Accident Management Strategies for Mark I and Mark III BWRs

Accident Management Strategies for Mark I and Mark III BWRs E. L. Fuller Office of Nuclear Regulatory Research United States Nuclear Regulatory Commission IAEA Workshop Vienna, Austria July 17-21, 2017 1

Outline of Presentation Background Assumptions for the analyses In-vessel recovery by injecting water into RPV MAAP 5 models for corium evolution and quenching Vessel penetration failure modeling Results and insights from in-vessel retention studies MAAP 5.03 and MAAP 5.04 analyses Ex-vessel mitigation Conclusions and insights 2

Background CPRR Rulemaking technical basis report discusses venting strategies and water addition to mitigate the effects of core debris exiting the vessel. Water addition and water management, along with venting through the wetwell, ensure BWR Mark I and Mark II containment building integrity and minimization of radionuclide releases to the environment Analyses suggest that sufficient time may be available for adding water to the vessel to prevent vessel failure BWR SAMGs evaluate whether vessel has failed to determine which operator actions to use In-vessel recovery analyses should consider water level in lower plenum, corium constituents, corium-water and corium-structure interactions, and vessel failure modes Ex-vessel corium cooling should consider corium-concrete interactions and cavity/pedestal designs SAMGs for Mark III plants need to prevent major hydrogen burns 3

Assumptions for the Analysis All transients start with an ELAP and last 72 hr Industry (BWROG) EPG/SAG Rev. 3 is in place FLEX is in place both pre- and post-core damage 500 gpm injection into RPV or Drywell from external source at vessel breach Provision for both Severe Accident Water Addition (SAWA) or Severe Accident Water Management (SAWM) Control flow rate to prevent submerging the wetwell vent Recirculation pump leakage of 18 gpm per pump starts at the time of the initiating event Initial buildup of water in the drywell from nominal leakage RCIC operation Suction from SP (option for suction from CST/SP) Flow rate nominally 600 gpm RPV level control via throttling of RCIC 4

Assumptions (continued) RPV pressure control Initial pressure control in 800 1000 psig band after 10 min Controlled depressurization after one hour Subsequent pressure control in 200 400 psig band for continued RCIC operation Further depressurization after RCIC failure Containment venting (Mark I) Early venting from wetwell air space prior to core damage at 15 psig Not performed if RCIC already failed Close vent upon entry into SAG; reopen at PCPL (60 psig) Vent sizing consistent with industry assumptions 5

Relevant Models in MAAP 5.04 and Results When No Water is Added Improved treatment of corium behavior in lower plenum Addition of an important vessel penetration model that results in reducing the time to vessel failure 6

Principal Features of Lower Plenum Modeling Corium relocation to water in LP Particle bed generation from corium melt jet breakup Corium structure formation of oxide pool, crusts, and metal layer Heat transfer within corium pool and between corium and its surroundings Quenching debris bed In-vessel gap formation and cooling from gap Reactor vessel failure mechanisms 7

MAAP 5.04 Paints a Different Picture Of Corium Behavior in LP and Failure at Penetrations than Previous Codes Instrument tubes fill with molten core debris in core region. Molten debris re-freezes in instrument tubes and plugs form, particularly at the penetration locations. After relocation into the LP, instant stratification into a particle bed over metal and oxidic layers no longer assumed, but is calculated. The effect is to diminish the size and role of the metal layer. Earlier vessel failure predicted due to failure of closure welds from transfer of heat in the plugs. Consequently, in-vessel recovery may be less likely if water is added. 8

Failure mechanisms evaluated for initial failure of RPV lower head CRLH - damage fraction due to creep of the lower head wall CRCRD - damage fraction due to creep of ex-vessel CRD tube TRPTN - debris plug melt-through of instrument tubes at vessel weld: heat is transferred from plug to weld. EJPT - ejection of instrument tubes from weld failure EJCRD - of CRD tubes from weld failure EJDR - of drain line from weld failure ABLH - jet ablation of the lower head OVLH - overlying metal layer attacking the vessel wall 9

