Outline

1. Level 2 PSA for the VVER 440/213 Dukovany NPP and Its Implications for Accident ManagementJiří Dienstbier, Stanislav Husťák OECD International Workshop on “Level-2 PSA and Severe Accident Management”, Cologne, 29-31 March 2004

2. Outline • Plant features • History of PSA 2 • Methodology used • Main characteristics • Containment failure modes • Large event tree - APET • PSA 1 – PSA 2 interface • Main part of APET • Hydrogen model • Fission product release – source term to the environment • Results • Sensitivity studies • Accident management • Conclusions and plans for near future

3. Plantfeatures • 4 units in 2 twin-units, twin units in common building, each unit has its own containment • Mostly rectangular leak tight rooms, pressure suppression system … bubble condenser • Recirculation sump is not at the lowest level, possibility to lose ECC coolant to ventilation • Reactor cavity is the containment boundary including double steel cavity door

4. History PSA 2 for unit 1 First (Revision 0) Limited scope Level 2 PSA • From 1995 to April 1998 as US AID project – contractor SAIC (Science Applications International Corporation) with NRI Řež as subcontractor and with plant support • Based on SAIC-NRI level 1 PSA from 1994 • Limited to normal operation at power without ATWS, no shutdown states, no external events • 4 fission product groups, point estimates of frequencies, uncertainties treated by sensitivity study • Large event tree (APET) method (program EVNTRE) • MELCOR 1.8.3 physical analyses • Knowledge transfer to NRI specialists was a part of the project Revision 1 • Autumn 1998 (SAM proposals updated in autumn 1999) by NRI Řež • Using NRI Řež living PSA 1 from 1998 (partially including new EOP), much different from the PSA 1 in rev.0 • Extended to fires and internal floods • Large modification of the event tree – about ½ of questions changed keeping their order • Only small modification of basic events Revision 2 • End of 2002, living PSA 1 2001 used, fully taking into account new EOPs, including ATWS sequences (did not propagate into PSA 2) • Revision of the AICC hydrogen burn model • Containment failure (leak type) due to slow pressurisation by steam and non-condensable gases added

5. Main characteristics Main characteristics • Limited scope Level 2 PSA • Similar to IPE for US power plants • Limited to normal operation at power including internal events - fires, floods • Not included: External events like earthquake, low power and shutdown states • 4 fission product groups – Cs, Te, Ba, noble gases, only Cs+Ba used for sorting the results to release categories • Large event tree (APET) method, the resulting tree has 100 nodes (usually more than 2 states in each node): • 12 nodes PSA 1 – PSA 2 interface (PDS vectors) • Nodes 13 to 85 accident progression • Nodes 86 to 100 related to fission product release to the environment – source term • Program EVNTRE (developed by SNL) • The results are probabilities of 12 release categories + results of binning and sorting • About 90 basic events and several physical parameters • Revision 0 only • MELCOR 1.8.3 physical analyses of selected sequences (5 basic sequences + their variations), results used to specify some parameters and basic events • Other activities – plant walkdown, containment feature notebook

6. Containment failure modes • Classification of events timing: • Early … before reactor vessel bottom failure (and about 2 hours later for fission products) • Late … after this time • Failure locations in the containment (several possible) and cavity (or cavity door) • Retention in walls or auxiliary building surrounding containment neglected • Containment fragility curve (after DOE/NE-0086, 1989) • Containment – normal distribution, m = 400 kPa overpressure, s = 80.9 kPa • Cavity – normal distribution, m = 2420 kPa overpressure, s = 460 kPa • Possible containment isolation failure • Ventilation lines P-2 (TL-40), O-2 (TL-70) • Drainage, neglected in revision 2

7. PSA 1 – PSA 2 Interface • PDS (plant damage state) vectors representing first 12 nodes of PSA 2 event tree and characterizing the plant systems at the onset of core damage • Respecting US NRC IPE and IAEA recommendations to reflect PSA 1 results • PDS description • First node representing initiating event • 13 events, ATWS, ILOCA (interfacing LOCA other than through SG) screened out because of low frequency in PSA 1 • initiating events specific for PSA 2, especially RPV-PTS …reactor vessel rupture due to thermal shock • Other 12 events • Different size LOCA – S-LOCA, MS-LOCA, M-LOCA, LG-LOCA • LOCA leading to water loss outside main sump – IL/RCP, IL/POOL • SGCB … SG collector break and lift off, SGTR … SG tube rupture • SB-OUT … steamline break outside containment, SB-IN … steamline break inside containment • TRANS … transient – very similar PDS vectors to SB-OUT, total loss of feedwater in both • SBO … station blackout – failure of electric power supply including category 2 • Flood included as SBO 34 • Fires in some of the TRANS and IL/RCP initiators

