FUNDAMENTAL SAFETY OVERVIEW VOLUME 2: DESIGN AND SAFETY CHAPTER S: RISK REDUCTION CATEGORIES. 2.fsb. ATWS THROUGH PROTECTION SYSTEM FAILURE (STATE A)

Transcription

1 PAGE : 1 / 7 2.fsb. ATWS THROUGH PROTECTION SYSTEM FAILURE (STATE A) This sectin deals with the fllwing PCC-2 events, with the assumed failure f the Reactr Trip signal that cmes frm the Reactr Prtectin System: - excessive increase in secndary steam flw (pening f the GCTc [MSB]), - lss f nrmal feedwater supply t the steam generatrs (ARE [MFWS] and AAD [SSS] lss), - ttal lss f ffsite pwer supply (MDTE [LOOP]), - failure f the RCV [CVCS] that leads t an uncntrlled primary circuit brn dilutin, - uncntrlled withdrawal f a grup f cntrl rds. These five events were chsen because they are representative f the mst nerus ATWS cases. They are studied t assess their impact n: - the integrity f the RCP [RCS] (verpressure prtectin aspect), - the integrity f the cre (fuel prtectin aspect). The events cnsidered here are similar t thse discussed in the sectin ATWS thrugh rds failure (see Sectin S.1.2FSa). The nly difference is that the absence f the Reactr Trip is due t failure f the F1A signal itself (all the rds are available, but the F1A signal f the AAR [RT] is nt activated), rather than rds failure (the AAR [RT] F1A signal is available, but all the rds are nt available). A calculatin is nly prvided when the safety criteria cannt be shwn t be met by argument alne. When n calculatin is perfrmed in Sectin S.1.2FSb, the justificatin uses the calculatin perfrmed in Sectin S.1.2FSa as the basis fr the analysis f the transient. 2.fsb.1. ATWS - excessive increase in secndary steam flw (pening f the GCTc [MSB]) The fllwing justificatin uses, as its basis, the calculatin f the transient perfrmed in Sectin S.1.2FSa1 fr ATWS thrugh rds failure. - befre the initiatin f the F1A signal by the AAR [RT], the transient is identical t the ne discussed in Sectin S.1.2FSa1 - after the initiatin f the AAR [RT] signal, the transient differs frm the ne discussed in Sectin S.1.2FSa1: by the absence f the ATWS signal and the related actins (immediate startup f the RBS [EBS], shutdwn f the GMPP [RCP] n the very lw GV [SG] level signal) because the F1A signal fr AAR [RT] has nt been triggered.

2 PAGE : 2 / 7 by the absence f actins related t the faulty AAR [RT], i.e. n turbine trip signal, nr the high lad ARE [MFWS] lines islatin nr the clsure f the main steam islatin valves (VIV) [MSIV], and, if required, t meet the safety criteria, by the interventin f the dedicated RRC-A feature intrduced t cmpensate fr the lss f F1A signal f the AAR [RT]. Fr prtectin against verpressure, a generic methd is adpted that cvers all the ATWS sequences: the emptying f the GVs [SGs] must be prevented while the cre remains at a high pwer level. This situatin is prevented thrugh the autmatic initiatin f a reactr trip/turbine trip signal n Lw GV [SG] Level which is diverse t the reactr prtectin system, fr example in the Prcess Autmatin System (PAS). This diverse reactr trip signal is a RRC- A feature and is F2 classified. In the event f an Excessive increase in secndary steam flw by pening the GCTc [MSB], the GV [SG] water inventry is nt exhausted and there is n RCP [RCS] verpressure risk. The diverse reactr trip/turbine trip signal is nt activated and is nt necessary. In the event f an Excessive increase in secndary steam flw due t pening f the VDA [MSRT] (r a secndary valve that leads t the cnsumptin f secndary water), the secndary water inventry decreases cntinuusly, which leads t a reductin f the GV [SG] water level. The diverse reactr trip/turbine trip F2 signal is initiated and prtects the RCP [RCS] against excessive verpressure. With regards t cre prtectin, the reactr pwer limitatin functin limits the pwer excursin that results frm the uncntrlled cldwn, and stabilizes the cre pwer t apprximately 105% PN. This limitatin firstly inhibits the withdrawal f cntrl rds, then decreases the turbine pwer by reducing the pening f the turbine inlet valve, and if required, inserts the cntrl rds. During the transient, the RFTC [DNBR] remains abve the RFTC [DNBR] limit, and there is n risk f DNB. The integrity f the fuel is therefre nt impaired. In the event f an Excessive increase in secndary steam flw by pening the GCTc [MSB], which bunds all the excessive cldwn cases in the event f ATWS, the cre heat is finally remved, half by the GCTc [MSB] (whse capacity is apprximately equal t 50% f the nminal flw) and half by the turbine. 2.fsb.2. ATWS lss f main feedwater The fllwing argument uses, as its basis, the calculatin f the transient perfrmed in Sectin S.1.2FSa2 fr ATWS thrugh rds failure. - befre the initiatin f the F1A signal by the AAR [RT], the transient is identical t the ne discussed in Sectin S.1.2FSa2 - after the initiatin f the AAR [RT] signal, the transient differs frm the ne discussed in Sectin S.1.2FSa2: by the absence f the ATWS signal and the related actins (immediate startup f the RBS [EBS], shutdwn f the GMPP [RCP] n the very lw GV [SG] level signal) because the F1A signal f the AAR [RT] has nt been triggered.

