ML20072R345
| ML20072R345 | |
| Person / Time | |
|---|---|
| Site: | Clinch River |
| Issue date: | 03/11/1983 |
| From: | James Hammelman, Liner R, Tefi B SCIENCE APPLICATIONS INTERNATIONAL CORP. (FORMERLY |
| To: | NRC |
| Shared Package | |
| ML20072R344 | List: |
| References | |
| CON-NRC-03-82-096, CON-NRC-3-82-96 SAI-84-123-WA, NUDOCS 8304050542 | |
| Download: ML20072R345 (147) | |
Text
..
RISK REDUCTION FEASIBILITY STUDY
> 0F SELECTED MODIFICATIONS TO CRBRP SAFETY SYSTEMS FINAL REPORT
)-
r J
)
- 8. Ateft R. Liner J. Hammelman
)
Report No.
l SAI-84-123-WA
)
March 11, 1983
)
Prepared for:
r '
U.S. Nuclear Regulatory Commission Washington, D.C. 20555 Contract No. NRC-03-82-096
)- SCIENCE APPLICATIONS,'INC.
Post Office Box 1303,1710 Goodridge Drive, McLean, Virginia 22102, (703) 821-4300 8304050542 830311
4 Table of Contents 4
Section Page LIST OF FIGURES. . . . . . . . . . . . . . . . . . . . . iii LIST OF TABLES . . . . . . . . . . . . . . . . . . . . . V
1.0 INTRODUCTION
. . . . . . . . . . . . . . . . . . . . . . 1-1 3
2.0 INITIATING EVENTS AND DOMINANT ACCIDENT SEQUENCES. . . . 2-1 3.0 DIRECT HEAT REMOVAL SERVICE (DHRS) . . . . . . . . . . . 3-1 3.1 Introduction . . . . . . . . . . . . . . . . . . . . . 3-1 3.2 System Description . . . . . . . . . . . . . . . . . . 3-2 3.3 Qualitative and Quantitative Analysis of DHRS. . . . . 3-5 3.4 Dominant Accident Sequence Involving DHRS. . . . . . . 3-17 3.5 Suggestions for Improvement in the Reliability of the
> DHRS. . . . . . . . . . . . . . . . . . . . . . . . 3-20 3.6 Sumary and Conclusions. . . . . . . . . . . . . . . . 3-22 4.0 CONTAINMENT SYSTEMS. . . . . . . . . . . . . . . . . . . 4-1
)
4.1 Introduction . . . . . . . . . . . . . . . . . .'. . . 4-1 4.2 Containment / Confinement System Description ... . . . . '4-4 4.3 Reactor Cavity and Containment Response to a-Vessel /
' Guard Vessel Melt-Through . . . . . . . . . . .-._. 4-8
>- 4.4 Sodium Concrete Interaction Issues and Containment-Response to Beyond Base Case' Accident Scenarios . . 4-14 4.5 Review of Various Ex-Vessel Core Retention Devices. . 4-24 4.6 _Effect of a Core Catcher on the Frequency of Radio-
, _ active Release Following a CDA. . . . . .-.. . . . . 4-28 I
4.7 Summary, Conclusions and Recomendations . . . . . . . 4-32'
)
.. 1:
, - ~
l l
l i
i 1
5.0 RELATIVE LIKELIHOOD 0F SELECTIVE TRANSIENT OVERPOWER INITIATORS . . . . . . . . . . . . . . . . . . . . . . . 5-1 1
5.1 Introduction . . . . . . . . . . . . . . . . . . . . . 5-1 l 5.2 Systems Description. . . . . . . . . . . . . . . . . . 5-5 l j 5.3 Relative Likelihood of Insertion of Different Rates of Reactivity in the Core Due to Control Rod Withdrawal Accidents. . . . . . . . . . . . . . . . 5-13 1 5.4 Relative Likelihood of a Transient Overpower (TOP)/
Loss of Flow (LOF) Sequence . . . . . . . . . . . . 5-42 i 5.5 Summary and Conclusions 6.0 PERFORMANCE REVIEW 0F THE CRBRP CONTAINMENT CLEANUP l
SYSTEM . . . . . . . . . . . . . . . . . . . . . . . . 6-1
( ,
6.1 Introduction . . . . . . . . . . . . . . . . . . . . . 6-1 i 3 6.2 Performance Requirements and Design of the Containment
- Cleanup System. . . . . . . . . . . . . . . . . . . 6-2' 6.3 Identification and Evaluation of Performance Issues. . 6-9 6.4 Sunnary and Conclusions. . . . . . . . . . . . . . . . 6-18 APPENDIX A References. . . . . . . . . . . ._. . . . . . . . . A-1 i
t
/
-l ,
- 11
p 7
List of Figures '
l Figure P_a!Le 2-1 Generic'LWBR Initiating Accident Event Tree . . . . . . 2-3 3-1 Configuration of the Direct Heat Removal Service During Normal Plant Operation . . . . . . . . .-. . .--. . . . . 3-3 3-2 Fault Tree for the Failure of DHRS . . . . . . . . . . . 3-6
) 4-1 Simplified Schematic of the CRBR Containment / Confinement Building . . . . . . . . . . . . . . . . . . . . ._. . . 4-5 4-2 0xygen and Hydrogen Concentrations as a Function of Time for the Base Case (0.5"/hr for 4 Hours). . . . . . . . . 4-12 j' 4-3 Penetration vs. Time for Various Sodium Limestone Concrete Experiments . . . . . . . . . . . . . . . . . . 4-16 4-4 Various Penetration Rates as a Function of Time. . . . . 4-17 4-5 Total Concrete Penetration vs. Time to Vent. . . . . . . 4-19 4-6 0xygen and Hydrogen Concentrations as.a Function of Time for the Molten Core Concrete Interaction Scenario. . . . 4-20 4-7. The Sacrificial-Bed Concept. . . . . . . .-. ... . . . . 4-25 4-8 The Cooled Crucible Concept. ... . . . . . . ... . . . . 4-27
) .
5-1 Clinch River Breeder Reactor Plant Heterogeneous Core Design. . . . . . . ... . . ... . . . . . . . . . .
5-6.
5-2 Simplified Block Diagram of Reactor Control System . . .= 5-9
) 5-3 Simplified Block Diagram of the Primary Control. Rod Drive Mechanism Controller . . . ..... . . . . . ... . . 5-10 5-4 Control' Rod Block System Based. on Rod Position . . . . . 5-12 5-5 Different Sequences of Events Following a Rod Withdrawal I Accident-. . . . . . . . . . . . . . ... . . . . .-.-. . 43-6-1 Maximum Containment. Vent Rates . . . . ..... . . . .t. . 6-3 6-2 Maximum Cantainment Atmosphere-Temperature'. . . . . .... 6-4
).
f iii . I
, :i i
J
b-
).
List of Figures (Continued)
Figure P_aie 6-3 Schematic of the CRBRP Containment Cleanup System. . . . 6-7
) 6-4 Predicted Inlet Gas Temperatures for the Polypropylene Gas Filter . . . . . . . . . . . . . . . . . . . . . ... 6-17
)
J
).
T .
}
~
2-
I d
i-List of Tables Table Page.
I 2-1 Dominant Accident Initiators Contributing to the Unprotected Loss of Flow (ULOF) Accident . . . . . . . . 2-6 2-2 Dominant Accident Initiators Contributing to the LOHS. . 2-7 3-1 Failure Rates for Various Components of the DHRS . . . . 3-12 3-2 Contribution of Various Events to the Failure of the DHRS . . . . . . . . . . . . . . ... . . . . . . . . . . 3-14 3-3 Effect of.0perator Error and Other Human Related.
Events on the Failure of the DHRS. . . . . . . . . . . . 3-16 4-1 Extra Time Between Evacuation and Venting for Various i Accident Scenarios . . . . .-. . ... . . .;. . . . . . . 4-23 4-2 Frequency of Various Containment Failure Mechanisms. . . 4-29 5-1 The Expected Position of Row 7 Primary Control Rods at the Beginning and End of Cycle for the First Five Cycles' 5-7--
2 Failure Modes and Effect Analysis for the Auto: Inter- +
face Board Clock and Overspeed Detection System.' . . . . 5-18 5-3 Component Failures that Result in Auto Interface Board Clock Mechanism Producing Pulses that Correspond to a
> Bank Withdrawal of 14' Inches Per Minute or More... . . .. 5-27 5-4 Component Failures that Contribute-to the Failure of the-Auto Interface Board Overspeed Detector for. Bank With-drawal Rates of.14 Inches per Minute or More .. . . . . . : 5-29.
) 5-5 Failure Modes and Effect Analysis of the Rod Controller-
-Drawer Clock and.0verspeed Detection SystemsL. . . ... 5-30'
, 5 Component Failures that Contribute'to the Failure'of-
'the Rod Controller Drawer Overspeed Protection Such that Rod Movements in Excess of 10 Inches'Per Minute y are Permitted. . . . . . .-. . .-. . ... . . . ... . . . 5-37. l 5-7 Component Failures'that Contribute-to the Failure of-the Rod Controller Drawer Clock Mechanism. -. . . . .~. . 5-40 .
6-1 Comparison of Design and Scaling Parameters for the' l 3 Quench Tank... . . . .:. . .c.'. ..- ... ... . . . . . .. 6-11 H
'l V
): _
- , .- - - ..- .. . -j
1 I,
j
{ l i i
! INTRODUCTION j
[
f As a part of the current revitalization of : interest in licensing of the CRBRP, an effort was initiated by the Nuclear Regulatory Commission l
j to look into various issues related to the'CRBRP risk assessment. This report describes the preliminary work performed under one task of this I effort namely the risk reduction feasibility study. The' objective of this ,
task is to review various safety related systems and issues of current -l interest to the NRC and identify areas of importance, concern and any '
possible changes ~or additions which can result in a potentially meaningful reduction in the overall risk attributed to the operation of the CRBRP.. In this regard there has been no attempt at systematic review of various CRBRP engineered safety systems and only the systems or safety issues of most ;
concern to the NRC have been evaluated. l l
After a brief discussion of the dominant accident sequences and the corresponding . initiators in the next section, Section 3 deals with' issues related to the reliability of the Direct Heat Removal Service (DHRS).
, The concern about DHRS arises from the fact that in'the event of' loss of all three-main heat transport loops, DHRS must-perform the function of heat removal _ reliably. Regarding the reliability of this system there was - some concern about independence of the power source to this system, especially during a loss of offsite power _ condition, and if an additional dedicated source of emergency power would be beneficial in increasing the' reliability of this system. To address this concern the overall reliability of-the DHRS system and the accident sequences leading to core melt' that require opera-tion of the DHRS were analyzed and are presented in Section:3.
Section 4 deals with the issues related to the possible need and-t benefits of an ex-vessel core retention. device more commonly known.as'a'.
-" core catcher." The issue:in this case is that following a core disruptive:
. accident and vessel and guard . vessel ' melt-through. an energetic interaction I
between the molten fuel,' steel, sodium and the concrete on the floor of the cavity will . result. - These . interactions : will ' result in release' of ' consid-erable: amounts of water vapor and other gases such as CO
, 2 . . Interaction of-the ; released water vcpor and. sodius' re'sults in production of large ~ amountsL
!' , of hydrogen which is vented to the upper containment building ~and will-burn -
T 1-l ' -
~
'~
M2 '.L .::: . .~
~'
)
in the non-inerted atmosphere of containment building until this atmosphere
-becomes oxygen starved. At this time the hydrogen will build up and so to avoid hydrogen concentrations close to detonation levels some time after the
. initiation of .the accident the ' upper containment atmosphere must be vented and purged. This leads to questions related to the adequacy of the time between evacuation of the area surrounding the site and time for venting and
) purging. Also issues related to the reliability and performance of contain-ment cleanup system during venting are very important. Thus, due to the uncertainties in the various parameters determining the containment response to a core meltdown, there is some concern whether using a core ' catcher as a
- j. means to delay the venting requirement is beneficial and what are the alter-natives to this design change. These issues are discussed in detail in Section 4.
Section 5 consists of discussion of two topics. The~first topic
)- is the relative likelihood of large reactivity' insertions due to control rod withdrawal -and the second topic is the likelihood-of a combined transient overpower (TOP) and loss of flow (LOF) accident. u
)- The importance of the first topic arises from the fact'that one of the most critical input parameters in the analysis of possible outcomes of a transient overpower accident is the rate of reactivity insertion in the core
~
as the result of a TOD initiator. This is due to the fact that at high reactivity insertion rates the location of the fuel pin failure is closer to
) the central region of the core and due:to fuel movement toward the center,-
the consequences of a TOP could be an gergetic termination of'the accident.
This is in contrast to TOP accidents initiated by low reactivity insertion rates where fuel pin failuras and consequently fuel sweepout is away from -
)- the core and a benign termination would result. Various studies have shown that to get an energetic core disruptive accident, reactivity insertion rates of 20 cents per second or more would be necessary. :Thus, the objec--
.tive of Section 5 is'to review the possible mechanisms leading to various
, reactivity insertion rates and specifically see if the relative probability
) of[large reactivity' insertion rates of about 20 cents per second.or more compared to accidents introducing lower reactivity-rates of 10 to 12 cents.
-A separate but related. topic concerning the relative likelihood of
) .a combined transient overpower and loss of. flow : accident was analyzed. . The- .
1-2.
)
._ z . ._ a . . _ . _ - .
y
b f
i i . 2.0 Initiating Events and Dominant Accident Sequences l 'In this section, a review of various accident initiators and the corresponding accident sequences will be performed. The objective of'this li review is to identify accident initiators which have a high frequency of I occurrence and which could possibly lead to'a Core Disruptive Accident (CDA). Once .these initiators have been identified any possibility of l
reduction of their frequency of occurrence based on design improvement or 3
test and maintenance changes can be investigated. '
i l A core disruptive accident can be -initiated if there is an
{
imbalance between the rate of heat generation and. heat removal .in the core.
This heat . imbalance could lead to the melting-of the fuel and cladding.
l
- . There are two general conditions that could lead to a heat imbalance, these are
b l 1. Inadequate heat removal; .this could occur when the reactor is at j- full power or in a shutdown condition where only; decay heat has to -
i be removed.
l-
- 2. Reactor. power' production beyond the design capacity of the heat--
]~
! removal systems implying that even if the reactor heat removal ,
j system is performing its intended function it cannot remove the
! _ excessive power production by the core.-
j:
The inadequate heat removal would result if there'is a fault
~
- preventing removal of heat from the core to the . intermediate heat' transport loops or from. the intermediate heat exchangers to the steam. generating system'(SGS) or from the SGS to the ultimate heat- sink. To' find accident
!. . initiators leading to inadequate heat balance, it is necessary to search closely for the f aults .in the core, Primary Heat Transport System (PHTS) -
- Intermediate. Heat Transport ' System -(IHTS) and Steam / Electrical Generation
. System (SEGS). -During shutdown, heat can also be' remove'd by the. Steam.
~
- Generator Aux 111ary Heat' Removal. System (SGAHRS) and the Direct Heat Removal' ,
~
, Service (DHRS). Faults-in these systems must.also be ' investigated for
. possible accident initiators.
4 e
t
- ii
_-___________m__m, , , .., ; , , , , , , . , , , , _ .
__ _ _ . _ .m .#,_ ,
l I
j' Excess reactor power can occur due to failures in the core that are related to fuel, sodium, steel or control rods. These include failure
! in the control system or other faults or failures that could result in the introduction of excess reactivity to the. core.
{
Irrespective of the accident initiator, accident s'equences can be grouped into the two broad categories- of protected and unprotected
- accidents. The. protected accidents are the accidents where the reactor l shutdown system functions properly and the reactor is scrammed. -The
- unprotected accident sequences are sequences where the reactor shutdown
$ fails. As was mentioned earlier, the accident sequences of interest in this
!- study are the sequences that .could possibly lead to core meltdown.
i j In a recent series of studies on accident delineation in the i LMFBRs a generic event tree was developed for the various accident
[ initiators in the CRBRP (1,2). Figure 2-1 shows this generic LMFBR event 1 tree. The starting point of this. event tree is an accident initiator which results in a transient.or subsystem f ault or f ailure requiring emergency
{_ plant shutdown. In sequence- A, the accident condition is detected success-
' fully and the reactor is scrammed. At this point pump' trip- or coastdown. is -
l of no consequence although the pumps eventually will . trip.- Shutdown heat l removal system (SHRS) operates and pony motors . provide forced c'irculation.
l Consequences of this accident sequence depend on the accident initictor and-
- any possible-subsystem failure. If the primary coolant boundary is intact.
i and there has been no core damage then cold shutdown can be achieved without radioactive release to the environment. If the core is undamaged but the-l primary system has been compromised then cold shutdown is still possible butE l radioactivity might also be released to the outside environment if the containment isolation fails. If the core is damaged because of the accident initiator then a coolable geometry might not exist even if SMS and forced flow were available.
]_
r Sequence B is the-same as Sequence A except that the forced flow is not available. _In the LMFBR accident delineation study (1), due to the l
- uncertainty in' the natural circulation capability of. CRBRP'.it is indicated I that.a core. disruptive accident.(CDA) might be possible as a' result 'of' f ailure of the forced flow. . Recent. studies on the cooling capability of.
