«Item 7b Severe Accidents Related Issues Preliminary Monitoring Report Report to the Federal Ministry of Agriculture, Forestry, Environment and Water ...»
It is at Level 4 that the design of NPPs of Temelín vintage (early 1980s) did not originally provide sufficient hardware and software means for coping with beyond design basis accidents (BDBA). The NPPs designed recently take BDBAs into account both in the design and operational stage and provide means to control them so that most BDBAs do not lead to core damage. The older plants do not have such technical means, for example the measures for depressurization of the RCS are not as efficient as in new designs (for EPR the capacity of PORV is 900 t/h, for older plants about 150-200 t/h) or protection against molten coriumconcrete interaction does not fully prevent hazards of basemat penetration. Nevertheless, old NPPs were often found to have considerable safety margins, especially those with large dry containments such as those in Zion or Surry NPP in the US.
The US NRC recognized this and found that in NPPs with large dry containment several issues important for severe accident management can be resolved by proper implementation of SAMGs without hardware upgrading. Such issues include hydrogen hazard, Direct Containment Heating, in-vessel and ex-vessel steam explosion. In EU the situation in NPP safety regulation area is rather different and more complicated, depending on the country. For example Spanish NPPs follow the requirements of US NRC (with some exceptions for Trillo, which is a Siemens PWR), while German and French practice is based on RSK and IPSN guidelines. In the result, both German and French NPPs with large dry containment have installed or are planning to install hydrogen recombiners, although such recombiners are not required in the US or Spanish NPPs. Of the 95 PWRs in Western Europe, the only PWRs which have not installed (or for which a decision has not already been made to install) severe accident-designed PAR units are the 6 American-designed PWRs in Spain and the 3 American-designed PWRs in Sweden. In the French NPPs the backfitting including hydrogen recombiners was decided recently and will be implemented over the next few years.
There are however some issues, where backfitting is difficult and expensive in terms of financial costs and workers’ exposure. This concerns first of all the MCCI after RPV failure.
For new designs such as EPR it is planned to spread the molten corium over an additional area and to install a protective zirconium layer inside the basemat, protected from above with sacrificial concrete layer (to prevent direct attack of oxide corium on zirconium) and cooled from below with a special cooling system, capable of removing decay heat from the corium.
In case of old designs no such design changes are reasonably practicable.
For example in Borselle NPP presently in operation in the Netherland the reactor cavity is dry, no corium spreading is envisaged, and in case of RPV failure a melt-through of the basemat is possible within about 3 days. This is also the situation in most other PWRs presently in operation in the EU. The severity of resulting radiological releases depends on the effectiveness of fission product removal by spray systems and/or their deposition on containment internal surfaces but is largely driven by the fact that the bottom of the basemat is located several meters to tens of meters under local grade elevation. By contrast, the WWER-1000/320 plants, including Temelín, have the bottom of their basemats located about 10 meters above the local grade elevation. Calculations show that these processes (sprays and deposition processes) are quite effective, assuring dramatic reductions of volatile fission product concentration in the air within the time span needed for basemat penetration·[TACIS 02].
In the evaluation of vulnerabilities of Temelín NPP to severe accident sequences one should be aware that severe accidents are events of very low frequency, and that no absolute guarantee of safety is given for such sequences in the presently operating reactors in the European Community or elsewhere. However, the measures already implemented and planned in 82 ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues EU and US NPPs are judged by the regulators to reduce the hazards to manageable proportions, both by decreasing their frequency and by mitigating their consequences. In the following chapters it will be considered whether the measures implemented and planned in Temelín correspond to the EU practice (and secondarily to US practice) in this area or not.
Current plant status Temelín NPP has WWER 1000 type 320 reactors, and the first unit of Temelín has been under construction since 1984. It has vulnerabilities typical for reactors designed in the early 1980s (except for the elevated basemat, which is unique to the WWER 1000 design in Europe), although some of the weak points have been recently removed within the upgrading programme implemented jointly by Westinghouse and Temelín NPP. In particular, new instrumentation qualified for accident conditions has been installed, Symptom Oriented Emergency Operating Procedures have been implemented and Severe Accident Management Guidelines based on WOG SAMGs are being developed. Judging by vulnerabilities of other
NPPs designed in the same period, the PN7 team identified the following issues, which require closer scrutiny:
- Protection against Primary to Secondary cooling system leakages (PRISE)
- Depressurization of the Reactor Coolant System (RCS)
- Protection of reactor basemat against penetration in the effect of Molten Corium-Concrete Interaction (MCCI)
- Hydrogen release into containment and the involved hazards of hydrogen burning
- Containment overpressurization Each of these issues has been studied in several NPPs presently in operation in EU countries and/or in the US, and the results compared with Temelín plant status. Following sections of this report discuss detailed findings on how these vulnerabilities are dealth with.
Evaluation Temelín vulnerabilities are similar as in other PWR NPPs designed in the same period (early 1980s) with the exception of the nature of the basemat failure vulnerability owing to Temelín’s elevated basemat. More detailed discussion on whether the measures taken by the plant (already implemented and planned) to deal with plant specific vulnerabilities in accident management in a similar manner to NPPs presently in operation in the EU and US, is provided in Section 5 of this report.
4.1.2 Selection of Sequences for PN7 Analysis
The severe accident scenarios calculated by the PN7 team were chosen so as to cover the main areas of interest in SA management in Temelín NPP, at least as far as it was known before the Prague workshop held in June 2003 in which Czech side presented their SAM strategies and planned hardware improvements. The scenarios were also chosen to cover the most dominant contributors to core damage frequency identified in the updated Temelín PSA [ČEZ 02].
Since the issue of hydrogen hazards seemed the most crucial for containment integrity, the scenarios potentially involving high hydrogen releases were to be studied in detail by IRR/ARCS team, which was in charge of analyses of hydrogen distribution and hazards.
