PROBABILISTIC SAFETY ANALYSIS OF THE GREEK RESEARCH REACTOR

Transcription

1 DEMO 2001/ 2 PROBABILISTIC SAFETY ANALYSIS OF THE GREEK RESEARCH REACTOR O.N. Aneziris C. Housiadas I.A. Papazoglou M. Stakakis National Centre for Scientific Research Demokritos Institute of Nuclear Technology and Radiation Protection P.O. Box 60228, Agia Paraskevi, Athens, Greece Abstract This report documents the work and the results of a Probabilistic Safety Assessment (PSA) performed for the Greek Research Reactor (GRR1) of the Institute of Nuclear Technology-Radiation Protection (INT-PR) of the National Center for Scientific Research Demokritos. The work has been sponsored by INT-RP and has been performed as part of the Safety Analysis Review and Revision of the research rector in view of the change of the fuel of this reactor from Highly Enrichment Fuel to Low Enrichment Fuel. The PSA has been performed according to the procedures suggested in relevant IAEA publications. Keywords: Probabilistic Safety Assessment, LEU fuel, Research Reactors, GRR-1. February 2001

2 1

3 TABLE OF CONTENTS 1 Executive summary Introduction Objective and Scope Results Core Damage states Core Damage Frequency and accident Sequences Core Damage Frequency and Initiating Events Release Categories Conclusions Hazard Identification Plant Familiarization And Information Gathering Identification Of Radioactivity Release Sources Determination and selection of plant operating states Initiating Event Selection Safety Functions Safety Function System Relationship Reactor Protection System Primary Heat Removal System Reactor pool Natural Convection Emergency Core Cooling System Containment Isolation Emergency Ventilation System Electric Power Supply System Plant System Requirements Success Criteria for the Reactor Protection System Primary Heat Removal System & Reactor Pool Emergency Core Cooling Containment Isolation Emergency Ventilation Electric Power supply Core Damage Definition Grouping and Screening Of Initiating Events Accident Sequence Modeling Event Sequence Modeling Loss of Coolant (ET1) Event Tree for the IE Loss of Flow owing to pump failure (ET2) Event Tree for initiator LOFA owing to butterfly failure (ET3) Event Tree for initiator LOFA owing to flapper failure (ET4) Event tree for initiator Excess reactivity (ET5) Event tree for initiator Loss of offsite power (LOOP) (ET6) Event tree for initiator Flow Blockage (ET7) System MODELING Fault trees for ET Fault Trees for Event ET Fault Trees for the event Tree ET Fault Trees for the event Tree ET Fault Trees for the Event Tree ET Fault Trees for Event Tree ET Fault Trees for Event Tree ET Human Performance Analysis Data Assessment And Parameter Evaluation Initiating Events Component Failure Data

4 4.3 Human Error Probabilities Accident Sequence Quantification Determination Of Accident Sequences To Be Quantified Boolean Reduction Frequencies Of Accident Sequences Leading To Core Damage Frequencies Of Core Damage States Radioactivity Release Categories References

5 1 EXECUTIVE SUMMARY 1.1 INTRODUCTION This report documents the work and the results of a Probabilistic Safety Assessment (PSA) performed for the Greek Research Reactor (GRR1) of the Institute of Nuclear Technology-Radiation Protection (INT-PR) of the National Center for Scientific Research Demokritos. The work has been sponsored by INT-RP and has been performed as part of the Safety Analysis [1] review and revision of the research rector necessitated by the change of the fuel of this reactor from Highly Enrichment Fuel to Low Enrichment Fuel. The PSA has been performed according to the procedures suggested in relevant IAEA publications [2,3]. 1.2 OBJECTIVE AND SCOPE The objective of the PSA reported here was to assess the main accident sequences and the corresponding frequencies leading to core damage. It is therefore a Level-1 PSA. The scope of the PSA included only internal initiating events and loss of offsite power. External initiating events like earthquakes, floods and fires, as well as sabotage were not included in the scope of the present study. Only the reactor core has been considered as the source of potential radioactivity release, since at the time of the study all spent fuel has been removed from the site of the reactor. Based on the results of this study, however, it is judged that such storage does not represent a significant risk of accidental radioactivity release with onsite or offsite consequences. All operating phases of the reactor have been considered but only fullpower operation has been assessed as risk significant. Core damage has been conservatively assumed to result in any state of the core where fuel temperature exceeds the design limit, or, if the available thermal-hydraulic models cannot demonstrate successful cooling of the core. 4

6 Quantification has been performed using generic data in particular those reported in IAEA publication [5]. Human reliability data have been assessed in terms of the generic guidance provided in Ref. [7]. This means that the quantitative results provide a relative ranking and importance of the various accident sequences rather than an absolute statement on the actually expected frequencies of these accidents. At this point an uncertainty analysis was not performed. Preparatory work for eventual Level-2 and Level-3 analysis consisted in the determination of four types of core damage states of varying severity with respect to the degree of damage. Furthermore accident sequences have been analyzed to include operability of containment isolation and radioactivity removal systems. 1.3 RESULTS Core Damage states Core damage has been concervativel assumed to accur when the available thelmohydraulic models cannot support successful cooldown of the reactor core, given a particulae state for the various safety systems. More detailed calculations might indicate that in some cases core damage is not actually occuring. All accident sequences identified do not lead to the same degree of core damage. Depending on the initiating event, the safety systems that operate and on the indications of the thermo-hydraulic analysis five core-damage states have been defined. These states and their corresponding frequencies are reported in Table 1.1. Core damage state D5 is provisional pending further investigation of the conditions that assumingly lead to this state. It is noteworthy that 97.2% of the severe core damage (>10%) frequency is contributed by accidents resulting in less than 30% core melt. Table 1.1. Core damage states Core Damage % Of Core assumed Frequency (/yr) state melted D1 100% 7.00E-08 D2 50% 1.60E-08 D3 30% 1.60E-06 D4 10% 1.40E-06 D5 <3% 1.00E-04 Total 1.03E-04 5

