«Item 7b Severe Accidents Related Issues Preliminary Monitoring Report Report to the Federal Ministry of Agriculture, Forestry, Environment and Water ...»
It should be noted that validation of the currently used codes was carried out on experiments that do not necessarily reflect WWER plant specific features. This is an additional contributor to the uncertainties associated with the results of SA obtained for Temelín NPP, and especially affects the in-vessel portion of the accident progression calculation due to differences in reactor coolant system layout (e.g., horizontal steam generators) and reactor pressure vessel internals design, and the ex-vessel portion of the analyses insofar as differences in containment layout are concerned.
In some cases the existing uncertainties may have an impact on the selection of specific SAM measures. Therefore, in the plant specific applications, due attention should be given to the assessment of uncertainties using code to code comparison and sensitivity analysis with respect to various modeling assumptions and parameters. The sensitivity/benchmarking tests should be accompanied by the engineering evaluation.
The plant specific analyses conducted for the development of AM should be based on best a estimate approach and using evaluation models for the plant. This involves selection of best ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues 49 estimate correlations and use of realistic assumptions and criteria. One of the relevant aspects is the selection of suitable core damage criterion. This criterion should be ‘realistic’ and also consistent with the approach taken in SAM. The criterion for the onset of core damage recommended by Westinghouse for the use in AM is based on a directly measurable parameter. The parameter used in the Westinghouse EOP/SAMG approach is the reactor coolant temperature at the core outlet measured by the coolant thermocouple system. The value of 650 oC is recommended by Westinghouse to be used as an indication of the onset of core damage.
It is important that all relevant assumptions, criteria and input parameters that may affect the results be identified and clearly defined. Attention should be given to the assessment of applicability range of the models and correlations and their suitability with regard to plant specific features. In the computer codes used currently for severe accidents simulation there are a number of modelling options and the need for user definition of model parameters.
Specific modelling issues that involve analyst decisions such as in-vessel core degradation phenomena, consideration of creep failure mechanism, direct containment heating (DCH), debris transport, quench, and coolability of corium, steam explosion in RPV and cavity, accident induced rupture of the RCS piping and SG tubes, and the accident induced loss of containment should be subject to comprehensive engineering evaluation. The evaluation should include the sensitivity analyses.
Current plant status Analytical tools applied in SA analysis at the Temelín plant have been described in the presentations [Duspiva 03, Jakab 03]. The tools include a number of integral and mechanistic separate effect codes.
The main computer code used in the severe accident analysis for Temelín was MELCOR 1.8.3. The Czech regulatory authority (SUJB) has certified this version. The newest version of the MELCOR code (1.8.5) is under adaptation (the existing analyses are planned to be updated using this version of the code).
In addition to MELCOR integral code, some mechanistic separate effects codes have also been used – ICARE-2 for the analyses of fuel damage progression during SAs and CONTAIN code (version 1.12) for the analyses of containment phenomena including DCH aspects. The code WECHSL, which is part of the integral code ASTEC being developed in EU, was used for MCCI calculations.
The fission product releases were calculated with the mechanistic code IODE, developed in Switzerland and successfully tested in International Standard Problem ISP-41 [Duspiva 03].
The Institute for Nuclear Research (ÚJV) Řež has conducted all SA analyses for Temelín NPP; it works at the same time as a TSO for Czech NPPs and SUJB. ÚJV Řež was deeply involved in the severe accident analysis from the early 1990s. The personnel involved in the calculation are highly qualified and have necessary expertise including the knowledge of severe accident phenomenology, familiarity with the tools and detailed knowledge of the plant.
This team is reported [Duspiva 03] to actively participate in the international research activities (CSARP, EU FWP, OECD) and code validation exercises. In relation to MELCOR, the expertise was consolidated through considerable support from MELCOR developer team (MCAP) and international exchange of user experience (MCAP, EU FWP, ISP).
50 ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues Evaluation From the presented material [Duspiva 03, Jakab 03] it can be concluded that the Czech experts involved in the SA analysis for Temelín NPP have access to relevant computer codes, information and data, know-how, and lessons from practical experience. They are deeply involved in international programmes in the area of SA research, development and validation of analytical tools, and their application. Several examples where given during the Prague workshop that support this statement.
Efforts to reduce considerable uncertainties in the results of SA analysis, which is one of the generic issues, are clearly visible. The team tries to use the state-of-the-art codes and experience from other code users. However, some concerns can be expressed in relation to the uncertainty and sensitivity analyses. No information was provided on this subject in the workshop presentations. The highest uncertainties, which may have an impact on SAM measures and containment challenges (e.g. in the areas of core loss of geometry, in-vessel and exvessel core coolant interaction, and hydrogen combustion) should be subject to engineering evaluation and sensitivity analysis.
It should be noted that proper evaluation of the existing Temelín analyses with regard to modelling aspects would require detailed investigations that involve specialized expertise and significant effort. Such evaluation is beyond the scope of this project. In this situation, an independent review of SA analysis conducted or used in the development of SAM (e.g. by IAEA under the IPSART or RAMP missions) would be desirable.
Future actions by the operator/regulator, which are recommended on the technical level to be monitored jointly in the framework of the pertinent bilateral Agreement between Austria and
the Czech Republic:
• The Specialist’s Team would recommend the Austrian Governement to consider supporting that an independent review is performed for the area of SA analysis. It is worth noting that IAEA RAMP provides such assistance at various stages of SAMP development.
