Level 2 PSA for the VVER 440/213 Dukovany NPP and Its Implications for Accident Management Jir

1
Level 2 PSA for the VVER 440/213 Dukovany NPP
and Its Implications for Accident
ManagementJirí Dienstbier, Stanislav Husták

• OECD International Workshop on Level-2 PSA and
  Severe Accident Management, Cologne, 29-31 March
  2004

2
Outline

• Plant features
• History of PSA 2
• Methodology used
• Main characteristics
• Containment failure modes
• Large event tree - APET
• PSA 1 PSA 2 interface
• Main part of APET
• Hydrogen model
• Fission product release source term to the
  environment
• Results
• Sensitivity studies
• Accident management
• Conclusions and plans for near future

3
Plant features

• 4 units in 2 twin-units, twin units in common
  building, each unit has its own containment
• Mostly rectangular leak tight rooms, pressure
  suppression system bubble condenser
• Recirculation sump is not at the lowest level,
  possibility to lose ECC coolant to ventilation
• Reactor cavity is the containment boundary
  including double steel cavity door

4
History

• PSA 2 for unit 1
• First (Revision 0) Limited scope Level 2 PSA
• From 1995 to April 1998 as US AID project
  contractor SAIC (Science Applications
  International Corporation) with NRI Rež as
  subcontractor and with plant support
• Based on SAIC-NRI level 1 PSA from 1994
• Limited to normal operation at power without
  ATWS, no shutdown states, no external events
• 4 fission product groups, point estimates of
  frequencies, uncertainties treated by sensitivity
  study
• Large event tree (APET) method (program EVNTRE)
• MELCOR 1.8.3 physical analyses
• Knowledge transfer to NRI specialists was a part
  of the project
• Revision 1
• Autumn 1998 (SAM proposals updated in autumn
  1999) by NRI Rež
• Using NRI Rež living PSA 1 from 1998 (partially
  including new EOP), much different from the PSA 1
  in rev.0
• Extended to fires and internal floods
• Large modification of the event tree about ½ of
  questions changed keeping their order
• Only small modification of basic events
• Revision 2
• End of 2002, living PSA 1 2001 used, fully taking
  into account new EOPs, including ATWS sequences
  (did not propagate into PSA 2)
• Revision of the AICC hydrogen burn model

5
Main characteristics

• Main characteristics
• Limited scope Level 2 PSA
• Similar to IPE for US power plants
• Limited to normal operation at power including
  internal events - fires, floods
• Not included External events like earthquake,
  low power and shutdown states
• 4 fission product groups Cs, Te, Ba, noble
  gases, only CsBa used for sorting the results to
  release categories
• Large event tree (APET) method, the resulting
  tree has 100 nodes (usually more than 2 states in
  each node)
• 12 nodes PSA 1 PSA 2 interface (PDS vectors)
• Nodes 13 to 85 accident progression
• Nodes 86 to 100 related to fission product
  release to the environment source term
• Program EVNTRE (developed by SNL)
• The results are probabilities of 12 release
  categories results of binning and sorting
• About 90 basic events and several physical
  parameters
• Revision 0 only
• MELCOR 1.8.3 physical analyses of selected
  sequences (5 basic sequences their variations),
  results used to specify some parameters and basic
  events
• Other activities plant walkdown, containment
  feature notebook

6
Containment failure modes

• Classification of events timing
• Early before reactor vessel bottom failure (and
  about 2 hours later for fission products)
• Late after this time
• Failure locations in the containment (several
  possible) and cavity (or cavity door)
• Retention in walls or auxiliary building
  surrounding containment neglected
• Containment fragility curve (after DOE/NE-0086,
  1989)
• Containment normal distribution, m 400 kPa
  overpressure, s 80.9 kPa
• Cavity normal distribution, m 2420 kPa
  overpressure, s 460 kPa
• Possible containment isolation failure
• Ventilation lines P-2 (TL-40), O-2 (TL-70)
• Drainage, neglected in revision 2

7
PSA 1 PSA 2 Interface

• PDS (plant damage state) vectors representing
  first 12 nodes of PSA 2 event tree and
  characterizing the plant systems at the onset of
  core damage
• Respecting US NRC IPE and IAEA recommendations to
  reflect PSA 1 results
• PDS description
• First node representing initiating event
• 13 events, ATWS, ILOCA (interfacing LOCA other
  than through SG) screened out because of low
  frequency in PSA 1
• initiating events specific for PSA 2, especially
  RPV-PTS reactor vessel rupture due to thermal
  shock
• Other 12 events
• Different size LOCA S-LOCA, MS-LOCA, M-LOCA,
  LG-LOCA
• LOCA leading to water loss outside main sump
  IL/RCP, IL/POOL
• SGCB SG collector break and lift off, SGTR SG
  tube rupture
• SB-OUT steamline break outside containment,
  SB-IN steamline break inside containment
• TRANS transient very similar PDS vectors to
  SB-OUT, total loss of feedwater in both
• SBO station blackout failure of electric
  power supply including category 2
• Flood included as SBO 34
• Fires in some of the TRANS and IL/RCP initiators

