ML15198A054

NRR E-mail Capture - (External_Sender) Supplemental Material for Today 2.206 Public Mtg

ML15198A054
Person / Time
Site:	FitzPatrick
Issue date:	06/29/2015
From:	Azulay J Alliance for a Green Economy
To:	Alexander Chereskin Plant Licensing Branch 1
References
Download: ML15198A054 (62)

Text

1 NRR-PMDAPEm Resource From:

Paul Gunter [paul@beyondnuclear.org]

Sent:

Monday, June 29, 2015 10:44 AM To:

Chereskin, Alexander Cc:

Azulay/Jessica; Tim Judson

Subject:

[External_Sender] Supplemental material for today 2.206 public mtg Attachments:

fitz_2206_2nd-prb-mtg_FINAL_06292015_pg-statement.doc; hydrogen-generation-safety-report.pdf Follow Up Flag:

Follow up Flag Status:

Flagged Hi Alex, Please find attached my statement for today meeting with the PRB and the referenced supplemental document.

I can shorten my oral statement to fit the time each of us is allotted See you soon.

Paul Paul Gunter, Director Reactor Oversight Project Beyond Nuclear 6930 Carroll Avenue Suite 400 Takoma Park, MD 20912 Tel. 301 270 2209 www.beyondnuclear.org

Hearing Identifier:

NRR_PMDA Email Number:

2238 Mail Envelope Properties (CALTCGd=seEOavsAi+4FAhxu8Azn_gaLuiEL4da45Ga7okM=1=A)

Subject:

[External_Sender] Supplemental material for today 2.206 public mtg Sent Date:

6/29/2015 10:43:51 AM Received Date:

6/29/2015 10:43:50 AM From:

Paul Gunter Created By:

paul@beyondnuclear.org Recipients:

"Azulay/Jessica" <jessica@allianceforagreeneconomy.org>

Tracking Status: None "Tim Judson" <timj@nirs.org>

Tracking Status: None "Chereskin, Alexander" <Alexander.Chereskin@nrc.gov>

Tracking Status: None Post Office:

mail.gmail.com Files Size Date & Time MESSAGE 436 6/29/2015 10:43:50 AM fitz_2206_2nd-prb-mtg_FINAL_06292015_pg-statement.doc 61896 hydrogen-generation-safety-report.pdf 1983833 Options Priority:

Standard Return Notification:

No Reply Requested:

No Sensitivity:

Normal Expiration Date:

Recipients Received:

Follow up

1 Statement of Paul Gunter, Beyond Nuclear Before the U.S. Nuclear Regulatory Commission Emergency Enforcement Petition Review Board Public Meeting As per 10 CFR 2.206 Re: James Fitzpatrick Nuclear Generating Station Docket 050-00333 Monday, June 29, 2015 Good afternoon. My name is Paul Gunter and I represent the Petitioner Beyond Nuclear based in Takoma Park, MD.

Entergys Fitzpatrick nuclear power station in Scriba, New York fits into a historic and disturbing recurring pattern of the nuclear industrys failure to comply with design performance criteria for the GE Mark I boiling water reactor containments licensing basis and the US Nuclear Regulatory Commissions failure as the regulator to require and enforce compliance of the licensing basis.

Fitzpatrick is a GE Mark I boiling water reactor as were the Fukushima Daiichi Units 1 through 5. Units 1, 2 and 3 were at power on March 11, 2011 at the time of the earthquake and tsunami and all experienced severe reactors accidents followed by catastrophic containment failure with widespread and persistent radiological contamination.

Fukushima Daiichi Units 1, 3 and 4 experienced hydrogen explosions.

The Petitioners have requested this second meeting to respond to the NRC Petition Review Boards initial recommendations to reject in part and accept in part while holding in abeyance actions requested in our

2 March 9, 2012 emergency enforcement petition as supplemented on March 13 and March 20, 2012.

The Petition Review Board rejects the Petitioners request that the Fitzpatrick operating license be immediately suspended pending a public hearing on the power reactors continued operation with the substandard and severe accident vulnerable GE Mark I pressure suppression containment. The Power Authority of the State of New York refused to make modifications with the installation of a hardened containment vent line as recommended in NRC Generic Letter 86-16 issued September 1, 1989. Now, post-Fukushima, the current operator, Entergy, continues to rely upon the unmodified, pre-existing, partially hardened, partially non-pressure bearing vent path that if used under accident conditions is highly likely to fail to high pressure steam and non-condensable explosive gases in the auxiliary housing at the Standby Gas Treatment System resulting in a radiological release at ground level.

The Petitioners respond that Generic Letter 89-16 explicitly acknowledges that the continued reliance on such pre-existing capability including non-pressure bearing vent path or duct work jeopardizes the access to vital plant areas and equipment and represents an unnecessary complication that threatens accident management strategies. The Petitioners have asserted that this same unnecessary complication represents an undue public health and safety risk.

3 The PRB rejected the Petitioners request for immediate enforcement action stating that there is no imminent threat to the public health and safety because a sequence of events like the Fukushima accident is unlikely to occur in the United States and continued operation and licensing activities do not pose an immediate threat to public health and safety.

The fact is that there have now been five severe nuclear accidents in the past 36 years demonstrating by observation that the likelihood of severe nuclear accidents in reality is greater than the NRC theoretical and industry promotional models produced since the 1970s. All of the severe accident sequences were unique to one another and unanticipated. This reality places an emphasis on the importance of regulatory enforcement to maintain NRCs purported defense-in-depth philosophy at every level including containment performance criteria for the all-important final barrier protecting the public health and safety from radiological disaster. Chapter 10 of the Code of Federal Regulation Part 50 Appendix A General Design Criterion 16 establishes the minimum requirement for containment design performance as an essentially leak tight containment structure against the uncontrolled release of radioactivity to the environment and to assure that the containment design conditions important to safety are not exceeded for as long as postulated accident conditions require.

The fact that the NRC issued Generic Letter 89-16 to the operator of Fitzpatrick nuclear power station and industry on a voluntary compliance basis deferred its enforcement obligation to maintain

4 licensing agreements for the containment performance criteria. It further deferred its commitment to maintain defense in depth at Fitzpatrick when the operator opted out of installing hardened containment vent, instead relying upon a pre-installed only partially hardened containment vent system. Given that Generic Letter 89-16 was implemented under 10 CFR 50.59, Fitzpatricks as-installed partial containment vent hardware was not inspected by NRC walk down, only a review of its design.

The Petitioners further assert that the fact that the installation of a hardened containment vent as described in Generic Letter 89-16 was installed in the Fukushima Daiichi units and failed to avert catastrophic containment failure does not justify Fitzpatrick operators decision to not install the hardened containment vent from the primary containment to a release point on the elevated emissions stack. Rather, both the multiple hardened vent failures to successfully vent explosive gases at four Fukushima Mark I units and the Fitzpatrick operators continued reliance on the pre-existing containment vent amplify the Petitioners concern with the current licensing basis vulnerability. We therefore reassert our request that the Fitzpatrick operating license be immediately suspended.

The Petitioners acknowledge that the NRC issued Enforcement Action 2012-050 Order to Modify Licenses with Hardened Containment Vents and established the mandatory compliance date for an enhanced hardened containment vent on all Mark I and Mark II reactors---including Fitzpatrick---to be no later than December 31, 2016. On June 6, 2013, the NRC issued Enforcement Action 2013-109

5 ISSUANCE OF ORDER TO MODIFY LICENSES WITH REGARD TO RELIABLE HARDENED CONTAINMENT VENTS CAPABLE OF OPERATION UNDER SEVERE ACCIDENT CONDITIONS super ceding EA 2012-050. EA 2013-109 provides for compliance dates for Phase I for the installation of a now enhanced reliable hardened containment vent on the wetwell component of the containment no later than June 30, 2018 and for Phase II compliance no later than June 30, 2019 for the installation of an optional unfiltered containment vent on the drywell component of the containment or an alternative mitigation strategy for Severe Accident Water Addition and Severe Accident Water Management that does not install a hardened vent but instead relies upon partial flood up of the drywell component while managing water addition to maintain freeboard in the wetwell so that the Phase I hardened vent remains operable to relieve an accidents high pressure, extreme temperature and non-condensable and combustible gases to the atmosphere. The wetwell vent does not have an external filter and relies upon the original designs scrubbing effect in the wetwell water to prevent radiological releases to the environment. The Petitioners now note the addition of a one and half year delay before full implementation of the Phase 1 wetwell hardened containment vent totaling up as an additional three years that Fitzpatrick will operate with the vulnerable Mark I pressure suppression containment system and the pre-existing partially hardened containment vent. The Petitioners reassert that extending the continued operation of Fitzpatrick with an unreliable containment under accident conditions represents undue risk to public health and safety in the interim and prompts the call for the suspension of the

6 Fitzpatrick operating license.

Given the history of NRC regulation, the extended delay is likely not to be the last. The Petitioners have asked for the suspension of operations with the pre-existing containment vent. The Petition Review Board has rejected a review of the requested action in part stating the staff explicitly recognized the wide variance in the reliability of the hardened vent designs among Mark I plants. The design at Fitzpatrick is one example of that variance. Therefore, the issue should be rejected, pursuant to Criterion 2 for rejecting a petition under 2.206 meaning that the raised issue has already been thoroughly reviewed by the NRC and is resolved such that the solution is application to the raised issue.

The Petitioners note that this same wide variance in the reliability of hardened vent designs includes not only Fitzpatricks half measure of the containment vent that if used under severe accident conditions will likely explode inside the adjacent building to the reactor building, it also includes the demonstrated failed vent designs at Fukushima Daiichi Units 1, 2, 3 and 4. Accordingly, the NRCs Orwellian-like interpretation of variance of reliability includes unreliable performance. The Petitioners reassert that Fitzpatricks operating license be suspended.

The Petition Review Board accepts three of the Petitioners challenges to Fitzpatricks continued operation for review then holds the request for suspension of the operating license in abeyance. Those challenges are:

7 Fitzpatrick operators claim of unlikely ignition points in the pre-existing vent line and release path that would otherwise cause a detonation of hydrogen gas generated by a severe accident; The NRC Inspection Report finding that Fitzpatricks existing plant capabilities and current procedures do not address hydrogen considerations during primary containment venting, and; Fitzpatricks mitigation strategy and current procedures do not address hydrogen considerations during primary containment venting.

In each case, the Petition Review Board references the NRC Near Term Task Forces Recommendation 5.1 to order licensees to include reliable hardened containments vents on all Mark I and Mark II boiling water reactors namely Enforcement Action 2013-109 and Task Force Recommendation 6 for a long term review by NRC to identify insights about hydrogen control and mitigation inside containment or in other buildings as additional information is revealed through further study of the Fukushima Daiichi accident.

The Petitioners have a number of concerns with the Petition Review Boards recommendation to hold the requested enforcement action in abeyance while the Fitzpatrick nuclear power plant continues to operate with a vulnerable containment structure and unaddressed safety issues that involve the large amounts of non-condensable explosive gases that would be generated under severe accident conditions and ignition sources that can result in deflagration and detonation with widespread and long lasting radiological

8 consequences that would affect large sectors of society, economy and the environment.

The matter of arriving at timely resolution to these unaddressed issues ranks high among the Petitioners concerns.

According to NRC presentations, the current challenges to the hydrogen gas problem include very little reliable empirical data on hydrogen is being reported since the Fukushima accident and any verifiable information on the chain of events at Fukushima may not be available for 10+ years.

In support of their petition, the Petitioners submit for the record Natural Resource Defense Councils technical report Preventing Hydrogen Explosions in Severe Nuclear Accidents: Unresolved Safety Issues Involving Hydrogen Generation and Mitigation. (March 2014) with findings that NRC and the nuclear industry are far from resolution by Recommendation 6.

Even after Fukushima Daiichis three devastating hydrogen explosions, the NRC has relegated its investigation of severe accident hydrogen safety issues to the lowest-priority of its post-Fukushima Daiichi accident response. The NRDC report finds that beyond adding reliable hardened containment vents to Fukushima-style reactors, it could take decades before the U.S. nuclear industry implements further hydrogen control measures.

9 A boiling water reactor like Fitzpatrick has several times more mass of zirconium in their reactor cores than larger pressurized water reactors like Indian Point Unit 3. A typical BWR core with 800 fuel assemblies would actually have more than the 76,000 kg of zirconium cited by the IAEA as typically present in a BWR core. It is the interaction of the zirconium fuel cladding with steam at high temperatures during a severe accident that generates the explosive hydrogen gas.

The NRDC technical report further finds that the NRC computer models under-predict hydrogen gas generation rates during severe accidents. Citing technical reports from Oak Ridge National Laboratory and the International Atomic Energy Agency which account for hydrogen gas generation during the evolution of a severe accident and how computer safety models under predict rates of hydrogen generation that would occur during the re-flooding of an overheated reactor core can cause hydrogen gas rates to vary by a large degree. NRDC points out that despite these reports, the NRC Near Term Task Force failed to discuss NRC computer safety models, like MELCOR, under predict such hydrogen gas generation rates thus undermining defense-in-depth with less conservative computer models. When hydrogen generation rates are underpredicted, hydrogen mitigation systems are not likely to be designed so that they could handle the generation rates that would occur in actual severe accidents.

As such, contrary to NRC and industry claims, the reliable hardened containment vent issue is not yet resolved and very likely prove as

10 troublesome to NRC and industry on holding to current implementation schedules and no more reliable than the wide variance of design of its predecessor. The NRDC report calls particular attention to severe accident scenarios where there is a rapid containment pressure increases and uncertainty for the diameter and thickness of a reliable containment vent line and more certainty for the lack of reliability of the as-built containment vent currently relied at Fitzpatrick for the next several years.

The NRDC report further illuminates that the current NRC enforcement action does not require that hydrogen be mitigated in the BWR secondary containment, also known as the reactor building, in severe accidents despite the multiple demonstrations and devastating consequence at Fukushima Daiichi. In line with the NRC defense-in-depth philosophy, hydrogen gas leakage from more than 150 penetrations in the Fitzpatrick Mark I primary containment and/or a hardened containment vent line needs to be considered and mitigated.

Severe nuclear accident hydrogen explosions remain an unresolved safety issue.

The NRDC report points out that during a severe accident, large volumes of water will be pumped into Fitzpatricks reactor core creating thousands of kilograms of steam. This large quantity of steam will initially create an inerting effect that can suppress and prevent hydrogen gas explosions. When the steam eventually condenses at some point in an accident, either naturally or by the use

11 of containment spray systems hydrogen combustion can occur with only a very small amount of energy from an electrical spark or a static electric charge, for example that caused the Hindenburg disaster.

AUTHOR Mark Leyse NRDC Nuclear Program Consultant CONTRIBUTING EDITOR Christopher Paine Senior Nuclear Policy Adviser, NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents:

Unresolved Safety Issues Involving Hydrogen Generation And Mitigation NRDC REPORT MARCH 2014 R:14-02-B

ACKNOWLEDGMENTS NRDC gratefully acknowledges the support of its work on nuclear safety from the Carnegie Corporation of New York, the Beatrice R. and Joseph A. Coleman Foundation, and the Independent Council for Safe Energy, a project of the Tides Center. The author thanks Christopher Paine, Matthew McKinzie, Jordan Weaver, Thomas Cochran, George Peridas, David Lochbaum, Gordon Thompson, and Robert Leyse for their suggestions and for reviewing this report; the author is particularly grateful to Mr. Paine for requesting that he write this report.

ABOUT NRDC The Natural Resources Defense Council (NRDC) is an international nonpro"t environmental organization with more than 1.4 million members and online activists. Since 1970, our lawyers, scientists, and other environmental specialists have worked to protect the worlds natural resources, public health, and the environment. NRDC has of"ces in New York City, Washington, D.C., Los Angeles, San Francisco, Chicago, Bozeman, MT, and Beijing and works with partners in Canada, India, Europe, and Latin America. Visit us at www.nrdc.org and follow us on Twitter @NRDC.

NRDCs policy publications aim to inform and in"uence solutions to the worlds most pressing environmental and public health issues. For additional policy content, visit our online policy portal at www.nrdc.org/policy.

NRDC Director of Communications: Lisa Benenson NRDC Deputy Director of Communications: Lisa Goffredi NRDC Policy Publications Director: Alex Kennaugh Design and Production: www.suerossi.com

© Natural Resources Defense Council 2014

3 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents TABLE OF CONTENTS I.

EXECUTIVE

SUMMARY

......................................................................................................................................................................4 II. Hydrogen Generation in Nuclear Power Plant Accidents.............................................................................................................13 A. Technical

Background:

Design Basis Accidents and the Zirconium-Steam Reaction....................................................................13 B. Severe Accidents and the Heat Produced by the Zirconium-Steam Reaction..............................................................................17 C. Hydrogen Generation in Accidents: Rates and Quantities............................................................................................................17 D. NRC Models Underpredict Severe Accident Hydrogen Generation Rates...................................................................................18 E. An Attempt to Eliminate Hydrogen Risk: Developing Non-Zirconium Fuel Cladding....................................................................19 III. Severe Accident Hydrogen Explosions: An Unresolved Safety Issue..........................................................................................20 A. The Potential Damage of Missiles Propelled by Hydrogen Explosions.........................................................................................20 B. Hydrogen Explosions: De"agrations and Detonations..................................................................................................................21 C. Limitations of Computer Safety Models to Predict Hydrogen Distribution in the Containment and Hydrogen De"agration-to-Detonation Transition.....................................................................................22 IV. Severe Accident Hydrogen Mitigation............................................................................................................................................23 A. Hydrogen-Mitigation Strategies for Different Containment Designs............................................................................................23 Case Study: Hydrogen Risks in Westinghouses Probabilistic Risk Assessment for the AP1000 and Plans for Managing an AP1000 Severe Accident..........................................................................................29 B. Problems with Current Hydrogen-Mitigation Strategies for Respective Reactor Designs............................................................30 C. Monitoring Core Degradation and Hydrogen Generation in Severe Accidents.............................................................................36 V. NRDCs Recommendations for Reducing the Risk of Hydrogen Explosions in Severe Nuclear Accidents..............................40 A. Develop and Experimentally Validate Computer Safety Models that Would be Capable of Conservatively Predicting Rates of Hydrogen Generation in Severe Accidents.......................................................................40 B. Assess the Safety of Existing Hydrogen Recombiners, and Potentially Discontinue the Use of PARs until Technical Improvements are Developed and Certi"ed..............................................................................40 C. Signi"cantly Improve Existing Oxygen and Hydrogen Monitoring Instrumentation......................................................................40 D. Upgrade Current Core Diagnostic Capabilities in Order to Better Signal to Plant Operators the Correct Time to Transition from Emergency Operating Procedures to Severe Accident Management Guidelines................................................................................................................................40 E. Require All Nuclear Power Plants to Control the Total Quantity of Hydrogen that Could be Generated in a Severe Accident....................................................................................................................................41 F. Require that Data from Leak Rate Tests be used to Help Predict the Hydrogen Leak Rates of the Primary Containment of each BWR Mark I And Mark II Licensed by the NRC in Different Severe Accident Scenarios................................................................................................................................41

4 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents I. EXECUTIVE

SUMMARY

A s demonstrated during the March 2011 severe nuclear accident in Fukushima, Japan, accumulation and subsequent detonation of hydrogen gas produced by an overheated nuclear core reacting with steam can breach a reactors containment structures and result in widespread radioactive contamination.1 The gas is initially generated by the rapid oxidation of the zirconium alloy tubes (fuel cladding) that surround the low-enriched uranium fuel pellets in commercial power reactors (Figure 1).

When the fuel cladding enters a certain temperature range well above its typical operating temperature, the zirconium-steam reaction becomes autocatalytic, meaning that it propagates via self-heating from the chemical reaction itself.

This produces large quantities of hydrogen in a brief period.

This intense reaction also causes the fuel cladding to erode and breach, which releases harmful levels of radionuclides into the reactor vessel. The fuel cladding is the "rst line of defense among multiple barriersthe reactor vessel, a steel and/or reinforced concrete containment, and a further, secondary containment in some designs2that are intended to prevent release to the environment of the biologically hazardous radionuclides produced by nuclear "ssion (see Figure 2). In some accident scenarios, over-pressurization of the reactor vessel can be exacerbated by the buildup of hydrogen from the zirconium-steam reaction, causing seals at the multiple penetrations of the vessel required for reactor monitoring and control to leak hydrogen into the containment.

To protect the integrity of the reactors cooling system, pressure relief valves are designed to open automatically, resulting in discharge of radioactively contaminated steam and hydrogen gas into the containment. In older boiling water reactor (BWR) designs, this discharge is initially into the pressure suppression pool or wetwell portion of the primary containment.3 In the March 2011 Fukushima Daiichi accidentin which the cores of three GE-designed boiling water reactors lost all cooling and melted downhydrogen leaked from the primary containments into the reactor buildings.

The hydrogen accumulated in the reactor buildings and detonated, causing large releases of harmful radionuclides that contaminated a wide area and prompted the evacuation of some 90,000 people. A smaller hydrogen explosion also occurred in the March 1979 Three Mile Island Unit 2 (TMI-2) accidenta partial core meltdown of a pressurized water reactor (PWR)that did not breach the containment.

The U.S. Nuclear Regulatory Commission (NRC) has a checkered history when it comes to requiring measures that would effectively reduce the risk of hydrogen explosions in the event of a severe accident at a U.S. nuclear power plant. This regulatory lapse is rooted in the history of the development of commercial nuclear power in the United States, when the NRCs predecessor agency, the Atomic Energy Commission (AEC), had a dual mandate: both to promote and to regulate commercial nuclear power.

As a consequence of this internal con"ict of interest, rather than consult independent scienti"c and technical institutions, the AEC entrusted two companies that designed nuclear reactorsWestinghouse and General Electric (GE) with the mission of demonstrating that in a large-pipe-break loss-of-coolant accident (LOCA), the emergency core-cooling systems for their respective reactor designs would in fact prevent overheating of the core, and hence prevent the generation of large quantities of explosive hydrogen gas.

In response to the TMI-2 partial meltdown in 1979, the NRC revised its regulations regarding the control of hydrogen in an effort to help prevent hydrogen explosions in severe nuclear accidents. In 1981, the NRC issued a requirement that GE-BWRs with the small-volume Mark I and somewhat larger Mark II containments operate with their atmospheres inerted with nitrogen, to minimize the risk of hydrogen combustion.

In 1985, the NRC required installation of hydrogen igniters systems to burn off leaked hydrogen before it accumulates Figure 1: Structure of a Uranium Fuel Assembly Source: NRC

5 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents Source: NRC Reactor Concepts Manual, Rev. 0200 Figure 2: Cutaway View of a GE Mark I Boiling Water Reactor (BWR)

This is the design that exploded at Fukushima Daiichi, Japan, in March 2011.