3 PAGE : 3 / 7 by the absence f actins related t the failed AAR [RT] signal, i.e. n turbine trip signal (absence f ARE [MFWS] lines islatin has n effect since the ARE [MFWS] is lst due t the initiating event), and, if required, t meet the safety criteria, by the interventin f the dedicated RRC-A feature intrduced t cmpensate fr the lss f F1A signal f the AAR [RT]. With regards t prtectin against verpressure, the emptying f the GVs [SGs] must be prevented while the cre remains at a high pwer level. This situatin is prevented thrugh the autmatic initiatin f a reactr trip/turbine trip signal n Lw GV [SG] Level which is implemented utside the Reactr Prtectin System, fr example in the Prcess Autmatin System (PAS). This diverse reactr trip signal is a RRC-A feature and is F2 classified. With regards t cre prtectin, cmpared with the case fr rds failure discussed in Sectin S.1.2FSa2, the GMPPs (RCPs) are nt tripped n "very lw GV [SG] level" (the signal is nt activated because there is n ATWS signal). As a result, there is n decrease in the RFTC [DNBR] margin. At the same time, with the reductin f the GV [SG] level, the average RCP [RCS] temperature cntrl causes the insertin f rds t keep the RCS temperature at its demanded value (the efficiency f the RCP [RCS] / GV [SG] heat transfer decreases with the decrease f the GV [SG] level). The cre pwer is reduced, which increases the RFTC [DNBR] margin. When the Lw GV [SG] level is reached, the diverse reactr trip/turbine trip F2 signal is initiated and Reactr Trip ccurs. There is n lnger any risk f fuel damage. Thrughut the transient, the RFTC [DNBR] margin is higher than the initial RFTC [DNBR] margin, and there is n risk f DNB. The integrity f the fuel is nt therefre impaired. 2.fsb.3. ATWS - lss f ffsite pwer (MDTE [LOOP]) The fllwing argument uses, as its basis, the calculatin f the transient perfrmed in Sectin S.1.2FSa3 fr ATWS thrugh rds failure. - befre the initiatin f the F1A signal f the AAR [RT], the transient is identical t the ne discussed in Sectin S.1.2FSa3 - after the initiatin f the AAR [RT] signal, the transient differs frm the ne discussed in Sectin S.1.2FSa3: by the absence f the ATWS signal and the related actins (startup f the RBS [EBS]) because the F1A signal f the AAR [RT] was nt initiated. (Nte: the absence f the GMPP [RCP] tripping n the very lw GV [SG] level signal has n effect as all the GMPPs [RCPs] are lst at the beginning f the transient), by the absence f actins related t the faulty AAR [RT] signal, which has n effect since turbine trip and ARE [MFWS] lss ccur at the beginning f the transient, and, if required, t meet the safety criteria, by the interventin f the dedicated RRC-A feature intrduced t cmpensate fr the lss f F1A signal f the AAR [RT].