7 1.3.2 Core Damage Frequency and accident Sequences An accident sequence with rather high frequency (10-04 /yr) has been identified with the potential to lead to limited core damage. This sequence is initiated by a blockage in the flow in one of the channels and followed by a failure of the operator to detect the need for and manually shut down the reactor. If this blockage goes on undetected this particular channel will remain without cooling for a long period of time and core damage cannot be excluded. Detailed reactor physics and thermo hydraulic analyses are necessary to assess the consequences of this sequence. It is noteworthy, however, that no engineering features exist presently in the reactor to detect the partial loss of flow and alert the operators of the problem. More severe (>10%) Core Damage Frequency has been assessed at 3 x 10-6 /yr. This frequency has been determined using data provided in Ref. [5] for research reactors operating for different periods per calendar year and it has not been modified to reflect the present limited use of GRR1and/or the operational experience of the Greek research reactor.. Thirtyfour accident sequences have been identified ranging in frequency from 10-4 /yr down to /yr. These sequences are tabulated in Table 1.2 arranged in terms of decreasing frequency. It is noteworthy that one sequence contributes 97% to the core damage frequency. Should the flow blockage sequence be excluded the more severe core damage (>10%) frequency is equal to 3.2x10-6 with ten sequences contributing 95% of this frequency. These are: Loss of coolant accident coupled with a failure of the flapper to open owing to a failure of the weight that counter acts the force of the pressure difference during normal coolant flow (Sequence #2 in Table 1.2). Insertion of excess reactivity while the reactor operates at full power coupled with a failure to interrupt power at the electromagnets of the control rods. This can be due either to failure of the corresponding logic device (GATET3, Sequence #3 Table 1.2) or to the failure of a relay in the stuck positions (RELT3, Sequence #4 Table 1.2). Total loss of flow owing to inadvertent closure of the butterfly valve coupled with a failure of the flapper to open owing to the weight malfunction (Sequence #5 Table 1.2). Total loss of flow owing to failure of both primary pumps coupled with a failure of the flapper to open owing to the weight malfunction (Sequence #6 Table 1.2). 6

8 Loss of coolant accident (LOCA) coupled with failure to scram owing to failure to disconnect power of the electromagnets of the control rods. Again the latter can be due to either failure of the logic device (GATET3, Sequence #7 Table 1.2) or to the failure of a relay in the stuck positions (RELT3, Sequence #8 Table 1.2). A LOCA coupled with failure to scram owing to failures of both pool level sensors SENST2 at 6 and SENST1 at 12 (Sequence #9 Table 1.2). A LOCA coupled with failure to scram owing to failure of pool level sensor SENST1 at 12 and human error (Sequence #10 Table 1.2). Finally, the last sequence with frequency higher than 10-8 /yr (sequence #11, Table 1.2) is initiated by Excess reactivity coupled with the failure of one rod to drop Core Damage Frequency and Initiating Events Classified in terms of their contribution to the frequency of core damage the ordering of the various initiators is as presented in Table 1.3. This table provides in column #2 the sum of the frequencies of all accident sequences initiated by the respective initiator (column #1) and leading to core damage. The most severe initiator from the frequency point of view, is the blockage of flow in one of the fuel assemblies, should further calculations support the assumption that such an initiator can lead to limited core damage. Following this the largest contribution to severe core damage (>10%) is made by accidents initiated by LOCA (46%), followed by the insertion of excess reactivity initiator (46%), various loss of flow initiators (7%) and loss of offsite power (LOOP) (1%). 7

9 Table 1.2 Minimal cut sets of Accident sequences leading to core damage (100% OR 50% OR 30% OR 10% or <3%) TERM # FREQUENCY (YR) CUTSETS RELEASE CATEGORY E-04 FLOW BLOCKAGE OP3 R E-06 LOCA FAIL_W R E-07 EXCESS REACTIVITY GATET3 R E-07 EXCESS REACTIVITY RELT3 R E-07 LOFAB FAIL_W R E-07 LOFA FAIL_W R E-08 LOCA GATET3 R E-08 LOCA RELT3 R E-08 LOCA SENST1 SENST2 R E-08 LOCA SENST1 OP1 R E-08 EXCESS REACTIVITY RODS1 R E-09 LOOP SW_1FS FAIL_W R E-09 LOOP SW_2FS FAIL_W R E-09 LOOP DIESEL FAIL_W R E-09 LOFA GATET3 R E-09 LOFAB GATET3 R E-09 LOFA RELT3 R E-09 LOFAB RELT3 R E-09 LOFAF RELT3 R E-09 LOFAF GATET3 R E-09 LOOP AC_GENERATOR FAIL_W R E-09 EXCESS REACTIVITY VMBOUTFC FAIL_W R E-09 EXCESS REACTIVITY VMBINFC FAIL_W R E-09 LOCA RELT2 SENST1 R E-09 LOCA SENST2 RELT1 R E-09 EXCESS REACTIVITY ELECTR R E-09 LOCA FLAP_S R E-10 LOOP VMBOUTFC FAIL_W R E-10 LOOP VMBINFC FAIL_W R E-10 LOFAB FLAP_S R E-10 LOFA FLAP_S R E-10 LOCA OP_H OP_MB OP_PB R E-11 LOCA RELT1 RELT2 R E-11 LOFAF ROD5 R41 TOTAL 1.032E-04 8

