Accidents in nuclear facilities

Transcription

1 2 Accidents in nuclear facilities 62 Scientific and Technical Report IRSN

2 2 Accidents in nuclear facilities FIRST results of the Phebus FPT3 test Study of ruthenium chemistry in the containment building under severe accident conditions newsflashnewsflashnewsflashnewsflashnewsflashnewsflash 2.3 Kick-off FOR CHIP, an experimental program in Grenoble UF 6 behavior in AN accidental release context Studies and experiments to quantify accidental UF 6 release in front-end fuel cycle facilities Study of physical phenomena and consequences associated with criticality accidents ANALYSIS OF THE Mechanical behavior OF containment on CPY 900 MWe PWRs under severe accident conditions newsflashnewsflashnewsflashnewsflashnewsflashnewsflash 2.7 Initial results of the Prisme Door campaign Local-scale thermohydraulics R&D to support LOCA studies A new research program to study fuel assembly behavior at La Hague storage pools in the event of accidental dewatering KEY DATES: Dissertations defended and other major events IRSN - Scientific and Technical Report

3 Accidents in nuclear facilities Michel Schwarz Prevention of Major Accidents An important aspect of the Institute's mission consists of preventing nuclear facility accidents and assessing measures to limit the potential consequences to human health and the environment. These objectives are achieved through missionoriented research programs to improve knowledge of accident phenomena, and through the development of computer codes and assessment methods. Once validated, these tools are used to assess accident risks and analyze the measures taken by operators to manage these risks. IRSN has focused considerable efforts on research in these areas, presented in detail in the following articles. Pressurized water reactor core meltdown accidents, such as the 1979 accident in the US at the Three Mile Island (TMI) nuclear power plant, have been the subject of several research programs in France and throughout the world. Core meltdown accidents are considered highly improbable, due in large part to measures taken since the TMI accident, and they can occur only if several independent safety systems fail. Nonetheless, the potential consequences, namely radioactive release to the environment, justify pursuing research efforts in this area. Three articles have been dedicated to this topic. The first presents results from the final test of the international program Phebus FP (fission products). It highlights the influence of control rod materials on iodine release inside containment. The second article describes research on the behavior of ruthenium in the containment building. Large quantities of this highly radiotoxic element could be emitted during certain accident scenarios, partly in gas form. The third article reports on mechanical simulations of a 900 MWe PWR containment. Serving as the ultimate barrier around a reactor, the containment building prevents radioactive release to the environment. A multiscale approach was used to finely evaluate the strength limits for this structure, a critical component in nuclear safety. A brief article sums up the Chip program that IRSN is conducting in partnership with the CNRS. CHIP focuses on the chemical forms iodine can take during transfer from the degraded reactor core to the containment building, and on the volatility of these iodine species. To control uranium hexafluoride containment in fuel cycle facilities, models are needed to understand dispersion of heavy UF 6 gas, as well as the chemical reactions between UF 6 and steam, which produce caustic hydrofluoric acid. An in-depth article examines progress made in this important area. Another significant risk requiring preventive measures, particularly in fuel cycle facilities, is criticality risk. This phenomenon can occur in fissile material if the geometry and material configuration are 64 Scientific and Technical Report IRSN

4 "critical", triggering an uncontrolled nuclear fission chain reaction. Criticality accidents can result in serious injury, especially for workers in the immediate vicinity. The state of knowledge on criticality accidents is the focus of another in-depth article. A nuclear facility fire can have severe consequences, particularly if safety functions are jeopardized. A brief article presents initial results from the international PRISME research program on fire propagation in confined and ventilated facilities. Spent fuel assemblies are stored in vast pools at the La Hague reprocessing plant. Pool water dissipates the residual heat released by these assemblies. A brief article describes a new research program IRSN is conducting with AREVA, to assess the consequences of a pool dewatering accident. Operator demand for higher fuel burnup and longer cycle times is driving the development of ever more sophisticated computer tools, capable of analyzing the impact of these changes on reactor safety. This is the backdrop to a short article on current R&D at the Institute aimed at developing and validating LOCA assessment tools. IRSN - Scientific and Technical Report

5 2. 1 FIRST RESULTS of the Phebus FPT3 test Béatrice Simondi-Teisseire, Bruno Biard, Jérôme Guillot, Christelle Manenc, Philippe March, Frédéric Payot Experimentations and Measurements of Accidental Releases Laboratory Since the accident in the US at the Three Mile Island Unit 2 (TMI-2) nuclear power plant on March 28, 1979, resulting in partial core meltdown and limited fission product release, a number of experimental safety research programs have been conducted by different organizations around the world. In 1988, IPSN launched Phebus FP, a major international research program on severe water reactor accidents (involving core meltdown). Conducted in the like-named experimental reactor operated by the CEA, Phebus involved a series of integral experiments, reproducing expected physical core meltdown phenomena as realistically as possible. Experimental results from the PHEBUS FP program combined with results from separate effect tests are key to validating the simulation codes used in light water reactor safety analyses [Birchley et al., 2005; Clément, 2003a; Clément et al., 2006; Evrard et al., 2003; Schwarz et al., 1999; Schwarz et al., 2001], in particular ASTEC [Van Dorsselaere et al., 2004], developed by IRSN in collaboration with GRS, as well as the ICARE/CATHARE code. The Phebus FP program consisted of five tests successfully conducted from 1993 to 2004 [Clément et al., 2006]. FPT3 was the fifth and final test, carried out from November 18 to 22, Its specific feature consisted of testing the fuel using the neutron-absorbing boron carbide (B 4 C) material used in 1300 MW PWRs, whereas earlier Phebus tests had employed the silverindium-cadmium (Ag-In-Cd) alloy used in 900 MW PWRs. Raw experimental data collected during the test, and in subsequent non-destructive test campaigns, have been processed and researchers are currently analyzing overall data consistency. This article presents insights gained from FPT3 results [Clément et al., 2005a; March et al., 2006; Simondi-Teisseire et al., 2006], which will be consolidated by non-destructive tests currently underway. Experimental facility In the Phebus facility, experimental conditions are representative of a PWR core meltdown accident [Schwarz et al., 1999; Clément 66 Scientific and Technical Report IRSN

6 Accidents in nuclear facilities 2. 1 PWR 7 Paint 3 Scale = 1:5000 Containment PHEBUS FP Reactor coolant system 1 2 Break Figure 1 The Phebus FP facility. et al., 2003b], appropriate for the study of fuel rod and absorber rod degradation, molten pool formation, and release and transport of degradation products (fission products emitted from the fuel, gases and/or aerosols from fuel rod/absorber rod degradation) in the reactor coolant system and containment. Researchers are particularly interested in iodine behavior, since environmental release of iodine in the days following core meltdown could have considerable radiological impact. ph 5 buffer solution simulating the reactor sump 6 (for technical reasons, the sump represented only 10% of the vessel crosssection in Phebus), a gas containment ( 5 ) and, in the upper part, condensing, cooled, painted surfaces (2) ( 7 ). The cold leg discharges into the open area of the vessel, simulating a break downstream from the steam generator. FPT3 investigated physical phenomena occurring in the following systems: the reactor core ( 1 ), simulated by an assembly comprising 18 fuel rods previously irradiated in the BR3 reactor with burnup of 24.5 GWd/tU, two instrumented rods containing fresh fuel, and a neutron-absorbing boron carbide rod; the fuel rods have Zircaloy cladding and the absorber rod has steel cladding with a Zircaloy guide tube; the reactor coolant system simulated by experimental circuits, consisting of a 700 C hot leg ( 2 ) and a 150 C cold leg ( 4 ), connected by an inverted U-shaped tube 4 m high simulating the steam generator ( 3 ), where a sharp drop in coolant temperature takes place; the containment building, simulated by a 10 m 3 vessel (1) with an electropolished surface, a 120-liter tank at its base filled with These three zones are reproduced at a scale of 1:5000 with respect to a 900 MWe PWR (Figure 1) and are equipped with various instruments to measure flow rate, temperature, radiation (high count-rate gamma spectrometry), concentrations of hydrogen, oxygen, and carbonaceous gases, and to take sequential samples of experimental circuit fluid, containment atmosphere, and sump liquid. Non-destructive measurements were performed in the facility after the test to quantify the gamma emitters retained in the experimental circuit and vessel samples, and to characterize fuel degradation (using X-ray radiography, computed tomography, and gamma spectrometry to establish the γ emitter distribution profile for the rod assembly). (1) Referred to as "vessel" in the rest of this article. (2) Referred to as "condensers" in the rest of this article. IRSN - Scientific and Technical Report

7 2. 1 FPT3 objectives FPT3 objectives can be divided into three groups according to the relevant system: test device, experimental coolant system, and vessel. diffusiophoresis on condensers, and deposition on electropolished vessel walls); any potential FP poisoning effect on catalytic hydrogen recombiners used in nuclear reactor containments. FPT3 test scenario Test device The main objective was three-fold: to obtain substantial degradation in the fuel rods and neutron-absorbing rod, substantial volatile FP release in a low-pressure hydrogen-rich atmosphere, and an overall displaced fuel weight of around 1 kg, of the 10 kg initially present in the rod assembly. Experimental coolant system The main objective was to apprehend emission of fission products from the fuel, gases and aerosols produced by fuel rod and absorber rod degradation, as well as transport and deposition of fission products in the reactor coolant system under low pressure (0.2 MPa). Another objective was to collect data on fission product chemistry, in particular interactions with the walls of high-temperature lines and with carbon and boron compounds produced by B 4 C oxidation. Methane formation is particularly important because it can promote organic iodine formation. To investigate this phenomenon, the FP release phase must be sufficiently long and take place under highly reducing conditions (achieved by transforming nearly all injected steam into hydrogen through oxidation of B 4 C and Zircaloy cladding). Vessel The main objective was to study FP physicochemistry in the hours and days following their emission from the rod assembly, along with the effects of boron and carbon compounds. Researchers focused on iodine radiochemistry in the sump water and vessel atmosphere, using several dedicated instruments. Painted surfaces installed in both the sump and the containment area (condensing cooled painted surfaces) provided a source of organic compounds capable of interacting with iodine. In addition to these objectives, researchers also aimed to characterize: the size of aerosols released in the vessel and the aerosol deposition processes (gravitational settling to vessel bottom, Prior to the actual experimental phase, the test rod assembly was re-irradiated in the Phebus reactor for a period of 8.5 days, to obtain a representative inventory of short-lived fission products (e.g. iodine-131 with a half-life of around 8 days). Re-irradiation was followed by a transition phase (rod assembly drying, limit condition adjustment, and xenon poisoning reduction), lasting around 37 hours. The degradation phase lasted around 5 hours. Experimental circuit pressure was kept at 0.2 MPa and the steam injection flow rate in the lower part of the rod assembly at 0.5 g/s. Power in the rod assembly was increased by successive ramps and plateaus until the degradation objectives were reached, at which point the reactor was shut down. The fuel rod assembly was then cooled for around one hour, followed by isolation of the vessel from the circuit. Between reactor shutdown and the end of steam injection, the hydrogen recombiner coupons were placed in the containment atmosphere for 30 minutes. The experimental phase then moved into a long-term phase lasting 4 days, with three successive stages: an "aerosol" stage lasting around 37 hours, aimed at analyzing aerosol deposition mechanisms in the vessel; a 13-minute washing phase, in which aerosols deposited by gravitational settling on the hemispheric vessel bottom were transferred to the sump; a 2-day chemistry stage, dedicated to iodine chemistry in the sump and containment atmosphere, with particular focus on iodine speciation. Water temperature during this stage was brought to C to favor a representative 0.73 g/s evaporation/condensation cycle between sump and condensers. Main results for rod assembly degradation During the experiment, reactor power was increased gradually (Figure 2). The first plateaus were maintained at low levels to 68 Scientific and Technical Report IRSN

8 Accidents in nuclear facilities 2. 1 Temperature ( C) Calibration Start of test: 11:49:00 (0 s) Duration: 04:49:30 (17,370 s) Reactor shutdown: 16:38:30 (17,370 s) P1 start: 360 s P1 end: 3960 s Cladding failure P2 start: 4260 s P2 end: 7920 s Pre-oxidation Hydrogen first detected: 8440 s Start of oxidation: 9480 s Start of low-steam phase: 10,000 s B 4 C failure P3 start: 8640 s P3 end: 9000 s Oxidation P4 start: 11,100 s P4 end: 15,420 s Plateau P4 Heating Cooling Time (s) - T0: 11h49m00s Hydrogen Insulation mm Insulation mm Core power Fuel mm Fuel mm P4a P4b Start of heating phase: 15,420 s Reactor shutdown: 17,370 s P4c 1 st rise under lower grid 2 nd rise under lower grid Core power (a.u.) / SDHY700 hydrogen (a.u.)/ SDHY700 hydrogen (a.u.) Figure 2 General timeline of FPT3 degradation phase. Start time is set at the beginning of the reactor power ramps. make sure that temperatures reached the expected values. On-line measurements of the rod assembly, experimental circuits, and vessel indicated that the following events occurred: cladding failure, occurring around the rod assembly midplane ( 500 mm) at a temperature close to 800 C, as in earlier tests; absorber rod failure at around 500 mm. Maximum guide tube temperature was roughly 1450 C, at least 100 degrees higher than in earlier tests (which used an Ag-In-Cd absorber rod). CO was first detected in the containment atmosphere a few seconds after absorber rod failure, which is consistent with temperatures measured in the experimental rod assembly. CO 2 entered the vessel later, at the end of the first oxidation phase, once the hydrogen concentration in the experimental circuit had fallen. The concentration of CH 4 was too close to the detection limit to draw any conclusions regarding its formation. the main oxidation phase, occurring shortly after absorber rod failure in the rod assembly midplane, with a maximum rod assembly temperature of 1650 C at 500 mm. As in FPT2, no significant material displacement was detected during the main oxidation phase, in contrast to oxidation during FPT1, which was more violent; displacement of materials, particularly the fuel, beginning in the last plateau and continuing until the start of the subsequent power ramp phase, likely resulting in formation of a small molten pool. Molten material progression in FPT3 was apparently faster and more penetrating than in earlier tests, given that cooled materials were found under the rod support plate during post-test examinations. This could be explained by a lower melting temperature, due to the presence of boron and steel compounds in the U-Zr-O mixture (containing melted Zircaloy cladding and IRSN - Scientific and Technical Report

