Published on

  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide


  1. 1. 0/JJ< HDGE NATIONAL LABORATORY LIBRARYond 3 4i45b DDSllflfi 4 NUREG/CR-2182 (ORNL/NUREG/TM-455/V1) Station Blackout at Browns Ferry Unit One—Accident Sequence Analysis D. H. Cook S. R. Greene R. M. Harrington S. A. Hodge D. D. Yue OAK RIDGE NATIONAL LABORATORY CENTRAL RESEARCH LIBRARY CIRCULATION SECTION 4500N ROOM 175 LIBRARY LOAN COP DO NOT TRANSFER TO ANOTHER PERSON If you wish someone else to see this report, send in name with report and the library will arrange a loan. Prepared for the U.S. Nuclear Regulatory Commission Office of Nuclear Regulatory Research Under Interagency Agreements DOE 40-551-75 and 40-552-75
  2. 2. Printed in the United States of America. Available from National Technical Information Service U.S. Department of Commerce 5285 Port Royal Road, Springfield, Virginia 22161 Available from GPO Sales Program Division of Technical Information and Document Control U.S. Nuclear Regulatory Commission Washington, D.C. 20555This report was prepared as an account of work sponsored by an agency of theUnitedStates Government. Neitherthe UnitedStatesGovemment norany agencythereof, nor any of their employees, makes any warranty, express or implied, orassumes any legal liability or resoonsibility for the accuracy, completeness, orusefulness of any information, apparatus, product, or process disclosed, orrepresents that its use would not infringe privately owned rights. Reference hereinto any specific commercial product, process, or service by trade name, trademark,manufacturer, or otherwise, does not necessarily constitute or imply itsendorsement, recommendation, or favoring by the United States Government orany agency thereof. The views and opinions of authors expressed herein do notnecessarily state or reflect those of the United States Government or any agencythereof.
  3. 3. NUREG/CR-2182, Vol. I ORNL/NUREG/TM-455/VI Dist. Category RX, IS Contract No. W-7405-eng-26 Engineering Technology Division STATION BLACKOUT AT BROWNS FERRY UNIT ONE ACCIDENT SEQUENCE ANALYSIS D. H. Cook S. R. Greene R. M. Harrington S. A. Hodge D. D. Yue Manuscript Completed — October 6, 1981 Date Published — November 1981Notice: This document contains information of a preliminarynature. It is subject to revision or correction and thereforedoes not represent a final report. Prepared for the U. S. Nuclear Regulatory Commission Office of Nuclear Regulatory Research Under Interagency Agreements DOE 40-551-75 and 40-552-75 NRC FIN No. B0452 Prepared by the OAK RIDGE NATIONAL LABORATORY OAK RIDGE NATIONAL LABORATORY LIBRARY Oak Ridge, Tennessee 37830 operated by UNION CARBIDE CORPORATION for the 3 445b DDEllfifl 4 DEPARTMENT OF ENERGY
  4. 4. XXI CONTENTS PageSUMMARY vABSTRACT 11. INTRODUCTION 12. DESCRIPTION OF STATION BLACKOUT 53. NORMAL RECOVERY 74. COMPUTER MODEL FOR SYSTEM BEHAVIOR PRIOR TO LOSS OF INJECTION CAPABILITY 175. INSTRUMENTATION AVAILABLE DURING STATION BLACKOUT AND NORMAL RECOVERY 306. OPERATOR ACTIONS DURING STATION BLACKOUT AND NORMAL RECOVERY 337. COMPUTER PREDICTION OF THERMAL-HYDRAULIC PARAMETERS FOR NORMAL RECOVERY 36 7.1 Introduction 36 7.2 Conclusions 36 7.2.1 Normal recovery — conclusions 36 7.2.2 Loss of 250 vdc — conclusions 37 7.3 Normal Recovery 37 7.3.1 Normal recovery — assumptions 37 7.3.2 Normal recovery — results 38 7.4 Loss of 250 vdc Batteries 50 7.4.1 Loss of 250 vdc batteries —assumptions 50 7.4.2 Loss of 250 vdc batteries — results 508. FAILURES LEADING TO A SEVERE ACCIDENT 59 8.1 Induced Failure of the HPCI and RCIC Systems 62 8.2 Stuck-Open Relief Valve 65 8.3 Loss of 250-Volt DC Power 68 9. ACCIDENT SEQUENCES RESULTING IN CORE MELTDOWN 71 9.1 Introduction 71 9.2 Accident Phenomenology 71 9.2.1 Accident progression resulting in core melt 71 9.2.2 Containment failure modes 72 9.3 Event Trees 74 9.3.1 Event trees for accident sequences resulting in core melt 74 9.3.2 Core damage event tree 74 9.3.3 Containment event tree 74 9.4 Accident Sequences 78 9.4.1 MARCH computer code 78 9.4.2 Accident progression signatures 78 9.5 Containment Responses 123 9.5.1 Drywell responses 123 9.5.2 Wetwe 11 responses 14910. PLANT STATE RECOGNITION AND OPERATOR MITIGATING ACTION 161 10.1 Introduction 161 10.2 Plant State Recognition 161
  5. 5. XV Page 10.3 Operator Key Action Event Tree 163 10.4 Operator Mitigating Actions 16311. INSTRUMENTATION AVAILABLE FOLLOWING LOSS OF 250 VOLT DC POWER 16512. IMPLICATIONS OF RESULTS 167 12.1 Instrumentation 167 12.2 Operator Preparedness 170 12.3 System Design 17213. REFERENCES 173ACKNOWLEDGEMENT 177APPENDIX A. Computer Code used for Normal Recovery 179APPENDIX B. Modifications to the March Code 197APPENDIX C. March Code Input (TB) 199APPENDIX D. Pressure Suppression Pool Model 205 D.l Introduction 205 D.2 Purpose and Scope 205 D.3 Description of the System 206 D.4 Identification of the Phenomena 207 D.5 Pool Modeling Considerations 211APPENDIX E. A Compendium of Information Concerning the Browns Ferry Unit 1 High-Pressure Cooling Injection System 217 E.l Purpose 217 E.2 System Description 217 E.3 HPCI Pump Suction 219 E.4 System Initiation 220 E.5 Turbine Trips 221 E.6 System Isolation 221 E.7 Technical Specifications 222APPENDIX F. A Compendium of Information Concerning the Unit 1 Reactor Core Isolation Cooling System 223 F.l Purpose 223 F.2 System Description 223 F.3 RCIC Pump Suction 225 F.4 System Initiation 225 F.5 Turbine Trips 226 F.6 System Isolation 227 F.7 Technical Specifications 228APPENDIX G. Effect of TVA-Estimated Seven Hour Battery Life on Normal Recovery Calculations 229
