Main Aspects And Results Of Level 2 PSA For KNPP WWER-1000/B320

Transcription

1 Proceedings of the 0 th International Conference on Nuclear Option in Countries with Small and Medium Electricity Grids Zadar, Croatia, -4 June 04 Paper No. 46 Main Aspects And Results Of Level PSA For KNPP WWER-000/B30 Kaliopa Mancheva, Kiril Tzenkov, Evgeni Borisov Risk Engineering Ltd 0 Vihren Street, Sofia, Bulgaria Kaliopa.Mancheva@riskeng.bg, Kiril.Tzenkov@ riskeng.bg, Evgeni. Borisov@riskeng.bg ABSTRACT The PSA Level for Kozloduy NPP (KNPP) is an update of a previous study with wider scope of analysis. The previous study represented the status of the units up to 00. The current PSA Level is based on the PSA Level and represents the status of the units up to 007 year concerning the systems and procedures included in PSA level and status up to 0 for the systems and procedures (e.g. SAMG) related to containment and severe accident aspects. The study is performed after the PSA level has been finished and approved by the customer. Compare to the older analysis all modes of operation for analyzed in PSA level event groups as well Spent Fuel Pool accidents are investigated. The analysis consists of both deterministic and probabilistic analysis. As part of deterministic analysis a contemporary containment strength analysis and accident progression deterministic analysis using the last version of MELCOR are performed. The probabilistic analysis contains of two parts: Interface PSA and CET are calculated using Riskspectrum program code. Two types of models for CET have been developed: one for conditional probabilities calculations and a set of simplified CET s for each PDS group for integral model. The purpose of the first model is to be able to perform quick calculations and for sensitivity analyses as well. The simplified CET s are used for integral calculation of the model. Source Term analysis is mainly based on the MELCOR analyses results. All characteristics of the releases have been defined, i.e. location, mass, energy of radionuclide groups and activity of the released isotopes (most important are reported only). The main goals of the study are to analyze the status of the containment, systems designed to prevent containment failure and operator action required under the severe accident and to give quantitative assessment of the risk parameter LERF (Large Early Release Frequency). This report will present main results, finding and conclusions of the analysis. Based on the results, the effectiveness of the current means and SAMG are assessed qualitatively. INTRODUCTION Units 5 and 6 of Kozloduy are of VVER-000/B30 type of reactors. These are pressurized light water reactors with four loops, horizontal SG and with 3 independent and of 00 % capacity safety systems trains. The PSA Level analysis is partially an update of the currently available PSA L study for Units 5 and 6 of Kozloduy NPP (KNPP) and partially entirely new analysis. The new study includes in addition to the previous one all low power and shutdown modes and Spent Fuel Pool (SFP) analysis. The scope of the new study covers: Internal IE s Internal Flooding; Internal Fires; 46-

2 Seismic Hazard, All power levels and shutdown of the reactor installation and SFP (full power mode is excluded from the analysis of SFP) are analyzed. Moreover, the new study is based on different PSA tools and the latest MELCOR version is used for accident progression analysis. The old study is developed using SAPHIRE for interface part and EVNTRE code for Containment Event Tree analysis. The current study is performed using RiskSpectrum for interface and CET part of the analysis, i.e. the PSA part of the modeling. In this sense, the current study can be treated as an entirely new study. The analysis structure is shown on Figure. The figure pictures the different tasks performed in the study and relations between them. Input Data Analysis Containment Structural model development MELCOR s Models Development (Reactor and SFP) PSA L$L Interface Melcor Calc Containment Structural Analysis System & Human Error Analysis Phenomenon Analysis Containment Event Trees Melcor Clacs Primary Side Structural Analysis Primary Side structural model development Source Term Analysis Melcor Calcs Sensitivity, Uncertainty and Importance Analysis Quantitative Assessment Additional Assessments Conclusions and Insights Recomendations Figure : PSA Level Analysis structure Goals of the study are in compliance with the recommendations given in IAEA SSG-4 document (reference). INTERFACE BETWEEN PSA LEVEL AND LEVEL The interface analysis links PSA L and L models in way that all of the sequences in PSA L are grouped in so called Plant Damage States (PDS), which further are analyzed in CET model. The analysis groups sequences based on their similar characteristics in order CET model can treat particular PDS as one severe accident scenario. This means that the severe accident progression for all of the sequences grouped in one PDS are expected to be identical or similar. Therefore, grouping process is performed using so called attributes or characteristics of the sequences, which are identical or similar for all the sequences in the PDS and are important considering the severe accident progression. For the sequences with no bypass of Containment, the following attributes are used: IE s class Large LOCA, Small Small LOCA, Transient, TBO and ATWS classes are analyzed; Primary Side Pressure at core damage moment: - Pressure is above 0 kgf/cm only make up system can be used; - Between kgf/cm and 0 kgf/cm HPIS can be used; - Bellow kgf/cm LPIS can be used; 46-

