Insights and lessons learned from Level 2 PSA for Bohunice V2 plant MACIEJ KULIG

International Workshop onLevel 2 PSA and Severe Accident Management

Köln Germany March 29-31, 2004

Insights and lessons learned from Level 2 PSA for Bohunice V2 plant

MACIEJ KULIG

ENCONET Consulting, Ges. m. b. H., Auhofstrasse 58, 1130 Vienna, Austria

Outline

Overview of the PSA project - Organisation- Objectives and scope

Selected methodological aspects - PDS definition - Source Term categorization / analysis- Confinement Event Trees- Quantification

Insights from sensitivity analysis Conclusions

Project Organisation

ENCONET Consulting Ges. m. b. H., Vienna, AustriaProject leadership Definition of PDS Preparation and quantification of containment ETs Analysis and interpretation of the results

VUJE Trnava Inc., Slovakia Identification of containment challenges Source Term Analysis

RELKO Ltd., Bratislava, Slovakia Preparation and quantification of PDS ET/FT models

Lenkei Consulting Ltd., Pecs, Hungary Structural analysis of the confinement building

Objectives and scope of the PSA project

PSA objective Frequency of LER and risk dominant sequencesPSA scope Complies with the current state-of-the-art practices

All typical Level 2 elements/tasks included (Level 1 model extended to quantify selected PDS, containment isolation and damage/CET, Source Term and RC, supporting T/H analyses and containment structural analysis, sensitivity analysis, etc.)

PSA compatible with V2 integrated Level 1 PSA model Reflects 1999 plant status

PSA covers full power and shutdown operating modes

PSA Level 2 Task Overview

Modification of existing ETs:

- Status of confinement isolation- Status of spray systems- Status of injection systems

PDS Parameters:

- Confinement status- Sequence type- Safety injection- Cavity water- Confinement spray

CET Headings:

- Induced RCS rupture- Very early H2 burn- Very early conf. fail.- Vessel failure- Early conf. failure- Debris cooled ex-vess.- Late cont. failure- Long term cont. failure

RC Parameters:

- Sequence type- CD extent- Spray status- Conf. status

InitiatingEvents

Extended ET/FT model Accidentscenarios

PDS SelectedPDS

Accident progressionContainment ETs

CETEnd States

Releasecategories

Sum =Total CDF

Screeningfor lowfrequencyPDSs

Plant Damage States Definition

PDS grouping attributes – parameters of highest influence on the post-CD accident progression

Insights from other studies (NUREG-1150, PH4.2.7.a, PH2.09/95), specific features of V2 taken into account Confinement status (3 possible parameter values)

(Confinement isolated, not isolated, bypassed). Sequence type (8 possible parameter values)

LOCA initiators (4), and transient IEs including ATWS and SLBI (4)Secondary status considered if it affects the SA progression. Safety injection (4 possible parameter values)

Possibility of in-vessel recovery & long term debris cooling(1 LP or HP train operable, recovered early, recovered late, failed) Cavity water (2 possible parameter values)

Water in the cavity below RPV prior to vessel failure (dry or wet) Confinement spray (4 possible parameter values)

Long term pressure in the confinement, inert vs. non-inert CONF (1 CSS train operable, recovered early, recovered late, failed)


Assigning CD sequences to the selected PDS – based on a systematic process

PDS grouping logic – Decision Trees with PDS parameters as DT headings- Grouping process repeatable- Non-possible combinations of parameters explicitly identified /

excluded PDS grouping – separate logic for different Power

Operational State (POS) groups PDS set reduced to 69 combinations of attributes

Many combinations eliminated taking into consideration the dependencies between PDS headings and POS-specific boundary conditions


PDS grouping logic – 5 POS groups G0 - Full power operational states

RCS and the confinement normally closed. G1 - Applicable to POS 1, 11 and 12,

Essentially similar to the full power state RCS and the confinement normally closed.