  6. 6. SUMMARY This study describes the predicted response of Unit 1 at the BrownsFerry Nuclear Plant to a hypothetical Station Blackout. This accidentwould be initiated by a loss of offsite power concurrent with a failure ofall eight of the onsite diesel-generators to start and load; the only remaining electrical power at this three-unit plant would be that derivedfrom the station batteries. It is assumed that the Station Blackout occursat a time when each of the Browns Ferry units is operating at 100% powerso that there is no opportunity for use of the batteries for units 2 or 3in support of unit 1. The design basis for the 250 volt DC battery system at Browns Ferryprovides that any two of the three unit batteries can supply the electrical power necessary for shutdown and cooldown of all three units for aperiod of 30 minutes with a design basis accident at any one of the units.It is further provided that the system voltage at the end of the 30 minuteperiod will not be less than 210 volts, and that all DC equipment suppliedby this system must be operable at potentials as low as 200 volts. It is clear that the 250 volt system was not designed for the case ofa prolonged Station Blackout, and the period of time during which the DCequipment powered by this system could remain operational under these conditions can only be estimated. It would certainly be significantly longerthan 30 minutes since all three batteries would be available, the equipment is certified to be operable at 200 volts, and there would be no design basis accident. In response to AEC inquiry in 1971, during the period of plant construction, TVA estimated that the steam-driven High Pressure Coolant Injection (HPCI) and Reactor Core Isolation Cooling (RCIC)systems, which use DC power for turbine control and valve operation, couldremain operational for a period of four to six hours. A period of fourhours has been assumed for this study.* Within 30 seconds following the inception of a Station Blackout, thereactor would have scrammed and the reactor vessel would be isolated behind the closed main steam isolation valves (MSIVs). The initial phaseof the Station Blackout extends from the time of reactor vessel isolationuntil the time at which the 250 volt DC system fails due to battery exhaustion. During this period, the operator would maintain reactor vesselwater level in the normal operating range by intermittent operation of theRCIC system, with the HPCI system available as a backup. Each of thesewater-injection systems is normally aligned to pump water from the condensate storage tank into the reactor vessel via a feedwater line. *It should be noted that the events subsequent to failure of the 250volt DC system are relatively insensitive to the time at which this failure occurs. This is because the only parameter affecting the subsequentevents which is dependent upon the time of failure is the slowly-varyingdecay heat. As part of a requested review of the results of this study, TVA performed a battery capacity calculation which shows that the unit batteriescan be expected to last as long as seven hours under blackout conditions.In Appendix G, the effect of a battery lifetime of seven vice four hoursupon study results is shown to be limited to timing.
  7. 7. vx The operator would also take action during the initial phase to control reactor vessel pressure by means of remote-manual operation of theprimary relief valves; sufficient stored control air would remain available to permit the desired remote-manual valve operations for well overfour hours. The Control Room instrumentation necessary to monitor reactorvessel level and pressure and for operation of the RCIC and HPCI systemswould also remain available during this period. There is no Emergency Operating Instruction for a Station Blackout atBrowns Ferry. However, the existing written procedure for operator actionfollowing reactor isolation behind closed MSIVs provides for the reactorvessel level control and pressure control described above. The primaryrelief valves would actuate automatically to prevent vessel over pressuri-zation if the operator did not act; the purpose of pressure control byremote-manual operation is to reduce the total number of valve actuationsby means of an increased pressure reduction per valve operation and topermit the steam entering the pressure suppression pool to be passed bydifferent relief valves in succession. This provides a more even spacialdistribution of the transferred energy around the circumference of thepressure suppression pool. The initial phase of a Station Blackout has been analyzed in thisstudy by use of a relatively simple computer code developed specificallyfor this purpose. This coding uses the Continuous Systems Modeling Program (CSMP) language of the IBM computer system to simulate the responseof Browns Ferry Unit 1 to postulated operator actions. The analysisshows, because of the loss of the drywell coolers, that it is necessaryfor the operator to begin to reduce the reactor vessel pressure to about0.791 MPa (100 psig) within one hour of the inception of the StationBlackout. This depressurization reduces the temperature of the saturatedfluid within the reactor vessel and thereby decreases the driving potential for heat transfer into the drywell, yet keeps the vessel pressurehigh enough for continued operation of the RCIC system steam turbine.With this action, the drywell average ambient temperature can be kept below 149°C (300°F) throughout the initial phase of a Station Blackout;tests have shown that both the drywell structure and the equipment locatedtherein can be expected to survive temperatures of this magnitude. The analysis also reveals an important second reason for operator action to depressurize the reactor vesel early in the initial phase of aStation Blackout. This depressurization removes a great deal of steam andthe associated stored energy from the reactor vessel at a time when theRCIC system is available to inject replacement water from the condensatestorage tank and thereby maintain the reactor vessel level. Subsequently,when water injection capability is lost for any reason, remote-manual relief valve operation would be terminated and there would be no furtherwater loss from the reactor vessel until the pressure has been restored tothe setpoint [7.72 MPa (1105 psig)] for automatic relief valve actuation.Because of the large amount of water to be reheated and the reduced levelof decay heat, this repressurization would require a significant period oftime. In addition, the subsequent boiloff* would begin from a very high *The term "boiloff" is used to signify a monotonic decrease in reactor vessel water level due to intermittent loss of fluid through theprimary relief valves without replacement.