3 Containment Status isolated, not isolated or opened; Spray System Status available in recirculation mode or failed; AC Power Supply availability At least out 3 Safety 6 kv Switchgears is available or TBO; ECCS availability out of 3 HPIP or LPIP is available, out of 3 Make-up pumps is available, all systems are failed ; Time to Core damage: - Core damage occurs before -th hour after EP is onset; - Core damage occurs after -th and before 4-th hour after EP is onset; - Core damage occurs after 4-th and before 48-th hour after EP is onset; - Core damage occurs after 48-th hour after EP is onset. For the bypass events the attributes are as follows; IE s Class Medium or Large Break, SGTR and Interface LOCA; SDA status failed in open position or operate in cycling mode; SGSV status failed in open position or operate in cycling mode; Primary Side Pressure Bellow or above SDA (7 kgf/cm ) set point for opening; For Spent fuel Pool, the attributes are similar, although, systems for injection into the SFP are not the same and some of the attributes used for reactor installation are skipped (e.g. pressure at fuel damage moment). The distribution of different major PDS groups for reactor installation and SFP are shown on Figure. RI analysis Figure : PDS distribution SFP analysis 3 ACCIDENT PROGRESSION ANALYSIS MELCOR CALCULATIONS Deterministic part of accident progression analysis has been performed using the last version of MELCOR code, i.e. version.. The results of the analysis are used for containment event tree construction, bases of conditional probabilities assignment for most of the phenomena, quantitative analysis of the source term. Several models are developed to envelope different POS (Plant Operating State) for reactor installation and SFP. The choice of the POS s is done based on the PSA level and respectively PSA L&L interface results. The models that are used consequently in the analysis are: Full power (POS0) model for reactor installation; Cold state (POS06) model for reactor installation; Shutdown state with open reactor (POS08) model for reactor installation; Shutdown state with unloaded reactor (POS0) model for Spent fuel pool. 46-3

4 3. Reactor installation modeling Two different nodalizations have been used simple one for LBLOCA sequences and the detailed one for all others (which includes Small Small LOCA, Transients and ATWS). Generally, the differences between two nodalizations is in the core region, where a number of 30 control volumes (CV) has been used for detailed nodalizations and 5 CV for simplified one. The detailed nodalization gives more sophisticated behavior of internal flows and consequently more realistic simulation of the slow core degradation. The control volume model for Primary Side is represented by volumes in detailed nodalization and by 87 in the simple one. The nodalizations for the current study are shown on Figure 3. 3,7 3,7 CVx03 CVx04 9, CV CV CV035 CV CV050 CV034 CV033 CV03 CV CV00 CV , CV CV CV CV CV070 CV CV07 CV07 CV037 CV047 CV CV06 CV06 CV036 CV046 CV056 CV05 CV05 CV035 CV045 CV055 CV x x09-00 (0-00*) CV CV04 CV04 CV034 CV044 CV054 CV458 CV03 CV03 CV033 CV043 CV053 CV0 CV0 CV03 CV04 CV CV CVx * X=,,3,4 30,8 x0-x03 30,8 x0-x6 x6-x7 x7-x8 x8-x CVx6 CVx7 CVx8 x0-x3 x3-x x4-x5 x5-x CVx3 CVx4 CVx x0-x0 x0-x x-x x-x05 CVx0 CVx CVx 8,0395 7,938 7,938 CVx0 x0-x0 CVx0 x00-x CVx CV458 x08-x ,8 0,5 CVx08 x07-x08 x04-x05 CVx05 x05-x06 CVx ,065 CVx07 x06-x07 0,640 0,5 Simple Nodalization Detailed Nodalization Figure 3: Primary Side Nodalizations For open reactor modes, the nodalization is changed to account for absence of some of the internal structure and reactor cover. Additionally, the connections between different parts of Primary side (SG, Pressurizer and Reactor) and gas removal system are simulated. The nodalization of the model is shown on Figure CV CV8 CV44 x03-8 x FL43-44 CV463 3,7 CVx03 CVx04 3, CV CV40 FL4 CV40 CV CV40 FL CV CV CV035 CV034 CV033 CV03 CV03 CV CV x x09-00 (0-00*) TQn đĺ ěî í ňí î đŕ çőëŕ ćäŕ í ĺ (ďî äŕ âŕ í ĺ í ŕ ňî ďëî í î ńčňĺ ë) CV00 CV0 CVx * X=,,3,4 30, ,938 x0-x03 x0-x CVx6 x0-x3 CVx x0-x0 8,0395 CVx0 x0-x0 CVx0 CVx0 x00-x CVx09 x08-x09 x6-x7 CVx7 x3-x4 CVx4 x0-x CVx,8 CVx08 x07-x08 0, x7-x8 x4-x5 x-x CVx8 CVx5 CVx x04-x05 x8-x05 x5-x05 x-x05 CVx05 x05-x06 CVx06 30, ,938,065 CVx07 x06-x07 0,640 0,5 TQn đĺ ěî í ňí î đŕ çőëŕ ćäŕ í ĺ (î ňâĺ ćäŕ í ĺ í ŕ ňî ďëî í î ńčňĺ ë) CV407 Figure 4: Primary Side Nodalization for open reactor More simplified nodalization is used for the secondary side. Two different nodalizations of secondary side of steam generator have been tested in order to choose the most appropriate, first one with one control volume and second one with three control volumes per SG (riser, downcomer and steam part). The results for 5 different transients showed that the more detailed nodalization slows down calculations significantly, about times, without any significant change in the behavior 46-4