Twenty-two units of this design are still operational in the U.S.

to explosive concentrationsin pressurized water reactor (PWR) ice condenser containments and GE-BWR Mark III containments.

By contrast, after Fukushima Daiichis three devastating hydrogen explosions, the NRC decided to relegate investigating severe accident hydrogen safety issues to the lowest-priority and least proactive stage (Tier 3) of its post-Fukushima Daiichi accident response. Hence, beyond ensuring reliable containment pressure relief vents are added to obsolescent Fukushima-type reactors, it could take many years, or even decades, before the U.S. nuclear industry implements further hydrogen control measures.

Multiple technical pathways exist for minimizing the risk of hydrogen explosions in severe nuclear accidents.

However, in the aftermath of the Fukushima Daiichi accident, the NRC has merely declared that severe nuclear accidents are vanishingly rare events that can be either prevented or sharply limited in scope, thereby avoiding any signi"cant buildup of hydrogen and attendant explosion risk. The reality, however, is that merely waving a rhetorical magic wand over Overhead crane (for refueling)

Reactor building (secondary containment):

fourth line of defense Primary containment (drywell): third line of defense Reactor pressure vessel (RPV), enclosing nuclear core: second line of defense Primary containment torus (wetwell): part of third line of defense, relieving gas pressure buildup in undersize drywell Elevated spent fuel pool

6 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents Source: Containment Integrity Research at Sandia National Laboratories - An Overview, NUREG/CR-6906 Figure 3: Cutaway View of a GE Mark II BWR with Uni"ed Concrete Drywell/Wetwell Primary Containment Design This design is deployed at Limerick Units 1 and 2, Susquehanna 1 and 2, and Nine Mile Point 2.

The primary containment volume is only slightly larger than that of the Mark I.

Reactor vessel Drywell Vent pipes to wetwell Wetwell Water level

7 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents the problem of hydrogen explosion risk "ies in the face of a number of unresolved safety issues, including:

Q experimental evidence that current reactor computer safety models do not accurately predict the onset of rapid hydrogen generation in severe nuclear accidents, and that they under-predict the rates of hydrogen generation that occur in such accidents; Q an aging "eet of U.S. reactors that will increasingly operate beyond the 40-year term of their initial licenses while facing severe competitive pressures from other electricity generation technologies, creating a perilous tradeoff between economic viability and public safety; Q the compromised ability of 40-year old containments to prevent hydrogen leakage (for example, at the seals of pipe and cable penetrations) under the elevated-pressure conditions that are expected to occur in severe accidents; Q the apparent willingness of the NRC to accede to licensee requests to relax and defer requirements for periodic containment pressurization and leak rate testing; and Q the lack of technical readiness of U.S. power reactor owners to detect and control dangerous concentrations of hydrogen in all the places where it could migrate and explode in a nuclear power plant.

We conclude that the NRC is failing to meet the statutory standard of adequate protection of the public against the hazard of hydrogen explosions in a severe reactor accident.

Our reasons are summarized below and set forth in more detail in the body of this report.

1. NRC computer safety models underpredict the rates of hydrogen generation that have occurred in experiments simulating severe nuclear accidents.

Reports from the Oak Ridge National Laboratory (1997), the OECD Nuclear Energy Agency (2001), and the International Atomic Energy Agency (IAEA) (2011) support the conclusion that current computer safety models underpredict the rates of hydrogen generation that may occur in severe accidents when zirconium fuel cladding and other core components react with steam, especially during a re-"ooding of an overheated reactor core. Unfortunately, the NRCs 2011 Recommendations for Enhancing Reactor Safety in the 21st Century: Near-Term Task Force Review of Insights from the Fukushima Daiichi Accident and subsequent Fukushima safety review documents do not discuss the fact that the NRCs computer safety modelssuch as the widely used MELCOR code developed by Sandia National Laboratories underpredict the hydrogen generation rates that occur in severe accidents. By overlooking the de"ciencies of computer safety models, the NRC undermines its own philosophy of defense-in-depth, which requires the application of conservative models. When hydrogen generation rates are underpredicted, hydrogen mitigation systems are not likely to be designed so that they can handle the hydrogen gas generation rates that would occur in actual severe accidents.

2. BWR Mark I and Mark II primary containments are especially vulnerable to overpressurization and hydrogen leaks.

In 1972, the chief nuclear safety analyst for the AEC recommended discouraging further use of the type of primary containments used in the GE-BWR Mark I and Mark II designs, claiming they were susceptible to overpressurization. One reason these containments are vulnerable is that their volumes are relatively small: typically about one-ninth and one-sixth the volume, respectively, of PWR large dry containments. In September 1989, the NRC publicly acknowledged that BWR Mark I primary containments might not be able to withstand the internal gas pressures that would build up in severe accidents. However, at the time, the NRC merely issued guidance that was not legally binding, recommending that owners of BWR Mark I designs on their own initiative install a hardened vent to the external environment for each reactor units doughnut-shaped wetwellto reduce the internal gas pressure and remove decay heat in the event of a severe accident.

In the United States, the vents currently installed in each BWR Mark I wetwell (see Figure 1) do not have a standardized design, are not out"tted with high-capacity "lters to prevent the release of harmful radionuclides in accidents, are not subject to NRC inspection for proper maintenance and continuing operability, and do not have an independent train of backup power sources to help ensure remote operation during a station blackout (i.e., a total loss of both grid-connected and backup alternating current power at a nuclear power plant).

As overall leak-rate tests demonstrate, GE-BWR Mark I and Mark II primary containments are not designed to prevent hydrogen leakage in accidents. These tests are legally required at U.S. nuclear power plants for determining how much radiation would be released from the containment in a design-basis accident (i.e., an anticipated accident in which, by design, a core melt would be prevented). In overall leak rate testsconducted below their nominal design pressuresBWR Mark I and Mark II primary containments have been shown to leak hundreds of pounds of air per day. For example, in 1999, tests conducted at Nine Mile Point Unit 1 (a BWR Mark I) and at Limerick Unit 2 (a BWR Mark II) found that overall leakage rates at both units exceeded 350 pounds of air per day, an amount that is less than the maximum allowed leak rates. This means that in a severe accident, even if there were no damage to a primary containment, hydrogen would leak into the secondary containment (reactor building). Leak rates would increase as the internal pressure increased, and they would become even greater if the seals at the various piping and cable penetrations were damaged. (Typical BWR containments have 175 penetrations, almost twice as many as typical PWR containments.)

8 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents Photo credits: top, unknown; bottom, Digital Globe Figure 4: Internet Images of the Fukushima Daiichi Nuclear Power Station from the Ocean Side Before and After the March 2011 Tsunami and Hydrogen Explosions Destroyed (from Right) Units 1, 3, and 4 A plume is visible coming from a blown-out shield building panel in the side of the Unit 2 reactor, which, while still intact, also experienced a core melt.

9 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents

3. GE-BWR Mark I and II containments perform poorly in leak rate tests, yet the NRC is planning to further relax requirements for leak rate testing.

BWR Mark I primary containments have failed a number of overall leak rate tests; for example, Oyster Creekthe oldest operating commercial reactor in the United States, which is considered to be quite similar to Fukushima Daiichi Unit 1 has failed at least "ve tests. In one test, Oyster Creeks primary containment leaked at a rate 18 times greater than its design leak rate; if this test was conducted at the same pressure as subsequent Oyster Creek tests, which seems likely, the primary containment leaked more than 6800 pounds of air per day. Such results raise the questions: What were the observed pre-accident leak ratesbelow design pressureof the three primary containments that leaked hydrogen at Fukushima Daiichi? Could there have been excessive hydrogen leakage at one or more of the primary containments, without it becoming overpressurized?

Since the Fukushima Daiichi accident, the problem of hydrogen leakage from primary containments has still not been adequately addressed. Mark II primary containments must also be assessed as likely to incur hydrogen leaks in severe accidents. Nevertheless, the NRC is currently preparing to extend the intervals at which overall and local leak rate tests must be conducted to once every 15 years (from the current 10 years) and once every 75 months (from the current "ve years), respectively. This will only further decrease the safety margin of BWR Mark I and Mark II designs. In its safety analyses to assess extending the test intervals, the NRC overlooked the fact that BWR Mark I and Mark II primary containments are particularly vulnerable to hydrogen leakage.

In a severe accident, BWR Mark I primary containments that leak excessively in tests conducted below their design pressure would leak dangerous quantities of explosive hydrogen gas into secondary containments; however, the NRC does not seem concerned about these excessive leakage rates. A 1995 NRC report, NUREG-1493, concluded that increasing allowable leakage rates by 10 to 100 times results in a marginal risk increase, while reducing costs by about 10 percent [emphasis added]. And a 1990 NRC report, NUREG-1150, concluded that even if there is leakage equivalent to 100 percent of the contained gas volume per day, the calculated individual latent cancer fatality risk is below the NRCs safety goal. But this safety goal clearly would not be achieved if leaking hydrogen were to detonate in the reactor buildings, as it did at Fukushima Daiichi.

In March 2013, the NRC asserted that [s]ensitivity analyses in NUREG-1493 and other studies show that light water reactor accident risk is relatively insensitive to the containment leakage rate because the risk is dominated by accident sequences that result in failure or bypass of containment [emphasis added]. In reality, the progression of the Fukushima Daiichi accident was indeed affected by the leakage of hydrogen gas. The evidence suggests that Unit 3s primary containment did not fail before hydrogen leaked into the Unit 3 reactor building and detonated. The internal pressure of Unit 3s primary containment actually increased after the hydrogen explosion occurred.

In a nuclear power plant accident, a mixture of hydrogen, nitrogen, and steam could leak from the primary containment; as internal pressures increase and the accident progresses, the concentration of hydrogen in the leaking mixture would increase. If there were no damage to the primary containment, the quantity of hydrogen that leaked (by weight) would be relatively small, because hydrogen is about one-fourteenth as dense as air. However, a secondary containment could be breached if, for example, only 20 to 40 pounds of hydrogen were to leak into it, accumulate locally, and explode.

4. Large-volume PWR dry containments, made of reinforced concrete with a steel liner, are a prominent safety feature of many U.S. nuclear power plants; however, they are not necessarily invulnerable to the effects of hydrogen explosions.

The NRC mistakenly claims that the large containment volumes of most PWRsa reactor design found in about two-thirds of the U.S. nuclear "eetwould keep the pressure spikes from potential hydrogen explosions within their design pressures. But this claim is predicated on an uncertain and therefore misplaced assumption that hydrogen combustion would occur in the form of a de"agration, a combustion wave traveling at a subsonic speed relative to the unburned gas.

However, when local hydrogen concentrations are greater than about 10 percent by volume, it is possible for a de"agration to transition into a detonation, a combustion wave traveling at a supersonic speed relative to the unburned gas. Unfortunately, in a severe accident, a hydrogen detonation could occur within a PWR large dry containment if there were elevated local hydrogen concentrations, especially in the presence of carbon monoxide and high temperatures; this could cause internal pressure spikes to exceed twice the containments design pressure.

Furthermore, a local hydrogen explosion occurring inside the containment could propel debris, such as concrete blocks from internal walls, into the containment structure at high velocities. The impact of such internally generated missiles could damage essential safety systems and severely crack a PWRs containment.

According to a 2011 IAEA report on the mitigation of hydrogen hazards in severe nuclear accidents, no analysis ever has been made on the damage potential of "ying objects generated in an explosion of hydrogen. Yet we know from the Fukushima Daiichi accident that debris propelled from hydrogen detonations caused extensive damage to backup emergency power supplies and hoses that were intended to inject seawater into overheated reactors. Some of the debris dispersed around the site by explosions was highly radioactive, exposing personnel to higher dose rates and setting back their efforts to control the accident.

As nuclear safety expert David Lochbaum has noted, During design basis accidents, the response of operators and workers is primarily passiveverifying that automatic equipment actions have occurred. In essence, workers are observers during design basis accidents. During severe accidents, workers get off the bench and into the game.

10 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents The keystone of [the U.S. nuclear] industrys response to Fukushima is FLEX, an array of portable components moved into place by workers. Inadequate hydrogen control during a severe accident would seem to render FLEX virtually useless.4

5. In the presence of the quantities of hydrogen generated in severe accidents, untimely ignitions from currently installed devices for controlling the buildup of hydrogen inside some U.S. nuclear reactor containments could cause hydrogen detonations.

Hydrogen recombiners are devices that eliminate hydrogen by combining it with oxygen, a reaction that produces steam and heat. There are two types of hydrogen recombiners:

passive autocatalytic recombiners (PARs), which operate without electric power, utilizing catalytic surfaces to facilitate the combining of hydrogen and oxygen molecules; and thermal recombiners, which are electrically powered.

In September 2003, the NRC rescinded its requirement that most types of PWRs operate with hydrogen recombiners installed in their containments, because it decided that the quantity of hydrogen that would be released in design-basis accidents is not risk-signi"cant. Indian Point on the Hudson River near New York City is the only nuclear power plant in the United States that currently operates with PARs. The new Westinghouse AP1000 design, under construction in Georgia, South Carolina, and China, is intended to operate with only two PARs installed in its containment. The hydrogen removal capacity of a single recombiner unit is only several grams per second whereas hydrogen generation in a severe accident could range from 100 to 5,000 grams per second.

If a PWR still operates with hydrogen recombiners, there are typically only two units installed in its containment, their mission being to reduce the quantity of hydrogen generated in a design basis accident. By contrast, European PWR containments typically have 30 to 60 such devices installed, with the mission of reducing the quantity of hydrogen generated in a severe accident.

Clearly, just two recombiners would not be capable of eliminating, in timely fashion, the quantity of hydrogen generated in a severe accident. But this is not their only limitation. When hydrogen recombiners are exposed to the elevated hydrogen concentrations that occur in severe accidents, they have a tendency to malfunction and incur ignitions, which could cause a hydrogen detonation that compromised the containment. Hence, it seems that maintaining the token capacity of two recombiners actually presents a net safety hazard. This is especially a problem with PARs, which operators would not be able to deactivate; at least electrically powered thermal recombiners could be switched off when a hydrogen concentration reached a level at which the recombiner could incur ignitions.

The NRC requires that hydrogen igniters be installed in reactor containments that are neither inerted nor designed to withstand high internal pressuresPWR ice condenser and BWR Mark III containments. Igniters are intended to burn off hydrogen as it is generated in an accident, before it can reach concentrations at which combustion would threaten the integrity of the less sturdy containment. In a severe accident, to safely actuate hydrogen igniters, operators would need to know the local concentration of hydrogen in the vicinity of each igniter; if igniters were actuated too lateafter local detonable concentrations of hydrogen built upthey could actually cause a hydrogen detonation that breached the containment.

6. The NRC has insuf"cient requirements for monitoring the quantities of hydrogen generated in severe accidents.

NRC rules state that in nuclear accidents, hydrogen monitors must begin to function within 90 minutes of the emergency injection of coolant water into the reactor vessel.

Ninety minutes could be too late in a fast-moving accident scenario. In 2003, the NRC took the odd step of reclassifying both hydrogen and oxygen monitors (required for BWR primary containments that operate with nitrogen-inerted atmospheres) as non-safety-related equipment, meaning that the equipment does not need to have redundancy, seismic resistance, or an independent train of onsite standby power.

Furthermore, GE-BWR Mark I and Mark II designs operate with hydrogen monitors installed only in their inerted primary containments, not in their reactor buildings. In the Fukushima Daiichi accident, hydrogen from three nuclear units leaked into these buildings and exploded.

7. Operators of PWRs lack a suf"cient capability to monitor the onset and progression of core degradation in the event of an accident.

This insuf"cient capability limits operator knowledge of when to transition from emergency operating procedures (EOPs)intended to prevent core damageto severe accident management guidelines (SAMGs)intended to stabilize a damaged reactor core with auxiliary ad-hoc cooling measures while preventing signi"cant off-site releases of radionuclide contamination. The operating measures appropriate to preventing core damage early in an accident are obviously not the same as those intended to contain the consequences of core damage that has already occurred while forestalling further compounding events, such as hydrogen explosions, that could result in a signi"cant loss of containment. Not knowing which regime one is operating in could have severe consequences.

In PWRs, core-exit thermocouplestemperature measuring devicesare the primary equipment that would be used to detect inadequate core-cooling and to signal the point at which operators should transition from EOPs to SAMGs. However, data from experiments demonstrate that core-exit temperature measurements are neither an accurate nor a timely indicator of maximum fuel-cladding temperatures in the core, and hence an unreliable indicator of the likelihood of signi"cant hydrogen production. In the most realistic severe accident experiment ever conducted in which an actual reactor core was heated with decay heat

11 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents before melting downcore-exit temperatures were measured at approximately 800°F when maximum in-core fuel-cladding temperatures exceeded 3300°F.

In a severe accident, plant operators are supposed to implement SAMGs before the onset of the rapid zirconium-steam reaction, which leads to thermal runaway in the reactor core. Clearly, using core-exit thermocouple measurements in order to detect inadequate core cooling or uncovering of the core is neither reliable nor safe. For example, PWR operators could end up re-"ooding an overheated core simply because they do not know the actual condition of the core. Unintentionally re-"ooding an overheated core could generate hydrogen, at a rate as high as 5,000 grams per second, and the containment could be compromised if large quantities of that hydrogen were to detonate, as occurred at Fukushima.

NRDCS RECOMMENDATIONS FOR REDUCING THE RISK OF HYDROGEN EXPLOSIONS IN SEVERE NUCLEAR ACCIDENTS A. The NRC should develop and experimentally validate computer safety models that can conservatively predict rates of hydrogen generation in severe accidents.

The NRC needs to acknowledge that its existing computer safety models underpredict the rates of hydrogen generation that occur in severe accidents. The NRC should conduct a series of experiments with multi-rod bundles of zirconium alloy fuel rod simulators and/or actual fuel rods as well as study the full set of existing experimental data. The NRCs objective in this effort should be to develop models capable of predicting with greater accuracy the rates of hydrogen generation that occur in severe accidents.

B. The safety of existing hydrogen recombiners should be assessed, with the use of PARs potentially discontinued until technical improvements are developed and certi"ed.

Experimentation and research should be conducted in order to improve the performance of PARs so that they will not malfunction and incur ignitions in the elevated hydrogen concentrations that occur in severe accidents.

The NRC and European regulators should perform safety analyses to determine if existing PARs should be removed from plant containmentsand, if so, whether they should be replaced with electrically powered thermal hydrogen recombiners that have their own independent train of emergency power. The latter course would require operators to have instrumentation capable of providing timely information on the local hydrogen concentrations throughout the containment, so they could deactivate the thermal recombiners when hydrogen concentrations reached the levels at which the recombiners malfunction and incur ignitions.

C. Existing oxygen and hydrogen monitoring instrumentation should be signi"cantly improved.

In line with the conclusions of the NRCs own Advisory Committee on Reactor Safeguards (ACRS), the NRC should reclassify oxygen and hydrogen monitors as safety-related equipment that must undergo full quali"cation (including seismic quali"cation), have redundancy, and have has its own independent train of emergency electrical power.

The current NRC requirement that hydrogen monitors be functional within 90 minutes of emergency cooling water injection into the reactor vessel is clearly inadequate for protecting public and plant worker safety. Following onset of an accident, NRC regulations should require that hydrogen monitors be functional within a timeframe that enables immediate detection of quantities of hydrogen indicative of core damage and a potential threat to containment integrity.

The NRC should also require hydrogen monitoring instrumentation to be installed in:

1. BWR Mark I and Mark II secondary containments;

2. fuel-handling buildings of PWRs and BWR Mark IIIs; and

3. any plant structure where it would be possible for hydrogen to enter.5 D. Current core diagnostic capabilities require upgrading to provide plant operators a better signal for when to transition from emergency operating procedures to severe accident management guidelines.

The NRC should require plants to use thermocouples placed at different elevations and radial positions throughout the reactor core to enable plant operators to accurately measure a wide range of temperatures inside the core under both typical and accident conditions. In the event of a severe accident, in-core thermocouples would provide plant operators with crucial information to help them track the progression of core damage and manage the accident, indicating, in particular, the correct time to transition from EOPs to implementing SAMGs.

E. The NRC should require all nuclear power plants to control the total quantity of hydrogen that could be generated in a severe accident.

The NRC should require all nuclear power plants to operate with systems for combustible gas control that would effectively and safely control the total quantity of hydrogen that could potentially be generated in different severe accident scenarios; and to have strategies for venting gas from the inerted primary BWR Mark I and Mark II containments without causing signi"cant radiological releases. The NRC should also require nuclear power plants to operate with systems for combustible gas control that are capable of preventing local concentrations of hydrogen in the containment from reaching concentrations that could support explosions powerful enough to breach the containment, or damage other essential accident-mitigating

12 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents features. Hydrogen explosions are not expected to occur inside the primary BWR Mark I and Mark II containments, which operate with inerted atmospheres, unless somehow oxygen is present.

The NRC should require licensees who operate nuclear power plants with hydrogen igniter systems to perform analyses demonstrating that these systems would effectively and safely mitigate hydrogen in different severe accident scenarios. Licensees unable to do so would be ordered to upgrade their systems to adequate levels of performance.

F. The NRC should require that data from leak rate tests be used to help predict the hydrogen leak rates of the primary containment of each BWR Mark I and Mark II licensed by the NRC in different severe accident scenarios.

The NRC should require that data from overall leak rate tests and local leak rate testsalready required by Appendix J to Part 50 for determining how much radiation would be released from the containment in a design basis accident also be used to help predict hydrogen leak rates for a range of severe accident scenarios involving the primary containments of each GE-BWR Mark I and Mark II licensed by the NRC. If data from an individual leak rate test were to indicate that dangerous quantities of explosive hydrogen gas would leak from a primary containment in a severe accident, the plant owner should be required to repair the containment.

The rationale for this requirement is obvious: Hydrogen explosions, or hydrogen concentrations in the reactor building that pose a detonation risk, can severely inhibit emergency response actions essential to containing the accident. Or even worse, emergency response actions themselves, such as hooking up portable power equipment, could actually provide the spark for hydrogen explosions in critical areas of the plant.

The NRC should also end its practice of allowing repairs to be made immediately before leak rate tests are conducted to evaluate potential leakage paths, such as containment welds, valves, "ttings, and other components that penetrate containment. This repair before test practice obviously defeats the nuclear safety objective of providing an accurate statistical sample of actual pre-existing containment leak rates.