4 PAGE : 4 / 7 With regards t prtectin against verpressure, the wmptying f the GVs [SGs] must be prevented while the cre remains at a high pwer level. This situatin is prevented thrugh the autmatic initiatin f a reactr trip/turbine trip signal n Lw GV [SG] Level which is implemented utside the Reactr Prtectin System, fr example in the Prcess Autmatin System (PAS). This diverse reactr trip signal is a RRC-A feature and is F2 classified., The limiting phenmenn fr cre prtectin is the decrease f the primary flw rate (caused by the initiating event) that leads t a decrease in the RFTC [DNBR] margin. The rd failure case examined in Sectin S.1.2FSa3 shws that the RFTC [DNBR] minimum ccurs early in f the transient, befre any mitigatin actins can ccur. The prgressin f the transient is similar in bth the "rd failure" and "prtectin system failure cases. On Lw GV [SG] level, the Reactr Trip is initiated by the diverse reactr trip/turbine trip F2 signal, which is beneficial in cmparisn with failure f the rds. After the autmatic reactr shutdwn, there is n lnger any risk f fuel damage. During the transient, the RFTC [DNBR] minimum value is the value btained fr the rd failure case, which is higher than the RFTC [DNBR] limit. There is n risk f DNB and the integrity f the fuel is nt therefre impaired. 2.fsb.4. ATWS RCV [CVCS] malfunctin that leads t a decrease in the brn cncentratin f the primary clant 2.fsb.4.1. Identificatin f the causes A ttal failure f the autmatic shutdwn system f the reactr n demand frm the reactr'sprtectin system can be caused: - either by the failure f the autmatic reactr shutdwn F1A signals, i.e. that nne f the signals sent by the Reactr Prtectin System de-energise the rd drive cils, - r by failure f the cntrl and shutdwn rds after de-energisatin f their drive cils. In this case, the actuatin f the rds due t cntrl r limitatin signals als fails. This Sectin, S.1.2FSb4, deals with the first case, due t prtectin system failure. The secnd cause, linked t the lcking f the rds, is dealt with in Sectin S.1.2FSa4. 2.fsb.4.2. Sequence f events When the reactr is at pwer, the decrease in brn cncentratin causes an increase in the primary temperature which is cunteracted by the insertin f the cntrl rds. When the P1 bank (which is the first t be inserted) reaches its insertin limit, the mnitring system generates an alarm. When the alarm ccurs, the cntrl prcedures require the peratr t check the brn meter: the dilutin is then identified and the peratr is assumed t terminate it in 30 minutes. In the meantime, the cntrl rds cntinue t be inserted thus maintaining the primary temperature and pressure cnstant. Thus the transient amunts t a slw insertin f the RCCA banks in nminal cnditins. 2.fsb.4.3. Safety criteria It must be demnstrated that "the final state fr the RRC-A studies" can be reached, i.e.:

5 PAGE : 5 / 7 - achieving lng term cre subcriticality, - ensuring that the residual heat is remved, - integrity f the three barriers that prevent release f radiactive materials, in accrdance with the fllwing criteria: The RFTC [DNBR] remains higher than 1.21 (see sub-chapters D.4 and P.1), the integrity f the RCP [RCS] is nt impaired (the preliminary decupling criterin is that the peak pressure f the RCP [RCS] must nt exceed 130% f the design pressure, i.e bar (see Chapter C.6.1.5)). 2.fsb.4.4. Results and cnclusin The cntinued dilutin fr 30 minutes after reaching the P1 bank's insertin limit causes the full insertin f the P1 and P2 banks and the partial insertin at the tp f the cre f the P3 bank. The minimum RFTC [DNBR] ccurs when the P1 and P2 banks are fully inserted. The insertin f the P3 bank, even if it causes an increase in the enthalpy rise factr, skews the axial pwer distributin t the bttm f the cre which increases the RFTC [DNBR]. The minimum RFTC [DNBR] is significantly higher than the 1.21 criterin. As the temperature is kept cnstant by the insertin f cntrl rds, there is n increase in the primary pressure. 2.fsb.5. ATWS uncntrlled withdrawal f a grup f cntrl rds 2.fsb.5.1. Identificatin f the causes The PCC 2 event, uncntrlled RCCA bank withdrawal, cmbined with the cmplete failure f reactr trip system is classified as RRC-A event. A ttal failure f the reactr trip n demand frm the reactr's prtectin system can be caused: - either by the failure f the autmatic reactr shutdwn F1A signals, i.e. that nne f the signals sent by the prtectin system de-energises the rd drive cils, - r by failure f the cntrl and shutdwn rds after de-energisatin f their drive cils. In this case, actuatin f the rds due t cntrl r limitatin signals als fails. This Sectin, S1.2FSb5, deals with the first case, due t prtectin system failure. The secnd cause, linked t rd failure, is dealt with in Sectin S.1.2FSa5.

