A DYNAMIC ASSESSMENT OF AUXILIARY BUILDING CONTAMINATION AND FAILURE DUE TO A CYBER-INDUCED INTERFACING SYSTEM LOSS OF COOLANT ACCIDENT

Transcription

1 A DYNAMIC ASSESSMENT OF AUXILIARY BUILDING CONTAMINATION AND FAILURE DUE TO A CYBER-INDUCED INTERFACING SYSTEM LOSS OF COOLANT ACCIDENT Z.K. Jankovsky The Ohio State University Columbus, USA jankovsky.3@osu.edu Abstract M.R. Denman Sandia National Laboratories Albuquerque, USA T. Aldemir The Ohio State University Columbus, USA Accident scenarios with the potential to bypass containment or otherwise lead to early release of radioactive material are a focus of significant scrutiny in nuclear power plant design and safety assessment. One such scenario is an interfacing system loss of coolant accident in which the low-pressure residual heat removal system is overwhelmed by undesired physical communication with the high-pressure reactor coolant system. The pipe or heat exchanger dependent failures that may follow offer a path of contamination past containment. A cyber-induced undesired valve opening is considered that is not readily reversed from the main control room with the objective of assessing the impact of inhospitable conditions and hydrogen accumulation in the auxiliary building. Radioactive contamination and flooding in the auxiliary building may impede operators in resolving the initial valve opening event. A dynamic assessment of these uncertainties is performed using the ADAPT dynamic event tree analysis package, exploring through a structured process the likely outcomes of the combination variety of events and physical parameters of interest. 1. INTRODUCTION In nuclear power plant (NPP) safety analysis, an early release of radionuclides represents a breakdown of the containment strategy that is designed to increase the time available for response to mitigate the consequences of an accident. The containment structure itself has numerous penetrations to accommodate ancillary systems. One class of accidents that is of concern with regards to early release in a light water reactor (LWR) is the interfacing system loss of coolant accident (ISLOCA), in which a low-pressure system beyond containment is damaged by unintended communication with the high-pressure reactor coolant system (RCS). Such events have historically been assessed to lead to large early off-site exposure [1]. The low initiating event probability of an ISLOCA often leads to it being screened out of analyses [2]. In advance of the implementation of digital instrumentation and control (DI&C) in new and existing plants [3], a great deal of research was performed for modeling the likelihood of the various failure modes of digital systems [4, 5, 6, 7]. This is necessary because the software and communications networks associated with digital systems present additional failure modes that are distinct from those in traditional analog control systems. For example, a programming error in a network device may result in spurious actuations of diverse systems in a similar fashion to a cable fire [8]. In this work, a simultaneous failure of digital controllers is considered which has the effect of opening motor-operated valves (MOVs) at full RCS pressure and endangering the lower-pressure residual heat removal (RHR) system. Plant dynamics associated with the initiating event, overpressure capacities of RHR components, and timing and success of mitigation actions by plant personnel are treated in a dynamic event tree (DET) framework which can account for complex hardware/software/firmware/process/human interactions and allows for the search of the uncertainty space in a verifiable manner for adequate completeness. Recently developed analysis tools are used to examine the resulting DET and draw insights into the importance of various events and parameters. 2. PLANT SYSTEM AND TRANSIENT The hypothetical plant being studied in this work is a three loop pressurized water reactor (PWR) with a combined low pressure safety injection (LPSI) and RHR system 1 located outside of containment, a configuration that exists in multiple operating plants in the USA [9]. High pressure safety injection (HPSI) and LPSI are 1 When discussing the shared system and its pipes, pumps, and heat exchangers, this is referred to as RHR. Discussion of the injection function uses the term LPSI. 1

