RELIABILITY ANALYSIS OF 2400 MWTH GAS-COOLED FAST REACTOR NATURAL CIRCULATION DECAY HEAT REMOVAL SYSTEM

1. RELIABILITY ANALYSIS OF 2400 MWTH GAS-COOLED FAST REACTOR NATURAL CIRCULATION DECAY HEAT REMOVAL SYSTEM M. Marquès, C. Bassi & F. Bentivoglio michel.marques@cea.fr CEA, DEN, SESI, Cadarache, F-13108 Saint-Paul-lez-Durance, France

2. INTRODUCTION • The treatment in PSA of passive systems (specially category B passive systems implementing moving working fluid ) is a difficult task because in addition to the mechanical failures of its components (hardware failure), the failure of the system in achieving its intended design function, referred as functional failure [Burgazzi] has to be considered. • The difficulty in the evaluation of the functional failure risk lies in the great number of parameters that must be taken into account, in their associated uncertainties and in the limitations of physical modelling. • The reliability of the DHR system has been studied in two accidental situations. • For these two situations, we have considered that all the active features cannot operate and that the only way is completely passive using natural circulation. • The reliability analysis is based on the RMPS methodology [European Project]. • Reliability and global sensitivity analyses use uncertainty propagation by Monte Carlo techniques.

3. DHR SYSTEM DESCRIPTION • The DHR system (a) consists: • 3 dedicated DHR loops (3 x 100% redundancy) • a metallic guard containment enclosing the primary system (close containment), • Each dedicated DHR loop (b) is composed • a primary loop (in Forced Circulation with blower, or Natural Circulation) • a secondary circuit filled with pressurized water (Natural Circulation) • a ternary pool, initially at 50°C,

4. DHR STARTEGY WITH NATURAL/FORCED CIRCULATION Naturalconvection Natural convection (first 5 days: only if nitrogen injection)

5. SCENARIOS FOR NCDHR RELIABILITY EVALUATION • Station Black-Out (SBO) initiating event: Loss Of Station service Power (LOSP) cumulated with all Emergency Diesel Generators failure to start. 1 DHR loop available • 3 inches diameter LOCA initiating event, located on the cold part of a main cross-duct, representative of depressurized situations, with a total loss of forced circulation DHR means. 2 DHR loops available. Two transient scenarios are selected to be representative of the situations of interest regarding the natural circulation DHR process for the GFR N2 injection from 3 accumulators (P < 10 bars)

6. FAILURE CRITERIA Preliminary acceptance criteria for Category IV scenarios (frequency ranging from 10-6 to 10-4)

7. MODELING WITH CATHARE 2 CODE CLOSE CONTAINMENT MODELING + 3 NITROGEN ACCUMULATORS DHR LOOP SECONDARY/TERTIARY CIRCUIT CORE & PRIMARY CIRCUIT

8. STEADY STATE RESULTS A well-stabilized steady-state is achieved, with all thermal-hydraulic parameters being close to their design value.

9. LOFA : REFERENCE RESULTS Transient results (reference case with nominal values of the input parameters) A stable flow-rate of about 30 kg/s is quickly (in less than 100 s) established in the DHR loop and is maintained up to the end of the transient (3600s) during the natural circulation phase. The heat removal (by only one DHR loop) is sufficient and all failure criteria are respected, with values staying well below the safety limits: Maximum clad temperature: 1054 °C (Failure limit: 1600 °C); Maximum coolant temperature: 1034.0 °C (Failure limit: 1250 °C);

10. UNCERTAINTIES IN LOFA SCENARIO Selected for reliability anaysis

11. UNCERTAINTIES IN LOFA SCENARIO Modeling of the input uncertainties Input sampling and propagation of uncertainties A Latin Hypercube Sampling (LHS) has been performed using the 10 above uniform distributions. 1000 samples of the input parameters were simulated and for each a thermal-hydraulic calculation was performed with the CATHARE2 code.

