Scenarios of Heavy Beyond-Design-Basis Accidents in HTGRs N.G. Kodochigov, Yu.P. Sukharev

Transcription

1 Scenarios of Heavy Beyond-Design-Basis Accidents in HTGRs N.G. Kodochigov, Yu.P. Sukharev IAEA Technical Meeting on the Safety of High Temperature Gas Cooled Reactors in the Light of the Fukushima Daiichi Accident, April 08-11, 2014, Vienna, Austria

2 Introduction The practical response of the Rosatom to the Fukushima Daiichi NPP accident was to develop the Work Plan to Enhance the Safety Level of Operating Russian NPPs that in particular has a provision to carry out target checks and safety analysis of extreme events with account of the Fukushima Daiichi NPP accident. This paper describes the analysis that has similar objectives and is performed for a Nuclear Power and Process Station (NPPS) design with a reactor plant based on a high-temperature modular gas-cooled reactor. The station is designed to produce hydrogen by the high-temperature electrolysis method (MHR-HTE). This paper describes scenarios developed for beyond-design-basis accidents (BDBA). Analysis results for these accidents are given in the report Results of Safety Assessment Test (Stress Tests) for HTGR. 2

3 Goal of the Work The goal of the work is to substantiate heavy BDBA scenarios for the NPPS with the MHR-HTE reactor plant in extreme external events and to carry out an analysis of these accidents. As an initial event for the accidents, an Maximum Design-Basis Earthquake (MDBE) + 1 point seismic impact is adopted (9 points on the MSK-64 scale). It is assumed that the initial event results in a total NPPS blackout and containment damage. Accident scenarios are considered with failures of safety-grade systems emergency protection system and reserve reactor shutdown system (RSS), passive reactor cavity cooling system (RCCS) overlapping the initial event, as well as with primary circuit depressurization or steam generator inter-circuit leak overlapping the initial event. 3

4 4 Brief Description of the Design The following equipment and systems are incorporated in the MHR-HTE reactor plant: a) Primary circuit: 1) Modular high-temperature gas-cooled reactor (HTGR) 2) Steam-generating units (SGU) each of which incorporates a steam superheater, steam generator and main gas circulator 3) Vessel unit that joins the reactor vessel, SGU vessels and cross-vessels into a single high-pressure system 4) Unit of the Shutdown Cooling System (SCS) that incorporates a heat exchanger and SCS gas circulator with a shut-off valve b) Primary circuit overpressure protection system c) Primary coolant purification system d) Helium system e) Main gas circulator cooling water system (within the containment) f ) SCS cooling water system g) Reactor Cavity Cooling System (RCCS) The primary coolant is helium; the working media of the secondary circuit are superheated steam and feedwater. The reactor plant boundaries are the leak-tight containment, segments of the secondary pipelines and pipelines of the reactor plant auxiliary systems with redoubled localization valves all of them are within the containment.

5 30,000 nm 3 /h H 2 15,000 nm 3 /h O 2 Electricity Water 5 Schematic Diagram of the Plant High-temperature electrolysis plant (HTEP) Steam STP SH 800 C SG Steam Water Gas circulator SCS Reactor Cooling tower RCCS MHR-HTE is a two-circuit plant. The primary circuit is designed to transfer heat generated in the reactor core to the working medium of the secondary circuit in the SGU. The design leak of the primary circuit is 0.3% of the entire volume per 24 hours. The secondary circuit is designed to produce superheated steam with required parameters in steam generators (SG) and steam superheaters (SH), and to supply the steam to the steam-turbine plant to generate electricity; and to the high-temperature electrolysis plant (HTEP) to produce hydrogen.

6 6 Safety Systems The MHR-HTE reactor has two independent emergency shutdown systems, namely, a CPS system and a reserved shutdown system (RSS). The worth of either of these systems is sufficient for bringing the reactor core to and maintaining it in the cold unpoisoned subcritical state considering the principle of single failure (non-insertion into the core) of one CPS or RSS control element having the highest worth. The control and protection system (CPS) elements are control rods and RSS control elements (absorber spherical elements). As an absorber material, both CPS and RSS use natural boron carbide. In the reactor core, there are 54 CPS control rods (12 control rods in the fuel stack; 36 control rods in the replaceable side reflector; and 6 control rods in the replaceable central reflector) and 18 channels for RSS absorber spheres (all the channels are in the fuel stack). All CPS control rods and RSS channels are equipped with individual drives. CPS CRDMs and RSS control element drive mechanisms are electro-mechanical. The core is rendered subcritical automatically (or remotely by the operator) through de-energizing all electric motors in the CRDMs on a scram signal and inserting all CPS control rods into the core passively under gravity. In the case of a CPS failure, the operator performs an emergency reactor shutdown. The MHR-HTE reactor plant has three reactor heat removal systems, the first two of which are not safety grade systems: - Heat removal system through SGU steam generators - Shutdown Cooling System (SCS) - Reactor Cavity Cooling System (RCCS)