10 Table 1.3. Core damage states Initiator Frequency of Conditional Probability Core Damage of Core Damage (/yr) (/yr) Fuel blockage 1.00E E-02 Loss of Coolant Initiator (LOCA) 1.40E E-02 Insertion of Excess reactivity 1.40E E-03 Loss of Flow owing to failure of both Primary Pumps 1.00E E-02 Loss of Flow owing to Butterfly 1.00E E-02 valve closure Loss of Flow owing to Flapper opening 1.40E E-03 Loss of offsite power supply 2.80E E-04 (LOOP) Of interest are also the conditional probabilities of core damage given the initiator (column #3, Table 1.3). These probabilities give a quantitative measure of the effectiveness of the reactor design against the corresponding accidents. The relative importance of the various initiating events does not change when their frequency of occurrence is not included in the quantification. Again the higher conditional probability of core damage given the occurrence of an initiating event is for the flow blockage in one channel. There is no engineered safety systems associated with this event and the operator has to detect the event from overall abnormal behavior of the system. Equally vulnerable is the design of the reactor to the LOCA and total loss of flow initiators. If any of these initiators occur then natural circulation and heat removal to the pool is of outmost importance since there is no other means for heat removal (in the case of LOCA owing to pool isolation). In all three cases if the weight in the flapper has been wrongly set (too light) the flapper will not open and natural circulation cannot be established. Conditional probability given loss of flow owing to flapper opening is 10-3 and is lower than LOCA and Loss of flow, since by definition in this case natural circulation exists. Thus the only failure that can lead to core damage is failure to scram. The same conditional probability characterizes the accident sequences initiatred by excess reactivity insertion. Finally Loss of offsite power does not represent significant safety concerns given the design of the reactor, since the conditional probability of core damage in this case is equal to

11 1.3.4 Release Categories Although no detailed analysis has been performed, an assessment of the possible radioactivity release categories along with the associated frequencies has been performed. Radioactivity released to the environment depends on the amount of radioactivity released in the containment, the state of the containment, and the state of radioactivity removing systems. Three states of the containment related systems have been considered depending on whether containment isolation is achieved and on whether Emergency ventilation with the associated filters is available (Table 1.4): These three states combined with the five core damage states provide fifteen release categories (Table 1.5). Of those, the most severe are those associated with loss of containment isolation coupled with core damage states D1 and D2. In this sense, it can be assessed that the frequency of significant amount of radioactivity release from the containment is in the order of 9 x /yr (i.e. release categories R3 + R61). Table 1.4. Containment states Containment Isolation Emergency Available Ventilation Available 1 YES YES 2 YES NO 3 NO - Table 1.5 Release Categories Release Category Core damage State Containment State Frequency /yr R1 D1 C1 7.06E-08 R2 D1 C2 1.00E-09 R3 D1 C3 8.19E-12 R41 D2 C1 2.24E-09 R51 D2 C2 1.27E-11 R61 D2 C3 3.76E-13 R4 D3 C1 1.65E-06 R5 D3 C2 1.40E-09 R6 D3 C3 2.03E-10 R7 D4 C1 1.39E-06 R8 D4 C2 6.01E-09 R9 D4 C3 2.76E-08 R10 D5 C1 1.00E-04 R11 D5 C2 4.29E-07 R12 D5 C3 1.15E-08 10

12 1.4 CONCLUSIONS The level-1 PSA performed for GRR-1 research reactor indicates, based on conservative assumptions, that the probability of an accident that would lead to severe core damage (>10%) from internal initiating events is 3 x 10-6 per year of reactor operation. This frequency is not expected to significantly change, even when external events are added. Earthquake is the most severe external event with a potential of causing a LOCA type accident, but the frequency with which such an event is expected is less than 10-7 /yr. There is a sequence, presently under investigation that could also lead to core damage in one of the fuel elements. This sequence is initiated by flow blockage in one of the fuel channels and its frequency is rather high (10-4 /yr) Relatively large radioactivity release (with respect to the core inventory) is expected with a frequency of 1 x /yr, a negligibly low frequency. This frequency will remain negligibly low even if external events contribute to an increase by one or two orders of magnitude. There is no engineeered safety feature to mitigate and/or terminate potential problems associated with flow blockage. This conclusion is however subject to the results of a detailed analysis of the consequences of such an event. No other major design problem has been identified with the exception of two single failures that can cause failure of automatic scram for certain initiating events that are too fast for manual scram. Provided that the flow blockage accidents is not leading to core damage with the assessed frequency, it is noteworthy that the determined frequencies, i.e. for core damage and large reactivity releases, both meet the U.S. Nuclear Regulatory Commission s criteria (for large Power Reactors), which are 10-6 /yr and 10-7 /yr respectively. 11

