FULL POWER AND SHUTDOWN LEVEL 2 PSA STUDY FOR UNIT 1 OF J. BOHUNICE V1 NPP by

RELKO Ltd. Engineering and Consulting ServicesRELKO Ltd. Engineering and Consulting Services

1/54

International Workshop on Level 2 PSA and Severe Accident Management, 29-31.3.2004 Koln, Germany

FULL POWER AND SHUTDOWN LEVEL 2 PSA STUDY FOR UNIT 1

OF J. BOHUNICE V1 NPP

by

Zoltan Kovacs and Helena NovakovaRELKO Ltd, Engineering and Consulting Services

Bratislava, Slovak Republic


2/54


CONTENTS

Introduction and overview of the Level 2 PSA methodology

Description of the Confinement

The interface between the level 1 and 2 PSA

Description of the accident progression analyses

Evaluation of the confinement failure modes and construction of the confinement event trees

Definition of release categories

Discussion of the source term analysis

The results and sensitivity studies

Conclusions


3/54


INTRODUCTION

Within the gradual reconstruction of J. Bohunice V1 NPP the upgrading of the confinement was performed and new accident localisation system was installed.

The level 2 PSA (for full power, low power and shutdown operating modes) was developed with the following objectives:

to identify the ways in which radioactive releases from the plant can occur following the core damage,

to calculate the magnitudes and frequency of the release, to provide insights into the plant behaviour during a severe accident, to provide a framework for understanding containment failure modes, the impact

of the phenomena that could occur during and following core damage and have the potential to challenge the integrity of the confinement,

to support the severe accident management and development of SAMGs.


4/54


INTRODUCTION

The level 2 PSA model of the J. Bohunice V1 NPP was developed in the RISK SPECTRUM Professional code.

This model calculates the frequency of the individual release categories generating minimal cut sets which involve the initiating event of the accident, component failures and human errors.

The magnitudes of release categories are calculated using: the MAAP4/VVER for reactor operation and shutdown mode with closed reactor vessel and the MELCOR code for shutdown mode with open reactor vessel.

Although the level 1 PSA mission time is 24 h, the level 2 PSA simulated accident sequences 48 h to provide greater understanding of confinement performance during the later stages of a scenario. So, both the level 2 PSA mission time and the deterministic analyses time are 48 h.


5/54


OVERVIEW OF THE LEVEL 2 PSA METHODOLOGY

Project management:Definition of objectives and scope of level 2 PSA study, project management, team selection and organisation, quality assurance of the project.

Familiarisation with the plant: Familiarisation with the plant and identification of design aspects importance to severe accidents, description of the confinement and accident localisation system of the plant after the safety upgrading.

Interfacing of level 1 and 2 PSA: Development of extended event trees, definition of plant damage states as initiating events for CETs.

Accident progression analyses: Analyses of progression of severe accidents, computer codes used for the analyses, treatment of the accident phenomena, input data, calculation results.


6/54


OVERVIEW OF THE LEVEL 2 PSA METHODOLOGY

Confinement performance analyses: Structural response, confinement bypass and confinement isolation analyses.

Construction of CETs: Construction of confinement event trees, quantification of confinement event tree events, uncertainties in the event probability quantification.

Source term analyses: Definition of release categories (sources terms), grouping of fission products, fission product release calculations, treatment of uncertainties in the estimated source terms.

Quantification of frequencies for release categories: Calculation of frequencies of release categories using the integrated full power and shutdown model developed in RISK SPECTRUM Professional code.

