SAMG-related Insights gained by Level 2 PSA Calculations

OECD Meeting on SAMG-related Insights gained by Level 2 PSA Calculations

- 1 -

SAMG-related Insights gained by Level 2 PSA Calculations

O. Nusbaumer, H. Eitschberger

Leibstadt NPP (KKL), Switzerland

1. Abstract

Leibstadt Nuclear Power Plant (KKL) is a BWR6/238 Mark 3 plant located in northern Switzerland. Current Emergency Operational Procedures (EOP) cover already numerous severe accident issues. In order to complete these procedures according to today’s understanding of Severe Accident Management (SAM), KKL has initiated an internal effort to develop and use Beyond-Design-Basis Accident computer codes and models. The NRC MELCOR code has been preferred to MAAP for its nodalization flexibility and its state-of-the-art ability to integrally calculate entire accident progressions. After having performed numerous severe accident simulations for the KKL Level 2 Probabilistic Safety Assessment, the intended use of the Melcor deck is to develop accident scenarios for drills and support both technical staff training and Severe Accident Management. The actual KKL MELCOR environment is currently one of the most complete MELCOR applications worldwide.

The KKL Level 2 PSA project is a good illustration of how computer codes may help plant engineers to better understand the physics and the progression of severe accidents and the plant specific response. They will be able to identify vulnerabilities under abnormal conditions, to quantify the consequences of operator actions by sensitivity calculations and to help the safety engineers establishing and validating SAM. The goal of a Level 2 PSA is not only to determine the containment response and source-term release, but, above all, to identify contingencies for improvement.

The KKL development process towards these state-of-the-art SAM tool and method, as well as the main insights gained by the numerous investigations is presented.

2. Introduction

2.1. Brief description of the KKL NPP

Leibstadt Nuclear Power Plant (KKL) is a BWR6/238 Mark 3 Containment plant located in northern Switzerland. Leibstadt began commercial operation on December 15, 1984. It is Switzerland’s fifth and largest NPP.

The nuclear steam supply system consists of a Boiling Water Reactor 6 (BWR/6) supplied by General Electric. KKL is currently operating at 3515 MWth. The reactor core consist of 648 fuel elements, each with 96 fuel rods in a 10x10 arrangement. The total weight of uranium oxide is about 115 t.


- 2 -

In the event of a LOCA, four independent Emergency Core Cooling Systems (ECCS) ensure together sufficient cooling of the reactor core. The ECCS consist of the low pressure injection systems (LPCI A/B/C, SEHR A/B), the low and high pressure core spray systems LPCS and HPCS, and automatic depressurization system. In addition the steam-driven Reactor Core and Isolation provides an additional high pressure injection into the reactor vessel. The RCIC operates independently of auxiliary AC-power, plant service air or external cooling water systems. Furthermore RHR A/B and SEHR A/B provide heat removal capabilities. The total nominal heat removal capacity is 115 MW or 3.2 % of the rated thermal power.

Reactor depressurization is ensured by 16 Safety Relief Valves (SRV) which relief the high-pressure reactor steam to the Suppression Pool (SP). The SP is a large annular pool containing about 3700 mP

3 Pof demineralized water which is located between the Drywell and the outer

containment boundary. The SP acts as main heat-sink during emergency situations. Furthermore, the SP is a source of water of the ECCS.

2.2. Status of PSA-related projects at KKL

KKL had to update their PSA due to the power upgrade program.

The following figure shows an overview of the PSA projects structures at KKL:

Shutdown PSA: released to the Swiss authorities in 2001 Level 2 PSA: released to the Swiss authorities in 2001 Level 1 PSA: waiting for final HSK approval LPSA: depending on Level 1 PSA SAM: currently in concept phase: BWROG EPG/SAG Rev. 2 and KKL SAS

tools will be considered

2.3. Equipment and infrastructure for Accident Analysis

KKL uses many different computer codes for both Accident Analysis and technical staff

training, most of them ‘in-house’. They include:

2.3.1. Fullscope simulator

Figure 2 shows a view of the KKL fullscope simulator. The simulator provides a control room replica dedicated to the training of plant operators. The simulator provides a plant-specific


- 3 -

simulation of two-phase flow thermal-hydraulic effects, 3D neutronics, electrical and instrumentation systems.

Due to the assumption of an always intact core geometry, the capability of the training simulator with regards to a simulation of Severe Accident scenarios is limited. While phenomena like metal-water reaction, Hydrogen production, fission product release and decay are simulated, a core degradation is out of scope. The simulator, besides of ist main purpose of operator training, is therefore an adequate tool to analyze operating transients and procedures up to the point of core melting.

2.3.2. MELCOR

2.3.2.1. Overview

In order to go further into the core degradation phases of accidents, KKL initiated an effort to develop its own severe accident simulator. KKL decided to use the NRC MELCOR computer code, which met KKL requirements.