'CRBRP via natural circulation have shown that following an accident natural l
- 2-2 ho
^ ~ '
7~ 17
,_ . _ . . ~ "' Ti I ...._7 _ . . . . .
y y. m - y- 7 .- - _ -. _
Detection Scran Pump SHRS Forced Flow Accident Category Trip
-A Cold Shutdown B Protected Transient or Fault Without Forced Flow; CDA Possible 7
-C Protected Transient or Fault Without SHRS; CDA
^
Inevitable D Unprotected Transient or Fault With Loss of Flow CDA Inevitable Accident
~ Initiator
- Unprotected Transient or Fault F Unprotected Transist or Fault Figure:2-1. Generic LMFBR Initiating Accident Event Tree.
. . _ . _. ._ _ _ _ _ _ ...m. _ . . - _ _ _ _ _ _ _ _ . _ _ _ . . _ _ _ _ _ _ . _ _ _ ___ _ _ _ _ _ . _ - __ _____ _ _ _ _ _ _ _ _ _ _ _ _ _-
)l- )
l circulation can be established in three, two or even one loop so long as the primary and intermediate loops are available for heat removal (3). Based on
) 'these early results it is safe to say that failure of the forced flow after an accident by itself is unlikely to be the cause of accident progression to a core disruptive accident. Thus it_ is more appropriate to ask whether sufficient heat removal via forced or natural circulation is available ;
)
following an accident rather than focusing on forced circulation only. l 1
In Sequence C, the shutdown heat removal system (SHRS) is '
unavailable. This~is assumed to imply that all means 'of heat removal are lost and so a loss of heat sink (LOHS) accident results. Because there is-
) no heat removal possibility a CDA is assumed to be inevitable in this case.
As will be shown shortly, among various protected accidents, LOHS is the most important accident sequence with the highest contribution to the core melt frequency.
)
Sequences A, B and C described so f ar have been protected sequences where reactor shutdown has performed its function. Sequences D, E and F are unprotected sequences where the scram system fails upon demand.
) In Sequence D, detection of the failure is successful and a signal for scram and pump trip is initiated. In the CRBRP design :. reactor scram signal is always accompanied by a signal for pump trip. In this sequence the pump- .
will trip but the reactor shutdown system will not scram the reactor. - This leads to an unprotected loss of "ow (ULOF) accident and is the dominant accident sequence among unprotected accident sequences.
In Sequence E both scram and pump trip f ail. The reactor would probably be at or.above full power. The progression of-the accident-and its.
)' final status is strongly dependent on .the accident . initiator and 'the ,
sequence of events that.would occur as a function of time following accident
-initiation.-
)- Sequence F is fairly similar to Sequence. E in. that an _ accident' has' ,
been initiated but the detection system fails to detect the accident condi-tion and thus there is no signal for scram or pump trip. Again,;the reactor' will ~ operate at or abo've full power;- the consequences of this accident:~are .
strongly dependent on the.. accident initiatorf and sequences of events ;after -
the accident initiation.
~
2-4
1
).
l l
As a part of Task 1 of the present effort on the CRBRP risk l T assessment, using a generic event tree similar to the one described above i and a list of accident initiators, a-scoping analysis of the various CRBRP accident sequences were performed (4). The results of this preliminary analysis have shown that among various accident sequences leading to core y meltdown, 22% of the core melt frequency is due to the unprotected accidents and 78% due to protected accidents. Among unprotected accidents consisting of unprotected loss of flow (ULOF), unprotected transient overpower (UTOP) and unprotected loss of heat sink (ULOHS), the ULOF accident mentioned above is the dominant accident sequence contributing up to 86% of the core melt .
frequency due to unprotected accidents.
t With respect to the protected accidents consisting of loss of heat sink (f NS), loss of coolant accident (LOCA) and transient overpower (TOP),
> the LOHS sequences where SHRS has failed contributt- up to 97% of the core melt frequency due to protected accidents.
As was mentioned earlier the unprotected accident' sequences
) leading to core meltdown are dominated by the unprotected loss of flow (ULOF) accident sequence. Table 2-1 shows the dominant accident initiators contributing to this accident sequence.- Among various protected accident sequences leading to core melt; loss of heat sink (LOHS) is the domin' ant accident sequence. Table 2-2 shows the dominant-. accident initiators con-
) tributing to this accident sequence. In Table 2-2 the accident initiator leading to loss of all three heat transport loops is shown'to have a mean -
frequency of 8.47x10-4 per year. As will be discussed in great detail .in the section on DHRS, currently there is some uncertainty about the frequency
)- ~
of occurrence of this initiator _ and much higher numbers have been quoted ~ in--
some references. Thus, it is conceivable that- this initiator could have a-higher contribution to the total frequency _ of the core-melt. -
)- Overall,'the list of initiators shown in Tables-2-1 andL 2-2 are - !
the dominant accident initiators both for the protected and unprotected accident sequences leading to-core meltdown and a further' detail analysis of causes of these initiators 'could help in possible reduction of the overall:
frequency of core meltdown in.the CRBRP.
I
[ 2-5)
1
)
Table 2-1. Dominant Accident Initiators Contributing to the l Unprotected Loss of Flow (ULOF) Accident j
)
Initiator Mean Sequence Mean Accident Frequency Per Frequency Percentage Initiator Year Per Year Contribution
). .
- 1. Pump trip in 3 8.75 3.62x10-5 50.2 primary loops due to inadver-tent PPS
) 2. Loss of main 3.61 9.31x10-6 12.9 feedwater supply, main condenser or turbine trip
- 3. Loss of one heat 2.63 8.78x10-6 12.1
) transport loop or one steam
. generator 1oop
- 4. Normal shutdown- 3.28 8.46x10-6 11.7 with SHRS
) available
- 5. Normal shutdown 2.19 5.64x10-6 7.8 with one heat transport loop unavailable
- 6. Normal shutdown 0.626 1.62x10-6. 2.2 with DHRS unavailable
)
4 y :. 2 .
~
. .. . . = . . .
I F
1 I
)
Table 2-2. Dominant Accident Initiators Contributing to the LOHS I
Initiator Mean Frequency Mean Frequency Percentage Per Year Per Year of the Total
- 1. Loss of Main Feed- 3.61 2.03x10-4 69.4 water, Main con-denser and Turbine Generator Trip j 2. Loss of Instrumen- 5.15x10-5 5.15x10-5 17.6 tation and Vital Plants Components
- 3. Loss of Off-Site 1.25x10-2 1.56x10-5 5.3 Power Greater Than
) 2 Hours
- 4. Loss of Off-Site - 1.25x10-1 7.03x10-6 2.4 Power Less Than 2 Hours
) 5. Loss of All Three 8.47x10-4 6.67x10-6 2.2 Heat Transport Loops And All
.Three Steam Generators
)
L 2 ..
E i
- 3.0 Direct Heat Removal Service (DHRS)
\
- 3.1 Introduction i
- In this section, the overall reliability of the Direct Heat g Removal Service (DHRS) will be analyzed. The importance of the DHRS arises a
- from the fact that in the unlikely event of complete loss of all three main I l - heat transport loops, the decay heat removal must be performed by the DHRS j so that any possibility of core damage can be avoided. This has lead to '
- some concern about the overall reliability of this system and a more .
specific question related to the need for an additional diverse source-of AC power for this system.
Af ter a normal or accident-related shutdown of the. reactor, the
-main condenser /feedwater system is the normal path for rejection of the decay heat. In this case the steam produced-in the steam generators-is bypassed from the turbine to the main condenser and feedwater is provided to the steam drum for' decay heat removal. If the main condenser /feedwater system is not available the decay heat will be removed by the Steam
'- Generator Auxiliary Heat Removal Service (SGAHRS). The SGAHRS consists of two subsystems, namely the Auxiliary, Feedwater System (AFWS) and the Protected Air Cooled Condensers (PACC's). .The short. term heat removal is -
provided by the AFWS where the feedwater from Protected Water Storage Tank i (PWST) or an alternative -source such as Condensate Storage Tank (CST) is fed' to the steam drums and steam leaving the steam generators is vented. The
.long term heat removal is orovided by the PACC's which start operation simultaneously with AFWS and with time accept more'of the heat removal 1
capacity. Eventually all the heat will be removed by the protected air-cooled condensers.
As will be discussed later on in Section 3.4 on the dominant'
~
accident sequences involving DHRS, based 'on some; recent' reports (2, 5) the likelihood ofL complete: loss 1of ~ all.-three heat transport loops'is not:.
insignificant.. In fact, based on the numbers mentioned:in ~ these references and the unavailabiity of the~DHRS: calculated. in' this r'eport,- the. accident- -
sequences involving DHRS-could oecome'the'. dominant accident' sequences leading to core melt.. It is' crucial 'at this-point _to realize that there is
~
F
~
1 a significant skepticism: and uncertainty 1about' the;high- probability:of11oss :
13-l'
, l 2
f i-
- of all three main heat transport loops quoted in the above references at
{ this time. Thus, whether.the accident sequences involving complete loss of the three main heat transport loops along with loss of DHRS are' the dominant
- j. core melt accider.t sequences or not is clearly dependent on the frequency of
{_ the initiator, namely loss of all three main heat transport loops.
4
$ The main point at this time is realization of the fact that l reliability of DHRS is important to the safety of the CRBRP. Whether this reliability is crucial in the sense that core melt accident sequences involving DHRS actually dominate the overall core melt frequency or not is I
uncertain at this point and will be further discussed in greater detail later on.
r
- In the next section, a brief description of the.DHRS during normal
! plant operation and in the accident mode will be presented. Section 3.3
- j. deals with the qualitative and quantitative analysis _of the DHRS. This i involves a f ault tree analysis of the system and quantification of the-f ault b tree. to determine the numerical value for the _unavailablity of the DHRS on I demand. The dominant _ accident sequences involving DHRS are discussed in j Section 3.4. In this section uncertainties associated with the initiator mentioned above will be discussed. Also a comparison between core melt
~
{
t accident sequences involving DHRS and other dominant core melt accident j sequences will be presented. In Section 3.5 some alternatives related to possible improvement in the reliability of DHRS will'be presented.. -This _is .
- followed by a sumary and conclusion of the study..
l 3.2 System Description
( The Direct Heat. Removal Service is designed to provide a fourth
! redundant' path tor decay heat remo' val following reactor shutdown.. It i enhances the_ reliability of decay heat removal-by serving as'a backup to the. q r three primary, intermediate and steam generating . heat transport ' loops. - This I system is capable of. removing approximately 11 MWth _using itsione available loop. This' capability is adequate in preventing loss of coolable- geometry and limiting the average bulk primary sodium temperature to approximately -
11400F after complete loss of all three main heat _ transport loops;upon
- shutdown from full power and full operation of;DHRS half.an hour' after the shutdown (6). Figure 3-1 shows a simplified schematic of the DHRS during-l 4
3-2'-
. , . , , - _ . , . . . . . . . _ _ . - , _ . ~ -
, ~ , ,m-- , -
JiJk hh RSS RC8 D @- EVST NAK EVST NAK PUMP t
j t J PUMP L. _J
-c-) --
-c ) c j e
- [ REACTOR 150
VESSEL
.. .. __ u :
, EVST AIRBLAST HEAT EXCHANGERS 151 102*
g2 _
149 57 w2_ _
OVERFLOW 46 420' HX "
- c-m m _ m g IPRIMARY COLD t y3
~ y3 368* 415 y 109' MAM g 103*3 L,__g it
) J 6 104 A 116 - : =^ ,
MAKEUP g
i EVST I PUMPS I NAK g I
I LOOPS I
-D<H,2-c4- "t"J "
!- ! ! ! 118 8 132 L. q g- J
' l-q pJ
- ACTIVE VALVES ii d[ .
Figure 3-1. CONFIGURATION OF THE DIRECT HEAT REMOVAL SERVICE DURING NORMAL PLANT OPERATION
1 p
1
! normal reactor operation. As is shown on the figure, during normal reactor
[ operation approximately 120 GPM of sodium leaves the reactor vessel to the
[. overflow vessel. Both makeup pumps are' running during normal operation at
[ reduced flow rate. Of the 120 GPM of sodium pumped by the makeup pumps, approximately 90. GPM go through the primary cold trap's for cleanup. After
~
j j the cleanup operation this sodium mixes with the rest of the sodium going
[ through the solenoid operated valve (S0V) 102 and is -recycled back to the
[ : reactor. During normal operation SOV 103 is closed and no heat is removed l_ from the primary sodium. On the secondary side of the DHRS one airblast heat exchanger and its associated Ex-vessel Storage Tank (EVST) NaK: pump is
[
running continuously whereas the other airblast heat exchanger and the associated NaK pump is on standby. The active NaK loop removes the decay
! heat from the EVST.during normal operations. The DHRS is initiated after l two main heat transport loops are lost for any reason and will be required
{
to carry the total decay heat only if-all three main heat transport loops j -have been lost for any reason. In such a case, the system is activated
- manually and remotely from- the control room.- Once the system is -initiated i
by the operator, a sequencer automatically sends the signals for various
)
actions 7:ecessary to bring the system on line. These actions include:
o opening valves 103, 357, 358, 415 and 416 i
f o closing. valves 102, 109, 359 and 420 i
l o increase makeup pumps speed so-that approximately 560 GPM of sodium can be recycled, .and t.
i' o startup the inactive airblast heat' exchanger and its
! associated NaK pump.-
l 4
[ The' operator. in this case will monitor the : change of- status of various'
- I valves and pumps through the indicators in the control roomiand has the-
. ability to intervene atiany'timejif corrective action is necessary.
- iThe DHRS is not designed to operate on natural circul.ation.
LCurrent analysis. has shown thatithe system :can function ~ properly'with two Jpony motors operating; Furth'er analysis of the system based _on one ponys
~
motor ~ operation or _ even natural ~ circulation ;isi planned forL the near c future.' ,
i
~
^
41
)-
Electric power for the operation of the pony motors and the makeup pumps and l
the EVST NaK pumps is provided by the normal and emergency AC electrical systems.
Finally, operation of both airblast heat exchangers is only neces-sary for an initial period. As time goes on, the decay heat reduces to the
). level where one NaK loop operation is sufficient to dissipate all the decay heat. Currently, it is estimated that for- the first 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> of DHRS operation, both airblast heat exchangers 'are required to remove decay heat.
Also, analysis of the core and DHRS system has shown that in the unlikely event of temporary loss of DHRS after its initiation due to any reason, the primary sodium heats up at a rate of 500F/Hr. This indicates that there is sufficient time for any corrective action that might be necessary after initiation of the DHRS.
I 3.3 Qualitative and Quantitative Analysis of the DHRS To assess the reliability of the DHRS and find the major contribu-tions to the f ailure probability of the DHRS a simplified f ault tree was I developed for the event " Failure of DHRS" (upon demand) and is shown in Figure 3-2. The various major faults leading to failure of DHRS are divided into failure of DHRS primary system, secondary system, failure of the elec-tric power, test and maintenance outages, human related errors and finally
) f ailure of pony motors (see sheet DHRS1, Figure 3-2). Once the f ault tree is quantified, contributions of these various events to the. failure of DHRS can be assessed. . This in turn will help to. identify major areas of concern with respect to the reliability of the DHRS and areas with most potential for payoff in terms of any change or improvement.- The fault tree shown in-Figure 3-2 has been developed to a level of detail where 'some data -is available for the basic events. For example, the airblast heat .exchangers have not been developed any further than their general failure 'although one can break this f ault into failure of. the .f an, louvers or other subsystems.
) Since an overall probability for the failure of .airblast heat exchangers is <
available no more det' ail; has been incorporated in the f ault tree. The human related error is primarily the' operator error to initiate the operation of
~
the system. Other human.related errors have been assumed to. be negligible.
y Since no procedures for test or maintenance are available at this time no
~
value has been assigned to the contribution of test.and maintenance outages-l 1 3-5L m
FAILURE OF DHRS ew M
FAI U" F FAILURE OF TWO HUMAN
. i FAILURE OF HRS FAILURE OF THE P. Y. -DHRS ' OUT OF THREE ELECTRIC POWER RELATED
- PRIMARY SYSTEM SECONDARY PONY MOTORS TO DHRS ERRORS SYSTEM f3
, 1 2 3 DHRS2 DHRS3 DHRSS I
L .
i TEST AND LOSS OF OFFSITE LOSS OF ONE
'-- MAINTENANCE POWER GIVEN A OF THE TWO OUTAGES DEMAND FOR DIESEL DHRS GENERATORS
- 4 a -
DHRSS f-L~
t I
fr " DHRS1
(
Figure 3-2. FAULT TREE FOR THE FAILURE OF DHRS
$ "E g c 24 w w
=3%
D s
3 gEO Ogm g-3 p>o w >
Ih w
- W W
E b _
- r g
<t.O o ON$
~ EES
=t; s-a w
E I=
Om2 E WS$
8 O
>O 5we 6
3 g
- n -
h "
m w = y
$N giE t- m k e
3 (a
E i
.?
rn. E ai-1 i 52 3*E zE 2
! W
, m w
O *W*4z g e '3s un
< D EU,w
- E st-d 5
e
., a h
s.o 3W" W ti
.Z
- >l O i
$.a5 d
514 t 2ge 3-7
v v v v v- v v v v- v v FAILURE OF DHRS
\ SECONDARY SYSTEM DHRS1 m
FAILURE OF FAILURE OF DHRS DHRS SECONDARY SECONDARY LOOP A LOOP 8 h
DHRS4 T
FAILURE OF FAILURE OF FAILURE OF FAILURE OF FAILURE OF SOV 357 AIRBLAST NAK PUMP A SOV 358 SOV 359 TO OPEN. HX A TO RUN TO RUN TO OPEN TO CLOSE O O O O DHRS3 Figure 3-2. (CONTINUED)
. - _ . - - _ _ _ . . - . _ _ - - _ - _ . - - _ - _ . _ _ - _ _ - . - _ _ _ _ . _ _ _ . - _ _ _ n ,- - .- - --- - ---. - -- - - - -m -
y _.-
FAILURE OF A DHRS
.ECONDARY S
/7g LOOP W DHRS3 1 I I I FAILURE OF FAILURE OF FAILURE OF FAILURE OF FAILURE OF SOV 416 AIRBLAST NAK PUMP B SOV 415 SOV 420
, TO OPEN HX B TO START TO START TO OPEN TO CLOSE O O O O O y
6 PIPE SECTION
\
DHRS2 em FAILURE OF FAILURE OF FAILURE OF MV 132 TO MAKEUP PUMP MV 118 TO REMAIN OPEN B TO RUN REMAIN OPEN O O O DHRS4 Figure 3-2. (CONTINUED)
m WNh
=
3b
_o= m z
m E Z O Om 0 \
l W e
'hwmo O we
$OQ= I O tu O W J Z 4: W 2
OF O 4
ww$
mm- -.