Presentation and interpretation of the results


7/54


OVERVIEW OF THE LEVEL 2 PSA METHODOLOGY -main events of the severe accident

Core Damage

(PDS)In-Vessel Phase

ReactorVessel

Melt-through

Radioactive release

(RC)

Radioactive release

(RC)

Radioactive release

(RC)

Late Ex-Vessel Phase

Radioactive release

(RC)

IntactConfinement


8/54


CONFINEMENT DESCRIPTION


9/54


CONFINEMENT DESCRIPTION - the main issues of the confinement

The confinement leak-tightness The accident localisation system The confinement spray system The confinement isolation The confinement data as input to the deterministic codes Structural analyses of the confinement


10/54


CONFINEMENT DESCRIPTIONLeakage from the confinement: volume % / 24 h

0

100

200

300

400

500

600

1993 1994 1995 1996 1997 1998 1999 2000 2001 Unit1

Unit2

YEAR

Unit 1 Unit 2

YearUnit 1 Unit 2

1990 5039.00 7173.00

1993 403.96 565.00

1994 255.06 291.30

1995 132.00 93.00

1996 86.90 70.68

1997 68.18 51.04

1998 59.58 45.81999 58.16 43,162000 54.56 42.14

2001 48.5 40.77

Leakage from confnem ent

[ % / 24 hours ]


11/54


CONFINEMENT DESCRIPTION

p27kPa

p 30kPa

4xDN800

2xDN2501kPa

p 50kPa

R102

R048

R002

R302 R301

ECCS SS

2xDN510 4xDN510

12 x DN1130

R104

BWST

p15kPa

DN600 DN1200


12/54


THE INTERFACE OF LEVEL 1 AND 2 PSA

Development of the level 2 probabilistic model is started with the construction of the extended event trees (EETs).

This is complementary level 1 modelling before the plant damage state grouping (PDSs).

It allows credit for the core damage recovery. Construction of EET is performed for each core damage sequences of the level 1 PSA model.

The next step is a definition of PDSs and assignment to consequences of the EETs.

Then, the confinement event tree (CET) is developed for each PDS as part of level 2 probabilistic model.

Consequences of the CETs are the release categories. Their frequency represents the results of the level 2 PSA.


13/54



INITIATING EVENTS

LEVEL 1 EVENT TREES

IE1

IE2

IE3

.

.

.

.

.

.

.

.IEN

EXTENDEDLEVEL 1 EVENT TREES

CONFINEMENT EVENT TREES(CET)

RELEASE CATEGORIES(RC)

-Nominal leakage -Scrubber release-Confinement rupture-Basemat melt through-Core damage recovery (CDR) with leakage

OK

CD

OKCDR

123.....


14/54



In same cases the level 1 event trees are changed before starting of EET construction. The reason is in the definition of the event tree top events.

The following example clarifies the problem. Given loss of the primary to secondary side heat removal, failure of the primary bleed and feed (top event in the level 1 event trees) via the pressurizer safety valve leads to the core damage.

The reason of a failure (operator error or hardware failure) is evaluated in the fault tree under the top event. However, different plant damage states occurs if operator fails to initiate bleed or bleed and feed is initiated but the losses are not compensated by at least a HPSI pump.


15/54



Development of the level 2 model of the Bohunice V1 plant was performed using the RISK SPECTRUM PSA Professional code. The level 1 PSA model was developed also in this code.

After an evaluation of the software capabilities for level 2 applications, it was decided to streamline the sequence quantification process by: 1) adding the EET top events directly to the core damage sequences of the level 1 event trees,

2) defining the PDSs as the initiating events of the CETs and 3) assign the release categories to the CET sequences. In principle, this allows the explicit consideration also of all level 1

events in the overall model. The level 2 calculation may therefore be based on the complete plant model without any intermediate results.


16/54



The top events of the extended event trees:confinement isolationHPSILPSIConfinement spray systemOther events


17/54


THE INTERFACE OF LEVEL 1 AND 2 PSA: PDS

The plant damage states (PDS) represent a functional groupings of level 1 core damage sequences.

The criteria for binning the level 1 sequences into the plant damage states are based on the following five characteristics of each sequence: Initiator (Large LOCA, Small LOCA, Transient, Confinement bypass)Time to core melt (early < 1 h, late > 1 h)ECCS status (A - water injected into the RPV or reactor cavity, core damage

recovery possible, D - no water injected)Confinement spray system (Y - available, N -unavailable)Confinement status (I - isolated, A - not isolated, B - bypassed)Example of PDS: TLDNI - transient, late CD, no CD recovery, no spray

system, confinement isolated


18/54


ACCIDENT PROGRESSION ANALYSES

The J. Bohunice V1 level 2 PSA is accomplished by coupling a probabilistic model of the confinement response to the postulated initiating events with a deterministic physical model to examine the plant response.