5 of SG model. Therefore, the simple one has been used for all the analyzed scenarios. The two nodalizations are shown on Figure CVx CVx x00-x x00-x0 CVX00 Steam Generators FLX05 Riser CVX00 CVX0 FLX04 X=5,6,7,8 FLX03 Downcomer FLX08 FLX07 Steam Generators CVX0 Figure 5: Secondary Side Nodalizations The containment nodalization is shown on Figure 6. As it is seen from the picture, the so called central hall compartment (which is about m 3 out of m 3 in total) is divided into 0 control volumes on 4 different levels. The idea of the division is to account for possible gas stratification and to account for spray system inability to spray all over the entire central hall volume directly III CV Transport hatch m CV CV CV478 ENVIRONMENT CV CV CV CV467 (n03,08,09,-4) CV CV (n0,0,04, ,0) (n5) (n93,95) (n06,07) (n00) CV465 (n96,97,99) (n7, CV46 ĂŔ50/ n9) ĂŔ504/ CV466 ĂŔ403 ĂŔ504/ ĂŔ507/ (n7,9-4) CV463 ĂŔ603/ ĂŔ304 ĂŔ30(3) ĂŔ3 ĂŔ605 CV464 ĂŔ3 (n8) ĂŔ50/ ĂŔ33 ĂŔ40 ĂŔ503 ĂŔ50 ĂŔ40 ĂŔ504/ ĂŔ504/3 ĂŔ507/ ĂŔ60 ĂŔ603/ ĂŔ603/ ĂŔ604 (n4) (n3,33) (n87) (n34, (n8-86) n37-40) (nn73,88-9) CV CV459 ĂŔ30()***, ĂŔ407/ ĂŔ30()***, ĂŔ407/ ĂŔ506/, ĂŔ606/ ĂŔ506/, ĂŔ606/ CV ĂŔ304** CV460 ĂŔ405/ CV485 CV ĂŔ405/5 ĂŔ405/ ĂŔ30 ĂŔ30() î ň ĐĹŔĘŇÎ ĐŔ ĂŔ405/6 ĂŔ405/ ĂŔ406() ĂŔ405/3 ĂŔ406() ĂŔ505 CV A (n4-8) (n3,33) CV486 ĂŔ CV984 CV987 (n70-7) ENVIROMENT ENVIROMENT (n64-67,69) CV456 ĂŔ ( n3,80,8) ĂŔ ĂŔ304** ĂŔ (n60,6) ĂŔ309/ CV455 ĂŔ (n55,58) ĂŔ307/,,3 ĂŔ35/3 (n59) ĂŔ309/,3, ĂŔ308* ĂŔ (n44,56) ĂŔ35/ ĂŔ35/ ĂŔ308* (n4,47-49) CV45 n46 CV45 CV454 CV453 ĂŔ306/ ĂŔ306/ ĂŔ ĂŔ306/ (n5-8) CV ENVIRONMENT CV985 IV GA m CAV0 I GA m GA308 CAV30 Heavy door GA30 II (n5) n (n57) 3.7 CV450 ĂŔ0 6.9 Containment nodalization Cavities in containment Figure 6: Containment Nodalization The cavities in the lower containment compartments are modeled in a way to account for heavy door, which is between room GA30 and GA30 and to account for possible interaction between metal structure of transport hatch cover and core melt (corium) that will be spread into GA30 and GA308 rooms after heavy door failure. 46-5

