«Item 7b Severe Accidents Related Issues Preliminary Monitoring Report Report to the Federal Ministry of Agriculture, Forestry, Environment and Water ...»
This issue is considered in another project under the Melk Process (PN3). However, even if the BRU-As are shown to be qualified for two-phase flow and water flow, in case of multiple demands during the accident they can fail as discussed in Section 4.2.1. The piping lines conducting to BRU-As have been calculated and their strength was found to sustain dynamic loads due to water-steam or solid water flow conditions.
ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues 107 On the secondary side there are several possibilities of refilling the steam generators, one of them being the fire water system. The strategies for this purpose have been developed, the sources of water are plenty and all of them are specified in SAMG. In addition there is a large time margin to implement these measures. It was shown in the calculations of the PRISE scenario in which a core meltdown due to lack of water on the secondary side of steam generators occurs after 5 days. Taking into account the numerous sources of water available to feed the secondary side it is incredible to assume that any team of operators fail to use these sources during 5 days to fill up the secondary side of steam generators.
The Austrian side did not find out the numerical values for entry point bleeding capacity and other parameters used in WOG SAMGs, but the general statement was that SAMGs are entered if the operator finds that the EOPs are unsuccessful. The criteria will be introduced in the symptom oriented (SO) EOPs when the plant is ready for the implementation of SAMGs.
Given the long time period available in which to accomplish primary makeup (so long as the BRU-A valves continue to function properly), it is nearly inconceivable that the operating staff (together with the accident management team in the TSC and all available regulatory and industry technical support) would fail to provide primary makeup within 5 days to avoid core damage. This outcome generally indicates the robustness of the design and the EOPs for PRISE accidents.
If a BRU-A valve sticks open in a PRISE accident, the scenario then proceeds much more rapidly, with core melt and vessel failure within 18÷19 hours. Even in this case there is considerable time available to accomplish primary makeup, including potential for recovery of the situation by the second shift to come on duty since in an 18÷19 hour time period at least one shift change will take place. Thus, in the extreme case in which a particular mindset develops that results in depressurisation and primary makeup not occurring during the shift, in which the accident has started, continuation of such a mindset in a new crew of operations and TSC staff coming on duty is less likely.
Even if a PRISE accident proceeds to core melt, it is likely as a result of EOP and SAMG provisions adopted or pending adoption that the affected steam generator will continue to receive feedwater throughout the duration of the accident. This will result in a reduction of the resulting "source term" of radioactive materials released to the environment (a mitigation strategy).
The MELCOR calculations performed in PN7 for the PRISE accident indicate that the scenario defined in the PSA is very likely not to develop into a severe accident due to the extended (5-day) time frame within which the accident is recovered using water sources available onsite. Thus, the updated PSA core damage frequency represents an over-estimate.
The medium PRISE accident (40 mm Deff) only realistically goes to core damage if the BRUA sticks open. Above we estimated a 10% chance of this happening due to repeated demands on the BRU-A to open to relieve steam pressure in the PRISE sequence. If the BRUA valve were to fail closed, a similar situation would be posed to the main steam safety valves, which would then themselves be subjected to repeated demands to open.
The updated PSA estimates the frequency of medium PRISE severe accidents to be 3,09×10-6 [1/a]. The MELCOR calculation results combined with a preliminary assessment of the likelihood of the BRU-A valve sticking open indicate that the CDF should be reduced by a factor of ten to 3,09×10-7 [1/a] (assuming that the BRU-A is qualified for water and two-phase flow). In the small LOCA discussion in Section 220.127.116.11, the CDF due to internal events was reduced from 1,49×10-5 [1/a] to 1,19×10-5 [1/a]. When considering the reduction estimated above for the PRISE accident, the total CDF due to internal events could be further reduced to 9,1×10-6 [1/a].
108 ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues Evaluation The hazards involved in PRISE accidents are well recognized, the strategies appropriately developed and the technical means are provided to cope with PRISE events. The strategies adopted have resulted in a reduction in both the likelihood and consequences of most PRISE accidents. The PSA results show a reduction from 4,3×10-5 [1/a] to 3,0×10-7 [1/a] for Medium PRISE accidents (some of the reduction comes from better understanding of the thermalhydraulics and success criteria for the accident, and some comes from optimized EOP and SAMG actions). Reduction of consequences arises from the SAMG strategy of maintaining water in the affected SG to ’scrub’ fission product releases in the event that a PRISE accident proceeds to core damage.
5.2 Prevention and Mitigation of Station Blackout As the main feature of this scenario is the loss of power, the VLIs below address mainly the aspects connected with the availability of power sources to prevent and later on to mitigate the accident.
VLI No. VLI title / description 8.3.1 Are there means to provide off-site power from a reliable source besides the main power network? (e.g. from a hydro power plant, as in Dukovany)?
8.3.2 Are there means to provide cross-connection to the other unit on the site?
8.3.3 Are there any mobile diesel generators?
8.3.4 Has the capacity of batteries been extended to or beyond 2 hours?
8.3.5 Is it possible to operate (open, close) PORV, BRUA and other valves needed for SAM implementation after loss of power lasting longer than 2 hours?
8.3.6 Is there diversity provided in Diesel generator power supply?
8.3.7 Other than main feedwater, auxiliary feedwater, and emergency feedwater, are there any other capabilities to inject water into the steam generators?
State-of-the-art requirements and practices The recovery of electric power is the essential condition of success in prevention of core damage or later on in prevention of the basemat penetration in the case of severe accidents.