13 2 HAZARD IDENTIFICATION 2.1 PLANT FAMILIARIZATION AND INFORMATION GATHERING Reactor GRR-1 is a typical 5 MW pool-type reactor with MTR-type fuel elements, cooled and moderated with demineralized light water. In line with the international Reduced Enrichment for Research and Test Reactor (RERTR) programme, the core has been recently fuelled with Low Enriched Uranium (LEU) elements of U 3 Si 2 -Al type. The fuel enrichment is 19.75% and the fissile loading is g of 235 U per plate. The equilibrium LEU core contains 28 standard fuel elements and 5 control fuel elements, arranged on a 6 9 element grid plate. Each standard fuel element consists of 18 flat plates. The control fuel element is of the same size as the standard element but consists of only 10 plates, thus providing an inner gap for the insertion of the control blades. The control material is composed of Ag (80%), Cd (5%) and In (15%). The core is reflected by Beryllium on two opposite faces and is surrounded by a practically infinite thickness of pool water. One graphite thermal column is adjacent to one side of the core. In the middle of the core there is a flux trap. The core is suspended in a 9-m deep water pool of a volume of approximately 300 m 3. The fuel elements are cooled by circulating the water of the pool at a rate of 450 m 3 /h. The water flows downward through the core, passes through a decay tank and then pumped back to the pool through the heat exchangers. A weighted flapper valve attached to the bottom of the core exit plenum enables natural circulation through the core in the absence of forced flow circulation. Core inlet temperature, i.e. pool water, is not permitted to exceed 45 C. Pool temperature depends on reactor power, as well as on external temperature, because the latter affects heat dissipation in the cooling towers. In practice, core inlet temperature has been observed to vary in the range between 20 C and 44 C. Also quite homogeneous temperature conditions prevail in the pool, considering that similar measurements are routinely recorded from thermocouples located at distant positions in the pool. The analysis has been based on the Safety Report of the Greek Research Reactor. Plant layout drawings Review with operating staff 2.2 IDENTIFICATION OF RADIOACTIVITY RELEASE SOURCES Radioactive material can be found in the following locations: Reactor Core 12

14 In Pool spent fuel storage Inside the building spent fuel storage pool. Outside spent fuel storage pool storage The scope of the present analysis included only radioactivity release from the reactor core. Presently there is no spent fuel stored in either the inside or the out side storage pool. Recriticality accidents in the in pool storage spent fuel has not been considered. 2.3 DETERMINATION AND SELECTION OF PLANT OPERATING STATES. The following plant operation states have been considered. Nominal full power operation (5MW) Reduced power operation Start-up operation Reactor subcritical, reactor pool available. As it is discussed later in section 2.7, as well as, in Reference [4], nominal full power operation is a plant operating state bracketing all others from the safety point of view. This is due to the fact that the reactor pool constitutes a large heat sink that is always available, regardless of the operating state of the reactor 2.4 INITIATING EVENT SELECTION An initiating event is an event that creates a disturbance in the plant and has the potential to lead to core damage, depending on the successful operation of the various mitigating systems in the plant. For the purposes of this analysis, the list of initiating events (IE) was determined through reference to previous lists. In particular, the list contained in TABLE I of Safety Series No 35-G1 pp has been considered [2]. This Table is reproduced as Table Only internal IEs, i.e. hardware failures in the plant and or faulty operations of plant hardware through human error, have been considered. Two broad categories of IE can be distinguished. Loss of Coolant Accidents (LOCA) are all events that directly cause loss of integrity of the primary coolant pressure boundary. Transient initiators are those that could create the need for a reactor power reduction or shutdown and subsequent removal of decay heat. 13

15 TABLE LIST OF INITIATING EVENTS [2] 1. Loss of electrical power supplies - Loss of normal electrical power 2. Insertion of excess reactivity - Criticality during fuel handling and loading (fuel insertion error) - Startup accident - Failure of control rod or control rod follower - Failure of control rod drive or system - Failure pf other control devices (moderator, reflector, etc.) - Unbalanced rod positions - Failure or collapse of structural components - Cold water insertion - Moderator changes - Influence from experiments and experimental facilities (e.g. flooding, voiding, temperature effects, insertion or removal of fissile or absorber material) - Insufficient shutdown reactivity - Inadvertent control rod ejection - Errors in the maintenance of reactivity devices 3. Loss of flow - Failure of primary pump - Primary coolant flow reduction (e.g. valve failure, blockage in piping or heat exchanger) - Influence of experiment failure or mishandling - Failure of emergency cooling system - Primary coolant boundary rupture (pipe or vessel) leading to loss of flow - Fuel channel blockage - Improper power distribution due, for example, to unbalanced rod positions, in-core experiments or fuel loading - Coolant reduction due to core bypass - Malfunction of reactor power control - System pressure deviation from normal limits - Loss of heat sink (e.g. valve or pump failure, system rupture) 4. Loss of coolant - Primary coolant boundary rupture - Damaged pool - Pump-down of pool - Failure of beam tubes or other penetrations 5. Erroneous handling or malfunction of equipment or components - Failure of fuel element cladding - Mechanical damage to core or fuel (e.g. handling of fuel, dropping of transfer flask on fuel) - Criticality in fuel storage - Failure of containment or ventilation system - Loss of coolant to fuel in transfer or storage - Loss or reduction of proper shielding - Failure of experimental apparatus or material (e.g. loop rupture) - Exceeding fuel ratings 6. Special internal events - Internal fires or explosions - Internal floodings - Loss of support systems - Security incidents - Malfunctions of the reactor experiment - Improper access to restricted areas 7. External events - Earthquake (including seismically induced faulting and slides) - Flooding (including upstream dam failure, river blockage) - Tornadoes and tornado missiles - Hurricanes, storms and lightning - Explosions - Aircraft crash - Fire - Toxic spills - Transport accidents - Effects of adjacent facilities 8. Human error 14

