4 in the EOPs) is reached, operators are required to depressurize. There is some uncertainty whether operators would perform a rapid ED at this point or slowly modulate valves 3-6

to stay below the HCL curve and follow it down. A slow depressurization is performed here with a rapid depressurization explored in a sensitivity calculation.

With two trains of CRDHS injection available at the maximum rate, there is plenty of HPI to support a normal cooldown of the reactor to achieve low-pressure conditions and allow for LPI; in this case, LPCI. The rate of cooldown will depend on the adequacy of injection to maintain level but will not exceed 55.6 degrees C/hr (100 degrees F/hr). It is assumed in these calculations that the depressurization begins at 30 minutes at a rate of 44.4 degrees C/hr (80 degrees F/hr). This choice in timing is somewhat arbitrary but was deemed reasonable, since it would take time for operators to assess the sufficiency of injection and initiate a cooldown. The rate of depressurization is the lower bound of the suggested rate in the EOPs and is thought reasonable, since it seems unlikely that operators would depressurize the reactor at the maximum recommended rate when only alternate injection sources are available.

Regardless, the calculation is not particularly sensitive to these variables.

In the calculations with increased CRDHS injection, the assumption is that the CRDHS injects in batch mode with the pump (or pumps) secured when RPV level reaches Level 8 and restarted when level falls to Level 2. While this is the automatic mode of injection for HPCI and RCIC under normal conditions, there is no indication in the procedures that this is the method used for alternate injection using the CRDHS pumps. It was chosen for the sake of modeling convenience and to ensure that water does not spill over into the steamlines.

Early operator action to manually close the MSIVs to maintain pressure and limit inventory loss is also explored at various times. The condenser is assumed to be available in these scenarios in an effort to explore the impact of early MSIV closure. In reality, a train of feedwater or condensate is necessary for long-term availability of the PCS, since the condenser tubes would eventually be covered with water and rendered ineffective. Therefore, cases with automatic or no closure of the MSIVs assumes indefinite availability of the condenser for steam condensation.

3.2.2 MELCOR Simulation Results The following discussion is based on the results of the TRANS-30 scenarios (Cases 1-16). In addition to this, APPENDIX C APPENDIX D to this report provide figures for selected parameters of interest.

In the cases with nominal CRDHS injection (Cases 1-8), makeup is insufficient to maintain level, and the RPV water level falls quickly. In the cases without manual action to close the MSIVs, they close automatically on low RPV level (+163 centimeters [+64 inches]) at 16 minutes. Inventory is no longer lost through the steamlines to the condenser, but pressure quickly rises and the SRVs begin to cycle, dumping steam to the wetwell. The RPV water level continues to fall and ADS actuates when level reaches the assumed level setpoint of either +38 or -64 centimeters (+15 or -25 inches) with either one or two SRVs available for ADS. RHR is in LPCI mode by default and begins injection once RCS pressure is sufficiently low. Since RHR is needed in LPCI mode, and only one train of RHR is available by scenario definition, no wetwell cooling is available. Operators maintain RPV pressure around 0.34 MPa (50 psig) by modulating the SRVs as needed. Hence, torus water temperature slowly continues to rise.

When wetwell pressure reaches the required PCPL of EOP-2 of 53 psig, the hardened vent in the torus is opened and decay heat is expelled through the vent.

3-7

None of the scenarios with nominal injection results in core damage. However, in some cases, the core uncovers and experiences some heatup during ADS depressurization. Table 3-4 demonstrates the impact of various factors on the extent of this heatup. The factor with the greatest impact is the number of valves available. A single valve is able to depressurize the reactor and allow for LPI; however, the depressurization takes several minutes, during which time LPCI is deadheaded. During this time, the core uncovers and begins to heat up. As pressure continues to decrease, water in the feedwater lines begins to flow back into the RPV.

This water enters the RPV Downcomer, re-covering much of the core and preventing the core from overheating further, even before LPCI is able to inject. Some uncertainty is associated with the timing of water entering the RPV from the feedlines. Table 3-5 includes two sensitivity scenarios with the feedwater line isolated from the RPV at time zero. The scenarios still do not go to core damage, but there is a somewhat greater heatup of the core before LPCI is able to inject. Case 5b reaches 660 degrees C (1,220 degrees F) and Case 7a reaches 703 degrees C (1,297 degrees F).

With a second valve available, the depressurization rate is increased and LPCI injects sooner, precluding any significant heatup of the core. In addition, there is very little heatup of the core when waiting until the water level is at -64 centimeters (-25 inches), and there is no heatup when LPCI is initiated at +38 centimeters (+15 inches).

Table 3-4 Timing of Significant Events and the Maximal Peak Cladding Temperature Reached in the TRANS-30 with nominal CRDHS injection Maximum MSIV ADS Core Case # PCT1 closure actuation uncovery degrees C (min) (min) (min)

(degrees F)

1. 6.0 38.4 41.7 437 (819)

2. 6.0 38.4 42.2 -2

3. 6.0 52.1 45.5 499 (930)

4. 6.0 52.1 45.5 331 (628)

5. 16.3 39.0 42.3 441 (826)

6. 16.3 39.0 42.3 -2

7. 16.3 52.8 45.5 504 (939)

8. 16.3 52.8 45.5 336 (637) 1Recall that a PCT of 1,204 degrees C (2,200 degrees F) is the core damage surrogate.

2The maximum cladding temperature occurred during steady state (i.e., no heatup during the transient).

Manual action to close the MSIVs does not have a significant effect on the scenarios with nominal CRDHS injection. The difference between automatic closure on low water level and the assumed manual action is only 10 minutes. When the MSIVs are closed, RPV pressure quickly rises and the SRVs begin to cycle, so the difference in inventory lost in these 10 minutes is small.

In cases where a single train of CRDHS is able to inject at the maximum capacity (Cases 9-13),

the water level initially falls as inventory is lost through the MSIVs and SRVs. However, as the decay heat of the reactor decreases, the injection from the CRDHS is able to offset this loss and 3-8

recover the RPV level. Since the rate of injection is low, a cooldown of the reactor to low pressure, shutdown conditions is not initiated.

Manual action to close the MSIVs has a greater impact on the scenarios with a single train of increased CRDHS injection. Since the water level does not fall as far, automatic closure of the MSIVs does not occur and without operator action to close the MSIVs, the turbine bypass valves regulate RPV pressure by dumping steam to the condenser. However, with the early closure of the MSIVs at 10 minutes (Case 9), pressure quickly rises and reaches the SRV relief setpoint and begins relieving into the suppression pool (either by cycling on the lowest pressure SRV or by operators opening a valve to keep pressure below this setpoint), which reduces inventory, although not quite as much as the 20-minute case. The difference in RPV level between the 10-minute case and the 20-minute case (Cases 9 and 11) is only 11 centimeters (4.5 inches) at their lowest points. Another impact of early manual MSIV closure is the amount of decay heat that goes to the suppression pool rather than out the steamlines. This impacts the time needed to reach the action is required region of the HCL curve. If operators perform an ED (as in Cases 10 and 12), the loss in inventory is greater if ED occurs earlier in the transient, so early manual closure is less beneficial. If not performing an ED and operators only modulate the SRVs to stay below the HCL curve (as in Cases 9 and 11), then this is not a concern. The HCL curve is reached at 5.2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , when MSIVs are closed at 10 minutes versus 6.0 hours0 days 0 hours 0 weeks 0 months when closed at 20 minutes. ED, when the HCL curve is crossed in Cases 10 and 12, results in a level drop of 2.2 and 2.5 meters respectively. However, it is not enough to uncover the core in either case.

In the case with no operator action to close the MSIVs to maintain inventory, steam continues to be dumped to the condenser. Because of this, the wetwell water temperature does not rise and the HCL curve is never reached. Wetwell cooling is also not required and RHR remains dormant throughout the calculation In those cases where two trains of CRDHS are available (Cases 14-16), there is more than enough makeup to maintain the RPV water level. Because of this, a reactor cooldown can occur. Operators are assumed to start the cooldown at 30 minutes at a rate of 44.4 degrees C/hr (80 degrees F/hr). During this depressurization, CRDHS injects in batch mode through two cycles, injecting cool water from the CST that also aids in the cooldown of the reactor. Depressurization continues until pressure is low enough for LPCI to inject. These calculations assume that operators switch to LPCI when pressure drops below 200 psig. Also, at this time, one CRDHS is secured and the other is reduced to the nominal injection rate per AIP-407.

Early closure of the MSIVs at 10 versus 20 minutes has little measurable impact on these scenarios. There is abundant coolant being injected into the RPV, and the reactor cooldown begins at 30 minutes. However, in the 10-minute case, the SRVs cycle on the relief setpoint for several minutes before the initiation of the cooldown, but they do not in the 20-minute case.

When MSIVs are left opened, the reactor cooldown is performed using the turbine bypass valves rather than the SRVs. Hence, the cooldown does not result in any significant heatup of the wetwell, the HCL curve is never reached, and wetwell cooling is not needed.

The following discussion is based on the results of the TRANS-49 scenarios (Cases 17-20) as they compare to the TRANS-30 cases.

By sequence definition, depressurization capabilities are not available. In the sequence description, this corresponds to fewer than two ADS valves being available. The TRANS-30 3-9

calculations show that a single valve is successful in depressurizing the reactor in this scenario.

Hence, for these calculations, the inability for operators to depressurize implies no SRVs are available except in a pressure relief function.

For the cases that have no early closure of the MSIVs (Cases 18 and 20), the simulation progresses the same as in the analogous TRANS-30 cases (Cases 13 and 16). This is because the turbine bypass valves are being used rather than the SRVs to maintain RPV pressure and the inability to depressurize through the ADS system is nonconsequential.

In the case with early closure of the MSIVs and a single train of CRDHS (Case 17), only a single train of CRDHS is available, and it is sufficient to maintain level. The single train of RHR operates in wetwell cooling mode and extends the time to reach the HCL curve. EOP-1 directs operators to modulate the SRV to prevent the RPV from cycling on the SRVs. However, in this case, the ability to manually operate the SRVs is assumed lost and the SRVs cycle at the lowest SRV setpoint. The HCL curve is eventually crossed at 6.1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and without SRV operation available, operators would be directed to use alternate means to reduce pressure (Table 7 of EOP-1). Since RCIC and HPCI are unavailable by scenario definition, operators would be directed to use the MSL drains, RWCU (only modeled as a heat sink that ceases at reactor scram), or other steam-driven equipment to reduce the RPV pressure. Since the NRCs current model does not include these other systems, no further action to depressurize is modeled and RPV pressure remains elevated.

The case with early closure of the MSIVs and two trains of CRDHS (Case 19) progresses very similarly to that with a single train of CRDHS. Even though there is sufficient injection to support a cooldown, with MSIVs closed and SRVs unavailable, the pressure remains high, cycling on the lowest setpoint SRV. The HCL curve is crossed at 4.9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months , and operators would seek alternative means to reduce pressure.

Sensitivity Calculations In addition to these results, additional sensitivity studies were run to investigate specific issues, documented in Table 3-5.

Table 3-5 Sensitivity study matrixHPI and SRV criteria for non-ATWS Case # Sensitivity Impact 5a Increase CRDHS flow rate to Initially, there is little difference between this sensitivity and the base mimic alternate flow provided calculation. The additional injection from SLC does little to offset the by the SLC system (12.7 initial loss of inventory through the steamlines. ADS is actuated at m3/hr [56 gpm] per EOP-1, 46.4 minutes when level reaches +38 centimeters (+15 inches). The Table 2A). increased injection has a greater impact in the long term. Until 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , LPCI goes through 3 cycles (versus 4 cycles in the base calculation).

After 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , LPCI is no longer called upon to inject. SLC makeup is sufficient to prevent level from reaching L 2 between 8 and 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

This is in contrast to 4 more duty cycles of LPCI that occur in the base calculation.

6a LPI provided by CS rather There is little difference in the calculation. In the base calculation, it is than LPCI the timing of LPI that makes a difference in the calculations, not the source of that injection.

6b Automatic initiation of ADS ADS activates 120 seconds after the water level in the vessel (i.e., operator fails to inhibit Downcomer falls below Level 1. ADS actuates at 16.3 minutes, which is ADS early) just after MSIV closure. The core briefly uncovers at 19.3 minutes but LPCI injection allows for level recovery. In this case, bypassing 3-10

Table 3-5 Sensitivity study matrixHPI and SRV criteria for non-ATWS (continued)

Case # Sensitivity Impact automatic ADS actuation and manually actuating it delayed the need for LPCI by about 20 minutes.

6c Recirculation pump seal There is a minimal impact of recirculation pump seal leakage on the leakage of 4.1 m3/hr results of the transient. ADS actuation and core uncovery both occur (18 gpm) per pump 4 minutes sooner; there are some minor timing differences downstream of when LPCI injects.

5b Feedwater line isolated from In the base calculation, the water in the feedwater line enters the RPV 7a the RPV at start of scenario Downcomer just as the core begins to heat up and thereby arrests the heatup. In this scenario, a valve is added to the feedwater inlet to isolate the line at the start of the transient. Without this water, the core continues to be uncovered during the long ADS depressurization from a single valve. Core damage does not occur in either case but there is more heatup of the core before LPCI is able to inject.

3.3 Small Loss-of-Coolant Accident Sequence 3.3.1 Calculation Matrix Development Table 3-6 describes the PRA sequence that is the focus of this section.

Table 3-6 PRA sequences of interest for depressurizationSLOCA PRA Seq. Event Description SLOCA-25 Initiator Leakage occurs between 0.5- and 2-inch equivalent diameter (e.g., through-wall crack in recirculation piping).

/RPS Reactor is successfully shut down.

/OEP Offsite power is available (failure sequence disabled in model).

/VSC Failure of vapor suppression (top event is disabled in model)

PCS Power conversion system fails (e.g., operator fails to maintain feedwater injection).

MFW Main feedwater fails (e.g., operator fails to maintain feedwater injection).

HPI High-pressure injection fails (meaning RCIC and HPCI are both unavailable).

/DEP Manual depressurization of the reactor occurs (e.g., two of six SRVs opened by operator).

CDS Condensate system fails (e.g., operator fails to maintain condensate injection).

/LPI Low-pressure injection succeeds (namely one train of LPCI or one train of CS succeeds).

/SPC Suppression pool cooling late succeeds (namely, at least one train of RHR provides suppression pool cooling).

OK Core damage is averted.

Table 3-7 provides the calculation matrix for the subsequent MELCOR calculations, while Table 3-8 provides the calculation boundary and initial conditions. The following describes the key modeling assumptions made for these calculations.

3-11

Table 3-7 Calculation matrixHPI and SRV criteria for non-ATWSSLOCA Case Sequence CRDHS Timing of # of SRVs

ADS during initiation ADS

21. Based around SLOCA-251-inch 1 train, N/A N/A equivalent steam (steamline, inside maximized drywell) break

22. 2 trains, N/A N/A maximized

23. Based around SLOCA-251.8- 1 train, +15 1

24. inch equivalent liquid (recirculation maximized 2 loop) break

25. -25 1

26. 2

27. 2 trains, +15 1

28. maximized 2

29. -25 1

30. 2 Table 3-8 Initial and boundary conditionsHPI and SRV criteria for non-ATWSSLOCA These conditions are in addition to the generic modeling conditions from Table 2-6 and the calculation-specific conditions from Table 3-7.

System Condition RCS 100% (full power).

Reactor successfully trips on first-in RPS signal.

No recirculation pump seal leakage.

Number of SRVs availablesee Table 3-7.

Balance of plant Offsite power remains available.

Support systems are available unless specified otherwise.

Turbine trip occurs at the time of reactor trip.

Feedwater and condensate fail at the time of turbine trip.

MSIV closuresee Table 3-7.

ECCS/ESF ESF signals successfully perform their functions.

HPCI and RCIC are unavailable.

CRDHSsee Table 3-7.

SLCAvailable, but not used.

LPCI/core sprayone train of LPCI is available for RPV injection.

Containment Suppression pool coolingone train is available.

Nominal drywell and wetwell initial conditions (see Table 2-6) are present.

Other operator LPCS may need to be disabled per EOP-1, if other actions low-pressure systems are available.

Actions to stabilize level/pressuresee Table 3-7.

Timing of manual ADS initiationsee Table 3-7.

The initiating event in these scenarios is an SLOCA. The break size and location are varied with either a 1-inch equivalent steamline break or a 1.8-inch equivalent break in the recirculation line.

3-12

The steamline break takes place upstream of the MSIVs inside containment. The break size and location are interchanged in sensitivity calculations.

As in the TRANS scenarios, both RCIC and HPCI are unavailable and CRDHS is explored as the alternate source of injection with either one or two trains available for HPI. Operator action to initiate a cooldown of the reactor is contingent upon the sufficiency of CRDHS to provide sufficient makeup to support the cooldown.

For the steamline break cases, the scenarios play out similarly to the TRANS cases with a single train insufficient to support a reactor cooldown while two trains are sufficient. For the cases with a break in the recirculation line, the water level falls too quickly for CRDHS to provide sufficient makeup. MSIVs close on low RPV level, and operators take action to depressurize the RPV using ADS after level reaches +38 centimeters (+15 inches) and before it reaches -64 centimeters (-25 inches), with the two ends of the spectrum explored in the calculation matrix.

The number of ADS valves available is also explored here, with either one or two of the five total ADS valves available for emergency relief.

Again, early operator action to manually close the MSIVs to maintain pressure and limit inventory loss is explored. Cases with automatic or no closure of the MSIVs assumes indefinite availability of the condenser for steam condensation.

3.3.2 MELCOR Simulation Results The following discussion is based on the results of the SLOCA-25 scenarios (Cases 21-30). In addition to this, APPENDIX C to this report provides figures for selected parameters of interest.

In the cases with a steamline break (Cases 21 and 22), the break is small enough that pressure and level do not drop significantly. The setpoint for automatic MSIV closure at Level 1 is not reached and MSIVs remain open. Steam is dumped to the condenser through the turbine bypass valves. With a single CRDHS pump available, operators would likely not go to cold shutdown, since the amount of alternate HPI is only just sufficient to maintain RPV water level.

The wetwell water temperature heats up because of the steamline break that fills the drywell with steam. As the drywell pressure rises, steam is forced through the Downcomer vents to the wetwell, where it condenses. A single train of RHR is operating in wetwell cooling mode and keeps the wetwell temperature from rising to the point of reaching the HCL curve. Hence, depressurization is never required, and operators maintain RPV pressure in a 1.38-MPa (200-psi) band with some cooling of the RPV occurring from the injection of relatively cool CST water into the vessel by CRDHS.

With two trains of CRDHS, there is sufficient makeup to support a reactor cooldown. It is assumed to begin at 30 minutes at a rate of 44.4 degrees C/hr (80 degrees F/hr). Since the condenser is available, the depressurization uses the turbine bypass valves. Once pressure reaches 200 psig, RHR switches function to LPCI mode and becomes the source of injection. At this point, one of the CRDHS pumps is secured and the other is throttled to inject at a reduced rate (the nominal rate) in accordance with AIP-407.

The larger, recirculation line break causes the RPV water level to fall quickly. Unlike the TRANS and steamline break scenarios, CRDHS at the enhanced injection rate is unable to prevent a rapid decrease in water level even with both pumps operating. While none of the scenarios result in core damage, the core uncovers and, in some cases, experiences core heatup during ADS depressurization. Table 3-9 demonstrates the impact of various factors on the extent of 3-13

this heatup. The factors with the greatest impact are both the number of SRVs available for ADS actuation and the timing of ADS actuation.

In the cases with a single train of CRDHS available, the MSIVs close automatically at 4.8 minutes on the low RPV water level. Pressure rises shortly thereafter, and the RPV begins to cycle on the lowest setpoint SRV. Soon after, operators initiate ADS as the water level continues to fall and reaches either +38 centimeters (+15 inches) or -64 centimeters

(-25 inches). If two SRVs are available, there is only modest heatup of the core when operators wait to activate at -64 centimeters (-25 inches) (in Case 26) and no measurable heatup if ADS begins at +38 centimeters (+15 inches) (in Case 24). However, there is a rather significant heatup of the core if there is only a single valve available (Cases 23 and 25).

As in the TRANS scenarios above, as pressure decreases, water in the feedlines drains back into the RPV. However, Table 3-10 includes a sensitivity with the feedline isolated at the start of the transient and it shows little difference. A single valve is able to depressurize the reactor and allow for LPI with no core damage occurring. However, the margin for error is small, and crediting a single SRV for success is not recommended in this case.

Depressurizing the RPV in this case is important not just to speed the LPCI but also to increase CRDHS injection and decrease break leakage. The difference in injection between low and high pressures (40.2 m3/hr [177 gpm] versus 51.1 m3/hr [225 gpm]) means that the faster pressure is reduced, the sooner CRDHS can inject at a higher rate. Table 3-10 gives sensitivities with nominal CRDHS injection and two SRVs available. Both scenarios end in success, highlighting the importance of depressurization over injection rate.

Before ADS actuation, there is not a significant difference when two trains of CRDHS are available. The additional injection is still small compared to the loss through the break, and the water level falls quickly. MSIVs actuate on low level at 5.1 minutes. After ADS actuation, heatup of the core is less significant before LPCI, when a single SRV is available.

In those cases, with two SRVs available for ADS, CRDHS injection prevents core damage from occurring during the depressurization. LPCI begins after RPV pressure falls below the assumed deadhead pressure of 197 psid. This injection is able to recover the RPV water level fully, and all calculations thereafter are in a safe and stable state. With a single SRV, the time to depressurize the RPV is extended, and there is more uncertainty as to whether core damage would occur.

A number of cases (Cases 22, 23, 26-30) began to run very slowly caused by numerical issues in the code after RPV depressurization and in the long-term RHR cooling phase (after 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months in all cases). Since the reactor is in a safe and stable state in each of these scenarios at this point, no attempt was made to restart these scenarios and they were terminated before 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Table 3-9 Timing of significant events and the maximal peak cladding temperature reached in the 1.8-Inch recirculation line SLOCA cases Case # Maximum MSIV ADS Core PCT degrees closure actuation uncovery C (degrees (min) (min) (min)

F)1

23. 4.8 8.5 10.2 820 (1,508) 3-14

Table 3-9 Timing of significant events and the maximal peak cladding temperature reached in the 1.8-Inch recirculation line SLOCA cases (continued)

24. 4.8 8.5 11.3 -

25. 4.8 10.8 9.9 865 (1,589)

26. 4.8 10.8 9.9 384 (723)

27. 5.1 9.4 11.5 581 (1,078)

28. 5.1 9.4 12.5 -

29. 5.1 12.1 10.8 609 (1,128)

30. 5.1 12.1 10.8 344 (651) 1Recall that a PCT of 1,204 degrees C (2,200 degrees F) is the core damage surrogate.

2The maximum cladding temperature occurred during steady state (i.e., no heatup during the transient).

Sensitivity Calculations In addition to these results, additional sensitivity studies were run to investigate specific issues, documented in Table 3-10.

Table 3-10 Sensitivity study matrixHPI and SRV criteria for non-ATWS Case # Sensitivity Impact 21a Early closure of the MSIVs Operators take early action to close MSIVs at 10 minutes to conserve (10 minutes) inventory. SRVs are then used to regulate pressure rather than the turbine bypass valves in the base case. Even with a train of wetwell cooling available, the wetwell water temperature rises to the point that it crosses the HCL curve at 12.0 hours0 days 0 hours 0 weeks 0 months . A single SRV is throttled open to keep RPV pressure below the HCL curve. This has little impact, however, on the RPV level and the overall results of the scenario.

24a Nominal CRDHS Injection The CRDHS injection rate is reduced in these scenarios to the 26a nominal prescram rate of 9.61 m3/hr (42.3 gpm).

In both cases, the reduced CRDHS injection results in a more rapid drop in level with MSIV closure occurring at 4.5 minutes. ADS actuation begins sooner at 7.4 minutes and 9.7 minutes in Case 24a and 26a, respectively. Because the rate of injection is reduced, there is more uncovery of the core and the core heats up more. Unlike the base case, there is some modest heatup of the core in Case 24a with PCT reaching 373 degrees C (703 degrees F). In the second case, there is also slightly more heatup of the core with PCT reaching 478 degrees C (892 degrees F). In either case, using two SRVs to depressurize, the reactor is still able to expedite LPCI to prevent significant core uncovery.

24b LPI provided by a single The LPCS model was modified to operate in batch mode between 26b train of core spray rather Levels 2 and 8. There is no indication in the procedures that this is than LPCI how the pump would actually be operated. The choice was for modeling convenience and so that water would not flood the steamlines. Core spray injects to the region below the vessel shroud dome. Following ADS actuation, LPCS is able to inject sooner, since the shutoff head of LPCS is 264 psid versus 197 psid for LPCI.

In the first case, LPCS begins injecting 3 minutes sooner but still after the water level has reached its lowest point and recovered from water in the feedwater line re-entering the vessel. LPI begins sooner but at a slower rate with LPCS rather than LPCI, and level reaches Level 8 at about the same time as the base case.

In the second case, LPCS begins injecting at roughly the same time that the core begins to heat up. PCT reaches 378 degrees C 3-15

Table 3-10 Sensitivity study matrixHPI and SRV criteria for non-ATWS (continued)

Case # Sensitivity Impact (712 degrees F), and the core is completely covered at 16.5 minutes versus at 20.8 minutes in the base case.

24c Automatic initiation of ADS In the base case, pressure briefly rises after MSIV closure and the (i.e., operator fails to inhibit SRVs cycle before ADS actuation. In this sensitivity, both MSIV ADS early) closure and ADS actuation occur at 4.8 minutes, and there is no cycling of the SRVs. ADS actuation occurs only 4 minutes sooner than if operators waited for level to fall to +38 centimeters (+15 inches), so there is not a significant difference in the results, apart from minor shifts in timing.

23a Recirculation pump seal In the first case, the seal leakage causes ADS to actuate 0.4 minutes 24d leakage of 4.1 m3/hr sooner. Because of this, the lowest RPV water level is slightly higher (18 gpm) per pump than the base case. The highest PCT attained is 813 degrees C (1,495 degrees F), 7 degrees C (45 degrees F) less than the base case. Because the seal leakage is so much less than the injection rate of LPCI, it has little impact on the rate of level recovery once LPI begins.

In the second case, the seal leakage has a minimal effect on the simulation. MSIV closure and ADS actuation start 0.1 minutes sooner and water level falls slightly faster after each LPCI cycle. Again, there is no heatup of the core.

21b Break size and location of These sensitivities use a modified version of the deck with the size of 24e SLOCA exchanged the steamline break and recirculation line break interchanged.

In the first case, the larger steamline break causes the level to fall faster than in the base case. MSIVs close at 44.0 minutes on low RPV level. After the MSIVs close, the loss of inventory is reduced, and CRDHS is able to recover the water level. The RPV pressure does not remain elevated as in the base case but slowly falls over the course of the simulation. The "action is required" region of the HCL curve is never reached, since a single train of wetwell cooling is available and RPV pressure is kept low from the larger steamline break.

In the second case, with a smaller recirculation line break, the RPV water level falls much more slowly, but a single train of CRDHS is still unable to maintain the RPV water level. The MSIVs close at 9.4 minutes on low RPV level and ADS actuates at 23.0 minutes. The core just barely uncovers at 26.7 minutes before it is re-covered by CRDHS injection.

23b Feedwater line isolated from In the base calculation, the water in the feedwater line enters the RPV the RPV at start of scenario Downcomer just as the core begins to heat up and thereby arrests the heatup. In this scenario, a valve is added to the feedwater inlet to isolate the line at the start of the transient. There is minimal impact on the scenario from the water not entering or leaving the feedline. As in the base scenario, core damage does not occur, and there is a similar heatup of the core before LPCI is able to inject.

3.4 Conclusions Drawn from MELCOR Results The staff makes the following observations about the MELCOR results with regard to TRANS-30 and 49:

CRDHS injection alone operating at the nominal, prescram rate is insufficient in providing makeup to the RPV following an unexpected reactor trip. Another source of HPI (such as RCIC) or LPI with successful ADS operation is necessary for success.

3-16

A single SRV is able to depressurize the RPV and core damage is avoided. However, the uncertainty associated with the volume of water entering and leaving the vessel (i.e., seal leakage, CRDHS injection, feedwater line emptying) at this time makes success of this scenario uncertain.

The small difference in timing for MSIV closure (6 versus 16 minutes and 10versus 20 minutes) had little impact on the results. Of greater importance is whether MSIVs are closed at all and whether steam is condensed in the wetwell or condenser. If the condenser is available and MSIVs do not close on low RPV level, the HCL curve will never be reached and ED is not required. Without availability of the condenser, operator action to depressurize the RPV will be necessary to remain below the HCL curve.

A single CRDHS pump injecting at the postscram increased injection rate is sufficient for RPV water inventory makeup. However, it may not be sufficient to support an RPV cooldown in the first few hours of the transient.

Two CRDHS pumps injecting at the postscram injection rate provide more than enough makeup to the RPV and can facilitate a cooldown of the RPV to cold shutdown conditions as long as a train of RHR is available.

Without ADS, operators would have to use alternative means to depressurize the RPV after reaching the HCL curve.

Operator initiation of ADS at either the +15-inch or inch level has little impact on the success of the scenario.

The staff makes the following observations about the MELCOR results with regard to SLOCA:

Given an SLOCA in the steamline, pressure and level fall but a single train of CRDHS at the increased postscram rate is able to maintain the RPV level. This is true for both a 1-inch and 1.8-inch equivalent break. With two trains, there is more than enough injection to maintain level and to support a cooldown to cold shutdown conditions.

For a small, recirculation line LOCA, the loss of inventory is significant enough that even both CRDHS pumps operating at full capacity are insufficient to maintain level. A single train was insufficient even for a smaller 1-inch equivalent break.