Ud4 O das W
<m W D
/$ 06 3 kEo -
i:
Z O
U w>M M m2E 9 W
Rmo .9 EO2 E o m hW wbN m E. mZe Ok n ffO W$ NI Emo
$g 102 d3 40 m
w>"
mZ=
_ 300 s & dL>
/n z (mo
% EO2
=0 3-10
to the failure of the DHRS. Only an estimate for the operator error to initiate the system is provided. Also all the test or drain lines are assumed to be much smaller than the main DHRS piping so that no flow diver-sion due to faults in these lines would be capable of disabling the system's heat removal capability.
Table 3-1 shows the f ailure rates for various components and events used for the quantification of the f ault tree. Most of the numbers are widely accepted f ailure rates for various components. In the case of I the operator error, a probability of an error of commission of 10-3 with a i probability of f ailure to recover of 0.1 is assumed. The lone operator error probability of 10-4 is suggested due to the fact that the operator has a reasonably long time (in the order of one hour or more) to act or recover from any mistake. Obviously if the operator error probability is large it could have a major effect on the total failure rate of the DHRS as will be shown later. Note also that f ailure rates for f ailure-to-run events are small. Since the mission time for the system is assumed to be short (in the order of days), contribution of f ailure-to-run events to the DHRS unavaila-bility is assumed negligible. Thus, the calculated failure probability of I
DHRS it essentially its failure on demand.
Table 3-2 shows the f ailure probability of the DHRS and various contributions to this value.
)
As can be seen from the table the failure probability of the DHRS is dominated by f ailure of any one of seven valves to change state and one NaK pump to start. This is because neither the primary system nor the y
secondary system is redundant initially, i.e., all the valves and the pump f ailures are single element minimal cut sets. As was mentioned earlier, af ter a period of operation of DHRS (approximately 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />) the decay heat is reduced to the point where only operation of one secondary loop is _
necessary. With respect to the question of possible need for a diverse I
source of AC power to the DHRS it is clear from the table that the contribu-tion of f ailure of the electric power _to the f ailure of the DHRS ~is very small. This is due to.the f act that the DHRS.is only required when all three primary heat transport loops are lost. Thus if the accident initiator
) is the loss of all three main heat transport loops where DHRS has to remove-the decay heat, for the system to be disabled there' must be a loss of
)- 3-11
. - = -
Table 3-1. Failure Rates for Various Components of the DHRS Component Fault Failure Rate Source Failure of Solenoid AD = 1.0x10-8/D WASH-1400 (7)
Operated Valve to
~ Operate on Demand (0penorClose)
Failure of Manual Valve .. WASH-1400 To Remain Open (plug)
A0" Demand Failure rate 4Hr/D based on monthly test j converted to hourly ,
= 2.7x10 7/Hr failure rate Failure of Check Valve A0 = 3x10-7/Hr WASH-1400 To Remain Open (Reverseleak) i ,
Failure of Motor AD = 1.0x10-8/D WASH-1400 Operated Pump to Start 1
Failure of Motor A0 = 3x10-5/Hr WASH-1400 Operated Pump to Run h Failure of Diesel AD = 3x10 2/D WASH-1400 Generator to Start Failure of Diesel A0 = 3x10-*/Hr WASH-1400
) Generators'to Run Fail'ure of Pony Motors- :CRBRP Safety Study (5).
(engagementofmechant- AD = 3x10-"/D cal clutch)
)
); 3-12
Tabic 3-1.- Failure Rates for hrious Components of the DHRS (Continued)'
Component Fault Failure Rate Source Loss of Offsite Power Based on Loss of Off-Given a Demand for A D " 365x24 0.1x24 site Power Probability DHRS of 0.1/yr (CRBRP Safety
= 2/8x10-" Study) and a Continuous 1 l
Loss-for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
Pipe Rupture WASH-1400 A0 = 1.0x10-'/Hr Operator Failure to A D
= 1.0x10-8 x0.1 Based on Error of Com-Start the System mission of 10-s and a
= 10-" Failure to Recovery of 0.1 (Handbook of Human Reliability (8))
i-Overflow Vessel Rupture c.
- Assumed Negligible failure of Overflow c Assumed Negligible Heat Exchanger Failure of Airblast A0 = 1.0x10-5/Hr ~ CRBRP Safety Study.
. Heat Exchanger i-4
)
s g
u L 3 b -
, 3-13.-
m ,.
i, Table 3-2. Contribution of Various Events to the Failure of the DHRS~
f Event Failure Probability Major Contribution Failure of DHRS 1.0x10-3 Failure of S0V 103 Primary System -
to Change State
)
Failure of DHRS 7.0x10-8 Failure of Six SOV's Secondary System and one NaK Pump to Start I
Failure-of Two 3.0x10-*
Out of Three Pony Motors ,
- Failure of Electric 1.6x10-5
. Power to DHRS -
Human Related 1.0x10-' Only Operator Error to Error Initiate.the System is
). Assumed.
DHRS Failure on 8.1x10-8 Failure'of Seven 50V's Demand to Change State and One Pump to Start
)
).:
m ,
b 3-14 .
.y
offsite power and loss of at least one diesel generator. The probability of simultaneous loss of all three main loops and loss of offsite power and one diesel is very small. Alternatively if .the initiator is loss of offsite power or even station blackout, DHRS.is not required to remove the decay taat. Decay heat can be removed by natural circulation in the primary and secondary heat. transport loops and operation of the steam turbine driven 1 auxiliary feedwater pump for about two hours. The current limit on the period of heat removal is the operation of batteries necessary for control and instrumentation (5). Thus addition of another source of emergency AC power exclusively for DHRS does not seem to have much effect on the relia-
> bility of the DHRS.
As was mentioned before, for the operator error a low probability :
of 10-4 was chosen due to the relatively long period of . time available for both initiation of the system and recovery of any errors. Obviously variations in this value may have a major effect on the reliability of the DHRS. This effect is shown in Table 3-3 where the human error is varied from 10-4 to 10-1 Note that this human error can be thought of as a l combination of operator and other human related events such as test and
) maintenance outages. As can be seen once the human error increases _to 10-2 or above it becomes the dominant contributor to the failure of the DHRS.
In the next section a discussion of the dominant accident sequence-
) involving DHRS which could possibly lead to a core disruptive accident will be presented. The discussion will also include a comparison between this sequence and other core melt accident sequences.
- )
)
y .
we b
2 3 .
I
'N I" -'
_.-___.__.__.-_______.___a -
- j. '
Table _3-3. Effect of Operator Error and Other Human Related Events on the Failure of the DHRS. 1 D
Operator Error and Other Human Related Events Failure Probabilities Failure of DHRS ,
t O' 10-* 8.1x10-:
10 : 9.0x10-8 10-2 (Dominating) 1.8x10-2 O 10-1 (Dominating) 0.108 O .
O .
i O
O -
J ,
P
3.4 . Dominant Accident Sequence Involving DHRS In this section dominant accident sequences involving DHRS which can lead to a core disruptive accident (CDA) will be discussed. The
> objective of this discussion is to determine the importance of the reliability of the DHRS as a mitigating system in sequences which could lead
~
to a core disruptive accident.
) The DHRS is only required to remove the decay heat if all three primary heat transport loops are lost. The CRBR Safety Study (5) mentions several causes for the loss of all three steam generating loops; these include: "a main steam header rupture with f ailure to isolate the loops, '
)
stuck open safety valves or pressure relief valves, water level control malfunction in the steam drums leading to dry out, spurious inadvertent actuation of the water-steam side of the sodium water reaction system, inadvertent isolation of the evaporators in the loops, a large sodium-water reaction that exceeds the capacity of the SWRPRS and damages all three heat 2
transport loops, and a large earthquake that causes actuation of the rupture disks in all intermediate loops." The CRBR Safety Study indicates that the major contributor to the loss of all three steam generating loops is a simultaneous actuation of all three rupture disks in the intermediate loops
). due to a greater than safe shutdown earthquake (SSE). The frequency of an earthquake greater than SSE is estimated to be 3.4x10-5/ year and the same.
number is used as the initiator for loss of all three steam generating loops -
(CRBR Safety Study (5), Appendix .III, page .100). In another part of the
~
CRBR Safety Study a different scenario involving loss of all three main heat transport loops and operation of the DHRS is mentioned. In this scenario the initiator is a normal shutdown with one heat transport loop unavailable.
The frequency of this initiator is assumed to be 2.0/ year. Then. failure of a second loop is postulated to.be pnssible with probability 0.05 and the third loop at 0.1, leading to a complete -loss of all three loops with a.
frequency of 10-2 (CRBR Safety Study (5), Appendix II, page 37).
i Tne accident delineation _ study (2) also identifies the loss of all f three heat transport loops as an initiator based on a common-cause rupture of all'three rupture disks. Once these rupture disks have failed the sodium.
[
3 se w
)
)
in the evaporators or the superheaters is dumped to a dump tank and the evaporator or the superheater is inerted to avoid any further sodium-water reaction. The probability of occurrence of this event is given as 2x10-2(9). Thus it seems that there is a range of values for this initia-
) tor. Based on the last value suggested in the accident delineation study the probability of core melt due to loss of all three main heat transport loops and loss of the DHRS is 1.6x10-4 The probability of this sequence is rather large and as will be shown later could be the dominant accident g sequence leading to a COA. On the other extreme if the probability of loss of all three main heat transport loops is taken to be 3.4x10-5 from the CRBR Safety Study, the probability of core melt is 2.7x10-7 which is a rather small value and will not contribute much to the overall probability of core melt.
)
To determine the importance of accident sequences involving DHRS that could lead to a CDA, a list of other dominant accident sequences with their associated probabilities are -shown in Table 3-4 (2). These sequences
) are protected accident sequences where after initiation of the accident for any reason the reactor is successfully shut down. However, the shutdown heat removal system (SHRS) is f ailed and core melt is inevitable if the f ailure of SHRS persists for a long period of time. As'was discussed
) earlier in the section on accident initiators, the estimated probabilities of both sequences 2 and 3 in Table 3-4 are very conservative and their actual frequency is most probably much smaller than the numbers indicated in the table. Comparison among these sequences show that if the DHRS sequence is based on the high initiator frequency of 2x10-2 it clearly. dominates the
)
overall core melt probability. Otherwise, if the low initiator frequency of 3.4x10-5 is used, the core melt frequency of the sequence involving DHRS is not an important contributor.
) Thus the importance of the reliability of the DHRS as a mitigating system clearly depends on the correct estimate of the frequency of complete loss of all three main heat transport loops. It is expected that.the applicant will provide their estimate of this number based on their best
) judgment in the near future. At that point a more meaningful discussion of the issues related to the reliability of the DHRS can be provided.
) 3-18
Table 3-4 . Dominant Accident Sequences Involving Loss of SHRS (CDA Inevitable)
Accident Sequence Estimated Frequency
- 1. Feedwater valve faults, isolation, control 4.5x10-s or drain valves (frequency 1.5/ year),
successful detection and scram but failure of SHRS.
- 2. Loss of flow in 3 pumps (frequency 10-2/yr), 2.0x10-5 successful detection and scram but failure of SHRS.
- 3. Loss of offsite power (frequency 0.1/yr), 1.8x10-s successful detection and scram but failure of SHRS.
- 4. Loss of all three main heat transport loops 2.7x10 1.6x10-"
(frequency 3.4x10-5/yr - 2.0x10-2/yr), suc-cessful detection and scram but failure of SHRS.
3-19
3.5 Suggestions for Improvement in the Reliability of the DHRS As was discussed in the last section, the importance of the DHRS as a mitigating system is strongly dependent on the frequency of loss of all three main heat transport loops such that DHRS would be required to remove decay heat. Currently there is much uncertainty regarding this value.
Irrespective of the probability of the initiator, there are ways to improve the : eliability of the DHRS so that even if the probability of loss of all three main heat transport loops is high the overall core melt sequence probability would be small. This is because the DHRS, as currently designed, is vulnerable to a number of " single features."
The first suggestion, which is based on the existing configuration of the DHRS with minimum change of valves and piping, is to make the system redundant. This can be done by incorporating the following changes:
- a. Make the makeup pumps completely redundant by using i
, full-capacity pumps.
- b. Add an SOV on the primary side parallel to S0V 103 so that failure of one SOV to open on demand does not faii i the system
- c. Make the secondary side completely redundant by increasing the heat removal capability of each airblast heat exchanger and its associated NaK pump so that the two loops are redundant.
These changes not only will result in the redundancy of the primary and secondary side of the DHRS but also has the effect of making the emergency I
power supply redundant. This is due to the fact that in case of loss of offsite power at the present configuration one makeup pump, airblast heat exchanger and NaK pump receive AC power from one diesel generator and the other makeup pump, airblast . heat exchanger and NaK pump from the other i diesel generator. In case.of ' loss of one diesel during the initial period of.the DHRS operation where two. loop operation is required the system cannot-I 3-20 u _
perform its heat removal function. If the system is changed to a completely redundant configuration then loss of one diesel will not disable the system.
If these recommendations were implemented the probability of I f ailure of the DHRS would be reduced from 8.1x10-3 to about 2.5x10-5 plus contributions from operator error and test / maintenance outages. If the operator error is assumed to be 10-4 as previously discussed, and if techni-cal specifications effectively preclude dominant test / maintenance contribu- I
- t. tiont, the probability of failing of the DHRS would be reduced to about 1.25x10-4 which is a reduction of more than an order of magnitude. Based on this the highest probability core melt frequency could be reduced from 1.6 x10-4 to perhaps 2.5x10-6, It should be noted that introduction of the suggested redundancy results in reduction of hardware f ailure probability from 8.0x10-3 to 2.5 x10-5 In this case the operator error of 10-4 clearly dominates the total DHRS failure probability of 1.25x10-4 If it is evident that further i
reduction in the failure probability of the DHRS is desired and the-limiting factor is the operator error some investigation into the possibility of an automatic actuation system might be desirable.
) Another way to improve the reliability of the DHRS would be to change the valve configuration such that a single valve failure cannot disable the system. As was mentioned earlier, the major contributors to the failure of the DHRS are failure of one' valve on the primary side or any one
)
of six valves on the secondary side to change state.upon actuation of the system. If.the valve configuration is changed so that no single valve failure can disable the system, all the single element' minimal cut sets can be eliminated. Moreover, a modified configuration would make it easier to maintain tha system without unduly increasing system unavailability. In I
fact, with the system subject to so many single failures, it may be impossible to allow maintenance of components while the reactor is at power and still stay within acceptable unavailability bounds.
k Overall it is clear from the above discussion that -if it is determined that a 'more reliable DHRS.is necessary there are several ways to .
3-21
make the system so reliable that even with the assumption of a high probability for the loss of all three main heat transport loops, the contribution to the core melt frequency from the dominant sequence involving DHRS would be very small.
3.6 Summary and Conclusions An assessment of the reliability of the Direct Heat Removal l Service (DhRS) was performed, It was estimated that the probability of l failure of the DHRS is 8.0x10-3 plus the probability of operator error plus l the probability of the system being unavailable due to a test or maintenance outage. Based on the f act that there would be a reasonably long period of time available for the operator to initiate the system or recover from any errors, a low operator error probability of 10-4 was judged to be likely.
Assuming the test and maintenance contribution is small, this results in a total probability of f ailure of DHRS of about 8.1x10-3 If either or both of the operator error and test / maintenance contributions were increased to 10-2 or above, this value would dominate the overall DHRS f ailure probability.
The contribution of the failure of the AC power to the failure of DHRS was shown to be small primarily due to the f act that simultaneous failure of all three main heat transport loops with a consequent demand for the operation of DHRS and loss of offsite power is a low probability event.
