PROPOSAL, DESIGN, IMPLEMENTATION AND SAFETY DEMONSTRATION OF SEVERE ACCIDENT MANAGEMENT MEASURES AT VVER440 IN SLOVAKIA Ing. Jozef Baláž, Ph.D. VUJE a.s. Trnava, Slovakia Email: Jozef.Balaz@vuje.sk Ing. Milan Cvan, CSc VUJE a.s. Trnava, Slovakia Email: Milan.Cvan@vuje.sk Abstract During the past two decades large effort was dedicated in Slovakia to upgrade the operating VVER440/V213 units to cope with severe accidents. The concept is based on In Vessel Retention (IVR) strategy, but the upgrades - now in finalization phase - were complex and harmonized within all aspects, both safety (prevention, mitigation, releases) and feasibility (availability of equipment, realization costs). The complex of hardware upgrades is composed of eight groups, as e.g. IVR, primary circuit depressurization, long term heat removal, severe emergency sources of coolant and power supply etc. The paper briefly summarizes the long way already passed - initial conditions, approach in design concept, scope and interrelations of individual measures, up to safety demonstration of the efficiency of the severe accident management using adjusted severe accident management guidelines. Selected specific topics are described in more detail to point out the obstacles and list of most important contributions to safety of the units is presented. 1. INTRODUCTION Extension of the safety assessment of the nuclear power units in operation started in Slovakia during the late 90s. Initially the effort was focused to understanding of the overall response of the VVER 440 units to severe accident conditions - development of basic models and simulation of such accident scenarios in frame of PHARE project [4], [5]. Consequently, all necessary steps were undertaken to cover complete scope of the evaluated safety extension to severe accidents - from probabilistic assessment of events, core and plant damage states and creation of large and full scope database of severe accident analyses point of view, up to the quantification of potential impacts of severe accidents on the environment. At the beginning of 2005, the level of knowledge was considered sufficient enough to start - in parallel with continuing analytical effort - with systematic identification of weaknesses of the VVER 440, V213 units regarding and ability to control of severe accidents. This systematic identification was aimed on compilation of objectives, strategies, specific procedures and necessary needed systems, which would allow either, enhance protection of the units or an efficient management of severe accident scenarios. During the first decade of 20th, four units of VVER440 (V213) reactors were in operation in Slovakia. At that time the decision was taken to complete another two units of the same design, but with design extension up to the 4 th level in depth, i.e. to modify the design in such a way, that it would also satisfy as much as reasonably possible the requirements relevant for newly built units. It required activities aimed to proposal and design systems for protection and mitigation ([6], [7]) of severe accident, which resulted in design and realization of the complex of measures on units in operation and also on units in completion phase. Application of such measures enabled development and introduction of efficient Severe Accident Management Guidelines. 1
IAEA-CN-86 [Right hand page running head is the paper number in Times New Roman 8 point bold capitals, centred] 2. SELECTION OF APPROACH As required and as specific for severe accidents, the philosophy of the approach to proposal and development of a set of technical measures, dedicated to the severe accident management, shall emphasise protection of the environment and the limitation of consequences on the environment. Thus the main objective of the strategy shall be to protect the containment integrity and to control the atmosphere pressure inside of the containment, especially form the long term point of view. Analyses of diverse scenarios and considerations of potential measures showed that effective limitations of consequences of severe accidents on opened reactor or in the spent fuel pool are difficultly applicable, if ever and the effort in this case should be better focused on practical elimination of such events via implementation of the extraordinary robust and reliable prevention technical and management means. Evaluation of the complex set of severe accident scenarios with simulation of diverse potential systems for their control shown, that the principal requirement is to prevent reactor pressure vessel damage (to made ex-vessel phases of severe accident practically eliminated). If this goal is not reached then the phenomena as high pressure melt ejection, steam explosions, excessive hydrogen production and containment pressurization in long term may cause present insolvable challenges in proposal mitigation measures. Another specific outcome of the evaluation was in conclusion that the set of measures needs to be complex, dealing with all identified challenges, and well balanced to provide optimum set of means to control any hypothetical severe accident scenario, without impact to design basis safety. The design phase of individual systems followed the evaluation. At the beginning it was ascertained, that the qualification of newly designed systems and equipment is a very important and difficult problem. Systems needed to be qualified to environmental conditions, specific for developed severe accident such as very high radiation, high temperature and pressure, exposure from hydrogen burning, flooding etc. Generic approach to qualification use to lead to requirements that are not applicable on corresponding equipment, due to commercial unavailability on the market. Developed methodology of qualification of the equipment, dedicated to severe accident management helped to bridge these obstacles. Compilation of the overall mitigation strategy represented a task which was consisting of design of particular highly reliable technical means and appropriate procedures dedicated to cope with severe accident challenges, to allow the staff an efficient control of the accident, and to provide them properly reliable technical means for, in expected environmental conditions. This effort, concerned the both, the development of the systems and the application of them at units, had resulted in practical application of 4th level of defence in depth, as full scope extension of the original design basis. 