Compendium of Analyses to 

Investigate Select Level 1 

Probabilistic Risk 

Assessment End-State 

Definition and Success 

Criteria Modeling Issues

Office of Nuclear Regulatory Research

NUREG/CR-7177

ERI/NRC 13-210
NRC Reference Material 

As of November 1999, you may electronically access 

NUREG-series publications and other NRC records at 

NRC’s Public Electronic Reading Room at 

http://www.nrc.gov/reading-rm.html. Publicly released 

records include, to name a few, NUREG-series 

publications; Federal Register notices; applicant, 

licensee, and vendor documents and correspondence; 

NRC correspondence and internal memoranda; bulletins 

and information notices; inspection and investigative 

reports; licensee event reports; and Commission papers 

and their attachments. 

NRC publications in the NUREG series, NRC 

regulations, and Title 10, “Energy,” in the Code of

Federal Regulations may also be purchased from one 

of these two sources. 

1. The Superintendent of Documents

 U.S. Government Printing Office

Mail Stop SSOP

Washington, DC 20402–0001

Internet: bookstore.gpo.gov

Telephone: 202-512-1800

Fax: 202-512-2250 

2. The National Technical Information Service 

Springfield, VA 22161–0002

www.ntis.gov

1–800–553–6847 or, locally, 703–605–6000 

A single copy of each NRC draft report for comment is 

available free, to the extent of supply, upon written 

request as follows:

Address: U.S. Nuclear Regulatory Commission

 Office of Administration 

Publications Branch

 Washington, DC 20555-0001

E-mail: DISTRIBUTION.RESOURCE@NRC.GOV

Facsimile: 301–415–2289 

Some publications in the NUREG series that are 

posted at NRC’s Web site address 

http://www.nrc.gov/reading-rm/doc-collections/nuregs 

are updated periodically and may differ from the last 

printed version. Although references to material found on 

a Web site bear the date the material was accessed, the 

material available on the date cited may subsequently be 

removed from the site.

Non-NRC Reference Material 

Documents available from public and special technical 

libraries include all open literature items, such as books, 

journal articles, transactions, Federal Register notices, 

Federal and State legislation, and congressional reports. 

Such documents as theses, dissertations, foreign reports 

and translations, and non-NRC conference proceedings 

may be purchased from their sponsoring organization. 

Copies of industry codes and standards used in a 

substantive manner in the NRC regulatory process are 

maintained at—

The NRC Technical Library

Two White Flint North

11545 Rockville Pike

Rockville, MD 20852–2738 

These standards are available in the library for reference 

use by the public. Codes and standards are usually 

copyrighted and may be purchased from the originating 

organization or, if they are American National Standards, 

from—

American National Standards Institute

11 West 42nd Street

New York, NY 10036–8002

www.ansi.org

212–642–4900 

AVAILABILITY OF REFERENCE MATERIALS

IN NRC PUBLICATIONS

Legally binding regulatory requirements are stated only 

in laws; NRC regulations; licenses, including technical 

specifications; or orders, not in NUREG-series 

publications. The views expressed in contractorprepared publications in this series are not necessarily 

those of the NRC.

The NUREG series comprises (1) technical and 

administrative reports and books prepared by the staff 

(NUREG–XXXX) or agency contractors (NUREG/CR–

XXXX), (2) proceedings of conferences (NUREG/CP–

XXXX), (3) reports resulting from international 

agreements (NUREG/IA–XXXX), (4) brochures 

(NUREG/BR–XXXX), and (5) compilations of legal 

decisions and orders of the Commission and Atomic and 

Safety Licensing Boards and of Directors’ decisions

under Section 2.206 of NRC’s regulations (NUREG–

0750).

DISCLAIMER: This report was prepared as an account 

of work sponsored by an agency of the U.S. 

Government. Neither the U.S. Government nor any 

agency thereof, nor any employee, makes any warranty, 

expressed or implied, or assumes any legal liability or 

responsibility for any third party’s use, or the results of 

such use, of any information, apparatus, product, or 

process disclosed in this publication, or represents that 

its use by such third party would not infringe privately 

owned rights.
Compendium of Analyses to 

Investigate Select Level 1 

Probabilistic Risk 

Assessment End-State 

Definition and Success 

Criteria Modeling Issues

Manuscript Completed: June 2013

Date Published: May 2014

Prepared by:

1

A. Krall

1

P. Sawant

1

S. Choi

1

M. Khatib-Rahbar

2

D. Helton

1

Energy Research, Inc.

P. O. Box 2034

Rockville, MD 20847

2

U.S. Nuclear Regulatory Commission

D. Helton, NRC Project Manager

NRC Job Code V6219

Office of Nuclear Regulatory Research

NUREG/CR-7177

ERI/NRC 13-210

iii

ABSTRACT

As part of the routine development, maintenance, and application of the US Nuclear Regulatory 

Commission’s (NRC’s) risk tools, assumptions are made with respect to how nuclear power plant 

accidents will be represented. The NRC conducts research, and performs analyses, to investigate the 

adequacy of these assumptions. Recently, the Office of Nuclear Regulatory Research has increased its 

use of the MELCOR computer code for investigating assumptions related to the success criteria, 

sequence timing, and end-state definition aspects of Level 1 probabilistic risk assessment (PRA). This

report augments the existing collection of contemporary Level 1 PRA success criteria analyses and 

complements other ongoing work related to success criteria analyses for the Byron Station that will be 

documented in an upcoming NUREG report. 

This report focuses on investigations of (a) the effect of modeling assumptions on key figures-of-merit

such as the time of depletion of the refueling water storage tank; (b) the relative conservatism or nonconservatism associated with commonly used and potential core damage surrogates; (c) the time 

required to arrest fuel heatup if mitigation equipment is recovered following a core heatup; and (d) the 

comparison of MELCOR to the Modular Accident Analysis Program (MAAP) for characterizing the safety 

margins of selected PRA sequences through an uncertainty quantification process.

v

FOREWORD

Energy Research, Inc., performed the work documented in this report under sponsorship and direction of

the U.S. Nuclear Regulatory Commission’s (NRC’s) Office of Nuclear Regulatory Research. The work 

supported ongoing activities related to the NRC’s standardized plant analysis risk (SPAR) models, as 

described below and in the report.

Probabilistic risk assessment (PRA) models for nuclear power plants rely on underlying modeling 

assumptions known as success criteria and sequence timing assumptions. These criteria and 

assumptions determine what combination of system and component failures will lead to postulated core 

damage, as well as the timeframes during which components must operate or operators must take 

particular actions. This report augments the existing collection of contemporary Level 1 PRA success 

criteria analyses, and thus improves the defensibility of how core damage surrogate selection (e.g., peak 

cladding temperature of 1,478 Kelvin (2200 °Fahrenheit)) affects PRA sequence end-state determination, 

as well as how important modeling assumptions impact accident sequence evolution and associated key 

figures-of-merit (e.g., the time to initiate an alternate core cooling strategy). As such, this report supports 

(1) maintaining and enhancing the SPAR models; (2) supporting the NRC’s risk analysts when 

addressing specific issues in the accident sequence precursor (ASP) program and the significance 

determination process (SDP); and (3) informing other ongoing and planned initiatives.

MELCOR, which is the NRC’s Level 1 PRA success criteria and severe accident analysis computer code, 

was used to perform this work. Relevant assumptions and limitations for each application of the code are 

described. The results of the work, which are described in greater detail in the abstract and the report, 

highlight the importance of variations in specific PRA modeling assumptions (e.g., the assumed leakage 

size for steam generator tube rupture accidents), recommend specific core damage surrogates 

(e.g., peak cladding temperature of 1,478 Kelvin (2200 °Fahrenheit) for MELCOR success criteria 

applications at full-power), illustrate timing requirements for restoring injection to arrest fuel heatup, and 

show good agreement between MELCOR and the Modular Accident Analysis Program Version 4 (MAAP4 

– the most widely used tool by the US industry in this arena) for an uncertainty analysis related to loss of 

all feedwater.

The NRC plans to use the results of this work in its ongoing SPAR development activities, and when 

appropriate, for particular ASP or SDP applications. The results also will be useful in the agency’s efforts 

to develop a full-scope PRA for Vogtle Units 1 and 2.

vii

CONTENTS

Section Page

ABSTRACT ...................................................................................................................................................iii

FOREWORD................................................................................................................................................. v

CONTENTS..................................................................................................................................................vii

LIST OF FIGURES........................................................................................................................................ix

LIST OF TABLES....................................................................................................................................... xvii

EXECUTIVE SUMMARY ............................................................................................................................xxi

ACKNOWLEDGMENTS............................................................................................................................ xxiii

ACRONYMS ..............................................................................................................................................xxv

1. INTRODUCTION .................................................................................................................................... 1

2. DESCRIPTIONS OF PLANTS AND MODELS....................................................................................... 3

2.1 Byron Unit 1 Plant and MELCOR Model ...................................................................................... 3

2.2 Surry Plant and MELCOR Model.................................................................................................. 8

2.3 Peach Bottom Plant and MELCOR Model.................................................................................. 14

2.4 Cross-Comparisons of Several 4-Loop Westinghouse PWRs ................................................... 19

2.4.1 Introduction .................................................................................................................... 19

2.4.2 Comparisons of Plant Design Data Important to Severe Accident Progression ........... 19

2.4.3 Time to Core Damage Estimate .................................................................................... 28

3. INVESTIGATION OF SEQUENCE VARIABILITY................................................................................ 35

3.1 Investigation of Sequence Variability—Byron Unit 1 .................................................................. 35

3.1.1 Investigation of Sequence Variability – Byron Unit 1, Loss of DC Bus 111 with B&F... 35

3.1.2 Investigation of Sequence Variability - Byron Unit 1, Loss-of-Coolant During 

Shutdown....................................................................................................................... 36

3.2 Investigation of Sequence Variability – Surry, Steam Generator Tube Rupture (SGTR)........... 39

3.3 Investigation of Sequence Variability – Peach Bottom, SBO with RCIC until Battery 

Depletion..................................................................................................................................... 41

3.4 Investigation of Sequence Variability – Timing of Key Events ................................................... 42

4. INVESTIGATION OF CORE DAMAGE SURROGATES ..................................................................... 45

4.1 Investigation of Core Damage Surrogates – Byron Unit 1 ......................................................... 46

4.1.1 Investigation of Core Damage Surrogates – Byron Unit 1, Loss of DC Bus 111 with 

B&F ................................................................................................................................ 47

4.1.2 Investigation of Core Damage Surrogates – Byron Unit 1, Shutdown .......................... 47

4.2 Investigation of Core Damage Surrogates—Surry, SGTR ......................................................... 47

4.3 Investigation of Core Damage Surrogates – Peach Bottom, SBO with RCIC until Battery 

Depletion..................................................................................................................................... 58

4.4 Investigation of Core Damage Surrogates – Observations ........................................................ 61

5. INVESTIGATION OF TIME NEEDED TO ARREST FUEL HEATUP .................................................. 63
viii

Section Page

6. UNCERTAINTY ANALYSIS ................................................................................................................. 67

6.1 Approach..................................................................................................................................... 67

6.1.1 Selected Accident Scenario........................................................................................... 67

6.1.2 Selected Input Parameters ............................................................................................ 68

6.2 Results ........................................................................................................................................ 73

6.3 Comparison with the EPRI-MAAP Study.................................................................................... 82

7. REFERENCES ..................................................................................................................................... 85

APPENDIX A: DETAILS OF BYRON LOSS OF DC BUS 111 AND SHUTDOWN ANALYSES .........A-1

A.1. Introduction ................................................................................................................................A-1

A.1.1 Background...................................................................................................................A-1

A.1.2 Objectives and Scope...................................................................................................A-1

A.1.3 Outline...........................................................................................................................A-1

A.2 Byron Scenarios and Results: Loss of DC Bus 111 with Bleed and Feed ................................A-1

A.2.1 Loss of DC Bus 111 with Bleed and Feed....................................................................A-1

A.2.2 Results ..........................................................................................................................A-3

A.2.3 Summary: Loss of DC Bus 111 with Bleed and Feed Scenario .................................A-32

A.3 Byron Scenarios and Results: Loss of Coolant During Shutdown ..........................................A-33

A.3.1 Break Outside the Containment during Shutdown .....................................................A-33

A.3.2 Results ........................................................................................................................A-38

A.3.3 Summary: Shutdown Scenario ...................................................................................A-83

A.4 Reference ................................................................................................................................A-85

APPENDIX B: DETAILS OF THE SURRY SGTR ANALYSIS .............................................................B-1

B.1 Introduction ................................................................................................................................B-1

B.1.1 Background...................................................................................................................B-1

B.1.2 Objectives and Scope...................................................................................................B-1

B.1.3 Outline...........................................................................................................................B-1

B.2 Accident Scenario and Results..................................................................................................B-1

B.2.1 Steam Generator Tube Rupture Sequence SGTR-9....................................................B-1

B.2.2 Results ..........................................................................................................................B-6

B.2.3 Summary: SGTR-9 Scenario......................................................................................B-31

B.3 Reference ................................................................................................................................B-32

APPENDIX C: DETAILS OF PEACH BOTTOM SBO ANALYSIS...................................................... C-1

C.1 Introduction ............................................................................................................................... C-1

C.1.1 Background.................................................................................................................. C-1

C.1.2 Objectives and Scope.................................................................................................. C-1

C.1.3 Outline.......................................................................................................................... C-1

C.2 Accident Scenario and Results................................................................................................. C-1

C.2.1 SBO with RCIC Operation until Battery Depletion....................................................... C-1

C.2.2 Results ......................................................................................................................... C-5

C.2.3 Summary: SBO with RCIC Scenario ......................................................................... C-23

C.3 Reference ............................................................................................................................... C-23
ix

LIST OF FIGURES

Figure Page

Figure 2.1.1 Reactor Core and Lower Plenum Nodalization ............................................................... 5

Figure 2.1.2 Reactor Pressure Vessel Control Volume and Flow Path Nodalization.......................... 6

Figure 2.1.3 Reactor Coolant System Nodalization............................................................................. 7

Figure 2.2.1 Nodalizations of the Core and Lower Part of the Vessel................................................. 9

Figure 2.2.2 Nodalization of Upper Part of the Vessel....................................................................... 10

Figure 2.2.3 Nodalization of the Surry RCS....................................................................................... 11

Figure 2.2.4 Nodalization of the Surry Containment.......................................................................... 12

Figure 2.2.5 Drawing of a Steam Generator and Nodalization of Steam Generator A...................... 13

Figure 2.3.1 Nodalization of the Core Region.................................................................................... 15

Figure 2.3.2 Nodalization of the Peach Bottom RCS......................................................................... 16

Figure 2.3.3 Nodalization of the Reactor Vessel................................................................................ 17

Figure 2.3.4 Nodalization of the Peach Bottom Containment............................................................ 18

Figure 2.4.1 Normalized RPV Collapsed Water Level at the Time the PCT Reaches 1,478 K 

(2,200 °F)....................................................................................................................... 31

Figure 4.1.1 Times of Core Damage in Byron LoDC Bus 111 B&F Scenario and its Sensitivity 

Cases, According to Various Surrogate Measures........................................................ 50

Figure 4.1.2 Times of Core Damage in Byron Shutdown Scenario and its Sensitivity Cases, 

According to Various Surrogate Measures.................................................................... 54

Figure 4.2.1 Times of Core Damage in Surry SGTR Scenario and its Sensitivity Cases, 

According to Various Surrogate Measures.................................................................... 57

Figure 4.3.1 Times of Core Damage in Peach Bottom SBO with RCIC until Battery Depletion 

Scenario and its Sensitivity Cases, According to Various Surrogate Measures ........... 61

Figure 6.1 Uncertainty Distribution for Power Level at Start of LoMFW Event Initiation ................ 69

Figure 6.2 Uncertainty Distribution for Steam Generator Water Level Setpoints ........................... 70

Figure 6.3 Uncertainty Distribution for Time of Reactor Trip .......................................................... 71

Figure 6.4 Uncertainty Distribution for the HPSI Flow Rate............................................................ 72

Figure 6.5 Uncertainty Distribution for the PORV Flow Area.......................................................... 72
x

Figure Page

Figure 6.6 Uncertainty Distribution for Time of AFW Failure .......................................................... 73

Figure 6.7 Uncertainty Distribution for Time of Feed Initiation........................................................ 74

Figure 6.8 Uncertainty Distribution for the TCD.............................................................................. 74

Figure 6.9 Comparison of the CCDF of the Calculated PCT (Load) and the CDF of the 

Temperature at which Core Damage is Assumed (Capacity) ....................................... 79

Figure 6.10a The PDF of the Calculated PCT (Load) and Temperature at which Core Damage 

Is Assumed (Capacity) for Configuration 1.................................................................... 80

Figure 6.10b PDF of Calculated PCT (Load) and TEMPERATURE at which Core Damage is 

Assumed (Capacity) for Configuration 2........................................................................ 81

Figure 6.11 Comparison of the CCDF of the Calculated PCT (Load) for One Hundred (100) 

and Fifty (50) Sample Simulations................................................................................. 82

Figure A.1.1.1a Water Level in the Steam Generators (Case A.1.1 short-term) ...................................A-6

Figure A.1.1.1b Water Level in the Steam Generators (Case A.1.1 longer-term) .................................A-6

Figure A.1.1.2 Coolant Injection Rates before and around the Time of S Signal (Case A.1.1)...........A-7

Figure A.1.1.3a Pressure in the Pressurizer (Case A.1.1 short-term)....................................................A-7

Figure A.1.1.3b Pressure in the Pressurizer (Case A.1.1 longer-term)..................................................A-8

Figure A.1.1.4a PORV and Net Core Volumetric Outflow Rates (Case A.1.1 short-term).....................A-8

Figure A.1.1.4b PORV and Net Core Volumetric Outflow Rates (Case A.1.1 longer-term) ..................A-9

Figure A.1.1.5a Average Liquid Temperatures in the Hot and Cold Legs (Case A.1.1 short-term).......A-9

Figure A.1.1.5b Average Fluid Temperatures in the Hot and Cold Legs (Case A.1.1 longer-term) ....A-10

Figure A.1.1.6 Average Main Steam Line Pressure (Case A.1.1)......................................................A-10

Figure A.1.1.7a Water Levels in the Vessel (Case A.1.1)....................................................................A-11

Figure A.1.1.7b Water Levels throughout the Plant (Case A.1.1)........................................................A-11

Figure A.1.1.8 Peak Cladding Temperature (Case A.1.1) .................................................................A-12

Figure A.1.1.9 ECCS Injection Rates (Case A.1.1)............................................................................A-12

Figure A.1.1.10 Core Exit Temperature (Case A.1.1) ..........................................................................A-13

Figure A.1.1.11 Spatially Maximized Mass Ratio, Zirconium Oxide to Zirconium (Case A.1.1) ..........A-13

Figure A.1.2.1a Water Level in the Steam Generators (Case A.1.2 short-term) .................................A-18
xi

Figure Page

Figure A.1.2.1b Water Level in the Steam Generators (Case A.1.2 longer-term) ...............................A-18

Figure A.1.2.2a Pressure in the Pressurizer (Case A.1.2 short-term)..................................................A-19

Figure A.1.2.2b Pressure in the Pressurizer (Case A.1.2 longer-term)................................................A-19

Figure A.1.2.3 ECCS Injection (Case A.1.2) ......................................................................................A-20

Figure A.1.2.4 Saturation and Sump Water Temperatures (Case A.1.2) ..........................................A-20

Figure A.1.2.5a Fan Cooler Cooling Rate (Case A.1.2 short-term) .....................................................A-21

Figure A.1.2.5b Fan Cooler Cooling Rate (Case A.1.2 longer-term) ...................................................A-21

Figure A.1.2.6 Fan Cooler Condensation Rate (Case A.1.2).............................................................A-22

Figure A.1.2.7 Containment Pressure (Case A.1.2)...........................................................................A-22

Figure A.1.2.8 Water Level in the Vessel (Case A.1.2)......................................................................A-23

Figure A.1.2.9 Core Exit Temperature (Case A.1.2) ..........................................................................A-23

Figure A.1.2.10 Peak Cladding Temperature (Case A.1.2) .................................................................A-24

Figure A.1.3.1 Pressure in the Pressurizer (Case A.1.3)...................................................................A-26

Figure A.1.4.1 Pressure in the Pressurizer (Case A.1.4)...................................................................A-27

Figure A.1.5.1 Pressure in the Steam Generator Domes (Case A.1.5) .............................................A-28

Figure A.1.5.2 Pressure in the Pressurizer (Case A.1.5)...................................................................A-29

Figure A.1.8.1 Pressure in the Pressurizer (Case A.1.8)...................................................................A-30

Figure A.1.8.2 Pressure in the Pressurizer (Case A.1.8 Variant).......................................................A-31

Figure A.1.9.1 Pressure in the Pressurizer (Case A.1.9)...................................................................A-32

Figure A.2a Dump Valve Flow and Steam Generator Pressure during A.2.x Steady State ..........A-38

Figure A.2b RHR and Steam Generator Cooling during A.2.x Steady State .................................A-39

Figure A.2.1.1a Break Flows (Case A.2.1 short-term) .........................................................................A-40

Figure A.2.1.1b Break Flows (Case A.2.1 longer-term) .......................................................................A-41

Figure A.2.1.2 RCS Pressure (Case A.2.1)........................................................................................A-41

Figure A.2.1.3a Core Exit Temperature (Case A.2.1 short-term).........................................................A-42

Figure A.2.1.3b Core Exit Temperature (Case A.2.1 longer-term).......................................................A-42
xii

Figure Page

Figure A.2.1.4 RHR Pump Rate and Liquid Volume in Hot Leg D (Case A.2.1)................................A-43

Figure A.2.1.5 Water Levels in the Pressurizer and Steam Generator D (Case A.2.1).....................A-43

Figure A.2.1.6a Water Levels in the Vessel (Case A.2.1)....................................................................A-44

Figure A.2.1.6b Water Levels in the RCS (Case A.2.1) .......................................................................A-44

Figure A.2.1.7 Cumulative Flows and Inventory Decreases (Case A.2.1).........................................A-45

Figure A.2.1.8 Clearing of the Loop Seal in Loop B (Case A.2.1)......................................................A-45

Figure A.2.1.9 Water Levels in the Steam Generators (Case A.2.1) .................................................A-46

Figure A.2.1.10 Pressures in the Steam Generators and Vessel Dome (Case A.2.1) ........................A-46

Figure A.2.1.11a Decay Heat and Heat Transferred to Steam Generators (Case A.2.1)......................A-47

Figure A.2.1.11b Core Exit Temperature and Heat Transferred to Steam Generators (Case A.2.1)....A-47

Figure A.2.1.12 Pressurizer, Surge Line, and Hot Leg Top Water Levels (Case A.2.1)......................A-48

Figure A.2.1.13 Pressurizer Water Levels: Base Case and Case of Active SPARC Model in the 

Surge Line to Pressurizer Flow Path (Case A.2.1).....................................................A-48

Figure A.2.2.1 Break and ECCS Injections Flow Rates (Case A.2.2)................................................A-52

Figure A.2.2.2 Water Level in the Reactor Pressure Vessel (Case A.2.2) ........................................A-53

Figure A.2.2.3 RCS Pressure (Case A.2.2)........................................................................................A-53

Figure A.2.2.4a RHR Pump Rate and Liquid Volume in Hot Leg D (Case A.2.2)................................A-54

Figure A.2.2.4b RHR Pump Rate and Liquid Volume in Hot Leg D – Narrower Range 

(Case A.2.2)................................................................................................................A-54

Figure A.2.3.1 Water Levels in the Vessel (Case A.2.3)....................................................................A-56

Figure A.2.3.2 Water Levels in the Core (Case A.2.3).......................................................................A-56

Figure A.2.4.1 Water Levels in the Pressurizer (Case A.2.4) ............................................................A-58

Figure A.2.4.2 Water Levels in the Core (Case A.2.4).......................................................................A-59

Figure A.2.4.3 Temperatures of Coolant at the Core Exit (Case A.2.4).............................................A-59

Figure A.2.4.4a Temperatures of Coolant at the Core Exit (Case A.2.4 short-term) ...........................A-60

Figure A.2.4.4b Temperatures of Coolant at the Core Exit (Case A.2.4 longer-term) .........................A-60

Figure A.2.5.1 Core Exit Coolant Temperature (Case A.2.5).............................................................A-61
xiii

Figure Page

Figure A.2.6.1 Decay Heat and Heat Transferred to Steam Generators (Case A.2.6)......................A-63

Figure A.2.6.2a Pressures at the Pressurizer (Case A.2.6).................................................................A-63

Figure A.2.6.2b Pressures at the Steam Lines Common Header (Case A.2.6)...................................A-64

Figure A.2.6.2c Primary and Secondary Pressures (Sensitivity Case for A.2.6).................................A-64

Figure A.2.6.2d Primary and Secondary Pressures (Base Case for A.2.6) .........................................A-65

Figure A.2.6.2e Primary-Side Liquid Temperature - Loop A SGT; CV430 (Case A.2.6) .....................A-65

Figure A.2.6.2f Secondary-Side Liquid Temperature - Loop A Boiler; CV460 (Case A.2.6) ..............A-66

Figure A.2.6.2g Differences Between Primary- and Secondary-Side Liquid Temperatures 

(Case A.2.6)................................................................................................................A-66

Figure A.2.6.3 Cumulative Break Flow (Case A.2.6) .........................................................................A-67

Figure A.2.6.4 Swollen Water Levels in the Pressurizer (Case A.2.6)...............................................A-67

Figure A.2.6.5 Cumulative Flow through the RHR Pump (Case A.2.6) .............................................A-68

Figure A.2.6.6 Water Levels in the Core (Case A.2.6).......................................................................A-69

Figure A.2.6.7a Pressures (Supplemental Calculation with RHR Pump Trip and No Break)..............A-70

Figure A.2.6.7b Pressures (Supplemental Calculation Variant with RHR Pump Trip and No 

Break) .........................................................................................................................A-70

Figure A.2.7a.1 Water Levels in the Core (Case A.2.7a).....................................................................A-71

Figure A.2.7b.1 Break Flows (Case A.2.7b).........................................................................................A-72

Figure A.2.7b.2 Water Levels in the RCS (Case A.2.7b).....................................................................A-73

Figure A.2.7b.3 RHR Pump Rate and Liquid Volume in Hot Leg D (Case A.2.7b)..............................A-73

Figure A.2.7d.1 Break Flows (Case A.2.7d).........................................................................................A-75

Figure A.2.7d.2 Water Levels in the RCS (Case A.2.7d).....................................................................A-75

Figure A.2.7d.3 RHR Pump Rate and Liquid Volume in Hot Leg D (Case A.2.7d)..............................A-76

Figure A.2.8.1 Water Levels in the Core (Case A.2.8).......................................................................A-77

Figure A.2.9.1 Water Levels in the RCS (Case A.2.9) .......................................................................A-78

Figure A.2.9.2 ECCS Injections Flow Rates (Case A.2.9) .................................................................A-78

Figure A.2.9.3 Containment Pressure (Case A.2.9)...........................................................................A-79
xiv

Figure Page

Figure A.2.9.4 Decay Heat and Fan Cooler Heat Removal (Case A.2.9)..........................................A-79

Figure A.2.10.1 Break Flows (Case A.2.10).........................................................................................A-80

Figure A.2.10.2 Vessel Dome Pressures (Case A.2.10)......................................................................A-81

Figure A.2.10.3 Water Levels in the RCS (Case A.2.10).....................................................................A-81

Figure A.2.10.4 Cumulative flows and Inventory Decreases (Case A.2.10)........................................A-82

Figure A.2.11.1 Vessel Dome Pressures (Case A.2.11)......................................................................A-83

Figure A.2.11.2 Break Flows (Case A.2.11).........................................................................................A-83

Figure B.1 Surry SPAR (v8.17) SGTR Event Tree ........................................................................B-2

Figure B.1.1.1 Pressures (Case B.1) ...................................................................................................B-8

Figure B.1.1.2 SGTR Break Flows and HHSI Rate (Case B.1) ...........................................................B-8

Figure B.1.1.3 Cumulative HHSI (Case B.1).......................................................................................B-9

Figure B.1.1.4 Steam Generator Downcomer Water Levels (Case B.1)..............................................B-9

Figure B.1.1.5 Coolant Flow through the Cold Legs (Case B.1)........................................................B-10

Figure B.1.1.6a Water Level in the Core (Case B.1)............................................................................B-10

Figure B.1.1.6b Water Level in the Pressurizer (Case B.1) .................................................................B-11

Figure B.1.1.7 Core Exit Temperature (Case B.1) .............................................................................B-11

Figure B.1.1.8 Peak Cladding Temperature (Case B.1) ....................................................................B-12

Figure B.1.2.1 Primary RCS Pressure (Case B.2) .............................................................................B-14

Figure B.1.2.2 Cumulative Safety Injections and Sprays (Case B.2).................................................B-14

Figure B.1.2.3 Steam Generator Downcomer Water Levels (Case B.2)............................................B-15

Figure B.1.2.4 Core Exit Temperature (Case B.2) .............................................................................B-15

Figure B.1.2.5 Peak Cladding Temperature (Case B.2) ....................................................................B-16

Figure B.1.3.1 Pressures (Case B.3) .................................................................................................B-17

Figure B.1.3.2 Cumulative Safety Injections and Sprays (Case B.3).................................................B-17

Figure B.1.3.3 Steam Generator Downcomer Water Levels (Case B.3)............................................B-18

Figure B.1.3.4 Core Exit Temperature (Case B.3) .............................................................................B-18
xv

Figure Page

Figure B.1.3.5 Peak Cladding Temperature (Case B.3) ....................................................................B-19

Figure B.1.4.1 Cumulative HHSI (Case B.4)......................................................................................B-20

Figure B.1.4.2 Peak Cladding Temperature (Case B.4) ....................................................................B-20

Figure B.1.5.1 Pressures (Case B.5) .................................................................................................B-21

Figure B.1.5.2 Cumulative HHSI (Case B.5)......................................................................................B-22

Figure B.1.5.3 Peak Cladding Temperature (Case B.5) ....................................................................B-22

Figure B.1.16.1 Water Level in the Core (Case B.16)..........................................................................B-25

Figure B.1.16.2 Cumulative HHSI (Case B.16)....................................................................................B-25

Figure B.1.16.3 Coolant Flow through the Cold Legs (Case B.16)......................................................B-26

Figure B.1.16.4 Steam Generator Downcomer Water Levels (Case B.16)..........................................B-26

Figure B.1.17.1 Pressures (Case B.17) ...............................................................................................B-27

Figure B.1.17.2 Cumulative Safety Injections and Sprays (Case B.17)...............................................B-28

Figure B.1.17.3 Water Levels in the Core (Case B.17)........................................................................B-28

Figure B.1.18.1 Pressures (Case B.18) ...............................................................................................B-29

Figure B.1.18.2 Cumulative Safety Injections and Sprays (Case B.18)...............................................B-29

Figure B.1.18.3 Water Levels in the Core (Case B.18)........................................................................B-30

Figure C.1.1.1 Water Levels in the Vessel (Case C.1)........................................................................ C-5

Figure C.1.1.2 Injection by RCIC (Case C.1) ...................................................................................... C-6

Figure C.1.1.3 Maximum Cladding and Core Exit Coolant Temperatures (Case C.1)........................ C-6

Figure C.1.1.4 Containment Pressures (Case C.1)............................................................................. C-7

Figure C.1.2.1 Injection by RCIC (Case C.2) ...................................................................................... C-9

Figure C.1.2.2 Water Levels in the Vessel (Case C.2)........................................................................ C-9

Figure C.1.2.3 Maximum Cladding and Core Exit Coolant Temperatures (Case C.2)...................... C-10

Figure C.1.3.1 Pressure in the Reactor Pressure Vessel (Case C.3) ............................................... C-11

Figure C.1.3.2 Water Levels in the Reactor Pressure Vessel (Case C.3) ........................................ C-12

Figure C.1.3.3 Maximum Cladding and Core Exit Coolant Temperatures (Case C.3)...................... C-12
xvi

Figure Page

Figure C.1.4.1 Injection by RCIC (Case C.4) .................................................................................... C-13

Figure C.1.4.2 Water Levels in the Vessel (Case C.4)...................................................................... C-14

Figure C.1.4.3 Maximum Cladding and Core Exit Coolant Temperatures (Case C.4)...................... C-14

Figure C.1.5.1 Injection by RCIC (Case C.5) .................................................................................... C-15

Figure C.1.5.2 Water Levels in the Vessel (Case C.5)...................................................................... C-16

Figure C.1.5.3 Maximum Cladding and Core Exit Coolant Temperatures (Case C.5)...................... C-16

Figure C.1.6.1 Injection by RCIC (Case C.6) .................................................................................... C-17

Figure C.1.6.2 Water Levels in the Vessel (Case C.6)...................................................................... C-18

Figure C.1.6.3 Maximum Cladding and Core Exit Coolant Temperatures (Case C.6)...................... C-18

Figure C.1.8.1 Maximum Cladding and Core Exit Coolant Temperatures (Case C.8)...................... C-20

Figure C.1.9.1 Maximum Cladding and Core Exit Coolant Temperatures (Case C.9)...................... C-21

Figure C.1.10.1 Maximum Cladding and Core Exit Coolant Temperatures (Case C.10).................... C-22

Figure C.1.11.1 Maximum Cladding and Core Exit Coolant Temperatures (Case C.11).................... C-22
xvii

LIST OF TABLES

Table Page

Table 2.1.1 Byron Plant Data.............................................................................................................. 3

Table 2.2.1 Surry Plant Data............................................................................................................... 8

Table 2.3.1 Peach Bottom Plant Data .............................................................................................. 14

Table 2.4.1a Comparisons of Design Data for Byron/Braidwood, Callaway, Comanche Peak, 

and Vogtle Reactors (SI units)....................................................................................... 21

Table 2.4.1b Comparisons of Design Data for Byron/Braidwood, Callaway, Comanche Peak, 

and Vogtle Reactors (English units) .............................................................................. 24

Table 2.4.2 Summary of Byron/Braidwood, Callaway, Comanche Peak, and Vogtle Design 

Features......................................................................................................................... 27

Table 2.4.3 Comparisons of Time of Core Uncovery for Byron/Braidwood, Callaway, 

Comanche Peak, and Vogtle Nuclear Power Plants ..................................................... 30

Table 2.4.4 MELCOR-Predicted Times of Core Damage and Corresponding Water 

Level (Byron).................................................................................................................. 30

Table 2.4.5 Estimated Times of Core Uncovery and PCT Attaining 1,478 K (2200 °F) for 

SBO Scenarios at the Byron/Braidwood, Callaway, Comanche Peak, and 

Vogtle Nuclear Power Plants ......................................................................................... 32

Table 3.1.1 Conditions of the Loss of DC Bus 111 Scenario ........................................................... 35

Table 3.1.2 Conditions of the Shutdown Scenario ........................................................................... 37

Table 3.2.1 Conditions of the SGTR Scenario ................................................................................. 40

Table 3.3.1 Conditions of the SBO/RCIC Scenario .......................................................................... 41

Table 3.4.1 Summary of the Timing of Key Events for the Base- and Sensitivity-Case 

Calculations ................................................................................................................... 43

Table 4.1 Core Damage Surrogates.............................................................................................. 45

Table 4.1.1 Times of Core Damage (in Hours) According to Various Surrogate Measures 

Compared Among Base and Sensitivity Cases of Byron LoDC Bus 111 B&F 

Scenario......................................................................................................................... 48

Table 4.1.2a Bins and Statistics for Times to Start of Core Uncovery, Byron LoDC Bus 111 

B&F Scenario................................................................................................................. 49

Table 4.1.2b Bins and Statistics for Times for PCT to Exceed 1,478 K (2,200 °F), Byron 

LoDC Bus 111 B&F Scenario ........................................................................................ 49
xviii

Table Page

Table 4.1.3 Times of Core Damage (in hours) According to Various Surrogate Measures 

Compared Among Base and Sensitivity Cases of Byron Shutdown Scenario.............. 51

Table 4.1.4a Bins and Statistics for Times to Start of Core Uncovery, Byron Shutdown 

Scenario......................................................................................................................... 52

Table 4.1.4b Bins and Statistics for Times for PCT to Exceed 1478K (2200 °F), Byron 

Shutdown Scenario........................................................................................................ 53

Table 4.2.1 Times of Core Damage (in Hours) According to Various Surrogate Measures 

Compared Among Base and Sensitivity Cases of Surry Scenario SGTR-9 ................. 55

Table 4.2.2a Bins and Statistics for Times to Start of Core Uncovery, Surry SGTR Scenario .......... 56

Table 4.2.2b Bins and Statistics for Times for PCT to Exceed 1478K (2200 °F), Surry SGTR 

Scenario......................................................................................................................... 56

Table 4.3.1 Times of Core Damage (in Hours) According to Various Surrogate Measures 

Compared Among Base and Sensitivity Cases of Peach Bottom SBO with 

RCIC until the Battery Depletion Scenario .................................................................... 59

Table 4.3.2a Bins and Statistics for Times to Start of Core Uncovery, Peach Bottom SBO 

with RCIC Scenario ....................................................................................................... 60

Table 4.3.2b Bins and Statistics for Times for PCT to Exceed 1,478 K (2,200 °F), Peach 

Bottom SBO with RCIC Scenario .................................................................................. 60

Table 4.4.1 Summary of Core Damage Timings for Base-Case Calculations ................................. 62

Table 5.1 Matrix of Scenarios for Calculating Recovery Actions................................................... 63

Table 5.2 Summary of Calculated Time for Successful Recovery Actions (Peach Bottom 

and Byron Plants) .......................................................................................................... 65

Table 6.1 Uncertainty Distribution for Power Level at Start of LoMFW Event Initiation ................ 69

Table 6.2 Uncertainty Distribution for Time of Reactor Trip .......................................................... 71

Table 6.3 Uncertainty Distribution in Time of AFW Failure............................................................ 73

Table 6.4 Sampled Values of All Input Parameters for 100 Samples ........................................... 75

Table 6.5 MELCOR Analysis Results for Configurations 1 and 2 ................................................. 79

Table 6.6 Summary of the Rank Regression Results.................................................................... 81

Table 6.7 Sensitivity to Sample Size ............................................................................................. 82

Table 6.8 Comparison of the EPRI-MAAP Analysis and the Current MELCOR Analysis............. 83
xix

Table Page

Table A.1 Loss of Bus 111 with the B&F: System, Phenomenological, and Operator 

Action Assumptions ......................................................................................................A-2

Table A.2 Sensitivity Cases for Byron Loss of Bus 111 with Bleed and Feed Scenario ..............A-4

Table A.3 Timing of Key Events Predicted for the MELCOR Model Loss of Bus 111 with 

Bleed and Feed Base-Case Calculation (Times in Hours Unless Stated 

Otherwise).....................................................................................................................A-5

Table A.4 Timing of Key Events Predicted for the MELCOR Model Bus Loss with Bleed 

and Feed Sensitivity Case 2 Calculation (Times in Hours Unless Stated 

Otherwise)...................................................................................................................A-17

Table A.5 Shutdown: System, Phenomenological, and Operator Action Assumptions..............A-36

Table A.6 Sensitivity Cases for the Byron Shutdown Scenario ..................................................A-37

Table A.7 Timing of Key Events Predicted for the MELCOR Model Shutdown BaseCase Calculation.........................................................................................................A-40

Table A.8 Timing of Key Events Predicted for the MELCOR Model Shutdown SensitivityCase 2 Calculation......................................................................................................A-51

Table A.9 Timing of Key Events Predicted for the MELCOR Model Shutdown SensitivityCase A.2.7b Calculation .............................................................................................A-72

Table A.10 Timing of Key Events Predicted for the MELCOR Model Shutdown SensitivityCase A.2.7d Calculation .............................................................................................A-74

Table B.1 List of Operator Actions for the SGTR Sequence.........................................................B-4

Table B.2 Sensitivity Cases for Surry SGTR................................................................................B-5

Table B.3 Timing of Key Events Predicted for the MELCOR Model SGTR Base-Case 

Calculation (Case B.1) ..................................................................................................B-7

Table B.4 Comparison of Times of Events (in Hours) among SGTR Base and Sensitivity 

Calculations ................................................................................................................B-32

Table C.1 Assumptions Applicable to SBOs with the RCIC Operating until Battery 

Depletion...................................................................................................................... C-2

Table C.2 Sensitivity Cases for Peach Bottom SBO with RCIC Operation until the Battery 

Depletion...................................................................................................................... C-4

Table C.3 Timing of Key Events in the Base-Case Calculation ................................................... C-5

Table C.4 Timing of Key Events – Case 2 ................................................................................... C-8

xxi

EXECUTIVE SUMMARY

As part of the routine development, maintenance, and application of the US Nuclear Regulatory 

Commission’s (NRC’s) risk tools, assumptions are made with respect to how nuclear power plant 

accidents will be represented in the risk assessment framework. The NRC conducts research, and 

performs analyses, to investigate the adequacy of these assumptions. Recently, the Office of Nuclear 

Regulatory Research has increased its use of the MELCOR computer code for investigating assumptions 

related to the success criteria, sequence timing, and end-state definition aspects of Level 1 probabilistic 

risk assessment (PRA). Success criteria are used in PRAs for establishing the system or component 

requirements for satisfying a particular safety function (e.g., to develop system fault tree logic). Sequence 

timing assumptions are used for establishing time frames for how long a piece of equipment must operate 

or by what point an operator action must be taken, and are frequently used in human reliability analysis. 

End-state definition assumptions (e.g., a core damage surrogate of 1478K (2200 °F) peak clad 

temperature) are used for binning accident sequences into success or failure end-states, such that core 

damage frequency can be calculated. All of these assumptions are required by a PRA model because it is 

a Boolean logic representation of plant accident scenarios that captures a multitude (e.g., tens of 

thousands) of different failure combinations, and therefore cannot reasonably utilize a thermal-hydraulic 

computer code to simulate each accident sequence.

This report augments the existing collection of contemporary Level 1 PRA success criteria analyses for 

the purpose of (i) maintaining and enhancing the Standardized Plant Analysis Risk (SPAR) models; 

(ii) supporting the NRC’s risk analysts when addressing specific issues in the Accident Sequence 

Precursor (ASP) program and the Significance Determination Process (SDP); and (iii) informing other 

ongoing and planned initiatives. The report also completes some work that was initiated as part of a 

previous effort, namely the investigation of core damage surrogates described in Section 2 of 

NUREG-1953, “Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the 

Standardized Plant Analysis Risk Models – Surry and Peach Bottom,” as well as complimenting other 

ongoing work related to success criteria analyses for the Byron Station that will be documented in an 

upcoming NUREG report. Figure ES-1 depicts how the current report fits in to this broader set of 

activities.

Figure ES-1 Relationship of This Report to Other Activities
xxii

This report focuses on investigations of (a) the effect of modeling assumptions on key PRA figures-ofmerit such as the time of depletion of the refueling water storage tank; (b) the relative conservatism or 

non-conservatism associated with commonly used and potential core damage surrogates; (c) the time 

required to arrest fuel heatup if mitigation equipment is recovered following a core heatup; and (d) the 

comparison of MELCOR to the Modular Accident Analysis Program (MAAP) for characterizing the safety 

margins of selected PRA sequences through an uncertainty quantification process.

The report supports the following general conclusions:

• Variations in modeling assumptions (e.g., the effect of reactor coolant system makeup flow prior 

to a safety injection signal, specification of the hydraulic momentum exchange length) were found 

to have a modest effect on intermediate figures-of-merit of interest in a Level 1 PRA (e.g., time to 

steam generator dry out). However, some particular modeling assumptions were found to have a 

significant effect and should be considered (e.g., by creating an additional initiating event bin) if 

they are likely to influence a particular end-use. Examples include: (i) break size and location; 

(ii) number of ruptured steam generator tubes; (iii) reactor power level at the time of trip; 

(iv) timing of early operator actions; (v) time of battery depletion; (vi) behavior of turbine-driven 

systems after battery depletion; and (vii) stochastic failure in the open or partially open position of 

relief valves.

• For selection of core damage surrogates for at-power accidents, a peak cladding temperature in 

excess of 1,478 K (2,200 °F) is an appropriate choice for a core damage surrogate for MELCOR 

success criteria applications, because it is not overly-conservative or overly non-conservative. For 

shutdown conditions, a single metric may not be sufficient for prescribing a realistic surrogate for 

core damage. Rather, a combination of shutdown core damage surrogates could be used 

including low reactor pressure vessel water level (one-third of the fuel height); temperature (PCT 

above 1,478 K); and a Cesium-class release fraction (3 percent released from fuel). In particular, 

the limited PWR shutdown analyses performed in this study would suggest a one-third active fuel 

height as a precursor to fuel damage (e.g., gap release) and a PCT above 1,478 K as a precursor 

to more significant fuel damage. Additional clarifying remarks are provided in the report.

• With regards to the time necessary to arrest fuel heatup (referring to the difference in time 

between when recovered injection or cooling capabilities resume their function and the time at 

which the fuel temperature begins to decrease), the present results indicate that a margin of five 

to ten minutes are generally sufficient for recovery of injection. A much longer time period was 

required for a case which considered recovery of closed-loop cooling during shutdown. The 

present analysis did not consider situations where additional recovery actions are happening 

concurrently (such as automatic depressurization), which might have competing effects on water 

inventory. Thus, these results should not be applied to those situations. A specific application will 

also need to consider the additional time required for tasks such as realigning systems and 

resetting reactor control system permissives.

• For a particular scenario studied (loss of all feedwater with charging unavailable), a MELCOR 

uncertainty analysis replicating the input assumptions from a recently-published Modular Accident 

Analysis Program version 4 (MAAP4) uncertainty analysis showed good agreement between the 

two codes in terms of the fraction of accident simulations predicted to result in core damage.

More details regarding these conclusions are available in associated sections of the report.
xxiii

ACKNOWLEDGMENTS

The authors wish to acknowledge the contributions of several United States Nuclear Regulatory 

Commission (NRC) staff including Jeff Mitman, Jeffery Wood, and Selim Sancaktar, who provided input 

into the selection of boundary conditions for the Byron shutdown analyses; James Corson, who provided 

recommendations for improving the Byron MELCOR model and some associated analyses; Michelle 

Flanagan, who consulted on 10 Code of Federal Regulations 50.46 aspects; and Laura Kozak, who 

facilitated a site visit and information gathering for the Byron model.

The authors also wish to acknowledge Kenneth Wagner (dycoda) and Andrew Goldman (Sandia National 

Laboratories), who performed some of the work on the Surry steam generator tube rupture analysis.

In addition, the authors acknowledge Richard Sherry and Jeff Gabor of ERIN Engineering, who answered 

questions about an Electric Power Research Institute (EPRI)-sponsored study that is referenced in this 

report.

Finally, the authors wish to acknowledge Exelon for providing detailed design and operational information 

about the Byron station, and for supporting a site visit and telephone calls to ensure that boundary 

conditions were well-informed.

This work was performed under the auspices of the NRC Office of Nuclear Regulatory Research, under 

contract number NRC-HQ-11-C-04-0054 with Energy Research, Inc. 

xxv

ACRONYMS

Acronym Definition

AC Alternating Current

ADS Automatic Depressurization System

AFW Auxiliary Feedwater

B&F Bleed & Feed

BWR Boiling-Water Reactor

CCDF Complementary Cumulative Distribution Function

CCW Component Cooling Water

CDF Cumulative Distribution Function

CRD Control Rod Drive

CST Condensate Storage Tank

DC Direct Current 

ECCS Emergency Core Cooling System

EOP Emergency Operating Procedure

EPRI Electric Power Research Institute

ERI Energy Research, Inc.

FSAR Final Safety Analysis Report 

FW Feedwater

HHSI High-Head Safety Injection

HPCI High-Pressure Coolant Injection

HPI High-Pressure Injection

LER Licensee Event Report

LHSI Low-Head Safety Injection

LHS Latin Hypercube Sampling

LOCA Loss-of-Coolant Accident

LoDC Loss of DC

LoMFW Loss of Main Feedwater 

LPCS Low-Pressure Core Spray 

MAAP Modular Accident Analysis Program

MPa megaPascal
xxvi

Acronym Definition

MPa-g megaPascal-gauge 

MFW Main Feedwater

MSIV Main Steam Isolation Valve

MSTV Main Steam Turbine Valve

NPSH Net Positive Suction Head

NR Narrow Range

NRC Nuclear Regulatory Commission

PCC Partial Correlation Coefficient

PCT Peak Cladding Temperature 

PDF Probability Distribution Function

PORV Pilot Operated Relief Valve

POS Plant Operating State

PRA Probabilistic Risk Assessment

psig pounds per square inch gauge

PWR Pressurized Water Reactor

RCFC Reactor Containment Fan Cooler

RCIC Reactor Core Isolation Cooling

RCP Reactor Coolant Pump

RCS Reactor Coolant System

RHR Residual Heat Removal

RPV Reactor Pressure Vessel

RWST Reactor Water Storage Tank

S Byron terminology for an SI signal

SBO Station Blackout

SC Success Criteria

SG Steam Generator

SGT Steam Generator Tube

SGTR Steam Generator Tube Rupture

SI Safety Injection

SNL Sandia National Laboratories
xxvii

Acronym Definition

SOARCA State-of-the-Art Reactor Consequence Analyses

SPAR Standardized Plant Analysis Risk

SRV Safety Relief Valve

TAF Top of Active Fuel

TBV Turbine Bypass Valve 

TCD Temperature of Core Damage 

VCT Volume Control Tank

WR Wide Range

1

1. INTRODUCTION

To date, the success criteria in the United States Nuclear Regulatory Commission’s (NRC’s) 

Standardized Plant Analysis Risk (SPAR) models have, for the most part, been extracted from those used 

in the associated licensee Probabilistic Risk Assessment (PRA) models. The licensees’ PRAs have used 

a variety of methods to determine success criteria, including conservative design-basis analyses and 

more realistic best-estimate methods. Consequently, in some situations plants that should behave 

similarly from an accident sequence standpoint were observed to have different success criteria for 

specific accident scenarios. This issue has been recognized for some time, but the infrastructure was not 

in place until recently at the NRC to support the refinement of these criteria [1].

The MELCOR computer code has been under development at Sandia National Laboratories (SNL) with 

NRC support. The code is designed for application to severe accident analyses and PRA studies. NRC 

recently initiated an activity applying MELCOR to level-1 PRA success criteria analyses, including the 

evaluation of several options for defining core damage in level-1 PRA studies and for conducting success 

criteria analyses for (1) a 3-loop Westinghouse pressurized-water reactor (PWR) with a sub-atmospheric 

containment [1]; (2) a boiling-water reactor (BWR) with a Mark I containment [1]; and (3) a 4-loop 

Westinghouse PWR with a large, dry containment (NUREG forthcoming). 

This report augments the existing collection of contemporary Level 1 PRA success criteria analyses for 

the purpose of (i) maintaining and enhancing the SPAR models developed by the NRC; (ii) supporting the 

NRC’s risk analysts when addressing specific issues in the Accident Sequence Precursor (ASP) program 

and the Significance Determination Process (SDP); and (iii) informing other ongoing and planned 

initiatives. The report also completes some work that was initiated as part of a previous effort, namely the 

investigation of core damage surrogates described in Section 2 of NUREG-1953 [1], as well as 

complimenting other ongoing work related to success criteria analyses for the Byron Station that will be 

documented in an upcoming NUREG report.

Section 2 of this report provides a description of the three plants used in subsequent MELCOR analysis, 

salient plant design information, and analytical formulations of interest. This sets the stage for the 

subsequent sections which focus on investigations of (a) the effect of modeling assumptions on key 

figures-of-merit such as the time of depletion of the refueling water storage tank (Section 3); (b) the

relative conservatism or non-conservatism associated with commonly used and potential core damage 

surrogates (Section 4); (c) the time required to arrest fuel heatup if mitigation equipment is recovered 

following a core heatup (Section 5); and (d) the comparison of MELCOR to the Modular Accident Analysis 

Program (MAAP) for characterizing the safety margins of selected PRA sequences through an 

uncertainty quantification process (Section 6).

A PWR represented by the Byron Unit 1 plant was selected to illustrate the analysis of an accident 

initiated by a partial loss of onsite power. Sections 3.1.1 and 4.1.1 (and Appendix A) of this report 

specifically analyze the Byron sequence referred to as the Loss of DC Bus 111 with Bleed and Feed 

(B&F). The Surry plant was selected to illustrate the analysis of an accident initiated by a steam generator 

tube rupture (SGTR). Sections 3.2 and 4.2 (and Appendix B) of this report analyze the sequence referred 

to as SGTR-9. For a case involving a BWR, the Peach Bottom plant is considered. Sections 3.3 and 4.3 

(and Appendix C) of this report specifically focus on an analysis of the sequence referred to as a station 

blackout (SBO) with reactor core isolation cooling (RCIC) until battery depletion. An analysis of a loss of 

coolant accident for the Byron plant arising during shutdown conditions is described in Sections 3.1.2 and 

4.1.2 (and the latter part of Appendix A). In addition, to compare simulations that used the MELCOR 

versus the MAAP computer code [2], the Byron loss of main feedwater (FW) accident scenario was 

reanalyzed using a stratified Monte Carlo approach as documented in Section 5.

Applicability of the analysis in this report to new large light water reactors (LWRs) and advanced integral 

pressurized water reactors (iPWRs) is limited based on consideration of specific design differences that 

would affect the results being used. Since some of these new designs have significant differences relative 
2

to the plants studied in this report, accidents and timings may be significantly different. The relative timing 

between reaching core damage surrogates and reaching different figures-of-merit would also be 

susceptible to differences in plant design and operation. The order of reaching core damage surrogates 

and different figures-of-merit would be the most transferrable to new plant designs, but could be affected 

by differences in system capacities and core design. The analysis in this report is not expected to have 

any applicability to significantly different designs beyond the new large LWRs and iPWRs such as the 

advanced non-light water reactors.