This process also incorporates the evaluation of the impact of the phenomenological uncertainties.

The probabilistic model is embodied in EETs and CETs developed in the RISK SPECTRUM PSA code. The plant physical model is defined in the MAAP4/VVER and MELCOR parameter files (more detailed description is in presentation of Mr. M. Cvan from VUJE).


19/54


ACCIDENT PROGRESSION ANALYSES

• The deterministic codes provide information required to perform the calculations of the plant specific fission product transport and thermal hydraulic response to the postulated accident sequences.

• They are also used to study the sensitivity of the source term to the phenomenological uncertainties.

• The source term analysis used a default values for the model parameters. The sensitivity analysis identifies any variations from this approach.

• The deterministic analyses are supplemented with the phenomenological evaluation summaries to provide a complete physical representation of the plant.


20/54


CONFINEMENT FAILURE MODES

• Phenomenological evaluations have been performed in support of the plant level 2 PSA project to determine the likelihood of all postulated confinement failure modes and mechanisms.• These evaluations were performed systematically to address the controlling physical processes or events specific to the plant configuration. The confinement failure modes of the plant considered unlikely are: over-pressure, direct confinement heating, steam explosions, thermal attack of the confinement penetrations, vessel thrust forces and melt through the induced failure of the reactor cavity floor. • Failure modes more likely to occur are: hydrogen combustion, confinement isolation failure, and confinement bypass.


21/54


CONFINEMENT FAILURE MODES - Cofinement structural analyses

• A plant specific structural analysis of the J. Bohunice V1 confinement (SG compartment) has been performed to determine the ultimate internal temperature and pressure capacity and the most likely failure locations for BDBA (break of the cold leg of a RCS loop with double ended discharge of primary coolant; no ECCS and no spray system is considered).

• The BDBA present the maximum temperature and pressure load for the confinement. For all initiators within the DBA lower values of these parameters were calculated by the MAAP4/VVER code.


22/54



- Temperature loading:The temperature in the hermetic zone did not increase during the LOCA 160°C in accordance to MAAP4/VVER analysis.

The effect of this temperature on the confinement integrity is minimal during the accident.

The results of analyses of the concrete structures under the accident temperature loads present that the structure resistance is sufficient for the BDBA loads condition.


23/54



- Pressure loading:The structural analysis carried out for BDBA under the high internal over-pressure corresponding to the mean strengths and non-linearity behaviour of the concrete structures.

The evaluation of the structural integrity was performed for the critical places, which were defined from the previous non-linear analysis for various loads of BDBA and DBA.The non-linear analysis takes into account the concrete cracking and crushing, layered approximation of the shell elements with various material properties, etc.

The maximum pressure in the confinement in case of large LOCA is 223 kPa. Probability of loss of confinement integrity for this pressure is less than 0.0001.


24/54


CONFINEMENT FAILURE MODES -unlikely failure modes

Direct confinement heating (DCH) is the process of directly heating the confinement atmosphere by the molten core debris should it be hydro-dynamically forced out of the reactor cavity due to the primary system blowdown. A phenomenological evaluation was performed to examine the likelihood of the plant confinement failure due to DCH. The evaluation excluded this event.

Thermal attack of confinement penetrations. The mechanical and electrical penetrations or seals are not susceptible to thermal degradation due to the confinement gas temperatures. Those penetrations can withstand the confinement temperatures up to and beyond 500 C. However, such elevated temperatures are not predicted for the confinement for sustained periods of time.

Ex-vessel steam explosion. Unlikely event because the reactor cavity is dry.


25/54


CONFINEMENT FAILURE MODES - unlikely failure modes

Vessel thrust force: The maximum jet thrust force could not lift the vessel and its internals, even without considering the ability of the vessel support structure to withstand the thrust load.

If the coolant loop piping and shield wall are considered, a much larger

force would be required to dislodge the reactor vessel. Even if the vessel could shirt, the confinement is configured in such a manner that the reaction forces cannot be transmitted to the confinement wall.