7 Safety Systems (continued) Thus, operation of these systems is ensured through functioning of the control and auxiliary (electric and water supply) systems. If it is impossible to use active normal operation systems, emergency heat removal is performed by the RCCS that functions as a safety-grade protection system and incorporates two equally efficient independent cooldown channels. One channel is sufficient to cool down the shutdown reactor. RCCS is a fully passive system heat is removed from the core through the reactor vessel by natural physical processes (heat conduction, radiation and convection). Media circulation is natural in the water circuit and air circuit. The safety grade systems also include: - Leak-tight containment system - Localizing valves 7

8 8 Assumptions Because the main radioactive product retention barrier in the MHR is fuel, a lowpressure containment with a controlled vented release is viewed as a leak-tight enclosure (confinement). With such a solution, at the initial stage of the primary circuit depressurization accidents, a controlled limited release of low-activity primary helium is done from the containment rooms directly to the high-rise venting chimney without purification in filters in order to prevent a containment failure due to overpressure. Then, the containment is actively vented with purifying the released air-helium mixture in aerosol and coal filters. In beyond-design-basis accidents (BDBA), if active venting equipment is out of order, the long term radioactivity release to the environment is limited by the hydraulic lock on the path of the controlled release. The possible radioactivity release to the environment will be determined by the containment leak rate (the design leak rate is 1.0% of the volume per 24 hours at the maximum accident pressure of 0.15 MPa). The main specifications of the MHR-HTE reactor plant in operation at 100% nominal power are shown in the table.

9 Main Specifications of the Reactor Plant Parameter or Characteristic Value Reactor thermal power, MW Heat losses in RCCS and SCS, MW 5.0 Reactor inlet/outlet helium temperature, C 492.0/850.0 Reactor helium flow rate, kg/s Reactor inlet helium pressure, MPa 7.0 9

10 Containment Schematic Design schematic diagram of the low-pressure containment with a controlled vented release Low-pressure Контайнмент низкого containment давления Energy Блок conversion преобразования unit (electricity энергии generation) (производство электроэнергии) Reactor Реактор High-temperature Высокотемпературный heat exchanger теплообменник 10

11 Selection of Beyond-Design-Basis Accidents for the Safety Analysis In order to assess MHR-HTE reactor plant safety in extreme external events, a spectrum of possible accidents is considered that are postulated by the initial event a seismic impact in excess of the Maximum Design-Basis Earthquake level (MDBE + 1 point) with additional failures of reactor plant equipment and systems overlapping the initial event and resulting in heavier consequences that require actions to be taken in order to mitigate these consequences. 11

12 12 Selection of Beyond-Design-Basis Accidents for the Safety Analysis (continued) It is assumed that the seismic impact with the magnitude in excess of the MDBE produces a number of dependent failures that aggravate the accident mode and consequences: damage to (break of) the external power supply lines, which leads to a long-term blackout to a loss of normal in-house power supply sources at the NPPS partial or full structural failure of the cooling towers in the return water supply system and sprinkler pools (or cooling towers), which results in a loss of the ultimate heat sink systems containment depressurization with the area equal to the hydraulic lock pipe cross-section (the pipe diameter is 2000 mm) due to a structural failure of the hydraulic lock after a fall of the venting chimney In its turn, the blackout results in trips of: main primary gas circulators feedwater and condensate pumps main gas circulator return water system circulation pumps return water supply system circulation pumps, which is a reason for a loss of the reactor core heat removal channel through the SGUs.

13 13 Selection of Beyond-Design-Basis Accidents for the Safety Analysis (continued) Additionally, the loss of the ultimate heat sinks leads to a loss of cooling of the emergency and reserved diesel generators (EDG and RDG), which makes it impossible to start them the allowed operation time for the diesel generators without cooling is less than 60 seconds. Thus, the failure to start the EDG and RDG can be looked at as a dependent failure. The total NPPS blackout that is the loss of normal, reserved and emergency power supply sources in its turn, makes it impossible to start circulation pumps in the water supply system, SCS cooling water system, SCS gas circulator, which means a loss of the reactor core heat removal channel through the SCS. As additional failures of reactor plant systems and equipment that determine scenarios of beyonddesign-basis accidents, the following are considered: - scram actuation failure - failure of two RCCS channels - cross-vessel break - steam generator inter-circuit leak According to IAEA recommendations, the reactor scram actuation failure (ATWS-type accidents) is looked at as a failure of only the fast acting scram system and it takes place because of the scram signal not reaching the CRDMs or because of a mechanical failure of the CRDMs due to a common reason. Eventually, this leads to non-insertion of the CPS control elements into the core on the scram signal. Initiation is preserved of all the other protective actions provided for by the design to bring the reactor plant to a safe and controlled state.