Finally, the NRC should reconsider its plan to extend the intervals of overall and local leak rate tests to once every 15 years and 75 months, respectively. The NRC needs to conduct safety analyses that consider BWR Mark I and Mark II primary containments are vulnerable to hydrogen leakage.

It also seems probable that as old reactors are kept in service beyond their original licensed lifetimes, the intervals between leak rate tests should be shortened rather than extended.

13 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents A. TECHNICAL BACKGROUND: DESIGN BASIS ACCIDENTS AND THE ZIRCONIUM-STEAM REACTION In typical operating conditions at a nuclear power plant, highly pressurized coolant6 water is pumped through the reactor coolant system7 piping into the reactor pressure vessel where it "ows between the fuel rods, carrying away heat produced by the "ssion (splitting) of uranium (235U) atoms in the fuel. The coolant waters temperature exceeds 500°F; nonetheless, it still provides cooling for the fuel rods located in the reactor core as long as a suf"cient "ow of coolant is maintained.8 U.S. nuclear power plants are referred to as light water reactors because they use ordinary water (H2O), as opposed to heavy water (2H2O or D2O), as a coolant. In a boiling water reactor like those that suffered hydrogen explosions at Fukushima, the coolant exits the reactor core as a steam-water mixture. Water droplets are removed in a steam dryer located above the core, and then the steam passes through the steam line to the main turbine, which powers an electric generator, and is condensed back into water before reentering the core (see Figure 5).

II. HYDROGEN GENERATION IN NUCLEAR POWER PLANT ACCIDENTS Source: NRC Reactor Concepts Manual, Rev. 0200, pages 3-7, with additional explanatory features by NDRC Figure 5: Schematic Diagram of Heat Removal from a Boiling Water Reactor (BWR)

Heat is removed during normal operation by generating steam, which rises to the top of the reactor vessel (1), and is then used directly (red line) to drive a turbine (2) that spins an electrical generator. When a reactor shuts down, however, the core continues to produce heat from radioactive decay. This decay heat is removed initially by bypassing the turbine and delivering the steam directly to the condenser (3), which is cooled by water pumped from lakes, rivers, or ocean (green), with the condensed steam (blue) returning to the reactor as coolant (4). When steam pressure drops to approximately 50 pounds per square inch, the residual heat removal (RHR) system (5) is used to complete the cool-down process. Water in the normal coolant recirculation loop (6) is diverted from the recirculation pump to the RHR pump which sends it through a supplementary heat exchanger and back to the reactor.

Multiple electrically controlled pumps and valves are dependent on external sources of electricity for safe operation in the critical period following reactor shutdown. In a severe accident, drywell containment (7) is designed to vent (8) excess radioactive steam pressure into a wetwell suppression chamber (9) half "lled with water, which operators, in turn, can vent to the atmosphere through Reliable Hardened Vents (10) to relieve excess pressure. Currently, such vents do not "lter radioactive aerosols and gases.

14 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents In a pressurized water reactor the coolant typically circulates to and from the reactor in two to four closed primary loops, where it is maintained at a pressure high enough to prevent the water from boiling. Each primary loop has a steam generator (heat exchanger) where the coolant heats and boils water circulating through a secondary loop maintained at a lower pressure than the primary loop producing pressurized steam to spin the main turbine and generate electricity (see Figures 6 and 7).

Both reactor types have main condensers to condense the steam back into water after it exits the turbines; this water is pumped back to the reactor pressure vessel (in a BWR) or steam generator (in a PWR). The main condensers of both BWRs and PWRs rely on vast amounts of water, drawn from a local water body such as a lake, river, or ocean. This water may be returned directly to the local water body at elevated temperatures, sometimes damaging the local ecology; alternately, cooling towers may be deployed to remove heat from this water. Roughly two-thirds of the thermal energy produced by a nuclear reactor is not converted into electricity but rather is discharged to the environment as waste heat.

Reactor cores have tens of thousands of uranium fuel rods, bundled together into fuel assemblies. For example, each reactor at Indian Point Energy Center near New York City has 87 metric tons of fuel contained in 193 fuel assemblies (each with 204 fuel rods), or almost 40,000 fuel rods. The cladding of the fuel rods is made of zirconium alloy.9 The fuel cladding is a thin tube, typically with a diameter of less than half an inch, sheathing small cylindrical uranium-dioxide fuel pellets stacked one on top of the other. The active fuel region of the fuel rods (the length of the cladding containing the fuel pellets) is approximately 12 feet long.

In sum, a reactor core contains large amounts of zirconium metal that can react with steam at high temperatures to produce vast quantities of hydrogen gas. In the event of a design basis accident,10 BWR and PWR emergency core cooling systems are designed to inject and circulate water through the reactor core to prevent the fuel rods from overheating when the normal reactor cooling system ceases to function. The respective emergency core cooling systems are required to mitigate a number of postulated design-basis accidents, including the worst-case scenario envisioned Source: The Westinghouse Pressurized Water Reactor Nuclear Power Plant, page 4 Figure 6: Simpli"ed Schematic Diagram of a Westinghouse Pressurized Water Reactor (PWR) with Three Intersecting Heat Transfer Heat Loops PWR designs typically have two to four primary loops and a corresponding number of steam generators and main coolant pumps.

Water in the primary loop is maintained by the pressurizer at around 2250 pounds per square inch, about twice the pressure of a BWR. Weak points in this system from a radiation containment perspective are the numerous valves and penetrations of the reactor vessel required to control and cool the reactor; the seals of the main coolant pumps, which must be actively cooled and are prone to leakage; and the thousands of small-diameter, thin-walled primary loop steam tubes in the steam generators, which are prone to erosion and leakage into the secondary loop. The tertiary loop can be open, returning heated water from the turbine condenser directly to a local river, lake, or bay; or closed, utilizing one or more wet (evaporative) or dry (fan-driven air) cooling towers (not shown) to recycle the tertiary coolant in a semiclosed loop (makeup water must be added to the system due to evaporative losses).

15 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents by regulators: a large-pipe-break loss-of-coolant accident (LOCA). Note that the March 2011 Fukushima Daiichi accident in Japan is considered a beyond design basis accident11 or a severe accident that exceeded the design parameters of the plant.

In a hypothetical large-pipe-break LOCA at a PWR, the largest pipe in the reactor coolant system would break, causing a rapid discharge of coolant; the core would be either partly or completely emptied of water. The reactors power would shut down within seconds, because the absence of the coolant, which is also a neutron moderator,12 and the rapid insertion of control rods would stop the "ssion chain reaction. A control rod is a rod, plate, or tube containing a neutron-absorbing material used to control the power of a nuclear reactor by preventing further "ssions. However, the maximum local temperature of the fuel cladding would increasefrom approximately 600°F to more than 1000°F within 60 seconds13 due to the absence of coolant. The fuel cladding would be heated by the residual heat in the fuel and by decay heating (the radioactive decay of "ssion products),

which at the beginning of an accident would generate about 7 percent of the thermal power produced during normal operation. The decay heat decreases as the accident progresses yet remains a signi"cant heat source for the duration of the accident.

If local fuel-cladding temperatures were to approach 1800°F, the cladding would incur additional heating from the exothermic (heat-generating) reaction of its zirconium content with the steam present in the reactor core. This chemical reaction is variously referred to as a metal-water reaction, zirconium-steam reaction, or zirconium oxidation. The latter term is used because the zirconium-steam reaction produces zirconium dioxide (ZrO2), in addition to hydrogen and heat.14 Source: NRC Reactor Concepts Training Manual, Pressurized Water Reactor Systems, Section 4-1 Figure 7: Layout of a Westinghouse Four-Loop Pressurized Water Reactor (PWR)

The reactor has four steam generators and four main coolant pumps (the fourth pump is hidden by the perspective of the drawing).

All these components are massive.

To set the scale, the interior of the reactor vessel is about 15 feet wide by 40 feet high. U.S. examples include Indian Point Units 2 and 3 (New York), Vogtle Units 1 and 2 (Georgia), Comanche Peak Units 1 and 2 (Texas) and Diablo Canyon Units 1 and 2 (California).

16 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents Source: University of New Mexico Libraries Exhibition Nuclear Engineering Wall Charts Figure 8: Cutaway View of French N4 Standardized PWR Design, Based on Westinghouse Technology but with a Double-Walled Primary Containment Structure (1)

Reactor pressure vessel (2) and primary coolant loop piping are shown in red; main steam lines (in blue) are shown coming from the top of the steam generators (3),

shown in light green. These are supplied by the feedwater system (dark green piping), which also cools the spent fuel pool (4) and main coolant pump seals (dark green). The turbine building (5) encloses a steam-driven turbine generator unit (in purple) with a rated output of 1500 MWe. The tertiary cooling loop for the turbine steam condenser is not shown.

4 1

3 2

3 2

17 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents If the emergency core cooling system is to prevent the fuel cladding from overheating in a large-break LOCA, it must overcome the heat from three primary sources: 1) the residual heat stored in the fuel, 2) the heat from radioactive decay, and

3) the heat generated by the zirconium-steam reaction.

B. SEVERE ACCIDENTS AND THE HEAT PRODUCED BY THE ZIRCONIUM-STEAM REACTION Practically speaking [zirconium] oxidation runaway comes indue to the heat of the oxidation reaction increasing generally faster than heat losses from other mechanisms.

[I]f peak [fuel-cladding] temperatures remain below 1000°C

[1832°F], you will probably escape the runaway [oxidation],

but if you get to 1200°C [2192°F], you will probably see the oxidation light up like a 4th of July sparkler (literally thats what it looks like) as it looks like) as it goes into the rapid oxidation regime.15 Randall O. Gauntt, Sandia National Laboratories The Three Mile Island Unit 2 (TMI-2) accident, which occurred in March 1979, was a small-break LOCA16 that transitioned into a severe accidenta partial meltdown because there was inadequate cooling of the core. Decay heating caused local fuel-cladding temperatures to increase up to the point at which the cladding began to rapidly react with the steam present in the reactor core, which in turn produced more heat.

Robert E. Henryan Argonne National Laboratory nuclear safety expert,17 suggested that in the TMI-2 accident, when local fuel-cladding temperatures reached about 1832°F (1000°C), the heat produced by the zirconium-steam reaction was approximately equal to the heat produced by radioactive decay,18 and that from [that] point on, the core was in a thermal runaway state.19, 20 Henry stated that

[t]he [zirconium] oxidation rate increase[d] with increasing temperature, which [led] to an escalating core heatup rate.

Therefore, the core damage was generally caused by the

[zirconium] cladding oxidation [emphasis added].21 Once thermal runaway (runaway zirconium oxidation) commences in a severe accident, maximum local fuel-cladding temperatures increase rapidlytens of degrees Fahrenheit per second. Thermal runaway is what leads to a partial or complete meltdown. After thermal runaway commenced in the TMI-2 accident (plausibly at about 1832°F [1000°C]), within a few minutes, maximum local fuel-cladding temperatures would have reached the melting point of zirconium, which exceeds 3300°F.22 In the March 2011 Fukushima Daiichi accident, the respective reactor cooling systems of Units 1, 2, and 3 reportedly survived the earthquake more or less intact.

However, the plant incurred a loss-of-offsite power, then "ooding from the tsunami caused its backup diesel generators to fail, and backup batteries were depleted within about eight hours. The latter were insuf"cient in any case to power emergency core-cooling pumps once the steam-driven backup pumps became inoperative. Hence, the three units lost the ability to remove their reactors decay heat. This caused the coolant water to boil away and uncover the fuel rods in the cores of the three units, exposing them to steam.

Once the fuel rods were uncovered, decay heating caused cladding temperatures to increase to the point at which their zirconium content rapidly reacted with the steam and generated large quantities of hydrogen gas.

The NRC needs to consider that not all severe accidents would be relatively slow-moving station-blackout accidents caused by natural disasters, like the Fukushima Daiichi accident. Fast-moving accidents could also occur; for example, a large-pipe-break LOCA could rapidly transition into a severe accident, because of thermal runaway. A meltdown could commence within 10 minutes of the onset of such an accident.23 C. HYDROGEN GENERATION IN ACCIDENTS:

RATES AND QUANTITIES It should be noted that in an unmitigated BWR severe accident the entire Zircaloy inventory of the reactor would eventually oxidize (either in the reactor vessel or on the drywell "oor),

generating as much as 6000 [pounds] (2722 kg) of hydrogen (plant speci"c value).24 Sherrell R. Greene of Oak Ridge National Laboratory In a reactor accident, fuel-cladding temperatures, plant operator actions, and other factors would affect hydrogen generation rates and the total quantity generated.

In a PWR accident in which the maximum fuel-cladding temperature at any point in the core does not exceed 2200°F (the regulatory fuel-cladding temperature limit for design basis accidents25), hydrogen generation is predicted to occur at rates from 1 to 50 grams per second;26 similar rates would occur in a BWR design basis accident. A safety analysis conducted for Indian Point Unit 3 (a large PWR) found, reassuringly, that after a design basis LOCA, it would take a total of 23 days for the hydrogen concentration in the containment to reach 4 percent of the containments volume (the lower "ammability limit).27 The NRCs 2011 Near-Term Task Force Review of Insights from the Fukushima Daiichi Accident states that an important aspect of the NRCs approach to safety through defense-in-depth is the mitigation of the consequences of severe accidents, including the mitigation of the hydrogen that would be generated in such an accident. However, the Near-Term Task Force report discusses neither the rates of hydrogen generation that could occur nor the total quantity of hydrogen that could be generated in severe accidents.

Given that in the Fukushima Daiichi accident, hydrogen explosions caused large radiological releases, this must be considered a major weakness in the NRCs report and its continuing regulatory response to the lessons learned from the Fukushima accident.

18 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents However, in a severe PWR accident, the picture changes dramatically: hydrogen generation could occur at rates from 100 to 5,000 grams per second28 (two orders of magnitude greater than in a design basis accident), and similar rates would occur in a severe BWR accident. An OECD Nuclear Energy Agency report states, a rapid initial [hydrogen]-

source occurs in practically all severe accident scenarios because the large chemical heat release of the [zirconium]-

steam reaction causes a fast self-accelerating temperature excursion during which initially large surfaces and masses of reaction partners are available.29 If an overheated reactor core were re-"ooded with water, up to 300,000 grams of hydrogen could be generated in 60 seconds.30 In this scenario, according to one report, between 5,000 and 10,000 grams of hydrogen could be generated per second.31 (In the TMI-2 accident, re-"ooding of the uncovered reactor core by the emergency core cooling system caused a spike in the hydrogen generation rates; it has been estimated that approximately 33 percent of all the hydrogen produced occurred during re-"ooding.32)

The total quantity of hydrogen that could be generated in a severe accident is different for PWRs and BWRs. Considering hydrogen generated only from the oxidation of zirconium:

if the total amount of the zirconium in a typical PWR core, approximately 26,000 kilograms (kg), were to chemically react with steam, this would generate approximately 1150 kg of hydrogen; if the total amount of zirconium in a typical BWRs core, approximately 76,000 kg, were to chemically react with steam, this would produce about 3360 kg of hydrogen.33 Large BWR cores typically have about a 58-percent greater initial uranium mass than large PWR cores,34 and this larger mass is divided into approximately 45 percent more fuel rods than in a PWR. However, these differences alone do not account for the fact that BWR cores have almost three times the mass of zirconium in their cores than PWRs.35,36 BWR cores have signi"cantly more zirconium mainly because, unlike PWRs, BWR fuel assemblies have channel boxes surrounding the fuel rods. The mass of each BWR assembly channel box is greater than 100 kg.37 Thus a BWR core with 800 fuel assemblies would actually have more than the 76,000 kg of zirconium cited by the IAEA as typically present in a BWR core.)

The total quantity of hydrogen generated in a severe accident can vary widely: The Fukushima Daiichi accident, which resulted in three meltdowns, most likely generated more than 3,000 kg of hydrogen per affected unit; the amount produced in the TMI-2 accident is estimated at about 500 kg.38 In a severe accident, hydrogen would also be generated within the reactor vessel from the oxidation of non-zirconium materials: metallic structures and boron carbide (in BWR cores).39 In the TMI-2 accident, the oxidation of steel accounted for approximately 10 percent to 15 percent of the total hydrogen generation.40 In a case in which the molten core penetrated the reactor vessel, hydrogen would be generated from the oxidation of metallic material (chromium, iron, and any remaining zirconium) during direct containment heating and also from interaction of the molten core with concrete (out of which containment "oors are made).41 A safety study for the PWRs at Indian Point discusses a case in which interaction of a molten core with a concrete containment "oor would generate more than 2721.5 kg of hydrogen.42 If a molten core interacted with concrete, carbon monoxide (which, like hydrogen, is a combustible gas) would also be generated. Depending on different accident scenarios, concrete types, and geometrical factors affecting the molten core-concrete interaction, the quantities of carbon monoxide generated could vary greatly; concentrations could differ by up to several volume percent in the containment.43, 44 D. NRC MODELS UNDERPREDICT SEVERE ACCIDENT HYDROGEN GENERATION RATES A 2001 OECD Nuclear Energy Agency report advises that high hydrogen generation rates must be taken into account in risk analysis and in the design of hydrogen mitigation systems. However, the same report notes that computer safety models used by regulators underpredicted the actual rates of hydrogen generation that occurred in two sets of experiments simulating severe accidents: the CORA tests and LOFT LP-FP-2.45 (The CORA and LOFT LP-FP-2 experiments were conducted to investigate accidents that lead to a meltdown of the reactor core. LOFT LP-FP-2 was conducted with an actual nuclear reactor, 1/50th the volume of a full-size PWR, designed to represent the major component and system response of a commercial PWR. LOFT LP-FP-2 was an actual core meltdownthe most realistic severe accident experiment conducted to date; it combined decay heating, severe fuel damage, and the quenching of zirconium fuel cladding with water.46) Computer safety models also failed to predict hydrogen generation in the initial QUENCH facility experiments.47 This indicates that computer safety models also underpredict the hydrogen generation rates that would occur in severe accidents.48 A 1997 Oak Ridge National Laboratory (ORNL) report states that hydrogen generation in severe accidents can be divided into two separate phases: 1) a phase that runs from when the fuel cladding is still intact through the initial melting of the fuel cladding, which accounts for about 25 percent of the total hydrogen produced; and 2) a phase after the initial melting of the fuel cladding, in which there is additional melting, relocation, and the formation of uranium-zirconium-oxygen blockages, which accounts for about 75 percent of the total hydrogen generated (as indicated in analyses of the BWR CORA-28 and -33 tests).49 According to the 1997 ORNL report, computer safety models predict hydrogen generation rates reasonably well for the "rst phase, in which the fuel cladding remains intact, but predict hydrogen generation rates for the second phase much less robustly. The 1997 ORNL report stresses that it is obvious that computer safety models need to accurately predict hydrogen generation rates when the fuel cladding is no longer intact, especially because most of the hydrogen

19 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents generation occurs in that phase.50 A 2011 International Atomic Energy Agency (IAEA) report states that computer safety models underpredict the rates of hydrogen generation that would occur during a re-"ooding of an overheated reactor core.51 The report cautions that, in different scenarios, re-"ooding could cause hydrogen generation rates to vary to a large degree and that predictions need to consider the possible range of outcomes in order to help prepare for severe accident hydrogen risk. In the BWR CORA-17 test, which simulated the re-"ooding and quenching of an overheated core, approximately 90 percent of the hydrogen generation occurred during re-"ooding.52 Unfortunately, recent reports do not explicitly state the extent that computer safety models under-predict hydrogen generation rates during the re-"ooding and quenching of an overheated corei.e., a percentage value of the under-prediction has not been provided. However, presentation slides from a 2008 European meeting state that the total amount of hydrogen under re"ooding remains highly underestimated in [the] CORA-13 and LOFT LP-FP-2 experiments [emphasis added]. In fact, regarding recent computer simulations of LOFT LP-FP-2, the same presentation slides state: High temperature excursions with extended core degradation and enhanced hydrogen release observed in the test during re"ood was not reproduced due to the lack of adequate modeling53 [emphasis added].

Despite these reports dating back to 1997, the NRCs 2011 Near-Term Task Force report on insights from the Fukushima Daiichi accident failed to mention, much less discuss, the fact that the NRCs computer safety modelssuch as the widely used MELCOR code developed by Sandia National Laboratoriesunderpredict the hydrogen generation rates that occur in severe accidents. By overlooking the de"ciencies of computer safety models, the NRC undermines its own philosophy of defense-in-depth, which requires the application of conservative models.54 When hydrogen generation rates are underpredicted, hydrogen mitigation systems are not likely to be designed so that they could handle the generation rates that would occur in actual severe accidents.

E. AN ATTEMPT TO ELIMINATE HYDROGEN RISK: DEVELOPING NON-ZIRCONIUM FUEL CLADDING Perhaps the most effective way to help prevent hydrogen explosions in severe accidents would be to develop fuel cladding that does not generate large quantities of hydrogen when the core overheats in such accidents. Zirconium alloy cladding could possibly be replaced with silicon carbide, molybdenum alloys, molybdenum-zirconium alloys, or iron-chromium-aluminum alloys.55 Silicon carbide is perhaps the most promising alternate; in the design basis accident temperature rangebelow 2200°Fsilicon carbide is far less reactive than zirconium with steam,56 generating much less hydrogen.

In 2010, according to an article in Nuclear Engineering International, a type of silicon carbide fuel cladding with a triplex design57 was still in the early stages of development and testing the article opines that developing such cladding is a high-risk, but potentially high-payoff58 venture. It remains to be seen if triplex silicon carbide would be a suitable replacement for zirconium alloy as a fuel-cladding material; there are a number of problems with silicon carbide cladding that still need to be resolved.

One problem is that during typical reactor operation the fuel pellets in silicon carbide cladding would have higher temperatures than they do when sheathed in zirconium. This would occur for two reasons: First, after extended irradiation, silicon carbide has a lower thermal conductivity than zirconium alloy,59 meaning less of the fuels heat would pass through the cladding and into the coolant. Second, the thin gap between the fuel pellets and the cladding would not be closed early in the "rst fuel cycle as occurs when zirconium cladding is used.60 Both of these phenomena would prevent the pressurized water from cooling the fuel pellets in silicon carbide cladding as effectively as it does when the fuel pellets are sheathed in zirconium cladding.

A second problem is that an effective means of hermetically sealing the ends of silicon carbide fuel-cladding rods has not yet been developed.61 If the fuel-cladding rods were not hermetically sealed during reactor operation, "ssion products would escape from the fuel rods and enter the coolant water.

