Accident Management Guidance for Spent Fuel Pools and Shutdown Conditions

Transcription

1 Accident Management Guidance for Spent Fuel Pools and Shutdown Conditions Roy Harter RLH Global Services SAMG-D course, IAEA, Vienna, Austria October 2015

2 IAEA Safety Guide NS-G-2.15 Severe Accident Management Programmes for Nuclear Power Plants Main Principles: The recommendations of this Safety Guide have been developed primarily for accident management during atpower states, but are intended to be valid also for other modes of operation, including shutdown states Severe accidents may also occur when the plant is in the shutdown state. In the severe accident management guidance, consideration should be given to any specific challenges posed by shutdown plant configurations and large scale maintenance, such as an open containment equipment hatch. The potential damage of spent fuel both in the reactor vessel and in the spent fuel pool or in storage should also be considered in the accident management guidance. As large scale maintenance is frequently carried out during planned shutdown states, the first concern of accident management guidance should be the safety of the workforce Severe accident management should cover all modes of plant operation and also appropriately selected external events, such as fires, floods, seismic events and extreme weather conditions (e.g. high winds, extremely high or low temperatures, droughts) that could damage large parts of the plant. In the severe accident management guidance, consideration should be given to specific challenges posed by external events, such as loss of the power supply, loss of the control room or switchgear room and reduced access to systems and components. 2

3 3 Spent Fuel Accident Management Guidance

4 Spent Fuel Pool Design GDC in App A of 10CFR50 and RG 1.13: The pool structures, spent fuel racks, and overhead cranes are designed as Seismic Category 1: Suitable shielding for radiation protection Appropriate containment, confinement, and filtering systems Residual heat removal capability that reflects the importance to safety of decay heat Ability to prevent significant reduction in fuel storage coolant inventory under accident conditions 4

5 Typical BWR Fuel Pool Cooling System The Fuel Pool Cooling and Cleanup System normally maintains the SFP water temperature, purity, clarity and level within limits. NOT A SAFETY RELATED SYSTEM! 5

6 Single Line Diagram of SFP Makeup Systems ESW Hose Well Water via ESW Hose Fire Hoses on RB 855, 833, 812, 786, and 757 Levels Condensate SW Hoses Demin Water Hoses Portable Pump Spool Piece RHR RHRSW ESW Fire Water Cond SW Well Water GSW Fuel Pool Gate Shield Blocks Condensate & Feedwater RHR Core Spray CRD RHRSW ESW Fire Water Condensate SW Well Water GSW SBLC Reactor Well Spent Fuel Pool Normal SFP Makeup Source Fuel Pool Cask Storage Alternate SFP Makeup Source Skimmer Surge Tanks Condensate Service Water To RHR Fuel Pool Cooling System Additional SFP Makeup Sources During Outages with Reactor Cavity Flooded 6

7 Spent Fuel Assemblies Stored in SFP Spent fuel assemblies have: Radioactive fission products and actinides as a result of critical operations A heat source associated with the radioactive decay of the fission products and actinides (that is, decay heat) 7

8 8 Past NRC-sponsored Analyses for Identification of SFP Severe Accidents

9 Spent Fuel Pool Critical Safety Functions Spent Fuel Pool Critical Safety Functions: Reactivity control Inventory control Temperature control Radioactivity control Combustible gas control Exceptions to the critical support functions compared to those applied to the RPV are the following: No high-pressure injection is needed No depressurization method is required There is not a containment, only a confinement EPRI TBR Spent Fuel Pool Accident Characteristics 9

10 Installed Systems Available to Satisfy SFP Critical Safety Functions Reactivity Control Inventory Control Temperature Control Radioactivity Control Fuel pool racks Poison curtain or poison plates Liquid poison solution Borated water from the refueling water storage tank (PWR) Fuel pool cooling and cleanup system Condensate transfer Demineralized Water Fire protection system water Refueling water purification system SFP cooling and purification system Primary water systems CVCS flow (PWR) RHR fuel pool assist ECCS (via the RPV when fuel transfer canal is open) Fuel pool cooling RHR in fuel pool assist Standby gas treatment system (BWR) Building Ventilation and filtration system Secondary containment / isolation No design features for control of combustible gas in the SFP at many plants EPRI TBR Spent Fuel Pool Accident Characteristics 10