8
PSA 1 PSA 2 Interface

• Following 11 nodes
• HPI ... state of HP ECC injection and
  recirculation
• LPI ... state of the LP ECC injection and
  recirculation
• Sprays ... state of containment sprays
• SHR ... secondary heat removal (mainly feedwater
  availability)
• SecDP ... secondary system depressurisation
  (important only for SHR OK)
• PrimDP ... primary system depressurisation by the
  operator
• ECCS_Inv ... location of (decisive part) of ECC
  water inventory
• VE_Cat2 ... state of category 2 electric power
  (diesels)
• VE_CI ... Two events combined
• containment isolation (CI)
• recirculation sump isolation against water loss
  (fSumpI sump isolation failed)
• VE_CHR ... containment heat removal
  system status (not including water and
  electricity availability)
• BC_Drain ... location of bubble condenser water
• These nodes have 2 to 4 attributes
• Result 34 PDS vectors (table 2 in the paper),
  only 5 of them with frequency gt 10-6/y
• RPV-PTS, SB-OUT, TRANS, IL/RCP, blackout

9
PSA 1 PSA 2 Interface

Figure 1 Analysis of CDF
10
APET

• Nodes (questions) 13 to 85
• Development of APET - Main event tree as
  framework including
• primary pressure before vessel failure, ECCs
  water location, early recirculation, vessel
  failure
• containment failure early
• late recirculation
• containment status late
• Phenomenology
• The same as for PWR reactor (importance often
  different, e.g. in-vessel hydrogen)
• Special connected with cavity design and its
  function as containment boundary
• HPME and cavity failure by gases or steam
  overpressure
• Cavity door failure by debris jet impingement
• Containment failure by gases transfer from the
  cavity
• Cavity door failures by thermal effects 1)
  large, 2) smallloss of sealing, a) within 2
  hours after VF, b) late
• Technical systems complicated the event tree and
  required repeating of some questions
• category 2 electric power early and late
• primary system depressurisation
• sprays early and late
• late phase - water in cavity / cavity door status
  (to avoid feedback)
• Quantification of basic events and physical
  parameters (quantification tables for
  probability)

11
Fission product release to the environment -
source term

• Nodes 86 to 100
• Early and late release of Cs, Te, Ba, XeKr in
  of inventory
• Decontamination factors (DF) - primary,
  containment, sprays
• Revolatilization of early released and deposited
  f.p. also assumed
• Calculation (using DF) using user functions and
  sorting of releases
• The result of 100 is sorted to 12 release
  categories
• Thresholds 0.1, 1.0, 10.0 of inventory for Cs
  group and 1 order less for Ba group
• In revision 2, the results sorted to 5 classes
• 1. early high more than 1 of Cs or 0.1 of
  Ba with early containment failure
• 2. late high the same with late containment
  failure
• 3. early low between 0.1 and 1 of Cs and 0.01
  and 0.1 of Ba with early containment failure or
  no failure
• 4. late low - the same with late containment
  failure
• 5. very low less than 0.1 of Cs and 0.01 of
  Ba
• The last class specified according to Swedish and
  Finnish criteria (0.1 137Cs)
• Noble gases release higher, not used in these
  classes
• We think about adding one more category for LERF
  (gt10 of Cs and I early)

12
Summary results

13
Summary results
14
Results

• Results sorted according to
• Consequences for PDS vectors
• 11 risk vectors with early or late high release
  frequency above 10-7/year found
• used for scenario analyses recommendations
• initiated by RPV-PTS, SB-OUT or TRANS, SBO,
  IL/RCP, IL/POOL, SGCB
• Core damage
• Limited 17,7 (38.5 w/o RPV-PTS) or Full
• Pressure at vessel bottom head failure
• Low (below 0.8 MPa) 91.8 (82.0)
• Most Important phenomena leading to containment
  failure
• CDF (w/o RPV-PTS)
• E_Byp_Rp 0.64 ( 1.40)
• E_Rp 23.78 (17.56)
• Hydrogen deflagration or detonation 12.34 (
  7.70)
• Cavity failure (mostly steam explosion) 10.47 (
  7.72)
• E_Leak 0.77 (1.69)
• Single SG tube break 0.37 (0.81)
• L_Rp 0.16 (0.17)
• L_Lk 16.06 (12.31)