Based on this it is concluded that addition of a separate diverse source of AC power exclusively for DHRS would not have much effect on the probability of core melt. -
The dominant accident sequence involving DHRS that could lead to a possible core disruptive accident consists of loss of all three main heat transport loops and f ailure of the DHRS on demand. Currently there is a considerable amount of uncertainty in the probability of this initiator probability. The values quoted in two reports range from 3.4x10-5/yr to 2x10-2/yr. This leads to a core melt frequency of 2.7x10-7 to 1.6x10-4 With respect to the contribution of this sequence to the overall core. melt frequency it was shown that the higher probability of 1.6x10-4 would make -
3-22
.h I.
1
. this the dominant accident. sequence leading to core melt whereas with the f lower probability ~of 2.7x10-7, the sequence would not have much effect on f
the overall core melt frequency.
It i s concluded that a decision on the adequacy of.DHRS .l 4
reliability should be deferred until the probability of loss of all.three l main heat transport loops can be estimated with greater confidence.
Despite the above uncertainty, two alternatives for improvement of l the reliability of the DHRS were suggested. In the first case it.was'
[ suggested that both the primary and secondary sides of the DHRS should be j made redundant. This redundancy can be incorporated in ' the present design
! by increasing the capacity of the makeup pumps, NaK pumps and airblast heat j, exchangers so that they become redundant.and addition of one more SOV to the l primary system parallel to the SOV 103. The effect of this change would be i a reduction in the estimated DHRS f ailure probability from 8.1x10-3 to
- 1.25x10-4 This results in the reduction of the core melt. frequency of the high probability sequence from 1.6x10-4 to 2.5x10-6, The overall conclusions from this . discussion are that DHRS is an important accident mitigating system. The'excct contribution of failure of DHRS to the overall core melt frequency' depends on a realistic probability ,
for the loss of all three main heat transport systems. Thus any judgment on -
j the adequacy' of the present system is also dependent ,on the above probability, current estimates of which are very uncertain. ' Irrespective of this uncertainty there are several ways that the reliability.of the.' DHRS can j be increased to the point where even if the probability of;1oss.of all three~ ,
main heat transport loops were high, the contribution:of this core melt
~
sequence to the' total core melt frequency.would be'small.
.s .
3-23 -
% . ~> -m- . s. A - -. . - - c w + ,_ r ..m., ,, .-ew,e ,- -
)
4.0 : Containment Systems I 4.1 Introduction In this section issues related to the possible need and overall benefits of an ex-vessel core retention device, more commonly known as a
" core catcher," are discussed. The concern about possible need for an ex-.
vessel core retention device stems from the fact that in the unlikely event of a core disruptive accident (CDA) followed by a vessel and guard-vessel melt-through a large scale interaction between sodium, molten fuel, steel
)_
and concrete would result. The decay heat generated by the molten fuel and hot sodium will result in the release of a considerable amounts of moisture and carbon dioxide from concrete. Assuming the thin steel liner covering the cavity floor fails upon contact with the.large amount of sodium and core debris, sodium will next interact with the released moisture and carbon dioxide generating substantial amounts of hydrogen and aerosols. The hydro-gen, aerosols and sodium vapor will be transported to the noninerted upper reactor containment atmosphere by the pressure differential between the reactor cavity and upper containment where both hydrogen and sodium vapor
) will burn generating heat and pressure in the' upper reactor containment atmosphere. As will be shown in greater detail later on, the limiting factor threatening the integrity of the containment is production and accumulation of hydrogen in the upper reactor containment. In the early
)- stages of the accident the hydrogen produced as a result of sodium water vapor interaction will burn nearly continuously in the upper containment atmosphere. Eventually the quantity of the oxygen in the containment _ atmos-phere falls below the levels necessary for burning of the hydrogen and the hydrogen concentration increases rapidly. To . avoid buildup of hydrogen in
)
the containment atmosphere to the detonation _ levels, current procedures for-CRBRP calls for. upper reactor containment venting and purging once the..
concentration of hydrogen has reached 6%. By venting and purging ~ the con-tainment atmosphere the containment pressure is reduced and substantial smounts of. air are introduced to.the containment. Addition of- air to the
'~
) .-
containment atmosphere will dilute the hydrogen and introduce suf.ficient oxygen to the atmosphere. so that hydrogen can burn in a controlled manner.
L m
1__ . _ . _ .
),
Currently there are some general criteria set for the CRBR containment design' acceptability; these are:
- 1. The.public risk from beyond design basis accidents in CRBR should be comparable to those of light water reactors.
}- 2. Following a core. meltdown accident the containment integrity must be maintained for a'sufficiently long period of time without venting so that any evacuation. plan can be implemented.
Thus the main issue related to the decision concerning the need
)
for a core catcher is whether analysis of the current design, including uncertainties in various phenomenologies involved, shows that following a core meltdown and guard vessel penetration there is' sufficient time for the evacuation of the surrounding area before any venting is initiated. Also
) included in this issue is the reliability of the containment venting cleanup system since if the time for venting is close to the evacuation time then it is absolutely necessary for the cleanup system to perform its function as required with a high degree of certainly. Even if addition of a core
) catcher seems to be desirable due to uncertainties in the calculation of the phenomenologies involved, relative benefits of a core catcher ' compared to other design modifications such as an . increase in the overall reliability of the shutdown heat removal . system must be evaluated.
).
As will be discussed in Section 4.3, there are many parameters that influence the analysis of the consequences of a vessel, guard vessel melt-through scenario. Among these the assumed rate of sodium concrete interaction is the most important parameter. This is due to the fact that
) the rate of sodium concrete interaction determines the rate and amount of water vapor release from.the concrete and consequently the rate of hydrogen production. Currently there is some disagreement on this issue ~ based on.
experimental observations at the Hanford Engineering Development Laboratory.
)c (HEDL) and Sandia National Laboratory. The uncertainty in-the rate of-
,- sodium concrete interaction-is one of the main reasons for the difficulty in
. assessment ofLissues related to the need for. an ex-vessel core retention device and will .b'e discussed in . great! detail _ .later 'on.
y-
) 4-2.
~ ,e ,w -----p-,r- - , - ~ -
i l
)
In the next section a brief description of the reactor containment and various engineered safety features incorporated in the design of the
) cavity, heat transport cells and upper reactor containment to deal with the consequences of a core meltdown accident will be provided. Section 4.3 consists of a review of the applicants base case analysis. The objective here is to point out all the important sequences of events and various D assumptions used to perform the calculations. The uncertainties in various parameters having major influence on the outcome of these analyses will also be discussed in this section. Section 4.4 deals with the applicant's extreme penetration and other beyond base case analyses. Issues related to 3 the uncertainties in the sodium concrete interaction and its influence on the outcome of the containment response to a CDA will also be discussed. A brief description of the various active and passive ex-vessel core retention devices are provided in Settion 4.5. In Section 4.6 the effect of addition of a core catcher to the mean frequency of the radioactive release will be discussed. Another alternative, namely, a more reliable shutdown heat removal system, and its effect on the overall frequency of radioactive release following a CDA will also be analyzed. The objective here is to show the comparative benefits of addition a of core catcher in reducing the D overall risk compared to other alternative changes in the design of various mitigating systems. Finally the results of the study are summarized in Section 4.7 and general conclusions and recommendations are presented.
D D
D D
O 4-3
1
}
4.2 Containment / Confinement System Description l
The containment / confinement system including the isolation system is designed to withstand the consequences of a design basis accident with no '
release of radioactivity to the' environment beyond the low permissible leakage rates (6). ;
)
The containment vessel .is a cylindrical structure 1.4 inches thick with an inner diameter of 186 feet. The structure is dome shaped at the top -
I with the lower part up to the operating floor embedded in concrete. Figure
) 4-1. shows a simplified drawing of the containment / confinement system. The operating floor is 816 feet above the ground floor. The top of the dome is approximately 159 feet .above the operating floor. Below the operating ;
floor, there are several concrete cells housing the reactor vessel and guard l vessel nearly at the center of the containment in the reactor cavity, the ;
). three primary heat transport system (PHTS) loops, sodium cold traps, sodium j storage tank and other support systems. The reactor cavity roof including .
the vessel head is an integral part of the operating floor. The inner cell's atmosphere is inerted using nitrogen gas with a small and controlled
) amount of oxygen content. Inclusion of a small quantity of oxygen is designed to prevent nitriding of the high temperature piping. Inerting of the various cell's atmospheres will. help in preventing sodium fires in case !
of a sodium spill. The atmosphere of the inerted cells is continuously
) cooled by the Recirculating Gas Cooling System. The cell atmosphere control system monitors the rate of leakage into and out of the cells. If the rate of leakage or introduction of oxygen to the' cell is above specified limits the cell or the plant-will be shutdown.-
) The inner surf aces of the cells are lined by a steel plate to prevent interaction of sodium- and concrete' in case of a sodium spill. The lining system consists of a 3/8 inch carbon steel plate, a 3.8 inch thick insulating concrete panel to protect the structural concrete from-high <
) temperatures in case of al sodium spill, steel anchors or_ embedded structural sections' welded to the liner and a 1/4 inch' thick ' air gap between the liner
- . and the insulating concrete to provide a continuous venting for relief of' any gas pressure such as ' steam pressure that might ~ be produced .as a result-
[
) of a sodium spill-and generation of heat. The vent system is designed to be
, capable of limiting pressure buildup ini excess of,5.psig.- The steam-
- 4-4' t
l4 Y s-
, ,, ,- w n a ., -,en ,-~e-~s s , .c ww ,-- --
M E
T S
Y
, S T
N C *
" - E V
R
>
- E M N E I L
T l S Y Y T S I M
VE E AT l N G CS G w
O I
T A
T N
R U
P R Y O S T T CN AE Jc,Ei RD BL N
I I
T R U E
M N
E EV R v CB E T
_ U R
V T G r HN T
S N E
N I
T y _ % j/ i TE w
N I M N
I A
T A
R E
O I V AN Cl .
A MO 3 C EC
, R H/
L w O CT T
C SN E A
E R
DE M
@ I N FI L A I _
1 P T MN w
[l I O N g 'y' SC l
1 4
w e A r u
g i
F GM I E W T OS OY
^C S T E M
NT ES MY NS W
I A U P T
NN OA CLE C
W a'
. generated during a large sodium spill will be vented to non-inerted areas of the reactor containment, namely Cell 105, below the operating floor except for the space below the cavity floor which is directly vented to the upper containment building. Since hydrogen production can only occur. as a result of sodium-water reactions, no hydrogen production is expecttd unless the cell liner is f ailed and sodium attacks the concerete. The space between ,
) the reactor liner and the concrete-has been divided into four zones by horizontal baffles. These zones include three along the vertical walls and ,
one which includes the cavity floor and corners. This feature has been provided so that in case of a sodium spill and water vapor production no j propogation can occur from one zone to another.
Following a CDA and guard vessel penetration the cavity floor liner is expected to fail rapidly upon contact with molten fuel, structural material and sodium. At this point large quantities of water vapor and other gases will result in generation of hydrogen and other aerosols. To i
prevent the reactor cavity from failure due to overpressurization a system of redundant flow paths is provided for the venting of gases frora the reactor cavity to the upper reactor containment. This system consists
) of venting the gases from the reactor cavity to the primary heat transport cells and to the upper containment atmosphere through redundant rupture disks which provide venting upon a pressure. differential-of 11.5 psig between the reactor cavity and upper containment atmosphere (10).
)
The volume of the containment building is approximately 3.6x106 '
cubic feet above the operating floor and 1.4'x106 cubic feet below-the operating floor. The reactor containment building is designed so that'at
)
the design pressure and temperature of 10 psig and 2600F the maximum leakage rate would not exceed 0.1% of the containment volume per day. The ..
confinement building above the operating floor is' a concrete structure 4 feet thick (3 feet thick dome) with about 6-feet of space between the steel containment and concrete' confinement structure above the operating floor. : A -
)
negative pressure is maintained in the space betwe'en the containment!and confinerdent to reduce any possibility of leakage..
Based on the analysis of the design basis accident, the~re are no -
) requirements for containment heat removal' or containment atmosphere cleanup W *
- 4' '
, ya + w , --+ - . - - , > y % wy 9
systems. Containment venting and purging including a cleanup system is provided for the beyond design basis accidents.
The containment isolation system is designed to provide for the automatic required isolation of the containment in case of an accident and prevention of the leakage of radioactive material to the outside atmosphere.
All the lines directly penetrating the containment aimosphere with the exception of the intermediate heat transport system (IHTS) lines, include two isolation valves; one inside the containment, and one outside the con-tainment. All the valves are designed so that they can be tested for leakage and will be in the closed position upon loss of air or electric power. Manual actuation for all the isolation valves is also provided. Due to the time lag involved in pressure and temperature buildup in the contain-ment in case of an accident, radiation monitors are primarily relied upon as the source for initiation of containment isolation.
The annulus filtration system is designed to minimize leakage of radioactive material to the outside atmosphere. The functions of this system include maintenance of the annulus at a negative pressure and filter-ing the annulus exhaust during normal and accident conditions. Two completely redundant filter-f an units are provided for this purpose. The system is designed to filter 180,000 CFM of air of which 1700 CFM is exhausted and the rest is circulated through the ducts. During a beyond i
design basis accident annulus cooling and cleanup systems are not operating until venting and purging are initiated.
4-7
3-4.3 Reactor Cavity and Containment Response to a Vessel / Guard Vessel Melthrough i
- j. In this section the base case analysis performed by the applicant l' on the response of the cavity and upper reactor containment building to a j vessel / guard vessel melt-through will be discussed. The objective of this
- O review is to point out the major sequence of events and assumptions used in l l the analysis of reactor cavity and containment response to a core melt down )
{ accident. It is important to note that although the consequences of a guard-
{ vessel melt-through is strongly dependent on the assumed rate of-sodium con-o crete interaction, the sequence of events is f airly similar and only the i time of occurrence of various events changes from one scenario to another.
l The applicant's analysis of cavity and upper containment response
- to a vessel melt-through is presented in their assessment of thermal margin l
beyond the design base (10).
I l The starting point of the analysis is a core disruptive accident- ,
(CDA) that has propagated to a whole core accident. In the analysis it is lO
. assumed the core debris and sodium will penetrate the vessel and guard l vessel in approximately 1000 seconds. The applicants sensitivity analysis j has shown that changes in the holdup time from 100. seconds to 10,000 seconds l does not have much effect on containment response to the accident. Another
'O- study has shown that guard vessel penetration time greater than 1000 seconds
- . could have significant'effect on the outcome of the accident (11). The
! reason for this discrepancy is not clear at this . point. After the vessel-guard vessel melt-through, all the core and blankets plus approximately I 1.1x106 pounds of sodium with an average temperature of about.9900F is O
i assumed to enter the reactor cavity. The core-structural material mixture
- is expected to have temperatures. close~ to the melting point of steel, i.e.,
j approximately. 25800F. Applicant's analysis indicates that a coolable debris i
bed.with an average depth of approximately 1.5 inches will be formed on the -
cavity floor. IFor the expected particle size of the core debris the 'dryout
. debris bed depth ~where cooling is no longer-possible is calculated to be i approximately.5.3 inches. Thus fuel is .not expected to be in a molten state j 'and. no significant~ fuel-concrete interaction is expected in early: stages of-- ;
O. Lthe accident. After fuel debris and .sodiumL contact the cavity floor liner ' l it .is assumed that the liner will f a111very ' rapidly. The applicant 1 q
- O .4-8 A
indicates that t'his assumption is quite conservative sino studies have shown that the most probable failure mechanism for the liner is a localized f ailure of the liner which reduces the exposure surf ace of concrete to sodium and fuel debris (12). At this point the sodium will start interact-ing with concrete. The basic mechanism of sodium-concrete interaction is based on interaction of sodium and the water vapor released from the con-
> crete due to the heat of fuel debris and sodium. The water content of the concrete can be divided into evaporable water and chemically bound water.
The evaporable water, which is about 50% of the total water, will be released at a very high rate once the concrete temperature is above 1000C.
p_ The chemically bound water is released more gradually over a range of temperature from 2000C to about 8000C. Both the evaporable and chemically bound water can be released from deep within the concrete by migrating to the surface of the concrete due to pressure driven flow. The interaction of sodium and water vapor released from concrete occurs in two ways (13):
2Na + H2O : Na20 + H2 Na +HO 2 Na0H + 1/2H2 D Between the two reactions shown above the second one is expected to dominate in cases where excess sodium exist. Both of the above reactions are exothermic and result in generation of a substantial amount of heat. Also as can be seen hydrogen is also produced in the above reactions which when p vented out to the upper reactor containment can burn in the non-inerted upper reactor containment. Sodium will also react with limestone aggregate which consists of calcite (CACO 3) and dolomite (MgCa(C03 )2) according to y 4Na + 3 CACO 3 2 2Na2CO3 + Ca0 + C 4Na + 3MgC03 2Na2003 + Mg0 + C Experimental results have shown the above sodium solid reactions are temperature dependent and do not occur at an appreciable rate if concrete D temperature is below a threshold temperature of 500-6000C. At higher temperatures calcite and dolomite disintegrate and generate C02 which will react with sodium and sodium oxide:
Na20 + C02 : Na2C03 D 4Na + CO2 2Na20+C 4Na + 3C02 2Na2CO3+C i
D- 49 l
i 4
5 As was mentioned earlier in the introductory section, one of the most impor . i i tant parameters effecting the containment response to a vessel melt-through !
is the rate of sodium concrete interaction. This is due to the f act that j this interaction is the main fact'or determining the rate and total amount of j- water vapor and CO2 release from concrete. Consequently.the rate and total
- . production of hydrogen depends on the sodium-concrete interaction.
