PROBABILISTIC SAFETY ANALYSIS (PSA) LEVEL 2 Kaliopa Mancheva March 16, 2017
WHY PSA LEVEL 2? o The safety bases are established on the principles of safety, thereby ensuring protection of those working at a nuclear facility, as well as of the population and the environment against harmful ionizing radiation at this moment and in future. These principles determine the need for risk assessment and management of nuclear facilities. The PSA is one of the basic means for risk assessment of possible releases of radioactive products into the environment and the consequences thereof o More specifically, the PSA Level 2 deals basically with the investigation and assessment of possible paths of radioactive products release after nuclear fuel damage and the possibility not to release them into the environment o Nuclear fuel damage is associated with the term severe accident March 16, 2017
o The implementation of such type of projects has the following objectives: A systematic analysis to achieve certainty in the nuclear facility project compliance with the main safety objectives - overall level of safety Risk assessment of releases of radioactive products into the environment after fuel damage in the reactor, spent fuel pool, storage facilities and other facilities containing radioactive material Verification of project balancing, i.e. to ascertain that there are no expressed deficiencies in terms of specific impacts Use of the source terms and frequencies to determine off-site consequences (Level 3 PSA input) Evaluation of plant design To identify potential vulnerabilities in the mitigation of severe accidents To compare design options Support and verification of SAMG Use of a range of other PSA applications in combination with the Level 1 PSA results
o Objectives of the specific task: Assessment of Large Early Release Frequency (LERF): it considers only the sequences, for which the releases occur in the early phase of the accident. It is used for early risk release assessments A full-scope PSA Level 2: it considers all sequences, which lead to releases into the environment, both at the early and late phase of the accident
SCOPE OF PSA LEVEL 2 o PSA Level 2 can have a different scope, depending on the following: The type of initiating events that are to be analyzed: Internal initiating events (which include facility-internal failures, fires and flooding) External hazards (which include seismic, tornado, strong winds, high temperatures, external fires and floodings and etc.) The facility operational modes Full power modes Low power and shutdown modes The fuel location: Reactor vessel Spent fuel pool Spent fuel storage facility
General Steps of Level 2 PSA Input from the Level 1 PSA core damage minimal cut-sets/accident sequences Plant familiarisation for Level 2 PSA Plant damage states definition Severe accident modelling Containment performance analysis Source term analysis Quantification Results Sensitivities, uncertainties Use of the results Information collection and familiarization with plant features that influence severe accident progression Grouping of core damage MCSs into PDSs Phenomena/ Containment Event Tree (CET) analysis Response to severe accidents Fission product transport/ release categorization CET probabilities/ quantification Frequencies of large (early) release / release categories Sources of uncertainty Identifications of severe accident vulnerabilities and other applications
Design aspects identification o Identify and highlight plant SSC and operating procedures that can influence: severe accidents progression containment response transport of radioactive material o o The task includes also Reactor Building, Auxiliary Building, Secondary containment and etc. Examples: core materials and geometry of the reactor internals area under the reactor pressure vessel flow paths from the area under the reactor pressure vessel to the main containment volume chemical content of the concrete features that could lead to containment bypass sequences
[kg-zr per MW] PWR BWR WWER ANF 10x10 GNF 10x10 Fuel 6.0 11.5 8.05 Channel Control Rods Fuel Channel Box 0.5 [--] 0.78 [--] 5.6 [--] Grids and other [--] [--] 0.77 9x9 8x8 Total (kg) 3000 MW reactor 20,000 51,000 28,800 Channel box
General Steps of Level 2 PSA Input from the Level 1 PSA core damage minimal cut-sets/accident sequences Plant damage states definition Grouping of core damage MCSs into PDSs
Initiating Events (< 100) Initial plant Accident damage sequences states (millions) (50 to 100) Consolidated plant damage states (< 20) Accident progression / containment event tree end states (10 4 to 10 6 ) Release categories (< 20) Conditional consequence bins (< 20) Frequency * Consequence Accident sequence event trees (event probabilities from fault trees) Binning Process Combine Similar PDS Accident progression / containment event trees (branch probabilities with uncertainties) Risk Integration Stop Iterative truncation 10-10... 10-12... to convergence Screen on low frequency Sensitivity analysis & reconsideration of low-frequency PDS with high consequences LEVEL 1 LEVEL 1-2 Interface LEVEL 2 LEVEL 3
o o Plant Damage State (PDS) core melt sequences identified in the Level-1 PSA grouped based on similarities in accident progression and availability of containment safeguards and other systems that might have impact on accident progression after core melt Binning process is intended to establish an interface between The plant systems analysis (Level-1 PSA) and The containment response analysis (Level-2 PSA) o Software: SAPHIRE RiskSpectrum 1.2 last version