11 SFP Initiating Events LOOP Loss of SFP Cooling Seismic LOOP Weather-related LOOP (for example, hurricane, tornado) Equipment Failures Internal flood External flood Loss of SFP Inventory External event causing structural failure of the SFP Failure of the SFP gate Turbine missiles Cask or heavy load drop results in structural damage to the SFP Siphoning of the pool Core Damage Events At power At shutdown EPRI TBR Spent Fuel Pool Accident Characteristics 11

12 SFP Hazard Impacts EPRI TBR Spent Fuel Pool Accident Characteristics 12

13 13 Decay Heat as a Function of Time for a Spent PWR Assembly

14 SFP Level as a Function of Time following a Loss of SFP Cooling 55 Hours 110 Hours 165 Hours 220 Hours 14

15 15 Time to Boil & Time to Uncover Fuel following Loss of SFP Cooling

16 Early SFP Accident Management Guidance Typical SFP Accident Management Procedures Alarm Response Procedures (Hi/Lo SFP Level) Abnormal Operating Procedures (Loss of SFP Cooling) Historical industry focus was based on sequences associated with loss of Decay Heat Removal and SFP level PRIMARILY driven by refueling outage risk management 16

17 Terrorist Attacks September 11, 2001 The 9/11 terrorist attacks brought a new focus on SFP accidents! Zirconium fires re-introduced into the safeguards domain Phase 2 of NRC B.5.b response focused on SFP vulnerabilities and capabilities 17

18 Fukushima Daiichi Accident Fukushima Daiichi accident brought new concerns with SFP accidents! The loss of cooling to the fuel pools for units 1, 2, 3, and 4 resulted in the pools heating up and ultimately reaching saturation or near saturation temperatures. The resultant evaporation reduced the spent fuel pool inventories The loss of spent fuel pool cooling, coolant inventory, and makeup capability at the Fukushima Daiichi plant could have resulted in damage to stored spent nuclear fuel and significant radiological consequences to station personnel, the site, and the surrounding region 18

19 19 Key Responses to Fukushima Daiichi Spent Fuel Pool Insights in USA Key recommendations in INPO IER L1-11-2: Verify implementation of recommendations of SOER 09-1, Shutdown Safety, for SFP Safety Functions When SFP Temp >200F, protect SFP heat removal and makeup systems Identify time to 200F in event cooling is lost Verify adequacy of SFP AOPs Revise Station EOPs to monitor key SFP parameters during accidents NRC Order EA , Reliable Spent Fuel Pool Instrumentation NRC Order EA , "Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond Design-Basis External Events Makeup with a Portable Injection Source Rate to exceed boil off for design basis heat load Hoses on deck Connection to SFP cooling piping Vent pathway Spray capability (200 gpm/unit to pool)

20 EPRI SFP Analyses EPRI June 2011 EPRI May 2012 EPRI August 2012 EPRI October 2012 EPRI May 2013 EPRI May 2013 EPRI April 2013 Summary of EPRI Research Applicable to Nuclear Accident Scenarios Summary of the EPRI Early Event Analysis of the Fukushima Daiichi Spent Fuel Pools Following the March 11, 2011 Earthquake and Tsunami in Japan Impacts Associated with Transfer of Spent Nuclear Fuel from Spent Fuel Storage Pools to Dry Storage After Five Years of Cooling Severe Accident Management Guidance Technical Basis Report (Volume 1: Candidate High-Level Actions and Their Effects) Spent Fuel Pool Risk Assessment Integration Framework (Mark I and II BWRs) and Pilot Plant Application Spent Fuel Pool Accident Characteristics Fukushima Technical Evaluation, Phase 1 MAAP5 Analysis 20

21 New Focus on SFP AMG BWR and PWR Owner s Groups developed SFP AMG in both EOPs/SAGs Similar efforts performed for other plant types in other countries 21

22 EPRI SAMG TBR Insights Loss of water Fuel Clad Heatup Fuel Swell/Burst Gap Release Zirconium Oxidation Zirconium Fire Fission Product Release 22

23 EPRI SAMG TBR Insights SFP Candidate High Level Actions (CHLA): Inject into the SFP Spray the SFP 23

24 Dose Rates from a Drained SFP NRC Response Technical Manual 96 (NUREG/BR-0150) provides a basic indication of area dose rates corresponding to a typical spent fuel pool that has drained. A ground level whole body gamma dose of ~ 100 msv/hr (10 rem/hr) corresponds to a point 100 m from the edge of the drained pool. 24

