sequences, then more refined analyses can be used to show that the safety system success criteria for such sequences are conservative (e.g., perform more refined
3. If for some sequences the analyses of the previous two steps would fail to show that the success criteria are conservative, i.e., the peak cladding temperature determined
from these analyses exceeds the limiting value of 2200°F), then one or more of the following options should be considered:
• Quantify the probability that these sequences would lead to core damage because of T-H performance uncertainties, and properly incorporate this probability in the PRA analysis.
• Consider regulatory oversight of active nonsafety-related systems. This would increase the reliability of such systems and, in turn, would decrease the challenge
rate of the safety-related passive systems.
• Consider design and/or success criteria changes which make the analyses of either one of the first two steps successful (i.e., with these changes the analyses show that the new success criteria are conservative).
SUMMARY AND CONCLUSIONS
The T-H unreliability of passive safety systems, such as those used in Westinghouse's AP600 design, must be assessed and accounted for in the PRA. However, the quantification of T-H unreliability involves a prohibitively large number of computations. A conservative risk-based 'margins" approach was developed which eliminates the need to quantify T-H unreliability for most, if not all, accident sequences. With this approach the issue of T-H unreliability is addressed by linking it to the passive safety system success criteria and, thus, to core damage frequency (CDF). This is achieved by assuring that the adopted success
criteria for safety systems and operator actions are conservative enough so that the
contribution to a sequence CDF from T-H uncertainties is significantly smaller than the contribution from hardware failures and human errors.85
The margins approach is currently being implemented for the analysis of the passive system performance reliability of the AP600 design. This analysis, which is performed in support of the AP600 design certification, has so far indicated that the conservative margins approach can be a very efficient tool for addressing the issue of passive system T-H reliability in
advanced passive reactor designs. In addition, such an approach can drastically reduce the effort needed to address this issue. Preliminary indications (no complete results are available yet) are that there is adequate margin to core damage for most AP600 design accident
sequences. However, the success criteria for a few sequences may have to be changed.
REFERENCES
1. M. Mazumdar, J.A. Marshall, and S.C. Chay, "Methodology Development for Statistical Evaluation of Reactor Safety Analyses," EPRI-NP-194 (1976).
2. J.K. Vaurio and CJ. Mueller, "Probabilistic Analysis of LMFBR Accident
Consequences with Response Surface Techniques," Nuclear Science and Engineering 75, 401-413 (1978).
3. E.E. Morris, C.J. Mueller, I.E. Cahalan, and H. Komortya, "A Comparison Study of
Reactor Surface Methodology and Differential Sensitivity Theory in Core Disruptive
Accident Analysis," Proc. 1981 International ANS/ENS Topical Meeting onProbabilistic Risk Assessment. September 1981.
4. NUREG/CR-5249, "Quantifying Reactor Safety Margins," 1989
5. M.G. Ortiz and L.S. Ghan, "Uncertainty Analysis of Minimum Vessel Liquid Inventory During a Small-Break LOCA in a B&W Plant - An Application of the CSAU Method Using the RELAP5/MOD3 Computer Code,"NUREG/CR-5818, 1992.
6. C.D. Fletcher, G.E. Wilson, C.B. Davis, and T.J. Boucher, "Interim Phenomena Identification and Ranking Tables for Westinghouse AP600 Small Break Loss-of-Coolant Accident, Main Steam Line Break, and Steam Generator Tube Rupture Scenarios," INEL-94/0061 (Draft Report), October 1994.
FEASIBILITY AND EFFICIENCY STUDIES OF FUTURE PWR SAFETY SYSTEMS
P. AUJOLLET
Commissariat a 1'Energie Atomique, Cadarache, France
Abstract
The French Atomic Energy Commission (CEA) has initiated evaluation studies of innovative safety systems, in terms of efficiency and reliability in selected accidental sequences. Three kinds of systems are currently evaluated : direct depressurization system designed to control PWR primary pressure to prevent in-pressure core melt down, passive residual heat removal systems and steam injector systems.