16 2.5 SAFETY FUNCTIONS The design of the Greek Research Reactor incorporates a number of safety functions aiming at preventing core damage to occur following an initiating event. There are five basic safety functions given in the following table. TABLE SAFETY FUNCTION FOR A RESEARCH POOL TYPE REACTOR IMPORTANT FOR PROTECTING AGAINST CORE DAMAGE 1. Control reactivity 2. Remove core decay heat and stored heat 3. Maintain primary reactor coolant inventory 4. Protect containment integrity (isolation, overpressure) 5. Scrub radioactive materials from containment atmosphere a a Only for binning purposes: see section SAFETY FUNCTION SYSTEM RELATIONSHIP One or more systems are incorporated in the design of the reactor to serve each of the safety functions. The systems that directly perform a safety function are termed front-line systems; those required for the proper function of the front line systems are termed support systems. The front-line systems of the research reactor are given in the following table. TABLE SAFETY FUNCTIONS AND CORRESPONDING FRONT-LINE SYSTEMS Safety Function Front-Line Systems 1. Control reactivity Reactor Protection System a. Automatic b. Manual 2. Remove core decay heat and stored a. Primary Heat Removal System heat b. Reactor Pool (Natural Convection) c. Emergency Core Cooling System 3. Maintain primary reactor coolant Reactor Pool Isolation inventory 4. Protect containment integrity (isolation, overpressure) a. Containment Isolation b. Emergency Ventilation System 5. Scrub radioactive materials from containment atmosphere Emergency Ventilation System 15

17 These front-line systems are described in detail the Safety Analysis of the Research Reactor [1] Reactor Protection System. The safety system consists of two independent safety channels, the magnet power supply, and the safety circuit with scrams, reverses interlocks and alarms. Safety Channels: Each of the two independent safety channels consists of an uncompensated ionization chamber (UIC) and a safety amplifier. The UIC consists of insulated concentric cylinders contained in a sealed can. The amplifier is employed for measurements of the UIC current. This current is proportional to the neutron flux in the power range of the reactor. The signal is displayed on a meter of the device panel. The signal is controlled by means of maximum and minimum contacts. Magnet Power Supply: The magnet power supply provides the necessary D.C. power to the five electromagnets, which hold the shim safety rods connected to the drive mechanisms. Readings of the current of each electromagnet are displayed on five meters located on the panel of the device. Also, five potentiometers are provided for current adjustment between 0 and 250 ma. A voltmeter with a multi position selector indicates the voltage for each electromagnet (0-25 V). An interruption of the current, supplying the electromagnets, results in a rod dropping in the core and the reactor shuts down (SCRAM). Safety Circuitry: a. Scram: A rapid shutdown of the reactor by releasing and dropping all of the shimsafety rods into the core, occurring under maximum hazard conditions, is defined as a scram. When the release and drop of the shim safety rods is caused by a sudden cut-off of the magnet currents the scram is called "fast" since it occurs in about 5 ms. Such a "fast" scram occurs e.g. when 130% of power is reached in either safety channel. When the scram occurs by opening the power circuit of the magnet power supply (or in other words when the magnet power supply is turned off) it is then considered as a "slow" scram, since the decay of voltage from the supply takes longer (about 20 ms). Such a "slow" scram could be caused from a group of conditions. Each 16

18 condition corresponds to a contact in a series circuit. If any contact should open the shim safety rods will drop by loss of power of the magnet power supply. Such a condition causing a "slow" scram is e.g. a low level of the pool water (30 cm below the operating level). b. Reverse: For the less serious conditions than the ones resulting in a scram, the reverse is provided to automatic drive all shim safety and control rods simultaneously into the core as long as the condition exists. After a reverse occurs the reactor may be quickly adjusted to normal conditions. The signals and resulting responses from the safety circuitry of the reactor protection system are provided below in Table c. Interlocks: During reactor operation a series of interlocks protects operator from manipulations that may endanger reactor safety. For instance, no rods withdrawal is possible when the log count rate recorder of the startup channel is turned off, etc. d. Alarms: For abnormal conditions an alarm system is provided. The alarms are listed in Table Primary Heat Removal System This system performs the basic safety function of heat removal from the reactor core both under power operation, as well as, following shutdown. The reactor core is cooled by circulating the deminaralized water of the pool. The water flows through the core to cool the fuel plates and then it is directed to a 20 m 3 delay tank where short-lived isotopes decay. At the outlet of delay tank the circuit is divided into two branches, each one of them having its own pump, flow meter and heat exchanger. The two primary pumps are horizontal, centrifugal, all stainless steel pumps, installed in the delay tank room. Each one feeds the relative heat exchanger with a flow rate of 1000 U.S. gpm (225 m 3 /hr). Past the heat exchangers, the two branches are connected together again and are returned to the pool after passing a flow meter. Very close to the water outlet and inlet two butterfly valves have been installed. In case the water levbel in the pool decreases, these valves can close in order to prevent a severe loss of cooling water should the leak occur downstream of the outlet and upstream of the inlet valve. The secondary cooling system transfers heat from the heat exchangers to the cooling towers. To this end, there are two centrifugal carbon steel pumps which 17

