BWR Safety Improvement as a Lesson Learned from Fukushima Accident

Transcription

1 BWR Safety Improvement as a Lesson Learned from Fukushima Accident M. M. Zaky and S. A. Kotb ETRR-2, Atomic Energy Authority, Cairo, Egypt Received: 20/5/2016 Accepted: 15/7/2016 ABSTRACT The serious accident at Fukushima nuclear power plant generated a worldwide attention and precipitated severe public concern about the safety of nuclear power plants. The accident has also forced some countries to rethink about their nuclear energy policies, and made a serious negative impact on the nuclear industry around the world. This accident caused confusion in the nuclear safety and in the public acceptance of the nuclear energy. The application of nuclear energy always depend on the safety systems used to ensure the global health of environment, public and workers through the defense in-depth strategy. This paper considers a modification to the Reactor core Isolation Condenser (RIC) system for cooling after shutdown in Boiling Water Reactors (BWR). As for the existing bypass valves which are normally closed, a new normally open bypass valves are suggested to guarantee the continuity of cooling even if all power supplies are lost and/or plant blackout. Keywords: Nuclear accident, Safety Assessment, Boiling Water Reactor Isolation Condenser (BWR-IC). I. INTRODUCTION The accident at the Fukushima Daiichi nuclear power plant in Japan occurred following a severe off-shore earthquake and subsequent tsunami on 11 March Flooding of the plant and damage to equipment resulted in an extended station blackout, loss of core cooling, fuel melting, hydrogen explosions and releases of radioactive materials to the surrounding area, resulting in contamination of the environment and potential long term consequences [1]. Many nuclear power plants (NPPs) that are being planned or constructed now, have planned operating lives up to 60 years, so there is the potential for significant changes in climate and weather conditions during the lifetime of the plant. The change in weather conditions may involve more frequent periods of severe or extreme weather. These events may affect the reliability of the plant and the grid systems. Hence, this should be considered during the design of the NPP and its grid connections [2]. The effect of severe weather events on the plant and its systems must be reassessed and well studied to prevent their impact on health and economic activities. The design of NPP and its onsite power system should take into consideration steady state, short term operation and transient conditions originating from the grid, that can occur whether the NPP is operating or at shutdown conditions [3]. These considerations include: Switching surges; Lighting surges; Voltage sags and swells in conjunction with clearing of faults on the grid; Brownout events; Voltage and frequency variations and transients when the grid (and main generator) is affected by faults; Prolonged loss of all off-site supplies from the grid. The protection scheme of the NPP should be designed in such a manner that safety electrical systems are shielded against adverse effects caused by such off-site events. Extreme external events such as strong winds, thunderstorms, high temperatures, floods, rising sea levels and tsunami affect the plant operability and reliability [4]. Japanese earthquake and tsunami record may be the highest in the world. Hence the Japanese designs for nuclear power plants involve extremely high safety level to cope with natural disasters, but a new natural event with serious impact is not expected in the design phase. The history of nuclear accidents gives an indication that Fukushima is the most serious accident as a direct effect of a natural disaster [5]. The lessons learned from this accident will be useful for defining and implementing