2 IAEA-CN emergency systems that can replace lost RCS inventory from external tanks in the event of a LOCA. HPSI provides a small amount of flow at pressures up to 12 MPa. LPSI can provide a larger flow rate at 2 MPa. In the case of a sudden pressure increase, the small relief lines of the RHR system are likely to be overwhelmed. An ISLOCA subjects the RHR intake piping and the heat exchangers (HXs) to high pressure, which may cause them to fail [10]. Either type of failure has the potential to spill RCS inventory outside of containment, resulting in an early release of radionuclides and a flood in the auxiliary building. In the event of an RHR ISLOCA, the reactor will automatically scram due to low RCS pressure. HPSI and LPSI will automatically inject water up to their operating pressures if they are available. The pilot-operated relief valves (PORVs) are automatically activated and will open and close to maintain a nominal pressure range. The effect of opening a PORV is to vent the RCS into the larger containment volume. Because of the shared RHR system, LPSI is assumed lost until recovery actions have been performed. The component cooling water (CCW) system cools the RHR HXs, RHR and HPSI pumps, and other plant systems. CCW and the systems that depend on it are assumed to be out of service in the event of an RHR HX failure, and restored once CCW is isolated from the HX. There are actions that may be taken to mitigate the effects of the breaks. Isolating the refueling water storage tank (RWST) from the RHR system will preserve inventory for injection and lessen the extent of auxiliary building flooding. Bypassing damaged HXs restores a pathway from the RHR pumps to RHR outlet. Isolation of damaged HXs recovers systems dependent on CCW, such as HPSI. Finally, if the RHR isolation valves are stuck open the operators may open the PORVs. This action was explored in detail in the State-of-the- Art Reactor Consequence Analyses (SOARCA) project as a way to reduce the mass of water and radionuclides that blow out of containment [2]. 3. DYNAMIC CASE A DET was generated using the ADAPT driver code [11] coupled with a plant model [12] in the MELCOR light water reactor severe accident code [13]. ADAPT operates by perturbing an initial plant model according to user-supplied rules that describe possible ways the system can evolve (branching conditions) and tracking the resulting accident progression sequences [11]. The simulator (in this case MELCOR) is programmed to recognize when plant conditions indicate a branching condition has been reached. For example, if uncertainty in RHR piping failure is to be assessed, the model is programmed to stop the first time the piping is challenged by an increase in pressure. At that point ADAPT determines the reason for stopping and applies the necessary changes to a template MELCOR input file to generate at least two branches, one with no RHR piping failure and the other corresponding to the case where failure occurs. Each branch is run forward from the branching point in a new instance of MELCOR when computing resources are available until the next challenge. The process ends when all sequences reach the maximum simulation time indicated by the input. Branches in ADAPT are assigned likelihoods that are conditional on the associated condition (e.g., ISLOCA initiation) being reached. For an uncertain parameter with a cumulative distribution function (CDF), such as the pressure capacity of piping, multiple samples may be taken from CDF to cover the uncertainty space of interest. A balance must be struck between coverage of parameter space and computational cost, as the size of the DET may grow significantly with each additional sampled value. However, it is possible to verify whether an adequate number of samples have been drawn by observing the convergence of a metric of interest (e.g., dynamic importance measures described in Section 4). In this study, the RHR intake pipe and HXs are assumed to have uncertain pressure capacities that vary according to lognormal distributions with parameters shown in Table 1. The CDFs and initially sampled values (red stars) of these capacities are seen in Fig. 1. For illustration purposes, only the 5 th, 50 th, and 95 th percentile values were used for each component in generating the DET. If the pressure in a MELCOR control volume exceeds the capacity at the specified CDF percentile, rupture of the represented hardware is assumed to occur. The timings for mitigating operator actions taken outside the control room are assumed to follow a Weibull distribution with parameters taken from [16], which was originally applied to the manual isolation of an auxiliary feedwater system. The CDF for the base distribution, as well as one modified with a minimum time to completion of 350s, are shown in Fig. 2. A minimum time may be set to account for unavoidable delays such as donning protective equipment and moving through the building. Values initially sampled are indicated with a red star in Fig. 2, of which the 5 th, 50 th, and 95 th percentile values were used in this study. A pipe break or HX rupture is assumed to initiate flow into the RHR pump room or RHR HX room, respectively, potentially bursting the room door and flooding the main hall of the building. This may delay operators, and they are assumed to be unable to complete their tasks in water levels over 1 inch. There is uncertainty as to the burst capacity of the doors; a nominal level of 5 feet is used [14], along with levels of 4 feet