8. PSA 1 – PSA 2 Interface • Following 11 nodes • HPI ... state of HP ECC injection and recirculation • LPI ... state of the LP ECC injection and recirculation • Sprays ... state of containment sprays • SHR ... secondary heat removal (mainly feedwater availability) • SecDP ... secondary system depressurisation (important only for SHR OK) • PrimDP ... primary system depressurisation by the operator • ECCS_Inv ... location of (decisive part) of ECC water inventory • VE_Cat2 ... state of category 2 electric power (diesels) • VE_CI ... Two events combined: • containment isolation (CI) • recirculation sump isolation against water loss (fSumpI = sump isolation failed) • VE_CHR ... containment heat removal system status (not including water and electricity availability) • BC_Drain ... location of bubble condenser water: • These nodes have 2 to 4 attributes • Result – 34 PDS vectors (table 2 in the paper), only 5 of them with frequency > 10-6/y • RPV-PTS, SB-OUT, TRANS, IL/RCP, blackout

9. PSA 1 – PSA 2 Interface Figure 1 Analysis of CDF

10. APET • Nodes (questions) 13 to 85 • Development of APET - Main event tree as framework including: • primary pressure before vessel failure, ECCs water location, early recirculation, vessel failure • containment failure early • late recirculation • containment status late • Phenomenology • The same as for PWR reactor (importance often different, e.g. in-vessel hydrogen) • Special connected with cavity design and its function as containment boundary • HPME and cavity failure by gases or steam overpressure • Cavity door failure by debris jet impingement • Containment failure by gases transfer from the cavity • Cavity door failures by thermal effects [1) large, 2) small=loss of sealing, a) within 2 hours after VF, b) late] • Technical systems complicated the event tree and required repeating of some questions: • category 2 electric power early and late • primary system depressurisation • sprays early and late • late phase - water in cavity / cavity door status (to avoid feedback) • Quantification of basic events and physical parameters (quantification tables for probability) • MELCOR plant analyses • detailed problems analysed by MELCOR (cavity) • hand calculation, engineering judgement • literature • Hydrogen • Early and late, same models but different assumptions • Production according to scenario and core damage (full, limited), concentration calculated • Type of burn: no burn – diffusion burn – deflagration – detonation specified according to concentration and other • Consequences calculated for deflagration using AICC model and comparing the modified peak pressure with containment strength curve • no burn – diffusion burn no containment failure • detonation always failure • Update of model in revision 2, the strongest effect had the assumption about electric power not a good igniter

11. Fission product release to the environment - source term • Nodes 86 to 100 • Early and late release of Cs, Te, Ba, Xe+Kr in % of inventory • Decontamination factors (DF) - primary, containment, sprays • Revolatilization of early released and deposited f.p. also assumed • Calculation (using DF) using user functions and sorting of releases • The result of 100 is sorted to 12 release categories • Thresholds 0.1, 1.0, 10.0 % of inventory for Cs group and 1 order less for Ba group • In revision 2, the results sorted to 5 classes: 1. early high – more than 1% of Cs or 0.1% of Ba with early containment failure 2. late high – the same with late containment failure 3. early low– between 0.1% and 1% of Cs and 0.01% and 0.1% of Ba with early containment failure or no failure 4. late low - the same with late containment failure 5. very low – less than 0.1% of Cs and 0.01% of Ba • The last class specified according to Swedish and Finnish criteria (0.1% 137Cs) • Noble gases release higher, not used in these classes • We think about adding one more category for LERF (>10% of Cs and I early)

12. Summary results

13. Summary results

14. Results Results sorted according to • Consequences for PDS vectors • 11 “risk vectors” with early or late high release frequency above 10-7/year found • used for scenario analyses recommendations • initiated by RPV-PTS, SB-OUT or TRANS, SBO, IL/RCP, IL/POOL, SGCB • Core damage • Limited 17,7% (38.5% w/o RPV-PTS) or Full • Pressure at vessel bottom head failure • Low (below 0.8 MPa) 91.8% (82.0%) • Most Important phenomena leading to containment failure % CDF (w/o RPV-PTS) • E_Byp_Rp … 0.64 ( 1.40) • E_Rp … 23.78 (17.56) • Hydrogen deflagration or detonation 12.34 ( 7.70) • Cavity failure (mostly steam explosion) 10.47 ( 7.72) • E_Leak … 0.77 (1.69) • Single SG tube break 0.37 (0.81) • L_Rp … 0.16 (0.17) • L_Lk … 16.06 (12.31) • Thermal failure of door sealing 12.547.76 • Basemat penetration 2.67 1.85 • Intact containment … 58.62 (66.93)