MELCOR is a fully integrated, relatively fast-running, engineering-level computer code that models the progression of severe accidents in light-water nuclear power plants. MELCOR is being developed at Sandia National Laboratories for the U.S. Nuclear Regulatory Commission as a second-generation plant risk analyzer. An entire spectrum of severe accident phenomena is modeled in MELCOR. Characteristics of severe accident progression that can be treated with MELCOR include the thermal hydraulic response in the reactor coolant system, reactor cavity, containment, and confinement buildings; core heatup and degradation; radionuclide release and transport; hydrogen production, transport, and combustion; core-concrete attack; heat structure response; and the impact of engineering safety features on thermal hydraulic and radionuclide behavior.

2.3.2.2. KKL MELCOR Deck

The KKL MELCOR accident management model was built to simulate various types of transient and accident scenarios, involving complete or partial failure of plant systems and their components. The model includes the following plant systems and components:

• Reactor Coolant System

Reactor Vessel with two recirculation loops and pumps

Core (includes modeling of the core degradation processes in the Lower Plenum)

Steam Lines, Turbine/Condenser and Hotwell

Feedwater System (feedwater lines, pumps and heaters)

Control Rod Drive system

• Containment System

Reactor Cavity and Drywell

Containment

Suppression Pool

Upper Pool with the Suppression Pool makeup line

Shield Annulus and the Containment shield wall

Filtered Containment Venting System

Hydrogen Mixing System

Suppression Pool drainage


- 4 -

Drywell and Containment failure models

• Turbine and Auxiliary Buildings

Release path for interfacing systems during LOCA (V-Sequence)

Auxiliary Building Room ZC06R923 (CV972).

Turbine Building volume

Equipment Drain Tanks

• Engineered Safeguard Systems

Safety Relief Valves and Automatic Depressurization System

Main Steam Isolation Valves

Reactor Core Isolation Cooling

High Pressure Core Spray

Low Pressure Core Spray

Residual Heat Removal System, Trains A, B and C

Special Emergency Heat Removal System

Alternative Injection (Emergency Service Water (ESW) Train B) via LPCI B and injection

from Hinterberg reservoir via HPCS suction line)

• Other Plant Systems

Condensate Storage Tank

Hinterberg Reservoir

2.3.2.3. KKL / RMA extension of the MELCOR developer version

As part of the KKL Level 2 PSA, KKL initiated an ambitious effort to improve some routines of the standard MELCOR 1.8.4 developer version. Many of them have been made possible by means of the MELSIM visualization interface (see 2.3.2.3). They exclusively reflect improvements (e.i. KKL specific best-estimate) and were supported and verified by other computer codes and measurements. They include:

Implementation of the ANS-5.1-94 standard for decay heat calculation, to be used instead of the MELCOR’s default ANS-5.1-79 standard.. Moreover, the decay heat is calculated as a function of the reactor history, which allows users to setup different operating conditions (BOC, EOC, Shutdown,...). Up to 10 fuel batches may be specified, each having up to 1000 power segments. Neither of these features is available in the developer’s version of MELCOR.

Online decay heat calculation during extended fission power generation (e.g. ATWS sequences with significant water level oscillations). The decay is updated online as a function of the fission power history. In the original MELCOR release, the decay heat starts to decay at transient initiation, which is obviously not conservative during ATWS.

Implementation of the KKL specific Chexal-Layman correlation (for sub-cooled water inlet). This correlation returns the fission power as a function of core collapsed water level (or void distribution), reactor pressure and inlet subcooled. The KKL specific Chexal-Layman correlation was developed using the 3D neutronics thermo-coupled capabilities of the fullscope simulator. Further independent verifications have been made using the PSI TRAC-BF1 computer code (see figure 3, comparison at 70 bar, blue curve for sub-cooled inlet (-20°C)).

Activity release


- 5 -

The HSK is in a process to define activity release as a PSA risk measure. For the KKL 2001 Level 2 PSA, it has been decided to evaluate these releases for all major Plant Damage States (PDS). Consequently the MELCOR environment has been extended with a radionuclides decay/buildup module. The daughter products production is not explicitly treated by MELCOR, but by its visualization interface MELSIMP

©RMAP (see 2.3.2.3). The activity feature

has been developed by RMA into the MELSIM environment as a KKL requirement.

The activity release is the amount of radionuclide activity in Bequerel (Bq) released out of the containment, integrated over the release duration. The release may occur through several release paths simultaneously (FCVS, drainlines, equipment hatch, leakage etc) and it may start many hours after the start of the accident and it may continue for many hours. The total amount of activity in the containment itself is a function of time after Scram, driven by both the decay of fission products and by the buildup/decay of daughter products. Furthermore, for ATWS sequences there is a continued production of activity sources (like the decay heat) due to the continued fission power. Therefore the determination of the activity release must account for the time dependent buildup and decay of radionuclide species after the initiating event as well as the time dependent release flow through several release paths from the containment.