25 SFP AMG Considerations Strategies: o o o o Water injection & Spray capability using ALL available methods including permanent and portable equipment Decay heat removal using ALL available methods including permanent and portable equipment Radiation levels in SFP area Use of SFP sprays Hydrogen control Operating HVAC Venting Refuel Floor areas Use of H2 Recombiners and Igniters Supporting Tools: o o o o Decay heat for various SFP configurations Boil-off rate of water in the pool and leakage rate Identify margins to limits and timing of actions Estimates for hydrogen and oxygen production rates Estimate increases in dose rates corresponding to lowering SFP level 25

26 Addition of SFP into SAMG SAMG entry conditions established for scenarios with and without in-vessel core damage Entry to SAMG typically based on SFP water level Westinghouse SFP SAMG: SAG-9 Refill the Spent Fuel Pool SCG-5 Recover Spent Fuel Pool Level SCG-1 Mitigate Fission Product Releases SFP SAMGs for US BWROG developed after Fukushima Daiichi accident Integrated into Secondary Containment Control guidelines SFP level and temperature Secondary Containment Area Temperatures, Levels, A 26

27 Plant Modifications for SFP SAMG Reliable SFP Level Instrumentation Hydrogen Detectors in areas near the SFP Hydrogen Vents in buildings housing SFP Hydrogen Igniters / Recombiners in SFP area Connections to utilize portable equipment 27

28 Plant Modifications for SFP SAMG Hydrogen Detector Hydrogen Vent 28 Connections to Use Portable Equipment SFP Level Instrumentation

29 29 Example US BWR AMG Addressing SFP

30 30 Example - Koeberg SFP AMG

31 31 Shutdown Accident Management Guidance

32 Why is AMG for Shutdown Conditions Important? 33 percent of a station s overall risk is associated with shutdown periods Plant configurations are different Many systems / components are out of service Small amount of coolant during certain phases Some automatic features not available Many activities take place Many personnel, unfamiliar with the plant are working during the outage Events initiated from cold shutdown or refuel conditions, security events, and widespread catastrophic failures of major plant structures were not specifically considered in the original development of EOPs/SAGs. 32

33 33 Operating Verses Shutdown Conditions

34 Variability in Outage Conditions Sat Sun Mon Tue Wed Thu Fri Sat Sun Mon Tue Wed Thu Fri Sat Sun Mon Tue Wed Thu Fri Sat Sun Mon Tue Wed Thu Fri Sat Sun Mon Tue Wed Thu Fri Sat Sun Mon Tue Wed Thu Fri Sat Sun Mon FP Gates removed FS # 1 60 hours FS # 2 72 hours FP Gates installed Rx level at flange RX/Cavity Water Level Tension RPV Head Class 1 leak Test Normal Rx Level Generator Offline to Cold S/D Lowered Inventory First Fuel Shuffle B SDC in service LPRMs CRDMs OPDRVS, RECIRC Common SDC Second Fuel Shuffle Friction Testing Lowered Inventory Torus Water Level A SDC in service Scram time testing B SDC Plant Startup to Generator on-line A EDG work 125 VDC Div 1 Work B EDG work 125 VDC Div 2 work 1T035 - SBDGs inop but available A RHR Work A CS Work RWCU work B RHR Work B CS All RHR not available for injection Secondary Containment Work Switchyard Work for NERC relays and Hiawatha Line B LOOP LOCA test A LOOP LOCA test Risk Sectors

35 NUMARC Industry Guidelines for Shutdown Safety NUMARC (Dec 1991) Identified Five Key Safety Functions during shutdown conditions 1. Decay Heat Removal Capability 2. Inventory Control 3. Electrical Power Availability 4. Reactivity Control 5. Containment - Primary/Secondary Required procedures to be developed for the loss of each Safety Function 35

36 Key Shutdown Safety Functions Decay Heat Removal maintains RCS pressure / temperature and Spent Fuel Pool temperature below specified limits. This includes support systems and heat sinks used to remove decay heat. Inventory Control essential to maintaining the overall decay heat removal function. Lower inventory also reduces the time to boil, making losses of DHR more consequential. Electric Power Availability measures established to ensure adequate electric power is available to support other key safety functions Reactivity Control ensures sufficient shutdown margin in the RCS and SFP, provides effective control of fuel assemblies and control rod placement, management of boron concentration, and monitor core behavior. Containment Closure ensures closure of penetrations to provide a functional barrier to fission product release prior to core boiling 36 36