3. APPLIED SOLUTION CONCEPT The need of practical elimination of the possibility of the severe accident occurrence on opened reactor or spent fuel pool led to proposal of supplementary independent systems dedicated to coolant delivery in to points of interests (opened reactor and spent fuel pool), supplementary cooling systems, dry risers and organization measures within Severe Accident Management Guidelines framework. All these measures were assessed from reliability and disposability point of view. Taking in to account mainly these criteria they were further developed in detail design level. The matter of severe accidents management and control at the power states of the plant had shown more difficult. Too demanding requirements, which come from expected environmental loading conditions for the equipment located inside of the containment caused, that survivability and reliability of such equipment, without any regard on its possible qualification could not be assured during the all expected period of the accident (at least one year). The solution of the issue led to final formulation of mitigation strategy, development of qualification methodology for equipment
dedicated to operate in severe accident conditions and to dividing of accident management in to a few separate stages. 3.1. Mitigation strategy Following are the basics of the severe accident control strategy, developed on the basis of existing and newly added systems. To depressurize the primary circuit via independent, highly reliable and appropriately capable system in order to prevent scenarios characterized by the high pressure inside the primary circuit, typically resulting in the high pressure corium discharge into the reactor pit; To acquire sufficient sources of coolant to flood the reactor pit in order to take over the control of severe accident; To install supplementary external sources of the coolant to prevent transition of any accident to the severe fuel damage; to quench and cool down the core and/or; to decrease pressure inside of the containment and; to increase coolant amount inside of the containment. To flood the reactor pit, to prevent permanent coolant losses and to provide access for the coolant to reactor pressure vessel; To retain degraded core inside of reactor pressure vessel and to set up sufficient heat sing from the core through reactor pressure vessel wall (In Vessel Retention); To manage hydrogen control inside of the containment, via recombination and ignition of the hydrogen and other combustibles and inertisation of the atmosphere to prevent fast flame propagation in case of burning and to prevent detonation; To set up sufficient heat sink from the containment and to assure appropriate tightness of the containment hermetical boundary; To install the system which would prevent possible dangerous underpressure inside of the containment during particular accident regimes; To assure appropriate measurement of necessary parameters required for the proper decision making process. 3.2. Methodology of qualification of the equipment for Severe Accidents Difficulties experienced during a selection of the equipment capable enough to operate inside the containment in severe accident conditions, for generally defined period of the time of the accident lasting, insufficient commercial availability of such equipment and frequent questions of the designers led developing team to release qualification methodology [8]. The methodology addresses and summarizes procedures to quantify requirements for the equipment dedicated to operate in severe accidents conditions. It simultaneously provides designer, how to proceed in selection of particular equipment. This methodology distinguishes between really required active mission time of the particular system (equipment) and its passive part (passive mission time), in which it is necessary to maintain the system operable in the standby mode. The overall required mission time is by this manner significantly reduced, resulting in significant reduction of the total absorbed radiation dose and the heat and pressure exposition. This approach is based on the fact, that once the intended safety function of the particular equipment or system is completed the operability of this system is not required anymore. Therefore, the real mission time requirement can be derived from the time frame in which the execution of required action can be assumed effective and reliable. This approach is furthermore supported by the fact that if the relevant action is executed over such timeframe, it may miss their purpose (e.g. delayed primary depressurization leads to primary break) and may lead to the overall strategy failure. 3
