The Canary, The Ostrich, and The Black Swan

An Historical Perspective on Our Understanding of BWR Severe Accidents and Their Mitigation
Sherrell R. Greene, srg@energxllc.com, EnergX LLC, Oak Ridge, Tennessee
Presented at the International Meeting on Severe Accident Assessment and Management: Lessons Learned from Fukushima Daiichi, November 12, 2012, San Diego, CA

Some definitions...

Canary a bird prized by miners as an early warning system for the presence of deadly gas Ostrich a bird, believed by many, to stick its head in the sand to avoid menacing circumstances Black Swan the symbol for an event which surprises everyone, but which, when viewed in retrospect, is considered to have been both predictable and inevitable

S. R. Greene, EnergX, LLC - 12 Nov 2012

Presentation Overview

Personal Preface Challenges raised by Fukushima Daiichi accident History of BWR severe accident knowledge evolution Detailed ndings from historic BWR severe accident analyses Mega-Lessons from early work Some hard questions for us all

S. R. Greene, EnergX, LLC - 12 Nov 2012

Preface / Personal Perspective: The appropriate approach to nuclear safety requires...

Awareness of Ones Responsibility To Society

a recognition that if we dont do our job well, many people can pay the price for a long, long time

A sense of Chronic Uneasiness

a questioning attitude

Scientic and Technical Humility

a healthy respect for the limitations of our knowledge

S. R. Greene, EnergX, LLC - 12 Nov 2012

Events at Fukushima Daiichi challenge traditional assumptions

Two simultaneous beyond-design-basis external events will not occur Accident events in one unit of a multi-unit site do not propagate to or signicantly impact another unit on that site The availability of shared external emergency equipment and the ability of plant staff to respond to events in a single unit are not compromised by events at other units on the same site Regardless of cause, the world outside the plant boundary is not so impacted by the event as to compromise its ability to provide assistance to the plant The public risk and consequences of a major event are adequately captured by traditional prompt and latent cancer fatality metrics
5

S. R. Greene, EnergX, LLC - 12 Nov 2012

Few were thinking the unthinkable prior to TMI-2

1957 WASH-740 1967 Reginald Farmer proposes risk-based siting criterion 1973 WASH-1250 1975 WASH-1400 (Reactor Safety Study) 1979 Three Mile Island - 2 (TMI-2) Accident 1980 NRC launches TMI action plan (NUREG-0660)

S. R. Greene, EnergX, LLC - 12 Nov 2012

ORNL was chartered by NRC in 1980 to focus on analysis of BWR severe accidents

Intense activity from 1980 ~ 1995: SASA, BWRSAT, Mk-II & Mk-III CPIP, ...
Focused on risk-dominant accidents from WASH-1400

station blackout (SBO) small break loss of coolant accident (SBLOCA) loss of decay heat removal (LDHR) anticipated transient without scram (ATWS)

Integrated reactor / primary containment / secondary containment (reactor building) accident sequence analysis BWR-4 / Mk-I initial focus, followed by Mk-II and Mk-III Goals were to inform

on-going risk studies development of EOPs and SAMGs experimental programs accident simulation code development regulatory actions
7

Produced over 250 papers, reports, and formal presentations on BWR severe accident phenomenology, accident sequence progression, ssion product behavior, and accident management strategies between 1980 and late 1990s

S. R. Greene, EnergX, LLC - 12 Nov 2012

Much of what we need to know about BWR severe accidents was known by the early 1990s
IPE & IPEEE

Industry Actions
IDCOR Mk-I Drywell Flooding Study CONF-820609 Severe Accident Management Operator Human Factors Study NUREG/CR-3887

S N tat U io RE n G Bla / c SB N LO CR- kou U C 21 t RE A 82 G ,V LD /C 1& N H R2 U R 26 RE 72 G ,V /C 1& R2 29 73

Key Analyses
40 0

BNL Accident Mitigation Studies, NUREG/CR-5474 SBO Mk-I Rx Bldg. Response Studies CONF-8610135-41 ORNL/M-1015 CONF-8710111-6 CONF-8810155-12 CONF-880615-1 ORNL/M-1019 NE&D, 120 (1990) NE&D 121 (1990) CONF-91107-1 BWR Rx Vessel Failure Mode Studies In-vessel Accident Mitigation Studies CONF-911-79-2, NUREG/CR-5869 NUREG-1150 Mk-II & Mk-III SBO Primary Containment & Rx Bldg. Response Studies NUREG/CR-5565, NUREG/CR-5571 SOARCA Study NUREG1935