The analyses contained herein are intended to be confirmatory in nature, and while suitable for their 

intended use in supporting the NRC’s risk activities they are not intended to be used by licensees for riskinformed licensing submittals. 
3

2. DESCRIPTIONS OF PLANTS AND MODELS

2.1 Byron Unit 1 Plant and MELCOR Model

Energy Research Inc. prepared the Byron MELCOR model input deck and maintains supporting

documentation for this MELCOR deck, including an account of the various model/deck revisions. The 

model represents Unit 1; Section 2.4 of this report documents some of the differences that exist between 

Byron Unit 1 and Byron Unit 2. Most of the plant-specific data for the model are derived from the 

Byron/Braidwood Final Safety Analysis Report (FSAR), although additional data is drawn from many 

other sources (e.g., plant models for similar plants). High-level design parameters for the plant are listed 

in Table 2.1.1.

Table 2.1.1 Byron Plant Data

Characteristic Value (as modeled)

Design Type Four-loop Westinghouse PWR

Containment Type Large Dry

Power Level 3,586.6 MWt

Number of Centrifugal Charging Pumps (also used for 

high-head safety injection)

Two

Number of Safety Injection (SI) Pumps Two

Number of SI Trains Two

Pressure Corresponding to Charging / SI Dead-Head 17.9 MPa (2,600 psia) /

10.7 MPa (1,550 psia)

Lowest Pressurizer PORV Opening/Closing Setpoint 16.2 MPa (2,350 psia) /

16.067 MPa (2,330 psia)

Number of Cold-Leg Accumulators One per loop (four total)

Nominal Operating Pressure 15.5 MPa (2,250 psia)

RWST Volume Technical Specification 1,495 cubic meters (395,000 gal)

Most calculations described in this report were made with Revision 5 of the input deck.1 All of the 

calculations used the “YV-3272” release of the MELCOR/MELGEN version 1.8.6, except for one 

sensitivity calculation pertaining to the “Loss of DC Bus 111 with a B&F” scenario that used MELCOR 

version 2.1.

Figures 2.1.1 through 2.1.3 show the MELCOR model nodalizations. For the purposes of the success 

criteria calculations, the containment is adequately represented by one node, because this nodalization 

scheme adequately predicts bulk containment pressure and temperature response. Were the deck to be 

used for Level 2 PRA purposes, this nodalization would need to be refined. Regarding Figure 2.1.3, the 

control volumes in the model are designated by a 3-digit number where the first digit (3, 4, 5, or 6)

corresponds to loops D, A, B, and C, respectively, in the plant nomenclature.2

 1 The power level used in this report is the power level before the 1.63% power uprate currently undergoing NRC 

review. The calculations described in this report that pertain to the “Loss of DC Bus 111 with B&F” scenario were 

made with an enhanced version of the Revision 5 input deck that included the following two changes: (i) correction of 

the setpoint for scram on a low RCS pressure and (ii) adjustment of the water volumes delivered from the RWST at 

levels Lo-2 and Lo-3 to be more realistic. Note that the first of these changes is irrelevant to the LoDC Bus 111 B&F 

scenario, and the second affects only one of the sensitivity cases (Case A.1.2). The enhanced Revision 5 input deck 

was the starting point for the development of the Shutdown input deck used in the Section 4.1.2 calculations.

2 This lettering versus numbering scheme is that of Revisions 7 and later (Revision 5 does not introduce any lettering 

scheme). The various revisions of the input deck differ on their treatment of differences among the four loops. Of 

these loop-to-loop differences, only the existence of the pressurizer in one loop is expected to have an effect in most 

scenarios. The enhanced version of Revision 5 introduced a difference by assuming that each ECCS pump (there are 

two of each kind) injects into pairs of legs. Apart from that (and the pressurizer), the loops were treated identically in 
4

The Byron "Shutdown" model applies to a phase of shutdown operations, when the reactor coolant 

system (RCS) is closed and 24 hours have elapsed since reactor shutdown. The following bullets 

summarize the main differences between the Shutdown model and the main model:

• The decay heat is calculated at a shifted time t’ = t + 24 hours, where t is the simulation time. (During 

the pre-transient part of the calculation [i.e., during -5000 s < t < 0 s], the decay heat is constant at 

21.29 MW, which is the decay heat generation rate at 24 hours.)

• The closed-loop operation of one residual heat removal (RHR) pump provides the decay heat 

removal by taking suction from the pressurizer-loop (Loop D) hot leg. The outflow passes through an 

RHR heat exchanger and is then injected into the cold legs of Loops A and D. The RHR heat 

exchanger is modeled with a shell-side component cooling water temperature of 314 K (105 °F) and 

an efficiency of 0.609. The flow rate is controlled by feedback logic to maintain a constant coolant 

temperature at the core exit.

• Initial water temperatures throughout the RCS (primary and secondary sides) are assumed to be 

466.5 K (380 °F). Initial pressures are the corresponding saturation pressure (1.35 megaPascal 

[MPa]). (A sensitivity study is performed later to demonstrate the effect of subcooling.)

• There is a provision for a break outside of the containment in the RHR lines that feed the cold legs of 

Loops B and C; the initial flow rate of this flow area is about 1,000 gpm (0.063 m3

/s).

 

that revision. Revisions 7 and later credit equal injection of each ECCS pump into all legs, but introduce loop-to-loop 

differences in the secondary sides (e.g., volumes of main steam lines).
5

115

A

ctiv

e fuel L

o

w

er plenum

Core support 

Lower core plate

Support columns

 

Core barrel

Lower head

114

113

112

111

110

109

108

107

106

105 205 305 405 505

103 203 303 403 503

501

104

102

101 201

202

204

206 306

301 401

302 402 502 602

406 506

207 307 407 507

208 308 408 508

209 309 409 509

210 310 410 510

211 311 411 511

212 312 412 512

213 313 413 513

214 314 414 514

215 315 415 515

304 404 504

Figure 2.1.1 Reactor Core and Lower Plenum Nodalization
6

Lower plenum

120

120

130

141 151 161 171 181

142 152 162 172 182

143 153

144

145

146

148

Upper head

195

154 174 184

155 165 175 185

176 186

158 168 178 188

190 189 Bypass 110

111

Downcomer 110

178

169159149

149 159 169 179 189

248 258 268 278

147 157 167 177 187

148 158 168 178 188

145 155 165 175 185 191

246 256 266

276

245 255 265 275

144 154 164 174 184

244 254 264 274

243 253 263 273

143 153 163 173 183

142 152 162 172 182

141 151 161 171 181

140 150 160 170 180

242 252 262 272

241 251 261 271

Core Upper plenum

 y p 

190

156 166

164

163 173 183

To hot legs

277 187

To hot legs

(lower part)

(upper part)

186 Leakage flow

283

282

281

280

279

Figure 2.1.2 Reactor Pressure Vessel Control Volume and Flow Path Nodalization
7

444

Loop C

244

Feedwater 

inlet

Loop A

480 Steam line

MSIV

FL378 370

Loop D

Feedwater 

inlet

370

360

360

305

330

305

302

PRT

308

PORV

394

Rupture 

Disk

300 302

187

011

Loop B

340

033

320

346

342

344

310

470

460

365

443

243

MELCOR nodalization of the Byron reactor coolant system

FL308, 309, 

306

312

, 307

SRV

400 320

446 448 444

RPV

348

011

620

642 542

245

544 546 548

446

644 646 648

600

442

FL372-376 FL472-476

RVs 1~5 RVs 1-5

465

460

Feedwater 

inlet 

RVs 1~5 RVs 1~5

FL672~676

680 580

FL572~576

570 670

044

043

to CV700 

470 380 Steam line Steam line 

common header 700

640

540

334

633

433

333

223

423

623

332 333

186

321 337

338

Accumulator

(mass source)

CF5607 CF5958

SI pump injection

(mass source)

MSIV

FL478

MSIV

FL678

440

187

421 437

438

223 323 533 633

321

310

311 313 314 339

RCP

346

311

348

334

434

634

034 224

424

624

430

434

224 324 534 634

Accumulator

(mass source)

CF5617

SI pump injection

(mass source)

CF5958

RCP

432 433

670

660

665

670

640

336

436

636

036 226

426

626

630

634

226 326 536 636

632 633

448 446

420

410 410

411

420

421

414 413 411 439

610

610

611

620

621

614 613 611 639

186

621 637

638

648

SI pump injection

(mass source)

CF5858

Accumulator

(mass source)

CF5818

646

246

445

570

560

565

570

540

335

435

635

035

225

425

625

530

534

225 325 535 635

532 533

500 510

520

537

538

521

510

511 513 514 539

511

521 520

SI pump injection

(mass source)

CF5807

Accumulator

(mass source)

CF5858

548 546

RCP RCP

FL462

FL662

FL362

054

053

055

056

650

450 350

550

SI pump injection

(mass source)

CF5967

SI pump injection (mass source) CF5967

SI pump injection

(mass source)

CF5867

SI pump injection

(mass source)

CF5867

Sink 702

Throttle 682 683 Condenser 

Steam Dump

CF8494

704 Hotwell CF8548

CF8568 to

CV650

CF8558

CF8538

to

CV550

PORV

FL377

PORV

FL477

PORV

FL677

P

Figure 2.1.3 Reactor Coolant System Nodalization
8

2.2 Surry Plant and MELCOR Model

The Surry MELCOR model input deck was prepared at Sandia National Laboratories, under NRC 

sponsorship, as part of the State-of-the-Art Reactor Consequence Analyses project [3]. High-level design 

parameters for the plant are listed in Table 2.1.1.

Table 2.2.1 Surry Plant Data 

Characteristic Value (as modeled)

Design Type Three-loop Westinghouse PWR

Containment Type Sub-atmospheric

Power Level 2,546 MWt1

Number of Centrifugal Charging Pumps (also used for 

high-head safety injection)

Three

Number of HHSI Trains Two

Pressure Corresponding to HHSI Dead-Head 17.65 MPa (2,560 psia)

2

Lowest Pressurizer PORV Opening/Closing Setpoint 16.2 MPa (2,350 psia) / 

15.6 MPa (2,260 psia)

Number of Cold-Leg Accumulators One per loop (three total)

Nominal Operating Pressure 15.4 MPa (2,235 psia)

RWST Volume Technical Specification 1,470 cubic meters (387,100 gal) 1 The power level used in this report is the power level before the October 2010 measurement uncertainty 

recapture power uprate of 1.6%. 2 Table 6.2-5 of the FSAR provides a design head of 5800 ft (1.8% lower than the 5,905 feet that the stated value 

corresponds to). The MELCOR input model takes this design pressure in to account when specifying the pump 

curve, but bases the shutoff conditions on actual test data (Byron Jackson Test T-30705-3).

Figures 2.2.1 through 2.2.5 were reproduced from the SNL Surry model documentation; they show the 

MELCOR model nodalizations. NRC provided the MELCOR input deck, the raw output for calculations 

B.1 through B.20, and some incomplete and preliminary documentation to ERI. All of the calculations 

used the “YV” release of MELCOR/MELGEN version 1.8.6. (SNL performed calculations B.1 through 

B.20; ERI performed calculation B.21 and all of the analyses.)
9

Figure 2.2.1 Nodalizations of the Core and Lower Part of the Vessel
10

Figure 2.2.2 Nodalization of Upper Part of the Vessel 
11

Figure 2.2.3 Nodalization of the Surry RCS 

CV530 - PRT

Reactor Vessel

(see detailed 

drawings)

Steam Generator

 1-RC-E-1B

(see hot leg/steam 

generator Loop B detail)

Steam Generator

 1 RC - -E-1A

(see hot leg/steam 

generator Loop A detail)

Steam Generator

 1-RC-E-1C

(see hot leg/steam 

generator Loop C detail)

CV220 CV235

CV101

CV153

CV201 CV / 222

CV202 CV / 221

CV401/CV422

CV402/CV421

CV437 CV440

237 CV 240 CV

435 CV 420 CV

500 CV

CV520

Pressurizer

FL241

FL242

FL243

FL244

FL442

FL443 FL444

FL441

FL201/FL240

FL202/FL292

FL231

FL431

CF206

Accumulator

(Mass 

Source)

Accumulator

(Mass 

Source)

CF206

HHSI LHSI

CF222

CF218

RWST Suction (Mass Source)

Containment Sump 

Suction Mass Source ( )

CF942

FL401/FL440

FL402/FL492

LHSI

HHSI

CF222

CF218

RWST Suction (Mass Source)

Containment Sump 

Suction (Mass Source)

CF942

Rupture 

Disk

FL540

PRT 

Cubicle

CV042

SRV-3

FL538

SRV-2

FL537

PORV-1, FL530

PORV-2, FL531

SRV-1

FL535

FL505

FL510

CV301/CV322 CV302/CV321

FL301/

FL340

FL202/

FL292

320 CV 335 CV

CV337

CV340

FL342

FL331

FL341

FL343

FL344

Accumulator

Mass (

Source) CF206

HHSI

LHSI

CF218

RWST Suction (Mass Source)

Containment Sump 

Suction (Mass Source)

CF942

CF222

RC

Pump

RC

Pump

RC

Pump

RCP Seal Leakage to 

SG A Cubicle – CV020

FL901 (21 gpm)

FL911 (182 gpm)

FL921 (500 gpm)

FL903 (21 gpm)

FL913 (182 gpm)

FL923 (500 gpm)

FL902 (21 gpm)

FL912 (182 gpm)

FL922 (500 gpm)

Aux. Bldg.

CV817

FL997 - Letdown Line Bypass

RCP Seal Leakage to 

SG C Cubicle – CV040

RCP Seal Leakage to 

SG B Cubicle – CV030

Pressurizer 

Surge Line

Loop B

Loop C

Loop A

FL283270 CV 280 CV

CV281 

Turbine

MSIV

FL286

Steam Tra

FL287

SRV-2/3/4/5

SRV-1, FL

PORV, FL

Flow Restri

FL285

FL288 

FL483480 CV 470 CV

CV281 

Turbine

MSIV

FL486 Steam Tr

FL487

Flow Restri

FL485

SRV-1, FL

PORV, FL

FL488 

SRV-2/3/4/5

380 CV 370 CV

CV281 

Turbine

MSIV

FL386 Steam Trap

FL387

Flow Restrictor

FL385

SRV-1, FL363

PORV, FL362

CV998

Environment

FL388 CV295

TDAFW Pump

SRV-2/3/4/5, FL364

FL383

FL893 Surge Line Creep Rupture Basement

CV005
12

Figure 2.2.4 Nodalization of the Surry Containment
13

Figure 2.2.5 Drawing of a Steam Generator and Nodalization of Steam Generator A

RPV

CV209

CV211

CV212

CV215

CV213

CV217

CV216

CV214

CV225

CV226

FL233

FL294

FL218 FL228

FL216 FL215

FL227 FL217 FL295 FL265

CV201 CV202

CV222 CV221

CV153

CV152

FL291

FL296

FL231

FL292

FL202 FL240

FL201 FL210

FL211

FL250 CV260

CV265CV260

CV250

CV250

FL830 & FL831

FL252

FL253

FL254

FL283

SG Tube Creep Rupture

FL205

FL873 Creep Rupture

SG A

Cubicle

CV020

FL206 FL293

FL266

FL245

Main Feedwater

(Mass Source) CF251

Turbine Driven Aux. Feedwater

(Mass Source) CF253

Motor Driven Aux. Feedwater

(Mass Source) CF1325

to CV270

and Turbine

to CV220

Hot Leg

Cold Leg

Loop A

Natural Circulation Flow Path Definitions

(identified in red on diagram)

*Natural circulation entry conditions defined as (a) 

hot leg CVs <5% water, (b) >10 K super heat in hot 

leg, and (c) recirculation pumps tripped.

*Maintain natural circulation flow paths when (a) 

hot leg CVs <10% full of water, (b) pumps are off, 

(c) no major creep rupture failures, and (d) loop 

seal flow is <20% of HL flow. (CF5672)

*FL240, FL205 and FL206 are open and FL245 is 

closed during non-natural circulation conditions. 

FL240, FL205 and FL206 are closed and FL245 is 

open in natural circulation conditions.

*FL293 and FL295 are open and FL211 and FL266 

are closed in non-natural circulation conditions. 

FL293 and FL295 are closed and FL211 and 

FL266 are open in natural circulation conditions.

*FL211/FL210 and FL266/FL265 are adjusted to 

give mixing ratio of 15%/85%.

*FL202 pressure drop adjusted to give CD = 0.12 

(from FLUENT).

*FL218 and FL227 pressure drop adjusted to give 

Tube_flow/HL_flow (Mratio) = 2.
14

2.3 Peach Bottom Plant and MELCOR Model

SNL prepared the Peach Bottom MELCOR model, under NRC sponsorship, as part of the State-of-the-Art 

Reactor Consequence Analyses project [3]. High-level information about the plant are listed in Table 

2.3.1.

Table 2.3.1 Peach Bottom Plant Data

Characteristic Value (as modeled)

Design Type General Electric Type 4 BWR

Containment Type Mark 1

Power Level 3,514 MWt

RCIC Capacity 2.27 cubic meters/min (600 gpm)

HPCI Capacity 18.9 cubic meters/min (5,000 gpm)

Lowest SRV Opening/Closing Setpoint in Relief 

Mode

7.81 MPa (1,133.5 psid3) / 

7.58 MPa (1,099.5 psid)

Nominal Operating Pressure 7.24 MPa (1,050 psia)

Suppression Pool Inventory 3,568 cubic meters (942,300 gal)

All of the calculations used the “YV-3272” release of MELCOR/MELGEN version 1.8.6 and were 

performed at ERI. Figures 2.3.1 through 2.3.4 were reproduced from the SNL Peach Bottom 

documentation and show the MELCOR model nodalizations. 

The scenario under study depends on the detailed modeling of the turbine-driven RCIC system (because 

it involves a situation where RCIC is the only available source of injection in to the reactor vessel). The 

rest of this section describes the RCIC and is closely paraphrased from the SNL Peach Bottom model 

documentation.

The RCIC system is modeled by control volumes and flow paths including the RCIC turbine (CV611) flow 

from main steam line C to the RCIC turbine (FL611), the flow from the RCIC turbine to the suppression 

pool (FL613), the flow from the condensate storage tank (CST) to the FW piping (including RCIC pump 

FL614), and the flow from the suppression pool to the FW piping (including RCIC pump FL606). Steam 

flow through the RCIC turbine is modeled to account for the transfer of energy from the steam line to the 

suppression pool during the RCIC operation.

 3 Pounds per square inch differential (psid) is the differential pressure in psi between the main steamline and the 

wetwell; the present (2012) Technical Specification value is actually 1135 psid, but this difference is judged negligible 

for the purposes of these calculations.
15

Figure 2.3.1 Nodalization of the Core Region CV514 CV524

CV534

CV544CV554

CV345

Shroud Dome

CV320

Lower 

Plenum

CVH Nodalization accompanying

COR Nodalization

CV111CV121

CV131

CV141CV

CV

151

511

CV521

CV531

CV541

CV551

CV512CV522

CV532

CV542CV552

CV112

CV122

CV132

CV142CV152

CV513CV523

CV533

CV543

CV553

CV113

CV123

CV133

CV143CV153

CV114CV124

CV134

CV144

CV154

CV515CV525

CV535CV545

CV555

CV115

CV125

CV135

CV145

CV155

BWR/4 Core Nodalization

101 201 301 401 501

Top Guide &

Upper Tie Plate

Lower Tie Plate 

& Nose Pieces

105 205 305 405 505

Height of Fuel Assemblies

Heated Fuel Length

Lower Core Plate & 

"Elephant's Foot"

Control Rod 

Guides Tubes

106 206 306 406 506

117 217 317 417 517

103 203 303 403 503

102 202 302 402 502 108 208 308 408

508

107

207

307

407507

109

209

309

409509

110

210

310

410

510

111

211

311

411511

112

212

312

412512

113

213

313

413

513

114

214

314

414514

115

215

315

415

515

116

216

316

416

516

Penetration - R1

Control Rod 

Stub Tubes

Penetration - R2Penetration - R3

Penetration - R4

Penetration - R5

Lower head

TAF

BAF

0.0 m

1.295 m

1.892 m

2.490 m

3.088 m

5.267 m

5.494 m

5.875 m

6.256 m

6.637 m

7.018 m

7.399 m

7.780 m

8.161 m

8.542 m

8.923 m

9.304 m

9.630 m

104 204 304 404 504

603

604

602
16

Figure 2.3.2 Nodalization of the Peach Bottom RCS FL387 LOOP B FL383 FL385 LOOP A FL384 FL382 FL614

CST CV360

Steam Dome

CV320

Lower Plenum

FL304

CV310

Downcomer

CV310

Downcomer

CV383

CV385

CV384

CV382

FL386

FL312 FL312

CV300

CV300

FL310 FL311

FL356

FL357

FL370

CV391

Turbine / Hotwell

(time independent)

FL371

Inboard

MSIVs

FW

Pump

CV392

Feedwater source

(time independent)

CRD

Pump

RCIC

Core Spray

(Loop 1)

CV600

FL372

FL702

FL706

FL606

CV370 (Steam Lines B, C & D)

FL399

(RV Breach)

CV350

 Steam Separators

SVs

(2 valves)

FL910

(Wetwell Vent)

to drywell

atmosphere

Drywell

CV220

CV901

Environment

FL360 - FL362,

FL364 - FL369

FL358

FL653

RHR-2 RHR-1

HPSW

FL648

FL649

FL652

SPRSR01

CV652

CV651

CV650

CV700

Reactor

Building RWCU return

(not modeled)

CV374 CV372

FL611

FL376 FL374

CV220

CV653

FL656 (LPCI)

FL655(supp.pool

cooling)

FL657(LPCI)

FL654(supp.poolcooling)

CV394

(time

independent

keep-full at

steady state)

S/RV (typical)

9 parallel valves

Turbine

Building

FL600

FL613

CV611

FL351

FL699

FL651

FL650

A C B D

CV355

Steam Dryers

FL355 FL352

FL704

SPRSR02

CV631

HPCI

FL633

FL631

FL626

FL634

CV345

 Shroud Dome

FL345

CV373 (Steam Line A) CV375 (Steam Line A)

Inboard

MSIV FL377 FL375 FL373

FL359,

FL363

S/RV (typical)

2 parallel valves
17

Figure 2.3.3 Nodalization of the Reactor Vessel
18

Figure 2.3.4 Nodalization of the Peach Bottom Containment

The RCIC pump delivers 600 gpm (0.038 m3

/s) via the MELCOR option to specify the flow velocity. 

Suction is initially aligned to the CST. The switchover of pump suction to the suppression pool occurs 

upon receipt of a low CST water level signal. This event, however, is not attained in any of the present 

simulations.

RCIC is modeled with automatic initiation and termination criteria. It is initiated upon receipt of a reactor 

vessel low level-2 signal at 472 inches (12.0 meters [m]). RCIC is terminated upon receipt of a reactor 

vessel high level-8 signal at 593 inches (15.1 m)4

. User input (CF937) may also be selected to model 

manual pump operation, where operators throttle the RCIC turbine/pump to maintain water levels at 30 

inches (0.76 m) above instrument zero at 568 inches (14.4 m) after automatic initiation.

 4 It was discovered after completion of the analyses that a value of 583 inches (14.8m) was actually used. The first 

footnote in Appendix C reports the effect on accident timing due to this setpoint deviation.
19

In the MELCOR model, the RCIC turbine-driven pump is isolated or tripped under the following 

conditions:

• loss of alternating current (AC) and direct current (DC) power 

• low main steam line C pressure (i.e., main steam line pressure ≤75 pounds per square inch gauge 

[psig] [0.52 megaPascal-gauge [MPa-g])

• high turbine exhaust pressure (i.e., suppression pool pressure ≥50 psig [0.34 MPa-g])

• suppression pool temperature above pump net positive suction head (NPSH) limits (taken as 183 

°F at 0 psig, 207 °F at 5 psig, 225 °F at 10 psig [84 °C at 0 MPa-g, 97 °C at 0.034 MPa-g, 107 °C at 

0.069 MPa-g])

• pump bearing cooling fluid temperature limit exceeded (i.e., suppression pool temperature > 220 °F 

[107 °C])

• suppression pool water level below pump suction vortex limits (taken as 0.67 feet [0.20 m])

• flooding of the main steam line (CV370) 

Note that some conditions that could actually fail the RCIC may have been omitted here. For example, 

effects on the RCIC operation of having no forced ventilation cooling in the RCIC pump room are not 

modeled. Meanwhile, some of the above trips might not be relevant for situations where the RCIC is 

being run without DC power.

The time of battery depletion (which results in loss of DC power) is user-specified by control function 

CF901. When the RCIC is operated manually, user input may specify the ongoing RCIC turbine/pump 

operation at the (fixed) speed current when the batteries are depleted (CF933).

2.4 Cross-Comparisons of Several 4-Loop Westinghouse PWRs

There are several plants that closely resemble the Byron Unit 1 plant described in Section 2.1. The 

comparison of these plants is of interest (even though the rest of this report focuses on the three plants 

discussed in Sections 2.1 through 2.3) because it will aid in an evaluation of the extension of results from 

a forthcoming and related NUREG exploring Byron success criteria.

2.4.1 Introduction

This section compares the system design data that are important to core damage progression and the 

containment response for five four-loop PWRs: the Byron, Braidwood, Callaway, Comanche Peak, and 

Vogtle plants5

. In addition, simple analytically based estimates of the time of core damage for each plant 

were compiled and compared for a typical SBO scenario. Section 2.4.2 presents key design data for the 

plants. Section 2.4.3 presents methods for calculating estimates of core damage and related results.

2.4.2 Comparisons of Plant Design Data Important to Severe Accident Progression

Tables 2.4.1a and 2.4.1b compare key design data for the Byron, Braidwood, Callaway, Comanche Peak, 

and Vogtle reactors. (These two tables have identical content, except Table 2.4.1b provides the values in 

English units.) The Byron and Braidwood plants are based on a nearly identical design. Their common 

design data appear under the heading Byron/Braidwood and are based on the common Byron/Braidwood

FSAR. The Byron and Comanche Peak power plants consist of two units with nearly identical nuclear 

steam supply systems and turbine generators. The steam generators for Byron Unit 1 compared with 

those for Byron Unit 2 are different; the same is true for the two units at the Comanche Peak site. Table 

2.4.1 shows that the RCS volume and heat transfer area in the steam generators for Units 1 and 2 at the 

Byron and Comanche Peak plants are different. Table 2.4.1 also indicates some missing data as not 

 5 There are several other plants of similar design (e.g., Seabrook, Diablo Canyon) but only the 5 identified sites are 

compared in order to reduce the scope of this comparison effort.
20

available. This data is subject to variability in the ways that information is presented in the FSAR or other 

sources (e.g., nominal delivered flow versus theoretical pump flow rate), and should be used with caution.

To compare the system design features important to core damage and containment pressurization among 

the plants, Table 2.4.2 lists scaling ratios such as system volume to power and hydrogen mass to 

containment volume. In addition, to estimate containment pressurization from non-condensable gases or 

from consideration of combustion loads, Table 2.4.2 compares the calculated maximum mass of 

hydrogen generated by zirconium (Zr) oxidation with the average hydrogen concentration in the 

containment. Although these issues are not relevant to estimates of time to core damage, they are of 

interest to level-2 PRAs. 

The following noteworthy observations are based on comparisons of the data in Table 2.4.1:

• The ratio of the RCS water volume to reactor power can provide the degree of margin for loss of 

decay heat removal scenarios. The results of this comparison show that the RCS volume-to-reactor 

power ratios of Unit 1 at Byron, Callaway, and Comanche Peak are around 10 percent higher than 

the others. This difference is due to different steam generator designs that result in a bigger total RCS 

water volume for the former units. With all other conditions remaining the same, the time to boiling for 

the entire RCS water inventory should be about 10 percent longer for Unit 1 of Byron, Callaway, and 

Comanche Peak compared to the rest of the plants.

• The containment free-volume-to-reactor power ratio provides an indication of the degree of margin for 

the buildup of pressure in the containment during severe accidents. The Callaway plant shows the 

lowest value. On the other hand, the Callaway plant has the highest containment design pressure.

• The ratio of Zircaloy and fuel masses to the containment volume indicates the degree of margin for 

containment pressurization by non-condensable gases generated during molten core concrete 

interactions or Zircaloy oxidation. In other words, as the value of this ratio becomes larger, the 

containment pressurization rate is expected to increase. The Callaway plant has the highest such 

ratio, so the expectation is that its containment will show the fastest pressurization rate compared to 

the other plants.

• The uniform maximum hydrogen concentration inside the containment appears to be similar for all of 

these plants except Callaway, which is around 35 percent higher than the other listed plants. This 

concentration is consistent with the comparison of the ratio of Zircaloy mass to containment free 

volumes. 
21

Table 2.4.1a Comparisons of Design Data for Byron/Braidwood, Callaway, Comanche Peak, and Vogtle Reactors (SI units)

Component Parameters* Unit Byron/Braidwood Callaway Coma

Reactor Coolant System

Reactor power MWth 3586.6 3565 

Heated fuel length m 3.66 3.65 

UO2 weight kg 92641 92636 

Cladding weight kg 19675 24422 

Normal primary pressure MPa-a 15.65 15.41 

Normal primary temperature K 583.9 584.9 

Normal core mass flow rate 106 kg/hr 62.2 63.2 

Total system volume including 

PRZ and surge line m3 386 / 350(Unit1/Unit 2) 394 37(Un

Total system water volume 

including PRZ and surge line m3 375 / 338(Unit1/Unit 2) 370 36(Un

Total reactor vessel water 

volume below active fuel m3 65 65 (1) 

Reactor cooling pump (RCP) 

coast down duration s 30 30 

Pressurizer

PORV (2 valves) Opening pressures of 

pressurizer relief valves MPa-g

16.2 / 16.1

(Unit1/Unit 2) 16.1 

Capacity of pressurizer relief 

valve for one unit

kg/hr 9.5E4 9.5E4 

Nominal volume of steam in 

pressurizer

m3

11 20 2

(Un

SRV (3 valves) Opening pressure MPa-g 16.97 16.97 

Capacity of valve for one unit kg/hr 1.90E5 1.90E5 1

Steam Generators

Heat transfer area m2 7414 / 4487

(Unit1/Unit 2) 7334 706(Un

Nominal secondary pressure MPa-g

6.97 / 6.47

(Unit1/Unit 2) 7.12 7.0(Un
22

Table 2.4.1a Comparisons of Design Data for Byron/Braidwood, Callaway, Comanche Peak, and Vogtle Reactors (SI units)

Component Parameters* Unit Byron/Braidwood Callaway Coma

Nominal secondary liquid 

volume m3 71.3/Not Available(Unit 1/Unit 2) (2) 66.8 Not 

Opening pressure of steam 

generator safety relief valve 

(5 valves)

MPa-g

8.20 (2)

8.31 (2)

8.41 (2)

8.52 (2)

8.10 (2)

(Unit 1 only)

Not Available Not 

Total steam flow 106 kg/hr 7.27 / 7.23

(Unit 1/Unit2) 7.24 7.0(Un

Total capacity of relief valves 

(% of total steam flow ) % 112 (2) Not Available 

AFW Design flow rate: motor-driven 

/ turbine- or diesel-driven, per 

pump (# and type of pumps)

m3/s 0.056 (1m) / 0.056 (1d) 0.036 (2m) /

0.072 (1t)

0.0

0.

Accumulator (4 units)

Accumulator pressure MPa-g 4.41 4.14-4.48 4.

Liquid temperature K 311-339 322 2

Accumulator water volume m3 26.5 24.1 

Total volume m3 38.2 Not Available 

Emergency Core Cooling System

Charging pump 

(2 units)

Maximum flow rate m3/s 0.035 0.028(3) 

Head at maximum flow rate(4) MPa-d 5.17 Not Available 

Dead head pressure MPa-d 17.6 Not Available Not 

Safety injection 

(SI) pump (2 

units)

Maximum flow rate m3/s 0.041 0.028 (3) 

Head at maximum flow rate(4) MPa-d 5.59 Not Available 

Dead head pressure MPa-d 10.7 Not Available Not 

RHR pump 

(2 units)

Design flow rate m3/s 0.189 0.303 

Dead head pressure MPa-d 1.17 Not Available Not 

Head at maximum flow rate(4) MPa-d 1.10 Not Available 
23

Table 2.4.1a Comparisons of Design Data for Byron/Braidwood, Callaway, Comanche Peak, and Vogtle Reactors (SI units)

Component Parameters* Unit Byron/Braidwood Callaway Coma

Spray pump Number of units - 2 2 

Approx. deliverable flow per 

train(5) m3

/s 0.207 0.195 

Reactor water 

storage tank 

(RWST)

Tank temperature K 322 311 

RWST total deliverable water 

volume m3 1238 1237 

Containment

Free volume m3 7.810E+4 7.079E+4 8.

Design pressure MPa-g 0.34 0.41 

Basemat thickness m 2.44(6) 3.05 

Basemat concrete 

composition - Zinc paint/carbon 

steel/concrete

Zinc 

paint/carbon 

steel/concrete

Zinc p

stee

Reactor cavity flow area m2 84.3

(Calculated) Not Available Not 

* The design parameters are from the Final Safety Analysis Reports. Additionally, in the case of Byron Unit 1, some parameters are bas

input deck, as noted.

(1) All reactors are assumed to have the same water volume below the top of the active fuel since documents show that the core diam

are all equal; the tabulated value derives from the Byron MELCOR deck.

(2) Value from the ERI MELCOR model of Byron Unit 1.

(3) Charging pump capacity from Callaway FSAR Table 6.3-12.

(4) Head at maximum flow rate (MPa-d, a.k.a., MPa-differential) is calculated based on the head in feet at the maximum flow rate.

(5) This is the representative value cited in the containment analysis (Section 6 of the FSAR). In some cases, other values are giv

capacity.

(6) Basemat thickness at the cavity.
24

Table 2.4.1b Comparisons of Design Data for Byron/Braidwood, Callaway, Comanche Peak, and Vogtle Reactors (English un

Component Parameters* Unit Byron/Braidwood Callaway Coma

Reactor Coolant System

Reactor power MWth 3586.6 3565 

Heated fuel length in. 144 143.7 

UO2 weight lb 204236 180200 2

Cladding weight lb 43376 53840 

Normal primary pressure Psia 2270 2235 

Normal primary temperature F 591.7 593.1 

Normal core mass flow rate 106 lb/hr 137.2 139.4 

Total system volume including 

PRZ and surge line ft3 13620/12340(unit1/unit 2) 13910 134(un

Total system water volume 

including PRZ and surge line ft3 13230/11950(unit1/unit 2) 13068 128(un

Total reactor vessel water 

volume below active fuel ft3 2293 2293 (1) 2

Reactor cooling pump (RCP) 

coast down duration s 30 30 

Pressurizer

PORV (2 valves) Opening pressures of 

pressurizer relief valves psig 2345/2335 2335 

Capacity of pressurizer relief 

valve for one unit lb/h 2.10E+05 2.10E+05 2.

Nominal volume of steam in 

pressurizer

ft3 390/390

(unit1/unit 2) 720 8

(un

SRV (3 valves) Opening pressure psig 2460 2460 

Capacity of valve for one unit lb/hr 4.20E+05 4.20E+05 4.

Steam Generators

Heat transfer area ft2 79800/48300 (unit1/unit 

2) 78946 760(un

Nominal secondary pressure psig 1010/938 1033 10
25

Table 2.4.1b Comparisons of Design Data for Byron/Braidwood, Callaway, Comanche Peak, and Vogtle Reactors (English un

Component Parameters* Unit Byron/Braidwood Callaway Coma

(unit1/unit 2) (un

Nominal secondary liquid 

volume ft3 2516/Not Available(Unit 1/Unit 2) (2) 2358 Not 

Opening pressure of steam 

generator safety relief valve 

(5 valves)

psig

1190 (2)

1205 (2)

1220 (2)

1235 (2)

1175 (2)

(Unit 1 only)

Not Available Not 

Total steam flow 106 lb/hr 16.02 / 15.95

(Unit 1/Unit2) 15.96 15.4(Un

Total capacity of relief valves 

(% of total steam flow ) % 112 (2) Not Available 

AFW Design flow rate: motor-driven 

/ turbine- or diesel-driven, per 

pump (# and type of pumps)

gpm 900 (1m) / 900 (1d) 575 (2m) /

1145 (1t)

57

1

Accumulator (4 units)

Accumulator pressure psig 640 600-650 6

Liquid temperature F 100-150 120 7

Accumulator water volume ft3 935 850 

Total volume ft3 1350 Not Available 

Emergency Core Cooling System

Charging pump 

(2 units)

Maximum flow rate gpm 550 450(3) 

Head at maximum flow rate(4) ft 1750 Not Available 

Dead head pressure psid 2550 Not Available Not 

Safety injection 

(SI) pump (2 

units)

Maximum flow rate gpm 655 450 (3) 

Head at maximum flow rate(4) ft 1890 Not Available 

Dead head pressure psid 1550 Not Available Not 

RHR pump 

(2 units)

Design flow rate gpm 3000 4800 

Dead head pressure psid 170 Not Available Not 

Head at maximum flow rate(4) ft 375 Not Available 

Spray pump Number of units - 2 2 
26

Table 2.4.1b Comparisons of Design Data for Byron/Braidwood, Callaway, Comanche Peak, and Vogtle Reactors (English un

Component Parameters* Unit Byron/Braidwood Callaway Coma

Approx. deliverable flow per 

train(5) gpm 3285 3086 

Reactor water 

storage tank 

(RWST)

Tank temperature F 120 100 

RWST total deliverable water 

volume gallon 326972 326860 3

Containment

Free volume ft3 2.758E+06 2.50E+06 3.

Design pressure psig 50 60 

Basemat thickness ft 8(6) 10 

Basemat concrete 

composition - Zinc paint/carbon 

steel/concrete

Zinc 

paint/carbon 

steel/concrete

Zinc p

stee

Reactor cavity flow area ft

2 907.9 (calculated) Not Available Not 

* The design parameters are from the Final Safety Analysis Reports. Additionally, in the case of Byron Unit 1, some parameters are bas

input deck, as noted.

(1) All reactors are assumed to have the same water volume below the top of the active fuel since documents show that the core diam

are all equal; the tabulated value derives from the Byron MELCOR deck.

(2) Value from the ERI MELCOR model of Byron Unit 1.

(3) Charging pump capacity from Callaway FSAR Table 6.3-12.

(4) Head at maximum flow rate is based on the head in feet at the maximum flow rate.

(5) This is the representative value cited in the containment analysis (Section 6 of the FSAR). In some cases, other values are giv

capacity.

(6) Basemat thickness at the cavity.
27

Table 2.4.2 Summary of Byron/Braidwood, Callaway, Comanche Peak, and Vogtle Design Features

Parameters Unit Byron/Braidwood

(Unit 1/Unit 2) Callaway Comanche Peak

(Unit 1/Unit 2) 

RCS water volume/power m3/MWth 0.104/0.094 0.104 0.100/0.094 

Containment free volume/power m3/MWth 22 20 24 

Zr mass/containment free volume kg/m3 0.252 0.345 0.268 

Fuel mass/containment free volume kg/m3 1.186 1.308 1.086 

Maximum mass of H2 generated by Zr 

oxidation* Kg 863.0 1071.1 1009.8 

Maximum H2 concentration 10-3 moles/m3 5.52 7.57 5.88 

Containment design pressure MPa 0.44 0.51 0.44 

* 100% of cladding oxidation was assumed in calculating maximum mass of H2 generated
28

2.4.3 Time to Core Damage Estimate

This section formulates and uses simple analytic approaches to estimate the time to core damage for an 

assumed SBO scenario to illustrate their usefulness when a simplified approach is desired for estimating 

operator response timings. Section 3 in this report contains fully mechanistic calculations of time to core 

damage. The assumed initiator of this scenario is a reactor scram and a complete loss of cooling 

(including the main and auxiliary FW systems). All normal makeup and emergency core cooling systems

(ECCS) are assumed to be unavailable. Two criteria are used to define core damage: (i) the time that 

core uncovery started, and (ii) the time when the peak cladding temperature (PCT) reached 1,478 K 

(2,200 °F). The first criterion is a more conservative indicator since it is based on the consideration of the 

water level reaching the top of the active fuel (TAF) only. The second criterion is based on the time 

required for the PCT to attain 1,478 K, which typically corresponds to a time when the water level is 

considerably lower than the TAF. Therefore, this criterion provides a more realistic estimate of core 

damage initiation.

Note that following discussion neglects the effects of RCP seal leakage, and this effect would need to be 

accounted for in cases where significant leakage is projected.

2.4.3.1 Time to Core Uncovery Estimate

This section estimates the time of core uncovery in the case of an SBO accident scenario. In an SBO, the 

time of core uncovery is related to the time integral of the decay heat since the reactor shutdown. The 

SBO scenario is the simplest boil-off scenario where the heat sink is lost and the fluid leaves through the 

pressurizer (PRZ) relief valves. Core uncovery is assumed to begin when all of the water in the RCS 

above the TAF is depleted due to the boil-off. Initially, the decay heat is removed by pool boiling in the 

steam generators (secondary sides). After the secondary sides of the steam generators dry out, the 

decay heat is removed by boiling off the primary system water, which then passes through the pressurizer 

PORVs as steam.

The first step for calculating core uncovery time is to estimate the time of steam generator secondary side 

dryout (see Reference [4]). The time (t1) at which the secondary system dries out is given approximately 

by: 

 Q dt h V insulation losses fg sc

t

d _

1

0

= + ∫ ρ (2.4.1)

where Qd is the decay power, Vsc is the volume of liquid on the secondary side of the steam generators, 

ρ is the density of water, and hfg is the latent heat of vaporization at the steam generator relief valve set 

point of about 1,190 psia (8.2 MPa)6

. Note that the insulation heat losses to the containment are assumed 

to be negligible since the steam generators are well insulated.

For this calculation, a simplified decay heat curve describing typical PWRs is developed. For a specific 

example, the system data for the Byron Unit 1 reactor are used. Two time periods are defined for more 

accurate decay heat representation:

 0.082 064 0 0. − Q = Q ×t d 1< t < 50 s (2.4.2a)

 -0.24 1177 0 Q 0. Q t d = × 50 < t < 106 s (2.4.2b)

Here Q0 is the initial power level (e.g., 3,586.6 MW(t) in the case of Byron Unit 1). The required energy to 

vaporize the water mass (right-hand side of Equation (2.4.1) is calculated as:

 6 Note that using the steam generator PORV setpoint would change hfg by less than 0.5%.
29

fg sc

t

Qd dt = E = ρh V ∫

1

0

= 3.01 ×105 MJ

where the mass of water in the steam generator ( ρVsc = 740.7 × 71.2 × 4) = 210,950 kg at a pressure of 

1,025 psia (7.067 MPa); the latent heat for vaporization, hfg, is 1.428 x 106 J/kg at a SRV opening 

pressure of 1,190 psia (8.2 MPa). 

Therefore, Equation (2.4.1) is expressed as follows using the decay heat as approximated by Equation 

(2.4.2):

0

0.76 0.76

0 1

0

0.1548 ( 50 ) 2.459

1

Q dt Q t Q

t

d = − + ∫ = 3.01 × 105 MJ

which can be used to calculate t1 = 4,060 seconds (68 minutes). 

As a consequence of the drying out of the steam generators, no major heat sink is subsequently available 

for the removal of the heat that continues to evolve within the primary system. After the secondary system 

dries out, the pressure in the primary system rises until it reaches the opening setpoint pressure of the 

pressurizer PORVs.

The core uncovery time (t2) can be obtained by balancing the decay heat that results in the evaporation of 

saturated water mass, mtaf, to bring the water level to the TAF:

 dt

h

Q t

m

t

t fg

d

taf ∫ =

2

1

( ) (2.4.3)

where t1 is the time at which the steam generator secondary side dries out in seconds, t2 is the time to 

core uncovery in seconds, and hfg is the heat of vaporization of water in J/kg. Note that the energy 

required to heat the initially subcooled liquid to saturation is neglected here.

Using the decay heat representation of Equation 2.4.2 that is of the form:

b

d Q aQ t

− = 0 × (2.4.4)

Substituting Equation (2.4.4) into (2.4.3) and performing the integration yields:

 (1 )

( ) 1

1

1

2

0 0

2

1

2

1

b

t t

m h Q dt aQ t dt aQ

t b b

t

b

t

t

taf fg d −

− = = =

− −

−

∫ ∫ (2.4.5)

which can be rearranged to obtain an expression for the time to core uncovery:

1 1/(1 )

1

0

2 [(1 ) ] taf fg b b t

aQ

m h

t b − − = − + (2.4.6)

In the case of Byron Unit 1, the mass of water in the primary side at the normal operating condition (2,270 

psia [15.651 MPa]) is 2.63 × 105 kg. The temperature of this water is initially 592 K, being subcooled by 

27 K; the corresponding liquid density is 704 kg/m3

. Of this, it is assumed that all primary-side liquid in the 

RCS at elevations above the active fuel (2.17 × 105 kg) must be lost to uncover the core, but not all of it 

needs to be boiled. Because of the thermal expansion of the initially subcooled water as it heats up and 

finally becomes saturated at the relief valve opening pressure (2,350 psia [16.203 MPa]; temperature 622 

K; density 581 kg/m3

), the liquid expands beyond the capacity of the RCS, and some is spilled through 

the PORVs. The energy required for this liquid heatup is negligible. The amount of spilled liquid can be 

estimated as follows:
30

• The initial liquid volume is 2.63 × 105 kg/704 kg/m3 = 373.6 m3

.

• After expansion, the liquid volume is 2.63 × 105 kg/581 kg/m3 = 452.7 m3

.

• The pressurizer can accommodate 11 m3 of the increase (initial void).

• Therefore, the spilled volume is 79.1 m3

–11 m3 = 68.1 m3.

• Using the simple-average density (642.5 kg/m3

), the spilled mass is 4.4 × 104 kg.

Therefore, the required amount of liquid water, mtaf, which must be converted to steam to uncover the 

core is (2.17 × 105 - 4.4 × 104

) = 1.73 ×105 kg. With mtaf = 1.7 × 105 kg and using the latent heat at 

saturation at 2,350 psia (16.203 MPa] (hfg = 1.428 x 106 J/kg), the estimated core uncovery time is 

determined using Equation (2.4.6) to be t2 = 6,960 seconds (116 minutes).

These approximate results of 68 minutes for t1 and 116 minutes for t2 compare favorably with the 

MELCOR predictions of 66 and 117 minutes, respectively. Therefore, this approximate calculation 

provides an adequate physical representation of this sequence during the boil-off stage. Table 2.4.3 

compares the times of steam generator secondary side dryout and start of core uncovery among the five 

plants. The time of core uncovery appears to be similar among the plants, which is consistent with 

volume-to-power ratio comparison results in Table 2.4.2. Note that the core uncovery time estimates for 

Byron Unit 2 and the Comanche Peak plants are not listed due to the lack of data for the steam generator 

secondary side water volume.

Table 2.4.3 Comparisons of Time of Core Uncovery for Byron/Braidwood, Callaway, Comanche Peak, 

and Vogtle Nuclear Power Plants

Parameters Unit Byron/Braidwood Callaway Comanche Peak Vogtle

Core uncovery time min 116 (Unit 1)

(MELCOR, 117) 114 116 (Unit 1) 114

SG dryout time min 67 (Unit 1)

(MELCOR, 66) 61 65* 68

*The steam generator secondary-side water volume of Byron Unit 1 is assumed due to a lack of information.

2.4.3.2 Time to Core Damage Estimate

The time that the peak cladding temperature (PCT) attains any of variously considered limiting 

temperatures provides a better estimate for the start of core damage than the time that core uncovery 

starts. The time of core damage is identified with the time when the PCT attains 1,478 K (2,200 °F). To 

identify this time, the MELCOR calculations for Byron Unit 1 that describe one base and six sensitivity 

cases of the loss of DC bus with bleed and feed (B&F) scenario (the LoDC Bus scenario referred to here 

includes independent failure of DD-AFW which results in a total loss of feedwater and the unavailability of 

1 PORV; see Section A.1 of Appendix A) and likewise one SBO scenario (see Section 5) are referred to 

for reference data for the RPV water level at the time that the PCT reaches 1,478 K (see Table 2.4.4).

Table 2.4.4 MELCOR-Predicted Times of Core Damage and Corresponding Water Level (Byron)

Case (See 

Appendix A for 

case definitions)

RPV water level 

below TAF (hr)1

PCT>1478K 

(hr)

RPV water level at 

PCT>1478 K (m)2

Covered fraction 

of core

LoDC Bus (A.1.1) 1.35 1.91 3.72 0.17

LoDC Bus (A.1.3) 1.28 1.83 3.72 0.17

LoDC Bus (A.1.4) 1.28 1.81 3.70 0.17

LoDC Bus (A.1.5) 1.32 1.88 3.74 0.18
31

Case (See 

Appendix A for 

case definitions)

RPV water level 

below TAF (hr)1

PCT>1478K 

(hr)

RPV water level at 

PCT>1478 K (m)2

Covered fraction 

of core

LoDC Bus (A.1.6) 1.35 1.91 3.73 0.17

LoDC Bus (A.1.7) 1.35 1.91 3.74 0.18

LoDC Bus (A.1.8) 1.35 1.91 3.73 0.17

SBO 1.95 2.57 3.44 0.10

1 Recall that for the non-SBO scenarios, the time to core uncovery will be different due to the period of time very early 

in the transient where the reactor is still at full-oower but main feedwater has been lost 2 This elevation is relative to the inside bottom of the RPV lower head; for reference BAF is just over 3m and TAF is 

just under 7m; these are collapsed water levels

As shown in Figure 2.4.1, the normalized water level (i.e., fraction of the core that is covered) at the time 

that the PCT reached 1,478 K for various Byron LoDC Bus cases and one Byron SBO case ranges from 

0.1 to 0.18. These levels correspond to RPV levels of 3.44 m and 3.72 m, respectively for LoDC Bus and 

SBO. Analytic calculations for the PCT time to reach 1,478 K can be performed based on these assumed 

equivalent water levels. This time is identified when the core water inventories are reduced to these two 

levels. Two possible values for the equivalent water level are derived from somewhat different scenarios 

(i.e., they differ in that the LoDC Bus includes B&F), thus providing some indication of the variability in the 

equivalent water level. The results are intended to apply to the SBO scenarios because the estimated 

levels apply to that case. 

Figure 2.4.1 Normalized RPV Collapsed Water Level at the Time the PCT Reaches 1,478 K (2,200 

°F)

The calculation method is similar to that of the starting time for core uncovery, except that the amount of 

water to be boiled off correspondingly increases by the amount between TAF and the considered 

equivalent water level in the core region. Additionally, it is assumed that the heat transferred to the water 

is proportional to the fraction of the core that is covered. As a consequence of this simple approach, the 

water level approaches the bottom of the active fuel (BAF) asymptotically.

0.00

0.02

0.04

0.06

0.08

0.10

0.12

0.14

0.16

0.18

0.20

0 0.5 1 1.5 2 2.5 3

Time (hr) at PCT 2200 F

Fraction of the core that is covered (-)

Byron LoDB Bus

Byron-SBO
32

The time (t3) when PCT reaches 1,478 K (or actually, the time when the water level reaches the assumed 

equivalent level) can be obtained from the following balance between decay heat into the water and the 

energy removed by evaporation: 

 M

m t Q t

dt

dm

hfg d

( ) = − ( ) (2.4.7)

where m(t) is the liquid mass currently in the active core region, M is the liquid mass initially in the active 

core region, hfg is the heat of vaporization of water, and Qd(t) is the decay heat. Since the water mass m(t) 

is proportional to the water height z(t) in the core region (reckoned from the BAF), Equation (2.4.7) can be 

expressed in terms of water height z(t) as

M

z t Q t

dt

dz

hfg d

( ) = − ( ) (2.4.8)

The solution of Equation (2.4.8) is

BAF

fg

t

t

TAF BAF L

Mh

Q t dt

z t L L +





















= − − ∫

3

2

( )

( ) ( )exp (2.4.9)

where LTAF and LBAF are the elevation of the top and bottom of active fuel, respectively, and z(t) denotes 

the water level reckoned from the usual reference point (i.e., the inside bottom of the vessel); t2 is the 

previously evaluated time of the beginning of core uncovery. On setting z(t) to the considered equivalent 

level (i.e., either 3.44 m or 3.72 m in the case of Byron), Equation (2.4.9) can be rearranged to obtain an 

expression for the time (t3) it takes the PCT to reach 1,478 K (2,200 °F):

1/(1 )

1

2

0

3 ( )

ln (1 ) b

b

BAF

fg TAF BAF t

z t L

L L

aQ

b Mh

t

−

−





 





+















−

− − = (2.4.10)

For the SBO scenario at the various plants, Table 2.4.5 compares the estimated times that core uncovery 

starts and the PCT attains 1,478 K (2,200 °F), which is implied by the assumed equivalent water levels. A 

minor variation arises due to the variability in the value of the equivalent water level (estimated as the 

level range spanned by the values defined in the Byron SBO versus the LoDC Bus scenarios).

Table 2.4.5 Estimated Times of Core Uncovery and PCT Attaining 1,478 K (2200 °F) for SBO 

Scenarios at the Byron/Braidwood, Callaway, Comanche Peak, and Vogtle Nuclear Power 

Plants

Parameters Unit Byron/Braidwood Callaway Comanche Peak Vogtle

Time of core 

uncovery

min 116(Unit 1)

(MELCOR, 117) 114 116 (Unit 1) 114

Time of PCT at 

1,478 K (SBO 

equivalent level)

min 149

(MELCOR, 154) 147 148 146

Time of PCT at 

1,478 K (LoDC 

Bus equivalent 

level)

min 141 139 140 138
33

The simple analysis under-predicts (in the Byron case) the amount of time when the PCT reaches 

1,478 K (2,200 °F) by only a few minutes compared with the MELCOR prediction. The discrepancy may 

be due to an overestimation in the simple analytical approach of the decay heat available to boil off the 

water. As the core water level decreases to low levels in the MELCOR calculation, the decay heat results 

not only in boiling off the water but also in heating up structures such as fuel rods. On the other hand, the 

simple analysis assumes that all decay heat generated within the estimated covered section of the core 

goes only into the water. As a result, the analytical estimate shows an earlier prediction of when the PCT 

will reach 1,478 K (2,200 °F) than the MELCOR estimate does. However, the overall agreement is good.

As such, this section has demonstrated that the simplified analytical approach gives useful core damage 

timing estimates when more detailed analyses are not available.