Progression of RCS Failure Models Added in MAAP 4 through MAAP 5.04. (Note: while the illustration is for BWRs, the models also apply to PWRs) Note that the other penetration failure models are also included in MAAP 5.03 10

Results from Simulating Mark I No Water Addition Cases Industry FLEX and (BWROG) EPG/SAG Rev. 3+ are assumed to be followed. Depressurizing RPV after RCIC failure makes in-vessel injection of fire water possible. Time is available after RCIC failure for injection into RPV to possibly prevent vessel failure. MELCOR 2.1 vessel failure due to lower head creep rupture. MAAP 5.03 vessel failure due to CRD tube ejection. MAAP 5.04 predicts earlier vessel failure (at 17.8 hr), at lower head penetrations due to weld failure. If penetration failure models bypassed, vessel fails by creep rupture at 19.2 hr. MELCOR 2.1 and MAAP 5.03 predict venting before vessel failure and consequent early iodine and cesium releases to the suppression pool and the environment. MAAP 5.04 releases to environment don t start until venting begins. Event Timing (hr) MELCOR 2.1 MAAP 5.03 MAAP 5.04 RCIC fails 9.6 9.6 9.6 Core uncovers 12.0 11.3 11.1 Core damage begins 13.7 11.7 11.4 Lower head dries out 18.1 19.9 16.2 Containment vented at 75 psia 14.9 22.8 18.9 Vessel fails 23.0 25.0 17.8 I release fraction to env. at 72 hr 2.3 E-1 7.8 E-3 1.1 E-2 Cs release fraction to env. at 72 hr 1.9 E-2 2.4 E-3 7.9 E-3 Hydrogen produced in vessel, kg 1195 790 700 11

MAAP 5.03 and 5.04 Pictures of Melt Progression and Debris Evolution (no water addition) MAAP 5.03 Significant molten pool formed in core region, with surrounding crusts. Axial flow through molten pool blocked by crusts. Particulate debris, caused by jet breakup of molten pour, in lower plenum predominates at first, with rapid formation of molten metal and oxidic layers below the particle bed. Oxidic crust separates the molten layers. Vessel failure at 25 hr from ejection of CRD tubes penetrating part-way up the lower head. MAAP 5.04 Smaller molten pool formed in core region than for MAAP 5.03. Particulate debris, caused by jet breakup of molten pour, aggregates in lower plenum. Particulate debris melts to form an oxidic pool, much crust, and a very small metallic layer. Vessel failure at 17.8 hr from instrument tube weld failure at the bottom of the lower head. 12

PB No Injection, Vessel Damage Fractions (MAAP 5.04 Case) Welds at instrument tube penetrations fail due to heat transfer from internal corium plugs where the tubes penetrate the vessel. Damage fractions increase rapidly at first; then increase gradually. CRD and drain line ejection penetration fractions are somewhat lower by vessel failure. RPV lower head creep damage fraction is still quite low at vessel failure. 13

IN-VESSEL RECOVERY 14

Benefits of Preventing Vessel Failure by Water Addition to RPV Averts drywell liner melt-through and other containment failure modes. No fission products or hydrogen in the reactor building If water is added soon enough, relocation of the corium into the lower plenum may not occur Nearly all volatile fission products are deposited either in the suppression pool or the RPV. Less than 1% are vented to the environment, and only after the vent is opened The sooner water is added the lower the releases The best outcome is to be able to add water before venting All lower-volatility fission products remain in the RPV Post-accident cleanup and maintenance of a safe stable state is much easier Long-term cooling by using the RHR system No debris in the pedestal region or drywell 15

CsI Distribution at 72 hr (MAAP 5.04) Releases to environment don t start until venting begins. Water addition suppresses revaporization and releases from RPV. Time RPV injection begins, hr Vessel Failure Fraction of CsI Inventory at 72 hr RPV DW SP Env. 13 No 0.42 1.5 E-3 0.58 1.5 E-5 14 No 0.38 6.2 E-4 0.62 1.1 E-4 15 Yes (late) 0.17 6.5 E-4 0.82 3.2 E-3 24 Yes 0.11 1.3 E-3 0.89 5.0 E-3 none Yes 0.07 2.0 E-3 0.92 7.9 E-3 16