37 NUMARC Accident Management Guidance Expectations AMG should be established to address loss of RCS inventory during shutdown conditions. The guidance should consider the following: identifying the potential source and magnitude of the loss providing sufficient makeup capability coping with high radiation levels in containment AMG should prioritize available alternate cooling methods (e.g., gravity feed and bleed, low pressure pump feed and bleed, high pressure pump feed and bleed, etc.) for conditions that are planned for the outage AMG should be established to address loss of power during shutdown conditions AMG should include guidance to maintain adequate shutdown margin in the RCS and spent fuel pool Containment hatches (equipment and personnel) and other penetrations that communicate with the containment atmosphere should either be closed or capable of being closed prior to core boiling following a loss of DHR and should be addressed in procedures 37

38 NUREG-1449 Safety During Shutdown and Low Power Operation Key Insights Outage planning is crucial to safety during shutdown conditions since it establishes the level of mitigation equipment available Well-trained and well-equipped plant operators play a very significant role in accident mitigation for shutdown events PWR accident sequences involving loss of RHR during operation with a reduced inventory (e.g., mid-loop operation) are dominant contributors to the core-damage frequency Extended loss of decay heat removal capability in PWRs can lead to a LOCA caused by failure of temporary pressure boundaries in the RCS or rupture of RHR system piping. In either case, the containment may be open and ECCS recirculation capability may not be available. Passive methods of decay heat removal can be very effective in delaying or preventing a severe accident in a PWR All PWR and Mark III BWR primary containments are capable of providing significant protection under severe core-damage conditions, provided that the containment is closed or can be closed quickly Mark I and II BWR secondary containments offer little protection, but this is offset by a significantly lower likelihood of core damage in BWRs 38

39 INPO SOER Shutdown Safety Key Operations Recommendations Shift manager maintains overall responsibility for control of the key safety functions Consider standby equipment as available only when it can be made operational by automatic or simple operator actions Minimize the time at lowered inventory Protect systems and equipment that operate to support a key shutdown safety function Verify that AOPs/EOPs for mitigating challenges to shutdown safety such as a loss of shutdown or spent fuel pool cooling can be performed as written based on the outage system/equipment configurations Develop contingency plans when equipment required by the procedures will not be available Provide training on procedures for events such as loss of inventory, shutdown cooling, fuel pool cooling, containment integrity, and off-site power. 39

40 EPRI SAMG TBR Shutdown Safety EPRI TBR Revised after the Fukushima Daiichi Accident: Fukushima Daiichi Units 1, 2, and 3 were operating at full power at the time of the earthquake, and Units 4, 5, and 6 were in a shutdown state The loss of cooling to units in a shutdown state highlighted the need for additional considerations relating to the challenges in deploying particular management strategies, which is a necessary component of the decision-making process With respect to external events, the consideration of the capability to cope with a severe accident progressing from the complete range of operational configurations is a key means of ensuring robustness of site SAMG implementations The effects of the various CHLAs on plant conditions during other modes of operation, and particularly during shutdown, depends on the configuration of the plant when the CHLA is implemented 40

41 EPRI SAMG TBR Operational Configurations Verses Defined Modes (PWR) Mode 1 - power is >5% full power Mode 2 - startup mode, power <5%full power Mode 3 - hot standby, reactor critical & Tave >[330] F Mode 4 - hot shutdown, reactor critical and RCS Tave is between [330] F and [200] F Mode 5 - cold shutdown, reactor is critical and RCS Tave is less than [200] F Mode 6 - refueling mode. Transition between 5 to 6 when RPV head bolts are less than fully tensioned 41

42 EPRI SAMG TBR Operational Configurations Verses Defined Modes (BWR) Mode 1 - encompasses all operational states associated with power operation. Mode 2 reactor startup mode Mode 3 - hot shutdown operational states Mode 4 - contains all the operational states associated with cold shutdown conditions Mode 5 - encompasses the operational states associated with reactor refueling 42