12. LOFA : Statistical analysis of the response of interest Linear Correlation Coefficients the three maximum temperatures are highly correlated, while the maximal primary pressure is not correlated with these temperatures

13. LOFA : Statistical analysis of the response of interest The uncertainties on the responses of interest are small: variation coefficients are close to 5% for the temperatures and less than 2% for the primary pressure All the quantiles considered (even X99.9%) are below the failure criteria: far below for clad maximal temperature and with a positive margin (about 100°C) for the TMAX_Gas

14. LOFA : GLOBAL SENSITIVITY ANALYSIS Objective: evaluate the importance of each input uncertain parameter in contributing to the overall uncertainty of each response of interest. Standard Regression Coefficients : SRC ON RESPONSE : MAXIMAL CLAD TEMPERATURE

15. LOFA : RELIABILITY ANALYSIS None of the cases among the 1000 simulations met the failure criteria: Tmax_clad always < 1600°C and Tmax_gas always < 1250°C. Failure probability Pf? Wilks’ formula for one sided tolerance interval can be used for calculating a conservative upper bound  of the actual probability of failure Pf : ( expresses the “confidence” that Pf )  with= 0.95 and N = 1000, it is obtained  = 0.003  This constitutes however a very high upper bound of Pf, according to the margins obtained:

16. LOFA : RELIABILITY ANALYSIS Reliability analysis using the regression model Tmax_gas for which we have less margin Linear model Tmax_gas = 1022.6 + 3.0972 * V1+ 0.5621 * V2+ 58.772 * V4 -203.18 * V5 - 40.257 * V6 + 738.80 * V7 + 2.59 * V8 - 287.14 * V9 -21.541 * V10 R2 = 0.994 In performing various numbers of simulations with this linear model : With the initial probabilistic model and even with 108 simulations, the maximal value obtained is 65°C below the failure criteria.

17. LOFA : RELIABILITY ANALYSIS Pessimistic calculation “pessimistic” case in taking all the input parameters at their envelope value  No failure and the maximal value of TMAX-Gas = 1166°C when it is calculated directly with the CATHARE2 code and = 1196°C with the linear regression model.

18. LOFA : RELIABILITY ANALYSIS Effect of change of the probabilistic model on Pf estimation  Even in doubling the range of variation of the most important variables (blower inertia or wall thermal inertia), the failure probabilities obtained keep very small.  The same is observed in increasing the ranges of variation of all the input parameters by 50%.  In order to obtain a relatively significant failure probability (~10-4) , it is necessary to double the range of variation of the two most important variables simultaneouslyor to increase all the ranges by 70% Given that the occurrence frequency of the transient is also very small (Loss Of Station service Power + Emergency Diesel Generators failure to start + only one of two DHR loop available for natural circulation), the global risk (product of the failure probability by the transient occurrence frequency) associated with this transient will be very low.

19. LOFA : CONCLUSION On the reference case, with nominal values of the input parameters, only one DHR loop working in natural circulation fulfills perfectly its mission. A stable flow-rate of about 30 kg/s is quickly (in less than 100 s) established in the DHR loop and is maintained up to the end of the transient during the natural circulation phase. During one hour from the beginning of the transient, the heat removal is sufficient and all failure criteria are respected, with values staying well below the safety limits. Among all the parameters studied in the sensitivity analysis, very few have a significant influence on the transient, in the area investigated. The major effect is produced by the additional singular pressure drop coefficient, which simulates the stopped DHR blower. But in the following of the analysis, we have considered that around the DHR blower there is a by-pass, which is opened when the DHR blower is stopped. In this case the uncertainty on this parameter will not have a significant effect; however the reliability of this by-pass system will have to be investigated in further studies. The primary blower’s inertia has a noticeable effect on the transient sequence and on the whole system parameters. Nominal power, delay between primary valves closure and DHR valves opening and wall inertia are others parameters of influence. All remaining parameters have a very limited impact on the transient. The failure probability of the DHR system in case of transient 1 occurrence is very small, considering the given uncertainties for the parameters and even in increasing greatly the range of variation of the input parameters. The DHR system working in natural circulation is a very reliable system for this type of accident of loss of flow accident and even when only one DHR loop is available.