Currently there is some discrepancy between the experimental results j- observed at HEDL and Sandia National Laboratory. The applicants analysis of l containment response to the vessel melt-through is based on a sodium pene-l tration rate of 1/2 inch / hour for-four hours. This assumption was based on i the earlier experimental observations at HEDL (14,15,16). Some recent l experiments at Sandia National Laboratory have shown a much higher rate of j sodium concrete reaction. For example reaction rates of 8.4, 9.1 and 15 l centimeters were observed in reaction times of 25, 60 and 195 minutes (17, 18,19). These results correspond to reaction rates of 7.9"/hr, 3.5"/hr and l
! 1.8"/hr. Note that all the above experiments were sodium limited, i.e., the !
- experiments were terminated due to consumption of all the sodium. Thus it l is not clear whether such rates would have been sustained for a long period I of time. Also several experiments in the same series of tests showed quite
- benign reaction rates with very small total penetrations. Currently a
! series of tests is being conducted at HEDL and Sandia National Laboratory in
[ an attempt to resolve the differences between the previous experimental i results(20). Preliminary results of the HEDL experiments are available and will be discussed in the next section.
f ,
l j At this point all the ground rules used by the applicant for the .
{ analysis of the base case, i.e., a sodium concrete reaction rate of 0.5"/hr
! for four hours have been described. The calculation of reactor cavity and j' upper containment building response to the vessel / guard vessel melt-through-
- has been performed by the computer; code CACECO (21). This code calculates
- mass and energy balance between various cell representing different parts of ~ .
( th'e containment. ~In the applicants analysis the containment was divided <
into four. cells representing reactor' cavity,: pipeway . cells, upper contain
~
!' ment ' atmosphere _ above the operating floor and non-inerted atmosphere below
.the operating floor (cell -105).
~
A e
4 The analysis ~ of the accident shows that' the reactor ' cavity and pipeway- cells - will ~ pressurize rapidly beyond ; the set point L of the ruptuce
~4-10L -
c .
,4 o y ._w,, .-._w.. . , - - . . , .- , - - , - . , . . , , < - - , ,, , , , , . . . ,,, .
1 i
4
^
- . disks so an interconnection between cavity and upper containment atmosphere j is established very soon after vessel melt-through. The maximum reactor j cavity pressure of 29 psig.is calcula'ted a very short time after vessel j penetration based on instantaneous consumption of the 2% oxygen available in the-cavity. The cavity temperature at the time of this transient is 12400F.
I This pressure. drops rapidly to less than 4 psig as soon as the rupture disks
[ connecting the cavity and the upper containment building open.' But the j cavity temperature increases due to the decay heat and various reactions j between sodium and water vapor and other gases released from the concrete.
Sodium boiling is expected in about 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> after the guard vessel penetra-tion. Hydrogen build up and oxygen depletion in the upper containment as a function of time is shown in Figure 4-2. As can be seen from the figure i j hydrogen concentration in the upper containment atmosphere increases to f about 4.5% in 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> at which time the hydrogen will burn and create a j pressure spike in the upper containment. This spike increase-the contain-
!' ment pressure to about 22 psig before falling down to about 4 psig. From 10 4
)' hours after guard vessel penetration where hydrogen burns to 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after guard vessel penetration hydrogen burns continuously and no accumulation of l hydrogen is observed. The oxygen concentration in the upper containment
! atmosphere continuously decreases from the initial concentration of about l 22% to a concentration below 3% at about 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. At this point the upper f containment atmosphere is oxygen starved and hydrogen cannot burn anymore.
{ This results in 'a rapid buildup of hydrogen. The applicant's current post '
j core meltdown procedures call for containment venting and purging as soon as i
hydrogen concentration has reached 6%. This is done so that no hydrogen l accumulation close to detonation levels would be. reached. By : venting and
[ purging the containment ;the containment pressure is. -lowered to the ,
! atmosphere pressure and sufficient air is introduced into the- containment
} atmosphere so that hydrogen is diluted and oxygen concentration.is increased ,
f and control' led hydrogen burn can continue. ' At the same time the annulus
, cooling systems is started so that heat from the steel' containment and annu,1us atmosphere' can be removed.
i At' the time of venting and~~ purging the . average containment
+
? atmosphere's temperature is . about - 5400F. Average steel- dome' temperature is -
i
~380oFf and the maximum steel ~ dome temperature' is. 640oF. Applicants Lanalysis has'shown that the containment's capability:at this' temperature is about 36-l psig whereas containment pressure at the. time.of venting and purging is' t ,
d :4-11) _
+ .
)
)
am a - a sus a mas a HYDROGEN _
-20 3 g_
PURGE
-18 8-
) -
E y
-16 z 7- 6 O z g -14 g 5 6- g
) z g -12 r
z z o o 5- z z -10 o w
- z
) 4- a sg * .#* E
- *# g* #p . , ~*
- E E I *
%,/
- - 1, I 3- ll l
g I -6 3
2-Il t- *4
,i
-4 i .!
s.-
.i I .
3 1- fl l -2
.l l' l 0' 8
. . . . . O O 20 40 60 80 100 120 140 TIME (HOURS) i 1
)
Figure 4-2. OXYGEN AND HYDROGEN CONCENTRATIONS AS A FUNCTION OF j TIME OF 1rf E BASE CASE (0.5"/HR FOR 4 HOURS) 4-12
- ]
I about 18 psig. Thus it is clear that 'the limiting factor forcing contain-ment venting and purgir J is the hydrogen buildup. After venting and purging 4
containment's temperature goes through a spike due to decrease in the con-tainments pressure and increase in boil off. This results in a containment temperature increase to 6500F before reduction in temperature due to-operation of the annulus cooling system. From here on containments pressure I will be close to atmospheric pressure.
Sodium in the cavity is eventually expected to completely boil dry in about 130 hours0.0015 days <br />0.0361 hours <br />2.149471e-4 weeks <br />4.9465e-5 months <br />. At this point molten steel and fuel will react with the y
concrete and-moisture and C02 will be released from the concrete. Most of the reaction is between steel and water vapor and CO2 released from the concrete. The amount of various gases produced including hydrogen will not impose any large pressures on the containment integrity. The effect of the remaining decay heat on the cavity structure is strongly dependent on the t
)
thermal resistance of the crust where molten steel and fuel is in contact. i Consequently the higner the rate of heat transfer upward from molten steel and fuel, the higher is the thermal load on cavity structure. Several cases where analyzed by the applicant. If the upward heat transfer is in the order of 5-15% of the total decay heat no cavity structural failure is expected. If the upward heat transfer is in the order of 40-55% the reactor-cavity wall and reactor vessel head is expected to fail in 600 hours0.00694 days <br />0.167 hours <br />9.920635e-4 weeks <br />2.283e-4 months <br />.after guard vessel penetratiori. Finally, if upward heat transfer is in the range of 80-90% the cavity wall and reactor vessel heat is expected to fail irs 400 hours0.00463 days <br />0.111 hours <br />6.613757e-4 weeks <br />1.522e-4 months <br /> after guard vessel penetration. The maximum fuel penetration in the:
concrete is calculated to be about 20 feet. The remaining unmelted con-crete, which is about 6 feet, is expected to be cracked and weakened. - The containment pressure after boil dry is essentially-atmospheric and no threat.
to the integrity of the containment or confinement is expected.-
~
l l
l l
.I 4
13- '
4.4 Sodium Concrete Interaction Issues and Containment Response to
- Beyond Base Case Accident Scenarios In this section a brief-discussion of the various sodium concrete interaction experiments performed at HEDL -and Sandia National Laboratory will be presented. The~ objective of this brief discussion is to see if it is possible to deduce a reasonable range of sodium concrete interaction rates from the widely dispersed experimental data which is pertinent to the time scale of interest to post core melt accident analyses. This will be followed by a discussion of two beyond base case analyses of containment response to a guard vessel melt-through where the rate.of sodium concrete interaction is substantially higher than the base case described in the last section. The overall goal of the discussien presented in this section is to see, considering various experimental results on sodium concrete interaction rates, i'
- a. The base analysis is conservative enough to be acceptable as the realistic containment response to a guard vessel melt-through
- accident? and
- b. The two beyond base case analyses, namely the extreme penetration case and th'e molten fuel concrete interaction case, are bounding' cases, i.e., do they represent the upper-limit in severity of possible. sodium penetration into the concrete. Furthermore it is extremely important to determine whether these assumed sodium
! penetration rates into the concrete are based on any observed j experimental results and if so should they be Gnu as the base case for licensing analysis of containment response to a core meltdown accident?
All the available experimental results on sodium concrete reaction have been summarized-in two recent reports (22,23). Some general trends
~were observed from various experiments. These include:
- a. Sodium solid (aggregate) reaction. is temperature dependent and there seems to be a threshold temperature of 500 to 6000C below which no large scale sodium-concrete interaction will occur.
4-14
l s
- b. Interaction of Isodium and water vapor released 'from concrete is the dominant energy producing reaction,
- c. Spalling and cracking of the surface of concrete seems to increase !
the rate 'of sodium concrete interaction for short times before .
reaction product buildup limit the sodium penetration rate.
)
- d. Sodium penetration into concrete has been limited in most observed cases by buildup of a layer of reaction products, f Figure 4-3 shows the results .of various sodium concrete interac-tion experiments (24). Note that the results of the latest HEDL experiments such as SET-14, LCT-13 are also shown on this figure. The most reactive j Sandia experiments mentioned earlier are experiments LS-1, LS-2 and LS-3 <
which were performed for short periods of time due to sodium limitation.
) Note also that experiments LS-4, LS-5 and LS-8, which are part, of the same series of experiments as LS-1 through LS-3, show very small. reaction rates and penetration. The highest total penetration ~ of sodium in concrete was observed in the SET-14 experiment. In this experiment a total penetration-
)- of approximately 13 inches was observed in about 90' hours. The LCT-2 experiment shown next to SET-14 was based on interaction ~of sodium and dehydrated concrete. It is also interesting to note that for all the exp'eriments that have been carried out in the range of 20 to 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> the
>- maximum penetration'is less than~ 5 inches. Figure 4 4 shows the sodium penetration into concrete as a function of time for experiments SET-14, LCT-1 and LCT-12 which have shown the highest total penetration of sodium in:
concrete. ' Also shown on the figure is the assumed penetration rate for the base case (0.5 inches per hour.for four hours) and an extreme-penetration.
case which 'the applicant has analyzed. The extreme _ penetration case:is; based on a sooium penetration rate.of-seven inches per hour.for.three hours ,
and one inch per hour from three hours on. It is .very interesting -to note i where this extreme penetration rate comes' from. _ Until_ recently:NRC's posi- l
-tion on containment response to a core melt down accident has been that-1
~ following a CDA 'and. guard . vessel penetration,s the containment- integrity must - _
be maintained for a period of 24-hours without venting'so_ that-sufficientJ .
time. would exist for;implementction of.-any evacuation. The ~ applicant .has
~
l 1 - analyzed the extreme penetration case as an upper bound case where if the: )
requirement for time of veni!ing is-relaxed to 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> then a total!of'28
~
l
~~
~ 4-15. ,
^
- - ~ _ _ _ _ _ _ ~- -
SODIUM-LIMESTONE CONCRETE REACTION PENETRATION
SUMMARY
PENETRATION (INCHES) 14 13 SET-14 00 LCT-2 e HEDL AVERAGE PENETRATION 12 - A SANDIA MAXIMUM PENETRATION A SANDIA MAXIMUM PENETRATION-11 -
SODIUM LIMITED 10 -
9 -
~
LCT-1 0 7 -
6 - 1.8"/Hr. A LS-3 LCT-12 0 j
5 -
l 4 - 3.5"/Hr. A LS-2 CDC-10 LCT-130 3 - - 7.9"/Hr. A LS-1 SC-4 LS-9
, e LFT-6 O SC-14 LSC-2 SC-8 SC-13 LS-8 -9:
l ~ SET-12 LS-4 -18 SC-18 LFT-4 LS-6 g 0 ' ' ' ' ' ' ' ' b ' L S.'A A iail An i e e i 0.1 1.0 10 100 l
TIME AT TEMPERATURE (HOURS)
Figure 4-3. Penetration vs. Tir.a for Various Sodium Limestone Concrete Experiments.
e es me se
e- <- - - - s - - - .- - ,
26-24-22-20- I S ET-14 EXTREME PENETRATION CASE 8 LCT-12 18- O LCT-1 h
x
--- BASE CASE' o 16-E.
z o 14-
.p.
m
.L w-hi 12- X z
E SLOPE IS 0.6"/HR I 10-
/ D s-
/
3 6
g* A s- -=
3
, 4- )
2-f
/
s'X 0 1'O 2'O 3'O 4'O 5'O 6'O YO 8O 9'O 100 i
TIME (HOURS)
Figure 4-4. VARIOUS PENETRATION MATES AS A. FUNCTION OF TIME
__ --_____________o
inches of sodium penetration in concrete can be accommodated without con-tainment failure. This total penetration can be found by looking at Figure 4-5 which shows the time to vent vs. total concrete penetration (24). Thus if it is assumed that a venting time of 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> is acceptable the total penetration which can be accommodated is 28 inches. The extreme penetration rate of 7 inches per hour for three hours and one inch per hour from there I on results in a total penetration of 28 inches in 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />. Also the initial rate of 7 inches per hour corresponds to the most reactive dANDIA experiment LS-1 (Figure 4-3) which was performed for approximately 20 minutes. Thus it is extremely important to realize that the extreme pene-l' tration case is not based on any observed experimental result and in effect is a backward calculation which shows the total penetration that can be accommodated if a 10 hour1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> venting based on 6% accumulation of hydrogen is assumed. Looking at Figure 4-4, it can be seen that the initial penetration
) rate assumed for the base case it higher than the experimental results shown but the total penetration for the time period of interest, i.e., 20 to 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> is not conservative. Thus it seems that a more realistic base case where the rate and total penetration of sodium is higher than the current base but considerably lower than the extreme penetration case is highly desirable.
In an effort to determine if there are any other molten core /
sodium concrete reaction scenarios that might be more limiting than the
) cases studied, the applicant also analyzed a case where molten core instead of sodium was assumed to penetrate the concrete (25). In this scenario it was assumed that initially sodium will penetrate concrete at a rate of 7 inches per hour (corresponding to the most reactive Sandia experiment, LS-1)
) for about 20 minutes resulting in a total penetration of 2.3 inches. After this it is assumed that molten core is in a noncoolable geometry when it sinks to the bottom of the reaction products and will interact with con-crete. As molten core penetrates concrete, water- vapor and CO2 is released
)
from concrete which will react with sodium as discussed previously. Figure 4-6 shows the concentration of the hydrogan 'and oxygen as a function of time. Note that this figure is very similar to Figure 4-2 for base case as '
f ar as the sequence of events is concerned. Only the timing of'the events is different. In this scenario venting and purging is necessary in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> f compared to 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> for 'the base case and 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> for. the extreme F
4-18 i
,0 4
T
, N E
V O
,3 0 T E
M I
_ T S
S
)
V E N H
C O I
N I T
(
N A
O R I T T E A N 0 R
,2 T E E P N
E E
_ P T E E T R E
R C C N N O O C C
L A
T O
,0 T 1
5-4 e
r u
g i
F 0
0 0 0 0 0 0 5 4 3 2 1 Gca@
e 0Er$>oFmEe y ?=
k . ,
' 'W ~ M v v v v v v v v -v mamassmans OXYGEN 10- -25 HYDROGEN t
-20 -
- 8- 8 m a m a an , % E 6 z z o%* 9 9- g#
PURGE
-15 s 2
6- %*g, Z b #
b i
N-O Z
O %+%,
y
^, #
'p', 2 O
O O
2 4_ %*
- E ,**,same,* , -10 2 m
m r s-s g o%ss. ?
.% x Q *% -
$ *l O
=
2- *g ,I -5
- % .I
\.f I 3 l I I I l l l 0 5 10 15 20 25 30 35 40 45 50 TIME (HOURS)
Figure 4-6. OXYGEN.AND HYDROGEN CONCENTRATIONS AS A FUNCTION OF TIME FOR THE MOLTEN CORE CONCRETE INTERACTION SCENARIO
+
9
)
penetration case. This case is very similar to a case where sodium would penetrate the concrete at a rate of one inch per hour continuously.
So far we have discussed the consequences of a core meltdown based on various molten core or sodium interaction rates with concrete. The applicant's analysis shows that for all these scenarios, i.e., base case,
) molten core concrete interaction and extreme penetration case, if venting and purging is performed as planned, the public would not be exposed to any kind of risk.
