«Item 7b Severe Accidents Related Issues Preliminary Monitoring Report Report to the Federal Ministry of Agriculture, Forestry, Environment and Water ...»
Since the number of sequences leading to the release of radioactivity is very large the selection is made based on a systematic categorization of sequences. The categorisation scheme is typically based on several state attributes such as initiating event (IE) group and status of safety systems (emergency core cooling, secondary heat sink, containment heat removal and containment boundary). Some guidance can be found in the IAEA guidelines [IAEA 03].
The number of sequences within this group depends on the applied grouping of IEs and in PWR practice is of the range 20 – 30 sequences. For instance, SA simulations conducted at the initial stage of SAM investigations (for the WWER 440/213 plant) within the Phare project 4.2.7.a and 4.2.7.a/93 [WESE 96, WESE 97] included 20 SA sequences. It should be noted that insights from plant specific PSA provide a sound basis for the selection of most important scenarios (as discussed in Section 2.1).
ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues 45 At the later stages of SAM investigations the analyses focus on confirmation and optimization of SAM strategies. Typically, scenarios selected in the initial phase are revisited and recalculated assuming specific operators actions and AM measures. Focus is put on system capabilities to perform the required functions, selection of symptoms to be used to initiate AM measures, investigation of time margins for AM actions, and identification of potential plant upgrades. Additional input is also required for the calculation of setpoints used in SAMGs and development of computational aids.
Current plant status The analytical work to provide support for the development of Temelín SAM was initiated in 1991. [Sỷkora 01 a]. The analyses of SA scenarios were performed by Nuclear Research Institute (ÚJV Řež) which acts as TSO for all Czech NPPs.
In the period of 1991-93 a number of SA scenarios initiated by various LOCA events were simulated using the STCP-M package (MARCH3-M code). These scenarios included both high and low pressure scenarios. A broad spectrum of LOCAs (25, 40, 100 and 2×850 mm) and transients (plant blackout, loss of FW to SGs) were addressed in these calculations.
Scenarios that involved consequential LOCA events (caused by a station blackout and loss of RCP seal cooling) were also addressed. Source Term calculations were performed for selected cases which had high frequency of occurrence or involved early and severe radiological consequences.
The calculations focused on the investigation of accident scenarios without operator actions.
Several cases, which differed with the availability of safety systems (ECCS, CSS, EFW, electrical power, etc.), were simulated for each of the accident initiators. Investigations of AM measures were limited.
Specific SA scenarios covered in these calculations are described in the paper presented by Kujal [Kujal 94]. They include 19 simulations – 2 cases for LOCA 25 mm, 6 cases for LOCA 40 mm, 1 case for LOCA 100 mm, 4 cases for LB LOCA (2×850 mm) and 6 cases for transient group). One of the LOCA 40 mm cases was intended to address impact of corium spreading outside the reactor cavity.
The calculations provided early insights on plant vulnerabilities and potential AM measures (RCS depressurization and opening of the reactor cavity to slow down progression of molten core concrete interaction (MCCI)).
Starting from 1994, analytical investigations of SAs were continued using more advanced simulation codes, improved plant and component models, and consistent input data. All activities were subject to a systematic QA. These simulations were performed using the MELCOR code version 1.8.3 (adopted for WWER 1000 NPPs), ICARE-2 (analyses of fuel damage) and CONTAIN code version 1.12 (analyses of containment phenomena).
An overview of the calculations performed with the advanced SA codes is given in the material provided by Czech side or published elsewhere [Sỷkora 01, SONS 01, Pazdera 03, Kujal 03].
Two scenarios – medium break LOCA 100 mm with station blackout and transient without operator actions – were calculated in the initial phase of these investigations [Sỷkora 01 a].
The latter scenario was analysed as a typical high pressure SA scenario accompanied by SA phenomena (DCH, hydrogen burn and basemat melting through).
New calculation cases were defined and investigated when PSA results become available.
These included three groups of scenarios: Large primary to secondary (LOCA (40 mm) without operator actions (PRISE), LB LOCA (DN 200 mm) on pressurizer surge line (without active ECCS, and station blackout. There were specific cases within the PRISE and LB LOCA groups that addressed impact of selected SAM measures (corium spreading over the expanded cavity area) or certain SA phenomena (direct containment heating - DCH), steam 46 ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues explosions, hydrogen explosion, long term overpressurization of the containment). One of the recent calculations investigated the scenario in which LP ECCS is restored in the ex-vessel phase [Pazdera 01].
More detailed description of the scenarios can be found in Annex A. The number of calculated cases performed in this phase of the investigations is not known. It was reported that further analyses are planned be performed in the end of 2003 using the latest version of MELCOR code (1.8.5).
The calculations provided insights to support decisions on the implementation of various SAM strategies and potential plant upgrades. The relevant insights obtained from the analyses are discussed below.
The penetration of the basemat by molten corium was shown to be a significant threat to the containment integrity. Corium spreading to the room adjacent to the reactor cavity has been found to reduce the rate of molten corium concrete interaction (MCCI) during ex-vessel phase of a SA. The corium spreading strategy was therefore adopted at Temelín. Related planned modifications of the plant include the installation of a remote control system to open the reactor cavity door before the RPV break and placing removable physical barriers to restrict molten corium pool area and protect equipment hatch against MCCI. Additionally, the existing penetrations and reactor cavity instrumentation channels are planned to be protected for the case of molten corium attack by individual concrete plugs.
The protection against long-term overpressurization of the containment needs to be provided.
The existing containment pressure test depressurization line with filters and throttle valves as the ultimate means of containment venting is proposed to be used to implement this strategy.