Therefore, this postulated failure mode is prevented by the plant design.


26/54


CONFINEMENT FAILURE MODES - unlikely failure modes

Confinement failure by melt through: If the basemat melt through occurs, the atmospheric release will be limited to that resulting from the design-basis leakage and a filtered release of radionuclides through the soil.

Because of the presence of the water on the confinement floor, it was our judgement that this event is precluded. However, if all water pathways are plugged, a melt through could eventually occur after tens of hours. A probability of 10- 4 with an error factor of 10 was assigned to this event for all PDS and sequences on the basis of engineering judgement. Later it was removed from the CETs because the risk associated with this event would not affect the total risk.


27/54


CONFINEMENT FAILURE MODES - Hydrogen detonation (considered event)

From the analyses it was considered that the main contributor to the failure of the confinement is from the ignition of the combustible gas mixtures.

A best-estimate assessment of the in-vessel and ex-vessel hydrogen production is possible using the MAAP4/VVER code. The code calculates the hydrogen, oxygen and steam inventory in the confinement and identifies the time periods when the hydrogen is combustible or invent.

The potential confinement pressurization resulting from the hydrogen combustion is bounded by the calculating the adiabatic isochoric complete combustion (AICC) of this assumed hydrogen inventory. It is hand calculated on the basis of the outputs from the MAAP4/VVER code.


28/54


CONFINEMENT FAILURE MODES - Hydrogen detonation (considered event)

• The analyses identified three phases of possible hydrogen burn: before the reactor vessel failure, at the reactor vessel failure and after the reactor vessel failure.• However, hydrogen detonation is precluded if the confinementis not isolated. • In the level 2 PSA of western plants the likelihood of hydrogen detonation is set 0 for PDS with the confinement spray system fails to operate for reduce the steam concentrations.However, for the J. Bohunice V1 plant the MAAP4/VVER analyses have shown that the hydrogen detonation is possiblealso if the spray system fails to operate. • This hydrogen detonation concentration existsin the BWST which is part of the confinement boundary (the steam is condensated but the hydrogen is accumulated above thewater level). In other areas of the confinement (in the SG boxes) the hydrogen detonation is not possible if the spray system fails to operate.


29/54


CONFINEMENT FAILURE MODES - Confinement isolation failure (considered event)

The confinement isolation system is designed to preserve the ability of the confinement boundary to prevent or limit the escape of fission products that may result from postulated accidents.

In the event of a possible radiation release from the confinement through the process lines, the confinement isolation system automatically isolates all lines penetrating the confinement which do not serve an accident mitigating function.

For the Bohunice V1 plant the confinement ventilation system and the BWST blowdown line must be isolated in case of the accident. Fault tree was developed and involved into the level 2 PSA model.


30/54


CONFINEMENT FAILURE MODES - Confinement bypass (considered event)

Confinement bypass is considered as an accident initiator that can lead to the core damage because the loss of cooling fluid to a location outside the confinement disables the ECCS for long-term core cooling.

The most likely mechanisms for this failure mode, identified for the plant as being significant in terms of the potential consequences, are SG collector rupture (SGTM), SG tube rupture (SGTR) or interfacing LOCA.

Note, however, that the SGTM sequences during the full power operation contribute about 36% to the total core damage frequency. Contribution to the full power core damage frequency from SGTR is 3.4% and from interfacing LOCA is less than 1%. These initiators are not dominant from the risk point of view during the reactor shutdown.


31/54


CETs

The general guidelines used for the development of the CETs are summarised below:- the initiating event of a CET is a PDS,- the CET top events and structure provide the details necessary to characterise the fission product source term releases,- the CET considers factors which dominate the confinement response; thus, the top events consider broad categories of the confinement behaviour,- the CET considers early confinement failure timing (i.e., confinement failure at or shortly after vessel failure) and late confinement failure; the results indicate significant impact from early and late hydrogen detonation.