As in the TRANS cases, two SRVs are necessary for ADS success. In addition, operator action to activate ADS at either the +15-inch or inch level has little impact on success.

3-17

4 MITIGATING STRATEGIES (FLEX) USAGE IN LOSS-OF-ALTERNATING-CURRENT-POWER SCENARIOS 4.1 Issue Description Following the severe accidents of March 2011 at the Fukushima Dai-ichi nuclear power plant site in Japan, the NRC issued several new regulatory requirements, including Order EA-12-049.

This order required all U.S. nuclear power plants to implement strategies that allow them to cope without their permanent electrical power sources for an indefinite amount of time. The associated strategies must keep the reactor core and spent fuel stored in pools cool, as well as protect the containment. The mitigation strategies use a combination of already installed equipment (e.g., steam-powered pumps), additional portable equipment that is stored on site, and equipment that can be flown in or trucked in from one of two regional response centers.

During the implementation of the above order, the NRC issued interim staff guidance (ISG) in the form of JLD-ISG-12-01, Compliance with Order EA-13-109, Order Modifying Licenses with Regard to Reliable Hardened Containment Vents Capable of Operation under Severe Accident Conditions, in August 2012 (NRC, 2012a), and Revision 1 of the same in January 2016 (NRC, 2016b). The January 2016 revision states the following, in part:

The NRC staff considers that the development, implementation, and maintenance of strategies and guidance in conformance with the guidelines provided in NEI 12-06, Revision 2, are an acceptable means of meeting the requirements of Order EA-12-049, subject to the exceptions, additions, and clarifications in the enclosure with this ISG. However, NRC endorsement of NEI 12-06, Revision 2, does not imply NRC endorsement of references listed in NEI 12-06, Revision 2.

Nuclear Energy Institute (NEI)-12-06, Diverse and Flexible Coping Strategies (FLEX)

Implementation Guide, Revision 2, issued December 2015 (NEI, 2015a), in turn, provides development, implementation, and maintenance guidance for the strategies and equipment, including the FLEX support guidelines (FSGs), which serve as a new set of guidance governing response to declared ELAP events.

These strategies and equipment are designed for use in postulated accidents where an ELAP is declared during the course of responding to an SBO, and so this project will provide confirmatory information with respect to the success criteria and sequence timing assumptions associated with potential licensee use in risk-informed licensing and oversight submittals.

However, in some cases licensees have sought credit for these strategies and equipment in non-ELAP scenarios (loss-of-ac-power scenarios more generally, or otherwise). Examples include the following:

Watts Bar Units 1 and 2EDG completion time extension based on availability of a FLEX diesel generator (TVA, 2016) and (NRC, 2017)

Palo Verde Units 1-3

- credit for FLEX in shutdown risk management (as stated by the PaloVerde licensee during public meetings) 4-1

- use of alternate ac FLEX connection box and FLEX diesel-driven steam generator makeup pump for exigent technical specification change (NRC,2016c)

For this reason, this project will develop similar confirmatory information for other scenarios of interest.

For Mark I and II containment designs, the NRC issued separate orders related to venting capabilities; namely, Order EA-12-050 Order to Modify Licenses with Regard to Reliable Hardened Containment Vents (NRC, 2012a), and a superseding modification in Order EA-13-109, Order to Modify Licenses with Regard to Reliable Hardened Containment Vents Capable of Operation Under Severe Accident Conditions (NRC, 2013a). The extension of venting capabilities covered by Order EA-13-109 is closely coupled with venting strategies used in the response to ELAP events.

Similar to the process described above for the mitigating strategies order, the NRC has issued two ISGs (JLD-ISG-2013-02, Compliance with Order EA-13-109, Order Modifying Licenses with Regard to Reliable Hardened Containment Vents Capable of Operation Under Severe Accident Conditions, dated November 14, 2013 [NRC, 2013a], and JLD-ISG-2015-01, Compliance with Phase 2 of Order EA-13-109, Order Modifying Licenses with Regard to Reliable Hardened Containment Vents Capable of Operation under Severe Accident Conditions, issued April 2015 [NRC, 2015b]) for Order EA-13-109 implementation, ultimately endorsing (with exceptions and clarifications) NEI-13-02, Industry Guidance for Compliance with Order EA-13-109, Revision 1, issued April 2015 (NEI, 2015b).

4.1.1 DAEC Post-Fukushima Actions Related to Mitigating Strategies In response to NRC Order EA-12-049, DAEC submitted an overall integrated plan on February 28, 2013, and 6-month periodic updates thereafter. DAEC is subject to all five hazards covered by the implementing guidance of this order: seismic; external flooding; storms with high winds; snow, ice, and low temperatures; and high temperatures (NextEra, 2013a). In December 2016, DAEC came into full compliance with this order (NextEra, 2016).

Similarly, in response to NRC Order EA-13-109, DAEC submitted its overall integrated plan on June 25, 2014, and 6-month periodic updates thereafter. The original plan and subsequent updates address a plant modification to provide a new severe-accident-capable hardened wetwell vent (i.e., HCVS). DAEC anticipates coming into final compliance with this order during the next refueling outage (NextEra, 2018).

4.1.2 The Scenario Assumed for Mitigating Strategies Formulation The purpose of the response to the mitigating strategies order was to develop strategies capable of mitigating a simultaneous loss of ac power and loss of normal access to the UHS resulting from a beyond-design-basis event by providing adequate capability to maintain or restore core cooling, containment, and SFP cooling capabilities (at all units on a site).

The following assumptions apply to the conditions leading up to the event and to the initiator itself (from NextEra, 2013a and NRC, 2014b):

4-2

The plant has been operating at 100 percent for at least 100 days or has just been shut down because of the impending event; SFP heat load assumes themaximum design-basis heat load for the site.

Reactor and support systems are in normal operational ranges, and all plant equipment is operating normally or is available from the standbystate.

The initiating event is assumed to be a LOOP resulting from an external event, with no prospect for recovery.

All installed sources of emergency onsite ac power and SBO alternate ac power sources are assumed unavailable and not imminentlyrecoverable.

The following additional assumptions apply after the event occurs:

Normal access to the UHS is lost, but the water inventory in the UHS remains available and robust piping connecting the UHS to plant systems remains intact. The motive force for river water supply pumps is assumed to be lost with no prospect for recovery.

Cooling and makeup water inventories contained in systems or structures with designs that are robust with respect to seismic events, floods, and high winds, and associated missiles are available.

Fuel for FLEX equipment stored in structures with designs that are robust with respect to seismic events, floods and high winds, and associated missiles remains available.

Permanent plant equipment that is contained in structures with designs that are robust with respect to seismic events, floods, and high winds, and associated missiles is available.

Other equipment, such as portable ac power sources, portable backup dc power supplies, spare batteries, and equipment for 10 CFR 50.54(hh)(2), may be used, provided it is reasonably protected from the applicable external hazards.

Elements of the installed electrical distribution system, including inverters and battery chargers, remain available, provided they are protected consistent with the current station design.

Recovery of damaged plant equipment is excluded.

No additional events or failures are assumed to occur immediately before or during the event, including security events.

All boundaries of the SFP are intact (e.g., liner, gates, transfer canals). Although sloshing may occur during a seismic event, the initial loss of SFP inventory does not prevent access to the refueling deck around the pool. The SFP cooling system is intact, including attached piping.

Offsite personnel start arriving at 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and the site will be fully staffed by 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after the event.

4-3

4.1.3 DAEC Plant Modifications To Comply with the Post-FukushimaOrders In accordance with (NextEra, 2013a; NextEra, 2014a), plant modifications made specifically to address the mitigating strategies order include the following:

addition of one portable 480V generator for alternate power connections:

- to repower 125V dc battery chargers (1D12 and 1D120), 250V dc battery charger ID43, and 480V ac load center IB0321

addition of two 120V ac generators for alternate instrument power connections:

- to repower 120V ac generator to IY11 and IY21 or connect 120V ac generator to instruments locally

a diverse injection point for connection of portable pumps to the RPV, using:

- a 4-inch branch installed on the RHR service water piping at location GBB-0042

- a connection point from the main turbine condenser system hotwell (to be used in flooding events only, as the condenser is not seismically qualified)3

new portable equipment storage locations

deployment location for portable equipment during floods

strategies for replenishing fuel supplies for portable equipment Attachments 2 and 3 of (NextEra, 2013a)4 include an equipment use matrix for Phases 2 and 3 of the mitigating strategies order.

In accordance with (NextEra, 2014b; NextEra, 2015b), additional plant modifications to address the severe accident capable hardened vent order include the following:

1 This load center designation was updated in (NextEra, 2014a).

2 (NextEra, 2013a) states that this involves a 4-inch branch to be installed on the 12-inch GBC-005, RHR service water piping upstream of MO 1942 in the South East Corner Room. (NextEra, 2014a) updates the location but does not specify whether the other characteristics (e.g., relationship to MO 1942) still apply.

3 (NextEra, 2013a) stated that a buried pipe would be installed to provide circulation pit water from the pump house to the (flood-protected area) turbine building. In (NextEra, 2015a), this approach was replaced by the use of the hotwell.

4 As indicated in (NextEra, 2014a), Attachment 6 of (NextEra, 2013a) inadvertently omits reactor water level indication.

4-4

A remote operating station for the HCVS is installed in the 1A35 essential switchgear room in the turbine building.

A new wetwell vent path is installed using an existing spare penetration off the wetwell, with new primary containment isolation valves and a new rupture disk. The vent piping is routed in to the south reactor building stairwell, up to the refuel floor, and out the reactor building roof. Attachment A of (NextEra, 2015b) includes a schematic of the ventpath.

A dedicated uninterruptable power supply and disconnect switches needed to power the HCVS are installed.

Attachment B of (NextEra, 2015b) lists the process instrumentation for the HCVS.

The only HCVS-related portable equipment identified in (NextEra, 2014b), beyond the portable diesel generator described above under the EA-12-049 modifications, is the compressed gas cylinders for longer term valve motive force.

This series of cases investigates what PRA functions the FLEX equipment and strategies can satisfy and what limitations need to be placed on failure or success of such equipment and strategies. For these cases, there are several key uncertainties to be explored. The bullets highlighted below in bold are the focus of this case.

The following are key uncertainties:

time of loss of ac power (i.e., EDG failure to run)

time of battery depletion6

time of ELAP declaration

time of RCIC loss (if other than upon battery depletion), including possible consideration of the following:

- efforts to manually operate RCIC without dc power (i.e., blackrun)

- suppression pool conditions:

heatup (i.e., NPSH or bearing overtemperature) pressure (i.e., high turbine exhaust pressure) level (i.e., insufficient suction)

- RCIC turbine flooding from RPV overfill or insufficient steam from RPV underfill

RCIC delivered flow 5 (NextEra, 2014b) updated this location from the original integrated plan.

6 This item encapsulates various issues that are transparent to the MELCOR model, such as the effectiveness of load-shedding efforts, the fluctuation in charge during the battery lifecycle, the extent of the demands on the batteries (e.g., SRV lifts, RCIC operation), and efforts to align a 480V ac generator to extend battery life.

4-5

availability of HPCI

number of relief valves actuating during depressurization and timing of action (also the subject of Chapter 3)

recirculation seal leakage

flow rate achieved by ac-independent injection, and timing of injectioncould also consider inadvertent partial diversion of flow (as at Fukushima) or core inlet plugging if dirty water is being used

timing and nature of containment venting (also the subject of Chapter 5)7

effect of containment venting/failure on late injection (also the subject of Chapter 6)

Although this investigation is anticipatory (focused on PRA uses that have not yet materialized),

the existing SPAR model is still used as an anchor point for selecting one SBO sequence with postulated late-use of diverse RPV injection using a FLEX pump and one non-SBO sequence of the same. Section 4.2 describes the SBO sequence, while Section 4.3 describes the non-SBO (LOMFW) sequence.

4.2 Station Blackout Sequence 4.2.1 Calculation Matrix Development Table 4-1 describes the PRA sequence that is the focus of this section.

Table 4-1 SBO sequence of interest for FLEX-based diverse injection PRA Event Description Sequence LOOPGR- Initiator A grid-related LOOP occurs.

38-9

/RPS Reactor is successfully shut down.

EPS Both divisions of emergency onsite power (diesel generators) fail, resulting in an SBO.

/SRV SRVs successfully reclose (if demanded).

/RPSI Recirculation pump seals retain their integrity.

/RCI02 RCIC successfully provides high-pressure RPV makeup before battery depletion.

EXT RCIC fails at or near the time of battery depletion (e.g., because of failures related to valve alignment).

/DEP-B Manual depressurization of the reactor occurs (e.g., two of six SRVs opened by operator).

/FWS AC-independent injection succeeds in providing low-pressure RPV makeup (assumed here to come from the FLEX pump diverse injection capability). Set to fail in current baseline model.

7 Site-specific information related to containment venting can also be found in Technical Support Guidance Appendix C and SEPs 301.1-301.3. The licensee provided most of these with its postsite visit submittal, while it included the SEP 301.1 just before the site visit with the FSG supporting material.

4-6

Table 4-1 SBO sequence of interest for FLEX-based diverse injection (continued)

PRA Event Description Sequence OPR- Offsite power is not recovered within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

12H DGR- A diesel generator is not recovered within 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months simplying that the FSG-12H based action to receive and hook up a 4160kV turbine generator from the National SAFER Response Center has not occurred.

/CVS-B Containment venting operations are successful.

/L01 Injection continues after venting operations.

OK Core damage is averted.

Table 4-2 provides the calculation matrix for the subsequent MELCOR calculations, while Table 4-3 provides the calculation boundary and initial conditions. A discussion of the key modeling assumptions made for these calculations follows.

Table 4-2 Calculation matrix mitigating strategiesSBO Case Time of ac Time of loss of RCIC 1 2 3 CST availability Venting actions4

loss 1 Required t = 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (FLEX pump Available 2 Anticipatory provides injection 3 thereafter) Required Unavailable 4 Anticipatory 5 Required t = 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months (FLEX pump Available 6 Anticipatory t=0 provides injection 7 thereafter) Required Unavailable 8 Anticipatory 9 Required Available 10 Indefinite (no FLEX Anticipatory 11 injection) Required Unavailable 12 Anticipatory t = 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (FLEX pump 13 provides injection thereafter)

Required t = 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months (FLEX pump Available t = 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months 14 provides injection thereafter) 15 Indefinite (no FLEX Anticipatory 16 injection) Unavailable 1 Although the SPAR model dictates that RCIC would fail from battery depletion, the FLEX portable diesel generator may be able to provide this battery power. RCIC failure here is assumed to occur, not for one particular reason but rather based on a myriad of potential failure modes, such as high exhaust pressure, suppression pool temperature, and battery depletion. As such, RCIC could be lost before this time. If RCIC trips, restart is not considered (as a simplifying assumption).

2 Depressurization following battery depletion would require additional actions to locally operate the SRVs, as they require dc power for other-than-pressure relief operation.

3 At 110 psig, the FLEX pump is able to inject to the RPV at a rate of approximately 129 m3/hr (570 gpm). The licensee provided a pump curve to generate the nominal pressure-dependent flow rate.

4 Required venting refers to the PCPL of EOP-2 venting action of maintaining 0.31-0.37 MPa (45-53 psig) in the wetwell. Anticipatory venting refers to maintaining a pressure band of 0.03-0.07 MPa (5-10 psig) in SEP 301.3.

4-7

Upon a loss of all ac power, operators enter AOP 301.1 for an SBO. This procedure directs operators to begin a rapid depressurization of the reactor, not surpassing a cooldown rate of 44.4-55.6 degrees C/hr (80-100 degrees F/hr). This must be initiated within 30 minutes, regardless of whether an ELAP has been declared. Hence, for the simulations in the calculation matrix of Table 4-2, there is a 55.6-degree-C/hr (100-degree-F/hr) cooldown that begins 30 minutes after the loss of all ac power. The EOPs contain a warning for operators to maintain RPV pressure greater than 150 psig to prevent RCIC loss on low steam pressure; therefore, a lower bound of 150 psig is enforced while RCIC is available for injection. Operators are permitted by EOP-2 to exceed the 55.6-degree-C/hr (100-degree-F/hr) cooldown limit, should this rate be insufficient in staying below the HCL curve. However, the cooldown limit is sufficient in all of the calculations in Table 4-2.

AOP 301.1 directs operators to declare an ELAP if (1) it is determined that ac power may not be restored within the coping time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , or (2) if the plant has been in an SBO condition for 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Therefore, it is reasonable to assume that an ELAP is declared 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after loss of all ac, and operators enter a beyond-design-basis event at this time. Operators then perform load-shedding actions (within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months ) to extend the battery life of the safety-related station batteries. During this time, RCIC (or HPCI if RCIC is unavailable) provides core makeup from either the CST or the suppression pool (depending on availability but with preference given to the CST). CST availability is varied in the calculation matrix with RCIC taking suction on either the CST or the wetwell.

RCIC/HPCI failure in the SPAR SBO sequence occurs upon battery depletion since dc power is required for RCIC/HPCI control. As previously described, FLEX procedures include the staging of a 480V diesel battery charger for repowering the 125V dc battery chargers (1D12 and 1D120). If this is successful, dc power and control of RCIC/HPCI is not lost. There are, however, many other potential failure modes for RCIC/HPCI, such as high exhaust backpressure, loss of NPSH, and overheating of bearings. The range of failure times in Table 4-2 is intended to reflect these failure modes as well as the failure of the FSG-based use of a portable diesel generator to supply power to station battery chargers. Note that indefinite RCIC availability implies that the battery recharging is successful. The other pump and turbine trips built into the model are still active.

The availability of a FLEX pump for injection following the loss of RCIC is also explored. The pump is assumed to have been staged for injection before the loss of dc power in accordance with the FSGs. Upon a loss of RCIC, two SRVs are used to rapidly lower pressure such that it remains below 50 psid between the RPV and wetwell. (EOP ED calls for RPV pressure less than 50 psig above torus pressure.) In the applicable scenarios, the FLEX pump begins injecting when RPV pressure falls below the pumps 110 psig deadheadpressure.

This section also investigates venting actions. In the event of a loss of the UHS or an ELAP, operators would open the HCV to maintain an anticipatory pressure band of 5-10 psig to maintain RCIC injection. If anticipatory venting does not occur, when the wetwell pressure approaches 53 psig, the required PCPL of EOP-2 venting action of maintaining 45-53 psig would be enforced (see Appendix B).

Under normal conditions, RCIC injection is performed in batch mode wherein the RCIC pump is secured when the RPV level reaches the desired maximum level (normally Level 8) and then restarted when level falls below the minimum desired level (normally Level 2). EOP-1 grants operators the option to use RCIC in an expanded level band if loss of injection is a concern.

This expanded band is 38 centimeters (15 inches) to 655 centimeters (258 inches) above the 4-8

TAF. Discussions with DAEC operations staff suggested that operators are unlikely to allow level to go below 303.5 centimeters (119.5 inches) (referred to as Level 2), even when it is procedurally permitted. Hence, batch RCIC injection for these calculations is taken to be RCIC cycling full on and full off to maintain a band of 303.5 centimeters (119.5 inches) to 655 centimeters (258 inches). The exception to this is scenarios with ac power available for the first 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . In an early round of calculations, water level continued to increase even after RCIC was secured at the expanded high level because of ongoing injection from CRDHS. This led to water entering the steamlines and a loss of RCIC on a code-automatic trip signal of a high steamline water level. For this reason, the upper bound of the RCIC level band was reduced by 0.5 meters (20 inches) (from 6.55 meters [258 inches] to 6.05 meters [238 inches] above TAF) to prevent flooding of the steamlines and loss of RCIC. This was thought reasonable since RCIC could be expected to operate with some water entering the steamlines. The LOMFW scenarios in the next section explore this further.

FLEX guideline SAMP-730 recommends that operators not run RCIC in batch mode when taking suction on the wetwell with wetwell water temperature greater than 215 degrees F. The concern is degradation in pump performance and reliability at such an elevated temperature.

Instead, operators are encouraged to throttle the pump within the permitted level band. If the CST is unavailable and suction is being taken on the wetwell, the current calculations model this throttled injection when the water temperature in the suppression pool reaches 215 degrees F.

However, if RCIC is already secured when the temperature reaches 215 degrees F, it is assumed that injection does not start until level falls back to Level 2. The target level assumed here is the normal RPV level of 485 centimeters (191 inches) above TAF. This choice should be carefully evaluated since, although thought to be reasonable, the water level could procedurally be maintained anywhere between 38 and 655 centimeters (15 and 258 inches).

If wetwell water temperature is greater than 250 degrees F, SAMP-730 directs operators to throttle RCIC full open to run up the water level to just below the steamlines before swap-over to FLEX injection. This is not included in the staffs model since, for one, the wetwell water temperature reaches this value after the swap-over to the FLEX pump has already occurred. In addition, procedurally, this runup of level only takes place when wetwell temperature exceeds 250 degrees F. There is no known procedure for running up water level when anticipating the loss of RCIC before this temperature is attained; however, the possibility of operators running up water level before the loss of dc power is investigated as a sensitivity calculation.

RCS depressurization following loss of dc power requires additional actions to locally operate the SRVs since they require dc power for operation other than automatic pressure relief. For all LOOP scenarios, it is assumed that depressurization is successful, regardless of whether RCIC failure was caused by dc power loss. SAMP-707 provides procedures for depressurizing the RPV by use of battery carts or battery packs, or both, to open the valves locally. Hence, RCS ED begins at the time of RCIC loss and the FLEX pump begins injecting when pressure falls below the pumps 0.76 MPa (110 psig) deadhead pressure. It is important to note that, upon a loss of all dc power, without this local depressurization, the staged FLEX pump would be deadheaded, and core damage would occur.

4-9

Table 4-3 Initial and boundary conditionsmitigating strategiesLOOPGR These conditions are in addition to the generic modeling conditions from Table 2-6 and the calculation-specific conditions from Table 4-2 System Condition RCS 100% (full power).

Reactor successfully trips on loss of offsite ac.

Nominal1 recirculation pump seal leakage.

Number of SRVs availabletwo of six.

Balance of Offsite powerunavailable.

plant Onsite emergency acsee Table 4-2.

DC powersee Table 4-2.

Support systems are available (if ac is available) unless specified otherwise.

Turbine trip occurs upon loss of offsite ac.

Feedwater and condensate fail upon loss of offsite ac.

MSIV closure occurs upon loss of offsite ac.

ECCS/ESF ESF signals successfully perform their functions until battery depletion.

CST availabilitysee Table 4-2.

HPCI is unavailable (by PRA sequence definition).

RCIC availabilitysee Table 4-2.

CRDHS and SLC are unavailable upon loss of ac.

LPCI/core spray are unavailable upon loss of ac.

Containment Suppression pool cooling is unavailable upon loss of offsite and onsite ac.

Nominal drywell and wetwell initial conditions (see Table 2-6).

Other If credited, LPCS may need to be disabled per EOP-1, if other low-pressure operator systems are available.

actions Actions related to RPV depressurizationsee Table 4-2.

Actions related to containment ventingsee Table 4-2.

Actions to align alternate injection via a FLEX pumpsee Table 4-2.

1 In this context, this means 4.1 m3/hr (18 gpm)/pump at the lowest SRV pressure setpoint.

4.2.2 MELCOR Simulation Results Table 4-4 lists the results of the 16 LOOP calculations. In addition to this, APPENDIX D to this report includes figures for selected parameters of interest.

Table 4-4 LOOPGR results RCIC Containment FLEX pump Core Core Case suction venting injection uncovery damage source (hours) begins (hours) (hours) (hours)

1. CST Required (20.7) Yes (4.0) No No

2. CST Anticipatory (6.4) Yes (4.0) No No

3. WW Required (17.7) Yes (4.0) No No

4. WW Anticipatory (5.6) Yes (4.0) No No

5. CST Required (20.6) Yes (8.0) No No

6. CST Anticipatory (7.1) Yes (8.0) No No

7. WW Required (16.3) Yes (8.0) No No

8. WW Anticipatory (6.0) Yes (8.0) No No

9. CST Required (21.0) No > 24 > 24 4-10

Table 4-4 LOOPGR results (continued)

RCIC Containment FLEX pump Core Core Case suction venting injection uncovery damage source (hours) begins (hours) (hours) (hours)

10. CST Anticipatory (7.1) No No No

11. WW Required (12.4) No 10.5 12.0

12. WW Anticipatory (6.0) No No No*

13. CST Required (23.2) Yes (4.0) No No

14. CST Required (22.6) Yes (8.0) No No

15. CST Anticipatory (7.8) No No No

16. WW Anticipatory (6.9) No No No*

Although core damage is not predicted in these calculations, RCIC is operating for an extended period of time (>16 hours) with suction on the wetwell and low NPSH available. Pump damage caused by cavitation is likely and the success of the scenario is questionable at best.

In many cases, during the first cycle of RCIC, the RPV water level dips significantly lower than Level 2 before RCIC injection raises the level. The cause of this is multifaceted. First, there is a 30-second delay in RCIC injection following level falling through Level 2. In addition, the temperature of the water injected by RCIC is significantly cooler than the water already in the feedwater line (105 degrees F versus 430 degrees F). The density of the water is increasing rapidly both here and in the RPV. This change of density is likely a factor in the slow-to-respond water level. Additionally, early on in the sequence progression, the decay heat is high enough to significantly influence the efficacy of RCIC injection.

In those cases where all ac power is lost at time zero, the reactor trips and the RPV cycles on the lowest pressure SRV. After 30 minutes, the 55.6 degree C/hr (100 degree F/hr) cooldown is initiated. The model used a PID controller to attain this cooldown rate. Hence, there are times when the rate is exceeded (particularly when RCIC injection takes place), but on average, the desired rate is maintained.

In the scenarios in which all ac power is lost at time zero and RCIC is lost at 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (Cases 1-4 and 14), there is ample cooling from RCIC injection to the RCS from either the wetwell or the CST. The RCS is depressurized to 1.03 MPa (150 psig) to allow for prolonged RCIC injection.

RCIC makes it through one full cycle and part of a second. At 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , RCIC is secured, the RPV is rapidly depressurized to 0.34 MPa (50 psig), and FLEX begins injection at the nominal rate. Whether operators perform anticipatory venting or not is of no consequence to the success of these sequences, since wetwell pressure is below 0.07 MPa (10 psig) at 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months when the FLEX pump begins to inject. RCIC performance is not in question, and the success of FLEX pump injection is not contingent upon the pressure or temperature in the wetwell. However, the hardened vent must still be opened eventually to allow for the expulsion of decay heat from the wetwell, which occurs in these cases at either the anticipatory or the required setpoints of 0.07 MPa (10 psig) or 0.37 MPa (53 psig), respectively.

The NPSH available for RCIC suction on the wetwell is estimated for those scenarios in which the CST is unavailable (Case 3 and 4). At 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , the NPSH is well above the 6.1 meters (20 feet) of head that is required for RCIC pump suction according to the UFSAR. This implies that pump cavitation is not a concern when swap-over occurs at 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

In the scenarios with RCIC lost at 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months (Cases 5-8), RCIC makes it through three cycles before it is lost, and operators switch to FLEX injection. When the CST is available (Cases 5 and 6), RCIC injection remains in batch mode for the entire 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . As in the analogous 4-hour cases, anticipatory venting has little impact on the outcome when CST is available, although 4-11

venting is necessary for decay heat rejection to the environment. In the cases where the CST is unavailable (Cases 7 and 8), RCIC injection is throttled around 5.1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months when the wetwell temperature rises above 215 degrees F. Not long after this, the NPSH available for RCIC falls below 6.1 meters (20 feet) and some cavitation in the pump is possible (although it is not modeled). When the hardened vent is opened around 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months in the case with anticipatory venting, the NPSH drops even further. As of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , the NPSH available to RCIC is 3.41 meters (11.2 feet) in the case without anticipatory venting and 1.7 meters (5.6 feet) in the case with anticipatory venting.

In the cases where RCIC is available indefinitely (Cases 9-12), a swap-over to FLEX pump injection is assumed not to occur, and RCIC remains the source of long-term injection. It is perhaps not intuitive that core damage occurs in the case with RCIC suction from the CST and required HCL venting (Case 9), since RCIC is injecting cool water from the CST. Although CST inventory has not been exhausted, RCIC still trips around 20.2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The cause of this loss of injection is a RCIC turbine trip on high backpressure in the wetwell of 0.34 MPa (50 psig). Since the wetwell pressure is allowed to increase to 0.37 MPa (53 psig) with the required PCPL venting, this trip is inevitable. Since dc power is available in this scenario, the automatic protection system is active and RCIC cannot be restarted. This is similar to what is thought to have happened at Fukushima Unit 3. There, dc power was available and RCIC injection was lost at 21 hours2.430556e-4 days 0.00583 hours 3.472222e-5 weeks 7.9905e-6 months because of the high backpressure trip (Sandia, 2014a).8 With dc assumed to be available in these scenarios, the trip is active, and they are assumed to go to core damage because of a loss of RCIC injection when wetwell pressure reaches 0.34 MPa (50 psig). Operator action to vent the wetwell at the anticipatory setpoint of 0.07 MPa (10 psig) in Case 10 prevents this trip of RCIC from occurring and core uncovery and damage are not predicted to occur so long as the CST is available. As of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , there is ample water still available in the CST.