Three scenarios were selected for MELCOR code analyses due to the different hydrogen combustion circumstances presented as well as their contribution to core damage frequency.
These scenarios included blackout, SB LOCA with common cause failure of emergency core cooling and containment spray, and a medium PRISE scenario with extended failure to depressurize the RCS to stop the loss of primary coolant to the environment.
ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues 83 These three scenarios were identified in the revised PSA as the three most likely severe accidents, with a total contribution of nearly 61% of the internal events CDF. Note, however, that during the Specialist Workshop it was identified that the initiating event frequency for small LOCAs is very conservative, and thus the sequence is probably not as probabilistically important as originally thought. Note further that as a result of the MELCOR calculations performed it appears that unless the BRU-A secondary steam relief valve sticks open, the PRISE sequence is unlikely to be a core damage sequence because several days would be available for the plant staff to undertake recovery actions and terminate the sequence short of core damage.) The hydrogen generation and distribution hazards associated with these three scenarios made them of interest with respect to hydrogen combustion hazards. The SB LOCA sequence was identified for analysis due to the hydrogen generation under circumstances where combustible conditions would likely exist in the containment (based on the Three Mile Island Unit 2 accident experience) and the containment sprays would be unavailable to mitigate fission product releases. Due to these circumstances, and due to the limited time available for the analyses, this scenario was selected in advance to be analysed with a 3dimensional computational fluid dynamics (CFD) code (GASFLOW).
The station blackout sequence was selected for analysis based on its CDF contribution as well as the expectation that it would result in one of the largest in-vessel hydrogen releases among PWR accident scenarios. Finally, the PRISE accident was selected for analysis to investigate whether sufficient hydrogen would be released at the time of vessel failure to pose a hydrogen combustion hazard in a containment which would contain very little steam and in which containment sprays would be unavailable. The PRISE accident was evaluated assuming that the BRU-A valve functioned as designed, and also in a variation in which the BRU-A valve stuck open early in the sequence.
Additional scenarios analyzed included LB LOCA with loss of ECCS, chosen as the accident with the fastest RPV failure, for which the effectiveness of corium spreading strategy was to be evaluated. Consequently, the calculations were done in several variants, including corium ejection to reactor cavity only, or corium spreading over additional areas of 25 m2 and 100 m2, the latter corresponding to the area available in the room adjoining reactor cavity.
Another case considered was total loss of feed water (LOFW) with EFWS not available and SB LOCA 50 mm with loss of ECCS and EFWS. These cases were studied to find out the effectiveness of various methods of RCS depressurization when EFWS is not available, and so RCS cooling through SG depressurization is of limited use. Several strategies of SAM were studied, with RCS depressurization by means of opening PORVs on the secondary side of SGs, by using the Emergency Gas Removal System from the RCS and by opening PORV on the pressurizer. The case with no SAM leading to high pressure scenario with RPV failure under high pressure was also studied.
In total the calculations conducted in PN7 teams were meant to provide insights relating to
the following aspects:
- Effectiveness of corium spreading strategy
- Effectiveness of various methods of RCS depressurization
- Plant response to hydrogen releases to the containment
- Containment overpressurization hazards in case of low pressure and high pressure RPV failure scenarios.
84 ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues
4.1.3 Overview of analyses
The cases analyzed cover a wide spectrum of severe accident conditions and can be therefore of interest in reviewing the results obtained for Temelín NPP. The main findings of these analyses are presented in the Annex, in Table A.1. The first set of calculations presented in Annex A (Table A.1), was performed by Czech TSO. It includes analyses of PRISE with two variants (with and without thermal creep modelled), analyses of LB LOCA with loss of ECCS also performed in two variants (with and without hydrogen detonation), the analysis of blackout, and finally the analysis of LB LOCA with late recovery of ECCS [Kujal 03, Pazdera 03].
One of the results reached in Czech calculations is that the principal hazard to containment integrity is the possibility of basemat penetration by molten corium. The strategy of corium spreading and flooding of reactor cavity with water before the RPV failure is evaluated in the Czech calculations to result in significant slowing down of the MCCI processes and the Czech authors claim that eventually the concrete penetration can be completely stopped [Sỷkora 01b, Sỷkora 03].
However, in the light of present day knowledge this claim cannnot be proved. The large-scale experimental work aimed at clarification of MCCI processes is still going on. The existing experimental evidence (from the MACE smaller-scale program and the WETCOR program) does not support the thesis that concrete penetration can be stopped since melt quenching was not achieved in any of these experiments [SKI 2000]. MELCOR code calculations carried out by the PN7 team also suggest that concrete penetration will finally occur.
The set of calculations performed within TACIS programme covered all important severe accident sequences and was used to develop PSA level 2 for Balakovo NPP [Morozov 03]. The results of this work show robustness of large dry containment typical for WWER 1000 units and resistance to hazards of DCH or hydrogen burns, and high effectiveness of WOG SAMGs, which reduce very much the frequency of unmitigated severe accidents.
The analyses performed by PN7 teams are discussed in more detail below in Section 4.2, but generally their results are in good agreement with the Czech and TACIS conclusions.
Some of the PN7 calculations were performed to parallel Czech calculations, which were presented during meetings held before the Road Map process was initiated. These calculations were done with limited nodalization of the containment (11 or 14 nodes in most cases, 54 nodes in one case; compared with 6 nodes most of the Czech calculations). Not surprisingly, similar results were noted owing in large part to the similar modeling concepts applied.
The PN7 analyses broadly show good resistance of large dry containment to severe accident hazards with the exception of basemat penetration, which remains the weak point of Temelín NPP, and with the possible exception of the potential (for limited periods of time) for energetic hydrogen combustion modes.