)-
These calculations are based on venting and purging at the required time, i.e., when hydrogen concentration has reached 6% and the assumption that the containment cleanup system will perform with an efficiency cf 99% for solid and liquid radioactive material and 97% for vapers. Based on these assumptions the controlled release to the environ-
) ment for the scenarios discussed above are below 10 CFR 100 guidelines. The critical question related to the venting and purging time is that if the containment cleanup system does not perform its function as specified, resulting in dirty venting, then it would be absolutely essential to show
) that evacuation of the area surrounding the reactor site can be performed well before venting time so that even including uncertainties in the evacua-tion time there would be enough time between- the end of evacuation and venting time. Thus the question of the need for a core catcher arises from
) the f act that if there is not sufficient margin between the required time for evacuation and the time of venting then a core catcher can offer the benefit of delaying the venting time by inhibiting sodium concrete interac-tion and production of hydrogen and other aerosols. To assess the extra time available between evacuation and venting a recent study on the required times' for evacuation within 2, 5 and 10 miles of the site was performed (26). There are four levels of emergency depending upon the. extent of the accident, these are:
)' 1. Notification of unusual event
- 2. Alert
- 3. Site area emergency
- 4. ' General emergency
)
> 4-21
k The general emergency is declared if 'a large scale core melt has occurred or is about to= occur. In this case decisions with respect to evacuation must be made. Before an accident progresses to a large scale CDA there are many indicators that could alert the operator about the accident, its seve< ty and progression. Following a CDA and guard vessel penetration the operator will monitor containment conditions. The decision for evacua-
) tion is based on detection of approximately 1% hydrogen in the containment coupled with high containment radiation level (S105 R/hr). The Tennessee Department of Transportation has calculated the estimated times for evacua-tion of population within 2, 5 and 10 miles of the site. The results of
)' this calculation along with the extra time available between evacuation and venting for three accident scenarios is shown in Table 4-1. As can be seen, time to 1% hydrogen accumulation, which corresponds to the time for declara-tion of general emergency if high radiation is also detected in the contain-ment, varies from 1.75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> to 3.75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> after guard vessel penetration.
)
The evacuation times vary from 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for the 2 mile radius to 7.25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br /> for 10 miles radius. Based on these numbers and the time for venting, extra time between evacuation and venting-can be calculated. The results of this calculation shows that for venting times of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or more there seems to
) be sufficient time between venting and the 10 mile zone evacuation even including uncertainties in the evacuation time. But for the extreme pene-tration case the extra time between venting and evacuation is fairly short.
It is crucial at this point to emphasize an earlier point that the extreme-
)_ penetration case is based on assumption of venting in 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> and the penetration rates of sodium into concrete corresponding to this' case is substantially higher than any observed experimental results. Thus the results of the extreme penetration case must be analyzed with this point in mind and no realistic decision can be made based on this hypothetical case.
)
In the next section a brief review'of the various concepts for retention of molten core debris will be presented. This will be followed by an estimate of the benefits of- a core catcher with respect to lowering the probability of radioactive release from containment following a CDA and a-comparison of benefits of core catcher with other alternatives 1such as a more reliable shutdown heat removal system.
)~
)' 4-22
- -= . . . ..
m u . .v .v. .. v v v- :v v v v
~
Table 4-1. Extra Time Between Evacuation.and Venting for Various Accident' Scenarios
-Accident Scenario Time to 1% Time For Venting- Extra Time Between (Sodium Concrete Hydrogen Evacuation Time Evacuation and Venting -
Interaction. Rate) Accudulation .(Hrs)
(Hrs)
Distance From Distance From' Site (miles) Site (miles)-
2 5 10 2 5 10 i
Y ~
-Base' Case' 3.75 4 5.3 7.25 36 28.25 26.95 25
--(0.5"/hrfor4. hours)
Molten Core Concrete- 3.0 4 5.3 7.25 24 17.0' 15.7 13.75
~ Interaction (Equiva.
' lent lto 1"/hr con-
.tinuously).
Extreme Penetration' '1.75 4 5.3 7.25 10 4.25 2.95. 1.0
. Case (7"/hr,for 3
. hours, 1"/hr. con-tinuously afterwards)
__.___mm_..m_______ _ _ _ __ _ _ _ _ _ _ __ _ _ _ _ _ _ _ _ _ __ _ _ . . , w = _ . e--_ _ ______ __________n
i
- 4.5 Review of Various Ex-Vessel Core Retention Devices
)
In this section a brief review of various ex-vessel core retention devices will be presented. The ex-vessel core retention devices commonly .
referred-to as core catchers can be divided into two groups of active core catchers and passive core catchers (27) The active concepts include an
) active heat removal mechanism whereas the passive concepts are essentially a j barrier between sodium, molten core and -the concrete.
The passive designs'can also be divided into sacrificial bed y concepts and stable barrier concepts. In the sacrificial bed concept a thick layer of high melting point material is incorporated in the design of the cavity directly below the reactor vessel. Figure 4-7 shows a typical arrangement of a sacrificial bed concept (27). Note that in this figure an '
active cooling system is also shown .in the bottom and around the sacrificial bed. This active cooling system would not be included in the passive design. The basic idea in choosing the material for a sacrificial bed i
concept is that the material must be soluble.with the fuel so that the heat' source, i.e., molten fuel debris, would be diluted by . mixing with . core.
I catcher material. In this way the penetration of molten material and sodium '
~
into the sacrificial bed material will be retarded substantially. If-a thick enough layer of sacrificial bed material is used total penetration can be avoided for a long period of time. At the same time since there is no y contact between sodium or molten core debris and concrete there would be 'no interaction between sodium and water vapor or other gases that would be pro--
duced due to propagation of heat through sacrificial bed material. Any
. water vapor or. gas produced by propagati.on of heat to the concrete can
~
conceivably be-vented to various cells below the operating floor or to the upper reactor. containment building. Among various' oxide refractory' mate - >
rials which ~are mutually. soluble' with mixed oxide fuel,' magnesia,' Mg0, and -
alumina, A10 23, have shown : good characteristics in experiments with- sodium (28,29). j
? :1
~
In the stable barrier concept a material with much higher ' melting'- ;
temperature than material used for-.the sacrificial bed concept is' used. I Essential.ly the melting temperature of the stable bed material'must be close -
)f to the boiling point of- the fuel so that no massive attack of the stable bed material by molten fuel would be possible.' 1Among material with -such a high -
4 b
L4-24 1
-E ,, , , _ . . . - ,
l l
l C REACTOR VESSEL i
I C GUARD VESSEL l
SODIUM LEVEL
' i :' ?! :.
.* .A . . -c'2.q .tj ? .*;*
.e t' -
_-:_ _ _AFTER _ -_ -_ - _MELT.THROUGH
^:^^
^ '^ .".e. ;
. *.' 4 f R-_ _-R _ .
.m J,
, :* . RINGHEADER
.
- i *. s. , --
y ,u .,,
e.,,., y g..s .
~
ff. ; .. . ; . ; ., .
_2
" =
'*:.. e ,*F.. ,.. -
2 --
r.' .,:.?.
s ..*'. J, ',j e _=_ -
.__ J - .,.
?_" u - 7 s *s.'*'.
iI.fsf sJ _ __
. . . L.,
3 .<..
.V. . g
=' n % = ---_ .
~ _
_-_- J6 4 .; .l e 2.v
- d.'tt
_ m
.e. ,
. . . ..e _y g.. './
.. ^^^^
- CORE . ? ** !
- L ^ ^
E^ -
"Wim6^^^^^--->--^^'g --
- .,;: :. . w*;,..a t
- ..=.- i't ..-
?g:*? '.* *; h*, h '"**'T**.
NeK p* % Q 4.gl l.ail a.*.
FLOW f. ". ;.' . 7-CH ANNEL % *' 4'.* ;/.i FIR MIC.KS '. ..'i .. ' '..
. Ale .O23OM MW
- \*./'
.. 4.' .
n.:
... ab -r- n, . . . .
.:. ..~ .-
.i M1900000000000000000QW...<
- ';'.3:ME:MWRMSkv.!RM..uMMsM&4MXWAii.*. *
.W': : :! . ?9%i;
'?.. . 'd.'*(g;-); .. ;.).:;}':'.
t ,, '.-
- .M.,';
!V.H 8
CytCRE <,'f
- C::. .'6':6W:': .
.*i.' ;g,. 4. b'' tf:.'-.': . *? . ~ .\#'E
' .' t'C*.E. '!i.'b;5';'b;:.',$
.$.5'sN5.N,I,4 h;.'.3
- 3 'lf,1~t'? 'G*
' WALL .?;.?$ ,? /.*ff. .f,.
INBULATION f
1 1 Figure 4-7. The Sacrificial Bed Concept.
1 4-25 j 1
+
melting point are graphite and tungston. Tungston is not very promising.
'because it is susceptible to the attack' by the molten steel (13). The drawback with using graphite is the interaction of mixed oxide and steel with graphite and production of a considerable amount of carbor monoxide.
, Besides these' materials, uranium oxide 'and thorium oxide can also ee-used as-stable barriers but they-are much more expensive than graphite. The problem of . release of carbon monoxide as the principal reason for the choice of U02 brick instead of graphite in the design of the SNR-300 core catcher (13,30).
In the active core retention ' devices, an active cooling system is used to remove the heat from the cavity floor. In these concepts, if the active system functions as designed no significant penetration of molten fuel in the liner or concrete is expected. One kind of active design with a thick layer of sacrificial bed and active cooling _ underneath and around the bed was shown in Figure 4-7. This design is not very desirable because if a properly designed active cooling system is.used there is no-need for a thick layer of sacrificial bed. The more attractive alternative is the cooled crucible concept. One such design is shown in Figure 4-8 (27). In this concept two thin liners with active cooling loops of NaK between them are constructed on the cavity floor. The surface of the crucible is coated with a protective layer of either a h'igh conductivity material such as copper or.
~
a good insulator such as Mg0. A conical spreader on.the surface of the crucible directly below the vessel belps in spreading the core debris and protects the central section of the crucible from direct impact of-the falling debris. The sodium above the core debris plus active heat . removal underneath the liner will keep the core debris in a coolable geometry. -An active core retention device similar to the design described _ above is cur -
- rently planned for the SNR-300 (30).
I 4-26
)
, (OF CONTAINMENT SLDG.
) w so00 3300 GUARD VESSEL i 6000 W16 m 40'-
)- .' % g l
. l
- n* ,
.o* .
-p
,.,.. a
} *
.'. .'.. SOLID SODIUM 100
..e*, . C15 :50 \ .g
. , ,., 11 f
l, . . ' . i .'. ; .?," .. _
.. .... m . .
, ,m, ;
' - ~ ~ - ~
CROSS SECTIONAL VIEW 3 .. . . . :. .. : . : . ...y'. .: .
a'
.l. -
. ; , , ,4,* * ,,
, :. ' .' :.. ' '. , '
- it ;.j - /
. . ' _ . , ...: ... . e i *
\
I
)
, '.N. , e INNER JACKET w .
N- f RIB SUPPORT STRUCTURE I
l, e "
)
/l/' I t
COOLANT F LOW PATH I ,
)
pI
, l
/
OUTER JACKET ,
' " ^
P
. ,19 -
BOTTOM INNE R JACKET SEISMIC LOCKS g ' '* i FOR RADIAL EXPANSION -
N OUTER VESSEL SUPPORT GRID FLOW SEPARATOR AND INNER JACKET SUPPORT -
^
Figure 4-8. The Cooled Crucible Concept-4-27
l l
. 4.6 Effect of A Core Catcher on the Frequency of Radioactive Release Following A CDA In this section a discussion of the effect of addition of a core ;
catcher in reducing the total probability of radioactive release to the environment following a core disruptive accident will be presented. To understand the importance of this. design modification, the effect of alternative changes such as a more reliable shutdown heat removal system, specifically a more reliable DHRS, on the frequency of the core melt and consequently radioactive release will also be evaluated. In a recent scoping analysis of the dominant core melt and radioactive release sequences in CRBR it was shown that 78% of the total mean frequency of core melt per year is due to protected accidents and 22% due to unprotected accidents (4).
Protected accidents are events in which the scram system has shutdown the t reactor af ter initiation of the accident but other f aults, . principally failure of the heat removal system, will result in a core disruptive acci-dent. About 97% of the protected accidents are due to loss of heat sink (LOHS) and the rest due to loss of coolant accident (LOCA) and transient' "
overpower (TOP) accidents.
The results of this study show that following a core disruptive accident there is a 98% probability that the radioactive material will be cleanly vented through scrubbers and filters with no threat to the environ-ment. The other 2% probability consists of early and late dirty venting, containment isolation f ailure, containment overpressurization failure'and instantaneous containment failure due to CDA initiated missile or fires. In.
these cases some radioactive material can get out to the environment outside the containment building. Table 4-2 shows the various events-for the release of radioactivity and their probability '(4). An interesting number from Table 4-2 is the percentage of radioactive release due .to containment isolation f ailure. As can be seen almost 29% of the total failure proba-bility of containment is due to failure of the containment . isolation system.
I Addition of a core catcher will definitely effect the. timing and conse-quently magnitude of radioactive material being ve,,ted and can conceivably avoid containment overpressurization. It does not have substantial effect on the consequences of the containment isolation failure since radioactive 1- . gasses and particles that are vented to the upper containment building can escape the containment boundary upon failure of the isolation system. It i
4-28
i Table 4-2. Frequency of Various Containment Failure Mechanisms Containment Response Mean Frequency Percentage of Mode Per Year. The Total Late Dirty Vent, 1.4x10-6 20.2 Unfiltered Release Early Dirty Vent, 1.4x10-6 20.2
. Unfiltered Release Containment Isolation 2.0x10-6 28.9 Failure Containment Overpressure 2.1x10-6 30.4 Failure Instantaneous Containment 7.1x10-9 0.1 Failure Due to CDA Initiated Missiles Instantaneous Containment 1.4x10-8 0.2 Failure Due to CDA Initiated Fire Total 6.9x10-6 4
s J4 ,
i should be noted that the consequences'of containment isolation failure could p
conceivably be less severe than early containment failure or dirty venting since .f ailure of the containment-isolation system does not automatically result in release of radioactive material to the atmosphere. Radioactive material in this case will be vented to an adjacent building and eventually will find its way to the outside environment, but in this process a large f quantity of' the radioactive material can~get trapped or plated out on the piping surf aces.
Thus, assuming addition of a core catcher can delay the need for
) venting and so reduce the probability of early or late dirty venting and eliminate the possibility of containment overpressurization failure, then this change can reduce the overall mean frequency of radioactive release by a f actor of about 3.4.
L
)
As an alternative the effect of a more reliable DHRS on the total core melt and radioactive release frequency was also investigated. As was mentioned earlier 22% of the total mean frequency of the core melt per year is due to unprotected accidents. These accidents, which include unprotected
) loss of flow, transient overpower and loss of heat sink, are dominated by unprotected loss of flow. The-major contributor to these accidents is obviously the failure of the scram system and more reliable shutdown heat removal system will not effect this category of the events substantially.
).
Among protected accidents loss of' heat sink constitutes 96% of.the -
total frequency of the core melt accidents. As was discussed earlier in Section 2 on accident initiators,'the loss of heat sink is dominated by five
)
initiators listed in Table 2-2. In these calculations failure probability-of- the DHRS was assumed to be 7.88x10-3. ~ Also note.that the mean frequency -
of loss of all three main heat' transport loops is on the low side of the spectrum of values mentioned for this initiator earlier. If in the above calculations 'the probability of failure of the- DHRS. .is reduced from
)
' 7.88x10-3 to 1.24x10-4; which is the number calculat'ed earlier based on
~
introduction of redundancy in the' design of the DHRS (except forithe loss; of offsite power initiator greater than 2' hours in.which case the DHRS'unavail- d ability changes from'6x10-2 to 1.0x10-3), then the mean frequency of- core:
)S melt due to'l.0HS can be reduced to 5.51x10-5. LThe total mean frequency of: ~
core melt'as a result of this would be reduced from'3.8x10-4 to !1.55x10-4, b- (4-30 ,
k.
a 1.e., by a factor of 2.5. This reduction in the total mean frequency of the core meltdown directly translates to the same f actor of reduction in the total mean frequency of radioactive release.
Thus, it seems that an increase in the reliability of the shutdown
~
heat removal system can conceivably produce the same order of magnitude benefits' as introduction of a core catcher with respect to reduction of the total frequency of radioactive release -to the environment following a core disruptive accident.
4 I
l-
)
)
)
) .
)
4-31
4.7 Sumary, Conclusions and Recommendations A review of the applicant's analysis of containment response to a core disruptive accident followed by vessel and guard vessel penetration was performed. It was shown that among various f actors effecting the consequences of a core melt-through, the rate and total penetration of sodium into concrete is the most important factor. This is due to the fact that sodium concrete interaction rate determines the rate of water vapor release from concrete and consequently the rate of production of hydrogen as a result of sodium water vapor interaction. In all cases analyzed by the applicant the limiting f actor forcing venting and purging of the upper containment is buildup of hydrogen in an oxygen starved upper containment atmosphere. Thus, to avoid buildup of hydrogen to the levels where detonation might be possible, a criteria for venting and purging of the upper containment atmosphere at 6% hydrogen concentration was used.
Three major cases analyzed by the applicant which cover a wide spectrum of sodium concrete interaction rates include:
I
- a. A base _ case analysis where the rate of sodium concrete interaction is 0.5 inches per hour for four hours. This analysis shows that upper containment venting and purging must be initiated 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after guard vessel penetration. Based on experimental observation
! available, this rate and total penetration is not conservative.