The feasibility and performance of each system is assessed through the analyses of accidental transients in a reference three loops PWR, making use of the Probabilistic Risks Analysis (PRA) method and the CATHARE 2 thermal hydraulic code.
These studies are conducted in four steps : sizing of each system using one or more reference transients, insertion of each new system ; modification of accidental procedures and event-trees, calculation of fuel damages probabilistic risk values during selected accidental transients and ranking of core damages probabilistic risk values.
In particular, a high pressure single stage steam driven injector which was tested at SET laboratories was modelled with the thermal hydraulic code CATHARE.
INTRODUCTION
The present article summarizes some features of the PWR innovative safety systems wich are currenly studied at CEA Innovative Safety Systems Department mainly with Cathare 2 code:
• direct depressurization system sizing and opening setpoint value adjustment
• passive residual heat removal: Secondary Condensing System and In-vessel Heat Exchangers studies
• Safety Injection System or Auxiliary Feedwater Systems with Steam injector. ENEL/SIET Steam injector Mock up tests results (2) studies with Cathare 2 code
Beyond the specificities of these particular systems, current studies objectives are to verify the ability of the concept to fullfill its function, to determine its physical generic limits, to foresee code developments and experimental code assessment programs, to eventually improve the systems and determine
complementary safety systems.
DEPRESSURIZATION SYSTEM
This system must permit a direct control of the primary circuit pressure in extreme conditions. Its objectives are to prevent a in-pressure core melt down by discharging primary circuit to a low pressure value (fixed at 1 MPa in that case).
System description.
A valve system is located at the top of the pressurizer, the discharging system is connected to a pool (DR.WST : In-Reactor Water Storage Tank) located inside the containment. These studies are performed with Cathare Safety code reactor data set to simulate standart 900 PWR.
87
Applications and Objectives.
This system has to achieve a fast (hundred secondes) depressurization of the primary circuit to reach and to maintain it at a pressure value lower than 1 MPa.
Method.
After a first sizing of the valve, opening setpoint value adjustment is achieved by simulation with Cathare code of anticipated transients with multiple failures leading to extreme conditions with uncovered core and primary circuit at a high pressure value.
The first transient chosen was a total loss of Auxiliary Feedwater Systems event with only accumulators and LPIS available, during this transient the system has to remove heat from nuclear core primary and secondary circuits.
Then several transients were tested. Among them, a small break Steam Generator tube rupture event with only accumulators and LPIS available, gave a sizing point at low pressure as the depressurization system with a decreased flowrate had to remove heat coming from the core, the primary circuit and from the broken Steam Generator.
The current signal for valve opening is based on reactor vessel water level measurement with an opening of the valve at hot and cold legs uncovering. CATHARE simulations results show the efficiency of the depressurization system during these transients.
It was also verified that an inadvertant opening of the valve during reactor normal operating conditions do not lead to core damages.
The size of the discharging pool was determined by considering the subcooled liquid water mass needed to condensate the entire primary coolant mass in vapor phase.
Studies current status
Additional calculations are currently performed to verify the efficiency of the system during other transients such as multiple Steam Generator tubes ruptures, or small break with primary pumps kept on.
All these results are to be compared with a fast depressurization valve opening test experimental results which is to be performed on BETHSY integral test facility in 1996.
These studies are completed by a definition work of an experimental program on CEA Super Claudia facility to modelize direct condensation of water/steam jets in a pool. Super Claudia experimental activities will be focused on separate effect tests in order to measure fixed physical parameters influence on condensation process.
RESIDUAL HEAT REMOVAL SAFETY SYSTEMS Two kinds of passive systems are currently assessed :
• At primary circuit level (Refroidissement du Reacteur au Primaire system RRP from CEA/DER/SIS)
• At secondary circuit level (Secondary Condensing System SCS) Reacteur Refroidissement Primaire system [1].
Usually the residual power is removed in an active way in two steps : first by the Steam Generators (SG) at high primary side pressure, second by Residual Heat Removal System (RHRS) at low primary side pressure and temperature.