A June 2012 Nuclear Energy Advisory Committee report lists additional problems with silicon carbide fuel cladding, such as a lack of ductility (the ability to bend, expand or contract without breaking) compared with currently used cladding types. The report also speculates that within four years further research and experimentation should con"rm whether or not such problems can be resolved. If the problems are resolved, in-reactor testing of silicon carbide fuel cladding could take an additional 10 to 20 years.62 Hence, even if all were to go well, it could take more than two decades before silicon carbide fuel cladding is ready for commercial use. There is certainly no reason to expect that zirconium alloy fuel cladding will ever be widely replaced in the aging U.S. "eet of nuclear power plants, which are facing obsolescence in the 2025-2050 timeframe.

20 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents In the Fukushima Daiichi accident, hydrogen detonated in and seriously damagedthe reactor buildings housing Units 1, 3, and 4, causing large radiological releases. The hydrogen explosion that occurred in the Unit 1 reactor building also caused a blowout panel in the Unit 2 reactor building to open, which resulted in a loss of secondary containment integrity.63 Actually, from a strict technical perspective, secondary containment integrity was lost the moment the "ooded emergency diesel generators failed to supply backup power. Maintaining secondary containment integrity requires (a) an intact reactor building structure, and (b) a standby gas treatment system to "lter releases from the intact structure to the atmosphere and maintain the structure at a lower pressure than ambient pressure (thus ensuring, in the case of small leaks, that outside air leaks in rather than inside air leaking out). Flooding of the emergency diesel generators by the tsunami took away (b) hours before the explosion took away (a).64 As discussed in the preceding sections, the zirconium-steam reaction will generate large quantities of hydrogen in severe accidents. When it reaches a suf"cient local concentration inside the containment, this hydrogen will explode if exposed to an ignition source, of which there are many, given the amount of electrical equipment and wiring located inside the containment. In the TMI-2 accident, a hydrogen explosionprobably initiated by an electric spark65occurred in the containment (a PWR large dry containment). The TMI-2 accident explosion did not breach the containment; however, the integrity of either a PWR ice condenser containment or a BWR Mark III containment could be compromised by an explosion of the quantity of hydrogen generated in the TMI-2 accident, because such containments have substantially smaller volumes and lower design pressures than PWR large dry containments.66,67 The fact that a hydrogen explosion did not breach TMI-2s containment does not preclude the possibility that if a meltdown were to occur at another PWR with a large dry containment, a hydrogen explosion could breach the containment, exposing the public to a large radiological release. Nonetheless, the NRC 2011 Near-Term Task Force report on insights from the Fukushima Daiichi accident claims that the pressure spike of potential hydrogen explosions would remain within the design pressure of PWR large dry containments.68 However, according to NRC safety analyses,69 conducted a decade ago, hydrogen explosions inside PWR large dry containmentsof the quantity of hydrogen generated from zirconium-steam reactions of 100 percent of the active fuel-cladding lengthcould cause pressure spikes as high as 114 pounds per square inch (psi)70 to 135 psi71over twice the design pressure of a typical PWR large dry containment.

Such extreme pressure spikes could cause a PWR large dry containment to fail. There are also other safety analyses with worrisome results. For example, analyses conducted for Indian Point Units 2 and 3 about three decades ago found that peak pressures caused by hydrogen explosions could exceed the estimated failure pressure of Indian Points containmentsapproximately 126 pounds per square inch gauge72 (psig) or 141 pounds per square inch absolute73 (psia).74 For certain severe accident scenarios, peak pressure spikes were predicted to be 160 psia, 169 psia, about 157 psia, and 180 psia or greater.75 (Some nuclear safety experts believe the accuracy of containment failure pressure estimates is questionable; according to one, Experimental data on the ultimate potential strength of containment buildings and their failure modes are lacking.76)

A. THE POTENTIAL DAMAGE OF MISSILES PROPELLED BY HYDROGEN EXPLOSIONS In a severe accident, a local hydrogen explosion within the containment could propel debris, such as concrete blocks from disintegrated compartment walls, at extremely high speeds. The impact of such debris (internally-generated missiles) could compromise essential safety systems and even breach the containment, especially if it were made of steel.77 If a PWR large dry containment made of reinforced concrete with a steel liner78 were struck by a missile propelled by a hydrogen explosion, the containment would be more likely to incur cracks than to experience gross failure. Yet this is mere speculation: According to a 2011 IAEA report, no analysis ever has been made on the damage potential of "ying objects, generated in [a hydrogen]-explosion.79 An Institute of Nuclear Power Operations (INPO) report, published in November 2011 thoroughly documents how in the Fukushima Daiichi accident, internally generated missiles and missiles from secondary containments, propelled by hydrogen explosions, caused a considerable amount of damage and set back efforts to control the accident.80 The report states:

[D]ebris from the explosion struck and damaged the cables and mobile generator that had been installed to provide power to the standby liquid control pumps. The debris also damaged the hoses that had been staged to inject seawater into Unit 1 and Unit 2.... Some of the debris was also highly contaminated, resulting in elevated dose rates and contamination levels around the site. As a result, workers were now required to wear additional protective clothing, and stay times in the "eld were limited. The explosion signi"cantly altered the response to the event and contributed to complications in stabilizing the units.81 III. SEVERE ACCIDENT HYDROGEN EXPLOSIONS:

AN UNRESOLVED SAFETY ISSUE

21 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents B. HYDROGEN EXPLOSIONS:

DEFLAGRATIONS AND DETONATIONS In a severe accident, water pumped into the reactor core to cool the fuel rods would heat up and produce thousands of kilograms of steam, which would enter the containment through pressure relief valves or a break in the cooling system circuit. At different points in an accident the presence of large quantities of steam in the containment would have an inerting effect, either helping to prevent or completely preventing hydrogen combustion if the steam concentration were 55 volume percent82 or greater. (If hydrogen combustion were to occur, the presence of steam would help reduce its intensity.83) However, after enough steam condensed and this would be inevitable at some point in an accident, either naturally or by the use of containment spray systems84 either local or global hydrogen combustion could occur.

In a dry atmosphere of hydrogen and air, the lower "ammability limit of hydrogen is a concentration of 4.1 volume percent.85 If hydrogen concentrations were from 4.1 to about 8.0 volume percent, hydrogen combustion would be in the form of a de"agration with a relatively slow "ame speed.86 A de"agration is a combustion wave traveling at a subsonic speed relative to the unburned gas. (In the TMI-2 accident, a hydrogen de"agration occurred when the hydrogen concentration was 8.1 volume percent87 causing a rapid pressure increase of approximately 28 psi in the containment.88) A famous instance of a hydrogen de"agration occurred on May 6, 1937, when the hydrogen-"lled dirigible Hindenburg ignited while landing at Lakehurst, NJ and collapsed into a smoldering mass of twisted wreckage on the ground within a matter of seconds.

In a severe reactor accident, hydrogen could randomly de"agrate when its concentrations were at 8.0 volume percent or lower, because only a small quantity of energy is required for igniting hydrogen; sources of random ignition include electric sparks from equipment and static electric charges.89 It has been postulated that in the TMI-2 accident, the hydrogen de"agration was initiated by a ringing telephone90 and in the case of the Hindenburg, by the buildup of a static electric charge on its specially-coated outer skin.

In one sense, random or in some instances deliberate ignition of hydrogen at relatively low concentrations is bene"cial, in that it can prevent the hydrogen from building up to more dangerous detonable concentrations.

Unfortunately, in a severe accident, the average hydrogen concentration in the containment could reach 7.0 to 16.0 volume percent, or higher; local concentrations could be much higher. In a dry atmosphere of hydrogen and air, with hydrogen concentrations above about 10.0 volume percent, Source: D. W. Stamps et al., Sandia National Laboratories, Hydrogen-Air-Diluent Detonation Study for Nuclear Reactor Safety Analyses, NUREG/CR-5525, January 1991, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML071700388)

Table 1: Calculated Hydrogen (H2) production Due to 75% Zirconium-Water Reaction Note that all the predicted containment hydrogen concentrations (far right-hand column) are above the combustion threshold of 4.1 volume percent, and most are above temperature-dependent detonation thresholds of 11.6 and 9.4 volume percent hydrogen, at 68°F and 212°F, respectively.

22 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents "ames can accelerate up to and beyond the speed of sound:

this phenomenon is termed de"agration-to-detonation transition.91 A detonation is a combustion wave traveling at a supersonic speed (greater than the speed of sound) relative to the unburned gas. Hydrogen combustion in the form of detonations occurred in the Fukushima Daiichi accident.

Higher temperatures and/or the presence of carbon monoxide could increase the likelihood of a de"agration-to-detonation transition. In a dry hydrogen-air mixture, the lower concentration limits at which de"agration-to-detonation transition can occur is 11.6 volume percent at temperature of 68°F; at 212°F, the lower concentration limit falls to 9.4 volume percent.92 And in the presence of 5.0 volume percent of carbon monoxide (generated if a molten core interacts with a containments concrete "oor), 10.0 volume percent of hydrogen can detonate at approximately 68°F.93 One safety expert has concluded that within the large geometries of PWR-containments a slow laminar de"agration would be very unlikely. In most cases, highly ef"cient combustion modes must be expected.94 In a small-break LOCA, large quantities of steam could enter the containment well before hundreds of kilograms of hydrogen were released into the containment. In such a scenario, thermal strati"cation could prevent the hydrogen from mixing with the steam.95 In scenarios in which large quantities of steam were present in the containment, the hydrogen could reach high concentrations because the inerting effect of the steam could prevent the hydrogen from igniting at lower concentrations. After the steam condensed, a de"agration could transition into a etonation.

C. LIMITATIONS OF COMPUTER SAFETY MODELS TO PREDICT HYDROGEN DISTRIBUTION IN THE CONTAINMENT AND HYDROGEN DEFLAGRATION-TO-DETONATION TRANSITION In a September 2011 meeting of the Advisory Committee on Reactor Safeguards (ACRS), Dana Powers, senior scientist at Sandia National Laboratories, expressed concern over the fact that hydrogen detonations occurred in the Fukushima Daiichi accident and stated that in experiments, detonations areextraordinarily hard to get.96,97,98 Consequently, computer safety models (codes) derived from these experiments have limitations in predicting the hydrogen distribution and steam condensation that would occur in the containment in different severe accident scenarios.

A 2007 OECD Nuclear Energy Agency report states, Further work in code developmentand code user training, supported by suitable complex experiments, is necessary to achieve more accurate predictive capabilities for containment thermal hydraulics and atmospheric gas/

steam distribution. As a result of the code assessment, the modeling of the following three phenomena appeared to be the major issues: condensation, gas density strati"cation, and jet injection [emphasis added].99 Computer safety models also have limitations in predicting the phenomenon of hydrogen de"agrations transitioning into detonations; as well as the maximum pressure loads the containment would incur from detonations, in different scenarios. Westinghouses probabilistic risk assessment for its new and supposedly passively safe AP1000 reactor design, under construction in Georgia and South Carolina, observes that the phenomenon of hydrogen de"agration-to-detonation transition is complex and not completely understood and that the maximum pressure loads from detonations are dif"cult to calculate.100 The Fukushima Daiichi accident demonstrated that the NRC needs to conduct more realistic hydrogen combustion experimentsperhaps in facilities on the same scale as actual reactor containments, at elevated temperatures and with the large quantities of hydrogen that are produced in severe accidents.

Source: Containment Integrity Research at Sandia National Laboratories:

An Overview, Sandia National Laboratories, NUREG/CR-6906/ SAND2006-2274P, July 2006 Table 2: Release Paths in LWR Containments

23 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents A. HYDROGEN-MITIGATION STRATEGIES FOR DIFFERENT CONTAINMENT DESIGNS Over the course of six decades, the NRC and its predecessor agency, the Atomic Energy Commission, have licensed six basic types of reactor containments (see Table 3), but within each type there are numerous design and construction differences (see Table 4) that translate into a wide and highly uncertain range of capacities to contain a severe reactor accident.

PWRs with Large Dry Containments and PWRs with Subatmospheric Containents The NRC does not require the owners of PWRs with large dry containments (52 out of 53 such units are currently operational in the U.S.), or the owners of PWRs with sub-atmospheric containments, maintained at an internal pressure below atmospheric pressure ("ve out of seven such units are currently operational in the U.S.) to mitigate the hydrogen that would be generated in severe accidents. The agency assumes that the large containment volumes of such PWRs are suf"cient to keep the pressure spikes of potential hydrogen de"agrations within the design pressures of the structures.101 One hydrogen mitigation strategy for these types of containments would be to mix the hydrogen entering the containment using its fan coolers; this would reduce local hydrogen concentrations and mix the hydrogen with steam, which has an inerting effect.102 A second hydrogen mitigation strategy for such PWRs would be to use hydrogen recombiners, safety devices that eliminate hydrogen in an accident by recombining hydrogen with oxygena reaction that produces steam and heat. There are two types of recombiners: passive autocatalytic recombiners (PAR), which operate without electric power, and electrically powered thermal recombiners. The hydrogen removal capacity for one hydrogen recombiner unit is only several grams per second.103 In September 2003, the NRC likewise rescinded its requirement that PWRs with large dry containments and PWRs with sub-atmospheric containments operate with hydrogen recombiners installed in their containments. It decided that the quantity of hydrogen produced in design-basis accidents would not be risk-signi"cant and that hydrogen recombiners would be ineffective at mitigating the quantity of hydrogen produced in severe accidents104 when hydrogen generation could occur at rates as high as 5.0 kg per second.105 In the United States, if such PWRs still have hydrogen recombiners, there are typically two of them in each containment, to mitigate the quantity of hydrogen produced in a design basis accident. For example, Indian Points containments each have two hydrogen recombiner units.106 To help mitigate hydrogen in a wide range of severe accident scenarios, a group of European nuclear safety experts have recommended that such PWRs have from 30 to 60 hydrogen recombiner units distributed in their containments.107 However, even 60 hydrogen recombiner units would not be capable of eliminating all of the hydrogen generated in some severe accident scenarios within the timeframe required to prevent a hydrogen explosion.

IV. SEVERE ACCIDENT HYDROGEN MITIGATION Source: NUREG/CR-6906/SAND2006-2274P, July 2006 Table 3: U.S. Power Reactor Containment Structures, by Type

24 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents Source: NUREG/CR-6906/SAND2006-2274P, July 2006 Table 4: U.S. PWRs Classi"ed by Containment Construction Type

25 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents Figure 9: Typical PWR Large Dry Containment Designs Left: Large dry steel primary containment with reinforced-concrete shield. Right: Containment constructed with post-tensioned concrete with steel liner (e.g., Palisades).

Reinforced-concrete shield building 2.5 feet thick Steel primary containment

26 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents PWRs with Ice Condenser Containments and BWR Mark III The NRC requires that PWRs with ice condenser containments (nine such units are currently operational in the U.S.) and BWR Mark IIIs (four are currently operational in the United States) operate with hydrogen igniters installed in their containments in order to mitigate the hydrogen that would be generated in the event of a severe accident.108 Hydrogen igniters are intended to burn off hydrogen as it is generated in an accident, before it reaches concentrations at which combustion would threaten the integrity of the containment. Hydrogen mitigation is essential for PWRs with ice condenser containments and BWR Mark IIIs because their containments have relatively low design pressures,109 which makes them more vulnerable to hydrogen exlosions.

Such containments could be compromised by an explosion of the quantity of hydrogen that was generated in the TMI-2 accident.110 Hydrogen igniters are intended to manage the quantity of hydrogen that would be generated by a zirconium-steam reaction of 75 percent of the fuel-claddings active length,111 which is considerably less than the quantity of hydrogen generated at each melted-down unit at Fukushima-Daiichi.

Table 5: U.S. BWRs by Containment Construction Type A Mark I plant, Vermont Yankee, is missing from the NRCs compilation.

Source: NNUREG/CR-6906/ SAND2006-2274P, July 2006

27 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents Figure 10: Typical PWR Ice Condenser Steel Containment with Concrete Shield Building (e.g., Sequoyah)

Source: NUREG/CR-6906/SAND2006-2274P, July 2006 Containment spray system Hydrogen igniters Shield building dome Concrete shield building wall Top of ice bed Ice condenser Vapor barrier Accumulator Steel liner Reactor cavity Steel primary containment Steam generator Ice condenser Ventilation fan and equipment Reactor vessel Sump

28 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents BWR Mark I and BWR Mark II The NRC requires that BWR Mark Is (23 such units are currently operational in the U.S.) and BWR Mark IIs (eight such units are currently operational in the U.S.) operate with primary containments that have an inerted atmosphere112 to help prevent hydrogen combustion. An inerted containment atmosphere is de"ned as having less than 4.0 percent oxygen by volume.113 Nitrogen is used to inert BWR Mark I and Mark II primary containments because nitrogen is inexpensive and nontoxic.

Such containments are relatively small, so deinerting and inerting for outages between fuel cycles can be achieved within hours; these processes are also inexpensive.114 If BWR Mark I and Mark II primary containments were not inerted, they would be extremely vulnerable to hydrogen explosions in severe accidents, because of their relatively small volumes.115 Such containments, if not inerted, could easily be compromised by an explosion of the quantity of hydrogen generated in the TMI 2 accident. A year after the Fukushima accident, in March 2012, the NRC ordered the installation of reliable hardened vents in BWR Mark I and Mark II containments by December 31, 2016.116 A hardened vent could help control hydrogen in a severe accident but its primary purposes are to remove heat from and depressurize BWR Mark I and Mark II containments, which due to their small volumes are more susceptible than other containment designs to failure from overpressurization in an acident.

In September 1989, the NRC issued non-legally binding guidance to all owners of BWR Mark I facilities, recommending117 that hardened vents be installed.118 The NRC does not require that hydrogen be mitigated in the secondary containments of BWR Mark I and Mark II units.

Figure 11: Cross-section View of a Typical BWR Mark III Containment (e.g., Perry, Riverbend)

Freestanding steel primary containment (red) with lower suppression pool (blue) and concrete shield building) has a low design pressure rating (15 psig), requiring that credit be given to the use of hydrogen igniters and containment sprays to meet containment requirements.

Figure 12: BWR Mark II Reinforced Concrete Containment (Limerick Units 1 and 2)

Drywell inerted with nitrogen (orange) is connected by pressure relief pipes (red) to wetwell (green). Waterline is in blue.

Source: NNUREG/CR-6906/SAND2006-2274P, July 2006 Source: NNUREG/CR-6906/SAND2006-2274P, July 2006

29 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents CASE STUDY: Hydrogen Risks in Westinghouses Probabilistic Risk Assessment for the AP1000 and Plans for Managing an AP1000 Severe Accident Currently four Toshiba-Westinghouse AP1000 units are under construction in South Carolina and Georgia. The NRC purports to have more stringent safety requirements for the AP1000, that re"ect the Commissions expectation that future designs will achieve a higher standard of severe accident performance than currently operating light water reactors.119 And Westinghouse has touted the AP1000 as having, in the event of a severe accident, a far lower probability of breaching its containment than currently operating nuclear power plants. However, Westinghouses probabilistic risk assessment (PRA) for the AP1000 erroneously claims that it would not be possible for a hydrogen detonation to occur in the AP1000s containment if the hydrogen concentration were less than 10.0 volume percent. A hydrogen detonation could compromise the containment and thus cause a large radioactive release. In fact, Westinghouses PRA assumes that the containment would fail in all cases, in which hydrogen de"agrations transitioned into detonations.120 Westinghouses PRA for the AP1000 states that [s]ince the lowest hydrogen concentration for which de"agration-to-detonation transition has been observed in the intermediate-scale FLAME facility at Sandia [National Laboratories] is 15 percent,121 and [NRC regulation] 10 CFR 50.44 limits hydrogen concentration to less than 10 percent, the likelihood of de"agration-to-detonation transition is assumed to be zero if the hydrogen concentration is less than 10 percent.122 Westinghouse does not consider that the lower concentration limits at which de"agration-to-detonation transition can occur, at temperatures of 68°F and 212°F, are 11.6 and 9.4 volume percent of hydrogen, respectively.123 According to a 1998 Brookhaven National Laboratory report: Most postulated severe accident scenarios are characterized by containment atmospheres of about 373K [212°F] However, calculations have shown that under certain accident scenarios local compartment temperatures in excess of 373K [212°F] are predicted.124 It is perplexing that Westinghouses PRA for the AP1000 as well as the NRCs regulations for future water-cooled reactors rely on outdated assumptions that the phenomenon of hydrogen de"agration-to-detonation transition cannot occur below hydrogen concentrations of 10.0 volume percent: in 1991, Sandia National Laboratories reported that, in an experiment, de"agration-to-detonation transition occurred at 9.4 volume percent of hydrogen.125 The previous year, the same information was reported at the NRCs Eighteenth Water Reactor Safety Information Meeting.126 In a September 2011 Advisory Committee on Reactor Safeguards meeting, Dana Powers, a senior scientist at Sandia National Laboratories, expressed concern over the fact that hydrogen detonations occurred in the Fukushima Daiichi accident and stated that in experiments, detonations areextraordinarily hard to get.127 However, neglecting to reassess hydrogen-combustion safety issues for the AP1000 after Fukushima, the NRC went ahead and issued licenses for two AP1000s in February 2012.

Paradoxically, two of the AP1000 containments safety deviceshydrogen igniters, and passive autocatalytic hydrogen recombiner (PAR) units when they malfunction and behave like ignitersprovide ignition sources that are capable of causing hydrogen detonations. In a severe accident, hydrogen igniters must be actuated at the correct time, because, as Peter Hoffman wrote in the Journal on Nuclear Materials: [t]he concentration of hydrogen in the containment may be combustible for only a short time before detonation limits are reached.128 If AP1000 operators were to actuate the hydrogen igniters in an untimely fashionafter a local detonable concentration of hydrogen developed in the containmentit could cause a detonation. This especially could occur because Westinghouses emergency response guidelines for the AP1000 are "awed: Operators are instructed to actuate hydrogen igniters when the core-exit gas temperature exceeds 1200°F. Westinghouse maintains that the core-exit temperature would reach 1200°F before the onset of the rapid zirconium-steam reaction of the fuel cladding,129 which leads to thermal runaway in the reactor core; however, experimental data demonstrates that this would not necessarily be the case.

Westinghouse and the NRC, which approved the AP1000 design, both overlooked dataavailable for more than a quarter centuryfrom the most realistic severe accident experiment conducted to date (LOFT LP-FP-2), in which core-exit temperatures were measured at approximately 800°F when maximum in-core fuel-cladding temperatures exceeded 3300°F.