When RCIC suction is on the wetwell, as in Cases 11 and 12, the pressure in the wetwell and operator venting action is also important. Without anticipatory venting, the wetwell pressure and temperature continue to rise as the RPV vents into the wetwell. The bulk water temperature in the wetwell reaches 250 degrees F at 7.9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months , and RCIC is assumed to fail. Without an injection source, core uncovery and damage occur. Conversely, in Case 12, venting of containment begins at 6.0 hours0 days 0 hours 0 weeks 0 months . The anticipatory venting is successful in keeping the wetwell pressure low and therefore keeping the water temperature under the 250 degrees F threshold for loss of RCIC. Hence, there is no hard trip of RCIC, and injection continues with RCIC being throttled for makeup. However, the NPSH available to the pump drops below 6.1 meters (20 feet) at 5.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , and cavitation is possible. Once wetwell venting begins and the pressure drops, the NPSH falls and is at 1.6 meters (5.1 feet) at 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . Operating RCIC out beyond 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months while taking suction on a saturated pool is therefore beyond what RCIC is designed for, and this scenario should not be considered a success. Hence, with long-term RCIC injection on the wetwell, wetwell venting has the positive effect of keeping the suction water temperature below 250 degrees F and reducing concern for RCIC failure on high bearing temperature, but it has the negative effect of reducing the NPSH available to the pump by reducing the pressure within the wetwell. According to the DAEC UFSAR (Section 1.8.1), the maximum wetwell 8 If dc power had not been available, SAMP-703 discusses RCIC operation during loss of electrical power. It states that, if turbine exhaust pressure reaches 50 psig, operators are to close the RCIC throttling valve; however, there is a warning statement that the automatic initiation and isolation features will not be available. In this case then, the 50-psig turbine isolation on backpressure requires a manual action and operators could reopen the RCIC valve when pressure drops below 50 psig.

4-12

pressure that can be credited for NPSH is 0.15 MPa (22 psia). Hence, the lower NPSH from anticipatory venting is more in line with the licensees assumptions.

In summary, anticipatory venting and CST availability become critical when dc power is not lost, long-term injection from RCIC is relied upon, and there is no FLEX swap-over. Core damage was averted when CST injection was combined with early venting (Cases 10 and 15).

For these scenarios, the combination of cool water from the CST and expulsion of decay heat out the HCV by means of anticipatory venting led to success. Without this early venting (Case 9), the RCIC turbine trips on high backpressure in the wetwell and damage occurs. All cases with long-term RCIC suction on the wetwell cannot be assumed to be in a safe and stable state at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . If anticipatory venting does not occur, RCIC is lost because of high wetwell water temperature and fuel damage occurs. With anticipatory venting, the NPSH available to the pump is low enough that damage to the pump could occur and the source of injection would be lost.

In those scenarios in which ac power is available for the first 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months from the diesel generators (Cases 13-16), the emergency diesels power the wetwell cooling from the RHR system and injection from CRDHS and both are therefore available for the first 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . Since MFW relies on offsite power, RPV makeup is provided by RCIC. MSIVs close on a LOOP and the SRVs open, relieving pressure to the wetwell. Upon a complete loss of ac at 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , CRDHS injection and wetwell cooling are lost. Operators then begin a cooldown of the reactor at the maximum allowed rate.

When compared to the analogous scenarios with ac power lost at the start of the transient (Cases 1, 5, 10, and 12), since the wetwell is initially cooled by RHR, action to vent the wetwell through the hardened containment vent is delayed in these scenarios. In the cases with FLEX pump swap-over and indefinite RCIC injection from the CST (Cases 13-15), this has little impact on the scenario results, apart from shifts in timing, and RPV water level is successfully maintained. In the case with indefinite RCIC injection on the wetwell and anticipatory containment venting (Case 16), the NPSH available to the pump is still a concern although it falls below the required head at 7.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months rather than at 5.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months in Case 12. Again, the pump never trips on high wetwell water temperature, but long-term cavitation in the pump is a concern.

Sensitivity Calculations In addition to these results, additional sensitivity studies were run to investigate specific issues, documented in Table 4-5.

Table 4-5 Sensitivity study matrixmitigating strategiesSBO Case # Sensitivity Impact 7a Availability of HPCI, in lieu With the much greater injection rate of HPCI, the water level recovers at 8a of RCIC a greater rate during the first duty cycle and there is more overshooting 9a of RPV level past the point when HPCI is secured. Steamline flooding occurs in all three cases. This occurs since relatively cold water is being injected rapidly up to the setpoint, which then heats up and expands. In all three cases, HPCI is lost on a code-automatic trip of HPCI when the steamline floods to a certain level. This trip is meant to capture the phenomena of turbine damage when a large volume of water enters the steamlines. There is uncertainty as to whether the pump would be lost since the Terry turbine is designed to handle some liquid water ingress.

4-13

Table 4-5 Sensitivity study matrixmitigating strategiesSBO (continued)

Case # Sensitivity Impact Without HPCI injection, water level falls quickly with core uncovery occurring before 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in all three cases. Since the FLEX pump is not yet available for injection, RPV level does not recover in time and core damage occurs in all three cases.

8b FLEX delivered flow The reduced flow has very little impact on the long-term state of the reduced by 50% reactor water level. It takes a little longer for the water level to turn around following RCIC failure, allowing water level to drop slightly further before it is recovered. Note that this is 50% of the rated flow (~114 m3/hr

[500 gpm]) and not 50% of the committed flow (68.1 m3/hr [300 gpm])

and that injection is taking place after 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , when the decay heat is significantly less. This sensitivity highlights the sufficiency of normal FLEX pump injection to provide adequate makeup for long-term cooling.

8c Increased recirculation The increased leakage led to an increased demand for RCIC injection. In seal leakage (13 m3/hr the base case, the vacuum breakers open repeatedly to equalize (60 gpm) per pump) pressures in the wetwell and drywell as the wetwell pressure rises because of RPV depressurization. There is less need for this pressure equalization in the sensitivity since the drywell is pressurized from the additional seal leakage into containment. As a result, less heat from the wetwell enters the drywell and the hardened vent opens 6 minutes sooner. Overall, there is not a significant difference when compared to the base case, other than modest timing shifts. Importantly, core damage still does not occur.

8d No recirculation seal There was little difference in the results of this calculation. The timing of leakage key events shifted slightly. Without water leaking into the drywell, wetwell and drywell pressures rise somewhat more slowly and venting begins 7 minutes later. Nominal seal leakage appears not to play a significant role in the outcome of this scenario.

8e Run up the water level to SAMP-730 directs operators to run up the water level before securing the steamlines before RCIC. In this sensitivity, at 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , RCIC is throttled fully open until FLEX swap-over water level is just below the steamlines. RPV ED is then initiated.

Wetwell water level is at +5.6m (220 inches). It takes 18 minutes for water level to reach 0.25 meters (10 inches) below the steamlines (the level given in the EOPs). ED brings the level down by 2.4 meters (94 inches) to roughly the normal water level and then FLEX injection maintains the level.

8f Alternate decay heat Little to no difference in the simulation since the two decay heat formulation using the formulations are very similar, with the ANS curve being nearly identical built-in ANS decay heat in the first 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , slightly lower from 2 to 9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months , and slightly greater standard after 9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months . Because of this, wetwell venting occurs 7 minutes later than the base case, but the long-term temperature in the wetwell is slightly higher in this sensitivity and the wetwell pressure at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months was about 0.007 MPa (1 psid) greater than the base case.

1 In earlier versions of the MELCOR deck, there was a low primary side pressure trip setpoint of 1.03 MPa (150 psid) between the wetwell and RPV steamlines (taken from UFSAR Table 15.0-6 p124/141 for P_rpv = 1.14 MPa (165 psia) while Figure 5.4-10 tells us P_ww is 0.14 MPa (19.8 psia) in this case). This was changed in later versions of the deck since it did not appear to agree with what is in the EOPs (they state that RCIC is available down to RPV pressure of 1.03 MPa (150 psig)). Also, the RCIC system description gives RPV pressure of 0.517 MPa (75.0) psig as the trip setpoint for the RCIC turbine. Even though a differential pressure setpoint is more realistic, the RCIC system description and the PB precedent were followed with a trip setpoint of 0.52 MPa (75 psig).

4.3 Loss-of-Main-Feedwater Sequence 4.3.1 Calculation Matrix Development Table 4-6 describes the PRA sequence that is the focus of this section.

4-14

Table 4-6 LOMFW sequence of interest for FLEX-based diverse injection PRA Event Description Sequence LOMFW- Initiator A loss of all MFW occurs.

25

/RPS Reactor is successfully shut down.

/OEP Offsite power is available.

/SRV SRVs successfully reclose (if demanded).

/HPI HPI succeeds (RCIC or HPCI).

SPC Suppression pool cooling (RHR) fails (e.g., common-cause failure of suppression pool strainers)

/DEP Manual depressurization of the reactor occurs (e.g., two of six SRVs opened by operator).

CRDHS CRDHS fails to provide makeup (e.g., one of two trains out for testing and maintenance).

CDS CDS fails to provide makeup (e.g., common-cause failure of pump discharge check valves).

LPI No trains of CS or LPCI succeed at providing LPI (e.g., common-cause failure of suppression pool strainers).

/VA Alternate LPI is successful (to be investigated here using the FLEX pump).

Shutdown Shutdown cooling fails (e.g., operator error).

cooling CSS Containment spray cooling mode of RHR fails (e.g., operator error dependent on failure to align shutdown cooling).

PCSR The PCS failure is not recovered (e.g., inability to recover the pump discharge check valve common-cause failure).

/CVS Containment venting operations are successful.

/LI Injection continues after containment venting.

OK Core damage is averted.

Table 4-7 provides the calculation matrix for the subsequent MELCOR calculations, while Table 4-8 gives the calculation boundary and initial conditions. A discussion of the key modeling assumptions made for these calculations follows.

Table 4-7 Calculation matrixmitigating strategiesLOMFW-25 Case Time of RCIC Time and method of RPV Time/delivered flow of

failure4 depressurization1,2,3 FLEX injection 5

17. Timing based on EOP-2 HCL/Follow HCL t = 5 hour5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months s/nominal

18. curve t = 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months s/nominal

19. t = 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months t = 5 hour5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months s/nominal

20. Timing based on EOP-2 HCL/Rapid t = 5 hour5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months s/nominal25%

21. t = 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months s/nominal 1 Depressurization following battery depletion would require additional actions to locally operate the SRVs, as they require dc power for other than pressure relief operation.

2 Follow HCL curve refers to the heat capacity limit curve (Graph 4) in EOP-2. The MELCOR model encodes the operator actions to achieve this depressurization and walk down the HCL curve. Rapid infers a single action wherein multiple SRVs are opened when the action is required regime in Graph 4 is first reached and a 55.6 degree C/hr (100 degree F/hr) cooldown is initiated.

3 The RC/P leg of EOP-1 includes a provision to stop depressurization before losing the pressure required to operate RCIC (i.e., 1.03 MPa (150 psig)).

4 RCIC may be lost before this time, based on, for example, high exhaust pressure or suppression pool temperature.

In the calculations, if RCIC trips, restart will not be considered (as a simplifying assumption).

5 At 0.758 MPa (110 psig), the FLEX pump is able to inject to the RPV at a rate of approximately 129 m3/hr (570 gpm). A pump curve provided by the licensee generated the nominal pressure-dependent flow rate.

4-15

Table 4-7 Calculation matrixmitigating strategiesLOMFW-25 (continued)

Case Time of RCIC Time and method of RPV Time/delivered flow of

failure4 depressurization1,2,3 FLEX injection 5 Timing based on EOP-2 HCL/Follow HCL 22.

curve t = 9 hour1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months s/nominal

23. t = 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months

24. Timing based on EOP-2 HCL/Rapid t = 10 hour1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months s/nominal

25. t = 10 hour1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months s/nominal25%

1 Depressurization following battery depletion would require additional actions to locally operate the SRVs, as they require dc power for other than pressure relief operation.

2 Follow HCL curve refers to the heat capacity limit curve (Graph 4) in EOP-2. The MELCOR model encodes the operator actions to achieve this depressurization and walk down the HCL curve. Rapid infers a single action wherein multiple SRVs are opened when the action is required regime in Graph 4 is first reached and a 55.6 degree C/hr (100 degree F/hr) cooldown is initiated.

3 The RC/P leg of EOP-1 includes a provision to stop depressurization before losing the pressure required to operate RCIC (i.e., 1.03 MPa (150 psig)).

4 RCIC may be lost before this time, based on, for example, high exhaust pressure or suppression pool temperature.

In the calculations, if RCIC trips, restart will not be considered (as a simplifying assumption).

5 At 0.758 MPa (110 psig), the FLEX pump is able to inject to the RPV at a rate of approximately 129 m3/hr (570 gpm). A pump curve provided by the licensee generated the nominal pressure-dependent flow rate.

The LOMFW scenarios begin with an LOMFW. The reactor scrams on low RPV level and RCIC begins injection after the water level falls below Level 2. HPI is the only form of makeup available, as prescribed by the PRA sequence definition.

The turbine trips upon a loss of feedwater, and the turbine bypass valves open to pass steam directly to the condenser in the hotwell. However, a train of feedwater/condensate is necessary for long-term availability of the PCS since the condenser tubes will eventually be covered with water and rendered ineffective. Hence, the assumption is that turbine bypass valves are initially open and pass steam to the hotwell but would eventually be lost with a closure of the MSIVs. In these calculations (and in the LOMFW scenarios in subsequent chapters), the MSIVs close on a low RPV pressure trip. This trip was later determined to not be plant-actual since it is only active when the turbine is running. However, the net result; namely, the initial availability of the condenser with an eventual loss of the PCS when MSIVs close, is likely to mimic the actual plant response but with great uncertainty in the timing. In the series of calculations in this chapter, MSIV closure occurs at 30 minutes. Table 4-10 includes a sensitivity with MSIV closure (and loss of the condenser) occurring at time zero. Upon MSIV closure, the RPV pressure rises to the SRV relief setpoint.

When the RPV pressure and wetwell temperature reach the action is required region of the HCL curve (Graph 4 in EOP-2), operators are directed to depressurize the RPV. At this point, operator action to depressurize the reactor is modeled in one of two ways. Operators either perform an ED and fully open two SRVs in a rapid RPV depressurization, or they modulate an SRV open (along with a second, as necessary) to follow the HCL curve. This depressurization continues until RPV pressure is 0.34 MPa (50 psi) above the wetwell pressure. However, EOP-1 instructs operators to keep pressure above 1.03 MPa (150 psig), if RCIC or HPCI, or both, are required for injection.

In contrast to the LOOPGR scenarios, offsite power is available. While CRDHS injection fails to provide makeup according to the PRA sequence definition, it continues to inject at the preaccident flow rate of a single pump. Both trains of RHR fail from common-cause failure so there is no suppression pool cooling available to remove decay heat from the wetwell and LPCI/core spray are not available for LPI. Recirculation pump seal leakage is assumed not to occur since seal cooling is available.

4-16

In an early round of calculations, the water level continued to increase significantly even after RCIC was secured at the expanded high level caused by thermal expansion, ongoing injection from CRDHS, and RPV depressurization. This led to water entering the steamlines and a loss of RCIC on a code-automatic trip signal of high steamline water level. For this reason, the upper bound of the RCIC level band was reduced by 0.5 meters (20 inches) (from 6.55 meters

[258 inches] to 6.05 meters [238 inches] above TAF) to prevent flooding of the steamlines and loss of RCIC. This is thought to be reasonable since RCIC can still be expected to run with some water in the steamlines. The possibility of steamline flooding and subsequent loss of RCIC is investigated as a sensitivity calculation.

In the LOMFW scenarios, anticipatory venting is not credited, and the hardened containment vent is opened at the required PCPL setpoint of 0.37 MPa (53 psig). The reasoning is that (1) this will aid understanding of the failure versus success space (since crediting venting is expected to routinely lead to success), and thus the sensitivity of the PRA criterion to this assumption, and (2) the operators are less likely to do the anticipatory venting in a situation where they are both taking RCIC suction from the CST and in a scenario that in no way approximates an ELAP.

In those cases where RCIC is lost, these scenarios differ from the LOOPGR calculations in that the FLEX pump is not assumed immediately available for injection since its use following a non-ELAP event is not yet proceduralized. This could likely lead to a delay in diagnosis and staging.

The lag time in injection between the loss of RCIC and the start of FLEX pump injection is explored for this reason. As for the necessary ED down to 0.34 MPa (50 psig) to allow for the swap-over to FLEX injection, a midpoint between the time RCIC is lost and the start of FLEX injection is used. These diagnoses and execution lags are appropriate for both actions. The delivered flow rate of the FLEX pump is also varied. A pump curve provided by DAEC dictates the nominal flow rate, and a diminished flow rate of 25 percent below the nominal rate puts the flow rate close to the committed flow rate of 68.1 m3/hr (300 gpm) outlined in the FSGs.

Table 4-8 Initial and boundary conditionsmitigating strategiesLOMFW These conditions are in addition to the generic modeling conditions from Table 2-6 and the calculation-specific conditions from Table 4-7.

System Condition RCS 100% (full power).

Reactor successfully trips on first-in RPS signal.

No recirculation pump seal leakage.

Number of SRVs availabletwo of six.

Balance of OFFSITE POWER is available.

plant Support systems are available unless specified otherwise.

Turbine trip occurs upon loss of feedwater.

ECCS/ESF ESF signals successfully perform their functions.

CST is available.

HPCI is unavailable (by PRA sequence definition).

RCIC availabilitysee Table 4-7.

CRDHS and SLC are available.

LPCI/core spray are unavailable.

Containment Suppression pool cooling is unavailable (by PRA sequence definition).

Nominal drywell and wetwell initial conditions (see Table 2-6).

Other Actions related to RPV depressurizationsee Table 4-7.

operator Containment venting occurs at wetwell pressure of 0.37 MPa (53 psig).

actions Actions to align alternate injection via a FLEX pumpsee Table 4-7.

4-17

4.3.2 MELCOR Simulation Results Table 4-9 lists the results of the nine LOMFW calculations. In addition to this, Appendix D to this report includes results for selected parameters of interest.

Table 4-9 LOMFW results and key timings Maximum Level when Level when FLEX FLEX PCT1 RCIC ED Core RCIC is lost begins Case injection degrees lost begins uncovery (centimeters (centimeters

begins C (hrs.) (hrs.) (hrs.) [inches] [inches] above (hrs.) (degrees above TAF) TAF)

F)

17. 4.0 4.5 4.8 5.0 563.4 (222.0) -22 (-8.7) 322 (611)

18. 4.0 5.0 6.0 791 5.0 566.4 (223.0) -210 (-82.7)

(1455)

19. 4.0 4.5 4.8 5.0 563.4 (222.0) -155 (-60.9) 421 (790)

20. 4.0 4.5 4.8 5.0 563.4 (222.0) -151 (-59.5) 438 (820)

21. 4.0 5.0 5.3 6.0 1106 563.4 (222.0) -263.7 (-103.8)

(2023)

22. 8.0 8.5 No 9.0 534.4 (210.4) 338.1 (133.1) -

23. 8.0 8.5 No 9.0 386.1 (152.0) 258.6 (101.8) -

24. 8.0 9.0 No 10.0 384.8 (151.5) 125 (49.1) -

25. 8.0 9.0 No 10.0 1384.8 (151.5) 123 (48.5) -

1Recall that a PCT of 1,204 degrees C (2,200 degrees F) is the core damage surrogate.

2The maximum cladding temperature occurred during steady state (i.e., no heatup during the transient).

The pressure in the RPV in the LOMFW scenarios before depressurization requires some explanation. Upon a reactor trip, RPV pressure initially falls as the turbine bypass valves open to pass steam to the condenser. However, as mentioned before, the assumption is that condenser tubes will eventually cover with water and be ineffective at steam condensation.

MSIV closure occurs at 30 minutes (on low steamline pressure, which is not a plant-actual trip with the turbine tripped) and mimics a loss of the PCS for steam condensation. There is some uncertainty on the timing of this loss of the condenser (DAEC assumes that it is lost immediately in its PRA) since it is not clear how long it would take water to fill the hotwell and cover the condenser tubes. An impact of this assumption will be on the amount of decay heat that is deposited in the wetwell versus in the hotwell, which will subsequently affect the timing of reaching the HCL curve and containment venting. A number of sensitivity calculations are described in Table 4-10 wherein MSIVs are assumed to close at the start of the transient to elucidate the impact of this assumption.

Following MSIV closure, the RPV pressure begins to rise until there is another decrease in pressure that takes place around 0.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . This is caused in part by the cool RCIC water filling the RPV. Water from RCIC enters the Downcomer and subcools the water there. The water level increases in both the Downcomer and the riser but at different rates since the cooler Downcomer water is denser. When the level in the standpipes reaches the threshold of the flowpath going from the riser to the Downcomer, the warmer water spills over into the Downcomer and begins to raise its temperature. The water level in the Downcomer then catches up to the water level in the standpipes and begins to cool the water there as well. This reduces both steam flow and the pressure in the dome. When the first RCIC cycle ends, heatup resumes, thus increasing the pressure back to the relief setpoint. A similar pattern occurs during the second RCIC cycle from 2.5 to 3.0 hours0 days 0 hours 0 weeks 0 months . Until 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , all scenarios are the same.

4-18

RPV pressure reaches the action is required region of the HCL curve at 4.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . At this point, operator action to depressurize the reactor is modeled by either fully opening two SRVs in a rapid depressurization, or by modulating an SRV open to follow the HCL curve. In those cases where HPI is no longer available (Cases 17-21) and FLEX pump injection is in the process of being staged, the depressurization continues until RPV pressure is less than 0.34 MPa (50 psid) above the wetwell pressure. Otherwise, the depressurization ends at 1.03 MPa (150 psig).

Core damage does not occur in any of the LOMFW calculations. However, the core is uncovered in all cases where dc power is lost at 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . In the 4-hour cases, even though they end in success with no core damage, it is important to note the water level at the time of RCIC loss. As seen in Table 4-9, in each of the simulations where the core is uncovered, water level is around the normal water level when RCIC is lost. In actuality, water level could be as low as 3.04 meters (119.5 inches) above TAF at the time of RCIC failure, which would lead to a more significant uncovering of the core. Table 4-10 includes two sensitivity calculations with RCIC failure when RPV level is at Level 2. These sensitivities demonstrate that success is uncertain when there is a significant delay (more than an hour) in FLEX injection. Without procedures in place that would ensure the prior staging of FLEX equipment, the 4-hour scenarios (Cases 17-21) should be considered to go to core damage.

Depressurization by following the HCL curve has a more favorable impact on the loss of inventory than a rapid depressurization. When RCIC fails at 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and operators follow the HCL curve (Case 18), there is a gradual depressurization from 4.3 to 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months and then a rapid depressurization at 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months . In contrast, in the analogous case with rapid depressurizations at and 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months (Case 20), the RCS level falls more than half a meter further and nearly goes to core damage.

None of the 8-hour cases have core uncovery since, by the time RCIC fails, the RCS has already been depressurized down to 1.03 MPa (150 psig) to stay below the HCL curve, and the subsequent ED at either 8.5 or 9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months does not have as significant an impact (this combined with the fact that the decay heat is lower at this point). This points to the importance of the RCS being depressurized before RCIC failure.

The 25-percent reduction of FLEX injection extends the time to level recovery by 14 minutes when RCIC is lost at 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and by 8 minutes when RCIC is lost at 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

Hence, a 25-percent reduction in FLEX injection (caused by, for example, partial freezing in the hose, clogging of the FLEX pump suction, or diverted flow to the SFP) would not affect the success of these scenarios. A further diminished flow rate of 50 percent is explored as a sensitivity.

Sensitivity Calculations In addition to these results, additional sensitivity studies investigated specific issues, documented in Table 4-10.

4-19

Table 4-10 Sensitivity study matrixmitigating strategiesLOMFW Case # Sensitivity Impact 19a Availability of HPCI, In Case 19a, HPCI goes through two cycles but is then lost on a code-automatic 22a in lieu of RCIC trip on high steamline water level. HPCI is lost at 2.2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , and water level begins to fall. At 3.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months , wetwell temperature and RPV pressure reach the action is required region of the HCL curve, operators begin a rapid ED down to 1.03 MPa (150 psig), and the core is briefly uncovered at this time. Because of high wetwell water level, there is a swap-over of HPCI to suction on the wetwell. HPCI recovers from the trip in this case since the steamline water level drops below an assumed recovery setpoint, begins injecting, and recovers the RPV water level. HPCI again floods the steamlines and is lost again at 3.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months when the ED begins. This trip cycles on and off repeatedly while the ED takes place. Water level is recovered and HPCI has its final cycle at 3.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months , with a turbine trip from low steamline pressure.

From here, the scenario proceeds the same as in the base case, with FLEX injection precluding core damage. It is uncertain what the plant-actual response would be in this case. Although the loss and recovery of HPCI on a flooded steamline may be analogous to the self-regulated injection that was seen at Fukushima (Sandia, 2014a).

In Case 22a, HPCI again cycles twice and is then lost around 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months on a code-automatic trip on the high steamline water level. In this case, HPCI does not recover from the steamline flooding and core damage occurs at 5.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months .

22b 50% reduction in The reduced injection is still sufficient to provide enough makeup to the RPV. This delivered FLEX is especially true since injection begins 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months into the transient when inventory pump flow loss through the SRVs is small.

23a SRV fails open In the base scenarios, operators are assumed to modulate the SRVs open to prevent continuous cycling on the lowest pressure SRV with pressure held around 7.58 MPa (1,100 psig). If operators did not take this action, the lowest pressure SRV would cycle repeatedly. In this sensitivity, no action is taken to modulate the valves open and the lowest pressure SRV reaches 270 cycles at 3.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months and is then assumed to stick open. RCS water level happens to be just below the steamlines at this time. The rapid depressurization leads to expansion of the water in the RCS and water floods the steamlines. RCIC is lost on a code-automatic trip on high water level in steamline. RCS pressure and water level drop quickly at this point. RCIC is shortly recovered at 4.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months in this case since the steamline water level drops below an assumed recovery setpoint. However, after 17 minutes of injection, the RCIC turbine trips on low primary side pressure. The FLEX pump in this scenario is not assumed to be staged until 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months so only CRDHS is injecting at this time and core damage occurs at 7.9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months . With 3.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months between the loss of RCIC and core damage, there should be ample time for FLEX equipment to be staged and core damage could be avoided.

22c RCIC delivered flow The reduced flow has little effect on the scenario. On its first cycle, water level dips reduced by 10% a little lower before RCIC can recover the RPV water level.

22d Failure of FLEX FLEX injection is assumed to be lost at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Because CRDHS is still injecting injection at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from the CST, water level decreases slowly, reaching TAF at 40 hours4.62963e-4 days 0.0111 hours 6.613757e-5 weeks 1.522e-5 months . The water level continues to decrease to the 2/3 fuel height and levels off. The fuel heats up some, but there is sufficient cooling to prevent core damage. CRDHS continues to inject, maintaining this level until CST is depleted down to the reserve level around 62 hours7.175926e-4 days 0.0172 hours 1.025132e-4 weeks 2.3591e-5 months , at which point it trips automatically. Without operator action to continue this injection, the core immediately begins to heat up and core damage occurs 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months later, around 64 hours7.407407e-4 days 0.0178 hours 1.058201e-4 weeks 2.4352e-5 months .

22e Alternate decay There is little to no difference in the simulation. While there are slight differences in heat formulation the timing of injection and venting, the decay heat curve used in the base model is using the built-in similar enough to the ANS standard that there is little impact on the results.

American Nuclear Society (ANS) decay heat standard 22f Increased level RCIC is lost at 3.9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months on a code-automatic trip of a flooded steamline. The band with steamline simulation ended unexpectedly at 4.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months because of a calculational issue in the flooding and loss of steamline and could not be restarted. Since FLEX injection is assumed to not be RCIC available until 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months , this sensitivity would likely have gone to core damage.

4-20

Table 4-10 Sensitivity study matrixmitigating strategiesLOMFW (continued)

Case # Sensitivity Impact 17a Begin cooldown at Depressurization begins at 0.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months at a controlled 55.6 degrees C/hr 0.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months at the (100 degrees F/hr) cooldown rate and reaches 1.03 MPa (150 psig) around maximum allowed 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months . RCIC is secured at 4.0 hours0 days 0 hours 0 weeks 0 months while RPV water level is at its highest rate point. ED begins at 4.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , but pressure is already low and level falls from 599 (55.6degrees C/hr centimeters (236 inches) at 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 378 centimeters (149 inches) at 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months ,

[100 degrees F/ when FLEX injection begins at 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months . Hence, the early, controlled hr]) depressurization is successful in preventing core uncovery.

19b RCIC is lost with Instead of operating RCIC in batch mode in these sensitivity calculations, RCIC 21a water level at Level injection is throttled to maintain RPV level at Level 2.

2 (lost at 4.0 hours0 days 0 hours 0 weeks 0 months and then FLEX at In the first case, RCIC fails at 4.0 hours0 days 0 hours 0 weeks 0 months . Incidentally, operators also reach the 5.0 and 6.0 hours0 days 0 hours 0 weeks 0 months , action is required region of the HCL curve at this time and perform an ED (ceasing respectively) at 1.03 MPa (150 psig) with the hopes that they might recover RCIC injection). An ED down to 0.34 MPa (50 psig) begins at 4.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months and FLEX injection begins at 5.0 hours0 days 0 hours 0 weeks 0 months . With the water level much lower than in the base case, depressurization brings the water level well below the TAF. The core begins to heat up with PCT reaching 543 degree C (1,009 degree F) before FLEX injection recovers level and cools the core. Case 19b, therefore, ends in success, although by a tight margin. In the second case, RCIC also fails at 4.0 hours0 days 0 hours 0 weeks 0 months with a simultaneous ED down to 1.03 MPa (150 psig). However, ED down to 0.34 MPa (50 psig) begins at 5.0 hours0 days 0 hours 0 weeks 0 months and FLEX injection begins at 6.0 hours0 days 0 hours 0 weeks 0 months . The extended time between RCIC loss and FLEX injection here gives time for the core to be significantly uncovered. FLEX injection begins too late to avoid core damage, which occurs at 6.0 hours0 days 0 hours 0 weeks 0 months .

