Level 2 PSA for the VVER 440/213 Dukovany Nuclear Power Plant

Nuclear Nuclear Research Research Institute Řež plc Institute Řež plc Level 2 PSA for the VVER 440/213 Dukovany Nuclear Power Plant Jiří Dienstbier, Stanislav Husťák OECD International Workshop on Level-2 PSA and Severe Accident Management, Cologne, 29-31 March 2004 3/19/04 1

Outline Plant features History Methodology used Main characteristics Containment failure modes Large event tree - APET PSA 1 PSA 2 interface Main part of APET Hydrogen model Fission product release source term to the environment Results Sensitivity studies Accident management Conclusions and plans for near future 19.3.2004 2

Plant features 4 units in 2 twin-units, twin units in common building, each unit has its own containment Mostly rectangular leak tight rooms, pressure suppression system bubble condenser Recirculation sump is not at the lowest level, possibility to lose ECC coolant to ventilation Reactor cavity is the containment boundary including double steel cavity door 19.3.2004 3

History PSA 2 for unit 1 First (Revision 0) Limited scope Level 2 PSA From 1995 to April 1998 as US AID project contractor SAIC (Science Applications International Corporation) with NRI Řež as subcontractor and with plant support Based on SAIC-NRI level 1 PSA from 1994 Limited to normal operation at power without ATWS, no shutdown states, no external events 4 fission product groups, point estimates of frequencies, uncertainties treated by sensitivity study Large event tree (APET) method (program EVNTRE) MELCOR 1.8.3 physical analyses Knowledge transfer to NRI specialists was a part of the project Revision 1 Autumn 1998 (SAM proposals updated in autumn 1999) by NRI Řež Using NRI Řež living PSA 1 from 1998 (partially including new EOP), much different from the PSA 1 in rev.0 Extended to fires and floods Large modification of the event tree about ½ of questions changed keeping their order Only small modification of basic events Revision 2 End of 2002, living PSA 1 2001 used, fully taking into account new EOPs, including ATWS sequences (did not propagate into PSA 2) Revision of the AICC hydrogen burn model Containment failure (leak type) due to slow pressurisation by steam and non-condensable gases added 19.3.2004 4

Main characteristics Main characteristics Limited scope Level 2 PSA Similar to IPE for US power plants Limited to normal operation at power including internal events - fires, floods Not included: External events like earthquake, low power and shutdown states 4 fission product groups Cs, Te, Ba, noble gases, only Cs+Ba used for release categories Large event tree (APET) method, the resulting tree has 100 nodes (usually more than 2 states): 12 nodes PSA 1 PSA 2 interface (PDS vectors) Nodes 13 to 85 accident progression Nodes 86 to 100 related to fission product release to the environment source term Program EVNTRE (developed by SNL) The results are probabilities of 12 release categories + results of binning and sorting About 90 basic events and several physical parameters Revision 0 only MELCOR 1.8.3 physical analyses of selected sequences (5 basic sequences + their variations), results used to specify some parameters and basic events Other activities plant walkdown, containment feature notebook 19.3.2004 5

Containment failure modes Table 1 Containment failure modes Failure mode Assumed effective leak size Caused by phenomena Early bypass rupture Bypass sequences SGCB (single SG tube added to early leak) Early or late rupture 1 m 2 Containment isolation failure*, pressurization due to hydrogen burn, hydrogen detonation, steam explosion, vessel rocket, cavity or cavity door failure Early leak 0.01 m 2 Cavity door loss of tightness, SGTR Late leak 0.01 m 2 Cavity basemat penetration, containment failure by slow pressurization Intact containment natural leak 12.5 % / day used, it is about 9 % at present * The fact that containment isolation failure starts very early is taken into account for source term. Classification of events timing: Early before reactor vessel bottom failure (and about 2 hours later for fission products) Late after this time Failure locations in the containment (several possible) and cavity (or cavity door) Retention in walls or auxiliary building surrounding containment neglected Containment strength curve (after DOE/NE-0086, 1989) 1) Containment normal distribution, m = 400 kpa overpressure, s = 80.9 kpa 2) Cavity normal distribution, m = 2420 kpa overpressure, s = 460 kpa Possible containment isolation failure Ventilation lines P-2 (TL-40), O-2 (TL-70) Drainage, neglected in revision 2 19.3.2004 6

PSA 1 PSA 2 Interface PDS (plant damage state) vectors representing first 12 nodes of PSA 2 event tree and characterizing the plant systems at the onset of core damage Respecting US NRC IPE and IAEA recommendations to reflect PSA 1 results PDS description First node representing initiating event 13 events, ATWS, ILOCA (interfacing LOCA other than through SG) screened out because of low frequency in PSA 1 initiating events specific for PSA 2, especially RPV-PTS reactor vessel rupture due to thermal shock Other 12 events Different size LOCA S-LOCA, MS-LOCA, M-LOCA, LG-LOCA LOCA leading to water loss outside main sump IL/RCP, IL/POOL SGCB SG collector break and lift off, SGTR SG tube rupture SB-OUT steamline break outside containment, SB-IN steamline break inside containment TRANS transient very similar PDS vectors to SB-OUT, total loss of feedwater in both SBO station blackout failure of electric power supply including category 2 Flood included as SBO 34 Fires in some of the TRANS and IL/RCP initiators 19.3.2004 7

