UNENE 3-4 S1

1
Chapter 3 -- Case Studies Lec. 4More Histories
and Lessons

• Three Mile Island
• Chernobyl
• Close call - Davis-Besse

2
Three Mile Island Unit 2
3
TMI -- Event Sequence 0What happened before the
accident happened? -- The Setup

• Design was a captive to the concept of design
  basis accidents. Small break was not one of
  them.
• No regulatory staff on site, and management was
  sloppy.
• Hostile relations with regulator existed over
  many years.
• Staff had supreme confidence in the plant and
  their own abilities.
• Failure to observe the precursor events that took
  place at other plants -- no Owners Groups.
• No worries!

4
TMI -- Event Sequence 1
5
TMI Event Sequence 2
6
TMI Event Sequence 3
7
TMI Event Sequence 4
8
TMI2 Core End StateVessel head removed
(1984)All fuel removed (1990)
9
TMI Bottom Head Peak Temperature Estimates
10
TMI -- Some Lessons Learned

• Design of valve position indicators
• Operator training / operator aids
• Hydrogen control, post-accident
• Primary Coolant Pumps
• Revise prescriptive approach to regulation
• Severe Accidents PSA
• Wetter is better

11
Another Point of View - 1James Reason, Human
Error
12
Another Point of View -2James Reason, Human
Error
13
Another Point of View - 3James Reason, Human
Error
14
Another Point of View - 4James Reason, Human
Error
15
Another Point of View - 5James Reason, Human
Error
16
Some More TMI Lessons

• A Review of Recommendations Arising from the
  Three Mile Island Accident, TMI Task Group,
  Ontario Hydro, August 1980 (3 volumes)
• Fact Sheet on the Accident at Three Mile
  Island, US Nuclear Regulatory Commission, 1993
• www.nrc.gov/reading-rm/doc-collections/fact-sheet
  s/
• Human Error, James Reason, Cambridge University
  Press, 1990, ISBN 0-521-30669-8 p. 251
• General info Managing the Unexpected - Assuring
  High Performance in an Age of Complexity, K.E.
  Weick K.M. Sutcliffe, Jossey-Bass, 2001

17
Chernobyl Unit 4 -- First Operation Dec.
1983Core Disruptive Accident -- Ukraine, USSR,
April 26, 1986

• 1000 MWe unit, one of 15 RBMK in USSR at that
  time
• Boiling light water coolant, direct steam cycle
• Graphite moderator, 2 coolant loops
• Each coolant loop has 840 fuel channels, max..
  power 3.25 MW
• Two 500 Mwe turbine-generators.
• On-power fuelling, fuel enrichment 2, burnup 20
  MWd/kg
• Negative power coefficient at full power
  positive at low power
• Accident happened during a safety test - intended
  to demonstrate T/G power supply to ECCS pumps
  during power rundown

18
Chernobyl Unit 4 - Core
Light-water cooled, graphite moderated Core
diameter 11.8 m Core height 8.6 m Direct
cycle Vertical pressure tubes Positive void
coefficient which depended on reactor state
19
Chernobyl Steam Feedwater System
20
Chernobyl -- Control and Protection System
(24) Shortened absorbing rods
(12) Local auto control (LAC) -- 12 control zones
(24) Auto control rods
(12) Average power control -- 3 banks of 4 rods
each
(24) Emergency control -- uniformly selected
(139) Manual rods
(24) Local emergency protection -- 2 rods per zone
(24) Emergency rods
(115) Manual control
21
Chernobyl Emergency Core Cooling System From
75-INSAG-1, Summary Report on the Post-Accident
Review Meeting on the Chernobyl Accident, IAEA
1986
22
Chernobyl Containment SystemFrom 75-INSAG-1,
Summary Report on the Post-Accident Review
Meeting on the Chernobyl Accident, IAEA 1986
23
Chernobyl -- Event Sequence 0 What happened
before the accident happened? -- The Setup

• Reactor design was derived from Pu production
  reactors - chief designer had been honored with
  the Order of Lenin
• Soviet culture was not conducive to open
  criticism of authority
• Time pressure to do test before scheduled outage
• Electrical engineers were in charge of the test
• Test procedures were very poorly defined
• Electrical dispatcher introduced last-minute
  change in program
• An option for two tests was retained, so the
  reactor was not tripped at start of the first
  test
• Several safety trip signals were disabled in
  order to continue test
• Operator failed to stabilize unit at 25 power
  after LAC shut off