35

3. INVESTIGATION OF SEQUENCE VARIABILITY

3.1 Investigation of Sequence Variability—Byron Unit 1

3.1.1 Investigation of Sequence Variability – Byron Unit 1, Loss of DC Bus 111 with B&F

The transient initiator considered in this analysis is loss of DC bus 111. This bus powers the main 

feedwater regulating valves and their associated bypasses, which close upon the loss of DC power, so 

the initiator implies a loss of the main FW (MFW). Additional consequences of the loss of the bus include 

the unavailability of one of the two pressurizer PORVs, and all motor-driven auxiliary feedwater (AFW). 

Furthermore, the scenario definition assumes that diesel-driven AFW and charging (after an ECCS signal)

are not available because of independent failure. The condenser steam dump valves are assumed to be 

available and are used while the main steam isolation valves (MSIVs) remain open to control the primaryside coolant temperature. (In the present instance, the MSIVs eventually close automatically due to their 

trip on MELCOR-predicted excessive rapid decrease of steam generator pressure following SG dryout 

and subsequent automatic condenser steam dump operation: see Section A.2.2.1 for more details.) As 

stated above, charging pumps are not available for ECCS injection. However, normal-operation injection 

by one of the charging pumps is accounted for initially after scram. One of two SI pumps and one of two 

RHR pumps are available7

. A successful transition to the recirculation mode is assumed, but the RHR 

heat exchanger is assumed to be unavailable. To test the containment fan cooler effectiveness, only one 

out of the four containment fan coolers is available. There is no consideration of a possible discharge 

from the containment into the environment, whether from a building failure or from any operator-initiated 

venting. The operators are assumed to initiate B&F at 20 minutes. Table 3.1.1 summarizes conditions of 

the LoDC Bus 111 scenario. (Table A.1 in Appendix A also summarizes the availability of various 

systems.) This set of conditions usually leads to core damage in Level 1 PRAs.

Table 3.1.1 Conditions of the Loss of DC Bus 111 Scenario

Accident initiator Loss of DC bus 111

Unavailable systems

FW of any type

Accumulators (by PRA convention – RCS pressure doesn’t permit injection)

Charging pumps (in the ECCS configuration)1

One pressurizer PORV

One SI pump and one RHR pump

Three containment fan coolers

Containment sprays

Available systems

One charging pump aligned for normal makeup1

One pressurizer PORV

One SI pump and one RHR pump

One fan cooler

SG PORVs and dump valves

RCPs

Operator actions B&F2

1 One charging pump injects until the S signal is sent or the volume control tank depletes. The failure that 

causes loss of charging during ECCS alignment is also assumed to prevent automatic switchover from the 

VCT to the RWST during normal charging.

2 Bleed and feed consists of: tripping the RCP; opening the PRZ PORV; and manually sending the S signal.

 7 The high-pressure ECCS pumps at Byron are usually referred to as SI pumps, and sometimes as HPI pumps. This 

usage is in addition to the standard abbreviation, SI, for safety injection.
36

To investigate the variability of the predictions, eight sensitivity cases are defined in addition to the base 

case. Table A.2 in Appendix A shows how each sensitivity case differs from the base case. 

In the base-case scenario (Case A.1.1; see Section A.2.1 of Appendix A) and in all associated sensitivity 

cases, reactor trip occurs at 40 seconds or earlier. The results show that the RCS pressure drop provided 

by opening one pressurizer PORV at 20 minutes is sufficient to allow one SI pump to begin to inject soon 

thereafter (at about 21 minutes). Later, however, in the base case and in all sensitivity cases, RCS 

pressure increases high enough to deadhead the pump. The return of higher pressures is due to the loss 

of steam generator cooling after the steam generators dry out. In the base case, the time when the SI 

pump is deadheaded is from 0.75 to 2.04 hours. Due to the lack of injection, the core partly uncovers and 

results in gross core damage (e.g., the relocation of fuel and support structures). In the base case, the 

temperature of the hottest cladding first exceeds 1,478 K (2,200 °F) at 1.91 hours.

Two sensitivity cases (A.1.2 and A.1.9) avoid gross core damage (e.g., material relocation). In Case 

A.1.2, an earlier reactor trip was prescribed at 11 seconds. The SI pump deadhead and partial core 

uncovery still occur and the core still heats up, but only such that the temperature of the hottest cladding 

attains a maximum of 1,123 K. Therefore, MELCOR does not predict any gap releases to occur. In Case 

A.1.9, the decay heat is uniformly reduced to 80 percent of its base-case value. Again, SI pump 

deadhead, partial core uncovery, and core heatup still occur, but the cladding temperature remains below 

964 K, too low for gap releases or gross core damage to occur.

The other sensitivity cases, all of which result in core damage, investigate the following factors: 

• the role of injection by a charging pump before the ECCS signal (Case A.1.3 discounts such 

injection), 

• the influence of manual steam generator depressurization (Case A.1.4 imposes depressurization of 

all four steam generators at 10 minutes), 

• the effect of a stuck-open steam generator relief valve (Case A.1.5),

• the effect of accumulator injection (Case A.1.6 credits all of the accumulators, which are discounted in 

the base case),

• the effect of additional fan coolers (Case A.1.7 credits all four fan coolers, whereas the base case 

credits only one),

• uncertainties due to different MELCOR code versions (Case A.1.8 repeats the base case using 

MELCOR version 2.1 instead of version 1.8.6).

These aforementioned factors entail little variation in the times when core damage occurs. See Section 

4.1.1 and Appendix A for additional details.

Among all factors considered, early reactor trip and lower power level have the strongest effect.

3.1.2 Investigation of Sequence Variability - Byron Unit 1, Loss-of-Coolant During Shutdown 

Section 2.1 of this report briefly describes a MELCOR model that represents the Byron plant during 

shutdown operations. The section describes a loss of reactor coolant event near the time of refueling, but 

while the RCS is still closed. The loop stop valves (which serve the same function as nozzle dams at 

other plants) are open, the RCS is full of water, and 24 hours have elapsed since the reactor shut down. 

The scenario considers a break outside of the containment in piping that connects an RHR pump to two 

cold legs. Initial temperatures around the RCS are 466.5 K (380F). The RHR pump not affected by the 

break is in use in a closed-loop configuration to remove the decay heat, which is 21.29 MW initially. The 
37

break flow area has been assigned so as to result in an initial break discharge rate of about 1,000 gpm

(0.063 m3

/s). Table 3.1.2 below summarizes the conditions of the shutdown scenario. Table A.5 in 

Appendix A summarizes the availability of various systems.

Table 3.1.2 Conditions of the Shutdown Scenario

Mode Analogous to hot shutdown conditions

RCS pressure and temperature 1.35 MPa (196 psi); 466.5 K (380°F)

RCS water level Vessel, all piping, and steam generator tubes full; 

pressurizer nearly full (1 m3 steam bubble)

Availability of steam generators

SG loops Filled

SG secondary side water 

level/pressure/temperature

~normal operating level/1.35 

MPa (196 psi) / 466.5 K

(380°F)

Loop stop valves Open

MFW/AFW Not available

Availability of other relevant structures, 

systems, and components 

Sump Available (not drained)

RWST Available (not drained)

RHR train alignments 1 train aligned for decay heat removal, 1 train aligned for 

ECCS LPI

Planned refueling outage versus forced 

outage Analogous to a planned outage

Before versus after refueling Before

To investigate the variability of the predictions, thirteen sensitivity cases are defined in addition to the 

base case. Table A.6 in Appendix A shows how each sensitivity case differs from the base case. 

In the base case scenario (Case A.2.1; see Section A.3.1 of Appendix A), no operator actions are 

credited, which leads to core damage due to the RHR pump’s loss of suction as the hot leg is depleted 

due to the loss of coolant inventory. Core damage is calculated to initiate at 3.34 hours, according to the

measure that associates core damage with the temperature of the hottest cladding exceeding 1,478 K 

(2,200 ° F).

Variants of the base case that also reach core damage consider the following:

• A modified treatment of the behavior of the RHR pump on very low hot leg water levels (Case A.2.4 

predicts core damage 0.13 hours earlier on the assumption that the pump trips and cannot be 

recovered),

• An attempt to bring about more steam generator cooling, contrary to proceduralized actions (Case 

A.2.6 initiates a slow secondary-side depressurization starting at 0.5 hours and predicts core damage 

1.12 hours earlier; it is included here to show the negative effect of this action but it is acknowledged 

that the accuracy of the simulation is affected by the assumed initial conditions; see Section A.3.2.6),

• Break flows of different size (Case A.2.7a reduces the break flow area to 75 percent of the base-case 

value and predicts core damage 0.37 hours later; Case A.3.7b reduces the break flow area to 10 

percent of the base-case value and predicts core damage at 11.38 hours; Case A.3.7c reduces the 

break flow area to 5 percent of the base-case value and predicts core damage at 23.92 hours; Case 

A.3.7d increases the break flow area to 500 percent of the base-case value and predicts core 

damage at 39.8 minutes),
38

• Lower decay heat (Case A.2.8 reduces the decay heat to 75 percent of the base-case value8 and 

predicts core damage 0.12 hours later),

• Different break location (Case A.2.10 considers a hot leg break and predicts core damage 2.25 hours 

later),

• Initially sub-cooled RCS (Case A.2.11 starts the transient from water-solid, pressurized primary-side 

conditions and predicts core damage 0.13 hours later).

In the above bullets, the times to core damage refer to the measure that associates core damage with the 

temperature of the hottest cladding region exceeding 1,478 K (2,200 °F).

Case A.2.2 avoids gross core damage on the assumption that operators initiate ECCS injections at 0.5 

hours, with one charging pump and one SI pump taking suction from the reactor water storage tank 

(RWST) that is assumed to be refilled as necessary. Core uncovery is not prevented (the time that the top 

third of the core is first uncovered is 2.14 hours). However, gap releases and the relocations of fuel or 

structures are predicted not to occur.

Variants of Case A.2.2 that also avoid gross core damage consider the following:

• A later time for the same actions (Case A.2.3 credits the actions to occur at 1.0 hour),

• A modified treatment of the behavior of the RHR pump on very low hot leg water levels (Case A.2.5 

applies the same treatment considered in Case A.2.4 to Case A.2.2), and

• Available switchover to the ECCS sump recirculation mode (Case A.2.9 reinterprets the break as 

located inside the containment, so that water accumulates in the sump).

See Section 4.1.2 and Appendix A for additional details. In summary, break size and location, as well as 

operator actions, are found to have the largest effect on the results.

Note that the general applicability of these findings is subject to some limitations. In this report, the 

shutdown modeling is considered a first foray into this subject and consequently, there is a preference 

that the shutdown model should not depart too much from the main, full-power model9

. For this reason, a 

phase in the shutdown operations is considered in which, for example, the head is still on the vessel. 

Considerations of risk importance might have led to other choices for a shutdown scenario, but risk 

importance is not central to the goals of this report. In the general time frame under consideration, actual 

shutdown operations would likely have water-solid conditions in the RCS, with a pressure well above the 

saturation pressure. Because of anticipated possible numerical difficulties related to water 

incompressibility, the adopted model is set up with saturated conditions and with a steam bubble volume 

of 1 m3 in the pressurizer. The impact of this assumption is diminished by the fact that the considered 

scenario includes a break, which tends to bring the RCS to saturation quickly, even if it were initially 

subcooled. This is demonstrated by a sensitivity case that relies on a fictitious cover of pressurized, noncondensable gas to provide pressure compliance before the start of the transient. The base-case break, 

which connects two cold legs to the environment via a broken RHR injection line, may not be realistic 

(because of certain check valves inside the containment that the model neglects). A sensitivity case 

 8 This initial decay heat is quite similar to the decay heat at 72 hours, which is estimated as 15.85 MW. Case A.2.8 

therefore serves as an approximation to a modified scenario in which the transient begins at 72 hours. However, the 

present treatment with a uniform reduction of the decay heat by a constant factor is not exactly equivalent to 

evaluating the unmodified decay heat curve at any later times, and the assumed initial conditions (e.g., RPV head still 

in place) would likely not actually be applicable at 72 hours. 9 Additional MELCOR shutdown analyses are being performed by NRC for Byron Unit 1, and are planned for Vogtle 

Units 1 & 2.
39

where the break is from a hot leg leads to results qualitatively similar to those of the base case, but core 

damage occurs somewhat later.

Operator actions are considered to be large risk drivers during a shutdown, and knowing how much time 

the operator has to act is important. The timing of the operator actions considered in these calculations 

have been set plausibly, but not with any attempt to establish how late these actions can be taken and 

still lead to the aversion of core damage. Establishing the latest times for successful operator actions for 

various plants and various scenarios is, in fact, the subject of Section 5 of this report. That section 

considers a Byron shutdown scenario of the SBO scenario type, not the loss-of-coolant accident (LOCA) 

scenario considered here. Timing calculations for the scenario considered here could be similarly carried 

out.

3.2 Investigation of Sequence Variability – Surry, Steam Generator Tube Rupture (SGTR)

The accident sequence (sometimes referred to herein as SGTR-9) is initiated by a steam generator tube 

rupture (SGTR). The sequence ends in core damage following failures to initiate a primary- and 

secondary-side cooldown, refill the RWST, and provide long-term heat removal. (See Figure B.1 in 

Appendix B for an event tree that defines SGTR-9 and other possible sequences that may result from a 

SGTR accident.) The MELCOR model includes the following:

• An initiating SGTR at time t = 0.

• Scram, automatic MSIV closure, MFW trips, and RCP trips from cavitation at model-predicted times

(note that procedurally-directed trip of all RCPs early in the transient is not modeled).

• Available high- and low-head safety injection (HHSI, LHSI) and containment sprays with the RWST 

as the source.

• Available turbine-driven and motor-driven AFW with the CST as the source.

• Operator actions to isolate the faulted steam generator, occurring at a hard-wired time (17.88 

minutes). 

• No provision for steam generator cooldown (e.g., by controlled depressurization).

• Recirculation mode unavailable for all systems.

• No refilling of the RWST or CST.

The base-case calculation also assumes no termination or control of HHSI by operators, no B&F, and no 

RHR. However, some of these actions are considered in the sensitivity cases. Table 3.2.1 summarizes 

conditions of the SGTR scenario. 
40

Table 3.2.1 Conditions of the SGTR Scenario

Accident initiator Double-ended rupture of one steam generator tube

Unavailable systems

Refilling of the RWST or CST

Switchover to the ECCS recirculation mode

Available systems

Turbine-driven and motor-driven AFW with CST as the source

HHSI, LHSI, and containment sprays with RWST as the source

RCPs (until tripped by cavitation) – procedurally-directed trip early in the 

transient not modeled

Operator actions Isolation of one of three high-head injection pumps (in the base case); B&F

and/or water-level-dependent control of SI (in sensitivity cases)1

1 Cases for controlling HHSI above TAF (i.e., below the normal pressurizer level) and B&F are counter to 

EOPs for the prescribed conditions. They are included for illustrative purposes, though they could be viewed 

as representing errors of commission.

To investigate the variability of the predictions, twenty sensitivity cases are defined in addition to the base 

case. Table B.2 in Appendix B shows how each sensitivity case differs from the base case. 

In the base-case scenario (Case B.1; see Section B.2.1 of Appendix B), core damage occurs at about 38 

hours (e.g., 37.90 hours according to the surrogate measure that identifies core damage with the PCT 

exceeding 2,200 °F [1,478 K]). 

Core damage is much earlier (5.1 to 7.8 hours by the PCT >2,200 °F [1,478 K] measure) in the sensitivity 

cases that lead to a stuck-open or held-open pressurizer PORV. A stuck-open PORV occurs in the halftube break case (Case B.3) because the small break does not depressurize the vessel, which leads to 

excessive PORV cycling. Several cases (B.17 through B.20) assume held-open PORVs as one of the 

conditions that would be established by operators as part of initiating a B&F (which would be an error of 

commission in this scenario, and are for illustrative purposes only). Whether the PORV is stuck open or is 

held open, the resulting steam flow to the containment actuates the sprays and consequently, the RWST 

is depleted more quickly.

The sensitivity cases that result in the actual reduction of the HHSI rate (Cases B.5, B.6, and B.16) lead 

to longer times to core damage, because depletion of the RWST is postponed. Note that Cases B.17 

through B.20 are not included in this category, although water-level-dependent control of the HHSI is 

credited. The injection rate tends to be higher than in the base case because of the held-open PORV. 

The one case that avoids core damage (Case B.16, with no core damage as of 72 hours) assumes that 

the rate of HHSI is no more than is required to maintain the core water level somewhat above the TAF, 

and is included for illustrative purposes. 

The cases that consider a five-tube break (B.2, B.10, B.11, and B.15) give intermediate times to core 

damage (around 23 hours) due to lower vessel pressures (i.e., relative to the base case), which lead to 

higher HHSI rates and earlier RWST depletion.

These results show that specific boundary condition assignments dominate the sources of variability for 

the analyzed scenario. These assignments include the number of tubes that ruptured, operator action to 

initiate a B&F, and operator action to maintain the core water level just above TAF to conserve the RWST 

inventory. The importance of the latter two specific items is dominated by the scenario’s assumption that 

recirculation is unavailable. Therefore, the key conclusion is that specific boundary condition assignments 

drive the results, and that which specific boundary condition assignments are important depends on the 
41

specifics of the scenario. The importance of one or another boundary condition, depending on the 

scenario, is in contrast to a situation where all boundary condition specifications contribute relatively 

equally to the variability of the results.

The times to core damage range from 4.20 to 43.03 hours; they depend on the sensitivity case and on the 

core damage surrogate measure. This range excludes one sensitivity case where no core damage is 

indicated as of 72 hours (Case B.16, with a successful operator initiation of the water-level-dependent 

control of HHSI).

With very few exceptions, the order that the various surrogate measures indicate core damage is 

independent of the sensitivity case. In most cases, the final measure (PCT temperature above 3,000 °F 

[1,922 K]) is indicated around two hours after the first measure (one-third of the core uncovered). See

Section 4.2 and Appendix B for additional details.

3.3 Investigation of Sequence Variability – Peach Bottom, SBO with RCIC until Battery 

Depletion

NUREG-1953 [1] provides a range of SBO calculations for Peach Bottom, considering several injection 

sources. Here, cases where RCIC is available are investigated further. The transient initiator is a loss of 

all onsite power except for batteries, which are credited to support only the operation of the RCIC system. 

No system is credited to function except the RCIC system, which is available for 8 hours, the assumed 

time when the batteries are depleted. In particular, the RHR pumps, low-pressure core sprays, and 

service water are assumed to be unavailable. It is also assumed that FW, recirculation pumps, and the 

control rod drive (CRD) hydraulic system fail at the start of the transient. (These last three systems do, 

however, operate during the pre-transient steady state, which has a duration of 120 seconds.) The 

automatic depressurization system (ADS) is also assumed to be unavailable due to the power loss or, 

alternatively, because the operators act to inhibit ADS activation so that the RCIC system may be used. It 

is also assumed that the safety relief valves (SRVs) will operate indefinitely (i.e., it is assumed that the 

SRVs do not fail due to excessive cycling). Table 3.3.1 summarizes conditions of this SBO/RCIC 

scenario. 

Table 3.3.1 Conditions of the SBO/RCIC Scenario

Accident initiator SBO

Unavailable systems All but the RCIC

Available systems RCIC until the battery is depleted

Operator actions None

To investigate the variability of the predictions, ten sensitivity cases are defined in addition to the base 

case. Table C.2 in Appendix C shows how each sensitivity case differs from the base case. In the base 

case scenario (Case C.1; see Section C.2.1 of Appendix C), the unavailability of the RCIC after 8 hours–

the assumed battery depletion time–results in core damage starting at 10.99 hours (according to the 

criterion of the PCT exceeding 1,478 K [2,200 °F]). Two sensitivity cases (C.4 and C.5) are identical to 

the base case, except for the assumption that battery depletion occurs at 2 hours and 5 hours, 

respectively. Core damage (according to the same criterion) occurs in these cases at 4.27 and 8.03 

hours, respectively.

One sensitivity case (C.2) considers that the RCIC may continue to run in an uncontrolled mode after 8 

hours, until it shuts off due to flooding in the steam lines at 13.87 hours. In this case (according to the 

same criterion), core damage occurs at 18.57 hours. 
42

In the base case (C.1), the SRV of the lowest opening pressure opens and closes a total of 1,426 times 

as of the end of the calculation (at 11.9 hours). In a sensitivity case (C.3), this valve remains stuck open 

after it has opened 187 times. This event occurs at 2.45 hours. According to the same criterion, core 

damage occurs at 7.15 hours, the RCIC having become unavailable at 3.88 hours as a result of low 

vessel pressure stemming from the stuck-open valve.

Another sensitivity case (C.7) assumes that the SRV with the lowest opening pressure is failed in the 

closed position throughout the calculation. The results are similar to those of the base case because the 

vessel pressure is relieved by the other SRVs whose opening pressures are only slightly higher. In a 

sensitivity case that uniformly reduces the decay heat to 90 percent of the base-case value (C.6), core 

damage occurs at 11.58 hours according to the same criterion.

A sensitivity case (C.8) that assumes a reduction of 10 percent in the maximum flow rate of the RCIC 

pump leads to a delay of about 0.6 hours in the time of core damage. A case that considers a lower initial 

temperature of the water in the CST (C.11) leads to a delay of about 0.4 hours. Sensitivity cases that 

consider adjustments of some parameters that affect the flow through the SRVs (C.9) and the correlation 

for heat transfer coefficients during boiling (C.10) give results not significantly different from those of the 

base case. See Section 4.3 and Appendix C for additional details.

3.4 Investigation of Sequence Variability – Timing of Key Events

Table 3.4.1 summarizes the timing of key events for the four basic scenarios at the three plants. For each 

event, the Table provides a range of times. The range is defined by the earliest and latest times of 

occurrence predicted by the base and sensitivity cases pertaining to the scenario. The ranges for the 

Surry scenario do not include results from cases 16 through 20. Some events are not relevant to some 

scenarios; these are marked N/A. Some relevant events do not occur (e.g., core damage in cases where 

mitigation actions are successful). For such non-occurring but relevant events, a footnote provides the 

time of the end of the run. See Appendices A, B, and C for additional details.
43

Table 3.4.1 Summary of the Timing of Key Events for the Base- and Sensitivity-Case Calculations

Event1 Byron LoDC 

Bus 111

Byron 

Shutdown Surry SGTR 2 Peach Bottom SBO

First opening of the pressurizer 

PORV or SRV 0.13 – 0.33 3 N/A 0.33 4 0.01 5

Number of pressurizer or vessel 

PORV or SRV cycles at time of 

core damage (or end of run) 6 1 – 49 3 N/A 495 4 187 – 1594 5

Pressurizer first goes water-solid 0.42 7 0.00 8 0.57 – 6.10 9 N/A

RCIC becomes unavailable N/A N/A N/A 2.00 – 13.87

Steam generator dry out 10 0.28 – 1.83 N/A 30.8 – 35.4 9 N/A

First time water level is below TAF 1.28 – 2.52 0.19 – 16.81 6.65 – 39.30 3.30 – 16.87

First time when SI pump is 

deadheaded, subsequent to actual 

injection

0.30 – 2.06 N/A N/A N/A

Reduced pumping rate of RHR 

pump A due to low water level at 

suction point

N/A 0.18 – 15.52 N/A N/A

Pressurizer empties Does not occur 0.34 – 14.59 0.01 – 9.33 11 N/A

Zero pumping rate of RHR pump A 

due to dry out of suction point N/A 0.36 – 18.92 12 N/A N/A

RWST depletion 7.23 – 7.74 13 2.96 – 3.46 14 3.56 – 11.37 N/A

RCPs trip due to cavitation N/A N/A 4.23 – 14.97 N/A

CST depletion N/A N/A 17.97 – 32.12 11 N/A

Time of core damage 6 1.81 – 1.92 15 0.67 – 23.92 12 7.77 – 42.80 4.27 – 18.57

1 Times in hours. The ranges are defined by the results obtained from all cases. The symbol N/A indicates 

that the event is irrelevant or not considered. 

2 Results from cases 16 through 20 are not considered.

3 In all 9 cases, PORV1 is opened manually at 20 minutes, and remains open afterwards. In two cases only, it 

also opens and closes automatically earlier.

4 This event occurs in only one of the 16 cases. In this case, the valve sticks open on cycle #495.

5 Opening time (30 seconds) is the same for all 11 cases. The lower bound (187 cycles) occurs in a case that 

considers that the valve sticks open.

6 Time of core damage according to the surrogate that associates core damage with the PCT in excess of 

1,478 K.

7 In all cases, the non-liquid volume fraction falls to below about 1•10-4 at about 25 minutes.

8 This event occurs in only one of the 14 cases. In that case, the condition (solid pressurizer) applies at the 

start of the transient.

9 The longest-running calculation in which this event does not occur ends at 23 hours.

10 Byron: first time when all steam generators are dry. Surry: first time when the broken steam generator is dry.

11 The longest-running calculation in which this event does not occur ends at 8 hours.

12 The longest-running calculation in which this event does not occur ends at 10 hours.

13 Only three cases were run long enough to attain this event.

14 This event occurs and is possible only in four cases.

15 The longest-running calculation in which this event does not occur ends at 28 hours.

45

4. INVESTIGATION OF CORE DAMAGE SURROGATES

A number of criteria can be set for determining the time of core damage, which may be convenient for 

computer simulations versus an actual accident. Some have been defined for regulatory purposes while 

others have different technical origins. In order to estimate how much variability in the time of core 

damage may arise from the definition of the criterion, thirteen surrogate criteria are defined for these 

studies. The definitions of the core damage surrogates listed in Table 4.1 are based on experience with 

MELCOR models as are informed by regulatory guidance such as NUREG–1465 (Reference [5]) and the 

current (2012) revision of 10 CFR 50.46 (Reference [6]).

Table 4.1 Core Damage Surrogates

No. Surrogate Origin

1. Core water level drops below the TAF A traditional surrogate used in some PRAs for PWRs

2. Core water level drops below 2/3 of 

active fuel height

3. Core water level drops below 1/3 of 

active fuel height A traditional surrogate used in some PRAs for BWRs

4. Peak local cladding temperature 

exceeds 1,200 oF (922 K)

A surrogate commonly used if a particular computer 

code (or code version) is known to under-predict core 

heatup during core uncovery

5. Core-exit coolant temperature exceeds 

1,200 oF (922 K)

Core exit temperature reaching 922 K is used as a 

transition criterion in some Severe Accident 

Management Guidelines (SAMGs)

6. Finite release of noble gases from fuel Equivalent to a PCT of 1,173 K for the MELCOR inputs 

used in these analyses

7.

Cumulative hydrogen generation 

exceeds 1% of potential (i.e., amount 

of hydrogen corresponding to steamoxidation of all zirconium in the core)

An ECCS acceptance criterion defined in 10 CFR 

50.46(b)(3) (as of 2012)

8. Release of cesium group from the fuel 

exceeds 3% of the initial inventory

NUREG–1465 assigns 3% as the gap release fraction 

for PWRs and BWRs when long-term core cooling is 

maintained (i.e., accidents not involving degraded or 

molten core conditions)

9. Peak local cladding temperature 

exceeds 2,200 oF (1,478 K)

An ECCS acceptance criterion defined in 10 CFR 

50.46(b)(1) (as of 2012)

10.

Maximum thickness of cladding oxide 

layer exceeds 17% of cladding 

thickness 

An ECCS acceptance criterion defined in 10 CFR 

50.46(b)(2) (as of 2012)

11. Peak local cladding temperature 

exceeds 2,500 oF (1,644 K)

12. Peak local cladding temperature 

exceeds 2,876 oF (1,853 K)

The oxidation kinetics transition temperature based on 

the Urbanic-Heidrick oxidation model

13. Peak local cladding temperature 

exceeds 3,000 oF (1,922 K)
46

A few technicalities, some of which are plant-specific, concerning the evaluation of some of the surrogate 

measures are noted in the next paragraphs. Those that are plant-specific are discussed below in the subsection that pertains to the particular plant. The technicalities that do not depend on the plant are 

discussed here, as follows:

• For metrics stemming from 10 CFR 50.46, it is important to note that the order in which these 

surrogates are reached differs from the order typically seen for large break LOCA evaluations for 

three reasons. First, the present analyses use the severe accident code MELCOR, rather than a code 

specifically designed for a design-basis LOCA analysis, and these classes of tools have different 

modeling assumptions associated with fluid flow, heat transfer, and oxidation modeling that are a 

function of their intended end-use. Second, the present analyses use best-estimate modeling inputs, 

rather than conservative modeling inputs typical of some 10 CFR 50.46 evaluations. Third, the 

present analyses investigate small LOCAs and transients, which evolve over longer timescales and 

therefore have different heatup characteristics compared to large break LOCAs. In summary, the 

results of the present analyses are representative of the characteristics of typical PRA accident 

sequences of interest, but should not be attributed to 10 CFR 50.46 evaluations.10

• Whereas in these MELCOR simulations surrogate #6 (finite release of noble gases from fuel) is 

exactly equivalent to the PCT attaining 1,173 K (i.e., gap releases occur according to this temperature 

condition in MELCOR), surrogate #8 (release of radionuclides of the cesium group from the fuel 

exceeds 3 percent of the initial inventory) depends on the details of MELCOR’s modeling of 

radionuclide releases from fuel and on user-specified, plant-specific inputs. Examples of inputs 

include the relative inventories in the fuel versus in the gap and the treatment of compound classes 

such as cesium iodide and cesium molybdate.

• The transition from slow to rapid oxidation based on the Urbanic-Heidrick correlation occurs at a 

temperature where a change in the zirconium oxide microstructure is expected. This transition occurs 

at 1,853 K (2,876 oF). From the point of view of the surrogate, this transition simply provides a 

characteristic temperature to use as the setpoint for the surrogate.

• The measure for maximum thickness of the cladding oxide layer is actually calculated using the ratio 

of the mass of zirconium oxide to that of zirconium. This approach is therefore equivalent to a 

measure based on a layer thickness only while zirconium oxide forms only on the outside of the fuel. 

(Note that the relevance of this remark comes from a requirement of 10 CFR 50.46, which states that 

if the cladding ruptures, then the inside surfaces should be included in the oxidation.)

4.1 Investigation of Core Damage Surrogates – Byron Unit 1

A few plant-specific technicalities concerning the evaluation of some of the measures are noted in the 

next paragraphs. 

For the surrogates based on core water level, the level is defined by summing the heights of the 

collapsed water columns in the lower plenum, core channel and upper plenum (where the second of five 

computational rings is used), and the dome. 

In the current Byron model, more than 3 percent of the initial cesium class inventory is assigned to the 

fuel rod gap. Consequently, the cesium release and the noble gas class release surrogates are reached 

simultaneously.

 10 Note that 10 CFR 50.46 focuses on core coolability. Radiological considerations associated with design-basis 

accidents are addressed elsewhere in the regulations (e.g., 10 CFR 100). Also note that ECCS acceptance criteria 

defined in 10 CFR 50.46 are currently the subject of rulemaking efforts.
47

The measure for maximum thickness of the oxide layer on the cladding is actually calculated using the 

ratio of the mass of zirconium oxide to that of zirconium. Moreover, because this model does not provide 

the time-dependent masses of the individual components (such as cladding), the net core-region masses 

of zirconium oxide and zirconium are used instead of the cladding masses specifically. These net masses 

include contributions from, for example, the guide tubes.11

The surrogate referring to hydrogen generated by zirconium oxidation is actually implemented in terms of 

the mass of hydrogen generated by oxidizing zirconium and steel. 

4.1.1 Investigation of Core Damage Surrogates – Byron Unit 1, Loss of DC Bus 111 with B&F

Table 4.1.1 and Figure 4.1.1 show the times to core damage according to various surrogate measures for 

the Byron LoDC Bus 111 B&F base and sensitivity cases. Refer to Section 3.1.1 (and also Appendix A) 

for the sensitivity case definitions and to Section 4 for definitions of the surrogate measures. Table 4.1.2a 

provides statistical data for the time when core uncovery starts. Table 4.1.2b does the same for the time 

when the PCT first exceeds 1,478 K (2,200 °F). The definitions of the bins are based on timing similarities 

and not on any logical similarities among the case definitions. See Appendix A for additional details.

4.1.2 Investigation of Core Damage Surrogates – Byron Unit 1, Shutdown 

Table 4.1.3 and Figure 4.1.2 show the times to core damage according to various surrogate measures for 

the Byron Shutdown base and sensitivity cases. Refer to Section 3.1.2 (and also Appendix A) for the 

sensitivity case definitions and to Section 4 for the definitions of surrogate measures. Table 4.1.4a 

provides statistical data for the time when core uncovery starts. Table 4.1.4b does the same for the time 

when the PCT first exceeds 1,478 K (2,200 °F). The definitions of the bins are based on timing similarities 

and not on any logical similarities among the case definitions. See Appendix A for additional details.

4.2 Investigation of Core Damage Surrogates—Surry, SGTR

Table 4.2.1 and Figure 4.2.1 show the times to core damage according to various surrogate measures for 

the Surry SGTR base and sensitivity cases. Refer to Section 3.2 (and also Appendix B) for the sensitivity 

case definitions and to Section 4 for the definitions of surrogate measures. Table 4.2.2a provides 

statistical data for the time when core uncovery starts. Table 4.2.2b does the same for the time when the 

PCT first exceeds 1,478 K (2,200 °F). The definitions of bins are based on timing similarities and not on 

any logical similarities among the case definitions. See Appendix B for additional details. 

A few plant-specific technicalities concerning the evaluation of some of the measures are noted in the 

next paragraphs. 

For the surrogates based on core water level, the level is defined by summing the heights of the swollen 

water columns in the lower plenum, the core channel, and the upper plenum. Each of the five 

computational rings provides a water level; the minimum level is then used to evaluate the surrogates.12

 11 The base case of the Loss of DC Bus 111 scenario has been repeated with no change except for the definition of a 

control function equal to this measure and calculated using the masses peculiar to the cladding component. The 

difference, relative to the standard post-run analysis that uses the lumped masses of zirconium components of all 

type, is less than 1 minute for the indicated time of core damage (see Figure A.1.1.13 and related discussion in 

Appendix A).

12 This approach to defining the level for Surry generally follows the approach suggested by a built-in control function 

in the SNL-provided deck, especially with regard to the minimization over rings. The built-in control function, however, 

extends the sum only as high as the top of the channel, and so produces spuriously early indications of the time when 

the level falls below the TAF. See more discussion in Appendix B.
48

Table 4.1.1 Times of Core Damage (in Hours) According to Various Surrogate Measures Compared Among Base and S

Byron LoDC Bus 111 B&F Scenario

Case

Water

Level 

Below 

TAF

Water

Level 

Below 

2/3 AF

Water

Level 

Below 

1/3 AF

PCT 

> 

922K

CET 

> 

922K

Finite 

Xe 

Release

Hydrogen 

Generation 

> 1% 

Potential

Cesium 

Release 

> 3% 

Inventory

PCT > 

1478K

Maximum 

Oxide 

Depth > 

17% Clad 

Thickness

PC

164

A.1.1

(Base) 1.35 1.47 1.58 1.66 1.68 1.81 1.88 1.81 1.91 1.94 1.

A.1.2 2.52 2.82 3.03 3.03 3.06 – – – – – – 

A.1.3 1.28 1.40 1.51 1.59 1.62 1.73 1.81 1.73 1.83 1.87 1.

A.1.4 1.28 1.39 1.50 1.58 1.60 1.72 1.79 1.72 1.81 1.85 1.

A.1.5 1.32 1.44 1.56 1.63 1.66 1.78 1.85 1.78 1.88 1.92 1.

A.1.6 1.35 1.47 1.58 1.66 1.68 1.81 1.88 1.81 1.91 1.94 1.

A.1.7 1.35 1.48 1.57 1.66 1.68 1.81 1.88 1.81 1.91 1.94 1.

A.1.8 1.35 1.46 1.58 1.66 1.68 1.82 1.91 1.82 1.92 1.95 1.

A.1.9 2.12 2.38 2.63 2.65 – – – – – – – 
49

Table 4.1.2a Bins and Statistics for Times to Start of Core Uncovery, Byron LoDC Bus 111 B&F Scenario

Bin Cases Important Deviations from Base Case Range of Time to 

TAF (hour)

Within-B

to TAF: M

De

1

All but 

A.1.2

and 

A.1.9

Injection by a charging pump before S signal discounted (A.1.3), 

depressurized steam generators (A.1.4 and A.1.5), accumulators 

credited (A.1.6), all fan coolers credited (A.1.7), MELCOR version 

(A.1.8)

1.28 – 1.35 

2 A.1.2, 

A.1.9

Early scram (A.1.2), reduced decay heat (A.1.9)

(in both cases, there are no relocations or gap releases) 2.12 – 2.52 

Table 4.1.2b Bins and Statistics for Times for PCT to Exceed 1,478 K (2,200 °F), Byron LoDC Bus 111 B&F Scenario

Bin (defined 

in Table 

4.1.2a)

Range of Time to 1,478 K (hour) Within-Bin Statistics for Time to 1,478 K: mean ± o

(hour)

1 1.81 – 1.92 1.88 ± 0.04

2 N/A (does not occur) N/A
50

Figure 4.1.1 Times of Core Damage in Byron LoDC Bus 111 B&F Scenario and its Sensitivity Cases, 

According to Various Surrogate Measures13

 13 The case numbers that label the horizontal axis omit the initial prefixes (e.g., “4” in the axis label denotes case 

A.1.4). Gross core damage is avoided in cases A.1.9 and A.1.2.

1

2

3

4

4 3 5 1 6 7 8 9 2

Case Number

Time to Core Damage Surrogate [hr]

PCT > 1922K

Max. oxidized depth > 17% of clad thickness

PCT > U.H. transition (1853K)

PCT > 1644K

PCT > 1478K

Hydrogen production > 1%

Cesium release > 3% of initial inventory

Xenon release > 0 kg

CET > 922K

PCT > 922K

Core level < 1/3 AF

Core level < 2/3 AF

Core level < TAF
51

Table 4.1.3 Times of Core Damage (in hours) According to Various Surrogate Measures Compared Among Base and Se

Shutdown Scenario 

Case

Water

Level 

Below 

TAF

Water

Level 

Below 

2/3 AF

Water

Level 

Below 

1/3 AF

PCT 

> 

922K

CET 

> 

922K

Finite 

Xe 

Release

Hydrogen 

Generation 

> 1% 

Potential

Cesium 

Release 

> 3% 

Inventory

PCT >

1478K 

Maximum 

Oxide 

Depth > 

17% Clad 

Thickness

P

16

A.2.1

(Base) 0.75 0.79 3.12 2.87 2.93 3.16 3.32 3.16 3.34 3.55 3

A.2.2 1.59 2.14 – – – – – – – – 

A.2.3 0.75 0.79 – – – – – – – – 

A.2.4 0.75 0.79 2.95 2.22 2.52 3.08 3.19 3.08 3.21 3.41 3

A.2.5 1.59 2.52 – – – – – – – – 

A.2.6 0.79 0.86 2.02 1.76 1.83 2.04 2.23 2.04 2.22 2.56 2

A.2.7a 1.01 1.06 3.46 3.20 3.27 3.56 3.69 3.56 3.71 3.92 3

A.2.7b 7.87 8.23 9.93 9.38 9.62 10.17 10.36 10.17 11.38 11.36 1

A.2.7c 16.81 17.43 19.54 19.41 19.50 23.10 20.81 23.10 23.92 23.73 2

A.2.7d 0.19 0.21 0.36 0.50 0.59 0.59 0.67 0.59 0.67 0.74 0

A.2.8 0.80 0.85 3.11 2.91 2.98 3.31 3.44 3.31 3.46 3.71 3

A.2.9 0.76 0.81 – – – – – – – – 

A.2.10 3.61 4.14 5.36 5.06 5.13 5.40 5.56 5.40 5.59 5.84 5

A.2.11 0.77 0.81 3.24 2.99 3.05 3.29 3.44 3.29 3.47 3.68 3
52

Table 4.1.4a Bins and Statistics for Times to Start of Core Uncovery, Byron Shutdown Scenario 

Bin Cases Important Deviations from Base Case Range of Time to TAF (hour)

Within-Bin S

TAF: Mean 

Devia

1

A.2.1 (base), 

A.2.4, A.2.6, 

A.2.7a, A.2.8, 

A.2.11

Modified treatment of RHR pump as suction is 

lost (A.2.4), steam dump valve opened 

(A.2.6), reduced break flow (A.2.7a), reduced 

decay heat (A.2.8), initially water-solid RCS 

(A.2.11)

0.75 – 1.01 0.

2 A.2.2, A.2.3, 

A.2.5, A.2.9

Operator recovery of ECCS (no relocations or 

gap releases) 0.75 – 1.59 1.

3 A.2.7b Reduced break flow 7.87 

4 A.2.7c Reduced break flow 16.81 

5 A.2.7d Increased break flow 0.19 

6 A.2.10 Break from a hot leg 4.14 
53

Table 4.1.4b Bins and Statistics for Times for PCT to Exceed 1478K (2200 °F), Byron Shutdown Scenario 

Bin (defined in Table 4.1.4a) Range of time to 1478K (hour) Within-bin statistics for tim

one standard devi

1 2.22 – 3.71 3.24 ± 0.

2 N/A (does not occur) –

3 11.38 –

4 23.92 –

5 0.67 –

6 5.59 –
54

Figure 4.1.2 Times of Core Damage in Byron Shutdown Scenario and its Sensitivity Cases, According 

to Various Surrogate Measures14

 14 The case numbers that label the horizontal axis omit the initial prefixes (e.g., “7d” in the axis label denotes case 

A.2.7d). Gross core damage is avoided in cases A.2.3, A.2.9, A.2.2, and A.2.5.

0

5

10

15

20

25

7d 6 4 1 8 11 7a 10 7b 7c 3 9 2 5

Case Number

Time to Core Damage Surrogate [hr]

Max. oxidized depth > 17% of clad thickness

PCT > 1922K

PCT > U.H. transition (1853K)

PCT > 1644K

PCT > 1478K

Hydrogen production > 1%

Cesium release > 3% of initial inventory

Xenon release > 0 kg

Core level < 1/3 AF

CET > 922K

PCT > 922K

Core level < 2/3 AF

Core level < TAF
55

Table 4.2.1 Times of Core Damage (in Hours) According to Various Surrogate Measures Compared Among Base and S

Scenario SGTR-9

Case

Water

Level 

Below 

TAF

Water

Level 

Below 

2/3 AF

Water

Level 

Below 

1/3 AF

PCT 

> 

922K

CET 

> 

922K

Finite 

Xe 

release

Hydrogen 

Generation 

> 1% 

Potential

Cesium 

Release 

> 3% 

Inventory

PCT >

1478K 

Maximum 

Oxide Depth 

> 17% Clad 

Thickness

1

B.1

(Base) 34.67 36.47 37.00 37.17 37.40 37.57 37.63 37.63 37.90 37.90 3

B.2 22.00 22.37 22.77 22.67 22.93 22.87 23.07 23.07 23.03 23.10 2

B.3 6.65 6.92 7.32 7.23 7.40 7.48 7.65 7.67 7.77 7.80 

B.4 35.17 36.63 37.53 37.70 37.93 38.10 38.17 38.17 38.43 38.43 3

B.5 39.30 41.07 41.87 42.00 42.27 42.43 42.50 42.53 42.80 42.80 4

B.6 34.73 36.10 37.10 37.23 37.47 37.63 37.70 37.73 38.00 38.00 3

B.7 34.67 36.13 37.03 37.17 37.40 37.57 37.63 37.67 37.93 37.93 3

B.8 34.67 36.53 37.03 37.17 37.43 37.57 37.67 37.67 37.93 37.93 3

B.9 34.63 36.23 37.00 37.13 37.37 37.53 37.60 37.63 37.90 37.90 3

B.10 21.70 22.07 22.47 22.40 22.57 22.60 22.77 22.80 22.73 22.80 2

B.11 21.80 22.17 22.60 22.50 22.73 22.70 22.87 22.90 22.83 22.90 2

B.12 –

B.14 Same as Case B.1

B.15 21.67 22.07 22.47 22.37 22.57 22.57 22.73 22.77 22.73 22.77 2

B.161 No core damage as of 72 hours

B.171 5.38 5.62 5.98 6.00 6.15 6.30 6.43 6.50 6.65 6.65 

B.181 4.20 4.43 4.78 4.70 4.85 4.92 5.10 5.15 5.10 5.15 

B.191 Same as Case B.17

B.201 Same as Case B.18

B.21 34.67 36.20 37.00 37.17 37.40 37.60 38.00 37.70 38.07 38.13 3

1 Cases for controlling HHSI above TAF (i.e., below the normal pressurizer level) and B&F are counter to EOPs for the presc

included for illustrative purposes, though they could be viewed as representing errors of commission.
56

Table 4.2.2a Bins and Statistics for Times to Start of Core Uncovery, Surry SGTR Scenario

Bin Cases Important Deviations from Base 

Case Range of Time to TAF (hour)

Within-Bin S

TAF: Mean 

Devia

1 B.3,

B.17-B.201 1⁄2 tube rupture or B&F initiated2 4.2 – 6.71 5

2 B.2,

B.10-B.11, B.15 5-tube rupture 21.7 – 22.0 2

3

B.1 (base),

B.4-B.9,

B.12-B.14, B.21

- 34.6 – 39.3 3

4 B.161 Control of HHSI without B&F > 721 

1 Cases for controlling HHSI above TAF (i.e., below the normal pressurizer level) and B&F are counter to EOPs for the presc

included for illustrative purposes, though they could be viewed as representing errors of commission.

2 Both characteristics lead to one or more fully open pressurizer PORVs, increasing primary side inventory loss, which is detrim

depletion (with recirculation mode unavailable). A “1⁄2 tube rupture” is a break whose flow area is half the cross-sectional area o

Table 4.2.2b Bins and Statistics for Times for PCT to Exceed 1478K (2200 °F), Surry SGTR Scenario

Bin (Defined in Table 

4.2.2a) Range of Time to 1,478 K (hour) Within-Bin Statistics for Time to 

mean ± one standard deviation 

1 5.1 – 7.81 6.3 ± 1.0

2 22.7 – 23.0 22.8 ± 0.1

3 37.9 – 42.8 38.4 ± 1.4

4 > 721 > 72

1 Cases for controlling HHSI above TAF (i.e., below the normal pressurizer level) and B&F are counter to EOPs for the presc

included for illustrative purposes, though they could be viewed as representing errors of commission.
57

Figure 4.2.1 Times of Core Damage in Surry SGTR Scenario and its Sensitivity Cases, According to 

Various Surrogate Measures15

The measure for maximum thickness of the zirconium oxide layer on the cladding is actually calculated 

using the ratio of the mass of zirconium oxide to that of zirconium. In the case of Surry, the masses used 

are in fact specifically those of the cladding, since the required information is available according to the 

setup of this deck. (For other plants, the masses used necessarily include the contributions from, e.g., 

guide tubes. The reason is that MELCOR provides the cladding-specific masses only if appropriate 

control functions are defined before the run is executed, which has been done only in the case of Surry.) 

 15 The case numbers that label the horizontal axis omit the initial prefixes (e.g., “18” in the axis label denotes case 

B.2.18). The Figure omits three cases that duplicate other cases and one case for which no surrogate ever indicates 

(see Table 4.2.1). Cases 17 and 18 should be viewed with the cautions cited in previous tables in mind.

0

5

10

15

20

25

30

35

40

45

18 17 3 15 10 11 2 9 1 7 5 21 6 4 5

Case Number

Time to Core Damage Surrogate [hr]

PCT > 1922K

PCT > U.H. transition (1853K)

PCT > 1644K

Max. oxidized depth > 17% of clad thickness

PCT > 1478K

Cesium release > 3% of initial inventory

Hydrogen production > 1%

Xenon release > 0 kg

CET > 922K

PCT > 922K

Core level < 1/3 AF

Core level < 2/3 AF

Core level < TAF
58

Indication of the 13th criterion (peak local cladding temperature exceeds 3,000 oF [1,922 K]) is used to 

stop the calculations automatically. Consequently, all calculations end with no fuel relocations having 

occurred. (Applies to Surry model only.)

To evaluate the cesium-class release surrogate predicted by the Surry model, the released mass from 

class 2 (alkali metals) is added with stoichiometric fractions of the releases of class 16 (cesium iodide) 

and class 17 (cesium molybdate). The released mass is then compared with the initial class 2 inventory. 

The model necessarily predicts that the cesium release surrogate indicates core damage later than the 

noble gas class release surrogate (i.e., because less than 3 percent of the cesium inventory is assigned 

to the gap), but the precise timing depends on the details of MELCOR’s radionuclide release models.

The definition of the surrogate that compares the cladding temperature with the temperature of the 

Urbanic-Heidrick transition is unchanged in case B.21, even though that case uses a different correlation 

for the temperature-dependent reaction rate coefficient. (That is., the surrogate is still satisfied when the 

cladding temperature exceeds 1,853 K, even though the alternative reaction rate correlation may locate 

the transition at a different temperature.) 

The surrogate referring to hydrogen generated by zirconium oxidation is actually implemented in terms of 

the mass of zirconium oxide.

4.3 Investigation of Core Damage Surrogates – Peach Bottom, SBO with RCIC until Battery 

Depletion

Table 4.3.1 and Figure 4.3.1 show the times to core damage according to various surrogate measures for 

the Peach Bottom SBO with RCIC until battery depletion base and sensitivity cases. Refer to Section 3.3 

(and also Appendix C) for the sensitivity case definitions and to Section 4 for the definitions of the 

surrogate measures. Table 4.3.2a provides statistical data for the time when core uncovery starts. Table 

4.3.2b does the same for the time when the PCT first exceeds 1,478 K (2,200 °F). Definitions of the bins 

are based on timing similarities and not on any logical similarities among the case definitions. See 

Appendix C for additional details. 

A few plant-specific technicalities concerning the evaluation of some of the measures are noted in the 

next paragraphs. 

For the surrogates based on core water level, the level is defined by summing the heights of the swollen 

water columns in the lower plenum, core channel (the third of five computational rings in the model), and 

the shroud dome. 

As discussed in the SNL Peach Bottom model documentation, most of the initial inventory of cesium is in 

molybdate form (i.e., the MELCOR class 17 radionuclide group is pre-populated), so the 3 percent cesium 

release surrogate is computed from the cesium molybdate release. The model necessarily predicts that 

this surrogate indicates later than the noble gas class release surrogate (i.e., because less than 3 percent 

of the cesium molybdate inventory is assigned to the gap), but the precise timing depends on the details 

of the MELCOR radionuclide release models.

The measure for maximum thickness of the oxide layer on the cladding is actually calculated using the 

ratio of the mass of zirconium oxide to that of zirconium. Moreover, because this deck does not provide 

the time-dependent masses of the individual components (such as cladding), the net core-region masses 

of zirconium oxide and zirconium are used instead of the cladding masses specifically. These net masses 

include contributions from the guide tubes, canister, and control rod blade. (See the footnote to the 

corresponding paragraph in Section 4.1.) 
59

Table 4.3.1 Times of Core Damage (in Hours) According to Various Surrogate Measures Compared Among Base and S

Peach Bottom SBO with RCIC until the Battery Depletion Scenario

Case

Water

Level 

Below 

TAF

Water 

Level 

Below 

2/3 AF

Water 

Level 

Below 

1/3 AF

PCT 

> 

922K

CET

> 

922K

Finite 

Xe 

Release

Hydrogen 

Generation 

> 1% 

Potential

Cesium 

Release

> 3% 

Inventory

PCT > 

1478K

Maximum 

Oxide 

Depth > 

17% Clad 

Thickness

P

1

C.1.1

(Base) 9.60 9.97 10.38 10.36 10.44 10.69 10.83 11.14 10.99 11.07 1

C.1.2 16.87 17.33 17.82 17.82 17.92 18.20 18.35 18.72 18.57 18.63 1

C.1.3 5.93 6.35 6.78 6.72 6.80 6.97 7.13 7.28 7.15 7.22 

C.1.4 3.30 3.58 3.87 3.85 3.90 4.07 4.20 4.42 4.27 4.35 

C.1.5 6.85 7.17 7.53 7.52 7.58 7.78 7.93 8.19 8.03 8.12 

C.1.6 10.00 10.42 10.87 10.86 10.95 11.23 11.37 11.74 11.58 11.65 1

C.1.7 9.62 10.00 10.39 10.39 10.47 10.71 10.85 11.17 11.01 11.09 1

C.1.8 10.23 10.62 11.04 11.03 11.11 11.35 11.50 11.83 11.67 11.74 1

C.1.9 9.55 9.94 10.32 10.33 10.40 10.64 10.79 11.09 10.94 11.03 1

C.1.10 9.60 9.97 10.38 10.36 10.44 10.69 10.83 11.14 10.99 11.07 1

C.1.11 9.97 10.34 10.76 10.75 10.84 11.08 11.22 11.54 11.39 11.46 1
60

Table 4.3.2a Bins and Statistics for Times to Start of Core Uncovery, Peach Bottom SBO with RCIC Scenario

Bin Cases Important Deviations from Base Case Range of Time to TAF

(hour)

Within-Bi

to TAF: M

De

1 C.3 – C.5 SRV stuck-open (C.1.3); early battery depletion 

(C.1.4 and C.1.5) 3.30 – 6.85 

2 C.1, 

C.6 – C.11

Base case (C.1.1); reduced decay heat (C.2.6); 

one unavailable SRV (C.1.7); reduced RCIC flow 

rate (C.1.8); SRV parameters (C.1.9); heat 

transfer coefficients for boiling (C.1.10); CST 

liquid temperature (C.1.11)

9.55 – 10.23 

3 C.2 RCIC in manual mode (C.1.2) 16.87 

Table 4.3.2b Bins and Statistics for Times for PCT to Exceed 1,478 K (2,200 °F), Peach Bottom SBO with RCIC Scenario

Bin (Defined in Table 4.3.2a) Range of Time to 1,478 K (hour) Within-Bin Statistics for Time to 1,478 K: Me

Deviation (hour)

1 4.27 – 8.03 6.48 ± 1.61

2 10.94 – 11.67 11.22 ± 0.29

3 18.57 –
61

Figure 4.3.1 Times of Core Damage in Peach Bottom SBO with RCIC until Battery Depletion Scenario 

and its Sensitivity Cases, According to Various Surrogate Measures16

The surrogate referring to hydrogen generated by zirconium oxidation is actually implemented in terms of 

the mass of hydrogen generated by oxidizing zirconium and steel.