In the KKL MELSIM model there are nine different radionuclide release paths modeled from the containment. In order to perform a realistic analysis of the activity release the time dependent buildup, decay and release rate of activity through release paths was modeled as a SIM feature in the KKL MELSIM system, where the input for the decay and buildup is developed by a code that can handle the radionuclide decay and buildup chains (MicroShield). Each of the KKL MELSIM Level 2 accident progression sequences was run with the Activity Release module, so that the details of the time dependent activity release rate and the integral release for each release path and each isotopic group is determined.

The noble gas activity release is in most cases more than 99% of the total activity release. Therefore, from a total activity release perspective there is not much difference between the release categories since in all cases most of the noble gases are released. However, the radiological consequences are less dependent on the noble gas release, since noble gases tend to rise from the point of release and disperse in the atmosphere, except for inversion weather conditions. The aerosol activity release, defined as all activity releases except noble gases, is a more discriminating measure of risk and it is typically used to characterize the activity release for a source term.

2.3.2.4. MELSIM

MELSIM (MELcor Simulation and Interactive Modeling) is an interactive visualization and analysis system developed by RMA. MELSIM is a graphical interface which enables interactive severe accident analysis with MELCOR. It visualizes physical and dynamical process data online as they are calculated by MELCOR. Moreover, it allows interaction with the MELCOR Control Functions (CF) to change the status of some components or systems online (e.g. loss of bus power, pump failure, manual component activation etc).

MELSIM was chosen for the Level 2 PSA because it is user-friendly and it enables severe accident simulation and training for the KKL staff.

KKL has evaluated several tools for severe accident simulation to train / support accident management and technical teams. The requirements were:

Faster than real-time

Workstation- based simulation


- 6 -

State-of-the-art calculation of the entire accident phenomena for transients, accidents and beyond-design-basis accidents with MELCOR

Graphical display of the accident development

The current basis of the KKL-MELSIM is the 2001 MELCOR 1.8.4 KKL deck. Appropriate control and protection logic for operation of the non-emergency plant systems, as well as for initiation and control of ECCS, is modeled with MELSIM components and logic which interface with the MELCOR Control Functions. The automatic systems and components trip logic as well as the start-up and control logic are simulated. Trips and automatic system actions are based on calculated parameters reaching the actuation setpoint. One of the strengths and special features are the structural and interactive screens. The KKL MELSIM features 6 different screens (Containment, Reactor, ECCS, HP CCS, LP CCS, Core, Reactor cavity).

The KKL ECCS screen is presented as an example below:

2.3.2.5. TRAC-BF1

The KKL TRAC-BF1 model is maintained at the Paul Scherrer Institute (PSI) in Villigen, Switzerland. TRAC-BF1 is used by KKL to perform some independent validations. For the Level 2 PSA, TRAC-BF1 supported the study and development of:

Geodetic water injection from the feedwater tank after an emergency reactor depressurization (passive makeup)

Response and void distribution in the feedwater lines after a LOCA event.


- 7 -

Additional verification of the Chexal-Layman ATWS correlation

2.4. Hardware SAM measures already implemented at KKL

Severe Accident mitigation has always been a concern of both KKL and HSK. The table below shows the different SA mitigation systems already installed at KKL

3. KKL analysis process for plant-specific EOP/SAMG development

3.1. What is a standard Level 2 PSA ?

A Level 2 PSA is an official report requested by the authorities. It consists of an analysis of the physical processes involved in the accident and the response of the plant and containment systems, to assess the likelihood, the time, the mode and the quantity of radiological release to the environment (e.g. source term). The scope of work related with Level 2 PSA includes:

Development of a plant specific Plant Damage State Matrix (PDSM) that defines the accident sequence categories.

Interpret the results of the Level 1 model (+containment status) quantification to develop a condensed set of Key Plant Damage States (KPDS), and to define an accident sequence for each KPDS to represent the KPDS in the Level 2quantification. This process is called “binning of the Level 1 PDS”.

Analyze the accident progressions, containment responses and source terms for all KPDS.

Assessment of uncertainties in the accident progressions by means of a Containment Phenomenological Event Tree (CPET). Other synonym may read “Accident Progression Event Tree” (APET) or “Containment Event Tree” (CET). Develop split fractions for the CPET top events. Quantify the CPET.

Dispatch the CPET end-states into source term/release categories

Integrate and interpret the Level 2 analysis results to provide insights into dominant release categories and their dominant contributors.

3.2. Importance of Level 2 PSA analysis and SAS in the SAMG development process

The goal of a PSA Level 2 is not only to determine the containment response and source-term release, but, above all, to identify vulnerabilities and improvement contingencies.

The KKL Level 2 PSA project is a good illustration of how detailed Severe Accident analyses and microprocessorized simulations may help plant engineers to better understand the physics and progression of severe accidents (especially the plant specific response), to identify eventual plant vulnerabilities or dualities under abnormal conditions, to quantify the consequences of operator actions by sensitivity calculations and to help safety engineers in

AM measure Installed in

Containment H2 ignitors 1988H2 recombinator designH2 mixing system designBoron injection system designPassive injection system 1985Venting system 1996ADS inhibit during ATWS 1999FW runback during ATWS 1999


- 8 -

establishing and validating SAM. The potential of a combination between human experience and computer simulation is enormous.