PSA 1 PSA 2 Interface Following 11 nodes HPI... state of HP injection and recirculation LPI... state of the LP injection and recirculation Sprays... state of containment sprays SHR... secondary heat removal (mainly feedwater availability) SecDP... secondary system depressurisation (important only for SHR OK) PrimDP... primary system depressurisation by the operator ECCS_Inv... location of (decisive part) of ECC water inventory VE_Cat2... state of category 2 electric power VE_CI... Two events combined: containment isolation (CI) recirculation sump isolation against water loss (fsumpi = sump isolation failed) VE_CHR... containment heat removal system status (not including water and electricity availability) BC_Drain... location of bubble condenser water: These nodes have 2 to 4 attributes Result 34 PDS vectors (table 2 in the paper), only 5 of them with frequency > 10-6 /y RPV-PTS, SB-OUT, TRANS, IL/RCP, blackout 19.3.2004 8

PSA 1 PSA 2 Interface Figure 1 Analysis of CDF Loss of ECC water Complete loss of all electric power including batteries 22% 1% Hardware or control problem difficult to solve (switch over to recirculation) Complete loss of electric power up to category 2 1% 6% 1% 69% Error in procedure including human error (primary depres s uris ation) Very limited core damage 19.3.2004 9

APET Nodes (questions) 13 to 85 Development of APET - Main event tree as framework including: primary pressure before vessel failure, ECCs water location, early recirculation, vessel failure containment failure early late recirculation containment status late Phenomenology The same as for PWR reactor (importance often different, e.g. in-vessel hydrogen) Special connected with cavity design and its function as containment boundary HPME and cavity failure by gases or steam overpressure Cavity door failure by debris jet impingement Containment failure by gases transfer from the cavity Cavity door failures by thermal effects [1) large, 2) small=loss of sealing, a) within 2 hours after VF, b) late] Technical systems complicated the event tree and required repeating of some questions: category 2 electric power early and late primary system depressurisation sprays early and late late phase - water in cavity / cavity door status (to avoid feedback) Quantification of basic events and physical parameters (quantification tables for probability) MELCOR plant analyses detailed problems analysed by MELCOR (cavity) hand calculation, engineering judgement literature Hydrogen Early and late, same models but different assumptions Production according to scenario and core damage (full, limited), concentration calculated Type of burn: no burn diffusion burn deflagration detonation specified according to concentration and other Consequences calculated for deflagration using AICC model and comparing the modified peak pressure with containment strength curve no burn diffusion burn no containment failure detonation always failure Update of model in revision 2, the strongest effect had the assumption about electric power not a good igniter 19.3.2004 10

Fission product release to the environment - source term Nodes 86 to 100 Early and late release of Cs, Te, Ba, Xe+Kr in % of inventory Decontamination factors (DF) - primary, containment, sprays Revolatilization of early released and deposited f.p. also assumed Calculation (using DF) using user functions and sorting of releases The result of 100 is sorted to 12 release categories Thresholds 0.1, 1.0, 10.0 % of inventory for Cs group and 1 order less for Ba group In revision 2, the results sorted to 5 classes: 1. early high more than 1% of Cs or 0.1% of Ba with early containment failure 2. late high the same with late containment failure 3. early low between 0.1% and 1% of Cs and 0.01% and 0.1% of Ba with early containment failure or no failure 4. late low - the same with late containment failure 5. very low less than 0.1% of Cs and 0.01% of Ba The last class specified according to Swedish and Finnish criteria (0.1% 137 Cs) Noble gases release higher, not used in these classes We think about adding one more category for LERF (>10% of Cs and I early) 19.3.2004 11

Summary results Figure 2 Release classes and containment failure, case with PTS fre que ncy [1/ye ar], CDF=2.968E-05 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% 6.9105E-06 4.3631E-07 1.739E-05 1.0909E-05 3.9547E-06 2.296E-07 4.768E-08 4.773E-06 7.4742E-06 7.248E-06 1 2 re le as e containme nt s tate very low nocf late low CFL_Leak early low CFL_Rp late high CFE_Leak early high CFE_Rp+Byp_Rp 19.3.2004 12

Summary results Figure 3 Release classes and containment failure, case without PTS frequency [1/year], CDF=1.357E-05 100% 90% 80% 70% 60% 6.9107E-06 9.075E-06 ve ry low nocf la te low CFL_Le a k early low CFL_Rp late high CFE_Leak early high CFE_Rp+Byp_Rp 50% 3.4796E-07 40% 2.5974E-06 30% 20% 9.161 6E-07 1.670E-06 2.296E-07 2.305E-08 10% 2.7996E-06 2.573E-06 0% 1 2 re le as e c o ntainm e nt s tate 19.3.2004 13