A new passive system supplying similar functions is described and analysed. This studies have been performed with a standart 900 MWe PWR reactor Cathare 2 data set.
Description and principle. RRP system includes three in-reactor vessel heat exchangers. A layout of reactor vessel internal structures to allow forced or natural convection and of the external heat sink are shown in Fig. 1.
A suction system (Fig. 2) allows forced or natural convection around the integrated heat exchangers.
The heat sink introduced into the reactor vessel is placed above the core so natural convection can occur inside the reactor vessel.
The size of the reactor vessel has to be increased with respect to current PWR reactor vessel sizes, to integrate the heat exchangers.
Functional analysis and efficiency.
RRP system can work in a large range of conditions.
• In normal operating conditions, convection in the intermediate circuit is available as primary pumps are working, the suction system establishes convection around the heat exchangers; the heat removal capacity of the system is about 80 MW. A cold shutdown can be conducted using only RRP system
• If primary pumps are off, a short natural circulation loop between the core and the heat exchanger is established . Primary water is circulating only inside the reactor vessel Under these conditions, it has been shown that with only natural circulation heat exchanges in the intermediate circuit 30 MW can still be extracted. These last results have been evaluated by CATHARE 2 calculation in the cases of a small break or a total blackout with in both cases Auxiliary Feedwater System (AFS) unavailable These accidental sequences were conducted in a totally passive way by the RRP system
Figure 1. RRP System
It must be noticed that RRP system still works with a primary low water level (under hot and cold leg level)
System advantages.
Cold shutdown can be achieved without any extra system.
RRP system can work totally passively with no time limit (atmosphere as heat sink) at hot shutdown.
The primary fluid is always confined in reactor vessel.
RRP is always effective even if vessel water level is at primary hot and cold legs level
For small breaks and blackout kind of accidents, RRP system allows a significant increase of the intervention delay and only low pressure safety systems needed
System drawbacks.
The inspection and maintenance operations are obviously more difficult to perform It implies additive penetrations in the reactor vessel
Reactor vessel dimensions must be significally increased.
The system needs additive penetrations in the containment
Intermediate circuit water flows from the core vessel to the outside of the containment during accidental transients
89
suction system
Figure 2. Reactor Vessel with RRP System Current studies
.Linked to the drawbacks last point mentionned a RRP system with an intermediate circuit heat sink created by a in-pool heat exchangers system located in the containment is currently studied
Secondary Condensing System.
Description and principle.
SCS is a passive system using natural convection. It has to fullfill the safety function of the classical Auxiliary Feedwater System.
After closure of the main steam valves and opening of the SCS valves steam coming from the three Steam Generators • is condensed in heat exchangers immersed in three pools located outside the containment, condensed water is driven back by gravity to Steam generator inlets. Fig. 3 shows a scheme of this system.
Heat exchangers sizing is based on ability to remove residual heat during a loss of feedwater transient with the application of the single failure criterion (that means roughly 45 Mw for one heat exchanger), cooling rate limits, low steam temperature at low load and degraded steam generator mass inventorie. The calculations were performed with the two phase flow COPE code to get an optimized couple tubes number-tubes length.
Efficiency.
In the case of blackout sequence with all AFS unavailable, CATHARE 2 simulations have been performed. Cathare results shows that, after opening of the SCS steam valves, elapsed time value to reach the SCS liquid water maximum flowrate value seems to be convenient (less than 20 sec.), stationnary flowing conditions inside the SCS are established after 40 sec.allowing heat removal from the primary circuit untill standard low pressure decay heat removal system can be started.
Extra CATHARE calculations with degraded Steam Generator mass inventory or with one or two SCS systems unavailable were performed, the results show that safe conditions are maintained as far as natural circulation is maintained in the pools (water level)
Steam Generator Tube Rupture (SGTR) simulations have shown that an automatically started SCS on Scram signal is particularly efficient even with a one hour delayed operator action.
Current studies status
. They are focused on pool characteristics adjustment with 3 D.rwo phase flow code calculations and on EPICE experimental program definition to improve and validate Cathare in-pool (or low pressure) heat exchangers modelling.