19 circulate water from the lower part of the cooling towers to the heat exchangers. Tap water flows through the carbon steel piping which connects the heat exchangers to the upper part of the cooling towers from where it is flushed down. Air circulates through each cooling tower by means of an air blower. After cooling, the secondary water is pumped back to the heat exchangers. Any loss of secondary water caused by evaporation is automatically replaced Reactor pool Natural Convection. As described in greater detail in the Safety report and in section 2.7 the reactor pool presents a major heat sink capable of independently absorbing the heat generated in the core in most of the cases. Natural convection is made possible through the opening of a weighted flapper valve sealing the core exit plenum. The safety flapper is a counterbalanced flapper valve attached to the bottom of the plenum, which is secured to the lower mounting flange of the grid plate at the bottom of the core support tower. The flapper is counterbalanced against plenum pressure to keep the valve closed as long as normal flow is maintained. If flow rate decreases, the total pressure inside the plenum rises until the pressure difference across the flapper is so low that the counterweights open the flapper. Natural convection then provides emergency cooling of the core. The flapper opens at a flow rate of 400 gpm ( 90 m 3 /h). Opening of the flapper, actuates the flapper switch and scrams the reactor, when the power is higher than 100 KW. For low power operation, up to 100 KW, the flapper may be left open and natural convection is used for cooling. At startup, when forced circulation is used for cooling, the safety flapper is manually closed from the core bridge Emergency Core Cooling System In the event of a LOCA accident resulting in loss of the primary water and core uncovery the Emergency Core Cooling System (ECCS) can spray the reactor core through a 5cm diameter pipe with water coming from a 250 m 3 storage tank located 30 m higher than the surface of the reactor pool. The water tank can be continuously filled by the city water. The ECCS has been tested to check its performance The coolant flow rate per fuel element was measured to be of the order of 0.75 l/min (the observed maximum was 18

20 9.4 l/min). It is assumed that such a spray is capable of removing the fission-product decay heat, thus keeping the core temperature well bellow the melting point Containment Isolation In the event of an emergency, the normal ventilation system of the containment stops and the containment is isolated through the automatic closure of all existing openings. At the same time the Emergency Ventilation system starts operating Containment isolation is activated when the reactor operator shuts the reactor down (manual scram). Following such a manual scram, all electrical dampers associated to the air pumps of the ventilation system close automatically, isolating the reactor hall from the environment Emergency Ventilation System Following a manual scram, the pumps of the ventilation system stop and the emergency ventilation starts automatically, removing the possibly contaminated air in a rate of 1500 m 3 /h. The operation of the emergency ventilation system has a two-fold purpose: First, to maintain a pressure in the reactor hall slightly lower than the environment pressure, preventing any uncontrolled ground release, due to possible leakage of contaminated air through the building cracks or small holes. Second, to pass the contaminated air through activated charcoal filters, for iodine retention, as well as through a series of glass and absolute filters. The glass and absolute filters are replaced according to the indication of the differential pressure meters installed at the filter units and the activated charcoal filters are replaced twice a year. After the filters the ventilated air is discharged into the atmosphere through the reactor stack (effective height 50 m) Electric Power Supply System This is the only support system for the front line systems described above. The system consists of the main power which is received from the utility plus the following sources: 19

21 Non Break Unit: This unit ensures a continuous operation to the control system and to one pump of the primary cooling system. It consists of a 65 KW motor (receiving power from the utility), which is connected with a 60 KVA generator and a 135 HP diesel motor. A flywheel provides a continuous and smooth rotation to the system and therefore, will not cause any disturbance when the diesel motor starts after a power failure. Stand-by Unit: This unit is a diesel motor generator of 120 KVA power. This starts operating automatically about 10 sec after the power failure occurs. It can feed one secondary pump and the corresponding cooling tower blower, part of the ventilation, the emergency ventilation, the crane and part of the lights. Central Stand-by Unit: From the central "stand-by" unit of "Demokritos" a power of 70 KVA can be received to supply the second primary pump, the mechanical doors of the reactor hall and the pneumatic irradiation facility (Rabbit). Diesel Motor: A small diesel motor generator of 12 KVA is connected to feed part of the emergency lights and part of the monitoring system automatically with a time lag of about 10 sec following a power failure. No manual action is needed for this procedure. 2.7 PLANT SYSTEM REQUIREMENTS This section provides a short description of the requirements of each of the front-line systems for successful operation assuming that all hardware is available and properly functioning and associated human actions are correctly performed Success Criteria for the Reactor Protection System There are four ways for achieving interruption of the chain reaction through the insertion of the control rods into the core. 1. Fast Scram 2. Slow Scram 3. Reverse 4. Manual A summary description has been given in section

22 The following table provides the signals necessary for the activation of the reactor protection system in each of the four possible modes. (Fast and slow scrams are combined into one category) Primary Heat Removal System & Reactor Pool Success criteria for the systems performing the heat removal safety function have been determined on the basis of a special thermal-hydraulic analysis presented in Reference [4]. The results of these analyses can be summarized as follows: Transients at Full Power operation with successful Scram. If successful shutdown is achieved following the initiation of a transient, then calculation indicate that core integrity is preserved through heat removal either via the primary heat removal system to the atmosphere or via natural convection to the reactor pool. For the latter successful opening of the flapper is required. The only case where natural convection does not guarantee cooling of the core is if the shutdown follows a transient initiated by the insertion of excess reactivity Transients at Full Power without Scram (ATWS) In transients without scram, operation of the primary heat removal system is necessary to maintain stable conditions of heat removal. Such transients are those initiated by Loss of offsite power. A transient initiated by blockage of flow in one of the channels and failure to scram will inevitably lead to limited core damage in channel with the blocked flow.. All other transients involve the partial or total loss of flow and hence, loss of primary heat removal and the analysis in Ref. [4] does not support adequate cooling of the core. Again given an accident initiated by the insertion of excess reactivity failure to scram instigates conditions that even full availability of the primary heat removal system cannot reverse Loss of Coolant Accidents If pool isolation is possible, that is if the break occurs at such a point that the loss of water from the pool can be stopped then natural convection can help in the case of successful opening of the flapper. 21