General Steps of Level 2 PSA Input from the Level 1 PSA core damage minimal cut-sets/accident sequences Severe accident modelling Phenomena/ Containment Event Tree (CET) analysis
o Main purposes and outcomes from the deterministic analysis Time chronology of the accident physical parameters of accident progression dependencies between phenomena o Used for expert judgment assessment of probabilities for different phenomena o Software: MELCOR, MAAP, ASTEC CV070 CV092 CV091 CV050 CV060 CV012 CV013 CV014 CV015 CV016 CV017 CV022 CV023 CV024 CV025 CV026 CV027 CV032 CV033 CV034 CV035 CV036 CV037 CV042 CV043 CV044 CV045 CV046 CV047 CV052 CV053 CV054 CV055 CV056 CV057 CV040 CV010 CV020 WWER-1000 Reactor Model
First Phase of Accident Progression IE TBO and DC power available Covers the period from CD to vessel breach - CD = 1200 C of claddings Chronology: Time [h:m] Event Comment 0.0 IE TBO with DC available 0.00+ Reactor Scram, MSIV* closure 0.00+ Diesel generators fail to start 0:03 MCP coast down 0:58 PORV opens Pressure is >180 MPa 3:03 H 2 generation starts H 2 O-Zr 3:08 Gap release Core damage 3:36 Tcl >1200 C Core damage 4:23 Core degradation Loss of mass of CL 6:55 Vessel failure Start to eject to cavity
Pressure and Temperatures Primary Side pressure is controlled by PORV Temperature increase rapidly after water depletion Secondary Side pressure is controlled by SG SV SDA assumed failed (no DC power)
Level [m] Level [m] Levels 14 12 10 8 6 4 2 Primary Side - Levels TAF BAF 0 0.00 2.00 4.00 6.00 8.00 Time [hours] 2.5 Pressurizer level is maintained up to vessel failure RPV level start to decrease after SG depletion SG levels 2 Major insights: PRZ level not indicative for mass inventory in the system 1.5 1 0.5 0 0.00 2.00 4.00 6.00 8.00 Time [hours]
Area Fraction [-] Mass [kg] Hydrogen generation Core blocking 700 600 500 400 300 200 100 1 0.9 0.8 0.7 0.6 0.5 0.4 0.3 0.2 0.1 0 0.00 2.00 4.00 6.00 8.00 Time [hours] Hydrogen generated in in-vessel phase 0 0.00 2.00 4.00 6.00 8.00 Time [hours] Upper FL Lowest FL Last Upper FL Lower FL Total H 2 production Simplified nodalization 5 volumes in core region H 2 production from Zr H 2 production from Steel H 2 production from B 4 C
o STRUCTURAL ANALYSIS OF THE PRIMARY SIDE ELEMENTS In case of a severe accident, the primary side elements operate in beyond design conditions. Therefore, an analysis is required of their operability and probability of failure, respectively. Tube bundle of the steam generator part o o The conditions of their operation are determined by deterministic analyses results with MELCOR or other integral code. The analysis of Primary Side components response is based on the following: WWER-1000 models with the ALGOR product MCP/ SG header/ pressurizer surge Steam Generator line Deterministic part: determining the ultimate capacity by using the finite elements method Probabilistic part: assessment of the probability of failure (e.g. Larson-Miller approach)
o A CET is a logical framework for estimating the range of consequences associated with a given accident sequence Initiating Event System failures Human actions Level 1 Level 2 Core Damage Challenges to Containment Integrity Fission Product Release to the Environment o A CET is a time-line of accident progression It represents the sequence of events that could lead to failure of the containment pressure boundary and fission product release to the environment
o It is a Probabilistic model It represents uncertainties in ability to predict accident progression Particular assumptions regarding each o uncertainty lead to different conclusions regarding plant response to the sequence Branch point probabilities typically NOT based on statistical analysis of data Reflect confidence that one outcome is more likely to be correct than its alternative Accident Sequence xxx Containment Response Intact Fails Late Fails Early Fission Product Release None Large Small Large Small
o Unlike the Level 1 event tree, branch points in a CET often have more than two possible outcomes: Branch may not simply represent success or failure of an event Often represent alternative conditions or physical process Hydrogen Concentration in Containment? 4 < Conc < 8% No burn Hydrogen Burn? Weak Deflagration None Accident Sequence xxx 8 < Conc < 14% Weak Deflagration Strong Deflagation o All branches represent sequences of interest Conc > 14% Strong Deflagation Detonation Quantification does not exclude success paths
RV at Low Pressure at Onset of Core Damage Injection Recovered No Vessel Breach No Early Containment Failure No MCCI No Late Containment Failure Sprays Containment Fails Early Containment Fails at VB with RCS at High Pressure Containment Fails at VB with RCS at Low Pressure Containment Bypass or Isolation Failure Containment Fails Prior to Vessel Breach RCS Not Depressurized Before Vessel Breach Containment Fails Given RCS at High Pressure RCS Depressurized at Vessel Breach Containment Fails Given RCS at Low Pressure In-vessel Steam Explosion Fails Containment Containment Fails by Overpressure During Core Degradation RCS Depressurized Before Vessel Breach High- Temperature Failure of Cavity Penetration Hydrogen Burn at Vessel Breach Fails Containment
