«Item 7b Severe Accidents Related Issues Preliminary Monitoring Report Report to the Federal Ministry of Agriculture, Forestry, Environment and Water ...»
3.1 Accident Analysis done by CEZ-ETE to Support SAMG Programme Severe accident analysis that is intended to support the development of SAM and SAMGs should fulfil multiple objectives. They include understanding of major SA phenomena including their timing, gathering insights relating to plant behaviour during SA including source terms, identification of plant weaknesses to SA, identification of SAM mitigative measures/actions and related plant improvements, and validation of SAM measures with respect to their effectiveness and consistency with plant design capabilities.
It should be noted that a considerable number of deterministic severe accident analyses is normally performed to support the development of Level 2 PSA. In addition, the plant specific PSA itself provides useful insights relating to the risk.
Supporting accident analysis used to backup the development and implementation of AMP can be evaluated based on good practice criteria described in the IAEA guidelines [IAEA 03, IAEA 99]. These criteria address both the quality of the analysis and its scope/ level of detail.
The following sections address these aspects in more detail.
The availability and use of plant specific PSA is discussed in Section 3.1.1 Section 3.1.2 provides some background information related to the scope and level of detail of the existing severe accident analysis. Modelling aspects of severe accident analysis are discussed in Section 3.1.3, documentation of the analyses in Section 3.1.4, and the related quality assurance (QA) aspects in Section 3.1.5.
3.1.1 Availability of PSA and Other Supporting Safety Studies
VLI No. VLI title / description 2.1.1 Has the plant specific PSA been completed? Is there any work for PSA update on-going?
2.1.2 Were the plant specific PSA results available for the identification of SAM strategies?
How these results have been used in the development of SAMP?
2.1.3 Have Level 1 accident sequences beyond 24 hours been investigated in relation to SA?
2.1.4 Have any plant specific severe accident insights/strategies been identified in the PSA study?
State-of-the-art requirements and practices A plant-specific PSA and supporting accident analysis are recognised as very important elements in the development of SAM programme and SAMGs. They serve as an important means to ensure that the SAM guidance prepared is appropriate for the plant, in terms of identifying potential challenges, verifying applicability of strategies, and supporting implementation activities such as guideline validation. One of the first tasks in developing the plant specific SAMP is to identify the severe accident phenomena and scenarios, which can result in failure of the plant fission product boundaries. PSA, if available, is the best information source for these investigations.
A comprehensive PSA Level 1 and 2 provides a tool, which can be used to identify plant vulnerabilities and also to measure the effectiveness of accident management measures to reduce risk. Preventive AM measures can be incorporated into level 1 PSA, and the mitigative measures modelled in the level 2 PSA. The reduction in predicted risk profile (in terms of the source terms and their frequencies) is a measure of the impact of implementing AM. It should 42 ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues be noted that both Level 1 and Level 2 parts of the PSA are needed in order to be able to take credit for both preventive and mitigative measures.
In the USA practice [NRC 88, NUMARC 92-01, NEI 94], the issues related to severe accidents have been addressed through the assessment of plant specific Individual Plant Examinations (IPEs) and other supporting studies. This assessment focused on providing information on relevant fission product release pathways, contributing severe accident phenomena, dominant core damage sequences and contributing failures. It includes any ‘insights’ identified during the performance of the IPE, which would reduce risk and any ‘vulnerabilities’ reported in the IPE in response to Generic Letter 88-20 [NRC 88, NRC 90].
So far not many plants of WWER 1000 type have Level 2 PSA. A preliminary PSA study has been developed for Balakovo NPP (WWER 1000/320). It can be noted that in this study containment bypass scenarios (mainly PRISE) have been found to be a dominant contributor to the radiological risk of the plant [Morozov 03].
Current plant status The Temelín specific PSA (Level 1 and 2) was developed in 1996. This study is currently being updated in order to reflect the actual knowledge of plant design and procedures (symptom based EOPs introduced in 1996), state-of-the-art PSA techniques, resolution of IPERS recommendations to the original 1996 study, the final plant design, and experience gained from other PSAs conducted for WWER 1000/V320 units.