23 TABLE SIGNALS AND RESULTING RESPONSE FROM THE REACTOR PROTECTION SYSTEM Sensors& Alarms SCRAM REVERSE MANUAL S1: UIC #1 If S1>130% of full Display Power S2: UIC#2 If S2 > 130% of full Display Power S3B: Period If S3B < 3sec If 3s < S3B <10s Alarm & Recorder S3A: Power IF S3A >130% of Full Power Alarm & Recorder S4 : Coolant Outlet If S4 > 56 0 C Recorder Temperature S5 : Pool Level at If ON Alarm -12 S6: Flapper open IF S6=ON & Alarm S3A>100KW S7: Pump failure (both pumps) C1A Partial flow meter #1 C1B Partial flow meter #2 C2 Total flow meter IF S7=ON & Alarm S3A>100KW If C1A<160m 3 /h & If C1A<160m 3 /h & Display C1B<160m 3 /h & S3A>3MW S3A>100KW If C1A<160m 3 /h & If C1B<160m 3 /h & Display C1B<160m 3 /h & S3A>3MW S3A>100KW If C2<320m 3 /h & Alarm & Display S3A>3MW C3 ΔT differential If C3>10 0 C Alarm & Display I1: Pool Level<-6 Alarm I2: Coolant Temp. Recorder I3: CIC#2, Linear-N Recorder 22

24 2.7.3 Emergency Core Cooling If a LOCA proceeds to the point that core uncovery occurs, then the Emergency core cooling system will passively spray the core with water. It has been assumed that successful operation of this system will prevent core damage Containment Isolation On the basis of the summary description given in section above, it is required that appropriate manual action has been undertaken by the operator (manual scram) Emergency Ventilation Similarly as before, the requirement is that reactor operator issues a manual scram (see summary description of section 2.6.6) Electric Power supply Here, the requirement is that the non-break unit is available. As described in section 2.6.7, the non-break unit permits an uninterrupted transition from normal utility power to emergency power supply, ensuring the operation of the reactor control system and one primary pump. 2.8 CORE DAMAGE DEFINITION Based on the thermal hydraulic analysis presented in Reference [4] and the above definitions of front-line system success criteria the following definitions of core damage have been incorporated in the analysis. Core damage is assumed whenever the available means for fission and decay heat removal cannot ascertain via the calculations presented in reference [4] adequate cool down of the core. 2.9 GROUPING AND SCREENING OF INITIATING EVENTS Based on the response of the safety systems described in section 2.6 and 2.7 the following groups of initiating events have been formed: 1. Loss of Coolant Initiator (LOCA) 2. Loss of Flow owing to failure of both Primary Pumps 3. Loss of Flow owing to Butterfly valve closure 4. Loss of Flow owing to Flapper opening 5. Insertion of Excess reactivity 6. Loss of offsite electrical power supply (LOOP) 7. Fuel channel Blockage 23

25 External events were out of scope. Other i.e. are either of low frequencies or included in the above groups. 24

26 3 ACCIDENT SEQUENCE MODELING Five initiating events have been identified in the Greek research reactor, which are the following: Loss of coolant (LOCA), Loss of Flow (LOFA), Excess reactivity, Loss of offsite power (LOOP), Flow Blockage. The associated thermal-hydraulic analysis is given in detail in Ref. [4]. Loss of Flow might occur in the three ways: either owing to failure of both pumps, or to the failure of the safety flapper or to the butterfly value failure. Finally the following seven initiators are further analyzed in this report: a) Loss of Coolant (LOCA) b) Loss of Flow owing to pump failure c) Loss of Flow owing to flapper failure d) Loss of Flow owing to butterfly value failure e) Excess reactivity f) Loss of offsite power (LOOP) g) Flow Blockage 3.1 EVENT SEQUENCE MODELING Seven event trees have been developed, one for each initiating event Loss of Coolant (ET1) Event Tree ET1 models the possible response of the reactor to loss of coolant. ET1 (see Figure 3.1) comprises the following events: 1. LOCA (I.E.) It is assumed that during full power operation there is a guillotine rupture of the largest (10 ) pipe connected to the bottom of the reactor. (LOCA). 2. Availability of reactor protection system Following LOCA the reactor protection system, both automatic and manual systems should shut down the reactor. Success of this event results in scram and hence in interruption of the fission chain reaction. 3. Pool isolation Following LOCA the pool should be isolated from the cooling system. This occurs if the butterfly valves close, either manually or automatically, within 16 min following the accident (see thermal-hydraulic analysis, section 5.1). Successful isolation of the pool from the location of the break results in the core being immerged in the pool 25