3.3. Additional features of the 2001 KKL-Level 2 PSA

In a concern to respond to the latest PSA trends and criteria, as well as to better address the new SAMG concerns, KKL decided to extend its Level 2 PSA to address many new concepts. The concept of Accident Management Event Trees (AMET’s) and Risk Oriented Analysis (ROA) were considered in the study. The following picture illustrate the KKL methodology:

Level 1 Core Plant Release

Initiating Damage Damage Categories

Events States States

(CDS) (PDSs)

3.4. Accident Management Event Trees (AMET)

A quite new concept in Level 2 PSA is to integrate some general Accident Management Event Trees (AMET). The Level 1 PSA and the Level 1-2 Interface PSA do not consider many of the instructions and alternate systems of the current KKL EOP’s. The AMET’s address appropriate system and actions as specified in the EOP on a PDS specific basis to identify the set of Key Plant Damage States (KPDS) and dominant sequences for the Level 2 phenomenological analysis. For some of the operator actions of the AMET’s there may be several signals and conditions for which the operators are trained to perform actions based on EOP’s. For example, the operators are directed to depressurize the vessel if the Suppression Pool heat capacity limit is exceeded, as well as if the core water level decreases below a certain setpoint. Several signals to perform AM actions increase the likelihood that the action will be taken, but no additional credit is considered for multiple actions.

The tracking of PDS through the AMET is important, because the new PDS assignment can change as a result of the consideration of AM actions (e.g. high pressure to low pressure melt scenario). The failure fraction values (e.g. split fractions) in the AMET’s are based on engineering judgement, considering the time available for the action, the EOP instruction, the type and difficulty level of the action and whether it is a sequence that operators are trained on regularly. It was decided not to consider any AM actions until at least 1 hour after the accident initiation.

An example of AMET is given below:

Level 1 PSA

Event Tree

Model

Level 1 – 2 Interface:

Containment System Event Tree Model

(CSET)

Level 2 PSA

Containment Phenomeno-logical Event Tree (CPET)

Activity release

calculation (Bq) and

Risk (Bq/year)

Level 2 PSA Accident

Management Event Trees

(AMET)


- 9 -

3.5. Towards the risk diagram

Risk is defined as:

eConsequencFrequencyRisk :

With regards to nuclear risk, there is a mathematical issue multiplying very low numbers (Frequencies are usually in the range of 10E-5 to 10E-8) with quite large numbers (Consequences may be in Bequerel) may lead to unphysical meaning.

However, if one does not consider this formula as a point estimate and decides to integrate it over the years and the number of NPP’s worldwide, and finally lets increases t towards infinite, one notices that the formula converges towards the average yearly radioactive release:

t

Bqeconsequencyearfrequencyt

yearBqreleaseAverage NPP Sequencesvivi

t

][][

lim]/[_,

1,

Therefore, evaluating the risk [Bq/reactor year] is, from a KKL point of view, a representative risk indication and should be considered as integral part of Level 2 PSA’s.

A common way to present such risk considerations is within a 2D diagram. X-axis usually represent the consequences (maybe in fatalities, activity [Bq], activity equivalent [e.g., kg Cs137] etc), while the Y-axis addresses the frequencies.

EDSm1 L1 Seq.: LOSP and all 5 DG fail to start (EDSo1 in draft)

AM Act’n (1) Restart RCIC on 2nd Level 2, (2) Manually open SRVs, (3) Line up Hinterberg, (4) Recover Power, (5) Manually isolate drainlines.

EDSm1Restart

RCIC-1hOpenSRVs

Line upHinterb’g

RecoverPower

LPME vsHPME

TX, TYIsolated

Frequ’cy PDS Percent Sequence No / Comments / (Synopsis)

3.70E-07 0.8 0.9 0.9 0.73 1.75E-07 Success 47.3% 1 RCIC for 2 h, Power rec win 10 h. (EDSM1-T2-CI-HB6h-4SRV-Rec570)0.27 0.9 5.83E-08 IDSm1 15.7% 2 Power not recovered by 10h, SRVs close, hi P core melt

0.1 6.47E-09 EDSm1 1.7% 3 As sequence above, Drainlines not isolated.0.1 0.59 1.57E-08 Success 4.2% 4 FWT injected, Power recovered between 2h & 6h

0.41 0.9 0.75 7.37E-09 IDSm3 2.0% 5 No Hinterberg, Power not recovered before 6 h. LPME0.25 2.46E-09 EDSm3 0.7% 6 As sequence above, Drainlines not isolated. (EDSM1-T2-4SRV)

0.1 0.75 8.19E-10 IDSm1 0.2% 7 No Hinterberg, Power not recovered before 6 h. HPME0.25 2.73E-10 EDSm1 0.1% 8 As sequence above, Drainlines not isolated. (EDSM1-T2-4SRV)