22g CST unavailable Since the CST is unavailable, RCIC suction is taken from the wetwell. This also means that CRDHS injection is not available. MSIVs close at 16 minutes on low level (14 minutes sooner than the assumed closure on loss of PCS steam in the base case). In addition, there is no cool water from the CST being injected to the RPV, so more steam is passing to the wetwell. Both differences mean more heat is deposited in the wetwell. Available RCIC NPSH falls below 20 feet at 6.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and its availability, therefore, becomes questionable. At 7.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , RCIC begins its last cycle and is throttled since the wetwell temperature at this time is greater than 102 degrees C (215 degrees F) (see discussion in Section 4) and operators maintain the normal RPV level. RCIC is lost at 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months by scenario definition and RPV depressurization begins at 8.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months . FLEX injection starting at 9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months successfully prevents any core uncovery or damage.

19c MSIV closure at In both scenarios, MSIVs close at the start of the transient. Because of this, there is 22h start of transient a greater amount of decay heat deposited in the wetwell. The HCL curve is reached at 2.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months (1.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months sooner than the base case), and operators are forced to begin depressurizing the RPV at that time.

In the first case, the depressurization is rapid. Since RCIC is available until 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , the loss in inventory from the depressurization is offset by the injection from RCIC.

Unlike the base case, the core is not uncovered during the depressurization. In this case, reaching the HCL curve earlier is beneficial, as it prevented ED from being necessary when RCIC was unavailable.

In the second case, RCIC is available until 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months and operators walk down the HCL curve starting at 2.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months . As in the base case, RPV pressure has been reduced to 1.03 MPa (150 psig) by the time RCIC is lost. While the HCL curve is reached 1.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months sooner than in the base case, there is not a large difference in the net result between this scenario and the base case. RCIC is lost after the depressurization has occurred, whether MSIV closure is at 30 minutes or at time zero. By chance, the RPV water level when RCIC is lost at 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months is at its lowest point (instead of being near the normal water level in the base case). Hence, the water level falls lower than the base case but still not low enough to uncover the core.

4-21

4.4 Conclusions Drawn from MELCOR Results The staff makes the following observations about the MELCOR results with regard to LOOPGR:

Without manual depressurization following loss of both dc power and RCIC injection, the FLEX pump would be unable to inject and core uncovery and fuel damage would be inevitable.

FLEX injection led to success in all scenarios for which FLEX credit was given, regardless of timing of RCIC loss and HCV ventingactions.

If FLEX is not available, success is only possible with both anticipatory venting and CST availability. The combination of cool water from the CST, combined with expulsion of decay heat out of the HCV through anticipatory venting, led to success. Without CST water, the RCIC could be damaged by cavitation. Without anticipatory venting, the RCIC would trip on high wetwell backpressure.

The loss of NPSH is of concern when RCIC is taking suction from the wetwell.

The use of two valves for ED is sufficient for RPV depressurization in all scenarios

In total, these calculations demonstrate that FLEX pump injection can ensure that core damage does not occur. This supports the conclusion that FLEX pumps should beable to mitigate in SBO scenarios, whether anticipatory venting occurs or not. Additionally, it is important to note that, without FLEX, almost all SBO scenarios end in core damage, despite the availability of large amounts of water from the CST.

The staff makes the following observations about the MELCOR results with regard to LOMFW:

Success was not sensitive to a lower delivered flow rate of the FLEX pump.

One impact on core uncovery was the initial water level and pressure before depressurization down to 0.34 MPa (50 psig) in the RCIC to FLEX swap-over. It is optimal to depressurize the RCS while HPI is available. Although core damage does not occur in all cases, the amount of core uncovery is lessened the earlier the depressurization occurs.

Core uncovery occurs in all cases where RCIC is lost at 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (before RPV ED) and could go to core damage if the water level were lower at the time of RCIC loss and FLEX injection were not staged rapidly. This is because operators were assumed to wait to depressurize until pressure reached the HCL curve. However, as discussed above, if operators initiated depressurization before the loss of RCIC, core uncovery could be avoided.

Steamline flooding occurs at the expanded level band with HPCI but may also occur with RCIC. This is because the thermal expansion of the water causes spillover into the steamlines. Over time, this could cause degradation of the turbine and the possible loss of the injection source.

In those cases in which no procedures are in place for the staging of FLEX equipment, timely injection cannot be assumed and early failure of RCIC/HPCI may result in core damage.

4-22

FLEX injection led to success in all scenarios for which FLEX credit was given, regardless of timing of RCIC loss and HCV ventingactions.

If FLEX is not available, success is only possible with both anticipatory venting and CST availability. The combination of cool water from the CST, combined with expulsion of decay heat out of the HCV through anticipatory venting, led to success. Without CST water, the RCIC could be damaged by cavitation. Without anticipatory venting, the RCIC would trip on high wetwell backpressure.

The loss of NPSH is of concern when RCIC is taking suction from the wetwell.

The use of two valves for ED is sufficient for RPV depressurization in all scenarios

In total, these calculations demonstrate that FLEX pump injection can ensure that core damage does not occur. This supports the conclusion that FLEX pumps should be able to mitigate in SBO scenarios, whether anticipatory venting occurs or not. Additionally, it is important to note that, without FLEX, almost all SBO scenarios end in core damage, despite the availability of large amounts of water from the CST.

The staff makes the following observations about the MELCOR results with regard to LOMFW:

Success was not sensitive to a lower delivered flow rate of the FLEX pump.

One impact on core uncovery was the initial water level and pressure before depressurization down to 0.34 MPa (50 psig) in the RCIC to FLEX swap-over. It is optimal to depressurize the RCS while HPI is available. Although core damage does not occur in all cases, the amount of core uncovery is lessened the earlier the depressurization occurs.

Core uncovery occurs in all cases where RCIC is lost at 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (before RPV ED) and could go to core damage if the water level were lower at the time of RCIC loss and FLEX injection were not staged rapidly. This is because operators were assumed to wait to depressurize until pressure reached the HCL curve. However, as discussed above, if operators initiated depressurization before the loss of RCIC, core uncovery could be avoided.

Steamline flooding occurs at the expanded level band with HPCI but may also occur with RCIC. This is because the thermal expansion of the water causes spillover into the steamlines. Over time, this could cause degradation of the turbine and the possible loss of the injection source.

In those cases in which no procedures are in place for the staging of FLEX equipment, timely injection cannot be assumed and early failure of RCIC/HPCI may result in core damage.

4-23

5 EMERGENCY CORE COOLING SYSTEM INJECTION FOLLOWING CONTAINMENT FAILURE ORVENTING 5.1 Issue Description Many licensee BWR PRAs credit coolant injection following containment venting and containment failure caused by the slow overpressurization of containment resulting from a loss of containment heat removal. The key characteristic of these sequences is the failure of containment (or the venting of containment) before core damage occurs. These sequences often involve a loss of ac power and are generally known as TW sequences. Although, historically, the SPAR models have not given credit for injection following containment failure, recently some of the new revisions to the SPAR models include some credit for late (postcontainment failure) injection, based in part on insights gained during the implementation of the mitigating systems performance indicator and, in part, on evaluations provided by individual licensees to support an upgrade of their own models. Whether or not credit for coolant injection is given after containment failure (or venting) can significantly affect CDF.

There are several concerns about emergency coolant injection performance during the time leading up to and immediately after containment failure (or venting). These issues are primarily associated with accident sequences that include failure of long-term heat removal (TW) or ATWS, where heat removal is simply inadequate for the heat being generated. The progression of these sequences includes the effects of high pressure inside containment and then the consequences of subsequent containment failure or venting. Specifically, as the containment atmosphere pressurizes, some injection systems might cease working because of increased backpressure on the turbine steam exhaust. Additional concerns arise when the containment fails or is vented. In this case, the severely adverse environment produced in the reactor building as a result of containment failure (or venting, depending on the configuration of the vent path used) could cause needed safety equipment to fail. Also, at the time of containment failure (or venting), the rapid depressurization of the suppression pool water could generate boiling in the suppression pool, and ECCS pumps not designed for two-phase flow could fail, while significant flashing of suppression pool water could lower the level to the point of introducing vortexing or suction line uncovery concerns. Finally, rupture of containment could directly affect continued ECCS operation, if injection or suction lines were damaged. Each of these mechanisms has the potential to result in failure of some or all coolant injection and lead to core damage.

The generic concerns above can lead to the need for plant-specific evaluations, in that plant designs can vary in several key aspects. First, plants use ECCS pumps with varying capabilities in their response upon seeing two-phase flow.1 Second, the response of the containment to overpressure failure can vary by design (most notably in terms of where the containment is likely to fail and whether it is likely to fail in a catastrophic versus liner tearing fashion). Finally, there is plant-to-plant variability in the layout of equipment (not only the pumps themselves but also the other components required for successful operation) in the reactor and control buildings, and in the way that equipment is protected from flooding and high temperatures and humidity.

1 Note that containment accident pressure analyses investigated the performance of pumps under these types of conditions (e.g., (BWROG, 2012a) and (BWROG, 2012b)).

5-1

An additional issue that has received attention in recent years concerns the reliance on containment overpressure when assessing the operability of emergency coolant injection during a postulated design-basis accident (i.e., containment accident pressure). This issue is not considered further here per se, as the focus is on the response of the system during the actual predicted conditions (e.g., operation of ECCS when the containment pressure is elevated).

However, the same basic considerations apply here once containment has been vented or has failed, or if a containment isolation failure prevented containment pressurization. APPENDIX F to this report includes more information on gradual overpressurization of Mark I, Mark II, and Mark III containments.

In the past, there were concerns that the ADS valves could be forced closed by the high ambient pressure; however, as seen in APPENDIX F , even at low temperatures, the containment would fail at 0.97 MPa (140 psig). Given that the SRVs open at pressures much higher than this, the containment would likely fail before the ADS valves would be forced to close.

Finally, this issue also has a philosophical aspect, which is whether a cooled core, but failed containment, should be considered an acceptable (OK) end state for Level 1 PRA purposes.

On the one hand, this is a clear loss of defense in depth, and the failure of containment with successful continued ECCS injection could be viewed as a benevolent failure, in that containment failure has prevented the further containment pressurization that would affect SRV operation and low-pressure ECCS injection flow rates. On the other hand, the core is still cooled, and a significant radiological release is not expected within the considered sequence mission time. Some types of evaluations (e.g., SDP) would allow one to consider the large early release frequency aspects of this end state (despite the lack of core damage). For context, also note that Level 1 PRAs typically neglect consideration of containment isolation failure, which has some analogous aspects. A unique aspect of the ECCS late injection situation, relative to containment isolation failure, is the greater uncertainty in where and how the containment will fail and what effect this will have on the injection systems.

The uncertainties of interest for late injection following containment venting or containment failure are as follows:

the leakage path from primary containment to the reactor building or environment

the extent of normal leakage or containment isolation impairment at the time of the initiator and resulting containment isolation signal

the mode of containment failure in terms of the speed of drywell depressurization

the timing (and associated pressure) of venting

the vent path used

the point at which the vent path is closed

the response of the SRVs and ECCS pumps to the elevated pressure and the depressurization 5-2

With regard to PRA sequences, the same two sequences identified in Section 4 of this report are used as anchors for the investigation.

Note that all simulations in this chapter are extended to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months to better explore the long-term performance of RCIC in debilitated containment conditions.

5.2 Station Blackout Sequence 5.2.1 Calculation Matrix Development Table 5-1 provides the calculation matrix for the subsequent MELCOR calculations, while Table 5-2 provides the calculation boundary and initial conditions. Note that the PRA sequence used here is the same as that of Section 4.2, which includes a more detailed explanation. This section discusses the key modeling assumptions made for these calculations as they differ from those in Section 4.2.

Table 5-1 Calculation matrixECCS injectionSBO sequence Case Sequence Venting action or Vent path used Response of ECCS pumps

containment failure to pressure change

1. Based Anticipatory venting Drywell2-inch vent Functional

2. around per SEPs bypass1 50% Degraded LOOPGR 3. 9 Drywell18-inch main Functional

4. vent1 50% Degraded

5. Nonfunctional

6. Hard pipe vent2 Functional

7. 50% Degraded

8. Failure at 0.37 MPa Drywell2-inch vent Functional

9. (53 psig) bypass1 50% Degraded

10. Drywell18-inch main Functional

11. vent1 50% Degraded

12. Nonfunctional

13. Hard pipe vent2 Functional

14. 50% Degraded 1 SEP 301.2 dictates a targeted torus pressure band of 0.07-0.10 MPa (10-15 psig).

2 SEP 301.3 dictates a targeted torus pressure band of 0.03-0.07 MPa (5-10 psig).

Upon a loss of all ac power, operators enter AOP 301.1. It is assumed here that, at 30 minutes, operators begin a cooldown of the reactor. An RPV depressurization down to 1.03 MPa (150 psig) at the maximum cooldown rate of 55.6 degrees C/hr (100 degrees F/hr) is assumed.

The purpose of this analysis is to explore long-term RCIC performance during an SBO.

Consequently, the analysis did not consider FLEX injection. It assumes that dc power in the form of batteries is available indefinitely, which is necessary for RCIC level control. Where degraded RCIC performance is assumed, the RCIC injection rate is reduced by 50 percent when the containment vent first opens.

5-3

As in the previous chapter, containment venting actions are also investigated. In the event of a loss of the UHS or an ELAP, operators would open the hard pipe vent to maintain an anticipatory wetwell pressure band of 0.03-0.07 MPa (5-10 psig) to maintain RCIC injection in accordance with SEP 301.3. If this vent path is unavailable, operators would vent the wetwell using the old wetwell vent in SEP 301.1, maintaining an anticipatory pressure band of 0.07-0.10 MPa (10-15 psig). If both wetwell vents are unavailable, operators would vent using the drywell main vent in SEP 301.2, maintaining an anticipatory pressure band of 0.07-0.10 MPa (10-15 psig). These latter two procedures instruct operators to first open the corresponding 2-inch bypass lines and then open the full 18-inch main line if this proves insufficient in maintaining the desired pressure. The calculation matrix in Table 5-1 includes venting using the 2-inch bypass and 18-inch main drywell lines, as well as the wetwell hard pipe vent. This is to explore RCIC performance following containment failure at low containment pressures caused by venting.

Even though the required PCPL venting action of maintaining 0.31-0.37 MPa (45-53 psig) would be enforced if anticipatory venting does not occur and the wetwell pressure approaches 0.37 MPa (53 psig), researchers decided not to investigate this venting action here. In Section 4.2.2, in the cases in which containment venting occurs at 0.37 MPa (53 psig) in the wetwell, CST was available and dc power was indefinitely available, the RCIC turbine trips on high turbine exhaust pressure at 0.34 MPa (50 psig) and is never recovered since pressure remains relatively high (in the 0.31-0.37 MPa (45-53 psig) pressure band assumed for required venting). This trip requires manual operator action for RCIC to be reset. Hence, venting at a pressure band of 0.31-0.37 MPa (45-53 psig) would lead to RCIC tripping and core damage occurring in all these scenarios. Chapter 4 describes this important result, while this section investigates the possibility of containment failure. Rather than operators maintaining a pressure band of 0.31-0.37 MPa (45-53 psig), the Chapter 5 analysis assumes the respective vent fails irreversibly open when wetwell pressure reaches 0.37 MPa (53 psig). The intent here is to explore the performance of ECCS injection following containment failure. In these cases, RCIC trips on high backpressure of 0.34 MPa (50 psig) but operator action to recover RCIC when wetwell pressure falls below 0.28 MPa (40 psig) is assumed. This recovery setpoint is an assumption and not based on any procedures. It merely seeks to credit operators who successfully restart RCIC when wetwell pressure is sufficiently low.

The model assumes that venting through the old drywell or wetwell vents opens a flowpath directly to the reactor building because of an assumed ductwork failure. The old vents are unhardened and could therefore leak or rupture when demanded. This conservative choice is made to better understand the possible conditions of the reactor building for inhabitability and flooding should a rupture occur.

The CST is assumed to be available for RCIC injection. This choice was made in order to focus on the impact of containment failure and because it is more likely that the CST would be available for injection. Table 5-4 includes a series of sensitivities where RCIC suction is on the wetwell.

Calculations are carried out to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months to investigate the long-term performance of RCIC and inhabitability of the reactor building.

5-4

Table 5-2 Initial and boundary conditionsECCS injectionSBO sequence These conditions are in addition to the generic modeling conditions from Table 2-6 and the calculation-specific conditions from Table 5-1.

System Condition RCS 100% (full power).

Reactor successfully trips on first-in RPS signal or loss of offsite ac.

Nominal1 recirculation pump seal leakage.

Number of SRVs availabletwo of six.

Balance of OFFSITE POWER is lost at time zero.

plant DC power is available indefinitely.

Support systems are available (if ac is available) unless specified otherwise.

Turbine trip occurs at time zero.

Feedwater and condensate fail at time zero.

MSIV closure occurs upon loss of offsite ac (for loss-of-ac scenarios).

RPV depressurization begins at 0.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months at the maximum cooldown rate (55.6 degrees C/hr [100 degrees F/hr]).

CST is available for injection until depleted and then injection switches to wetwell.

ECCS/ESF ESF signals successfully perform their functions (while dc power exists).

HPCI is unavailable.

RCIC is available indefinitely.

FLEX injection is unavailable.

CST is available.

CRDHS and SLC are unavailable.

LPCI/core spray are unavailable.2 Containment Suppression pool cooling is unavailable.2 Nominal drywell and wetwell initial conditions (see Table 2-6).

Other If credited, LPCS may need to be disabled as in EOP-1, if other operator low-pressure systems are available.

actions 1 In this context, this means 4.1 m3/hr (18 gpm/hr)/pump at the lowest SRV pressure setpoint.

2 The exception to this is before loss of all offsite and onsite ac in the loss-of-ac power scenarios.

5.2.2 MELCOR Simulation Results Table 5-3 lists key timings from the 17 LOOP calculations. In addition to this, APPENDIX E includes figures for selected parameters of interest.

Table 5-3 LOOPGR results Case Vent path used Response of Venting Core Core

ECCS pumps to (hours) uncovery damage pressure change (hours) (hours)

1. Drywell2-inch vent Functional 9.6 28.2 30.5

2. bypass 50% Degraded 9.6 25.5 27.8

3. Drywell18-inch main Functional 9.6 No No

4. vent 50% Degraded 9.6 No No

5. Nonfunctional 9.6 14.0 15.8

6. Hard pipe vent Functional 7.1 No No

7. 50% Degraded 7.1 No No 5-5

Table 5-3 LOOPGR results (continued)

Case Vent path used Response of Venting Core Core

ECCS pumps to (hours) uncovery damage pressure change (hours) (hours)

8. Drywell2-inch vent Functional 20.6 24.3 26.6

9. bypass 50% Degraded 20.6 24.3 26.6

10. Drywell18-inch main Functional 20.6 No No

11. vent 50% Degraded 20.6 No No

12. Nonfunctional 20.6 24.3 26.6

13. Hard pipe vent Functional 20.6 No No

14. Degraded 20.6 No No In those cases in which the 2-inch vent is used for anticipatory venting (Cases 1 and 2),

containment pressure and, consequently, wetwell pressure, continue to rise as the size of the bypass vent proves to be insufficient in competing with the SRVs venting into the wetwell. RCIC trips inevitably on high exhaust backpressure as the torus pressure rises above the 0.34 MPa (50 psig) setpoint. With no other injection source available, the core eventually is uncovered, and core damage occurs. The reduced RCIC flowrate in Case 2 serves only to speed the onset of core uncovery and damage. Note that SEP 301.2 calls for operators to vent initially on the 2-inch vent bypass line but switch to the 18-inch main vent line if they are unable to achieve the desired pressure. In these scenarios, then, operators, if able, would have opened the main line when it became apparent that the pressure was rising in containment.

When the 18-inch main drywell vent is used for anticipatory venting (Cases 3-5), operators are able to achieve a 0.07-0.10 MPa (10-15 psig) wetwell pressure band (as in SEP 301.2 direction) since the vacuum breakers (which operate on dc power) keep the differential pressure between the drywell and wetwell within 0.003 MPa (0.5 psid). The reduced RCIC injection rate has no impact on the success of the scenario. The combined rate of inventory loss through the SRVs and seals at 9.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months when the venting begins is about 7.2 kg/s and RCIC injects at a rate of 25 kg/s at rated flow and 12.5 kg/s at the degraded rate. When RCIC is lost entirely at the time of venting (Case 5), there is a slow rate of inventory loss that eventually leads to core uncovery and core damage.

When the hardened vent is used, operators maintain a pressure band of 0.04-0.07 MPa (7-10 psig) in the wetwell. Note that the nominal RCIC injection (Case 6) is similar to Case 16 from Section 4.2.2, where CST is available and anticipatory venting is successful. In addition, when there is degraded RCIC injection, the scenario still ends in success for the same reason as the analogous drywell vent case.

In the containment failure cases (Cases 8-14), the RCIC turbine trips when wetwell pressure rises through 0.34 MPa (50 psig) on high wetwell backpressure and before the opening of any of the containment failure paths, which are all assumed to occur at 0.37 MPa (53 psig). This trip requires manual action to be reset. When there is a 2-inch break (Cases 8 and 9), it is once again not sufficient to bring wetwell pressure down, and RCIC remains unavailable. Since the failure path opens after RCIC has already tripped, a degraded pump performance (in Case 9) has no impact on the scenario. In both cases, then, core uncovery and damage occurs. Since venting began much later, RCIC failure on high backpressure occurs sooner and core damage 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months sooner than in the analogous venting cases (Cases 1 and 2).

5-6

In the 18-inch failure cases (Cases 10-12), wetwell pressure drops quickly with the stuck-open valve, and pressure quickly falls below the assumed reset value for RCIC injection. Wetwell pressure reaches atmospheric pressure around 26 hours3.009259e-4 days 0.00722 hours 4.298942e-5 weeks 9.893e-6 months and brings the wetwell water temperature down to 100 degrees C (212 degrees F). In both the functional and degraded RCIC cases (Cases 10 and 11), the trip and reset occur in between RCIC cycles and, therefore, injection is never lost. As in the analogous venting case, the degraded RCIC injection is sufficient to maintain level, allowing for long-term level control. Without the assumed reset on RCIC injection, core uncovery and damage would occur as demonstrated in the nonfunctional case (Case 12).

When the drywell vent opens either for venting purposes or containment failure, the ductwork is assumed to rupture, and steam enters the reactor building. The blowout panels on top of the reactor building open soon after to relieve pressure. Steam condenses on the relatively cool walls and structures of the reactor building and water begins to accumulate on the ground. The DAEC flood analysis reveals that this condensed water makes its way into the southeast and southwest stairwells and from there into the other basement rooms. The HPCI and RCIC rooms are at this basement level and if water rises above 0.9 meter (3 feet), the pumps inside may become inoperable. The RCIC room is protected by a sealed door and never has more than a few inches of water in any of the cases. This water is the result of condensing steam that enters the room through vents. Hence, RCIC is not affected by the rising water level in the basement, and its long-term availability in all cases is not in question. HPCI, on the other hand, has a fire door between it and the stairwell that is assumed to fail when 0.9 meter (3 feet) of water accumulates in the stairwell. In the cases with the small, 2-inch vent, the amount of water entering the basement is relatively small, and the water level in the HPCI room remains well below the 3-foot level. For the 18-inch venting cases (Cases 3-5), however, the water level in the HPCI room is just below the 0.9-meter (3-foot) level at 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . HPCI availability is questionable beyond this time. In the 18-inch failure cases (Cases 10-12), even though the pathway opens much later in the transient, the HPCI room fills to nearly the same level by 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months as in the vented cases, since the vent is stuck open. Because of this, if RCIC were unavailable, HPCI availability beyond 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is doubtful.

There is RCIC (and HPCI) isolation on high torus area or RCIC area temperature.

Thermocouples are set up within the respective rooms to measure the ambient temperature. If the RCIC or HPCI room rises to 79.4 degrees C (175 degrees F), then an isolation signal is produced for the respective pump. In addition, if the torus area vent air temperature reaches 65.6 degrees C (150 degrees F), an isolation signal is produced for both pumps (after a 30-minute delay for RCIC and a 15-minute delay for HPCI). The ambient temperature in the HPCI and RCIC rooms does not reach 79.4 degrees C (175 degrees F) in any of the scenarios since they are relatively isolated from the torus room. However, the torus room temperature exceeds the 65.6-degree-C (150-degree-F) isolation setpoint in all cases. The model does not include these isolation signals since EOP-1 directs operators to bypass them if necessary.

Hence, ongoing RCIC operation in these cases assumes operator action to bypass the high torus area vent temperature trip.

The CST remains unexhausted at 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months in all cases. However, if the CST were not available for some reason and RCIC were forced to take suction from the wetwell, RCIC long-term performance becomes questionable. This is because the wetwell eventually becomes saturated, and RCIC would be taking suction on a boiling pool. Table 5-4 includes a sensitivity with CST unavailability.

5-7

Sensitivity Calculations In addition to these results, Table 5-4 documents additional sensitivity studies that investigated specific issues.

Table 5-4 Sensitivity study matrixECCS injectionSBO sequence Case Sensitivity Impact 3a Availability of As in the Chapter 4 HPCI sensitivity cases, the increased flow of HPCI 10a HPCI, in lieu of makes flooding of the steamlines a greater possibility when running the RCIC water level up to just below the steamlines. A lower target high level is assumed here to determine the long-term impact of HPCI should steamline flooding not be a concern.

In Case 3a, HPCI takes suction from the CST until 1.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months , at which point HPCI automatically swaps to the wetwell because of the high wetwell water level. The wetwell continues to heat up but anticipatory venting keeps the wetwell temperature below the 121 degrees C (250 degrees F) assumed setpoint for pump failure and HPCI maintains level indefinitely. However, the NPSH available to the HPCI pump falls below the 6.4 meters (21 feet) required at 5.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . Long-term availability of the pump is questionable at best, and this scenario should not be considered a success.

Case 10a is identical to 3a except that anticipatory venting does not occur and wetwell pressure and temperature continue to rise. When the wetwell bulk water temperature reaches 121 degrees C (250 degrees F) at 8.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months , HPCI is lost and core damage soon follows.

1a CST unavailable All four calculations end in core damage.

3b 8a Without CST availability, RCIC is required to take suction from the 10b suppression pool. Performing anticipatory venting is irrelevant with the 2-inch vent (Case 1a); the wetwell pressure is not able to be sufficiently relieved and the water temperature rises above 121 degrees C (250 degrees F). The SEPs state that RCIC should remain available below this wetwell temperature but its performance is questionable beyond. RCIC is lost at 7.9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months and core damage occurs at 11.9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months .

This is nearly identical to what occurs in both cases without anticipatory venting (Cases 8a and 10b). RCIC is lost on high wetwell temperature and core damage occurs at 11.9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months . Containment failure at 0.37 MPa (53 psig) occurs after this at 12.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months .

When suction is on the wetwell and anticipatory venting occurs through the 18-inch vent (Case 3b), the wetwell water temperature does not rise above the 121 degree C (250 degree F) assumed failure setpoint and provides long-term injection and RPV level control. However, RCIC is taking long-term suction on a saturated pool with NPSH well below the 6.1 meters (20 feet) required. Hence, cavitation and pump failure are possible if not likely and core damage would likely occur.

5-8

Table 5-4 Sensitivity study matrixECCS injectionSBO sequence (continued) 3c No venting of Without containment venting, the wetwell and drywell pressures continue containment to rise unchecked. RCIC trips on high backpressure at 0.34MPa occurs. (50 psig) at around 20 hours2.314815e-4 days 0.00556 hours 3.306878e-5 weeks 7.61e-6 months . Water level is 0.25 meter (10 inches) above the high level at the time of the trip so it takes several hours for water to reach the TAF. Immediately before core damage, the pressure in the wetwell/drywell is well below the failure pressure for the given ambient temperature that is described in APPENDIX F . Hence, there is no concern for containment failure or SRV failure before core damage.

Core damage occurs at 26.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . It is possible that SRVs could seize open or closed at high drywell pressures. This would cause the RCS to either pressurize or depressurize rapidly. However, this would simply exacerbate an already certain failure since RCIC has been lost.

3d Increased seal The water level initially dips lower than the base case, but RCIC injection leakage (34.1 can recover level quickly since RCIC is injecting at a rate of 90.8 m3/hr m3/hr [150 gpm] (400 gpm). Containment venting is required 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months sooner than the total, 17 m3/hr base case because of the increased leakage into the drywell. The CST

[75 gpm] per is depleted around 41 hours4.74537e-4 days 0.0114 hours 6.779101e-5 weeks 1.56005e-5 months and RCIC swaps over to inject from the pump) wetwell. Since the bulk wetwell water temperature is around 121 degrees C (250 degrees F), RCIC reliability in recirculation mode is questionable at best.

3e Increased seal With the increased leakage, water level drops significantly low initially, leakage (68.1 nearly reaching the TAF. However, RCIC is sufficient in recovering level.

m3/hr [300 gpm] There is little impact here on the pressure in the RCS since the seal total, 34.1 m3/hr leakage is a water level break, and RCIC injection eventually makes up

[150 gpm] per the inventory loss. The cooling of the RCS brought on by the colder CST pump) water does so slowly, and RCIC performance on low RPV pressure is never a concern. RCIC never loses required steam supply pressure because of the leakage. There is a significant impact on the drywell pressure, since all the water is flashing to steam and pressurizing the containment. Containment venting occurs at 5.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , 4.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months sooner than the base case.

CST is depleted at 29 hours3.356481e-4 days 0.00806 hours 4.794974e-5 weeks 1.10345e-5 months and swaps to recirculation mode, taking suction off the wetwell. The water in the suppression pool is at saturation and sitting around 121 degrees C (250 degrees F). RCIC operation beyond this time is questionable at best.