No vessel failure following injection into RPV at 14.5 hr (MAAP 5.04) 17

Vessel Fails Following Injection into RPV at 15 hr (MAAP 5.04) Injection occurred while water was still in LP. Vessel failure delayed until 29.3 hr Weld failure from heat transfer from plugged tube at bottom of vessel 18

Ex-Vessel Mitigation and Achievement of a Safe Stable State 19

Debris Cooling in Mark I Pedestal Region following Injection into RPV just after Vessel Failure (MAAP 5.04) 20

Delayed Injection is Better Than No Injection at All (MAAP 5.03) 21

BWR Mark III Containment and Shield Building Perry and River Bend have steel containments inside annular shield buildings. Grand Gulf and Clinton have reinforced concrete containments inside annular shield buildings. All four containments have hydrogen igniters throughout. The design pressure is 15 psig for each plant. Grand Gulf has a vent that can be used to prolong RCIC until it fails, and then again after core damage. The others don t. DW and WW communicate only if the pressure difference between them is large enough to uncover at least one horizontal vent. If the SP water level gets high enough it can flow over the weir wall into the DW (and vice-versa). 22

Results for Perry Cases with No Recovery Pressurization after vessel failure is dominated by non-condensable gas generation from core debris/concrete interactions. Containment failure is assumed at 64.3 psig (the median composite failure pressure in the Perry IPE), at the equipment hatch level above the suppression pool (Comp. A). Containment survives more than a day. Small hydrogen burns early in scenarios. 23

Results and Insights for Grand Gulf No Recovery Cases The GGNS FLEX Integrated Plan states that igniters can be re-powered using a portable hydrogen igniter generator. There is no burning in the 12 hr battery cases. The no dc power and 12 hour battery cases, respectively, have practically identical pressure behavior. 24

Grand Gulf 12 hr Battery Cases: Oxygen Concentration in Upper Dome The main purpose of early venting is to prolong RCIC operation. In addition, early venting significantly lowers oxygen concentration, thus eliminating the possibility of Hydrogen and Carbon Monoxide burning later. Is not so effective when the batteries fail early. 25

PNPP RECOVERY STUDY Recovering diesel/ac power allows a number of actions to be taken Turning on RHR to cool suppression pool Using HPCS to add water to vessel and cool debris either in-vessel or in the Pedestal region Activate the Suppression Pool Make-Up system to initiate upper pool dump Vent the containment to lower pressure and remove hydrogen from the containment atmosphere Global burns are an issue to be dealt with after initiating recovery actions Recovery makes it possible to achieve a safe stable state 26

PNPP Recovery Study: Batteries Lost at 6 hr; Vary Time When RHR and 500 gpm HPCS are turned on after diesel generator is available Recovery of RHR cools down the suppression pool and the containment, and condenses steam. HPCS is somewhat effective in limiting CCI and consequent Hydrogen and CO production. Large global hydrogen and CO burns are predicted in the dome after recovery. 27

Attributes of a Safe Stable State Low pressure in containment Water in suppression pool is cool and plentiful Sufficient water in Pedestal and Drywell to cool debris and terminate core debris/concrete interactions No flammable mixture of hydrogen and oxygen Core melt progression has stopped Radioactive releases have stopped 28

A Perry Safe Stable State Case: Containment Pressure Operator actions and events assumed are: diesel power and venting at 18 hr, upper pool dump at 19 hr, RHR, 500 gpm HPCS, igniters on at 20 hr, and 100 gpm SP make-up at 24 hr. Drywell pressure rises quickly following TIP tube failure at 10 hr and vessel failure at 17.1 hr. Containment pressure decreases to ambient after venting. 29

A Perry Safe Stable State Case: Containment Temperatures Operator actions and events assumed are: diesel power and venting at 18 hr, upper pool dump at 19 hr, RHR, 500 gpm HPCS, and igniters on at 20 hr, and 100 gpm SP make-up at 24 hr. Drywell temperatures are high because of persistent decay heat in core debris. Spikes are due to TIP tube failure at 10 hr and vessel failure at 17.1 hr. SP water and containment dome temperatures are low by 48 hr. 30