32/54


CETs - Main assumptions

The following main assumptions are used in the CET construction:

.For core damage recovery only the HPSI and LPSI pumps of unit 1 are considered; HPSI pumps of unit 2 are not taken into consideration due to the limited water sources; external water sources are also not considered for this purpose.

It is possibility to supply the RCS also by the spray system pumps. However, using a spray system pump for the core damage recovery is not considered in the model because these pumps must perform other safety functions.

If the core damage recovery for PDS with early CD is not performed before the vessel failure, recovery after the vessel failure is considered not to be possible.

.After successful core damage recovery no hydrogen detonation is considered.


33/54


CET: Large LOCA, early core damage, ECCS available, spray system available, confinement isolated

CET1A @SS(S&C)00 ECDR-1A EHD LHD

Confinement event tree 1 - LEAYI-A

CONFINEMENT SPRAY AND COOLING OF THE TANK AVAILABLE

Core damage recovery before reactor vessel failure

Hydrogen detonation at reactor vessel failure

Hydrogen detonation after reactor vessel failure

No. 1

2

3

4

5

6

7

Conseq. NR

RC1

RC4.2

RC3

RC2

RC4.2

RC3

2

1

2

1

2

1

2

1


34/54


RELEASE CATEGORIES

Four general classes of the containment-failure modes were involved into the RC:

Isolation failure Hydrogen detonationDesign leakageConfinement bypass (SGTM, SGTR, interfacing LOCA)

These general classes represent different source term magnitudes because they represent different leakage rates: leakage via not isolated piping, gross structural failure, low gradual release via confinement normal leakage and confinement bypass with different rates.


35/54


RELEASE CATEGORIES - leakage rate

The blow-off line of 1 200 mm diameter (installed from the borated water storage tank to the reactor hall) is the most dominant leakage path, if it is not isolated.

Hydrogen detonation in the confinement is defined as increased leakage with gross structural failure leading to a puff release of radionuclides followed by leakage through an open path to the environment.

The design leakage involves releases via COFs and normal leakage of the confinement (the leakage rate is 48 volume percent per day).

The confinement bypass occurs after SGTM, SGTR and interfacing LOCA


36/54


RELEASE CATEGORIES

In addition, the following issues were integrated into the RCs:Release mechanism (core overheating, in-vessel and ex-vessel core

damage recovery)Effects of the spray system operationTime to core damage and time to vessel failureTime to confinement failurePlant operating modes


37/54


RELEASE CATEGORIES - times to core damage and vessel failure

Initiating event PDS Time to core damage [h]

Time to vessel failure[h]

LOCA 500 mm LEAYI, LEDNI, LEDNN,LEDYN, LEDYI

0.22 1.80

LOCA 100 mm SEAYI, SEDNI, SEDNN,SEDYN, SEDYI

0.45 3.00

LOCA 32 mm SLAYI, SLDNI, SLDNN,SLDYN, SLDYI

2.18 5.18

Loss of secondaryheat removal, nobleed and feed

TLAYI, TLDNI, TLDNN,TLDYN, TLDYI

4.20 6.00

Loss of RHR, openreactor vessel

TLDNN, TLDYNSLDNN, SLDYN

6.90 21.50


38/54


RELEASE CATEGORIES

NR - no release RC0.1 - confinement survives with spray, in-vessel core damage recovery RC0.2 - confinement survives with spray, ex-vessel core damage recovery RC1 - confinement survives with spray, no core damage recovery RC2 - confinement survives with spray, no core damage recovery RC3 - early confinement failure at vessel failure RC4.1 - late confinement failure at vessel failure RC4.2 - late confinement failure after vessel failure RC5.1 - confinement isolation failure with spray, reactor vessel closed RC5.2 - confinement isolation failure with spray, reactor vessel open RC6.1 - confinement isolation failure without spray, reactor vessel closed RC6.2 - confinement isolation failure without spray, reactor vessel open


39/54


RELEASE CATEGORIES

RC7.1 - confinement bypass after SGTM, steam dump station to the atmosphere re-closed

RC7.2 - confinement bypass after SGTM, steam dump station to the atmosphere fails to re-close

RC8.1 - confinement bypass after SGTR, steam dump station to the atmosphere re-closed

RC8.2 - confinement bypass after SGTR, steam dump station to the atmosphere fails to re-close

RC9 - confinement bypass after interfacing LOCA


40/54


SOURCE TERMS CHARACTERISATION

The purpose of the source term analysis is to quantitatively describe the magnitude and composition of radionuclide releases to the environment resulting from the core damage accidents.