2 measures for preventing accidents involving large releases of radioactive materials at nuclear installations worldwide, including all the nuclear reactors. The Fukushima accident caused the most extensive release of radioactivity since the Chernobyl accident in 1986, and was far worse than the Three Mile Island accident in the United States, The equipment failure and human error initiated the accident of Chernobyl and Three Mile Island, while the Fukushima accident was initiated by a natural disaster; a huge earthquake and a tsunami. The tsunami knocked out the backup power systems that are needed to cool the reactors at the plant, causing several numbers of these reactors to undergo fuel melting, hydrogen explosions, and radioactive materials release [6]. II. PLANT HISTORY AND DESCRIPTION A. Fukushima Historical Record of Extreme External Events The tsunami height design basis was 3.1 meters for Daiichi based on the actual assessment of the 1960 Chile tsunami and the plant had been built about 10 meters above the sea level with the seawater pumps 4 meters above sea level. The Daini plant was also built 13 meters above sea level. The design basis was reassessed and revised to 5.7 meters above, and the seawater pumps were sealed in The maximum amplitude of this tsunami was 23 meters at the point of origin; about 180 km from the Fukushima site. The tsunami heights at the worst condition were about 15 meters height, and the Daiichi turbine zones were under some 5 meters of seawater. The Daini site was less affected. In the last century there have been eight tsunamis in the region with maximum amplitudes at origin above 10 meters these having arisen from earthquakes of magnitude 7.7 to 8.4, on average one every 12 years. The records of 1983 and 1993 were the most recent in Japan, showing the maximum heights at the origin of 14.5 meters and 31 meters respectively, both induced by affecting earthquakes of magnitude 7.7. An extreme earthquake of a magnitude 8.3 produced a tsunami with run-up height of 38 meters in Tohoku region, killing more than 27,000 persons has been recorded in June The Fukushima Daiichi was designed and sited in the 1960s, were considered acceptable in relation to the scientific knowledge then, with low recorded run-up heights for that particular coastline. The tsunami countermeasures had been taken during the design phase. The 2001 extreme external event came out of the likelihood of a large earthquake and resulting major tsunami of some 15.7 meters at the Daiichi site. The Japanese government's Earthquake Research Committee report on earthquakes and tsunamis off the Pacific coastline of northeastern February 2011, was due to be released in April, and might have brought about changes. It includes analysis of an earthquake of a magnitude 8.3 that is known to have struck the region more than 1140 years ago, triggering enormous tsunamis that flooded vast areas of Miyagi and Fukushima prefectures. The report concludes that the region should be alerted on the risk of a similar disaster striking again. The 11 March, 2001 earthquake measured a magnitude of 9.0 and involved substantial shifting of multiple sections of seabed over a source area of 200 x 400 km. Tsunami waves devastated wide areas of Miyagi, Iwate and Fukushima prefectures [7]. B. Plant Description and Accident Scenario The Fukushima power station housed a boiling water reactor of the 1960s vintage (BWR-3 Mark 1), four BWR-4 Mark 1, and one BWR-5 Mark 2 with a total electric generation capacity of around 4700 MW At the time of the accident only three reactors were in operation, and the others were in shutdown mode for planned maintenance. The earthquake automatically triggered a shutdown as designed, and halted the fission chain reaction, the main source of energy production, in those operating reactors. However, the residual heat of the core would remain significant for enough time to melt the reactor core [8]. Following a major earthquake, a 15 meter tsunami disabled the power supply and cooling of three Fukushima Daiichi reactors, causing a nuclear accident. All three cores largely melted in the first three days. The accident was rated 7 on the International Nuclear Event Scale (INES), due to high radioactive releases. The tsunami affects the power supplies, however, for Units (1 to 4), there was a

3 complete loss of all power supplies AC power from the main power supply, emergency diesel generators (EDs) and DC power supplies, and this was the main cause of the severe accidents that followed [9]. III. FUKUSHIMA DAIICHI NPP SAFETY SYSTEMS For the reactor cooling functions in the case of design basis events the following safety systems were implemented in the following units: - Unit 1 was equipped with Isolation Condensers (IC) and a High Pressure Core Injection system (HPCI). - Unit 1 was equipped with a Core Spray system (CS) and a reactor Shut-down Cooling system (SHC). - Units 2 and 3 were equipped with HPCI and a Reactor Core Isolation Cooling system (RCIC) to cool the reactors when they are under high pressure during containment isolation sequences. - Units 2 and 3 were equipped with a Residual Heat Removal system (RHR) and a low pressure CS to cool the reactors when they are under low pressure. - Additionally, in the main steam line that leads to the Reactor Pressure Vessel (RPV) are installed main steam Safety Relief Valves (SRV) that discharge steam in the reactor to the Suppression Chamber (S/C) and safety valves that discharge steam in the reactor to the Dry Well (DW) of the PCV. The SRV functions as an automatic decompression system. - The Isolation Condenser (IC) is a passive high pressure system that is on standby during normal operation. This system is able to remove decay heat when the reactor is shutdown and isolated from the turbine. The system is designed to start automatically upon receipt of a high reactor pressure signal; it can also be activated manually by the operators. The IC operates by natural circulation (i.e. without pumps). During its operation, steam flows from the reactor, condenses in the tubes of the IC tanks and returns by gravity to the reactor. The water outside the tubes (in the IC tanks) will heat-up and eventually boil and vent steam to the atmosphere. Operation of IC includes a number of valves need to change position. The IC actuation requires a DC power supply, which is provided by batteries. Both reactors of Units 2 and 3 were equipped with the RCIC system. The function of the RCIC system is to provide core cooling make up water to the reactor vessel when it is isolated. The system consists of a steam turbine driven pump capable of delivering water to the reactor vessel at high pressure. The turbine is driven by steam produced in the reactor vessel, and exhausts to the suppression pool under water. The system is designed to start automatically upon receipt of a low water level in the reactor signal. Once the reactor water level is recovered, the system is designed to stop automatically. The DC electrical supply is necessary for the control of the turbine and the system flow. Units 1 to 3 were also equipped with a system to inject water in the reactor at high pressure (HPCI), powered by DC supply. Under reactor isolation conditions, the HPCI is a back-up system for the IC in BWR-3s, Unit 1 and for the RCIC system Units 2 and 3, BWR-4s. The HPCI consists of a turbine driven pump, auxiliary systems required for turbine operation including DC power that can be provided by batteries and associated piping and instrumentation. This system is normally aligned to suction water from the condensate storage tank, the suppression pool being an alternate source of water. The HPCI is designed to start automatically on receipt of a low water level in the reactor signal, or a high drywell pressure signal. It can also be actuated manually by the operators. The steam used by the turbine is discharged into the suppression pool. Unfortunately, all these systems require DC power for operation. The cold make-up water should be provided to fill-up the IC tanks. Without adding more water, the tanks of isolation condenser will empty, and its cooling capability will stop after 8 hours, if no water injected to the tank. Also, the

