Accident Management Strategies for

Mark I and Mark III BWRs

E. L. Fuller

Office of Nuclear Regulatory Research

United States Nuclear Regulatory Commission

IAEA Workshop

Vienna, Austria

July 17-21, 2017

1

Outline of Presentation

• Background

• Assumptions for the analyses

• In-vessel recovery by injecting water into RPV

– MAAP 5 models for corium evolution and quenching

– Vessel penetration failure modeling

• Results and insights from in-vessel retention studies

– MAAP 5.03 and MAAP 5.04 analyses

• Ex-vessel mitigation

• Conclusions and insights

2

Background

• CPRR Rulemaking technical basis report discusses venting strategies

and water addition to mitigate the effects of core debris exiting the

vessel.

– Water addition and water management, along with venting through the wetwell,

ensure BWR Mark I and Mark II containment building integrity and minimization of

radionuclide releases to the environment

– Analyses suggest that sufficient time may be available for adding water to the

vessel to prevent vessel failure

• BWR SAMGs evaluate whether vessel has failed to determine which

operator actions to use

• In-vessel recovery analyses should consider water level in lower

plenum, corium constituents, corium-water and corium-structure

interactions, and vessel failure modes

• Ex-vessel corium cooling should consider corium-concrete

interactions and cavity/pedestal designs

• SAMGs for Mark III plants need to prevent major hydrogen burns

3

• All transients start with an ELAP and last 72 hr

• Industry (BWROG) EPG/SAG Rev. 3 is in place

• FLEX is in place both pre- and post-core damage

– 500 gpm injection into RPV or Drywell from external source at vessel

breach

– Provision for both Severe Accident Water Addition (SAWA) or Severe

Accident Water Management (SAWM)

• Control flow rate to prevent submerging the wetwell vent

• Recirculation pump leakage of 18 gpm per pump starts at the

time of the initiating event

• Initial buildup of water in the drywell from nominal leakage

• RCIC operation

– Suction from SP (option for suction from CST/SP)

– Flow rate nominally 600 gpm

– RPV level control via throttling of RCIC

Assumptions for the Analysis

4

Assumptions (continued)

• RPV pressure control

– Initial pressure control in 800 – 1000 psig band after 10 min

– Controlled depressurization after one hour

– Subsequent pressure control in 200 – 400 psig band for

continued RCIC operation

– Further depressurization after RCIC failure

• Containment venting (Mark I)

– Early venting from wetwell air space prior to core damage at

15 psig

• Not performed if RCIC already failed

– Close vent upon entry into SAG; reopen at PCPL (60 psig)

– Vent sizing consistent with industry assumptions

5

Relevant Models in MAAP 5.04 and

Results When No Water is Added

6

• Improved treatment of corium behavior in lower

plenum

• Addition of an important vessel penetration

model that results in reducing the time to vessel

failure

Principal Features

of Lower Plenum Modeling

• Corium relocation to water in LP

• Particle bed generation from corium melt jet breakup

• Corium structure – formation of oxide pool, crusts,

and metal layer

• Heat transfer within corium pool and between corium

and its surroundings

– Quenching debris bed

– In-vessel gap formation and cooling from gap

• Reactor vessel failure mechanisms

7

MAAP 5.04 Paints a Different Picture

Of Corium Behavior in LP and Failure

at Penetrations than Previous Codes

8

• Instrument tubes fill with molten core debris

in core region.

• Molten debris re-freezes in instrument tubes

and plugs form, particularly at the

penetration locations.

• After relocation into the LP, instant

stratification into a particle bed over metal

and oxidic layers no longer assumed, but is

calculated. The effect is to diminish the size

and role of the metal layer.

• Earlier vessel failure predicted due to failure

of closure welds from transfer of heat in the

plugs.

• Consequently, in-vessel recovery may be

less likely if water is added.

Failure mechanisms evaluated for

initial failure of RPV lower head

9

• CRLH - damage fraction due to creep of the lower

head wall

• CRCRD - damage fraction due to creep of ex-vessel

CRD tube

• TRPTN - debris plug melt-through of instrument

tubes at vessel weld: heat is transferred from plug

to weld.