Before the source term calculations were actually performed, the sequences with similar source term characteristics were grouped into the release categories to reduce the total number of the sequences to be analysed.

Source term quantification was then performed by the analysing a single, representative accident sequence for each release category by the MAAP4/ VVER code resp. MELCOR code.


41/54


SOURCE TERMS CHARACTERISATION - sequence selection

A representative systemic sequence for each release category was selected for the source term analysis.

The analysed sequence was chosen because it had the highest frequency of occurrence of any sequence within the release category or because it was expected to bound all other sequences of these category.

Selection of a sequence other than that with the highest frequency occurred when that sequence could result in earlier core damage and vessel failure or it was not a full power sequence. To be conservative, always a full power sequence is selected for the plant operating modes with the closed reactor vessel.


42/54


RESULTS - power operation - conditional probabilities of RC

Releasecategory

Frequency Definition Conditionalprobability

RC7.1 8.39E-06 Confinement bypass after SGTM, > 10% volatiles released 0.30RC4.1 6.05E-06 Late confinement failure at vessel failure, > 10% volatiles released 0.22NR 6.03E-06 Success, no confinement failure within 48 h, < 0.1% volatiles

released0.22

RC2 1.38E-06 Confinement survives with sprays, > 10% volatiles released 0.05RC6.1 1.36E-06 Confinement isolation failure without spray, > 10% volatiles

released0.05

RC3 1.15E-06 Early confinement failure at vessel failure, > 10% volatilesreleased

0.04

RC8.1 9.59E-07 Confinement bypass after SGTR, > 10% volatiles released 0.04RC0.2 6.61E-07 Confinement survives without spray, late core damage recovery,

1% volatiles released0.03

RC9 2.73E-07 Confinement bypass after interfacing LOCA, > 10% volatilesreleased

0.01

RC4.2 1.46E-07 Late confinement failure after vessel failure, > 10% volatilesreleased

0.01

RC5.1 1.15E-07 Confinement isolation failure with spray, 4 volatiles released 0.01RC0.1 6.78E-09 Confinement survives with spray, early core damage recovery,

< 1% volatiles released0

RC1 8.65E-11 Confinement survives with spray, 5% volatiles released 0RC8.2 7.42E-11 Confinement bypass after SGTR, stuck open steam dump station

to the atmosphere, > 10% volatiles released0

RC7.2 1.24E-11 Confinement bypass after SGTM, stuck open steam dump stationto the atmosphere, > 10% volatiles released

0


43/54


RESULTS - power operation - LERF

The large early release frequency is calculated from the release categories, where more than 10% volatiles is released and the release is initiated within 2 h after initiating events. So, the large early release frequency (LERF) is given as a sum of the following frequencies:

LERF = RC3 + RC5.1 + RC6.1 + RC7.1 + RC7.2 + RC8.1 + RC8.2 + RC9 = 1.22E-5/y

Conditional probability of large early release given core damage is 0.44.


44/54


RESULTS - shutdown

POS/RC NR RC0.1 RC0.2 RC1 RC2 RC3 RC4.1 RC4.2POS1 - 8.56E-12 1.95E-09 2.38E-13 1.41E-09 2.09E-09 1.71E-08 2.29E-10POS2 - - 1.15E-09 6.76E-13 9.89E-10 - 1.04E-08 2.41E-11POS3 - - - - - - - -POS4 - - - - - - - -POS5L - - - - - - - -POS5S - - - - - - - -POS6 - - - - - - - -POS7 - - - - - - - -POS8 - - 3.91E-08 1.26E-12 1.57E-09 - 3.52E-07 7.36E-10POS9 - 2.20E-11 3.70E-09 3.19E-13 2.72E-09 4.13E-09 3.27E-08 4.59E-10POS10 6.10E-08 6.68E-11 2.79E-08 1.62E-12 7.48E-09 1.26E-08 2.54E-07 1.78E-09SHUTDOWN Total