3 and 6 feet to gauge sensitivity to the burst capacity. Two mitigating actions may be taken from inside the control room: opening of PORVs and RWST isolation. These actions are branched at times of 6 minutes and 16 minutes following accident initiation, respectively, based on the SOARCA ISLOCA study [2]. Isolating the RWST from LPSI involves closing an MOV; the likelihood of failure for this action as well as opening a PORV are shown in Table 2. FIG. 1. CDF for RHR Component Capacities [15, 16]. FIG. 2. CDF for time to complete actions [17]. Table 1. RHR COMPONENT CAPACITY Component Median Log. Std. Dev. (psig) Intake Pipe [15] Tube [16] Shell [16] Table 2. EVENT LIKELIHOODS Event PORV fail to open [18] PORV fail to close [18] MOV fail to open or close [18] Likelihood (demand -1 ) 7.0* * * RESULTS AND ANALYSIS The example DET was generated on a computing cluster consisting of three dual processor nodes running Red Hat Enterprise Linux 7, with capacity to run 56 branches simultaneously. This resulted in 38,000 branches and required 9 days to run. The conditional core damage probability was 2.9*10-6. The primary pressure and vessel water level are shown in Figs. 3 and 4, respectively, for all sequences. Sequences that maintain a high pressure past approximately 100s are those that experienced a loss of isolation but branched into high values of pressure capacity for RHR piping and HXs. The top of active fuel is marked in Fig. 4 at 6.7m. FIG. 3. Primary pressure for all sequences. FIG. 4. Reactor Vessel water level for all sequences. A small number of scenarios were run manually to confirm expected accident behavior. All scenarios that experienced an RHR HX break also experienced core damage. This is an expected result of the assumption that an RHR HX break disables CCW, and thus HPSI, until it is isolated. Opening the PORVs early in the scenario was observed to lessen the extent of loss of RCS inventory, as expected from the work reported in [2]. 3

4 IAEA-CN In order to determine the significance of key uncertain parameters, measures were used which compare the value of a consequence of interest (e.g., hydrogen production) for different values of the parameter of interest (e.g., time to RHR HX isolation) across a DET. Referred to as dynamic importance measures (DIMs) [19], the DIMs considered in this study are defined in Table 3, where R represents the expected value of a measure of consequence, x=0 represents the set of sequences where event x does not occur, and x=1 represents the set of sequences where event x does occur. R may be defined, for example, as the peak value of a physical measure. The value of DIM1 represents the ratio of the expected value of the consequence measure between an event occurring and not occurring. The values of DIM2 and DIM3 are functions of the value i, which is used to represent uncertainty in the extent or timing of an event x. An example calculation is given in Equation 1 for an event x that occurs in sequences A and B, and not in C. The conditional probabilities of the sequences are 0.35, 0.45, and 0.1, respectively. The values of the consequence measure R are 0.93, 0.45, and 0.55, respectively. (1) The final value in Equation 1 is interpreted as follows: in sequences where x occurs, the expected consequence is 1.2 times that of sequences where x does not occur. DIM1 values calculated for some relevant events are given in Table 4. Values of Inf in Table 4 indicate that there was no hydrogen generation in sequences where the event did not occur. In this case, it appears that hydrogen is produced only when an RHR HX failure occurs, and that a pipe break tends to increase it. This is expected, as an RHR HX failure also disables HPSI until the supporting CCW system can be restored. Comparisons are made for some non-binary isolation timings in Table 5. A relationship can be seen where hydrogen production tends to increase with the time required to isolate an RHR HX shell rupture. Early isolation times are associated with decreased hydrogen generation versus cases where isolation fails, while a later isolation time is associated with increased generation. It appears that a point is reached (the location of which would be determined by further study) where late isolation is less desirable than a failure of isolation. The effects of RHR component capacities, as well as the burst capacities of the doors to the RHR pump and HX rooms are seen in Table 6. Higher levels of hydrogen production have been observed for cases with higher door capacities. Mitigating actions cannot be performed in a room while it is flooded, and bursting of the door may result in faster dryout after a leak and thus quicker recovery of affected systems. Table 3. DYNAMIC IMPORTANCE MEASURES Importance Measure Description Consequence ratio of occurrence to non-occurrence Consequence ratio of value x=1 i