• EJPT - ejection of instrument tubes from weld failure

• EJCRD - of CRD tubes from weld failure

• EJDR - of drain line from weld failure

• ABLH - jet ablation of the lower head

• OVLH - overlying metal layer attacking the vessel wall

10

Progression of RCS

Failure Models Added

in MAAP 4 through

MAAP 5.04. (Note: while

the illustration is for

BWRs, the models also

apply to PWRs)

Note that the other

penetration failure

models are also

included in MAAP 5.03

Results from Simulating

Mark I No Water Addition Cases

• Industry FLEX and (BWROG) EPG/SAG Rev. 3+ are assumed to be followed.

• Depressurizing RPV after RCIC failure makes in-vessel injection of fire water possible.

• Time is available after RCIC failure for injection into RPV to possibly prevent vessel failure.

• MELCOR 2.1 vessel failure due to lower head creep rupture.

• MAAP 5.03 vessel failure due to CRD tube ejection.

• MAAP 5.04 predicts earlier vessel failure (at 17.8 hr), at lower head penetrations due to weld

failure. If penetration failure models bypassed, vessel fails by creep rupture at 19.2 hr.

• MELCOR 2.1 and MAAP 5.03 predict venting before vessel failure and consequent early

iodine and cesium releases to the suppression pool and the environment.

• MAAP 5.04 releases to environment don’t start until venting begins.

11

Event Timing (hr) MELCOR 2.1 MAAP 5.03

MAAP 5.04

RCIC fails 9.6 9.6 9.6

Core uncovers 12.0 11.3 11.1

Core damage begins 13.7 11.7 11.4

Lower head dries out 18.1 19.9 16.2

Containment vented at 75 psia 14.9 22.8 18.9

Vessel fails 23.0 25.0 17.8

I release fraction to env. at 72 hr 2.3 E-1 7.8 E-3 1.1 E-2

Cs release fraction to env. at 72 hr 1.9 E-2 2.4 E-3 7.9 E-3

Hydrogen produced in vessel, kg 1195 790 700

12

MAAP 5.03 and 5.04 Pictures of Melt

Progression and Debris Evolution

(no water addition)

MAAP 5.04

• Smaller molten pool formed in core

region than for MAAP 5.03.

• Particulate debris, caused by jet

breakup of molten pour, aggregates in

lower plenum.

• Particulate debris melts to form an

oxidic pool, much crust, and a very

small metallic layer.

• Vessel failure at 17.8 hr from

instrument tube weld failure at the

bottom of the lower head.

MAAP 5.03

• Significant molten pool formed in core region,

with surrounding crusts.

• Axial flow through molten pool blocked by

crusts.

• Particulate debris, caused by jet breakup of

molten pour, in lower plenum predominates at

first, with rapid formation of molten metal and

oxidic layers below the particle bed. Oxidic

crust separates the molten layers.

• Vessel failure at 25 hr from ejection of CRD

tubes penetrating part-way up the lower head.

13

PB No Injection,

Vessel Damage Fractions (MAAP 5.04 Case)

• Welds at instrument tube penetrations fail due to heat transfer from internal corium plugs

where the tubes penetrate the vessel.

• Damage fractions increase rapidly at first; then increase gradually.

• CRD and drain line ejection penetration fractions are somewhat lower by vessel failure.

• RPV lower head creep damage fraction is still quite low at vessel failure.

IN-VESSEL RECOVERY

14

Benefits of Preventing Vessel

Failure by Water Addition to RPV

• Averts drywell liner melt-through and other containment failure

modes.

– No fission products or hydrogen in the reactor building

• If water is added soon enough, relocation of the corium into the

lower plenum may not occur

• Nearly all volatile fission products are deposited either in the

suppression pool or the RPV.

– Less than 1% are vented to the environment, and only after the vent is opened

– The sooner water is added the lower the releases

– The best outcome is to be able to add water before venting

• All lower-volatility fission products remain in the RPV

• Post-accident cleanup and maintenance of a safe stable state is

much easier

– Long-term cooling by using the RHR system

– No debris in the pedestal region or drywell

15

CsI Distribution at 72 hr (MAAP 5.04)

• Releases to environment don’t start until venting begins.

• Water addition suppresses revaporization and releases from RPV.

16

Time RPV

injection

begins, hr

Vessel

Failure

Fraction of CsI Inventory at 72 hr

RPV DW SP Env.

13 No 0.42 1.5 E-3 0.58 1.5 E-5

14 No 0.38 6.2 E-4 0.62 1.1 E-4

15 Yes (late) 0.17 6.5 E-4 0.82 3.2 E-3

24 Yes 0.11 1.3 E-3 0.89 5.0 E-3

none Yes 0.07 2.0 E-3 0.92 7.9 E-3

No vessel failure following

injection into RPV at 14.5 hr (MAAP 5.04)

17

Vessel Fails Following

Injection into RPV at 15 hr (MAAP 5.04)

18

• Injection occurred while water

was still in LP.