In LOFT LP-FP-2, when core-exit temperatures were 800°F, the rapid zirconium-steam reaction of the fuel cladding had already occurred and the reactor core had started melting down. Hence, relying on core-exit temperature measurements in an AP1000 severe accident could be unsafe: In a scenario in which operators re-"ooded an overheated core simply because they did not know the actual condition of the core, hydrogen could be generated at rates as high as 5.0 kg per second. If operators were to actuate hydrogen igniters in such a scenario, it could cause a hydrogen detonation.

Westinghouses general description of the AP1000 states that [PARs] control hydrogen concentration following design basis events.130 However, in the elevated hydrogen concentrations that occur in severe accidents, PARs are prone to malfunctioning and behaving like hydrogen igniters. This is a problem: AP1000 operators would not be able to switch off PARs, because they operate without electrical power. If the AP1000 containments PAR units malfunctioned and incurred ignitions after a detonable concentration of hydrogen developed in the containment, it could cause a detonation.131 This could occur in a number of severe accident scenarios, especially those in which the AP1000 containments hydrogen igniter system was not operational,132 enabling local detonable concentrations of hydrogen to develop in the containment.

30 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents B. PROBLEMS WITH CURRENT HYDROGEN-MITIGATION STRATEGIES FOR RESPECTIVE REACTOR DESIGNS PWRs with Large Dry Containments and PWRs with Subatmospheric Containments As noted above, the NRC does not require owners of PWRs with large dry containments and PWRs with sub-atmospheric containments to mitigate the hydrogen that would be generated in severe accidents; however, in severe accidents, it would be possible for the pressure spikes of hydrogen explosions to exceed the design pressures of such containments. The NRC has reported that hydrogen detonations could occur in PWRs with large dry containments and PWRs with sub-atmospheric containments. For example, a 1990 NRC letter to plant owners states that in severe accidents, local and global hydrogen detonations could occur in PWRs with large dry or sub-atmospheric containments.133 Furthermore, a 1991 report by Sandia National Laboratories cautions that in severe accidents, in which 75 percent of the fuel-cladding active length oxidized, detonable concentrations of hydrogen could develop in dry hydrogen-air mixtures in such containments. The report states that in a severe accident, steam typically would be present in the containment, yet the quantity of steam would be unpredictable because of condensation, which would be facilitated by containment spray systems. Detonations would most likely be initiated through de"agration-to-detonation transition, yet direct detonations could perhaps be possible at higher temperatures.134 Hydrogen recombiners would be prone to malfunctioning by incurring ignitions in the elevated concentrations that occur in severe accidents. This would be a serious problem: A recombiners unintended ignition could cause a detonation.135 PARs could be advantageous in station-blackout accidentsa complete loss of grid-supplied and backup on-site alternating current powerbecause they operate without either external power or plant operator actuation; however, there is no way to prevent such recombiners from self-actuating or to shut them off in elevated hydrogen concentrations. Plant operators would be able to control the operation of electrically powered thermal hydrogen recombiners; yet operators should be cautious about actuating thermal recombiners in an accident. Plant operators should actuate thermal recombiners only if hydrogen concentrations are low and should deactivate them Figure 13: Typical PWR Subatmospheric Reinforced Concrete Containment with Steel Liner (e.g., Diablo Canyon, North Anna, Surrey, Beaver Valley)

Source: NUREG/CR-6906/SAND2006-2274P, July 2006 The Uncertain Performance of Different Containment Designs in a Severe Accident Is Likely to Vary Widely Figure 14 compares the calculated design pressure (in pounds per square inch above sea level atmospheric pressure, or psig) of the six main types of U.S. commercial reactor containments with their net free volume in millions of cubic feet. BWR Mark I and II have a nominally strong pressure rating, due to their use of pressure-suppression pools, but very low free volume. The BWR Mark III and PWR ice condenser designs have the lowest design pressures of the group as well as moderate volumes, while the two other PWR containment designs have the largest volumes along with comparatively high design pressures.

The actual safety situation is more complex than re"ected in this "gure. In reality, no two reactor containments, even at the same facility, are exactly alike, and units of the same type can vary widely in their design and construction details. Predictions of local failure mechanisms, which could lead to signi"cant leakage in an accident even before overall design pressures are exceeded, depend on the availability of accurate as-built information (geometry and material properties) at structural discontinuities (e.g.,

near containment doors or pipe and cable penetrations).

Even if this information is available (not typical for actual containments), the prediction, a priori, of local failures is at best an uncertain proposition.... Any evaluation of the capacity of an actual containment must be based on the entire system, including mechanical and electrical penetrations and other potential leak paths.

Source: NUREG/CR-6906/SAND2006-2274P, July 2006, p. xvii

31 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents if hydrogen concentrations increase to dangerous levels. Of course, to soundly make such decisions, operators would need to ascertain local hydrogen concentrations throughout the containment, which would be especially dif"cult in the course of a fast-moving and/or chaotic accident scenario.

Among the PWRs in the United States that still have hydrogen recombiners installed, only one has PARs (Indian Point Unit 2); the others have thermal recombiners typically two units in each containment. In Europe, some PWRs have from 30 to 60 PARs installed and distributed in their containments to help mitigate hydrogen in the event of a severe accident.136 This is puzzling, given that such recombiners would be prone to behaving like igniters malfunctioning by incurring ignitionsin elevated hydrogen concentrations.137 After intensive deliberation, European regulators decided not to require igniters in PWRs (those without ice condenser containments) because [u]ncertainties were identi"ed with respect to, among other aspects, hydrogen distribution and combustion behavior.138 In line with the reasoning behind this decision, it seems that European regulators should also be hesitant about allowing PWRs to operate with PARs installed in their containments, because unintended ignitions from such recombiners would be neither predictable nor preventable in a severe accident.

Another problem with hydrogen recombiners is that in a severe accident, cesium iodide particles transported through them could be converted into volatile iodine, producing an additional source term of radiation exposure.139 PWRs with Ice Condenser Containments and BWR Mark III Containments The NRC requires that PWRs with ice condenser containments and BWR Mark IIIs operate with hydrogen igniters installed in their containments in order to mitigate the hydrogen that would be generated in the event of a severe accident.140 However, hydrogen igniters should be used only in cases where the effects of their use are entirely predictable, and predictions must indicate that the containment would not be threatened by any potential de"agrations arising from the deliberate ignition of hydrogen.141 Safety experts have questioned the safety of using igniters to mitigate hydrogen at certain times in some severe accident scenarios. For example, an OECD Nuclear Energy Agency report published in August 2000 states, The main question in the application of the igniter concept is its safety orientation.

The use of igniters should reduce the overall risk to the containment and should not create new additional hazards such as a local detonation.142 Another paper, published in 2006, states that [w]ith early ignition, the hydrogen will be eliminated by slow combustion without high thermal and temperature loads, but with late ignition, hydrogen detonation transition will quickly occur with high local thermal and pressure loads which will threaten the integrity of the containment.143 A 1990 NRC letter to plant owners cautions that hydrogen igniters would be prevented from operating in station blackouts at PWRs with ice condenser containments and Figure 14: Typical Containment Volume and Design Pressure for U.S. Nuclear Plants As a general rule, low volumes make it more likely that design basis pressures will be exceeded in a severe accident.

Source: NUREG/CR-6906/SAND2006-2274P, July 2006

32 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents BWR Mark IIIs. If hydrogen were not burned off, it could reach detonable concentrations; if power were then restored, the igniters could cause a hydrogen detonation.144 BWR Mark I and BWR Mark II Containments Hydrogen generation is a serious problem for the small-volume, inerted BWR Mark I primary containment, because hydrogen is non-condensable at the temperatures expected in a nuclear power plant.145 In a BWR severe accident, hundreds of kilograms of non-condensable hydrogen gas would be generated (potentially exceeding 3,000 kg146) at rates as high as 5,000 to 10,000 grams per second if there were a re-"ooding of an overheated reactor core.147 This would increase the internal pressure of the primary containment.

If enough hydrogen were generated, the containment would likely "rst leak excessively before failing catastrophically from overpressurization.

A BWR Mark I primary containment is made up of a drywell shaped like an inverted lightbulb, which contains the reactor vessel, and a steel wetwell (also called a torus) shaped like a doughnut, which surrounds the base of the drywell.

The drywell and wetwell are connected by large pipes. The wetwell is half "lled with water (typically about 790,000 gallons148)and is sometimes referred to as a suppression pool. A BWR Mark II primary containment also has a drywell and wetwell (concrete), but these are shaped and oriented from their BWR Mark I counterparts.

In a severe accident, water already present or pumped into the reactor core to cool the fuel rods would heat up and produce thousands of kilograms of steam, which would enter the drywell of the primary containment. The water in the wetwells suppression pool is intended to condense the steam and help absorb the heat released by the accident to reduce the pressure in the primary containment; as the steam pressure builds up in the drywell, steam vents downward into the wetwell through pipes, which terminate underwater in the suppression pool. (Without the condensation of the steam in the suppression pool, the relatively small primary containments of BWR Mark Is and Mark II units (often termed pressure suppression containments) would quickly fail from overpressurization.

However, the generation of suf"ciently large quantities of non-condensable hydrogen gas in a severe accident could overwhelm the capacity of the primary containment. For example, there could be a severe accident scenario at a BWR Mark I in which there is a rapid accumulation of steam in the drywell and non-condensable gas (nitrogen149 and hydrogen) in the wetwell; in such a scenario, the primary containments pressure could rapidly increase up to the venting and failure levels.150 Early BWRs Perform Poorly in Containment Leak-Rate Tests, Even When Liberal Test Protocols Allow Pretest Repairs to Supposedly As Found Condition of Seals and Valves BWR Mark I and Mark II primary containments are designed to limitnot preventhydrogen leakage in accidents. In overall leak rate tests151conducted below design pressure such containments leak hundreds of pounds of air per day.

For example, in 1999, tests conducted at Nine Mile Point Unit 1, a BWR Mark I, and Limerick Unit 2, a BWR Mark II, found that overall leakage rates at both units were in excess of 350 pounds of air per day,152, 153 which is actually less than the maximum allowed leak rates.

This means that in a severe accident even if there were no damage to a primary containment, hydrogen would leak into the secondary containment (the reactor building);

leak rates would increase as the internal pressure increased and would become even greater if the seals at the various piping and cable penetrations were damaged. (Typical BWR containments have 175 penetrations, almost twice as many as typical PWR containments.)154 Regarding reactor containments and hydrogen leakage, a 2011 IAEA report states:

[N]o containment is fully leak tight, [hydrogen] will leak to the surrounding areas, which often have the function of secondary containment. Hence, there is a certain risk that combustion may occur outside the primary containment. This may lead to combustion loads exerted on the containment from outside. Usually, containments have considerable margin against loads from inside, as they are in principle designed to carry the pressure loads from a large break LOCA. The pressure bearing capability for loads from outside can be substantially less155 Figure 15: Prestressed concrete containment vessel (PCCV) at the Ohi Unit 3 reactor in Japan A 1:4 scale model of a prestressed concrete containment vessel (PCCV) at the Ohi Unit 3 reactor in Japan, undergoes a massive rupture in a 2001 Sandia Laboratory test at 3.63 times its design pressure (Pd), or 206.4 psig. The pressurized model had experienced leak rates in earlier tests, indicating functional failure at 2.4 times Pd.

Source: NNUREG/CR-6906/SAND2006-2274P, July 2006

33 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents In an accident, a mixture of hydrogen, nitrogen, and steam would leak from a BWR primary containment; as internal pressures increased and the accident progressed, the concentration of hydrogen in the leaking mixture would increase. If there were no damage to the primary containment, the quantity of hydrogen that leaked (by weight) would be relatively small, because hydrogen is about 14 times less dense than air.156 However, a BWR secondary containmentwhich has a design pressure of approximately 3.0 psig157could be breached if, for example, between 20 to 40 pounds of hydrogen were to leak into it, accumulate locally, and explode.

In a severe accident, it is highly probable that the seals at the penetrations of BWR Mark I and Mark II primary containments would become degraded (of course, some penetration-seals could already be degraded by material aging before the accident occurred.) A 1984 report from Brookhaven National Laboratory advises that severe accident risk estimates should consider [t]he potential for containment leakage through penetrations prior to reaching estimated containment failure pressures. The report further notes it is highly probable that the leakage of BWR Mark I and Mark II primary containments would prevent overpressurization, and that [f]ailure of non-metallic seals for containment penetrations (primarily equipment hatches, drywell heads, and purge valves) are the most signi"cant sources of containment leakage.158 BWR drywell heads, which have diameters between 30 to 40 feet, would most likely incur the highest leak rates in the containment as internal pressures increased.159 Containments have had leaks, exceeding allowable leakage rates, that lasted for many monthsprimarily from large penetrations, such as the purge and vent valves, [main steam isolation valves, for BWRs only], and valves inadvertently left open.160 In fact, BWR Mark I primary containments have failed a number of overall leak rate tests; for example, Oyster Creekthe oldest operating commercial reactor in the U.S.,

which is considered to be quite similar to Fukushima Daiichi Unit 1has failed at least "ve tests.161 In one test, Oyster Creeks primary containment leaked at a rate that was 18 times greater than its design leak rate;162 if this test was conducted at 35 psig, the same pressure as subsequent Oyster Creek tests,163 which seems likely, the primary containment leaked at a rate in excess of 6800 pounds of air per day.164 Such results beg the question: what were the pre-accident leak ratesbelow design pressureof the three primary containments that leaked hydrogen at Fukushima Daiichi?

Since the Fukushima Daiichi accident, the problem of hydrogen leakage from primary containments has not been adequately addressed. (Mark II primary containments would also incur hydrogen leaks in severe accidents.) In fact, the NRC is currently preparing to reduce the frequency of both local and overall leak rate testing from once every "ve and once every 10 years, respectively, to once every 75 months and 15 years, respectively.

Remarkably, the current 10-year requirement already represents a loosening of the original leak-test intervals, which stood at 2.0 to 3.3 years prior to 1995, depending on the particular nature of the test.165 In its safety analyses to assess extending the test intervals, the NRC has simply overlooked the fact that BWR Mark I and Mark II primary containments are vulnerable to hydrogen leakage. Moreover, as reactors approach and exceed their originally-licensed lifetimes of 40 years, one might intuitively conclude that the need for containment leak rate testing is actually increasing, not diminishing, in order to gauge the impact of aging penetration seals and isolation valves on containment integrity under a range of accident scenarios, including severe accidents.

Local leak rate tests of containment penetrations are supposed to be conducted as as-found tests, meaning that the penetrations are not supposed to be repaired immediately before testing; however, NUREG/

CR-4220 reports that all of the NRC Senior Inspectors for containment systems [who] were contacted and asked to relate their experience with containment isolation system performance.166 They stated that:

[R]eported leakage rates often do not represent true leakage rates. Utilities are generally allowed to perform some minor repair on a valve prior to recording its as-found condition for a leakage test. Similarly, major repair (such as completely rebuilding a valve) is permitted prior to recording a valves as-left condition at the end of its leakage test.167 Hence, around 1985 when NUREG/CR-4220 was published, it was a common practice for utilities to make minor repairs on valves immediately before recording their as-found leak rates. The local leak rate tests that are intended to measure leakage rates at containment isolation valves are termed Type C tests. In September 1995, the NRC extended Type C test intervals from two years to "ve years. Interestingly, the failure rates of Type C as-found tests have decreased by about one order of magnitude since the test intervals for such tests were increased in 1995.168 Such signi"cant improvements beg the question: since 1995, to what degree have valves been repaired immediately before recording their as-found leak rates?

NUREG/CR-4220 states that one of the NRC Senior Inspectors indicated that Types B and C tests [local leak rate tests] are performed before Type A [overall leak rate test],

enabling repairs to be made sothat the Type A test can be passed easily.169 In a March 2013 ACRS meeting, an ACRS member similarly observed that [i]f they did all their preparations perfectly, they would never fail.170 It is clear that overall leak rate tests and local leak rate tests would provide a far more accurate assessment of pre-existing containment leak rates if repairs were not allowed to be made immediately before testing.

A report from the Electric Power Research Institutes (EPRI), Risk Impact Assessment of Extended Integrated

34 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents Leak Rate Testing Intervals,171 has been used by the NRC to help justify the extension of testing intervals.172 However, this report overlooked the fact that in severe accidents, BWR Mark I and Mark II primary containments leak explosive hydrogen gas into secondary containments. A second major problem with EPRIs report is that its list of overall leak rate test failures does not include the majority of test failures reported in NUREG/CR-4220. NUREG/CR-4220 lists a total of 60 overall (integrated) leak rate tests that failed before March 1985;173 in fact, NUREG/CR-4220 also reports that when considering the results of local leak rate tests that failed with excessive leakage rates, the number of overall leak rate tests that failed is a total of 109.174 By contrast, EPRIs report lists a total of nine containment leakage or degradation events that occurred before March 1985.175 Regarding its methodology for assessing the risk impact of extended test intervals, EPRIs report states The "rst step is to obtain current containment leak rate testing performance information. This information is used to develop the probability of a pre-existing leak in the containment using the Jeffreys Non-Informative Prior statistical method [emphasis added].176 Clearly, the NRC needs to review a large portion of the existing data that EPRI overlooked and reassess the risk impact of extended test intervals.

In a severe accident, any primary containment in a condition that would cause it to fail a leak-rate test would leak dangerous quantities of explosive hydrogen gas into a reactor building, even at below design pressure; however, the NRC does not seem concerned about excessive leakage rates.

A 1995 NRC report177 concluded thatincreasing allowable leakage rates by 10 to 100 times results in a marginal risk increase, while reducing costs by about 10 percent178

[emphasis added]. And a 1989/1990 NRC report179 concluded that even if there is a containment leakage of 100 percent per day, the calculated individual latent cancer fatality risk is below the NRCs safety goal.180 Clearly, this safety goal would not be achieved if leaking hydrogen were to detonate in secondary containments, as it did at Fukushima Daiichi.

In March 2013, the NRC stated that [s]ensitivity analyses in NUREG-1493 and other studies show that light water reactor accident risk is relatively insensitive to the containment leakage rate because the risk is dominated by accident sequences that result in failure or bypass of containment181 [emphasis added]. The progression of the Fukushima Daiichi accident was certainly affected by the leakage of hydrogen gas. In fact, it is possible that Unit 3s primary containment did not fail before hydrogen leaked into the Unit 3 secondary containment and detonated.

Table 6: Historical Reactor Containment Integrated Leak Rate Test (ILRT) Failures Even with Test Protocol Allowing Pre-Test Repairs (circa 1985)

Source: P.J. Pelto et al., Reliability Analysis of Containment Isolation Systems, Paci"c Northwest Laboratory, NUREG/CR 4220, June 1985, available at: NRCs ADAMS Documents, Accession Number:

ML103050471

35 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents The internal pressure of Unit 3s primary containment actually increased after the hydrogen explosion occurred.

The explosion occurred on March 14 at 11:01 am, then at 12:00 pm the primary containments pressure started increasing from 52.2 psia to 53.7 psia, at 4:40 pm the pressure started decreasing from 69.6 psia, and at 8:30 pm the pressure started increasing from 52.2 psia.182 In the Fukushima Daiichi accident, the BWR Mark I primary containments of Units 1, 2, and 3 incurred internal pressures that exceeded the loads they were designed to sustain. According to an INPO report published in November 2011, the highest recorded internal pressures in the primary containments of Units 1, 2, and 3 were approximately 1.7, 1.7, and 1.4 times greater than their design pressures, respectively.183 (In the accident, hydrogen leaked from the primary containmentsaccording to INPO:

most probably at the penetrations184of Units 1, 2, and 3 and detonated in the secondary containments of Units 1, 3, and 4.) The NRC has stated that in the circumstances of the Fukushima Daiichi accident, it is reasonable to conclude that BWR Mark IIs would also incur devastating consequences, because Mark II containment designs are only slightly larger in volume than Mark I containment designs185 and also use wetwell pressure suppression.186 Reliable Hardened Vents In an attempt to resolve the problems of BWR Mark I and Mark II primary containment overpressurization and decay heat removal, in March 2012, the NRC ordered that reliable hardened vents be installed in BWR Mark Is and Mark IIs by December 31, 2016.187 (As stated above, in September 1989, the NRC had tried to solve the same problems by issuing non-legally binding guidance to all the owners of BWR Mark Is, recommending188 that hardened vents be installed in Mark Is.189) The NRCs order stipulates a number of performance objectives and features that a new design of a hardened vent must have; for example, shall include a means to prevent inadvertent actuation.190 It could be dif"cult to design a hardened vent that would perform well in scenarios in which there were rapid containment-pressure increases. A 1988 report by the Committee on the Safety of Nuclear Installations report states that [f]iltered venting is less feasible for those sequences resulting in early over-temperature or overpressure conditions. This is because the relatively early rapid increase in containment pressure requires large containment penetrations for successful venting.191 This indicates that a reliable hardened vents piping will likely need a diameter and thickness greater than what has been voluntarily installed at BWR Mark I containments in the United States.192 If a hardened vent were designed for passive operation by means of a rupture disk, in place of a remotely or manually actuated valve, venting would occur if a predetermined threshold pressure were reached. A reliable passive venting capability could be bene"cial in severe accident scenarios that have rapid containment pressure increases. However, a 1983 Sandia National Laboratories manual cautions that it may be dif"cult to design vents that can handle the rapid transients involved in a severe accident.193 It is important to consider that in the Fukushima Daiichi accident, the particular design of the installed vents may have caused the accident to be worse than it would have been without their use: The INPO report of November 2011 states that it is postulated that the hydrogen explosion in the Unit 4 reactor building was caused by hydrogen from Unit 3.194 Unit 3 and Unit 4s containment vent exhaust piping was interconnected, so hydrogen may have been vented from Unit 3 to Unit 4s secondary containment,195 where it detonated.

In severe accidents, spent fuel pools are vulnerable to the hydrogen explosions that can occur in BWR Mark I and Mark II secondary containments. Spent fuel pools, which store fuel assemblies after they are discharged from the reactor core, are located in the secondary containment of these designs, elevated about 70 to 80 feet above ground level. If a spent fuel pool were compromised by a hydrogen explosion, it could cause large radiological releases.

Some thought initially that the explosion that occurred in Fukushima Daiichi Unit 4 at 6:00 am on March 15, 20113.63 days after the March 11, 2011 earthquakecould have been caused by the detonation of hydrogen gas generated by the reaction of steam with the zirconium cladding of fuel rods stored in the spent fuel pool. Subsequent investigations indicated that this was not the case.

However, according to a 2012 ORNL paper, the hydrogen that detonated could have come from the Unit 4 pools fuel assemblies reacting with steam: If there were a loss of spent fuel pool cooling, the water in the pool would be heated by the fuel rods decay heat until it reached the boiling point; then the water would boil away, uncovering the fuel rods.