6.10E-08 1.76E-10 7.32E-08 4.03E-12 1.42E-08 1.88E-08 6.66E-07 3.23E-09

POS/RC RC5.1 RC5.2 RC6.1 RC6.2 RC7.1 RC7.2 RC8.1 RC8.2 RC9POS1 6.03E-11 - 6.37E-10 - 1.90E-08 2.78E-14 1.60E-09 1.72E-13 5.66E-10POS2 3.08E-11 - 4.66E-10 - 1.38E-08 2.03E-14 1.08E-09 1.26E-13 3.78E-10POS3 3.45E-06 - 2.86E-07 - - - - - -POS4 - 1.17E-05 - 5.77E-06 - - - - -POS5L - - - 1.31E-06 - - - - -POS5S - 1.36E-06 - 2.80E-06 - - - - -POS6 - 1.57E-05 - 6.76E-06 - - - - -POS7 6.91E-06 - 5.52E-07 - - - - - -POS8 1.27E-09 - 9.29E-10 - 2.13E-08 3.11E-14 1.89E-09 1.92E-13 5.92E-10POS9 1.42E-10 - 2.82E-09 - 3.60E-08 5.22E-14 3.16E-09 3.22E-13 1.08E-09POS10 6.32E-10 - 1.16E-08 - 9.55E-08 1.38E-13 9.51E-09 8.68E-13 2.35E-09SHUTDOWN Total

1.04E-05 2.88E-05 8.54E-07 1.67E-05 1.86E-07 2.66E-13 1.72E-08 1.68E-12 3.73E-09


45/54


RESULTS - shutdown - LERF

So, the large early release frequency (LERF) is given as a sum of the following frequencies:

LERF = RC3 + RC5.1 + RC6.1 + RC7.1 + RC7.2 + RC8.1 + RC8.2 + RC9 = 1.15E-5/y

Conditional probability of large early release given core damage is 0.21.


46/54


Sensitivity analyses

Sensitivity analyses were performed to address the factors which can have impact on the release category frequency and magnitude. Sensitivity analyses were also performed to address the questions concerning equipment operation during a severe accident.

The factors: - Large confinement bypass (recovery action) - Hydrogen recombiners After implementation of changes the large early release frequency will be

3.75E-6/y for power operation. No impact of changes on the shutdown risk, due to the high CDF

(symptom based procedures have to be implemented)


47/54


Sensitivity analyses -equipment survivability inside confinement

After reviewing the environmental parameters of a severe accident and the critical components located inside the confinement, it is concluded that the issues associated with the equipment operability inside the confinement are: aerosol accumulation on the spray nozzles and high temperature, plugging and radiation.

The engineered safety features are expected to survive the pressure, temperature, radiation, debris and steam conditions expected during a severe accident. This evaluation covers critical equipment located inside the confinement and the safety equipment building.


48/54


Sensitivity analyses -equipment survivability outside confinement

If the HPSI, LPSI pumps and confinement spray pumps are not lost in a severe accident, then the critical components of these pumps can be adequately cooled and maintain operability in the recirculation mode.

This conclusion is based on a review of the BWST water temperature, temperature of critical pump components and the pump motor cooling.

In addition, a review of environmental qualification results of the pump power cables indicated that these cables will remain operable at the elevated room temperature. A pump room equipment inventory survey shows that there is no other heat sensitive equipment inside the room.


49/54


CONCLUSIONS

For the full power operation it can be concluded that:

The results indicate that, given core damage, there is an 25% probability that the confinement will successfully maintain its integrity and prevent an uncontrolled fission product release. After the implementation of the recovery actions for SGTM and installation of hydrogen recombiners in the confinement this probability will be increased to 74%. For comparison: a western PWR plant has the probability of 84%.