  8. 8. vxxvessel level because of the increase in the specific volume of the wateras it is heated and repressurized. Thus, an early depressurization willprovide a significant period of valuable additional time for preparativeand possible corrective action before core uncovery after injection capability is lost. One design feature of the HPCI system logic was brought into questionby the analysis. The existing logic provides for the suction of the HPCIsystem pump to be automatically shifted from the condensate storage tankto the pressure suppression pool upon high sensed suppression pool level.During a Station Blackout, this would occur after about three hours whenthe average suppression pool temperature has reached about 71°C (160°F).*Since the lubricating oil for the HPCI turbine Is cooled by the water being pumped, this would threaten the viability of the HPCI system. The rationale for the automatic shift in HPCI pump suction on highsensed pool level is not explained in the literature available to thisstudy. There is no corresponding provision for a shift of the RCIC pumpsuction on high pool level, and a separate logic is provided for an automatic shift of the HPCI pump suction should the supply of water from thecondensate storage tank become exhausted. For these reasons, it is recommended that the desirabilty of the automatic shift of HPCI pump suction onhigh sensed suppression pool level be reexamined. The plant response during the initial phase of a Station Blackout canbe summarized as an open cycle. Water would be pumped from the condensatestorage tank into the reactor vessel by the RCIC system as necessary tomaintain level in the normal operating range. The injected water would beheated by the reactor decay heat and subsequently passed to the pressuresuppression pool as steam when the operator remote-manually opens the relief valves as necessary to maintain the desired reactor vessel pressure.Stable reactor vessel level and pressure control is maintained during thisperiod, but the condensate storage tank is being depleted and both thelevel and temperature of the pressure suppression pool are increasing.However, without question, the limiting factor for continued removal ofdecay heat and the prevention of core uncovery is the available of DCpower. The sequence of events used for the fission product release analysisfor a prolonged Station Blackout was established by this study under theassumption that no independent secondary equipment failures would occur.Dependent secondary failures, i.e., those caused by the conditions of aStation Blackout, were included in the development of the sequence, butwith the assumption that the operator does take action to depressurize thereactor vessel and thereby prevent drywell temperatures of the magnitudethat could severely damage the equipment therein. The point is importantbecause the operator would probably be reluctant to depressurize; currenttraining stresses concern for high suppression pool temperatures (based onLOCA considerationst) and the operator would recognize that suppressionpool cooling is not available during a Station Blackout. *It is expected that any accident sequence resulting in high suppression pool level would also produce an associated high pool temperature. tThere is currently no written procedure for the case of StationBlackout.
  9. 9. viii This study has established that the possible dependent secondaryfailure of a stuck-open relief valve would not reduce the reactor vesselpressure below that necessary for operation of the RCIC steam turbine during the period in which DC power would remain available. However, duringthis period all of the energy transferred to the pressure suppression poolwould pass through the tailpipe of this one relief valve and would be concentrated near its terminus. This would reduce the steam-quenching capacity of the pool to that provided by the effective volume of water surrounding this one tailpipe. Local boiling in this area would pass most ofthe relief valve discharge directly to the pool surface and could resultin early containment failure by overpressurization. The question of suppression pool effectiveness in quenching reliefvalve steam discharge in cases which involve highly localized energytransfer from the reactor vessel is important to a complete analysis ofany severe accident in which the pressure suppression pool is used as aheat sink. This question has not been resolved, at least in the non-proprietary literature, and has been recently adopted as a dissertation topicfor a University of Tennessee doctorial candidate working with the SevereAccident Sequence Analysis (SASA) project. Pending the results of thiswork, pool-averaged temperatures are used in this study. The MARCH code has been used in support of the analysis of the secondphase of a Station Blackout, i.e., the period after the 250 volt DC systemfails because of battery exhaustion. The existing versions of MARCH aretoo crude to permit modeling plant response to a series of postulated operator actions such as those previously discussed for the initial phase ofa Station Blackout. Therefore, in the event sequence modeled by the MARCHcode, the reactor vessel remains pressurized with pressure control byautomatic relief valve actuation and level control by automatic operationof the HPCI system. As before, averaged suppression pool temperatures areused, and it is assumed that injection capability is lost after fourhours, when the unit battery is exhausted. In the MARCH event sequence, the reactor vessel water level is in thenormal operating range and the vessel is pressurized at the four-hourpoint when boiloff begins due to loss of injection capability.* The MARCHresults predict core uncovery 62 minutes after the beginning of boiloff,followed by the inception of core melting 53 minutes later. The modelprovides that the melted core slumps down to the bottom of the reactorvessel and this results in a predicted failure of the reactor vessel bottom head at approximately three hours after injection capability is lost.The subsequent breaching of the primary containment because of failure ofthe electrical penetration modules by overtemperature is predicted atabout four and one-half hours after the inception of boiloff. The detailed *These conditions at the beginning of boiloff are similar to thosepredicted by the previously discussed sequence which models the plant response to operator actions during the initial phase because in that sequence, the reactor vessel would have to repressurize before boiloff couldbegin. The difference is in the timing. If injection capability werelost at the four-hour point, the boiloff would begin immediately if thevessel is pressurized, but would be delayed if the vessel were depressur-ized.