G2 - Applicable to POS 2, 3, 7, 8, 9 and 10, RCS closed but the confinement open.

G3 - Applicable to POS 4, 5S and 6, RCS and confinement open, the fuel in the RPV

G4 - Applicable to POS 5L, The fuel relocated to the refuelling pool


Sequence type – important PDS parameter Influence on RCS pressure and CONT pressureCategorization based on plant specific thermal

hydraulic analysesParameter values (full power): L1 - LOCA 7-20 mm without FW (potential IR + CAV overpressurization) L2 - LOCA 20-40 mm without FW (no IR, potential CAV overpressurization) L3 - LOCA 7-40 mm with FW (no IR, potential CAV overpressurization) L4 – LOCA 7-40 with FW and APR (aggressive SG bleed) and

LOCA 40-500 mm (no IR, no CAV overpr., LPSI can inject before VF) T1 - Reactivity transients / ATWS (potential CAV overpressurization) T2 - Transients without FW (potential CAV overpressurization) T3 - Steam line break (SLB) inside confinement (CONT press. higher than T2) T4 - Transients without FW and SLB with CONT not isolated

(CS effect can be neglected)


Sequence type - summary features of LOCA SA scenarios, definition of L1 – L4 parameter values

LOCA <20mm LOCA 20-40 mm LOCA >40 mm IR No IR No IR No LP (L1) No LP (L2) LP (L4) HP HP HP

No secondary side cooling

CAV CAV No CAV No IR No IR No IR No LP (L3) No LP (L3) LP (L4) HP HP HP

Secondary side available

CAV CAV No CAV No IR No IR No IR LP (L4) LP (L4) LP (L4) HP HP HP

Secondary side depressurised with FW (APR)

No CAV No CAV No CAV IR – Induced RCS rupture is a possibility LP – LPSI can inject before vessel failure CAV – Cavity overpressure may occur HP –HPSI can inject before vessel failure Note: In L3 due to availability of FW the cavity pressure rise following VF is expected

lower as compared to L2 case (without FW)

Source Term

Source Term grouping parameters Extent of core damage

Gap release, Full CD in-vessel, Full CD ex-vessel with MCCI

RCS statusLB LOCA, Transient or SB LOCA, IS LOCA, Open reactor/pool

Containment sprayCSS available or recovered (1 train), CSS failed

Containment isolationCONT isolated, failed after 20 hrs, failed after 7 hrs, failed early

ST estimated based on plant specific thermal hydraulic analyses for representative SA scenarios

SA codes used - MARCH3, CORCON, TRAP-MELT3, VANESSA, MELCOR (open vessel)

Example Source Term – LB LOCA case

The amount of iodine (I2) released from the confinement (% of the initial core inventory) for sequences initiated by LB LOCA.

The most relevant factors that affect the radiological release:▪ Extent of core damage, ▪ Availability of sprays, ▪ CONT isolation status

0,00%

0,01%

0,10%

1,00%

10,00%

100,00%

Conf. isolated,spray available

Conf. isolated, no spray

Conf. failed early,spray available

Conf. failed early, no spray

- Gap release only - Partial CD, core cooled in RPV - Full CD with MCCIRC

G0-A8

RC G0-B5

Source Term Examples of high consequence RCs

G3-LPS7 – RPV open Full CD CONT open G0-P-A – IS LOCA, Full CD with MCCI, CONT bypassed G0-PG-A – PRISE LOCA, Full CD with MCCI, CONT bypassed G0-TA8 – Transient, Full CD with MCCI, Early CONT failure, No sprays, G0-A8 – LOCA, Full CD with MCCI, Early CONT failure, No sprays, G0-TB8 – Transient, Full CD in-vessel, Early CONT failure, Spray on,

The amount of iodine and caesium (I2 and Cs) released from the confinement (expressed as % of the initial core inventory) for selected RCs.