- b. A molten core concrete interaction where the core debris is not in a-coolable geometry and the molten. core front penetrates the j concrete. Analysis has shown that this case is similar to a sodium concrete interaction rate of one inch per hour continu-ously. This case results in the requirement of initiation 'of.
venting and purging 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after guard vessel penetration.
f_ c. An extreme penetration case which results in a venting and purging 2
time of 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />. after guard vessel penetration. .The sodium concrete reaction rate corresponding .to this - case is 7.' inches per -
hour for 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> and one inch per. hour continuously afterward.- It I was emphasized that this case was' chosen to show what rate- of sodium concrete interaction could be accommodated if-a 10 hour1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> -
1 4-32 u
3 venting was assumed. The rate and total sodium concrete interaction in this case is not based on any observed experimental result and is extremely conservative. In fact, a recent study of the observed experimental results shows that a sodium concrete interaction rate of 18 cm/hr (7.08"/hr) for the first 20 minutes, 2.57' cm/hr (1.01"/hr) from 20 minutes to 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> and .08 cm/hr 3 (0.031"/hr) from 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> to 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> will envelope all tho observed experimental results (23). This empirical relationship results in a total penetration of 5.5", 5.8" and 6.2" in 20, 30, and 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> after guard vessel penetration. From Figure 4-5, a
,3 total penetration of 6 inches results in ventinc and purging times greater than 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />'after guard vessel penetration.
The decision about evacuation is based on accumulation of 1%
hydrogen in the upper containment along with high radiation level. The time for 1% hydrogen accumulation ranges from 1.75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> after guard vessel penetration for the extreme penetration case to 3.75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> after guard vessel penetration for the base case. The evacuation 'of the site surroundings has been calculated to take approximately 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for a 2 mile 3 zone to over 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> for the 10 mile zone. Based on this the extra time between the end of evacuation and beginning of venting and purging can be calculated. It was shown that for the molten core concrete interaction case and the base case where time for venting and purging was more than 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> 3 after guard vessel penetration there is reasonably sufficient time between evacuation and time for venting and purging even with uncertainties in evacuation time in mind. For the extreme penetration case the extra time is not long enough to take large uncertainties in the evacuation time into account.
3 With respect to the overall conclusions and recommendations it is clear that the extreme penetration case is not based on any experimental observation and seems to be.'very conservative.. Typical observed penetra-3 tions in the range of.20 to 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> are in the order of 5 to 7 inches. It would be extremely. beneficial if through'a meeting or any other form of communication among NRC's various consultants an agreement on a "most likely" rate of sodium concrete interaction can be . reached. This "most O likely" rate would include an error band. The containment response to a CDA can be calculated based on the upper bound _of this mostslikely sodium 43 4-33
concrete interaction rate to determine a realistic time for initiation of venting and purging. If the venting and purging time calculated based on this analysis is acceptable in the sense that including uncertainties in the !
evacuation time there would be sufficient margin between end of evacuation and time for venting and purging then this case can be designated as the base case for TMBDB evaluations. However, if no consensus on a most likely sodium concrete interaction rate can be found or if the calculations show that sufficient margin between evacuation time and venting and purging time does not exist then reliability of the containment cleanup system must be evaluated very closely. Based on current analysis of the applicant if the
- containment cleanup system performs with an efficiency of 99% for the solid and liquid radioactive material and 97% for gases then the controlled release to the environment is below 10 CFR 100 guidelines. It is crucial to determine if such high efficiencies are actually possible for the cleanup system under extremely unfavorable accident conditions. Also since based on 3
above efficiencies the controlled release is considerably below 10 CFR 100 guidelines it is desirable to know the cleanup system efficiencies below which released doses become unacceptable in an accident condition. In other words the reliability of the filter system versus the efficiency level must be evaluated. It is conceivable that reliability of the cleanup system at a lower acceptable efficiency could be considerably higher than the high efficiency values.
> Another area of uncertainty is related to calculations and assumptions used in analyzing various cases using the computer code CACECO.
In a recent report, BNL has raised some questions about some of these uncertainties (31). These uncertainties and especially their effect on the y
currently calculated time for venting and purging must be resolved.
The reliability of hydrogen monitoring devices in the containment and in the accident conditions is extremely important. This importance is due to both decisions related to the initial evacuation orders, i.e... the-
)
1% hydrogen accumulation criteria and also for the timing of venting and purging. High reliability of these monitoring devices in the accident environment must be demonstrated.
) -Finally, if based on the analysis of the upper bound most likely-sodium concrete interaction rates and considerations of the reliability of 4-34
)
) ;l the containment cleanup system and _ uncertainties in the evacuation time, the time for venting 'and purging is found to be too close to the evacuation
)
time, then the possibility of addition of a core catcher to the existing ,
design of the CRBRP cavity must be considered. Even in this case advantages and disadvantages of addition of a core catcher versus benefits of alterna-tive actions such as a more reliable shutdown . heat removal system must ~ be -
) considered. As was shown previously, some realistic changes on parts of the '
shutdown heat removal system resulting in a more reliable, heat removal mechanism could conceivably have comparable effects on the frequency of the radioactive release to the environment following a CDA as addition of an ex-
) vessel core- retention ' device.
)
)
).-
A
)-
). .
L4-35'
..u _ _ . . , , . __ _ _,
I 5.0 Relative Likelihood of Selective Transient Overpower Initiators 5.1 Introduction 1
l One of the areas of concern in assessment of the Clinch River Breeder Reactor Plant (CRBRP) response to a hypothetical core disruptive accident (HCDA) is the possibility of the initiation of high energetics that r could damage the vessel and the containment structure. The principal reason for existence of this possibility is the fact that CRBRP has a positive 1 sodium void coefficient. Thus, contrary to the light water reactors which
! have a negative void coefficient, in the CRBRP, upon initiation of an'acci-dent leading to sodium heat-up and boiling, additional reactivity would be l added to the system.
4 To assess the various phenomenologies involved in the core disruptive accident (CDA) energetics and the probabilities associated ' with l- the different scenarios, a CRBR Energetics Review Management Group was
! formed by the Nuclear Regulatory Commission (NRC) in July 1982. The primary objective of this group was to evaluate the relative likelihood of a core disruptive accident leading to an " energetic" termination with possible damage to the vessel as opposed to a " benign or mild" termination with no significant work-energy release (32).
)
In general core disruptive accidents are initiated due to two j broad classes of events. These are:
- a. reduction in core cooling capability where heat generated in the core cannot be removed due to a malfunction in the heat removal j system, i
- b. increase in core power due-to reactivity insertion to the point g where even if the heat removal system is functioning to its designed capability the amount of heat production-is so-high that core disruption'would result.
There is also.another class of failures called subassembly failure-propagation which could lead to a core disruptive accident'but'does not fall 5-1
D l
into any of the above two categories. It should be noted that in discussing g core disruptive accidents that could conceivably letd to an energetic termination, f ailure of the scram system along with one of the two conditions mentioned above would be necessary. In other words the
" unprotected" loss or reduction in heat removal or " unprotected" reactivity insertion accidents could possibly lead to an energetic CDA. j The reduction or loss of heat removal capability events can be represented by " Loss of Flow" (LOF) or " Loss of Heat Sink" (LOHS) accidents.
But since the consequences of loss of flow accidents envelope the whole 8 class of accidents resulting from loss or reduction in heat removal, LOF accidents are taken to represent this class of accidents.
The class of accidents resulting in reactivity insertion and large e increases in power are represented by the Unprotected Transient Overpower (UTOP) initiators. The basic mechanisms for insertion of reactivity in the CRBR include control rod withdrawal or a shift in fuel geometry into a more reactive configuration due to a seismic evelt or passage of a disturbance such as a bubble through the core, thereby introducing positive reactivity to the core. The uncontrolled rod withdrawal results in insertion of a continuous reactivity rate to the co're depending on the number of rods withdrawn and the rate of rod withdrawal. Contrary to this, fuel compaction or passage of foreign substances results in a step increase in reactivity.
O The consequences of a step insertion can be enveloped by ramp rates if a large enough ramp rate is considered in analyzing the consequences of a transient overpower initiator (33). Focusing on the rod withdrawal as the representative initiator for the transient overpower accidents, it has been e shown that the consequences of a reactivity insertion due to rod withdrawal, as far as an energetic or benign termination of the accident is concerned, is directly dependent on the rate of reactivity insertion due to control rod system malfunction (34, 35, 36,1). This is due to the f act that at low g levels of reactivity insertion the fuel pin failure locations are away from the center of the fuel elements whereas at high reactivity insertion rates failure location is much closer to the center of the fuel element. If the fuel pin fails away from the center of the fuel rod the rest of the fuel will move toward this failure location and away from the center of the fuel O rod which is the most reactive part of the rod. This fuel motion introduces negative reactivity to the core and results in a mild or benign termination.
9
.5-2
l I
But if the fuel. pin f ailure is near the center of the fuel rod, the fuel in I other parts of the fuel rod will move toward the center of the fuel rod
)
adding substantially more reactivity to the core and leading to a possible '
energetic termination of the core disruptive accident. In one study, the range of reactivity insertion rate was divided into slow reactivity inser-tion covering 1 to 5 cents per second, rapid reactivity insertion rates covering 10 to 50 cents per second and very rapid reactivity insertion rates covering 50 cents to 3 dollars per second (33). To represent the slow rate a 1 cent per second case was analyzed. The rapid and very rapid rates were represented by a 10 cents per second and 3 dollars per second. In addition a step reactivity insertion of 60 cents per step was analyzed. For the 1 cent per second case, the fuel failure position was 16" above midplane and negative reactivity effect of fuel sweepout was much higher than the posi-tive reactivity effect of sodium voiding and a mild termination resulted.
, For the 10 cents per second case, the fuel f ailure position was 14" above midplane and mild termination was again observed. When this case was arti-ficially forced to f ail the pins at midplane, the accident progressed to prompt criticality with associated high ramp rates indicating the importance of fuel pin f ailure location. For the 3 dollars per second case, f ailure location was 6" above midplane and mechanical disassembly resulted.
Current analysis of the energetic CDA as a function of the rate of reactivity insertion indicates that a reactivity insertion rate of about 20
)
cents per second or more is necessary to create an energetic core disruptive accident (37).
The applicant's analysis of possible control rod system
> malfunctions leading to various rates of reactivity insertion indicates that based on expected ' control rod bank worth near the core midplane, up to 12.6 cents per second of reactivity insertion might be possible due to a bank withdrawal at 9 inches per minute (38). For this to happen-approximately
)
seven subsystems such as flux controllers, clocks or overspeed protection devices must fail. To insert much' higher reactivity rates of 20 cents per second or above, an additional two to three subsystems have to fail.
The primary objective of the present analysis is to review the-I-
possible failure mechanisms leading to various reactivity insertion rates -
and specifically see if the probability of large reactitity insertion rates t
5-3 u
I of approximately 20' hents per second and above is substantially lower than 3
the 10-12 cents per second. This is the essence of task I-1~of the CRBR ,
Energetics Review Management group with t:1e objective to "show that} TOP p calculations driven by 10 cents per second provide an appropriate envelope."
Obviously if it is possible to show that the probability of reactivity insertion rates much higher than:20 cents per second is substantially lower I then reactivity insertion rates of 10 to 12 cents per second, then the possibility of an energetic termination of a CDA due to a TOP would be icwered significantly.
I In addition a separate but related topic about the likelihood of combined transient overpower (TOP) and loss of flow (LOF) accident will also be discussed. The classical analysis of transient overpower accidents has always included the inherent assumption that failure of the scram system y results in the failure of the signal for tripping the primary coolant pumps and thus the primary pumps are running. The objective of anclyzing this issue is to show that the relative likelihood of a combined T0P/LOF is much lower than that of a TOP, thus supporting' the contention that the above assumption for the analysis of TOP used in previous studies is correct.
In the next section a brief description of the CRBRP control rod system will be presented. This description will include a discussion of various levels of protection incorporated in the design of the control rod
) system that would limit the rate of rod withdrawal.
~
Section 5.3 deals with various scenarios that could result in- rod- a withdrawal ~ rates . corresponding to a reactivity insertion ~~ rate - of. 20 cents -
~
j per second or more. In this section the incremental probabilityf of reactivity insertion at a rate of 20 cents or more coapared to a reactivity insertion rate of 10 to 12 cents per second~is calculated.
The subject-of the likelihood of a combined T0P/LOF. accident i
~
l compared to the classical TOP is: treated in Section 5.4. This treatment-is #
more descriptive and qualitative than quantitative.
Finally, all the. results' are summarized in Section 5.5 which also -
h includes the conclusions and recommendations for further study in this area.
F 5-41 u
)
5.2 Systems Description
)
The control rod system in the Clinch River Breeder Reactor (CRBR) consists of two redundant and diverse subsystems namely the primary c.ontrol rod system and the secondary control rod system. In the ctrrent hetereogeneous core design there are nine control rods in the primary
) control system and six control rods in the secondary control system. All the primary and secondary control rods consist of highly enriched (92% Blo) :
l boron carbide pellets. The primary control rod assemblies consist of 37 pin bundles which move inside a hexagonal duct. The active length of the :
) control rod pins which include boron carbide absorbers is 36 inches. Both control rod systems are designed to have sufficient negative reactivity such !
that either system by itself can shut down the reactor with the highest .
worth rod stuck.
3 Figure 5-1 shows a schematic of the heterogeneous core with the primary and secondary control rod positions. In this configuration the three primary rods in the fourth row of the core are designated as startup rods. Thus, at the beginning of reactor operation these three primary
) control rods and all six 3econdary control rods are withdrawn from the core.
The remaining six primary control rods in the seventh row are used for burnup adjustments. At the beginning of the fuel cycle the six primary control rods are approximately 18 inches or halfway inside the core. Note
) that the exact position of these rods depends on the particular fuel: cycle as is shown in Table 5-1 (6).- Once the reactor is scrammed both the primary and secondary control rods are inserted into the core.
). Since only the six primary control rods are inserted into the core during normal plant operation, only accidental withdrawal of these rods must be considered when considering reactivity insertion rates. .Inlthis regard the beginning of the fuel: cycle when the core is most reactive and more_of-the primary control rods are inserted in the core is expecte'd to be the
)
worst time for the rod withdrawal accidents.
From the.beginning of the fuel cycle, as the fuel _is burned and -l reactivity decreases, the control rods are withdrawn at.a slow' rate to,
.-. compensate for the lost reactivity.- The control. rod movement can be accom-plished in eithe; single or group mode. Below 40% thermal power, the plant 5-5 o
}
)
)
)
"NELD S S; ELD ASSEMBLIES ASSEMBLIES
)
)
)
)
0156 FUEL ASSEMBLIES h 6 ALTERNATE FUEL 2u - 3.T
^
Q 76 INNER BLANKET ASSEMBLIES "o^"Y c "'" ' ^SS""SS 126 RADICAL BLANKET ASSEMBLIES O S312 8"o RADICAL SHIELD ASSEMBLIES g 9 PRIMARY CONTROL ASSEMBLIES
)
Figure 5-1. CLINCH RIVER BREEDER REACTOR PLANT HETEROGENEOUS CORE DESIGN l l
T 5-6
, _ _.a
I D
l 1
D I
Table 5-1 The Expected Position of Row 7 Primary Control Rods at the Beginning and End of Cycle for the First Five Cycles J
Expected Position of Row 7 Primary Control Cycle Rods, Inches Inserted Into the Core B0C E0C D
1 23.2 25.6 2 20.0 29.7 3 3 20.1 27.9 4 18.1 29.2 5 18.9 25.5 9
O D
D D '
1 O .
5-7
4-variables.such as sodium and steam flow'and temperatures and power are j controlled manually. In this case the control rod movement is in manual mode. Above 40% thermal power all these variables including the control rod movement are controlled automatically. Figure 5-2 shows a simplified dia-gram of the Reactor Controller which provides the signals for the rod movement (38). The plant Supervisory Control System sends a core exit
') temperature signal to the reactor controller. The limiter L1 shown in Figure 5-2 limits the flux demand signal as supplied by the core exit temperature controller to 103% of the power. This means that if, based on the input core exit temperatures, there is a demand for increase in the
) overall plant power to more than 103% of the rated power, control rods will not be allowed to move out. The core flux which corresponds to the core power and is measured in several locations is fed to a median select system which selects the median signal and sends this to a comparator. At a given
) core power, ti:e desired core exit temperature is preset. Thus, by comparing the average core exit temperature and the core flux it can be determined if the reactor power should be increased or decreased. If the core exit tem-perature and flux level are in line, no signal for rod movement is produced. l Otherwise the flux controller amplifies the error signal producing a direc-
) tion signal for the rod withdrawal or insertion and the rate of rod move-ment. The limiter L2 in this~ case limits the rod withdrawal demand to a rate of 4 inches per minute. This means-that if based on the demand for power increase, a rod withdrawal demand signal at higher than 4 inches per
) minute is produced, the limiter L2 will not allow higher. rates of rod withdrawal than 4 inches per minute. Figure 5-2 also shows a Rod Withdrawal Stop (RWS) mechanism. This system consists of a set of secondary flux signals which are measured separately from primary flux signals, a median
) select system and two blocking mechanisms. If the flux output signal of the-mediar. select system is either higher than a preset flux level, implying reactor power already is very high, or the power-to-flow ratio is higher than a preset limit, then an interlock mechanism will prevent rod withdrawal irrespective of the rod withdrawal demands. Currently there are two rod
' withdrawal stop mechanisms similar to the one shown in Figure 5-2 incor-porated.in the design of the CRBRP. The output of the. reactor controller system in the form'of direction and rate of rod movement is next fed to the Primary Control Rod Drive Mechanism Controller as is shown in Figure 5-3.