15
Sensitivity studies

• Sensitivity studies are the only method to assess
  uncertainty here
• Revision 0 PSA 2
• 23 sensitivity studies
• Showing importance of some basic events like
  steam explosions
• Including accident management
• Changing only basic events and parameters, no
  event tree change
• Revision 1
• Accident management and preventive measures only
• Also small event tree changes if needed
• Most efficient
• Cavity flooding and external vessel cooling
• Primary system depressurisation by operator
• Combining depressurisation with other measures

16
Sensitivity studies

• Revision 2
• case without RPV-PTS shown before
• case without RPV-PTS and IL/RCP with coolant loss
  (plant modification)
• CDF decreased to 1.1510-5 / year LERF decreased
  to 2.3010-6 /year
• primary system depressurisation in SAMG
• Low efficiency - mostly low pressure accident and
  depressurisation in EOP
• higher probability of hydrogen early ignition as
  in the previous revisions
• Early containment failure due to hydrogen 4
• higher hydrogen source
• medium50 oxidation, high80 (instead of
  35 / 50)
• LERF 1.5310-5, more than 50 of CDF is early
  containment failure
• lower containment strength
• 300 instead of 400 kPa median, similar results
  like for higher hydrogen source
• lower containment strength and higher hydrogen
  source
• Early containment rupture 69 CDF, LERF
  2.0610-5 / year, hydrogen the only risk
• lower steam explosion probability in the cavity
• 0.1 (instead of 0.5) for high molten fraction,
  0.01 (0.1) for low molten fraction
• containment failure by steam explosion 1.41 CDF
  (10.43)

17
Severe accident management

• Present situation
• Dukovany concentrated on core damage prevention
  in the past
• CDF decreased considerably, more than one order
  of magnitude
• This was due to plant modification and symptom
  oriented EOP
• Plant modifications not included in the last
  revision of PSA 2
• modification to eliminate ECC coolant loss from
  MCP motor deck (IL/RCP) to start soon
• intensive study of RPV-PTS to decrease its
  probability
• Isolation of cavity drainage
• for eliminating ECC water loss after RPV-PTS also
  ventilation line isolation would be needed
• using fire pumps for feedwater, filling of SG
  from tank by gravity lower blackout CDF
• After these modifications, CDF below 10-5/year
  can be reached
• SAMG needed to decrease high early release
• WOG generic severe accident management guidelines
  (SAMG) modified to VVER 440/213
• Theory
• Accident Management can be divided into levels
  of defense
• Measures to restore cooling shortly after core
  damage and stop the accident in the vessel
• Measures to prevent containment failure
• Measure to mitigate release for failed or
  bypassed containment

18
Severe accident management

• Hydrogen
• The plant is equipped with PAR for DBA, they are
  too slow
• PHARE 94 2.07 showed that even extension of PAR
  is a problem too large area needed to eliminate
  risk of DDT
• MELCOR 1.8.5 analyses indicate negligible risk
  for self-ignition at 10 of hydrogen
• Caused by large differences in local
  concentration
• Controlled combustion seems the most promising,
  igniters needed
• NRI prepares a project to start in 2005 to
  analyze their number and location
• Cavity and cavity door protection
• More complex, the strategy depending on plant
  modifications wet or dry cavity
• Decision to use in-vessel retention by external
  cooling not yet taken
• If not accepted, we can partially flood the
  cavity and cool the door
• Risk of steam explosion in the cavity must be
  analyzed
• High pressure melt expulsion must be prevented
  especially for water in the cavity
• Existing SAG primary system depressurisation
  sufficient
• Dry cavity strategy simple thermal protection
  of cavity door - cheap solution
• Other issues can be covered by procedures,
  except
• Reduction of the release in primary to secondary
  accidents

19
Conclusions and plans for near future

• Limited scope PSA 2 proved to be a very good tool
  especially when comparing risk importance of
  individual phenomena
• Extension to shutdown states needed and should
  start soon
• Before next revision of limited scope PSA 2 for
  power states (in 2006 ?), some problems have to
  be solved
• Most of them already included in other project
• better containment strength calculation results
  in 2004
• better scenarios MELCOR 1.8.5 analyses in 2004
  including SAMG
• decreasing conservatism of natural leak from the
  intact containment retention in walls and
  external building 2004
• improved knowledge of steam explosions including
  cavity strength ??