0.1 0.31 9.18E-09 Success 2.5% 9 No SRV open, Power recovered between 2h & 3h0.69 0.5 1.02E-08 IDSm1 2.8% 10 No SRVs open, CU at 3 h, Power not rec. betw. 2 & 3 h

0.5 1.02E-08 EDSm1 2.8% 11 As sequence above, Drainlines not isolated.0.2 0.8 0.9 0.73 3.89E-08 Success 10.5% 12 RCIC 1 cyc, Pwr rec win 10h (EDSM1-T2-R1c-CI-HB4h-4SRV-Rec570)

0.27 0.9 1.29E-08 IDSm1 3.5% 13 Power not recovered by 10h, SRVs close, hi P core melt0.1 1.44E-09 EDSm1 0.4% 14 As sequence above, Drainlines not isolated.

0.1 0.46 2.72E-09 Success 0.7% 15 FWT injected, Power recovered between 2h & 5.2h0.54 0.9 0.75 2.16E-09 IDSm3 0.6% 16 No Hinterberg, Power not recovered before 5.2 h. LPME

0.25 7.19E-10 EDSm3 0.2% 17 As sequence above, Drainlines not isolated. (EDSM1-T2-R1c-4SRV)0.1 0.75 2.40E-10 IDSm1 0.1% 18 No Hinterberg, Power not recovered before 5.2 h. HPME

0.25 7.99E-11 EDSm1 0.0% 19 As sequence above, Drainlines not isolated. (EDSM1-T2-R1c-4SRV)0.2 0 0 Success 0.0% 20 No SRV open, Power recovered before 2 h (considered in Level 1)

1 0.5 7.40E-09 IDSm1 2.0% 21 No SRVs open, CU at 2 h, Power not rec. in 2 h (considered in Level 1)0.5 7.40E-09 EDSm1 2.0% 22 As sequence above, Drainlines not isolated.


- 10 -

3.6. Identifying plant-specific vulnerabilities

The NPP specific accident sequences with the highest activity release are called “risk dominant sequences” and represent the set of accidents which contributes to the highest radioactive release to the environment (assuming for example an infinite plant operation).

SAMG implementation or research should address these very sequences in the first place, since they are most significant considering both frequency and consequences.

4. Selection of SAMG-related insights gained by the Leibstadt PSA’s

4.1. Hydrogen

4.1.1. General aspects of Hydrogen production

In a prolonged core uncovery, once the cladding temperature reaches 900°C, the heat produced by fuel cladding oxidation dominates the core heatup by decay heat. The reaction proceeds vigorously at 1000°C and significant amount of Hydrogen are formed in the RPV. The oxidation reaction of the cladding Zircaloy is shown below:

][5797.522 222Zrkg

JEHZrOOHZr

And for the kinetic process:

Overall risk

1.E-08

1.E-07

1.E-06

1.E-05

1.E-04

1.E-031.

E-0

3

1.E

-02

1.E

-01

1.E

+0

0

1.E

+0

1

1.E

+0

2

1.E

+0

3

1.E

+0

4

1.E

+0

5

1.E

+0

6

1.E

+0

7

Release [g Cs eq]

Fre

qu

ency

[/y

r]


- 11 -

)(2

TKdtWd

Where W is the mass of metal oxidized per unit surface area and K(T) is a rate constant expressed as an exponential function of surface temperature T.

For the Zircaloy-HR2RO reaction, the rate constant may be evaluated using the Urbanic-Heidrich correlation. This correlation is a published standard for both BWR and PWR Zr oxidation evaluations.

KTeTK

KTeTK

T

T

0.1853,9.87)(

0.1853,6.29)(0.16610

0.16820

4.1.2. Combustible Gas Control at KKL

The Combustible Gas Control Systems have the functions to maintain the post-LOCA hydrogen gas concentrations below combustible levels by.

Mixing the atmosphere of the Containment with that of the Drywell, following a LOCA, to dilute the hydrogen gas concentration inside the Drywell.

Recombining hydrogen and oxygen in the Containment atmosphere following a LOCA, to limit the hydrogen concentration inside the Containment to less than 4% by volume.

Limit the Containment hydrogen gas concentration by burnoff to prevent hydrogen-oxygen detonation.

4.1.3. Insight gained


- 12 -

As part of the Level 2 PSA, some simulations and complementary studies about large LOCA transients have been achieved. An interesting insight has been discovered performing simulations with the MELCOR SAS. Independent analysis and BWR PSA meetings have then confirmed the simulation predictions. All BWR plants without Drywell vacuum breaker may present this same vulnerability:

Following both a medium or large Drywell LOCA (e.g. recirculation, bottom head failure), Hydrogen potentially accumulates inside the Drywell, due to metal-water reaction (e.g. Zirconium oxidation) and to the radiolytic decomposition of water in the RPV. In such scenarios, it has been shown that the Drywell HR2R concentration can reach about 20% by volume in less than one hour.