RAMP review limited to the area of SA analyses could be conducted before final implementation of SAMG. Such review would also assess the scope of the analyses and quality aspects including those discussed in Sections 3.1.4 and 3.1.5.
3.1.4 Adequacy and Completeness of Documentation of the Accident Analysis
VLI No. VLI title / description 2.4.1 Are there a plant specific data compiled into a single document/file (“Database of the Analysis”) 2.4.2 Is there a comprehensive description on how plant data were converted into a code input deck for SA analysis (“Engineering Handbook”)?
2.4.3 Are the input data, assumptions, and model information complete and adequately documented? Is there a complete list of all input variables required for severe analyses code?
2.4.4 Has the selection of optional code/model parameters been properly documented (including justification)?
2.4.5 How have the input data for individual accident scenarios been archived?
2.4.6 Are the results of accident analysis adequately documented? Can the results be properly linked with the specific input deck? Is there a comprehensive description of the accident scenario and the code version used in the simulation?
ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues 51 State-of-the-art requirements and practices Complete and adequate documentation of the information used in the analysis and results of analyses is important to facilitate proper use of data and to ensure the traceability of results.
All input data, assumptions, and model information should be compiled into a single document (“Database of the analysis”) [IAEA 03]. The scope of data is typical for the majority of the integral codes applied in the SA analysis. Data include hydrodynamic component data, physical and chemical data for structures, data for peripheral systems, reactor protection and reactor kinetics data. The geometrical characteristics of the plant and plant performance data should represent ‘as built’ conditions. All data sources should be referenced. It is recommended that in addition to the database document there is also a comprehensive description on how plant data were converted into a code input deck (so called “Engineering Handbook”). This document should describe relevant features of the model and assumptions.
The collection of data and the preparation of database documentation should be carried out with adherence to a thorough QA procedure. Documentation of the input data should be subject to independent review. Records of the review should be included.
The documentation of the results of accident analysis should include a complete description of the accident scenario, relevant information on the code version, and reference to the specific input deck. All relevant data needed for reproducing the analysis should be available including code modelling options and parameters. Presentation of the results typically includes comprehensive description of plant response (behaviour primary and secondary system, and containment), timing of main events, summary of peak quantities, information on source term, and discussion/interpretation of results. Selected parameters should be represented in a graphical form. Archiving the input deck in electronic form for a reasonable period of time is considered a good practice.
Current plant status Plant specific data have been collected and are available for severe accident analyses conducted by UJV Rez [Kujal 03].
It is reported that a ‘Temelín Database’ has been prepared for the area of SA analysis [Duspiva 03]. This database covers all important process systems and safety systems as well as the containment buildings. Plant specific models have been prepared for the core, RCS, secondary system, safety systems, plant control systems and relevant operational systems. No detailed information has been made available on the related documentation, its completeness and adequacy.
Information on the documentation of results of the existing SA anlysis is limited. Some highlevel summary information on this subject was provided during the Prague Workshop and in previous meetings in 2001.
Evaluation Insufficient information is available upon which to draw a conclusion on this aspect of the SAM programme. A Temelín database has been prepared. However, it was not discussed in any detail and was not available for review. None of the severe accident calculations (along with their parameter and modeling choices) was available for review.
52 ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues
VLI No. VLI title / description 2.5.1 Is there a formal QA programme applicable for SA analysis?
2.5.2 What arrangements are in place to ensure that the analyses are traceable and reviewable?
2.5.3 Have any independent reviews of SA analyses been conducted at the plant?
State-of-the-art requirements and practices Basic QA rules applicable to safety analyses in general should also be followed during performance of the plant specific SA analysis. The following recommendations defined in IAEA
guidelines [IAEA 03] are applicable:
Formalised QA programme document should be developed, Analyses team should be qualified for the job (qualifications should be documented), Responsibilities of all experts involved should be specified, All documents needed for a subsequent review should be recorded, Only validated and accepted methods should be used, Results of analysis should be independently reviewed, All differences found in the review should be resolved before the final use of results, Complete supporting analysis should be archived for a reasonable period of time.
Current plant status It is reported [Sỷkora 01 a] that a formal QA programme applicable to safety analysis was established and executed at the plant and TSO for carrying SA analysis starting from 1994. No details are available relating this programme. A QA programme was also reported applied to the PSA. One of the internal procedures related to QA aspects was mentioned in the presentations during the Prague workshop (CR SONS VDS-030 “Internal Procedure on the Assessment of Computer Codes Used for Safety Related Analyses”) [Duspiva 03].
Evaluation QA was applied for the SAM supporting calculations starting from 1994. No information is available on the details of this programme.
3.2 Development of SAM Strategies Generally, a SAM strategy is a method that can be used to recover from or mitigate a specific challenge during an accident that involves core damage. Plant specific strategies are normally developed using a systematic process, which starts with the evaluation of high level generic strategies that are applicable to specific type of NPP (e.g. those defined in [WOG 94] for PWRs). The next step is the evaluation of all lower level strategies that can be implemented within each of the high level strategies using plant specific features.
Important aspects relating to the definition of SAM strategies are discussed in the following subsections. Section 3.1 addresses the selection and definition of strategies. The review of plant capabilities as designed that can be used in the implementation of the strategies is discussed in Section 3.2. Use of external equipment is addressed in Section 3.3. Formal definition and documentation aspects are addressed in Section 3.4.
ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues 53
3.2.1 Selection of SAM Strategies
VLI No. VLI title / description 3.1.1 Do the selected AM strategies cover all relevant functions?