9 2. 1 dissolved uranium oxide fuel). Total weight of relocated UO 2 was around 1 kg, in agreement with experimental objectives, although it was spread over a greater height than in earlier tests. FPT3 hydrogen production kinetics were similar to FPT2 kinetics, and more gradual than FPT0 and FPT1: the lower steam injection rate around 0.5 g/s in FPT2 and FPT3, as opposed to 2 g/s in FPT0 and FPT1 resulted in slower progression of the Zircaloy cladding oxidation front. Hydrogen production lasted longer, however, leading to a 17-minute period in which the volume concentration of hydrogen in the experimental circuit exceeded 70%. During degradation, Zircaloy and boron carbide oxidation produced 60 moles of hydrogen (52-53 moles from Zircaloy and 7-8 moles from boron carbide). In other words, 73% of Zr and 77% of B 4 C were oxidized during the degradation phase. As in earlier tests, a less-significant oxidation stage occurred in the final rod assembly degradation phase, when materials flowed into the lower part of the assembly. Maximum hydrogen concentration in the experimental circuit reached 20% during this late oxidation stage, which lasted around 13 minutes. As expected, moderate but significant rod assembly degradation was obtained during FPT3, as shown by the X-ray images taken after the test (Figure 3). Main results from experimental circuits and vessel FP emission, transport, and deposition in the experimental circuit For the elements measured to date, overall release from the FPT3 rod assembly was similar to overall release in earlier tests [Clément et al., 2006; Dubourg et al., 2005]. The elements measured can be classified according to overall release: elements released in substantial amounts (around 80% of the initial rod assembly inventory [i.i.]) such as noble gases (e.g. Xe); I, Te, and Cs volatile fission products with a released fraction in the 45-75% range; elements released in low or very low amounts, such as Ba or Zr; around 3% of the initial Ba rod inventory was released, and fractions were much lower for some elements. As in FPT2, the low steam injection rate (0.5 g/s) resulted in significant deposition of volatile fission products (Cs, I, Te, and Mo) in the upper part of the rod assembly. This stands in contrast to FPT0 and FPT1, in which a higher steam injection rate (2 g/s) led to deposits downstream (in the upper plenum above the rod assembly, and in the tube simulating the steam generator). FPT3 also resulted in significant cesium and iodine deposits in the steam generator tube, representing 9.4% of the initial cesium inventory and 7.1% of the initial iodine inventory, a two-fold increase compared to FPT2. Aerosol release was most significant at the end of the first oxidation phase and during the fuel displacement phase. Figure 3 X-ray images of Phebus FP rod assembly before and after FPT0, FPT1, FPT2, and FPT3. Volatile FP transport through the experimental circuit toward the vessel began in the first oxidation phase and ended with reactor shutdown. Xe, I, and Cs entered the vessel at a relatively stable rate throughout the release phase. Te entered the vessel with a significant delay compared to Cs and I. Measurements also indicate that Te was deposited in the hot leg in greater quantities than the other volatile fission products. Mo was only measurable in the tank after the first oxidation phase, suggesting that release was limited in the hydrogen-rich phase and only became significant in the high-steam phase that followed. This is consistent with the fact that oxidized Mo is more volatile than the metal. Noble gases, which did not react with coolant system surfaces, reached the containment atmosphere without being retained in 70 Scientific and Technical Report IRSN

10 Accidents in nuclear facilities 2. 1 the experimental circuit. By contrast, volatile fission products (such as I, Cs, and Te) were released in comparable fractions, around 45-75% of the initial fuel weight, but they reached the vessel in different amounts: 34% i.i. for iodine, 5% i.i. for tellurium, and 31% i.i. for cesium. The fractions measured for FPT2 were much higher: 57% i.i. for iodine, 28% i.i. for tellurium, and 41% i.i. for cesium. For FPT3, the lower Te and Cs fractions carried into the vessel can be attributed to the large deposits of these elements measured in the hot leg, mainly in the vertical line and steam generator for Te, and upstream from the steam generator for Cs. A weight balance must be established prior to any conclusions about iodine retention in the experimental circuits. Aerosol behavior in the vessel The rate of aerosol deposition on condensers in the vessel was similar for FPT3 and FPT2, consistent with similar condensation rates (in the degradation phase and early "aerosol" stage) and involving diffusiophoresis (aerosols entrained by steam condensation on cooled painted surfaces). The rate of aerosol deposition by gravitational settling was lower by a factor of two compared to earlier tests. This can be attributed to smaller aerosol size and/or lower aerosol concentration in the vessel (which reduces aerosol agglomeration and hence size), and/or lower aerosol density. For Cs and Te, however, gravitational settling remained the major aerosol deposition mechanism in the vessel, with around 50-60% of the vessel inventory deposited on the hemispheric bottom. Measurements indicated nonnegligible deposits on the vessel walls, containing around 15% of the I, Cs, and Te weight initially carried into the vessel at the end of the "aerosol" stage, a higher proportion than in FPT2 and FPT1. Iodine behavior in the vessel Around 34% of the iodine weight initially contained in the fuel was carried into the vessel. This is lower than the corresponding fraction in earlier tests [Clément et al., 2006; Girault et al., 2006; Jacquemain et al., 1999]. In FPT3, iodine released in the vessel was mainly in gas form (mean gaseous iodine in the atmosphere of the vessel during degradation was around 80%). The absorber rod (B 4 C in FPT3, rather than the Ag-In-Cd used in previous tests) appeared to have a significant impact on the physicochemical form of iodine released in the vessel. In FPT3 iodine behavior therefore differed significantly from aerosol FP behavior. For example: during the degradation phase, iodine was deposited around three times faster in the vessel than aerosols of the other elements, due to gaseous iodine absorption by the cooled painted surfaces, on which 55% of the iodine weight released in the vessel was deposited; during wash-down, no significant additions of iodine to the sump were measured, indicating that very little iodine was deposited on the hemispheric vessel bottom. This is consistent with the fact that iodine was mainly in gas form during the aerosol sedimentation phase. In the degradation phase, as iodine transport into the vessel began to slow, gaseous iodine measured in the vessel reached a maximum of 13% of the initial rod assembly iodine weight, which is much higher than the maximum values measured in earlier tests [Clément et al., 2006 ; Girault et al., 2006; Jacquemain et al., 1999]. Then, as the aerosol stage began, gaseous iodine fell very rapidly to 0.8% of the initial iodine inventory. This sharp decline suggests that iodine trapping on the cooled painted surfaces was very efficient. A similar decrease was observed in FPT1 and FPT2, but with a lower initial gaseous iodine concentration in the vessel. During the aerosol stage of FPT3, the gaseous iodine fraction continued to decrease until it reached % of the initial rod inventory weight. During the chemistry stage (after aerosols deposited on the hemispheric vessel bottom were washed into the sump), the gaseous iodine fraction decreased from % to a plateau around 0.03% of the rod assembly inventory (compared to 0.01% for FPT2), probably indicating a physicochemical iodine equilibrium inside the vessel. Throughout the experimental phase, the gaseous iodine fraction was predominantly (over 75%) inorganic, as it was in FPT2, in contrast to FPT0 and FPT1, where organic iodine was the major component. FPT3 experimental data do not indicate significant iodine desorption from the vessel walls or condensers during the experimental timescale. Iodine collected in the sump water (ph 5 ± 0.2, 90 C in aerosol stage, 100 C in chemistry stage) was mostly in soluble form throughout the test. The iodine water solubility observed in FTP3 is consistent with the use of the B 4 C rod instead of the Ag-In-Cd rod, which reduces the trapping efficiency of iodine in the insoluble form AgI [Funke, 1996]. Iodine recovered in the sump, estimated at 5.4% of the initial rod inventory weight, resulted mainly from condenser draining. IRSN - Scientific and Technical Report

11 2. 1 Conclusions and outlook In general, FPT3 reached the test objectives satisfactorily [Albiol et al., 2004]. Certain preliminary results deduced from available FPT3 data were unexpected, however, particularly the large gaseous iodine fraction carried into the vessel during degradation (although it quickly dropped within a few hours to produce iodine values similar to those in earlier tests) and the lower-than-expected liquefaction temperature of the U-Zr-O-B-steel mixture (known as "corium"). Further studies [Clément et al., 2005b] are underway, both to provide additional experimental data and to apprehend the physicochemical phenomena behind these results. Researchers are also in the process of transposing the results to reactor conditions, in order to evaluate their impact on the assessment of any radioactive release in an accident situation. References T. Albiol, S. Morin (2004), FPT3 test statement, CPEX/PH/ , Document Phébus IP/04/560. J. Birchley, T. Haste, H. Bruchertseifer, R. Cripps, S. Güntay and B. Jäckel (2005), Phebus-FP: Results and significance for plant safety in Switzerland, Nuclear Engineering and Design, vol. 235, pp P.D.W. Bottomley, P. Carbol, J.P. Glatz, D. Knoche, D. Papaioannou, D. Solatie, S. Van Winckel, A.-C. Gregoire, G. Grégoire and D. Jacquemain (2005), Fission product and actinide release from the Debris bed test Phebus FPT4: synthesis of the Post test Analyses and of the Revaporisation testing of the plenum samples performed at ITU, International Congress on Advanced Power Plants (ICAPP-05), May 15-19, Seoul, Korea. B. Clément (2003a), Summary of the Phebus FP Interpretation status, Proc. 5th Technical seminar on the Phebus FP programme, Aix-en-Provence, France, June B. Clément, N. Hanniet-Girault, G. Repetto, D. Jacquemain, A.V. Jones, M.P. Kissane and P. Von der Hardt (2003b), LWR severe accident simulation: synthesis of the results and interpretation of the first Phebus FP experiment FPT-0, Nuclear Engineering and Design, vol. 226, pp B. Clément, O. De Luze and G. Repetto (2005a), Preliminary results and interpretation of Phebus FPT-3 test, MELCOR Cooperative Assessment meeting, September 20-21, Albuquerque (NM) USA. B. Clément, N. Girault, G. Repetto and B. Simondi-Teisseire (2006), Les enseignements tirés du programme PHEBUS PF, RST IRSN 2006, B. Clément, R. Zeyen (2005b), The Phebus Fission Product and Source-Term international programs, International Conference Nuclear Energy for New Europe 2005, Bled, Slovenia, September 5-8. J.C. Crestia, G. Repetto and S. Ederli (2000), Phebus FPT-4 First post test calculations on the debris bed using the ICARE V3 code, Proc. 4th technical seminar on the Phebus FP programme, Marseille, France, March. R. Dubourg, H. Faure-Geors, G. Nicaise and M. Barrachin (2005), Fission product release in the first two Phebus tests FPT-0 and FPT-1, Nuclear Engineering and Design, vol. 235, pp J.M. Evrard, C. Marchand, E. Raimond and M. Durin (2003), Use of Phebus FP Experimental Results for Source Term Assessment and Level 2 PSA, Proc. 5th Technical seminar on the Phebus FP programme, Aix-en-Provence, France, June F. Funke, G.-U. Greger, A. Bleier, S. Hellmann and W. Morell (1996), The reaction between iodine and silver under severe PWR accident conditions, Chemistry of Iodine in Reactor Safety, Workshop proceedings Würenlingen, Switzerland June, NEA/CSNI/R(96)6. N. Girault, S. Dickinson, F. Funke, A. Auvinen, L. Herranz and E. Krausmann (2006), Iodine behaviour under LWR accidental conditions: lessons learnt from analyses of the first two Phebus FP tests, Nuclear Engineering and Design, vol. 236, pp D. Jacquemain, N. Hanniet, C. Poletiko, S. Dickinson, C. Wren, D. Powers, E. Krausmann, F. Funke, R. Cripps and B. Herrero (1999), An Overview of the Iodine Behaviour in the Two First Phebus Tests FPT-0 and FPT-1, OECD Workshop on Iodine Aspects of Severe Accident Management, Vantaa, Finland, May Ph. March et al. (2006), First results of the Phebus FPT-3 test, Proc. of the 14th International Conference on Nuclear Engineering, July 17-20, 2006, Miami, Florida, USA. M. Schwarz, G. Hache and P. Von der Hardt (1999), Phebus FP: a severe accident research programme for current and advanced light water reactors, Nuclear Engineering and Design, vol. 187, pp M. Schwarz, B. Clément and A.V. Jones (2001), Applicability of Phebus FP results to severe accident safety evaluations and management measures, Nuclear Engineering and Design, vol. 209, pp B. Simondi-Teisseire, B. Biard, J. Guillot, C. Manenc, P. March, F. Payot, C. Gaillard, B. Morassano, M. Pepino (2006), FPT3 Phébus Test: first results on iodine behaviour, Cooperative Severe Accident Research Program (CSARP), September 25-28, Albuquerque (NM) USA. J.-P. Van Dorsselaere et H.-J. Allelein (2004), ASTEC and SARNET, Integrating Severe Accident Research In Europe, Proc. EUROSAFE Forum, Berlin, Germany, Scientific and Technical Report IRSN

12 2. 2 Study of ruthenium chemistry in the containment building under severe accident conditions Christian Mun, Laurent Cantrel Corium and Radioelements Transfer Research Laboratory Context Safety in nuclear power plants is based on defense-in-depth and containment of radioactive materials. A key safety measure to prevent environmental release consists of containing the radioactive products in the reactor core within three successive barriers: the fuel cladding, the reactor coolant system (RCS), and the containment building. A severe accident (SA) has an extremely low probability of occurrence (1), since it implies coolant loss concurrent with partial or total failure of safety systems. Nonetheless, such an event would result in core meltdown and loss of the first two containment barriers, allowing the release of fission products into containment. Ruthenium (Ru) metal, found in nuclear fuel as a fission product, is considered to have low volatility; studies show that the Ru fraction emitted from a UO 2 pellet heated in a mixed oxidizing atmosphere (H 2 O/H 2 ) to around 2300 C (SA reactor core temperature) ranges from 1% to 10% [Ducros et al., 2005; Libmann, 1996]. However, under oxidizing conditions, the metal species oxidizes, releasing greater quantities of far more volatile (1) Level 1 probabilistic safety assessments (PSAs) conducted by IRSN on 900 MWe PWRs (PSA1 900) estimate the probability of occurrence for core meltdown accidents to be 10-5 /year.reactor. Although the probability is very unlikely, core meltdown accidents would have significant radiological consequences, justifying in-depth studies on postulated scenarios and their progression. ruthenium oxides, which may then reach the containment. This explains why ruthenium is of particular concern when studying accidents involving air ingress in the reactor vessel (the most oxidizing accident conditions). Two predominant scenarios resulting in fuel-air contact have been identified (Figure 1). The first scenario involves accidental draining of the reactor pool during refueling, with simultaneous core dewatering [Powers et al., 1994]. The second corresponds to the core meltdown phase that follows failure of the vessel bottom due to corium (molten core materials), where gas (air) circulates between the vessel pit, the reactor vessel, and the RCS break [Seropian, 2003], [Freydier et al., 2006]. In the second configuration, the ruthenium released from the fuel is transported through the RCS, characterized by a strong thermal gradient, before reaching the containment. Recent experimental studies indicate that a fraction of the ruthenium is not trapped in the coolant system; the rate of trapping, or retention, varies according to the species transported and the thermal gradient involved, which in turn depends on where the break is located. Ruthenium can take gaseous forms, such as ruthenium trioxide (RuO 3 (g)) and ruthenium tetroxide (RuO 4 (g)), along with condensed forms such as RuO 2. It may also be contained in mixed aerosols (e.g. Cs 2 RuO 4 ). Other accident types involving fuel-air contact mainly spent fuel handling and transport accidents or accidental draining of a spent fuel storage pool can result in Ru metal oxidation IRSN - Scientific and Technical Report