4.4 Investigation of Core Damage Surrogates – Observations

Table 4.4.1 summarizes core damage surrogate results for the four base cases. The first surrogate 

measure to indicate is always water level at the TAF, while the last measure to indicate is plantdependent. The order within the legends in Figures 4.1.1, 4.1.2, 4.2.1, and 4.3.1 depicts the base-case 

order in which the surrogate measures indicate. The spread is plant- and scenario-dependent. The 

findings suggest that the surrogate measure associating core damage with the spatially maximized 

cladding temperature exceeding 1,478 K [2,200 °F]) is roughly equivalent to an uncovery of 86 percent of 

the core (i.e., the simple average of the fractions from the four base cases), but there is considerable 

 16 The case numbers that label the horizontal axis omit the initial prefixes (e.g., “4” in the axis label denotes case 

C.1.4).

0

5

10

15

20

25

4 3 5 9 1 10 7 11 6 8 2

Case Number

Time to Core Damage Surrogate [hr]

Cesium molybdate release > 3% of initial inventory

PCT > 1922K

PCT > U.H. transition (1853K)

Max. oxidized depth > 17% of clad thickness

PCT > 1644K

PCT > 1478K

Hydrogen production > 1%

Xenon release > 0 kg

CET > 922K

Core level < 1/3 AF

PCT > 922K

Core level < 2/3 AF

Core level < TAF
62

uncertainty. Note that in the case of the Surry calculation, the water level is actually below the BAF (by 

about 8 cm) when this measure indicates.

Table 4.4.1 Summary of Core Damage Timings for Base-Case Calculations

Plant / 

Scenario

Time of 1st

Core Damage 

Surrogate 

Reached (hr) 

[Surrogate]

PCT > 

1,478 

K

(hr)

Time of Last Core 

Damage Surrogate 

Reached (hour) 

[Surrogate]

Δt Between 

1st and Last 

Surrogate 

Reached 

(hr)

% of Core 

Uncovery 

at Time of 

PCT > 

1,478 K

Byron /

Loss of DC 

Bus 111

1.35

[Water level at 

TAF]

1.91

1.94

[PCT > 1,922 K

(3,000 °F); 

Oxide layer > 17% of clad 

thickness]

0.59 83.5

Byron /

Loss-of-coolant 

during 

shutdown

0.75

[Water level at 

TAF]

3.34

3.55

[Oxide layer > 17% of 

clad thickness]

2.80 75.4

Surry /

SGTR

34.7

[Water level at 

TAF]

37.9

38.2

[PCT > 1,922 K

(3,000 °F)]

3.48 100

Peach Bottom /

Station 

blackout

9.6

[Water level at 

TAF]

11.0

11.1

[Cesium release from fuel 

> 3%]

1.54 84.2

There are two conclusions drawn from these results:

(1) For at-power accidents, a PCT in excess of 1,478 K (2,200 °F) is a good choice for a core damage 

surrogate for MELCOR success criteria applications, because it is not overly-conservative or overly 

non-conservative. 

(2) For shutdown conditions, a single metric may not be sufficient for prescribing a realistic surrogate. 

Rather, a combination could be used including low water level (one-third of the fuel height); 

temperature (PCT above 1,478 K); and a Cesium class release fraction (3 percent released from 

fuel). If only one metric is used, the current limited PWR analyses would suggest that water level at 

one-third active fuel height is a precursor to fuel damage and a PCT above 1,478 K is a precursor to 

significant fuel damage.

The definition of the core damage surrogate is tied to the tool that is being used to analyze the accident, 

as well as the context of the analysis. For instance, if using an Excel calculator for shutdown operator 

timings that tracks water level, peak clad temperature would not be an available output. Meanwhile, if 

activation of the accident management infrastructure (as opposed to a PRA interface definition) is the 

motivation of the analysis, a different criterion might be more appropriate. Furthermore, the above 

guidance is not intended to suggest that no localized fuel damage will have occurred prior to these 

conditions. But, given the use of a tool that models core behavior and nodalizes the core similar to 

contemporary MELCOR input models, and the intent to use a realistic indicator of when an accident has 

transitioned from a pre-core damage to a post-core damage state, the criteria are reasonable.
63

5. INVESTIGATION OF TIME NEEDED TO ARREST FUEL HEATUP

This section considers how much time injection systems need to operate in order to arrest fuel heatup to 

the point of core damage, in the case that such systems, initially unavailable, are recovered prior to core 

damage. Note that this discussion does not consider the time required to realign these systems or to 

reset interlocks, etc., because these steps require an additional focus on given applications. Further, the 

present analysis does not consider situations where additional recovery actions are happening 

concurrently (such as automatic depressurization), which might have competing effects on water 

inventory. Thus, these results should not be applied to those situations.

This section highlights six SBO scenarios. Two pertain to the Peach Bottom plant and four pertain to the 

Byron Unit 1 plant. The discussion considers the effectiveness of the plants’ systems (e.g., ECCS) when 

they are recovered in the course of the SBO. Specifically, it is of interest to determine how much earlier 

than the time of core damage (i.e., in the absence of that recovery) specific systems must be recovered in 

order to prevent core damage. Table 5.1 summarizes the definitions of the six selected scenarios. The 

various assumptions in the Byron scenarios regarding how primary and secondary relief valves may stick 

open have been made in order to ensure that both high- and low-pressure situations are considered.

Table 5.1 Matrix of Scenarios for Calculating Recovery Actions 

Scenario Recovery Action

Peach 

Bottom SBO

A RCIC operates until batteries are depleted at 8 

hours (i.e., the scenario treated in Appendix C) Recover all modeled ECCS1

(i.e., HPCI and LPCS) B No RCIC

Byron 

full-power 

SBO

A No Auxiliary FW; no depressurization of primary 

or secondary sides of the RCS

Recover 1 train (out of 2) of 

all modeled ECCS1 

B

AFW is available until batteries are depleted (5 

hours); secondary-side depressurization due to 

one stuck relief valve of one steam generator (the 

valve gets stuck on cycle 2392

); primary-side 

depressurization due to one stuck pressurizer 

relief valve (it gets stuck on the first cycle)

Recover both trains of all 

modeled ECCS1

Byron shutdown 

SBO

Similar to the base case of the scenario treated in 

Appendix A, except there is no break and the 

RHR pump stops at t = 0; there is no secondaryside depressurization; there is a primary-side 

depressurization due to one stuck pressurizer 

relief valve (it gets stuck on cycle 513)

A Recover closed-loop 

RHR 

B Recover one train of all 

modeled ECCS1,3

1 All pumps are available, but current pressure and flow versus head curves determine whether low-pressure 

pumps actually inject. 2 Note that this valve failure mechanism is actually less relevant for Byron, which uses a hydraulically-operated 

modulating valve type. 3 The recovered train includes the RHR pump that is not in a closed-loop operation.

The first of the two Peach Bottom SBO scenarios is the one that Appendix C analyzes. In that scenario, 

the RCIC is operational until the batteries are depleted at 8 hours. Core damage occurs at 10.99 hours. 

(This section identifies the time of core damage with the time when the spatially-maximized cladding 

temperature attains 1,478 K [2,200 °F]). The second Peach Bottom scenario is the same, except that the 

RCIC is not available at any time. Core damage occurs at 1.17 hours in this case. Both cases include 

recovery of the high-pressure coolant injection (HPCI) and low-pressure core spray (LPCS) systems.
64

The first two of the four Byron SBO scenarios are full-power scenarios17. In the first scenario, no credit is 

given to AFW, and all relief valves (i.e., all pressurizer relief valves and all steam generator relief valves) 

are credited to cycle indefinitely as demanded. This scenario results in core damage at 2.58 hours. The 

second Byron full-power SBO credits AFW until the time of battery depletion, which is assumed to occur 

at 5 hours. It is also assumed that the first steam generator relief valve to reach a count of 239 open-andclose cycles will remain stuck open (see Note 2 from Table 5.1). That number of cycles has a cumulative 

probability of 0.50 for a stuck-open valve, given a failure probability of 2.896 x 10-3 per-demand. 

Moreover, should a pressurizer relief valve open even once, the assumption is that it will remain stuck in 

the open position (i.e., during the first opening cycle). This scenario results in core damage at 10.43 

hours. In the first case, the assumption is that only one ECCS train consisting of one charging pump, one 

high-pressure pump, and one low-pressure (i.e., RHR) pump will be recovered. The second case 

considers the recovery of the complete Byron ECC system (two trains with a total of six pumps). In both 

cases, available pumps initially take suction from the RWST.

The last two of the four Byron SBO cases pertain to a shutdown scenario18. The two cases are 

distinguished by the assumed recovery actions. The scenario is most easily defined in terms of the 

scenario analyzed in the second half of Appendix A. Briefly, the differences between the present scenario 

and the one discussed in Appendix A are (a) the absence of a break in the present case; and (b) the 

unavailability in the present case of the RHR pump at the start of the transient. In a shutdown 

configuration, the RHR pump operates in a closed-loop mode, taking suction from a hot leg. One 

pressurizer relief valve is assumed to stick open when the valve has cycled 513 times. For that number of 

cycles, the cumulative probability of having a stuck-open valve is 0.50 given a failure probability of 1.35 x 

10-3 per demand. With no recovery action, this scenario attains core damage at 15.87 hours. The first 

shutdown case supposes recovery of the RHR pump operating in the closed-loop shutdown mode. The 

second case analyzes the recovery of one complete train of the Byron ECCS. That is to say, one each of 

the charging, SI, and RHR pumps is available to inject by taking suction initially from the RWST. Note that 

this second case does not consider recovery of the RHR pump that had been operating in closed-loop 

configuration. In the second case, the RCS pressure determines the actual injection rate of the RHR and 

other available pumps (which draw from the RWST). This statement also applies to all credited injection 

systems considered in the six cases, other than the case that considers the closed-loop configuration. (In 

closed-loop configuration, an RHR pump may operate at high RCS pressure, since the pressure exists on 

both sides of the pump.)

Table 5.2 lists a summary of the MELCOR-calculated results. The latest successful recovery times are 

approximate (i.e., the resolution is about five minutes). According to these calculations, action at the 

tabulated time averts core damage in all cases. With one exception, a time of five to seven minutes 

before the time of core damage is sufficiently early to actuate the recovered injection system(s) to avert 

core damage. The exception occurs in the Byron shutdown scenario, in the case of recovery of the RHR 

pump operating in a closed-loop configuration. In this case, the recovery action has to precede core 

damage by 119 minutes. In the absence of a recovery action, the Byron shutdown scenario leads to a 

stuck-open pressurizer relief valve at 14.0 hours, when the valve cycles for the 513th time. The open valve 

results in a rapid loss of coolant; therefore, if it is recovered only after the sticking of the valve, the RHR 

pump eventually becomes inoperable again. (The reason is that this pump takes its suction from a hot 

leg.) To avert core damage, the recovery of the RHR pump must precede the 513th cycle of the relief 

valve. The recovery time tabulated in Table 5.2 is in fact seven minutes earlier than when the valve 

becomes stuck, in the absence of any recovery action. The tabulated time is early enough for the RHR 

system to reduce and maintain the RCS pressure below the relief valve setpoint before the 513th cycle 

occurs. In contrast, if the RHR pump is recovered five minutes after the relief valve sticks open, core 

damage is not averted, although the RHR pump is able to operate for about one hour, with the result that 

core damage is postponed by about 1.3 hours, relative to the case of no action. Note that the requirement 

 17 These full-power Byron SBO simulations use Revision 6 of the Byron model. 18 This Byron shutdown SBO scenario is simulated with the Byron Shutdown model described in Section 3.1.2.
65

of notably early recovery of closed-loop RHR injection depends critically on the assumption about valve 

sticking.

A conclusion to draw from these results regarding the time to arrest a fuel heatup is that five to ten 

minutes are sufficient for the SBO transients investigated, if capability to inject from the RWST (as 

opposed to closed-loop cooling) is recovered. A specific application will also need to consider the 

additional time required for tasks such as realigning systems and resetting permissive, as well as any 

concurrent recovery actions (e.g., system depressurization) that might have competing effects on water 

inventory.

Table 5.2 Summary of Calculated Time for Successful Recovery Actions (Peach Bottom and Byron 

Plants) 

Scenario Noteworthy Event(s) Hour tCD

* (hour) tRC** (hour) 

Peach 

Bottom SBO

A Last RCIC duty ends 7.1 10.99 tCD – 5 minutes

B – 1.17 tCD – 5 minutes

Byron fullpower SBO

A Steam generators dry out 1.1 2.58 tCD – 7 minutes

B

One steam generator relief valve 

becomes stuck in the open position 8.5

Steam generators dry out 8.6 10.43 tCD – 5 minutes

One pressurizer relief valve becomes 

stuck in the open position 9.0

Byron shutdown 

SBO

Steam generators dry out 13.9

15.87

A tCD – 119 

minutes

One pressurizer relief valve becomes 

stuck in the open position 14.0 B tCD – 7 

minutes

* Time of core damage without the recovery action.

** Approximate latest time that the recover action is successful.

67

6. UNCERTAINTY ANALYSIS

This section documents the results of the uncertainty analysis study that was performed to determine the 

probability of core damage under the loss of main feedwater (LoMFW) event in the Byron Unit 1 nuclear 

power plant. The analyses performed as part of this study follow those performed in Reference [7] by the 

Electric Power Research Institute (EPRI) using the Modular Accident Analysis Program, version 4.0.6, 

(MAAP4). The major objectives of this study are:

• To quantify in the form of probability density functions the uncertainties associated with key input 

parameters, and to propagate these uncertainties through selected configurations of the LoMFW

scenario using the MELCOR model and a Latin Hypercube Sampling (LHS) process for Byron Unit 1. 

• To calculate the probability associated with the occurrence of core damage as defined and using the 

PCT as the relevant figure-of-merit.

• To assess the most influential input parameters that affect core damage as defined with the PCT as 

the key figure-of-merit and using a linear regression approach (i.e., the PCC/SRC computer code [8]).

• To determine the sensitivity of results (e.g., probability of core damage) to the sample size.

• To compare the MELCOR results of the analysis to the EPRI-MAAP study results.

6.1 Approach

6.1.1 Selected Accident Scenario

The scenario considered in the EPRI-MAAP analysis was the LoMFW event with a subsequent failure of 

all AFW and a failure to recover any form of FW (e.g., AFW, MFW, or cross-tie to the other unit). The 

EPRI-MAAP analysis selected a generic Westinghouse 4-loop PWR design with Model D5 steam 

generators and both motor- and turbine-driven AFW. Similar to Byron Unit 1, this plant design included 

high-head centrifugal charging pumps and high-pressure safety injection (HPSI) pumps. The EPRI-MAAP 

study analyzed eleven different configurations of the LoMFW scenario. These configurations differ in the 

availability of the RCP trip, the number of PORVs, and the number of HPSI and charging pump trains. 

This study of Byron Unit 1 used the MELCOR input deck and analyzed two different configurations of the 

LoMFW scenario19. The assumptions for these configurations are similar to two of the eleven 

configurations that the EPRI-MAAP study analyzed. The selected configurations differ in the number of 

PORVs available for a B&F operation. In the first configuration (Configuration 1), there is one available 

PORV. The second configuration (Configuration 2) considered two available PORVs. The current analysis 

assumes the availability of one HPSI pump train; the analysis assumes that no charging pump is 

available. The RCPs are allowed to trip when specific trip conditions are reached. These assumptions are 

also similar to those of the corresponding two configurations that the EPRI-MAAP study analyzed. 

The above selected LoMFW scenario is also similar to the Loss of DC Bus 111 scenario analyzed in 

Section 3.1.1 of this report (the loss of DC bus 111 also results in a loss of the MFW), except for the 

following difference:

• In the Section 3.1.1 analysis, one charging pump injects coolant until the S signal is generated or the 

volume control tank is depleted. However, for the current uncertainty propagation calculations, the 

charging pumps are assumed to be unavailable from the initiation of event (for consistency with the 

EPRI assumptions).

 19 Revision 7 of the Byron MELCOR model was slightly modified to (i) facilitate execution in batch mode and 

(ii) correct an error concerning the heat input by the RCPs.
68

6.1.2 Selected Input Parameters

The input parameters and their associated uncertainty distributions that were selected for the current 

uncertainty analysis are similar to those of the EPRI-MAAP analysis [7]. Specifically, the EPRI-MAAP 

analysis considered uncertainty distributions in the following parameters: 

• the power level at the start of an incident

• three steam generator water level setpoints (they account for uncertainties in steam generatorlevel measurements)

• time of the reactor trip

• number of PORVs opened for the B&F 

• number of available HPSI and charging pump trains 

• HPSI pump flow characteristics near the shutoff head

• pressurizer PORV flow characteristics 

• time of AFW failure 

• reactor coolant pump trip

• time of feed initiation (HPSI actuation)

• temperature of core damage (TCD)

The uncertainties associated with three parameters, specifically the number of available HPSI and 

charging pump trains, the number of PORVs that are opened for B&F, and the tripping of the RCPs, were 

treated explicitly in the EPRI-MAAP analysis, which resulted in 11 different configurations. Reference [7] 

notes that the selection of the probability distributions representing the uncertainties in various input 

parameters were based on reviews of prior MAAP-based thermal/hydraulic and severe accident 

simulations, emergency operating procedures, and PRA LoMFW accident sequence event tree analyses. 

The input parameters and the associated uncertainty distributions selected for the current analysis are 

discussed below.

Power Level at the Start of an Accident – This analysis assumes three discrete estimates representing 

the probability distribution for reactor power level at the start of the accident that are identical to those 

defined as part of the EPRI-MAAP study (see Figure 6.1 and Table 6.1). Reference [7] notes that this 

distribution is based on reviews of the data from the Licensee Event Reports (LERs) for the LoMFW

initiating events [9]. 

Steam Generator Water Level Setpoints – In the EPRI-MAAP analysis, the uncertainty associated with 

the steam generator level measurement was modeled by assigning distributions to the following three 

steam generator level setpoints:

• 36.3 percent narrow range (NR) for the automatic reactor trip
69

• 14 percent NR for entry to Emergency Operating Procedure (EOP) FR-H.1 (used as a trigger to 

start charging)20

• 25 percent wide range (WR) for initiating the B&F

Figure 6.1 Uncertainty Distribution for Power Level at Start of LoMFW Event Initiation

Table 6.1 Uncertainty Distribution for Power Level at Start of LoMFW Event Initiation

Power Level [%] Probability

100 0.602

80 0.091

50 0.307

In defining samples, these setpoints were assumed to be 100 percent correlated. The EPRI-MAAP study 

considered the triangular distributions corresponding to each steam generator water level setpoint, reexpressed in mass instead of in height and centered at the nominal mass [7]. The upper and lower 

bounds of the triangular distributions were assumed to be at ±15 percent of the nominal value. 

The current MELCOR uncertainty study only considers two steam generator water level setpoints:

• 18.0 percent NR for an automatic reactor trip

• 25 percent WR for the initiation of a B&F 

Note that 36.3 percent of the NR water level modeled in the EPRI-MAAP study is a reactor trip setpoint 

for the Westinghouse 4-loop plant with a Model D5 steam generator. For the Byron Unit 1 plant that uses 

Babcock and Wilcox steam generators, this setpoint is at 18 percent of the steam generator NR water 

level. The second steam generator setpoint from the EPRI-MAAP analysis, which defines the entry to 

 20 Reference [7] lists 10 percent and not 14 percent. However, this amount was changed to the actual value of 14 

percent used in the analyses and is based on a personal communication with the authors. 

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

40 50 60 70 80 90 100 110

Power level at start of incident (%)

PDF

50% Power

80% Power

100% power
70

EOP FR-H.1 (10 percent of the NR for Byron Unit 1), is not used in the MELCOR analysis since charging 

is unavailable. 

Figure 6.2 shows the selected uncertainty distribution in the steam generator water level setpoints. Note 

that the uncertainty distribution is applied to the actual steam generator NR and WR water level setpoints 

expressed in height instead of in mass.

Figure 6.2 Uncertainty Distribution for Steam Generator Water Level Setpoints

Time of Reactor Trip – Figure 6.3 and Table 6.2 show the uncertainty distribution selected for the reactor 

trip condition. A four-state discrete distribution based on the EPRI-MAAP study is assumed. According to 

Reference [7], the data from the review of the LERs associated with the “Rate of Initiating Events at U.S. 

Nuclear Power Plants 1988-2008” [9] for LoMFW-initiating events was used to arrive at the selected 

uncertainty distribution. 

Reactor trip condition ‘0’ models the reactor trip by an early operator action or by an assumed early 

automatic trip and occurs at the initiation of the event (i.e., at problem time t = 0 minutes, simultaneous 

with the loss of the MFW). Reactor trip condition ‘1’ simulates the trip by manual operator action and 

occurs at t = 1 minute. Reactor trip condition ‘2’ models operator action at a code-predicted time related to 

the steam generator water level, but this condition occurs at a higher level than the normal automatic lowlevel reactor trip setpoint (whose setpoint is 18 percent of the steam generator NR). This operator action 

is assumed to take place as soon as the steam generator water level drops by approximately 50 percent 

of the total level drop required to reach the 18 percent steam generator low level setpoint. Reactor trip 

condition ‘3’ simulates an automatic reactor trip at the 18 percent steam generator low level setpoint. In a 

given calculation, the mode that actually applies is fixed by the sample. For example, if the sample 

dictates condition ‘1,’ then the reactor trip occurs at 1 minute irrespective of automatic trip conditions '2' 

and/or '3.'

HPSI Pump Flow Characteristics Near the Shutoff Head – This parameter assumes a triangular 

distribution identical to that of the EPRI-MAAP study. The nominal HPSI flow is used as the mode of the 

0

1

2

3

4

5

6

7

8

0.8 0.9 1 1.1 1.2

Fractional change in SG level setpoint [-]

PDF

Steam generator level measurement
71

triangular distribution, and the upper and lower bounds are assumed at ± 10 percent of the nominal value. 

Figure 6.4 shows the selected uncertainty distribution, which is applied to the HPSI pump flow curve.

Pressurizer PORV Flow Characteristics – The EPRI-MAAP study assumed a triangular distribution with 

the nominal PORV flow as the mode and the upper and lower bounds at ± 20% of the nominal value. 

Figure 6.5 shows that in the current study, the same triangular distribution is applied to the PORV flow 

area. Configuration 2 has two available PORVs (see Section 6.1.1), and the flow areas of the two PORVs 

are sampled independently from the triangular distribution in Figure 6.5.

Figure 6.3 Uncertainty Distribution for Time of Reactor Trip

Table 6.2 Uncertainty Distribution for Time of Reactor Trip

Reactor Trip (RT) 

Condition Description Time [min] Probability [%]

0 Early automatic/manual RT 0 25

1 Early manual RT 1.0 23

2 Intermediate manual RT tSG Low Lev / 2 23

3 Late automatic trip tSG Low Lev 29

Time of AFW Failure – A two-state discrete distribution identical to that of the EPRI-MAAP study is 

assumed for the time of AFW failure. Figure 6.6 and Table 6.3 show the selected distribution for the time 

of AFW failure. Reference [7] notes that this distribution was selected using the data from 

NUREG/CR-6928 [10] for a failure to start and a failure to run (during the first hour) for motor-driven and 

turbine-driven AFW systems. AFW is activated on a low SG water level setpoint (i.e., 18 percent of the 

steam generator NR level).

0

0.05

0.1

0.15

0.2

0.25

0.3

0.35

0 1 2 3

Reactor trip condition [-]

PDF

Reactor trip at 0 min

Reactor trip at 1 min

Reactor trip at SGLowLev/2

Reactor trip at SGLowLev
72

Figure 6.4 Uncertainty Distribution for the HPSI Flow Rate

Figure 6.5 Uncertainty Distribution for the PORV Flow Area

Time of Feed Initiation (HPSI Actuation) – This input parameter models the uncertainty in time required 

by operators to initiate a B&F after the steam generator water level reaches 25 percent of the WR value. 

A log-normal distribution shown in Figure 6.7 is similar to the EPRI-MAAP study distribution and is 

assumed for this parameter. Reference [7] notes that this distribution represents the human error 

0

1

2

3

4

5

6

7

8

0.8 0.9 1 1.1 1.2

Fractional change in HPSI pump flow [-]

PDF

HPSI pump flow

0

1

2

3

4

5

6

7

8

0.8 0.9 1 1.1 1.2

Fractional change in PORV flow area [-]

PDF

PORV flow area
73

probability of ~1.4 × 10-3 for the failure to perform the action within 21 minutes of the actuation cue (i.e., 

25 percent of the WR level).

Figure 6.6 Uncertainty Distribution for Time of AFW Failure

Table 6.3 Uncertainty Distribution in Time of AFW Failure

AFW Failure Condition Description Time [min] Probability [%]

1 Delayed failure 30 min after AFW actuation signal 40

2 Early failure At AFW actuation signal 60

Temperature Used to Define Core Damage – The TCD represents the temperature threshold (treated as 

the temperature strength in a stress-strength interference type concept). The uncertainty in this parameter 

(see Figure 6.8) is represented by a triangular distribution, which is similar to the EPRI-MAAP study and 

is centered at 2,200 °F (1,478 K), with upper and lower bounds anchored at 2,600 °F (1,700 K) (UrbanicHeidrick transition temperature) and 1,800 °F (1255 K) (representative PRA success criteria), 

respectively. Furthermore, similar to the EPRI-MAAP study, this parameter is sampled randomly along 

with the input parameters described above. The probability of core damage is determined based on the 

number of samples for which the calculated PCT (i.e., load) exceeded the sampled TCD. In the current 

analysis, Section 6.2 shows that the probability of core damage is also determined based on comparisons 

of the complementary cumulative distribution functions (CCDF) for the calculated PCT (i.e., load) and the 

cumulative distribution functions (CDF) of the TCD (i.e., capacity CDF calculated from the triangular 

distribution in Figure 6.8). Conceptually, these two approaches should produce the same results.

6.2 Results

The eight input variables (including two steam generator water level setpoints) and the TCD are sampled 

using the constrained LHS technique embedded in the LHS77 computer code [11]. The sample size 

selected for the current analysis is 100, which is the same as the sample size in the EPRI-MAAP study. A 

sensitivity study was performed to determine the impact of sample size on the estimated probability of 

core damage. Table 6.4 shows the sampled values of all eight input parameters and the TCD for the 100 

samples. Table 6.4 also shows the calculated PCT for Configurations 1 and 2.

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0 1 2 3

AFW failure condition [-]

PDF

AFW failure at 30 min after actuation

AFW failure at actuation
74

Figure 6.7 Uncertainty Distribution for Time of Feed Initiation

Figure 6.8 Uncertainty Distribution for the TCD

0.0E+00

5.0E-04

1.0E-03

1.5E-03

2.0E-03

2.5E-03

3.0E-03

3.5E-03

4.0E-03

0 500 1000 1500

Time delay in initiation of F&B operation [s]

PDF

0.00E+00

5.00E-04

1.00E-03

1.50E-03

2.00E-03

2.50E-03

3.00E-03

500 1000 1500 2000 2500 3000

Clad temperature (F)

PDF

Clad temperature (K)

533 811 1088 1366 1644 1922
75

Table 6.4 Sampled Values of All Input Parameters for 100 Samples

Run Power SG 

Setpoint RT HPSI 

Flow

PORV-1 

Flow

PORV-2 

Flow

AFW 

Failure

Time of 

SI 

Injection

TCD Configuration 

PCT

[%] [-] [-] [-] [-] [-] [-] [s] [K] [K] 

1 50 1.07 1 1.06 0.84 0.95 1 306 1350 576 

2 100 1.06 1 1.06 0.98 0.93 2 135 1322 2800 

3 100 1.08 2 0.99 1.16 1.01 1 223 1555 591 

4 100 0.93 0 1.01 1.01 1.06 1 167 1589 2800 

5 100 0.87 3 1.02 0.93 1.07 2 395 1439 2800 

6 50 0.99 2 0.99 1.04 1.03 2 283 1428 579 

7 100 0.92 1 0.96 1.12 1.14 1 159 1383 2800 

8 50 1.01 1 0.97 1.04 1.03 2 115 1466 580 

9 50 0.87 2 1.05 0.95 0.96 2 74 1550 586 

10 100 0.97 1 0.95 1.00 1.08 2 362 1450 2800 

11 100 1.06 2 0.99 1.06 1.12 2 317 1494 2800 

12 50 0.97 1 0.98 1.09 1.08 1 240 1405 577 

13 100 1.12 0 0.97 1.00 1.10 2 92 1600 2800 

14 50 0.99 0 1.05 1.05 1.03 2 346 1455 577 

15 100 0.93 3 1.06 1.08 0.97 1 364 1450 2800 

16 100 0.90 1 0.98 1.02 0.87 2 291 1655 2800 

17 100 1.10 3 0.96 1.12 1.04 2 151 1505 2800 

18 100 0.99 1 1.08 1.03 1.00 2 296 1522 2800 

19 100 0.95 2 0.95 1.06 1.15 1 701 1472 2800 

20 50 0.96 1 1.04 0.98 0.94 2 190 1389 580 

21 100 1.08 0 1.01 0.93 1.03 2 341 1444 2800 

22 100 0.96 1 1.03 0.91 1.11 1 110 1528 2800 

23 100 0.92 1 1.04 1.06 0.88 1 130 1578 2800 

24 100 1.00 3 1.01 1.10 0.96 2 260 1544 2800 

25 50 1.02 1 0.99 1.07 0.91 1 177 1500 577 

26 100 1.00 0 1.04 0.97 0.83 1 180 1672 2800 

27 50 1.04 0 1.04 1.10 1.03 2 235 1339 576 
76

Table 6.4 Sampled Values of All Input Parameters for 100 Samples

Run Power SG 

Setpoint RT HPSI 

Flow

PORV-1 

Flow

PORV-2 

Flow

AFW 

Failure

Time of 

SI 

Injection

TCD Configuration 

PCT

[%] [-] [-] [-] [-] [-] [-] [s] [K] [K] 

28 80 0.99 0 0.92 0.98 0.92 2 198 1516 629 

29 50 0.94 3 1.01 0.90 1.00 2 206 1611 586 

30 50 0.94 1 1.02 0.99 0.91 1 559 1466 577 

31 80 1.03 3 1.05 1.11 0.90 1 381 1461 585 

32 80 1.06 2 0.94 0.92 0.92 2 76 1444 590 

33 50 1.05 2 1.02 1.17 0.97 2 219 1422 578 

34 100 1.13 2 1.02 1.06 1.04 1 136 1633 585 

35 100 0.91 2 0.93 0.97 0.82 2 145 1289 2800 

36 100 0.89 1 0.97 1.07 1.05 1 448 1583 2800 

37 50 0.91 3 1.00 1.01 0.92 2 424 1483 587 

38 50 1 3 1.03 0.94 1.15 2 97 1333 583 

39 100 0.97 0 0.95 1.00 1.11 1 185 1339 2800 

40 50 1.03 2 0.93 0.96 1.02 2 186 1439 578 

41 50 1 1 0.94 0.87 0.98 1 504 1566 577 

42 100 0.98 2 0.90 1.14 0.89 1 277 1361 2800 

43 100 0.97 2 1.00 0.96 1.09 2 339 1505 2800 

44 100 1.08 0 0.97 0.86 0.95 2 280 1533 2800 

45 50 1.07 3 1.00 1.06 1.10 2 374 1366 579 

46 50 0.94 2 0.99 0.91 1.06 2 154 1428 584 

47 50 1.01 0 1.00 1.01 0.87 2 267 1494 578 

48 100 0.95 0 1.05 1.03 1.17 1 403 1300 2800 

49 100 0.88 0 0.96 1.03 1.01 2 200 1416 2800 

50 50 1.1 2 0.99 1.02 1.09 1 128 1355 575 

51 80 1.09 2 0.98 0.99 0.92 2 526 1378 589 

52 50 0.91 0 0.97 1.02 1.02 1 437 1394 571 

53 100 0.99 1 1.09 1.04 0.93 2 470 1405 2800 

54 80 1.03 0 0.93 1.14 1.06 2 209 1528 589 
77

Table 6.4 Sampled Values of All Input Parameters for 100 Samples

Run Power SG 

Setpoint RT HPSI 

Flow

PORV-1 

Flow

PORV-2 

Flow

AFW 

Failure

Time of 

SI 

Injection

TCD Configuration 

PCT

[%] [-] [-] [-] [-] [-] [-] [s] [K] [K] 

55 50 0.93 3 1.07 0.81 0.90 1 147 1455 578 

56 80 1.02 3 0.95 1.07 1.00 2 521 1655 1163 

57 50 1 0 1.06 0.98 1.17 2 268 1594 578 

58 50 0.96 3 0.98 1.00 0.97 1 243 1578 578 

59 50 0.98 1 0.95 0.96 1.05 1 141 1522 575 

60 100 0.98 0 1.01 0.89 0.99 2 356 1411 2800 

61 100 1.05 0 1.02 0.95 1.05 2 246 1600 2800 

62 100 1.01 1 0.99 1.04 1.01 2 252 1466 2800 

63 100 0.98 0 0.97 0.99 1.01 1 236 1416 2800 

64 100 1 1 1.00 1.02 0.86 1 119 1511 2800 

65 100 1.01 1 1.03 0.88 0.94 2 156 1372 2800 

66 100 1.03 3 0.96 1.01 0.85 2 460 1539 2800 

67 100 0.95 2 1.01 0.94 0.97 2 411 1505 2800 

68 100 1.02 3 0.99 0.91 1.04 1 172 1433 2800 

69 100 1 3 1.03 1.01 1.08 1 123 1622 2800 

70 100 1.02 3 1.04 1.08 1.10 2 386 1489 2800 

71 50 0.98 3 1.00 0.93 1.02 1 480 1611 579 

72 100 1.09 2 1.03 0.85 0.94 1 842 1455 2800 

73 50 1.1 0 1.03 1.08 0.94 1 570 1389 576 

74 100 1.01 3 1.00 0.90 0.99 2 323 1266 2800 

75 100 1.03 0 0.94 0.88 0.98 2 164 1566 2800 

76 100 1.05 0 1.01 0.95 0.99 2 328 1478 2800 

77 80 1.06 3 1.07 1.10 0.96 2 196 1516 587 

78 50 1.11 0 0.92 0.97 1.00 2 415 1561 579 

79 100 0.98 0 1.03 1.15 0.95 2 302 1350 2800 

80 100 0.92 3 1.00 1.13 1.04 2 257 1483 2800 

81 100 1.04 2 1.02 1.15 1.00 1 249 1628 590 
78

Table 6.4 Sampled Values of All Input Parameters for 100 Samples

Run Power SG 

Setpoint RT HPSI 

Flow

PORV-1 

Flow

PORV-2 

Flow

AFW 

Failure

Time of 

SI 

Injection

TCD Configuration 

PCT

[%] [-] [-] [-] [-] [-] [-] [s] [K] [K] 

82 100 1.02 3 1.02 0.94 1.07 1 102 1561 2800 

83 100 0.9 3 0.98 1.05 0.88 2 193 1489 2800 

84 100 0.96 3 0.98 1.11 0.99 2 228 1539 2800 

85 100 1.07 1 1.07 1.05 0.90 2 224 1461 2800 

86 50 1.04 3 0.97 0.85 1.13 1 862 1533 574 

87 100 1.01 3 1.00 0.90 1.02 2 203 1572 2800 

88 100 0.96 3 1.01 1.00 1.13 1 332 1478 2800 

89 100 1.04 3 1.01 1.03 0.85 1 289 1433 2800 

90 80 1.02 3 1.00 0.87 0.99 1 600 1550 586 

91 100 0.97 2 0.98 0.89 1.07 2 213 1422 2800 

92 50 1.04 3 0.98 1.01 0.89 2 311 1500 580 

93 80 0.93 0 1.04 0.93 1.12 2 231 1516 588 

94 50 0.95 1 0.94 0.97 0.96 1 312 1400 577 

95 100 0.97 2 0.95 0.97 0.95 1 273 1378 2800 

96 100 1.03 1 1.03 1.09 0.98 2 215 1316 2800 

97 100 0.94 0 1.05 0.99 1.06 2 637 1644 2800 

98 100 1.09 2 0.96 0.94 1.05 1 175 1400 2800 

99 100 1.05 2 1.08 0.96 0.98 2 168 1478 2800 

100 100 1.14 2 0.99 0.92 0.98 2 262 1472 2800 
79

Table 6.5 shows the results of the MELCOR calculations for Configurations 1 and 2. The number of 

simulations for each configuration where the calculated PCT (load) exceeds the indicated core damage 

temperature thresholds is also listed in Table 6.5. As noted earlier, the TCD is a temperature sampled 

from the triangular distribution shown in Figure 6.8. Since there are a total of 100 samples for each 

configuration, the probability that the PCT will exceed the TCD is about 0.57 (i.e., 57 out of 100) for 

Configuration 1 and about 0.15 (i.e., 15 out of 100) for Configuration 2. 

Table 6.5 MELCOR Analysis Results for Configurations 1 and 2

Configuration >TCD > 1,800 °F

(1255 K)

> 2,200 °F

(1,478 K)

> 2,600 °F

(1700 K)

1 57 57 57 57

2 15 15 15 15

Figure 6.9 shows the CCDF of the calculated PCT (load) and the CDF of the TCD (capacity). The CDF of 

the TCD is calculated from the probability distribution function (PDF) shown in Figure 6.8. The probability 

that the PCT exceeds the temperature at which core damage is assumed to occur is about 0.57 (57 

percent) for Configuration 1 and about 0.15 (15 percent) for Configuration 2. 

Figure 6.9 Comparison of the CCDF of the Calculated PCT (Load) and the CDF of the Temperature 

at which Core Damage is Assumed (Capacity)

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

500 1000 1500 2000 2500 3000

Clad temperature [K]

CDF/CCDF

TCD (capacity CDF)

Calculated PCT for Confg. 1 (load CCDF)

Calculated PCT for Confg. 2 (load CCDF)
80

Figure 6.10a and 6.10b show the PDF of the calculated PCT (load) and the TCD (capacity) for 

Configurations 1 and 2, respectively. Figure 6.10 shows that the discrete distribution is selected for the 

calculated PCT and PDF. The PCT for most of the samples (or runs) that avoid core damage remains 

between 570 K and 590 K. The PCT for the samples where core damage is observed is 2,800 K for all 

similar samples, because this particular temperature is the user-specified cladding relocation 

temperature. Once cladding attains this temperature, MELCOR reclassifies it as debris and no longer 

tracks that temperature as representative of cladding. 

The most influential input parameters were identified using the PCC/SRC computer code, which 

calculates the partial correlation coefficients (PCC) [8]. These coefficients provide measures of the 

relative contribution (importance) of each input variable to the observed variations in the output figure-ofmerit. Table 6.6 shows the results of the importance analyses; the uncertainty in the power level is by far 

the most important contributor affecting the calculated probability of core damage as estimated. The 

estimates are based on the present MELCOR analyses. The time of the AFW failure is shown to have a 

higher importance in Configuration 2. The uncertainties in all other parameters are only marginally 

significant (i.e., the importance of those with R2 values less than ~0.70 is not very meaningful).

Figure 6.10a The PDF of the Calculated PCT (Load) and Temperature at which Core Damage Is 

Assumed (Capacity) for Configuration 1

0

0.1

0.2

0.3

0.4

0.5

0.6

0 1000 2000 3000 4000 5000

Clad temperature [F]

Calculated PCT probability

0.0E+00

5.0E-04

1.0E-03

1.5E-03

2.0E-03

2.5E-03

3.0E-03

TCD probability

Calculated PCT

TCD

255 811 1366 1922 2477 3033

Clad temperature [K]
81

Figure 6.10b PDF of Calculated PCT (Load) and TEMPERATURE at which Core Damage is Assumed 

(Capacity) for Configuration 2

Table 6.6 Summary of the Rank Regression Results

Parameter

Case 1 Case 2

R2 Importance Ranking R2 Importance Ranking

Power 0.97 1 0.94 1

SG water level setpoints -0.40 3 -0.46 3

Time of reactor trip 0.17 5 -0.33 4

HPSI flow -0.06 6 0.01 8

PORV 1 flow -0.26 4 -0.02 7

PORV 2 flow NA NA -0.19 5

Time of AFW failure 0.52 2 0.80 2

Time of B&F initiation -0.05 7 0.05 6

0

0.05

0.1

0.15

0.2

0.25

0.3

0 1000 2000 3000 4000 5000

Clad temperature [F]

Calculated PCT probability

0.0E+00

5.0E-04

1.0E-03

1.5E-03

2.0E-03

2.5E-03

3.0E-03

TCD probability

Calculated PCT

TCD

255 811 1366 1922 2477 3033

Clad temperature [K]
82

The effect of the sample size is assessed by performing a sensitivity study for Configuration 1. Fifty (50) 

samples were selected for this sensitivity study. Table 6.7 shows the comparison of results based on the 

sample size of one hundred (100) and fifty (50). Furthermore, Figure 6.11 shows the comparison of CCDF 

of the calculated PCT (load) for the one hundred (100) and fifty (50) sample simulations. The CDF of the 

TCD (capacity) is also shown in Figure 6.11. The estimated probability of core damage using 50 samples 

is 0.60, which is slightly higher than the estimated probability of 0.57 based on 100 samples.

Table 6.7 Sensitivity to Sample Size

Sample Size >TCD > 1,800 °F

(1255 K)

> 2,200 °F

(1,478 K)

> 2,600 °F

(1,700 K)

100 57 57 57 57

50 30 31 30 30

Figure 6.11 Comparison of the CCDF of the Calculated PCT (Load) for One Hundred (100) and Fifty 

(50) Sample Simulations

6.3 Comparison with the EPRI-MAAP Study

Table 6.8 shows the results of the comparison between the present study and the EPRI-MAAP study. The 

probability of core damage estimated in the current analysis for Configuration 1 (0.57) is in good 

agreement with the EPRI-MAAP analysis estimates (0.61). The MELCOR estimated core damage 

probability of 0.15 for Configuration 2 is also lower than the EPRI-MAAP estimated probability of 0.22.

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

500 1000 1500 2000 2500 3000

Clad temperature [K]

CDF/CCDF

TCD (capacity CDF)

Calculated PCT for 100 samples (load

CCDF)

Calculated PCT for 50 samples (load

CCDF)
83

Table 6.8 Comparison of the EPRI-MAAP Analysis and the Current MELCOR Analysis

Study Configuration >TCD > 1,800 °F

(1255 K)

> 2,200 °F

(1,478 K)

> 2,600 °F

(1,700 K)

NRC-MELCOR Study

1 57 57 57 57

2 15 15 15 15

EPRI-MAAP Study [7]

1 61 63 61 60

2 22 26 22 19

Table 6.8 also shows the comparison of the number of samples showing a PCT higher than 1255 K 

(i.e., the lower bound of the core damage temperature uncertainty distribution), 1478 K (center of the core 

damage temperature uncertainty distribution), and 1,700 K (upper bound of the core damage temperature 

uncertainty distribution) between the EPRI-MAAP study and the present study. The estimated probability 

of core damage is in reasonable agreement in the case of both configurations. 

85

7. REFERENCES 

1. H. Esmaili, D. Helton, D. Marksberry, R. Sherry, P. Appignani, D. Dube, M. Tobin, R. Buell, 

T. Koonce, and J. Schroeder, “Confirmatory Thermal-Hydraulic Analysis to Support Specific Success 

Criteria in the Standardized Plant Analysis Risk Models-Surry and Peach Bottom,” United States 

Nuclear Regulatory Commission, NUREG-1953, (September 2011).

2. M. Khatib-Rahbar, et al., "A Probabilistic Approach to Quantifying Uncertainties in the Progression of 

Severe Accidents", Nuclear Science & Engineering, Volume 102, 219 (1989).

3. R. Chang, J. Schaperow, T. Ghosh, J. Barr, C. Tinkler, and M. Stutzke, “State-of-the-Art Reactor 

Consequence Analyses (SOARCA) Report,” U. S. Nuclear Regulatory Commission, NUREG–1935 

(January 2012).

4. R. Wilson, et al., “Reviews of Modern Physics” Volume 57, Number 3, Part II (July 1985).

5. L. Soffer, S.B. Burson, C.M. Ferrell, R.Y. Lee, and J.N. Ridgely, “Accident Source Terms for LightWater Nuclear Power Plants,” U. S. Nuclear Regulatory Commission, NUREG-1465, (February 

1995).

6. U.S. Code of Federal Regulations, Title 10, Energy, Part 50, “Domestic Licensing of Production and 

Utilization Facilities,” Subpart 46, “Acceptance criteria for emergency core cooling systems for lightwater nuclear power reactors” (2007).

7. J. Gabor, R. Sherry, and D. True, “Technical Framework for Management of Safety Margins-Loss of 

Main Feedwater Pilot Application,” EPRI Technical Report, EPRI-TR 1023032 (November 2011).

8. R. L. Iman et al., “A FORTRAN 77 Program and User’s Guide for the Calculation of Partial Correlation 

and Standardized Regression Coefficients,” NUREG/CR-4122, SAND85-0044, Sandia National 

Laboratories (June 1985).

9. "Rates of Initiating Events at U.S. Nuclear Power Plants 1988–2008, Reactor Operational Experience 

Results and Databases," http://nrcoe.inel.gov/results/.

10. "Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nuclear 

Power Plants," U.S. Nuclear Regulatory Commission, NUREG/CR-6928 (2007).

11. R.L. Iman and M.J. Shortencarier, “A FORTRAN 77 Program and User’s Guide for the Generation of 

Latin Hypercube and Random Samples for Use with Computer Models,” U.S. Nuclear Regulatory 

Commission, NUREG/CR-3624 (1984).

A-1

APPENDIX A: DETAILS OF BYRON LOSS OF DC BUS 111 AND SHUTDOWN 

ANALYSES

A.1. Introduction

A.1.1 Background

Section 2.1 of the main report describes the Byron Unit 1 plant and the MELCOR models of the plant in 

full-power and Shutdown configurations. This appendix provides the details of the models and analyses 

for the Byron Unit 1 nuclear power plant.

A.1.2 Objectives and Scope

The objectives of this appendix are to document the calculations specific to the Byron Unit 1 plant that 

encompass detailed results for two basic scenarios and their sensitivity cases. These simulations, and in 

part the model, are limited in scope to considerations important for determining success criteria and 

sequence timing.

A.1.3 Outline

Sections A.2 and A.3 respectively focus on results that describe two basic scenarios: “Loss of DC Bus 

111 with (B&F)” and “Shutdown.” The two scenarios and their sensitivity cases are defined in Sections 

A.2.1 and A.3.1, respectively, for “Loss of DC Bus 111” and “Shutdown.” Detailed results specific to the 

base and sensitivity cases appear in subsections of Section A.2.2 (in the case of “Loss of DC Bus 111”) 

and Section A.3.2 (in the case of “Shutdown”). Summary results pertaining to all cases appear in Section 

A.2.3 (“Loss of DC Bus 111”) and Section A.3.3 (“Shutdown”). These summary results also appear in 

Sections 3.1.1 (“Loss of DC Bus 111”) and 3.1.2 (“Shutdown”) of the main report. 

All detailed results of the Loss of DC Bus 111 scenario appear in the subsections of Section A.2.2, with 

each subsection pertaining to a particular (base or sensitivity) case. Likewise, detailed results on the 

Shutdown scenario appear in the subsections of Section A.3.2. To simplify the Figure numbering, a fourcharacter code is used within these subsections. After “A”, which designates Byron, the next character 

numbers the scenario. The character after that numbers the sensitivity case (the base case is counted as 

the first case). The last character in the string is the count among the Figures that apply to a given 

sensitivity case of a given scenario. For example, the first figure in the second sensitivity case that 

pertains to the Loss of DC Bus 111 scenario is Figure A.1.2.1. Figures not pertaining to a specific 

scenario and sensitivity case are not numerous, and are designated by a two-character code whose first 

character denotes Byron and whose second character is a count over the Appendix. A similar twocharacter code is used for all the Tables.

A.2 Byron Scenarios and Results: Loss of DC Bus 111 with Bleed and Feed

A.2.1 Loss of DC Bus 111 with Bleed and Feed

The transient initiator considered in this analysis is loss of DC bus 111. The FW regulating valves and 

their associated bypasses close when there is a loss of DC power, so the initiator implies a loss of MFW. 

Additional consequences of the loss of the bus are that one of the two pressurizer pilot operated relief 

valves (PORVs) is unavailable, and all motor-driven (MD) auxiliary feedwater (AFW) is unavailable. 

Additionally, the scenario definition assumes diesel-driven (DD) AFW and charging (after an ECCS 

signal) are unavailable. The condenser steam dump valves are assumed to be available and are used 

until the automatic closure of the main steam isolation valves (MSIVs) occurs. As stated above, charging 

pumps are not available for ECCS injection. However, normal-operation injection by one charging pump 

is accounted for initially after scram. One of two SI pumps and one of two RHR pumps are available. A 

successful transition to the recirculation mode is assumed, but the RHR heat exchanger is not available. 
A-2

One of four containment fan coolers is available. Containment depressurization, whether by operator 

action or building failure, is not modeled.21 Table A.1 summarizes the availability of various systems. The 

operators are assumed to initiate B&F at 20 minutes.

Table A.1 Loss of Bus 111 with the B&F: System, Phenomenological, and Operator Action 

Assumptions 

Primary 

side

RCPs tripped if:

(i) cold leg void fraction > 0.1 (a surrogate for cavitation); OR

(ii) containment pressure > 20 psig; OR

(iii) RCS pressure < 1,425 psig AND SI > 100 gpm (0.0063 m3

/s); OR

(iv) time to initiation of B&F is less than 2 minutes (assumed based on FR-H.1 guidance to 

trip RCPs before initiating SI).

Only 1 PORV is available (due to initiator) – it is the lower setpoint PORV (FL306) 

Secondary 

side

0 of 1 motor-driven (MD)-AFW trains available (due to initiator); 

0 of 1 diesel-driven (DD)-AFW trains available.

Injection into steam generators of water in the hotwell by a booster pump is assumed to be 

unavailable.

Cross-tie of the other unit’s MD-AFW is not attempted.(1)

Condenser steam dump valves and steam generator PORVs are assumed to be available. 

Atmospheric relief valves are allowed to cycle indefinitely without failing.

ECCS 0 of 4 accumulators are available (by probabilistic risk assessment (PRA) modeling 

convention).

Neither containment spray train is available.

1 of 2 RHR pumps, 1 of 2 SI pumps, 0 of 2 charging pumps are available for ECCS 

injection mode.

1 of 1 RHR pump, 1 of 2 SI pumps, 0 of 2 charging pumps are available for ECCS 

recirculation mode.

1 of 4 reactor containment fan cooler (RCFC) units is available.

Operator 

actions

Available ECCS pumps are secured during dead-head phase, available upon demand.

No RWST/CST refill is credited.

Other No component cooling water (CCW) to RHR heat exchanger is credited. Containment 

depressurization (i.e., by any gas flow into the environment) is not modeled.

1 As of this writing, the capability to cross-tie the other unit’s MD-AFW was removed from service awaiting NRC 

approval of a license amendment request.

 21 That is, the model lacks any flow path from the containment into the environment that describes either filtered (or 

otherwise controlled) venting or overpressure failure.
A-3

To investigate the variability of the predictions, eight sensitivity cases are defined in addition to the base 

case. The highlighted entries in Table A.2 show how each sensitivity case differs from the base case. 

• Case A.1.1 is the base case.

• Case A.1.2 assumes a higher level for the setpoint for the scram due to low steam generator water 

levels, leading to an earlier time for scram. 

• Case A.1.3 discounts the normal-operation injection by one charging pump, which explores a 

situation where charging isolates due to a cascading electrical distribution failure or other cause. 

• Case A.1.4 imposes depressurization of all four steam generators at 10 minutes, which explores a 

situation where the operators attempt to depressurize the steam generators early to allow for a FW 

injection from a low-pressure source. (No FW injection occurs, however.) 

• Case A.1.5 assumes that the condenser steam dump valves and the steam generator PORVs are not 

available, and a safety valve of one of the steam generators becomes stuck in the open position after 

excessive cycling.

• Case A.1.6 credits all ECCS cold-leg accumulators, which are not credited in the base case due to a 

PRA modeling convention not to credit systems that would not be expected to participate, because 

their failure is not included in the logic modeling. (Note that this case is identical to the base case 

through the time of core damage).

• Case A.1.7 credits all fan coolers.

• Case A.1.8 is the same as the base case, except that the calculations use MELCOR version 2.1 

instead of version 1.8.6.

• Case A.1.9 is the same as the base case, except that the decay heat is uniformly reduced by a factor 

of 0.8 relative to the base case.

The base-case calculation for the Byron Loss of Bus 111 with B&F scenario is described in detail in 

Section A.2.2.1. Sections A.2.2.2 through A.2.2.9 typically describe the sensitivity calculations in less 

detail. A summary discussion pertaining to this scenario appears in Section A.2.3, which also appears in 

the main report.

A.2.2 Results

A.2.2.1 Results of Case A.1.1 (Base Case)

The scenario progression is outlined in Table A.3 and illustrated in Figures A.1.1.1 to A.1.1.11. Loss of 

FW at t = 0 seconds (after a pre-transient steady-state period lasting 1,000 seconds) initiates the 

transient. No form of AFW is available.