The calculations performed within TACIS programme for WWER 1000 NPPs indicated that the recovery of electrical power within about 2,5 hours after station blackout makes it possible to avoid any significant core damage, and with the recovery within 3 hours it is possible to stop the process of core melting [TACIS 02]. Even after RPV failure the recovery of electric power makes it possible to actuate LPIS and inject water onto the molten corium pool, providing top cooling of the corium.
The problem of battery capacity is more complex. The original design capacity of batteries in WWER 1000 units was low, below 1 hour. According to nowadays practice, 2 hours are required. However, in many severe accident sequences the time needed to get the plant to stable steady state is longer. Such valves as PORV, the valves of EGR system, or reliable service water system valves etc. must be operable much longer than 2 hours. The analysis of needs in this respect should be made and the necessary long-term operation of all equipment needed under severe accident conditions should be assured. Since diesel generators are of key importance for providing reliable power under accident conditions, they should be protected from common cause failures. In some NPPs diversity within the DG system is provided.
ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues 109 Current plant status The hazard of station blackout is reduced by the variety of sources of electric power available, including the power from two external lines, from the other unit at Temelín NPP, from 3train emergency DG system and from two additional non-safety class diesel generators. The non-safety diesels are of the same design as safety diesels, but without some protective circuitry required of safety diesels. Thus there is some potential for common cause failures of diesel generators.
In the initial PSA study (1996) a battery depletion time of one hour was assumed. In the updated PSA a battery depletion time of 2÷3 hours is used [Mlady 03a]. Temelín staff informed us that actually the capacity of batteries is greater than required by design and with proper load management provides electric power for 2 to 4 hours after the accident [Sykora 03].
This would provide possibilities to open or close the valves needed for SAMG implementation. However, the capacity of batteries remains a weak point. It is worth noting that the example of some other WWER NPPs shows that the batteries can be and, in fact, have been exchanged in several plants for other units of higher capacity.
In case of blackout by definition no electric power is available and so there is no possibility to inject water to the core from any active systems. The injection from Safety Injection Tanks (SITs) can be achieved, but it is not sufficient to prevent core melting. Thus, station blackout would lead eventually to core melt and RPV failure There are several means of injecting water to the secondary side of SGs, as mentioned in section 5.1. However, although there are 2 spare diesels, which can be connected to any safety bus at either unit, the occurrence of a station blackout means by definition that these 2 diesels are unavailable. The fire protection system pumps are motor driven and unavailable in SBO conditions; the same is true of essential and non-essential service water. The only remaining way at this point to get water to the secondary side of the SGs is by fire trucks. In order to be able to control the valves for this and other operations it is necessary to have batteries available in the long term.
Evaluation The preventive measures at Temelín NPP correctly address the issue of station blackout. ).
Moreover, SAM strategies include measures to prolong battery lifetime by re-structuring the load profile much beyond the design period of 1 hour. Nevertheless, it might be desirable to exchange batteries or include in the system additional power sources that could provide electric power during the blackout conditions 110 ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues
5.3 RCS Depressurisation
VLI No. VLI title / description 8.4.1 What is the design basis for high vent points in the primary system?
What is the capacity of Emergency Gas Removal system lines?
8.4.2 Have there been analyses or experiments to establish real capacity of Emergency Gas Removal system?
8.4.3 Do analyses take credit for 30 kg/s or for limited 20 kg/s capacity of EGR?
8.4.4 Was the capacity of PORV to remain open at low pressures demonstrated?
Is its reliability to be opened at low pressures equal to that of the PORV to open at high pressures?
8.4.5 Are the lines leading to BRUA and to PORV qualified for water-steam mixture and solid water flows?
8.4.6 Is parallel gas removal assumed from several points in EGR system and from PORV?
Have there been analyses of physical restraints of steam flow in such cases?
Were they submitted to SUJB and approved?
8.4.7 Was the weakening of steel at high temperatures taken into account in high-pressure scenarios and SG tube rupture analyzed?
8.4.8 Were the consequences of sudden recovery of EFWS and injection of cold water into the SG considered?
8.4.9 Were the consequences of high temperature failures of measuring equipment and the delays or errors in SAM implementation considered?
8.4.10 Is the formation of water seals in the RCS considered in the analyses?
8.4.11 Has the model of natural circulation in the core with bypass flow downwards been considered?
8.4.12 What are the means of water injection onto molten corium ex-vessel 8.4.13 Has the candling heat transfer coefficient for core melt established in CORA tests been considered?
8.4.14 Has the stratification of corium with possible RPV failure at the sidewall been taken into account?
8.4.15 Has there been an analysis of high temperature fuel coolability with water?
Has the RPV weakening due to high temperatures been taken into account?
8.4.16 Does the depressurization strategy take into account the time during which the core was in high temperatures in choosing operator’s actions?
8.4.17 Could you generally characterise the end pressures achievable, under a variety of accident scenarios, using these depressurisation capabilities?
8.4.18 What is your assessment of the final pressure (at the time of vessel failure), which is required in order to avoid HPME/DCH for Temelín?
State-of-the-art requirements and practices The very importance of depressurization of the RCS is generally recognized, and according to both safety authorities and European TSOs [TSO 01] for future NPPs it is required „to transfer high pressure core melt sequences to low pressure core melt sequences with a high reliability“ [GRP/RSK 93]. The design provisions should include diverse secondary side heat removal systems to depressurize the primary in a controlled and reliable way, sufficient primary feed and bleed capacity in the event the secondary systems are lost, and adequately sized pressuriser relief devices or a specific dedicated system for direct primary depressuriETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues 111 zation as the last line of defence. The discharge capacity and the reliability of the depressurization system would have to be demonstrated for severe accident conditions. It is recommended that key valves be made as reliable as the valves used to prevent an over pressurization [EUR 20163].