13 2. 2 Air ingress following failure of vessel bottom Air ingress following an accident causing dewatering of reactor vessel Break Degraded rods Air Vessel breach Figure 1 Severe accident scenarios with air ingress in the reactor vessel. (in the presence of oxygen), depending on the temperature reached. Finally, ruthenium release was also detected during high-level waste vitrification in a spent fuel reprocessing plant. RuO 4 (g) formation during the process is postulated (HEPA filters (2) do not retain RuO 4 (g)). Purpose Ruthenium is a fission product with high radiotoxicity, mainly due to the isotopes 106 Ru (T 1/2 =369 d) and 103 Ru (T 1/2 =39.3 d). This makes ruthenium a significant radiocontaminant in the short and medium terms (as recognized by a French decree published in 2003). If Ru particles were accidentally disseminated in the environment, their high specific activity could lead to considerable external irradiation [Pöllänen, 1997]. Moreover, the risk of internal exposure cannot be overlooked, since volatile ruthenium species (typically RuO 4 ) could be inhaled. Significant amounts of ruthenium are formed during nuclear reactor operation (essentially by direct fission of 235 U and 239Pu). These amounts increase in proportion to fuel burn-up. In addition, ruthenium content is higher in MOX fuel than in conventional UO 2 fuel. Gradual adoption of MOX fuel and the trend toward higher burn-up rates could increase the amount of ruthenium formed over the fuel's lifetime. (2) High-efficiency particulate air filter. Scientific approach Ruthenium behavior, poorly modeled at present, is the focus of an R&D program included in the European SARNET [2007] excellence network. While IRSN deals with ruthenium behavior in containment, other network partners (VTT, AEKI, CEA, etc.) are conducting experimental studies on ruthenium release and transport in the reactor coolant system. The ultimate goal of all these programs is to supplement the experimental knowledge base needed to develop and validate models for the ASTEC integral code [Van Dorsselaere et al., 2005]. Regarding the IRSN program, a literature review revealed a lack of quantified data on RuO 4 gas phase stability and on behavior of the oxides RuO 2 (c) and RuO 4 (g) in radiolytic conditions. It also highlighted uncertainties, or even contradictions, concerning interactions between the gaseous tetroxide and containment surfaces (316L stainless steel or epoxy paints). This absence of relevant data in the literature [Mun, 2007] led researchers to conduct an in-depth experimental and theoretical study of ruthenium chemistry in severe accident containment conditions, focusing particularly on RuO 2 and RuO 4. Study parameters included a temperature range of C, moist or dry atmosphere, and more or less oxidizing conditions. With regard to RuO 4 (g) reactivity with steel surfaces, a number of papers have been published and several hypotheses advanced concerning reduction of RuO 4 deposited on steel. Questions remain, however, as to the exact nature of such deposits. There is also a total lack of information on interaction between ruthenium tetroxide and epoxy paint. And yet this is a key point, given the very large number of painted surfaces in the containment. 74 Scientific and Technical Report IRSN

14 Accidents in nuclear facilities 2. 2 In addition, the various reactions between ruthenium dioxide and air radiolysis products suggest that deposits of RuO 2, for example, could undergo significant oxidation, leading to gaseous tetroxide formation, with partial pressures potentially reaching 10-7 to 10-5 bar [Mun et al., 2006]. Oxidation of ruthenium species in the containment sump water is also conceivable, to the extent that radiolysis, as induced by suspended or dissolved fission products, can transform the water into an oxidizing medium. The sump would then constitute a potential source of volatile ruthenium (typically RuO 4 ). IRSN aims to gather enough information to be able to assess releases of RuO 4 (g) to the environment. Potential release pathways include natural containment leakage, pathways related to the French procedure of controlled and filtered containment venting (known as "U5"), and the ground in the case of basemat melt-through. Study outcomes Study of RuO 4 (g) "stability" Although gaseous ruthenium tetroxide is often described as "unstable", its stability must be evaluated at a severe accident timescale, i.e. during the first 24 hours and thereafter. For this purpose, a reliable and reproducible method of generating pure ruthenium tetroxide crystals was developed, since this compound is not available commercially. Experimental results show that RuO 4 (g) decomposition is slower than would be expected, based on the few indications given in the literature. Thus, in conditions representative of containment during a severe accident, i.e. at 90 C and in the presence of steam, half-life time for the gaseous tetroxide is around five hours. Furthermore, decomposition does in fact appear to follow a first-order rate law relative to the RuO 4 concentration, as predicted by certain authors [Ortins de Bettencourt et al., 1969; Debray et al., 1888], although their results were obtained under very different conditions. Regarding substrate interactions, the results contradict other findings in the literature, showing that RuO 4 (g) has no special affinity with ferrous substrates or epoxy paints. In fact, the type of substrate has no influence on gaseous tetroxide decomposition kinetics [Mun, Cantrel et al., 2007]. Finally, the tetroxide decomposition reaction is accelerated by the presence of steam and deposits of ruthenium oxides (RuO 2 or similar compounds), which act as catalysts. Ruthenium deposit surface characterization X-ray photoelectron spectroscopy (XPS) was used to analyze the interactions between RuO 4 deposits and the two PWR (3) containment substrates. The findings led to the following conclusions: there is strictly no difference in the types of ruthenium species found in deposits on epoxy paint and stainless steel; there are no chemical bonds linking the deposited ruthenium to the paint polymer or the iron oxides; in other words, no chemical reaction takes place at the deposit surface. The XPS spectra also established that the species deposited on the two containment substrates were similar to those detected in the commercially available reference sample of hydrated ruthenium dioxide. Analysis of the Ru3d and O1s orbitals indicated that hydroxylated forms of Ru(IV), e.g. RuO(OH) 2, made up most of the Ru deposits (at least at the outermost surface, i.e. 10 nm). They are the only species whose presence can be explained in both the commercial hydrated Ru dioxide reference powder and the experimental samples [Mun, Ehrhardt et al., 2007]. These results, coupled with the RuO 4 (g) stability results, led researchers to conclude that ruthenium tetroxide decomposition is a direct gas phase process, followed by condensation of the reaction products on painted surfaces, rather than an adsorption process. Using XPS analysis to elaborate on the rare indications in the literature, researchers were able to propose an overview of RuO 4 (g) decomposition reactions (Table 1). Ru deposit oxidation study The stability of containment ruthenium deposits in accident conditions, i.e. in a partially oxidizing environment, was investigated using two approaches: tests without irradiation, using an ozone generator to determine Ru deposit oxidation kinetics constants under the effect of ozone; radiolytic tests conducted in an irradiation facility (EPICUR, an ICPE (4) delivering a dose rate of around 4 kgy/h, Figure 2), aimed at realistically reproducing physicochemical containment conditions during an accident, particularly the inventory of radiolysis products (OH, O 3, etc.). (3) Pressurized water reactor. (4) ICPE : Facilities classified for environmental protection. IRSN - Scientific and Technical Report

15 2. 2 Reactions Steps Speed RuO 4 (g) RuO 3 (g) + 0,5 O 2 RuO 4 (g) + H 2 O(g) H 2 RuO 5 Initiation Slow Fast RuO 3 (g) 0.5 Ru 2 O O 2 H 2 RuO Ru 2 O 5,2H 2 O O 2 First reduction +VI +V +VIII +V Slow Medium RuO 3 (g) + RuO 2 Ru 2 O 5 Catalytic effect of RuO 2 Fast Ru 2 O 5 2 RuO O 2 Ru 2 O 5,2H 2 O + 2 H 2 O 2 (RuO 2,2H 2 O) O 2 Final reduction +V +IV? +V +IV? RuO 2 + H 2 O(g)amb. RuO(OH) 2 RuO 2,2H 2 O + H 2 O(g)amb. RuO(OH) 2 + 2H 2 O Surface hydroxylation by steam in the environment? Table 1 Analysis of RuO 4 (g) decomposition, with and without steam (5). The first qualitative study, involving the ozone generator, revealed revolatilization of ruthenium oxide deposits in the 40 C-90 C temperature range, in both dry and moist air. Revolatilization was induced by the oxidizing effect of O 3 on active Ru deposit sites, producing RuO 4 (g). Irradiation cell The same oxidation reaction was also detected in radiolysis tests, under the same temperature and humidity conditions. Thus, it was experimentally shown that temperature and humidity represent two key factors, whether or not ionizing radiation is present. More specifically, increasing these two parameters clearly favors the oxidation reaction. The strong effect of an increased humidity rate is assumed to be attributable to the hydroxyl radical (OH ), an extremely powerful oxidant with one electron. Based on the ozonation tests, an oxidation rate law for the ruthenium deposits was proposed: [ RuO ] d dt Where: 4 (g) = n (Ru ) ( k + k X(H O) ) dep [O ] 3 H 2O 2 V O k O3 and k H2 O: oxidation kinetics constants related to the action of O 3 and H 2 O(g) (l.mol -1.s -1 ) X(H 2 O): molar fraction of steam (5) This study refers to two distinct "types" of water vapor: the first, H 2 O(g), present in the system during stability tests with humidity; and the second, H 2 O(g) amb., produced after exposure of the samples (ruthenium depots on steel or painted substrates) to ambient air (following stability tests). 3 Glove box (used only during irradiation tests on iodine samples) Figure 2 n(ru dep ): quantity of ruthenium forming the deposit (mol) V: volume (l) [O 3 ]: ozone concentration (mol.l -1 ) The oxidation reaction is a first-order reaction with respect to [O 3 ] and [H 2 O]. Irradiator ( 60 Co sources) View of EPICUR facility (IRSN/DPAM/SEREA, Cadarache center). Based on the rate laws established during the study without irradiation, but nonetheless in the presence of radiolysis products (from O 3 ) (RuO 4 (g) decomposition and oxidation of the deposits forming RuO 4 (g)), the Ru fractions revolatilized under irradiation were calculated, then compared with the experimental irradiation results obtained in EPICUR. The calculated fractions are under-estimated by one order of magnitude. Therefore, oxidation is enhanced under γ-radiolysis, 76 Scientific and Technical Report IRSN

16 Accidents in nuclear facilities 2. 2 as compared to the ozonation tests; this is explained by the predominant role of the O. and/or OH. radicals. During the γ-radiation tests, additional quantities of these radicals were produced directly by air and steam radiolysis. Although this research focused primarily on gas phase ruthenium chemistry, aqueous solutions of ruthenium (in the form of perruthenate: RuO - 4 ) were irradiated in a few exploratory tests, to determine whether volatile ruthenium tetroxide could be formed from an aqueous phase subjected to radiolysis. Initial results revealed formation of RuO 4 (g). Depending on the experimental conditions, the revolatilized Ru fractions can reach values of around 12%. However, at this stage, the influence of key parameters such as ph, temperature, and the integrated γ dose has yet to be determined and quantified. Investigations will be pursued by IRSN in First evaluation of Ru releases Based on the experimental results detailed above, a kinetic model of RuO 4 (g) decomposition and volatile tetroxide formation via Ru oxide deposit oxidation was proposed and implemented in ASTEC [Van Dorsselaere et al., 2005], the benchmark European code for severe accident simulation. A "reactor case" simulation for a 900 MWe PWR was then carried out using realistic boundary conditions (thermohydraulic parameters, dose rates, etc.). The simulated accident scenario was an H2 sequence (6), involving reactor vessel failure followed by air ingress, with the ruthenium fraction released in the containment estimated at 10%. Several simulations were run to study the sensitivity of certain parameters (dose rate, amount of corium). The results of one of the "reactor" simulations (7) are shown to illustrate this approach. Figures 3 to 5 respectively show the mass of ruthenium in the form of RuO 4 (g) inside containment, the massof ruthenium deposited on the inner walls, and the mass of ruthenium released to the environment as RuO 4 (g). Gaseous ruthenium releases in this simulation were on the order of a few grams (Figure 5); similar values were obtained in the other simulations, despite differing initial conditions. The sensitivity study highlighted the following trends: dose rate plays an important role in volatile Ru formation, and decreasing it by a factor of 2 results in a two-fold drop in ruthenium releases; a two-fold increase in the corium mass pouring from the reactor vessel into the reactor pit results in a clear reduction of release by a factor of 6. While at first surprising, this outcome is explained by the indirect effects of containment temperature and pressure. With the doubled corium mass, the mean containment temperature increases (by around 30 K), with a correlative increase in RuO 4 (g) decomposition. Additionally in this case, Ru (kg) 6 Figure Ru (kg) H2 sequence t (s) Gaseous ruthenium tetroxide (RuO 4 ) Mass of Ru in containment as RuO 4 (g) H2 sequence Ru 1 Ru (6) The H2 sequence results in the combined loss of the normal steam generator (SG) feedwater system and the emergency SG feedwater system. (7) Simulation run with the following initial conditions: a dose rate of 10 kgy.h -1 prior to the U5 procedure (controlled and filtered containment venting), and a corium weight of 82 tons. The U5 procedure is implemented at 2.5 days. Figure 4 Mass of Ru deposited on walls t (s) Ru deposited on containment walls IRSN - Scientific and Technical Report

17 2. 2 Ru (g) Ruthenium released to environment 1 Ru t (s) Environment Conclusions and outlook With regard to gaseous phase ruthenium chemistry, this research identified the key reaction parameters and opened the way for model development. Applied to the "reactor case", the models indicate non-negligible ruthenium release, the radiological impact of which remains to be quantified. These models are currently being integrated in the MER (8) for PSA2 (9) studies. Research on ruthenium behavior will be pursued at IRSN and in the SARNET [2007] program in order to reduce experimental uncertainty associated with ruthenium gaseous phase chemistry, and to broaden knowledge of aqueous phase ruthenium chemistry in the presence of γ radiation. These objectives coincide with the priorities set by the SARNET committee of experts. Figure 5 Mass of Ru released to environment as RuO 4 (g). (8) Release assessment model. (9) Level 2 probabilistic safety assessment. steam partial pressure is less than 0.2 bar on average, which also favors a decrease in the gaseous tetroxide production rate. 78 Scientific and Technical Report IRSN

18 Accidents in nuclear facilities 2. 2 References h. Debray, A. Joly, Compte rendu des séances de l académie des sciences, 1888 (106) : p Décret relatif à la protection des travailleurs contre les dangers des rayonnements ionisants, n , paru au J.O. n 78 du 02/04/ G. Ducros, Y. Pontillon, P.P. Malgouyres, P. Taylor, Y. Dutheillet. Ruthenium release at high temperature from irradiated PWR fuels in various oxidising conditions; main findings from the VERCORS program. in Nuclear Energy for New Europe Bled (Slovenia). P. Freydier, J.L. Rousset, Evaluation of Air Ingress in the Reactor Vessel with the SATURNE Code. SARNET-ST-P19. EdF n HI-83/05/006/A J. Libmann, Éléments de sûreté nucléaire. Les éditions de physique IPSN C. Mun, Étude du comportement du produit de fission ruthénium dans l enceinte de confinement d un réacteur nucléaire, en cas d accident grave. Thèse univ. Paris XI C. Mun, L. Cantrel, C. Madic, A Review of Literature on Ruthenium Behaviour in Nuclear Power Plant Severe Accidents. Nuclear Technology, (3): p C. Mun, L. Cantrel, C. Madic, Study of RuO 4 Decomposition in Dry and Moist Air. Radiochimica Acta, (11): p C. Mun, J.J. Ehrhardt, J. Lambert, C. Madic, XPS Investigations of Ruthenium Deposited onto Representative Inner Surfaces of Nuclear Reactor Containment Buildings. Applied Surface Science, (18): p A. Ortins de Bettencourt, A. Jouan, Volatilité du ruthénium au cours des opérations de vitrification des produits de fission (2 e partie). Rapport CEA-R-3663 (2). 1969: CEN de Fontenay-aux-Roses. R. Pöllänen, Highly radioactive ruthenium particles released from Chernobyl accident: Particles characteristics and radiological hazard. Radiat. Protec. Dos., 1997 (71): p D. Powers, L.N. Kmethyk, R.C. Schmidt, A review of the technical Issues of air ingression during severe reactor accidents. NUREG/CR C. Seropian, Analysis of the potential for in-vessel air ingress during a severe accident in a PWR 900 MWe. Note technique IRSN/DPAM/SEMIC/LEPF. 03/01/2003. J.P. Van Dorsselaere, J.C. Micaelli, H.J. Allelein. ASTEC and SARNET. Integrating severe accident research in Europe. in ICAPP (15-19 mai). Séoul (Corée) IRSN - Scientific and Technical Report