ORNL computer analyses found that in this scenario, a total of 1,800 kg to 2,050 kg of hydrogen could have been generated. The analyses also found that 150 kg of hydrogen an amount that could have caused the Unit 4 explosion would have been generated 3.63 days after the accident commenced if the initial water level in the pool were 4.02 meters (at the top of the active length of the fuel rods).196 The NRC does not require that hydrogen be mitigated in the secondary containments of BWR Mark I and Mark II sites in severe accidents. This is a problem, because hydrogen could leak into secondary containments and explode, as occurred in the Fukushima Daiichi accident. The Fukushima Daiichi accident demonstrated that BWR Mark I secondary containmentsessentially ordinary industrial buildings with design pressures of approximately 3.0 psig197cannot withstand hydrogen explosions. (BWR Mark II secondary containments also have low design pressures.) In line with the NRCs approach to safety through defense-in-depth,198 the Fukushima Daiichi accident scenario of hydrogen leaking from overpressurized primary containments and/

or hardened vent systems should be considered as likely to occur again, in the event of a severe accident at either a BWR Mark I or BWR Mark II.

36 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents C. MONITORING CORE DEGRADATION AND HYDROGEN GENERATION IN SEVERE ACCIDENTS In a severe accident, plant operators would need equipment that effectively monitored evolving conditions; information, such as temperatures in the reactor core and hydrogen concentrations in the containment, would help them manage an accident and implement hydrogen mitigation. Without accurate and prompt core and containment diagnostics, plant operators would not be able to properly manage an accident. Unfortunately, some of the current methods of monitoring core and containment diagnostics are inadequate.

Monitoring Core Degradation In a severe accident involving a PWR, the primary tool used to detect inadequate core cooling and uncovering of the core would be coolant temperature measurements taken with core-exit thermocouples (temperature measuring devices) at a point above the active length of the fuel rods.

In many cases, a predetermined core-exit thermocouple measurement would be used to signal the time for PWR operators to transition from emergency operating procedures (EOP) to severe accident management guidelines (SAMG).

The NRCs Near-Term Task Force report states that EOPs typically cover accidents to the point of loss of core cooling and initiation of inadequate core cooling (e.g., core exit temperatures in PWRs greater than 649 degrees Celsius [1,200 degrees Fahrenheit]).199 Experimental data indicates that core-exit thermocouple measurements would not be an adequate indicator for when to safely transition from EOPs to SAMGs.200 Two of the main conclusions from experiments are: 1) that core-exit temperature measurements display in all cases a signi"cant delay (up to several hundred seconds) and: 2) that core-exit temperature measurements are always signi"cantly lower (up to several hundred degrees Celsius) than the actual maximum cladding temperature.201 In an experiment simulating a severe accidentLOFT LP-FP-2core-exit temperatures were measured at approximately 800°F when in-core fuel-cladding temeratures exceeded 3300°F.202 In a severe accident, plant operators are supposed to implement SAMGs before the onset of the rapid zirconium-steam reaction, which leads to thermal runaway in the reactor core. Clearly, using core-exit thermocouple measurements in order to detect inadequate core cooling or uncovering of the core would be neither reliable nor safe. For example, PWR operators could end up re-"ooding an overheated core simply because they did not know the actual condition of the core. Unintentionally re-"ooding an overheated core could generate hydrogen, at rates as high as effectiveness.203 Core-exit thermocouples are not installed in BWRs. In a severe accident involving this type of reactor, plant operators are supposed to detect inadequate core cooling or uncovering of the core by measuring the water level in the reactor core.

However, after the onset of core damage BWR reactor water level measurements are unreliable; and can read erroneously high in low-pressure accidents, like large-break LOCAs, and when there are high drywell temperatures.204 In the Fukushima Daiichi accident, plant operators did not know the actual condition of the reactor cores of Units 1, 2, and 3. In a December 2011 article, Saloman Levya former GE engineer-manager for BWRs205stated his judgment that in the Fukushima Daiichi accident, plant operators should have recognized that water level measurements were unreliable and that reactor and containment pressures as well as the wetwell water temperature would be superior indicators of the state of the core. According to Levy, The reactor and the containment pressures will rise faster when hydrogen is produced. Increased reactor and containment pressure rates and wetwell [water] temperature rises con"rm accelerated core melt.206 Yet what Levy recommends is not a solution to the problem of identifying the correct time to transition to SAMGs in a BWR severe accident, because the rapid zirconium-steam reaction would have already commenced by the time operators con"rmed an accelerated core melt.

MONITORING FOR THE PRESENCE OF OXYGEN AND HYDROGEN The NRC requires that BWR Mark I and Mark II units operate with oxygen monitors installed in their primary containments in order to con"rm that the containment remains inerted during operation. In a severe accident, if a primary containment were to become de-inerted, severe accident management strategies, such as purging and venting, would need to be considered.207 The NRC also requires that all licensed plants operate with the ability to monitor hydrogen concentrations in their containments. However, in 2003, the NRC reclassi"ed hydrogen monitors (and oxygen monitors) as non-safety-related equipment,208, 209 meaning that this equipment does not have to undergo full quali"cation (including seismic quali"cation), does not have redundancy, and does not require onsite (standby) power.

In severe accidents, hydrogen monitors would be used to help assess the degree of core damage that had occurred and to help with accident management. For example, BWR Mark IIIs use hydrogen monitors to help guide emergency operating procedures: Hydrogen igniters would not be used In scenarios in which hydrogen reached concentrations that would threaten containment integrity if the hydrogen were to combust.

BWR Mark I and Mark IIs operate with hydrogen monitors installed in their inerted primary containments yet do not have such monitors in their secondary containments.

David Lochbaum of the Union of Concerned Scientists has cautioned that [t]he inability to monitor hydrogen concentrations could cause [plant] operators to not vent

[BWR Mark I and Mark II] reactor buildings, thus leading to ignitions resulting in loss of secondary containment integrity. He states further that without the ability to monitor hydrogen, operators could preemptively vent the reactor buildings when it was not necessary to do so, which would also cause radioactive releases.210

37 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents Figure 16: Cutaway View of PWR Pressure Vessel and Core of Korean Standard Nuclear Power Plant Plus (KSNP +)

Source: econtent.unm.edu/cdm/search/collection/nuceng Deployed at Shin-Kori 1 and 2; Shin-Wolsong 1 and 2, South Korea.

Two-Loop PWR design based on U.S.

Combustion Engineering System 80 +.

To control the reactor, dozens of control rod extensions (2) must penetrate the vessel closure head (3) via nozzles (1) so that control rods can be withdrawn or inserted to control the "ssion reaction in nuclear fuel assemblies (8).

Highly pressurized water in the primary cooling loop enters the reactor vessel at (7) and exits at (5), the site of coolant temperature measurements that are supposed to guide operator actions in an accident.

In 1983, the NRC issued an order requiring that in a severe accident, hydrogen monitors function within 30 minutes after coolant water is injected into the reactor vessel; in 1998, the NRC determined that the 30-minute requirement can be overly burdensome and imposed a 90-minute requirement, instead.211 The NRC seems to believe that all severe accidents would be slow-moving station-blackout accidentsa complete loss of grid-supplied and backup onsite alternating current powerlike the Fukushima Daiichi accident; it does not consider that fast-moving accidents are also possible.

Despite Fukushima Daiichis three devastating hydrogen explosions, the NRC has relegated severe-accident hydrogen safety issues to the least proactive stage of its post-Fukushima regulatory responses to the accident (termed Tier 3). NRDC believes that the NRC should reconsider its approach and promptly address severe accident safety issues involving hydrogen. In this section we outline a number of safety initiatives that the NRC should pursue to reduce the risk of hydrogen explosions in severe accidents.

38 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents Figure 17: GE Boiling Water Reactor (BWR) Model 6 Reactor Vessel Note that control rod blades on the bottom must be hydraulically driven upward into the core, rather than dropping from above as they do in a PWR.

Source: USNR Technical Training Center Reactor Concepts Manual: Boiling Water Reactor (BWR) Systems, www.nrc.gov/reading-rm/basic-ref/teachers/03.pdf

39 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents Figure 18 Source: Reactor Concepts Manual, Boiling Water Reactor Systems, USNRC, Technical Training Center, www.

nrc.gov/reading-rm/basic-ref/teachers/03.pdf

40 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents A. DEVELOP AND EXPERIMENTALLY VALIDATE COMPUTER SAFETY MODELS THAT WOULD BE CAPABLE OF CONSERVATIVELY PREDICTING RATES OF HYDROGEN GENERATION IN SEVERE ACCIDENTS The NRC needs to acknowledge that its existing computer safety models underpredict the rates of hydrogen generation that occur in severe accidents. The NRC should conduct a series of experiments with multi-rod bundles of zirconium alloy fuel rod simulators and/or (actual) fuel rods as well as study the full set of existing experimental data. The NRCs objective in this effort should be to develop models capable of predicting with greater accuracy the rates of hydrogen generation that occur in severe accidents.

B. ASSESS THE SAFETY OF EXISTING HYDROGEN RECOMBINERS, AND POTENTIALLY DISCONTINUE THE USE OF PARS UNTIL TECHNICAL IMPROVEMENTS ARE DEVELOPED AND CERTIFIED Experimentation and research should be conducted in order to improve the performance of PARs so that they would not malfunction and incur ignitions in the elevated hydrogen concentrations that occur in severe accidents. Some experimentation and research has already been conducted; however, the problem of PARs incurring ignitions in elevated hydrogen concentrations remains unresolved.

The NRC and European regulators should also perform safety analyses to determine if existing PARs should be removed from plant containments. It is possible such analyses would "nd that removing PARs would help improve safety in the event of a severe accident. Until PARs are developed that do not pose a risk of ignitions in elevated hydrogen concentrations, the NRC and European regulators should also review whether to replace PARs with electrically powered thermal hydrogen recombiners. However, this could prove costly, and thermal hydrogen recombiners would not function in a station-blackout accident unless provided with their own independent train of emergency power.

In a severe accident, plant operators would be able to turn off thermal recombiners in order to prevent them from operating in elevated hydrogen concentrations.

However, to safely operate thermal recombiners, operators would be required to have instrumentation providing timely information on the local hydrogen concentrations throughout the containment.

C. SIGNIFICANTLY IMPROVE EXISTING OXYGEN AND HYDROGEN MONITORING INSTRUMENTATION The NRC should reclassify oxygen and hydrogen monitors as safety-related equipment that has undergone full quali"cation (including seismic quali"cation), has redundancy, and has its own independent train of emergency electrical power. These recommendations are in accordance with the conclusions of the NRCs Advisory Committee on Reactor Safeguards (ACRS), which stated that [t]he experience at Fukushima showed that essential reactor and containment instrumentation should be enhanced to better withstand beyond-design basis accident conditions and that [r]obust and diverse instrumentation that can better withstand severe accident conditions is needed to diagnose, select, and implement accident mitigation strategies and monitor their effectiveness.212 The NRC should require that, after the onset of a severe accident, hydrogen monitors be functional within a time frame that enables timely detection of quantities of hydrogen indicative of core damage and a potential threat to containment integrity. The current requirement that hydrogen monitors be functional within 90 minutes of the injection of coolant water into the reactor vessel is clearly inadequate for protecting public and plant worker safety.

NRDC supports the Union of Concerned Scientists request to the NRC regarding hydrogen-monitoring instrumentation.

The NRC should require that hydrogen monitoring instrumentation be installed in 1) BWR Mark I and Mark II secondary containments, 2) the fuel handling buildings of PWRs and BWR Mark IIIs, and 3) any other plant structure where it would be possible for hydrogen to enter.

D. UPGRADE CURRENT CORE DIAGNOSTIC CAPABILITIES IN ORDER TO BETTER SIGNAL TO PLANT OPERATORS THE CORRECT TIME TO TRANSITION FROM EMERGENCY OPERATING PROCEDURES TO SEVERE ACCIDENT MANAGEMENT GUIDELINES The NRC should require plants to operate with thermocouples placed at different elevations and radial positions throughout the reactor core to enable plant operators to accurately measure a wide range of temperatures inside the core under both typical and accident conditions.

In the event of a severe accident, in-core thermocouples would provide plant operators with crucial information to help them track the progression of core damage and manage the accidentfor example, indicating the correct time to transition from EOPs to SAMGs.

V. NRDCS RECOMMENDATIONS FOR REDUCING THE RISK OF HYDROGEN EXPLOSIONS IN SEVERE NUCLEAR ACCIDENTS

41 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents E. REQUIRE ALL NUCLEAR POWER PLANTS TO CONTROL THE TOTAL QUANTITY OF HYDROGEN THAT COULD BE GENERATED IN A SEVERE ACCIDENT The NRC should require all PWRs (with large dry containments, subatmospheric containments, and ice condenser containments) and BWR Mark IIIs to operate with systems for combustible gas control that would effectively and safely control the total quantity of hydrogen that could potentially be generated in different severe accident scenarios (this value is different for PWRs and BWRs). The NRC should also require the same for BWR Mark I and Mark II unless it is demonstrated that venting (without causing signi"cant radiological releases) their inerted containments would effectively and safely control the hydrogen generated in severe accidents. Systems for combustible gas control also need to effectively and safely control the total quantity of hydrogen that could potentially be generated at all times throughout different severe accident scenarios, taking into account the potential rates of hydrogen generation.

Additionally, the NRC should require all PWRs and BWR IIIs to operate with systems for combustible gas control that would be capable of preventing local concentrations of hydrogen in the containment or other structures from reaching levels that would support combustions, de"agrations, or detonations that could cause a loss of containment integrity and/or necessary accident mitigating features.

Furthermore, the NRC should require licensees of PWRs with ice condenser containments and BWR Mark IIIs (and any other nuclear power plants that would operate with hydrogen igniter systems) to perform analyses demonstrating that their hydrogen igniter systems would effectively and safely mitigate hydrogen in different severe accident scenarios. Licensees unable to do so should be ordered to upgrade their systems to adequate levels of performance.

F. REQUIRE THAT DATA FROM LEAK RATE TESTS BE USED TO HELP PREDICT THE HYDROGEN LEAK RATES OF THE PRIMARY CONTAINMENT OF EACH BWR MARK I AND MARK II LICENSED BY THE NRC IN DIFFERENT SEVERE ACCIDENT SCENARIOS The NRC should require that data from overall leak rate tests and local leak rate testsalready required by Appendix J to Part 50 for determining how much radiation would be released from the containment in a design basis accident be used to help predict hydrogen leak rates from the primary containment of each BWR Mark I and Mark II licensed by the NRC under different severe accident scenarios. If data from an individual leak rate test indicates that dangerous quantities of explosive hydrogen gas would leak from a primary containment in a severe accident, the plant owner would be required to repair the containment.

NRDC also recommends that the NRC require that overall leak rate tests and local leak rate tests be conducted without allowing repairs to be made immediately before the testing of potential leakage paths, such as containment welds, valves, "ttings, and components which penetrate containment.213 Additionally, NRDC recommends that the NRC reevaluate its plan to extend the intervals of overall and local leak rate tests to once every 15 years and 75 months, respectively.214 (There are two types of local leak rate tests; Type B is required at least once every 10 years.) The NRC needs to conduct safety analyses that take into account the relatively greater vulnerability of BWR Mark I and Mark II primary containments to hydrogen leakage. It is probable that the intervals between leak rate tests would need to be shortened rather than extended.

The NRC also needs to consider that in the past it was a common practice to make repairs to valves immediately before conducting as found local leak rate tests. Clearly, such tests do not provide accurate assessments of preexisting containment leak rates. The NRC needs to investigate whether repairs have been recently made immediately before conducting as found tests. More important, the NRC needs to fully integrate into its regulatory role the fact that in the Fukushima Daiichi accident, hydrogen leaked from the primary containments of Units 1, 2, and 3 and detonated in the secondary containments of Units 1, 3, and 4, causing large radiological releases.

42 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents ENDNOTES 1 In this report we frequently refer to severe nuclear accidents:

i.e., accidents in which there is severe damage to the reactor corefor example, a partial core meltdown. A severe nuclear accident could be caused by a natural disaster, mechanical failure, or plant operator errors. The accidents at Three Mile Island Unit 2, Chernobyl Unit 4, and Fukushima Daiichi Unit 1, 2, and 3 were all severe accidents.

2 As nuclear safety expert David Lochbaum has noted, Secondary containment is designed to have limited leakageinto the reactor building. The secondary containment leak test entails starting the standby gas treatment system. This system features fans, ductwork, dampers, and "lter trains that draw air from the reactor building and refueling "oors.

This "ltered air is discharged via an elevated release point. The "lter trains are tested periodically to see if they remove over 99% of the radioactive particles from the discharge stream. Note to author from David L.

Lochbaum, nuclear safety expert with the Union of Concerned Scientists, 01-06-2014.

3 Since hydrogen is a noncondensable gas, it will accumulate in the air space above the water surface of the suppression pool. When the differential pressure between the drywell and wetwell gets too great, vacuum breakers open automatically to transport hydrogen gas from the wetwell into the drywell, where it can accumulate or leak out into the surrounding reactor building.

4 Note to author from David L. Lochbaum, nuclear safety expert with the Union of Concerned Scientists, January 6, 2014.

5 This request to the NRC was "rst made by the Union of Concerned Scientists.

6 Typical operating BWR and PWR coolant pressures are approximately 1000-1050 pounds per square inch (psi) and approximately 2250 psi, respectively. See International Atomic Energy Agency (IAEA),

Assessment and Management of Ageing of Major Nuclear Power Plant Components Important to Safety: BWR Pressure Vessels, IAEA-TECDOC-1470, October 2005, p. 7; and IAEA, Assessment and Management of Ageing of Major Nuclear Power Plant Components Important to Safety: PWR Pressure Vessels, IAEA-TECDOC-1120, October 1999, p. 5.

7 The NRCs de"nition of the reactor coolant system: The system used to remove energy from the reactor core and transfer that energy either directly or indirectly to the steam turbine. See www.nrc.gov/reading-rm/

basic-ref/glossary/reactor-coolant-system.html.

8 Typical operating BWR and PWR coolant temperatures are 540°-550°F and 540°-620°F, respectively. See IAEA, Assessment and Management of Ageing of Major Nuclear Power Plant Components Important to Safety:

BWR Pressure Vessels, IAEA-TECDOC-1470, October 2005, p. 7; and IAEA, Assessment and Management of Ageing of Major Nuclear Power Plant Components Important to Safety: PWR Pressure Vessels, IAEA-TECDOC-1120, October 1999, p. 5.

9 For consistency, this report will use the term zirconium to refer to all the various types of zirconium alloys that make up fuel cladding. Zircaloy, ZIRLO, and M5 are particular types of zirconium alloy fuel cladding. In a LOCA environment, the oxidation behavior of the different fuel cladding materials, with various zirconium alloys, would be similar because of their shared zirconium content.

10 The NRCs de"nition of a design basis accident: A postulated accident that a nuclear facility must be designed and built to withstand without loss to the systems, structures, and components necessary to ensure public health and safety. See www.nrc.gov/reading-rm/basic-ref/glossary/design basis-accident.html.

11 The NRC states that beyond design basis accident is a term used as a technical way to discuss accident sequences that are possible but were not fully considered in the design process because they were judged to be too unlikely. (In that sense, they are considered beyond the scope of design basis accidents that a nuclear facility must be designed and built to withstand.) See www.nrc.gov/reading-rm/basic-ref/glossary/

beyond-design basis-accidents.html.

12 The coolant water slows down or moderates the kinetic energy of the neutrons produced by "ssion, enabling a self-sustaining "ssion reaction in the uranium isotope 235U, which makes up about 4 percent of the uranium in the fuel.

13 In a PWR, fuel rod temperatures could exceed 1830°F within 60 seconds; at a BWR, fuel rod temperatures could exceed 1830°F within three minutes.

14 The equation for the reaction is written as Zr + 2H2O ZrO2 +

2H2 + energy. The energy (heat) generated by the reaction is about 6.5 megajoules per kilogram (kg) of Zr reacted.

15 Randall O. Gauntt, Sandia National Laboratories, email to Jason Schaperow of NRC, Re: Cladding Behavior Under Steam and Air Conditions, January 31, 2000, available at: www.nrc.gov, Electronic Reading Room, ADAMS Documents, Accession Number: ML010680338.

16 In the TMI-2 accident, cooling water was discharged from the pilot-operated relief valve, which was stuck open.

17 Robert E. Henry held research positions at Argonne National Laboratory during the decade leading up to the TMI-2 accident and was associate director of the Reactor Analysis and Safety Division at Argonne when he became involved in the evaluation of the TMI-2 accident, as part of a group formed by the Electric Power Research Institutes Nuclear Safety Analysis Center (NSAC).

18 Robert E. Henry, presentation slides from TMI-2: A Textbook in Severe Accident Management, 2007 ANS/ENS International Meeting, November 11, 2007; seven of these presentation slides are in Attachment 2 of the transcript from 10 C.F.R. 2.206 Petition Review Board Re:

Vermont Yankee Nuclear Power Station, July 26, 2010, available at:

ADAMS Documents, Accession Number: ML102140405, Attachment 2.

19 Robert E. Henry, presentation slides from TMI-2: A Textbook in Severe Accident Management.

20 It is acknowledged that runaway oxidation occurred in the TMI-2 accident; however, the temperature at which it commenced is unknown, because there is no thermocouple data from the hot spots of the fuel assemblies. NRDC does not intend to present Robert E. Henrys postulation that runaway oxidation of zirconium cladding by steam commenced at 1832°F in the TMI-2 accident as evidence that a runaway reaction did in fact commence at 1832°F.

21 Robert E. Henry, presentation slides from TMI-2: A Textbook in Severe Accident Management.

22 NRC, Feasibility Study of a Risk-Informed Alternative to 10 CFR 50.46, Appendix K, and GDC 35, June 2001, available at: ADAMS Documents, Accession Number: ML011800519, p. 3-1.

23 Peter Hofmann, Current Knowledge on Core Degradation Phenomena, a Review, Journal of Nuclear Materials 270, Nos. 1-2 (April 1, 1999), p. 205.

24 Sherrell R. Greene, Oak Ridge National Laboratory, The Role of BWR Secondary Containments in Severe Accident Mitigation: Issues and Insights from Recent Analyses, 1988.

25 The regulation 10 C.F.R. § 50.46(b)(i) stipulates that in a postulated design basis accident, [t]he calculated maximum fuel element cladding temperature shall not exceed 2200°F.

26 E. Bachellerie et al., Generic Approach for Designing and Implementing a Passive Autocatalytic Recombiner PAR-System in Nuclear Power Plant Containments, Nuclear Engineering and Design 221, Nos.