Evaluation The extent of SA analyses performed for Temelín (in terms of a number of SA scenarios without the operator actions covered) is sufficient to provide a good understanding of most SA phenomena and challenges to the plant. From this point of view the situation is similar to other plants. Insights obtained from the analysis have been used to support SAM strategies.
However, large part of these simulations is old and they do not necessarily reflect the current plant status and state-of-the-art in the area of SA codes and modelling. Newer calculations performed with MELCOR code version 1.8.3 are limited to several cases.
It seems that no calculations were performed recently to assist in the optimization of SAMG strategies and with regard to system operation success criteria (e.g. timing and rate of ECCS injection during the in-vessel or ex-vessel phase). The situation should improve after completion of the set of analyses planned for the end of 2003 (using MELCOR version 1.8.5).
ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues 47
3.1.3 Modelling Aspects of the Existing Severe Accident Analysis
VLI No. VLI title / description 2.3.1 What computer codes were used in the severe accident analysis?
2.3.2 Which organisations were involved in the calculations of severe accidents (external subcontractors or plant staff)?
2.3.3 What qualifications have the personnel involved in the calculation?
2.3.4 To what extent the SA analysis is based on best estimate assumptions?
2.3.5 Were all phenomenological criteria/assumptions identified and clearly defined
for the following issues:
(a) Fuel cladding and fuel degradation/failure, (b) Zr-UO2 and Zr-steel reactions, (c) Core relocation, (d) Failure of internal supports and RPV bottom head, consideration of creep failure mechanism, (e) Direct containment heating, (f) Debris transport, quench and coolability of corium, (g) Steam explosion in RV and cavity, (h) Accident induced rupture of the RCS piping and SG tubes, (i) Accident induced loss of containment.
2.3.6 Have benchmarks been conducted for verification of models and data used in SA analysis?
2.3.7 Have the models been verified by code to code comparison tests, sensitivity studies, and comparison with the results obtained for other similar plants? Which scenarios were subject to such comparison? What were the conclusions from such comparison?
2.3.8 Have modelling assumptions and/or parameters been subjected to sensitivity/uncertainty analysis? Which parameters were subject to this analysis?
Which accident scenarios were selected for these investigations?
2.3.9 Have benchmarks been conducted for verification of models and data used in SA analysis?
2.3.10 Have the models been verified by code-to-code comparison tests, sensitivity studies, and comparison with the results obtained for other similar plants? Which scenarios were subject to such comparison? What were the conclusions from such comparison?
2.3.11 Have modelling assumptions and/or parameters been subjected to sensitivity/ uncertainty analysis? Which accident scenarios were selected for these investigations?
State-of-the-art requirements and practices Beyond design basis accidents and severe accidents are analysed with ‘realistic’, best estimate codes. These codes include integrated codes and mechanistic separate effects codes.
Integrated codes combine models in one package: for heat transfer, fluid flow, fission products release and transport, plant system operation and performance, and operator actions.
The codes of this type incorporate physical models for processes that are important during transients leading to and go beyond fuel damage, and all models are coupled at every time step. The best known and most frequently codes of this type are MELCOR and MAAP.
MELCOR has been developed by Sandia National Laboratories for the US Nuclear Regulatory Commission (NRC) and succeeded the existing Source Term Code Package [SNL 91].
This code is most frequently used for severe accident analysis in WWER NPPs.
MELCOR is a fully integrated, relatively fast-running code with the flexibility to model a wide spectrum of severe accident phenomena in light water reactor nuclear power plants. CharacETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues teristics of severe accident progression that can be treated with MELCOR include the thermal-hydraulic response in the reactor coolant system, reactor cavity, containment, and confinement buildings; core heatup and degradation; radionuclide release and transport; hydrogen production, transport, and combustion; core-concrete attack; heat structure response;
and the impact of engineered safety features on thermal-hydraulic and radioactive effluents behaviour. The use of parametric models is limited in general to areas with great uncertainties where there is no consensus concerning an acceptable mechanistic approach.
MAAP is a fully integrated code that can simulate the response of light water reactor plants during SA including actions taken as part of the accident management. The spectrum of severe accident phenomena covered in MAAP 4 is similar to the one represented in MELCOR.
The code uses a control volume and flow approach, however, the geometry of the control volumes is pre-specified (depending on reactor type).
Mechanistic codes are applied for detailed investigations of individual phases of the accident progression, to model separate effects and /or where it is felt that model details in integrated codes is not sufficient to produce reasonable results. Examples for widely used mechanistic codes are SCDAP/RELAP5, CATHAR-ICARE and ATHLET-SA (in-vessel phenomenology) and COCOSYS (RALOC), CONTAIN (for containment studies including hydrogen and FP behaviour) A key element in using codes (both mechanistic and integrated) is the demonstration that the codes’ predictions may be fully relied upon when providing the basis for accident management programmes to be established. This needs to be done by qualifying the code against experimental evidence, other codes, and engineering judgement.
The recognized computer codes that are applied for SA simulation are normally subject to extensive verification and validation (V&V). V&V benchmarking covers a range of phenomenological issues. Some validation efforts were also undertaken on larger integral standard problems.
MELCOR has been successfully validated by the code developers through multiple SA standard problems and code-to-code comparisons [Gauntt 01]. The results of code-to-data comparisons indicate that with the proper choice of user-specified modeling parameters, the code can match the general trends observed in the experiments and predicted by the more detailed codes (such as SCADAP/RELAP5). However, a relatively strong ‘user’s effect’ can be observed.
Results of code-to-code comparisons have shown a wide divergence in the predicted responses of the plants. The highest uncertainties that may have impact on SAM measures and containment challenges exist in the areas of core loss of geometry, in-vessel and ex-vessel corium-water interaction, hydrogen combustion, and molten corium concrete interaction (MCCI).