6 CORE BYPASS RING CORE RING CORE BYPASS RING CORE RING CORE BYPASS RING3 CORE RING 3 CORE BYPASS CORE BYPASS RING4 CORE RING 4 3. Spent Fuel Pool modeling Spent Fuel Pool for VVER-000 is of high density rack type. In total, a 563 fuel assemblies can be arranged in three partially separated pools or so called sections of the SFP. The spent fuel pool is located in the containment. The model nodalization and SFP rack view are shown on Figure 7. The core model is based on SFP-BWR type and accounts for channel (through the rack flow) part and bypass part (the flows between racks) CV CV09 CV CV 08 CV 080 CV 083 CV 08 CV CV 084 CV CV CV CV CV 070 CV CV 07 CV CV 074 CV 08 CV 077 CV CV CV 060 CV CV 06 CV CV 064 CV CV 067 CV CV CV 050 CV CV 05 CV CV 054 CV CV 057 CV CV CV 040 CV CV 04 CV CV 044 CV CV CV CV CV 030 CV CV CV 035 CV 034 CV CV CV CV0 CV00 Spent fuel pool nodalization Figure 7: Spent Fuel Pool Nodalization 0.7 View of SFP Rack 4 CONTAINMENT STRUCTURAL ANALYSIS The approach of containment structural analysis accounts for contemporary regulatory standards given in [4] [6] and methodical approach given in [3]. Additionally, the results and conclusions given in [7] [9] are accounted in the analysis. Several possible failure modes are studied due to high internal pressure: barrel or o-ring failure in the middle of the cylindrical part; blade failure at the basement part; failure due to hatches or penetration failure; failure due to flying objects. Additionally, two types of pressure behavior are analyzed quasi static pressure increase and dynamic (explosion or detonation) pressure increase. The assessment of the structural integrity of the containment during severe accident is done using finite element analysis of detailed 3D models of containment. Three different models are used. The code SOLVIA is used for the modeling and analyzing the containment ultimate capacity. For the flying object vulnerability analysis an empirical equations are used. The models are shown on Figure 9. All performed analyses with three different model (see Figure 8) in the current study and analytical and experimental results for similar type of constructions, confirms that main failure mode of the construction is failure of the cylindrical containment part in between or around the hatches caused by annular ring strains. Then, the obtained results are in qualitative and quantitative agreement with the contemporary understanding of the containment structure behavior. Main failure mode (the most probable one) is shear (failure) of the cylindrical containment part between hatches and penetrations due to high annular ring strains. Deterministically assessed ultimate capacity for this failure mode is 080 kpa (abs) for unit 5 and 00 kpa (abs) for unit 6. The median value of the absolute containment failure pressure for unit 5 is 430 kpa and 450 kpa for unit 6. On Figure 9 are shown two out of numerous fragility curves for different failure modes. 46-6

7 barrel or o-ring failure model Model blade failure model - Model 3 Figure 8: Structural models Static pressure Dynamic pressure impulse 0. s Figure 9: Fragility curves 5 CONTAINMENT EVENT TREES Generally, there are several approaches for CET or APET development. In this particular study, it was a ToR requirement to be used RiskSpectrum code for entire probabilistic model. This requirement predestines the approach to be used for CET development, i.e. ET/FT approach. Accident progression in reactor installation is divided into three main phases early phase (in-vessel accident progression), middle phase (vessel breach time) and late phase (about 0.5 hours after vessel breach up to the end of the analysis). For SFP accident progression similar phases are defined. The differences is in middle phase, which for SFP covers the period from the melt interaction with SFP concrete structures beginning up to failure of SFP concrete structures and relocation of the melt in the lower containment compartments. All known phenomena were analyzed for their applicability before CET development and only flying object, rocket mode failure and corium re-criticality were found as inapplicable. The phenomena that are included explicitly in the CET are hydrogen burning (for all three phases), high temperature creep rupture, PORV stuck open, HPME and DCH, in-vessel and ex-vessel steam explosion, static overpressure, MCCI. The conditional probabilities for occurrences and impact of the different phenomena are mainly based on the MELCOR analyses and contemporary understanding of phenomena behavior. 46-7