4 water in the suppression chambers to condensate the steam, which is discharged from the turbines in RCIC and HPCI systems should be cooled, that required AC power for operation. The effect of loss of all power supplies and the effect of IC bypass as a consequence of the accident is the main objective of this paper to enhance the safety functions [10]. a. The Isolation Condenser of the Plant IV. ISOLATION CONDENSER DESCRIPTION The main objective of the isolation condenser system as shown in figure 1 is to remove the decay heat and conserve the reactor water inventory when the reactor becomes isolated from the turbine condenser. The IC system consists of two trains of equipment. Each train consists of a large heat exchanger located in the reactor building, outside of containment and above the RPV in elevation, which condenses the steam produced from the decay heat and returns it to the reactor through the phenomena of natural circulation. The tube side of the isolation condenser is vented to the steam main line during normal operation. A sustained highly reactor pressure operates automatically the isolation condenser system. An automatic action initiates a motorized valve on the condensation return line to open and vent valves to the steam main line to close steam then flows, under reactor pressure to IC. This steam is routed to both condenser tube bundles. It is condensed by the cold water in the shell side of the condenser [11]. To obtain the desired flow of condensation from the IC to the RV, the normally closed condensate return valve can be throttled by the operator in the control room. During operation, the water on the shell side following a reactor isolation and scram, the energy added to the coolant will cause reactor pressure to increase and may initiate the IC. The capacity of this system is equivalent to the decay heat rate generation 5 minutes following the scram and isolation with no makeup water, the volume of water stored in the IC will be depleted in 1 hour and 30 minutes. This allows sufficient time to initiate makeup water flow to the shell side of the condenser [12]. Fig. (1): Fukushima Daiichi Unit 1, BWR, isolation condensers.

5 Fig. (2): Fukushima Daiichi Unit 1, BWR with modified IC. b. Improvement of BWR Safety Systems: Isolation Condenser Modifications The BWR safety system is improved by using a normally open relief valve to remove the decay heat even if the plant blackout and all power supplies are lost due to any of the common mode failures as those of extreme external events. At normal operation of the nuclear power plant the bypass valves (NO) remain closed. This normally open valve is connected with a DC power supply to guarantee the safety function even if the offsite power supply is lost. In normal shut down the cooling go through the normal shutdown cooling. Otherwise in emergency shutdown, the proposed normally open bypass valves would be open and the isolation condenser IC would be continued to operate, and the situation would have soon been brought under control. Figure 2 illustrates the proposed normally open valves of the isolation condenser and its feeding from the different power supplies of the plant: (off-site power supply, diesel generator and DC batters). c. Electrical Network Plant The modification of the IC s, bypass valves, normally open (NO) for Motor operated valve (MO), isolation valves to undergo. The bypass valves NO are designed to be normally open in case of the loss of all power supply in the plant. The electricity connection to the bypass valves is made by converting AC voltage from main bus and emergency diesel and connected on battery bus on parallel. At normal operation of the nuclear power plant the bypass valves NO remain closed. The connection to power supply to the NO valves is from the emergency DC source 125 volt DC. In normal shutdown, due to loss of off-site power supply, onsite power supply or DC power supply the bypass valves (NO) remain closed. In emergency shutdown due to a complete blackout, the bypass valves will open and the isolation condenser IC would continue operating and the situation would have soon been brought under control [13].