Before turning to the MELCOR-predicted results, it is useful to make some estimates. The scenario 

definition calls for the bleed and feed operation to begin at 20 minutes. At 20 minutes, the decay heat is 

87 MW. The maximum flow rate of one SI pump is 43.7 kg/s, which would be delivered only at an RCS 

pressure lower than about 5.1 MPa. The rate of heat transfer required to raise the temperature of the SIinjected liquid (311K) up to its saturation temperature (618K at 15.51 MPa) would be about 90 MW, if the 

water were to be injected at the maximum rate. Here the heat to vaporize the injected liquid is not 

considered. Thus one SI pump is only marginally capable of keeping the core subcooled, and can do so 
A-4

Table A.2 Sensitivity Cases for Byron Loss of Bus 111 with Bleed and Feed Scenario

Case Scram

Pre-S signal 

injection by one 

charging pump 

after scram(2)

Number of 

Steam 

Generators 

depressurized

SG PORVs and 

Condenser 

Dump Valves 

Available(3)

Number of 

Credited 

Accumulators

Number of 

Credited Fan 

Coolers

M

V

A.1.1

(Base) Automatic(1) Yes 0 Yes 0 1 

A.1.2 Early(1) Yes 0 Yes 0 1 

A.1.3 Automatic(1) No 0 Yes 0 1 

A.1.4 Automatic(1) Yes 4 (at 10 

minutes)(4) Yes 0 1 

A.1.5 Automatic(1) Yes 0 No(5) 0 1 

A.1.6 Automatic(1) Yes 0 Yes 4 1 

A.1.7 Automatic(1) Yes 0 Yes 0 4 

A.1.8 Automatic(1) Yes 0 Yes 0 1 

A.1.9 Automatic(1) Yes 0 Yes 0 1 

(1) Automatic: all modeled scram trips operate; scram occurs at 40 s due to low SG water level. Early: manual scram occurs a

where degrading conditions forewarned the operators that loss of the bus was imminent, and they were thus able to take immed

(2) This normal-operation injection by a charging pump continues until VCT depletes or the S signal is sent. No charging pum

purposes. The failure that causes loss of charging injection during ECCS is assumed to also prevent automatic realignment o

VCT to the RWST.

(3) If available, dump valves actuate at scram and act to control legs coolant temperature to 564.8 K. (4) Four steam generators are depressurized by MSIV and steam dump valve closure followed by a full opening of all steam gener

(5) Additionally, the secondary safety valve of the lowest opening pressure of the pressurizer loop (i.e., the valve represented b

MPa) is assumed to be stuck open on the 25th demand to close.
A-5

Table A.3 Timing of Key Events Predicted for the MELCOR Model Loss of Bus 111 with Bleed and 

Feed Base-Case Calculation (Times in Hours Unless Stated Otherwise) 

Event Description Time

Loss of all FW following loss of Bus 111 0 seconds

Scram (because of low water levels in steam generators) 40 seconds

Injection by one charging pump (in excess of letdown) begins 40 seconds

Condenser steam dump valves open 40 seconds

Injection by one charging pump ends (due to VCT depletion)(1) 10.9 minutes

Manual trip of all RCPs 18.0 minutes

Manual opening of pressurizer PORV-1; manual transmission of S 

signal 20.0 minutes

Injection by one SI pump drawing from RWST begins 20.7 minutes

MSIVs close (because of excessive rate of main steam line 

depressurization); condenser steam dump valves close 33.0 minutes

Steam generators dryout 33 minutes

SI pump deadheaded 0.75 to 2.04 ; 2.72 to 2.94

Core partially uncovered 1.35 to 3.5

Coolant temperature at core exit reaches 922 K (1,200 °F) 1.68

First gap release(2) 1.80

Peak clad temperature reaches 1,478 K (2,200 °F) 1.91

First failure of the core support plate 2.27

Calculation end 4.49

Accumulators inject Not available

Containment sprays actuate Not available

SG PORVs open Does not occur

Steam generator safety valves open Does not occur

Switch to ECCS recirculation mode Does not occur

Sump water becomes saturated Does not occur 1 The failure that causes loss of charging injection during ECCS is assumed to also prevent automatic realignment 

of normal charging from the VCT to the RWST. 2 In MELCOR, the volatile radionuclides in the fuel gaps are released by rings at the time when the cladding 

temperature, spatially maximized over a given computational ring, reaches 1,173 K. In the present case, the 

core’s entire gap inventory is released after 2.02 hours.
A-6

Figure A.1.1.1a Water Level in the Steam Generators (Case A.1.1 short-term)

Figure A.1.1.1b Water Level in the Steam Generators (Case A.1.1 longer-term)

10

15

20

25

-300 0 300 600 900 1200 1500

time [sec]

Level [m]

SG-D

SG-A

SG-B

SG-C

Scram setpoint

10

15

20

25

0 1 2 3 4 5

time [hr]

Level [m]

SG-D

SG-A

SG-B

SG-C
A-7

Figure A.1.1.2 Coolant Injection Rates before and around the Time of S Signal (Case A.1.1)

Figure A.1.1.3a Pressure in the Pressurizer (Case A.1.1 short-term)

0

5

10

15

20

-300 0 300 600 900 1200 1500

time [sec]

Injected mass rate to each of CLs A and D , kg/s

CFVALU.5244 / 2 - SI injection

CFVALU.5388 - charging pump before S signal

12

13

14

15

16

17

-300 0 300 600 900 1200 1500

time [sec]

Pressure [MPa]

CVH-P.305

S signal setpoint
A-8

Figure A.1.1.3b Pressure in the Pressurizer (Case A.1.1 longer-term)

Figure A.1.1.4a PORV and Net Core Volumetric Outflow Rates (Case A.1.1 short-term)

4

6

8

10

12

14

16

18

0 1 2 3 4 5

time [hr]

Pressure [MPa]

CVH-P.305 (Pressurizer)

SI pump deadhead

0

0.1

0.2

0.3

0.4

0.5

0 0.25 0.5 0.75 1 1.25

time [hr]

Outflow rate [m^3/s]

Core total

PORV total

PORV steam

PORV liquid
A-9

Figure A.1.1.4b PORV and Net Core Volumetric Outflow Rates (Case A.1.1 longer-term)

Figure A.1.1.5a Average Liquid Temperatures in the Hot and Cold Legs (Case A.1.1 short-term)

0

0.25

0.5

0.75

1

0 1 2 3 4 5

time [hr]

Outflow rate [m^3/s]

Core total

PORV total

PORV steam

PORV liquid

560

570

580

590

-500 0 500 1000 1500 2000 2500

time [sec]

Tavg (legs water temeprature) [K]
A-10

Figure A.1.1.5b Average Fluid Temperatures in the Hot and Cold Legs (Case A.1.1 longer-term)

Figure A.1.1.6 Average Main Steam Line Pressure (Case A.1.1)

400

500

600

700

800

900

1000

0 1 2 3 4 5

time [hr]

Tavg (legs water or steam temeprature) 

[K]

5.0

5.5

6.0

6.5

7.0

7.5

8.0

-500 0 500 1000 1500 2000 2500

time [sec]

Main steam lines pressure [MPa]
A-11

Figure A.1.1.7a Water Levels in the Vessel (Case A.1.1)

Figure A.1.1.7b Water Levels throughout the Plant (Case A.1.1)

0

2

4

6

8

10

12

14

0 1 2 3 4 5

time [hr]

Level [m]

Downcomer (collapsed)

Lower plenum to dome thru ring 2 (collapsed)

Lower plenum to dome thru ring 2 (swollen)

TAF

BAF

8

12

16

20

24

28

0 0.25 0.5 0.75 1 1.25

time [hr]

Level [m]

Pressurizer

SGT-D (CV330)

SGT-D (CV336)

SGT-B (CV530)

SGT-B (CV536)

SG-D (2nd side)

SG-B (2nd side)

Vessel
A-12

Figure A.1.1.8 Peak Cladding Temperature (Case A.1.1)

Figure A.1.1.9 ECCS Injection Rates (Case A.1.1)

500

1000

1500

2000

2500

3000

0 1 2 3 4 5

time [hr]

Temperature [K]

Maximum clad temperature

0

5

10

15

20

25

30

0 1 2 3 4 5

time [hr]

Injected mass rate to each of CLs A and D , kg/s

CFVALU.5244 / 2 - SI injection

CFVALU.5388 - charging pump before S signal
A-13

Figure A.1.1.10 Core Exit Temperature (Case A.1.1)

Figure A.1.1.11 Spatially Maximized Mass Ratio, Zirconium Oxide to Zirconium (Case A.1.1)

only if the open PORV can depressurize the RCS to less than about 5.1 MPa. Taking now a result from 

the calculation, the pressure that the RPV quickly falls to after the PORV is opened is about 8 MPa. At 

that pressure, one SI pump injects at only 29.7 kg/s, and the heat transfer rate required to bring the liquid 

up to saturation, boiling being discounted, is 61 MW. Since this is less than the decay heat, boiling of the 

coolant will occur and tend to raise its pressure and temperature further, if other forms of cooling are not 

500

1000

1500

2000

2500

3000

0 1 2 3 4 5

time [hr]

Temperature [K]

Maximum coolant

temperature at core exit

 

0.01

0.1

1

10

1.70 1.75 1.80 1.85 1.90 1.95 2.00

time [hr]

Mass ratio [-]

All components (base case with standard deck)

Cladding only (base case with special MELGEN deck - CF21616)

Core damage value (0.17)
A-14

available. The SI pump deadheads at 10.7 MPa. It can thus be anticipated from these simple estimates 

that the ability of a single SI pump to sustain injection is in doubt.

A detailed account of the predicted transient is as follows. Scram due to low steam generator water levels 

occurs at 40 seconds (see Figure A.1.1.1a). Beginning at this time, normal-operation injection by one of 

the two charging pumps is accounted for. At earlier times, the injection by one charging pump that occurs 

during normal plant operation is assumed in the model to be exactly canceled by normal letdown. The 

letdown is not included in the model, and it is supposed to end actually at scram while injection by a 

charging pump is supposed to continue after scram. This injection by one charging pump ends at 10.9 

minutes upon depletion of the volume control tank (VCT). Figure A.1.1.2 depicts early injection into the 

RCS.

Scram at 40 seconds results in a closure of the turbine throttle valve. It is assumed that the previously 

shut condenser steam dump valves become active at this time, immediately coming under automatic 

control with the attempt to keep the Tavg constant. Here, the Tavg is the simple four-loop average of the 

liquid temperatures in the hot and cold legs; in the MELCOR model, the hot and cold leg nodes nearest 

the steam generators are used. The assumed setpoint for Tavg is 564.8 K (557 °F). This action by the 

dump valves keeps main steam line pressures below the opening pressures of the steam generator 

PORVs (one per loop) and the steam generator safety valves (five per loop), which are all individually 

modeled. (The steam generator safety valves with the lowest opening pressure (8.205 MPa) are modeled 

by FL476, FL576, FL676, and FL376 in loops A through D22, respectively. The steam generator PORVs, 

which open at 7.79 MPa, are modeled by flow paths FL477, FL577, FL677, and FL377.) 

At 18 minutes, the operators trip all RCPs in preparation for initiating the B&F. At 20 minutes, the 

operators fully open one of the two pressurizer PORVs and manually trigger the “S” signal that initiates 

the ECCS. Figure A.1.1.3a shows the pressure in the pressurizer at early times. The events and 

processes that influence this pressure are: FW loss (RCS pressure rises); scram and a period of about 30 

seconds duration during which the dump valves open widely to bring the Tavg to setpoint (RCS pressure 

drops); injection by one charging pump into the RCS prior to depressurization with the PORV (RCS 

pressure rises); end of this injection due to VCT depletion (RCS pressure drops); RCP pump trip (RCS 

pressure rises); and the opening of one PORV (RCS pressure drops). Note that at 80 seconds, the low 

RCS pressure setpoint for an automatic initiation of the S signal is narrowly missed. Had it been reached, 

the injection by the charging pump would have stopped. This charging pump action is premised on the 

assumption that the realignment of its suction to the RWST taking place upon receipt of the S signal 

would fail, which is consistent with the scenario definition that does not credit charging pumps for ECCS 

purposes. Also, were there to be an S signal at this early time, actual injection by the SI pump would not 

have started then because of the high RCS pressure. Figure A.1.1.3b shows the full history of the 

pressurizer pressure.

The manually initiated S signal activates the ECCS at 20 minutes. Credit is given to one of two SI pumps 

and one of two RHR pumps. Each pump, as well as the charging pump in use between the times of 

scram and the S signal, is configured to divide its discharge equally between the cold legs of Loops A and 

D. (A footnote in Section 2.1 describes later correction of this treatment, but it is of little consequence for 

this scenario since all loops are intact.) Both charging pumps are assumed to be unavailable. (Although a 

charging pump had been in use earlier, it is assumed that the necessary realignment of the suction point 

of the charging pumps from the VCT to the RWST fails.) Actual injection rates by the available and 

activated SI and RHR pumps are calculated in accordance with their flow rate versus head curves. In fact, 

at the time of the signal, the primary pressure is too high for either pump to inject. As the pressure falls 

due to the open PORV, the SI pump begins to inject at 20.7 minutes. During the calculation (ending at 

4.49 hours), the primary pressure is always too high to permit injection by the RHR pump. Because of the 

short calculation time, ECCS recirculation mode is not attained. (In the recirculation mode, one RHR 

 22 The model’s control volumes and flow paths are designated CVixy and FLixy with i = 3, 4, 5, and 6 corresponding 

respectively to loops D, A, B, and C in plant nomenclature.
A-15

pump takes suction from the sump, and the other credited ECCS pumps then take their suction from that 

RHR pump.)

As has been pointed out in the opening paragraph, SI injection at any rate significantly less than one 

pump’s maximum rate supplies insufficient cooling to equal the decay heat by sensible heatup of the 

injected water alone. Boiling will occur unless there is additional cooling; boiling will result in repressurization unless the PORV outflow is sufficiently great. Initially, additional cooling is provided by the 

steam generators, resulting in a period of approximately steady RCS pressure lasting from about 0.4 to 

0.5 hours (about 8 MPa; see Figure A.1.1.3b). Steam generator cooling remains appreciable prior to the 

time of steam generator dryout (0.55 hours, as Figure A.1.1.1b shows). Later, there is no additional 

cooling, and re-pressurization depends on the PORV outflow. In general, the outflow through the PORV is 

a mixture of liquid and steam. Figures A.1.1.4a and A.1.1.4b show the liquid, steam, and total PORV 

volumetric outflow rates. Also shown is the total volumetric rate at which liquid and steam leave the core. 

(In the case of the core, the rate of inflows is subtracted from the rate of outflows to define the net 

outflow.) While the steam generators are not dried out, the core outflow almost always remains below the 

PORV outflow, and the pressure does not rise. After steam generator dryout, the core outflow 

increasingly exceeds the PORV outflow during the times shown in Figure A.1.1.4a. This imbalance results 

in re-pressurization of the RCS (Figure A.1.1.3b) such that the SI pump is deadheaded at 0.75 hours. The 

pressurization continues until SRV outflows begin at about 1.25 hours. 

Due to steam generator dryout and consequent loss of cooling starting at 0.55 hours (33 minutes), the 

dump valves react according to their control logic and open widely in an unsuccessful attempt to regulate 

Tavg (Figure A.1.1.5a) to its setpoint value. This opening results in a rapid fall of the main steam lines 

pressure (see Figure A.1.1.6), and at 33.0 minutes the MSIVs close because of a trip on excessive rate of 

the main steam line pressure drop (i.e., the pressure falls faster than 2.23 psi per second (15.4 kPa/s)). 

This closure effectively seals off the steam generators and makes the dump valves inoperable. Coolant 

temperature over the long term is shown by Figure A.1.1.5b.

Figure A.1.1.7a shows the water level in the vessel, which is defined by summing the heights of the 

columns of water in a stack of control volumes running from the lower plenum to the dome, by way of the 

second computational ring in the regions of radial nodalization. (See Figure 2.1.2 for the vessel 

nodalization. The difference between levels defined by swollen versus collapsed column heights is not 

significant in this case.) Figure A.1.1.7b co-plots the vessel water level with other water levels throughout 

the plant. The core starts to uncover at about 1.35 hours. It is partially uncovered during 1.35 to 3.5 hours 

and fully uncovered during a ten-minute period around 2.2 hours. 

A period of falling pressure begins at 1.56 hours, shortly after the core begins to uncover. As the fuel 

uncovers, a significant portion of the decay heat goes to heatup of the fuel (as shown by the climbing 

peak clad temperatures in Figure A.1.1.8). The SI pump is able to inject again at 2.04 hours. Except for a 

short period around 2.8 hours when it is deadheaded again, the SI pump is able to inject uninterruptedly 

for the rest of the calculation. Figure A.1.1.9 shows the ECCS injection rate to each of the cold legs of 

Loops A and D, due to the one credited SI pump (and, before the S signal at 20 minutes, one charging 

pump).

During the period from 1.80 to 2.02 hours, gap release is predicted to occur in all five of the computational 

rings of the core. (In MELCOR, gap release is modeled in a given ring when its axial maximum of 

cladding temperature reaches 1173 K.) Relocation of both cladding and fuel (modeled at a threshold of 

2800 K) is predicted. The lower core support plate also fails starting at 2.27 hours. Figure A.1.1.10 shows 

the maximum core exit temperature, which exceeds 922 K (1200 °F) at 1.68 hours. Figure A.1.1.8 shows 

the peak clad temperature (maximum over the entire core). This temperature first exceeds 1478 K (2200 

°F) at 1.91 hours. The calculation is terminated at 4.49 hours, because the damage to the core is already 

extensive by all measures.
A-16

As already discussed in the main part of this report, throughout this document the core damage surrogate 

measure based on maximum thickness of the cladding oxide layer is actually calculated using the ratio of 

the mass of zirconium oxide to that of zirconium. Moreover, except for the calculations made for Surry, 

the net core region masses of zirconium oxide and zirconium are used instead of the specific masses of 

cladding. The net masses include those of other components such as the control rod guide tubes as well 

as the canister and blade in the case of a BWR. These component-specific masses are not available in 

the default MELCOR output files. The base case of the present scenario, however, has been repeated 

with no change except for the definition of a control function equal to this measure, thus making it 

available in the output. The new control function uses the masses of the cladding component. This 

special deck is not described or documented anywhere else. As Figure A.1.1.11 shows, the difference 

relative to the standard post-run analysis that uses the lumped masses of zirconium components of all 

types is less than one minute in the indicated time of core damage.

A.2.2.2 Results of Case A.1.2 (Early Reactor Trip) 

Case A.1.2 addresses uncertainty in the time of scram. In the base case, scram occurs automatically at 

about 40 seconds due to low water levels in the steam generators. The predicted steady-state SG water 

level is 24.165 m (with respect to the inside bottom of the reactor pressure vessel [RPV]), to compare with 

the estimated plant value of 24.30 m. The estimated plant value for the scram setpoint is 22.69 m. (The 

model controls the steady-state mass of liquid to a known plant value of 53,347 kg per steam generator 

instead of controlling water level.) The base case uses 22.557 m as the scram setpoint, which preserves 

the difference between the plant’s normal operation value and the plant value for the scram setpoint. This 

sensitivity case arbitrarily assumes a higher scram setpoint of 23.600 m (to mimic manual scram based 

on operator action in response to degrading conditions preceding the bus loss), which leads to an earlier 

scram. Otherwise, this sensitivity case is the same as the base case. 

The scenario progression is outlined in Table A.4 and is illustrated in Figures A.1.2.1 to A.1.2.10. Scram 

stemming from low SG water levels at the assumed higher setpoint occurs at 11 seconds. (Figure A.1.2.1 

shows the steam generator levels.) Beginning at this time, the normal-operation injection by one of the 

two charging pumps is accounted for. This injection ends at 10.6 minutes, when the volume control tank 

(VCT) is depleted. 
A-17

Table A.4 Timing of Key Events Predicted for the MELCOR Model Bus Loss with Bleed and Feed 

Sensitivity Case 2 Calculation (Times in Hours Unless Stated Otherwise) 

Event Description Time

Loss of all FW because of loss of Bus 111 0 seconds

Scram (due to low water levels in steam generators) 11 seconds

Injection by one charging pump (in excess of the letdown) begins 11 seconds

Condenser steam dump valves open 11 seconds

Injection by one charging pump ends (because of VCT depletion) 10.6 minutes

Manual trip of all RCPs 18.0 minutes

Manual opening of pressurizer PORV-1 ; manual send of S signal 20.0 minutes

Injection by one SI pump drawing from the RWST begins 20.7 minutes

MSIVs close (as a result of high containment pressure); condenser 

steam dump valves close 1.48

SG PORVs open 1.72 to 3.38(1)

SG s dry out 1.8(2)

SI pump is deadheaded 2.06 to 3.04

Core is partially uncovered 2.5 to 4.9

Coolant temperature at the core exit reaches 922 K (1,200 °F) 3.06

Switch to ECCS recirculation mode (RHR heat exchanger not available) 7.74

Calculation end 27.8

Accumulators inject Not available

Containment sprays actuate Not available

SG safety valves open Does not occur

Gap release Does not occur

Sump water becomes saturated Does not occur

Peak clad temperature reaches 1,478 K (2,200 °F) Does not occur 1 Loops B, C, and A. Loop D (pressurizer loop) SG-PORV does not open. 2 Loops B, C, and A. Dryout in Loop D (pressurizer loop) occurs at 1.1 hours.
A-18

Figure A.1.2.1a Water Level in the Steam Generators (Case A.1.2 short-term)

Figure A.1.2.1b Water Level in the Steam Generators (Case A.1.2 longer-term)

10

15

20

25

-300 0 300 600 900 1200 1500

time [sec]

Level [m]

Scram setpoint (assumed high)

SG-D

SG-A

SG-B

SG-C

10

15

20

25

0 1 2 3 4 5

time [hr]

Level [m]

SG-D

SG-A

SG-B

SG-C
A-19

Figure A.1.2.2a Pressure in the Pressurizer (Case A.1.2 short-term)

Figure A.1.2.2b Pressure in the Pressurizer (Case A.1.2 longer-term)

12

13

14

15

16

17

-300 0 300 600 900 1200 1500

time [sec]

Pressure [MPa]

CVH-P.305

S signal setpoint

0

2

4

6

8

10

12

14

16

18

0 5 10 15 20 25

time [hr]

Pressure [MPa]

CVH-P.305 (Pressurizer)

SI pump deadhead
A-20

Figure A.1.2.3 ECCS Injection (Case A.1.2)

Figure A.1.2.4 Saturation and Sump Water Temperatures (Case A.1.2)

0

5

10

15

20

25

0 5 10 15 20 25

time [hr]

Injected mass rate to each of CLs A and D , kg/s

CFVALU.5388 - chrg before S signal

CFVALU.5244 / 2 - SI , inject mode

CFVALU.5520 - SI , recirc mode

CFVALU.5252 / 2 - chrg , inject mode

CFVALU.5506 - chrg , recirc mode

CFVALU.5248 / 2 - RHR , inject mode

CFVALU.5502 - RHR , recirc mode

20

40

60

80

100

120

140

0 5 10 15 20 25

time [hr]

Temperature [C]

CVH-TLIQ.800 (Sump)

CFVALU.5840 (Water injected by ECCS)

CVH-TSAT(P).800
A-21

Figure A.1.2.5a Fan Cooler Cooling Rate (Case A.1.2 short-term)

Figure A.1.2.5b Fan Cooler Cooling Rate (Case A.1.2 longer-term)

0.0

0.5

1.0

1.5

2.0

-300 0 300 600 900 1200 1500

time [sec]

Heat Removal Rate [MW]

ESF-QFC-RAT.1 (Three units , normal mode)

ESF-QFC-RAT.2 (Three units , accident mode)

ESF-QFC-RAT.3 (One unit , normal mode)

ESF-QFC-RAT.4 (One unit , accident mode)

0

10

20

30

40

50

60

0 5 10 15 20 25

time [hr]

Heat Removal Rate [MW]

ESF-QFC-RAT.1 (Three units , normal mode)

ESF-QFC-RAT.2 (Three units , accident mode)

ESF-QFC-RAT.3 (One unit , normal mode)

ESF-QFC-RAT.4 (One unit , accident mode)

Decay heat
A-22

Figure A.1.2.6 Fan Cooler Condensation Rate (Case A.1.2)

Figure A.1.2.7 Containment Pressure (Case A.1.2)

0

5

10

15

0 5 10 15 20 25

time [hr]

Water Vapor Condensation Rate [KG/S]

ESF-QFC-RAT.1 (Three units , normal mode)

ESF-QFC-RAT.2 (Three units , accident mode)

ESF-QFC-RAT.3 (One unit , normal mode)

ESF-QFC-RAT.4 (One unit , accident mode)

0.0

0.5

1.0

1.5

2.0

2.5

0 5 10 15 20 25

time [hr]

Pressure [bar]

Total

Water vapor
A-23

Figure A.1.2.8 Water Level in the Vessel (Case A.1.2)

Figure A.1.2.9 Core Exit Temperature (Case A.1.2)

0

2

4

6

8

10

12

14

0 5 10 15 20 25

time [hr]

Level [m]

Downcomer (collapsed)

Lower plenum to dome thru ring 2 (collapsed)

TAF

BAF

300

600

900

1200

0 5 10 15 20 25

time [hr]

Temperature [K]

Maximum coolant

temperature at core exit
A-24

Figure A.1.2.10 Peak Cladding Temperature (Case A.1.2)

Scram results in a closure of the turbine throttle valve and the opening of the condenser steam dump 

valves. The dump valves control attempts to keep Tavg constant at 564.8 K. This action of the dump 

valves keeps the main steam line pressures below the opening pressures of the SG PORVs and SRVs 

(the PORVs open eventually).

At 18 minutes, the operators trip all reactor coolant pumps in preparation for initiating the B&F. At 20 

minutes, the operators fully open one of the two pressurizer PORVs and manually trigger the S signal that 

initiates the ECCS. As in the base case, an early automatic S signal does not occur. The RCS pressure 

reaches a minimum of 12.7 MPa at 45 seconds, just slightly above the low-pressure S signal setpoint of 

12.63 MPa. Figures A.1.2.2 show the RCS pressure.

The manually initiated S signal activates the ECCS at 20 minutes. Credit is given to one of two SI pumps 

and one of two RHR pumps. Both charging pumps are assumed to be unavailable. Actual injection by the 

SI pump begins at 20.7 minutes. During the period of the ECCS injection mode, the RCS pressure is too 

high for the RHR pump to inject. 

All MSIVs close at 1.48 hours because of high containment pressure. This closure seals off the dump 

valves. The steam lines pressure rises until the SG-PORVs open at 1.72 hours. The PORVs remain 

closed after 3.38 hours. No SG relief valves open during the calculation.

Dryout of the steam generators occurs during 1.1 to 1.8 hours depending on the loop; see Figure 

A.1.2.1b. Consequently, the RCS pressures rise from about 1.5 to 2.6 hours, and the SI pump is 

deadheaded from 2.06 to 3.04 hours (Figure A.1.2.2b). 

At 7.74 hours, the RWST is drawn down to the level (so-called Lo-2) where the switch to the ECCS 

recirculation mode occurs. The model assumes that Lo-2 is attained when the volume delivered by the 

ECCS pumps and containment sprays is 187,736 gallons, which was calculated to represent the RWST 

initially at 89 percent full. In this calculation, drawdown of the RWST results from the one operating SI 

pump only: the other pumps and sprays are not available. In the recirculation mode, one RHR pump 

300

600

900

1200

0 5 10 15 20 25

time [hr]

Temperature [K]

Maximum clad temperature
A-25

takes suction from the containment sump. After passing through the RHR heat exchanger, the pump’s 

output then flows into all credited SI and charging pumps. These pumps are configured in parallel, for 

final injection into the cold and/or hot legs. In the present scenario, the RHR heat exchanger provides no 

cooling because of the assumed unavailability of the service water, and the RHR pump’s outflow is into 

the one available SI pump and then in two cold legs. Figure A.1.2.3 shows the injections resulting from 

the various pumps and modes. Cold legs A and D each receive water injected at the plotted rates. (A 

footnote in Section 2.1 describes later correction of this treatment, but it is of little consequence for this 

scenario since all loops are intact.). Here, by convention, during the recirculation mode, the injection is 

associated with the pump(s) downstream of the RHR pump. If the primary pressure falls low enough to 

allow it, the RHR pump would be aligned to inject directly to the RCS instead of feeding the other pumps. 

The plot would then associate the flow with the RHR pump.

During the time from 2.06 to 3.04 hours, the SI pump is deadheaded by high RCS pressure. At all other 

times later than 20.7 minutes, the ECCS injection occurs continuously. No water-level-dependent control 

of the injection is invoked, with the result that the pressurizer is overflowing at most times after 1 hour. At 

times later than about 5 hours, the flow through the PORV is almost pure liquid. The temperature of this 

liquid is never less than 205 °C (478 K), while the saturation temperature at the containment pressure is 

never more than 123 °C (396 K). Therefore, this effluent quickly becomes steam in the containment, and 

the fan cooler is thus effective in removing heat from the plant. 

From the time that the recirculation mode is initiated, the sump is filled to a depth of about 8 m above its 

bottom. During this mode, the temperature of the water increases from 85° C (at 7.74 hours) to 96° C 

(369 K) (at 25 hours). Therefore, adequate suction for the recirculation mode exists. Figure A.1.2.4 shows 

the temperature of the sump water and the saturation temperature. In the model’s single-node treatment 

of the containment, control volume CV800 represents the sump, dome and all other parts of the 

containment.

Besides the two ECCS pumps, the scenario also credits one of the four containment fan coolers. 

Containment sprays and accumulators are not credited. The fan cooler operates at all times, including 

during the pre-transient steady state. However, the S signal causes it to change to the so-called accident 

mode (Figure A.1.2.5a). From about 5 to 25 hours, the fan cooler is removing heat at around 30 to 20 

MW. As Figure A.1.2.5b shows, this cooling rate is comparable to the decay heat at times later than about 

5 hours. The energy extraction is primarily due to steam condensation (Figure A.1.2.6 shows the 

condensation rate). The containment pressure (Figure A.1.2.7) is around 0.2 MPa during this time range, 

with the water vapor partial pressure around 0.05 MPa. 

Figure A.1.1.8 shows the water level in the vessel. During the time from 2.5 to 4.9 hours, as a 

consequence of the period when the SI pump is deadheaded, the core uncovers partially. Figure A.1.1.9 

shows the temperature of the coolant at the core exit (maximized over the radius). The highest clad 

temperature (maximized over the core) occurs during this time (1,123 K at 3.15 hours), as Figure A.1.1.10 

shows.

The calculation is ended at 27.8 hours with the core kept covered by injection in the recirculation mode 

from one SI pump, while the fan cooler removes heat at a rate very close to the decay heat rate. Gap 

releases and gross core damage in the form of the relocation of any structures are avoided. However, 4.7 

kg of hydrogen are generated as a result of oxidation reactions in the core.

A.2.2.3 Results of Case A.1.3 (No Charging Pump Injection)

Case A.1.3 considers the effect of the injection by one charging pump. In the base case, this injection 

takes place during the time from scram until the time when the VCT depletes. In the base case, the VCT 

depletes at 10.9 minutes. That this injection need be accounted for starting only at scram assumes that 

normal-operation charging is canceled by letdown prior to scram. The letdown is not modeled but is 

assumed to end at the scram. In the sensitivity case, no injection by a charging pump occurs at any time
A-26

(i.e., unavailability of charging is related to failure of the charging pump or train and not a failure 

associated with realignment to ECCS injection). 

As Figure A.1.3.1 shows, the minimum RCS pressure that occurs soon after scram is sufficiently 

deepened (relative to the base case) by the lack of charging pump injection that the ECCS actuation 

pressure is attained at 64 seconds. In the base case, the ECCS is not activated until 20 minutes, by the 

manual S signal. However, despite being activated, the available ECCS pumps cannot inject until after 

the manual opening of PORV-1, and the only consequence of the early ECCS actuation is switching the 

fan cooler to accident mode. 

Figure A.1.3.1 Pressure in the Pressurizer (Case A.1.3)

Relative to the base case, at early times the RCS pressure is generally lower in the sensitivity case. Later, 

however, there is little effect on the pressure. As a result, the history of the SI pump deadhead, core 

uncovery, and core damage is similar in both the base and the sensitivity cases. The coolant temperature 

at the core exit first exceeds 922 K at 1.62 hours; the maximum cladding temperature first exceeds 1,478 

K at 1.83 hours; and the first failure of the core support plate occurs at 2.23 hours. These timings 

compare with 1.68, 1.91, and 2.27 hours, respectively, in the base case.

A.2.2.4 Results of Case A.1.4 (Depressurized Steam Generators)

Case A.1.4 assumes that at 10 minutes, operators depressurize all four steam generators (e.g., in 

anticipation of SG injection via an alternate low pressure source – though such injection is not credited 

here). This is accomplished by manually closing all MSIVs, then manually fully opening all SG PORVs. 

These actions are modeled as occurring instantly at 10 minutes.

Figure A.1.4.1 compares the base and sensitivity cases with respect to the pressure in the pressurizer. 

Initially (i.e., after the operator action takes place at 10 minutes), the depressurization of the secondary 

side has a notable effect on the primary-side pressure. After about half an hour, however, the base-case 

versus the sensitivity-case primary pressures are similar, leading to a similar history of core uncovery and 

7

9

11

13

15

17

-500 0 500 1000 1500 2000 2500 3000

time [sec]

Pressure [MPa]

Sensitivity case

Base case

S signal setpoint

SI pump deadhead
A-27

core damage. The coolant temperature at the core exit first exceeds 922 K at 1.60 hours. The maximum 

cladding temperature first exceeds 1,478 K at 1.81 hours. The first failure of the core support plate occurs 

at 2.27 hours. These timings compare with 1.68, 1.91, and 2.27 hours, respectively, in the base case.

Figure A.1.4.1 Pressure in the Pressurizer (Case A.1.4)

In an undocumented variant, the four steam generators are depressurized at scram. The core damage 

timings are similar: the coolant temperature at the core exit first exceeds 922 K at 1.76 hours, and the 

maximum cladding temperature first exceeds 1478 K at 1.98 hours.

A.2.2.5 Results of Case A.1.5 (One Steam Generator Safety Valve Is Stuck Open)

In this case, the assumed unavailability of the condenser steam dump valves and steam generator 

PORVs causes a cycling of the steam generator safety valves. Additionally, this sensitivity case assumes 

that one of the safety valves becomes stuck in the open position after 25 open-and-close cycles. The 

affected valve is FL376, the safety valve of lowest opening pressure in the pressurizer-loop steam 

generator, which opens at 8.205 MPa. This event occurs at 24.3 minutes.

It may be stated that the postulated sticking event is relatively unlikely. Reference [A.1] quotes 

NUREG/CR–7037 to present 263 as the number of valve lifts that yields a 50 percent cumulative 

probability of becoming stuck in the open position, estimated to apply to the steam generator relief valves 

at the Surry plant. This statistic implies a per-close sticking probability of 0.002632, which in turn implies a 

cumulative probability of 6.4 percent for becoming stuck in the open position in 25 or less demands to 

close. Two considerations led to imposing a comparatively early time for this valve to stick open. First, it is 

desired that the event should have interesting consequences, so it should precede the period of the SI 

pump deadhead. Second, the steam generator relief valves naturally cycle less frequently as the 

sequence progresses. For example, as a variant to the present calculation, were FL376 allowed to cycle 

indefinitely, it would have cycled 38 times at 43 minutes and 40 times at 67 minutes.

The count of pressurizer-loop steam generator safety valve cycles attains 25 cycles at 24.3 minutes, so in 

this sensitivity case the valve remains open starting at this time. All MSIVs are still open, so the stuck 

valve acts to depressurize all steam generators. At 30.5 minutes, however, the high containment pressure 

4

6

8

10

12

14

16

18

0 1 2 3 4 5

time [hr]

Pressure [MPa]

Sensitivity case

Base case

SI pump deadhead
A-28

trip point is reached, and all MSIVs close. The pressurizer-loop SG continues to depressurize until it

reaches atmospheric pressure at about 35 minutes. Pressures in the other steam generators recover, but 

the SRVs do not cycle again before the problem is ended. Figure A.1.5.1 depicts these events and shows 

the pressures in the four steam generator domes.

Figure A.1.5.1 Pressure in the Steam Generator Domes (Case A.1.5)

Figure A.1.5.2 compares the RCS pressure of the sensitivity case with that of the base case. These 

pressures are similar, and they lead to a similar history of core uncovery and core damage. The coolant 

temperature at the core exit first exceeds 922 K at 1.66 hours. The maximum cladding temperature first 

exceeds 1,478 K at 1.88 hours. And the first failure of the core support plate occurs at 2.23 hours. These 

timings compare with 1.68, 1.91, and 2.27 hours, respectively, in the base case.

0

2

4

6

8

10

0 0.5 1 1.5 2 2.5

time [hr]

Pressure [MPa]

CVH-P.370

CVH-P.470

CVH-P.570

CVH-P.670
A-29

Figure A.1.5.2 Pressure in the Pressurizer (Case A.1.5)

A.2.2.6 Results of Case A.1.6 (Accumulators Credited)

This case credits the four accumulators, which are assumed to be unavailable in the base case.

Before 5.1 hours, the sensitivity case results are identical to those of the base case, because the RCS 

pressure is above the accumulator injection pressure (4.515 MPa) before this time. Therefore, the cases 

are identical with respect to core damage, which occurs at around 1.8 hours depending on the surrogate 

measure. 

A.2.2.7 Results of Case A.1.7 (All Fan Coolers Are Credited)

This case credits all four fan coolers, while the base case credits only one.

The greater containment cooling has little effect on in-vessel processes, especially during the ECCS 

injection mode, when core damage occurs in the base case. As a result, the history of core uncovery and 

core damage is similar in the two cases. In the sensitivity case, the coolant temperature at the core exit 

first exceeds 922 K at 1.68 hours; the maximum cladding temperature first exceeds 1,478K at 1.91 hours; 

and the first failure of the core support plate occurs at 2.31 hours. These timings compare with 1.68, 1.91, 

and 2.27 hours, respectively, in the base case.

A.2.2.8 Results of Case A.1.8 (MELCOR Version 2.1)

Case A.1.8 is the same as the base case, except that the calculations use MELCOR version 2.1 (Release 

3649) instead of version 1.8.6. 

Figure A.1.8.1 compares the results with respect to the pressure in the pressurizer. Through the times at 

which the various core damage surrogate measures indicate, the differences are very small. Later, there 

are some timing differences in the pressures and in other phenomena. In the sensitivity case, the coolant 

temperature at the core exit first exceeds 922 K at 1.68 hours; the maximum cladding temperature first 

4

6

8

10

12

14

16

18

0 1 2 3 4 5

time [hr]

Pressure [MPa]

Sensitivity case

Base case

SI pump deadhead
A-30

exceeds 1,478 K at 1.91 hours; and the first failure of the core support plate occurs at 2.07 hours. These 

timings compare with 1.68, 1.91, and 2.27 hours, respectively, in the base case.

Figure A.1.8.1 Pressure in the Pressurizer (Case A.1.8)

It is noted that the Byron MELCOR model is under continuous development, and has reached Revision 8 

as this report is being finalized. (Except for the results reported in this paragraph, all results that apply to 

the Loss of DC Bus 111 scenario have been obtained using a working Revision 5 of the model23). Figure 

A.1.8.2 compares the pressure in the pressurizer, as predicted by Revision 8 of the model and MELCOR 

2.1, with the base-case calculation. (The thin black curves of Figures A.1.8.1 and A.1.8.2 are identical.) 

Core damage occurs at 2.16 hours in the Revision 8, version 2.1 calculation, according to the surrogate 

that associates core damage with peak cladding temperature in excess of 1478 K. In the base case 

(model Revision 5, MELCOR version 1.8.6), the core damage time by the same surrogate is 1.91 hours. 

Among the many modeling changes that may contribute to the different results, two changes have been 

identified with their specific effects. In Revision 8, the condenser steam dump valves attempt to control 

the average RCS legs temperature, Tavg, to a target value of 570 K. The Revision 5 value for the target is 

564.8 K. As the base-case write-up noted in connection with Figure A.1.1.3a, the low RCS pressure 

setpoint for an early automatic initiation of the S signal was narrowly missed in that calculation at about 

one minute after initiation of the transient. In Revision 8, the pressure setpoint would actually be attained 

were the target temperature taken as 564.8 K. To avoid the S signal, the target temperature is set higher 

in Revision 8. The desired effect in the first minute (i.e., suppression of the signal) is thereby achieved, 

but an ongoing consequence is that, according to Revision 8, the steam generators provide less cooling 

at all times. The reduced cooling accounts for the higher primary pressure that Figure A.1.8.2 shows in 

the time range from 0.1 to 0.3 hours.

A second modeling change for Revision 8 is the use of a larger value for the opening height of the flow 

path that connects the boiler with the separator in each steam generator. The opening height defines the 

range of elevations over which gas versus liquid can enter the flow path. In the present case, it may be 

considered an adjustable parameter since its value cannot be derived from the steam generator design. 

 23 See footnote 1 in Section 2 of the main report.

4

6

8

10

12

14

16

18

0 1 2 3 4 5

time [hr]

Pressure [MPa]

MELCOR 2.1 (release 3469) 

MELCOR 1.8.6 (release YV3272) 

SI pump deadhead
A-31

The larger value results in better numerical stability, especially during the pre-transient part of the 

calculation. The larger value also affects the steam generator level drop during the interval after 

feedwater loss and before scram, such that the scram (due to low water level) occurs earlier. The time of 

scram is 33 seconds in the case of the Revision 8 calculation, versus 40 seconds in the base case. As 

case A.1.2 showed, an earlier scram time can have long-term mitigating effects. Here, the time of core 

damage has been slightly postponed.

Generally, it is considered that the differences between the predictions of Revisions 5 and 8 of the model 

are not drastic, and not surprising given the many intervening input model changes.

Figure A.1.8.2 Pressure in the Pressurizer (Case A.1.8 Variant)

A.2.2.9 Results of Case A.1.9 (Reduced Decay Heat)

This case is the same as the base case until the reactor trip. After the reactor trip, the decay heat is 80 

percent of the base-case decay heat. Full power is assumed before the reactor trip. This assumption is 

overly conservative, but convenient since reducing the fission power would require re-working the steadystate model. In this case, this assumption proves to be acceptable since the prediction is that core 

damage is avoided.

Figure A.1.9.1 compares the primary pressures for both the base and sensitivity cases. In the sensitivity 

case, the period of SI pump deadheading is shorter and occurs later. The core is partially uncovered from 

2.12 to 3.45 hours. The hottest cladding temperature peaks at 2.71 hours at 964 K. Thus, MELCOR 

predicts that gap releases and gross core damage are avoided.

4

6

8

10

12

14

16

18

20

22

0 1 2 3 4 5

time [hr]

Pressure [MPa]

Sensitivity case (model Revision 8 , MELCOR version 2.1)

Base case (model Revision 5, MELCOR version 1.8.6)

SI pump deadhead
A-32

Figure A.1.9.1 Pressure in the Pressurizer (Case A.1.9)

A.2.3 Summary: Loss of DC Bus 111 with Bleed and Feed Scenario

The base-case and sensitivity-case calculations, in which the reactor trip occurs at 40 seconds or earlier, 

show that the RCS pressure drop provided by opening one pressurizer PORV at 20 minutes is sufficient 

to allow one SI pump to begin to inject soon thereafter (at about 21 minutes). Later, however, in the base 

case (Case A.1.1) and in all of the sensitivity cases, pressures high enough to deadhead the pump 

eventually return to the RCS. The return of higher pressures is due to the loss of steam generator cooling 

after the steam generators dry out. In the base case, the period of the SI pump deadhead is 0.75 to 2.04 

hours. Due to absence of injection, the core partly uncovers and gross core damage results (e.g., 

relocations of fuel and support structures occur). In the base case, the temperature of the hottest cladding 

first exceeds 1,478 K (2,200 °F) at 1.91 hours.

Gross core damage (e.g., material relocations) is avoided in two sensitivity cases. In the first (Case 

A.1.2), an earlier reactor trip at 11 seconds is prescribed. The SI pump deadhead and partial core 

uncovery still occur and core heatup still takes place; however, the maximum cladding temperature 

remains below 1,123 K. MELCOR therefore predicts that no gap releases will occur. In the second case 

(A.1.9), the decay heat is uniformly reduced to 80 percent of its base-case value. Again, the SI pump 

deadhead, partial core uncovery, and core heatup still occur, but since the maximum cladding 

temperature reaches only 964 K, no gap releases or gross core damage occurs.

The other sensitivity cases investigate the following factors: 

• the role of injection by a charging pump before the ECCS signal (Case A.1.3 discounts such 

injections) 

• the influence of manual steam generator depressurization (Case A.1.4 imposes depressurization on 

all four steam generators at 10 minutes) 

4

6

8

10

12

14

16

18

0 1 2 3 4 5

time [hr]

Pressure [MPa]

Sensitivity case

Base case

SI pump deadhead
A-33

• the effect of a stuck-open steam generator relief valve (Case A.1.5)

• the effect of accumulator injections (Case A.1.6 credits all accumulators, which are discounted in the 

base case)

• the effect of additional fan coolers (Case A.1.7 credits all four fan coolers, whereas the base case 

credits only one)

• uncertainties due to different MELCOR code versions (Case A.1.8 repeats the base case by using 

MELCOR version 2.1 instead of version 1.8.6)

These factors introduce little variation in the times to core damage. See Section 4.1.1 of the main report 

for additional details. 

A.3 Byron Scenarios and Results: Loss of Coolant During Shutdown

A.3.1 Break Outside the Containment during Shutdown

The Byron “Shutdown” MELCOR model is described briefly in Section 2.1 of the main report. The model 

applies to a phase of the shutdown operations occurring before refueling but while the RCS is still closed. 

The loop stop valves (which serve the same function as nozzle dams at other plants) are open, the RCS 

is full of water, and 24 hours have elapsed since reactor subcriticality. The main differences between the 

MELCOR shutdown model and the MELCOR full-power model are summarized in the following bullets:

• The decay heat is calculated at a shifted time t’ = t + 24 hours, where t is the simulation time. During 

the pre-transient part of the calculation (i.e., during -5000 s < t < 0 s), the decay heat is constant at 

21.29 MW, which is the decay heat at 24 hours.

• Initial water and steam temperatures throughout the RCS (primary and secondary sides) are 466.5 K 

(380 °F). Initial pressures are the corresponding saturation pressure (1.35 MPa).

• Decay heat removal is provided by the closed-loop operation of one RHR pump. The pump takes 

suction from the pressurizer-loop (loop D) hot leg. The outflow passes through an RHR heat 

exchanger and is then injected into the cold legs of loops A and D. The heat exchanger is modeled as 

described in the ERI-maintained calculation notes. In particular, the shell-side water temperature is 

314 K (105 °F), and the heat exchanger has an efficiency of 0.609. Water at 466.5 K is cooled to 

373.4 K by this heat exchanger. The pumping rate is controlled by feedback logic to keep the coolant

temperature at the core exit constant.

• There is a provision for a break outside the containment in the RHR lines that feed the cold legs of 

loops B and C. The assigned break flow area is such that the initial discharge rate is about 1,000 gpm

(0.063 m3

/s). These lines are not in use for injection before the start of the accident. The break of the 

common line is modeled with two flow paths, one in each cold leg.

Note that injections are to the loops D and A cold legs (modeled by control volumes CV348 and CV448), 

while the breaks are from the loops B and C cold legs (modeled by control volumes CV548 and CV648). 

In general, the model’s control volumes that are designated CVixy with i = 3, 4, 5, and 6 correspond 

respectively to loops D, A, B, and C in plant nomenclature (see footnote in Section 2.1 for more 

information on the loop numbering). For this reason, the breaks do not result in an immediate impairment 

of the discharge of the RHR-cooled water into the RCS. 
A-34

The base-case break, which connects two cold legs to the environment via a broken RHR injection line, 

may not be realistic because of certain check valves inside the containment that are neglected by the 

model. Sensitivity Case A.2.10 addresses this concern by considering a break from a hot leg.

In this report, shutdown modeling is considered a first foray into this subject and consequently, there is a 

preference for the shutdown model not to depart too much from the main full-power model. For this 

reason, a phase of the shutdown operations is considered in which, for example, the head is still on the 

vessel. However, MELCOR is fully capable of modeling all other phases of shutdown operations that 

possibly have greater risk significance. Such phases may include those where the head is removed and 

the core region is connected to the spent fuel pool by a continuous path through water.

Actual shutdown operations would likely have water-solid conditions in the RCS at this time, with the 

pressure well above the saturation pressure. The readily available modeling/operational data applicable 

to the water-solid state, however, were not complete. Moreover, numerical difficulties related to water 

incompressibility were also anticipated. As an expedient to meet these difficulties, it was decided to model 

the plant in the state that it has attained just prior to when the operators place the PORVs in cold 

overpressure protection. Saturated conditions hold at this time, but it occurs shortly before the time when 

the RCS becomes water-solid. The adopted model is set up with saturated conditions and a steam bubble 

volume of 1 m3 in the pressurizer. (However, see sensitivity Case A.2.11.) The RCS temperature is 

assumed to be at 466.5 K (380 °F), rather than 449.8 K (350 °F), which actually holds at the start of the 

period of water-solid conditions. The selected temperature is consistent with Step 21 of a Byron 

shutdown-related document referred to as 1BOA-SD-2. As noted, the assumption about the initial 

pressure (i.e., saturated instead of super-pressurized) is made partly for computational convenience, but 

it is not considered consequentially significant because the transient includes a break that may be 

assumed to quickly lower the pressure to near saturation (i.e., had the RCS been initially prescribed as 

super-pressurized). In fact, sensitivity case A.2.11 demonstrates that this assumption is correct.

Because the actual disposition of the steam generators at this point in the shutdown sequence is not 

known, the assumption that the temperature on the primary and secondary sides of the RCS is the same 

is made to minimize the thermal interaction between the two sides.

The transient initiator is the opening of a break outside the containment at time t = 0. Main FW and all 

forms of AFW are assumed to be unavailable. One out of four containment fan coolers is available. Table 

A.5 summarizes the availability of various systems.

To investigate the variability of the MELCOR predictions, thirteen sensitivity cases are defined in addition 

to the base case. The highlighted entries in Table A.6 show how each sensitivity case differs from the 

base case. 

Case A.2.1 is the base case. No operator actions are credited, thus insuring that core damage will 

eventually occur as a result of the lack of decay heat removal following a loss of suction by the RHR 

pump at the pressurizer-loop hot leg.

Case A.2.2 assumes that operators act at 0.5 hours to initiate ECCS injections (with the pumps operating 

according to their normal-operation configurations) with one charging and one SI pump. The pumps take 

suction from the RWST, which is credited to be refilled as required.

Case A.2.3 is similar to Case A.2.2, but with the actions occurring at 1.0 hours.

Case A.2.4 is similar to the base case, except that it assumes a more stringent treatment of the RHR 

pump suction loss.

Case A.2.5 combines Cases A.2.2 and A.2.4.
A-35

Case A.2.6 considers an attempt to enhance steam generator cooling, relative to what arises naturally in 

the base case. Starting at 0.5 hours, the condenser steam dump valve is held partially open to implement 

a gradual secondary-side depressurization. AFW is available.

Cases A.2.7a through A.2.7d are similar to the base case, except that the break flow areas differ from 

that of the base case by various constant factors.

Case A.2.8 is similar to the base case except the decay heat differs from that of the base case by a 

constant factor of 0.75.

In Case A.2.9, the break is inside the containment and allows the effluent to condense and return to the 

containment sump. Otherwise, it is similar to Case A.2.2, except that a successful switchover to the 

recirculation mode (ECCS pumps take suction from the sump) is credited when the RWST level reaches 

Lo-2.

Case A.2.10 considers a break from one hot leg of the same flow area as the net area of the base case’s 

two cold legs breaks.

Case A.2.11 redefines the pre-transient initial conditions so that a water-solid, sub-cooled primary RCS is 

prescribed.

The base-case calculation for the Byron shutdown scenario is described in detail in Section A.3.2.1. 

Sections A.3.2.2 through A.3.2.11 describe the sensitivity calculations, typically in less detail. A summary 

discussion pertaining to this scenario appears in Section A.3.3 (which also appears in the main report).

.
A-36

Table A.5 Shutdown: System, Phenomenological, and Operator Action Assumptions 

Primary Side Considered to represent the situation just before operators take the RCS water-solid and place the 

pressure protection mode:

• Initial temperature 466.5 K; saturation pressure 1.35 MPa

• Initial decay heat 21.29 MW

• RCPs off

• Full inventory

o Steam bubble at the top of the pressurizer volume ~1 m3

Secondary Side • Initial temperature 466.5 K; saturation pressure 1.35 MPa1

• FW not available1

• PORVs available

• Condenser dump valve closed; turbine throttle valve closed

• MSIVs open

ECCS Not available in the base case. (Sensitivity cases consider the recovery of one charging pum

operating according to their normal-operation ECCS configurations.)

Operator actions None for the base case. (Sensitivity cases consider alignment of one charging pump and one SI pu

normal-operation ECCS configurations, and the opening of the condenser dump valve.)

Other One fan cooler operates.

Sprays are not available.

1 Lack of information on the initial temperature of the RCS secondary sides during the considered time frame leads to the assumption t

and pressure are the same as those of the primary side. In this case, if the secondary sides remain closed, water levels stay high a

feedwater. However, sensitivity case A.2.6 considers available auxiliary feedwater in the case that the boil-off of secondary-side wate

a partial opening of the condenser steam dump valve.
A-37

Table A.6 Sensitivity Cases for the Byron Shutdown Scenario 

Case

Time of 

Operator 

Actions 

(hours)

Treatment of Loss 

of RHR Pump 

Suction on Low 

HL-A Level

Auxiliary FW 

and Condenser 

Dump Valve

Break Decay Heat

A.2.1

(Base) Never As in base case(1) Not available

Outside containment 

1,000 gpm

(0.063 m3/s)

Initially, 21.29 MW 

corresponding to 24 hours 

after scram

A.2.2 0.5(2) As in base case Not available As in base case As in base case 

A.2.3 1.0(2) As in base case Not available As in base case As in base case 

A.2.4 Never Pump trips: rate falls 

to zero irreversibly Not available As in base case As in base case 

A.2.5 0.5(2) Pump trips: rate falls 

to zero irreversibly Not available As in base case As in base case 

A.2.6 0.5(3) As in base case Available(3) As in base case As in base case 

A.2.7a Never As in base case Not available Break flow area 75% 

of base case As in base case 

A.2.7b Never As in base case Not available Break flow area 10% 

of base case As in base case 

A.2.7c Never As in base case Not available Break flow area 5% 

of base case As in base case 

A.2.7d Never As in base case Not available Break flow area 

500% of base case As in base case 

A.2.8 Never As in base case Not available As in base case Decay heat uniformly 

reduced to 75% of base case 

A.2.9 0.92(4) Pump trips: rate falls 

to zero irreversibly Not available

Inside containment 

1,000 gpm

(0.063 m3/s)

As in base case 

A.2.10 Never As in base case Not available From a hot leg: 

same flow area As in base case 

A.2.11 Never As in base case Not available As in base case As in base case 

1 The pump rate becomes zero only while there is less than 1 L of water in the lower part of the pressurizer-loop hot leg. 2 Operators initiate normal-operation ECCS modes with one charging pump and one SI pump. Suction is from the RWST, which 

3 The condenser steam dump valve is held partially open starting from 0.5 hours. 4 Operators initiate normal-operations ECCS modes with one charging pump and one SI pump. Suction is from the RWST unti

pump (which itself draws from the containment sump); one RHR heat exchanger is credited.
A-38

A.3.2 Results 

The following remarks about the pre-transient part of the calculations apply to most of the base and 

sensitivity cases (i.e., cases A.2.1 through A.2.7, A.2.9, and A.2.10). These cases have in common the 

pre-transient calculation described in this paragraph.) As noted in the definition of the scenario, 

isothermal initial conditions (466.5 K) are applied to both the primary and secondary sides of the RCS. 