8 Apparently, some of the phenomena, which are typical or possible for reactor installation, are inapplicable for SFP (e.g. HPME and DCH). Moreover, based on MELCOR analyses, in-vessel and ex-vessel steam explosion for SFP was found to be not applicable. System availability and their effect on the accident progression included in the model are LPIS, HPIS, Spay System, Make-up system (the make-up system injection effect is temporary and influences mainly release onset) and Passive Filter Ventilation system. Modeling approach of the systems has two aspects: system unavailability or conditional failure probability is done in a same approach as in PSA L and interface analysis and qualitative analysis for equipment located in containment is performed based on MELCOR results. The qualitative analysis determine whether system components in the containment status (failed or not due to beyond basis environment conditions) and system unavailability analysis analyses the stochastic nature of system failure possibility. As an example of CET structure, the early phase for high pressure sequences is shown on Figure 0. CET - tight Primary Side PORV stuck open High temp. creep High temp. creep AC power rupture - hot legs rupture - SGTR recovery or SL In vessel corium coolability In-vessel steam explosion Spray System operation Hydrogen burning Containment failure - early Time of failure P-EARLY-PHASE YP-STUCK HTRCS HTSGTR R-EL-I IVR-COOL IVR-SE SS-I BUR-I CONT-FE CONT-T No. Freq. Conseq. Code RC0 RC03 IVR-COOL 3 P-MID-PHA IVR-COOL-IVR-SE 4 RC03 IVR-COOL-IVR-SE-CONT-FE 5 5 P-MID-PHA IVR-COOL-IVR-SE-BUR-I 6 RC0 IVR-COOL-IVR-SE-BUR-I-CONT-T 7 RC0 IVR-COOL-IVR-SE-BUR-I-CONT-T(3) 3 8 RC03 IVR-COOL-IVR-SE-BUR-I-CONT-T(4) 9 P-MID-PHA IVR-COOL-IVR-SE-SS-I 0 RC03 IVR-COOL-IVR-SE-SS-I-CONT-FE 5 8.0E-0 P-MID-PHA IVR-COOL-IVR-SE-SS-I-BUR-I RC0 IVR-COOL-IVR-SE-SS-I-BUR-I-CONT-T 3 RC0 IVR-COOL-IVR-SE-SS-I-BUR-I-CONT-T(3) 3 4 RC03 IVR-COOL-IVR-SE-SS-I-BUR-I-CONT-T(4) 5 RC03 R-EL-I 6 P-MID-PHA R-EL-I-IVR-SE 7 RC03 R-EL-I-IVR-SE-CONT-FE E-04 P-MID-PHA R-EL-I-IVR-SE-BUR-I 9 RC0 R-EL-I-IVR-SE-BUR-I-CONT-T 0 RC0 R-EL-I-IVR-SE-BUR-I-CONT-T(3) 3 RC03 R-EL-I-IVR-SE-BUR-I-CONT-T(4) P-BYPASS HTSGTR 3 P-EARLY-P HTRCS 4 9.9E-0 P-EARLY-P YP-STUCK Figure 0: Containment Event Tree for Early phase 6 SOURCE TERM The release categories are determined based on the following main attributes: Containment status (isolation failure, isolated considering the expected lack tightness or bypassed); Time of release onset 4 time periods are distinguished (before hours, between h and 4 h, between 4 h and 48 h and after 48 hours); Mitigation features spray system and Filter Venting System; Containment failure location or Release location failure through containment basement, containment structure failure, isolation failure (releases are through vent stack); Activity [Bq] of 37Cs division is made based on the regulation normative bases, i.e. 3.0E 3 Bq. Then, there are two possibilities below the normative basis considered as small releases and higher than normative basis considered as large releases. Example of the represented results is given on Table. 46-8