The most likely mode of release from the confinement is a confinement bypass after SGTM with conditional probability of 30%. Late confinement failure (after 6 h) at the vessel failure, with a conditional probability of 22%, is the next most likely mode of the fission product release. Finally, the confinement survives with the spray is expected to occur with a conditional probability of 5% per core damage event. The conditional probability for the confinement isolation failure probability without spray is 5%, for early confinement failure at the vessel failure is 4%, for other categories 1% or less.


50/54


CONCLUSIONS

.The overall conditional confinement failure probability of 75% by the proposed modifications can be decreased to 26%. For a western plant this value is 16%.

The results of the level 2 PSA indicate that there are vulnerabilities in the area of the protection against hydrogen detonation. It requires immediate attention to improve the plant risk profile. In addition, attention must be paid to development of SAMGs in coincidence with the conclusions of this study.

Vulnerability screening was performed based on the screening criteria provided for US plants in “Criteria for Selecting Important Severe Accident Sequences”. The criteria states as follows: “Any functional sequence that has a core damage frequency greater than or equal to 1.0E-6 per year and that leads to containment failure which results in a radioactive release magnitude greater than or equal to PWR-4 release category of WASH-1400”. The PWR-4 release category was estimated as 10% of the volatile fission products. For the full power operation two such release sequences exits for category RC4.1, one sequence for RC6.1 and one sequence for RC7.1. However, the proposed modifications will remove the sequences from the list of the important sequences in case of RC4.1 and RC7.1.


51/54


CONCLUSIONS

For the shutdown operating modes it can be concluded that:

The shutdown risk is high for the open reactor vessel and open confinement. The reason is the high core damage frequency in the shutdown operating modes. After implementation of the recommended shutdown symptom-based emergency procedures significant decrease of the shutdown risk is possible.

Installation of filtered venting system in the reactor hall with long term operation could significantly decrease the release magnitudes during the shutdown operating modes.

.Important severe accident sequences based on the above mentioned definition exists for release categories: RC5.1, RC5.2 and RC6.2.


52/54


CONCLUSIONS

A number of features were identified through the course of the level 2 PSA which contribute to the performance of the confinement:

The most important feature of the confinement with respect to the fission product retention is its ability to remain intact in case of the steam over-pressurisation. This construction allows natural deposition mechanisms to remove the airborne fission products from the confinement atmosphere, and provides adequate time for the additional accident mitigation activities to be implemented.

.Installation of hydrogen recombiners are extremely important for the severe accident conditions. The confinement can not withstand hydrogen detonation.

.The inability to get the water into the reactor cavity prevents the external cooling of the intact reactor vessel.

The absence of any penetration in the lower vessel head coupled with the natural circulation in the primary system during a high pressure core melt is expected to induce creep rupture failure in the hot leg pipe prior to the vessel failure.


53/54


CONCLUSIONS

.Depressurization of the primary system prior to the vessel failure, as a result of the creep rupture failure of a hot leg pipe, should preclude concerns about the high pressure severe accident phenomena (i.e., ex-vessel steam explosion, direct confinement heating and vessel thrust forces).

Retention of the core debris in a dry cavity may induce MCCI melt through the cavity floor if the core debris cannot be cooled by the water.

Injecting water through the failed reactor vessel, in an attempt to cool the core debris in the cavity, is advisable and it does not depend on the status of the confinement cooling. Injecting water into a cavity filled with the hot core debris results in the formation of the hot steam. If the confinement cooling is available this steam is condensed. If no confinement cooling is available steaming from the cavity can eventually over-pressurise the confinement but the COFs prevent the confinement failure. The radiological release consequences of inducing a COF opening are expected to be lower than those associated with MCCI failure of the cavity floor.


54/54


CONCLUSIONS

Steam inerting of the confinement during a severe accident can not prevent hydrogen detonation in the BWST.

The insights gained through the analysis of the severe accident progression and the detailed study of the related phenomena has provided a detailed understanding of the plant behaviour under the severe accident conditions. The knowledge developed can form the basis for the future developments of SAMGs.

Documents

FULL POWER AND SHUTDOWN LEVEL 2 PSA STUDY FOR UNIT 1 OF J. BOHUNICE V1 NPP by