KOZLODUY NPP EVENT TREE SARRP 59 NQ = NUMBER OF QUESTIONS (SEE LINE 2) 1 1.000 TB-OPT 1 WHAT IS THE INITIATING EVENT? 8 VB LL MBL SML ISL SGTR TR TBO 1 1 2 3 4 5 6 7 8 0.000 1.000 0.000 0.000 0.000 0.000 0.000 0.000 ----------------------------------------------------------------------------------------------- 14 DOES THE OPERATOR DEPRESSURIZE THE RCS AFTER CD? 2 DEPR_Y DEPR_N 2 1 2 3 CASES 2 1 1 6 + 7 SGTR TR 0.990 0.010 1 1 8 TBO 0.000 1.000 OTHERWISE 1.000 0.000
General Steps of Level 2 PSA Input from the Level 1 PSA core damage minimal cut-sets/accident sequences Containment performance analysis Response to severe accidents
o o The analysis of containment structures response is based on the following: Deterministic part: determining the ultimate capacity by using the finite elements method Probabilistic part: assessment of the probability of failure under static and dynamic loads by creating the so-called fragility curves Software: Risk Engineering uses the SOLVIA and LSDYNA, which allows the development of 3D models of the studied objects Shell elements Models of containment and WWER-1000/В320 Reactor Building Solid elements
General Steps of Level 2 PSA Input from the Level 1 PSA core damage minimal cut-sets/accident sequences Source term analysis Fission product transport/ release categorization
o o The purpose of the analysis is to determine the following: time, location, energy and amount of the fission products released Analysis of the fractions by groups of elements of fission products released (MELCOR results) Assessment of fission products retention Using this analysis, both the full release activity, and the activities of individual nuclides, which have different consequences on the human body and soil, water, etc., are obtained. Vessel at Low Pressure No Early Contain. Failure Early F.P. Release to Pool No Core- Concrete Interaction No Late Contain. Failure Late Release to Pool Sprays Operate Auxiliary Building Retention RELEASE CATEGORY PDS LP CFE POOL DF CCI CFL POOL SPRYS AB RC 1 1 3 2 4 4 5 2 2 3 3 4 4 5 Release category Release frequency, [y -1 ] Aerosol release activity, [Bq] Risk of aerosol release, [Bq/y] Contribution to the risk of aerosol release, [%] Full release [Bq] TRAR [Bq/y] Contribution to the TRAR [%] RC1 1.0E-06 1.3E14 1.3E08 10 2.5E-15 2.5E-15 2.8
General Steps of Level 2 PSA Input from the Level 1 PSA core damage minimal cut-sets/accident sequences Quantification Results Sensitivities, uncertainties CET probabilities/ quantification Frequencies of large (early) release / release categories Sources of uncertainty
o Two interpretations of the concept of Probability Classical statistics: Statistical analysis of set of random data generates confidence intervals, not (strictly speaking) probability probability of frequency Bayesian: a quantity that we assign theoretically, for the purpose of representing a state of knowledge probability of probability Bayesian: Informed judgment that a particular outcome will occur reflects degree of belief of the observer. Only Bayesian interpretation is appropriate for PSA (particularly Level 2)
o Uncertainty : epistemic uncertainty reflects our lack of knowledge of the state of a system Can be reduced by further analysis (realistic approach) Can be reduced by changing our domain of experience (constructivist approach) aleatory variability randomness, observable measure of correspondence of our system model with the real world system Cannot be reduced by any means (for given system boundaries or for same model of a system) Very important statement aleatory variability is a property of our model and not a property of the real world system
100% 80% 60% 40% 20% 0% <12 18% 82% <24 20% 80% 21% <48 79% LERF 100% 80% 60% LRF 40% 20% 0% <12 93% 7% 11% 0% 7% <24 82% 83% 7% <48 10% SFP Closed Reactor Open Reactor Insights NO big impact of releases between 12-48 hours Dominant releases starts after 48 hours Dominant risk comes from POS s with closed reactor 40% 30% 20% 10% 0% 38% 38% 36% 29% 13% 4% 13% 9% 2% 9% RC01 RC02 RC03 RC04 RC05 All Phenomena Isolation Failure Insights Low risk of hydrogen burning Low risk steam explosions and HPME Almost 100% of the risk for Open reactor comes from isolation failure (RC4, 5) March 16, 2017 32
General Steps of Level 2 PSA Input from the Level 1 PSA core damage minimal cut-sets/accident sequences Use of the results Identifications of severe accident vulnerabilities and other applications
o Successful examples of applications of Level 2 PSA Comparison of results of the Level 2 PSA with probabilistic criteria To determine if the overall level of safety of the plant is adequate Evaluation of plant design To identify potential vulnerabilities in the mitigation of severe accidents To compare design options Development of severe accident management guidelines Use of the source terms to provide an input into emergency planning Use of the source terms and frequencies to determine off-site consequences (Level 3 PSA) Prioritization of research relating to severe accident issues Use of a range of other PSA applications in combination with the Level 1 PSA results
Headquarters: 10, Vihren str. Sofia 1618 Bulgaria Tel. + 359 2 8089 703 Fax: +359 2 9507 751 riskeng@riskeng.bg www.riskeng.bg March 16, 2017
March 16, 2017 THANK YOU!