9 Release Category PDS Table Activity of Release categories Activity [Bq] Sr-90 Ru-03 Te*-3 I-3 Xe-33 Cs-37 Ba-40 La-40 Ce-4 Sc,0E+04 4,68E+05,54E+04,47E+08 3,43E+08 8,6E+05,95E+05,35E+04 5,04E+04 Sc 4,99E+04 5,4E+04,9E+04 4,48E+06,4E+07 8,33E+04,0E+06 6,3E+04,55E+05 RC0 Sc3,6E+03,47E+04,9E+05 7,53E+07,77E+08,58E+05 5,0E+04 3,05E+0 5,7E+03 Sc4 3,4E+04,30E+04,65E+06,77E+08 4,4E+08,4E+05 7,0E+05,4E+0 7,99E+0 Sc5 3,83E+05,5E+05 3,8E+07,9E+09 4,8E+09 3,98E+06 7,84E+06 6,8E+03,4E+04 Sc6,94E+6 3,05E+6,E+6,90E+8 5,36E+8 7,00E+6 5,7E+7 3,E+6,63E+7 RC Sc7 5,40E+5,48E+6 8,68E+6 3,E+8 6,45E+8,37E+7,05E+7,04E+5,65E+6 Sc8,87E+6,87E+7,4E+6,68E+8 4,68E+8,85E+7 4,75E+7 3,00E+7 4,E+7 RC Sc9,79E+6,05E+6 9,89E+4,30E+8,94E+8 7,6E+6,69E+7 3,44E+5 7,3E+6 7 MAIN RESULTS Based on the definitions given in Bulgarian nuclear Agency regulatory guide for probabilistic analyses, risk parameters that need to be assessed in PSA L are: LERF Large Early Release Frequency frequency of accident sequences that lead to significant, not mitigated releases from the containment at a moment before the evacuation procedure of nearby local people has been finished, i.e. early fatalities or health troubles are possible, [/y]; LRF Large Release Frequency - frequency of large releases from NPP, [/y]; TRAR Total Risk of Activity Release total releases for particular release category, [Bq/y]. There are release categories (RC) defined for reactor installation and 5 RC s for spent fuel pool. Only one RC, named RC0, is assigned to the sequences with successful severe accident termination and releases, which are maintained bellow normative bases (i.e. activity of CS-37 bellow 3.0E3 Bq). For all of the rest RC, releases are higher or are expected to become higher compare to normative bases in time. In Table are given all the defined RC for reactor installation and SFP. As it can be seen from the table there several attributes that are used for RC division: Containment status; Type of containment failure; Time of containment failure; Release path direct or not direct releases to the Environment; Spray system and or Filter Venting system status. Table Release categories Release Category RC0 RC RC RC3 RC4 RC5 RC6 Frequency Description [y-] Reactor Installation 9.40E-06 Successful cooling of damaged core. Isolated containment - releases are less than normative bases. 8.08E-07 Not isolated containment or early failure. Releases starts before th hour to RB. 7.45E-08 Not isolated containment or early failure. Releases starts between th 4 th hour to RB. 7.53E-07 Not isolated containment or early failure. Releases starts before th hour to Environment.86E-07 Open reactor. Not isolated containment or early failure. Releases starts between th 4 th hour to Environment.98E-07 Open reactor. Not isolated containment or early failure. Releases starts before th hour to Environment 8.9E-07 Isolated containment. Releases are to RB due to basement failure. Activity of Cs-37 is less than 46-9

10 Release Category RC7 RC8 RC9 RC0 RC RC RC3 RC4 RC5 RC6 RC7 RC8 RC9 RC0 SFP-RC0 SFP-RC SFP-RC SFP-RC3 SFP-RC4 Frequency [y-] 3.0Е3 Bq up to the end of calculation Description 6.3E-08 Isolated containment. Sprays are in operation. Late containment failure due to hydrogen burning. Releases starts between 4 th 48 th hour to Environment.90E- Isolated containment. Sprays are in operation. Containment failure after vessel breach due to hydrogen burning, HPME or ex-vessel steam explosion. Late containment failure due to hydrogen burning. Releases starts between th 4 th hour to Environment 4.0E-09 Isolated containment. Sprays and Filter system are failed. Containment failure after vessel breach due to hydrogen burning, HPME or ex-vessel steam explosion. Late containment failure due to hydrogen burning. Releases starts between th 4 th hour to Environment. 8.65E-08 Isolated containment. Sprays and Filter system are failed. Late containment failure due to basement failure. Releases starts between 4 th 48 th hour to RB. 8.3E-08 Isolated containment. Sprays are failed. Containment failure after vessel breach due to hydrogen burning, overpressure or Filter system isolation failure. Releases starts between 4 th 48 th hour to Environment. 3.35E-06 Isolated containment. Sprays are failed. Containment failure after vessel breach due to hydrogen burning, overpressure or Filter system isolation failure. Releases starts after 48 th hour to Environment. 4.E-06 Isolated containment. Sprays are failed. Containment failure after vessel breach due to hydrogen burning, overpressure or Filter system isolation failure. Releases starts after 48 th hour to RB. 3.53E-06 Open reactor. Isolated containment. Sprays are failed. Late containment failure due to basement failure. Releases starts after 48 th hour to RB. Activity of Cs-37 is less than 3.0Е3 Bq up to the end of calculation. 4.06E-06 Open reactor. Isolated containment. Sprays are failed.. Late containment failure due to basement failure. Releases starts after 48 th hour to RB. Activity of Cs-37 is higher than 3.0Е3 Bq. 4.3E-06 Isolated containment. Sprays are failed. Filter system is in operation. Releases from Filter system are less than normative bases. In late phase, after 48 th hour, containment failed due to basement failure and releases to the RB goes beyond normative bases..73e-06 Containment bypass. IE is Primary to Secondary LOCA. SDA is stuck open. Early releases to the Environment..64E-07 Containment bypass. IE is Primary to Secondary LOCA. SDA operates in cycling mode. Early releases to the Environment..93E-07 Containment bypass. IE is Interface LOCA. Early releases to the RB..98E-08 Containment bypass due to HT SGTR. Releases to the Environment. Spent Fuel Pool 4.4E-08 Successful cooling of damaged core. Isolated containment - releases are less than normative bases..83e-06 Isolated containment. Late containment failure due to overpressure. Releases to the Environment starts after 9 days from the accident beginning. 3.E-07 Not isolated containment or early failure. Releases starts between th 4 th hour to the Environment. 5.37E-07 Not isolated containment or early failure. Releases starts after 7 th hour to the Environment..64E-09 Isolated containment. Late containment failure due to basement failure. Releases to the RB starts after 0 days from the accident beginning. On Figure are shown distributions for Release categories (excluding RC0) for all modes of Reactor Installation (RI), closed and open reactor. The results states that dominating categories are RC3 RC6, which actually represents accident sequences with basement failure in the late phase of the accident progression. The common characteristic between these 3 categories is that releases onset after 48-th hour from the emergency evacuation start point. The other significant dominant category is again a late failure (after 48-th hour) of the containment (RC) but the failure is caused by containment overpressure or Filter venting system isolation failure. The results for open and closed reactor confirm already made conclusions. 46-0