43 EPRI SAMG TBR CHLAs 43 Many CHLAs are not applicable, viable, or are diminished during Shutdown Conditions

44 Key Responses to Fukushima Daiichi Insights on Shutdown Safety in USA NRC Order EA , "Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond Design-Basis External Events" NEI Rev 1, Diverse and Flexible Coping Strategies (FLEX) Implementation Guide BWR and PWR Owner s Groups developing/modifying AMG for Shutdown Conditions INPO IER L and IER

45 INPO IER Key Recommendations Implement accident response strategies for an extreme external event with multiple methods to restore and maintain safety functions using a defense-in-depth approach Maintain emergency and accident response strategies and procedures consistent with current industry technical guidance Establish guidance to help prioritize, monitor, and execute critical response actions in the working conditions that may exist following an extreme external event Ensure that personnel can install and operate portable equipment within the time frames necessary to avoid core damage during extreme environmental and other post-event conditions. Extend the coping time using installed equipment to the extent practical and apply human factors techniques to reduce the potential for errors for actions that need to be performed in an urgent manner. Develop strategies for establishing core cooling and critical monitoring functions if DC power is lost during a prolonged loss of all AC power. Develop and validate procedures for venting containment when called for by EOPs/SAMG, assuming normal AC and DC power supplies and air systems are not functional. Establish site and corporate emergency plans that provide clear command and control structures, with defined lines of responsibility and accountability, for implementing response actions throughout the duration of an event. Establish plans for relocating personnel as well as communication and coordination functions to alternate locations during a nuclear accident or external event. Provide emergency responders with the authority to take necessary actions to mitigate the event without the need for external authorization. 45

46 46 Shutdown SAMG Scope of Applicability

47 Shutdown SAMG - Development Process Review the existing shutdown PSAs to gain insights with regard to: dominant accident sequences and initiators, vulnerable plant states, time to boiling, time to core damage, and time to containment failure, consequences of core damage, and the symptoms of severe accident phenomena. 47

48 Shutdown SAMG - Development Process Review the existing emergency operating procedures. The objective of this review is to identify: changes required to EOPs to accommodate shutdown conditions core damage diagnostic criteria for shutdown reactor states conditions for entry into SAMG for accident sequences not covered by Shutdown EOPs Transitions from Shutdown EOPs to SAMG. 48

49 Shutdown SAMG Considerations Traditional methods for determining core damage may not be applicable (RPV water level and Core Exit Thermocouples). Consider indirect indications: Containment radiation Containment hydrogen Ex-core neutron flux Challenges to core damage diagnostics and accident mitigation actions: Whether the RV head has been removed or not Potential loss of automatic start or isolation functions Potential openings in the RCS Status of the RCS injection and containment spray systems Viability of instrument indications Criteria and priorities for the use of available equipment and systems (use for reactor, containment, or SFP) 49

50 Sample PWROG Diagnostic Flow Chart EXISTING At-power SAMG NEW Shutdown SAMG 50

51 51 Example - Koeberg Shutdown AMG

52 52 Example Areva Operating Strategies for Severe Accidents (OSSA)

53 CONCLUSIONS SAMG modified and extended to effectively cover ALL plant operating states for PWRs (Westinghouse, AREVA, and Siemens) and VVER plant designs. BWRs now developing Shutdown SAMG. Plant-specific Shutdown Accident Analyses is a key prerequisite to the success of Shutdown SAMG development. Procedures for Accident Management during shutdown (EOPs, SAMGs for shutdown modes) represent cost effective measures to improve shutdown safety. During shutdown modes, several conditions are favourable with respect to core quenching by alternate Accident Management measures such as mobile equipment. Long time windows Core degradations starts considerably later after fuel uncovery 53

54 CONCLUSIONS Shutdown risk with respect to large early releases is dominated by scenarios with failure to reclose the containment equipment hatches or airlocks To support validation, Operator and TSC training upgrade of Full Scope Simulators is recommended to support high fidelity simulation of Shutdown states, including: low reactor inventory states, open reactor and open containment states, refuelling operations, and Spent Fuel Pool accidents. 54

55 Closing Thoughts Operating experience at Fukushima shows the importance of planning for adverse events when sharing of common equipment may be necessary. This planning can encompass the simultaneous challenges to the reactor core and SFP based on a common initiating event. This planning includes the procedures and criteria that might be used to determine when it may be desirable to switch between two or more destinations (for example, RPV and SFP, two units, two RPV functions). 55