The purpose of assuming equal initial temperatures on both sides is to minimize the role of the steam 

generators, since their disposition at this point in the shutdown sequence is not known. Because the 

RCPs are assumed to be turned off, temperature gradients develop comparatively slowly during the pretransient steady state. During this time, the interactions of the primary and secondary sides are 

sometimes sizable. For example, the net rate of heat transfer to the steam generators attains a peak of 

about 10 MW about 300 seconds into the calculation. Therefore, a comparatively long steady-state 

calculation is made extending from about 5,000 seconds to 0 seconds. During this time, the decay heat 

and the RHR pumping rate are clamped to 21.29 MW and 51.26 kg/s. The pumping rate provides 21.29 

MW of heat removal for water cooled from 466.5 K to 373.4 K. Steam generator water levels stay high 

during the steady state, so there is no demand for FW. The condenser steam dump valve is allowed to 

operate during the steady state in order to reduce small secondary-side pressure rises. The turbine 

throttle valve is always closed during all shutdown calculations. Small flows through the dump valve (1 

kg/s) occur during the steady state. These flows are zero at all times later than -400 seconds (except in 

sensitivity case A.2.6, where the dump valve is used during the transient). At t = 0 seconds, the pressures 

are 1.30 MPa in the pressurizer; 1.41 MPa in the vessel dome; and 1.32 MPa in the steam lines common 

header. A coolant flow of about 100 kg/s occurs in each loop from natural circulation, and heat is being 

transferred to the steam generators at a net rate of about 0.49 MW. The radially-averaged liquid 

temperature is 466.1 K at the core exit; 464.3 K in the pressurizer; and the steam in the common header 

is 466.1 K. There is a steam bubble volume of 1.2 m3 at the top of the pressurizer. Figures A.2a and A.2b

show some results from the steady-state calculation.

Figure A.2a Dump Valve Flow and Steam Generator Pressure during A.2.x Steady State

0

1

2

3

4

5

6

-5000 -4000 -3000 -2000 -1000 0

time [sec]

Mass Flow Rate [kg/s]

1.320

1.325

1.330

1.335

1.340

1.345

1.350

Pressure [MPa]

Dump valves flow (left axis)

Steam generator pressure (right axis)
A-39

Figure A.2b RHR and Steam Generator Cooling during A.2.x Steady State

A.3.2.1 Results of Case A.2.1 (Base Case)

The scenario progression is outlined in Table A.7 and is illustrated in Figures A.2.1.1 to A.2.1.12. The 

break at t = 0 seconds (after a pre-transient steady-state period lasting 5,000 seconds) initiates the 

accident. The break occurs outside the containment, in the line that runs from RHR pump B to cold legs B 

and C. Note that this pump is not in use for cooling. The RHR pump that is in use is RHR pump A, which 

injects to the cold legs of Loops D and A. These locations are modeled by control volumes CV348 and 

CV448. There are therefore two MELCOR break flow paths, one to directly connect each B and C cold 

leg to the environment. These locations are modeled by control volumes CV548 and CV648. The break 

flow areas (9.4 cm2 for each flow path) are assigned such that the early combined liquid flow is about 

1,000 gpm (0.063 m3

/s). 

The base case assumes that no operator actions occur, thus making eventual core damage inevitable. 

MFW and AFW are assumed to be unavailable; the condenser steam dump valves are assumed to 

remain shut. The steam generator PORVs are available, but the pressure remains too low for them to 

open during the calculation. The secondary sides of the steam generators, therefore, are effectively 

closed during the scenario.

Figures A.2.1.1a and A.2.1.1b show the break flows. Initially, the combined break flow from the cold legs 

of Loops B and C is about 39 kg/second, or 710 gpm (0.045 m3

/s). However, the RCS pressure (see 

Figure A.2.1.2) increases and produces a generally upward trend in the break flow rate during the first 

hour. The reason is that the breaks reduce the flow through the core of the injected water during this time. 

The resulting core heatup increases the pressure. The break flow exceeds 1,000 gpm (0.063 m3

/s) at 

about 11 minutes. The rising RCS pressure ends only at about 2.8 hours, as a result of decreasing steam 

production as more and more of the core uncovers.

0

5

10

15

20

25

-5000 -4000 -3000 -2000 -1000 0

time [sec]

Heat Flow [MW]

Decay heat

RHR cooling

Heat flow from liquid and steam inside SGTs into SGT walls
A-40

Table A.7 Timing of Key Events Predicted for the MELCOR Model Shutdown Base-Case Calculation 

Event Description Time (hours)(1)

Break in RHR-B lines outside the containment 0

Reduced RHR-A pump rate because of low water level in hot leg D ~0.7

Core partially uncovered 0.75

Pressurizer empties (i.e., contains less than 10 kg of liquid) 2.64

Zero RHR pump rate because of dry hot leg D ~2.7

Coolant temperature at core exit reaches 922 K (1,200 °F) 2.93

First gap release(2) 3.16

Peak cladding temperature reaches 1,478K (2,200 °F) 3.34

Calculation end 3.90

1 The tabulated time is the problem time. Decay heat is calculated at the problem time plus 24 hours and is initially 

21.29 MW. 2 In MELCOR, gap releases occur by rings when the axially-maximized clad temperature reaches 1,173 K in the 

given ring.

Figure A.2.1.1a Break Flows (Case A.2.1 short-term)

0

10

20

30

40

50

60

0 10 20 30 40 50 60

time [minutes]

Pool mass flow [kg/s]

0

300

600

900

1200

1500

1800

Pool mass flow [gpm]

FL-MFLOW.1.797

FL-MFLOW.1.799

Combined (right axis)
A-41

Figure A.2.1.1b Break Flows (Case A.2.1 longer-term)

Figure A.2.1.2 RCS Pressure (Case A.2.1)

0

10

20

30

40

50

60

70

80

90

100

-1 0 1 2 3 4

time [hr]

Pool mass flow [kg/s]

0

1

2

3

4

5

6

7

8

9

10

Steam mass flow [kg/s]

Pool (left axis)

Steam (right axis)

0.0

0.5

1.0

1.5

2.0

2.5

-1 0 1 2 3 4

time [hr]

Pressure [MPa]

Dome (CVH-P.195)
A-42

Figure A.2.1.3a Core Exit Temperature (Case A.2.1 short-term)

Figure A.2.1.3b Core Exit Temperature (Case A.2.1 longer-term)

460

470

480

490

500

-10 0 10 20 30 40 50 60

time [minutes]

Temperature [K]

Radial Maximum

0

500

1000

1500

2000

2500

3000

-1 0 1 2 3 4

time [hr]

Temperature [K]

Radial Maximum
A-43

Figure A.2.1.4 RHR Pump Rate and Liquid Volume in Hot Leg D (Case A.2.1)

Figure A.2.1.5 Water Levels in the Pressurizer and Steam Generator D (Case A.2.1)

0

20

40

60

-1 0 1 2 3 4

Flow through RHR pump [kg/s]

0

2

4

6

Volume of pool in Hot Leg-D [L]

minus CFVALU.2619

CVH-VOLLIQ.311 (right axis)

10

14

18

22

26

30

-1 0 1 2 3 4

time [hr]

Water level [M]

Pressurizer - swollen

Pressurizer - collapsed

SG, Loop D - swollen
A-44

Figure A.2.1.6a Water Levels in the Vessel (Case A.2.1)

Figure A.2.1.6b Water Levels in the RCS (Case A.2.1)

0

2

4

6

8

10

12

14

-1 0 1 2 3 4

time [hr]

Level [m]

Ring 1

Ring 2

Ring 5

Downcomer

CV311 (bottom half of Przr hot leg)

Cold leg bottom

TAF

BAF

0

5

10

15

20

25

30

-1 0 1 2 3 4

time [hr]

Level [m]

Downcomer (collapsed)

Lower plenum to dome thru core ring 2 (collapsed)

Przr

SGT 333 (in Loop D; cold leg receives injection )

SGT 433 (in Loop A; cold leg receives injection)

SGT 533 (in Loop B; cold leg is broken)

SGT 633 (in Loop C; cold leg is broken)

Cold legs bottom

TAF

BAF
A-45

Figure A.2.1.7 Cumulative Flows and Inventory Decreases (Case A.2.1)

Figure A.2.1.8 Clearing of the Loop Seal in Loop B (Case A.2.1)

0

50

100

150

200

250

300

350

-1 0 1 2 3 4

time [hr]

Mass [tonnes]

Cumulative break flow (all forms of H2O)

Cumulative liquid flow through RHR pump (from t=0)

SGT liquid inventory decrease

Vessel liquid inventory decrease

Przr liquid inventory decrease

 p p g y p 

4

5

6

7

8

9

10

0.5 0.75 1 1.25 1.5

time [hr]

Level [m]

CVH-LIQLEV.542

CVH-LIQLEV.544

Top of FL542
A-46

Figure A.2.1.9 Water Levels in the Steam Generators (Case A.2.1)

Figure A.2.1.10 Pressures in the Steam Generators and Vessel Dome (Case A.2.1)

24.80

24.90

25.00

25.10

25.20

25.30

-1 0 1 2 3 4

time [hr]

Level [m]

Loop D

Loop A

Loop B

Loop C

0.0

0.5

1.0

1.5

2.0

2.5

3.0

-1 0 1 2 3 4

time [hr]

Pressure [MPa]

SG-A (CVH-P.370)

SG-D (CVH-P.470)

SG-B (CVH-P.570)

SG-C (CVH-P.670)

Vessel (CVH-P.195)
A-47

Figure A.2.1.11a Decay Heat and Heat Transferred to Steam Generators (Case A.2.1)

Figure A.2.1.11b Core Exit Temperature and Heat Transferred to Steam Generators (Case A.2.1)

-5

0

5

10

15

20

25

-1 0 1 2 3 4

time [hr]

Heat Flow [MW]

Decay heat (COR-EFPD-RAT)

Heat flow from liquid and steam inside SGTs into SGT walls

-50

-25

0

25

50

-10 0 10 20 30 40 50 60

time [minutes]

Heat Flow [MW]

460

470

480

490

500

Temperature [K]

Heat flow from liquid and steam inside SGTs into SGT walls

Radially maximized coolant temeprature at core exit (right axis)
A-48

Figure A.2.1.12 Pressurizer, Surge Line, and Hot Leg Top Water Levels (Case A.2.1)

Figure A.2.1.13 Pressurizer Water Levels: Base Case and Case of Active SPARC Model in the Surge 

Line to Pressurizer Flow Path (Case A.2.1)

Figure A.2.1.3 shows that the coolant temperatures at the core exit also increase. Figure A.2.1.4 shows 

that the RHR pump flow rate increases according to its automatic control, which attempts to keep the core 

exit temperature constant. The increase in the pumping rate depends on the assumed details of the pump 

control logic (but see a sub-variant of Case A.2.4). 

0

5

10

15

20

25

30

-1 0 1 2 3 4

time [hr]

Level [m]

Pressurizer

Surge line

Loop D (Przr) hot leg top

10

14

18

22

26

30

0 1 2 3 4

time [hr]

Water level [m]

Sensitivity case

Base case
A-49

Figure A.2.1.3a shows oscillations in the core-exit coolant temperature during the first ten minutes of the 

transient. Related oscillations also occur in the break flow rate, RCS pressure, and the RHR pumping 

rate. These oscillations are caused by heat exchange with the steam generators and are discussed in 

more detail below. In Figures A.2.1.3a and A.2.1.3b, large temperatures that appear intermittently after 48 

minutes indicate times when a core-exit control volume has momentarily dried out. At such times, these 

figures display a vapor temperature. The lower liquid temperature is displayed at times when liquid exists.

The RHR pump takes suction from control volume CV311, the up-stream bottom part of the pressurizer 

hot leg that has a liquid volume of 0.75 m3 when full. CV311 remains full until about 0.7 hours. It is 

assumed that the RHR pump may pump at any rate up to its zero-head maximum (5,000 gpm (0.315 

m3

/s), or 275 kg/second for a water density of 872.4 kg/m3), as long as the leg contains any significant 

amount of water. (See the write-up for Case A.2.4 below for more discussion.) The actual rate during 

such times reflects throttling implemented by the control and is typically 50 to 60 kg/second (Figure 

A.2.1.4). Once CV311 becomes essentially empty, the RHR pumping rate is effectively the rate at which 

(for whatever reason) water re-appears in CV311. On the other hand, sensitivity Case A.2.4 considers 

that the RHR pump will trip irreversibly the first time that CV311 becomes essentially empty. In Figure 

A.2.1.4, the RHR pump operates at a reduced rate from about 0.7 to 2.7 hours, during which time CV311 

typically contains from 1 to 2 L of water. This water is continuously replenished by a flow from the 

pressurizer and is pumped out as fast as it flows in. As Figure A.2.1.5 shows, the pressurizer empties at 

about 2.6 hours. Only then does the RHR pump stop altogether. This treatment of RHR suction loss is 

reconsidered in sensitivity Case A.2.4, which shows that the times to core damage are a little earlier if the 

RHR pump trips irreversibly at 0.7 hours. In that case, the peak cladding temperature exceeds 1,478 K 

about 8 minutes earlier than in the base case; the difference is greater for earlier-indicating surrogate 

measures.

Figure A.2.1.6a shows the water levels in the vessel. Generally, for analyses of the Byron plant scenarios, 

the core water level is defined by summing the heights of the collapsed water columns in the stack of 

control volumes that runs from the lower plenum to the dome, by way of the second computational ring of 

core control volumes. This figure shows that in the present case, there is not a significant difference 

among water level definitions that use other rings, except that the outer rings define a slightly higher 

elevation for the plateau that extends from about 0.3 to about 0.7 hours. This plateau is high enough to 

keep the core completely covered. The initial fall of the core water level to this plateau is mainly a

pressure effect. The core water level is depressed by the steam building up in the dome until the level 

reaches the top of the hot legs, thus allowing the steam to escape into the RCS loops. The downcomer 

remains full until about 0.7 hours. In addition to the vessel water levels, Figure A.2.1.6b co-plots the water 

levels in the steam generator tubes (SGTs) and the pressurizer water level. This figure shows that the 

downcomer remains full until shortly after the SGTs are empty (at about 0.65 hours). Once the 

downcomer is no longer full, the core water level falls rapidly. The active fuel uncovers for the first time at 

0.75 hours, and the top-third of the active fuel uncovers for the first time at 0.79 hours. Soon, however, 

drainage from the pressurizer substantially stops further uncovery, and another plateau with one-third to 

one-half of the core uncovered extends from about 0.8 to 2.7 hours. This plateau ends shortly after the 

pressurizer empties (2.64 hours). According to the measure that associates core damage with a 

maximum core exit coolant temperature in excess of 922 K, core damage occurs at 2.93 hours. The first 

gap release occurs at 3.16 hours. The core damage criterion of peak cladding temperature in excess of 

1,478 K occurs at 3.34 hours. After 3.65 hours, the gap inventory of the entire core has been released. 

The calculation ended at 3.90 hours because of numerical problems associated with the melting of the 

heat structure that represents the upper core support plate. 

Figure A.2.1.7 co-plots the cumulative break flow; cumulative RHR pump flow; and decreases in liquid 

inventory inside the steam generator tubes, vessel liquid inventory, and pressurizer liquid inventory. 

Consideration of these curves (and their slopes) leads to the following approximate account of the break 

and the regions that feed it. Until about 15 minutes after the start of the transient, the water lost to the 

break comes from the core and the SGTs. From then until about 0.65 hours, the SGTs by themselves are 

the predominant source. The final source (i.e., after about 2.7 hours) is identifiable as the vessel, while 
A-50

pressurizer draining is the main source during approximately 0.9 to 2.6 hours. The flow through the RHR 

pump approximately equates to the break flow, except during the range of times from about 0.3 to 0.9 

hours (when the break flow is larger) and after about 2.7 hours (when there is no RHR pump flow). 

Recall that in Figure A.2.1.1b, the break flow transitions from all liquid to all steam during the time range 

from about 0.8 to about 0.9 hours. This transition is a result of the clearing of the loop seal in Loop B 

(which is one of the broken loops). Figure A.2.1.8 illustrates the clearing of the seal; flow path FL 542 

represents the loop seal. MELCOR allows gas to enter a flow path once the water level in the upstream 

control volume (in this case, CV 542) is low enough to uncover the top of the flow path. This partial 

uncovery occurs at 0.79 hours and is attributable to hydrostatic pressure. Although the flow path remains

covered on the downstream side, steam is able to traverse the water column standing in CV544 and thus 

reach the break. No other loop seal clears. The clearing of only one loop seal is typical: once the steam 

flows freely into a loop that has just cleared, any clearing tendency will be reduced in the other loops.

The calculation was carried out with the assumption that the initial secondary-side temperatures and 

pressures are the same as those on the primary side. In Figure A.2.1.5, the secondary-side water level in 

a typical loop (Loop D) remains relatively constant compared with the water level in the pressurizer. This 

result indicates that the assumed lack of FW is not important. Figure A.2.1.9 shows the water levels in all 

of the steam generators on a fine scale. Figure A.2.1.10 shows the SG pressures. The pressures of the 

four SGs coincide because they remain connected by the common header as long as the MSIVs are 

open; scenario definition holds them open indefinitely in anticipation of sensitivity cases that make use of 

the condenser steam dump valves. 

Figures A.2.1.11a and A.2.1.11b show the heat flow from the fluid inside the steam generator tubes into 

the tube walls. Although the problem’s initial conditions were chosen with the intent to minimize the 

interaction between the primary and secondary sides of the RCS, the cooling provided by the steam 

generators is nevertheless significant, amounting to around 5 MW in the times later than about 1 hour

(Figure A.2.1.11a). In the first hour, the heat flows are erratic, large in magnitude, and sometimes 

negative (i.e., from the secondary side to the primary side). The heat of condensation (either given up to 

the tube walls when vapor condenses on the tubes’ inner surfaces, or drawn from the tubes’ surfaces 

when liquid films there evaporate) results in the large magnitude. These erratic heat flows cause the 

oscillations of the core exit temperature mentioned above in connection with Figure A.2.1.3a, as Figure 

A.2.2.11b shows.

The slow emptying of the pressurizer is striking; it is not complete until 2.64 hours. Figure A.2.1.12 shows 

the water levels in the pressurizer, surge line, and hot leg top. There are times when the pressurizer 

water is suspended above an empty surge line. At 1.5 hours for example, both the surge line and the hot 

leg top are empty; the pressure in the pressurizer is 1.9481 MPa; and the pressure in the hot leg top is 

2.0114 MPa. In MELCOR, the pressure of a control volume may always be considered to apply at the top 

of any water column it contains. If the control volume is dry at that time, the height dependence of the 

pressure is small because of the typically low density of gas. At 1.5 hours, the pressurizer water level and 

liquid density imply a pressure of 2.0111 MPa at the bottom of the pressurizer. In other words, the 

conditions are nearly those of a hydrostatic equilibrium: the pressure difference acting to drive a flow is 

small and even slightly negative at this time, according to this estimate. Note also that as Figure A.2.1.7 

shows, the mass rate of pressurizer draining is similar to the RHR pumping rate and the break flow. 

Regarding the break flow during the relevant times (e.g., 1.5 to 2.6 hours; see Figure A.2.1.6b); it has the 

low mass rate appropriate to a steam flow (see Figure A.2.1.1b). These behaviors come about as the 

water that drains from the pressurizer is immediately pumped to the intact cold legs and moves from there 

to the downcomer. During the relevant times, the downcomer water level is too low for the water to pass 

on to the broken cold legs. It instead enters the core, boils, passes the cleared loop, and leaves the RCS 

as steam through the break. The rate of pressurizer draining (typically about 4.7 kg/second) is actually 

less than the rate at which water can be vaporized by the available decay heat (about 10.7 kg/second). 

The actual rate is affected by the modeling of the two-phase flows in the pressurizer/surge line/hot leg 

regions that lead to the (near) hydrostatic pressure balance referred to above. Two of these aspects are 
A-51

investigated in the variant calculations described in the following two paragraphs. This pressure balance 

prevents the pressurizer water from reaching the break as liquid via larger, gravity-driven flows. 

The pressurizer draining is affected significantly by a MELCOR phenomenological modeling parameter, 

referred to as the momentum exchange length, which defines the length over which momentum is 

exchanged between gas and liquid when these two phases simultaneously pass through a flow path. This 

parameter is intended to model counter-current flow limitation. Whereas the Byron model uses 0.1 m for 

this parameter for the RCS flow paths, two sub-variants of Case A.2.1 (undocumented apart from remarks 

in this paragraph) use 0.01 m and 1.0 m. The modified values are applied to the flow paths that connect 

the surge line to the hot leg and to the pressurizer. The former case gives 1.9 hours for the time when the 

pressurizer empties, while the latter case gives 3.2 hours. Although this variation is sizable, pressurizer 

draining can be considered slow in all the cases.

MELCOR has a set of models referred to collectively as the SPARC model, which describes interactions 

between liquid and gas bubbles. Inactive by default, the SPARC model may be activated for individual 

flow paths, though activating the model increases the computational time. In the base case, the model is 

active for the flow path that connects the hot leg to the surge line, but the model is inactive for the flow 

path that connects the surge line to the pressurizer. For another sub-variant of Case A.2.1 that is 

undocumented apart from remarks in this paragraph, the SPARC model is activated for the surge line to 

pressurizer flow path. Figure A.2.1.13 compares the pressurizer draining with and without an activated 

SPARC model for this flow path. Activation of the model delays the onset of pressurizer draining but later 

results in faster draining, so that the time for the pressurizer to empty is similar in both calculations. 

According to the measure that associates core damage with the spatially-maximized cladding 

temperature exceeding 1,478 K, the time to core damage is 3.44 hours with the SPARC model activated 

for the surge line to pressurizer flow path, versus 3.34 hours in the base case.

A.3.2.2 Results of Case A.2.2 (Operator Actions at 0.5 Hours)

This scenario progression is outlined in Table A.8 and illustrated in Figures A.2.2.1 to A.2.2.4. In this 

case, one charging pump and one SI pump become available at 0.5 hours. The pumps are assumed to 

operate according to their normal-operations ECCS modes. In particular, because the pressure in the 

vessel is low, the pumps inject at their maximum rates. They take their suction from the RWST, which is 

assumed to be refilled as necessary. As a result, the switchover to the recirculation mode never occurs. 

The pumps inject into the cold legs of Loops A and D (i.e., the intact legs).

Table A.8 Timing of Key Events Predicted for the MELCOR Model Shutdown Sensitivity-Case 2 

Calculation 

Event Description Time (hours)

Break in RHR-B lines outside the containment 0

Initiation of injection by one charging and one SI pump 0.50

Reduced RHR-A pump rate because of the low hot leg water level ~1.4

Core partially uncovered 1.59

Pressurizer empties (i.e., contains less than 10 kg of liquid) 1.93

Latest time to refill the RWST 2.96

Calculation ends 6.00

Coolant temperature at core exit reaches 922 K (1,200 °F)

First gap release Do not occur

Peak clad temperature reaches 1,478 K (2,200 °F)
A-52

Figure A.2.2.1 shows the flow rates of the break and the combined injections related to the charging and 

SI pumps. The pumps inject at a combined constant rate of 79.8 kg/second at all times after 0.5 hours. 

The separate contributions of the SI and charging pumps are 43.6 and 36.2 kg/second, respectively. As 

the analogous base-case figures (Figures A.2.1.1a/b) show, the peak break flow rate that occurs in the 

absence of the injections is about 97 kg/second and occurs at about 0.7 hours. The ability of the injected 

water to cool the core is limited, because the water need not pass through the core. The water can reach 

the breaks by way of the downcomer. For these reasons, the injections are insufficient to maintain the 

water level in the core before the start of core uncovery. After about 1.8 hours, however, the core water 

level is maintained with roughly the top quarter of the core uncovered. This finding is based on collapsed 

water levels in the second innermost computational ring. Figure A.2.2.2 shows the water levels in the 

vessel.

Figure A.2.2.1 Break and ECCS Injections Flow Rates (Case A.2.2)

0

20

40

60

80

100

120

0 1 2 3 4 5 6

time [hr]

Pool mass flow [kg/s]

0

2

4

6

8

10

12

Pool (left axis)

Steam mass flow [kg/s]

Injections from RWST (left axis)

Steam (right axis)
A-53

Figure A.2.2.2 Water Level in the Reactor Pressure Vessel (Case A.2.2)

Figure A.2.2.3 RCS Pressure (Case A.2.2)

0

2

4

6

8

10

12

14

16

0 1 2 3 4 5 6

time [hr]

Level [m]

Downcomer (collapsed)

Lower plenum to dome thru ring 2 (collapsed)

Cold leg bottom

TAF

BAF

0.8

1.0

1.2

1.4

1.6

1.8

2.0

0 1 2 3 4 5 6

time [hr]

Pressure [MPa]

Dome (CVH-P.195)
A-54

Figure A.2.2.4a RHR Pump Rate and Liquid Volume in Hot Leg D (Case A.2.2)

Figure A.2.2.4b RHR Pump Rate and Liquid Volume in Hot Leg D – Narrower Range (Case A.2.2)

Figure A.2.2.3 shows the pressure in the vessel. Periodic peaks are seen starting at about 2.8 hours. At 

the same time, there are peaks and dips, respectively, in the core and downcomer water levels (Figure 

0

10

20

30

40

50

60

0 1 2 3 4 5 6

time [hr]

Flow through RHR pump [kg/s]

0

2

4

6

8

10

12

Volume of pool in Hot Leg-D [L]

minus CFVALU.2619

CVH-VOLLIQ.311 (right axis)

0

0.2

0.4

0.6

0.8

1

1.2

0 1 2 3 4 5 6

time [hr]

Flow through RHR pump [kg/s]

0

0.2

0.4

0.6

0.8

1

1.2

Volume of pool in Hot Leg-D [L]

minus CFVALU.2619 CVH-VOLLIQ.311 (right axis)
A-55

A.2.2.2). These features are presumed to be results of spontaneous oscillations of the water level and 

water flow between the core and cooler regions that periodically quench the steaming, thereby bringing 

about the pressure oscillations that sustain the oscillations of flow and water level. This behavior is also 

reflected in the activity of the RHR pump (Figures A.2.2.4a/b). The RHR pump is considered to have full 

suction until about 1.4 hours. From then until about 2.0 hours, when the pressurizer empties, the hot leg 

bottom (i.e., control volume CV311, with a liquid inventory of 0.75 m3 when full) sporadically contains from 

1 to 11 L of water, and the RHR pump operates at reduced rates according to the assumed modeling of 

suction loss. The rate is set to zero only for a liquid inventory of less than 1 L. At nearly all times after 2.0 

hours, the hot leg bottom is essentially dry (less than 1 L of liquid). At the times of the pressure peaks, 

however, the liquid volume briefly exceeds 1 L and the RHR pump injects at a much reduced rate. The 

duration of these injections is about one minute, and the peak injection rates are about 1 kg/second. The 

ad hoc assumptions about RHR suction loss are reconsidered in sensitivity Case A.2.5, where 

substantially similar results are obtained if the RHR pump trips irreversibly at 1.38 hours.

At 2.96 hours, the cumulative injection by the charging and SI pumps reaches 187,736 gallons. This is the 

assumed volume delivered from the RWST after being drawn to Lo-2 from an initial 89 percent full status. 

The assumption is that by 2.96 hours the RWST will either be refilled, replenished at a rate to balance the 

depletion or an alternative injection source has been established.

The only surrogate measures that ever indicate core damage are those for a partial core uncovery. The 

first indication of water level at TAF occurs at 1.59 hours, and the first indication of an uncovery of the top 

third of the core occurs at 2.14 hours. The maximum cladding temperature never exceeds 560 K. The 

calculation ends at 6 hours.

A.3.2.3 Results of Case A.2.3 (Operator Actions at 1.0 Hours)

This case is the same as Case A.2.2, except that the injections from one charging pump and one SI 

pump begin at 1.0 hours instead of 0.5 hours. 

Figure A.2.3.1 shows the water levels in the vessel (core and downcomer) for the present sensitivity case. 

Figure A.2.3.2 compares the water level in the core in the present sensitivity case versus the water level 

in Case A.2.2. The time of the start of partial core uncovery in Case A.2.3 is 0.75 hours, which is the 

same as the base case. In comparison, the earlier time of operator actions credited in Case A.2.2 

postpones this time until 1.59 hours. The maximum amount of core uncovery, however, is only slightly 

greater in the case of the later operator actions.

The only surrogate measures that ever indicate core damage are those related to partial core uncovery. 

The first indication of the water level at TAF occurs at 0.75 hours, and the first indication of uncovery of 

the top third of the core occurs at 0.79 hours. The maximum cladding temperature attains a peak of 705 K 

at 1.01 hours. The calculation ends at 6 hours.
A-56

Figure A.2.3.1 Water Levels in the Vessel (Case A.2.3)

Figure A.2.3.2 Water Levels in the Core (Case A.2.3)

0

2

4

6

8

10

12

14

16

0 1 2 3 4 5 6

time [hr]

Level [m]

Downcomer (collapsed)

Lower plenum to dome thru ring 2 (collapsed)

Cold leg bottom

TAF

BAF

0

2

4

6

8

10

12

14

0 1 2 3 4 5 6

time [hr]

Level [m]

Sensitivity case A.2.3

Sensitivity case A.2.2

TAF

BAF
A-57

A.3.2.4 Results of Case A.2.4 (RHR Pump Trips Irreversibly on Suction Loss)

This case reconsiders the assumptions about the behavior of the RHR pump as it loses suction at the 

pressurizer-loop hot leg. In all other cases (except Cases A.2.5 and A.2.9), it is assumed that the RHR 

pump may pump at any rate up to its zero-head maximum any time that the leg contains any significant 

amount of water. The actual rate is set by the feedback control that attempts to keep the core exit coolant 

temperature constant. Since MELCOR sources are used to model the pump, no water removal from the 

hot leg may occur if no pool is there, so the assumption is that the pump rate becomes zero when the leg 

bottom (modeled by control volume CV311) contains less than 1 L of water. For a numerically smoother 

implementation of this control, a factor ranging linearly from 0.0 at 1 L of hot leg liquid inventory to 1.0 at 

11 L is applied to the rates of draw and injection. This factor allows the RHR pumping rate to become 

equal to the rate at which (for whatever reason) water reappears in CV311. In the base case, this logic 

leads to a period of a low RHR pump rate that lasts from about 0.7 to 2.7 hours, during which time the hot 

leg liquid inventory, sustained by pressurizer draining, fluctuates at around 1.5 L. The present sensitivity 

case considers the consequences of this period of possibly unrealistic RHR pump activity.

For a reconsideration of the modeling of RHR pump suction loss, first note that, according to Section 6 of 

the Byron/Braidwood FSAR (pp. 6.5-25), an RHR pump has a net positive suction head (NPSH) 

requirement of about 3.6 m when operating at 3,000 gpm (0.189 m3

/s). Less NPSH would be required at 

the smaller pump rates that arise in the Shutdown configuration. Also according to the FSAR, the 

elevation of an RHR pump has a center line about 8.8 m below the water level in the sump, when the 

sump is full. Considering the additional head provided by the elevation of the hot leg above the water 

level of the full sump (estimated at about 4.2 m), it seems clear that the NPSH requirement will be met 

any time that there is liquid in the hot leg, on the assumption that the suction point is at the leg bottom. 

(As discussed later in this section, the effects will likely be small if the suction actually is taken from a 

point above the bottom). In fact, after dryout of the hot leg, the RHR pump will continue to have suction 

until it pumps out the water in the part of its suction line above the lowest elevation that provides the 

required NPSH. Since the corresponding volume cannot be estimated without detailed knowledge about 

the line, it is defensible to suppose that the pump loses suction when the hot leg empties. It is expected 

that this time should differ negligibly from 0.70 hours, which is the time when the liquid inventory in control 

volume CV311 first fell below 11 L in the base case. (Later in the base case, the pump rate was throttled 

according to the ad hoc treatment described above, so that the hot leg did not rigorously empty until 

about 2.7 hours.) In the context of this discussion and for a more stringent treatment of the RHR pump 

operation as the pump loses suction, this sensitivity case therefore assumes that the pump trips 

irreversibly at 0.70 hours. Otherwise, the sensitivity case is the same as the base case.

Figure A.2.4.1 compares the sensitivity and base cases with respect to their pressurizer water levels. The 

differences indicate that the action of the pump in the base case helps to draw down the pressurizer, so 

that it empties about ten minutes earlier than it does in the sensitivity case. Figure A.2.4.2 compares the 

vessel water levels and shows minor differences in favor of deeper coverage in the base case. Somewhat 

larger differences appear in Figure A.2.4.3 for the (radially maximized) temperature of the coolant at the 

core exit. In particular, during the time from about 0.7 to 2.7 hours, the sensitivity case does not show the 

sporadic drying out of the outer core exit regions, which occurs in the base case as a result of the 

intermittent low flow-rate pumping of the RHR pump. (Figure A.2.4.3 shows the temperature of the vapor 

when no liquid is present.) The time at which the core exit temperature reaches 922 K is 2.52 hours in the 

sensitivity case versus 2.93 hours in the base case. The time at which the peak cladding temperature 

reaches 1,478 K is 3.21 hours in the sensitivity case versus 3.34 hours in the base case.

It can be concluded that the base-case treatment of the RHR pump suction loss, which allows pumping at 

reduced rates while there is very little liquid in the hot leg, leads to 5 to 30 minute delays of core damage 

depending on the surrogate measure and relative to results obtained with bounding assumptions about 

pump operation as suction is lost (i.e., irreversible trip). 
A-58

Case A.2.4 assumes an irreversible pump trip at what is still a rather small volume, 11 L, in CV311. 

However, because the hot leg is emptying fast at this time, little difference would arise given any other 

choice for a trip on the water level of the (partially full) hot leg. For example, the time when the water level 

is at the hot leg mid-plane—CV311 is full but CV310 is empty—is just 1.7 minutes earlier than the time 

adopted for the present calculation.

In a sub-variant of this sensitivity case (not documented apart from these remarks), during the beginning 

of the transient the RHR pumping rate and the temperature of the water returning from the RHR heat 

exchanger are clamped to 51.26 kg/second and 373.3 K, respectively. These are the values that hold at 

the end of the pre-transient part of the calculation. Otherwise, the sub-variant case is similar to sensitivity 

Case A.2.4. Figures A.2.4.4a/b compare the (radially-maximized) temperatures of the coolant at the core 

exit that result in the sub-variant sensitivity and base cases. The fine scales of Figure A.2.4.4a show that 

the oscillations in this temperature that occur during the first ten minutes of the transient are not a result 

of the RHR pumping rate control algorithm. In fact, they are a result of heat exchange with the steam 

generators, which is discussed in the base-case write-up. Figure A.2.4.4b is very similar to Figure A.2.4.3, 

which indicates that the particular assumptions of the RHR pumping rate control algorithm are not 

important in determining the times of core damage. The time at which the peak cladding temperature 

reaches 1,478 K is 3.20 hours in the sub-variant case versus 3.21 hours in the sensitivity case.

Figure A.2.4.1 Water Levels in the Pressurizer (Case A.2.4)

10

14

18

22

26

30

0 1 2 3 4

time [hr]

Water level [m]

Sensitivity case

Base case
A-59

Figure A.2.4.2 Water Levels in the Core (Case A.2.4)

Figure A.2.4.3 Temperatures of Coolant at the Core Exit (Case A.2.4)

0

2

4

6

8

10

12

14

0 1 2 3 4

time [hr]

Level [m]

Sensitivity case

Base case

Cold leg bottom

TAF

BAF

0

500

1000

1500

2000

2500

3000

0 1 2 3 4

time [hr]

Temperature [K]

Sensitivity case

Base case
A-60

Figure A.2.4.4a Temperatures of Coolant at the Core Exit (Case A.2.4 short-term)

Figure A.2.4.4b Temperatures of Coolant at the Core Exit (Case A.2.4 longer-term)

460

465

470

475

480

485

490

495

500

-10 0 10 20 30 40 50 60

time [minutes]

Temperature [K]

Sub-variant sensitivity case

Base case

0

500

1000

1500

2000

2500

3000

0 1 2 3 4

time [hr]

Temperature [K]

Sub-variant sensitivity case

Base case
A-61

A.3.2.5 Results of Case A.2.5 (Operator Actions at 0.5 Hours; RHR Pump Trips Irreversibly on 

Suction Loss)

Case A.2.5 combines Cases A.2.2 and A.2.4. That is, as in Case A.2.2, injections by one charging pump 

and one SI pump begin at 0.5 hours. As in Case A.2.4, instead of continuing to pump at a reduced rate 

during times when the water level in the hot leg is low, the RHR pump trips irreversibly. The time of 1.38 

hours for the pump trip in the present calculation is identified as the time when the liquid inventory in 

control volume CV311 first falls below 11 L in Case A.2.2. (Later in Case A.2.2, the pump rate is throttled 

so that it remains appreciable until about 2.0 hours.)

Figure A.2.5.1 compares the (radially maximized) coolant temperatures at the core exit as predicted for 

sensitivity cases A.2.5 and A.2.2. It can be concluded that the base-case treatment of the RHR pump loss 

of suction, which allows pumping at reduced rates while there is very little liquid in the hot leg, is not 

important to the prediction of core damage avoidance in Case A.2.2.

Figure A.2.5.1 Core Exit Coolant Temperature (Case A.2.5)

A.3.2.6 Results of Case A.2.6 (Enhanced Steam Generator Cooling)

Case A.2.6 is the same as the base case, except for the assumption that operators hold the condenser 

steam dump valve partially open starting at 0.5 hours as an attempt to enhance the cooling provided by 

the steam generators. 

As noted previously, the general definition of the shutdown scenario is premised on the assumption of 

initial isothermal conditions on both sides of the RCS. This assumption was considered adequate for 

minimizing the role of the secondary side given the insufficient availability of plant-specific operational 

information, including the actual role of the secondary side. The present sensitivity case starts from the 

same initial state, but it now considers operator actions intended to enhance the secondary-side cooling. 

Although the sensitivity case is therefore likely to model an unrealistic situation, it is included for modeling 

insights. Note also that Step 22c of 1BOA-SD-2 (a Byron document related to shutdown) seems to 

450

475

500

525

550

0 1 2 3 4 5 6

time [hr]

Temperature [K]

Sensitivity case A.2.5

Sensitivity case A.2.2
A-62

indicate that if any RHR pumps are running the operators will not dump steam, which is contrary to the 

operator action assumed here.

Base-case Figures A.2.1.11a/b show that despite the approximately isothermal conditions that hold on 

both sides of the RCS at the start of the transient, the steam generators provided significant cooling up to 

and after the onset of core damage in the base case. In the base case, the secondary sides remained 

closed during the transient. That is to say, the turbine throttle and condenser steam dump valves 

remained closed: pressures remained below the actuation setpoints of the PORVs and SRVs, and no 

demand for FW ever occurred since water levels stayed high. The present sensitivity case investigates 

enhancement of this cooling by depressurizing the secondary sides and providing FW. The sensitivity 

case assumes that the dump valve remains closed until 0.5 hours, when it is then held open to a fixed 

fraction (4.5 percent) of its fully opened position for the rest of the calculation. (When opened fully, the 

dump valve’s flow area, 0.109 m2

, is such as to provide a steam flow consistent with full-power plant data 

– steam flow 1345.2 kg/second at main steam line pressure 8.274 MPa-abs.) The AFW is also assumed 

available in this sensitivity case. Injections will maintain the water level as demanded, until the 

condensate storage tank is depleted. Calculations for a supplemental scenario, discussed at the end of 

this section, motivate the choice of the particular dump valve opening fraction.

Figure A.2.6.1 compares the steam generator cooling in the sensitivity and base cases. As in the base 

case, the cooling is erratic, and sometimes negative, during the first hour, making the comparison 

unclear. In the time from about 0.9 to about 2.2 hours, in the sensitivity case the steam generators 

provide 2 to 3 times as much cooling as they do in the base case. Even so enhanced, however, the 

cooling is generally less than the decay heat. After about 2.3 hours, there is no longer much difference. 

Figure A.2.6.2a shows the effect on primary pressure. Figure A.2.6.2b compares the secondary 

pressures. Figure A.2.6.2c co-plots the primary and secondary pressures in the sensitivity case only, 

while Figure A.2.6.2d does the same for the base case. Figures A.2.6.2e and A.2.6.2f are temperature 

analogs to Figures A.2.6.2a and A.2.6.2b. They compare the base and sensitivity cases with respect to 

the liquid temperature inside a typical steam generator tube (Figure A.2.6.2e) versus the liquid 

temperature outside the steam generator tube (Figure A.2.6.2f). In the sensitivity case, both the primaryside and the secondary-side liquid temperatures decrease as a result of the operator action (the primaryside temperature meaning in this case the temperature of the liquid inside the steam generator tube). 

Figure A.2.6.2g shows that the temperature difference between the primary- and secondary-side liquid is 

affected very little by the operator action (i.e., during the time from about 0.5 to 1.5 hours).
A-63

Figure A.2.6.1 Decay Heat and Heat Transferred to Steam Generators (Case A.2.6)

Figure A.2.6.2a Pressures at the Pressurizer (Case A.2.6)

-20

-10

0

10

20

30

40

0 1 2 3 4

time [hr]

Heat Flow [MW]

Decay heat (Sensitivity case) Sensitivity case Base case

0.5

1.0

1.5

2.0

2.5

3.0

0 1 2 3 4

time [hr]

Pressure [MPa]

Sensitivity case

Base case
A-64

Figure A.2.6.2b Pressures at the Steam Lines Common Header (Case A.2.6)

Figure A.2.6.2c Primary and Secondary Pressures (Sensitivity Case for A.2.6)

0.5

1.0

1.5

2.0

2.5

3.0

0 1 2 3 4

time [hr]

Pressure [MPa]

Sensitivity case

Base case

0.5

1.0

1.5

2.0

2.5

3.0

0 1 2 3 4

time [hr]

Pressure [MPa]

CVH-P.305 (Pressurizer)

CVH-P.700 (SG header)
A-65

Figure A.2.6.2d Primary and Secondary Pressures (Base Case for A.2.6)

Figure A.2.6.2e Primary-Side Liquid Temperature - Loop A SGT; CV430 (Case A.2.6)

0.5

1.0

1.5

2.0

2.5

3.0

0 1 2 3 4

time [hr]

Pressure [Mpa]

CVH-P.305 (Pressurizer)

CVH-P.700 (SG header)

 

420

440

460

480

500

520

0 1 2 3 4

time [hr]

Temperature [K]

Sensitivity case

Base case
A-66

Figure A.2.6.2f Secondary-Side Liquid Temperature - Loop A Boiler; CV460 (Case A.2.6)

Figure A.2.6.2g Differences Between Primary- and Secondary-Side Liquid Temperatures (Case A.2.6)

Whereas in the base case the steam generator water levels remain roughly constant during the transient 

(see Figure A.2.1.9 in the base-case write-up), in the sensitivity case falling water levels result in 

demands for AFW starting at 1.45 hours. The temperature of the injected water is 322 K (i.e., by 

assumption, the value appropriate to full-power operations). At first, these injections of cooler feedwater

help enhance the cooling, but finally (i.e., after about 2.3 hours) they make little difference.

Despite the lower primary pressure, Figure A.2.6.3 shows that the break flow is greater in the sensitivity 

case. The reason appears to be that lower RCS pressure results in faster pressurizer draining 

q p ( )

420

440

460

480

500

520

0 1 2 3 4

time [hr]

Temperature [K]

Sensitivity case

Base case

 

-0.5

0.0

0.5

1.0

1.5

2.0

0 1 2 3 4

time [hr]

Temperature difference [K]

Sensitivity case

Base case
A-67

(Figure A.2.6.4), supporting (during the draining) a larger RHR pumping rate (Figure A.2.6.5). The greater 

break flow results when most of the water drawn by the RHR pump from the hot leg re-enters the RCS at 

the Loop A and D cold legs and then leaves through the breaks in the cold legs of Loops B and C, after 

traversing the downcomer without passing through the core. 

Figure A.2.6.3 Cumulative Break Flow (Case A.2.6)

Figure A.2.6.4 Swollen Water Levels in the Pressurizer (Case A.2.6)

All forms of H2O

0

50

100

150

200

250

300

0 1 2 3 4

time [hr]

Mass [tonnes]

Sensitivity case

Base case

 

10

14

18

22

26

30

0 1 2 3 4

time [hr]

Water level [M]

Sensitivity case

Base case
A-68

Figure A.2.6.5 Cumulative Flow through the RHR Pump (Case A.2.6)

Figure A.2.6.6 shows water levels in the core. Because of the faster coolant inventory loss in the 

sensitivity case, the core more quickly attains the amounts of uncovery that enable core damage to be 

indicated according to the surrogate measures based on temperature and other phenomena. But both 

cases reach a plateau with approximately the top-third of the core uncovered in about the same time. This 

plateau persists until the pressurizer empties. 

The sensitivity case shows that the assumed operator action does initially enhance the steam generator 

cooling. Eventually, however, the cooling becomes similar to that of the base case, i.e., less than half the 

decay heat, and core damage is not avoided. Unexpectedly, effects of the action on the break flow 

actually hasten the time to core damage, relative to the base case.

The time at which the core exit temperature reaches 922 K is 1.83 hours in the sensitivity case versus 

2.93 hours in the base case. The time at which the peak cladding temperature reaches 1,478 K is 2.22 

hours in the sensitivity case versus 3.34 hours in the base case. The calculation is stopped at 3.02 hours 

due to numerical problems associated with the melting of the heat structure that represents the upper 

core support plate.

0

50

100

150

200

0 1 2 3 4

time [hr]

Mass [tonnes]

Sensitivity case

Base case
A-69

Figure A.2.6.6 Water Levels in the Core (Case A.2.6)

The remainder of this section provides some motivation for the set-up of Case A.2.6. Case A.2.6 

assumed a fixed opening fraction of 4.5 percent for the condenser steam dump valve. Note that the dump 

valve has a feedback control mode that automatically adjusts the opening fraction in an attempt to keep 

the secondary-side pressure constant. This automatic control is included in the full-power model. 

However, preliminary calculations for case A.2.6 showed that considerable modifications of the model’s 

feedback control logic (such as revisions of the gain factor between error signal and valve opening, and 

integration times) would be required in order for the calculation to yield constant pressure in the case of a 

break scenario at low power. Such updates seem unjustified, since there are no plant data to substantiate 

them. Moreover, it is not clear that the automatic dump valve control mode would be available during 

shutdown operations. Therefore, it was decided to assume for the sensitivity calculation a fixed dump 

valve opening that provides a gradual though uncontrolled secondary-side depressurization.

To determine the appropriate fraction, a scenario resembling a station blackout was simulated. There is 

no break, but the RHR pump is assumed to stop at the start of the transient. First, the situation of a 

closed dump valve was considered. Figure A.2.6.7a shows the primary- and secondary-side pressures 

that result. The secondary-side pressure rise is large, but not enough to open the PORVs or SRVs. 

Steam generator water levels stay high. Although a steady natural circulation flow around the primary 

loops occurs, the steam generators carry off only about 60 percent of the decay heat. The primary-side 

pressure quickly rises until the SRVs begin to cycle. 

Figure A.2.6.7b shows similar plots pertaining to a calculation in which the steam dump valve is opened 

to 4.5 percent at 345 seconds, approximately when the secondary-side pressure first begins to rise in the 

absence of such an action. With the 4.5 percent fraction, the secondary-side pressure remains fairly 

constant. In this case, the steam generator cooling amounts to about 95 percent of the decay heat until 

about 1.3 hours. The temperature at the core exit remains fairly constant after the opening of the dump 

valve and is only about 10 K higher than its pre-transient value. Because the primary system is watersolid, the primary pressure rise is again large, from 1.35 to about 5 MPa. But in this case, it is not 

0

2

4

6

8

10

12

14

0 1 2 3 4

time [hr]

Level [m]

Sensitivity case

Base case

Cold leg bottom

TAF

BAF
A-70

sufficient to open the SRVs. Steam generator water levels fall, and starting from about 1.3 hours AFW 

injections occur. The injection of the cooler water (322 K) results in cooling in excess of the decay heat, 

causing the primary pressure to decrease.

Figure A.2.6.7a Pressures (Supplemental Calculation with RHR Pump Trip and No Break)

Figure A.2.6.7b Pressures (Supplemental Calculation Variant with RHR Pump Trip and No Break)

Dump valve not credited

0

4

8

12

16

20

0 0.5 1 1.5 2

time [hr]

Pressure [Mpa]

1.0

1.4

1.8

2.2

2.6

3.0

Pressure [MPa]

CVH-P.305 (Pressurizer; left axis)

CVH-P.700 (SG header; right axis)

Dump valve credited

0

4

8

12

16

20

0 0.5 1 1.5 2

time [hr]

Pressure [MPa]

1.0

1.4

1.8

2.2

2.6

3.0

Pressure [MPa]

CVH-P.305 (Pressurizer; left axis)

CVH-P.700 (SG header; right axis)
A-71

For Case A.2.6, the assumed time for opening the dump valve, 0.5 hours, is reasonable for an operator 

action. This time also is approximately consistent with the time when RHR cooling is lost in the base case 

(i.e., about 0.7 hours).

A.3.2.7 Results of Cases A.2.7a, A.2.7b, A.2.7c, and A.2.7d (Other Break Flow Areas)

These four sensitivity cases are the same as the base case, except that the flow areas of the break differ 

from the base-case value.

In Case A.2.7a, the flow area is 75 percent of the value that applies to the base case. The resulting 

accident sequence is similar to that of the base case, except the events are delayed by 0.1 to 0.5 hours, 

depending on the time. Figure A.2.7a.1 compares the core water levels in the base and sensitivity cases. 

In the sensitivity case, the core starts to uncover at 1.01 hours; the time at which the core exit 

temperature reaches 922 K is 3.27 hours; and the time at which the peak cladding temperature reaches 

1,478 K is 3.71 hours. In the base case, these same events occur at 0.75, 2.93, and 3.34 hours. The 

calculation is stopped at 4.42 hours due to numerical problems associated with the melting of the heat 

structure that represents the upper core support plate.

Figure A.2.7a.1 Water Levels in the Core (Case A.2.7a)

In Case A.2.7b, the flow area is 10 percent of the value that applies to the base case, for a nominal initial 

break flow rate of 100 gpm (0.0063 m3

/s). Table A.9 provides timings of some of the key events. Figure 

A.2.7b.1 shows the break flows. During the first 2 hours, the break flow rate is close to 100 gpm (0.0063 

m3

/s), but it is as much as 185 gpm (0.0117 m3/s) later. Water levels are shown in Figure A.2.7b.2. The 

RHR pump (Figure A.2.7b.3) has full suction until about 7.3 hours, when the pressurizer empties, but 

pumping at reduced rates continues until about 9.3 hours. Uncovery of the core starts at 7.87 hours in the 

second computational ring. The time at which the peak cladding temperature reaches 1,478 K is 11.38 

hours. The calculation is stopped at 13.9 hours.

0

2

4

6

8

10

12

14

0 1 2 3 4 5

time [hr]

Level [m]

Sensitivity case

Base case

Cold leg bottom

TAF

BAF
A-72

Table A.9 Timing of Key Events Predicted for the MELCOR Model Shutdown Sensitivity-Case 

A.2.7b Calculation 

Event Description Time (hours)

Break in RHR-B lines outside the containment(1) 0

Reduced RHR-A pump rate due to low water level in hot leg D ~7.3

Core partially uncovered 7.87

Pressurizer empties (i.e., contains less than 10 kg of liquid) 7.26

Zero RHR pump rate due to dry hot leg D 9.32

Coolant temperature at core exit reaches 922 K (1,200 °F) 9.62

First gap release 10.17

Peak clad temperature reaches 1,478 K (2,200 °F) 11.38

Calculation ends 13.89

1 Nominal break flow, 100 gpm (0.0063 m3

/s) (vs. 1,000 gpm (0.063 m3/s) in the base case).

Figure A.2.7b.1 Break Flows (Case A.2.7b)

0

5

10

15

20

0 3 6 9 12 15

time [hr]

Pool mass flow [kg/s]

0

0.5

1

1.5

2

Steam mass flow [kg/s]

Pool (left axis)

Steam (right axis)
A-73

Figure A.2.7b.2 Water Levels in the RCS (Case A.2.7b)

Figure A.2.7b.3 RHR Pump Rate and Liquid Volume in Hot Leg D (Case A.2.7b)

0

5

10

15

20

25

30

0 3 6 9 12 15

time [hr]

Level [m]

Downcomer (collapsed)

Lower plenum to dome thru ring 2 (collapsed)

Przr

SGT 333 (in Loop D; cold leg receives injection )

SGT 433 (in Loop A; cold leg receives injection)

SGT 533 (in Loop B; cold leg is broken)

SGT 633 (in Loop C; cold leg is broken)

TAF

BAF

0

20

40

60

80

0 3 6 9 12 15

time [hr]

Flow through RHR pump [kg/s]

0

0.2

0.4

0.6

0.8

Volume of pool in Hot Leg-D [m^3]

minus CFVALU.2619

CVH-VOLLIQ.311 (right axis)
A-74

In Case A.2.7c, the flow area is 5 percent of the value that applies to the base case for a nominal initial 

break flow rate of 50 gpm (0.0032 m3

/s). During the first 4 hours, the break flow rate increases from about 

35 to 60 gpm (0.0022 to 0.0038 m3

/s), but the peak value (occurring at about 17 hours) is about 97 gpm

(0.0061 m3

/s). The pressurizer empties at about 14.6 hours. The RHR pump has full suction until about 

15.5 hours, but pumping at reduced rates continues until about 18.9 hours. Uncovery of the core starts at 

16.81 hours in the second computational ring. The time at which the peak cladding temperature reaches 

1,478 K is 23.92 hours. The calculation is stopped at 24.8 hours.