6 Main grid KV Main Transf D D D / Kv / Kv / Kv To EMO Bus DC Bus V Main enerator Fig. (3): Electrical network of the plant. Main grid KV Main Transf D D D / Kv / Kv / Kv To EMO Bus DC Bus V Main enerator Fig. (4): Electrical network with loss of offsite power supply (scenario 1).

7 Main grid KV Main Transf D D D / Kv / Kv / Kv To EMO Bus DC Bus V Main enerator Scenario 1: Loss of Offsite Power Supply Fig. (5): Electrical network with loss of (scenario 2). In case of loss of offsite power supply, the reactor will shut down and the diesel generators are working and voltage terminal on battery is available as shown in Fig 4 then, the emergency bypass valves (ENO) remain feeding and those valves are not opened. The isolation condenser is working through the (MO) valves to complete the normal shutdown cycle. Scenario 2: Plant Blackout In case of the station blackout with loss of offsite power supply, diesel generators failure and battery out of serves as shown in Fig 5 then, the voltage terminal on the emergency bypass valves (ENO) is lost and the valves opened. In this emergency shutdown condition, the isolation condenser is working through the proposed bypasses valves. V. APPLICATIONS OF PCTRAN SIMULATOR The nuclear power plant simulation software, PCTRAN, is a product of Micro Simulation Technology (MST) Inc., which can perform nuclear power plant transient and accident simulation on a personal computer. The latest version of PCTRAN, updated by MST Inc., contains the severe accident model comprised of core meltdown, vessel penetration and corium-concrete interaction. The software has several features that are suitable for being used as the evaluation tool for the emergency responses [14] : in this study, different accident and initiation events are simulated in the program and the consequences of those events are considered. PCTRAN also was used to conduct the designed timesequenced nuclear power plant accident scenarios [15, 16]. Figure 6 shows the variation in average and saturation temperature in Fahrenheit (TAV1, TAV2, TSAT1 and TSAT2) of the reactor in case of correctly action of IC and when IC bypasses respectively. It is noted that both of average and saturation temperatures are increasing due to the bypass of the IC and this shows the needing of modification of the IC to be normally open to overcome the steam relief even if the plant blackout. 410

8 Figure 7 illustrates the effect of the IC bypass on the pressure (P, in Psia) of the reactor and how the existing and good functioning of the IC maintains the pressure otherwise the pressure is increased and acts as a malfunction on the reactor and its safety functions. Figure 8 indicates the variations in void (%) due to the bypass of IC (VOID1 and VOID2) and how it increases compared with a good functioning of the IC. The void indicates the unbalance in cooling of the reactor and it may cause a bad consequence related to the reactor safety. Figure 9 describes the difference between core level with IC and with IC bypass, the core level decreases due to the IC bypass otherwise the core level is maintained in case of existing IC. Figure 10 shows the effect of the IC and IC bypass on the core flow, it is noted that the flow disturbance affects the reactor and cooling performance. Figure 11 illustrates the difference in the Turbine header pressure (PHDR, Ib/sec) due to the IC bypass, the pressure increases as a consequence of IC bypass relative to the pressure of normal work of IC. Figure 12 shows the comparison between WCOR in both cases of IC and IC bypass and how the guarantee of IC function safe the residual heat after shutdown process. Fig. (6): Average and saturation temperature (TAV and TSAT) with IC and IC bypass. Fig. (7): Pressure (P) with IC and without IC. 411

9 Fig. (8): Void (VOID) with and without IC. Fig. (9): Core level (LCOR) with IC and with IC bypass. Fig. (10): Core flow (COFL) with IC and with IC bypass. 413