0,00%

5,00%

10,00%

15,00%

20,00%

25,00%

G3-LPS7,G4-LPS8

G0-P-A, G0-P-Aa

G0-PG-A, G0-PG-Aa

G0-TA8,G0-TA8a

G0-A8, G0-A8a

G0-B8 G0-TB8

I2 radionuclide groupCs radionuclide group

Containment Event Trees – CET headings

CET Header Relevant characteristicsInduced RCS rupture Creep rupture of the hot leg or SG tubes (RCS

depressurization, potential bypass).

Very early H2 burn H2 burn prior to the in-vessel phase of the accident (hydrogen depletion).

Very early CONT failure Confinement failure due to hydrogen combustion before vessel failure

Reactor vessel failure Possibility of core cooled in-vessel (subsequent confinement challenges can be avoided).

Early CONT failure Confinement fails due to hydrogen combustion loads at the time of vessel failure

Debris cooled ex-vessel Prevention of molten core concrete interaction

Late CONT failure CF due to the combustion of hydrogen and/or combustible gases during the ex-vessel phase

Long term CONT failure CONT overpressurized by non-condensable gas/ vapour generation or basemat melt-through

Containment Event Trees - Example: CET for PDS G0-01 to PDS G0-48

Containment Event Trees

CET sub-models Each CET header uses several different decomposition event

tree (DET) models depending on different possible boundary conditions (PDS and sequence characteristics)

Each CET heading is decomposed into several more detailed questions easier to answer or quantify, suitable DET is selected based on the answers

DET provides graphical representation of different possibilities under each CET header (probabilities assigned)

End states Defined as a string with the following information:

LOCA/TRANSIENT – A, TCORE DAMAGE EXTENT – PART_CD, FULL_CD, CD+MCCI,SPRAY STATUS – SPRAYS_OK, NO_SPRAYSCONFINEMENT STATUS - VEARLYCF, NOT_ISOL, EARLY_CF,

CAV_DOOR, _LATE_CF, __NO_CF,…….

EXAMPLE:A FULL_CD NO_SPRAYS CAV_DOOR

Containment Event Trees CET sub-models - example “Very early CT failure -VECF0”

Confinement structural analysis

CONF structures checked: hermetic doors, reactor dome, lock covers, tube penetrations, SG room, and barbotage tower (liner and concrete wall)

00,10,20,30,40,50,60,70,80,9

1

MPa

bubbler tower

cavity door

Best estimate failure pressurebubbler tower 0.426 MPa (abs);cavity door - 0.594 MPa (abs)

Probability distribution:Log-normal (SD = 16%, NUREG-1150)

Model quantification

Quantification of PDS using Risk Spectrum code (each PDS sequence analysed separately)

PDS frequencies calculated as a sum of sequence analysis results (in MS Excel code after export of Risk Spectrum results)

PDS inputs to each CET is identified CET is quantified using the code in which they are developed Quantification conducted for each PDS using sub-models

(DET) which correspond to that PDS (logical rules are provided to select DET sub-model)

End states are assigned automatically to each CET sequence, textual identifiers serve to provide link with RCs.

Grouping of sequences using a short script (written in Phyton)

Overview of resultsOverview of results PDS frequencies

PDSs with the highest frequencies: PDS G3-01 – man induced LOCA in POS6 as a dominant IE, (SI not initiated due to HE) PDS G3-03 – man induced LOCA in POS6 as a dominant IE, (SI not available) PDS G2-03 – cold overpressurisation in POS7 as a dominant IE, PDS G0-40 – medium LOCA in full power as a dominant IE, PDS G4-01 – loss of non-vital operational 6 kV bus in POS5L as a dominant IE.