14 14 Selection of Beyond-Design-Basis Accidents for the Safety Analysis (continued) The failure of two RCCS channels with the full NPPS blackout leads to a loss of all heat removal systems provided for by the MHR-HTE design. It is assumed that the RCCS channels fail due to depressurization of the elements in water circuits. In terms of the worst consequences, depressurization is considered with breaks of surface cooler tubes throughout their entire cross-sections in the lower portion of the reactor cavity (one tube in each RCCS channel), which leads to a full loss of water in both channels of the system with water being supplied to the reactor cavity. A cross-vessel break throughout its entire cross-section of DN2300 leads to a twosided primary coolant outflow to the containment. The primary coolant outflow diameter is determined by the annular gap between the cross-vessel and the hot gas duct (around 360 mm). Under the conditions of the large break, the primary pressure drops fast and the containment pressure grows fast. The water inflow into the primary circuit due to the steam generator inter-circuit leak is accompanied by growing humidity and pressure in the primary circuit, leads to insertion of positive reactivity and oxidizing of graphite structures in the core and reactor. It is assumed that the design primary circuit leak rate is preserved in the accidents under consideration.

15 15 Selection of Beyond-Design Basis Accidents for the Safety Analysis (continued) Thus, for a safety analysis of the MHR-HTE reactor plant in heavy beyond-design-basis accidents (BDBA), the following accidents are selected: A) seismic impact with a loss of power supply sources and heat removed by the RCCS: 1) initial event: - seismic impact with the force greater than the MDBE 2) dependent failures: - blackout loss of the power supply, main and reserved in-house power supply transformers - failure of the ultimate heat sink systems: return water supply system and reliable industrial water supply system - failure to start the emergency and reserved diesel generators (EDG and RDG) B) seismic impact with a loss of power supply sources, non-actuation of the reactor scram and heat removed by the RCCS: 1) initial event: - seismic impact with the force greater than the MDBE 2) dependent failures: - blackout loss of the power supply, main and reserved in-house power supply transformers - failure of the ultimate heat sink systems: return water supply system and reliable industrial water supply system - failure to start the emergency and reserved diesel generators (EDG and RDG) 3) additional failures: - non-actuation of the reactor scram

16 Selection of Beyond-Design Basis Accidents for the Safety Analysis (continued) C) seismic impact with a total blackout, with a loss of power supply sources and RCCS failure: 1) initial event: - seismic impact with the force greater than the MDBE 2) dependent failures: - blackout loss of the power supply, main and reserved in-house power supply transformers - failure of the ultimate heat sink systems: return water supply system and reliable industrial water supply system - failure to start the emergency and reserved diesel generators (EDG and RDG) 3) additional failures: - failure of two RCCS channels D) seismic impact with a loss of power supply sources, depressurization of the primary circuit and heat removed by the RCCS: 1) initial event: - seismic impact with the magnitude greater than the MDBE 2) dependent failures: - blackout loss of the power supply, main and reserved in-house power supply transformers - failure of the ultimate heat sink systems: return water supply system and reliable industrial water supply system - failure to start the emergency and reserved diesel generators (EDG and RDG) 3) additional failures: - guillotine rupture of the cross-vessel throughout its entire cross-section of DN

17 Selection of Beyond-Design Basis Accidents for the Safety Analysis (continued) E) seismic impact with a loss of power supply sources, inter-circuit leak in the steam generator and heat removed by the RCCS: 1) initial event: - seismic impact with the magnitude greater than the MDBE 2) dependent failures: - blackout loss of the power supply, main and reserved in-house power supply transformers - failure of the ultimate heat sink systems: return water supply system and reliable industrial water supply system - failure to start the emergency and reserved diesel generators (EDG and RDG) 3) additional failures: - feedwater (steam) header break throughout its entire cross-section of DN20 in one steam generator Analysis results for reactor plant behavior in accidents according to the developed scenarios are shown in the presentation Results of Safety Assessment Tests (Stress Tests) for HTGR 17

18 Main Criteria for Safety Assessment As the main criteria for NPPS safety assessment in heavy beyond-designbasis accidents, the following are adopted: There is no need for emergency evacuation or resettlement of the population outside the buffer zone. This requirement is met if at the initial stage of the accident (first ten days), the radiation dose absorbed by the population is below 50 mgy, and the annual equivalent radiation dose for the population is below 50 msv during the first year after the accident. There are no actions to be taken to protect the population outside the emergency planning zone boundary (less than 25 km from the NPPS) except for temporary limitation of consumption of locally manufactured agricultural products. This requirement is met if the radiation dose for the population (without consuming the products) at the emergency planning zone boundary and outside it is less than 5 msv over the first year after the accident. 18

19 Burnakovsky proezd, 15, Nizhny Novgorod, , Russia Tel. (831) , (831) Fax (831)