• Vessel failure delayed until

29.3 hr

• Weld failure from heat transfer

from plugged tube at bottom

of vessel

Ex-Vessel Mitigation

and Achievement of a

Safe Stable State

19

Debris Cooling in Mark I Pedestal Region following

Injection into RPV just after Vessel Failure (MAAP 5.04)

20

21

Delayed Injection is Better Than

No Injection at All (MAAP 5.03)

22

BWR Mark III Containment

and Shield Building

• Perry and River Bend have steel

containments inside annular

shield buildings.

• Grand Gulf and Clinton have

reinforced concrete containments

inside annular shield buildings.

• All four containments have

hydrogen igniters throughout.

• The design pressure is 15 psig for

each plant.

• Grand Gulf has a vent that can be

used to prolong RCIC until it fails,

and then again after core damage.

The others don’t.

• DW and WW communicate only if

the pressure difference between

them is large enough to uncover at

least one horizontal vent.

• If the SP water level gets high

enough it can flow over the weir

wall into the DW (and vice-versa).

23

• Pressurization after vessel failure is dominated by non-condensable gas generation

from core debris/concrete interactions.

• Containment failure is assumed at 64.3 psig (the median composite failure pressure in

the Perry IPE), at the equipment hatch level above the suppression pool (Comp. A).

• Containment survives more than a day.

• Small hydrogen burns early in scenarios.

Results for Perry Cases

with No Recovery

Results and Insights for Grand Gulf

No Recovery Cases

24

• The GGNS FLEX Integrated Plan states that igniters can be re-powered using a portable

hydrogen igniter generator.

• There is no burning in the 12 hr battery cases.

• The no dc power and 12 hour battery cases, respectively, have practically identical

pressure behavior.

Grand Gulf 12 hr Battery Cases:

Oxygen Concentration in Upper Dome

25

• The main purpose of early venting is to prolong RCIC operation.

• In addition, early venting significantly lowers oxygen

concentration, thus eliminating the possibility of Hydrogen and

Carbon Monoxide burning later.

• Is not so effective when the batteries fail early.

PNPP RECOVERY STUDY

• Recovering diesel/ac power allows a number of

actions to be taken

– Turning on RHR to cool suppression pool

– Using HPCS to add water to vessel and cool debris

either in-vessel or in the Pedestal region

– Activate the Suppression Pool Make-Up system to

initiate upper pool dump

– Vent the containment to lower pressure and remove

hydrogen from the containment atmosphere

• Global burns are an issue to be dealt with after

initiating recovery actions

• Recovery makes it possible to achieve a safe

stable state

26

27

• Recovery of RHR cools down the suppression pool and the containment, and condenses steam.

• HPCS is somewhat effective in limiting CCI and consequent Hydrogen and CO production.

• Large global hydrogen and CO burns are predicted in the dome after recovery.

PNPP Recovery Study: Batteries Lost at 6 hr;

Vary Time When RHR and 500 gpm HPCS are

turned on after diesel generator is available

Attributes of a Safe Stable State

• Low pressure in containment

• Water in suppression pool is cool and plentiful

• Sufficient water in Pedestal and Drywell to cool

debris and terminate core debris/concrete

interactions

• No flammable mixture of hydrogen and oxygen

• Core melt progression has stopped

• Radioactive releases have stopped

28

A Perry Safe Stable State Case: Containment Pressure

29

• Operator actions and events assumed are: diesel power and venting at 18

hr, upper pool dump at 19 hr, RHR, 500 gpm HPCS, igniters on at 20 hr, and

100 gpm SP make-up at 24 hr.

• Drywell pressure rises quickly following TIP tube failure at 10 hr and vessel

failure at 17.1 hr.

• Containment pressure decreases to ambient after venting.

A Perry Safe Stable State Case: Containment Temperatures

30

• Operator actions and events assumed are: diesel power and venting at 18 hr,

upper pool dump at 19 hr, RHR, 500 gpm HPCS, and igniters on at 20 hr, and

100 gpm SP make-up at 24 hr.

• Drywell temperatures are high because of persistent decay heat in core

debris. Spikes are due to TIP tube failure at 10 hr and vessel failure at 17.1 hr.