In Case A.2.7d, the flow area is 500 percent of the value that applies to the base case for a nominal initial 

break flow rate of 5,000 gpm (0.315 m3

/s). Table A.10 provides timings of some key events. Figure 

A.2.7d.1 shows the break flows. From 5 to 10 minutes, the break flow rate is about 5,250 gpm (0.331 

m3

/s). Figure A.2.7d.2 shows the water levels. The RHR pump (Figure A.2.7d.3) operates at a reduced 

rate from about 11 to 15 minutes. It then has a second period of full suction before finally stopping 

altogether at 21.5 minutes. The pressurizer empties at 20.2 minutes. Uncovery of the core starts at 11.5 

minutes in the second computational ring. The time at which the peak cladding temperature reaches 

1,478 K is 39.8 minutes. The calculation is stopped at 1.5 hours.

Table A.10 Timing of Key Events Predicted for the MELCOR Model Shutdown Sensitivity-Case 

A.2.7d Calculation 

Event Description Time (minutes)

Break in RHR-B lines outside the containment(1) 0

Reduced RHR-A pump rate due to low water level in hot leg D ~11 – 15 

Core partially uncovered 11.5 

Pressurizer empties (i.e., contains less than 10 kg of liquid) 20.2 

Zero RHR pump rate due to dry hot leg D 21.5 

Coolant temperature at core exit reaches 922 K (1,200 °F) 35.1 

First gap release 35.2 

Peak clad temperature reaches 1,478 K (2,200 °F) 39.8 

Calculation ends 91

1 Nominal break flow, 5,000 gpm (0.315 m3

/s) (vs. 1,000 gpm (0.063 m3/s) in the base case).
A-75

Figure A.2.7d.1 Break Flows (Case A.2.7d)

Figure A.2.7d.2 Water Levels in the RCS (Case A.2.7d)

0

100

200

300

400

0.0 0.5 1.0 1.5

time [hr]

Pool mass flow [kg/s]

0

10

20

30

40

Steam mass flow [kg/s]

Pool (left axis)

Steam (right axis)

0

5

10

15

20

25

30

0.0 0.5 1.0 1.5

time [hr]

Level [m]

Downcomer (collapsed)

Lower plenum to dome thru ring 2 (collapsed)

Przr

SGT 333 (in Loop D; cold leg receives injection )

SGT 433 (in Loop A; cold leg receives injection)

SGT 533 (in Loop B; cold leg is broken)

SGT 633 (in Loop C; cold leg is broken)

TAF

BAF
A-76

Figure A.2.7d.3 RHR Pump Rate and Liquid Volume in Hot Leg D (Case A.2.7d)

A.3.2.8 Results of Case A.2.8 (Reduced Decay Heat)

Case A.2.8 is the same as the base case, except that the decay heat is uniformly reduced to 75 percent 

of its value in the base case. The initial decay heat is therefore 15.97 MW. This case receives a special 

pre-transient calculation with a clamped, appropriately reduced rate of RHR pumping relative to the base 

case. Note that the initial decay heat is quite similar to the decay heat at 72 hours, which is estimated as 

15.85 MW. Case A.2.8 therefore serves as an approximation to a modified scenario in which the transient 

begins at 72 hours. However, the present treatment with a uniform reduction of the decay heat by a 

constant factor is not exactly equivalent to evaluating the unmodified decay heat curve at any later times, 

and the assumed initial conditions (e.g., RPV head still in place) would likely not actually be applicable at 

72 hours.

The resulting accident sequence is similar to that of the base case, except for small delays of the various 

events. Figure A.2.8.1 compares the core water levels. In the sensitivity case, the core starts to uncover 

at 0.80 hours; the time at which the core exit temperature reaches 922 K is 2.98 hours; and the time at 

which the peak cladding temperature reaches 1,478 K is 3.46 hours. In the base case, these same events 

occur at 0.75, 2.93, and 3.34 hours, respectively. The calculation was stopped at 4.37 hours due to 

numerical problems associated with the melting of the heat structure that represents the upper core 

support plate.

0

20

40

60

80

0 5 10 15 20 25 30

time [minutes]

Flow through RHR pump [m**3]

0

0.2

0.4

0.6

0.8

Volume of pool in Hot Leg-D [m^3]

minus CFVALU.2619

CVH-VOLLIQ.311 (right axis)
A-77

Figure A.2.8.1 Water Levels in the Core (Case A.2.8)

A.3.2.9 Results of Case A.2.9 (Break inside the Containment with the ECCS Recirculation Mode)

This case considers that the break of the line running from RHR pump B to the cold legs of loops B and C 

occurs inside the containment instead of outside. As in Case A.2.4, the unaffected RHR pump A is 

supposed to trip irreversibly on the low hot leg water level, which should occur at 0.71 hours in the

present case. As in Cases A.2.2 and A.2.3, the ECCS injections from the RWST with one charging and 

one SI pump are credited. They begin at 0.92 hours. As modeled, the injections result from the ECCS 

actuation on high containment pressure; in actuality it may be due to operator action if the 

aforementioned actuation signal is disabled in this mode of plant operation. In contrast with the other 

cases, this case assumes that the ECCS is successfully switched over to the recirculation mode, where 

the containment sump becomes the water source, when the RWST water level is drawn down to Lo-2. 

This event occurs at 3.37 hours. In the assumed configuration, RHR pump A draws from the sump during 

the recirculation mode. Its discharge passes one RHR heat exchanger, then is fed into one charging and 

one SI pump, which finally inject into cold legs A and D (i.e., the two intact cold legs).

Many results are similar to those of Case A.2.2. Figure A.2.9.1 shows the water levels around the RCS. 

Figure A.2.9.2 shows the ECCS injections. By about 1 hour, a stable state is achieved and the core water 

level is steady, with no more than about the top third of the fuel uncovered. The top of the active fuel 

uncovers for the first time at 0.76 hours, and the top third uncovers for the first time at 0.81 hours. No 

other surrogate measures ever indicate core damage. The calculation is stopped at 7.4 hours.

In this case, because the break is inside the containment, containment pressurization sufficient to reach 

the ECCS actuation setpoint occurs. All Shutdown calculations credit one fan cooler, but only in this case 

does it play a significant role. ECCS actuation switches the cooler from normal mode to ECCS mode, and 

further containment pressurization is prevented. Figure A.2.9.3 shows the containment pressure. Figure 

A.2.9.4 shows the rate of heat extraction provided by the fan cooler, in comparison with the decay heat.

0

2

4

6

8

10

12

14

0 1 2 3 4 5

time [hr]

Level [m]

Sensitivity case

Base case

Cold leg bottom

TAF

BAF
A-78

Figure A.2.9.1 Water Levels in the RCS (Case A.2.9)

Figure A.2.9.2 ECCS Injections Flow Rates (Case A.2.9)

0

5

10

15

20

25

30

0 2 4 6 8

time [hr]

Level [m]

Downcomer (collapsed)

Lower plenum to dome thru ring 2 (collapsed)

Przr

SGT 333 (in Loop D; cold leg receives injection )

SGT 433 (in Loop A; cold leg receives injection)

SGT 533 (in Loop B; cold leg is broken)

SGT 633 (in Loop C; cold leg is broken)

TAF

BAF

0

5

10

15

20

25

0 2 4 6 8

time [hr]

Injected mass rate to each of CLs A and D , kg/s

CFVALU.5244 / 2 - SI , inject mode

CFVALU.5520 - SI , recirc mode

CFVALU.5252 / 2 - chrg , inject mode

CFVALU.5506 - chrg , recirc mode
A-79

Figure A.2.9.3 Containment Pressure (Case A.2.9)

Figure A.2.9.4 Decay Heat and Fan Cooler Heat Removal (Case A.2.9)

A.3.2.10 Results of Case A.2.10 (Break from a Hot Leg)

This case considers that the break occurs in the suction line of the unused RHR pump (instead of that 

pump’s injection line, as the base case supposes). The break therefore connects the loop C hot leg 

(modeled by control volume CV 611) with the environment, instead of connecting the cold legs of loops B 

and C with the environment, as occurs in the base case. 

0.108

0.113

0.118

0.123

0.128

0.133

0.138

0 2 4 6 8

time [hr]

Pressure [MPa]

0

5

10

15

20

25

0 2 4 6 8

time [hr]

Heat [MW]

Decay heat

Fan cooler - normal mode

Fan cooler - ECCS mode
A-80

Figure A.2.10.1 shows the break flow. The flow area of the break flow path, 18.8 cm2

, is assumed to be 

twice the area of the two base-case cold leg break flow paths, so that any different behavior of the 

sensitivity-case break flow is not merely a matter of different flow areas. Recall that the area was 

prescribed in order to obtain a net break flow of around 1,000 gpm (0.063 m3

/s) early in the transient in 

the base case. Figure A.2.10.2 compares the sensitivity and base cases with respect to the primary 

pressure. Whereas in the base case the RHR cooling is impaired from the start of the transient, in the 

sensitivity case the efficacy of RHR cooling is barely or not at all reduced until the actual loss of suction at 

the (intact) hot leg. In the base case, even though the suction was not lost until later, starting from t=0 

some of the returning cooled water spilled through the breaks after traversing the downcomer without 

passing the core. In the base case, the impaired cooling during the first hour caused the pressure to rise 

and therefore increased the break flow. This impairment and pressure rise do not occur in the sensitivity 

case, and the break flow stays around 650 gpm (0.041 m3

/s) during the first hour. 

Figure A.2.10.1 Break Flows (Case A.2.10)

0

10

20

30

40

50

60

70

80

-1 0 1 2 3 4 5 6 7

time [hr]

Pool mass flow [kg/s]

0

1

2

3

4

5

6

7

8

Steam mass flow [kg/s]

Pool (left axis)

Steam (right axis)
A-81

Figure A.2.10.2 Vessel Dome Pressures (Case A.2.10)

Figure A.2.10.3 shows the water levels at various locations. The water levels in the loop D hot leg (which 

the figure shows, and from which the RHR pump takes suction), and the loop C hot leg (with the break, 

and not shown in the figure) are similar at all times. A void first occurs there around 1.4 hours. After this 

time, the break flow is predominately steam (Figure A.2.10.1). Also after 1.4 hours, the RHR pump 

operates only at a reduced rate, which is equal on average to the rate at which water reappears in hot leg 

D due to pressurizer draining (Figure A.2.10.4). The slopes of the curves in Figure A.2.10.4 indicate that 

from about 1.4 hours until 2.65 hours (when the pressurizer empties), water leaves the pressurizer, is 

pumped to the vessel, boils in the core, and finally leaves the RCS through the break as steam, all at 

approximately equal mass rates. Draining the pressurizer is very similar to the base-case behavior. In the 

base case, the pressurizer empties at 2.64 hours.

Figure A.2.10.3 Water Levels in the RCS (Case A.2.10)

1.0

1.5

2.0

2.5

3.0

-1 0 1 2 3 4 5 6 7

time [hr]

Pressure [MPa]

Sensitivity case

Base case

0

5

10

15

20

25

30

-1 0 1 2 3 4 5 6 7

time [hr]

Level [m]

Downcomer (collapsed)

Lower plenum to dome thru ring 2 (collapsed)

Przr

SGT 333 (Loop D)

SGT 433 (Loop A)

SGT 533 (Loop B)

SGT 633 (Loop C)

Hot Leg D

TAF

BAF
A-82

Figure A.2.10.4 Cumulative flows and Inventory Decreases (Case A.2.10)

Uncovery of the core starts at 3.62 hours; significant heatup of the core begins at about 5 hours. The time 

to core damage, according to the measure that associates core damage with the spatially-maximized 

cladding temperature becoming greater than 1,478 K, is 5.59 hours in the case of the hot leg break 

versus 3.34 hours in the base case.

A.3.2.11 Results of Case A.2.11 (Initially Sub-cooled Primary RCS)

This case is the same as the base case, except for the initial primary-side pressure. Actual shutdown 

operations would likely have water-solid conditions in the RCS, with pressure well above the saturation 

pressure. Because of anticipated possible numerical difficulties related to water incompressibility, the 

base-case calculation was set up with saturated conditions instead of sub-cooled conditions. In this 

sensitivity case, a solid and sub-cooled state during the pre-transient period is generated by adding 

above the pressurizer a fictitious water pool under a cover of nitrogen gas with an initial pressure of 2.57 

MPa. As in the base case, the pre-transient calculation begins at -5,000 seconds. During most of the pretransient, the nitrogen buffers the RCS pressure against large fluctuations that would otherwise occur, 

until the thermal interactions between the primary and secondary sides of the RCS become steady. 

Figures A.2a and A.2b describe these interactions in the base case. The fictitious pool is valved out of the 

problem at -50 second. At the start of the transient (i.e., t = 0 s when the break opens), the pressure at 

the top of the completely full pressurizer is 2.54 MPa (354 psig). In the base case, the initial pressurizer 

pressure is 1.29 MPa, the saturation value. The base-case primary-side temperature of 466.5 K (380 °F) 

is assumed to also apply to this sensitivity case. The selected temperature is consistent with Step 21 of 

1BOA-SD-2 (a Byron document related to shutdown), whereas typical primary-side conditions at this point 

in a shutdown operation would be 360 psig (2.48 MPa-g) and 350 °F (450 K). The initial conditions on the 

secondary side of the RCS are the same for this sensitivity calculation as they are in the base case. In 

particular, the temperature is also 466.5 K and the pressure is the saturation value.

Figures A.2.11.1 and A.2.11.2 compare the primary pressure and the break flows in the sensitivity case 

versus the base case. Once the transient is initiated by the opening of the break, the pressure quickly 

falls to saturation in the sensitivity case. This results in similar primary pressures and similar break flows 

during most of the transient in the two cases. All results are therefore similar. The time to core damage 

according to the measure that associates core damage with the spatially-maximized cladding temperature

-50

0

50

100

150

200

250

300

350

400

-1 0 1 2 3 4 5 6 7

time [hr]

Mass [tonnes]

Cumulative liquid flow through RHR pump (from t=0)

Cumulative break flow (all forms of H2O)

SGT liquid inventory decrease

Vessel liquid inventory decrease

Przr liquid inventory decrease
A-83

becoming greater than 1,478 K is 3.47 hours in case the RCS is initially water-solid and sub-cooled, 

versus 3.34 hours in the base case. 

Figure A.2.11.1 Vessel Dome Pressures (Case A.2.11)

Figure A.2.11.2 Break Flows (Case A.2.11)

A.3.3 Summary: Shutdown Scenario

This scenario considers a break outside of containment in piping that connects an RHR pump to two cold 

legs. Initial temperatures around the RCS are 466.5 K. The RHR pump unaffected by the break is in use 

in a closed-loop configuration to remove the decay heat, which is 21.29 MW initially and corresponds to 

1.0

1.5

2.0

2.5

3.0

-1 0 1 2 3 4

time [hr]

Pressure [MPa]

Sensitivity case

Base case

0

10

20

30

40

50

60

70

80

90

100

-1 0 1 2 3 4

time [hr]

Pool mass flow [kg/s]

0

1

2

3

4

5

6

7

8

9

10

Steam mass flow [kg/s]

Pool (left axis; sensitivity case)

Pool (left axis; base case)

Steam (right axis; sensitivity case)

Steam (right axis; base case)
A-84

24 hours since scram. The break flow area produces an initial break flow of about 1,000 gpm (0.063 

m3

/s).

No operator actions are credited in the base case, thus leading to core damage when the RHR pump 

loses suction as inventory is lost and the hot leg empties. Core damage occurs at 3.34 hours according to 

the measure that associates core damage with the temperature of the hottest cladding exceeding 1,478 K 

(2,200 °F).

Variants of the base case that also lead to core damage consider the following:

• A modified treatment of the behavior of the RHR pump on very low hot leg water levels (Case A.2.4 

predicts core damage 0.13 hours earlier with the assumption that the pump trips irreversibly)

• An attempt to bring about more steam generator cooling (Case A.2.6 initiates a slow secondary-side 

depressurization starting at 0.5 hours and predicts core damage 1.12 hours earlier)

• Break flows of different sizes (Case A.2.7a reduces the break flow area to 75 percent of the basecase value and predicts core damage 0.37 hours later. Case A.3.7b reduces the break flow area to 

10 percent of the base-case value and predicts core damage at 11.38 hours. Case A.3.7c reduces 

the break flow area to 5 percent of the base-case value and predicts core damage at 23.92 hours. 

Case A.3.7d increases the break flow area to 500 percent of the base-case value and predicts core 

damage at 39.8 minutes.)

• Lower decay heat (Case A.2.8 reduces the decay heat to 75 percent of the base-case value and 

predicts core damage 0.12 hours later)

• Different break location (Case A.2.10 considers a hot leg break and predicts core damage 2.25 hours 

later) 

• Initially sub-cooled RCS (Case A.2.11 starts the transient from water-solid and super-pressurized 

primary-side conditions, and predicts core damage 0.13 hours later).

In the above bullets, the times to core damage refer to the measure that associates core damage with the 

temperature of the hottest cladding exceeding 1,478 K (2,200 °F).

Gross core damage is avoided in Case A.2.2, wherein, at 0.5 hours, operators initiate ECCS injections 

with one charging pump and one SI pump taking suction from an RWST that is assumed to be refilled as 

necessary. Core uncovery is not prevented. The time that the top third of the core is first uncovered is 

2.14 hours. However, gap releases and the relocation of fuel or structural material are not predicted to 

occur.

Variations of Case A.2.2 that also avoid gross core damage consider the following:

• A later time for the same actions (Case A.2.3 credits the actions to occur at 1.0 hour)

• A modified treatment of the behavior of the RHR pump on very low hot leg water levels (Case 

A.2.5 applies to Case A.2.2 the same treatment considered in Case A.2.4),

• Available switchover to the ECCS sump recirculation mode (Case A.2.9 reinterprets the break as 

occurring inside the containment, so water accumulates in the sump).
A-85

A.4 Reference

A.1 H. Esmaili, D. Helton, D. Marksberry, R. Sherry, P. Appignani, D. Dube, M. Tobin,

R. Buell, T. Koonce, and J. Schroeder, “Confirmatory Thermal-Hydraulic Analysis to Support 

Specific Success Criteria in the Standardized Plant Analysis Risk Models – Surry and Peach 

Bottom,” U. S. Nuclear Regulatory Commission, NUREG–1953 (September 2011).

B-1

APPENDIX B: DETAILS OF THE SURRY SGTR ANALYSIS

B.1 Introduction

B.1.1 Background

Section 2.2 of the main report describes the Surry plant and the MELCOR model. A more complete 

description of the model is provided by the SNL Surry model documentation. This appendix includes 

details of the models and calculations for the Surry nuclear power plant.

B.1.2 Objectives and Scope

The objectives of this Appendix are to document the calculations specific to the Surry plant that 

encompass detailed results for the basic scenario and its sensitivity cases. These simulations are limited 

in scope to considerations important for determining the relevant probabilistic risk assessment (PRA) 

level-1 system success criteria and sequence timing.

This Appendix analyzes an SGTR sequence sometimes herein referred to as SGTR-9. The emphasis is 

on the variability of the results that may arise from variations of the model, variations of the plant’s initial 

state, or variations of assumed operator actions that still fall within the SGTR-9 definition. To this end, the 

discussion defines a base case and 20 sensitivity cases. Of these 21 cases, SNL defined and computed 

20 cases. ERI defined the final case and carried out the MELCOR computation using a suitably modified 

version of the basic model. The results of interest are mostly confined to the time of core damage. 

Various criteria (referred to as core damage surrogates) are used to define these times. 

B.1.3 Outline

Section B.2 focuses on results that describe one basic scenario consisting of the SGTR-9. The scenario 

and its sensitivity cases are defined in Section B.2.1. Detailed results specific to the base and sensitivity 

cases appear in subsections of Section B.2.2. Summary results pertaining to all cases appear in Section 

B.2.3 and also in Section 3.2 of the main report. 

All detailed results appear in the subsections of Section B.2.2; each subsection pertains to a particular 

base or sensitivity case. To simplify the Figure numbering, a four-character code is used within these 

subsections according to the numbering scheme explained in the previous Appendix. After “B,” which 

designates Surry, the next character numbers the scenario (for Surry, there is only one scenario). The 

character after that numbers the sensitivity case; the base case is counted as the first case. The last 

character in the string is the count among the Figures that apply to a given sensitivity case in a given 

scenario. For example, the first figure in the second sensitivity case that pertains to the SGTR scenario is 

Figure B.1.2.1. Figures not pertaining to a specific scenario and sensitivity case are not numerous, and 

are designated by a two-character code. The first character denotes Surry and the second character 

reflects a count over this Appendix. A similar two-character code is used for all the Tables.

B.2 Accident Scenario and Results

B.2.1 Steam Generator Tube Rupture Sequence SGTR-9

Figure B.1 is an event tree that indicates 24 possible sequences that may result from an SGTR accident. 

SGTR-9 ends in core damage following a failure to initiate a primary- and secondary-side cooldown; to 

refill the RWST; and to provide long-term heat removal. 
B-2

Figure B.1 Surry SPAR (v8.17) SGTR Event Tree
B-3

Table B.1 gives the timings at which certain operator actions may be assumed to occur.

In the MELCOR model, the events in Figure B.1 and Table B.1 are taken into account by a setup that 

includes:

• An initiating steam generator tube rupture at time t = 0

• Scram, MSIV closure, MFW trips, and RCP trips at finite model-predicted times24

• Available HHSI, LHSI, and containment sprays with the RWST as the source

• Available turbine-driven and motor-driven AFW with CST as the source

• Operator actions E-3 (from Table B.1) occurring at a hard-wired time (17.88 minutes)

• No provision for steam generator cooldown (e.g., by controlled depressurization)

• Unavailable recirculation mode for all systems

• No refilling of the RWST or CST

The base-case calculation also assumes no termination or control of HHSI by operators, no B&F, and no 

RHR, although Table B.1 identifies interim SOARCA-recommended timings for these actions. Some of 

these actions are considered by the sensitivity cases, however. Note that the time of the operator actions, 

17.88 minutes, was hard-wired into the deck by the model developers. The rationale for this precise time 

is unknown, but it does not differ importantly from the SOARCA-recommended time of 15 minutes.

To investigate the variability of the predictions, 20 sensitivity cases are defined in addition to the base 

case. The highlighted entries in Table B.2 show how each sensitivity case differs from the base case. 

• Case B.1 is the base case.

• Cases B.2 and B.3 consider the effective number of tubes that rupture.

• Case B.4 considers the effect of a slightly higher initial water inventory in the RWST.

• Cases B.5 and B.6 consider the effect of reducing the number of HHSI pumps.

• Cases B.7, B.8, and B.9 adjust the conditions assumed to lead to failure in the open position of a 

secondary-side PORV. Cases B.10, B.11, and B.15 apply the adjusted conditions together with the 

larger effective number of ruptured tubes considered in Case B.2.

• Cases B.12, B.13, and B.14 adjust the conditions assumed to lead to failure in the open position of a 

pressurizer PORV.

• Case B.16 considers the effects of operators taking control of the HHSI system, so that level is 

controlled in the core (see event CSI in Figure 2.1). Maintaining level lower in the RCS would be 

outside the EOPs, and is included for illustrative purposes.

• Case B.17 adds to Case B.16 the opening of one pressurizer PORV to prepare for B&F operations 

(see event B&F in Figure 2.1). The criterion to start B&F would not have been obtained, and the 

calculation is included for illustrative purposes, though it could be viewed as an error of commission.

• Case B.18 adds to Case B.16 the opening of two pressurizer PORVs in preparation for B&F 

operations (see event B&F in Figure 2.1 and caution above).

 24 It was pointed out during review that Step 1 of E-3 directs the operators to trip the RCPs. Since the prescribed 

sequence credits operator actions downstream of this procedural step, this is a specific failure assumed by the 

analysis. Note that the SPAR sequence does not consider RCP trip, and generally, early RCP trip would be expected 

to make this particular scenario more benign (the RCPs act to push more primary side fluid out of the break, which 

there is more than adequate heat removal for the additional energy they impart in the system).
B-4

• Cases B.19 and B.20 add the availability of the RHR, which is subject to permitting temperature and 

pressure conditions, to Cases B.17 and B.18, respectively (see event RHR in Figure 2.1 and caution 

above).

• Case B.21 adjusts the kinetics of the zirconium steam-oxidation reaction. The Prater and Courtright 

correlation for the rate coefficient is used instead of the Urbanic-Heidrick correlation, which is used in 

all other cases.

Table B.1 List of Operator Actions for the SGTR Sequence

Operator Actions Description† Time

(hh:mm)

Spontaneous SGTR 00:00

Automatic reactor SCRAM 00:03

E-0 – Step 1. Verify Reactor Trip – Status OK 

E-0 – Step 2. Verify Turbine Trip – Status OK

E-0 – Step 3. Initiate E-0 Attachment 1, “System Alignment Verification”

E-0 – Step 4. Check SI Initiated – Status True (Low Pressurizer Pressure)

E-0 – Step 5. Verify AC Emergency Buses Energized – Status OK

E-0 –Step 6 RCS Average Temp – Trending to 547 oF, Turbine Bypass Valve (TBV) 

closed

E-0 – Step 7 Pressurizer PORVs and Spray Valves – Closed

E-0 – Step 8 RCP Trip – At least one charging pump is running (omitted here)

E-0 – Step 9 Steam Generators Faulted – Pressure is increasing

E-0 – Step 10 Steam Generator Tubes Ruptured – Status:

High radiation

Steam Generator NR increasing quickly

Go to E-3

00:03 to 00:15

E-3 – Step 1 Check RCP Trip – Status OK; HHSI is running (omitted here)

E-3 – Step 2 Identify Ruptured Steam Generator – Status True

E-3 – Step 3 Isolate Ruptured Steam Generator – Status:

Steam Generator PORV setpoint to 1,035 psig

PORV operating and cannot be closed

Steam Generator blowdown valves are closed

Steam supply from ruptured Steam Generator to TDAFW is isolated

Main Steam Turbine Valve (MSTV) from ruptured Steam Generator is closed

E-3 – Step 4 Check Ruptured Steam Generator Level –

NR level > 18%

AFW isolated to ruptured SG

E-3 – Step 5 Ruptured Steam Generator Pressure > 350 psig – Status True

Go to ECA-3.1

00:15

ECA-3.1 – Operators fail to implement in the base case

Assumed timing of the CSI‡ (throttling the high-pressure injection (HPI), if applicable) 00:15

Assumed timing of the pressurizer (opening the PORVs, if applicable) 00:60

Assumed timing of B&F, if applicable 00:60

Assumed timing of the RHR, if applicable 00:15 after 

entry conditions

† From interactions with Surry operators as part of the SOARCA project. ‡ CSI on procedure E-3, Step 23.
B-5

Table B.2 Sensitivity Cases for Surry SGTR

Case # 

Tubes

RWST

Inventory(1) HHSI(2)

Secondary 

PORV 

Failure(3)

Pressurizer 

PORV 

Failure(3)

CSI(4)

FAB(5) (# 

of PRZ 

PORVs)

RHR(6)

Alternate 

Oxidation 

Model(7)

B.1 1 TS 3→2 CDF = 0.5 CDF = 0.5 No 0 No No

B.2 5 TS 3→2 CDF = 0.5 CDF = 0.5 No 0 No No

B.3 0.5 TS 3→2 CDF = 0.5 CDF = 0.5 No 0 No No

B.4 1 Full 3→2 CDF = 0.5 CDF = 0.5 No 0 No No

B.5 1 TS 1→1 CDF = 0.5 CDF = 0.5 No 0 No No

B.6 1 TS 2→2 CDF = 0.5 CDF = 0.5 No 0 No No

B.7 1 TS 3→2 CDF = 

0.15 CDF = 0.5 No 0 No No

B.8 1 TS 3→2 CDF = 

0.85 CDF = 0.5 No 0 No No

B.9 1 TS 3→2 Water or

CDF = 0.5 CDF = 0.5 No 0 No No

B.10 5 TS 3→2 CDF = 

0.15 CDF = 0.5 No 0 No No

B.11 5 TS 3→2 CDF = 

0.85 CDF = 0.5 No 0 No No

B.12 1 TS 3→2 CDF = 0.5 CDF = 0.15 No 0 No No

B.13 1 TS 3→2 CDF = 0.5 CDF = 0.85 No 0 No No

B.14 1 TS 3→2 CDF = 0.5 Water or

CDF = 0.5 No 0 No No

B.15 5 TS 3→2 Water or

CDF = 0.5 CDF = 0.5 No 0 No No

B.168 1 TS 3→2 CDF = 0.5 CDF = 0.5 Yes 0 No No

B.178 1 TS 3→2 CDF = 0.5 CDF = 0.5 Yes 1 No No

B.188 1 TS 3→2 CDF = 0.5 CDF = 0.5 Yes 2 No No

B.198 1 TS 3→2 CDF = 0.5 CDF = 0.5 Yes 1 Yes No

B.208 1 TS 3→2 CDF = 0.5 CDF = 0.5 Yes 2 Yes No

B.21 1 TS 3→2 CDF = 0.5 CDF = 0.5 No 0 No Yes:

P & C 1 TS: Technical Specification level; Full: maximum level 2 3→2: 3/3 HHSI pumps start and 1 is isolated at 17.9 minutes per procedure; 1→1: 1/3 HHSI pumps starts and it

is not isolated at 17.9 minutes; 2→2: 2/3 HHSI pumps start and none are isolated at 17.9 minutes 3 CDF: Cumulative Distribution Function (e.g., 0.5 implies a 50% chance of failure for the given number of valve 

cycles); Water: valve failure due to two-phase flow 4 CSI: operators take control of safety injection 5 B&F – operators open 1 or 2 pressurizer PORVs 6 RHR: residual heat removal, available 15 minutes after entry conditions are persistently achieved (PRCS < 450 

psi, TRCS < 350 oF, hot leg water level above center line) 7 P & C: Prater and Courtright correlation for rate coefficients used instead of the default correlation 8 Cases for controlling HHSI above TAF (i.e., below the normal pressurizer level) and B&F are counter to EOPs for 

the prescribed conditions. They are included for illustrative purposes, though they could be viewed as 

representing errors of commission.
B-6

Section B.2.2.1 describes in detail the base-case calculation. Sections B.2.2.2 through B.2.2.21 describe 

the sensitivity calculations, typically in less detail. A summary discussion pertaining to this scenario 

appears in Section B.2.3, which is also in the main report.

B.2.2 Results

B.2.2.1 Results of Case B.1 (Base Case)

The sequence of successful versus failure events that defines scenario SGTR-9 is given in Figure B.1. 

The operator actions during the accident sequence are outlined in Table B.1. The scenario progression is 

outlined in Table B.3 and is illustrated in Figures B.1.1.1 to B.1.1.8. 

The SGTR (initiating at t = 0 seconds after a pre-transient steady-state period lasting 100 seconds) is 

modeled by two flow paths, each leading to the boiler of the steam generator of loop A. One originates in 

the steam generator inlet plenum, the other in the steam generator outlet plenum. (Note that loop A is not 

the loop that contains the pressurizer.) Each has as a flow area the full cross-sectional area (3.045 cm2

) 

of one steam generator tube to model a double-ended break of one tube. Figures B.1.1.1 and B.1.1.2 

show the primary pressure and the break flows, respectively.

The MFW stops at 2.9 minutes due to the scram. The RCPs continue to pump in all of the loops, by 

assumption that the operators fail to trip the RCPs as directed by procedure. 

High-pressure injection (HHSI) into all three cold legs begins at 3.1 minutes. The water source is the 

RWST. Containment sprays and low-pressure injection (LHSI), also with the RWST as the source, are 

credited to be available; however, the sprays actuation setpoint (containment pressure above 0.172 MPa) 

is never attained, nor is the RCS pressure ever less than the LHSI deadhead pressure (1.18 MPa). 

Motor-driven AFW starts at 3.5 minutes; turbine-driven AFW starts at 4.0 minutes. Steam generators A 

(with the steam generator tube break), B, and C (in the pressurizer loop) all receive motor-driven and 

turbine-driven AFW.

At the hard-wired time of 17.88 minutes, various operator actions are modeled. Both types of AFW are 

turned off to all steam generators. The pressure-dependent, per-loop HHSI rate is reduced to two-thirds 

of its true value, while injection at this reduced rate continues into all three legs. This treatment 

approximately models operator turn-off of one of the three HHSI pumps. The PORV in steam generator A 

becomes stuck open at 37.4 minutes from excessive cycling.

Motor-driven AFW starts up again at 50.3 and 51.0 minutes in steam generator C and steam generator B, 

respectively. The injection rate is controlled to maintain the level in the steam generator downcomers to 

23.376 m. The water level in steam generator A is above target at this time, thus ensuring a zero injection 

rate. Figure B.1.1.4 shows the steam generator downcomer levels. The injected water does not boil and 

does not leave the steam generators, but it builds up in the boilers and domes while the water levels in 

the downcomers are kept near the target by the control. Finally, at 8.40 hours, the water levels in the 

downcomers exceed the target, and the AFW stops. The AFW in these loops never resumes in the 

scenario.
B-7

Table B.3 Timing of Key Events Predicted for the MELCOR Model SGTR Base-Case Calculation

(Case B.1)

Event Description Time

Spontaneous SGTR (double-ended rupture on one tube) 0 

SCRAM, MFW trip, turbine control valves close 2.9 minutes

Steam dump valves open and modulate Not Simulated† 

Steam dump valves close (RCS temperature < 547 oF) Not Simulated† 

HHSI initiated into all loops; source is the RWST 3.1 minutes 

Motor-driven AFW starts in all loops 3.5 minutes

Turbine-driven AFW starts in all loops 4 minutes

Credited operator actions to isolate faulted steam generator: ‡

Secure AFW delivery

Isolate blowdown valve

Isolate Main Steam Turbine Valve (MSTV)

Set Steam Generator PORV to 1,035 psig

Isolate steam flow to TDAFW

Check that PORV is closed below 1,035 psig

15 minutes

Operators turn off all motor-driven and turbine-driven AFW 17.9 minutes

Rate of HHSI into all loops reduced to 2/3 of full capacity (to model operator turn-off 

of one HHSI pump) 17.9 minutes

Faulted steam generator (i.e., loop A) PORV begins to cycle 30.1 minutes

Faulted steam generator, flooded 33.2 minutes

Faulted steam generator, PORV becomes stuck fully open 37.4 minutes

Motor-driven AFW resumes in loop C 50.3 minutes

Motor-driven AFW resumes in loop B 51 minutes

End of HHSI (RWST attains the switch-over level but the switch to recirculation 

mode fails) 8.35 hours

Accumulator injections begin 8.63 hours

Motor-driven AFW stops in loops B and C due to high levels 8.40 hours

RCPs trip in all loops (void fractions in RCP flow paths exceed 0.1) 12.32 hours

Motor-driven AFW resumes in loop A 14.27 hours

All AFW becomes unavailable due to exhausted CST (96,000 gallons drawn by all 

types of AFW); motor-driven AFW stops in loop A 27.83 hours

SG of loop A drys out (SGs of loops B and C remain full) ~31 hours

Swollen level below the TAF (occurs first in ring 5) 34.67 hours

Turn-on of counter-current natural circulation model (all loops) 35 hours

More than 0.1 kg hydrogen generated by oxidation in core 36.87 hours

PORV of SG in loop C opens and cycles for rest of calculation 37.13 hours

PORV of SG in loop B opens momentarily 37.77 hours

Calculation ends (PCT exceeds 3,000 oF ) 38.15 hours

† The automatic operation of steam dump valves is not represented in the Surry MELCOR model. 

‡ Timing sequence from Appendix B, Section 5.3 of the SOARCA documentation (i.e., NUREG–1935; see 

Reference [B.1]). Only the first action is modeled, and as modeled it occurs at 17.9 minutes.
B-8

Figure B.1.1.1 Pressures (Case B.1)

Figure B.1.1.2 SGTR Break Flows and HHSI Rate (Case B.1)

0

5

10

15

20

0 10 20 30 40

time [hr]

Pressure [MPa]

0.00

0.05

0.10

0.15

0.20

Pressure [MPa]

Pressurizer

SG-A

SG-B

SG-C

Containment (right axis)

-10

0

10

20

30

40

50

60

70

80

0 10 20 30 40

time [hr]

Mass Flow Rate [kg/s]

Break from inlet plenum

Break from outlet plenum

HHSI injection rate
B-9

Figure B.1.1.3 Cumulative HHSI (Case B.1)

Figure B.1.1.4 Steam Generator Downcomer Water Levels (Case B.1)

0

200

400

600

800

1000

1200

1400

0 10 20 30 40

time [hr]

Cumulative HHSI [m^3]

CFVALU.220

10

15

20

25

30

0 10 20 30 40

time [hr]

Collapsed Level [m]

SG-A

SG-B

SG-C

AFW target
B-10

Figure B.1.1.5 Coolant Flow through the Cold Legs (Case B.1)

Figure B.1.1.6a Water Level in the Core (Case B.1)

-1000

0

1000

2000

3000

4000

5000

0 10 20 30 40

time [hr]

Liquid Mass Flow Rate [kg/s]

Loop A

Loop B

Loop C

0

2

4

6

8

10

12

0 10 20 30 40

time [hr]

Water Level [m]

Ring 1

Ring 2

Ring 3

Ring 4

Ring 5

TAF

2/3 AF

1/3 AF

BAF
B-11

Figure B.1.1.6b Water Level in the Pressurizer (Case B.1)

Figure B.1.1.7 Core Exit Temperature (Case B.1)

10

12

14

16

18

20

22

24

0 10 20 30 40

time [hr]

Level [m]

CVH-CLIQLEV.520

CVH-LIQLEV.520

Top

Bottom

300

600

900

1200

1500

0 5 10 15 20 25 30 35 40

time [hr]

Temperature [K]

Ring 1

Ring 2

Ring 3

Ring 4

Ring 5

1200F (922.04 K)
B-12

Figure B.1.1.8 Peak Cladding Temperature (Case B.1)

Figure B.1.1.3 shows the cumulative volume of water injected by the HHSI system. The injection mass 

rate appears in Figure B.1.1.2, co-plotted with the break mass flow rates. At 8.35 hours, HHSI has 

injected all available inventory of water in the RWST (1,215 m3

), so the switchover to the recirculation 

mode is required for the further use of HHSI (and, in general, LHSI and containment sprays – but these 

systems, though available, do not attain their setpoints and/or permissive conditions in this base-case 

calculation). According to the scenario definition, the switchover fails. No more injection to the primary 

system occurs in the calculation, except accumulator injections. Accumulators begin injecting for the first 

time at 8.63 hours. Accumulator injections stop at about 10 hours, resume at about 19 hours, and finally 

stop at about 21 hours. 

The RCPs in all three loops stop at 12.32 hours when, nearly simultaneously, the void fraction passing 

the RCP flow paths exceeds 0.1. After the RCPs trip, the coolant continues to flow at reduced rates by 

natural circulation, as Figure B.1.1.5 shows. This figure shows the cold leg liquid flows. Immediately after 

the RCPs trip, the vessel dome (control volume CV160) and the regions immediately below it (control 

volumes CV1R4, where R=1, ..., 5 stands for rings 1 through 5) abruptly empty out. (See Figure 2.2.1 in 

the main report for the vessel nodalization diagram.) Control volumes CV1R2 (which have the upper core 

support plate and TAF as the bottom) and CV7R8 (which have the upper core support plate and TAF as 

the top) stay nearly full. Being nearly full, they should be considered to deeply cover the core. 

Nevertheless, a control function, included in the SNL-prepared deck for evaluating the “water level below 

TAF” core damage surrogate, indicates this condition at this time (i.e., ~12.3 hours). This built-in control 

function has been defined by summing the heights of stacked water columns only up through CV7R8, 

whose tops are the TAF. This control function indicates at this time because of actually rather small gas 

volumes that develop in CV7R8 after RCP trip. The present analysis introduces a measure of water level 

that sums up column heights up through and including CV1R4 (i.e., almost to the top of the RPV). 

According to this measure, the (ring-dependent) water levels stay above the TAF until about 35 hours. 

Figure B.1.1.6a shows the so-defined levels. These levels stay fairly constant at about 8 m from 12.3 to 

33 hours (TAF is at 6.72 m). Note that there are flow paths through the upper core support plate, so it is 

reasonable to credit water above the plate as covering the TAF. The level measure that sums water 

column heights up through CV1R4 is adopted in this analysis to redefine the “water level below TAF” core 

300

600

900

1200

1500

1800

2100

0 5 10 15 20 25 30 35 40

time [hr]

Temperature [K]

Ring 1

Ring 2

Ring 3

Ring 4

Ring 5

End calculation (3000F = 1922K)

U-H Transition (1853K)

2500F (1644.3K)

2200F (1477.6K)

1200F (922.04K)
B-13

damage surrogate, since times of core damage obtained with this level measure are in much better 

agreement with those obtained with the other surrogates than are the times defined by the built-in “level 

below TAF” control function. The condition is considered to be satisfied when the lowest ring-dependent 

level is below the TAF, although in fact the levels defined by different rings are similar (Figure B.1.1.6a).

Figure B.1.1.6b shows the water level in the pressurizer. Even though it is completely full during the time 

from 6.1 to 8.4 hours, no liquid outflow through the pressurizer SRVs or PORVs occurs, because the 

pressure remains below the opening setpoints of all of these valves at all times during the calculation. 

The lowest opening pressure is 16.2 MPa for PORV-1.

After the RCPs trip, the natural-circulation RCS coolant flow rate in loop A (whose steam generator is the 

faulted one) is much greater than in the other loops. As a result, cooling is provided predominately by 

steam generator A. While steam generator B and steam generator C levels stay approximately constant 

and above the AFW target, the water level of steam generator A falls until the motor-driven AFW starts at 

14.27 hours, in this loop only. Injection continues from this time and the water level of steam generator A 

is controlled to about 23 m until 27.83 hours, when the AFW source (i.e., the CST, credited to supply 

96,000 gallons) is depleted. The water level of steam generator A then falls and dryout occurs at about 

31.0 hours. The TAF uncovers, first in ring 5 at 34.67 hours. Rapid increase of the core exit temperature 

(CET) defined by the vapor temperatures in control volumes CV1R2 (see Figure B.1.1.7) starts at about 

36.6 hours. Oxidation of Zircaloy in the core starts at about 36.9 hours. At 37.13 hours, the steam 

generator C PORV begins to cycle and the steam generator C water level begins to drop. This provides 

some cooling that lowers the vessel pressure but is insufficient to stop the rapid heatup. The “CET above 

1,200 oF (922 K)” core damage surrogate is met at 37.40 hours. A control function automatically stops the 

calculation when the peak cladding temperature (Figure B.1.1.8) has persisted above 3,000 oF for 30 

seconds, which occurs at 38.15 hours in this base-case calculation. 

B.2.2.2 Results of Case B.2 (5-Tube Rupture)

Figures B.1.2.1 through B.1.2.5 show the results of calculations for this case. The larger break 

depressurizes the RCS and results in a lower RCS pressure relative to Case B.1 (the base case). The 

HHSI rate is therefore higher and causes an earlier depletion of the RWST at 4.40 hours. Additionally, a 

small amount of water is drawn and injected by the LHSI system. Containment sprays do not actuate. 

After the RCPs trip (loop C at 4.58 hours and loops A and B at 4.87 hours), the natural circulation of 

coolant is much greater in loop A than in the other loops. Therefore, steam generator A supplies cooling 

and receives motor-driven AFW until depletion of the CST at 18.27 hours. The core begins to uncover at 

22 hours, oxidation of the core begins at about 22.6 hours, and the calculation is terminated at 23.11 

hours because the PCT is in excess of 3,000 oF.
B-14

Figure B.1.2.1 Primary RCS Pressure (Case B.2)

Figure B.1.2.2 Cumulative Safety Injections and Sprays (Case B.2)

0

2

4

6

8

10

12

14

16

0 10 20 30 40

time [hr]

Pressure [MPa]

Pressurizer

0

200

400

600

800

1000

1200

1400

0 10 20 30 40

time [hr]

Cumulative Injection [m^3]

RWST Capacity

CFVALU.220 , HHSI

CFVALU.217 , LHSI

CFVALU.808 , Sprays

Sum
B-15

Figure B.1.2.3 Steam Generator Downcomer Water Levels (Case B.2)

Figure B.1.2.4 Core Exit Temperature (Case B.2)

10

15

20

25

30

0 10 20 30 40

time [hr]

Collapsed Level [m]

SG-A

SG-B

SG-C

AFW target

300

600

900

1200

1500

0 5 10 15 20 25 30 35 40

time [hr]

Temperature [K]

Ring 1

Ring 2

Ring 3

Ring 4

Ring 5

1200F (922.04 K)
B-16

Figure B.1.2.5 Peak Cladding Temperature (Case B.2)

B.2.2.3 Results of Case B.3 (Half-Tube Rupture)

Figures B.1.3.1 through B.1.3.5 show the results of calculations for this case. The small break affords no 

depressurization of the RCS. Consequently, shortly after the operator action at 17.88 minutes (when the 

HHSI is reduced and AFW is stopped), pressurizer PORV-1 opens (19.5 minutes). PORV-1 then 

becomes stuck in the open position at 1.06 hours after cycling 495 times. Consequently, the containment 

pressurizes and attains the setpoint for spray actuation at 3.20 hours. The extra draw on the RWST, 

relative to the base case in which the sprays do not actuate, results in an earlier depletion of the RWST at 

3.55 hours. The RCPs trip simultaneously at 4.24 hours. The break flows become negative after about 

4.9 hours, due to the primary pressure falling below the pressure in steam generator A. These backflows 

into the primary system disrupt the natural circulation around loop A that had previously provided cooling. 

Also, there is no natural liquid circulation around the other loops. Therefore, the steam generators cannot 

provide any cooling. The calculation ends with the CST not exhausted but with no demand for AFW. The 

core begins to uncover at 6.65 hours, oxidation of the core begins at about 7.1 hours, and the calculation 

is terminated at 7.91 hours because of a PCT in excess of 1922 K (3,000 oF).

300

600

900

1200

1500

1800

2100

0 5 10 15 20 25 30 35 40

time [hr]

Temperature [K]

Ring 1

Ring 2

Ring 3

Ring 4

Ring 5

End calculation (3000F = 1922K)

U-H Transition (1853K)

2500F (1644.3K)

2200F (1477.6K)

1200F (922.04K)
B-17

Figure B.1.3.1 Pressures (Case B.3)

Figure B.1.3.2 Cumulative Safety Injections and Sprays (Case B.3)

0

5

10

15

20

0 2 4 6 8 10

time [hr]

Pressure [MPa]

0.00

0.06

0.12

0.18

0.24

Pressure [MPa]

Pressurizer

SG-A

SG-B

SG-C

Containment (right axis)

0

200

400

600

800

1000

1200

1400

0 2 4 6 8 10

time [hr]

Cumulative Injection [m^3]

RWST Capacity

CFVALU.220 , HHSI

CFVALU.217 , LHSI

CFVALU.808 , Sprays

Sum
B-18

Figure B.1.3.3 Steam Generator Downcomer Water Levels (Case B.3)

Figure B.1.3.4 Core Exit Temperature (Case B.3)

10

15

20

25

30

0 2 4 6 8 10

time [hr]

Collapsed Level [m]

SG-A

SG-B

SG-C

AFW target

300

600

900

1200

1500

0 2 4 6 8 10

time [hr]

Temperature [K]

Ring 1

Ring 2

Ring 3

Ring 4

Ring 5

1200F (922.04 K)
B-19

Figure B.1.3.5 Peak Cladding Temperature (Case B.3)

B.2.2.4 Results of Case B.4 (Additional RWST Inventory)

Figures B.1.4.1 and B.1.4.2 show the results of the calculations for this case, which uses the maximum 

value rather than the technical specification value for the initial water inventory of the RWST. This makes 

1,260 m3 of water available rather than the base-case value of 1,215 m3

. Progression of the accident is 

very similar to that of Case B.1. The core begins to uncover at 35.17 hours, oxidation of the core begins 

at about 37.4 hours, and the calculation is terminated at 38.68 hours because of PCT in excess of 1922 K 

(3,000 oF).

300

600

900

1200

1500

1800

2100

0 2 4 6 8 10

time [hr]

Temperature [K]

Ring 1

Ring 2

Ring 3

Ring 4

Ring 5

End calculation (3000F = 1922K)

U-H Transition (1853K)

2500F (1644.3K)

2200F (1477.6K)

1200F (922.04K)
B-20

Figure B.1.4.1 Cumulative HHSI (Case B.4)

Figure B.1.4.2 Peak Cladding Temperature (Case B.4)

B.2.2.5 Results of Case B.5 (Reduced HHSI Availability—One Pump)

Figures B.1.5.1 through B.1.5.3 show the results of calculations for this case, which only used one HHSI 

pump. In Base Case B.1, three pumps are used until 17.88 minutes, then two are used. A comparison of 

Figure B.1.5.1 with Figure B.1.1.1 shows that during the time of the HHSI, the vessel pressure is 

significantly lower in the sensitivity case than in Case B.1. As a result, on a per-pump basis the injection 

0

200

400

600

800

1000

1200

1400

0 10 20 30 40

time [hr]

Cumulative HHSI [m^3]

CFVALU.220

300

600

900

1200

1500

1800

2100

0 5 10 15 20 25 30 35 40

time [hr]

Temperature [K]

Ring 1

Ring 2

Ring 3

Ring 4

Ring 5

End calculation (3000F = 1922K)

U-H Transition (1853K)

2500F (1644.3K)

2200F (1477.6K)

1200F (922.04K)
B-21

rate is higher in the sensitivity case. In Case B.1, the net injection rate with two pumps is typically about 

40 kg/second. In the sensitivity case, the net injection rate with one pump is typically about 30 kg/second. 

The reduced net injection rate of the sensitivity case lengthens the time to RWST depletion, but by much 

less than a factor of two that one would associate with using only half the number of pumps. Specifically 

relative to Case B.1, the time to deplete the RWST is lengthened by 3.1 hours from 8.35 hours in Case 

B.1 to 11.45 hours in Case B.5. The time to core damage is lengthened by about 4.9 hours. Qualitatively, 

the progression of the accident is very similar to that of Case B.1. The core begins to uncover at 39.30 

hours, oxidation of the core begins at about 41.7 hours, and the calculation is terminated at 43.03 hours 

because of a PCT in excess of 1922 K (3,000 oF).

Figure B.1.5.1 Pressures (Case B.5)

0

5

10

15

20

0 10 20 30 40 50

time [hr]

Pressure [MPa]

0.00

0.05

0.10

0.15

0.20

Pressure [MPa]

Pressurizer

SG-A

SG-B

SG-C

Containment (right axis)
B-22

Figure B.1.5.2 Cumulative HHSI (Case B.5)

Figure B.1.5.3 Peak Cladding Temperature (Case B.5)

0

200

400

600

800

1000

1200

1400

0 10 20 30 40 50

time [hr]

Cumulative HHSI [m^3]

CFVALU.220

300

600

900

1200

1500

1800

2100

0 10 20 30 40 50

time [hr]

Temperature [K]

Ring 1

Ring 2

Ring 3

Ring 4

Ring 5

End calculation (3000F = 1922K)

U-H Transition (1853K)

2500F (1644.3K)

2200F (1477.6K)

1200F (922.04K)
B-23

B.2.2.6 Results of Case B.6 (Reduced HHSI Availability—Two Pumps)

In this case, only two HHSI pumps are used. Case B.1 (the base case) used three until 17.88 minutes, 

then two. The progression of the accident is very similar to that of Case B.1. Core damage is postponed 

by about five minutes.

B.2.2.7 Results of Case B.7 (Earlier Failure in the Open Position of the Secondary PORV)

This case assumes that the loop A secondary-side PORV will become stuck in the open position after 

cycling the number of times for which the cumulative probability of valve failure is 0.15. (The probability 

for Case B.1 (the base case) is 0.50, with the result that the PORV of steam generator A will become 

stuck in the open position at 37.4 minutes.) As a result, the steam generator A PORV will become stuck 

open at 36.2 minutes. The progression of the accident differs negligibly from that of Case B.1.

B.2.2.8 Results of Case B.8 (Later Failure in the Open Position of Secondary PORV)

This case assumes that the loop A secondary-side PORV will become stuck open after cycling the 

number of times for which the cumulative probability of valve failure is 0.85. (In Case B.1 (the base case), 

the probability of valve failure is 0.50, with the result that the PORV of steam generator A will become 

stuck open at 37.4 minutes.) As a result, the steam generator A PORV will become stuck open at 39.4 

minutes. The progression of the accident differs negligibly from that of Case B.1.

B.2.2.9 Results of Case B.9 (Failure in the Open Position of Secondary PORV by Water)

This case assumes that the loop A secondary-side PORV will become stuck open if the two-phase fluid 

passes through the valve. This condition is modeled as equivalent to significant liquid standing in the 

steam line. Additionally, as in Case B.1 (base case), the PORV will become stuck open after cycling the 

number of cycles that corresponds to a 0.50 cumulative probability of becoming stuck. In Case B.1, only 

becoming stuck after excessive cycling is considered, with the result that the PORV of steam generator A 

will become stuck open at 37.4 minutes. As a result, the steam generator A PORV will become stuck in 

the present case at 33.2 minutes, due to the two-phase flow. The progression of the accident differs 

negligibly from that of Case B.1.

B.2.2.10 Results of Case B.10 (5-Tube Rupture with Earlier Failure in the Open Position of Secondary 

PORV)

This case combines the conditions of Case B.2 (the rupture of five steam generator tubes) with those of 

Case B.7 (the steam generator A PORV becomes stuck open at the number of cycles corresponding to 

the 0.15 cumulative probability of sticking). As a result, the steam generator A PORV will be stuck open at 

13.5 minutes compared with 13.8 minutes in Case B.2. The progression of the accident is very similar to 

that of Case B.2. Core damage occurs at about 18 minutes earlier than in Case B.2.