to non-occurrence Consequence ratio of value x=1 i to average of occurrence Table 4. DIM1 VALUES Event (x in Table 3) RHR pipe break RHR HX tube break RHR HX shell break RHR HX shell isolation DIM1 3.8E6 Inf Inf 0.72 Table 5. DIM2 VALUES (*see Fig. 2 for percentiles) Event (x in Table 3) DIM2 RHR HX shell isolation (5 th* ) 1.9E-6 RHR HX shell isolation (50 th ) 1.0E-4 RHR HX shell isolation (95 th ) 2.6E21 Table 6. DIM3 VALUES (*see Fig. 1 for percentiles) Event (x in Table 3) DIM3 RHR pipe capacity (5 th* ) 1.4E-6 RHR pipe capacity (50 th ) 8.3E11 RHR pipe capacity (95 th ) 3.2E-7 RHR pump door (4ft) RHR pump door (6ft) RHR pump door (8ft) RHR HX door (4ft) RHR HX door (6ft) RHR HX door (8ft) 1.0E-6 1.0E-6 9.1E17 1.1E-6 9.8E-7 8.8E17

5 5. CONCLUSION A first-of-kind dynamic ISLOCA case was performed, considering the effects of flooding and contamination of the auxiliary building on emergency systems and the ability of operators to arrest the accident. This is an example of an accident type that has been assumed to have a low likelihood in existing analog plants, but may become more risk-significant as plants are upgraded or built with digital control equipment. The use of dynamic DET generation and post-processing tools allows for insights to be drawn that may be obscured in a traditional PRA. REFERENCES [1] Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants, United States Nuclear Regulatory Commission, Washington, DC, NUREG-1150, [2] State-of-the-Art Reactor Consequence Analyses Project Volume 2: Surry Integrated Analysis, United States Nuclear Regulatory Commission, Washington, DC, NUREG/CR-7110 Vol. 2, August [3] Oconee Nuclear Station Units 1, 2, and 3, Issuance of Amendments regarding Acceptance of the Reactor Protective System and Engineered Safeguard Protection System Digital Upgrade, United States Nuclear Regulatory Commission, Washington, DC, ML , [4] T. Chu, et. al., Modeling a Digital Feedwater Control System Using Traditional Probabilistic Risk Assessment Methods, United States Nuclear Regulatory Commission, Washington, DC, NUREG/CR-6997, [5] T. Aldemir, et. al., Current State of Reliability Modeling Methodologies for Digital Systems and Their Acceptance Criteria for Nuclear Power Plant Assessments, United States Nuclear Regulatory Commission, Washington, DC, NUREG/CR-6901, [6] T. Aldemir, et. al., Dynamic Reliability Modeling of Digital Instrumentation and Control Systems for Nuclear Reactor Probabilistic Risk Assessments, United States Nuclear Regulatory Commission, Washington, DC, NUREG/CR-6942, [7] T. Aldemir, et. al., A Benchmark Implementation of Two Dynamic Methodologies for the Reliability Modeling of Digital Instrumentation and Control Systems, United States Nuclear Regulatory Commission, Washington, DC, NUREG/CR-6985, [8] Implementing Digital Instrumentation and Control Systems in the Modernization of Nuclear Power Plants, International Atomic Energy Agency, Vienna, Austria, Nuclear Energy Series No. NP-T-1.4, [9] P. Lobner, et. al., Overview and Comparison of U.S. Commercial Nuclear Power Plants, United States Nuclear Regulatory Commission, Washington, DC, NUREG/CR-5640, September [10] G. Bozoki, et. al., Interfacing Systems LOCA: Pressurized Water Reactors, United States Nuclear Regulatory Commission, Washington, DC, NUREG/CR-5102, February [11] U. Catalyurek, et. al., Development of a Code-Agnostic Computational Infrastructure for the dynamic generation of accident progression event trees, Reliability Engineering & System Safety, vol. 95, no. 3, pp , Mar [12] J. Cardoni, et. al., Severe Accident Modeling for Cyber Scenarios, in Proceedings of ANS 2016 Winter Meeting. Las Vegas, NV, Nov [13] L. Humphries, et. al., MELCOR Computer Code Manuals - Vol. 1: Primer and User s Guide - Version , Sandia National Laboratories, Albuquerque, NM, SAND R, [14] A. Guler, et. al., A Dynamic Treatment of Common Cause Failure in Seismic Events. In: Proceedings of the 2016 International Congress on Advances in Nuclear Power Plants. San Francisco, CA, Apr [15] D. Wesely, Interfacing Systems LOCA (ISLOCA) component pressure capacity methodology and typical plant results, Nuclear Engineering and Design, vol. 142, no. 2-3, pp , August [16] D. Kelly, et. al., Assessment of ISLOCA Risk-Methodology and Application to a Westinghouse Four-Loop Ice Condenser Plant, United States Nuclear Regulatory Commission, Washington, DC, NUREG/CR-5744, Apr [17] K. Coyne, A Predictive Model of Nuclear Power Plant Crew Decision-Making and Performance in a Dynamic Simulation Environment, Ph.D. dissertation, The University of Maryland, [18] S. Eide, et. al., Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nuclear Power Plants, United States Nuclear Regulatory Commission, Washington, DC, NUREG/CR-6928, February [19] Z. Jankovsky, et. al., Dynamic Importance Measures in the ADAPT Framework. In: Proceedings of ANS 2016 Winter Meeting. Las Vegas, NV, Nov