• SP water and containment dome temperatures are low by 48 hr.

Perry Safe Stable State Determination: Hydrogen Production

31

• Recovery provides sufficient water onto the core debris to terminate

hydrogen production and CCI.

• Earlier recovery significantly reduces hydrogen production from CCI.

• Venting as soon as possible after recovery further reduces hydrogen

production from CCI.

Conclusions and Insights

• Early controlled venting enables RCIC to run longer, and

delay core damage.

• Early venting in Mark III containments can diminish oxygen

concentrations in containment , lowering the likelihood of

hydrogen combustion later.

• Depressurizing RPV after RCIC failure makes in-vessel

injection of fire water possible.

• Time is available after RCIC failure for injection into RPV to

possibly prevent vessel failure.

• MAAP 5.04 predicts earlier vessel failure than MELCOR 2.1

and MAAP 5.03.

• Most likely vessel failure mode is instrument tube ejection

due to closure weld failure weld failure.

32

Conclusions and Insights (cont.)

• Fission product releases to environment don’t start

until venting begins.

• Water addition suppresses volatile fission product

revaporization and releases from RPV.

• Water addition into the pedestal or lower drywell, from either

the failed vessel or directly onto the corium, is very effective

in limiting concrete ablation and combustible gas production.

• Venting is an important mitigation action, even for Mark III

containments.

• For Mark III’s it is important to vent after ac power is restored,

and to wait awhile to turn igniters back on.

33

Backup Slides

34

Debris Bed Arrangement in Lower Plenum.

35

Quenching by Water Ingression to Debris Bed.

36

37

38

39

Molten Pool Mass in Core Region

for Various Injection Times (MAAP 5.03)

Recovery from Injection into RPV at

20 hr: Corium and Water in LP (MAAP 5.03)

40

• MAAP 5.03 predicts that recovery is still possible even if most of the corium is in the

LP and the LP has dried out.

• RCIC is assumed to fail at 9.6 hr, so more than 10 hr is available to begin injection to

prevent vessel failure.

Debris Cooling in Mark I Pedestal Region following

Injection into RPV just after Vessel Failure (MAAP 5.03)

41

42

• Flow rates for Wsat are 1000 – 2000 gpm. Significantly more energy is removed than what is

produced by decay heat. However, steam condensation causes the containment to be de-

inerted and a global burn results, failing the containment.

• A flow rate of 500 gpm easily removes the decay heat. However, a global burn results.

• Flow rates for Wvap are 100 – 200 gpm. Energy from the decay heat is removed, and no

global burns occur. Pressure remains elevated, however.

• 50 gpm is insufficient to remove all the decay heat, The containment fails from overpressure.

PNPP Recovery Study: Batteries Lost at 6 hr,

RHR and HPCS on at 24 hr: HPCS flow rate variations

43

• Even with no igniters, global burns calculated to occur when containment is de-inerted.

and ignition criteria are met, even if igniters are not energized.

• Suppression pool temperatures reduced to about 110 ºF from RHR cooling.

• Sufficient water added to Pedestal and Drywell to cool core debris.

PNPP Recovery Study: Batteries Lost at 6 hr,

RHR and 500 gpm HPCS, No Igniters

44

• Global Hydrogen (and Carbon Monoxide) burns are predicted when Oxygen concentration

in the dome increases while steam condenses. Once de-inerting is achieved, igniters

provide the sparks.

• CO and Nitrogen are not shown. CO behaves like Hydrogen, while Nitrogen is an inertant

like steam.

PNPP Recovery Study: RHR and 500 gpm HPCS

at 24 hr – Global Burn in Upper Dome at 65.7 hr

Upper Dome and Drywell Pressures

at Time of Global Burn

45

• Pressure rise in Drywell lags that in the containment dome (where the burn

originates).

• This leads to an implosive pressure load on the drywell

• Suppression pool bypass is unlikely because the pressure differential between

the Drywell and Wetwell is less than 30 psid and the likelihood of a stuck-open

vacuum breaker is very low.

Perry Safe Stable State Determination: Hydrogen Production

46

• Recovery provides sufficient water onto the core debris to terminate

hydrogen production and CCI.

• Earlier recovery significantly reduces hydrogen production from CCI.

• Venting as soon as possible after recovery further reduces hydrogen

production from CCI.

47

Perry Safe Stable State Determination: Cesium Release Fraction

Fission product releases reduced from no-recovery case results.