Results Results sorted according to Consequences for PDS vectors 11 risk vectors with early or late high release frequency above 10-7 /year found used for scenario analyses recommendations initiated by RPV-PTS, SB-OUT or TRANS, SBO, IL/RCP, IL/POOL, SGCB Core damage Limited 17,7% (38.5% w/o RPV-PTS) or Full Pressure at vessel bottom head failure Low (below 0.8 MPa) 91.8% (82.0%) Most Important phenomena leading to containment failure % CDF (w/o RPV-PTS) E_Byp_Rp 0.64 ( 1.40) E_Rp 23.78 (17.56) Hydrogen deflagration or detonation 12.34 ( 7.70) Cavity failure (mostly steam explosion) 10.47 ( 7.72) E_Leak 0.77 (1.69) Single SG tube break 0.37 (0.81) L_Rp 0.16 (0.17) L_Lk 16.06 (12.31) Thermal failure of door sealing 12.54 7.76 Basemat penetration 2.67 1.85 Intact containment 58.62 (66.93) 19.3.2004 14

Sensitivity studies Sensitivity studies are the only method to assess uncertainty here Revision 0 PSA 2 23 sensitivity studies Showing importance of some basic events like steam explosions Including accident management Changing only basic events and parameters, no event tree change Revision 1 Accident management and preventive measures only Also small event tree changes if needed Most efficient Cavity flooding and external vessel cooling Primary system depressurisation by operator Combining depressurisation with other measures 19.3.2004 15

Sensitivity studies Revision 2 case without RPV-PTS shown before case without RPV-PTS and IL/RCP with coolant loss (plant modification) CDF decreased to 1.15*10-5 / year LERF decreased to 2.30*10-6 /year primary system depressurisation in SAMG Low efficiency - mostly low pressure accident and depressurisation in EOP higher probability of hydrogen early ignition as in the previous revisions Early containment failure due to hydrogen 4% higher hydrogen source medium =50% oxidation, high =80% (instead of 35% / 50%) LERF = 1.53*10-5, more than 50% of CDF is early containment failure lower containment strength 300 instead of 400 kpa median, similar results like for higher hydrogen source lower containment strength and higher hydrogen source Early containment rupture 69% CDF, LERF = 2.06*10-5 / year, hydrogen the only risk lower steam explosion probability in the cavity 0.1 (instead of 0.5) for high molten fraction, 0.01 (0.1) for low molten fraction containment failure by steam explosion 1.41% CDF (10.43%) 19.3.2004 16

Severe accident management Present situation Dukovany concentrated on core damage prevention in the past CDF decreased considerably, more than one order of magnitude This was due to plant modification and symptom oriented EOP Plant modifications not included in the last revision of PSA 2 modification to eliminate ECC coolant loss from MCP motor deck (IL/RCP) to start soon intensive study of RPV-PTS to decrease its probability Isolation of cavity drainage for eliminating ECC water loss after RPV-PTS also ventilation line isolation would be needed using fire pumps for feedwater, filling of SG from tank by gravity lower blackout CDF After these modifications, CDF below 10-5 /year can be reached SAMG needed to decrease high early release WOG generic severe accident management guidelines (SAMG) modified to VVER 440/213 Theory Accident Management can be divided into levels of defense 1. Measures to restore cooling shortly after core damage and stop the accident in the vessel 2. Measures to prevent containment failure 3. Measure to mitigate release for failed or bypassed containment Higher level usually less efficient Good defense in depth concept to have all levels VVER-440 with high natural leak requires level 3 also for intact containment PSA 2 indicates hydrogen as the highest priority, cavity (door) as the second highest priority 19.3.2004 17

Severe accident management Hydrogen The plant is equipped with PAR for DBA, they are too slow PHARE 94 2.07 showed that even extension of PAR is a problem too large area needed MELCOR 1.8.5 analyses indicate negligible risk for self-ignition at 10% of hydrogen Caused by large differences in local concentration Controlled combustion seems the most promising, igniters needed NRI prepares a project to start in 2005 to analyze their number and location Cavity and cavity door protection More complex, the strategy depending on plant modifications wet or dry cavity Decision to use in-vessel retention by external cooling not yet taken If not accepted, we can partially flood the cavity and cool the door Risk of steam explosion in the cavity must be analyzed High pressure melt expulsion must be prevented especially for water in the cavity Existing SAG primary system depressurisation sufficient Dry cavity strategy simple thermal protection of cavity door - cheap solution Other issues can be covered by procedures, except: Reduction of the release in primary to secondary accidents Improvement of habitability of the control room 19.3.2004 18

Conclusions and plans for near future Limited scope PSA 2 proved to be a very good tool especially when comparing risk importance of individual phenomena Extension to shutdown states needed and should start soon Before next revision of limited scope PSA 2 for power states (in 2006?), some problems have to be solved Most of them already included in other project: better containment strength curve results in 2004 better scenarios MELCOR 1.8.5 analyses in 2004 including SAMG decreasing conservatism of natural leak from the intact containment retention in walls and external building 2004 improved knowledge of steam explosions including cavity strength?? 19.3.2004 19