19 newsflashnewsflashnewsflashnewsflashnewsflashnewsflash 2.3 Kick-off FOR CHIP, an experimental program in Grenoble Marie-Noëlle Ohnet, Didier Jacquemain Separate Effect Test Programs Laboratory Benoît Durville, Christophe Marquie Experimental Equipment and Instrumentation Engineering Laboratory (1) USNRC, AECL, PSI, Suez/Tractebel, the European Commission. (2) Process and Materials Science and Engineering Laboratory, CNRS UMR 5266, INPG, UJF, Saint- Martin d Hères. (3) ASTEC: Accident Source Term Evaluation Code. Phebus FP experiments on PWR core meltdown demonstrated that reactor accident simulation codes do not take into account the fact that a significant portion of iodine emissions in the containment are released in a gaseous state. This may entail a greater risk of iodine release to the environment in the event of a reactor accident. In partnership with CEA, EDF, and other international organizations (1), IRSN has launched a research program aimed at generating experimental data on thermodynamic and kinetic constants for chemical reactions between the main elements in the reactor coolant system that could influence the volatile iodine fraction fuel is transported during an accident. The experimental facility developed for CHIP (a separate-effect test program on reactor coolant system iodine chemistry in accident conditions) was developed and coupled to a hightemperature mass spectrometer provided by CNRS/SIMaP-Grenoble (2). More than 20 subcontractors contributed to the development of this complex system, featuring over 600 miniaturized components a success crowning two years of fruitful cooperation between engineering project managers and research scientists. The first thermokinetic studies in the reactor began in April 2008 and will continue into Experimental results will be used to validate the ASTEC safety code (3) developed by the Institute, while aiming to reduce uncertainty in iodine source term assessments. Figure 1 Thermokinetic reactor. Figure 2 Instrumented furnace column. (reactor heating) 80 Scientific and Technical Report IRSN

20 2. 4 UF 6 behavior in an accidental release context Studies and experiments to quantify accidental UF 6 release in front-end fuel cycle facilities Abdalkarim Abbas, Cyril Huet Nuclear and Radiological Emergency Management Unit A common interest program on UF 6 behavior in accidental release contexts was conducted from 1998 to 2006 to achieve a better understanding of the consequences of environmental dispersion of UF 6 and its hydrolysis products. This program, conducted by IRSN, was co-funded by three operators: AREVA NC, Eurodif, and FBFC Romans. Uranium hexafluoride (UF 6 ) is the most volatile uranium-bearing compound. It is used in the front end of the nuclear fuel cycle, during the conversion, enrichment, and fabrication stages. UF 6 reacts violently with water, particularly steam, producing solid uranyl fluoride (UO 2 F 2 ) and gaseous hydrofluoric acid (HF). The environmental consequences of a UF 6 accident depend primarily on the chemical toxicity of UF 6 and HF, in addition to the radiotoxicity of uranium. Accidents involving UF 6 release represent a significant risk, which nuclear operators take into consideration when establishing safety practices and emergency plans for their facilities. But UF 6 behavior in an accidental release situation is poorly understood. The various assumptions currently used to quantify UF 6 release are associated with considerable uncertainty, which is particularly unsatisfactory for safety assessment purposes. This observation provided sufficient motivation to justify the UF 6 common interest program. The first step in this research program was to review current knowledge on UF 6 properties. Researchers focused on data relevant to accident situations involving UF 6 release. Conclusions from this review were used to define the various research topics investigated subsequently by the common interest program. Research topics UF 6 behavior in an accidental leak situation is complex because it involves several interacting physicochemical phenomena (Figure 1). For example, liquid UF 6 (the worst-case scenario for accident situations and the most complex in terms of the phenomena involved) is an unstable compound in ambient pressure and temperature conditions. Accidental containment loss on a container of liquid UF 6 stored in hot, pressurized conditions leads to rapid decompression of UF 6. This results in equivalent proportions of UF 6 in solid and vapor form, which behave very differently. Depending on the ambient thermodynamic conditions, the solid may sublimate and the vapor recrystallize. UF 6 vapor reacts violently with moisture in the air, producing HF vapor and UO 2 F 2 aerosols. The aerosols may then be deposited in the location where leakage occurred, and may IRSN - Scientific and Technical Report

21 2. 4 UF 6 gas, HF gas, and UO 2 F 2 solid released to environment via ventilation system or direct leakage UO 2 F 2 solid retained on HEPA filters, filter efficiency impaired after exposure to HF Moist air UF 6 gas + H 2 0 UF 6 gas + UO 2 F 2 solid + HF gas Heat UF 6 gas hydrolysis UO 2 F 2 solid deposition UF 6 Liquid UF 6 gas UF 6 solid + UO 2 F 2 solid UF 6 gas dispersion UF 6 phase distribution UF 6 liquid decompression Sublimation / recrystallization UF 6 release Figure 1 Process of accidental UF 6 release in a ventilated enclosure. be retained by ventilation system filters in the facility where the accident occurred. The filters may be damaged, however, due to the acidity of the HF gas. To make the most realistic impact assessment, the amounts of uranium and HF released to the environment must be determined, taking into account all the phenomena mentioned above. The common interest program comprised tests and studies aimed at expanding knowledge of the various phenomena involved in the accident process, in order to improve release assessment. The research focused on phase transitions, particularly sublimation, and on dispersion of UF 6 (a heavy, very reactive gas) inside an enclosure, UO 2 F 2 aerosol deposition, and the strength of filters exposed to HF. Results of the UF 6 common interest program Evaluating sublimation Scope Phase transitions are central to assessing the consequences of an accident involving UF 6. A key issue is the fate of solid UF 6, which forms after accidental leakage of liquid UF 6. According to current assumptions, solid UF 6 does not influence accident consequences once deposited and, in particular, does not sublimate. The study aimed to acquire the knowledge and tools necessary to evaluate solid UF 6 sublimation, for conditions representative of the accident situations taken into consideration in emergency plans. Approach The literature review yielded neither the data nor models needed to assess solid UF 6 sublimation kinetics and quantities in an accident situation. Consequently, researchers decided to develop a sublimation model and validate it experimentally. Sublimation model The model was developed by adapting Acacia [Ducruet et al.] to UF 6. Acacia is a model developed by IRSN to study evaporation/condensation-induced changes in the size of a free-falling water droplet in a facility with variable relative humidity, representative of nuclear reactor containments. The resulting model is based on calculating heat and material exchanges between solid UF 6 and the atmosphere, occurring via a solid/ vapor interface. Transfer coefficients were determined from the system's thermodynamic and air flow conditions (solid interface atmosphere). Phase transition kinetics were based on a series of equilibrium states (quasi-static model). Developing this model also helped identify the various parameters influencing the sublimation process, in particular the temperature inside 82 Scientific and Technical Report IRSN

22 Accidents in nuclear facilities 2. 4 the enclosure, UF 6 partial pressure, the size and shape of solid UF 6, and air flow conditions around the solid. Experimental validation Validation tests were conducted with simulants, such as dry ice, using the Bise test bench [Gelain, 2004], located at IRSN's Saclay site. This test bench creates a perfectly controlled air flow around a sample. CO 2 concentration in the air circulating around the sample was measured to evaluate the sublimation rate for dry ice. Results showed satisfactory agreement between measured sublimation rates and laws used in the model, thereby validating the model. The tests were also used to reproduce the influence of various model parameters, such as sample size and air flow rate around the sample. Iodine sublimation tests rounded out the study, confirming the influence of partial pressure on sublimation. Computation results Once validated, the sublimation model was used to quantify the degree of sublimation in situations representative of accidents considered in emergency plans. In all cases, computation shows that the fraction sublimated in a few hours is considerable, and in certain cases is even complete, thereby confirming that sublimation cannot be ignored in assessing the consequences of an accident involving UF 6. A sensitivity study on the various influential parameters quantified their impact on the sublimation rate. Some of these parameters could change considerably during accident progression, such as the gaseous UF 6 concentration, which depends on dispersion of the gas in the building where the accident has taken place. The common interest program examined this specific phenomenon, discussed below in the Study of gaseous UF 6 dispersion in a ventilated enclosure below. Assessment tool The sublimation model was implemented in SUBLI_UF 6. This tool was developed to take into account all phenomena affecting the influential parameters in the model, such as gaseous UF 6 dispersion in the enclosure and hydrolysis. Study of gaseous UF 6 dispersion in a ventilated enclosure Scope According to the current assumption, gaseous UF 6 distribution is homogeneous throughout the enclosure. Gaseous UF 6 has a high density (d = 12 g/cm 3 ) and could be emitted at very high concentrations in the event of accidental release. Under these conditions, gravitational effects can lead to stratification, in turn producing large concentration gradients. Gravitational effects can also strongly influence hydrolysis, which depends on: the quality of the mixture between gaseous UF 6 and moist air; sublimation, a function of the concentration of near-solid UF 6 ; and UO 2 F 2 aerosol deposition in the enclosure, which depends on the height of aerosol formation. This study aimed to improve characterization of UF 6 vapor dispersion in a ventilated enclosure by integrating the gravitational effects of this high-density gas. Approach Full-scale tests are usually required for experimental characterization of heavy gas dispersion. The nature of gaseous UF 6, however, rules out large-scale tests, given the necessary measures that must be taken to prevent the risk of environmental release. Researchers thus opted to model gaseous UF 6 behavior using a multidimensional computer tool. The first step was to select one of the commercially available numerical tools and assess its ability to simulate gravitational effects, which were characterized experimentally using a chemically inert simulant. The physicochemical properties of UF 6 were then integrated in the numerical model so that researchers could conduct a multidimensional simulation campaign for conditions representative of accidents involving UF 6 release. Selection and experimental validation of a multidimensional tool Although several commercially available multidimensional tools were evaluated, only CFX-5 [Ansys, 2003] met the requirements. The validation tests were conducted in two enclosures with different volumes (36 m 3 and 1500 m 3 ), at the IRSN Saclay site. Sulfur hexafluoride (SF 6 ) was used, given its high density (d = 5 g/cm 3 ). The tests examined 19 different configurations: 15 for the 36-m 3 enclosure and 4 for the 1500-m 3 enclosure. A large majority of these configurations showed strong stratification of the gas, with high floor-level concentrations as soon as injection began. Time-dependent changes in concentration levels were mainly linked to gas injection characteristics. High injection rates were experimentally observed to favor dispersion of the gas. Although injection remained the predominant dispersal mechanism, mechanical ventilation had a more pronounced effect in the 1500-m 3 enclosure. Hence, SF 6 stratification was less pronounced for spaces with greater volume. The two experimental enclosures were modeled using CFX-5, following a sensitivity study on the selected mesh. All tests were then simulated, and agreement with experimental results IRSN - Scientific and Technical Report

23 2. 4 [SF 6 ]ppm [SF 6 ]ppm B M H t(s) t(s) Figure 2 Changes in SF 6 concentrations calculated and measured experimentally at different heights in the 36-m 3 enclosure. H, M, and B respectively represent measurement heights of 2.50 m, 1.50 m, and 0.55 m, for an enclosure height of 3 m. was generally satisfactory, as shown by the comparative example in Figure 2. More specifically, the simulated injection ranges were in good agreement with test results; SF 6 stratification and the concentration levels reached at various measurement points were clearly reproduced in the simulations, even though the code had a slight tendency to over-estimate them. In addition, the time-dependent changes in SF 6 concentration were not always accurately simulated; the decrease in concentration level was generally faster in tests than in simulations. Based on these results, simulation of gravitational effects by CFX-5 was considered satisfactory enough to pursue this approach [Bouilloux et al., 2006]. Applying the model to UF 6 Researchers adapted the numerical model to UF 6 by integrating thermodynamic and physicochemical properties of the compound, in particular the exothermic hydrolysis reaction. A simulation campaign was defined to characterize the effects of gaseous UF 6 stratification on UF 6 hydrolysis as well as on solid UF 6 sublimation and UO 2 F 2 formation height, a data item required to assess deposition. Simulation parameters included orientation of the injection stream (vertical, horizontal), total amount of UF 6 emitted in the enclosure, and air renewal rate in the enclosure. Results and assessment tool applications Effect on hydrolysis Simulation results show that regardless of configuration, the simulated hydrolyzed fraction always exceeds 80% of the maximum hydrolysable fraction, determined by considering all available water vapor. These results are related to the strong reactivity of UF 6 and the air circulation ensured by the ventilation system in the enclosure. The simulations confirm that assuming homogeneous gas distribution in the enclosure is acceptable. This assumption has thus been integrated as an operational rule in SUBLI_UF 6. Effect on sublimation The concentration (or partial pressure) of UF 6 as it nears the solid phase is a parameter that influences sublimation. The higher its value, the lower the sublimation rate (which falls to zero when saturating vapor pressure is reached). Simulation results show that UF 6 concentrations near the ground are very high during the injection phase, and then decrease rapidly. Figure 3 illustrates that maximum concentration (7%) is reached at the end of injection (120 s), followed by a rapid drop (under 4% at 180 s). The test configurations resulted in concentrations that could reach nearly 30% at the end of injection, before decreasing rapidly. The operational criterion for integrating the effect of UF 6 stratification on sublimation assumes that no sublimation occurs in the enclosure during the injection phase and part of the drop-off phase, with injection lasting up to 20 minutes in the accident situations considered for emergency plans. This criterion remains to be integrated in SUBLI_UF 6. Effect on UO 2 F 2 aerosol deposition The height at which UO 2 F 2 aerosols are formed is a parameter required to evaluate deposits in the enclosure. By default, this height is set to the enclosure height, a conservative assumption for release 84 Scientific and Technical Report IRSN

24 Accidents in nuclear facilities 2. 4 UF 6 mass fraction (Volume 1) UF 6 mass fraction (Volume 1) s s UF 6 mass fraction (Volume 1) s UF 6 mass fraction (Volume 1) s Figure 3 Changes in concentration near the ground when UF 6 is injected for 120 s. assessment. The simulations indicate that beyond a certain height, the UF 6 concentration becomes very low; elsewhere it remains relatively homogeneous within the horizontal planes and shows a strong correlation to the UF 6 injection characteristics (Figure 4). For vertical injection, the height at which UF 6 concentration starts to decrease considerably is close to the injection height (below enclosure height). The Baines semi-empirical law can be used to evaluate injection height, which could in turn be used to estimate UO 2 F 2 deposition. For cases of non-vertical injection, the simulations show that the height of near-zero UF 6 concentration is lower than for vertical injection, and close to the exhaust outlet height. Consequently, depending on the case, several UO 2 F 2 formation heights can be used: enclosure height, for configurations where the atmosphere is relatively homogeneous, or for a conservative simulation of release; injection height, for vertical injections, estimated using the Baines law; exhaust outlet height, for other cases. UO 2 F 2 aerosol formation height must be known to use the deposition charts presented in the following section on UO 2 F 2 behavior. Characterization of UO 2 F 2 behavior Scope Hydrolysis of gaseous UF 6 produces l UO 2 F 2 aerosols, which may be deposited in the building where the accident has occurred. Until now, the assessment of accident consequences involving UF 6 has not taken this deposition into account, thereby ensuring conservative assessments. Data on UO 2 F 2 characteristics, including particle size, are, however, available in the literature, and deposition computer codes exist as well. Researchers thus set out to examine the conservative quality of this assumption. Approach The approach adopted was based on three objectives: to quantify deposition for conditions representative of accidents considered in emergency plans, using data from the literature and computer codes at IRSN; to identify the predominant deposition IRSN - Scientific and Technical Report