0,00E+005,00E-051,00E-041,50E-042,00E-042,50E-043,00E-043,50E-044,00E-044,50E-045,00E-04

PDS G0-40, PDS G0-01



PDS G3-01,PDS G3-03

PDS G4-01

The first dominant PDS in the group The second dominant PDS in the group Other

Overview of results

Full power operational states (G0) - All PDS - 9.99E-05/yr. Early/large release ~75% dominated by cavity door failure at VF and CONT failure due to hydrogen burn during in-vessel phase

POS 1, 11, 12 (G1) - All PDS - 2.05 E-05/yr, Early/large release ~80.5% - similar to G0

Other shutdown states (G2, G3, G4) ~6.10E-04/yr, Early/large release ~ 100%

0,0E+00

5,0E-05

1,0E-04

1,5E-04

2,0E-04

2,5E-04

3,0E-04

3,5E-04

4,0E-04

4,5E-04

5,0E-04

G0 G1 G2 G3 G4

Small/delayed release (confinement intact or failed late) Large release (confinement failed early, bypassed or open)

Overview of resultsFull power - Small release end-states groups

(< 1% of core inventory)

Dominant end-statesRC RC characteristics Total RCfrequency End-state description Frequency/ STC

RC1 Core recovered in-vessel,partial CD, no CF.

4.045E-07 A-PART_CD-SPRAYS_OK-___NO_CF 4.02E-07/ G0-B1

RC2 No confinement failure 1.572E-06 T-FULL_CD-SPRAYS_OK-___NO_CFA-FULL_CD-SPRAYS_OK-___NO_CF

1.37E-06/ G0-TA11.97E-07/ G0-A1a

RC3A Late CF, No MCCI 1.066E-07 A-PART_CD-SPRAYS_OK-_LATE_CFT-FULL_CD-SPRAYS_OK-_LATE_CFT-FULL_CD-NO_SPRAYS-VLATE_CFA-FULL_CD-SPRAYS_OK-_LATE_CF

7.99E-08/ G0-B31.38E-08/ G0-TA3a9.03E-09/ G0-TA6a1.97E-09/ G0-A3a

RC3B Late CF,+ MCCI 1.779E-7 T-CD+MCCI-NO_SPRAYS-_LATE_CFT-CD+MCCI-SPRAYS_OK-_LATE_CF

1.73E-07/ G0-TA73.75E-09/ G0-TA3

RC4 Basemat penetration(Meltthrough)

1.773E-5 T-CD+MCCI-NO_SPRAYS-MELTTHRUT-CD+MCCI-SPRAYS_OK-MELTTHRU

1.72E-05/ G0-TA23.74E-07/ G0-TA2

Overview of resultsFull power - Large release end-states groups

(> 1% of core inventory)

Dominant end-states RC RC characteristics Total RC frequency End-state description Frequency/ STC

RC5A Early CF, No MCCI, Cavity door failure

3.566E-05 T-FULL_CD-NO_SPRAYS-CAV_DOOR T-FULL_CD-SPRAYS_OK-CAV_DOOR T-FULL_CD-SPRAYS_OK-EARLY_CF

1.81E-05/ G0-TA8 1.53E-05/ G0-TA4 2.07E-06/ G0-TA4a

RC5B Early CF, + MCCI 7.248E-06 T-CD+MCCI-NO_SPRAYS-EARLY_CF T-CD+MCCI-SPRAYS_OK-EARLY_CF

6.65E-06/ G0-TA8 5.63E-07/ G0-TA4

RC6 Very early confinement failure

3.278E-05 T-CD+MCCI-NO_SPRAYS-VEARLYCF T-FULL_CD-SPRAYS_OK-VEARLYCF T-CD+MCCI-SPRAYS_OK-VEARLYCF

2.48E-05/ G0-TA8 5.69E-06/ G0-TA4a 1.55E-06/ G0-TA4

RC7A Confinement isolation failure, No MCCI

1.230E-06 T-FULL_CD-NO_SPRAYS-NOT_ISOL A-PART_CD-NO_SPRAYS-NOT_ISOL

1.18E-06/ G0-TA8a 2.81E-08/ G0-B8

RC7B Confinement isolation failure, + MCCI

1.479E-06 T-CD+MCCI-NO_SPRAYS-NOT_ISOL A-CD+MCCI-NO_SPRAYS-NOT_ISOL

1.40E-06/ G0-TA8 7.59E-08/ G0-A8

RC8A Bypass, scrubbed 0.311E-06 _-_______-_________-SG/V_WET _-_______-_________-SGTR_RVC