Shortly after the initial blowdown, the Drywell is steam-inerted by the large steam flow that is vigorously pushing the Drywell atmosphere through the Suppression Pool vent holes.

Shortly after core heatup, Hydrogen is produced and released via the Reactor Coolant System (RCS) breach. The infinitesimally low Oxygen and high steam concentration in the Drywell should normally inhibit any HR2R combustion or explosion. Due to the injection of cold water by all ECCS, steam is condensing in the Drywell. The pressure becomes sub-atmospheric.

When the concentration approaches 4%, the Hydrogen Mixing System is placed into operation.. The Mixing System is pumping containment atmosphere to the Drywell. The design goal was to dilute Hydrogen (from containment to Drywell and back via the SP vent holes). However, in such low Drywell pressure conditions, the Mixing System would need many hours until atmosphere could flow back to the containment. As a result, Hydrogen burns are expected, enabled by Oxygen supply from the Containment.

As a result, Drywell failure is to be expected.

The following plots present the Chapiro-response with and without Mixing System activation (bottom head rupture sequence):

This is a nice example how integrated/detailed Severe Accident Simulators may identify vulnerabilities.

4.1.4. SAMG measure

A special SAMG measure will be implemented into the KKL EOP’s to prevent any Mixing System activation in case of non-radiolytic Hydrogen generation (e.g. core uncovery).

4.2. Alternate water injection


- 13 -

The KKL current SFA’s include specific instructions to align alternate vessel injection systems if level cannot be maintained with the nominal ECCS. Furthermore, some alternate injection systems may potentially be used for long-term debris cooling.

4.2.1. ESW/B

ESW-B can be lined up by manual actions entirely outside the containment from the Main Control Room (MCR). ESW-B is lined up via the LPCI-B injection line.

4.2.2. Hinterberg (passive)

The Hinterberg is reservoir located on a hill 3 km away from KKL. The reservoir has a total capacity of 4300 mP

3P of cold water. A d = 40cm pipe connects the reservoir with a special KKL

room where fire hoses may be installed to connect the Hinterberg line with the HPCS system. The Hinterberg elevation is 75 meter higher than the HPCS reactor discharge nozzle. All installation material is locally stored. Lineup process is a trained operation which requires about 20 minutes.

A fullscope experiment showed the following flow rate as a function of reactor counter-pressure:

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 150

5

10

15

20

25

30

35

40

45

50Figure 2: Hinterberg Lineup Kennlinie

Absolute Reaktordruck [bara]

Dur

chfl

uss

[kg/

s]

m x( )

x

This passive system has been programmed in the KKL MECLOR model. After an emergency reactor depressurization (reactor pressure < 4 bara), the efficiency of this alternate system to remove decay heat has been shown.

In addition, due to the BWR/6 design, it is possible to use Hinterberg for long term debris cooling. The process is included in the KKL EOP’s. It consists of totally flooding the containment (through the vent holes both Drywell and reactor cavity). Long term debris cooling analysis is discussed in more details in section 4.4.

4.2.3. Geodetic injection of water from the FW tank (passive)

A interesting Feedwater issue was analyzed using the KKL fullscope simulator. While performing an emergency reactor depressurization under station blackout conditions (no AC), one observed an abnormally strong reactor water level increase. This transient behavior has then be analyzed in more details:


- 14 -

It was shown that large amount of water and steam were passively flowing from the Feedwater tank to the reactor.

KKL’s Feedwater Tank (FWT) is located slightly higher than the reactor feedwater nozzles. Under normal operation, it is saturated at 10 bar. This causes a geodetic injection into the vessel as the reactor pressure falls below this limit.

Some MELCOR runs showed the analog discharge behavior (steam quality: x=0.2). To better understand all the thermo-hydraulic effects (flashing in the tank, Counter Current Flow (CCF), flashing in the line, formation of plugs after the discharge process etc), as well as to validate both MELCOR and fullscope simulator calculations, KKL started, in collaboration with PSI, an ambitious TRAC-BF1 modelization effort.

The three simulators confirmed the initially calculated behavior: during emergency depressurization, a steam-water mixture (x=20%) is geodetically discharged to the reactor. The injection takes place in two phases as shown below. The peak mass flow rate peaks at about 800 kg/s, with an integrated mass flow of 430'000 kg (almost all the FW capacity). This is enough to refill the reactor up to the steam nozzles.

As a consequence, accident progressions with manual (e.g. AM) or automatic depressurization are therefore passively delayed by 1 to 2 hours, allowing more time for the decay heat and fission products activity to decay, providing a second chance for various actions.

4.2.4. CRD as a Core Cooling System

The Control Rod Drive (CRD) system controls changes in core reactivity by providing pressurized water to control rod drives which position neutron absorbing control blades within the core.

The CRD has the following functions:

- Provides rapid control rod insertion when reactor scram is required

- Provides control rod positioning in the core

- Provides adequate cooling water for the CRDs.