25 2. 4 UF 6 mass fraction mechanisms; and if necessary, to propose a simple tool to evaluate the deposit inside an enclosure UF 6 mass fraction UF 6 mass fraction Figure 4 UF 6 concentration in the enclosure at the end of injection. Evaluation of UO 2 F 2 deposit UO 2 F 2 is a very hygroscopic aerosol whose characteristics depend to a great extent on how the aerosol was formed (UF 6 hydrolysis). These characteristics could potentially change as the aerosol circulates within the facility or the environment, for example, following a reaction between the aerosol and humidity in the air. Nonetheless, after reviewing the literature, researchers were able to define characteristics they considered representative of the aerosol. More specifically, particle size is well represented by a log-normal distribution. The mass median aerodynamic diameter (MMAD) falls within a range of 1-10 µm, which can be reduced to 2-8 µm if the most frequent values in the literature are considered. Finally, the geometric standard deviation for the log-normal distribution varies from 1.5 to 2 and the density of UO 2 F 2 is around 4. Based on these data, a study was conducted using AEROSOLS_B2 [Gauvain et al.], for conditions representative of accidents considered in emergency plans. The main deposition phenomena (gravitational settling, Brownian diffusion, thermophoresis, and diffusiophoresis) and particle agglomeration phenomena (gravitational, Brownian, and turbulent coagulation) were taken into account. The simulations indicate that settling is the predominant deposition mechanism. Wall deposits by thermophoresis, diffusiophoresis or Brownian diffusion are negligible, regardless of the accident scenario considered. The aerosol characteristics (MMAD and particle size distribution) are major parameters in determining what portion of the aerosol will be deposited. For the characteristics considered, this study shows that deposition can be very significant in certain situations, and overlooking it amounts to a very penalizing or even unrealistic assumption. This pointed to the need for a simple assessment tool. Figure 5 HEPA filtering material exposed to HF. Assessment tool Using AEROSOLS_B2, researchers developed a tool for evaluating UO 2 F 2 deposition in an enclosure, only taking into consideration deposition by settling. Results are presented in the form of charts (curves and tables). Since this simple tool only considers deposition by settling, it requires only a limited number of parameters, i.e. aerosol characteristics (MMAD, standard deviation, density) and the characteristics of the enclosure where the accident occurred (height and air renewal rate). 86 Scientific and Technical Report IRSN

26 Accidents in nuclear facilities 2. 4 Charts were produced for two aerosols (MMAD of 2 and 8 µm, geometric standard deviation of 1.75, density of 4), for heights and renewal rates characteristic of industrial facilities that use UF 6. The tool offers a total of 264 configurations. Characterizing HEPA filter strength Scope High-efficiency particulate air (HEPA) filters consist of filtering cells in a galvanized or stainless steel frame or structure that holds the filtering material. HF could severely damage this filtering material, composed of borosilicate glass fibers. The study aimed to characterize the behavior of HEPA filters exposed to HF, focusing on any changes in filter efficiency. Approach For the accident situations considered in the common interest program, HEPA filters in facilities could be exposed to high HF concentrations (potentially reaching 5x10 4 to ppm), including concentrations greater than 104 ppm for durations varying from 45 minutes to 9 hours. The only existing data [Del Fabro et al., 2002], identified by the pre-test literature review, involves relatively low exposure times and concentrations (filters remain efficient after 15 minutes of exposure to HF concentrations between 300 and 400 ppm). These data are not representative of the postulated accident conditions, which are far more severe. Researchers thus collected experimental data that could be used to characterize HEPA filter efficiency at HF concentrations and exposure times representative of the accidents considered in emergency plans, with the additional aim of assessing limit strength, if possible. Test results The tests were performed by Comurhex, a company based in Pierrelatte, France. Their experimental facility can provide tested HF concentrations no lower than 1000 ppm. The tests [Bouilloux et al., 2004] consisted of exposing the filtering material to various HF concentrations and measuring the resulting changes in filtering characteristics. The results showed that exposing the filtering material to the facility's lowest HF concentration led to total loss of HEPA filter efficiency; the filtering material was destroyed in less than 60 minutes. Figure 5 shows filtering material exposed to HF. Assessment tool A comprehensive tool for determining the condition of a filter exposed to HF was not developed because researchers were unable to determine the filter's limit strength. But they were able to develop a graphic representation defining three distinct ranges of filter strength: filtering efficiency maintained (filter intact) (t < 15 min; C < 400 ppm); total loss of filtering efficiency (brittle filter) (t > 60 min; C > 1000 ppm); intermediate range where filter strength was not characterized (15 min < t < 60 min; 400 ppm < C < 1000 ppm). Summary of results The UF 6 common interest program compiled an inventory of physicochemical accident phenomena, reviewed the literature for each phenomenon, and in some cases, gained insight into how these phenomena influence impact assessment. These results were used to develop a set of "relatively" simple tools. The test results obtained in the UF 6 common interest program provided the basis for building the SUBLI_UF 6 computer tool, the charts to evaluate UO 2 F 2 aerosol deposition in the building where the accident occurred, and the graphic tool (based on HF concentration and exposure time) that characterizes the HEPA filter operational range. All these tools were used to assess the consequences of several accident scenarios, and the results were compared to values obtained using the "old" assumptions. The common interest program tools appear to provide more realistic assessments, particularly in terms of kinetics, considering that release time was previously a fixed value in most cases. Moreover, since the new assessments are based on the same approach (a series of physicochemical evaluations) regardless of the type of UF 6 release (e.g. liquid or gaseous), there is better physical consistency between results for the various types of accident, which was not necessarily the case up until now, since previous computing methods varied according to the operator and postulated scenario. While these results generally confirm the degree of risk associated with UF 6 activities at the front end of the fuel cycle, each accident situation can nonetheless be assessed more realistically, potentially highlighting significant differences, which may in turn lead individual facilities to redefine their most severe scenarios. IRSN - Scientific and Technical Report

27 2. 4 Outlook The tests characterizing heavy gas dispersion in a ventilated enclosure revealed phenomena that have yet to be explained. At the end of the injection phase, test results showed that a mechanism that reduces gas levels accentuates the wellmodeled decrease in gas concentration linked to air renewal in the enclosure. This translated as a faster dropping phase in the tests as compared to the simulations. Additional studies are necessary to explain these unexpected results. The UO 2 F 2 study revealed gaps in the literature on the aerosol characteristics and demonstrated its very strong influence on deposition. Setting up an experimental program to characterize the properties of the UO 2 F 2 aerosol is one possible follow-up project to the common interest program. Researchers were unable to determine the limit strength of HEPA filters exposed to HF, given that the lowest available HF concentration (1000 ppm) at the experimental facility was too high. Future efforts may focus on characterizing filter behavior across the entire concentration range. This, however, would require an experimental system capable of obtaining lower HF concentrations (below 1000 ppm). References ANSYS Company, CFX-5 Solver Theory Manual CFX Ltd., Oxfordshire, L. Bouilloux, C. Prevost, L. Ricciardi, R. Sestier-Carlin, Modélisation de la dispersion d un gaz lourd dans un local ventilé. Rapport scientifique et technique de l IRSN 2006, p L. Bouilloux,, E. de Vito, O. Norvez, Bilan de l étude du comportement des filtres THE en cas de rejet accidentel d UF6. Note technique DSU/SERAC/LECEV/04-26, septembre D. Ducruet, J. Vendel, Description détaillée d Acacia : algorithme appliqué à Caraidas pour la capture de l iode et des aérosols. Rapport d étude SERAC/LPMC/ L. Del Fabro, J.-C. Laborde, C. Huet, Réalisation d une étude bibliographique et du dimensionnement d essais dédiés au comportement de filtres THE en cas de rejet accidentel d UF6. Note technique DPEA/SECRI/02-082, septembre J. Gauvain, G. Lhiaubet, ESCADRE mod 1.2, AEROSOLS_B2 Release 3.3, Aerosol behavior in containment, Reference document. Note technique SEMAR 98/57. T. Gelain, Essais de sublimation de carboglace dans BISE. Rapport DSU/SERAC/LEMAC/04-10, mai Scientific and Technical Report IRSN

28 2. 5 Study of physical phenomena and consequences associated with criticality accidents Luis Aguiar, Véronique Rouyer Criticality Assessment, Study and Research Department Matthieu Duluc, Xavier Knemp, Igor Le Bars Assessment Section for Criticality Risks and Accidents Introduction What is a criticality accident? The risk of criticality (an uncontrolled fission chain reaction) exists in fuel cycle facilities where non-negligible amounts of fissile material (1) are handled (typically more than a few hundred grams). Nuclear power plants are therefore at risk, as are facilities for uranium enrichment, nuclear fuel fabrication, post-irradiation fuel processing, and nuclear waste management, in addition to fissile material transport casks and certain research laboratories. The fissile materials involved (uranium, plutonium, mixed uranium and plutonium, other fissile actinides [heavy nuclei]), their physicochemical form (liquid, solid, gas), and their conditions of use are all highly variable. When the handled material contains enough fissile material to initiate and sustain a fission chain reaction, the material is said to have reached "criticality" or a "critical state". A nuclear reactor in its normal operating state functions at criticality. Beneath this threshold, systems are referred to as "subcritical". Facilities that use fissile materials are designed so that subcriticality is maintained in all situations, with a safety margin relative to the critical state. Beyond criticality, in a "supercritical" state, the fission chain reaction (which produces energy, neutrons, and gamma radiation), develops at a pace that increases as the reaction goes further and further beyond critical conditions (2). This is called a criticality accident. Design and/or operating measures to avert criticality risk in facilities are subject to analyses and studies conducted by operators, as detailed in their safety reports. These measures, which, in France, must comply with a Basic Safety Rule specific to criticality risks (RFS 1.3.c), are also examined by IRSN criticality specialists. Nevertheless, despite the measures taken, criticality accidents cannot be totally excluded. As part of its mission to provide technical support to public authorities, IRSN conducts research focused on criticality accidents to obtain the most relevant information given the state of the art. The challenge is to preventively assess the consequences of a criticality accident, with a view to ensuring that measures taken in the event of an accident will effectively mitigate the consequences. The purpose of IRSN's research in this area is to develop and sharpen the skills required to assess the consequences of a criticality accident, in order to provide support in an emergency situation, particularly for assessing radiological consequences and response capability, and also to analyze the pertinence of the number of fissions (or the "fission source term"), a (1) Material containing nuclei said to be fissile, i.e. having a non-negligible probability of undergoing fission by interaction with neutrons, regardless of their energy level. (2) Critical conditions define all the characteristics required (mass, geometry, physicochemical form, etc.) for a neutron-multiplying medium to reach the critical state. IRSN - Scientific and Technical Report

29 2. 5 parameter operators use to assess the off-site radiological consequences of a potential criticality accident, which helps determine the type of mitigation action to be taken (e.g. which zones to evacuate). Acquiring and developing computer tools to assess accident consequences is essential to achieving this objective. Since 1945, about sixty criticality accidents have occurred in the world, with about forty taking place in research reactors or in laboratories conducting research on critical assemblies. Several lessons have been learned from this experience feedback with regards to the type of risk involved and the phenomenology characteristic of this type of accident. What type of risk is involved? Criticality accident risk is specific to the nuclear industry, one of several such risks (e.g. dissemination of radioactive materials, irradiation) which exist alongside conventional industrial risks such as fire. The risk of a criticality accident must be taken into account in all situations, both under normal operating conditions (process operations, maintenance operations, transfer operations, etc.) and subsequent to an incident situation (procedural errors, fires, earthquakes, floods, etc.). Two types of event occur when entering the supercritical state: events that may occur during fissile material transport, storage, or processing, where a chain reaction is always accidental, or events that may occur in a nuclear reactor. The two contexts are very different, since reactors are specifically designed for the purpose of initiating and controlling a chain reaction. Only the first type of event, directly related to fuel cycle facilities and laboratories, can be called "criticality accidents" in the strictest sense, and they are the focus of this article. parameters, such as how far the situation has gone beyond the critical state, and the supercriticality kinetics. For example, if the time required to double the number of neutrons is around half a second, the power produced can be multiplied by one million in 10 seconds. By comparison, if doubling time is on the order of one hundredth or one thousandth of a second, power can be multiplied by one billion in respectively three tenths or three hundredths of a second, reaching values of 10 to 100 MW in a few fractions of a second (100 MW represents around fissions per second, given that one joule equals approximately fissions). An accident results in an initial power spike, generally followed by other excursions. It can be prolonged over time by power oscillations of varying frequency and amplitude. Accident duration is also highly variable, ranging from a few seconds to a few hours. Some accidents terminate spontaneously, due to physical dispersion of the materials for instance, while others require human intervention. The heat and energy released by these power excursions are usually limited. In contrast, fission-induced emission of high-intensity gamma radiation and neutrons can have severe consequences on human health for people in the immediate vicinity, causing potentially fatal irradiation to workers who are the closest to the accident, given that gamma and neutron doses can reach 25 Gy and 20 Gy, respectively, at one meter from the source during the initial power spikes (10 17 fissions). Although preventive measures reduce the risk of a criticality accident, it may be appropriate to install detection systems to sound an alarm from the first power spike, even though this type of accident is characterized by its sudden onset, without any precursor signs. For accidents involving more than one power spike, these detection systems play a particularly important role for workers not fatally exposed during the first spike, by facilitating rapid evacuation of personnel, thereby limiting their exposure to neutron and gamma radiation. Criticality accidents result from an uncontrolled fission chain reaction, which translates as a rapid multiplication in the number of fissions, generally interrupted by various physical feedback effects that allow the system to return to a subcritical state. The first direct consequence is the energy generated, each fission releasing around 200 MeV of energy (1 MeV equals approximately joule). The energy released depends on the sequence of events, which in turn depends on several Finally, no criticality accident has ever resulted in significant radioactive release to the environment, but the latest accident (Tokai-mura, Japan, 1999) did highlight the importance of analyzing the impact on the local population. IRSN's research in the field of criticality accidents focuses on accident consequences in terms of radiation (gamma and neutrons) as well as energy release. Safety objectives IRSN focuses on developing the skills and resources necessary to: 90 Scientific and Technical Report IRSN