24
Chernobyl -- Event Sequence 1
25
Chernobyl -- Event Sequence 2
26
Chernobyl -- Event Sequence 3
27
Chernobyl - Reactivity History
28
Chernobyl -- Event Sequence 4

• Steam (and possibly thermal) explosions, reactor
  lid thrown aside
• Massive core destruction / dispersal reactor
  subcritical
• Graphite fire burned for several days
• Heroic efforts were made to contain the disaster
• Reactor space was nearly empty after the event
• Core melted and lava flowed into rooms below
  the reactor

29
Chernobyl Radioactive Material (1 PBq2.7x104Ci)
30
Remediation

• Extinguish roof fire
• Boron to ensure subcriticality
• Dolomite-lead-sand-clay to cover core, then
  nitrogen to stop fire
• Concrete sarcophagus around reactor
• Reduced void reactivity, improved SORs?

31
Immediate Consequences
31 early deaths among plant operators and cleanup
crew -- severe fire burns as well as extreme
radiation doses Delayed cancer fatalities
Several thousand ,if linear hypothesis is true at
small doses. Such an effect cannot be observed
because this rate is very small compared with
natural cancer fatality rate. About 1800 excess
thyroid cancers observed in children (treatable).
No leukaemias or other cancers observed
32
Contributing Cause - Design
Void reactivity strongly dependent on operating
state (30 mk. just before accident) Xenon
burn-out-transient distorted the axial flux
distribution Axial flux shape was changed
drastically by the axial coolant void
distribution Shutdown rate was slow, shared with
control system and dependent on operating
state Shutoff rods worked in reverse if fully
withdrawn
33
Contributing cause -- Design

• Containment bypassed (but not normally designed
  for reactor explosion)
• Could a PWR containment withstand such an
  explosion?

34
Contributing Cause - Operation

• Command and Control of the test sequence was not
  correct/clear
• Long period at part power (caused by dispatcher)
  led to an initial plant state that was unfamiliar
  to the operators
• Test procedure was subject to ad hoc alteration
• Operators did not follow established procedures
• Safety culture was not conducive to prudent
  operation
• Operators appeared to have lost any sense of
  danger

35
Chernobyl - Some Lessons From 75-INSAG-1, IAEA
1986

• Root cause of the Chernobyl accident was the
  human element
• Training, with emphasis on severe accident
  sequences
• Auditing, (internal and external) especially to
  prevent complacency
• Sustaining awareness of potential safety
  implication of mal-operation
• CONCLUSION place complete authority and
  responsibility for safety on a senior member of
  the operating staff of the plant. Create safety
  culture.
• Implement defence in depth concept in reactor
  design
• Look for inherent stability of the chain reaction
  of the reactor
• Automatic safety systems to act as soon as safety
  of theplant is threatened
• Ultimate passive barrier (containment) to
  dispersion, in case all else fails
• If no feasible containment can be designed,
  special attention should be given to protect
  against the consequences of a reactivity excursion

36
Chernobyl - Some More Lessons From 75-INSAG-1,
IAEA 1986

• A satisfactory man-machine interface is very
  important
• Recognize that competent operators provide the
  first and best defence.
• Ensure clear display of data vital to safety,
  including diagnostic capability
• As backup to operators, install reliable safety
  backup to ensure that plant is within the safe
  operating envelope at all respects. This backup
  must be so designed as to be difficult to bypass,
  and so that normal or planned operation raises no
  temptation to bypass it.

37
A Close Call -- Davis-Besse

• PWR, 873 Mwe, started up in 1977
• Boric acid clogged containment air cooler in 1999
• Containment radiation monitor showed
  contamination and clogging in May 1999
• Significant head corrosion began in 1998 or
  earlier
• Five control rod penetration nozzles were
  cracked, 3 penetrated nozzle wall
• Large cavity in vessel wall, sealed only by
  vessel liner
• NRC has placed 27 PWR plants in the high risk
  category for vessel corrosion - some in vessel
  bottom penetations

38
Davis-Besse Head Corrosion Location
39
Davis-Besse Head Cross-section Showing Damage
40
DB - A Hole in the HeadStainless steel liner
bulged, but did not fail
41
Lessons to be Learned
?