6 PAGE : 6 / 7 2.fsb.5.2. Sequence f events The uncntrlled withdrawal f a grup f cntrl rds causes a rapid increase in cre pwer, and an increase in the primary circuit temperature and pressure. On the secndary side, the pressure increase is limited by the pening f the GCTc [MSB]. As n autmatic shutdwn ccurs, nr any ther pwer reductin, due t the prtectin system failure, the withdrawal f the rds is nt stpped until they are fully withdrawn and reactivity insertin and the pwer increase can be higher than the values btained in the case f rds failure (see Sectin S.1.2.FSa.5). Hwever, reactivity feedback due t mderatr and Dppler temperature effects limits the pwer excursin. When the lw GV [SG] level is reached, a diverse autmatic shutdwn signal is generated which ends the transient by the insertin f bth the cntrl and shutdwn rds. 2.fsb.5.3. Safety criteria These are the same as described in sectin S.1.2.FSa fsb.5.4. Prtectin and mitigatin actins The fllwing functins mitigate the accident cnsequences in the event f an uncntrlled rd withdrawal cupled with a failure f the prtectin system. - reactr trip and turbine trip n lw GV [SG] level (F2) In additin, 3 the pressuriser safety valves, and 2 f VVP [MSSV] valves per GV [SG] are credited (F1A). 2.fsb.5.5. Specific assumptins Single failure and maintenance Single failure and maintenance d nt have t be taken int accunt in the RRC-A analyses. Initial cnditins The initial cnditins are the Best Estimate cnditins at 100% nminal pwer. The thermal-hydraulic primary flw rate is assumed, being cnservative even thugh it is nt strictly required by the accident analysis rules fr RRC-A sequences. Assumptins related t the rds The initial psitins f the cntrl assemblies taken int accunt are cnservative but realistic. The withdrawal speed is 75 steps/min. Neutrnic data The neutrnic data are calculated at the beginning f life DDV [BOL].

7 PAGE : 7 / 7 The Dppler temperature cefficient is at its mst psitive value, t minimise the cre pwer decrease after islatin f the steam lines. It cvers all ptential fuel management schemes. Reference fuel management is used t maximise the FΔH when the mderatr and Dppler temperature cefficients are set at their given values, which penalises the RFTC [DNBR] calculatin. Assumptins related t the systems The claimed F1A systems are as fllws: ASG [EFWS], pressuriser safety valves, VDA [MSRT], VVP [MSSV]. 2.fsb.5.6. Results and cnclusin Cre pwer first increases with the rd withdrawal. The minimum RFTC [DNBR] ccurs shrtly after 3 minutes, lng after the cre thermal pwer reaches its maximum (at apprximately 40 secnds). It is much higher than the 1.21 criterin. Since n reactr trip is activated, the turbine remains available, the steam generatr pressure increases up t the GCTc [MSB] pening pressure, then stabilises. The first pressuriser safety valve is demanded, and the peak primary pressure is a little higher than 180 bar. The GCTc [MSB] pens n the secndary side. With regards t the maximum pressure in the primary circuit, the results f the transient are cvered by thse presented in Sectin S.1.2.FSa.5 (rds failure). The decupling criterin f 130% f the design pressure is met with a large margin. After the withdrawal f the P1 bank and given that the GVs [SGs] can remve the cre heat, the primary parameters and in particular the cre pwer stabilise at an equilibrium level. The RFTC [DNBR] als reaches a stable value (at apprximately 200 s). Given that the GV [SG] level cntrl is nt taken int accunt in this analysis, the GV [SG] level decreases slwly. On lw GV [SG] level, an autmatic reactr trip is initiated by the diverse prtectin which stps the transient. When the GV [SG] level is cntrlled autmatically, n autmatic reactr trip ccurs; hwever, stable cnditins are reached. There is therefre n particular prblem regarding the heat remval.