27 water. Hence, if pool isolation succeeds, coolant inventory remains available (loss of coolant stops). Now, the concern is if natural circulation of pool water is available. 4. Natural circulation With pool water available the flapper should open and enable natural cooling of the core. As described in section 4.4. of [4] natural cooling is sufficient to prevent core damage if there has been a successful scram. Hence sequence #1 is successful. Should the flapper fails to open to enable natural circulation, adequate heat removal is doubtful. It has been conservatively assumed that core damage would occur. Equally doubtful is the adequacy of heat removal with and of course without natural heat removal capability in the case that the reactor is not shutdown via the reactor protection system. Again it has been assumed that if shutdown is not achieved, following total loss of flow core damage would occur. A different amount of core inventory release has been assumed depending on whether the fission chain reaction has been stopped and on whether natural circulation is possible. 5. Emergency core cooling system (ECCS) If the pool can t be isolated, then availability of natural pool water circulation is irrelevant, and the emergency cooling system should start operating, so as to spray water to the core. It is assumed that, with the reactor in shutdown state, spraying of the core is sufficient remove decay heat and thus to avoid core damage. As a result sequences #5 is considered as a successful sequence. Should the ECCS fail then natural cooling in air only is not sufficient to remove decay heat. As shown in sections 5.2 & 5.3. of the thermal-hydraulic analysis, core damage will occur in 2h 30 min, and radioactivity will be released within the reactor building. Consequences, however, depend on the amount of the radioactivity released outside the containment and hence the following events ought to be included in the tree. 6. Containment Isolation In case the ECCS does not operate, the reactor building should be isolated and all gates and doors should remain closed. The objective of this action is to prevent any radioactivity release to the environment. Successful isolation of the containment requires the operation of the emergency ventilation system to relief the pressure and to remove most of the released radioactivity through the filters. Failure of the containment to isolate results in the most severe accident sequence, from the release point of view, since it implies the release of the largest quantities of radioactivity from all accidents sequences. (Accident sequences #8 & # 17). 7. Emergency ventilation This event models the operation of the emergency ventilation system in case of LOCA. Successful operation of this system implies retaining of most of the 26

28 radioactivity inside the containment and in the filters. Failure of this system (Accident sequences #7 & #16) implies release of radioactivity at larger quantities than when the system operates but smaller than when the containment isolation has failed (Accident sequences #8 & #17). This event tree determines 17 sequences. Two lead to a safe situation ( 1, 5). All other sequences ( 2, 3, 4, 6-17) lead to an accident with 10%, 30%, 50% or 100% core damage and different degrees of releases to the environment. It is noteworthy that the operation of the shutdown system does not practically affect the final outcome of the sequence with respect to the consequences. It does, however, affect the probability of the sequences since some of the instrumentation and alarms are common to the reactor protection system, pool isolation through closure of the butterfly valve and the start of the ventilation system Event Tree for the IE Loss of Flow owing to pump failure (ET2) This event tree models the response of the reactor systems to the loss of flow of the coolant owing to the failure of both primary pumps. Figure 3.2 depicts this event tree comprising the following events. 1. Pump Failure (IE) Initiator in this case is the failure of both pumps of the primary coolant system 2. Reactor protection system In case of pump failure the reactor protection system should shut down the reactor. This may occur either automatically or manually. Successful shutdown of the reactor would leave as the only concern the removal of the decay heat from the core through the natural circulation in the pool. 3. Natural circulation heat removal In case of loos of flow, the flapper should open and enable natural circulation and heat removal. Successful opening of the flapper would ensure successful removal of the decay heat as indicated in the thermal-hydraulic analysis (Section 4.4). Hence sequence #1 is successful. Should the flapper fail to open to enable natural circulation, adequate heat removal is doubtful. It has been assumed that core damage will occur. Equally doubtful is the adequacy of heat removal with (and, obviously, without natural heat removal capability) in the case that the reactor is not shutdown via the reactor protection system. Again it has been assumed that if shutdown is not achieved, following total loss of flow core damage would occur. A different amount of core inventory release has been assumed depending on whether the fission chain reaction has been stopped and on whether natural circulation is possible. 27

29 4. Containment Isolation This is the same as event 6 in ET1 5. Emergency Ventilation This event models the operation of the emergency ventilation system in case of LOFA, owing to pump failure. There are ten sequences in this event tree. One leads to safe situation ( 1). Three sequences (#8, #9, & #10 implying ATWS and no natural circulation) lead to accident situation with 50% core damage, three sequences (#5, #6, #7 implying ATWS with natural circulation) lead to accident with 30% core damage and three sequences (#2, #3, #4 implying successful shutdown but no natural circulation) lead to accident with 10% core damage Event Tree for initiator LOFA owing to butterfly failure (ET3) This event tree models the response of the reactor system to a loss of flow owing to failure of one of the butterfly valves. The response is similar to the total loss of flow owing to loss of both primary pumps. It is examined in a second event tree, nevertheless, since the availability of the reactor protection system, as well as, of the emergency ventilation is different in this case. This is due to the fact that fewer signals are available in this case for the automated initiation of scram. The events comprising this event tree (see Figure 3.3) are the following. 1. LOFA owing to butterfly failure (IE) If for any reason one of the two butterfly valves closes abruptly during operation of the reactor, the coolant flow decreases and loss of flow will occur. 2. Reactor protection system This event models the availability of the reactor protection system, in case of LOFA owing to butterfly failure. The protection system (either manual or automatic) should shut down the reactor. 3. Natural circulation Same as event 3 in ET2 4. Containment Isolation Same as event 6 in ET1. 5. Emergency Ventilation This event models the operation of the emergency ventilation system in case of LOFA owing to butterfly failure. 28