IAEA-CN-86 [Right hand page running head is the paper number in Times New Roman 8 point bold capitals, centred] The methodology requires take in to account the particular place of installation of the equipment (from which the environmental loading conditions are derived) and the affiliation of the equipment to the mitigation system (what respond the question of needed mission time). The methodology then instructs designer directly qualify the equipment if possible. If it is not, the methodology comprehensively instructs designer how to relocate the equipment on a less exposed place of installation and what are dependencies of such relocation, accompanied with. If neither this option is applicable, designer is instructed how to protect the equipment and how to handle with high radiation exposure and hydrogen burning effects. The approach and description of the methodology will be included also in the TECDOC ([11]) which is in preparation phase. 3.3. Separation of accident management in to stages In order to allow better understanding of real needs of mission times of systems dedicated to severe accident management and control, the accident management process was divided in to a few stages of the accident management. Mentioned dividing which describes expected use of mitigation systems is demonstrated on following figure (Fig. 1.): Fig. 1. Separation of the Severe Accident in to Stages 4. SAFETY DEMONSTRATION OF PROPOSED MEASURES Following implementation of the technical resources in to the plants, this new abilities have been incorporated into the Severe Accident Mitigation Guidelines (SAMG). The real characteristics of systems, their intended application within the SAMGs including were used for integral assessment of their impact and contribution to the enhancement of safety of enhanced units. It included the comprehensive check of the Severe Accident Mitigation Guidelines (SAMG) [9], simulating evolution of diverse severe accident scenarios, including desired operation of mitigation systems. Also it was checked whether the operating personal is able to identify transition to severe accident, based on available information and whether it is able to mitigate sufficiently the severe accident consequences. The probabilistic safety assessment level 2 was used for selection of scenarios included into the verification scope. The severe accident management and control represents a process of decision making being carried out in very specific conditions, limited scope of information, high psychological stress, limited access
to the most systems inside of the plant and limited possibility of the manual check of corresponding equipment e.g. in case of monitoring lost its monitoring. Moreover, for certain crucial manipulations the limited timeframes exist. That is why the validation process of the both SAMGs and dedicated mitigation systems has also to prove, that it is reasonable to assume, that operating personal gets sufficient information and is provided sufficient time to execute desired manipulations. The verification and validation of SAMGs consisted of assessment of simulated response of operating personal using analyses of the scenarios, operating and emergency procedures and considering estimated response times and decision making delays. Consequently, decision making processes was analysed and assessed to judge its feasibility. Deterministic analyses used for this process (integral simulations of variations of diverse scenarios of severe accidents) took in to account estimated, verified and postulated delays in decision making trees gained during previous stage of the assessment. Consequently, the efficiency of the systems was evaluated. 5. CONCLUSION Extension of the design basis of existing Slovak units to severe accidents was long and a complicated way, which has been passed by Slovak nuclear operator and all supporting companies and teams. It was truly iterative process, based on very large analytical basis, putting together views, knowledge and effort of large number of diverse experts, resulting in installation of additional systems and completed by development and introduction of effective SAMGs. The final integral evaluation of the effort and state of the units regarding satisfaction of both legal and functional requirements (completed recently) stated, that all goals of the upgrade of units have been reached and that units satisfy safety requirements, relevant even for newly built reactors. VUJE expert team was participating intensively for the entire duration of the activities and proved its capability to deal with complex and complicated tasks. REFERENCES [1] CVAN, M., PHARE 4.2.7.a Task 6 Code and Model Qualification Report, rev. 2, internal report, VUJE, Trnava, 1997. [2] ROHAR, M., LOCAs to Qualify MAAP Mass and Energy Release Curves during Blowdown Phase rev.3, internal report, VUJE, Trnava, 1996. [3] PRIOR, B., Analysis of BOBA and Severe Accidents without Operator Actions, internal report, Westinghouse Energy Systems Europe SA, 1997. [4] CVAN, M., PHARE 4.2.7.a Task 8/9 Summary Report, rev. 3, internal report, VUJE, Trnava, 1997. [5] PRIOR, B., PHARE Project 4.2.7.a /93: VVER-440/213 Beyond Design Basis Analysis and Accident Management Final Report and Project Summary, internal report, Westinghouse Energy Systems Europe SA, 1998. [6] CVAN, M. at all, Súhrnná záverečná správa projektu UTR 9075, internal report, VUJE, Trnava, 2003. [7] CVAN, M. at all, Návrh patrení a modifikácií projektu pre riadenie ťažkýkch havárií, internal report, VUJE, Trnava, 2004. [8] BALÁŽ, J. at all, Určenie parametrov prostredia v miestnostiach a priestoroch pre zariadenia SAM 3. a 4. blok JE EBO, internal report, VUJE, 2013. [9] STOJKA, T. at all, 8SG/0004 Validation of Severe accident management guidelines - SAMG, internal report, VUJE, 2014. [10] JANČOVIČ J. at all, Hlavná správa projektu Vypracovanie komplexného deterministického zhodnotenia Projektu implementácie SAM - Riadenie ťažkých havárií, internal report, VUJE, 2013. [11] DUCHÁČ, A. at all, Assessment of equipment capability to perform reliably under severe accident conditions, TECDOC, IAEA, in preparation. 5