3f Increased seal The difference here is only 2,550 gallons of water. Compared to the leakage starting at 390,000 gallons available in the CST, this not significant. While there is 17 minutes (34.1 a minor shift in timing of containment venting and RCIC injection, the m3/hr [150 gpm] delay in seal leakage has little impact on the scenario.

total, 17 m3/hr

[75 gpm] per pump) 3g Increased seal The difference here is only 5,100 gallons of water. The delay in leakage leakage starting at has a bit more of an impact here with water level not dipping quite as low 17 minutes (68.1 before RCIC injection. Besides this, the results are similar to the base m3/hr [300 gpm] case with minor shifts in timing.

total, 34.1 m3/hr

[150 gpm] per pump) 5-9

5.3 Loss-of-Main-Feedwater Scenario 5.3.1 Calculation Matrix Development Table 5-5 provides the calculation matrix for the subsequent MELCOR calculations, while Table 5-6 provides the calculation boundary and initial conditions. A discussion of the key modeling assumptions made for these calculations follows.

Table 5-5 Calculation matrixECCS injectionLOMFW sequence Sequence Venting action or Vent path used Response of Case containment failure ECCS pumps to pressure change

15. LOMFW-25 Anticipatory venting Torus2-inch Functional

16. per SEPs vent bypass1 Degraded

17. Torus18-inch Functional

18. main vent1 Degraded

19. Nonfunctional

20. Drywell2-inch Functional

21. vent bypass1 Degraded

22. Drywell18-inch Functional

23. main vent1 Degraded

24. Nonfunctional

25. Hard pipe vent2 Functional

26. Degraded

27. Failure at 0.37 MPa Torus2-inch Functional

28. (53 psig) vent bypass1 Degraded

29. Torus18-inch main Functional

30. vent1 Degraded

31. Nonfunctional

32. Functional

33. Degraded

34. Drywell18-inch Functional

35. main vent1 Degraded

36. Nonfunctional

37. Hard pipe vent2 Functional

38. Degraded 1SEPs 301.1 and 301.2 dictate a targeted torus pressure band of 0.07-0.10 MPa (10-15 psig).

2SEP 301.3 dictates a targeted torus pressure band of 0.03-0.07 MPa (5-10 psig).

5-10

Table 5-6 Initial and boundary conditionsECCS injectionLOMFW sequence These conditions are in addition to the generic modeling conditions from Table 2-6 and the calculation-specific conditions from Table 5-1.

System Condition RCS 100% (full power).

Reactor successfully trips on first-in RPS signal.

Nominal1 recirculation pump seal leakage.

Number of SRVs availabletwo of six.

Balance of Offsite power is available.

plant Support systems are available unless specified otherwise.

Turbine trip occurs upon loss of feedwater.

Feedwater and condensate fail at time zero.

ECCS/ESF ESF signals successfully perform their functions (while dc power exists).

HPCI is unavailable.

RCIC is available indefinitely.

CRDHS and SLC are available.

LPCI/core spray are unavailable.

CST is available for injection until depleted and then injection switches to wetwell.

RPV depressurization is a walk down of the HCL curve.

Containment Suppression pool cooling is unavailable.

Nominal drywell and wetwell initial conditions (see Table 2-6).

Other If credited, LPCS may need to be disabled as in EOP-1, if other operator low-pressure systems are available.

actions 1 In this context, this means no seal leakage.

Upon an LOMFW, the reactor scrams on low level and RCIC begins injection after the water level falls below Level 2. MSIVs close at 30 minutes, at which point the RPV pressure increases to the SRV relief setpoint. Operator action to depressurize the RPV is assumed only when action is required according to the HCL curve, at which point operators walk down the curve.

As in the LOMFW scenarios in the previous chapter, MSIVs are initially open with steam being sent to the condenser. MSIVs close on a low RPV pressure trip, which was later found to not be plant-actual. However, the net result; namely, the initial availability of the condenser with an eventual loss of the PCS when MSIVs close, is likely to mimic the actual plant response. In this series of calculations, MSIV closure occurs at 30 minutes. Table 5-8 includes sensitivity cases with MSIV closure (and loss of the condenser) occurring at time zero.

This analysis does not explore the availability of the FLEX pump for injection. The CRDHS is assumed to inject at the preaccident flow rate of a single pump, and no recirculation pump seal leakage is assumed. The level band for RCIC injection is reduced by 20 centimeters to avoid flooding the steamlines (see the explanation in Section 4.3.1).

As for the LOOP scenarios, this report does not explore containment venting at the required PCPL setpoint of 0.37 MPa (53 psig) since it is understood that this would lead to failure of RCIC and, eventually, core uncovery. Instead, it assumes containment failure at 0.37 MPa (53 psig) wetwell pressure at various hole sizes. It explores the loss of RCIC at various times as a series of sensitivity calculations.

5-11

5.3.2 MELCOR Simulation Results Table 5-7 lists key timings from the 17 LOOP calculations. In addition to this, APPENDIX E to this report includes figures for selected parameters of interest.

Table 5-7 LOMFW results Maximum PCT Response of Core Case Venting degrees Vent path used ECCS pumps to uncovery

(hours) C pressure change (hours)

(degrees F)

15. Torus2-inch vent Functional 12.0 33.9 ,

16. bypass Degraded 12.0 - -

17. Torus18-inch vent Functional 12.0 - -

18. bypass Degraded 12.0 - -

19. Nonfunctional 12.0 23.1 696 (1,285)

20. Drywell2-inch vent Functional 12.0 - -

21. bypass Degraded 12.0 - -

22. Drywell18-inch main Functional 12.0 - -

23. vent Degraded 12.0 - -

24. Nonfunctional 12.0 23.0 698 (1,288)

25. Hard pipe vent Functional 9.4 - -

26. Degraded 9.4 - -

27. Torus2-inch vent Functional 23.4 33.9 558 bypass (1,036)

28. Degraded 23.4 33.9 558 (1,036)

29. Torus18-inch vent Functional 23.4 - -

30. bypass Degraded 23.4 - -

31. Nonfunctional 23.4 34.0 556 (1,033)

32. Drywell2-inch vent Functional 23.4 33.9 558 bypass (1,036)

33. Degraded 23.4 33.9 558 (1,036)

34. Drywell18-inch main Functional 23.4 - -

35. vent Degraded 23.4 - -

36. Nonfunctional 23.4 33.9 557 (1,035)

37. Hard pipe vent Functional 23.4 - -

38. Degraded 23.4 - -

5-12

Core damage does not occur in any of the LOMFW calculations. While the core is uncovered in cases where RCIC injection is lost, the loss occurs late enough in the accident that decay heat is low and nominal CRDHS injection is sufficient to provide makeup to the RCS.

In those cases with a small 2-inch vent, the vent opens as wetwell pressure rises through 0.10 MPa (15 psig). However, the wetwell pressure continues to rise despite the open valve.

This is true regardless of whether the torus (Cases 15 and 16) or wetwell bypass valve (Cases 20 and 21) is opened. Except for Case 16, they have very similar behavior with small differences in timing. RCIC is tripped on high wetwell backpressure, the level slowly begins to fall, and core uncovery occurs at 33.9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months . However, core damage does not occur since the RPV water level remains at 2/3 fuel height until the end of the calculation. This is because the ongoing CRDHS injection can provide sufficient makeup to the RCS.

In the degraded injection case with venting through the bypass 2-inch torus vent (Case 16),

core uncovery does not occur before 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . It is not immediately intuitive that the 2-inch scenario with degraded RCIC injection should have a more successful result with no core uncovery. The cause is simply fortunate timing. The slower ramp-up of the level causes an additional cycle of RCIC to occur before RCIC is lost on high wetwell backpressure. The water level is just above TAF at 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months when the calculation ends.

In the 18-inch drywell venting case with anticipatory venting (Case 17), venting begins at 12.0 hours0 days 0 hours 0 weeks 0 months when pressure reaches 0.10 MPa (15 psig). The 18-inch vent is sufficient to keep wetwell pressure within the desired pressure band of 0.07-0.10 MPa (10-15 psig) for anticipatory venting. With suction on the CST, RCIC is not threatened by a loss of NPSH and is able to run out to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months without issue. When debilitated pump performance is assumed (Case 18), a 50-percent reduction in RCIC injection has no impact on the success of this scenario. When venting begins at 12.0 hours0 days 0 hours 0 weeks 0 months , the rate of RPV inventory loss is slow and the combined makeup from CRDHS and 50-percent RCIC injection is more than sufficient to maintain the RPV level. When RCIC is lost entirely at the time of containment venting (Case 19), the water level decreases slowly since CRDHS is still injecting. While core uncovery occurs 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months after RCIC loss, core damage never occurs since the water level remains at 2/3 fuel height from ongoing CRDHS injection.

The preferred venting path is either the 18-inch wetwell vent or the hardened pipe vent.

However, if for some reason the wetwell vent is unavailable or if the wetwell water level is too high, operators would use the drywell vent. Since the SRVs are venting into the wetwell and there is no leakage into containment, it is the torus, not the drywell, that is heating up and pressurizing. The vacuum breakers between the wetwell and drywell open if wetwell pressure rises more than 0.003 MPa (0.5 psid) over that of the drywell. Hence, as the wetwell pressure rises, vacuum breakers open to the drywell and increase the pressure there as well. When wetwell pressure reaches 0.10 MPa (15 psig), the drywell vent opens, reducing pressure, which also causes the vacuum breakers to open, effectively depressurizing the wetwell. For this reason, the results in the drywell venting cases (Cases 22-24) behave very similarly to the corresponding wetwell venting cases (Cases 17-19), with small differences in timing.

There is little difference in the results between the 2-inch anticipatory venting cases and the cases with 2-inch vent failure (Cases 27-28 and 32-33). In the venting cases, the valve opens at 12.0 hours0 days 0 hours 0 weeks 0 months and never closes, while in the failure cases, the valve opens at 23.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and never closes. Even without the vent being open for those first 11.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , the overall behavior is similar. Core uncovery occurs at 33.9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months regardless and core damage is averted once again.

5-13

The location of the break (torus or drywell) again does not have a significant impact, apart from small timing differences.

For the 18-inch wetwell vent failure case (Case 29), RCIC is lost when pressure rises through 0.34 MPa (50 psig) on high wetwell backpressure. When the wetwell reaches 0.37 MPa (53 psig), the valve sticks open and both wetwell and drywell pressure fall. Operators are assumed to take action to restart RCIC, and the pump is reset locally when wetwell pressure falls through 0.28 MPa (40 psig). RCIC injection continues at this point, recovering the RPV water level, and the scenario ends in success. The two subsequent scenarios (Cases 30 and 31) with debilitated and nonfunctional RCIC demonstrate that CRDHS is sufficient for RCS makeup, even if RCIC is not recovered. The sensitivity analyses explore this further. The location of the break (torus or drywell) again does not have a significant impact, apart from small timing differences.

The hardened pipe vent calculations serve as a baseline comparison since the hardened vent is the preferred method of containment venting. The results are similar to those found in Section 5.3.1, which includes more information.

Sensitivity Calculations In addition to these results, Table 5-8 includes additional sensitivity studies that were run to investigate specific issues.

Table 5-8 Sensitivity study matrixECCS injectionLOMFW sequence Case # Sensitivity Impact 17a Availability of In both cases, allowing the water level to go up to the extended level band before 29a HPCI, in lieu of turning off HPCI would lead to significant water entering the steamlines. As is the RCIC case for RCIC in the base calculations, the extended high level is reduced by 0.51 meter (20 inches). However, thermal expansion still causes a significant amount of water to enter the steamline, HPCI fails on high steamline water level, and core damage occurs at 5.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months in both cases.

Both sensitivity cases are repeated here with the HPCI level band set to the MELCOR default (from just below Level 2 to just below Level 8). This is meant to determine whether HPCI can provide long-term makeup if steamline flooding were not a concern. Unlike RCIC, HPCI automatically switches from CST to wetwell suction if the wetwell water level becomes too high. HPCI suction switches to the wetwell on high wetwell water level in the first calculation at 2.2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

The first case assumes anticipatory venting through the 18-in torus vent and operators act to keep wetwell pressure in the 0.07-0.10 MPa (10-15 psig) range.

Because of this venting, the wetwell temperature remains below the 121 degree C (250 degree F) temperature at which the pump is threatened and a loss of HPCI injection does not occur. The core never uncovers, and core damage does not occur.

However, HPCI is taking suction on a saturated pool and the NPSH available falls below that required for operation (6.4 meters [21 feet]) at 5.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . Therefore, unless operators are credited with swapping HPCI suction back to the CST, this scenario should be considered to go to core damage.

Without anticipatory venting, the temperature in the wetwell rises above 121 degrees C (250 degrees F) at 9.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months and HPCI injection is assumed lost. It is not until the vent fails open that the wetwell water temperature cools. Operators are credited here with restarting HPCI recirculatory injection when the temperature falls below 102 degrees C (215 degrees F). The PCT reaches 931 degrees C 5-14

Table 5-8 Sensitivity study matrixECCS injectionLOMFW sequence (continued)

Case # Sensitivity Impact (1,708 degrees F) before HPCI injection recovers level and averts core damage.

However, suction of HPCI is again on the wetwell at this time, NPSH is well below the required head for the HPCI pump, and HPCI performance at this time is questionable at best. This scenario should be considered to go to core damage.

17b SRV fails open In the base scenarios, operators are assumed to modulate the SRVs open to prevent continuous cycling on the lowest pressure SRV with pressure held around 7.58 MPa (1,100 psig). If operators did not take this action, the lowest pressure SRV would cycle repeatedly. In this sensitivity, the MSIVs again close at 30 minutes and the lowest pressure then begins to cycle since no action is taken to modulate the valve open. The lowest pressure SRV reaches 270 cycles at 3.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months and is assumed to stick open. RPV pressure falls over the course of an hour with RCIC maintaining level. RCIC trips on low RPV pressure at 4.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . Nominal CRDHS is not a sufficient source of injection at this time and the RPV level falls. Core damage occurs at 7.8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

17c RCIC lost after RCICs final cycle ends at 5.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . Since RPV depressurization is still occurring at 3 complete this time, the RPV water level reaches TAF at 8.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months and continues to fall. Even cycles though the CRDHS is injecting at the nominal flow rate, it is not sufficient to prevent significant core uncovery. Core damage occurs at 12.1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

17d RCIC lost after RCICs final cycle ends at 6.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months . Since the RPV is depressurized down to 4 complete 1.03 MPa (150 psig) at this point, it takes longer for the level to fall. The RPV water cycles level reaches TAF at 15.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . At this point, CRDHS can provide sufficient makeup to the RCS to avert core damage. However, the core does heat up after it is uncovered, reaching a PCT of 876 degrees C (1,609 degrees F) at 22.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months before cooling back down. It is doubtful that nominal CRDHS injection could provide sufficient makeup if the water level reached TAF before 15.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

17e CST unavailable Until the timing of containment venting, the two scenarios are identical. With the CST 29b unavailable, the CRDHS is not available for injection. The MSIVs close 15 minutes sooner than the base case (because of the low RPV pressure trip later found to not be plant-actual). As the wetwell temperature rises, operators depressurize the RPV as necessary to stay below the HCL curve. Without CRDHS injection, RCIC cycles more frequently than in the base scenarios since level falls more quickly between each cycle. Note that the version of the deck used in this and the base scenario (Revision 7) does not include logic for throttled RCIC injection when the wetwell water temperature rises above 102 degrees C (215 degrees F).

In the first case, operators perform anticipatory venting starting at 8.8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . This venting prevents the wetwell water temperature from rising to the assumed high wetwell water temperature RCIC trip. However, NPSH falls below the 6.1 meters (20 feet) required at 6.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . Note that the actual time this occurs is sensitive to the timing of MSIV closure. However, in any case, long-term performance (out to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) of the pump is not likely. This scenario should be considered to go to core damage.

In the second case, operators do not perform anticipatory venting and the wetwell pressure and temperature continue to rise. RCIC is assumed to fail when the wetwell temperature reaches 121 degrees C (250 degrees F) at 9.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . Both RCIC and CRDHS injection are then unavailable and water level falls with core uncovery 2.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months later. Core damage is predicted at 13.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . At this time, the wetwell pressure has not yet reached the assumed 0.37 MPa (53 psig) failure setpoint.

17f Nominal seal Seal leakage does not have significant impact on these scenarios. There are minor 19a leakage differences in event timing from the base case but RCIC can keep up with the nominal leakage. As in the base case, core damage does not occur.

17g Increased seal When the recirculation pump seal leakage is increased, more RCIC injection is leakage to (34.1 required to offset the inventory loss through the seals. The CST water level reaches m3/hr [150 gpm] the RCIC reserve level around 24.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months , at which point CRDHS injection ends.

total, 17 m3/hr RCIC switches to wetwell injection on low CST level at 37.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months and provides level

[75 gpm] per control until the scenario ends at 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . Without wetwell cooling, however, the pump) NPSH available to the RCIC pump is insufficient to support long-term suction on the wetwell. This scenario is in a safe and stable state as of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , but RCIC availability out to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is not likely.

5-15

Table 5-8 Sensitivity study matrixECCS injectionLOMFW sequence (continued)

Case # Sensitivity Impact 17h Rapid RPV When the wetwell temperature and RPV pressure reach the action is required depressurization region of the HCL curve, operators perform an ED of 2 SRVs full open. However, at HCL curve EOPs warn operators to cease depressurization if it may threaten injection. Hence, operators maintain pressure at 1.03 MPa (150 psig) to prevent the loss of RCIC injection. The core uncovers very briefly at 4.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months during the depressurization.

However, RCIC injection is more than sufficient to recover the level and no core heatup is observed.

15a CRDHS Without CRDHS injection, MSIV closure happens sooner at 17.0 minutes. Recall that 19b unavailable this is not a plant-actual response but the result of including a MSIV closure trip on 31a low wetwell pressure that is not active.

In the first case, the start of containment venting is similar to the base case. Without CRDHS injection, level falls more quickly in between RCIC cycles, requiring that RCIC inject more frequently. As in the base case, when the wetwell pressure rises to 0.34 MPa (50 psig), RCIC trips on high backpressure and water level begins to fall.

Without CRDHS injection, however, level falls quickly with core uncovery at 28.0 hours0 days 0 hours 0 weeks 0 months and core damage at 30.2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

In the second case, RCIC is assumed lost entirely at the time of containment venting.

This occurs at 11.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months and RPV water level begins to fall. Without CRDHS injection, level does not remain at 2/3 fuel height and core damage occurs at 17.0 hours0 days 0 hours 0 weeks 0 months .

In the third case, without CRDHS injection, level again falls more quickly in between RCIC cycles and RCIC injects more frequently. When the wetwell pressure rises to 0.34 MPa (50 psig), RCIC trips at 21.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and is assumed unrecoverable. RPV water level begins to fall, and without CRDHS injection core, uncovery occurs at 24.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and core damage at 26.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months .

15b MSIVs close at A difference of 30 minutes for MSIV closure has a 2.7-hour difference in the timing of 17i start of containment venting. This demonstrates the large uncertainty in timing of wetwell 19c transient. conditions inherent in the LOMFW scenarios.

In the first case, with more decay heat deposited into the wetwell early in the transient, RCIC fails on high backpressure sooner than the base case (at 20.8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ). However, at this time, RCIC has recently completed a cycle of injection and RPV water level is high. This contrasts with the base case, where RCIC fails when RPV level is relatively low. Core uncovery occurs 7.1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months later in the sensitivity case than in the base case. This highlights the fact that the uncertainty in timing is not only in MSIV closure but also in the RPV level being anywhere in a wide level range when and if RCIC fails.

In the second case, the HCL curve is crossed at 2.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months , 100 minutes sooner than the base case, and a slow depressurization begins. This moves up the timeline of the scenario with containment venting beginning at 9.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months (2.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months sooner).

However, this scenario still ends in success.

In the third case, the HCL curve is again crossed at 2.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months . This moves up the timeline of the scenario with containment venting (coincident with RCIC failure) beginning at 9.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months (2.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months sooner). At this time, the RPV water level is relatively high and the CRDHS is still injecting. Water level falls slowly with core uncovery at 18.8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . As in the base case, CRDHS injection is still able to maintain level at the 2/3 height and core damage does not occur.

5.4 Conclusions Drawn from MELCOR Results The staff makes the following observations about the MELCOR results with regard to LOOPGR:

The 2-inch bypass vent is insufficient to keep the wetwell pressure low enough such that RCIC does not trip on high wetwell backpressure.

5-16

Venting through the 18-inch drywell vent successfully controls wetwell pressure and temperature. However, the reactor building becomes uninhabitable and has significant flooding.

Depending upon the size of containment failure, wetwell and drywell pressure will fall, potentially to the point of allowing RCIC restart following its loss on high wetwell backpressure. However, this requires operator action to reset the RCIC turbine, and without injection, core damage would ensue with a resulting uncontrolled release directly to the environment.

Venting through the containment vent, which is the preferred method of containment pressure control, led to no adverse reactor building conditions and better RCIC performance. This was also demonstrated in the previous section.

Conditions (i.e., water level and ambient temperature) in the basement are such that HPCI remains available out to but not beyond 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . Since RCIC is protected from internal flooding conditions, its failure from environmental conditions is not a concern.

Although all equipment is anticipated to be operable following internal flooding from vent failure, operator access to the reactor building would be severely affected.

Increased seal leakage is a concern in that it will deplete the CST at a greater rate and force the swap-over of HPI suction to the saturated wetwell where there are concerns for available NPSH; however, increased seal leakage does not significantly affect RPV pressure and available steam pressure for early RCIC performance.

Significant flashing of the wetwell volume such that wetwell water level was a concern did not occur any of the cases.

If the CST were not available, the RCIC pump would eventually experience two-phase flow because of wetwell boiling from containment venting. Thus, long-term performance and scenario success is questionable at best.

Again, steamline flooding occurs at the expanded level band with HPCI but may also occur with RCIC. This is because the thermal expansion of the water causes spillover into the steamlines. Over time, this could cause degradation of the turbine and the possible loss of the injection source.

The staff makes the following observations about the MELCOR results with regard to LOMFW:

Venting through the wetwell versus the drywell has no impact on success if vacuum breakers are available.

There is an important distinction between HPCI and RCIC injection in that HPCI has a swap-over to wetwell injection if level there rises 0.13 meter (5 inches) above the nominal level. With no operator action to prevent this swap-over, long-term HPCI injection does not lead to a success path because of NPSHconcerns.

5-17

Again, conditions (i.e., water level and ambient temperature) in the basement are such that HPCI remains available out to but not beyond 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . Since RCIC is protected from internal flooding conditions, its failure from environmental conditions is not a concern.

Again, steamline flooding is a concern in thesescenarios.

Significant flashing of the wetwell volume such that wetwell water level was a concern did not occur any of the cases.

CRDHS injection plays a critical role in success in these cases following RCIC failure. A single train of CRDHS injection is sufficient for RCS makeup after 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months .

5-18

6 SAFE AND STABLE END-STATE CONSIDERATIONS 6.1 Issue Description (ASME, 2013a) defines a safe and stable state as a plant condition, following an initiating event, in which RCS conditions are controllable at or near desired values. Requirement AS-A2 states, For each modeled initiating event, IDENTIFY the key safety functions that are necessary to reach a safe, stable state and prevent core damage. Requirement SC-A5 elaborates by requiring (for Capability Category II/III) that, for sequences where stable plant conditions are not achieved at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , additional evaluations must be performed. Examples of appropriate evaluation techniques include assigning an appropriate plant damage state for the sequence, extending the mission time until an acceptable end state is reached, or modeling additional system recovery or operator actions. Only in the definition of success path does the standard provide a later backstop time (that being 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ), and the success path concept is only invoked in the seismic margins assessment (Section 10). Meanwhile, NUREG-2122, (NRC, 2013d), defines a safe stable state as the Condition of the reactor in which the necessary safety functions are achieved. NUREG-2122 goes on to state, In a PRA, safe stable states are represented by success paths in modeling of accident sequences. A safe stable state implies that the plant conditions are controllable within the success criteria for maintenance of safety functions.

Historically, Level 1 PRA models (including the SPAR models) have typically assumed a mission time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , unless core damage was imminent at that time. The analysis in this portion of the report scopes the additional operator actions or system functionality that would be required to extend the sequence duration to a longer period of time (e.g., 48 or 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ).

Examples of common events of interest in this regard are refill of the CST, recovery of suppression pool cooling, alignment of additional alternative RPV injection water sources, and additional containment venting operations.

The SPAR development team is undertaking a symbiotic effort to formulate guidance for upgrading the suite of SPAR models to more closely conform with ASME/ANS RA-S-2013 in this regard (INL, 2016). The report identifies the following issues relevant to the BWR/4 Mark I design:

If battery charging (dedicated charging diesel) is successful during an SBO event, should the SPAR model mandate that power be recovered within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months be retained?

Should CST refill always be queried when the CST is the source of long-term makeup? If not, under what conditions should refill be queried?

Is suppression pool inventory adequate as a long-term source for injection when the suppression pool cooling system is failed and containment venting is successful?

How should recirculation pump leakage or failure be considered when relying on isolation condensers or CRDHS injection?

6-1

The following uncertainties are of interest for safe and stable end-state modeling:

room heatup concerns for long-term equipment operation (e.g., the potential that equipment performance will degrade, or operators will be unable to access equipment because of environmental conditions)

the leakage path from primary containment to the reactor building or environment

the extent of normal leakage or containment isolation impairment at the time of the initiator and resulting containment isolation signal

the initial volumes of water in the CST and suppressionpool

thermal-hydraulic uncertainties affecting the rate of containmentpressurization

decay heat formulation in the MELCOR model (the default adopted from a different plant versus the built-in ANS curve)

recirculation pump seal leakage 6.2 Station Blackout Sequence 6.2.1 Calculation Matrix Development Table 6-1 provides the calculation matrix for the subsequent MELCOR calculations, while Table 6-2 gives the calculation boundary and initial conditions. This analyses uses the same PRA sequence as that in Section 4.2, which includes a more detailed explanation. The following discusses the key modeling assumptions made for these calculations as they differ from those in Section 4.2.

Table 6-1 Calculation matrixsafe and stableSBO sequence Case Sequence RCIC injection Initial volume in Initial level in Recirculation

source CST suppression pump seal pool leakage

1. Based 24-foot MELCOR N/A Nominal

2. around level (i.e., 240,000 45.4 m3/hr LOOPGR- CST gallons) (200 gpm) 38-9 36-foot MELCOR Nominal 3.

4. level (i.e., 360,000 45.4 m3/hr gallons) (200 gpm)

5. WW N/A 10.1 feet Nominal

6. 45.4 m3/hr (200 gpm)

7. 10.4 feet Nominal

8. 45.4 m3/hr (200 gpm)

9. N/A Nominal 6-2

Table 6-1 Calculation matrixsafe and stableSBO sequence (continued)

Case Sequence RCIC injection Initial volume in Initial level in Recirculation

source CST suppression pump seal pool leakage

10. CST switching to 24-foot MELCOR 45.4 m3/hr FLEX after battery level (200 gpm) depletion at 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months

11. WW switching to N/A 10.4 feet Nominal

12. FLEX after battery 45.4 m3/hr depletion at 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months (200 gpm) 1As discussed previously, nominal recirculation pump seal leakage is 4.1 m3/hr (18 gpm) from each seal. The technical specification maximum for the seals is 14 m3/hr (61 gpm) total.

The first parameter explored in this section is the initial volume of the water available in either the CST or wetwell depending upon the injection source of RCIC. The intention is to identify how sensitive the success of the SBO sequence is to the initial conditions in the wetwell and CST. In the case of CST injection, the initial volume of water will dictate when a swap-over to wetwell injection is required. For the wetwell, the minimum and maximum limiting conditions for operation for wetwell water level are 3.08 and 3.17 meters (10.1 and 10.4 feet), respectively.

The volume of water within the wetwell contributes positively to the available NPSH for RCIC/HPCI pumps and as a heat sink for RPV depressurization.

Recirculation pump seal leakage is the other parameter that is varied in this analysis. The nominal pump seal leakage is typically taken to be 4.1 m3/hr (18 gpm) per pump. However, the possibility of an enhanced seal leakage following a catastrophic seal failure cannot be ruled out.

A seal leakage of 22.7 m3/hr (100 gpm) per pump is explored to determine if RCIC can successfully provide long-term makeup to the reactor while simultaneously losing significant inventory through the seals.

As in Chapter 4, these simulations include a 55.6-degree-C/hr (100-degree-F/hr) cooldown that is assumed to begin 30 minutes after the loss of all ac power. Also, as noted previously, battery power is required for control of the RCIC turbine as well as for SRV manipulation. Hence, the indefinite availability of RCIC in Cases 1-8 assumes indefinite battery life, implying that the FSG-based use of a portable diesel generator to supply power to station battery chargers has been successful.

Four of the cases also explore the availability of a FLEX pump for injection following the loss of RCIC. The pump is assumed to have been staged for injection before the loss of RCIC injection, in accordance with the FSGs. RCIC is assumed to be lost at 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months , and two SRVs are used for RPV ED such that it remains below 0.34 MPa (50 psid) between the RPV and wetwell pressures. (EOP-ED calls for RPV pressure less than 0.34 MPa (50 psi) above torus pressure.)

In the applicable scenarios, the FLEX pump begins injecting when pressure falls below the pumps 0.76 MPa (110 psig) deadhead pressure. These cases also vary in CST availability, as well as pump seal leakage. As noted previously, the depressurization of the reactor following battery loss in these cases implies local manipulation of the SRVs to lower and maintain pressure. Without this depressurization, FLEX would be deadheaded, level would fall, and core damage would ensue.

