Plant Specific Accident Sequences for Development of EOP and SAMG

1. Plant Specific Accident Sequences for Development of EOP and SAMG George Vayssier NSC Netherlands IAEA Workshop on Safety Analysis Report, Safety Analysis for Licensing and EOP/SAMG Development & Review 23 � 26 February 2004, Islamabad, Pakistan

2. Role of EOP/SAMG accident analysis Define and justify Diagnosis criteria Operating thresholds Verify and/or evaluate Risk to be covered Verify the capability of systems to perform their function

3. Role of EOP/SAMG accident analysis Different types of studies: Thermal hydraulic (codes, simulators, test loops, test on site) Mechanical studies System studies No need to do everything again: use also existing studies, e.g. for Safety Analysis Report

4. Accident sequences EOP/SAMG Differences in EOP and SAMG domain: EOPs should cover relevant accident sequences (remember: event-based EOPs); they are designed to do so; scenarios follow the event, e.g. SB LOCA, followed by HPSI and cooldown secondary, LPSI and recirc via the sump FRGs control basic (�critical�) safety functions, independent of the event; search for scenarios that challenge those functions, e.g. cool down and boration in parallel during ATWS SAMG has primarily a mitigative function, is directed to the protection of fission product boundaries, not event-based; focus on scenarios that challenge or have failed the integrity of FP boundaries, e.g. effect of hydrogen deflagration

5. EOP accident sequences Two prevailing approaches: Develop EOPs for all events inside the design basis, including the single failure; note: w/o scram, event lands in the AOPs (example: Siemens/FANP, Germany; EdF, France); in French: I- and A-procedures. Then: add more failures: beyond DBA (in Germany: Emergence Manual, in France: H-procedures, covered by U-procedures) Follow probabilistic selection of events, use evt. scenarios from the PSA level 1 (example: Westinghouse, newer French state-oriented approach)

6. EOP accident sequences Highly important difference: Do you start from scratch, or Do you use a reference plant? Volume of work is totally different! Example: Borssele (Netherlands, Siemens 2 loop PWR, West. EOPs/SAMG), Beznau (Switzerland, West. 2-loop PWR, West.-EOPs/SAMG): NO new analysis done for introduction W-EOPs�! Total amount of time: 2 years with dedicated team and support by the vendor

7. Accident sequences W-EOP Westinghouse methodology: Use reference plant Develop EOPs for DBA Use plant PSA to decide which beyond DBA would be necessary; provide probabilistic evaluation of all accident initiators and functional system failures, use functional cut-off of 10-8 per reactor-year; hence EOPs cover all sequences with probability > 10-8 per reactor-year, which covers 99.95 % of risk of sequences leading to core melt

8. Accident sequences W-EOP Benefit of using PSA / probabilistic cut-off Avoid: a procedure is provided for an accident with extremely low probability, and no procedure is provided for an accident with higher probability Plus and Minus: plus: unnecessary procedures are an unnecessary burden, as they otherwise take place in documents and training minus: one could also provide procedures for all events that are mechanistically (physically) possible (note: this is done in SAMG domain)

9. Accident sequences W-EOP Example of add-on / delete (Beznau): Add: SGTR plus loss of feedwater (non-negligible probability for 2-loop plant) Delete: SGTR without pressure control (ECA 3.3), as Beznau had more means to control pressure than the reference plant

10. EOP accident sequences Westinghouse methodology: Familiarization session: To identify the main differences in design compared to the reference plant; if any, perform plant specific analyses (e.g. for VVER, not for Borssele, Beznau) Strategy session: To identify the major strategies in comparison with the reference plant, making use of plant specific capabilities

11. Grouping of events Grouping of events by principal effects (SAR): Increase in heat removal by the secondary side, Decrease in heat removal by the secondary side, Decrease in flow rate in the reactor coolant system, Increase in flow rate in the reactor coolant system, Anomalies in distributions of reactivity and power, Increase in reactor coolant inventory, Decrease in reactor coolant inventory, Radioactive release from a subsystem or component. Note that not all land in EOPs, some are in AOPs (no scram, no safety system actuation), others in SAMG

12. Grouping of events (cont�d) Grouping of events by initiator: Reactivity anomalies due to control rod malfunctions Reactivity anomalies due to boron dilution or cold water injection Coast-down of the main circulation pumps Loss of primary system integrity (LOCAs) Interfacing systems LOCA Loss of integrity of secondary system

13. Grouping of events (cont�d) Grouping of events by initiator (cont�d): Loss of power supply Malfunctions in the primary systems Malfunctions in the secondary systems ATWS events Accidents in fuel handling Accidents in auxiliary systems Accidents due to external event Note: these events have large differences in probability

14. Selection of accident sequences Make selection of initiating events plus failures of mitigating systems (ECCS, heat removal), e.g. according to the probability threshold (10-8 / ry) Use categorization system, to group events into representative events re the core damage contributor Design EOPs for the selected events

15. Selection of accident sequences, example

16. Analysis for SAMG (cont�d)

17. Selection of accident sequences, example (cont�d) Note: not all combinations are needed, e.g. status of heat sink is not relevant for LB LOCA, neither is HPSI for LB LOCA. From this scheme, about 30 meaningful �core damage contributors (states)� are found Result is what equipment is needed and what operator actions are required

