Reliability of jet condenser

Only one valve has to be actuated to start the system. Its independence from electric power and support systems increases the reliability, resulting in a low number of failure modes and high system reliability. However, the reliability of the system contributes only little to the increased reliability of core cooling. The type of safety function and the safety-related system characteristics are more important in enhancing reactor safety than the system reliability. These characteristics of the jet condenser concept have been discussed in Sections 3.1 through 3.7.

99

During normal operation of the reactor, the startup valves to the PAHRSEC loops are closed. After reactor trip, the valves are opened to start the heat removal process. The pressure in the system before startup is essentially the same as the steam generator pressure. Only a small pressure difference across the closed startup valve exists which is created by a water column of about 5 meter in the jet condenser.

Owing to the small load on the valve disc, little force is necessary to open the valve for startup, increasing the reliability of the valve.

4. SUCCESS CRITERIA AND SYSTEM SIMULATION

The jet condenser success criterion for decay heat removal and depressurization following a small break LOCA was determined by transient system analysis using the Computer Code MAAP 3B (Modular Accident Analysis Program).

The code had been used to establish the system success criteria for San Onofre's probabilistic safety assessment, the Individual Plant Examination, mandated by the U.S.

Nuclear Regulatory Commission. MAAP simulates the effects of a wide range of accident scenarios and phenomena including the effect of engineered safety features, operator actions and changes in geometry during a severe accident.

The code was used to analyze the response of a pressurized-water reactor with 3,390 MW thermal power (2 steam generators, 4 reactor coolant pumps, San Onofre Unit 2/3) to a 5cm LOCA using two 75MW jet condensers as heat sinks. A failure of all coolant injection pumps and feedwater pumps was postulated.

During a small LOCA, heat removal from the reactor coolant system by the two PAHRSEC loops competes with the heat loss through the break by coolant leakage.

The energy removed by the systems is not available for forcing coolant out the break.

The net effect is a continuous reduction of the saturation temperature and pressure in the reactor coolant system, reducing the density of the two-phase flow discharged through the leak and, therefore, the leakage flow significantly.

Results of the transient MAAP analysis of a 5cm LOCA are shown in Figure 2.

Temperature, pressure, flow and leak rates decrease gradually. The core is never uncovered during the transient. Without any active safety system available, the water inventory in the reactor coolant system decreases initially. However, the accumulator tanks supply coolant at the same rate as the decreasing leakage rate, maintaining a

nearly constant coolant inventory after the first hour of the accident. After the first hour, the pressure of the reactor coolant system has been sufficiently lowered to allow the use of the shutdown cooling or low-pressure injection system.

5. PROBABILISTIC ASSESSMENT OF RISK REDUCTION

An evaluation of the impact of passive heat removal and depressurization effected by two jet condenser loops on the core damage frequency of a 1,100 MWe

pressurized-water reactor has been performed. The analysis is based on the models of the Individual Plant Examination (IPE) for San Onofre Units 2 and 3. The IPE was mandated by the Nuclear Regulatory Commission as a plant-specific probabilistic safety assessment for all U.S. nuclear power plants.

• 7 P = - 9 - 2

Time [s] ^{x l O}

Figure 2a: Primary system pressure and steam generator pressure as a function of time after reactor trip

2 3

Time [s]

5 10 3

Figure 2b: Peak clad temperature, core water temperature and steam generator temperature as a function of time after reactor trip

101

The code QUIKRISK was used to compute the reduction in core damage frequency resulting from heat removal/depressurization by jet condensers. QUIKRISK was developed to determine the impact of changes in the configuration of a nuclear power plant on the core damage frequency. QUIKRISK cuts the time for the solution of probabilistic models significantly, allowing the analyst to investigate various plant configurations in a limited time. The code uses existing fault tree models of San Onofre 2 and 3 developed for the Individual Plant Examination. The input for the code consists of configuration changes caused by maintenance, repair and testing as well as design changes or component failures.

A base case without any plant changes was quantified with QUIKRISK first. The core damage frequency of the plant design configuration (without jet condenser) was computed by QUIKRISK as 2.8E-5 per year. Subsequently, the fault tree models of the auxiliary feedwater system and LOCAs with less than 5 cm diameter were changed to incorporate the jet condenser safety function. After adding the jet condenser to the models, the core damage frequency decreased to 1.4E-5 per year.

These results do not take into account the safety characteristics discussed in Section 3.5. In addition, the consequences of core damage would be significantly reduced by the system characteristics discussed in Sections 3.6 through 3.8. External initiating events are not expected to cause LOCAs with diameters larger than 1 cm.

Medium and large LOCAs are, therefore, not part of the external initiating event spectrum. Consequently, jet condensers can cope with all external initiating events.

Including external events in a probabilistic safety assessment increases the system's risk-reduction potential significantly.