11 Reactor Installation all modes Closed reactor Open Reactor Figure : Release Category Distribution for Reactor Installation Looking at the aspects of the accident for SFP, one can conclude that here the differences between early and late releases are even more outlined compare to RI. As it is shown on Figure, the only one RC that can be considered as early release (release onset starts between th 4 th hours ) is RC, which has only % of contribution. Figure : Release Category Distribution for SFP The risk from releases is divided into two main groups, based on the interpretations for LERF and LRF given in the above. The main problem of assigning of different categories to LERF or LRF is the time after the emergency evacuation start point. The emergency evacuation start point is defined very clearly in the KNPP Emergency plan based on the IE, safety systems state and core state (e.g. temperature at core exit is above 650 C). Unfortunately, there are no normative bases or regulations or any other source of information that says what is the time duration of the evacuation procedure. Therefore, three different time intervals are assumed based on engineering judgment and other countries experiences. For LERF and respectively for LRF, the three time thresholds are -th 46-

12 hour, 4-th hour and 48-th hour. In that sense based on different groupings of RC s, three different numbers for LERF and LRF has been obtained: The evacuation finishes before -th hour LERF is 3,9E-06 [/y] and LRF is,05e-05 [/y]; The evacuation finishes before 4-th hour LERF is 4,43E-06 [/y] and LRF is,0e-05 [/y]; The evacuation finishes before 48-th hour LERF is 4,67E-06 [/y] and LRF is,98e-05 [/y]. Apparently, the results shows that the assumptions for different evacuation duration do not impact significantly the final results for LERF and LRF parameters. Moreover, LERF in all three cases is significantly less than target criterion, which is.0e-05 [/y]. On Figure 3 is shown LRF and LERF distribution for different states of reactor installation and SFP. Both figures shows that main contributor to the risk of releases is closed reactor. The result is expected considering the frequency of the PDS s for closed reactor and power level. The power level (full power is the representative power level) causes significantly faster core degradation and consequently earlier releases. Moreover, containment bypass events as primary to secondary LOCA are typical only for closed and are dominant release categories for LERF. The contribution of accident sequences for open reactor and SFP is determined exclusively by not isolated containment, as in these sequences a direct releases onset right after CD. For SFP, accident sequences with releases before -th hour are not realistic, due to slow water evaporation and low decay heat in SFP, regardless of the conservative assumption made for MELCOR analyses. A.Risk distribution based on Reactor state and SFP B.LERF distribution based on Reactor state and SFP Figure 3: Risk parameters LERF and LRF for different state of reactor and SFP On Figure 4A is shown risk distribution based on different types of IE s. The results show outlined domination of the IE s, which confirms the picture from PSA L. Generally, the distribution follows or is closed to the one obtained in PSA L. The main reason for this is that no system recovery is credited, except for power supply. Obviously, the credited sequences are not dominant one. Safety systems recovery is not credited mainly because of the lack of procedures for it, which determines too long time window for execution of the actions. The distribution of different containment failure modes that goes into LERF are shown on Figure 4B. The results are exclusively determined by the PDS with attribute not isolated containment. Therefore, the gathering of the sequences with containment failure in the early phase due to any other reason is acceptable. 46-