  10. 10. ixthermo-hydraulic parameters needed for the analysis of fission product release from the fuel rods and the subsequent transport of fission productsto the environment were taken from the MARCH results for this sequence. An estimate of the magnitude and timing of the release of the noblegas, cesium, and iodine-based fission products to the environment is provided in Volume 2 of this study. Under the conditions of a Station Blackout, fuel rod cladding failure would occur while the reactor vessel waspressurized. The distribution of both solid and gaseous fission productswithin the Browns Ferry Unit 1 core at the present time has been obtainedthrough use of the 0RIGEN2 code; the results show that internal gas pressure under Station Blackout conditions could not increase to the magnitude necessary to cause cladding failure by rod burst. Accordingly, thecladding has been assumed to fail at a temperature of 1300°C.
  11. 11. STATION BLACKOUT AT BROWNS FERRY UNIT ONE - ACCIDENT SEQUENCE ANALYSIS D. H. Cook S. R. Greene R. M. Harrington S. A. Hodge D. D. Yue ABSTRACT This study describes the predicted response of Unit 1 at the Browns Ferry Nuclear Plant to Station Blackout, defined as a loss of offsite power combined with failure of all onsite emergency diesel-generators to start and load. Every effort has been made to employ the most realistic assumptions during the process of defining the sequence of events for this hypo thetical accident. DC power is assumed to remain available from the unit batteries during the initial phase and the oper ator actions and corresponding events during this period are described using results provided by an analysis code developed specifically for this purpose. The Station Blackout is as sumed to persist beyond the point of battery exhaustion and the events during this second phase of the accident in which DC power would be unavailable were determined through use of the MARCH code. Without DC power, cooling water could no longer be injected into the reactor vessel and the events of the second phase include core meltdown and subsequent contain ment failure. An estimate of the magnitude and timing of the concomitant release of the noble gas, cesium, and iodine-based fission products to the environment is provided in Volume 2 of this report. 1. INTRODUCTION The Tennessee Valley Authority (TVA) operates three nearly identicalreactor units at the Browns Ferry Nuclear Plant located on the TennesseeRiver approximately midway between Athens and Decatur, Alabama. The General Electric Company and the Tennessee Valley Authority jointly participated in the design; TVA performed the construction of each unit. Unit 1began commercial operation in August 1974, Unit 2 in March 1975, and Unit3 in March 1977. Each unit comprises a boiling water reactor steam supply system furnished by the General Electric Company. Each reactor is designed for apower output of 3440 MWt, for a corresponding generated 1152 MWe; themaximum power authorized by the operating license is 3293 MWt, or 1067net MWe. The primary containments are of the Mark I pressure suppression pool type; the drywells are light bulb shape and both torus and dry-well are of steel vessel construction. The three units share a reactor
  12. 12. building-secondary containment of the controlled leakage, elevated releasetype. Safety systems for each unit include a Reactor Protection System, aStandby Liquid Control System for Poison injection, and the Emergency CoreCooling Systems: High-Pressure Coolant Injection (HPCI), Automatic Depressurization (ADS), Residual Heat Removal (RHR), and Core Spray (CS).The Reactor Core Isolation Cooling (RCIC) system is also provided for theremoval of post-shutdown reactor decay heat as a consequence limiting system. Several components and systems are shared by the three Browns Ferryunits. A complete description of these shared features is given in theFinal Safety Analysis Report;! the shared Safeguards systems and theirsupporting auxiliary equipment are listed in Table 1.1. With the assumptionthat the interfaces with the other two units do not interfere with the operation of any shared system as applied to the needs of the unit understudy, the existence of the shared systems does not significantly complicate the analysis of an accident sequence at any one unit. The results of a study of the consequences at Unit 1 of a StationBlackout (loss of all AC power) at the Browns Ferry Nuclear Plant are presented in this report. Section 2 provides a description of the event anddiscussion of the motivation for consideration of this event. The normalrecovery from a Station Blackout is described in Sect. 3, the computermodel used for the normal recovery analysis is discussed in Sect. 4, andthe instrumentation available to the operator is described in Sect. 5.The actions which the operator should take to prolong the period of decayheat removal are discussed in Sect. 6, and computer predictions of the behavior of the thermal-hydraulics parameters during the period when a normal recovery is possible are displayed in Sect. 7. A Severe Accident by definition proceeds through core uncovery, coremeltdown, and the release of fission products to the surrounding atmosphere. The equipment failures which have the potential to extend a Station Blackout into a Severe Accident are discussed in Sect. 8, and theSevere Accident sequences which would follow during a prolonged StationBlackout are presented in Sect. 9. The consequences of each of these sequences after the core is uncovered differ only in the timing of events;the actions which might be taken by the operator to mitigate the consequences of the Severe Accident are discussed in Sect. 10. The instrumentation available following the loss of injection capability during the period in which severe core damage occurs is described in Sect. 11. The conclusions of this Station Blackout analysis and the implications of the results are discussed in Sect. 12. This includes consideration of the available instrumentation, the level of operator training, theexisting emergency procedures, and the overall system design. Appendix A contains a listing of the computer program developed tomodel operator actions and the associated system response during the period when normal recovery is possible. The MARCH code was used for analyses of the severe accident sequences; the modifications made to this codeare described in Appendix B and an input listing is provided in AppendixC. The pressure suppression pool is the key to the safe removal of decayheat from an isolated Boiling Water Reactor, but no satisfactory method