20. LOCA: REFERENCE RESULTS On the reference calculation, with nominal values of the input parameters, the heat removal is sufficient and two DHR loops working in natural circulation fulfills their mission with the help of nitrogen injection from accumulators. But the margin is only 9°C on the third criteria (core upper structures integrity) • all failure criteria are respected: 1st TMAX_CLAD = 1404°C << 1600°C 2nd TMAX_CLAD = 840°C << 1000°C TMAX_GAS =1241°C < 1250°C TMAX_DHR_STRUCTURES < 850°C • after nitrogen injection a flow-rate of at least 50 kg/s is established in the DHR loops • and maintained up to the end of the transient during the natural circulation phase

21. UNCERTAINTIES INLOCASCENARIO Selected for reliability anaysis

22. LOCA: OAT SENSITIVITY ANALYSIS Effects of some parameters on the first and on the second peak of clad temperature are contradictory, because an early nitrogen injection limits the first peak but is unfavorable for the second, the nitrogen accumulators being empty earlier  difficulties in the design of the reactor in finding an optimum for these parameters.

23. UNCERTAINTIES INLOCASCENARIO Modeling of the input uncertainties Based on previous SA, 10 parameters are selectedfor which one of the failure criteria is exceeded, with two exceptions: the discharge line singular pressure drop because 50 % TMAX_GAS = criterion + 4°C the gas mixture viscosity for which the failure criteria is only exceeded by 0.9 °C Hypothesis: the10 uncertain input parameters follow normal distributions and probability = 0.95 to be between their minimum and their maximum

24. LOCA : UNCERTAINTIES PROPAGATION • Input sampling and propagation of uncertainties • A Latin Hypercube Sampling (LHS) has been performed using the 10 above normal distributions. • 100 samples of the input parameters were simulated and for each a thermal-hydraulic calculation was performed with the CATHARE2 code. Ex: Gas T at core outlet

25. LOCA: Statistical analysis of the responses of interest Tests  normal law with good accuracy

26. LOCA: GLOBAL SENSITIVITY ANALYSIS

27. LOCA : RELIABILITY ANALYSIS For each simulation  NC DHR system fails if at least one of the four failure criteria is exceeded : Tmax_clad_1st_peak > 1600°C or Tmax_clad_2nd_peak > 1000°C or Tmax_gas > 1250°C or Pclose_containment > 1.4 MPa With 100 simulations, = 0.49 and cov( )= 0.10 (acceptable accuracy) Failure probability with regards to each criterion considered independently The most often exceeded failure criterion is the gas temperature at core outlet (1250 °C). The second failure criterion, for which attention should be paid, is the pressure in the close containment. The criteria on the clad temperatures have very low probabilites compared to the two mentioned above.

28. LOCA : RELIABILITY ANALYSIS Effect of the change of the average value of lower plenum pressure for accumulator discharge  is favourable for reducing failure probability

29. LOCA : CONCLUSION On the reference case, with nominal values of the input parameters, we have obtained that two DHR loops working in natural circulation fulfill their mission with the help of nitrogen injection from accumulators. After nitrogen injection, a flow-rate of at least 50 kg/s is maintained up to the end of the transient during the natural circulation phase. For the transient duration considered (6 hours), the heat removal is sufficient and all failure criteria are respected, but the margin is only 9°C for the third criterion. By sensitivity analysis, we have identified the most important parameters influencing the four responses linked to the failure criteria. The effect of these parameters on the first and second clad and gas peak of temperature are often contradictory. This gives a glimpse of the difficulties in the design of the reactor to find an optimum for these parameters. The clad temperature criterion is satisfied in all the sensitivity cases, but the criterion on the gas maximal temperature is exceeded several time and the criterion on the close containment maximal pressure one time. Finally the reliability analysis of the DHR system for this transient shows a high conditional probability of failure essentially due to the risk of exceeding the failure criterion associated to the gas temperature at core outlet. This risk can be limited by increasing the reference value and by limiting the uncertainty on the lower plenum pressure for accumulator discharge.

30. CONCLUSIONS • The functional reliability of the DHR system working in natural circulation has been estimated in two transient situations corresponding to an “aggravated” LOFA and to a LOCA. • The failure probability of the DHR system in case of LOFA transient is very small, considering realistic uncertainties for the input parameters and even in increasing greatly their ranges of variation. The DHR system working in natural circulation appears a very reliable system for this type of LOFA accident and even when only one DHR loop is available. • For the LOCA transient, the reliability analysis of the natural circulation DHR system shows a high conditional probability of failure essentially due to the risk of exceeding the criterion associated to the core upper structures integrity. Following the global sensitivity analysis, this risk should be limited by increasing the reference values of two parameters: the primary pressure for accumulator discharge and the blower inertia, and by limiting their uncertainties.