1-3 (April 2003), p. 158 (hereinafter Designing and Implementing a PAR-System in NPP Containments).

27 Atomic Energy Commission, Safety Evaluation Report for Indian Point Nuclear Generating Unit No. 3, Docket No. 50-286, September 21, 1973, available at: www.nrc.gov, Electronic Reading Room, ADAMS Documents, Accession Number: ML072260465, p. 6-10.

28 E. Bachellerie et al., Designing and Implementing a PAR-System in NPP Containments, p. 158.

29 OECD Nuclear Energy Agency, State-of-the-Art Report on Flame Acceleration and De"agration-to-Detonation Transition in Nuclear Safety, NEA/CSNI/R(2000)7, August 2000, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML031340619, p. 6.38 (hereinafter Report on FA and DDT).

30 E. Bachellerie et al., Designing and Implementing a PAR-System in NPP Containments, p. 158.

43 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents 31 J. Star"inger, Assessment of In-Vessel Hydrogen Sources, in Projekt Nukleare Sicherheitsforschung: Jahresbericht 1999 (Karlsruhe:

Forschungszentrum Karlsruhe, FZKA-6480, 2000).

32 OECD Nuclear Energy Agency, In-Vessel Core Degradation Code Validation Matrix: Update 1996-1999, report by an OECD NEA Group of Experts, October 2000, p. 13.

33 IAEA, Mitigation of Hydrogen Hazards in Severe Accidents in Nuclear Power Plants, IAEA-TECDOC-1661, July 2011, p. 10 (hereinafter Mitigation of Hydrogen Hazards in SA).

34 This estimate is based on that fact that large BWR cores and large PWR cores have up to approximately 800 and 200 fuel assemblies, respectively (see NRC, Boiling Water Reactors (located at: http://www.

nrc.gov/reactors/bwrs.html) and NRC, Pressurized Water Reactors (located at: http://www.nrc.gov/reactors/pwrs.html)); and recent designs of BWR and PWR fuel assemblies have up to approximately 190 kg and 480 kg of initial uranium mass per assembly, respectively (see NRC, Certi"cate of Compliance No. 1014, Appendix B, Approved Contents and Design Features for the Hi-Storm 100 Cask System, (available at ADAMS No: ML13351A189), pp. 2.39, 2.44). Hence, large BWR cores and large PWR cores are estimated to have a total of approximately 152,000 kg and 96,000 kg of initial uranium mass, respectively.

35 BWRs and PWRs have up to approximately 800 and 200 fuel assemblies in their cores, respectively. NRC, Boiling Water Reactors (located at: http://www.nrc.gov/reactors/bwrs.html) and NRC, Pressurized Water Reactors (located at: http://www.nrc.gov/reactors/

pwrs.html).

36 Recent designs of BWR and PWR fuel assemblies have on the order of 96 and 264 fuel rods per assembly, respectively. Hence BWR and PWR cores can have up to approximately 76,800 and 52,800 fuel rods per core, respectively; so BWRs cores can have approximately 45 percent more fuel rods. NRC, Certi"cate of Compliance No. 1014, Appendix B, Approved Contents and Design Features for the Hi-Storm 100 Cask System, (available at ADAMS No: ML13351A189), pp. 2.39, 2.44.

37 Yasuo Hirose et al., An Alternative Process to Immobilize Intermediate Wastes from LWR Fuel Reprocessing, WM99 Conference, February 28-March 4, 1999.

38 Jae Sik Yoo and Kune Yull Suh, Analysis of TMI-2 Benchmark Problem Using MAAP4.03 Code, Nuclear Engineering and Technology 41, No. 7 (September 2009), p. 949.

39 IAEA, Mitigation of Hydrogen Hazards in SA, p. 6.

40 Report by Nuclear Energy Agency Groups of Experts, OECD Nuclear Energy Agency, In-Vessel and Ex-Vessel Hydrogen Sources, NEA/

CSNI/R(2001)15, October 1, 2001, Part I: B. Clément (IPSN), K. Trambauer (GRS), and W. Scholtyssek (FZK), Working Group on the Analysis and Management of Accidents, GAMA Perspective Statement on In-Vessel Hydrogen Sources, p. 15 (hereinafter: In-Vessel and Ex-Vessel Hydrogen Sources, Part I).

41 IAEA, Mitigation of Hydrogen Hazards in SA, p. 6.

42 Power Authority of the State of New York, Consolidated Edison Company of New York, Indian Point Probabilistic Safety Study, Vol. 8, 1982, available at: ADAMS Documents, Accession Number:

ML102520201, p. 4.3-10.

43 The volume percent of the carbon monoxide in the containment is the volume of the carbon monoxide in the containment divided by the volume of the containment multiplied by 100.

44 IAEA, Mitigation of Hydrogen Hazards in SA, p. 47.

45 Report by Nuclear Energy Agency Groups of Experts, OECD Nuclear Energy Agency, In-Vessel and Ex-Vessel Hydrogen Sources, Part I, p. 9.

46 T.J. Haste et al., Organisation for Economic Co-Operation and Development, Degraded Core Quench: A Status Report, August 1996,

p. 13.

47 L.J. Ott, Oak Ridge National Laboratory, Advanced BWR Core Component Designs and the Implications for SFD Analysis, 1997, p. 4.

48 LOFT LP-FP-2 was conducted in the Loss-of-Fluid Test Facility at Idaho National Engineering Laboratory in July 1985. The CORA and QUENCH tests were conducted at Karlsruhe Institute of Technology in Germany in the 1980s and 1990s.

49 L. J. Ott, Advanced BWR Core Component Designs and the Implications for SFD Analysis, p. 4.

50 L. J. Ott, Advanced BWR Core Component Designs and the Implications for SFD Analysis, p. 4.

51 IAEA, Mitigation of Hydrogen Hazards in SA, p. 14.

52 OECD Nuclear Energy Agency, In-Vessel Core Degradation Code Validation Matrix: Update 1996-1999, report by an OECD NEA Group of Experts, October 2000, p. 210.

53 G. Bandini et al., Presentation Slides, Progress of ASTEC Validation on Circuit Thermal-Hydraulics and Core Degradation, 3rd European Review Meeting on Severe Accident Research September 23-25, 2008, pp. 24, 28 (located at: http://www.sar-net.org/upload/4-5_bandini_

ermsar2008_1.pdf ).

54 Charles Miller et al., NRC, Recommendations for Enhancing Reactor Safety in the 21st Century: The Near-Term Task Force Review of Insights from the Fukushima Daiichi Accident, SECY-11-0093, July 12, 2011, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML111861807, p. 3.

55 Burton Richter et al., Report of the Fuel Cycle Research and Development Subcommittee of the Nuclear Energy Advisory Committee, June 2012, p. 5.

56 A.P. Ramsey, T. McKrell, and M.S. Kazimi, Silicon Carbide Oxidation in High Temperature Steam, Advanced Nuclear Power Program, MIT-ANP-TR-139, 2011, abstract.

57 A triplex cladding design consists of three layers of material surrounding the nuclear fuel: an inner layer of dense silicon carbide for "ssion gas retention, a central composite layer of wound silicon carbide "bers to enhance mechanical performance, and an outer environmental barrier coating to enhance corrosion resistance. See Ken Yueh, David Carpenter, and Herbert Feinroth, Clad in Clay, Nuclear Engineering International (January 2010), p. 14-15.

58 Ken Yueh, David Carpenter, and Herbert Feinroth, Clad in Clay, Nuclear Engineering International (January 2010), p. 14.

59 A 2011 Idaho National Laboratory report states that the thermal conductivity of silicon carbide can exceed the value of zirconium before irradiation. Extended irradiation tends to lower the [thermal] conductivity to a value half to one-third that of zirconium. See George Grif"th, Idaho National Laboratory, U.S. Department of Energy Accident Resistant SiC Clad Nuclear Fuel Development, INL/CON-11-23186, October 2011.

60 David M. Carpenter, Gordon E. Kohse, and Mujid S. Kazimi, An Assessment of Silicon Carbide as a Cladding Material for Light Water Reactors, Advanced Nuclear Power Program, MIT-ANP-TR-132, November 2010, abstract.

61 Electric Power Research Institute, Silicon Carbide Provides Opportunity to Enhance Nuclear Fuel Safety, EPRI Progress Report, September 2011, mydocs.epri.com/docs/CorporateDocuments/

Newsletters/NUC/2011-09/09d.html.

62 Burton Richter et al., Report of the Fuel Cycle Research and Development Subcommittee of the Nuclear Energy Advisory Committee, June 2012, p. 6.

63 INPO, Report on the Fukushima Dai-ichi Accident, p. 24.

64 The author is indebted to David Lochbaum of the Union of Concerned Scientists for raising this point.

65 E. Studer et al., Kurchatov Institute, Assessment of Hydrogen Risk in PWR, [undated], p. 1.

66 Allen L. Camp et al., Sandia National Laboratories, Light Water Reactor Hydrogen Manual, NUREG/CR-2726, August 1983, p. 4-107.

67 PWR ice condenser and BWR Mark III containments have volumes of approximately 1.2 x 106 cubic feet and 1.3 x 106 cubic feet, respectively; PWR large dry containments have a volume of approximately 2.2 x 106 cubic feet. PWRs with ice condenser containments and BWR Mark IIIs have containment design pressures of approximately 20 psig and 15 psig, respectively; PWR large dry containments have a design pressure of approximately 53 psig. See M.F. Hessheimer et al.,

Containment Integrity Research at SNL, NUREG/CR-6906, p. 24.

44 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents 68 Charles Miller et al., Recommendations for Enhancing Reactor Safety in the 21st Century: The Near-Term Task Force Review of Insights from the Fukushima Daiichi Accident, p. 42.

69 These analyses were conducted for different PWRs, which have containments with different free volumes and different quantities of fuel cladding (active length) in their cores; the containments of these PWRs also have different design pressures and estimated failure pressures.

Therefore, the results of these analyses do not directly apply to all PWRs. However, they do provide a general idea of the magnitude of the pressure spikes that a PWR containment might be expected to incur if an explosionof the quantity of hydrogen generated from a zirconium-steam reaction of 100 percent of the active fuel cladding lengthwere to occur in the event of a severe accident.

70 T.G. Colburn, NRC, letter regarding Three Mile Island Unit 1, license amendment from hydrogen control requirements, February 8, 2002,, Safety Evaluation by the Of"ce of Nuclear Reactor Regulation, Related to Amendment No. 240 to Facility Operating License No. DPR-50, Three Mile Island Unit 1, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML020100578, p. 5.

71 Kahtan N. Jabbour, NRC, letter regarding Turkey Point Units 3 and 4, exemption from hydrogen control requirements, December 12, 2001,, Safety Evaluation by the Of"ce of Nuclear Reactor Regulation, Turkey Point Units 3 and 4, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML013390647, p. 3.

72 Pounds per square inch gauge is the value of a given pressure relative to the atmospheric pressure at sea level (14.7 pounds per square inch).

73 Pounds per square inch absolute is the value of a given pressure relative to a vacuum (0.0 pounds per square inch).

74 Power Authority of the State of New York, Consolidated Edison Company of New York, Indian Point Probabilistic Safety Study, Vol.

8, 1982, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML102520201, p. 4.2-1 and Appendix 4.4.1, p. 14.

75 Power Authority of the State of New York, Consolidated Edison Company of New York, Indian Point Probabilistic Safety Study, Vol.

8, 1982, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML102520201, p. 4.3-22, 4.3-23.

76 M.F. Hessheimer et al., Containment Integrity Research at SNL, NUREG/CR-6906, p. 28; the source of this quote is NRC, Severe Accident Risks: An Assessment or Five U.S. Nuclear Power Plants, NUREG-1150, Vol. 3, January 1991, Appendix D, Responses to Comments on First Draft of NUREG-1150, p. D-22.

77 IAEA, Mitigation of Hydrogen Hazards in SA, p. 61-62.

78 M. F. Hessheimer et al., Containment Integrity Research at SNL, NUREG/CR-6906, p. 8.

79 IAEA, Mitigation of Hydrogen Hazards in SA, p. 62.

80 Institute of Nuclear Power Operations (INPO), Special Report on the Nuclear Accident at the Fukushima Daiichi Nuclear Power Station, INPO 11-005, November 2011, p. 9, 12, 21, 24, 25, 32, 37, 79, 85, 86, 96.

81 Institute of Nuclear Power Operations (INPO), Special Report on the Nuclear Accident at the Fukushima Daiichi Nuclear Power Station, INPO 11-005, November 2011, p. 9.

82 The volume percent of the hydrogen in the containment is the volume of the hydrogen in the containment divided by the volume of the containment multiplied by 100.

83 IAEA, Mitigation of Hydrogen Hazards in SA, p. 35.

84 IAEA, Mitigation of Hydrogen Hazards in SA, p. 63. Containment spray systems are typically located inside the roof dome of PWR containments and are designed to spray cool water to condense the steam and reduce internal gas pressure within the containment. See Figure 8.

85 IAEA, Mitigation of Hydrogen Hazards in SA, p. 34.

86 IAEA, Mitigation of Hydrogen Hazards in SA, p. 33.

87 Kahtan N. Jabbour, NRC, letter regarding Turkey Point Units 3 and 4, exemption from hydrogen control requirements, December 12, 2001,, Safety Evaluation by the Of"ce of Nuclear Reactor Regulation, Turkey Point Units 3 and 4, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML013390647, p. 4.

88 W. E. Lowry et al., Lawrence Livermore National Laboratory, Final Results of the Hydrogen Igniter Experimental Program, NUREG/CR-2486, February 1982, p. 4.

89 IAEA, Mitigation of Hydrogen Hazards in SA, p. 35.

90 OECD Nuclear Energy Agency, Report on FA and DDT, p. 1.2.

91 IAEA, Mitigation of Hydrogen Hazards in SA, p. 33.

92 D.W. Stamps et al., Sandia National Laboratories, Hydrogen-Air-Diluent Detonation Study for Nuclear Reactor Safety Analyses, NUREG/

CR-5525, January 1991, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML071700388, p. 43.

93 OECD Nuclear Energy Agency, Carbon Monoxide-Hydrogen Combustion Characteristics in Severe Accident Containment Conditions:

Final Report, NEA/CSNI/R(2000)10, 2000, p. 18.

94 Helmut Karwat, Igniters to Mitigate the Risk of Hydrogen ExplosionsA Critical Review, Nuclear Engineering and Design 118, 1990, p. 267.

95 IAEA, Mitigation of Hydrogen Hazards in SA, p. 113.

96 Advisory Committee on Reactor Safeguards, 586th Meeting, September 8, 2011, available at: ADAMS Documents, Accession Number:

ML11256A117, p. 95.

97 A number of hydrogen combustion experiments have been conducted at Sandia National Laboratories; for example, such experiments were conducted in the 1980s at the FLAME facilitya rectangular channel 100 feet long, 8 feet high, and 6 feet wide. M.P. Sherman et al., Sandia National Laboratories, FLAME Facility: The Effect of Obstacles and Transverse Venting on Flame Acceleration and Transition to Detonation for Hydrogen-Air Mixtures at Large Scale, NUREG/CR-5275, available at:

ADAMS Documents, Accession Number: ML071700076, abstract.

98 Most experiments investigating the lower hydrogen concentration limits at which de"agration-to-detonation transition occurs have been conducted in detonation tubes; such tubes have been 39 to 70 feet long and about 11 to 17 inches in diameter. OECD Nuclear Energy Agency, Report on FA and DDT, p. 3.5.

99 OECD Nuclear Energy Agency, International Standard Problem ISP-47 on Containment Thermal Hydraulics: Final Report, NEA/CSNI/R(2007)10, September 2007, p. 7.

100 Westinghouse, AP1000 Design Control Document, Rev. 19, Tier 2 Material, Chapter 19, Probabilistic Risk Assessment, Sections 19.41 to 19.54, June 13, 2011, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML11171A409, p. 19.41-2.

101 Charles Miller et al., Recommendations for Enhancing Reactor Safety, SECY-11-0093, p. 42.

102 OECD Nuclear Energy Agency, SOAR on Containment Thermal Hydraulics and Hydrogen Distribution, 1999, p. 18.

103 OECD Nuclear Energy Agency, Report on FA and DDT, p. 1.6.

104 NRC, Notice Regarding Eliminating the Hydrogen Recombiner Requirement, Federal Register 68, No. 186 (September 25, 2003), p.

55419.

105 E. Bachellerie et al., Designing and Implementing a PAR-System in NPP Containments, p. 158.

106 Indian Point Energy Center, License Renewal Application, Technical Information, 2.0, Scoping and Screening Methodology for Identifying Structures and Components Subject to Aging Management Review and Implementation Results, p. 2.3-61.

107 E. Bachellerie et al., Designing and Implementing a PAR-System in NPP Containments, p. 159.

45 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents 108 In January 1985, the NRC began requiring plant owners to install hydrogen control systems in the containments of such designs. See NRC Policy Statement, Combustible Gas Control in Containment, Federal Register, Vol. 68, No. 179, September 16, 2003, p. 54124.

109 PWRs with ice condenser containments and BWR Mark IIIs have containment design pressures of approximately 20 psig and 15 psig, respectively. See M.F. Hessheimer et al., Containment Integrity Research at SNL, NUREG/CR-6906, p. 24.

110 Allen L. Camp et al., Sandia National Laboratories, Light Water Reactor Hydrogen Manual, NUREG/CR-2726, August 1983, p. 4-107.

111 NRC Policy Statement, Combustible Gas Control in Containment, Federal Register 68, No. 179 (September 16, 2003), p. 54124.

112 In December 1981, the NRC began requiring plant owners to operate BWR Mark Is and Mark IIs with inerted primary containments. See NRC Policy Statement, Combustible Gas Control in Containment, Federal Register, Vol. 68, No. 179, September 16, 2003, p. 54123.

113 Federal Register 68, No. 179 (September 16, 2003), p. 54141.

114 IAEA, Mitigation of Hydrogen Hazards in SA, p. 74.

115 BWR Mark I and Mark II primary containments have volumes of approximately 0.28 x 106 cubic feet and 0.4 x 106 cubic feet, respectively; these are about one-eighth and one-sixth the volumes, respectively, of typical PWR large dry containments. See M.F. Hessheimer et al.,

Containment Integrity Research at SNL, NUREG/CR-6906, p. 24.

116 NRC, Order Modifying Licenses with Regard to Reliable Hardened Containment Vents, EA-12-050, March 12, 2012, available at: www.

nrc.gov, NRC Library, ADAMS Documents, Accession Number:

ML12054A694.

117 See NRC, Installation of a Hardened Wetwell Vent, Generic Letter 89-16, September 1, 1989, p. 1. Generic Letter 89-16 states that the Commission has directed the [NRC] staff to approve installation of a hardened vent under the provisions of 10 CFR 50.59 [Changes, Tests, and Experiments] for licensees, who on their own initiative, elect to incorporate this plant improvement.

118 NRC, Installation of a Hardened Wetwell Vent, Generic Letter 89-16, September 1, 1989, p. 1.

119 NRC Policy Statement, Combustible Gas Control in Containment, Federal Register 68, No. 179 (September 16, 2003), p. 54128; and see NRC Policy Statement Severe Reactor Accidents Regarding Future Designs and Existing Plants, Federal Register 50, No. 153 (August 8, 1985), p. 32138-32150.

120 Westinghouse, AP1000 Design Control Document, Rev. 19, Tier 2 Material, Chapter 19, Probabilistic Risk Assessment, Sections 19.34 to 19.35, June 13, 2011, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML11171A405, p. 19.34-4.

121 M.P. Sherman et al., Sandia National Laboratories, FLAME Facility:

The Effect of Obstacles and Transverse Venting on Flame Acceleration and Transition to Detonation for Hydrogen-Air Mixtures at Large Scale, NUREG/CR-5275, April 1989, available at: ADAMS Documents, Accession Number: ML071700076, p. 2.

122 Westinghouse, AP1000 Design Control Document, Rev. 19, Tier 2 Material, Chapter 19, Probabilistic Risk Assessment, Sections 19.41 to 19.54, June 13, 2011, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML11171A409, p. 19.41-4.

123 D.W. Stamps et al., Sandia National Laboratories, Hydrogen-Air-Diluent Detonation Study for Nuclear Reactor Safety Analyses, NUREG/

CR-5525, January 1991, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML071700388, p. 43.

124 G. Ciccarelli et al., Brookhaven National Laboratory, The Effect of Initial Temperature on Flame Acceleration and De"agration-to-Detonation Transition Phenomenon, NUREG/CR-6509, May 1998, available at:

www.nrc.gov, NRC Library, ADAMS Documents, Accession Number:

ML071650380, p. 1.

125 D.W. Stamps et al., Sandia National Laboratories, Hydrogen-Air-Diluent Detonation Study for Nuclear Reactor Safety Analyses, NUREG/

CR-5525, January 1991, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML071700388, p. 43.

126 NRC, Proceedings of the U.S. Nuclear Regulatory Commission Eighteenth Water Reactor Safety Information Meeting, NUREG/CP-0114, Vol. 2, April 1991. S.B. Dorofeev et al., Evaluation of the Hydrogen Explosion Hazard, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML042250131, p. 328.

127 Advisory Committee on Reactor Safeguards, 586th Meeting, September 8, 2011, available at: ADAMS Documents, Accession Number:

ML11256A117, p. 95.

128 Peter Hofmann, Current Knowledge on Core Degradation Phenomena, a Review, Journal of Nuclear Materials 270, Nos. 1-2 (April 1, 1999), p. 208.

129 Westinghouse, AP1000 Design Control Document, Rev. 19, Tier 2 Material, Chapter 19, Probabilistic Risk Assessment, Appendix 19D, Equipment Survivability Assessment, June 13, 2011, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number:

ML11171A416, p. 19D-3.

130 Westinghouse, AP1000 Design Control Document, Rev. 19, Tier 2 Material, Chapter 1, Introduction and General Description of Plant, Section 1.9, June 13, 2011, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML11171A337, p. 1.9-80.

131 K. Fischer, et al., Hydrogen Removal from LWR Containments by Catalytic-Coated Thermal Insulation Elements (THINCAT), Nuclear Engineering and Design 221 (January 2003), p. 146.

132 Westinghouse quali"es that the AP1000 containments hydrogen igniter system, if operational during a severe accident, will burn hydrogen as soon as the lean upward "ammability limits are met [emphasis added]. See Westinghouse, AP1000 Design Control Document, Rev.

19, Tier 2 Material, Chapter 19, Probabilistic Risk Assessment, Sections 19.41 to 19.54, p. 19.41-4.