18. Analysis for FRG-part of EOPs FRGs restore critical safety functions, and do that will all available means Could be called �support analysis� Not typical dependent on scenarios Examples: next slides

19. Examples of support studies related to functional objectives Subcriticality control Thresholds calculation on nuclear power Feasability of cooldown with boration in parallel Compatibility of available means of boration and cooldown rate ATWS analysis Response of nuclear power to intentional heat-up of core (i.e. limit feedwater flow) Response to MCP shutdown (main coolant pump) Risk of long term boron concentration/dilution Safety injection management in case of primary break

20. Examples of support studies related to functional objectives (cont�d) Core cooling RCS depressurisation strategies based on heat removal into the secondary side (i.e. dumping of steam from steam generators) effectiveness of the reactor coolant pumps (RCPs) restart for delay of core degradation; FRGs entry conditions/set-points (e.g. 650�C).

21. Examples of support studies related to functional objectives (cont�d) Heat removal control Maximum cooldown rate value for design and beyond design mechanical constraint, design report Pressure thermal shocks limits on reactor vessel Natural circulation operations maximum cooldown rate compatible with reactor vessel head cooldown to avoid steam bubble Loss of main heat sink Feed & bleed scenarios, time window for successful start

22. Examples of support studies related to functional objectives (cont�d) RCS inventory control Criteria for safety injection termination LOCA without high head safety injection Strategy in case of SGTR associated with a steam line break outside containment

23. Analysis for SAMG Recall major steps for development of SAMG: Find plant vulnerabilities Find plant capabilities Define candidate high level action (CHLAs) Develop strategies and guidelines, computational aids Verification and validation of guidelines Literature: NUMARC 92.01 - A process for Evaluating AM capabilities, NEI 91.04, rev. 1- Severe Accident Issue Closure Guidelines

24. Analysis for SAMG (cont�d) Plant vulnerabilities: select number of unmitigated events to find type and timing of challenges to FP barriers e.g. find risk for SG tube creep rupture and its timing, obtain hydrogen release and its timing, and the consequential deflagration (if any) find time to overpressure of the containment, etc. Group events with respect to the challenge of the FP barriers and select dominant ones for further consideration Note: some challenges are influenced by the AM action that is considered, e.g. flooding an overheated core will result in much hydrogen, thereby making the hydrogen challenge more severe. Some regulators (notably France, Netherlands) hence require that such flooding is done at the most unfavourable moment, resulting in 100% Zr clad reacted with steam

25. Analysis for SAMG (cont�d) All important phenomena should be addressed: Core degradation SG tube creep rupture / surge line creep rupture Steam explosion (often ruled out) RPV melt-through (high or low pressure) Steam spike from wet cavity, evt. steam explosion Basemat attack Hydrogen generation (in- and ex-vessel) Containment overpressure, sub-atmospheric pressure

26. Analysis for SAMG (cont�d) Relevant plant damage states are: degraded core, core ex-vessel, containment challenged, failed, bypassed. Define AM for each of those damage states. Example from NUMARC (loss of all off-site AC, failure of all on-site AC, depletion of batteries, loss of turbine-driven aux feed)

27. Analysis for SAMG (cont�d) Only a limited number of scenarios is required, because once the core is damaged, the rest of the process is fairly straightforward Select accidents that maximize the challenge to certain FP boundaries (e.g. station blackout to investigate high pressure scenarios, such as SG tube creep rupture, HPME; small LOCA for hydrogen production) Monitor whether key phenomena will be observed (e.g. onset of core damage (=no), vessel failure (=maybe)) Investigate the effect of countermeasures (e.g. flooding the cavity will cool the debris inside the vessel or not), in principle for all the CHLAs that are defined useful for the plant Example of severe accident insights in next page

28. Analysis for SAMG (cont�d)

29. Analysis for SAMG (cont�d) Once the strategies are defined, both positive and negative consequences must be analysed: e.g. cavity flooding may provoke large steam spikes upon vessel failure or even ex-vessel steam explosion, so do we flood or not? if we have only one charging pump available, do we inject or not? (risk: H2 generation in stead of cooling; Borssele: decided then not to inject; Beznau decided to inject)

30. Analysis for SAMG (cont�d) Also the set points must be obtained e.g. to what RCS pressure must we depressurize to avoid HPME? And the Computational Aids e.g. at what pressure and hydrogen concentration is the containment atmosphere flammable? Extensive reports are made for set point analysis and computational aids.

31. Analysis for SAMG (cont�d) Some strategies may require advanced analysis, e.g. CFD-codes for H2-distribution/combustion Validation and drills/exercises need templates; these must be developed by analysis Criteria: design a template that will lead the control room/ TSC through many severe accident guidelines Include a variety of possible operator actions, to anticipate real operator behaviour Make sure results are not defeated by uncertainties

32. Conclusions Adequate accident analysis is needed for all phases of accident management; analyses are very different for the various tasks; EOP: more scenario oriented, SAMG more phenomena oriented Include all types of analyses (T/H, mechanical, systems behaviour) To relief tasks, make use of reference plant analysis where possible Work on EOP/SAMG development can start from generic (reference) data, which later will be refined