Yalta , Crimea, Ukraine, September 24-29, 200 7 . 17 th Symposium of “Atomic Energy Research”

1. V. Kim, V. Kuznetsov, G. Balakan ‑ South-Ukraine NPP, UkraineG. Gromov, A. Krushynsky ‑ Analytical Research Bureau of SSTC NRSS. Sholomitsky, I. Lola ‑ Energorisk Ltd ANALYSIS AND DEVELOPMENT OF THE AUTOMATED EMERGENCY ALGORITHM TO CONTROL PRIMARY TO SECONDARY LOCAFOR SUNPP SAFETY UPGRADING Yalta, Crimea, Ukraine, September 24-29, 2007. 17th Symposium of “Atomic Energy Research”

2. Contents • Problem description • Accident progression under design automatics operation without operator actions • Description and criteria of algorithm operation • Result of simulations • Analysis of influence of failures or additional IEs on accident control algorithm realization • Conclusions

3. Problem description • The primary-to-secondary leak accident is one of the most complex and specific accidents for the VVER type Reactor Unit. Design operation of Unit automatics and systems does not allow reaching a safe stable condition without actions of plant personnel. • Such accident historically have belong to BDBA because of low frequency of occurrence, bur now after Rovno NPP accident with multiple SG collector cover liftings this accident have classified as DBA. • According to results of the safety analyses under the Level 1 PRA for SU NPP Unit 1, contribution of "small" leaks (break of one tube) into total core damage frequency (CDF) equals to 6% and "large" breaks (collector cover lifting) equals to 11% of CDF. • In accordance with Safety program stated by government authority of Ukraine, appropriate safety upgrading should be implemented for overcoming such accidents. • Thermal hydraulic analyses of primary to secondary leaks show that the time interval for critical actions during an active phase of the leakage is enough short. The results of simulation of such an accident with FSS show, that an operator quite often makes critical errors or controls the accident not optimally. • As means for overcoming of accident, the algorithm of primary-to-secondary leak control has been developed.

4. Accident progression under design automatics operation without operator actions

5. Accident progression under design automatics operation without operator actions Figure 1 – Time interval before BRU‑A opening after TSV closing depending on primary-to-secondary leak diameter(with prohibition of BRU‑K operation)

6. Description and criteria of algorithm operation actions To provide a transition of Unit to the safe end state, the proposed strategy and algorithm of accident control envisage the following: • Reduction of primary and ESG pressure difference to terminate leak loss of coolant(by injection in PRZ and/or operation of EGES). • ESG pressure control below setpoints of SDV operation to prevent radioactive release (by: (a) delay of FASIV closing; (b) prohibition of ESG BRU‑A closing; (c) by PRZ injection and EGES operation; (d) restriction of HPIS). • Localization of radioactive primary coolant within the ESG(by prohibition of BRU‑K after SG level increasing, and further closing of ESG FASIV and let-down of all SGs). Too early FASIV closing leads to pressure increasing in ESG, opening of SGVs with radioactivity release into the environment. • Primary inventory and pressurizer level control(by injection from HPIS or primary make-up system). For recovery of PRZ level, injection into PRZ or operation of EGES into the quench tank is needed. • Maintaining natural circulation via intact loops and recovery of a margin to saturation (by primary inventory control and secondary cooldown through intact SG). • Injection of boron to reach required concentration in primary coolant(by organization of water exchange in primary side by make-up/let-down operation).

7. Description and criteria of algorithm operation actions Criteria used for estimating results of accident control algorithm: • Timely termination of loss of primary coolant through the leak. • Maintaning primary inventory and reactor level. • Sufficient secondary heat removal. • Restoration of natural circulation via intact loops. • Recovery of a PRZ level. • Recovery of a margin to saturation. • Keeping reactor subcritical. • Minimization of radioactivity release from the primary side and outside the plant. • No ESG SDV opening. • Minimization of mass of primary coolant dumped through EGES into containment.

8. Result of simulations First stage: • prohibition of ESG BRU‑A closing • PRZ spray injection and EGES operation • closing of ESG FASIV (with delay) and let-down of all SGs • prohibition of BRU‑K after SG level increasing Second stage: • restriction of HPIS • secondary cooldown through intact SGs • injection of boron

9. Result of simulations

10. Result of simulations Figure 2 – Integrated mass flow rate through PRISE leak (after scram) under algorithm operation depending on leak equivalent diameter

11. Analysis of influence of failures or additional IEs on accident control algorithm realization For efficiency analysis of suggested accident control algorithm in case of failures or additional IEs the following beyond design basis accidents (BDBA) have been modeled: • accident control using algorithm in case of HPIS failure (failure of primary inventory control SF); • accident control using algorithm in case of PRZ spray and EGES failure (failure of primary pressure decrease and limitation SF); • accident control using algorithm in case of EGES valve failure to close after opening (failure of primary pressure control SF); • accident control using algorithm in case of HPIS pump failure to turn switch to recirculation mode (failure of primary pressure limitation SF); • accident control using algorithm in case of secondary cooldown failure (failure of heat removal from primary to secondary SF); • accident control using algorithm in case of false signal» primary-to-secondary leak” occurrence; • accident control using algorithm in case of additional IE “primary leak inside the containment from cold leg”; • accident control using algorithm in case of additional IE “primary leak inside the containment from pressurizer steam dome”; • accident control using algorithm in case of additional IE “loss of offsite power”; • accident control using algorithm in case of additional IEs “loss of offsite power” and ESG SDV failure to close after opening (failure of secondary pressure control SF)

12. Analysis of influence of failures or additional IEs on accident control algorithm realization

13. Analysis of influence of failures or additional IEs on accident control algorithm realization • Application of accident control algorithm demonstrates: • stopping loss of primary coolant inventory for all emergency scenarios except (HPIS pump failure to turn switch to recirculation and SDV sticking); • sufficient primary coolant inventory during accident and stable natural circulation in intact loops (except scenario with failure secondary cooldown) that is able for heat removal from the core; • short time opening of ESG SDV happened in case of failure of primary pressure control and in case of loss of offsite power, nevertheless, algorithm performance allow to minimize a number of SDV openings and significantly limit mass of primary coolant dumped into the environment; • in case of secondary cooldown failure positive result of algorithm consist in limitation of ESG pressure and exclusion of radioactivity release into the environment through ESG SDV; • in case of SG SV failure to close after opening the primary pressure may decrease down to LPIS operation; • positive effect of applying of accident control algorithm in case of failure to switch HPIS to recirculation consist in significant decrease of primary coolant radioactivity release into the environment through ESG SDV. Also it leads to increase of time margins for performing of required actions by plant personnel

14. Analysis of influence of failures or additional IEs on accident control algorithm realization Application of the algorithm for majority of considered above BDBA scenarios allows to meet acceptance criteria and safety functions. For the rest scenarios it ensures increase of time margins for required operator actions

15. Conclusions • The results of analysis of primary-to-secondary side breaks allow to reveal and generalize characteristic features of transient progression. • The analyses confirm efficiency of algorithm application. • Application of algorithm for some of the beyond design scenarios ensures fulfillment of safety functions and acceptance criteria, and for other part it, at least, facilitates course of emergency process and performance of required recovery actions. • Realization of the suggested algorithm, possessing sufficient universality, allows to transfer the power unit in a safe stable condition for all considered range of primary-to-secondary leaks.