15. Sensitivity studies • Sensitivity studies are the only method to assess uncertainty here • Revision 0 PSA 2 • 23 sensitivity studies • Showing importance of some basic events like steam explosions • Including accident management • Changing only basic events and parameters, no event tree change • Revision 1 • Accident management and preventive measures only • Also small event tree changes if needed • Most efficient • Cavity flooding and external vessel cooling • Primary system depressurisation by operator • Combining depressurisation with other measures

16. Sensitivity studies • Revision 2 • case without RPV-PTS shown before • case without RPV-PTS and IL/RCP with coolant loss (plant modification) • CDF decreased to 1.15*10-5 / year LERF decreased to 2.30*10-6 /year • primary system depressurisation in SAMG • Low efficiency - mostly low pressure accident and depressurisation in EOP • higher probability of hydrogen early ignitionas in the previous revisions • Early containment failure due to hydrogen 4% • higher hydrogen source • “medium”=50% oxidation, “high”=80% (instead of 35% / 50%) • LERF = 1.53*10-5, more than 50% of CDF is early containment failure • lower containment strength • 300 instead of 400 kPa median, similar results like for higher hydrogen source • lower containment strength and higher hydrogen source • Early containment rupture 69% CDF, LERF = 2.06*10-5 / year, hydrogen the only risk • lower steam explosion probability in the cavity • 0.1 (instead of 0.5) for high molten fraction, 0.01 (0.1) for low molten fraction • containment failure by steam explosion 1.41% CDF (10.43%)

17. Severe accident management • Present situation • Dukovany concentrated on core damage prevention in the past • CDF decreased considerably, more than one order of magnitude • This was due to plant modification and symptom oriented EOP • Plant modifications not included in the last revision of PSA 2 • modification to eliminate ECC coolant loss from MCP motor deck (IL/RCP) to start soon • intensive study of RPV-PTS to decrease its probability • Isolation of cavity drainage • for eliminating ECC water loss after RPV-PTS also ventilation line isolation would be needed • using fire pumps for feedwater, filling of SG from tank by gravity – lower blackout CDF • After these modifications, CDF below 10-5/year can be reached • SAMG needed to decrease high early release • WOG generic severe accident management guidelines (SAMG) modified to VVER 440/213 • Theory • Accident Management can be divided into “levels of defense” • Measures to restore cooling shortly after core damage and stop the accident in the vessel • Measures to prevent containment failure • Measure to mitigate release for failed or bypassed containment • Higher level usually less efficient • Good “defense in depth” concept to have all levels • VVER-440 with high natural leak requires level 3 also for intact containment • PSA 2 indicates hydrogen as the highest priority, cavity (door) as the second highest priority

18. Severe accident management • Hydrogen • The plant is equipped with PAR for DBA, they are too slow • PHARE 94 2.07 showed that even extension of PAR is a problem – too large area needed to eliminate risk of DDT • MELCOR 1.8.5 analyses indicate negligible risk for self-ignition at 10% of hydrogen • Caused by large differences in local concentration • Controlled combustion seems the most promising, igniters needed • NRI prepares a project to start in 2005 to analyze their number and location • Cavity and cavity door protection • More complex, the strategy depending on plant modifications – wet or dry cavity • Decision to use in-vessel retention by external cooling not yet taken • If not accepted, we can partially flood the cavity and cool the door • Risk of steam explosion in the cavity must be analyzed • High pressure melt expulsion must be prevented especially for water in the cavity • Existing SAG primary system depressurisation sufficient • Dry cavity strategy … simple thermal protection of cavity door - cheap solution • Other issues can be covered by procedures, except: • Reduction of the release in primary to secondary accidents • Improvement of habitability of the control room

19. Conclusionsand plans for near future • Limited scope PSA 2 proved to be a very good tool especially when comparing risk importance of individual phenomena • Extension to shutdown states needed and should start soon • Before next revision of limited scope PSA 2 for power states (in 2006 ?), some problems have to be solved • Most of them already included in other project: • better containment strength calculation … results in 2004 • better scenarios … MELCOR 1.8.5 analyses in 2004 including SAMG • decreasing conservatism of natural leak from the intact containment …retention in walls and external building … 2004 • improved knowledge of steam explosions including cavity strength … ??