133 NRC, letter to all licensees holding operating licenses and construction permits for nuclear power plants, except licensees of BWR Mark I plants, Completion of Containment Performance Improvement Program, Etc., July 6, 1990, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML031210418, p. 1.

134 D.W. Stamps et al., Sandia National Laboratories, Hydrogen-Air-Diluent Detonation Study for Nuclear Reactor Safety Analyses, NUREG/

CR-5525, January 1991, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML071700388, p. 53-p. 54.

135 K. Fischer et al., Hydrogen Removal from LWR Containments by Catalytic-Coated Thermal Insulation Elements (THINCAT), Nuclear Engineering and Design 221 (January 2003), p. 146.

136 E. Bachellerie et al., Designing and Implementing a PAR-System in NPP Containments, p. 159.

137 OECD Nuclear Energy Agency, Report on FA and DDT, p. 1.6.

IAEA, Mitigation of Hydrogen Hazards in SA, p. 66.

138 Eckardt, Bernd A., Michael Blase, and Norbert Losch, Containment hydrogen control and "ltered venting design and implementation, Framatome ANP, Offenbach, Germany (2002), p. 3-4.

139 Sonnenkalb, Martin, and Gerhard Poss, The international test programme in the THAI Facility and its use for code validation, EUROSAFE Forum, Brussels, Belgium (2009), pp. 16-17.

140 In January 1985, the NRC began requiring plant owners to install hydrogen control systems in the containments of such designs. See NRC Policy Statement, Combustible Gas Control in Containment, Federal Register, Vol. 68, No. 179, September 16, 2003, p. 54124.

141 Helmut Karwat, Igniters to Mitigate the Risk of Hydrogen ExplosionsA Critical Review, Nuclear Engineering and Design 118, 1990, p. 268.

142 OECD Nuclear Energy Agency, Report on FA and DDT, p. 1.10.

143 Xiao Jianjun, Zhou Zhiwei, and Jing Xingqing, Safety Implementation of Hydrogen Igniters and Recombiners for Nuclear Power Plant Severe Accident Management, Tsinghua Science and Technology 11, No. 5 (October 2006), p. 557.

46 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents 144 NRC, letter to all licensees holding operating licenses and construction permits for nuclear power plants, except licensees of BWR Mark I plants, Completion of Containment Performance Improvement Program, Etc., July 6, 1990, p. 1.

145 Hydrogen gas condenses to a liquid at approximately -423°F at the atmospheric pressure at sea level (14.7 psia).

146 IAEA, Mitigation of Hydrogen Hazards in SA, p. 10.

147 J. Star"inger, Assessment of In-Vessel Hydrogen Sources, in Projekt Nukleare Sicherheitsforschung: Jahresbericht 1999 (Karlsruhe:

Forschungszentrum Karlsruhe, FZKA-6480, 2000).

148 NRC, NRC Information Notice 2006-01: Torus Cracking in a BWR Mark I Containment, January 12, 2006, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML053060311,, p. 1.

149 Nitrogen is used to inert BWR Mark I and Mark II primary containments.

150 T. Okkonen, OECD Nuclear Energy Agency, Non-Condensable Gases in Boiling Water Reactors, NEA/CSNI/R(94)7, May 1993, p.

4-5. For a 3300-megawatt thermal BWR Mark I, in scenarios in which hydrogen would be produced from a zirconium-steam reaction of 40 percent, 70 percent, and 100 percent of all the zirconium in the reactor core (equivalent to the quantity of hydrogen that would be produced from a zirconium-steam reaction of 72 percent, 126 percent, and 180 percent, respectively, of the active fuel cladding length), if the total quantity of noncondensable gases (including nitrogen) were to accumulate in the wetwell, the primary containments pressure would increase up to 107 psi, 161 psi, and 215 psi, respectively. See T. Okkonen, Non-Condensable Gases in Boiling Water Reactors, p. 6.

151 Appendix J to Part 50, Primary Reactor Containment Leakage Testing for Water-Cooled Power Reactors, requires preoperational and periodic leak rate tests for BWR Mark I and BWR Mark II primary containments. Leak rate tests are required for determining how much radiation would be released from the containment in a design basis accident: an accident in which a meltdown would be prevented.

152 The following calculation is done by assigning the net free air volume of Oyster Creeks Mark I primary containment301,300 cubic feetto NMP-1. (At Oyster Creek, the minimum wetwell net water volume is 82,000 cubic feet.) See GPU Nuclear Corporation and PLG, Inc., Oyster Creek Probabilistic Risk Assessment: Level 2, Volume 1, June 1992, available at: NRC Library, ADAMS Documents, Accession Number: ML060550287, p. 3.5. The typical design pressure of a BWR Mark I primary containment is 58.0 pounds per square inch gauge (psig);

see M.F. Hessheimer et al., Containment Integrity Research at SNL, NUREG/CR-6906, July 2006, p. 24. The Nine Mile Point Unit 1 test was conducted at 35.0 psig; it is assumed that the test was conducted at 70°F. The density of air at 70°F and 1 atmosphere pressure (atm)14.696 pounds per square inch absolute (psia)is 0.07495 pound per cubic foot. At 1 atm, there would be 22,582 pounds of air in the primary containment; at 35.0 psig (3.38 atm), there would be 76,329 pounds of air in the primary containment. The overall leakage rate is 0.5045 percent of the containment airs weight (385 pounds) per day. For information on the 1999 Nine Mile Point Unit 1 test, see NRC, Nine Mile Point Nuclear Station Unit No. 1Issuance of Amendment Re: One-Time Extension of Primary Containment Integrated Leakage Rate Test Interval, Attachment 2, Safety Evaluation, March 2009, available at: NRC Library, ADAMS Documents, Accession Number: ML090430367, p. 4, 14.

153 The net free air volume of Limerick Unit 2s Mark II primary containment is 379,071 cubic feet. (At Limerick Unit 2, the minimum wetwell net water volume is 118,655 cubic feet.) See NRC, Limerick Generating Station Units 1 and 2Issuance of Amendments Re:

Application of Alternative Source Term Methodology, Attachment 3, Safety Evaluation, August 2006, available at: NRC Library, ADAMS Documents, Accession Number: ML062210214, p. 32. The design pressure of Limerick Unit 2s primary containment is 55.0 psig; see Exelon, Limerick Generating Station Units 1 and 2: Technical Speci"cations Change RequestType A Test Extensions, Attachment 1, Evaluation of Proposed Change, February 2007, available at: NRC Library, ADAMS Documents, Accession Number: ML070530296, p. 4.

The Limerick Unit 2 test was conducted at 44.0 psig; it is assumed that the test was conducted at 70°F. The density of air at 70°F and 1 atm is 0.07495 pound per cubic foot. At 1 atm, there would be 28,411 pounds of air in the primary containment; at 44.0 psig (3.99 atm), there would be 113,475 pounds of air in the primary containment. The overall leakage rate is 0.3272 percent of the containment airs weight (371 pounds) per day. For information on the 1999 Limerick Unit 2 test, see Exelon, Limerick Generating Station Units 1 and 2: Technical Speci"cations Change RequestType A Test Extensions, Attachment 1, Evaluation of Proposed Change, p. 3.

154 NRC, Regulatory Effectiveness Assessment of Option B of Appendix J: Final Report, November 2002, available at: NRCs ADAMS Documents, Accession Number: ML023100201, p. 2.

155 IAEA, Mitigation of Hydrogen Hazards in Severe Accidents in Nuclear Power Plants, IAEA-TECDOC-1661, July 2011, p. 61.

156 The density of hydrogen at 68°F and 1 atm is 0.005229 pound per cubic foot; the density of air at 70°F and 1 atm is 0.07495 pound per cubic foot.

157 Sherrell R. Greene, Oak Ridge National Laboratory, The Role of BWR Mark I Secondary Containments in Severe Accident Mitigation, Proceedings of the 14th Water Reactor Safety Information Meeting at the National Bureau of Standards, Gaithersburg, Maryland, October 27-31, 1986, Exhibit 6.

158 G.H. Hofmayer et al., Containment Leakage During Severe Accident Conditions, BNL-NUREG-35286, CONF-8406124-13, 1984, p. 6, 7, 8.

159 G.H. Hofmayer et al., Containment Leakage During Severe Accident Conditions, BNL-NUREG-35286, CONF-8406124-13, 1984, p. 4.

160 A.K. Agraual et al., An Estimation of Pre-Existing LWR Containment Leakage Areas for Severe Accident Conditions, BNL-NUREG-34212, CONF-840614-35, 1984, p. 3.

161 P. J. Pelto et al., Reliability Analysis of Containment Isolation Systems, Paci"c Northwest Laboratory, NUREG/CR-4220, June 1985, available at: NRC Library, ADAMS Documents, Accession Number:

ML103050471, p. 8.3.

162 Oyster Creeks design leak rate is 0.5 percent of the primary containment airs weight per day; in one overall leak rate test, Oyster Creeks primary containment leaked at a rate of 9.0 percent of its airs weight per day. See P.J. Pelto et al., Reliability Analysis of Containment Isolation Systems, NUREG/CR-4220, p. 8.5. See also NRC, Oyster Creek: Issuance of Amendment to Facility Operating License, September 1996, available at: NRC Library, ADAMS Documents, Accession Number:

ML011300129, Enclosure 1, Amendment No. 186, p. 4.5-10.

163 NRC, Oyster Creek: Issuance of Amendment to Facility Operating License, September 1996, available at: NRC Library, ADAMS Documents, Accession Number: ML011300129, Enclosure 1, Amendment No. 186, p. 1.0-5.

164 The net free air volume of Oyster Creeks Mark I primary containment is 301,300 cubic feet. (At Oyster Creek, the minimum wetwell net water volume is 82,000 cubic feet.) See GPU Nuclear Corporation and PLG, Inc., Oyster Creek Probabilistic Risk Assessment:

Level 2, Volume 1, June 1992, available at: NRC Library, ADAMS Documents, Accession Number: ML060550287, p. 3.5. The typical design pressure of a BWR Mark I primary containment is 58.0 psig. See M.F.

Hessheimer et al., Containment Integrity Research at SNL, NUREG/CR-6906, July 2006, p. 24. The test was conducted before March 1985 (when NUREG-/CR-4220 was completed). NUREG-/CR-4220 does not state what pressure the test was conducted at; however, it is highly probable that the test was conducted at 35.0 psig, the pressureassociated with a design basis loss-of-coolant accidentused for subsequent Oyster Creek tests.

It is assumed that the tests were conducted at 70°F. The density of air at 70°F and 1 atm is 0.07495 pound per cubic foot. At 1 atm, there would be 22,582 pounds of air in the primary containment; at 35.0 psig (3.38 atm),

there would be 76,329 pounds of air in the primary containment. The overall leakage rate is 9.0 percent of the containment airs weight (6870 pounds) per day. For information on the Oyster Creek test, see P.J. Pelto et al., Reliability Analysis of Containment Isolation Systems, NUREG/

CR-4220, p. 8.5.

47 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents 165 In September 1995, the NRC revised its regulations to extend the overall (Type A) leak rate test interval from about 3.3 years to 10 years; to extend the interval for Type B local leak rate tests, intended to measure leakage at penetrations (except for airlocks), from 2 years to a maximum of 10 years; and to extend the interval for Type C local leak rate tests, intended to measure leakage at isolation valves, from 2 years to 5 years.

After 1995, plant owners requested and received approval for one-time 5-year extensions to the 10-year interval requirement of the Type A test for about 94 reactors. In recent years, the NRC has been preparing to extend Type A test intervals to once every 15 years and extend Type C test intervals to once every 75 months. In the proposed revisions, a preoperational Type A test would be required for new reactors, and a second test would be required within 4 years. If the "rst two tests were successful, one test would be required every 15 years. Extensions of Type B and Type C test intervals would be permitted if two consecutive tests were successful. See NRC, Letter Regarding Regulatory Guide 1.163, Performance-Based Containment Leak-Test Program, March 20, 2013, available at: NRC Library, ADAMS Documents, Accession Number:

ML13067A219, p. 2. See also Advisory Committee on Reactor Safeguards (ACRS) 602nd Meeting Transcript, March 7, 2013, p. 10, 31-32.

166 P.J. Pelto et al., Reliability Analysis of Containment Isolation Systems, NUREG/CR-4220, p. 4.6.

167 P.J. Pelto et al., Reliability Analysis of Containment Isolation Systems, NUREG/CR-4220, p. 4.7.

168 ACRS 602nd Meeting Transcript, March 7, 2013, p. 32-33.

169 P.J. Pelto et al., Reliability Analysis of Containment Isolation Systems, NUREG/CR-4220, p. 4.7.

170 ACRS 602nd Meeting Transcript, March 7, 2013, p. 16.

171 EPRI, Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals, 1009325, Revision 2-A, October 2008.

172 ACRS 602nd Meeting Transcript, March 7, 2013, p. 37-39.

173 P. J. Pelto et al., Reliability Analysis of Containment Isolation Systems, NUREG/CR-4220, p. 8.3. The manuscript of NUREG/CR-4220 was completed in March 1985.

174 Local leak rate tests (Type B and C tests) are typically performed before an overall leak rate test. This implies that the leak rates noted in an [overall leak rate test] are smaller than the actual case. An additional review of as found leakages from Type B and Type C tests was performed A total of 49 [overall leak rate test] reports were identi"ed for which the Type A [overall leak rate] test did not fail but with the consideration of Type B and C as found leakage would be classi"ed as a failure. To simplify the analysis these 49 failures are added directly to the results presented above. Thus a total of 109 [overall leak rate test]

failures are identi"ed. Of these failures, 55 were for BWRs and 54 were for PWRs. See P. J. Pelto et al., Reliability Analysis of Containment Isolation Systems, NUREG/CR-4220, p. 8.6.

175 EPRI, Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals, 1009325, Revision 2-A, October 2008, p. A-3.

176 EPRI, Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals, 1009325, Revision 2-A, October 2008, p.v.

177 NRC, Performance-Based Containment Leak-Test Program, NUREG-1493, September 1995.

178 NRC, Regulatory Effectiveness Assessment of Option B of Appendix J: Final Report, November 2002, available at: NRC Library, ADAMS Documents, Accession Number: ML023100201, p. 3.

179 NRC, Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants, Final Summary Report, NUREG-1150, Vols. 1 and 2, June 1989 and December 1990.

180 NRC, Regulatory Effectiveness Assessment of Option B of Appendix J: Final Report, November 2002, available at: NRC Library, ADAMS Documents, Accession Number: ML023100201, p. 6.

181 NRC, Letter Regarding Regulatory Guide 1.163, Performance-Based Containment Leak-Test Program, March 20, 2013, available at: NRC Library, ADAMS Documents, Accession Number: ML13067A219, p. 1.

182 Institute of Nuclear Power Operations (INPO), Special Report on the Nuclear Accident at the Fukushima Daiichi Nuclear Power Station, INPO 11-005, November 2011, p. 96.

183 Institute of Nuclear Power Operations (INPO), Special Report on the Nuclear Accident at the Fukushima Daiichi Nuclear Power Station, INPO 11-005, November 2011, p. 11, 17, 24, 27, 29, 31.

184 Institute of Nuclear Power Operations (INPO), Special Report on the Nuclear Accident at the Fukushima Daiichi Nuclear Power Station, INPO 11-005, November 2011, p. 20.

185 BWR Mark I and Mark II primary containments have volumes of approximately 0.28 x 106 cubic feet and 0.4 x 106 cubic feet, respectively.

See M.F. Hessheimer et al., Containment Integrity Research at SNL, NUREG/CR-6906, p. 24.

186 NRC, Order Modifying Licenses with Regard to Reliable Hardened Containment Vents, EA-12-050, March 12, 2012, available at: www.

nrc.gov, NRC Library, ADAMS Documents, Accession Number:

ML12054A694, p. 3.

187 NRC, Order Modifying Licenses with Regard to Reliable Hardened Containment Vents, EA-12-050, March 12, 2012, available at: www.

nrc.gov, NRC Library, ADAMS Documents, Accession Number:

ML12054A694.

188 NRC, Installation of a Hardened Wetwell Vent, Generic Letter 89-16, September 1, 1989, p. 1. Generic Letter 89-16 states that the Commission has directed the [NRC] staff to approve installation of a hardened vent under the provisions of 10 CFR 50.59 [Changes, Tests, and Experiments] for licensees, who on their own initiative, elect to incorporate this plant improvement.

189 NRC, Installation of a Hardened Wetwell Vent, Generic Letter 89-16, September 1, 1989, p. 1.

190 NRC, Order Modifying Licenses with Regard to Reliable Hardened Containment Vents, EA-12-050, March 12, 2012, available at: www.

nrc.gov, NRC Library, ADAMS Documents, Accession Number:

ML12054A694, Attachment 2, p. 1.

191 R. Jack Dallman et al., Filtered Venting Considerations in the United States, Committee on the Safety of Nuclear Installations (CSNI)

Specialists Meeting on Filtered Vented Containment Systems, May 17-18, 1988, Paris, p. 3.

192 The piping of hardened vents currently installed at U.S. BWR Mark I plants is typically 8 inches in diameter.

193 Allen L. Camp et al., Light Water Reactor Hydrogen Manual, NUREG/CR-2726, p. 2-66.

194 INPO, Report on the Fukushima Daiichi Accident, p. 34.

195 INPO, Report on the Fukushima Daiichi Accident, p. 33-34.

196 Juan J. Carbajo, Oak Ridge National Laboratory, MELCOR Model of the Spent Fuel Pool of Fukushima Daiichi Unit 4, 2012, p. 1-2.

197 Sherrell R. Greene, Oak Ridge National Laboratory, The Role of BWR Mark I Secondary Containments in Severe Accident Mitigation, Proceedings of the 14th Water Reactor Safety Information Meeting at the National Bureau of Standards, October 27-31, 1986, Gaithersburg, Maryland, Exhibit 6.

198 The NRCs de"nition of defense-in-depth: An approach to designing and operating nuclear facilities that prevents and mitigates accidents that release radiation or hazardous materials. The key is creating multiple independent and redundant layers of defense to compensate for potential human and mechanical failures so that no single layer, no matter how robust, is exclusively relied upon. Defense-in-depth includes the use of access controls, physical barriers, redundant and diverse key safety functions, and emergency response measures. See www.nrc.gov/reading-rm/basic-ref/glossary/defense-in-depth.html.

199 Charles Miller, et al., Recommendations for Enhancing Reactor Safety in the 21st Century: The Near-Term Task Force Review of Insights from the Fukushima Dai-ichi Accident, ML111861807 (2011), p. 47.

48 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents 200 Robert Prior et al., OECD Nuclear Energy Agency, Committee on the Safety of Nuclear Installations, Core Exit Temperature (CET)

Effectiveness in Accident Management of Nuclear Power Reactor, NEA/

CSNI/R(2010)9, November 26 2010, p. 128-129.

201 Robert Prior et al., Core Exit Temperature (CET) Effectiveness in Accident Management of Nuclear Power Reactor, p. 128.

202 Robert Prior et al., Core Exit Temperature (CET) Effectiveness in Accident Management of Nuclear Power Reactor, p. 49-50.

203 ACRS, Review and Evaluation of the Nuclear Regulatory Commission Safety Research Program: A Report to the U.S. Nuclear Regulatory Commission, NUREG-1635, Vol. 10, April 2012, p. 11.

204 IAEA, Generic Assessment Procedures for Determining Protective Actions During a Reactor Accident, IAEA-TECDOC-955, August 1997, p.

25, 26.

205 See Salomon Levy, How Would U.S. Units Fare? Nuclear Engineering International (December 7, 2011). The journals Author Info states that Dr. Levy was the manager responsible for General Electric (GE) BWR heat transfer and "uid "ow and the analyses and tests to support [GEs] nuclear fuel cooling during normal, transient, and accident analyses from 1959 to 1977.

206 Salomon Levy, How Would U.S. Units Fare? Nuclear Engineering International (December 7, 2011). Levy makes a point of saying that his observations are not intended to be criticisms of the actions of the Fukushima Daiichi plant operators.

207 NRC Policy Statement, Combustible Gas Control in Containment, Federal Register 68, No. 179 (September 16, 2003), p. 54126.

208 NRC Policy Statement, Combustible Gas Control in Containment, Federal Register 68, No. 179 (September 16, 2003), p. 54126-54127.

209 In 2003, oxygen monitors were reclassi"ed from Category 1 to Category 2, and hydrogen monitors were reclassi"ed from Category 1 to Category 3. The NRC states, In general, Category 1 provides for full quali"cation, redundancy, and continuous real-time display and requires on-site (standby) power. Category 2 provides for quali"cation but is less stringent in that it does not (of itself) include seismic quali"cation, redundancy, or continuous display and requires only a high-reliability power source (not necessarily standby power). Category 3 is the least stringent. It provides for high-quality commercial-grade equipment that requires only offsite power. See NRC, Regulatory Guide 1.97, Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident, Revision 3, May 1983, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML003740282, p. 1.97-4.

210 David Lochbaum, UCS, letter regarding installing hydrogen monitoring instrumentation in BWR Mark I and Mark II secondary containments as well as in the fuel handling buildings of BWR Mark IIIs and PWRs, to David L. Skeen, NRC, Deputy Director, Division of Engineering, Of"ce of Nuclear Reactor Regulation, January 20, 2012, p. 2.

211 NRC Policy Statement, Con"rmatory Order Modifying Post-TMI Requirements Pertaining to Containment Hydrogen Monitors for Arkansas Nuclear One, Units 1 and 2, Federal Register 63, No. 192 (October 5, 1998), p. 53466-53467. NRC, Regulatory Guide 1.7, Control of Combustible Gas Concentrations in Containment, Revision 3, March 2007, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML070290080, p. 6.

212 ACRS, Review and Evaluation of the Nuclear Regulatory Commission Safety Research Program: A Report to the U.S. Nuclear Regulatory Commission, NUREG-1635, Vol. 10, April 2012, p. 11.

213 Appendix J to Part 50, Primary Reactor Containment Leakage Testing for Water-Cooled Power Reactors.

214 NRC, Letter Regarding Regulatory Guide 1.163, Performance-Based Containment Leak-Test Program, March 20, 2013, available at: NRCs ADAMS Documents, Accession Number: ML13067A219, p. 2.

49 NRDC Preventing Hydrogen Explosions In Severe Nuclear Accidents Natural Resources Defense Council 40 West 20th Street New York, NY 10011 212 727-2700 Fax 212 727-1773 Beijing Chicago Los Angeles Bozeman San Francisco Washington www.nrdc.org Printed on recycled paper www.nrdc.org/policy www.facebook.com/nrdc.org www.twitter.com/nrdc