7.96E-07/ G0-P-Aa 5.15E-07/ G0-PG-Aa

RC8B Bypass, unscrubbed 1.61E-07 _-_______-_________-SGTR_UNM 1.61E-07/ G0-PG-Aa RC9 Vessel fails in ROCKET

mode 4.852E-08 T-VROCKET-NO_SPRAYS-_VROCKET

T-VROCKET-SPRAYS_OK-_VROCKET 3.49E-08/ G0-PG-Aa 1.35E-08/ G0-PG-Aa

Overview of resultsOverview of results Sensitivity analysis - Case S1:

‘hot leg rupture probability’

Assumption investigated:Hot leg rupture probability increased from base case (e.g. ~ 0.33 for L1 group) to 0.7 (i.e. the value used in NUREG-1150 for HP PDS)

Impact on RC frequency profile:- ‘Cavity door failure’ contribution reduced- ‘Intact containment’ and ‘intact vessel’ contributions increased

0,0E+00

1,0E-05

2,0E-05

3,0E-05

4,0E-05

5,0E-05

6,0E-05

7,0E-05

8,0E-05

9,0E-05

1,0E-04

Base case Case S1

Late and long term confinment failuresConfinement failures no VFNo confinement failureConfinment bypass due to SGTR or IFSLAccidents - no confinment failure (VF)Accidents with confinment isol. failure (VF)

Confinment fails due to hydrogen burn at VFLong term basemat melthroughConfinment fails during in-vessel phase (VF)Cavity door fails at VF phase


‘hydrogen burning before vessel failure’

Assumption investigated: Hydrogen burn during the period before vessel failure would always occur at the highest hydrogen concentration i.e. no burns at low concentration (uniform distribution was assumed in the base case)

Impact on RC frequency profile:‘Very early confinement failure’ end-states contribution significantly increased

0,0E+00

1,0E-05

2,0E-05

3,0E-05

4,0E-05

5,0E-05

6,0E-05

7,0E-05

8,0E-05

9,0E-05

1,0E-04

Base case Case S2




‘hydrogen combustion in the cavity’

Assumption investigated: Hydrogen combustion does not occur in the cavity concurrent with blow-down loading (assumed very likely in the base case)

Impact on RC frequency profile:- ‘Cavity door failure’ contribution significantly reduced- ‘Basemat melt-through’ contribution increases (because

dominant sequences have all safety injection failed)

0,0E+00

1,0E-05

2,0E-05

3,0E-05

4,0E-05

5,0E-05

6,0E-05

7,0E-05

8,0E-05

9,0E-05

1,0E-04

Base case Case S3




‘Ex-vessel cooling analysis’

Assumption investigated:Ex-vessel cooling analysis assumes failure of ex-vessel cooling (with probability of 0.9 )

Impact on RC frequency profile:The results not sensitive to ex-vessel cooling details - only a small increase of ‘basemat melt-through’ contribution (in the base case melt-through is due to PDS with injection unavailable);

0,0E+00

1,0E-05

2,0E-05

3,0E-05

4,0E-05

5,0E-05

6,0E-05

7,0E-05

8,0E-05

9,0E-05

1,0E-04

Base case Case S4



Overview of resultsOverview of results Sensitivity analysis - Case M1:

‘Benefit of implementation SB EOP Fr.C-1’

SAM measure investigated:Actions aimed at reducing RCS pressure (after unsuccessful recovery of safety injection) using the PRZ safety/relief valves

Impact on RC frequency profile: reduced source term- ‘Cavity door failure’ contribution reduced (by a factor of ~2)- ‘Basemat melt-through’ contribution increases- Frequency of ‘confinement intact’ end-states increases.