  13. 13. Table 1.1 Shared safeguards systems and their auxiliary support systems System Quantity Function Standby AC Power Supply System Four diesel generators each cou Supply emergency power during loss of pled as an alternate source of offsite power conditions power to four Independent shutdown boards for Units 1 and 2. Four additional dtesel generators serve as alternate power sources to four Unit 3 shutdown boards. 250V DC Power Supply System Three batteries, one per unit. Supply DC power when battery chargers The 250V DC power supplies for the are not functioning DC-powered redundant services of each unit are normally derived from separate batteries. A fourth battery is provided for common station service. Control Rod Drive Hydraulic A spare control rod drive hydrau Provide driving force for normal rod System lic pump Is shared between Units 1 movement and 2. Reactor Building Closed Cooling Two pumps and two heat exchangers Provide cooling water to reactor Water System per unit with one common spare auxiliary equipment pump and heat exchanger for all three units Gaseous Radwaste System System is unitized except for a Obtain elevated discharge from the common discharge plenum, ducting, Standby Gas Treatment System and the 600-ft stackStation Drainage System One common drain header Into which Pass reactor building drainage to re each of the three unit reactor ceiver tanks building floor drainage pumps dis chargeStandby Coolant Supply System Completely shared system Provide means for core cooling fol lowing a complete failure of the Re sidual Heat Removal (RHR) cooling complexRHR Service Water System Completely shared system Provide an assured heat sink for long-term removal of decay heat when the main condensers are not available for any reasonEmergency Equipment Cooling Completely shared system Water System Distribute raw cooling water to equip ment and auxiliary systems which are required for shutdown of all three unitsStandby Gas Treatment System Completely shared system used only Filter and exhaust the air from a when an abnormal activity release unit zone and the refueling zone, the occurs refueling zone only, or the entire secondary containmentfor the analysis of the response of the torus and pool under severe accident conditions currently exists, at least in the non-proprietary literature. The nature of the problem and the measures being taken at ORNL toimprove the analysis capability are discussed in Appendix D. In the event of a Station Blackout, the reactor vessel will be isolated behind the closed Main Steam Isolation Valves (MSIVs) with pressuremaintained by periodic blowdowns through the relief valves to the pressuresuppression pool. Makeup water to maintain the reactor vessel level mustbe injected either by the High Pressure Coolant Injection (HPCI) or theReactor Core Isolation Cooling (RCIC) systems. The operation of these important systems is discussed in Appendices E and F.
  14. 14. As a portion of their review of the draft of this report, the Electrical Engineering Branch at TVA performed a battery capacity calculationwhich shows that the unit batteries at the Browns Ferry plant can be expected to provide power for as long as seven hours under station blackoutconditions. Since a battery life of four hours was assumed for the calculations of this work, a new Appendix G has been added in which all of thepossible failure modes other than battery exhaustion that were consideredin Sections 3, 7, and 8 are re-examined for applicability to the periodbetween four and seven hours after the inception of a Station Blackout. The magnitude and timing of the release of the fission product noblegases and various forms of iodine to the atmosphere are discussed inVolume 2. This includes the development of release rate coefficients forthe escape of these fission products from fuel as a function of temperature, specification of the various chemical forms, determination of theoptimum strategy for the modeling of precursor/daughter exchange, and thestudy of the particular auxiliary systems involved to determine the applicable fission product release pathways. These results are incorporatedinto a vehicle for the calculation of the transport of the individual fission products from the reactor core, through the primary and secondarycontainments to the atmosphere, control volume by control volume. The primary sources of information used in the preparation of thisreport were the Browns Ferry Nuclear Plant (BFNP) Final Safety AnalysisReport (FSAR), the Nuclear Regulatory Commission BWR Systems Manual, theBFNP Hot License Training Program Operator Training Manuals, the BFNP Unit1 Technical Specifications, the BFNP Emergency Operating Instructions, andvarious other specific drawings, documents, and manuals obtained from theTennessee Valley Authority*. Additional information was gathered by meansof one visit to the BFNP and several visits to the TVA Power OperationsTraining Center at Soddy-Daisy, Tennessee. The excellent cooperation andassistance of Tennessee Valley Authority personnel in the gathering of information necessary to this study are gratefully acknowledged. *The setpoints for automatic action used in this study are thesafety limits as given in the FSAR. In many cases these differ slightlyfrom the actual setpoints used for instrument adjustment at the BFNP because the instrument adjustment setpoints are established so as to providemargin for known instrument error.
  15. 15. 2. DESCRIPTION OF STATION BLACKOUT A Station Blackout is defined as the complete loss of AC electrical power to the essential and nonessential switchgear buses in a nuclear power plant.2 At the Browns Ferry Nuclear Plant, a Station Blackout would be caused by a loss of offsite power concurrent with the tripping of the turbine generators and a subsequent failure of all onsite diesel gen erators to start and load. After these events, the only remaining sources of electrical power would be the battery-supplied 250 volt, 48 volt, and 24 volt DC electrical distribution systems; AC power would be limited to the instrumentation and control circuits derived from the feedwater inverter or the unit-preferred and plant-preferred motor- generator setswhich are driven by the DC systems. The reliability of offsite power at Browns Ferry has been excellent.There are two independent and separated sources of 161 KV offsite power tothe plant, each from a different nearby hydroelectric station. In thenear future, offsite power will become even more reliable. System modifications will permit any of the three reactor units at Browns Ferry, in theevent of a generator trip, to receive reverse power from the TVA 500 KVAgrid which these units normally feed. However, should all offsite power be lost together with the trippingof the turbine generators, there remain eight diesel generators at BrownsFerry which are designed to automatically start and load whenever normalAC power is lost. By design, all equipment required for the safe shutdownand cooldown of the three Browns Ferry units can be powered by six* ofthese diesel units, even with the assumption of a design basis accident onany one unit.3 Therefore, a Station Blackout is an extremely unlikely event. Nevertheless, the consequences of a Station Blackout should be studied. It isimportant to recall that one Browns Ferry unit suffered a loss of electrical power to all of its emergency core-cooling systems during the March22, 1975 electrical cable tray fire.4* To determine if Browns Ferry andsimilar nuclear plants can recover from the loss of other combinations ofAC powered machinery, it will prove most efficient to first consider theplant response to a loss of all AC powered equipment, as in a StationBlackout. This study considers the effect on Unit 1 at Browns Ferry of a Station Blackout which begins with a loss of offsite power, associated turbine generator trip, and failure of all diesels to start. Barring furtherequipment failures, the battery powered systems have the capability tosupply the power necessary to operate the high-pressure water injectionsystems to maintain the reactor in a stable cooled state for severalhours. The first seven sections of this report pertain to the methodswhich can be used to prolong this period of water injection capability anddecay heat removal for as long as possible. *With operator action, any six diesel generators would be satisfactory. However, for adequate short term shutdown and cooldown responsewithout operator action, the six operable diesel generators would have tocomprise three of the four provided for the Unit 1/Unit 2 complex andthree of the four provided for Unit 3.