If the UHS or an ELAP is lost, operators would open the hardened containment vent to maintain an anticipatory pressure band of 0.03-0.07 MPa (5-10 psig) to maintain RCIC injection. This action is assumed successful in these cases. As in previous sections, batch RCIC injection is assumed with RCIC cycling full on and full off to maintain a band of 3.04 meters (119.5 inches) 6-3

to 6.55 meters (258 inches). If suction is on the wetwell, RCIC is assumed to be throttled when wetwell water temperature is greater than 215 degrees F. The target level assumed here is the normal RPV level of 4.85 meters (191 inches) above TAF. This choice should be carefully evaluated since, although thought to be reasonable, the water level could procedurally be maintained anywhere between 0.38 meter (15 inches) and 6.55 meters (258 inches).

Table 6-2 Initial and boundary conditionssafe and stableSBO sequence These conditions are in addition to the generic modeling conditions from Table 2-6 and the calculation-specific conditions from Table 6-1.

System Condition RCS 100% (full power).

Reactor successfully trips on loss of offsite ac.

Seal leakagesee Table 6-1.

Number of SRVs availabletwo of six.

RPV depressurization begins at 0.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months at the maximum cooldown rate (55.6 degrees C/hr [100 degrees F/hr]).

Balance of OFFSITE POWER is lost at time zero.

plant DC power is available unless specified otherwise.

Support systems are available (if ac is available) unless specified otherwise.

Turbine trip occurs upon loss of ac.

Feedwater and condensate fail at time zero.

MSIV closure occurs upon loss of offsite ac.

ECCS/ESF ESF signals successfully perform their functions (while dc power exists).

HPCI is unavailable.

RCIC is available unless specified otherwise.

CRDHS and SLC are unavailable upon loss of offsite ac.

LPCI/core spray are unavailable.

Containment Suppression pool cooling is unavailable.1 Nominal drywell and wetwell initial conditions (see Table 2-6) are present.

Anticipatory containment venting through the HCV.

Other operator If credited, LPCS may need to be disabled per EOP-1, if other low-pressure actions systems are available.

1 The exception to this is before loss of all offsite and onsite ac.

6.2.2 MELCOR Simulation Results Table 6-3 lists the results of the 12 LOOP calculations. In addition to this, APPENDIX G to this report includes figures for selected parameters of interest.

Table 6-3 LOOPGR results Source of NPSH1 available <6.1 meters Containment Core Case (20 feet)

RCIC venting damage

(hours) suction (hours) (hours)

1. CST 7.1 7.1 No

2. CST 8.4 4.4 No2

3. CST 7.1 7.1 No

4. CST 8.3 4.4 No

5. WW 5.3 5.8 No3 6-4

Table 6-3 LOOPGR results (continued)

Source of NPSH1 available <6.1 meters Containment Core Case (20 feet)

RCIC venting damage

(hours) suction (hours) (hours)

6. WW 6.1 4.4 No3

7. WW 5.7 6.1 No3

8. WW 6.3 4.6 No3

9. CST- 7.1 No 7.1

>FLEX

10. CST- 7.9 No 4.4

>FLEX

11. WW- 5.7 6.1 No

>FLEX

12. WW- 6.3 4.6 No

>FLEX 1NPSH is approximated using conditions in the wetwell. Table 2-1 in Section 2.1 contains more information.

2 The CST is depleted and swap-over to the wetwell occurs immediately after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Pump damage from cavitation is likely, and the success of the scenario is questionable at best.

3 Although these calculations do not predict core damage, RCIC is operating for an extended period (more than 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months ) with suction on the wetwell and low NPSH available. Pump damage from cavitation is likely, and the success of the scenario is questionable at best.

As of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , all cases taking suction from the CST are in a safe and, seemingly, stable state.

CST inventory has not been exhausted, even with the enhanced seal leakage and limited initial inventory of CST in Case 2. The wetwell water level, while high, has not yet threatened the vacuum breakers, RCIC exhaust, and hardened vent. However, these calculations were extended from 24 to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months to determine the stability of the results. As time goes on, conditions become less stable. In the cases with low initial CST inventory, swap-over of RCIC suction to the wetwell occurs at 38.1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months in the case with nominal seal leakage (Case 1) and at 24.1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months in the case with increased seal leakage (Case 2). This has the positive benefit of reducing the high wetwell water level threat. However, the NPSH available to RCIC is less than the 6.1 meters (20 feet) of head required for the pump to operate. Cavitation is likely to occur, and prolonged injection from the RCIC pump could lead to pump damage and loss of injection.

In the cases with greater CST inventory, the swap-over to the wetwell occurs much later. When there is only nominal seal leakage (in Case 3), the CST is still not exhausted as of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

When there is increased seal leakage (in Case 4), the CST is exhausted and swap-over occurs at 42.1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . While the wetwell water level still does not reach the wetwell vacuum breakers in these cases, it comes right up to them before swap-over occurs in the increased seal leakage case. The impact of initial CST water level, then, is on the timing of swap-over of RCIC to the wetwell. In addition, the increased rate of pump seal leakage serves to speed the loss of CST inventory.

When the CST is unavailable, and suction is on the wetwell, the available NPSH becomes important in determining the long-term availability of the pump. Anticipatory venting is assumed successful in all cases, which keeps the wetwell water saturated and water temperature below 121 degrees C (250 degrees F). However, the pressure in the wetwell also remains relatively low, reducing the head available to the pump. Additional inventory in the wetwell in Cases 7 and 8 results in two benefits to NPSH. First, the additional water weight itself provides more head to the pump. Second, the additional wetwell water acts as a slightly better heat sink and the wetwell water temperature does not increase as quickly. In the cases with nominal seal leakage, the increased wetwell water level leads to a 20-minute delay in the available NPSH dropping below the 6.1 meters (20 feet) required for RCIC operation (5.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months versus 6-5

5.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months ). In the cases with increased seal leakage, a significant amount of decay heat is going to the drywell rather than the wetwell through the leaking seals. Hence, the wetwell water temperature receives less of the decay heat and leads to a slower loss of the available NPSH for RCIC. NPSH drops below 6.1 meters (20 feet) at 6.1 and 6.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months in Cases 6 and 8, respectively. The availability of RCIC beyond the time when available NPSH falls below the required head is questionable at best. Cases 5-8 are not in a safe and stable state as of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Two sensitivity calculations are provided with loss of RCIC occurring when NPSH falls below 6.1 meters (20 feet).

As in the analogous Chapter 4 cases, FLEX pump injection can provide a means of long-term cooling following the switch at 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months . This is the case regardless of the method of injection, initial CST and wetwell inventory before the switch, and seal leakage. Even though available NPSH falls below that required for RCIC before the swap-over to FLEX injection, it is for a relatively short period of time (1.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months or less). RCIC would not be immediately lost, and it would take time for the core to uncover. Because of the safe and stable state as of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , these calculations were not extended to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

Sensitivity Calculations In addition to these results, Table 6-4 documents additional sensitivity studies to investigate specific issues.

Table 6-4 Sensitivity study matrixsafe and stableSBO scenario Case # Sensitivity Impact 1a Availability of HPCI, in lieu With the much greater injection rate of HPCI, the water level recovers at a 5a of RCIC, for multiple greater rate during the first cycle of HPI. However, there is more scenarios overshooting of RPV water level after the pump is switched off at the expanded upper level setpoint. Steamline flooding occurs in both cases.

This occurs since relatively cold water is being injected rapidly up to the setpoint (just below the steamlines) which then heats up and expands.

HPCI is tripped code-automatically on an assumed trip from the high steamline water level. Water level falls quickly and, since the FLEX pump is not assumed available in either case, RPV level does not recover. The core uncovers with core damage occurring at 2.0 hours0 days 0 hours 0 weeks 0 months in both cases.

Even with FLEX pumps available, it is unlikely that they could be staged and injecting in time to preclude core damage.

5b RCIC is lost upon NPSH In the first scenario, the NPSH available to RCIC falls below the required 11a available < 20ft head at 5.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months and RCIC is assumed lost. RPV water level at this time is relatively high (214 inches above TAF) since RCIC has recently completed a cycle. Therefore, it takes time for water level to fall below the TAF. The core uncovers at 8.1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and core damage occurs at 9.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . Even if level had been lower at the time of RCIC failure, it takes 1.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for the level to fall from Level 2 to TAF and an additional 1.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months for core damage to occur. Hence, there is ample time for FLEX injection to begin.

This is seen in the second case, where FLEX injection becomes available at 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months . Operators begin depressurizing the RPV with 2 SRVs and FLEX begins injecting soon after. Level recovers and core uncovery and damage are precluded.

6-6

6.3 Loss-of-Main-Feedwater Scenario 6.3.1 Calculation Matrix Development Table 6-5 provides the calculation matrix for the subsequent MELCOR calculations, while Table 6-6 gives the calculation boundary and initial conditions. This analysis uses the same PRA sequence as that in Section 4.3 , which includes a more detailed explanation. The following discusses the key modeling assumptions made for these calculations as they differ from those in Section 4.3.

Table 6-5 Calculation matrixsafe and stableLOMFW sequence Recirculation Case Time of RCIC Sequence CRDHS1 pump seal

failure leakage2

13. LOMFW-25 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Nominal Nominal

14. 45.4 m3/hr (200 gpm)

15. 1-train, maximized Nominal

16. 45.4 m3/hr (200 gpm)

17. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Nominal Nominal

18. 45.4 m3/hr (200 gpm)

19. 1-train, maximized Nominal

20. 45.4 m3/hr (200 gpm) 1Nominal CRDHS injection is roughly 9.61 m3/hr (42.3 gpm). The maximized, postscram injection rate to the vessel depends on RPV pressure. The rate is 51.1 m3/hr (225 gpm) for vessel pressure below 1.245 MPa-absolute (abs),

40.2 m3/hr (177 gpm) for vessel pressure above 6.05 MPa-abs; for intermediate pressures, a linear dependence is assumed.

2As discussed previously, nominal recirculation pump seal leakage is 4.1 m3/hr (18 gpm) from each seal. The technical specification maximum for the seals is 14m3/hr (61 gpm) total.

This series of simulations explored the sufficiency of the CRDHS to provide long-term makeup following the loss of HPI. In many analyses (e.g., UFSAR Chapter 15 analyses), the prescram injection rate of the CRDHS is assumed even after reactor trip. However, the CRDHS can be a significant source of injection if the increased postscram flow is assumed. The assumption is that, when operating at the enhanced CRDHS injection rate, the CRDHS operates in batch mode between L2 and L8. Unlike with the steam-driven pumps, the EOPs do not appear to give guidance for an expanded level band with an electric pump. While procedures direct operators to put the pump into automatic mode, there is no indication that the pump operates automatically in batch mode. Hence, the code-automatic cycling assumed here models and credits operator action to maintain level in a desired band.

The level band for RCIC injection is reduced by 20 centimeters to avoid flooding the steamlines (see the explanation in Section 4.3.1). The FLEX pump is assumed unavailable in these simulations.

This analysis also explored the timing of dc power loss (resulting in loss of RCIC injection) and the recirculation pump seal leakage rate. The intention is to determine how sensitive CRDHS 6-7

success in providing makeup is to the amount of decay heat present and the rate of inventory loss.

When RPV pressure reaches the action is required region of the HCL curve, operators are assumed to walk down the curve. Since the HPI systems are unavailable when the curve is reached, the assumption is that operators do not cease the depressurization at 1.03 MPa (150 psig) but continue to depressurize to 0.34 MPa (50 psid). Table 6-8 includes a sensitivity wherein the pressure is held at 1.03 MPa (150 psig).

As in the LOMFW scenarios in the previous chapters, MSIVs are initially open with steam being sent to the condenser. MSIVs close on a low RPV pressure trip, which was later found to not be plan-actual. However, the net result, namely, the initial availability of the condenser with an eventual loss of the PCS when MSIVs close, is likely to mimic the actual plant response. In this series of calculations, MSIV closure varies depending upon the amount of CRDHS injection and seal leakage and is therefore included in the results table. Table 6-8 includes sensitivity cases with MSIV closure (and loss of the condenser) occurring at time zero.

Table 6-6 Initial and boundary conditionssafe and stableLOMFW sequence These conditions are in addition to the generic modeling conditions from Table 2-6 and the calculation-specific conditions from Table 6-5.

System Condition RCS 100% full power.

Reactor successfully trips on first-in RPS signal.

Recirculation pump seal leakagesee Table 6-5.

Number of SRVs availabletwo of six.

Balance of OFFSITE POWER is available.

plant Support systems are available, unless specified otherwise.

Turbine trip occurs upon loss of feedwater.

Feedwater and condensate fail at time zero.

ECCS/ESF ESF signals successfully perform their functions.

HPCI is unavailable.

RCICsee Table 6-5.

CRDHS and SLC are available.

LPCI/core spray are unavailable.

CST is available for injection until depleted and then injection switches to wetwell.

RPV depressurization is a walk down of the HCL curve.

Containment Suppression pool cooling is unavailable.

Nominal drywell and wetwell initial conditions (see Table 2-6) are present.

Other If credited, LPCS may need to be disabled per EOP-1, if other low-pressure operator systems are available.

actions 6.3.2 MELCOR Simulation Results Table 6-7 lists the results of the eight LOMFW calculations. In addition to this, APPENDIX G to this report includes figures for selected parameters of interest.

6-8

Table 6-7 LOMFW results CRDHS Recirculation MSIV Core Core Case pump seal closure uncovery damage

leakage (mins) (hours) (hours)

Nominal 8.1 m3/hr 5.4

13. 30.0 6.7 (36 gpm) 45.4 m3/hr 5.4

14. 10.7 6.5 (200 gpm) 1-train, 8.1 m3/hr -

15. 23.2 -

maximize (36 gpm) d 45.4 m3/hr 6.7

16. 21.3 -

(200 gpm)

Nominal 8.1 m3/hr 7.4

17. 30.0 10.3 (36 gpm) 45.4 m3/hr 7.3 8.6

18. 10.7 (200 gpm) 1-train, 8.1 m3/hr - -

19. 23.2 maximize (36 gpm) d 45.4 m3/hr - -

20. 21.3 (200 gpm)

In all cases where CRDHS injection is at a nominal flow rate (Cases 13, 14, 17, and 18), core damage occurs following the loss of RCIC. The relatively low rate of injection from CRDHS is not able to compensate for the combined inventory loss through the SRVs and from the seal leakage. When there is increased seal leakage, the water level falls faster following the loss of RCIC. However, the water level at the time of RCIC failure is slightly higher in both cases, and thus core uncovery occurs at roughly the same time as in the analogous nominal leakage cases.

When there is enhanced CRDHS injection and nominal seal leakage (Cases 15 and 19), there is more than enough makeup to the RPV following RCIC failure. A single CRDHS at maximized flow offers sufficient makeup to the RPV so that the core is never uncovered, and batch mode injection of the CRDHS leaves the plant in a safe and stable state at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

When there is enhanced CRDHS injection and increased seal leakage (Cases 16 and 20),

depressurization of the reactor becomes important. At high pressures, the seals are leaking at a rate of about 45.4 m3/hr (200 gpm), the CRDHS is injecting at rate of about 40.2 m3/hr (177 gpm), and additional inventory is being lost through the SRVs to the wetwell. The net result is a decrease in RPV water inventory and water level. Depressurizing the RPV reduces the rate of seal leakage, and the CRDHS can inject at a higher rate (51.1 m3/hr [225 gpm] when RPV pressure is below 1.14 MPa (166 psig)).

This effect is seen in the case with RCIC lost at 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (Case 16). Level is high from the last RCIC cycle. The CRDHS begins injecting once RPV water level hits L2 and is, initially, not sufficient to make up for loss from the SRVs and seal leakage, since pressure is still high. As a result, the water level begins to fall. At 5.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months , RPV pressure reaches the HCL curve and depressurization begins with operators slowly following the HCL curve. Initially, the additional loss of inventory from depressurization causes level to fall even further, dropping below TAF at 6.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months . At 7.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , RPV pressure reaches a break-even point in inventory loss versus gain with seal leakage sufficiently reduced and CRDHS injection increased so that level begins to 6-9

recover and core damage is averted. A similar progression occurs in the 6-hour case (Case 20).

Table 6-8 includes a sensitivity wherein ED occurs when pressure reaches the HCL curve rather than walking down the curve.

Sensitivity Calculations In addition to these results, Table 6-8 documents additional sensitivity studies that were run to investigate specific issues.

Table 6-8 Sensitivity study matrixsafe and stableLOMFW scenario Case # Sensitivity Impact 17a Availability of HPCI, Using an extended level band before turning off HPCI leads to significant water in lieu of RCIC entering the steamlines. As is the case for RCIC in the base calculations, the extended high level is reduced by 0.51 meters (20 inches). However, thermal expansion still causes a significant amount of water to enter the steamline and HPCI failed on high steamline water level. Soon after, the code failed unexpectedly and was not able to be recovered. Had the scenario run to completion, core damage would have ensued with no source of injection.

17b SRV fails open The base scenarios assume that operators modulate the SRVs open to prevent continuous cycling on the lowest pressure SRV with pressure held around 7.58 MPa (1,100 psig). If operators did not take this action, the lowest pressure SRV would cycle repeatedly. In this sensitivity, the MSIVs again close at 30 minutes and the lowest pressure SRV then begins to cycle, since no action is taken to modulate the valve open. The lowest pressure SRV reaches 270 cycles at 3.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months and is then assumed to stick open. The level is relatively high at this point, and the open SRV causes water to flood the steamlines. RCIC is lost on a code-automatic trip from a flooded steamline.

With the stuck-open valve and no injection source, water level falls quickly. At 4.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months , RCIC recovers from its trip as water level in the steamlines falls below an assumed setpoint. RCIC can inject for 19 minutes before it is lost again when the turbine trips on low RPV pressure. The core uncovers at 5.8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months and core damage occurs at 7.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months .

15a Injection from In these scenarios, RCIC takes suction on the wetwell instead of the CST.

19a wetwell Since RCIC is lost early in the scenarios (at 4 and 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months in Case 15a and 19a, respectively), NPSH in the wetwell has not yet fallen below the 6.1 meters (20 feet) required for the pump, and there is no concern for pump cavitation while it is operating. Both scenarios progress similarly to the base case with increased CRDHS injection providing sufficient makeup to the RPV after RCIC is assumed to fail.

15b Cease RPV With the pressure held at 1.03 MPa (150 psig) following depressurization, the depressurization at rate of seal leakage is increased slightly in the long term. The CRDHS is still 1.03 MPa (150 psig) able to provide RPV makeup, and no uncovery or damage occurs.

15c ED when the HCL In both cases, as in the corresponding base scenarios, MSIVs close at 19b curve is reached 23.2 minutes after which steam is condensed in the wetwell. The HCL curve is reached in both cases at 4.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months .

In the first case, RCIC is no longer available when ED begins and the RPV water level falls quickly with core uncovery soon after. The CRDHS is operating at the increased injection rate and can keep the core covered sufficiently to prevent any heatup. The RPV water level slowly recovers, and the CRDHS maintains long-term level control, as in the base case.

In the second case, RCIC is available when ED begins. However, there is a 30-second delay in the start of RCIC injection, and RCIC starts after the water level has reached TAF. Once it starts, recovery of water level is much faster than with CRDHS injection alone. After RCIC is lost at 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , the CRDHS maintains RPV level, as in the base case.

6-10

Table 6-8 Sensitivity study matrixsafe and stableLOMFW scenario (continued) 15d MSIV closure at The biggest impact of the timing of MSIV closure is when the RPV 16a start of transient depressurization begins. With no decay heat being passed to the condenser, 19c the wetwell receives significantly more heat in the early part of the transient.

Hence, the HCL curve is reached 1.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months sooner in Cases 15d and 19c and 1.2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months sooner in Case 16a. This has a positive impact on the transient in that the seal leakage is reduced and CRDHS injection is increased sooner.

Water level does not fall as far after RCIC failure. In Case 16a, core uncovery does not occur as it did in the base case. This is not to say that early MSIV closure is preferred, since decay heat going to the condenser is always preferred over decay heat within containment. Instead, early depressurization is preferred over late.

6.4 Conclusions Drawn from MELCOR Results The staff makes the following observations about the MELCOR results with regard to LOOP:

In scenarios in which the CST is unavailable, the available NPSH for RCIC falls below the 6.1 meters (20 feet) required early in the scenario. Long-term availability of the pump is therefore questionable at best. This is also the case for HPCI taking suction on the wetwell. Without FLEX injection to provide long-term makeup, or the recovery of power, core damage would likely occur. This is the case even for nominal seal leakage.

Given significant recirculation pump seal leakage, the CST will deplete more quickly and, if the CST level is low, swap-over of RCIC to the wetwell will occur around 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Because of NPSH concerns, RCIC availability is questionable and core damage could occur.

In those cases that credit it, FLEX injection is successful in preventing core damage.

Again, steamline flooding occurs at the expanded level band with HPCI but may also occur with RCIC. This is because the thermal expansion of the water causes spillover into the steamlines. Over time, this could cause degradation of the turbine and the possible loss of the injection source.

The staff makes the following observations about the MELCOR results with regard to LOMFW:

Nominal CRDHS injection is not sufficient in providing makeup following RCIC failure at or before 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . However, increased postscram CRDHS injection is adequate for RPV makeup.

The rate of seal leakage has little impact on scenario success. Failure occurs regardless of leakage rate for nominal CRDHS injection, and success occurs for increased injection.

Timely depressurization of the RPV (in this case, walking down the HCL curve) is important since the rate of seal leakage as well as the rate of injection is pressure dependent.

Again, steamline flooding is a concern in these scenarios, particularly given HPCI rather than RCIC injection.

6-11

7 APPLICATION OF MELCOR RESULTS TO SPAR MODEL Table 7-1 maps the MELCOR calculations presented in Chapters 3-6 with the corresponding SPAR model sequence. APPENDIX H to this report includes all relevant event trees. It is important to note that SPAR models are most commonly used for event and condition assessments, meaning that the specific portions of the model have relatively more importance in specific applications than their baselines frequencies would suggest.

Table 7-2 summarizes the scenarios that have been investigated, recaps the boundary and initial condition variations studied using MELCOR, highlights relevant parts of the existing DAEC success criteria, and discusses the potential changes to the DAEC model based on the MELCOR analysis. In addition, the table identifies cases in which these results can be applied to SPAR models for other similar plants. This table is designed to be the starting point for subsequent evaluation by SPAR model developers to ensure that these changes are appropriate and assess whether the same changes can be made to SPAR models for similar plants.

Table 7-1 Mapping of MELCOR analyses to the DAEC SPAR (8.50) model Percentage as part of SPAR MELCOR Percentage as part of initiator class CDF sequence calculations total internal event CDF (internal events)

Chapter 3Degraded High-Pressure Injection and Relief Valve Criteria (non-ATWS)

TRANS-30 Cases 1-16 N/Asuccess path N/Asuccess path TRANS-49 Cases 17-20 0.27% 0.15%

SLOCA-25 Cases 21-30 N/Asuccess path N/Asuccess path Chapter 4Mitigating Strategies Usage in Loss of AC Power and Other Scenarios LOOPGR-38-9 Cases 1-16 N/Asuccess path N/Asuccess path LOMFW-25 Cases 17-25 N/Asuccess path N/Asuccess path Chapter 5ECCS Injection Following Containment Failure or Venting LOOPGR-38-9 Cases 1-14 N/Asuccess path N/Asuccess path LOMFW-25 Cases 15-38 N/Asuccess path N/Asuccess path Chapter 6Safe and Stable End-State Considerations LOOPGR-38-9 Cases 1-12 N/Asuccess path N/Asuccess path LOMFW-25 Cases 13-20 N/Asuccess path N/Asuccess path 7-1

MELCOR Initiator/aspect variations for Expected insights Proposed SPAR changes or application-specific considerations of interest baseline cases

A single SRV can depressurize the RPV and core damage is avoided.

However, the uncertainty associated with the volume of water entering and leaving the vessel (i.e., seal leakage, CRDHS injection, feedwater line emptying) at this time makes the success of this scenario uncertain. A CRDHS change to the SPAR models is not recommended because of this injection, manual uncertainty.

actions to

CRDHS injection alone operating at the nominal, prescram rate is TRANS stabilize level insufficient in providing makeup to the RPV following an unexpected Degraded HPI and pressure, reactor trip. Another source of HPI (such as RCIC) or LPI with successful and Relief Valve method of ADS operation is necessary for success. This is consistent with the current Criteria depressurization, SPAR logic.

(non-ATWS) timing of ADS

What high pressure

A single CRDHS pump injecting at the postscram increased injection rate 7-2 initiation, number systems are is sufficient for RPV water inventory makeup. However, this may not be of SRVs during required? sufficient to support RPV cooldown in the first few hours of the transient.

ADS

What operator Additionally, two CRDHS pumps injecting at the postscram injection rate actions are provide more than enough makeup to the RPV and can facilitate a required? cooldown of the RPV to cold shutdown conditions if a train of RHR is

How many ADS available. This increased injection is currently not queried in the SPAR valves need to models and could be added.

operate?

Given a small LOCA in the steamline, pressure and level fall but a single train of CRDHS at the increased postscram rate can maintain the RPV level. This is true for both a 1-inch and 1.8-inch equivalent break. Two trains provide more than enough injection to maintain the level and SLOCA CRDHS support a cooldown to cold shutdown conditions. This increased injection Degraded HPI injection, timing is currently not queried in the SPAR models and could be added.

and Relief Valve of ADS initiation, However, for a small, recirculation line LOCA, the loss of inventory is Criteria number of SRVs significant enough that even both CRDHS pumps operating at full capacity Table 7-2 Potential success criteria updates based on DAEC result (continued)

(non-ATWS) during ADS is insufficient to maintain the level. This is true even for a smaller 1-inch equivalent break and one train of the CRDHS.

As in the TRANS cases, two SRVs are necessary for the success of the ADS. This is consistent with the current success criteria.

Initiator/aspect MELCOR of interest variations for Expected insights Proposed SPAR changes or application-specific considerations baseline cases

Without manual depressurization following a loss of both dc power and RCIC injection, the FLEX pump would be unable to inject and core uncovery and fuel damage would be inevitable. This is consistent with the current SPAR model assumptions made for firewaterinjection.

FLEX injection led to success in all scenarios that gave FLEX credit, Timing of ac regardless of timing of RCIC loss and HCV venting actions. Given the LOOP power loss, ability of FLEX to prevent core damage, this confirms that FLEX Mitigating

What FLEX timing of RCIC equipment should be added to the SPAR models.

Strategies equipment can be loss, CST

If FLEX is not available, success is only possible with both anticipatory Usage used?

availability, venting and CST availability. The combination of cool water from the CST venting actions

What FLEX combined with expulsion of decay heat out the HCV by anticipatory 7-3 strategies can be venting led to success. Without CST water, RCIC could be damaged by used? cavitation. Without anticipatory venting, RCIC would trip on high wetwell

What conditions backpressure. Currently, the SPAR models do not query CST availability.

need to be satisfied This could be added for scenarios for which no alternate injection is for FLEX to be available.

successful?

Timing and LOMFW method of RPV Mitigating depressurization,

Success was not sensitive to a lower delivered flow rate of theFLEX Strategies time and pump.

Usage delivered flow rate of FLEX injection Table 7-2 Potential success criteria updates based on DAEC result (continued)

MELCOR Initiator/aspect variations for Expected insights Proposed SPAR changes or application-specific considerations of interest baseline cases

The 2-inch bypass vent is insufficient to keep the wetwell pressure low enough so that RCIC does not trip on high wetwell backpressure. This

Can you inject after confirms the current SPAR model, which does not consider the bypass failure because of vent as a means to success.

high *If flooding occurs from venting the 18-inch vents, conditions (i.e., water backpressure? level and ambient temperature) in the basement are such that HPCI

Can you inject after remains available out to but not beyond 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . Since RCIC is protected failure because of from internal flooding conditions, its failure from environmental conditions Venting action or high ambient is not a concern. Given the nature of the current modeling of late injection, LOOPECCS containment pressure? there is no distinguishing between HPI sources. If this modeling were Injection failure, vent path expanded, RCIC and HPCI injection should be looked at separately.

Following

Does containment used, response

Increased seal leakage is a concern in that it will deplete the CST at a Containment failure create of ECCS pumps greater rate and force the swap-over of HPI suction to the saturated Failure or wetwell boiling?

7-4 to pressure wetwell where there are concerns for available NPSH. However, given that Venting

Does containment changes increased seal leakage does not significantly affect RPV pressure and failure lead to two-available steam pressure for early RCIC performance, this is a candidate phase flow in for inclusion in the SPAR models.

pumps?

If the CST were not available, the RCIC pump would eventually

Does containment experience two-phase flow by wetwell boiling from containment venting.

failure lead to Thus, long-term performance and scenario success are questionable at suction-line best. Given the nature of the current modeling of late injection, CST uncovering? availability is not queried. If this modeling were expanded, CST availability

How does ECCS should be considered.

operate when containment

Venting through the wetwell versus the drywell has no impact on success pressure is if vacuum breakers are available. This is consistent with the current SPAR Venting action or LOMFW elevated? model.

containment ECCS Injection

There is an important distinction between HPCI and RCIC injection in failure, vent path

Does the type of Following that HPCI has a swap-over to wetwell injection if level thererises used, response containment failure Table 7-2 Potential success criteria updates based on DAEC result (continued)

Containment 0.13 meter (5 inches) above the nominal level. With no operator action to of ECCS pumps change any of the Failure or prevent this swap-over, long-term HPCI injection does not lead to a to pressure outcomes?

Venting success path because of NPSH concerns. Additionally, as mentioned changes above, environmental conditions differ between HPCI and RCIC. Given the nature of the current modeling of late injection, there is no

MELCOR Initiator/aspect variations for Expected insights Proposed SPAR changes or application-specific considerations of interest baseline cases distinguishing between HPI sources. If this modeling were expanded, RCIC and HPCI injection should be looked at separately.

A single train of CRDHS injection is sufficient for RCS makeup after 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months . This again points to distinguishing injection sources if the late injection modeling were expanded.