Perry Safe Stable State Determination: Hydrogen Production Recovery provides sufficient water onto the core debris to terminate hydrogen production and CCI. Earlier recovery significantly reduces hydrogen production from CCI. Venting as soon as possible after recovery further reduces hydrogen production from CCI. 31

Conclusions and Insights Early controlled venting enables RCIC to run longer, and delay core damage. Early venting in Mark III containments can diminish oxygen concentrations in containment, lowering the likelihood of hydrogen combustion later. Depressurizing RPV after RCIC failure makes in-vessel injection of fire water possible. Time is available after RCIC failure for injection into RPV to possibly prevent vessel failure. MAAP 5.04 predicts earlier vessel failure than MELCOR 2.1 and MAAP 5.03. Most likely vessel failure mode is instrument tube ejection due to closure weld failure weld failure. 32

Conclusions and Insights (cont.) Fission product releases to environment don t start until venting begins. Water addition suppresses volatile fission product revaporization and releases from RPV. Water addition into the pedestal or lower drywell, from either the failed vessel or directly onto the corium, is very effective in limiting concrete ablation and combustible gas production. Venting is an important mitigation action, even for Mark III containments. For Mark III s it is important to vent after ac power is restored, and to wait awhile to turn igniters back on. 33

Backup Slides 34

Debris Bed Arrangement in Lower Plenum. 35

Quenching by Water Ingression to Debris Bed. 36

37

38

Molten Pool Mass in Core Region for Various Injection Times (MAAP 5.03) 39

Recovery from Injection into RPV at 20 hr: Corium and Water in LP (MAAP 5.03) MAAP 5.03 predicts that recovery is still possible even if most of the corium is in the LP and the LP has dried out. RCIC is assumed to fail at 9.6 hr, so more than 10 hr is available to begin injection to prevent vessel failure. 40

Debris Cooling in Mark I Pedestal Region following Injection into RPV just after Vessel Failure (MAAP 5.03) 41

PNPP Recovery Study: Batteries Lost at 6 hr, RHR and HPCS on at 24 hr: HPCS flow rate variations Flow rates for W sat are 1000 2000 gpm. Significantly more energy is removed than what is produced by decay heat. However, steam condensation causes the containment to be deinerted and a global burn results, failing the containment. A flow rate of 500 gpm easily removes the decay heat. However, a global burn results. Flow rates for W vap are 100 200 gpm. Energy from the decay heat is removed, and no global burns occur. Pressure remains elevated, however. 50 gpm is insufficient to remove all the decay heat, The containment fails from overpressure. 42

PNPP Recovery Study: Batteries Lost at 6 hr, RHR and 500 gpm HPCS, No Igniters Even with no igniters, global burns calculated to occur when containment is de-inerted. and ignition criteria are met, even if igniters are not energized. Suppression pool temperatures reduced to about 110 ºF from RHR cooling. Sufficient water added to Pedestal and Drywell to cool core debris. 43

PNPP Recovery Study: RHR and 500 gpm HPCS at 24 hr Global Burn in Upper Dome at 65.7 hr Global Hydrogen (and Carbon Monoxide) burns are predicted when Oxygen concentration in the dome increases while steam condenses. Once de-inerting is achieved, igniters provide the sparks. CO and Nitrogen are not shown. CO behaves like Hydrogen, while Nitrogen is an inertant like steam. 44

Upper Dome and Drywell Pressures at Time of Global Burn Pressure rise in Drywell lags that in the containment dome (where the burn originates). This leads to an implosive pressure load on the drywell Suppression pool bypass is unlikely because the pressure differential between the Drywell and Wetwell is less than 30 psid and the likelihood of a stuck-open vacuum breaker is very low. 45

Perry Safe Stable State Determination: Hydrogen Production Recovery provides sufficient water onto the core debris to terminate hydrogen production and CCI. Earlier recovery significantly reduces hydrogen production from CCI. Venting as soon as possible after recovery further reduces hydrogen production from CCI. 46

Perry Safe Stable State Determination: Cesium Release Fraction Fission product releases reduced from no-recovery case results. 47