30 Accidents in nuclear facilities 2. 5 assess the possible consequences of criticality accidents in nuclear facilities to ensure that accidents do not lead to an unacceptable dose to the population, and that evacuation zones and assembly stations are in an appropriate location; analyze any accident situation, providing support for emergency response in order to provide public authorities with the information needed to define containment or exclusion areas, as well as any necessary response zones, based on assessment of the radiological consequences; and to help the operator and safety authorities terminate the accident situation, if shutdown is not spontaneous, and restore safety. Achieving these objectives requires excellent knowledge of accident phenomenology, especially the number of fissions. Sequence of events in a criticality accident One of the direct consequences of supercriticality is energy release, mainly in the form of heat, accompanied by intense neutron and gamma radiation, as well as fission gas release. Heating of the material initiates feedback mechanisms, which in turn reduce reactivity (3) until the system becomes subcritical, even temporarily. These interactions typically result in the first power spike. From that point on, the sequence of events varies considerably, based on the following parameters: the physicochemical form of the supercritical fissile material; the reactivity of the system, representative of the level of supercriticality; the initial spontaneous neutron source (which is different depending on the features of the media involved, i.e. nonirradiated enriched uranium, irradiated uranium containing plutonium, or plutonium alone); the neutronic feedback effects; the immediate environment and the equipment configuration where the accident has occurred (heat exchanges between the supercritical system and the surrounding materials, containment of the supercritical system, etc.). Depending on the type, extent, and kinetics of the different feedback effects (parameters related to the supercritical fissile material), criticality accidents are generally classified according to four categories: non-moderated solids, liquids, powders, and heterogeneous media. Unmoderated solids Materials referred to as "solid" include all compact materials where there is no moderator material (4), even in accident conditions. Solid materials are mostly metallic, but dry powder materials (sintered or unsintered) may also be included in this category, as well as fissile materials contained in matrices, solidified slag, etc. Accident phenomenology for these materials is relatively straightforward: the heat balance consists simply of calculating the heated temperature of the material, taking into account nuclear power levels, and heat loss induced through conduction and heat radiation. Feedback effects are always partially explained by expansion and nuclear temperature effects (5) (Doppler and neutron spectrum). The accident ends either by meltdown (or at least plastic deformation) and dispersion of fissile material, or by the intervention of workers (to remove a reflector, add an absorber, etc.). In general only a single spike is observed, within a relatively short timeframe (less than a few seconds). However, the 1997 Sarov accident [IAEA, 2001] progressed in a much different manner, involving power oscillation without significant meltdown or deformation of the fissile material. Consequently, the evolution of such systems must be assessed with caution. Liquids Accident phenomenology for liquids is more complex, involving radiolysis gas bubble formation (due to water molecule decomposition by fission fragments and gamma/neutron radiation) or vapor bubble formation (due to boiling of the solution) and other fluid movements within the system, in addition to the usual feedback effects (i.e. expansion and neutronic temperature effects). The system thus goes from a single-phase state to a two-phase state. After the first power spike, gas bubbles are formed by radiolysis and migrate toward the surface. Their quenching effect disappears as they migrate, and the power excursion can then start over. This process accounts for the oscillation phenomenon generally observed in solution criticality accidents (Figure 1). The possibility of partial ejection of the solution must also be considered in open vessel configurations. Gradual evaporation of the solution over longer timeframes can lead to either increased or decreased reactivity, depending on the situation. Post-accident behavior of the system therefore depends on whether it is (3) For a material capable of sustaining a fission chain reaction, reactivity is the parameter that gives the deviation from criticality, with positive values corresponding to supercriticality and negative values to subcriticality. (4) Material containing light nuclei such as hydrogen (water, CH 2, etc.), acts to slow neutrons, thereby increasing their likelihood of fission. (5) Temperature variation effects influencing intrinsic neutron properties of materials (absorption, production, and slowing of neutrons). IRSN - Scientific and Technical Report

31 2. 5 closed (vapor recondenses and returns to solution) or open (evaporation or ejection of the solution eventually restores a definitive subcritical state). Given all these phenomena, the duration of solution criticality accidents is extremely variable, ranging from a few seconds to a few hours. Heterogeneous media This type of material consists of nuclear fuel rod or plate assemblies, or pieces of solid fissile material immersed in a moderator, usually water. Criticality accident phenomenology in this case is even more complex than in a solution, given that the material can become a three-phase system with vapor or radiolysis gas bubbles, or even a vapor film at the solid-liquid interface. Heat transfers must therefore take into account three types of interface: solid-liquid, solid-gas, and liquid-gas. In most cases, the material is initially undermoderated, and as in solution accidents, several spikes can occur, but the characteristic time depends largely on the heterogeneity of the materials. Powders Criticality accidents may involve powder fissile materials in the presence of a moderator capable of mixing with the powder. Accidents of this type are studied regularly, even though no accident or general accident experience involving powder fuel materials has ever occurred. The main postulated scenarios involve the accidental penetration of water in an environment containing fissile material in powder form. Here again, accident phenomenology is more complex than in a solution because the material can become a three-phase system, and a distinction must be made between "expansion" of fissile material grains and moderator expansion. Powder wettability and inter-grain fluid migration kinetics are not well known, and could induce grain movement, deforming the system's geometry. As a result, a high degree of uncertainty is associated with post-accident outcomes for these configurations. The overall complexity of these phenomena illustrates both the importance and difficulty of apprehending orders of magnitude for the consequences of criticality accidents. Quantifying impact in this way has three key prerequisites: thorough knowledge of the state of the art and particularly past accident feedback; access to experimental data; and a firm grasp of both the empirical and advanced computation methods to estimate characteristic parameters of the source term. Power 1 st spike Solution heating + Radiolysis gas formation Exponential power increase 2 nd spike FREE EVOLUTION Bubble migration and release Oscillations Pseudo-equilibrium Time Figure 1 92 Scientific and Technical Report IRSN

32 Accidents in nuclear facilities 2. 5 The state of the art Criticality accidents in safety analyses on French nuclear facilities To define mitigation measures and facilitate crisis management for a criticality accident in a nuclear facility, the methodology generally used in France centers on a conservative "bounding" fission source term for the first hours of the accident (typically 5x10 18 fissions). This fission source term is based on data from experimental facilities (namely the French Crac and Silene facilities at CEA/Valduc) and analysis of past criticality accidents in the world. As a rule, criticality accident configuration in a given facility has little influence on the fission source term value. At 5x10 18 fissions, this value represents the maximum number of fissions for a two-hour period, obtained during experiments in the Crac and Silene facilities. However, the bounding fission source term approach does not take into account accident kinetics (time aspect) or the conditions specific to the facility. It may lead decision-makers to adopt excessive mitigation measures (large evacuation zones, additional protection measures outside the site for facilities with limited radiation protection). Consequently, a "finer" approach, one that integrates specific facility configurations as well as accident kinetics, may represent an improvement worth considering for the assessment of consequences and measures. Insights gained and research underway Experience feedback on past criticality accidents In-depth study of recorded criticality accidents in the world is a precious source of information for apprehending accident phenomenology. Since 1945, 60 criticality accidents have been documented in the world, most occurring in the US and the former USSR. Thirtyeight took place in research facilities (critical reactors and assemblies) and 22 in process facilities. In France, two accidents occurred in experimental reactors, neither resulting in severe irradiation. All 60 criticality accidents and the relevant information available are described in a document published by Los Alamos National Laboratory [McLaughlin et al., 2000]. A distinction is usually made between accidents in research facilities (where criticality or near-criticality is purposely established and systems are in place for detection, protection, and termination of the chain reaction) and accidents in process facilities (where all configurations are designed for subcriticality). In general, several types of lessons have been learned from criticality accidents. Regarding their causes, most criticality accidents took place during non-routine operations. None of them were exclusively attributable to equipment defects, and none took place during transport or in storage. The accidents arose from a wide range of fissile materials, varying in type (U, Pu) and enrichment. They usually involved liquid materials (fuel cycle plants) and metal media (especially in research facilities). None of the events involved fissile material in powder form, and accidents with heterogeneous media only occurred in research facilities. The mechanical consequences of these criticality accidents were very limited, aside from cases where a steam explosion followed the power excursion. In process accidents in particular, the total number of fissions for the first spike, where this number could be reconstructed, ranged from 3x10 15 to 2x The total overall number of fissions ranged from to 2.7x10 18, except for one accident involving very large amounts of fissile material and a number of fissions equal to 4x Most of the 22 accidents did not end after a single power spike. Duration ranged from a few seconds to around 40 hours, with more than half the accidents requiring human intervention to terminate the fission chain reaction. Analysis has shown that the pre-accident scenarios were difficult to predict and several (more than two) independent failures were reported. Parallel to this detailed, systematic analysis of past accidents, experimental research has been conducted since the 1960s to investigate criticality accident phenomena and estimate potential consequences. Experimental data Starting in 1967, France became one of the first countries to initiate ambitious experimental programs aimed at building knowledge on solution criticality accidents, using fissile solutions of uranyl nitrate highly enriched in 235 U. Various IRSN - Scientific and Technical Report

33 2. 5 facilities capable of producing "controlled" criticial excursions have been built around the world, for example: Godiva (U metal) and Jezebel (Pu metal) in the US; Sheba (solution of uranyl fluoride enriched to 5% 235 U) in the US; KEWB (highly enriched uranyl sulfate solution) in the US; Crac and Silene (highly enriched uranyl nitrate solutions) at CEA/Valduc in France; Tracy (solutions of uranyl nitrate enriched to 10% 235 U) in Japan. Experiments have mainly focused on solutions representing the greatest risk, based on feedback from past criticality accidents. As part of its mission, IRSN has engaged in an in-depth analysis of CEA/Valduc experimental results and broadened theoretical knowledge of the physical phenomena associated with criticality accidents. For reasons involving access to detailed data, this work has focused on the 72 experiments conducted on the Crac facility (designed to study the radiological consequences of criticality accidents) from 1967 to 1972, then on experiments conducted on the Silene facility (a free neutron evolution irradiation source, Figure 2) starting in This work culminated in an initial summary document, bringing together over 100 reports and articles describing experimental results obtained on Crac and Silene, along with criticality accident phenomenology. It was found that the total number of fissions depends mainly on total reactivity insertion, and that the first power spike characteristics depend mainly on the conditions in which reactivity is introduced initially. Another important parameter in the uncertainty relative to the fission source term involves the calibration procedures applied prior to the experiments. This point was therefore examined in detail. Feedback effects, such as radiolysis and boiling, represent the main phenomena that influence the sequence of events in the accident over time. Knowledge of all these phenomena is crucial to improving current accident codes, aimed at providing an order-of-magnitude estimate for the fission source term, and in developing more efficient tools. In addition to providing a better understanding of criticality accident phenomenology, the experimental results, particularly for fissile solutions, have given rise to simple equations providing a bounding fission source term estimate expressed as the total number of fissions. Empirical and simplified equations Based on lessons learned from past criticality accidents [McLaughlin et al., 2000] and results from fissile solution experiments, various equations (some empirical, others based on a simplified heat balance) were developed in France and elsewhere to estimate the bounding number of fissions generated by a criticality accident [Nakajima, 2003], without requiring any specific details about the accident scenario. IRSN inventoried and analyzed the various equations established for fissile solutions, comparing them against experimental results. The findings highlighted assumptions, some implicit, that underlie these relationships and considerably limit their range of validity. IRSN was then able to explicitly define the range of validity for these equations and hence their area of applicability. Figure 2 This inventory also enabled IRSN to propose a new formulation, based on existing relationships, to estimate a bounding value for total number of fissions in homogenous fissile solutions. The new relationship determines the maximum number of fissions for two cases, assuming negligible heat loss. In the first case, the chain reaction self-terminates (or is terminated) prior to boiling (solution heated to 100 C maximum). In the second case, the chain reaction self-terminates after the solution reaches the boiling point (once boiling occurs, the solution is assumed to evaporate down to the minimum critical volume 94 Scientific and Technical Report IRSN

34 Accidents in nuclear facilities 2. 5 V c [Φ] in the equipment considered, while in practice selfshutdown occurs at an equal or greater volume, depending on solution concentration). The bounding number of fissions can be expressed as a function of volume (V) and solution density (d sol ) using the following relationships, with volume in liters and density in kilograms per liter, where d e is water density: N f = 1.3x10 16.V.d sol (no boiling) N f = 1.3x10 16.V.d sol + 8x10 16.[V-V c (Φ)].d e (if boiling occurs). The advantage of these equations, applicable to all geometries, is that they require only minimum knowledge of the accident scenario. However, they are not valid if forced cooling is used, or if the solution recondenses after boiling. Nor can they be used to determine time-dependent changes in nuclear power and total number of fissions. Computer codes are therefore indispensable, particularly in the post-accident management of situations requiring intervention. Accidental insertion of reactivity Figure 3 Reactivity balance Point kinetics equations Power Energy Temperature FEEDBACK MECHANISMS TEMPERATURE EFFECTS VOID EFFECTS (radiolysis gas, vapor, etc.) Doppler effect Spectral effect Expansion effect (density, leakage, etc.) Computer codes Most computer codes used for criticality accident applications were developed for emergency response. The operational requirements therefore center on the simplest possible implementation, very short computing times, and order-ofmagnitude estimates of characteristic parameters of the fission source term. Although relatively basic, the models used are adequate for the targeted objective. Far more complex tools, such as Fetch [Pain et al., 2001], make it possible to perform much more rigorous analysis, given the models used, but require prohibitive computing time and resources. Various criticality accident simulation codes have been developed or co-developed in France, each designed for a particular type of fissile material: Critex for fissile solutions, Powder for powders, and Château for fuel rods immersed in water. All three codes are based on a common architecture, shown in Figure 3. Considered "simplified" computer codes, they can be used to quickly estimate, for the defined geometry (for instance, cylindrical for Critex), time-dependent changes in the power, energy, and temperature of the material over a limited period (first minutes of the accident). Critex is the most frequently used code at present. Initiated in the mid-1980s through an EC-funded contract and a partnership between AEA-SRD (UK) and IPSN (now IRSN), Critex is structured around "simple" methods based on physical laws and more empirical observations drawn from Crac and Silene experimental results. It is particularly suitable for cylindrical geometries like those of the Crac and Silene vessels. The area of validation for Critex currently includes some 30 experiments conducted in Crac and Silene as well as the American Sheba reactor. IRSN is currently expanding the database to include the new Crac and Silene experiments, and the Japanese TRACEY experiments. Unfortunately, all these studies involve cylindrical equipment and uranium solutions, limiting the area of applicability of the code. Critex is currently undergoing in-depth analysis to identify shortcomings and map out areas for improvement. The first step consisted in an exhaustive review (to identify the various procedures and variables, their functions, the physical models used, etc.). The current step focuses on assessing the models and their validity, and it is already apparent that major changes will be needed to accurately take into account geometries other than cylinders. Similar codes have also been developed in other countries: Agnes, Trace, and Inctac for solutions, and Agnes-P for powders. IRSN plans to analyze its other criticality accident codes as well, first Powder then Château. However, unlike Critex, there are no experiments validating the media simulated in IRSN - Scientific and Technical Report