In scenarios in which the CST is unavailable, the available NPSH for

If battery charging RCIC falls below the 6.1 meters (20 feet) required early in the scenario.

(dedicated Long-term availability of the pump is therefore questionable at best. This is 7-5 charging diesel) is also the case for HPCI taking suction on the wetwell. Without FLEX successful during RCIC injection injection to provide long-term makeup, or the recovery of power for wetwell an SBO event, source, initial cooling, core damage would likely occur. This is the case even with should the SPAR volume in CST, nominal seal leakage. This indicates that the CST should be queried when LOOPSafe model mandate initial volume in RCIC or HPCI is the source of long-term makeup.

and Stable End- that power be suppression

Given significant recirculation pump seal leakage, the CST will deplete State recovered within pool, more quickly and, if the CST level is low, swap-over of RCIC to the wetwell Considerations 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months be recirculation will occur around 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Because of NPSH concerns, RCIC availability retained?

pump seal is questionable and core damage could occur. However, given that

Should CST refill leakage increased seal leakage does not significantly affect RPV pressure and always be queried available steam pressure for early RCIC performance, this is a candidate when the CST is for inclusion in the SPAR models.

the source of long-

FLEX injection is successful in all cases. This again points to the term makeup? If appropriateness of adding FLEX to the SPAR models.

Table 7-2 Potential success criteria updates based on DAEC result (continued)

MELCOR Initiator/aspect variations for Expected insights Proposed SPAR changes or application-specific considerations of interest baseline cases not, under what conditions should refill be queried?

Is suppression pool inventory adequate as a long-term source for injection when the

Nominal CRDHS injection is not sufficient to provide makeup following Time of RCIC suppression pool RCIC failure at or before 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . However, increased postscram CRDHS LOMFWSafe failure, CRDHS cooling system has injection is adequate for RPV makeup. This increased injection is a and Stable injection, failed and candidate for being added to the SPAR model.

End-State recirculation containment

Timely depressurization of the RPV is important since the rate of seal Considerations pump seal venting is leakage, as well as the rate of injection, is pressure dependent. This 7-6 leakage successful? depressurization is a candidate for consideration in the SPARmodels.

How should recirculation pump leakage or failure be considered when relying on isolation condensers or CRDHS injection?

Table 7-2 Potential success criteria updates based on DAEC result (continued)

8 CONCLUSIONS This project performed MELCOR analyses for the DAEC, looking at various initiating events and sequences of interest. These results have either confirmed existing SPAR assumptions or provided a technical basis for a few specific model changes.

The study results provide additional timing information for several PRA sequences, confirm many of the existing SPAR model assumptions, and provide a technical basis for a few specific SPAR modeling changes. Potential SPAR model changes supported by this study include the following:

Degraded HPI and Relief Valve Criteria (non-ATWS): For both the TRANS and SLOCA cases, a single CRDHS pump injecting at the postscram increased injection rate is sufficient for RPV water inventory makeup. Additionally, two CRDHS pumps injecting at the postscram injection rate provide enough makeup to the RPV and can facilitate a cooldown of the RPV to cold shutdown conditions. This increased injection is currently not queried in the SPAR models and could be added.

Mitigating Strategies Usage: If FLEX is not available, the success of long-term cooling for these scenarios is only possible with both anticipatory venting and CST availability.

Currently, the SPAR models do not query CST availability. This could be added for scenarios in which no alternate injection is available. For the LOOP scenarios, FLEX injection led to success in all scenarios that gave FLEX credit, regardless of timing of RCIC loss and HCV venting actions. Given the ability of FLEX to prevent core damage, this confirms that FLEX equipment should be added to the SPAR models.

ECCS Injection Following Containment Failure or Venting: If the CST were not available, the RCIC pump would eventually experience two-phase flow by wetwell boiling from containment venting. If late injection modeling were expanded, CST availability should be considered. If flooding occurs from venting the 18-inch vents, conditions (i.e., water level and ambient temperature) in the basement are such that HPCI remains available out to but not beyond 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . Since RCIC is protected from internal flooding conditions, its failure from environmental conditions is not a concern. Additionally, for the LOMFW case, a single train of CRDHS injection is sufficient for RCS makeup after 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months . If the late injection modeling were expanded, injection sources should be distinguished. Given that increased seal leakage does not significantly affect RPV pressure and available steam pressure for early RCIC performance, updated SBO modeling is a candidate for inclusion in the SPAR models.

Safe and Stable End-State Considerations: In scenarios in which the CST is unavailable, long-term availability of the HPCI or RCIC pump is questionable at best. This is also the case for HPCI taking suction on the wetwell. The CST should be queried when RCIC or HPCI is the source of long-term makeup. Increased postscram CRDHS injection is adequate for RPV makeup. This increased injection is a candidate for inclusion in the SPAR model. Depressurizing the RPV when reaching the HCL curve is important since the rate of seal leakage, as well as the rate of injection, is pressure dependent. This depressurization is a candidate for consideration in the SPAR models.

8-1

9 REFERENCES 10 CFR 50.63 Part 10 Code of Federal Regulations § 50.63 Loss ofalternating current power.

ASME, 2013a ASME/ANS RA-Sb-2013, Addenda to ASME/ANS RA-S-2008: Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, American Society of Mechanical Engineers, New York, NY, July 1, 2013.

BWROG, 2012a BWR Owners Group, Task 3 - Pump Operation at Reduced NPSHa Conditions (CVDS Pump), BWROG-TP-12-018, Revision 0, October 2012.

(ADAMS Accession No. ML12300A220)

BWROG, 2012b BWR Owners Group, Task 5 - Effects of Non-Condensible Gaseson Seals (CVDS Pump), BWROG-TP-12-013, Revision 0, August 2012.(ADAMS Accession No. ML12300A222)

DAEC, 2005 Duane Arnold Energy Center, Updated Final SafetyAnalysis Report, Revsion 18, March 2005.

DAEC, 2008a Duane Arnold Energy Center, Applicants Environmental ReportOperating License Renewal Stage, Duane Arnold Energy Center, FPL Energy Duane Arnold, LLC, September 2008.

http://www.nrc.gov/reactors/operating/licensing/renewal/applications/duane-arnold/daec-er.pdf INL, 2016 Idaho National Laboratory, Safe and Stable State in SPARModel Event Trees, September 2016. (ADAMS Accession No. ML19098A890)

NEI, 2015a Nuclear Energy Institute, Diverse and Flexible Coping Strategies (FLEX)

Implementation Guide, NEI-12-06, Revision 2, December 2015. (ADAMS Accession No. ML16005A625)

NEI, 2015b Nuclear Energy Institute, Industry Guidance for Compliance with Order EA-13-109, NEI-13-02, Revision 1, April 2015. (ADAMS Accession No. ML15113B318)

NextEra, 2013a NextEra Energy Duane Arnold, LLC (NextEra), NextEra Energy Duane Arnold, LLCs Overall Integrated Plan in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events (Order Number EA-12-049), letter from R. Anderson, February 28, 2013. (ADAMS Accession No. ML13063A148)

NextEra, 2014a NextEra, NextEra Energy Duane Arnold Center, LLCs Six-Month Status Report in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events (Order Number EA-12-049), letter from R.

Anderson, February 24, 2014. (ADAMS Accession No. ML14063A065) 9-1

NextEra, 2014b NextEra, NextEra Energy Duane Arnold, LLCs Phase 1Overall Integrated Plan in Response to June 6, 2013, Commission Order Modifying Licenses with Regard to Reliable Hardened Containment Vents Capable ofOperating Under Severe Accident Conditions (Order EA-13-109), letterfrom R. Anderson, June 25, 2014. (ADAMS Accession No. ML14182A423)

NextEra, 2015a NextEra, NextEra Energy Duane Arnold, LLCs Six-Month StatusReport in Response to March 12, 2012, Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events (Order Number EA-12-049), letter from T. Vehec, August 14, 2015. (ADAMS Accession No. ML15246A409)

NextEra, 2015b NextEra, NextEra Energy Duane Arnold, LLCs Six-Month StatusReport in Response to June 6, 2013 Commission Order Modifying Licenses with Regard to Reliable Hardened Containment Vents Capable of Operating Under Severe Accident Conditions (Order EA-13-109), letter from T. Vehec June 18, 2015. (ADAMS Accession No. ML15170A333)

NextEra, 2016 NextEra, NextEra Energy Duane Arnold, LLCs Notificationof Full Compliance with Order EA-12-049 Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events and Submittal of Final Integrated Plan, letter from T. Vehec, December 7, 2016. (ADAMS Accession No. ML16347A010)

NextEra, 2018 NextEra, NextEra Energy Duane Arnold. LLCs Six-Month StatusReport in Response to June 6, 2013 Commission Order Modifying Licenses with Regard to Reliable Hardened Containment Vents Capable of Operation Under Severe Accident Conditions (Order Number EA-13-109), letterfrom D. Curtland, June 26, 2018. (ADAMS Accession No. ML18177A261)

NRC, 1984 U.S. Nuclear Regulatory Commission, Pressure SuppressionPool Thermal Mixing, NUREG/CR-3471, 1984.

NRC, 1987 U.S. Nuclear Regulatory Commission, Analysis of Core Damage Frequency from Internal Events: Methodology Guidelines, NUREG/CR-4550, September 1987.

NRC, 1990 U.S. Nuclear Regulatory Commission, Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants, NUREG-1150, October 1990.

NRC, 2002 U.S. Nuclear Regulatory Commission, BWR/4 Technology Manual (R-104B), 2002.

NRC, 2003 U.S. Nuclear Regulatory Commission, Regulatory Effectivenessof the Station Blackout Rule, NUREG-1776, August 2003. (ADAMSAccession No. ML032450542)

NRC, 2011a U.S. Nuclear Regulatory Commission,Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant 9-2

Analysis Risk ModelsSurry and Peach Bottom, NUREG-1953, September 2011. (ADAMS Accession No. 11256A023)

NRC, 2012a U.S. Nuclear Regulatory Commission, Issuance of Order to Modify Licenses with Regard to Reliable Hardened Vents, Order EA-12-050, March 2012. (ADAMS Accession No. ML12054A694)

NRC, 2012b U.S. Nuclear Regulatory Commission, Compliance withOrder EA-12-049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events, JLD-ISG-2012-01, August 29, 2012. (ADAMS Accession No. ML12229A174)

NRC, 2013a U.S. Nuclear Regulatory Commission, Issueance of Order to Modify Licenses with Regard to Reliable Hardened Containment Vents Capable of Operation under Severe Accident Conditions, Order-EA-13-109, June 2013.

(ADAMS Accession No. ML13143A321)

NRC, 2013b U.S. Nuclear Regulatory Commission, Compliance with Order EA-13-109, Order Modifying Licenses with Regard to Reliable Hardened Containment Vents Capable of Operation Under Severe Accident Conditions, JLD-ISG-2013-02, November 14, 2013. (ADAMS Accession No. ML13304B836)

NRC, 2013c U.S. Nuclear Regulatory Commission, State-of-the-Art Reactor Consequence Analyses Project, Volume 1: Peach Bottom Integrated Analysis NUREG/CR-7110, Volume 1, Revision 1, May 2013. (ADAMS Accession No. ML13150A053)

NRC, 2013d U.S. Nuclear Regulatory Commission, Glossary of Risk-RelatedTerms in Support of Risk-Informed Decisionmaking, NUREG-2122, November 2013.

NRC, 2014a U.S. Nuclear Regulatory Commission, Compendium of Analyses to Investigate Select Level 1 Probabilistic Risk Assessment End-State Definition and Success Criteria Modeling Issues, NUREG/CR-7177, ERI/NRC 13-210, May 2014. (ADAMS Accession No.ML14148A126)

NRC, 2014b U.S. Nuclear Regulatory Commission, Duane Arnold Energy Center Interim Staff Evaluation Relating to Overall Integrated Plan in Response to Order EA-12-049 (Mitigation Strategies) (TAC NO. MF1000), memorandum from Jeremy Bowen to R. Anderson, February 21, 2014. (ADAMS Accession No. ML14007A676)

NRC, 2015a U.S. Nuclear Regulatory Commission, Duane Arnold Energy CenterNRC Integrated Inspection Report 05000331/2015004; 07200032/2015001, February 3, 2016. (ADAMS Accession No. ML16035A054)

NRC, 2015b U.S. Nuclear Regulatory Commission, Compliance with Phase 2of Order EA-13-109, Order Modifying Licenses with Regard to Reliable Hardened Containment Vents Capable of Operation under Severe Accident Conditions, JLD-ISG-2015-01, April 2015. (ADAMSAccession No. ML15104A118) 9-3

NRC, 2015c U.S. Nuclear Regulatory Commission, Final SignificanceDetermination of White Finding and Notice Violation; NRC Inspection Report No.

05000237/2015010; Dresden Nuclear Power Station, September 2015.

(ADAMS Accession No. ML15260A508)

NRC, 2015d U.S. Nuclear Regulatory Commission, Dresden Nuclear Power Station, Units 2 and 3, Integrated Inspection Report 05000237/2014005; 05000249/2014005 and Preliminary White Finding, January 2015.(ADAMS Accession No. ML15209A177)

NRC, 2015e U.S. Nuclear Regulatory Commission, Oyster Creek Nuclear Generating Station - NRC Inspection Report No. 05000219/2014009 and Preliminary Yellow Finding/Old Design Issue, February 2015. (ADAMS AccessionNo.

ML15042A231)

NRC, 2016a U.S. Nuclear Regulatory Commission,Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk ModelsByron Unit 1, NUREG-2187, January 2016.

(ADAMS Accession Nos. ML16021A423 and ML16022A062)

NRC, 2016b U.S. Nuclear Regulatory Commission, REVISIONTO JLD-ISG-2012-01 Compliance with Order EA-12-049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events Interim Staff Guidance, Revision 1 toJLD-ISG-12-01, January 22, 2016. (ADAMS Accession No. ML15357A163)

NRC, 2016c U.S. Nuclear Regulatory Commission, Palo Verde Nuclear Generating Station, Unit 3 - Issuance of Amendments RE: Revision to Technical Specification 3.8.1, AC [Alternating Current] Sources - Operating (Emergency Circumstance) (CAC No. MF8961), December 2016. (ADAMS Accession No. ML16358A676)

NRC, 2017 U.S. Nuclear Regulatory Commission, Watts Bar Nuclear Plant, Units 1 and 2 - Issuance of Amendments Regarding Extension of Completion Time for Inoperable Diesel Generator (CAC Nos. MF7147 and MF7148), January 2017. (ADAMS Accession No. ML17006A271)

Sandia, 2014a Sandia National Laboratories, RCIC Operation in Fukushima Accidents as Modeled by MELCOR and Proposed Testing, Presentation at BWR Owners Group General Meeting, Key West, FL, October 7-8, 2014 Sandia, 2014b Sandia National Laboratories, MELCOR Peach Bottom input deck (in the copy provided to Energy Research, Inc., the input files aredated May 8, 2014; according to an included ReadMe file, this version has been called the CPRR deck), or its documentation in A General Purpose MELCOR Model of a BWR/4 Mark I Nuclear Power Plant, review version, August 29, 2008.

TVA, 2016 Tennessee Valley Authority, Revised Request for License Amendments -

Diesel Generator Completion Time Extension for Technical Specification 3.8.1, AC Sources - Operating (TS-WBN-15-09), March 2016. (ADAMS Accession No. ML16071A456) 9-4

APPENDIX A MELCOR VERSIONS

MELCOR VERSIONS MELCOR is a computer code that is under active development, so it is important to mention the code version used for this analysis, if only to allow users to reproduce the results discussed in this NUREG. All calculations used MELCOR 2.2.9541, which was the latest available code version when the work documented in this NUREG began.

Similarly, the MELCOR input deck used for the calculations described in this report was under active development throughout the project. Numerous changes were made to correct input errors, to improve the performance of system logic (e.g., cooldown logic), or to reflect feedback received from internal and external stakeholders about plant design and operations. The following table lists the major input deck revisions used for the various calculations documented in this report, as well as any modifications that may have been made to the base input model to address specific scenarios. Note that, unless otherwise stated, sensitivity studies use the same input model as their base cases, with some minor modifications described in the various tables documenting the sensitivity analyses.

Table A-1 Input Models Used for Documented Calculations ChapterScenario Cases Input Comments Model Revision #

Shakedown N/A Rev. 5 Includes cooldown logic to slowly calculations depressurize the reactor pressure vessel (RPV) at a rate of 55.6 degrees Celsius (degrees C) per hour (/hr) (100 degrees Fahrenheit (degrees F)/hr) using a proportional-integral-derivative controller.

Also includes the ability to throttle the FLEX to maintain a user-defined level.

Chapter 3Transient Rev. 7a* Removes the main steam isolation valve closure on low RPV pressure.

Chapter 3Small Rev. 7a* Removes the main steam isolation valve Loss of Coolant closure on low RPV pressure.

Accident Chapter 4Station Rev. 7a*

Blackout Chapter 4Loss-of- Rev. 7a*

Main-Feedwater Chapter 5 Station Rev. 7a*

Blackout Chapter 5 Loss-of- Rev. 7 This revision of the deck contains no Main-Feedwater throttled reactor core isolation cooling injection with suction on the wetwell. This only affects the sensitivity cases with no condensate storage tank (CST) available.

A-1

Table A-1 Input Models Used for Documented Calculations (continued)

ChapterScenario Cases Input Comments Model Revision #

Chapter 6 Station 1, 2, 9, 10 Rev. 7a* Includes decreased initial CST Blackout level/volume and an altered recirculation pump seal leakage size.

3, 4 Includes increased initial CST level/volume and an altered recirculation pump seal leakage size.

5, 6 Includes decreased initial wetwell level/volume and an altered recirculation pump seal leakage size.

7, 8, 11, 12 Includes increased initial wetwell level/volume and an altered recirculation pump seal leakage size.

Chapter 6 Loss-of- Rev. 7a* Includes an altered recirculation pump Main-Feedwater seal leakage size.

Revision 7a is the same as Revision 7 with the following additional logic: (1) added the option for reactor core isolation cooling to be throttled when suction is on the wetwell and the water temperature is between 101.7 degrees C and 121.1 degrees C (215 degrees F and 250 degrees F), and (2) after depressurization, safety/relief valves can be throttled to maintain pressure rather than cycling fully open and closed.

Table A-2 Known Errors in Input Models Used for Documented Calculations Input Model Issue Notes Revision #

Rev. 7/7a Automatic depressurization system ADS has a logic control that waits for (ADS) can only initiate if level first level to fall below L 2 before it can be falls below L2. actuated.

CF304 can be manipulated in .cor to force ADS without the need for level to reach L2.

Core spray control functions Core spray velocity CF3130 is not CF3131 and CF3132 do not call referenced in CF3131 and CF3132.

CF3130 as intended. This is corrected through the .cor file for the sensitivities that use core spray.

Trip on low wetwell water level not The trip does not actually exist and is plant-actual. more a surrogate for loss of net positive suction head. This trip is removed as needed through the .cor file for each relevant scenario (those with suction on the wetwell).

While the total volume is consistent The result is that the rooms are with the licensees Modular narrower than is plant-actual and the Accident Analysis Program model, water height rises rather quickly. This the altitude/volume information for has no impact on scenario conclusions the reactor building corner rooms is since the corner rooms are not modeled off. to contain any vital equipment.

A-2

APPENDIX B CONTAINMENT VENTING

CONTAINMENT VENTING 1

1 ELAP: extended loss of alternating current power; LUHS: loss of ultimate heat sink; PB: pressure band; RPS: reactor protection system; SEP: site emergency plan; SBGT: standby gas treatment B-1

APPENDIX C DETAILED CHAPTER 3 ANALYSIS RESULTS

DETAILED CHAPTER 3 ANALYSIS RESULTS C.1 TRANS Scenarios C.1.1 Case 1: TRANS-30, Nominal CRDHS, MSIV Closure at 6 min., ADS at +15 in., One SRV Figure C - 1 Flow rate of the containment vents C-1

Figure C - 2 Flow rate of the control rod drive hydraulic system Figure C - 3 Flow rate of the LPCI pump C-2

Figure C - 4 Flow rate of the SRVs Figure C - 5 Flow rate of the wetwell cooling system C-3

Figure C - 6 Water level in the CST Figure C - 7 RPV Downcomer water level C-4

Figure C - 8 Pressure in the RPV Figure C - 9 Pressure in the wetwell C-5

Figure C - 10 Plant status relative to the HCL curve (Graph 4 of the EOPs)

Figure C - 11 Peak temperature of the fuel cladding as a function of time C-6

C.1.2 Case 2: TRANS-30, Nominal CRDHS, MSIV Closure at 6 min., ADS at +15 in., Two SRVs Figure C - 12 Flow rate of the containment vents C-7

Figure C - 13 Flow rate of the control rod drive hydraulic system Figure C - 14 Flow rate of the LPCI pump C-8

Figure C - 15 Flow rate of the SRVs Figure C - 16 Flow rate of the wetwell cooling system C-9

Figure C - 17 Water level in the CST Figure C - 18 RPV Downcomer water level C-10

Figure C - 19 Pressure in the RPV Figure C - 20 Pressure in the wetwell C-11

Figure C - 21 Plant status relative to the HCL curve (Graph 4 of the EOPs)

Figure C - 22 Peak temperature of the fuel cladding as a function of time C-12

C.1.3 Case 3: TRANS-30, Nominal CRDHS, MSIV Closure at 6 min., ADS at -25 in., One SRV Figure C - 23 Flow rate of the containment vents C-13

Figure C - 24 Flow rate of the control rod drive hydraulic system Figure C - 25 Flow rate of the LPCI pump C-14

Figure C - 26 Flow rate of the SRVs Figure C - 27 Flow rate of the wetwell cooling system C-15

Figure C - 28 Water level in the CST Figure C - 29 RPV Downcomer water level C-16

Figure C - 30 Pressure in the RPV Figure C - 31 Pressure in the wetwell C-17

Figure C - 32 Plant status relative to the HCL curve (Graph 4 of the EOPs)

Figure C - 33 Peak temperature of the fuel cladding as a function of time C-18

C.1.4 Case 4: TRANS-30, Nominal CRDHS, MSIV Closure at 6 min., ADS at -25 in., Two SRVs Figure C - 34 Flow rate of the containment vents C-19

Figure C - 35 Flow rate of the control rod drive hydraulic system Figure C - 36 Flow rate of the LPCI pump C-20

Figure C - 37 Flow rate of the SRVs Figure C - 38 Flow rate of the wetwell cooling system C-21

Figure C - 39 Water level in the CST Figure C - 40 RPV Downcomer water level C-22

Figure C - 41 Pressure in the RPV Figure C - 42 Pressure in the wetwell C-23

Figure C - 43 Plant status relative to the HCL curve (Graph 4 of the EOPs)

Figure C - 44 Peak temperature of the fuel cladding as a function of time C-24

C.1.5 Case 5: TRANS-30, Nominal CRDHS, Automatic MSIV Closure, ADS at +15 in.,

One SRV Figure C - 45 Flow rate of the containment vents C-25

Figure C - 46 Flow rate of the control rod drive hydraulic system Figure C - 47 Flow rate of the LPCI pump C-26

Figure C - 48 Flow rate of the SRVs Figure C - 49 Flow rate of the wetwell cooling system C-27

Figure C - 50 Water level in the CST Figure C - 51 RPV Downcomer water level C-28

Figure C - 52 Pressure in the RPV Figure C - 53 Pressure in the wetwell C-29

Figure C - 54 Plant status relative to the HCL curve (Graph 4 of the EOPs)

Figure C - 55 Peak temperature of the fuel cladding as a function of time C-30

C.1.6 Case 6: TRANS-30, Nominal CRDHS, Automatic MSIV Closure, ADS at +15 in.,

Two SRVs Figure C - 56 Flow rate of the containment vents C-31

Figure C - 57 Flow rate of the control rod drive hydraulic system Figure C - 58 Flow rate of the LPCI pump C-32

Figure C - 59 Flow rate of the SRVs Figure C - 60 Flow rate of the wetwell cooling system C-33

Figure C - 61 Water level in the CST Figure C - 62 RPV Downcomer water level C-34

Figure C - 63 Pressure in the RPV Figure C - 64 Pressure in the wetwell C-35

Figure C - 65 Plant status relative to the HCL curve (Graph 4 of the EOPs)

Figure C - 66 Peak temperature of the fuel cladding as a function of time C-36

C.1.7 Case 7: TRANS-30, Nominal CRDHS, Automatic MSIV Closure, ADS at -25 in.,

One SRV Figure C - 67 Flow rate of the containment vents C-37

Figure C - 68 Flow rate of the control rod drive hydraulic system Figure C - 69 Flow rate of the LPCI pump C-38

Figure C - 70 Flow rate of the SRVs Figure C - 71 Flow rate of the wetwell cooling system C-39

Figure C - 72 Water level in the CST Figure C - 73 RPV Downcomer water level C-40

Figure C - 74 Pressure in the RPV Figure C - 75 Pressure in the wetwell C-41

Figure C - 76 Plant status relative to the HCL curve (Graph 4 of the EOPs)

Figure C - 77 Peak temperature of the fuel cladding as a function of time C-42

C.1.8 Case 8: TRANS-30, Nominal CRDHS, Automatic MSIV Closure, ADS at -25 in.,

Two SRVs Figure C - 78 Flow rate of the containment vents C-43

Figure C - 79 Flow rate of the control rod drive hydraulic system Figure C - 80 Flow rate of the LPCI pump C-44

Figure C - 81 Flow rate of the SRVs Figure C - 82 Flow rate of the wetwell cooling system C-45

Figure C - 83 Water level in the CST Figure C - 84 RPV Downcomer water level C-46

Figure C - 85 Pressure in the RPV Figure C - 86 Pressure in the wetwell C-47

Figure C - 87 Plant status relative to the HCL curve (Graph 4 of the EOPs)

Figure C - 88 Peak temperature of the fuel cladding as a function of time C-48

C.1.9 Case 9: TRANS-30, One Train of CRDHS, MSIV Closure at 10 min., RPV Pressure Follows HCL Curve Figure C - 89 Flow rate of the containment vents C-49

Figure C - 90 Flow rate of the control rod drive hydraulic system Figure C - 91 Flow rate of the LPCI pump C-50

Figure C - 92 Flow rate of the SRVs Figure C - 93 Flow rate of the wetwell cooling system C-51

Figure C - 94 Water level in the CST Figure C - 95 RPV Downcomer water level C-52

Figure C - 96 Pressure in the RPV Figure C - 97 Pressure in the wetwell C-53

Figure C - 98 Plant status relative to the HCL curve (Graph 4 of the EOPs)

Figure C - 99 Peak temperature of the fuel cladding as a function of time C-54

C.1.10 Case 10: TRANS-30, One Train of CRDHS, MSIV Closure at 10 min., Emergency Depressurization at HCL Curve Figure C - 100 Flow rate of the containment vents C-55

Figure C - 101 Flow rate of the control rod drive hydraulic system Figure C - 102 Flow rate of the LPCI pump C-56

Figure C - 103 Flow rate of the SRVs Figure C - 104 Flow rate of the wetwell cooling system C-57

Figure C - 105 Water level in the CST Figure C - 106 RPV Downcomer water level C-58

Figure C - 107 Pressure in the RPV Figure C - 108 Pressure in the wetwell C-59

Figure C - 109 Plant status relative to the HCL curve (Graph 4 of the EOPs)

Figure C - 110 Peak temperature of the fuel cladding as a function of time C-60

C.1.11 Case 11: TRANS-30, One Train of CRDHS, MSIV Closure at 20 min., RPV Pressure Follows HCL curve Figure C - 111 Flow rate of the containment vents Figure C - 112 Flow rate of the control rod drive hydraulic system C-61

Figure C - 113 Flow rate of the LPCI pump Figure C - 114 Flow rate of the SRVs C-62

Figure C - 115 Flow rate of the wetwell cooling system Figure C - 116 Water level in the CST C-63

Figure C - 117 RPV Downcomer water level Figure C - 118 Pressure in the RPV C-64

Figure C - 119 Pressure in the wetwell Figure C - 120 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-65

Figure C - 121 Peak temperature of the fuel cladding as a function of time C.1.12 Case 12: TRANS-30, One Train of CRDHS, MSIV Closure at 20 min., Emergency Depressurization at HCL Curve Figure C - 122 Flow rate of the containment vents C-66

Figure C - 123 Flow rate of the control rod drive hydraulic system Figure C - 124 Flow rate of the LPCI pump C-67

Figure C - 125 Flow rate of the SRVs Figure C - 126 Flow rate of the wetwell cooling system C-68

Figure C - 127 Water level in the CST Figure C - 128 RPV Downcomer water level C-69

Figure C - 129 Pressure in the RPV Figure C - 130 Pressure in the wetwell C-70

Figure C - 131 Plant status relative to the HCL curve (Graph 4 of the EOPs)

Figure C - 132 Peak temperature of the fuel cladding as a function of time C-71

C.1.13 Case 13: TRANS-30, One Train of CRDHS, Automatic MSIV Closure, RPV Pressure Follows HCL Curve Figure C - 133 Flow rate of the containment vents Figure C - 134 Flow rate of the control rod drive hydraulic system C-72

Figure C - 135 Flow rate of the LPCI pump Figure C - 136 Flow rate of the SRVs C-73

Figure C - 137 Flow rate of the wetwell cooling system Figure C - 138 Water level in the CST C-74

Figure C - 139 RPV Downcomer water level Figure C - 140 Pressure in the RPV C-75

Figure C - 141 Pressure in the wetwell Figure C - 142 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-76

Figure C - 143 Peak temperature of the fuel cladding as a function of time C.1.14 Case 14: TRANS-30, Two Trains of CRDHS, MSIV Closure at 10 min.