13 A.Risk distribution based on IE group B. Containment failure distribution based on phenomena types Figure 4: Risk distribution based on type of IE and LERF based on containment failure mode 8 CONCLUSIONS Based on the Bulgarian regulations for existing plants (currently in operation) the target risk parameters for severe accidents are: Art0 (3) For severe accidents, the limit of cesium-37 release in the atmosphere is 30 TBq that does not impose long-term restrictions for soil and water use in the monitored area. Combined release of other radionuclides different from cesium isotopes shall not in a long-term perspective, starting three months after the accident, provoke a greater hazard than the one identified for cesium release within the indicated limit. Art0 (4) The frequency of a large radioactive release into the environment that requires undertaking of immediate protective measures for the population shall not exceed.0-6 events per NPP per year. Since the last paragraph is considered for new plants, for the existing one as is KNPP, the requirement of interest is given in Transitional and Final Provisions: 3 (3) The frequency of a large radioactive release into the environment that requires undertaking of immediate protective measures for the population shall not exceed.0-5 events per NPP per year. The last risk parameter is considered as LERF in the analysis. Comparison of the obtained values for LERF against normative requirements for existing plants shows that the current safety level of unit 5 and 6 of KNPP meets the criteria for all three estimated LERF s. The results completely meets the international requirements for plants, which design is not performed based on the last contemporary safety standards. Therefore, one can conclude that safety level of KNPP is acceptable. Considering the requirement given in article 0 (3), which determines the maximum allowed magnitude of releases of Cs-37, only RC0 for Reactor installation and SFP-RC0 for SFP, meet this criterion. For all other release categories, this criterion is violated. That means that the releases in these categories should be always considered as large. Analysis of the results (main results and sensitivity analyses results) shows that: Major risk for radionuclide products releases to the environment in the early phase of the accident is dominated by primary to Secondary LOCA events, i.e. containment bypass; Major challenge to the containment integrity is basement melt through (concrete ablation). This could be explained with lack of severe accident management strategies directed to the MCCI management; 46-3

14 Operator actions for containment isolation are of high significance considering the LERF. In case of guaranteed isolation the LERF is lowered twice. Note, that all these actions need to be performed before severe accident onset; Operator action for Primary pressure decrease lowers the risk of early containment failures with about %, which shows the significance of this action; The HPME and DCH phenomena do not represent significant risk to the containment integrity. The main reasons for this results are lower compartments layout (lack of direct path to the upper containment volume), reactor cavity construction (closed cavity) and the high containment free volume that allows to accumulate the heat transferred from the corium to containment atmosphere; The in and ex-vessel steam explosion phenomena have negligible contribution to the LERF and LRF due to lack of conditions for occurrence for most of the scenarios and very low probability of containment failure in case of occurrence; Dynamic loads and consequent failure of the containment structure due to hydrogen and/or carbon monoxide burning are probable only in the late phase of the severe accident progression. The burning modes that are expected are flame acceleration or detonation. Note, that main source of flammable gas at this phase of the accident is MCCI phenomenon; Significant contribution to the SFP risk decrease would have an implementation of SAMG for SFP severe accidents. Considering the slower accident progression and available time, restoration of systems would decrease the risk several times; Unequal decay heat distribution of the fuel assemblies in SFP (loading of FA with high decay heat in one of the SFP pools) leads to significant decreasing of time to fuel damage and faster severe accident progression. Based on the conclusions different corrective measures are proposed to the plant staff. For most of the proposed measures additional analyses are required. 46-4

15 REFERENCES [] Probabilistic Safety Analysis for NPP, Safety Guide, BNRA, 00 [] Development and Application of Level Probabilistic Safety Assessment for Nuclear Power Plants, specific Safety Guide No. SSG-4, IAEA, Vienna 00; [3] ASAMPSA, 00, BEST-PRACTICES GUIDELINES FOR LPSA DEVELOPMENT AND APPLICATIONS, Volume - Best practices for the Gen II PWR, Gen II BWR LPSAs. Extension to Gen III reactors, ASAMPSA/WP&3/ 00-8 [4] U.S. NRC, REGULATORY GUIDE.6, CONTAINMENT STRUCTURAL INTEGRITY EVALUATION FOR INTERNAL PRESSURE LOADINGS ABOVE DESIGN BASIS PRESSURE [5] U.S. NRC, DRAFT REGULATORY GUIDE DG -03, CONTAINMENT PERFORMANCE FOR PRESSURE LOADS, December 008, [6] U.S. NRC, REGULATORY GUIDE.36, DESIGN LIMITS, LOADING COMBINATIONS, MATERIALS, CONSTRUCTION, AND TESTING OF CONCRETE CONTAINMENTS, December 008 [7] Rizkalla, Sami H., Simmonds, Sydney H., MacGregor, James G., Pre-stressed Concrete Containment Model, Journal of Structural Engineering, Vol., No. 4, April 984, pp [8] International Standard Problem No.48 Containment Capacity, Synthesis Report, NEA/CSNI/R(005)5, OECD Nuclear Energy Agency, Committee on the Safety of Nuclear Installations, France, September, 005 [9] NUREG / CR-6906, Containment Integrity Research at Sandia National Laboratories An overview, Washington DC, July