35 2. 5 Powder or Château. For now, the models can only be validated by comparisons between codes. One of the fundamental questions examines the extent to which results from these computer codes can be applied to geometries other than those simulated. To lead off the investigation into this difficult issue, IRSN proposed a case study (parallelepiped equipment containing a highly enriched uranyl nitrate solution) to the OECD/NEA (6) Expert Group on Criticality Excursion Analyses [OECD]. Conclusions and outlook Based on the state of the art in France, a fission source term on the order of 5x10 18 fissions is considered sufficiently conservative for analyzing consequences in the initial hours of a criticality accident. This value is generally used in all new facilities posing a criticality accident risk. Certain operators, however, have already considered the possibility of using a less conservative maximum total number of fissions, taking into account specific facility characteristics, in cases where the direct irradiation consequences estimated using the bounding value (5x10 18 fissions) were significant outside the facility and/or site. For example, in safety demonstrations based on feedback from the Tokai-mura accident (Japan, September 30, 1999), operators attempted to use the Critex code, with varying degrees of success, to determine a more realistic fission source term than the value mentioned above (5x10 18 fissions) for assessing potential accident consequences, or defining evacuation areas or assembly stations. Unfortunately, in most attempts of this sort, criticality accident codes are used outside their areas of applicability. Results must therefore be interpreted with caution, as the uncertainty estimate for the calculated values is not accurately known. Significant improvements must be made in the codes to validate a code-based approach. There is also a need to assess the possibility of using criticality accident codes to aid emergency response in the event of an accident. In a small number of cases, bounding fission source term determination was based on robust arguments and simplified equations, taking into account lessons learned from past accidents as well as specific characteristics of the facility in question. Here again, it is essential to accurately define the area of applicability for these simplified equations. Past accident feedback and experimental programs indicate that criticality accidents can vary in duration, potentially exceeding several hours. In this regard, the Tokai-mura accident underscored the need to consider ahead of time which shutdown mechanisms could be implemented in case of a criticality accident. Computer codes may serve as a valuable tool in this context, as they integrate the temporal aspect of accident progression. Finally, few countries have computer codes or experimental facilities dedicated to criticality accidents. Hence the need for IRSN to foster cooperation with the few partners possessing such capabilities, in an effort to improve its own knowledge. The first step was to exchange technical information with CEA/Valduc. Collaborative projects were also forged with JAEA (Japan Atomic Energy Agency), and since 2006, IRSN has been participating in the OECD/NEA Expert Group on Criticality Excursion Analyses [OECD]. In 2007, IRSN also proposed a draft version for an ISO standard on "fission source term" estimation for criticality accidents. This standard will provide methodology and recommendations for assessing the bounding number of fissions, as part of a safety analysis focused on a postulated criticality accident. (6) OECD: Organisation for Economic Co-operation and Development NEA: Nuclear Energy Agency. 96 Scientific and Technical Report IRSN

36 Accidents in nuclear facilities 2. 5 References IAEA, The criticality accident in Sarov, T.P. McLaughlin et al., A Review of Criticality Accidents, 2000 Revision, LA K. Nakajima, Applicability of Simplified Methods to Evaluate Consequences of Criticality Accident Using Past Accident Data, ICNC The OECD/NEA Expert Group on Criticality Excursion Analyses C.C. Pain et al., Transient Criticality in Fissile Solutions Compressibility Effects, Nucl. Sci. Eng., 138, p (2001). IRSN - Scientific and Technical Report

37 2. 6 Analysis of the mechanical behavior of containment on CPY 900 MWe PWRs under severe accident conditions Georges Nahas, Bertrand Cirée Civil Engineering and Structural Analysis Unit The containment building serves as the third and final barrier against environmental release of radioactive products from the reactor core. Its integrity, especially in accident situations, is critical to nuclear safety. IRSN carried out a major project on containment integrity as part of the level 2 probabilistic safety study (PSA2) on CPY-series 900 MWe pressurized water reactors (PWRs). This project took on the ambitious scientific challenge of assessing the risk of containment leakage after a severe accident leading to core meltdown. Reaching across several fields of expertise, the studies aimed to meet the following objectives: identify the various severe accident scenarios and probabilities of occurrence, analyze the mechanical behavior of containment, and assess containment integrity along with contamination risks for the immediate environment under severe accident conditions [Raimond et al., 2004]. The risk of containment failure during a severe accident arises from the multiple types of load applied to the structure, which may exceed its design pressure. These pressure loads and the accompanying temperature changes constitute the thermomechanical load over time. Studies conducted as part of the PSA2 project on 900 MWe PWRs aimed to assess containment response to a quasi-static load, i.e. a pressure spike or slow pressure rise [Raimond et al., 2004]. Linear simulations conducted on several severe accident categories allowed researchers to identify the scenario that would cause the most damage to the containment building. Designated the "AF scenario", it consists of three phases (Figure 1): the pre-thermal load phase, corresponding to core degradation; instants P1 and P2 represent the beginning and end of this phase, respectively; the pressure and temperature spike phase, corresponding to the adiabatic isochoric hydrogen combustion induced by core oxidation; instant P3 represents this spike; the slow rise in pressure and temperature, corresponding to corium-concrete interaction, assumed to bring corium into contact with sump water; instants P4 and P5 represent, respectively, the beginning and end of this phase (assumed to last 100 hours, with final absolute pressure reaching bar). Several pressure and temperature levels for the spike phase (P3) were studied. A spike limit pressure of bar absolute (2.61 times the containment design pressure) was selected, corresponding to adiabatic isochoric combustion of 125% of the maximum amount of hydrogen produced by core oxidation. The spike was assumed to last 90 seconds (a 30-second rise and 60-second fall), consistent with static simulation assumptions. These limit values selected for the AF scenario can be 98 Scientific and Technical Report IRSN

38 Accidents in nuclear facilities 2. 6 used to determine the containment safety margins in a severe accident context. In order to quantify the effect of temperature on severe accident loads and extrapolate results to other severe accident scenarios, without requiring an unreasonable number of non-linear calculations, the selected loads were limited to three scenarios: AF scenario; AS scenario (AF scenario without pressure/temperature spike); PL scenario (pressure only, no temperature loading). Multiscale approach The study was based on deterministic best-estimate calculations, performed using non-linear finite element analysis. A multiscale approach was adopted to apprehend structural behavior at various levels of detail, i.e. the straight section of the containment building, the equipment hatch, and the equipment hatch closing system. This approach made it possible to realistically represent the different thermomechanical phenomena, while keeping computing time and cost within reasonable limits (Figure 2). This article presents the simulations run using the global complete containment model, the quarter containment model, the local equipment hatch penetration model, and the detailed model [Cirée et al., 2007],[Nahas et al., 2007]. The simulations were optimized on the IRSN computation server prior to complete containment simulation using the CAST3M computer code [Verpeaux et al., 1989], which ran within reasonable computing time (275 hours). Global containment model (simulation of initial containment state) Severe accident simulation requires that knowledge on the initial, pre-accident state of the structures, under the effects of creep and shrinkage phenomena, is as close to reality as possible. For the PSA2 project, the containment age was set to 30 years. The prestressing reference simulation to establish the condition of the building structure after 30 years of service was run on a generic 900 MWe PWR containment building. The reference reactor was Unit 3 at the Blayais nuclear power plant. The position and tensioning of prestressing tendons is unsymmetrical, making it necessary to simulate the complete containment (360 ). The mesh used simulates the containment concrete, passive reinforcement, metal liner, protective concrete on the basemat, Temperature (C ) Absolute pressure (bar) P3 P P2 P4 P Time (s) Metal linertmax Containment concrete Tmax Pressure Figure 1 and, with simplified modeling, the equipment hatch shell with sleeve, flanges, and head. Internals are also modeled in a simplified manner, but all prestressing tendons are modeled with precision, including their geometry and deviations, especially around the equipment hatch and the two personnel airlocks. The model also simulates ground effect and backfill effect. Figures 2 and 3 depict the meshes used for this simulation. The concrete containment is subject to its own weight and prestressing from the tendons, which is calculated taking into account the nine phases of tensioning over a nine-month period. Prestressing calculations integrate tendon tension loss caused by friction (linear and angular) and relaxation (2.5% at 1000 hours), tension loss due to tendon anchor slip, and instantaneous tension loss due to elastic concrete shrinkage. Vertical tendon loads are calculated with tensioning at only one end, except for tendons deviated around the equipment hatch, which are tensioned at both ends. Loads for horizontal and dome tendons are calculated with tensioning at both ends. For each tendon tensioning phase as well as the 30-year service period, concrete shrinkage and creep were estimated in accordance with regulations, using equations from BPEL 1999 (regulatory document on limit-state design of prestressed concrete). These parameters were introduced at each simulation stage as "initial strain" loads, dependent on concrete drying, load age, and stress field. The calculation of prestressing and creep at 30 years served as the basis for the entire mechanical study as well as the simulations performed using the various models. Changes in containment pressure and temperature for the AF scenario. IRSN - Scientific and Technical Report

39 2. 6 Global complete containment model Global quarter containment model Local penetration model Detailed sleeve/ flange/head model Figure 2 Nested multiscale models: global complete containment model, global quarter containment model, local penetration model, sleeve/shell/flanges/head detailed model. Figure 3 Global complete containment meshes of prestressing tendons, reinforcement, metal liner, and equipment hatch. Quarter containment model (severe accident simulations) Thermomechanical simulations for severe accident conditions were carried out using a mesh representing one quarter of the containment, to reduce computing time. Prestressing and creep calculations performed for the complete containment model were projected on the "quarter containment" model, before severe accident pressure and temperature loads were applied. These calculations used a best-estimate approach that ignored variability in material characteristics. For the AF and AS scenarios, thermal calculations to define the temperature field at various instants in time during loading were carried out in linear transient mode. Limit conditions between the containment concrete and the steel liner assume they are separated by a layer of air layer to take into account thermal resistance between the concrete and steel. The air layer is necessary to simulate the temperature jump between the two materials, despite their physical continuity. The metal liner is in fact used as formwork during containment construction (Figure 3). Like the complete model, the quarter containment model simulates the containment concrete, prestressing tendons, passive reinforcement, metal liner, protective concrete on the basemat, internal structures, and the equipment hatch shell 100 Scientific and Technical Report IRSN

40 Accidents in nuclear facilities 2. 6 Amplitude 1.00E > -4.50E-03 < 1.77E E E E E E E E E E E E E E E E E E E E E-02 AF scenario at E+04 sec W1 in 67.5 plane W1 in 0 plane at sec Figure 4 Containment deformation amplified 100 times and concrete cracking in equipment hatch axis and in straight section during AF scenario spike (P3). with sleeve, flanges, and head. Figure 2 depicts the mesh used for this simulation. The concrete is modeled by eight-node, linear, solid finite elements, using a non-linear diffuse cracking behavior law (Ottosen model). Prestressing tendons and reinforcements are modeled by two-node rebar finite elements, with a non-linear elastoplastic behavior law integrating isotropic strain hardening. Tendon and reinforcement meshes, independent of the concrete mesh, are linked by kinematic relationships. The metal liner is modeled by shell elements with a non-linear elastoplastic behavior law integrating isotropic strain hardening. The ground is simulated using a superelement. Basemat uplift is possible, depending on severe accident loading [Verpeaux et al., 1989]. Analysis of non-linear computation results Analyzing results for the three severe accident simulations (AF, AS, and PL) led to the following observations. The AF simulation confirmed zones identified as the most sensitive areas of the containment building (Figure 4), particularly around the equipment hatch and also the gusset zone, which sustained crosswise cracking toward the prestressing tunnel. Comparing simulation results between the three scenarios (AF, AS, and PL) makes it possible to assess the temperature effect for the accident load applied (Figure 5). For example, comparing the AF and AS curves in Figure 5 shows that containment response is nearly reversible in the straight section (67.5 vertical plane at 22.9 m). Overall stability of the containment is maintained by the integrity of the prestressing tendons. Maximum equivalent plastic strain in the metal liner during the AF scenario after the pressure spike (P4) is greater than that obtained during the spike (P3) caused by thermal loading (Figure 6). Results from these three accident loads can be used to extrapolate mechanical containment behavior to other scenarios, since pressure was shown to be the main factor driving the mechanical phenomena. Leak paths are formed by any tears in the metal liner and cracks in the prestressed concrete containment wall. Calculated strain values for the metal liner are far below the fracture strain values for steel, and according to the results obtained, the liner should remain leaktight, with no signs of tearing. IRSN - Scientific and Technical Report

41 2. 6 Displacement (m) Absolute pressure (bar) AF scenario AS scenario PL scenario Equivalent plastic strain 1.3x x x10-2 1x10-2 9x10-3 8x10-3 7x10-3 6x10-3 5x10-3 4x10-3 3x10-3 2x10-3 1x Absolute pressure (bar) AF scenario AS scenario PL scenario Figure 5 Radial displacement at m in 67.5 plane. Figure 6 Maximum equivalent plastic strain in metal liner. To assess the risk of containment failure (metal liner, prestressed concrete wall), before analyzing and interpreting the results of the preceding studies based on the deformations obtained, it was first necessary to obtain experimental results to define acceptability criteria for the non-linear calculations. Simulation results were therefore compared to experimental results obtained using mockups, namely PCCV (NUPEC NRC Sandia National Laboratories), in order to correlate, when possible, the type of failure and the associated leak rates. A group of experts participated in this analysis in order to define these criteria. Analysis of mockup test results Results from representative tests constitute an important element in validating CAST3M simulations. The challenge is to find tests representative of the load conditions in question [Hessheimer et al., 2006]. PCCV (NUPEC NRC Sandia National Laboratories) is a 1:4- scale mockup of a prestressed concrete containment with metal liner. Pressure tests in dry air at ambient temperature were carried out at Sandia National Laboratories, followed by a structural failure mode test using water. The PCCV tests resulted in liner tears, with significant leakage, for absolute pressure values of around 10.7 bar (2.5 times the design pressure) [International Standard Problem, 2004]. Another test in the 1:6-scale RCCV mockup of a reinforced concrete containment with metal liner (NRC Sandia National Laboratories), conducted under pressure load conditions, produced similar results. Although analyses following the tests offered differing explanations of what caused the initial liner tears, such tears are always caused by strain localization. The absolute pressure level leading to containment loss was around 10 bar in both tests [Hessheimer et al., 2006]. PCCV test results and their numerical simulations were analyzed as part of the benchmark exercise for the OECD International Standard Problem No. 48 (ISP48), in which IRSN participated. Simulations were run with CAST3M, using the same approach as for the PSA2 project [International Standard Problem, 2004]. Neither IRSN simulations nor those run by the other participants predicted these tears at an absolute pressure of 10 bar, even though the various geometrical non-linearities were taken into account [International Standard Problem, 2005]. At this level of containment pressure loading, measured circumferential strain of the metal liner in the straight section of the barrel is 0.17%, and the calculated equivalent plastic strain is around %. This value falls below the limit values determined by liner characterization tests performed after the mockup tests. In contrast, calculations correctly simulated the structural failure mode test and the tear observed at the end of this test. This can be explained by modeling uncertainty and assumptions taken into account for the calculations. While metal liner tearing is a local phenomenon occurring at the weld scale, the calculations are conducted on an overall scale, where finite element size represents roughly twenty to thirty centimeters. To reproduce any liner tears, the models must be at the same scale as the phenomenon and take into account discontinuities pre- 102 Scientific and Technical Report IRSN