  16. 16. However, injection capability would ultimately be lost during an extended Station Blackout, either through exhaustion of the installed battery capacity or earlier, through secondary failures of vital equipment.Once injection capability is lost, the Station Blackout would become aSevere Accident with inevitable core uncovery. The remainder of this report proceeds from an assumption that the Blackout does develop into aSevere Accident, involving core meltdown and subsequent fission productrelease to the atmosphere.
  17. 17. o 1 CO X) <M 1 <4H CU rH T3 4-1 1 CU x> CU CO cu CU >, a m 1 X> CU rH •H CU XI 0) C 1 CJ . V4 CU TJ O CO 1 4J 1 CO •rl XI iH 3 O rH Sh >^Xl CU X CU m XI 4-1 CO cfl 1-1 a Cfl CO co cu i-H o CJ 3 X 3 i-H cu 4-1 CO o O * CO •H X) 1 1 4-1 CO XI o 4J CO >» o •H cu 4-1 CO rH CO CO u cu <-i cfl a) 3 O 3 4J CJ B o 4H >. a CO rH •H B Oh CD CU CU rH CD 4-1 ^ - s U •H u •H B cfl CO 3 co rH o XI o CO ^i CO CJ u CJ cu CU CO a. rH CU C CU > cfl 3 o cu cu 4-1 e > rH • s > cfl cj <5) »-i CO s 3 cu a 3 Cfl 4-1 4-1 CJ <u Sh Sh •H CO rH X) o CO O CU cu 4-1 XI > cfl o 5 O tH u CO y M > O a. •H cu •H o E H CO CJ 4-1 cfl Si o cfl CU rH >.4H tH 3 C CU c cfl CJ CO u Sh 4-1 60 c 4-1 •H 4-1 rH X 3 XI >H }-4 o 3 •H CD O U CM XI 4J rH X! I-H B CM X) CO cfl XI cfl CJ (U CU a. 3 CO B •H Sh 4-1 4-) CU cfl o a pi o Sh CU 4-1 SQ a i-H T) iH 4-1 cu O 4-1 PQ 4-1 crt Cfl CO XI 4-1 CU •H rH Sh > CO •H Sh O •H O X CO 4J y o s CU cu •H >-l 3 60 «. 60 B <4-l Cfl cfl •H CU XI Cfl cu B rH 3 B >-. <u CJ B 4-1 •H O CU CO CU ft-O O 4J c XI ^ S 2 XI TJ •H B B CU CJ0 Sh CU 4H cfl XI •r-> Sh Sh <u CO •H CD UH CJ •iH /^ • CD cfl 4-1 60 o s CU •H o MH S-l CO 60 CJ fi Cfl O r< B CO XI Sh a. B O o s 3 CO O cfl rl •H a 60 CO cu . a 4-i cu •H C r-l (X cfl rH 4J XI Cfl -H >< 1 cfl •H <U •H CU O cfl H CU B o s 4-1 a Sh U X) CU >> XI a •rH CO sh TJ •H Cfl •3 X Cfl CU CJ 4-1 X3 cu CU XI 4-1 CJ •H C cu CU CU 4J CD CJ 0, B cfl CU Sh rH A 4-1 •H >> C iH B u cfl u CO •H B >. CO B CU CO Cfl B . 4-1 <4H CU XI X Sh cu . 3 » O cfl U X B cfl h3 B rH vX CO XI o O Sh <3 CU U cu B .g cu 4-1 CO XI •H 4-1 X 4-1 S-l O CO Cfl o 4-1 4J 3 X CO cfl > 3 CU M 60 • O CU CJ 60 <U CO cu LO rH . CU o O O Sh CU a. o 3 s •H O CU X < o CO o B u CU X" 4-1 c M 4J Sh CJ •H CJ 4J CO •H XI CJ > CO rH XI •-N 4-1 CJ s "H O a, o a D. iH rH 4-1 U XI 4-1 O CU CO CO CU 4H >* Cfl X) o XI CO Oh X CO •H rH 4-1 •H o s-^ w 4J . cfl u O o o CO a •H •H Cfl 3 CU CO cu rH •H B 4J cfl 4-1 o X U rH •H CU a CU <4H XI xi CO 4-1 x> o fi rH 3 c <! i-H cu •H 3 X CO •H 4J • 4-1 u 4-1 rH 4-1 CU B CU cfl cu 3 4-1 Sh XI O XI 4-1 B B O CO cO a S X tH O o o c o CO 2 u 4-1 w cr Cfl vH 4-1 CO cfl cu cu •rH 60 •H Sh •rl B XI a P •H Sh XI H B Cfl cO •H CO >~, 4-1 B •H CO -*i •rH o 4J o a •H e cu 3 CXXI Cfl 4-1 •rH M cu rH B T-{ u o CU a, XI 3 O CJ a, fi CJ o CU B 3 XI 3 CU CO cfl f=j •rl rH B o /—N v£> in q CN . •H B CO B 4-1 O 4-> CD CU C CJ CO c rH B rH tH 4-1 . .