Figure C - 144 Flow rate of the containment vents C-77

Figure C - 145 Flow rate of the control rod drive hydraulic system Figure C - 146 Flow rate of the LPCI pump C-78

Figure C - 147 Flow rate of the SRVs Figure C - 148 Flow rate of the wetwell cooling system C-79

Figure C - 149 Water level in the CST Figure C - 150 RPV Downcomer water level C-80

Figure C - 151 Pressure in the RPV Figure C - 152 Pressure in the wetwell C-81

Figure C - 153 Plant status relative to the HCL curve (Graph 4 of the EOPs)

Figure C - 154 Peak temperature of the fuel cladding as a function of time C-82

C.1.15 Case 15: TRANS-30, Two Trains of CRDHS, MSIV Closure at 20 min.

Figure C - 155 Flow rate of the containment vents Figure C - 156 Flow rate of the control rod drive hydraulic system C-83

Figure C - 157 Flow rate of the LPCI pump Figure C - 158 Flow rate of the SRVs C-84

Figure C - 159 Flow rate of the wetwell cooling system Figure C - 160 Water level in the CST C-85

Figure C - 161 RPV Downcomer water level Figure C - 162 Pressure in the RPV C-86

Figure C - 163 Pressure in the wetwell Figure C - 164 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-87

Figure C - 165 Peak temperature of the fuel cladding as a function of time C.1.16 Case 16: TRANS-30, Two Trains of CRDHS, Automatic MSIV Closure Figure C - 166 Flow rate of the containment vents C-88

Figure C - 167 Flow rate of the control rod drive hydraulic system Figure C - 168 Flow rate of the LPCI pump C-89

Figure C - 169 Flow rate of the SRVs Figure C - 170 Flow rate of the wetwell cooling system C-90

Figure C - 171 Water level in the CST Figure C - 172 RPV Downcomer water level C-91

Figure C - 173 Pressure in the RPV Figure C - 174 Pressure in the wetwell C-92

Figure C - 175 Plant status relative to the HCL curve (Graph 4 of the EOPs)

Figure C - 176 Peak temperature of the fuel cladding as a function of time C-93

C.1.17 Case 17: TRANS-49, One Train of CRDHS, MSIV Closure at 10 min.

Figure C - 177 Flow rate of the containment vents Figure C - 178 Flow rate of the control rod drive hydraulic system C-94

Figure C - 179 Flow rate of the LPCI pump Figure C - 180 Flow rate of the SRVs C-95

Figure C - 181 Flow rate of the wetwell cooling system Figure C - 182 Water level in the CST C-96

Figure C - 183 RPV Downcomer water level Figure C - 184 Pressure in the RPV C-97

Figure C - 185 Pressure in the wetwell Figure C - 186 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-98

Figure C - 187 Peak temperature of the fuel cladding as a function of time C.1.18 Case 18: TRANS-49, Two Trains of CRDHS, Automatic MSIV Closure Figure C - 188 Flow rate of the containment vents C-99

Figure C - 189 Flow rate of the control rod drive hydraulic system Figure C - 190 Flow rate of the LPCI pump C-100

Figure C - 191 Flow rate of the SRVs Figure C - 192 Flow rate of the wetwell cooling system C-101

Figure C - 193 Water level in the CST Figure C - 194 RPV Downcomer water level C-102

Figure C - 195 Pressure in the RPV Figure C - 196 Pressure in the wetwell C-103

Figure C - 197 Plant status relative to the HCL curve (Graph 4 of the EOPs)

Figure C - 198 Peak temperature of the fuel cladding as a function of time C-104

C.1.19 Case 19: TRANS-49, Two Trains of CRDHS, MSIV Closure at 10 min.

Figure C - 199 Flow rate of the containment vents Figure C - 200 Flow rate of the control rod drive hydraulic system C-105

Figure C - 201 Flow rate of the LPCI pump Figure C - 202 Flow rate of the SRVs C-106

Figure C - 203 Flow rate of the wetwell cooling system Figure C - 204 Water level in the CST C-107

Figure C - 205 RPV Downcomer water level Figure C - 206 Pressure in the RPV C-108

Figure C - 207 Pressure in the wetwell Figure C - 208 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-109

Figure C - 209 Peak temperature of the fuel cladding as a function of time C.1.20 Case 20: TRANS-49, Two Trains of CRDHS, Automatic MSIV Closure Figure C - 210 Flow rate of the containment vents C-110

Figure C - 211 Flow rate of the control rod drive hydraulic system Figure C - 212 Flow rate of the LPCI pump C-111

Figure C - 213 Flow rate of the SRVs Figure C - 214 Flow rate of the wetwell cooling system C-112

Figure C - 215 Water level in the CST Figure C - 216 RPV Downcomer water level C-113

Figure C - 217 Pressure in the RPV Figure C - 218 Pressure in the wetwell C-114

Figure C - 219 Plant status relative to the HCL curve (Graph 4 of the EOPs)

Figure C - 220 Peak temperature of the fuel cladding as a function of time C-115

C.2 SLOCA Scenarios C.2.1 Case 21: SLOCA-25, 1-in. Equivalent Steamline Break, One Train of CRDHS Figure C - 221 Flow rate of the break in the steamline/recirculation line C-116

Figure C - 222 Flow rate of the containment vents Figure C - 223 Flow rate of the control rod drive hydraulic system C-117

Figure C - 224 Flow rate of the LPCI pump Figure C - 225 Flow rate of the SRVs C-118

Figure C - 226 Flow rate of the wetwell cooling system Figure C - 227 Water level in the CST C-119

Figure C - 228 RPV Downcomer water level Figure C - 229 Pressure in the RPV C-120

Figure C - 230 Pressure in the wetwell Figure C - 231 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-121

Figure C - 232 Peak temperature of the fuel cladding as a function of time C.2.2 Case 22: SLOCA-25, 1-in. Equivalent Steamline Break, TwoTrains of CRDHS Figure C - 233 Flow rate of the break in the steamline/recirculation line C-122

Figure C - 234 Flow rate of the containment vents Figure C - 235 Flow rate of the control rod drive hydraulic system C-123

Figure C - 236 Flow rate of the LPCI pump Figure C - 237 Flow rate of the SRVs C-124

Figure C - 238 Flow rate of the wetwell cooling system Figure C - 239 Water level in the CST C-125

Figure C - 240 RPV Downcomer water level Figure C - 241 Pressure in the RPV C-126

Figure C - 242 Pressure in the wetwell Figure C - 243 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-127

Figure C - 244 Peak temperature of the fuel cladding as a function of time C.2.3 Case 23: SLOCA-25, 1.8-in. Equivalent Liquid Break, One Trainof CRDHS, ADS at +15 in., One SRV Figure C - 245 Flow rate of the break in the steamline/recirculation line C-128

Figure C - 246 Flow rate of the containment vents Figure C - 247 Flow rate of the control rod drive hydraulic system C-129

Figure C - 248 Flow rate of the LPCI pump Figure C - 249 Flow rate of the SRVs C-130

Figure C - 250 Flow rate of the wetwell cooling system Figure C - 251 Water level in the CST C-131

Figure C - 252 RPV Downcomer water level Figure C - 253 Pressure in the RPV C-132

Figure C - 254 Pressure in the wetwell Figure C - 255 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-133

Figure C - 256 Peak temperature of the fuel cladding as a function of time C.2.4 Case 24: SLOCA-25, 1.8-in. Equivalent Liquid Break, One Trainof CRDHS, ADS at +15 in., Two SRVs Figure C - 257 Flow rate of the break in the steamline/recirculation line C-134

Figure C - 258 Flow rate of the containment vents Figure C - 259 Flow rate of the control rod drive hydraulic system C-135

Figure C - 260 Flow rate of the LPCI pump Figure C - 261 Flow rate of the SRVs C-136

Figure C - 262 Flow rate of the wetwell cooling system Figure C - 263 Water level in the CST C-137

Figure C - 264 RPV Downcomer water level Figure C - 265 Pressure in the RPV C-138

Figure C - 266 Pressure in the wetwell Figure C - 267 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-139

Figure C - 268 Peak temperature of the fuel cladding as a function of time C.2.5 Case 25: SLOCA-25, 1.8-in. Equivalent Liquid Break, One Trainof CRDHS, ADS at -25 in., One SRV Figure C - 269 Flow rate of the break in the steamline/recirculation line C-140

Figure C - 270 Flow rate of the containment vents Figure C - 271 Flow rate of the control rod drive hydraulic system C-141

Figure C - 272 Flow rate of the LPCI pump Figure C - 273 Flow rate of the SRVs C-142

Figure C - 274 Flow rate of the wetwell cooling system Figure C - 275 Water level in the CST C-143

Figure C - 276 RPV Downcomer water level Figure C - 277 Pressure in the RPV C-144

Figure C - 278 Pressure in the wetwell Figure C - 279 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-145

Figure C - 280 Peak temperature of the fuel cladding as a function of time C.2.6 Case 26: SLOCA-25, 1.8-in. Equivalent Liquid Break, One Trainof CRDHS, ADS at -25 in., Two SRVs Figure C - 281 Flow rate of the break in the steamline/recirculation line C-146

Figure C - 282 Flow rate of the containment vents Figure C - 283 Flow rate of the control rod drive hydraulic system C-147

Figure C - 284 Flow rate of the LPCI pump Figure C - 285 Flow rate of the SRVs C-148

Figure C - 286 Flow rate of the wetwell cooling system Figure C - 287 Water level in the CST C-149

Figure C - 288 RPV Downcomer water level Figure C - 289 Pressure in the RPV C-150

Figure C - 290 Pressure in the wetwell Figure C - 291 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-151

Figure C - 292 Peak temperature of the fuel cladding as a function of time C.2.7 Case 27: SLOCA-25, 1.8-in. Equivalent Liquid Break, TwoTrains of CRDHS, ADS at +15 in., One SRV Figure C - 293 Flow rate of the break in the steamline/recirculation line C-152

Figure C - 294 Flow rate of the containment vents Figure C - 295 Flow rate of the control rod drive hydraulic system C-153

Figure C - 296 Flow rate of the LPCI pump Figure C - 297 Flow rate of the SRVs C-154

Figure C - 298 Flow rate of the wetwell cooling system Figure C - 299 Water level in the CST C-155

Figure C - 300 RPV Downcomer water level Figure C - 301 Pressure in the RPV C-156

Figure C - 302 Pressure in the wetwell Figure C - 303 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-157

Figure C - 304 Peak temperature of the fuel cladding as a function of time C.2.8 Case 28: SLOCA-25, 1.8-in. Equivalent Liquid Break, TwoTrains of CRDHS, ADS at +15 in., Two SRVs Figure C - 305 Flow rate of the break in the steamline/recirculation line C-158

Figure C - 306 Flow rate of the containment vents Figure C - 307 Flow rate of the control rod drive hydraulic system C-159

Figure C - 308 Flow rate of the LPCI pump Figure C - 309 Flow rate of the SRVs C-160

Figure C - 310 Flow rate of the wetwell cooling system Figure C - 311 Water level in the CST C-161

Figure C - 312 RPV Downcomer water level Figure C - 313 Pressure in the RPV C-162

Figure C - 314 Pressure in the wetwell Figure C - 315 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-163

Figure C - 316 Peak temperature of the fuel cladding as a function of time C.2.9 Case 29: SLOCA-25, 1.8-in. Equivalent Liquid Break, TwoTrains of CRDHS, ADS at -25 in., One SRV Figure C - 317 Flow rate of the break in the steamline/recirculation line C-164

Figure C - 318 Flow rate of the containment vents Figure C - 319 Flow rate of the control rod drive hydraulic system C-165

Figure C - 320 Flow rate of the LPCI pump Figure C - 321 Flow rate of the SRVs C-166

Figure C - 322 Flow rate of the wetwell cooling system Figure C - 323 Water level in the CST C-167

Figure C - 324 RPV Downcomer water level Figure C - 325 Pressure in the RPV C-168

Figure C - 326 Pressure in the wetwell Figure C - 327 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-169

Figure C - 328 Peak temperature of the fuel cladding as a function of time C.2.10 Case 30: SLOCA-25, 1.8-in. Equivalent Liquid Break, TwoTrains of CRDHS, ADS at -25 in., Two SRVs Figure C - 329 Flow rate of the break in the steamline/recirculation line C-170

Figure C - 330 Flow rate of the containment vents Figure C - 331 Flow rate of the control rod drive hydraulic system C-171

Figure C - 332 Flow rate of the LPCI pump Figure C - 333 Flow rate of the SRVs C-172

Figure C - 334 Flow rate of the wetwell cooling system Figure C - 335 Water level in the CST C-173

Figure C - 336 RPV Downcomer water level Figure C - 337 Pressure in the RPV C-174

Figure C - 338 Pressure in the wetwell Figure C - 339 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-175

Figure C - 340 Peak temperature of the fuel cladding as a function of time C.3 Sensitivities Analyses C.3.1 Case 5a: Sensitivity to TRANS-30 Case 5 with IncreasedCRDHS Flow Rate to Mimic SLC Injection Figure C - 341 Flow rate of the break in the steamline/recirculation line C-176

Figure C - 342 Flow rate of the containment vents Figure C - 343 Flow rate of the control rod drive hydraulic system C-177

Figure C - 344 Flow rate of the LPCI pump Figure C - 345 Flow rate of the SRVs C-178

Figure C - 346 Flow rate of the wetwell cooling system Figure C - 347 Water level in the CST C-179

Figure C - 348 RPV Downcomer water level Figure C - 349 Pressure in the RPV C-180

Figure C - 350 Pressure in the wetwell Figure C - 351 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-181

Figure C - 352 Peak temperature of the fuel cladding as a function of time C.3.2 Case 5b: Sensitivity to TRANS-30 Case 5 with FeedwaterLine Isolated at Time 0 Figure C - 353 Flow rate of the break in the steamline/recirculation line C-182

Figure C - 354 Flow rate of the containment vents Figure C - 355 Flow rate of the control rod drive hydraulic system C-183

Figure C - 356 Flow rate of the LPCI pump Figure C - 357 Flow rate of the SRVs C-184

Figure C - 358 Flow rate of the wetwell cooling system Figure C - 359 Water level in the CST C-185

Figure C - 360 RPV Downcomer water level Figure C - 361 Pressure in the RPV C-186

Figure C - 362 Pressure in the wetwell Figure C - 363 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-187

Figure C - 364 Peak temperature of the fuel cladding as a function of time C.3.3 Case 6a: Sensitivity to TRANS-30 Case 6 with Low-Pressure Injection Provided by Core Spray Rather Than LPCI Figure C - 365 Flow rate of the break in the steamline/recirculation line C-188

Figure C - 366 Flow rate of the containment vents Figure C - 367 Flow rate of the control rod drive hydraulic system C-189

Figure C - 368 Flow rate of the LPCI pump Figure C - 369 Flow rate of the SRVs C-190

Figure C - 370 Flow rate of the wetwell cooling system Figure C - 371 Water level in the CST C-191

Figure C - 372 RPV Downcomer water level Figure C - 373 Pressure in the RPV C-192

Figure C - 374 Pressure in the wetwell Figure C - 375 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-193

Figure C - 376 Peak temperature of the fuel cladding as a function of time C.3.4 Case 6b: Sensitivity to TRANS-30 Case 6 with Automatic Initiation of ADS Figure C - 377 Flow rate of the break in the steamline/recirculation line C-194

Figure C - 378 Flow rate of the containment vents Figure C - 379 Flow rate of the control rod drive hydraulic system C-195

Figure C - 380 Flow rate of the LPCI pump Figure C - 381 Flow rate of the SRVs C-196

Figure C - 382 Flow rate of the wetwell cooling system Figure C - 383 Water level in the CST C-197

Figure C - 384 RPV Downcomer water level Figure C - 385 Pressure in the RPV C-198

Figure C - 386 Pressure in the wetwell Figure C - 387 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-199

Figure C - 388 Peak temperature of the fuel cladding as a function of time C.3.5 Case 6c: Sensitivity to TRANS-30 Case 6 with Nominal Recirculation Pump Seal Leakage Figure C - 389 Flow rate of the break in the steamline/recirculation line C-200

Figure C - 390 Flow rate of the containment vents Figure C - 391 Flow rate of the control rod drive hydraulic system C-201

Figure C - 392 Flow rate of the LPCI pump Figure C - 393 Flow rate of the SRVs C-202

Figure C - 394 Flow rate of the wetwell cooling system Figure C - 395 Water level in the CST C-203

Figure C - 396 RPV Downcomer water level Figure C - 397 Pressure in the RPV C-204

Figure C - 398 Pressure in the wetwell Figure C - 399 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-205

Figure C - 400 Peak temperature of the fuel cladding as a function of time C.3.6 Case 7a: Sensitivity to TRANS-30 Case 7 with FeedwaterLine Isolated at Time 0 Figure C - 401 Flow rate of the break in the steamline/recirculation line C-206

Figure C - 402 Flow rate of the containment vents Figure C - 403 Flow rate of the control rod drive hydraulic system C-207

Figure C - 404 Flow rate of the LPCI pump Figure C - 405 Flow rate of the SRVs C-208

Figure C - 406 Flow rate of the wetwell cooling system Figure C - 407 Water level in the CST C-209

Figure C - 408 RPV Downcomer water level Figure C - 409 Pressure in the RPV C-210

Figure C - 410 Pressure in the wetwell Figure C - 411 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-211

Figure C - 412 Peak temperature of the fuel cladding as a function of time C.3.7 Case 21a: Sensitivity to SLOCA-25 Case 21 Early Closure ofthe MSIVs (at 10 min.)

Figure C - 413 Flow rate of the break in the steamline/recirculation line C-212

Figure C - 414 Flow rate of the containment vents Figure C - 415 Flow rate of the control rod drive hydraulic system C-213

Figure C - 416 Flow rate of the LPCI pump Figure C - 417 Flow rate of the SRVs C-214

Figure C - 418 Flow rate of the wetwell cooling system Figure C - 419 Water level in the CST C-215

Figure C - 420 RPV Downcomer water level Figure C - 421 Pressure in the RPV C-216

Figure C - 422 Pressure in the wetwell Figure C - 423 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-217

Figure C - 424 Peak temperature of the fuel cladding as a function of time C.3.8 Case 21b: Sensitivity to SLOCA-25 Case 21 with Break Sizeand Location Exchanged Figure C - 425 Flow rate of the break in the steamline/recirculation line C-218

Figure C - 426 Flow rate of the containment vents Figure C - 427 Flow rate of the control rod drive hydraulic system C-219

Figure C - 428 Flow rate of the LPCI pump Figure C - 429 Flow rate of the SRVs C-220

Figure C - 430 Flow rate of the wetwell cooling system Figure C - 431 Water level in the CST C-221

Figure C - 432 RPV Downcomer water level Figure C - 433 Pressure in the RPV C-222

Figure C - 434 Pressure in the wetwell Figure C - 435 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-223

Figure C - 436 Peak temperature of the fuel cladding as a function of time C.3.9 Case 23a: Sensitivity to SLOCA-25 Case 23 with Nominal Recirculation Pump Seal Leakage Figure C - 437 Flow rate of the break in the steamline/recirculation line C-224

Figure C - 438 Flow rate of the containment vents Figure C - 439 Flow rate of the control rod drive hydraulic system C-225

Figure C - 440 Flow rate of the LPCI pump Figure C - 441 Flow rate of the SRVs C-226

Figure C - 442 Flow rate of the wetwell cooling system Figure C - 443 Water level in the CST C-227

Figure C - 444 RPV Downcomer water level Figure C - 445 Pressure in the RPV C-228

Figure C - 446 Pressure in the wetwell Figure C - 447 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-229

Figure C - 448 Peak temperature of the fuel cladding as a function of time C.3.10 Case 24a: Sensitivity to SLOCA-25 Case 24 withNominal CRDHS Injection Figure C - 449 Flow rate of the break in the steamline/recirculation line C-230

Figure C - 450 Flow rate of the containment vents Figure C - 451 Flow rate of the control rod drive hydraulic system C-231

Figure C - 452 Flow rate of the LPCI pump Figure C - 453 Flow rate of the SRVs C-232

Figure C - 454 Flow rate of the wetwell cooling system Figure C - 455 Water level in the CST C-233

Figure C - 456 RPV Downcomer water level Figure C - 457 Pressure in the RPV C-234

Figure C - 458 Pressure in the wetwell Figure C - 459 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-235

Figure C - 460 Peak temperature of the fuel cladding as a function of time C.3.11 Case 24b: Sensitivity to SLOCA-25 Case 24 withLow-Pressure Injection Provided by Core Spray Rather Than LPCI Figure C - 461 Flow rate of the break in the steamline/recirculation line C-236

Figure C - 462 Flow rate of the containment vents Figure C - 463 Flow rate of the control rod drive hydraulic system C-237

Figure C - 464 Flow rate of the LPCI pump Figure C - 465 Flow rate of the SRVs C-238

Figure C - 466 Flow rate of the wetwell cooling system Figure C - 467 Water level in the CST C-239

Figure C - 468 RPV Downcomer water level Figure C - 469 Pressure in the RPV C-240

Figure C - 470 Pressure in the wetwell Figure C - 471 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-241

Figure C - 472 Peak temperature of the fuel cladding as a function of time C.3.12 Case 24c: Sensitivity to SLOCA-25 Case 24 with Automatic Initiation of ADS Figure C - 473 Flow rate of the break in the steamline/recirculation line C-242

Figure C - 474 Flow rate of the containment vents Figure C - 475 Flow rate of the control rod drive hydraulic system C-243

Figure C - 476 Flow rate of the LPCI pump Figure C - 477 Flow rate of the SRVs C-244

Figure C - 478 Flow rate of the wetwell cooling system Figure C - 479 Water level in the CST C-245

Figure C - 480 RPV Downcomer water level Figure C - 481 Pressure in the RPV C-246

Figure C - 482 Pressure in the wetwell Figure C - 483 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-247

Figure C - 484 Peak temperature of the fuel cladding as a function of time C.3.13 Case 24d: Sensitivity to SLOCA-25 Case 24 with Nominal Recirculation Pump Seal Leakage Figure C - 485 Flow rate of the break in the steamline/recirculation line C-248

Figure C - 486 Flow rate of the containment vents Figure C - 487 Flow rate of the control rod drive hydraulic system C-249

Figure C - 488 Flow rate of the LPCI pump Figure C - 489 Flow rate of the SRVs C-250

Figure C - 490 Flow rate of the wetwell cooling system Figure C - 491 Water level in the CST C-251

Figure C - 492 RPV Downcomer water level Figure C - 493 Pressure in the RPV C-252

Figure C - 494 Pressure in the wetwell Figure C - 495 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-253

Figure C - 496 Peak temperature of the fuel cladding as a function of time C.3.14 Case 24e: Sensitivity to SLOCA-25 Case 24 with Break Sizeand Location Exchanged Figure C - 497 Flow rate of the break in the steamline/recirculation line C-254

Figure C - 498 Flow rate of the containment vents Figure C - 499 Flow rate of the control rod drive hydraulic system C-255

Figure C - 500 Flow rate of the LPCI pump Figure C - 501 Flow rate of the SRVs C-256

Figure C - 502 Flow rate of the wetwell cooling system Figure C - 503 Water level in the CST C-257

Figure C - 504 RPV Downcomer water level Figure C - 505 Pressure in the RPV C-258

Figure C - 506 Pressure in the wetwell Figure C - 507 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-259

Figure C - 508 Peak temperature of the fuel cladding as a function of time C.3.15 Case 26a: Sensitivity to SLOCA-25 Case 26 withNominal CRDHS Injection Figure C - 509 Flow rate of the break in the steamline/recirculation line C-260

Figure C - 510 Flow rate of the containment vents Figure C - 511 Flow rate of the control rod drive hydraulic system C-261

Figure C - 512 Flow rate of the LPCI pump Figure C - 513 Flow rate of the SRVs C-262

Figure C - 514 Flow rate of the wetwell cooling system Figure C - 515 Water level in the CST C-263

Figure C - 516 RPV Downcomer water level Figure C - 517 Pressure in the RPV C-264

Figure C - 518 Pressure in the wetwell Figure C - 519 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-265

Figure C - 520 Peak temperature of the fuel cladding as a function of time C.3.16 Case 26b: Sensitivity to SLOCA-25 Case 26 with Low-Pressure Injection Provided by Core Spray Rather Than LPCI Figure C - 521 Flow rate of the break in the steamline/recirculation line C-266

Figure C - 522 Flow rate of the containment vents Figure C - 523 Flow rate of the control rod drive hydraulic system C-267

Figure C - 524 Flow rate of the LPCI pump Figure C - 525 Flow rate of the SRVs C-268

Figure C - 526 Flow rate of the wetwell cooling system Figure C - 527 Water level in the CST C-269

Figure C - 528 RPV Downcomer water level Figure C - 529 Pressure in the RPV C-270

Figure C - 530 Pressure in the wetwell Figure C - 531 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-271

Figure C - 532 Peak temperature of the fuel cladding as a function of time C-272

Figure C - 533 RPV Downcomer water level Figure C - 534 Pressure in the RPV C-273

Figure C - 535 Pressure in the wetwell Figure C - 536 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-274

Figure C - 537 Peak temperature of the fuel cladding as a function of time C-275

C.3.13 Case 24d: Sensitivity to SLOCA-25 Case 24 with Nominal Recirculation Pump Seal Leakage Figure C - 538 Flow rate of the break in the steamline/recirculation line C-276

Figure C - 539 Flow rate of the containment vents Figure C - 540 Flow rate of the control rod drive hydraulic system C-277

Figure C - 541 Flow rate of the LPCI pump Figure C - 542 Flow rate of the SRVs C-278

Figure C - 543 Flow rate of the wetwell cooling system Figure C - 544 Water level in the CST C-279

Figure C - 545 RPV Downcomer water level Figure C - 546 Pressure in the RPV C-280

Figure C - 547 Pressure in the wetwell Figure C - 548 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-281

Figure C - 549 Peak temperature of the fuel cladding as a function of time C-282

C.3.14 Case 24e: Sensitivity to SLOCA-25 Case 24 with Break Size and Location Exchanged Figure C - 550 Flow rate of the break in the steamline/recirculation line C-283

Figure C - 551 Flow rate of the containment vents Figure C - 552 Flow rate of the control rod drive hydraulic system C-284

Figure C - 553 Flow rate of the LPCI pump Figure C - 554 Flow rate of the SRVs C-285

Figure C - 555 Flow rate of the wetwell cooling system Figure C - 556 Water level in the CST C-286

Figure C - 557 RPV Downcomer water level Figure C - 558 Pressure in the RPV C-287

Figure C - 559 Pressure in the wetwell Figure C - 560 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-288

Figure C - 561 Peak temperature of the fuel cladding as a function of time C-289

C.3.15 Case 26a: Sensitivity to SLOCA-25 Case 26 with NominalCRDHS Injection Figure C - 562 Flow rate of the break in the steamline/recirculation line C-290

Figure C - 563 Flow rate of the containment vents Figure C - 564 Flow rate of the control rod drive hydraulic system C-291

Figure C - 565 Flow rate of the LPCI pump Figure C - 566 Flow rate of the SRVs C-292

Figure C - 567 Flow rate of the wetwell cooling system Figure C - 568 Water level in the CST C-293

Figure C - 569 RPV Downcomer water level Figure C - 570 Pressure in the RPV C-294

Figure C - 571 Pressure in the wetwell Figure C - 572 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-295

Figure C - 573 Peak temperature of the fuel cladding as a function of time C-296

C.3.16 Case 26b: Sensitivity to SLOCA-25 Case 26 with Low-Pressure Injection Provided by Core Spray Rather Than LPCI Figure C - 574 Flow rate of the break in the steamline/recirculation line C-297

Figure C - 575 Flow rate of the containment vents Figure C - 576 Flow rate of the control rod drive hydraulic system C-298

Figure C - 577 Flow rate of the LPCI pump Figure C - 578 Flow rate of the SRVs C-299

Figure C - 579 Flow rate of the wetwell cooling system Figure C - 580 Water level in the CST C-300

Figure C - 581 RPV Downcomer water level Figure C - 582 Pressure in the RPV C-301

Figure C - 583 Pressure in the wetwell Figure C - 584 Plant status relative to the HCL curve (Graph 4 of the EOPs)

C-302

Figure C - 585 Peak temperature of the fuel cladding as a function of time C-303

NUREG-2236 Volume 1 Confirmatory Thermal-Hydraulic Analysis To Support Specific Success Criteria in the Standardized Plant Analysis Risk ModelsDuane Arnold October 2020 Chapters 1-8, Appendices A - C S. Campbell, S. Dennis, D. Helton, M. Khatib-Rahbar, A. Krall, L. Technical Kozak, R. Buell, F. Sock, J. Pires Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, DC 20555 Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, DC 20555 S. Dennis This report extends the work documented in NUREG-2187, Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk ModelsByron Unit 1, issued January 2016, to the Duane Arnold Energy Center. Its purpose is to produce an additional set of best estimate thermal-hydraulic calculations that can be used to confirm or enhance specific success criteria for system performance and operator timing found in the agencys probabilistic risk assessment tools. Along with enhancing the technical basis for the agencys independent standardized plant analysis risk (SPAR) models, these calculations are expected to be a useful reference to model end users for specific regulatoryapplications.

This report first describes major assumptions used in this study. It then describes the major plant characteristics for the Duane Arnold Energy Center, in addition to the MELCOR model used to represent the plant. Finally, the report presents the results of MELCOR calculations for selected initiators and compares these results to SPAR success criteria, the licensees success criteria, or other generic studies.

PRA, Success Criteria, MELCOR, thermal-hydraulic

Federal Recycling Program

NUREG-2236, Volume 1 Confirmatory Thermal-Hydraulic Analysis To Support Specific Success October 2020 Chapters 1-8, Appendices A-C Criteria in the Standardized Plant Analysis Risk ModelsDuane Arnold

ML20300A225

Text

Navigation menu

Search