The CRD is also used as a source of pressurized water for Reactor vessel hydrostatic testing and provides seal purge water for the Reactor Recirculation Pumps. Nominal CRD flow rate is 4.5 kg/s.

Although providing reactor vessel coolant makeup is not a design consideration for this robust hydraulic system, it is a normal function of the system. The CRD flow is delivered to the RPV via the control rod drives and the CRD system return line. The CRD flow requirements are


- 15 -

defined to meet the needs of the system’s normal functions of CRD cooling, notching and scramming. However, if it is desired to use the CRD system to assist with reactor makeup, the system configuration may be adjusted to increase CRD flow. Tests at KKL showed that the system full flow capacity reaches 14 kg/s, with both CRD pumps running. In such a configuration, the CRD can be used as a high-pressure core makeup system during emergency situations. The required actions may be performed either from the Main Control Room (MCR) or from the local CRD flow control station.

MELCOR simulation showed that the system could prevent core uncovery for decay power less than 30MW. This alternate system function is even more relevant during shutdown conditions where the decay power is significantly lower.

4.3. Station Blackout (SBO)

Station Blackout sequences are important risk contributors. Several interesting insights were discovered by means of KKL SAS (both example gained from MELCOR/MELSIM).

4.3.1. Drain-lines

During Station Blackout, the drain lines from both Containment and Drywell sump tanks to the liquid waste treatment system (Radwaste) are not isolated. The isolation valves are AC-powered and therefore cannot be closed. The Level 1 PSA fault-tree model for internal events did not include a manual action to isolate the drainlines because no procedures were available.

As an Accident Management action, KKL then implemented instructions to manually isolate two valves in the equipment drain lines outside the containment when the Suppression Pool reaches 48°C.

4.3.2. Reactor Re-pressurization after 10h

In SBO sequence where the reactor has been depressurized (8 Safety Relief Valves (SRV) open) to allow for passive water injection, core damage is only prevented if power is recovered before 10 hours. At about 10 hours the DC-batteries fail and the SRV re-close leading to a High Pressure core Melt Ejection (HPME).

No SAM mitigation actions implemented so far.

4.4. Long Term Debris Attacks and Coolability

4.4.1. General Aspects

The attack of core debris on concrete in a light water reactor is primarily thermal. The combination of decay heat and heat from chemical reactions is generated in the debris and is lost either through its top surface or to the concrete.

The quasi-steady partition of the heat loss between concrete and surface is determined by the ratio of the corresponding thermal resistances. Thus, debris behavior and concrete ablation are dominated by conservation of energy, with heat transfer relations providing the most important constitutive relations.

The heat flux to concrete is sufficient to decompose it, releasing water vapor (from both adsorbed water and hydroxides) and carbon dioxide (from carbonates) and melting the residual oxides. The surface of the concrete is ablated at several centimeters per hour typically, and molten oxides and molten steel from reinforcing bars in the concrete are added to the debris pool. The decomposition gases are strongly oxidizing at debris temperatures and will be reduced, primarily to hydrogen and carbon monoxide, on contact with metals in the debris.


- 16 -

Ultimately, the reacted and un-reacted gases enter the atmosphere above the debris pool, where they may or may not burn immediately.

The full concrete response is extremely complicated, with elements of ablation, transient conduction, decomposition of hydroxides and carbonates in advance of the ablation front, and transport of gases and liquid water through the concrete.

Typical thermal diffusivity of concrete is extremely small, a few times 10P

-7P mP

2P/s. Over the time

scale of interest in cavity phenomena (hours), the amount of heat which can be transferred into concrete (by transient conduction) under non-ablative conditions is usually small compared to the amount of heat which must be removed from core debris through other mechanisms to maintain its temperature below the ablation temperature. Therefore, if the debris temperature

is below the ablation temperature, the concrete surface is modeled as an adiabatic boundary. This explains the importance of debris cooling, even in the short term.

There is a possibility that an overlying coolant layer (water) could interact with molten debris so as to break it up and form a coolable debris bed. In the MAAP code, this quenching is assumed to occur; it is not considered in MELCOR.

Unless the debris is spread over an extremely large area, the interior of the oxide phase will remain molten for a long time, probably for weeks.

The corium temperature TRcoriumR(t) can be evaluated using the following non-linear differential equation:

)())(()()( ''' tmhTtTAPtP

dt

tdTvc waterLGcoriumchemicaldch

corium

4.4.2. Insights gained

Long-term debris coolability may be ensured by alternate injection systems. In a BWR/6, “containment flooding” means also Drywell flooding, since there is an “under-water” connection (Suppression Pool vent holes). Boiling effects do not take place due to sufficient conductional and convectional heat transfer. The Hinterberg water is exhausted through the venting system (FCVS) at 22.5 m elevation.