0,0E+00

1,0E-05

2,0E-05

3,0E-05

4,0E-05

5,0E-05

6,0E-05

7,0E-05

8,0E-05

9,0E-05

1,0E-04

Base case Case M1




‘In-vessel retention strategy - manual actuation’

SAM measure investigated:Adding a cavity flooding system (actuated manually)

Impact on RC frequency profile: reduced source term- ‘Cavity door failure’, ‘confinement failure during in-vessel phase’

and ‘long term basemat melthrough’ contributions reduced - ‘Confinement intact’ and ‘Confinement failure no VF’ end-states

increase

0,0E+00

1,0E-05

2,0E-05

3,0E-05

4,0E-05

5,0E-05

6,0E-05

7,0E-05

8,0E-05

9,0E-05

1,0E-04

Base case Case M2




‘In-vessel retention strategy - automatic actuation’

SAM measure investigated:Adding a cavity flooding system (automatically actuated)

Impact on RC frequency profile: ST significantly reduced- Similar to the implementation of manual system, but benefit greater - ‘Cavity door failure’ contribution significantly reduced- For the very early confinement failures the sequences without

vessel failure become dominant

0,0E+00

1,0E-05

2,0E-05

3,0E-05

4,0E-05

5,0E-05

6,0E-05

7,0E-05

8,0E-05

9,0E-05

1,0E-04

Base case Case M3




‘Adding hydrogen burners and independent spray system’

SAM measure investigated: Adding hydrogen burners and independent spray system

Impact on RC frequency profile:- The contribution of confinement failures due to hydrogen burn

before VF is reduced; improvement to some extent is offset by an increase in cavity door failures.

- This measure would be of most benefit when combined with other measures providing protection against cavity overpressure

0,0E+00

1,0E-05

2,0E-05

3,0E-05

4,0E-05

5,0E-05

6,0E-05

7,0E-05

8,0E-05

9,0E-05

1,0E-04

Base case Case M4



Conclusions – lessons from modelingConclusions – lessons from modeling

Definition of PDS – “sequence type” found to be useful PDS parameter

Separate set of PDS for each POS group - convenient Extension and re-quantification of Level 1 PSA model

needed Use of containment performance model with two levels

(CET + DET) – model manageable and easily traceable, subjective judgement clearly documented

Definition of End-States sufficiently detailed allows for flexible grouping with regard to source term characteristics

Step-wise process of CET quantification found effective and straightforward

Conclusions – insights from resultsConclusions – insights from results Plant risk profile For power operational states the main concern are

hydrogen burn during in-vessel phase and cavity door failure due to loads at vessel failure

For shutdown operational states dominant risk contributors are vessel open / confinement open states

Sensitivity to modelling assumptions The model is not sensitive to assumptions related to long

term confinement overpressure or the detailed modelling of ex-vessel cooling in the cavity

The model is sensitive to the probability of hydrogen burn in the cavity (due to small volume of the cavity)

There are uncertainties in relation to the induced hot leg rupture (during non-LOCA transients) due to uncertainties in creep rupture properties of steel

Conclusions – insights from resultsConclusions – insights from results All SAM measures investigated found beneficial Implementation of RCS depressurization (EOP Fr.C-1)

reduces cavity door failure frequency and increases the frequency of low release end states (intact confinement and melt-through confinement failure)

Implementation of cavity flooding with independent system reduces the vulnerability to cavity door failure, by reducing the number of sequences with vessel failure. An automatic actuation more beneficial than manual

Implementation of an effective system for hydrogen control would be beneficial in reducing contribution of very early CF. This measure should be combined with one of the others providing protection against cavity overpressure

These measures are being considered in SAMGs (currently under development for V2 plant)

Preventive SAM measures (EOP level) essential for shutdown POSs

Documents

Insights and lessons learned from Level 2 PSA for Bohunice V2 plant MACIEJ KULIG