—1 o> -H 00 cfl cfl CO 4-1 •»» e o XI O CJ •H S 3 CO 60 8 B O cfl 4-1 •H CO 4-1 c 4J CU O CJ o • cfl M cu O B Cfl 3 B . . CO C rH rH a cfl CO cu B 4-1 J4 • 60 cfl CD •H 1 o O CJ CU CU CD o CU Sh CJ o rH X) CU CJ CO •H cu cfl B J«S cfl •H CN CN CO s-^ CO PQ o cu u B 4-1 o a B B CU U O rH CJ •H XI CO CU cfl X XI CU CU CJ CU B fa CO 4-1 XI CD Sh c cu>u CO 4-1 o cu CO B 4-1 cfl o O -H x> a r-t X) CU CD 4-1 Sh c XI X! 4-1 rH > XI cu cfl 4-1 4-> O cfl CD vX CO xi a B04 O c M CO 4-> 4-) kS •H O ^H •H •H 3 CO CJ B CO cfl CO 3 >. CU 3 CU cu o 4J 4J 3 rH (U o cu > Sh CO C 4J Sh r^ •H B "Hw 4-1 o >-. CO CD CO XI PQ 4-1 4-1 O XI cfl CU 3 O CO XI CO XI XI CJ o Cfl X1 B x; M CU s CO <r cfl Xi 00> C •H CU CO CU >s 4J CO a CJ rH rH u /-N •H u a M CJ 4J CO 4-1 4J • •* CU Jrf 4-1 cu 4-1 CO Sh a o 4J CU CU ^-^ 4-1 Sh r^o •H 4-1 u S-i CO M 4J a <u CU i-H 3 o > G XI o CO O CU CU cu Sh CJ CJ CU u S O o rl CO Sh 60 XJ a -n 3 .cj cO o / ^ o •s CJ o CO •r-l O 0 4-1 M 3 4H •H cfl XI o Sh X3 Sh X CU B cfl > XI CU CU 4-1 4H 3 cfl cfl C B •H • 4-1 <r^ Sh 4J u M cu a Pm CU ••H B 4H 3 o CO O CU X) r-{ 4J Cu c cfl 4J •iH rH CO B CU Sh 4-1 a Sh cfl Sh cO o B .—1Ph cu CO CJ XI o 33 X) a. 4J CO •H cfl S X) 4-1 CO PQ A CO CU XI CO PQ XI X CO CO cfl O fi XI CO O •—i Pu •H £? CU 4-1 u P-l 4J •H CU CO cfl •H CO >% CU N-- •H B CO CU CU CU B ^h 3 2 >, CU MH CU X B 4-1 #H . XI oJ<c s S-l o a 3 <u 4-1 N^> CO 4-1 a U O iH i-H cfl 4-1 XI CO 4-1 CM O 4-1 B w u u CU 3 4J CO O •H 1 •H XI o B Sh 3 CO XI cfl 4-1 s cfl 3 O CU C X) (U 4-1 C CO Sh ^ Sh Cfl CD CU CD CU CN a -H H 4-1 CO rH CO o rH X CO 0 4-1 fi ^ o ^Oa TJ o CO CU O u CU CU 4-1 > XI c 4-1 4-1 •H CD CU <U 3 3 o cfl •rl 3 3 •H 4-1 XI CU 4-1 CU CO CU •H •H u-l COOh 60 C Cfl a •>-) CJ u CU CO B CO > fa e i-H CO o •H 4-1 O Sh CU 4-1 C O CU 4-1 O XI B 4-> • B CU 3 c >-> 4-1 rH O 4-1 ^-> • CUo C 3 cu o X> a M 4-1 XI •H CO cu cfl a. r l cfl 32; •H Pi •H CU •H cj B 4-1 <4H o CO i? CU CU X) mo 4-1 > B cfl rH CJ 4-1 CD •H B CU fi rH CU 4-1 o CO •H CD Cfl 4-1 CO CU CD 4-1 CJ B CO 6 cfl CJ 4-1 4-1 X CU O X) cfl a, -h X CO u •H B u •H •H 4J B pd O o o TJ r-i <4H B X XI O CO •H C CD Sh fi B CO 4-1 cfl Sh B rH Sh § cu CJ 4-1 U X c cu CO 4-1 o . o S CU a o •H x; cu <4-l •rl S-l CU CU CJ XI XI CO CU O 3 o t fi 4J CJ Sh CU U > M •H CO 01 4J o •H c rH •H 4-i 4J CU O rH B 3 4-1 CU 4-1 CU •H u-| CJ O o O XI o B CO 4-1 CO •H u •H o XI Cfl C a. CO cfl cfl 4-1 O XJ CO CD a CN rHCO o 4-) 4-1 •r-> CU 4J XI CU B O CO 4-1 CU u o •H r-H <4H CU XI CU CO 4J Sh D. CO CJ CU O CO 3 o CU •M CJ CD PQ C 3 . CU CU CO •H e TJ PQ a 4-) m >~> r-i 3 S 4-1 Xi CO •H CJ V4 3 XI a B 4J Cfl O 3 M XI B XI g CU cfl 60 CO •H X) a ih 01 CJ XI •H 4J CU O X) CD -* XI > o 4-1 •H c CU 4-1 O c CU B c >. 