B.2.2.11 Results of Case B.11 (5-Tube Rupture with a Later Failure in the Open Position of Secondary 

PORV)

This case combines the conditions of Case B.2 (the rupture of five steam generator tubes) with those of 

Case B.8 (the steam generator A PORV becomes stuck open at the number of cycles corresponding to 

0.85 cumulative probability). As a result, the steam generator A PORV becomes stuck in the open 

position at 14.6 minutes compared with 13.8 minutes in Case B.2. The progression of the accident is very 

similar to that of Case B.2. Core damage occurs about 11 minutes earlier than in Case B.2. 

Note that relative to Case B.2, core damage occurs earlier in both Cases B.10 and B.11, although one 

case has an earlier stuck-open PORV and the other a later stuck-open PORV. However, ERI ran Case 

B.2 because SNL’s calculation was not yet complete. It is possible that a small machine dependence 
B-24

caused the ERI-run Case B.2 to reach core damage relatively late, so the SNL-run Cases B.10 and B.11 

do not bracket Case B.2.

B.2.2.12 Results of Case B.12 (Earlier Failure in the Open Position of One Pressurizer PORV)

Case B.12 was defined to consider the consequences of assuming that pressurizer PORV-1 will become 

stuck open after cycling the number of times for which the cumulative probability of valve failure is 0.15 

(instead of 0.50 as Case B.1 assumes). Because PORV1 never opens in Case B.1, all results from this 

calculation are identical to those of Case B.1.

B.2.2.13 Results of Case B.13 (Later Failure in the Open Position of One Pressurizer PORV)

Case B.13 was defined to consider the consequences of assuming that pressurizer PORV-1 will become 

stuck open after cycling the number of times for which the cumulative probability of valve failure is 0.85 

(instead of 0.50 as Case B.1 assumes). Because PORV-1 never opens in Case B.1, all results from this 

calculation are identical to those of Case B.1.

B.2.2.14 Results of Case B.14 (Failure in the Open Position of One Pressurizer PORV by Water)

Case B.14 was defined to consider the consequences of assuming that pressurizer PORV-1 will be stuck 

open when the pressurizer fills up with liquid and water passes the PORV. In fact, all results from this 

calculation are identical to those of Case B.1 (the base case) because, although the pressurizer fills 

completely during the time from 6.1 to 8.4 hours, the pressure always remains below the opening 

setpoints of all SRVs and PORVs.

B.2.2.15 Results of Case B.15 (5-Tube Rupture, with Failure in the Open Position of Secondary PORV 

by Water)

This case combines the conditions of Case B.2 (the rupture of five steam generator tubes) with those of 

Case B.9 (loop A secondary-side PORV becomes stuck open when the steam line begins to fill up with 

liquid). As a result, the steam generator A PORV becomes stuck open at 10.5 minutes compared with 

13.8 minutes in Case B.2. The progression of the accident is very similar to that of Case B.2. Core 

damage occurs about 19 minutes earlier than in Case B.2.

B.2.2.16 Results of Case B.16 (HHSI Injection Rate Controlled To Maintain the Water Level in the 

Core)

Figures B.1.16.1 through B.1.16.4 show the results of calculations for this case, which assumes that 

operators take control of the HHSI rate to maintain the level in the core in a range of 7.4 to 8.1 m (i.e., 

above the TAF at 6.72 m). Such action would be outside the EOPs (maintaining level in the pressurizer 

would be expected), but the case is included for illustrative purposes.

The control is initiated at 32.3 minutes resulting from a high water level in steam generator A. At this time, 

the core level is above the target, so the HHSI is shut off. Trips of the three RCPs occur nearly 

simultaneously at 2.88 hours. HHSI resumes with a low average rate at 8.80 hours and a more significant 

average rate at about 11.6 hours. As in Case B.1 (the base case), after the RCPs trip the coolant flow by 

natural circulation is predominately in loop A. Motor-driven AFW is supplied to steam generator A (and to 

steam generator B and steam generator C in minute amounts) until the CST is exhausted at 9.77 hours. 

Dryout of steam generator A occurs at about 12.3 hours. Ongoing HHSI keeps the core covered and cool.

Relative to Case B.1, the level-dependent HHSI control substantially reduces the average HHSI rate, so 

the RWST is still not depleted as of 72 hours. By extrapolation, it will deplete at about 88 hours. Thus, 

core damage is avoided in this case, at least to times in excess of 72 hours.
B-25

Figure B.1.16.1 Water Level in the Core (Case B.16)

Figure B.1.16.2 Cumulative HHSI (Case B.16)

0

2

4

6

8

10

12

0 10 20 30 40 50 60 70 80

time [hr]

Water Level [m]

Ring 1

Ring 2

Ring 3

Ring 4

Ring 5

TAF

2/3 AF

1/3 AF

BAF

0

200

400

600

800

1000

1200

1400

0 20 40 60 80

time [hr]

Cumulative HHSI [m^3]

CFVALU.220

RWST Capacity
B-26

Figure B.1.16.3 Coolant Flow through the Cold Legs (Case B.16)

Figure B.1.16.4 Steam Generator Downcomer Water Levels (Case B.16)

-1000

0

1000

2000

3000

4000

5000

0 10 20 30 40 50 60 70 80

time [hr]

Liquid Mass Flow Rate [kg/s]

Loop A

Loop B

Loop C

10

15

20

25

30

0 20 40 60 80

time [hr]

Collapsed Level [m]

SG-A

SG-B

SG-C

AFW target
B-27

B.2.2.17 Results of Case B.17 (Controlled HHSI with One Open Pressurizer PORV) 

Figures B.1.17.1 through B.1.17.3 show the results of calculations for this case. This case adds the 

opening of pressurizer PORV-1 to the level-dependent control of the HHSI rate described in Section 

B.2.2.16. Actuation of PORV-1 takes place at the same time and condition (32.3 minutes due to high 

water level in steam generator A), when the injection control is initiated. Opening the PORV is a

preparatory step for B&F (error of commission for the prescribed conditions given that the B&F criteria 

would not be expected), but as in all of the SGTR scenarios, a switchover to the ECCS recirculation 

modes is not available. 

As a consequence of the open PORV, the containment pressurizes and attains the setpoint for spray 

actuation at 3.36 hours. The primary pressure, however, is never reduced to below the maximum primary 

pressure of 1.18 MPa that allows the LHSI. The extra draw on the RWST from the sprays relative to Case 

B.1 (the base case) in which the sprays do not actuate, results in an earlier depletion of the RWST at 3.99 

hours. 

The RCPs trip nearly simultaneously at 56.8 minutes. The break flows become negative after about 1.5 

hours. After that, there is no primary natural liquid circulation around loop A (or any other loop). 

Therefore, the steam generators cannot provide any cooling. The calculation ends at 6.86 hours because 

of a peak cladding temperature above 3,000 oF) with AFW still being supplied to the steam generators of 

loops A and C. 

Figure B.1.17.1 Pressures (Case B.17)

0

5

10

15

20

0 2 4 6 8

time [hr]

Pressure [MPa]

0.00

0.08

0.16

0.24

0.32

Pressure [MPa]

Pressurizer

SG-A

SG-B

SG-C

Containment (right axis)
B-28

Figure B.1.17.2 Cumulative Safety Injections and Sprays (Case B.17)

Figure B.1.17.3 Water Levels in the Core (Case B.17)

0

200

400

600

800

1000

1200

1400

0 2 4 6 8

time [hr]

Cumulative Injection [m^3]

RWST Capacity

CFVALU.220 , HHSI

CFVALU.217 , LHSI

CFVALU.808 , Sprays

Sum

0

2

4

6

8

10

12

0 1 2 3 4 5 6 7 8

time [hr]

Water Level [m]

Ring 1

Ring 2

Ring 3

Ring 4

Ring 5

TAF

2/3 AF

1/3 AF

BAF
B-29

B.2.2.18 Results of Case B.18 (Controlled HHSI with Two Open Pressurizer PORVs) 

Figures B.1.18.1 through B.1.18.3 show the results of calculations for this case. This case is similar to 

Case B.17 except operators open both PORV-1 and PORV-2. Again, the case is included for illustrative 

purposes. The accident progression is qualitatively similar to that of Case B.17. Spray actuation occurs at 

2.12 hours; RWST depletion occurs at 2.77 hours; and the RCPs trip at 44.7 minutes. The calculation 

ends at 5.36 hours due to a peak cladding temperature above 3,000 oF, with AFW still being supplied to 

steam generator A.

Figure B.1.18.1 Pressures (Case B.18)

Figure B.1.18.2 Cumulative Safety Injections and Sprays (Case B.18)

0

5

10

15

20

0 2 4 6 8

time [hr]

Pressure [MPa]

0.00

0.08

0.16

0.24

0.32

Pressure [MPa]

Pressurizer

SG-A

SG-B

SG-C

Containment (right axis)

0

200

400

600

800

1000

1200

1400

0 2 4 6 8

time [hr]

Cumulative Injection [m^3]

RWST Capacity

CFVALU.220 , HHSI

CFVALU.217 , LHSI

CFVALU.808 , Sprays

Sum
B-30

Figure B.1.18.3 Water Levels in the Core (Case B.18)

B.2.2.19 Results of Case B.19 (Controlled HHSI with One Open Pressurizer PORV, and an Available 

RHR)

The assumptions of this case are identical to those of Case B.17 except that the RHR was declared 

unavailable in all previous cases, but it is available here. This system draws water from a hot leg, passes 

it through a heat exchanger, and re-injects it into two cold legs. This system may start up only if the 

average temperature of the liquid in the vessel is below 450 K. Since this condition is not achieved in 

Case B.17, the results of Case B.19 are identical to those of Case B.17. Again, the case is included for 

illustrative purposes.

B.2.2.20 Results of Case B.20 (Controlled HHSI with Two Open Pressurizer PORVs and an Available 

RHR)

The assumptions for this case are identical to those of Case B.18, except that RHR is available here. This 

system draws water from a hot leg, passes it through a heat exchanger, and re-injects it into two cold 

legs. This system may start up only if the average temperature of liquid in the vessel is below 450 K; 

Case B.18 does not achieve this condition. The minimum vessel liquid reached in Case B.20 is 479 K. 

Case B.19 misses the permissive temperature even more widely. The results of Case B.20 are therefore 

identical to those of Case B.18. Again, the case is included for illustrative purposes.

B.2.2.21 Results of Case B.21 (Alternative Correlation for Oxidation Reaction Rate Coefficients)

This case differs from Case B.1 (the base case) only by the use of the Prater and Courtright correlation 

for the temperature-dependent rate coefficient that describes the kinetics of the reaction in which 

zirconium is oxidized by steam. All other calculations use the MELCOR default (i.e., the Urbanic and 

Heidrick correlation). The accident progression is very similar to that of Case B.1. The success criterion of 

hydrogen production attaining 1 percent of the amount that corresponds to steam oxidation of the wholecore zirconium inventory is met at 38.00 hours in Case B.21, versus 37.63 hours in Case B.1. The end of 

the calculation, due to PCT exceeding 3,000 °F (1,922 K), occurs at 38.22 hours, versus 38.15 hours in 

Case B.1.

0

2

4

6

8

10

12

0 1 2 3 4 5 6 7 8

time [hr]

Water Level [m]

Ring 1

Ring 2

Ring 3

Ring 4

Ring 5

TAF

2/3 AF

1/3 AF

BAF
B-31

B.2.3 Summary: SGTR-9 Scenario

In the base-case scenario (Case B.1), core damage occurs at about 38 hours (e.g., 37.90 hours 

according to the surrogate measure that identifies core damage with the peak cladding temperature 

(PCT) exceeding 2,200 °F (1,478 K). 

Core damage is much earlier (5.1 to 7.8 hours by the PCT >2,200 °F [1,478 K] measure) in the sensitivity 

cases that lead to a stuck-open or held-open pressurizer PORV. A stuck-open PORV occurs in the halftube break case (Case B.3), because the small break does not depressurize the vessel, thus leading to 

excessive PORV cycling. Held-open PORVs are assumed in several cases (Cases B.17 through B.20) as 

one of the conditions that would be established by operators as part of initiating B&F (an error of 

commission for the prescribed conditions). Whether the PORVs are stuck open or held open, the resulting 

steam flow to the containment actuates the sprays and consequently, depletes the RWST more quickly.

The sensitivity cases that result in actual reduction of the HHS injection rate (i.e., Cases B.5, B.6, and 

B.16) lead to longer times to core damage because depletion of the RWST is postponed. Note that Cases 

B.17 through B.20 are not included in this category. Although water-level-dependent control of HHSI is 

credited in these cases, the injection rate tends to be higher than in the base case because these cases 

also call for held-open PORV(s). 

The one case in which core damage is avoided (i.e., Case B.16, as of 72 hours) assumes that no more 

HHSI occurs than is required to maintain core water level somewhat above the TAF (included for 

illustrative purposes). 

The cases that consider a five-tube break (i.e., Cases B.2, B.10, B.11, and B.15) give intermediate times 

(around 23 hours) because of lower vessel pressures relative to the base case, thus leading to higher 

HHSI rates and earlier RWST depletion.

These results show that specific boundary condition assignments dominate the sources of variability for 

the analyzed scenario. These include the number of tubes ruptured, operator action to initiate B&F, and 

operator action to maintain core water level just above the TAF to conserve the RWST inventory. The 

importance of the latter two specific items is dominated by the scenario assumption that recirculation is 

unavailable. As such, the key conclusion is that specific boundary condition assignments drive the results, 

and which specific boundary condition assignments are important depends on the specifics of the 

scenario. This is in contrast to a situation where all boundary condition specifications contribute relatively 

equally to result variability.

The times to core damage range from 4.20 to 43.03 hours, depending on the sensitivity case and on the 

core damage surrogate measure. This range excludes one sensitivity case (Case B.16, with successful 

operator initiation of water-level-dependent control of HHSI), in which no core damage is indicated as of 

72 hours.

With very few exceptions, the order in which the various surrogate measures indicate core damage is 

independent of the sensitivity case. In most cases, the final measure of PCT above 3,000 °F (1,922K) is 

indicated around two hours after one-third of the core is uncovered.

In summary, Table B.4 compares the 21 cases with respect to certain events in the accident progression. 

A comparison of the times of core damage according to various surrogate measures appears in Section 

4.2 of the main report.
B-32

Table B.4 Comparison of Times of Events (in Hours) among SGTR Base and Sensitivity Calculations

Case

Flooding(1)

of SG in 

loop A

RWST 

Depleted

RCP Trip

(A, B, C)(2)

Restart of 

AFW to SG 

in loop A

CST 

Depleted

Dryout(3)

of SG in 

loop A

Core 

Water 

Level at 

TAF

Calculation End 

Time (4)

B.1

(Base) 0.52 8.35 12.32 14.27 27.83 31.0 34.67 38.15

B.2 0.17 4.40 4.87, 4.87, 

4.58 7.75 18.27 {11.87} 22.00 23.11

B.3 Does not 

occur

3.56 4.23 Does not occur {25.10} 6.65 7.91

B.4 0.52 8.67 12.63 4.35 28.33 31.4 35.17 38.68

B.5 0.67 11.37 14.97 18.33 32.12 35.4 39.30 43.03

B.6 0.56 8.40 12.33 14.30 27.90 30.9 34.73 38.22

B.7 0.52 8.37 12.27 14.30 27.87 30.8 34.67 38.16

B.8 0.52 8.37 12.3 14.30 27.87 30.9 34.67 38.18

B.9 0.52 8.33 12.27 14.27 27.83 30.8 34.63 38.13

B.10 0.17 4.42 4.97, 4.95, 

4.95 7.43 18.00 {11.88} 21.70 22.82

B.11 0.17 4.42 4.95 7.48 18.10 {11.88} 21.80 22.92

B.12 –

B.14 Same as Case B.1

B.15 0.17 4.40 4.85, 4.53, 

4.85 7.45 17.97 {11.88} 21.67 22.79

B.166 0.52 ~88(5) 2.87 1.26 9.77 12.2 > 72.00 72.00

B.176 0.52 3.99 0.94 3.97 Does not 

occur

{23.27} 5.38 6.86

B.186 0.52 2.77 0.74 2.34 {23.28} 4.20 5.36

B.196 Same as case B.17

B.206 Same as case B.18

B.21 0.52 8.37 12.30 14.27 27.83 30.8 34.67 38.22 1 Defined as the earliest time when liquid passes the steam generator outlet (FL283). 2 Only one time is tabulated if the three pumps trip nearly simultaneously. 3 In cases where dryout does not occur, the final downcomer water level is tabulated in braces. (Dryout 

corresponds to 11.20 m.) 4 Calculations end when peak cladding temperature exceeds 3,000 oF, except for Case 16. 5 Extrapolation. 6 Cases for controlling HHSI above TAF (i.e., below the normal pressurizer level) and B&F are counter to EOPs for 

the prescribed conditions. They are included for illustrative purposes, though they could be viewed as 

representing errors of commission.

B.3 Reference

B.1 R. Chang, J. Schaperow, T. Ghosh, J. Barr, C. Tinkler, and M. Stutzke, “State-of-the-Art Reactor 

Consequence Analyses (SOARCA) Report,” U. S. Nuclear Regulatory Commission, NUREG–

1935 (January 2012).
C-1

APPENDIX C: DETAILS OF PEACH BOTTOM SBO ANALYSIS

C.1 Introduction

C.1.1 Background

The Peach Bottom plant and its MELCOR model are described in Section 2.3 of the main report. The 

SNL Peach Bottom model documentation provides a more detailed description of the model. This 

Appendix highlights details of the calculations performed at ERI using the Peach Bottom model25.

C.1.2 Objectives and Scope

The objectives of this Appendix are to document the calculations specific to the Peach Bottom plant that 

encompass detailed results for the basic scenario and its sensitivity cases. These simulations are limited 

in scope to considerations important for determining the relevant PRA level-1 system success criteria and 

sequence timing.

C.1.3 Outline

Section C.2 is devoted to results that describe one basic scenario consisting of an SBO with the RCIC 

operational until batteries are depleted. Section C.2 defines the scenario and its sensitivity cases. 

Detailed results specific to the base and sensitivity cases appear in subsections of Section C.2.2. 

Summary results pertaining to all cases are in Section C.2.3. These summary results are also in Section 

3.3 of the main report. 

All detailed results are in the subsections of Section C.2.2. Each subsection pertains to a particular base 

or sensitivity case. To simplify the Figure numbering, a four-character code is used within these 

subsections, according to the numbering scheme defined in the previous Appendices. After “C,” which 

designates Peach Bottom, the next character numbers the scenario; in the case of Peach Bottom, there is 

only one scenario. The character after that numbers the sensitivity case; the base case is counted as the 

first case. The last character in the string is the count among the Figures that apply to a given sensitivity 

case of a given scenario. For example, the first figure in the second sensitivity case that pertains to the 

SBO with RCIC scenario is Figure C.1.2.1. Figures not pertaining to a specific scenario and sensitivity 

case are not numerous, and are designated by a two-character code. The first character denotes Peach 

Bottom, and the second character is a count over the Appendix. A similar two-character code is used for 

all the Tables.

C.2 Accident Scenario and Results

C.2.1 SBO with RCIC Operation until Battery Depletion

The transient initiator is a loss of all onsite power, except for batteries that are credited to support only the 

operation of the RCIC system. Table C.1 tabulates the assumptions that define the scenario. No system 

is credited to function except the RCIC, which is available until 8 hours, the assumed time that the 

batteries will be depleted. Due to the loss of all AC power, RHR pumps, low-pressure core sprays, and 

service water are not available; and FW, recirculation pumps, and the CRD hydraulic system fail at the 

 25 As mentioned in Section 2, it was discovered after completion of the analyses that the value used for the highvessel-level shutoff of RCIC in automatic control is lower than the actual value by 10 inches (0.25 m). This deviation 

has an effect similar to Case C.8 which looks at a different RCIC pump curve, in that it affects the duration and 

frequency of RCIC duties while dc power is available, and thus the vessel level at the assumed time of battery 

depletion. Case C.8 showed a modest change in accident timing. To evaluate the effect of this setpoint deviation, 

Case 1 has been rerun with the correct setpoint. Relative to the results of Case 1 as documented below (with the low 

setpoint), with corrected setpoint the end of the last RCIC duty cycle occurs 0.65 hours later, and core damage 

(identified with the PCT exceeding 1478K) occurs 0.97 hours later.
C-2

start of the transient. These last three systems do, however, operate during the pre-transient steady state, 

whose duration is 120 seconds. It is assumed that the Automatic Depressurization System (ADS) is 

unavailable because of the power loss or, alternatively, because operators act to inhibit ADS activation 

since the RCIC is to be used. The SRVs are assumed to cycle at their actuation setpoint indefinitely, 

assuming that the SRVs will not fail while cycling.

Table C.1 Assumptions Applicable to SBOs with the RCIC Operating until Battery Depletion 

Reactor Coolant 

System

Relief valves are allowed to cycle indefinitely without failing. (A sensitivity case 

considers one stuck-open relief valve.)

ECCS None available except RCIC.

Operator Actions Operators are assumed to act to inhibit automatic depressurization. A sensitivity 

case considers operator control of RCIC.

Other

Batteries deplete at 8 hours, failing the RCIC. Sensitivity cases consider other 

battery depletion times. Another case considers that the RCIC may continue to 

run in an uncontrolled mode after battery depletion.

The 8-hour battery depletion time may be characterized as representing the beginning-of-battery-life 

value or the value that describes mid-battery-life with effective load shedding. Also note that 8 hours is 

the Peach Bottom SBO coping time given in NUREG–1776, though this is a coincidence and not part of 

the sequence definition given that the licensing-basis coping time involves the use of alternate alternating 

current after 1 hour, whereas here the sequence being modeled is one where the operators fail to set up 

the alternate alternating current source within the required time (or it is unavailable) [C.1]. Moreover, the 

8-hour battery depletion time makes the calculation a hybrid between the following two SPAR sequences:

• LOOP-xx-39-30 with a core damage frequency of approximately 10-8 per year; 2-hour battery 

depletion time.

• LOOP-xx-39-9 representing successful operator actions to extend the RCIC operation beyond 

battery depletion. This is a non-minimal sequence in the base model because the action is 

assumed to fail. This sequence also includes failure branches for containment venting and late 

injection.

These remarks are based on the v8.19 (March 2011) version of the Peach Bottom 2 SPAR model.

The assumption that the SRVs do not become stuck-open is made because the relevant sequence 

(LOOPxx-39-59-6) is roughly two orders of magnitude lower in frequency than the one mentioned above. 

However, a sensitivity case considers the implication of failure of one SRV in open position following 

repeated cycling.

As described in Section 2.3 of the main report, the model includes automatic and manual modes for the 

RCIC. In the automatic mode and while there is power, the RCIC turns on and off between low and high 

vessel water levels with a 2.8 m deadband. While on, it pumps at the maximum rate. If the RCIC mode is 

specified as automatic, it stops pumping upon loss of power, which in this scenario occurs at 8 hours due 

to battery depletion. In the manual mode, while there is power, operators throttle the pump so that it 

operates continuously at a variable rate, thus maintaining a constant water level. If the RCIC mode is 

specified as manual, after battery depletion the RCIC turbine/pump operation continues at the speed it 

had when the batteries became depleted. The base case supposes that the RCIC mode is automatic. 

Hence, RCIC injection stops at 8 hours in the base case. A sensitivity case assumes that the RCIC mode 

is manual, which allows it to continue to run until it trips on one of the conditions described in Section 2.3 

of the main report.
C-3

To investigate the variability of the predictions, ten sensitivity cases are defined in addition to the base 

case. The highlighted entries in Table C.2 show how each sensitivity case differs from the base case as 

follows: 

• Case C.1 is the base case. The automatic mode is specified for the RCIC; hence, it fails at 8 hours 

because of depleted batteries.

• Case C.2 specifies the manual mode for the RCIC, allowing it to run on after 8 hours at a fixed rate 

until tripped by other conditions.

• Case C.3 repeats the base case, except that it assumes that the lowest-setpoint SRV (FL359) 

becomes stuck open after excessive cycling.

• Cases C.4 and C.5 repeat the assumptions of the base case, but with 2 and 5 hours as the battery 

depletion time, respectively.

• Case C.6 repeats the base case, but supposes that the event occurs while the reactor is operating at 

90% power. The decay heat is scaled relative to the base case.

• Case C.7 supposes that the lowest-setpoint SRV (FL359) may not open. Otherwise, Case C.7 is 

similar the base case.

• Case C.8 reduces the maximum RCIC flow rate to 90% of its base-case value.

• Case C.9 decreases the flow losses and the momentum exchange length, in the flow paths that 

model the two SRVs with the lowest opening pressures.

• Case C.10 applies a factor of 0.8 to the built-in correlation for the heat transfer coefficients that apply 

to the nucleate boiling curve for pool boiling and the transition boiling curve for film boiling.

• Case C.11 sets the initial temperature of the CST to 283 K; other calculations use 300 K.

The base-case calculation for the SBO with the RCIC operation until battery depletion is described in 

detail in Section C.2.2.1. Sections C.2.2.2 through C.2.2.11 describe the sensitivity calculations, typically 

in less detail. Summary discussion pertaining to this scenario appears in Section C.2.3 (which also 

appears in the main report).
C-4

Table C.2 Sensitivity Cases for Peach Bottom SBO with RCIC Operation until the Battery Depletion

Case RCIC 

Mode(1)

SRVs Are 

Stuck 

Open(2)

Battery 

Depletion 

Time, 

Hours

Factor for 

Decay 

Heat (3)

Number of 

Unavailable 

SRVs(4)

Factor for 

RCIC Flow 

Rate(5)

SRV 

Parameters(6)

F

Po

C.1

(Base) Automatic No 8 1.0 0 1.0 Base 

C.2 Manual No 8 1.0 0 1.0 Base 

C.3 Automatic Yes 8 1.0 0 1.0 Base 

C.4 Automatic No 2 1.0 0 1.0 Base 

C.5 Automatic No 5 1.0 0 1.0 Base 

C.6 Automatic No 8 0.9 0 1.0 Base 

C.7 Automatic No 8 1.0 1 1.0 Base 

C.8 Automatic No 8 1.0 0 0.9 Base 

C.9 Automatic No 8 1.0 0 1.0 See note (6) 

C.10 Automatic No 8 1.0 0 1.0 Base 

C.11 Automatic No 8 1.0 0 1.0 Base 

1 In automatic mode, RCIC stops when batteries deplete. In Case C.2, manual mode is specified, allowing RCIC to run on at a 

depletion. 2 In Case C.3, the SRV of lowest opening pressure (FL359) is stuck open after cycling 187 times. 3 In Case C.6, a factor of 0.9 is applied to the base-case decay heat curve. This factor models occurrence of the transient while t

power. 4 In Case C.7, the SRV of lowest opening pressure (FL359) is assumed to be unavailable to open. 5 In Case C.8, the base-case RCIC maximum flow rate, 37.7 kg/s, is reduced to 34.0 kg/s. 6 The parameters considered are K-loss and choked flow discharge coefficients, and the momentum exchange length. The base-ca

17.9 m, respectively. In case C.9, the respective values are 3.0, 1.5, and 0.5 m. 7 In Case C.10, a factor of 0.8 is applied to the built-in correlations for pool and film boiling heat transfer coefficients.
C-5

C.2.2 Results

C.2.2.1 Results of Case C.1 (Base Case)

The key events for this scenario are listed in Table C.3 and illustrated in Figures C.1.1.1 to C.1.1.4.

Table C.3 Timing of Key Events in the Base-Case Calculation

Event Description Time (hours)

Loss of onsite power except for batteries; trip of reactor, feedwater, 

recirculation pumps, and CRD hydraulic system 0 s

Beginning of first (of four) RCIC duties 0.18 (10.5 minutes)

End of last (of four) RCIC duties 7.1

Battery depletion (RCIC becomes unavailable) 8.0

Start of core uncovery 9.6

Core-exit coolant exceeds 922 K (1,200 °F) 10.44

Maximum cladding temperature exceeds 1,478 K (2200 °F) 10.99

End of calculation 11.9

Figure C.1.1.1 Water Levels in the Vessel (Case C.1)

0

2

4

6

8

10

12

14

16

0 2 4 6 8 10 12

time [hr]

Level [M]

CVH-LIQLEV.350 (separator)

Summed heights , LP, Channel R3 , Shroud Dome

TAF

BAF
C-6

Figure C.1.1.2 Injection by RCIC (Case C.1)

Figure C.1.1.3 Maximum Cladding and Core Exit Coolant Temperatures (Case C.1)

0

10

20

30

40

50

0 2 4 6 8 10 12

time [hr]

Mass Flow Rate [KG/S]

FL-MFLOW.376 (Feedwater)

FL-MFLOW.614 (Water drawn from CST by RCIC)

FL-MFLOW.606 (Water drawn from WW by RCIC)

FL-MFLOW.3.613 (RCIC turbine steam to WW)

500

1000

1500

2000

2500

3000

0 2 4 6 8 10 12

time [hr]

Temperature [K]

Cladding (maximized over core)

Coolant at core exit (maximized over radius)
C-7

Figure C.1.1.4 Containment Pressures (Case C.1)

Loss of onsite power (except for batteries) at t = 0 seconds initiates the transient after a pre-transient 

steady-state period lasting 120 seconds. The batteries are credited to support only the RCIC system, and 

they deplete at 8 hours. 

In the assumed automatic mode, RCIC turns on at low vessel water level and off at high vessel water 

level. Figure C.1.1.1 shows vessel water levels, and Figure C.1.1.2 shows the RCIC injection rate. Note 

that water pumped by the RCIC enters the vessel through MELCOR flow paths that model the FW piping. 

The figure legend labels the flow into the vessel as “Feedwater” (green curve) in reference to this 

modeled FW piping, although FW, as a system, is unavailable in this scenario. Two curves showing the 

RCIC-provided water entering the FW piping are also shown. One corresponds to a flow path coming 

from the CST; the other corresponds to a flow path coming from the wetwell. Only the first is finite in this 

calculation because depletion of the CST does not occur.

In Figure C.1.1.1, the water level in the core is defined by summing the heights of the columns of swollen 

water from the lower plenum to the shroud dome by way of the third of five computational core-region 

rings. The sum is not carried to higher levels because the top of the shroud dome control volume is higher 

than the bottom of the separator control volume. The separator is the region whose range of elevation 

contains the elevations of the RCIC control points, and its level can be considered to define the vessel 

water level until the other curve (shown in green in Figure C.1.1.1) begins to decrease, at about 9 hours. 

The RCIC control is based on the water level in the downcomer. 

The RCIC turns on for the first time at 10.5 minutes (Figure C.1.1.2). Altogether, the RCIC is on for four 

duties occurring at roughly regular intervals during the time from 10.5 minutes until 7.1 hours. The 

average duration of a duty is 45 minutes. The last duty ends at 7.1 hours. By the time another duty would 

be called for, the batteries have depleted and the RCIC cannot restart.

0.5

1.0

1.5

2.0

2.5

3.0

3.5

0 2 4 6 8 10 12

time [hr]

Pressure [bar]

CVH-P.202 (Upper DW)

CVH-P.220 (WW)
C-8

Outflows through the SRVs begin at 30 seconds. These outflows continue steadily, except during the 

times that the RCIC injects. There are 11 flow paths used to model the SRVs, but only two of them—

FL359 and FL360—ever open. Moreover, there is very little flow through FL360 after 30 minutes. At the 

end of the calculation (11.9 hours), FL359 has opened or closed 1426 times, and FL360 has opened or 

closed 48 times.

The core begins to uncover at about 9.6 hours. The temperature of the coolant at the core exit exceeds 

922 K (1,200 °F) at 10.44 hours; the first gap release is at 10.68 hours; and the maximum cladding 

temperature exceeds 1,478 K (2,200 °F) at 10.99 hours. Figure C.1.1.3 shows the core exit temperature 

and the maximum cladding temperature. Failures of the core support plate begin at 11.25 hours. The 

calculation is stopped at 11.9 hours, since gross core damage is underway.

Figure C.1.1.4 shows the pressure in the containment. The maximum temperature of water in the wetwell 

is 105 °C (this occurs at the end of the calculation). The wetwell water is always subcooled by at least 

13 K.

C.2.2.2 Results of Case C.2 (RCIC in Manual Mode)

This case assumes that the RCIC operates in manual mode, which allows it to run on after battery 

depletion until it is tripped by other conditions. The key events for this scenario are listed in Table C.4 and 

are illustrated in Figures C.1.2.1 to C.1.2.3.

Table C.4 Timing of Key Events – Case 2

Event Description Time (hours)

Loss of onsite power (except for batteries); trip of reactor, feedwater, 

recirculation pumps, CRD hydraulic system 0

Beginning of RCIC injection (at maximum rate) due to low water level 0.18 (10.5 minutes)

End of RCIC injection due to high water level 1.36

Resumption of RCIC injection with variable throttling to maintain constant 

water level (RCIC manual mode) 1.89

Battery depletion (RCIC injection rate locked in) 8.0

RCIC trip due to flooding of the main steam line 13.87

Start of core uncovery 16.9

Core-exit coolant exceeds 922 K (1,200 °F) 17.92

Maximum cladding temperature exceeds 1,478 K (2,200 °F) 18.57

End of calculation 20.0
C-9

Figure C.1.2.1 Injection by RCIC (Case C.2)

Figure C.1.2.2 Water Levels in the Vessel (Case C.2)

0

10

20

30

40

50

0 5 10 15 20

time [hr]

Mass Flow Rate [KG/S]

FL-MFLOW.376 (Feedwater)

FL-MFLOW.614 (Water drawn from CST by RCIC)

FL-MFLOW.606 (Water drawn from WW by RCIC)

FL-MFLOW.3.613 (RCIC turbine steam to WW)

0

2

4

6

8

10

12

14

16

18

0 5 10 15 20

time [hr]

Level [M]

Summed heights, Separator and Steam Dome

Summed heights , LP, Channel R3 , Shroud Dome

TAF

BAF
C-10

Figure C.1.2.3 Maximum Cladding and Core Exit Coolant Temperatures (Case C.2)

The RCIC manual mode versus the automatic mode, as represented in the model need some discussion. 

In automatic mode, the RCIC runs only at full speed but turns on and off between wide water level limits. 

In manual mode, on the other hand, before battery depletion, operators throttle the RCIC so that it runs 

continuously at a variable rate and maintains a constant level in the vessel. However, the logic specified 

by the model causes the first RCIC activity to be as if the mode were automatic, regardless of the mode 

specified by the user. That is, the first RCIC startup occurs on low level, and the RCIC runs at full speed 

until it shuts off on high level. The RCIC startup with throttling begins subsequently, as the falling level 

approaches the level that operators are assumed to maintain when they operate the RCIC manually.

Switching the user-specified mode from automatic to manual during the transient is not considered, for 

the following reason. The manual throttling is implemented in the model using a look-up table that sets 

the RCIC injection rate as a linearly decreasing function of water level. The assumption is that in the 

manual mode following a battery depletion, the RCIC maintains the rate it had at the instant the battery 

was depleted. This assumption makes the water level a controlling variable for the RCIC injection rate at 

all times after the depletion. If manual operation had been in effect only for a short time after the switch 

from a hypothetical period of automatic operation, the water level could be any value within the 

deadband. Assuming that the manual mode was in effect from the start of the transient ensures that at 

the time of battery depletion, the level will remain under control near the value that yields a quasi-steady 

state, wherein the RCIC injection rate equals the boil-off rate. After battery depletion, this RCIC injection 

rate will be locked in, but it will continue to equal the boil-off rate, at least approximately, for some time. 

This condition/assumption will apply only if the transient is not so short that the time of RCIC throttling is 

never reached.

Figure C.1.2.1 depicts the RCIC injection rate. The period of a throttled RCIC injection begins at 1.89 

hours. After battery depletion at 8 hours, the RCIC holds the rate it had at 8 hours. Because this rate 

exceeds the boil-off rate as the decay heat decreases, the level in the vessel rises (see Figure C.1.2.2). 

The steam line floods at 13.87 hours, which trips the RCIC and makes it unavailable for the rest of the 

scenario. Other RCIC trip conditions, which are listed in Section 2.3 of the main report, include a high 

500

1000

1500

2000

2500

3000

0 5 10 15 20

time [hr]

Temperature [K]

Cladding (maximized over core)

Coolant at core exit (maximized over radius)
C-11

turbine exhaust pressure and a pump bearing failure. These conditions have not yet been attained at the 

time of the trip due to flooding. Note that the MELCOR model does not account for the effect of RCIC 

room heatup on pump bearing temperature.

The core begins to uncover at about 16.9 hours. The temperature of the coolant at the core exit exceeds 

922 K (1,200 °F) at 17.92 hours. The first gap release is at 18.20 hours, and the maximum cladding 

temperature exceeds 1,478 K (2,200 °F) at 18.57 hours. Figure C.1.2.3 shows the core exit temperature 

and the maximum cladding temperature. Failures of the core support plate begin at 18.87 hours. The 

calculation is stopped at 20 hours because gross core damage is underway. 

C.2.2.3 Results of Case C.3 (One Stuck-Open SRV)

This case repeats the base case (C.1), except that it assumes that the lowest setpoint SRV (FL359) is 

stuck in the open position after excessive cycling. The cause of this occurrence is the 50 percent 

assumed cumulative probability of becoming stuck and a per-demand-to-close probability of 0.0037. The 

cumulative sticking probability is assumed for this calculation. The sticking probability per demand to 

close is the deck default, whose value is discussed in the SNL Peach Bottom model documentation. The 

sticking assumptions are equivalent to assuming that FL359 becomes stuck after opening 187 times. This 

event occurs at 2.45 hours. Until then, the sensitivity case is identical to the base case. 

Figure C.1.3.1 shows the vessel pressure, which falls after the SRV becomes stuck in the open position. 

At 3.88 hours, the pressure falls below 0.62 MPa and trips the RCIC. Although the pressure later recovers 

somewhat, the model assumes that the RCIC cannot be restarted.

Figure C.1.3.1 Pressure in the Reactor Pressure Vessel (Case C.3)

Figures C.1.3.2 and C.1.3.3 show the water level in the vessel and the cladding and coolant 

temperatures, respectively. The core begins to uncover at about 5.9 hours. The temperature of the 

coolant at the core exit exceeds 922 K (1,200 °F) at 6.80 hours; the first gap release is at 6.96 hours; and 

the maximum cladding temperature exceeds 1,478 K (2,200 °F) at 7.15 hours. Failures of the core 

0

2

4

6

8

0 2 4 6 8

time [hr]

Pressure [MPa]

CVH-P.360
C-12

support plate begin at 7.49 hours. The calculation is stopped at 7.6 hours, because gross core damage is 

underway.

Figure C.1.3.2 Water Levels in the Reactor Pressure Vessel (Case C.3)

Figure C.1.3.3 Maximum Cladding and Core Exit Coolant Temperatures (Case C.3)

0

2

4

6

8

10

12

14

16

0 2 4 6 8

time [hr]

Level [M]

CVH-LIQLEV.350 (separator)

Summed heights , LP, Channel R3 , Shroud Dome

TAF

BAF

0

500

1000

1500

2000

2500

3000

0 2 4 6 8

time [hr]

Temperature [K]

Cladding (maximized over core)

Coolant at core exit (maximized over radius)
C-13

C.2.2.4 Results of Case C.4 (Batteries Deplete at 2 Hours)

This case repeats the base case (C.1), except that battery depletion is assumed to occur at 2 hours 

instead of at 8 hours.

Figures C.1.4.1 through C.1.4.3 show the RCIC injection rate, vessel water level, and clad/coolant 

temperatures. The first RCIC duty ends at 1.32 hours because of the normal shutoff on high level. The 

next duty would have started at around 2.5 hours, but since that time is after the battery has depleted, 

there is no RCIC activity at any time after 1.32 hours.

The core begins to uncover at about 3.3 hours. The temperature of the coolant at the core exit exceeds 

922 K (1,200 °F) at 3.90 hours; the first gap release is at 4.05 hours; and the maximum cladding 

temperature exceeds 1,478 K (2,200 °F) at 4.27 hours. Failures of the core support plate begin at 4.43 

hours. The calculation is stopped at 5 hours, because gross core damage is underway.

Figure C.1.4.1 Injection by RCIC (Case C.4)

Regarding the figure above, the brief jump in the signature at approximately 2.5 hours corresponds to the 

uncovering of the vessel-side flow junction in the MELCOR model, and should be viewed as a numerical 

(rather than physical) event.

0

10

20

30

40

50

0 1 2 3 4 5

time [hr]

Mass Flow Rate [KG/S]

FL-MFLOW.376 (Feedwater)

FL-MFLOW.614 (Water drawn from CST by RCIC)

FL-MFLOW.606 (Water drawn from WW by RCIC)

FL-MFLOW.3.613 (RCIC turbine steam to WW)
C-14

Figure C.1.4.2 Water Levels in the Vessel (Case C.4)

Figure C.1.4.3 Maximum Cladding and Core Exit Coolant Temperatures (Case C.4)

0

2

4

6

8

10

12

14

16

0 1 2 3 4 5

time [hr]

Level [M]

CVH-LIQLEV.350 (separator)

Summed heights , LP, Channel R3 , Shroud Dome

TAF

BAF

500

1000

1500

2000

2500

3000

0 1 2 3 4 5

time [hr]

Temperature [K]

Cladding (maximized over core)

Coolant at core exit (maximized over radius)
C-15

C.2.2.5 Results of Case C.5 (Batteries Deplete at 5 Hours)

This case repeats the base case (C.1), except that battery depletion is assumed to occur at 5 hours 

instead of at 8 hours.

Figures C.1.5.1 through C.1.5.3 show the RCIC injection rate, vessel water level, and clad/coolant 

temperatures. At 5 hours, the third RCIC duty is in progress (the RCIC is injecting at the maximum rate).

The RCIC stops at this time and never starts again.

The core begins to uncover at about 6.8 hours. The temperature of the coolant at the core exit exceeds 

922 K (1,200 °F) at 7.58 hours; the first gap release is at 7.78 hours; and the maximum cladding 

temperature exceeds 1,478 K (2,200 °F) at 8.03 hours. Failures of the core support plate begin at 8.22 

hours. The calculation is stopped at 10 hours, because gross core damage is underway.

Figure C.1.5.1 Injection by RCIC (Case C.5)

0

10

20

30

40

50

0 2 4 6 8 10

time [hr]

Mass Flow Rate [KG/S]

FL-MFLOW.376 (Feedwater)

FL-MFLOW.614 (Water drawn from CST by RCIC)

FL-MFLOW.606 (Water drawn from WW by RCIC)

FL-MFLOW.3.613 (RCIC turbine steam to WW)
C-16

Figure C.1.5.2 Water Levels in the Vessel (Case C.5)

Figure C.1.5.3 Maximum Cladding and Core Exit Coolant Temperatures (Case C.5)

0

2

4

6

8

10

12

14

16

0 2 4 6 8 10

time [hr]

Level [M]

CVH-LIQLEV.350 (separator)

Summed heights , LP, Channel R3 , Shroud Dome

TAF

BAF

500

1000

1500

2000

2500

3000

0 2 4 6 8 10

time [hr]

Temperature [K]

Cladding (maximized over core)

Coolant at core exit (maximized over radius)
C-17

C.2.2.6 Results of Case C.6 (90 percent Decay Heat)

This case repeats the base case (C.1), except that the decay heat and likewise the fission heat before the 

scram are 90 percent of the base-case values. 

Figure C.1.6.1 shows the RCIC injection rate. As in the base case, the RCIC finishes four complete duties 

and is idle on high vessel level at 8 hours, at which time the batteries deplete and preclude any further 

RCIC activity. Because of the lower boil-off rate, the first RCIC turn-on and the last turn-off occur at 

slightly later times than in the base case, and the average duration of a duty is shortened slightly from 45 

minutes in the base case to 42 minutes in the sensitivity case. The onset of core damage is delayed for 

the same reason. Figures C.1.6.2 and C.1.6.3 show, respectively, the levels in the vessel and the 

cladding and coolant temperatures. The core begins to uncover at about 10.0 hours. The temperature of 

the coolant at the core exit exceeds 922 K (1,200 °F) at 10.95 hours; the first gap release is at 11.23 

hours; and the maximum cladding temperature exceeds 1,478 K (2,200 °F) at 11.58 hours. The 

calculation is stopped at 11.9 hours.

Figure C.1.6.1 Injection by RCIC (Case C.6)

0

10

20

30

40

50

0 2 4 6 8 10 12

time [hr]

Mass Flow Rate [KG/S]

FL-MFLOW.376 (Feedwater)

FL-MFLOW.614 (Water drawn from CST by RCIC)

FL-MFLOW.606 (Water drawn from WW by RCIC)

FL-MFLOW.3.613 (RCIC turbine steam to WW)
C-18

Figure C.1.6.2 Water Levels in the Vessel (Case C.6)

Figure C.1.6.3 Maximum Cladding and Core Exit Coolant Temperatures (Case C.6)

0

2

4

6

8

10

12

14

16

0 2 4 6 8 10 12

time [hr]

Level [M]

CVH-LIQLEV.350 (separator)

Summed heights , LP, Channel R3 , Shroud Dome

TAF

BAF

500

1000

1500

2000

2500

3000

0 2 4 6 8 10 12

time [hr]

Temperature [K]

Cladding (maximized over core)

Coolant at core exit (maximized over radius)
C-19

C.2.2.7 Results of Case C.7 (One Unavailable SRV)

This case repeats the base case (C.1), except that the SRV with the lowest opening pressure (FL359, 

opening at 7.815 MPa) is assumed to be stuck closed throughout the scenario. 

Whereas in the base case the vessel is relieved predominately by FL359, but with a small contribution 

from FL360; in the sensitivity case, the vessel is relieved predominately by FL360, but with a small 

contribution from FL361. The other eight flow paths that model SRVs—flow paths FL362 through 

FL369—do not open in either calculation. The opening pressure of FL360 is just 1 psi higher than that of 

FL359, and that of FL361 is likewise just 1 psi higher than that of FL360. (A 1 psi offset is assumed in the 

MELCOR model. The actual design (FSAR) setpoints for these valves is the same value.) Therefore, the 

results of this sensitivity case are very similar to those of the base case. At the end of the calculation 

(11.5 hours), FL360 has opened or closed 1,292 times, and FL361 has opened or closed 28 times.

Event timings characteristic of core damage are similar to those of the base case. The core begins to 

uncover at about 9.6 hours. The temperature of the coolant at the core exit exceeds 922 K (1,200 °F) at 

10.47 hours; the first gap release is at 10.70 hours; and the maximum cladding temperature exceeds 

1,478 K (2,200 °F) at 11.01 hours. Failures of the core support plate begin at 11.28 hours. The calculation 

is stopped at 11.5 hours, because gross core damage is underway.

C.2.2.8 Results of Case C.8 (Reduced RCIC Flow Rate)

This case repeats the base case (C.1), except that the maximum RCIC flow rate is reduced to 90 percent 

of its base-case value. 

As in the base case, the RCIC completes four duties. Because of the reduced flow rate, the duration of 

the duties is longer. The last duty ends at 7.72 hours instead of at 7.12 hours as in the base case. This 

leads to behavior in the sensitivity case very similar to that of the base case, but with a delay of about 0.6 

hours. Figure C.1.8.1 compares the cladding and core exit temperatures predicted by the sensitivity 

calculation with the base-case results.
C-20

Figure C.1.8.1 Maximum Cladding and Core Exit Coolant Temperatures (Case C.8)

C.2.2.9 Results of Case C.9 (SRV Parameters)

This case considers uncertainty in some of the parameters that describe the SRVs. The two SRVs with 

the lowest opening pressures are considered, because in the base case (C.1) they are the only SRVs that 

ever open. They are modeled by FL359 and FL360. The base-case values for the K-loss coefficient, the 

choked flow discharge coefficient, and the momentum exchange length are 5.0, 1.0, and 17.9 m, 

respectively. The last parameter is left unassigned by user input in the base-case model and has 

therefore been assigned by MELCOR. The large value reflects the long flow length of the SRV flow paths. 

The sensitivity case assigns these three parameters (for FL359 and FL360 only) as 3.0, 1.5, and 0.5 m. 

The changes made to the K-loss and choked flow discharge coefficients both tend to increase the flow. 

The shorter momentum exchange length reduces the ability of SRV gas flows to entrain liquid, which 

probably has been overestimated in the base case26.

As in the base case, only FL359 and FL360 ever open. Figure C.1.9.1 compares the cladding and core 

exit temperatures predicted by the sensitivity calculation with the base-case results. The differences are 

small, which is understandable since the considered differences only influence the duration that the SRVs 

are open and the flow rate during that time, but not the integrated flow (i.e., because their pressure 

setpoints control the opening and closing of the SRVs).

 26 MELCOR has a simple entrainment model that uses the momentum exchange length, in addition to other userspecified inputs (junction opening heights). The latter determines whether liquid/gas may be drawn into a flow path at 

any given time (based on liquid level), and thereby whether entrainment/flooding is a possibility. Meanwhile, the 

momentum exchange length value affects entrainment and flooding (when they may occur) by controlling the balance 

between the resulting force between the two flows (which tends to couple them and reduce slip) and buoyancy (which 

tends to separate pool from atmosphere). A larger value tends to promote coupling between pool and atmosphere, 

while a smaller one tends to enhance their separation.

Clad T maximized over core ;

Coolant T at core exit maximized over radius

500

1000

1500

2000

2500

3000

0 2 4 6 8 10 12 14

time [hr]

Temperature [K]

Cladding - Sensitivity case Cladding - Base case

Coolant - Sensitivity case Coolant - Base case
C-21

Figure C.1.9.1 Maximum Cladding and Core Exit Coolant Temperatures (Case C.9)

C.2.2.10 Results of Case C.10 (Heat Transfer Coefficients for Boiling)

This case repeats the base case (C.1), except that a factor of 0.8 is applied to the built-in correlation for 

the heat transfer coefficients that apply to the nucleate boiling curve for pool boiling (MELCOR sensitivity 

card 1241[1]) and the transition boiling curve for film boiling (MELCOR sensitivity card 1242[1]).

Figure C.1.10.1 compares the cladding and core exit temperatures predicted by the sensitivity calculation 

with the base-case results. The differences are very small. 

C.2.2.11 Results of Case C.11 (Initial Temperature of Water in the CST)

This case repeats the base case (C.1), except that the initial temperature of the CST is set to 283 K 

(other calculations use 300 K).

Figure C.1.11.1 compares the cladding and core exit temperatures predicted by the sensitivity calculation 

with the base-case results. The sensitivity-case results are well described as a delayed version of the 

base-case results. The delay is about 0.4 hours. 

Clad T maximized over core ;

Coolant T at core exit maximized over radius

500

1000

1500

2000

2500

3000

0 2 4 6 8 10 12

time [hr]

Temperature [K]

Cladding - Sensitivity case Cladding - Base case

Coolant - Sensitivity case Coolant - Base case
C-22

Figure C.1.10.1 Maximum Cladding and Core Exit Coolant Temperatures (Case C.10)

Figure C.1.11.1 Maximum Cladding and Core Exit Coolant Temperatures (Case C.11)

Clad T maximized over core ;

Coolant T at core exit maximized over radius

500

1000

1500

2000

2500

3000

0 2 4 6 8 10 12

time [hr]

Temperature [K]

Cladding - Sensitivity case Cladding - Base case

Coolant - Sensitivity case Coolant - Base case

Clad T maximized over core ;

Coolant T at core exit maximized over radius

500

1000

1500

2000

2500

3000

0 2 4 6 8 10 12

time [hr]

Temperature [K]

Cladding - Sensitivity case Cladding - Base case

Coolant - Sensitivity case Coolant - Base case
C-23

C.2.3 Summary: SBO with RCIC Scenario

In the base-case scenario (C.1), the unavailability of the RCIC after 8 hours (i.e., the assumed battery 

depletion time) results in core damage that starts at 10.99 hours, according to the criterion that the PCT 

exceeds 1,478 K (2200 °F). Two sensitivity cases (C.4 and C.5) are identical to the base case except that 

battery depletion is assumed to occur at 2 hours and at 5 hours. Core damage (according to the same 

criterion) occurs in these cases, at 4.27 and 8.03 hours, respectively.

One sensitivity case (C.2) considers the RCIC continuing to run after battery depletion in uncontrolled 

mode, until it is shut-off from the flooding in the steam lines at 13.87 hours. In this case, core damage 

occurs at 18.57 hours (according to the same criterion). 

In the base case (C.1), the SRV with the lowest opening pressure opens and closes a total of 1,426 times 

by the end of the calculation (i.e., 11.9 hours). A sensitivity case (C.3) considers this valve to be stuck in 

the open position after opening 187 times. This event occurs at 2.45 hours. Core damage, according to 

the same criterion, occurs at 7.15 hours, after the RCIC became unavailable at 3.88 hours due to low 

vessel pressure caused by the stuck-open valve.

Another sensitivity case (C.7) assumes that the SRV with the lowest opening pressure fails in a closed 

position throughout the calculation. The results are similar to those of the base case, because the vessel 

is relieved by the other SRVs whose opening pressures are only slightly higher.

In a sensitivity case that uniformly reduces the decay heat to 90 percent of the base-case value (C.6), 

core damage according to the same criterion occurs at 11.58 hours.

Sensitivity cases that consider adjusting some parameters that affect flow through the SRVs (Case C.9) 

and the correlation for heat transfer coefficients during boiling (Case C.10) show results that are not 

significantly different from those of the base case.

See Section 4.3 of the main report for additional details.

C.3 Reference

C.1 W.S. Raughley, “Regulatory Effectiveness of the Station Blackout Rule,” U. S. Nuclear Regulatory 

Commission, NUREG–1776 (August 2003).




UNITED STATES

NUCLEAR REGULATORY COMMISSION

WASHINGTON, DC 20555-0001

------------------

OFFICIAL BUSINESS
NUREG/CR-7177

Assessment End

Compendium of Analyses to Investigate Select Level 1 Probabilistic Risk 

-State Definition and Success Criteria Modeling Issues