42 Accidents in nuclear facilities 2. 6 sented by each weld and anchor, along with any cracks in the concrete, using tools capable of simulating strain localization in the structure. Transposing PCCV results to the PSA2 containment calculations led to the following criterion: maximum plastic strain obtained by non-linear calculations in the straight section must be less than 0.30% ± 0.15%. Above this value, liner tearing is highly probable, as a result of strain localization. Strain around the tear corresponds to values (around 10%) determined by the liner characterization tests. The criterion retained is thus relevant to containment modeling, rather than the material. More specifically, this leakage criterion, related to the modeling used and the mesh fineness, takes into account uncertainty inherent to the models and assumptions. Generalizing this criterion to cases of thermomechanical loading limits the mechanical aspect of strain to the 0.30% value [International Standard Problem, 2005]. The 0.3% metal liner strain value recommended by the expert group on the basis of the mockup test results corresponds to a containment pressure of around 10.5 bar absolute for the AF scenario, and 9.75 bar for the pressure-only PL scenario. Hence, the mean containment failure pressure is assumed to be around 10 bar absolute (2.25 times the design pressure). Local equipment hatch model The quarter containment model, which incorporates prestressing tendons and passive rebars as well as non-linear mechanical behavior laws, requires significant computing time, even though spatial discretization of the geometry is relatively coarse. A finer model was therefore adopted to study behavior in sensitive zones such as the equipment hatch, particularly the risk of flange disjunction in the containment closing system, resulting in direct leakage to the atmosphere. This model represents the exact geometry of the flanges, along with the bolts joining them together. Featuring the same elements as the global model (concrete, metal liner, reinforcement, and prestressing tendons covering an area of the barrel m wide and m high, the shell, flanges and bolts, gussets, and collars anchoring the shell in the concrete, etc.), the local model also applies the same thermomechanical loads and material behavior laws. In addition, prestressing, shinkage, and creep from the global model are projected on the local model. An initial iterative calculation "rebalances" the structure and achieves the initial mechanical state of a 30-year-old containment, as in the global model. Based on the single "quarter containment" simulation, several "penetration" accident simulations were carried out, with variations in certain parameters such as the mesh, mechanical bolt characteristics, rebars, limit conditions, and bolt tightening torque. These sensitivity studies estimated the uncertainty related to modeling, computing, and materials as being around 15%. Flanges are modeled with shell elements, as are the liner, gussets and collars, and sleeve/shell/flanges/head system. Rebars and tendons along with the 44 equipment hatch closing bolts are modeled by two-node rebar elements (Figure 7). Mesh topology (geometric node position, discretization) is independent of concrete mesh topology. Mechanical connections with the concrete (sleeve, tendon, and rebar anchoring) are represented by linear relationships. Unilateral (simple contact) relationships simulate the "non-interpenetration" of the flanges, including the possibility of disjunction [Verpeaux et al., 1989]. Given the number of linear and unilateral relationships, their management must be optimized as part of the numerical resolution. In the local model, three bolt types were considered (RCC-M data): E24 steel bolts currently used on 900 MWe PWR containments in France (diameter: 33 mm; yield strength: 238 MPa; tightening torque: 69 and 140 MPa); Z6 CNU 17.4 steel bolts (diameter: 33 mm; yield strength: 729 MPa; tightening torque: 369 MPa); 40 CNDV 0703 steel bolts (diameter: 24 mm; yield strength: 852 MPa; tightening torque: 273 MPa). To obtain local model limit conditions, displacement fields from the global simulation (quarter containment) are projected on the local model contour at each time step, based on the multiscale approach. This method is validated by comparing results from differently sized local models and by running basic test cases. Given the lack of experimental mechanical data on aged seal behavior, the studies do not take into account the seal between the two flanges, therefore limiting the possible outcome to disjunction of the flanges. Initial tests conducted by IRSN show that confinement of the seal to its housing at high temperature, due to its strong thermal expansion coefficient, can substantially impair reversibility. Even though the most realistic approach possible was used, certain simplifications were adopted for the penetration simulations. These simplifications are considered second-order elements relative to the main modeling elements. IRSN - Scientific and Technical Report

43 2. 6 Reinforcement Sleeve Collars Gussets Bolts Flanges Penetration 7164 nodes 5676 elements Figure 7 Concrete penetration, liner/sleeve/flanges/head, tendons, sleeve, flanges, and bolts. The main results are as follows: the choice of bolts (cross-section, yield strength) is the critical parameter in the mechanical study, with considerable repercussions on the degree of disjunction (Table 1); the spike in pressure and temperature (P3) has relatively little impact on pressure-dependent disjunction values; flange disjunction is thus largely influenced by containment ovalization and buckling around the sleeve, neither effect being very sensitive to temperature; regardless of the scenario and parameters, as pressure subsides, the flanges only close partially, due to bolt yielding and lack of reversibility in the concrete containment deformations around the equipment hatch (Figure 8); the disjunction profile along the sleeve circumference is more or less constant, with a disjunction length of around 4 m (for the half-circumference), and the leak cross-section is almost proportional to maximum flange disjunction; decreased prestressing has relatively little impact on disjunction during the pressure rise (slightly earlier disjunction); there is generalized concrete cracking during the pressure and temperature spike (P3); disjunction is relatively unaffected by changing the bolt tightening torque, the concrete behavior law parameters, and Potential leak areas Maximum flange disjunction AF scenario E24 steel bolts AF simulation Z6 CNU 17.4 steel bolts AF simulation 40 CNDV steel bolts Table cm mm 1 cm mm sleeve/concrete junction modeling. Detailed model 10 cm mm 50 cm mm > Absolute disjunction pressure and maximum disjunction as a function of calculated potential leak area. Modeling the flange connection is one of the most complicated aspects of the study, and generally the most sensitive in terms of flange disjunction, which appears to be the predominant leakage mode for the structure during the pressure rise. The difficulty results from the choice of shell elements for the local model. This led researchers to develop a detailed model, with 104 Scientific and Technical Report IRSN

44 Accidents in nuclear facilities 2. 6 EPSP 1.8x10-2 Max: 1.71x10-2 E % 1.6x x x10-2 1x x x x x CNDV Z6 CNU % 0.48% Min: Relative pressure (bar) UX 2.5x10-3 2x x10-3 1x x10-3 Max: 2.23x10-3 E24 40 CNDV Z6 CNU mm 1.9 mm 0.95 mm Min: Relative pressure (bar) AF30 E24_238 AF30 Z6 CNU 17.4 AF30 40 CNDV Figure 8 Plastic strain and maximum disjunction under seal as a function of relative pressure (in red: E24 steel bolts; in blue: Z6 CNU 17.4 steel bolts; in turquoise: 40 CNDV 0703 steel bolts). the following main characteristics: solid elements are used to model the metal sleeve, flanges, bolts, and hemispheric head, to avoid the problems posed by shell and beam elements in defining limit conditions; a much finer mesh is used, providing a more accurate representation of real geometry (changes in thickness, weld bevels, etc.); the gussets, collars, concrete, and rebars are not represented in this model, based on the assumption that concrete imposes its displacements and deformations on the less rigid metal components. The thermal calculation for the AF scenario was performed on the detailed sleeve model. The same behavior laws were used as in the equipment hatch simulation. The total linear element mesh, covering half the circumference (for reasons of symmetry), consists of 61,973 elements and 76,920 nodes (Figures 9 and 10). Unilateral relationships simulate attachment of the two flanges and contact with the bolts. Play can be introduced in these relationships. Unilateral contact with sliding and friction characterizes the connection between the shims, clamp, and the opposite flange. Implementation of the detailed model is similar to local model implementation. Limit conditions for imposed displacements are taken from the local model simulation and projected on the detailed model contour. An initial iterative calculation (prior to the accident simulation) balances the structure and the bolt tightening torque. Using solid elements and more accurate flange, shim, and clamp geometries, the detailed model makes it possible to define more realistic limit conditions for contact and friction between the flanges, with the imposed displacement provided by simulation of the same scenario using the local equipment hatch model. In this way, the detailed model provides new insights into the closing system's behavior. For example, it revealed the predominant effect of shear stress on bolts leading to failure, for moderate pressures, with a significant risk of compromising closure integrity. The normal load profile between the flanges is maximal at the clamp, and non-uniform around the circumference, which explains the moderate effect of changing tightening torque values and the friction coefficient: bolt yield strength is reached from the beginning of the AF scenario, after bolt tightening and establishment of steady-state mode (depending on the tightening torque selected); ultimate tensile strength for the bolts is reached at 8 bar absolute; plastic strain in bolts increases considerably during the pressure and temperature spike, eventually reaching values that have no physical significance; opening at the seal is slight (less than 0.1 mm), despite IRSN - Scientific and Technical Report

45 2. 6 Figure 9 Mesh of sleeve/flange system (including shims and bolts) at head end. Double O-ring seal Clamp in contact 14 mm thk Figure 10 Flange, head side Shim in contact 14 mm thk Shim with 2 mm of play Shim with 2 mm of play Flange, penetration side Mesh of single flange (with shims, clamp, and bolts) and schematic cross-section of both flanges. noticeable disjunction at the outer perimeter of the flanges. This model shows: the complex flange deformation mechanisms, excluding any interpolation, and the strong coupling between flange ovalization and buckling; the limited impact of axisymmetrical stress on the sleeve in terms of disjunction and bolt shearing (pressure loading, prestress-induced sleeve pinching), and the considerable nonaxisymmetrical sleeve strain imposed by the containment during the AF accident scenario (pressure and thermal loading), which result in flange buckling and ovalization; for bolts subjected to shear stress, the importance of bolt selection (cross-section, grade), which had a direct influence on the results (Figure 11). Ignoring the play between flanges and bolts, in the case where both flanges can slide relative to each other, bolt yielding occurs at low pressures (3.2, 3.8, and 5.5 bar absolute for E24, 40 CNDV 0703, and Z6 CNU 17.4 bolts respectively). These low pressure values, due to bolt shear stress, are highly sensitive to bolt/flange play. But given the equipment hatch closing problems on certain reactors and to remain conservative, it appears justified to minimize the flange-bolt play considered in the calculations. The shear criterion reached at low pressures (without play) is indicative of the weak closing system and the risk of bolt failure along a large portion of the circumference. The margin added by around 3 mm of play, realistic in terms of incipient bolt yielding, results in disjunction irreversibility during hydrogen combustion, at the estimated pressures of 6.2, 6.8, and 8.5 bar 106 Scientific and Technical Report IRSN

46 Accidents in nuclear facilities 2. 6 AF PREC 30 COL BO_E24 déformée des faces des brides 90683,193 9 Deformation with E24 bolts AF PREC 30 COM BO_Z6CNUI74_N déformée des faces des brides 90683,193 Deformation with Z6CNU17.4 bolts AF PREC 30 COL BO_E24_ser69 déformée des faces des brides 90683,193 9 Deformation with 40CNDV0703 bolts containment integrity. In addition to the simulations, mockup test results were examined by an expert group to define a seal criterion adapted to the finite element calculations. Based on the mockup test results, the expert group recommended a containment failure pressure of around 10 bar absolute (2.25 times the design pressure). The calculations assume an idealized liner without considering possible weld defects or corrosion damage, since these phenomena are very difficult to simulate numerically. A safety coefficient should therefore be defined based on knowledge of these defects to determine the containment failure pressure. Figure 11 Flange surface deformations at 10 bar absolute, amplified 100 times (AF scenarios). absolute for E24, 40 CNDV 0703, and Z6 CNU 17.4 bolts respectively. Decreasing the cross-section is therefore detrimental to bolt strength, whereas greater yield strength contributes to mechanical strength (Figure 11). Variation related to modeling choices and material characteristics was found to be around 15%, based on sensitivity studies. This is much lower than the variation linked to the flange tightening configuration, in particular flange/bolt play. Conclusion Assessing integrity of the containment building, which serves as the third and final barrier, is a critical safety issue, given that environmental release in a severe accident context is partly driven by containment leakage. The wide range of competence applied to this project is evidence of the complexity of the problem and the diversity of the parameters involved. Furthermore, the innovative multiscale approach and the structural calculations using non-linear finite element analysis, beyond the scientific challenge they represent, also demonstrate that numerical simulations can be used to assess containment integrity. Researchers were able to extrapolate results from the three severe accident scenarios simulated (AF, AS, and PL) to other severe accident scenarios in the PSA2 project, given that the mechanical phenomena are mainly pressuredriven. For the equipment hatch, depending on the possibilities of inter-flange sliding, the local and detailed models highlighted two complementary containment failure modes involving tensile stress and bolt shearing, subject to threshold effects and dependent on bolt choice and the specific conditions in each facility (initial play, flange surface condition, friction, etc.). Regardless of the failure mode, these studies confirmed the weakness of the current flange closing system, which uses 33-mm-diameter E24 steel bolts. EDF has decided to change the grade and diameter of equipment hatch bolts to increase the accident failure pressure to at least 8 bar absolute. Other weak parts of the containment not considered in these studies, e.g. other penetrations, also need to be investigated for severe accident conditions, since failure pressure depends on these elements as well. Finally, results of the PSA2 project played a key role in the 900 MWe PWR safety assessments prior to the third series of ten-year inspections, by providing the demonstrations required to support IRSN's analysis. The non-linear calculations effectively simulated mechanical containment behavior in severe accident conditions and made it possible to detect sensitive points in the structure. In 900 MWe PWR containments, the internal metal liner ensures IRSN - Scientific and Technical Report

47 2. 6 References B. Cirée, G. Nahas, 2007, Mechanical Analysis of the equipment hatch behaviour for the French PWR 900 MWe under severe accident. H01/3 - Proc. SMiRT, Toronto, Canada. M.F. Hessheimer, R.A. Dameron, 2006, Containment Integrity Research at Sandia National Laboratories. NUREG/CR-6906 SAND P. International Standard Problem No. 48, Containment capacity, 2004, Phase 2 Report Results of Pressure Loading Analysis, Organization for Economic Co-operation and Development, Nuclear Energy Agency, Committee on the Safety of Nuclear Installations. NEA/CSNI/R(2004)11. International Standard Problem No. 48, Containment Capacity, 2005, Synthesis Report, Organization for Economic Co-operation and Development, Nuclear Energy Agency, Committee on the Safety of Nuclear Installations. NEA/CSNI/R(2005)5/Vol.1, 2 and 3. G. Nahas, B. Cirée, 2007, Mechanical Analysis of the containment building behavior for the French, PWR 900 MWe under severe accident. H05/5 - Proc. SMiRT, Toronto, Canada. E. Raimond, B. Laurent, R. Meignen, G. Nahas, Cirée B., 2004, Advanced modelling and response surface method for physical models of level 2 PSA event tree. CSNI-WG-Risk-Workshop level 2 PSA and severe accident management, Köln, Germany. P. Verpeaux, A. Millard, T. Charras, A. Combescure, 1989, A modern approach of large computer codes for structural analysis. Proc. SMiRT, Los Angeles, USA. 108 Scientific and Technical Report IRSN

48 newsflashnewsflashnewsflashnewsflashnewsflashnewsflash 2.7 Initial results of the Prisme Door campaign Pascal Guillou William Le Saux Fire Experimentation Laboratory Ten countries and two French partners, EDF and the French armament procurement agency DGA, are participating in the experimental PRISME program, focused on fire propagation in elementary, multiple-enclosure scenarios applied to nuclear facilities. Launched by IRSN in 2005 and coordinated under the auspices of the OECD, PRISME consists of several test campaigns conducted over a five-year period. Prisme Door investigated heat and smoke propagation through open doors between rooms. This series of six tests carried out in IRSN's DIVA facility ended on March 29, Some 3500 measurements were taken, as described in the test reports, available to program partners at the PRISME website. IRSN has already applied the initial results as part of a comparative exercise between the various simulation codes used by the partners. Analysis of the results began with heat release rate calculations. For the first time in tests of this type, several approaches will be compared: a "mechanical" approach, in which the pyrolysis rate is measured using a specific weighing device, and the effective heat of combustion is calculated from results of the Prisme Source test campaign, conducted under the SATURNE hood; a "chemical" approach, based on measuring oxygen, carbon dioxide, and carbon monoxide concentrations; and a "thermal" approach, based on temperature measurements and wall heat fluxes. The heat release rate calculations were presented to program partners at the OECD PRISME meeting held on October 17 and 18, IRSN - Scientific and Technical Report