10 Fig. (11): Turbine header pressure (PHDR) with IC and without IC. Fig. (12): (WCOR) with IC and with IC bypass. VI. CONCLUSION The present study introduces a safety enhancement of BWR through the IC modifications. Basically safety functions should be able to shutdown the reactor safely, remove the heat and confinement the radiological releases to protect all inside and outside the nuclear reactor zone. Analysis of the accident at the Fukushima Daiichi, nuclear power plant in Japan occurred following a severe off-shore earthquake and subsequent tsunami is presented. Flooding of the plant and damage to equipment resulted in an extended station blackout, loss of core cooling, fuel melting, hydrogen explosions and releases of radioactive materials to the surrounding zone, with contamination of the environment and potential long term consequences. The isolation condenser plays a main role in the accident with suffering the plant due to its wrong function as normally closed in accident. We proposed a modification on the IC relief valve to guarantee the safety function during abnormal shutdown. PCTRAN, simulator is used to investigate the accident scenario and improvement the reactor safety. The results indicate that the proposed design will be able to save the safety functions in case of unplanned shutdown even in case of the plant blackout. 414

11 EFERENCES (1) Katsumi Hirose, Fukushima Daiichi nuclear power plant accident: summary of regional radioactive deposition monitoring results, Journal of Environmental Radioactivity, Vol. 111, PP , 2012, (2) INPRO, Special Report on the Nuclear Accident at the Fukushima Daiichi Nuclear Power Station, IAEA, (3) Alba L. Pineda-Solano, Victor H. Carreto-Vazquez and M. Sam Mannan, The Fukushima Daiichi Accident and its Impact on Risk Perception and Risk Communication, Chemical engineering transactions, Vol.31, (4) Jyri Mustajoki, Raimo P. Hämäläinen, Kari Sinkko, Interactive computer support in decision conferencing: Two cases on off-site nuclear emergency management, Decision Support Systems, Vol. 42, PP , (5) T.N. Srinivasan, T.S. opi Rethinaraj, Fukushima and thereafter: Reassessment of risks of nuclear power, Energy Policy, Vol. 52, PP , (6) Jiˇrina Vitázková, Errico Cazzol, Common Risk Target for severe accidents of nuclear power plants based on IAEA INES scale, Nuclear Engineering and Design, Vol. 262, PP , (7) Muhammad Zubair, Zhang Zhijian, Reliability data update method for emergency diesel generator of Daya Bay Nuclear Power Plant Annals of Nuclear Energy, Vol. 38, PP , (8) Yi-Hsiang Cheng, Chunkuan Shih, Show-Chyuan Chiang, Tung-Li Weng, Introducing PCTRAN as an evaluation tool for nuclear power plant emergency responses, Annals of Nuclear Energy, Vol. 40, PP , (9) K. Moriya and K. Sato, Fukushima Daiichi NPP Accident Plant Design and Preliminary Observations, Hitachi E Nuclear Energy, Ltd. May 3, (10) David Lochbaum, Fukushima Dai-Ichi Unit 1: The First 30 Minutes, PP. 1-11, (11) Eiji Yamamura, Experience of technological and natural disasters and their impact on the perceived risk of nuclear accidents after the Fukushima nuclear disaster in Japan 2011: A crosscountry analysis, The Journal of Socio-Economics, Vol. 41, PP , (12) Jussi K. Vaurio, Human factors, human reliability and risk assessment in license renewal of a nuclear power plant, Reliability Engineering and System Safety, Vol. 94, PP , (13) V. Saenko, V. Ivanov, A. Tsyb, T. Bogdanova, M. Tronko, Yu. Demidchik, S. Yamashita, Overview the Chernobyl Accident and its Consequences, Clinical Oncology, Vol. 23, PP (14) Jang-Shyong You, Wen-Fang Wu, Probabilistic failure analysis of nuclear piping with empirical study of Taiwan s BWR plants, International Journal of Pressure Vessels and Piping, Vol. 79, PP , (15) T. Narabayashi, Lessons learned from the Fukushima Daiichi Nuclear Power Plant Accident, Turbulence, Heat and Mass Transfer, Begell House, Inc.7, (16) JNES, IC Performance and Transient Analysis for Fukushima Daiichi NPP unit 1 accidents,