Summary results of Level 1 updated study (2001 status) are provided in Refs [ČEZ 02, Mlady 03 a, Mladý 03 b]. PSA Level 2 upgrading study is reported being underway (in co-operation with Scientech Inc.). The ongoing project on updating the Level 2 PSA is to be finalized by the end of 2003. Preliminary results from this study have been made available for the PN 7 project during the Prague workshop [Mlady 03 a, Mladý 03 b].
The Temelín PSA is reported to be a full scope study, which addresses internal and external initiating events and covers full power operational states and shutdown conditions. However, risk contributions from external events and shutdown risk were not discussed in details in the presentations given during the Prague workshop [Mlady 03 a]. It seems that this part of the PSA upgrading study is not completed yet. The upgraded PSA is reported to incorporate further improvements in modelling (e.g. common cause failures, treatment of dependencies, more realistic success criteria, etc.) and data (updated using WWER operating experience).
The PSA includes uncertainty analysis addressing all the modelling parameters included in the PSA database. No information was provided on the sensitivity analysis with regard to modelling assumptions.
It was reported that the most significant SA scenarios to be used in the development of SAM and SAMGs were identified in 1996 based on PSA Level 1 and 2 [Sỷkora 01 a]. These included three basic groups of severe accidents scenarios: the primary to secondary LOCA (PRISE) without operator actions, large RCS LOCA without emergency core cooling system (ECCS), and loss of off-site power (LOSP) leading to station blackout.
At that time the core damage frequency (CDF) was clearly dominated by the scenarios initiated by PRISE, (73% of the total CDF) followed by large LOCA (8,8%), small LOCA (4,5%) and LOSP (3,0%). In the most recent PSA Level 1 [Mlady 03 a], this risk profile changed considerably. The new CDF risk profile is relatively well balanced such that there are no dominant initiating events for accidents or individual combinations of failures (minimal cutsets) leading to core damage [Mlady 03 b]. The dominant scenarios identified in the old study remain the risk significant contributors (small LOCA – 22,1%, medium PRISE – 20,7%, LOSP – 17,8%) in the updated internal events analysis.
ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues 43 Evaluation A plant specific PSA was available and used in the identification of plant specific vulnerabilities to SA and development of AM strategies. Input from the upgraded PSA is being used in finalizing implementation of SAMGs. However, the full scope Level 2 PSA has not been completed yet (risk related to external events and shutdown risk is not considered).
It should be noted that external events may have an impact on the risk-profile however preliminary results presented at the Prague Workshop indicate that the core damage frequency impact is not expected to be large and these results are not expected to bring insights on any new SA challenges. Therefore, this is not an important issue from the point of view of SAMG development. Shutdown PSA may generate some new issues that should be addressed within SAM. So far, only very few plants (Borssele, Netherlands; Goesgen, Switzerland; and Koeberg, South Africa) addressed the accident scenarios initiated during shutdown conditions in plant specific SAMGs. For Temelín, this issue can be addressed after SAMGs for full power operational states are implemented. Based on the experience from other plants, extending full power SAMGs to cover shutdown conditions is relatively simple [Van Haesendonck 01].
Based on the results presented so far, it can be concluded that in terms of core damage (CDF) the current risk profile of the plant is relatively well balanced. It is worth noting that although the relative contributions to CDF changed as compared to results obtained in 1996 PSA study, the scenarios selected in 1996 as the basis for the development of SAM are still valid.
The information presented during the Prague workshop [Mlady 03 a] seems to indicate that the plant specific PSA reflects the current state-of-the-art in the area of PSA. The original 1996 study was subject to external review (IAEA IPERS mission) and the resulted recommendations are reported incorporated in the upgraded study. Detailed evaluation of the PSA study within the PN7 project was beyond the scope. However, it is believed that the study was performed in compliance with the current state-of-the-art. Some observations can be made with regard to PSA modelling based on the presentations given during the Prague workshop. They are briefly discussed below.