4J B B Sh CO XI CJ CU u CJ rH 4J CU u o X CO CO B rH CU CO Cfl CU rH 3 CU 4-> •H 60 Cfl cfl cu a. •H 4-1 o 2 3 60 Sh 4-1 O •H Sh o 3 CD rH 60 CO CU •H cfl 4-1 4-1 • cu CJ •H rH CU 3 . cfl O . #. S B 3 O 4-1 60 a. 4-1 •iH CU Sh •H Sh CJ CD rH CU 4H CU 4-1 UH B •I-) XI T3 c a a > T3 r-t <T rH CU CO u CD X) CU r-H •H CO 4-1 C U a. o 60X1 CO CU Xi 3 O CU X o X) O XI X3 O -H Sh c o •H •H 13 t-H CU cfl 4-) 3 •r» 60 rH cu CU B rH rH XI CU >S CU rH 4-1 XI CO 3 4-J M o X) Cfl Sh 4J B o 3 CO cu X3 CU a, rH CU 3 CU B CO o B C 4-1 CO C CU CO £2 X 3 4-1 rH 4-> B O 4J CO g CU 4-1 o •H CU cu H c CD cfl a. rH o rH rH 4-1 )-l •H o O O O cu 4-1 >-l r^ XI O e a O <-{ CU •H rH Sh CU o CO cu B rH O > B CU •H • « s O CU 4-1 CU CU O 4J (U > a o O cj CJ ^<i O rH > CJ <u u CU 60 Cfl CU 4-1 X CU 60 J4 Xl 3 CJ B cfl cfl CJ CU CU cu XI H XI c O rH a Sh CO CU O 4J Sh XI CO •rl Sh a. CJ CD CO c o 4-1 > 3 > 3 CD 4h g o •H XJ cu CU XI cfl o . B Q a. — O Sh c cu cfl U >v 4-1 a. CU rH cfl CO r-l cfl 4J B CU rH | W O u cfl cfl T-f 4J M B CO CM r-i 3 rH > X 4-1 CJ a o XI 60 rH O B > •H 4H tH rH rH rH CU •H CO cfl 4-1 cu cr 3 H C 3 4-1 cfl C XI o •H >-, 3 M CU CD s 3 CD CO 4-1 c H" PQ CO M h Xt •H X) XI PQ M CU o • cO >, CO cu O u o •H rH a •H B Sh 4-1 rH Q. co CD U B u •H 60 > CD •H cfl CO 3 cu CU CU 3 •H 4-i e 4-1 CU B XI ro 4J XI rH CO u 3 o 4-1 60 o CO cO c V4 cfl 4-1 CJ B 22 CU CU O CD XI B -H CO iH o •H CO C XI CO 4-1 u-i T3 rH Cfl CO B 3 •H 4-1 u cu CO CU CU 4-1 • CU o 4-1 <u o •H B CU O fi Sh 4-1 •H 4-1 H •H 4-1 CD •H •H CO o 4J 3 o 3 CO o O o CO B cfl XI 4-1 4-1 > cu CD CJ rH u X a c u •H 3 rH O •r-l CD CU O, a) 4-1 cfl 4-1 CJ > 43 <4-l r ^ cu •H CO CJ g ^H o a, 4-1 CO •H as * •H 4-1 CO B cfl Sh cu cfl o CU CU 4-1 cr O CJ B CO > XI a. 3 CJ 3 Cfl Cfl cfl •H u H 4J MH i-H CO 4-1 CD X! CO •H CU •H u CO > cu o 4H XI c > cu Cfl a> U •H U •H 4-1 3 CD . U CU c u CM cfl o cu rH o 4-1 XI B B Cfl <U X) 4-1 4-1 i-l > Xl o <- U a CO rH o <u XI U S-l 4-1 i-H •H U CO UH B rH rH CD CD XI cu 00 01 4-) X CU Sh •H CO 60 O o 4-1 4-1B •H >. X cu <U 4-1 CD cfl c 3 •H 4-1 cu B CU Sh 3 X) UH o B CU CU G.XI 4-1 XI •H fa XI CO CO CO 4-1 PI •H •H -H •H CO •H cfl fi •g rH CO S CJ cfl > cu a CO O CO CU fi CO o > CU cr o CU O CO CO O 4-1 H CO 60 CO •t CO B G B 4-1 4-1 CO 3 rH 4-1 4-1 B cfl XI o u 3 CO XI 60 cu c CJ <u 4-1 CU CU U 60 CJ CO CO 4H CO •H Cfl o TJ cu O >. CJ CJ < MH a CD 3 CD c M cu CO m 4-1 •H 4-1 cu H B 60 0 ^ cfl u fi B 3 C cu CU rH >M iH cfl fi s rH CU > CJ >. 1-1 XI CU cu MH CO cu ^ CM CU cu u CU cu CD u Sh •H •H rH 3 •H cfl CD iH cfl > > CO O 3 0 > M CU CJ CO CO O a CU > CO 3 > •H B CD 4-1 cu a. > 4-1 4-1 CU X X CU CD Ph a H o cu O Sh cu iH u cu )-l > •H •H S-l M CO CU a* cu rH r-i o CU CO 4-1 a. cfl cflcfl > u 4-1 Sh Sh 0) B cfl CU CU G Qh •H O w XI XI O o XI cu o s 4H M XI CO cu Sh cu XI CO CU Sh U CU 3 <U cu S-i cu o o 3 4-1 Sh 3 •H XI XI o o SH m PQ <M > 4-1 fa a •fi -H 3 C o CJ § 4-1 4-1 H •H 4-1 4-1 X CO CO 4-1 > U CM axi CO i-H XI CD rH <4H PQ 4-1 CO a. a. > 4-1 4-1 B 4-> 4-1