R W SS A SH

-1

Sandia Siting Study NUREG/CR-2239

M Po o di lic c y at St io at ns em to en S 91 t, af 1 SE et CY y G -0 oa 000 l 77

NRC Actions

T N MI U -2 R N EG Act Pr RC -066 ion N e p Gu 0 P la U a id RE ra e n G tio lin -1 n es 97 fo 7 r EO Pr P Ge ior N ne iti U r za RE ic t io S G- Sa n Po eve 093 fet of 50 lic re 3 y Is FR y A s 32 Sta ccid ues Sa 138 tem en en t P fe t 51 olic ty FR y Go St a 30 a l 02 te I 8 me G PE L G nt 88 en IP -20 eri c N E Le U S RE ub tt er G mi -1 tt 33 al IP 5 G G Eui L da 88 >I nc -2 P E e 0, E Su E Ge pp le ne m ri en c t 4 Le tt er PR Po A lic Go y a St l at em en t

Severe Accident Issues Closure Plan SECY-88-147

EP M RI gn S Ba t sis . G eve Re uid re A po an cc rt ce id , T Te en R- ch t 10 . 18 69 BW Re R v. O 0 G EP /S A G BW Re R v. O 1 G EP /S A G

BNL BWR LTSBO Analysis, NUREG/CR-5850

NRC NTTF Report

TMI-2

Chernobyl

1975

1980

1985

1990
8

1995

2000

2005

2010

S. R. Greene, EnergX, LLC - 12 Nov 2012

Fu D kus ai h ic im hi a

1981 BWR station blackout (SBO) severe accident analysis revealed fundamental insights

Station battery life determines sequence timing Short time to core damage following loss of DC power

accident

Instrumentation limitations would greatly hinder operators ability to diagnose and manage accident Operators role in managing / mitigation event is crucial Manual depressurization identied as key accident management strategy Automatic HPCI/RCIC suction shift detrimental Drywell failure into reactor building via electrical penetrations was most likely primary containment failure mode
9

S. R. Greene, EnergX, LLC - 12 Nov 2012

BWR small break loss of coolant (SBLOCA) severe accident was analyzed in 1982

Chorus of control room indicators and alarms hampers operators ability to rapidly diagnose accident Much of the safety-related equipment required for accident diagnosis and management might be compromised by break ow Operators role in managing / mitigation event is crucial Rapid depressurization was most important emergency action

EOPs prevented depressurization for breaks < ~ 0.35 m3/s (5600 gpm)

HPCI/RCIC operation threatened unless operator took actions beyond existing EOPs

variety of low pressure injection systems could over-ll reactor vessel

Late-phase repressurization of reactor vessel possible Containment ooding could prevent reactor vessel failure
10

S. R. Greene, EnergX, LLC - 12 Nov 2012

BWR Loss-of-Decay Heat Removal (LDHR) severe accident was analyzed in 1983

Control rod drive hydraulic system (CRDHS) is critical response system Maintenance of well-mixed pressure suppression pool buys signicant time

several options, but EOPs were not in place

Primary containment pressurization rate is sequence dependent HPCI & RCIC systems are at risk Operators role in managing / mitigation event is crucial Drywell coolers major benet if available Primary containment venting identied as key mitigation procedure

early venting required to avoid exceeding installed vent system design pressure
11

S. R. Greene, EnergX, LLC - 12 Nov 2012

The potential role of BWR reactor buildings in severe accidents was investigated in 1984-1990

Reactor building (RB) designs are highly plant specic RBs might retain 90% of radioactive aerosols in some sequences Primary containment failure mode & location has major impact on RB accident mitigation effectiveness Three RB systems can have major impact on its accident mitigation effectiveness

Fire suppression sprays Standby Gas Treatment System (SGTS) Reactor Building Standby Ventilation System (RBSVS)

Hydrogen deagrations/detonations can greatly compromise RB effectiveness

peak RB hydrogen detonation pressures ~ 221 kPa / 32 psia (4 X design pressure) reduce probability of RB bypass (e.g. drywell head seal failure) ensure reactor building integrity (e.g. avoid hydrogen detonations) improve reactor building ssion product retention
12

Key approaches to maximizing RB accident mitigation effectiveness are

S. R. Greene, EnergX, LLC - 12 Nov 2012

BWR Mk-I severe accident mitigation options were studied from 1982 through early 1990s