The initiating event frequency used in the PSA model for small break LOCA is very conservative as compared with the available world--wide industry data. This issue is not expected to affect the selection of SAM strategies, but it certianly has an impact on the plant risk profile and perhaps on decisions on the allocation of resources to reduce SA risk.
It was shown that the Level 1 model (CDF) had been subject to uncertainty analysis with regard to reliability parameters [Mlady 03 a]. Sensitivity analyses on basic modeling and phenomenology assumptions were not discussed at the Prague meeting. This issue seems to be important in relation to Level 2 PSA (indeed it is important in all Level 2 PSA studiesw) which is subject to considerable uncertainties. For instance, the impact of early hydrogen burn on accident progression was not investigated. It is worth noting that without dedicated devices for deliberate ignition, which seems to be the case for Temelín, the assumption that hydrogen deflagrations occur at the early phase of accident involve considerable uncertainty (see related comment in Section 3.1.3). Therefore, the risk impact of this assumption should be assessed by the sensitivity analysis.
Some inconsistencies between the PSA and the existing supporting analyses can be observed. For instance, there is a relatively high contribution (~ 28%) of ‘early containment failures’ due to basemat melt (through the penetrations and instrumentation channels located in the cavity wall) [Mlady 03 a], which seems to be inconsistent with the results obtained from severe accident analyses [Kujal 03, pages 16-18]. These SA calculations indicate that the rate of corium-concrete interaction in the region of vertical gauge channels is by one order of magnitude lower than in the reactor cavity region. Therefore, a failure of basemat by melting through the vertical gauge channels should be expected later than failure due to basematETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues melt in the cavity region. This failure is hard to be considered as an ‘early’ failure. This issue does not have any impact on the selection of SAM strategies, however, there appears to be an incoherence between the deterministic severe accident calculations and the probabilistic modeling of the phenomena in the PSA. This issue may indicate deficiencies in QA when carrying out safety analyses.
It seems that the interface between the PSA team and thermal hydraulic (T/H) accident analysis team needs improvement. Basic QA rules applicable to safety analysis should be followed also in the PSA area. General comments on QA programme in safety analysis are also given in Section 3.1.5.
The existing Level 2 PSA should be used to assess the effectiveness of ‘mitigative’ AM measures proposed within the plant specific SAMGs. The Level 2 PSA model is indeed capable of quantifying the fission product release frequency and magnitude and should be used to assess the impact of SAM in terms of the source term. No source term results, which could support such evaluation, were reported for Temelín at the Prague Workshop.
3.1.2 Scope and Level of Detail of the Existing Severe Accident Analysis
VLI No. VLI title / description 2.2.1 Is the level of detail of accident analysis adequate to support all needs of SAMP development? How many accident scenarios have been analysed for accidents scenarios without operator’s actions and for scenarios with AM measures?
2.2.2 What scenarios have been analysed with regard to system success criteria (e.g. timing and rate of ECCS injection during the in-vessel or ex-vessel phase) 2.2.3 What potential plant upgrades in relation to SAM has been identified as the result of severe accident analysis?
2.2.4 Certain Temelín severe accident progression calculations were reported in the Melk Protocol meetings in April and September 2001, and in the CEZ-ETE presentation at the NEA-OECD meeting in September 2001. What, if any, additional severe accident scenarios have been modelled in connection with SAMG development and implementation?
State-of-the-art requirements and practices Severe accident scenarios that should be selected for the analysis to support SAM can be grouped into two major categories: accidents without operator actions/AM measures and accidents in which AM measures are considered.
The first group includes sequences that would lead to core damage, core melt, vessel failure, containment failure, and release of fission product to the environment. Accidents of this type are analyzed as a first step of SAM investigations to gain an understanding of the plant behaviour during SAs, to determine severe accident phenomena important for the specific design, and to understand and rank challenges to fission product barriers.