KKL has performed several MELCOR simulations in order to study debris coolability and concrete ablation. Using the passive cooling from Hinterberg reduces the concrete ablation radius of a factor 55% and the fission product release of a factor 40%. Hinterberg has been preferred for its passive mode. Other system lineups have been investigated. As to be expected, active systems produce better results.

4.4.3. Anticipated Transient Without Scram (ATWS)

Anticipated Transient Without Scram (ATWS) sequences have the highest activity release potential and a very fast progression. The boundary between controlled and uncontrolled ATWS is in most of the cases very thin.

The Chexal-Layman correlation offers a convenient and accurate way to determine the fission power for BWR (exclusively) as function of reactor pressure and collapsed level:

7.03.07.0 //037.0 rrruf HHPPHCq


- 17 -

With:

),0.0max( fLLH and

45.0

4384.2

rf P

PL

qRfR = fraction of full operating fission power

CRuR = dimensional constant = 3.28084 mP

-1P

HRrR = arbitrary reference height, selected as 1 m

P = system pressure

PRrR = reference pressure, with default value 7.65318 MPa

L = height of downcomer water relative to the top of active fuel

The correlation has been compared to 3D neutronic models:

4.4.4. Operators to control fission power at 5%

In order to maintain the fission power within an acceptable range during ATWS, a new SAM-related procedure requests operators to manually decrease the reactor water level until neutron flux (e.g. fission power) reaches 5%. For high reactor pressure conditions, this 5% power level corresponds to a water level of –2 m, which is sufficient to guarantee enough core flow throughout the core to maintain the fuel assembly temperature below the oxidation limit. At low reactor pressure, the void fraction is significantly higher (e.g. lower moderation efficiency), leading to a water level higher than Top Of Active Fuel (TAF).

4.4.5. Passive cooling under ATWS, automatic power regulation

During ATWS, power is tightly correlated with water level, pressure and water injection rate. An idea to control an ATWS scenario is to supply the reactor with the exact amount of water needed to maintain its temperature.

Fission Power During ATWS (Chexal-Layman)

0%

5%

10%

15%

20%

25%

-4 -3.5 -3 -2.5 -2 -1.5 -1 -0.5 0 0.5 1 1.5 2 2.5 3

Collapsed water level relative to Top of Active Fuel (TAF) [m]

Fis

sio

n p

ow

er (

% o

f fu

ll f

issio

n p

ow

er)

10 Bara

20 Bara30 Bara

40 Bara50 Bara

60 Bara

70 Bara80 Bara

1st SRV1 Bara

3D neutronic (KKL Sim.)70 bar - 1 m

70 bar - 0.75 m

NO MORE RECIRCULATION

HIGHER CORE FLOW

Jet pumps Coastdown


- 18 -

The critical injection rate for controlled ATWS may be expressed by the following (simplified) equation:

fissiondch

critical

LG

rrrualno

erheating

LG

fissiondchi

PP

hhwith

h

HHPPHCP

h

PPm

05.0

//037.005.1'''

7.03.07.0min

sup

'''

State-of-the-art simulations using a 3D model is recommended for SAMG implementation. The given formula is only given to illustrate the feedback dynamic of water injection during ATWS for BWR or to give a first idea for the injection rate.

At KKL, an injection rate of 44 kg/s (e.g. RCIC or Hinterberg) leads to a sufficient water level with a fission power oscillating between 3 and 8%.

5. KKL results considering AM

Considering Accident Management Actions has 3 positive, distinct effects:

It reduces the core damage frequency

It reduces the overall radioactive release (consequences)

It allows more time until release

An example for some major KKL Key Plant Damage States is shown below:


- 19 -

6. Conclusions

The importance of plant-specific severe accident simulations has been shown. This should however never replace engineering judgement and experience, since they are two complementary aspects for a state-of-the-art SAMG implementation. KKL is convinced to have a sound plant specific basis for developing, verifying and establishing SAMG by use of an advanced PSA Level 2 applications.

7. Acknowledgment

The authors wish to thank Wolfgang Hösel for the review of this paper as for his constant support through the development and validation process of the KKL MELCOR deck. The authors wish to acknowledge the technical support provided by RMA.

8. References

R.M. Summers et al., MELCOR: A Computer Code for Nuclear Reactor Severe Accident Source Term and Risk Assessment Analysis, SAND90-0364, NUREG/CR-5531, Sandia National Labs, Albuquerque, January 1991.

Risk Management Associates, Inc., RMA 040, Kernkraftwerk Leibstadt Probabilistic Safety Assessment Level 2, 2001.

BET-00-082, KKL internal report, Hydrogen Problematic During Large Drywell LOCA, O. Nusbaumer, H. Eitschberger, H. Steffen, 2000.

BET-00-178, KKL internal report, Fission Power during a Postulated ATWS Accident at KKL, O. Nusbaumer, W. Hösel, H. Eitschberger, 2000.

Date post:	03-Jan-2017
Category:	Documents
Upload:	truongnhu
View:	231 times
Download:	1 times

SAMG-related Insights gained by Level 2 PSA Calculations

Documents