Drywell ooding to cool reactor pressure vessel (RPV) and primary containment liner

tension between priority of injecting water into the RPV if core / debris is coolable vs. time required to ood containment

Depressurizing the reactor pressure vessel

and ensuring it stays depressurzied

Restoring (low pressure) injection into RPV

and ensuring low-pressure injection is controlled and maintained

Boron injection to off-set melting and relocation of control blades

13

S. R. Greene, EnergX, LLC - 12 Nov 2012

Mk-II primary containment response to station blackout severe accidents was studied in 1988-1995

Short-term & long-term station blackout sequences Assessment impact of hardware improvements Key ndings

Six U.S. Mk-II containment designs differ in signicant ways Automatic Depressurization System (ADS) actuation timing impacts accident sequence timing (Rev. 4 vs. Rev 3 EPG comparison) Drywell ooding effectiveness is questionable
downcomer design & location constrains ooding options shutoff head of pumps available for drywell ooding is exceeded @ ~ 12

hours into STSBO

Drywell oor melt-through / containment failure at 8 - 10 hrs in STSBO and ~ 21 hours in LTSBO
14

S. R. Greene, EnergX, LLC - 12 Nov 2012

Mk-III primary containment response to station blackout severe accidents was studied in 1988-1995

Six different short-term station blackout sequences

operator actions: none, hydrogen igniters, vacuum breakers,

and containment venting

Unlike Mk-I & Mk-II, Mk-III containments arent inerted Key ndings Automatic Depressurization System (ADS) actuation timing impacts accident progression
Containments would probably not fail on over-pressure Wetwell hydrogen concentrations reach detonable limits in as little as 2 hours

in absence of operator actions Wetwell venting can inert the wetwell (due to oxygen depletion) for a few hours rendering drywell igniters ineffective
Ex-vessel debris interactions drive drywell temperatures to auto-deagration Containment venting with existing lines does not signicantly reduce the

probability of drywell & wetwell hydrogen detonations Provision of assured power to ignitors should be examined
S. R. Greene, EnergX, LLC - 12 Nov 2012 15

Legacy of 1980-1995 studies are Mega-Lessons

Realistic simulation of BWR severe accidents requires BWR-specic models Plant-specic design differences matter Existing plant instrumentation & control room indicators are often inadequate for severe accident management Purely symptom-based severe accident management approaches may not be optimal or even sufcient Timely reactor depressurization is often the most important action Potential role and value of reactor buildings in severe accident mitigation is often overlooked Skilled and informed operators are the key to accident management Major plant modications for severe accident mitigation dont pass the traditional Backt Rule cost/benet analysis
16

S. R. Greene, EnergX, LLC - 12 Nov 2012

Wheres our head today?

The basic facts about BWR severe accident behavior have been known since the 1980s Event progression at Fukushima Daiichi was consistent with scenarios analyzed 30 years ago Consequences of Fukushima-like accidents are unacceptable

public safety & trauma investment loss societal economic impacts

Current U.S. public risk goals do not shield us from Fukushimalike accidents
17

S. R. Greene, EnergX, LLC - 12 Nov 2012

The Fukushima Dai ichi accident raises fundamental questions

Will the Nuclear Industry and Regulators fall victim to crisis learning trap of focusing on the ills that brought on the crisis rather than the thinking that brought on the presenting ills? Will the Nuclear Industry and Regulators be preoccupied with and paralyzed by the fear of unintended consequences? Will the Nuclear Industry and Regulators go beyond the expedient to do what is in its own self-interest and the long-term interest of society? How can Industry respond to Fukushima without diluting operating focus & over-taxing human resources?
18

I N D U S T R Y

S. R. Greene, EnergX, LLC - 12 Nov 2012

Moving beyond the expedient should include...

Embracing reality that plant-specic design features are important Development (and backt) of dedicated severe accident instrumentation & indicator packages Re-examination of the adequacy of symptom-oriented severe accident management approach Re-examination and retooling (if/as needed) of the interfaces between onsite (EOPs, SAMGs, EDMGs) and off-site emergency actions Development of more realistic and credible methods of practicing and stress testing all accident mitigation procedures (EOPs, SAMGs, EDMGs, etc.) Development of a true societal risk goal Re-examination of the Backt Rule
19

S. R. Greene, EnergX, LLC - 12 Nov 2012

Thank you...

S. R. Greene, EnergX, LLC - 12 Nov 2012

20