1 (38). The auto interface -board consists of a clock mechanism which provides -
pulses for ' sequential core rod movement and an ; overspeed detection ,
)? 1 5-8
i POWER DEMAND LIMITER - 4 FLUX LIMITER U
. CONT OLL R (103% WER) j CONTROLLER (4,/ MIN)
. PRIMARY MEDIAN FLUX
- SELECT SIGNALS u,
'b I
FLOW " POWER /
RATE FLOW RATE
- BLOCK ROD WITHDRAWAL
- STOP (RWS)
OR e (ONE OF THE TWO ROD WITHDR AWAL I
.' SECONDARY
- MEDIAN HIGH FLUX -* SELECT
- FLUX SIGNALS BLOCK Figure 5-2. SIMPLIFIED BLOCK DIAGRAM OF REACTOR CONTROLLER SYSTEM .
9
v: .v v- -v v v v v v v v ROD BLOCK TRAIN I
- i. SECONDARY ROD ROD BLOCK TRAIN 11 INTERLOCK ,
o u o l AUTO IN IN i
R ATE --+ =
AUf0 OUT OUT ;
AUTO IN ---+
ROD MANUAL AUTO RWS (2) RWS (2)
AUTO OUT * ; : INTERFACE CONTROLLER INTERFACE SIMMM ROD WITHDRAWAL % DRAWER N U N[ BOARD BOARD STOP (2)
PULSE (6) PULSE (ONLY GROUP)
SINGLE / GROUP ---*
h a n COMMAND SIGNALS OT OTHER 8 ROD ROD SELECT (9)
CONTROLLER DRAWERS 1
- MANUAL IN MANUAL OUT I
Figure 5-3. SIMPLIFIEI) BLOCK DIAGRAM OF THE PRIMARY
- CONTROL ROD DRIVE MECHANISM CONTROLLER
mechanism. In case of rod withdrawal in the group mode the auto out and
- rate signals provide the necessary inputs for the clock system. The clock system then produces sequential pulses for the six primary rods to withdraw one step at a time. Each rod withdrawal step corresponds to a 0.025 inch of rod withdrawal. The overspeed detection mechanism in the auto interface !
board blocks any rod withdra'wal above 5.5 inches per minute. Thus, if the ;
clock mechanism fails and produces pulses corresponding to higher than 5.5
~ inches per minute rod withdrawal, the rod withdrawal will be stopped by the overspeed detection mechanism. Additionally there is a secondary interlock mechanism that prevents rod withdrawal if all the secondary control rods are !
) not out of the core as they are supposed to be. The manual interface board I is used for manual operation of the rod movement. In this case all nine primary rods can be moved but only one rod at a time. There are no clock or ;
overspeed protection mechanisms in the manual interf ace board. The high
) flux and power-to-flow ratio blocking mechanisms discussed earlier and shown in Figure 5-2 provide protection against high rates of manual rod withdrawal. The maximum rate of rod withdrawal is nine inches per minute for individual rods in the single rod movement mode. In the manual mode the clock signals are produced by the rod controller drawers. The output of
)
either the auto or manual interf ace board is fed to the rod controller !
drawers. There is one drawer for each rod. The rod controller drawer energizes the motors for the rod movement. Each drawer has a clock and an overspeed detection mechanism that limits rod withdrawal to about nine
>- inches per minute. Finally, there are two additional rod block mechanisms.
The first one is a protection. mechanism based on the rod misalignment. This mechanism will stop rod movement. if the end point of any of the six primary rods inserted into the core are more than 1.5 inches apart and will also
)- trigger an annunciator as is shown in Figure 5-4 (38). .The second protec-tion system currently being added to the control rod system is a rod with'-
drawal stop mechanism based on the bank average position setpoint. In-this case the average position of the control rods as a function' of time is j calculated during the fuel cycle and.is' set. If at any time during the fuel cycle the average rod.pcsition exceeds this preset point by a specified magnitude rod withdrawal .will be blocked.
At-this point the basic mechanism for. rod movementLhas been:
described. In the next section, the various combinations of the failures'of I. control . rod system that could lead to different rates of reactivityL y insertion will be discussed. ,
}
b '5 <
- l
~ . . . .-- .. .
l l
RELATIVE ROD l POSITION INDICATOR ROD BLOCK TO ROD D/A ; : CONTROLLER PULSE SIGNALS CONVERTER LOGIC (6) TRAIN I DRAWERS AVERAGE ir 1 r TO PLANT TEST & TO PLANT DEVIATION BYPASS : ANNUNCIATOR ANNUNCIATOR : ALARMS
~? SYSTEM CONTROLS SYSTEM M a a AVERAGE ABSOLUTE ROD RED BLOCK TO ROD POSITION INDICATOR : LOGIC CONTROLLER SIGNALS TR AIN 11 DRAWERS (6)
Figure 5-4. CONTROL ROD BLOCK SYSTEM BASED ON ROD POSITION
1 5.3 Relative Likelihood of Insertion of Different Rates of Reactivit?'
in the Core.Due to Control Rod Withdrawal Accidents
)
In this section various combinations of the failure of the control rod system that could lead to different rates of reactivity insertion are discussed. The objective of this section is to show that the probability of
) various f ailures that would lead to a reactivity insertion rate above 20 cents per second is substantially lower than failure mechanisms leading to reactivity insertion rates of about 10 to 12 cents per second.
) Because of multi-levels of overspeed protection incorporated in different subsystems of the control rod system, the rate of reactivity insertion can be divided into discrete levels corresponding to multi-failures up to an overspeed protection failure. Starting with the rod withdrawal accidents in group mode, the first overspeed protection is in the
) reactor controller system and specifically in the limiter L2 shown in Figure 5-2. This limiter will limit the rod withdrawal at speeds above 4'. inches per minute. Thus, the first rod withdrawal accident is:
) Case I. Bank Withdrawal Up to 4 Inches Per Minute For this accident to happen, five subsystems must f ail. These are:
)
Failure of the flux controller high (Figure 5-2)
~
1.
- 2. & 3. Failure of both of the secondary f' lux median select .1ow, (Figure-
) 5-2)
- 4. & 5. Failure of the Train I and Train II of the rod position rod block-
~(Figure 5-3)
) This- accident results in a reactivity insert; ion of 5.6 cent's per second.
(38).
.The next overspeed protection is in the auto interface board which-
> limits the rod: withdrawal Lto 5.5 ) inches per.' minute. LThus the:next; accident:
' scenario is: -
.[
,_13.
Case II. Bank Withdrawal Up to 5.5 Inches Per Minute For this accident, all the five subsystems discussed in Case I !
plus the additional failure of the rate limiter L2 (Figure 5-2) must occur. 1 Thus, a total of six subsystems must fail. The rate of reactivity insertion in this case is 7.7 cents per second (38).
The third overspeed protection is in the rod controller drawers (Figure 5-3) and limits the rod withdrawal to 9 inches per minute. Thus the next accident scenario is:
1 Case III. Bank Withdrawal Up to 9 Inches Per Minute In this case the following failures must occur:
- l. All the five failures in Case I.
- 2. Failure of the auto interf ace board clock such that it produces pulses at 9 inches per minute or more.
)
- 3. Failure of the auto interface board overspeed detector.
Thus a total of seven subsystem f ailures are necessary for this
) accident. This accident scenario results in a reactivity insertion of 12.6 cents per second (38).
There are also some single rod withdrawal scenarios which result in reactivity insertion. In general.the portion of the time that the
)
reactor is operated in the single rod movement is- very small. Additionally, the number of failures required in this mode is higher than the_ group mode for similar reactivity insertion rate.. For the rod withdrawal _ accidents in single mode two cases are considered.
Case IV. ~ Single Rod Withdrawal At 9 Inches Per Minute i For a single rod to withdraw at the 9 inches per minute rate which
)- is- controlled by. the rod _ controller drawer overspeed detection, the- l following. failures-have to occur.
J l
l I
5-14
e l._& 2. Failure of both of the secondary flux median select low, i.e., )
! failure of the rod withdrawal stop mechanisms. (Figure 5-2).
- 3. & 4. Failure of Train I and II of the rod position block system (Figure i 5-3). ;
l 5. Manual interface board produces false out command.
i l
- 6. Single / group comand line to auto interface board fails high.
The above six subsystem f ailures result in a reactivity insertion rate of 2.1 cents per second (38).
If the rod controller drawer overspeed protection f ails then a single rod can be withdrawn at the maximum mechanical speed which is the next case:
Case V. Single Rod Withdrawal Up to Maximum Mechanical Speed
) The maximum design speed for withdrawal is 72 inches per minute.
Actual test on the control rods has shown that at rod withdrawal-speeds close to 45 inches per minute, the centrifugal force causes a rod drop or scram (39). Ti:us, rod withdrawal at speeds higher than about 45 inches per
~
> minute is not physically possible. This leads to upper bound limits of reactivity insertion by a single control rod based on the maximum mechanical' speed. For. this accident the following failures must occur:
All six failures described for the previous case.
[ 1.-
- 2. . Failure of the controller drawer clocking circuit'so that pulses corresponding to rod withdrawal speeds-of 45 inches per minute are produced.-
F ,
3.. Failure of the controller drawer overspeed det'ection system.
These eight failures resul't in a reactivity insertion rate of '10.5; cents perg q p second:(38).
d 4
. . , , 4-, 4.. , '.J'...
To insert reactivity rates higher than the 10 to 12 cents per second produced by the accident scenarios described before, additional failures of certain control rod subsystems 'are required. From the reactivity insertion rates produced by the various rates of rod withdrawal j discussed so f ar it can be seen that to insert reactivity at a rate of 1.0 cents persecond, a rod withdrawal rate of approximately 4.3 inches per
~
h minute is required. Thus, to insert about 20 cents of reactivity per second a total rod withdrawal of about 86 inches per . minute is necessary.
Obviously, the rate of reactivity insertion is not an exact linear function of the rod withdrawal since the power shape and consequently control rod
) worth is not uniform in the core. Considering all the conservatism ,
incorporated in this analysis the above assumption is quite acceptable.
There are several scenarios that would result in a total control rod with-drawal of 86 inches per minute. Among these, we are interested in the scenaritas which are most likely, i.e., involve the least number of '
)
additional failures with respect to the previous cases. In this regard two cases are analyzed to find the most likely scenario for the insertion of about 20 cents per second of reactivity and determine the probability of this rate of insertion relative to- the probability of reactivity insertion
). at a rate of about 12 cents per second.
The first scenario consists of all the f ailures listed for Case III of grpup rod withdrawal that . leads to 12.6 cents per second reactivity
)' insertion plus additional failures that would result in a total reactivity.
insertion rate of 20 cents per second. These are:
I Case A
}-
- 1. Failures 1 through 5 of Case III
- 2. Failure 7 of Case III I 3. Auto interface clock failure at about 45l inches per minute l ,
- 4. Two rod controller drawer overspeed protection; failures.
In this case the' first fiveIfailures resultiin a~ bank -withdrawal
. at a rate 'of. 4 inches per-minute. : Theisixth failure .is: failure.of the auto
(. -
1 y' .
15 -16 ~.
z . _ _ . .- - . --- .: . ~ .-.
l interface board overspeed detection. Now if the clocking mechanism in tiie auto' interf ace board fails at a rate close to 45 inches per mi.nute, this rate is transmitted to rod controller drawers. The rod controller drawers have an overspeed protection mechanism that limits rod withdrawal to 9 ,
I inches per minute. So, if two out of six drawer overspeed detectors fail, two control rods can move out at the combined rate of about 90 inches per minute. As was mentioned earlier, to insert reactivity at a rate of 20 cents per second, a rod withdrawal rate of 86 inches per minute is required.
Thus, this scenario meets the above criteria. To find the probability of additional failures that result in a reactivity insertion rate of about 20 cents per second compared to the case which resulted in a reactivity insertion of about 12 cents per second, the applicant has developed a Failure Modes and Effect Analysis (FMEA) for the auto interface board and the rod controller drawer clock and overspeed detection mechanism. The FMEA 3 for the auto interface board clock and overspeed detector is shown in Table 5-2(39). Since the circuit drawings for these systems are fairly detailed, they are not reproduced here and the drawing number associated with each system which is part of the CRBRP docket is indicated on each table. In the failure effect column of Table 5-2, if the clock is disabled or it would not run, the failure does not result in signals for rod withdrawal and is of no l
interest to this case. As will be discussed later in this section, this mode of clock failure contributes to another rod withdrtwal scenario. Also_ ,
in this analysis it was conservatively assumed that if the clock mechanism produces pulses that correspond to rod withdrawals of 14 inches per minute or more, the rods will receive a signal that corresponds to 45 inches per minute, i.e., the maximum mechanical speed. It is obvious that:if-the control rods receive a pulse corresponding to a rod movement of more than 14 F inches per minute'they cannot immediately move at the maximum mechanical speed of 45. inches per minute. More realistically the rods will speed up until at some peint of their withdrawal they would possibly reach a 45-
-inches-per-minute speed.. Thus,' the rate of rod. withdrawal .is somewhere
- between 14 inches per minute and 45 inches per minute. These withdrawal rates . result in a~ range of reactivity insertion rates from a minimum.of.
about 15 cents per second to more than'29 cents per second.. : Table 5-3 shows the list of single failures that could result in the auto interface board clock1mechanism producing pulses that correspond to a' bank withdrawal -
of 14 inches per minute or'more. These failures-are essentially the single
~
[
4 .. t 5-17.=
~ n _ - - - - - - __
Table 5-2 Failure Modes and Effect Analysis For the Auto Interface Board Clock and Overspeed Detection System (Drawing 148J252)
Failure Component- Mode Failure Effect Al, Isolation Amp Analog Output Failed to Auto pulse clock period would go to 30.8 ms. This corresponds to Devicts AD277A- L+15 VDC . bank movement at 8.1 IPM.
Output Failed to Clock would not run.
Zero or -15 VDC A2, Amplifier Analog' Devices Output Failed High Clock is disabled.
3500CN Output Failed Low Clock is enabled even though analog clock rate signal is 4 ma. Clock would run at its minimum speed corresponding to bank movement at 0.05 IPM.
A3, Amplifier Analog Devices Output Failed to Auto pulse clock period would go to 26.8 ms. This corresponds to bank
- 3500CN +15 VDC- movement at 9.3 IPM.
Output Failed to Clock would not run.,
Zero or -15 VDC
' A4, V/F Converter Analog - Output Failed to Auto pulse clock period would go to 20.0 ms. This corresponds to bank Devic:s AD450K Max Freq. Consistent movement at 12.5.IPM.
With 50.ps Pulse Width Output Failed High, Clock would not run.
Low,' or to Zero A5, V/F Converter Analog Output Failed to Max Overspeed detector would only provide protection against bank movement
' Devic 2s AD450K Freq.' Consistent in excess of 12.5 IMP.
=With 50 ps Pulse-Width Output Failed High, Overspeed detector would disable out motion.
Low, or to Zero
m .-
y .u .v v _
L Table 5-2. continued l Failure .
j, ' Component Mode Failure Effect
, A12,.10 Volt Regulator Failed High Clock would not be enabled until analog clock rate signal exceeded l ~ Analog Devices AD581L 6 ma. For analog clock rate signals of 20 ma, the auto pulse clock l
period would be 57.1 ms. This corresponds to bank movement at 4.4-
- j. IPM. The overspeed detector would only provide protection against bank movement in excess of 8.3 IPM.
Failed Low- For analog clock rate signals of 20 ma, the auto pulse clock period would be 40 ms. This corresponds to bank movement at 6.3 IPM. How-ever, the overspeed detector would disable outmotion.
1U1, Quad 2 Input OR Gate Pin 3 Low Clock is criabled even though analog clock rate signal is 4 ma. Clock would run at minimum speed corresponding to bank movement at 0.05 IPM.
Pin 3 High Clock would not run.
Pin 4 Low Binary counter U3 would not reset. Clock speed would be cut in half.-
Bank could only move at 2.5 IPM.
Pin 4 High Clock would not run.
Pin 10 Low Binary counter U6 would not reset. On the average, U6 would output
. a pulse for every 128 input pulses, although it would not be constant.
Bank speeds would be equivalent to 3.9 IPM.
Pin 10 High Clock would not run.
' Pin 11 Low or High Clock would not run.
U2,"Qu'ad 2 Input OR' Gate _ Pin 2 Low -No Effect.
'RCA CD40718F .
Pin 2 High Clock would not run.
- ~
Pin 4 Low Overspeed detector would disable outmotion.
Pin 4 High Overspeed detector disabled.
.J (l' O 'O ~~ 'O O O U U U U Table 5-2 continued Failure .
Component Mode. Failure Effect U2 (Continued) Pin 10 Low Overspeed detector would disable outmotion.
Pin 10 High Overspeed detector disabled.
Pin 11 Low No effect.
Pin 11 High Overspeed detector disabled.
U4,- Quad 2 Input AND Gate Pin 3 Low No effect.
RCA CD4081BF Pin 3 High No effect.
Pin 4 Low No effect.
-f Pin 4 High Clock would not run.
Pin 10 Low No effect.
Pin 10 High Overspeed detector would disable outmotion.
Pin 11 Low No effect.
Pin 11 High No effect.
'US, Quad 2 Input OR Gate Pin 3 Low Overspeed detector would disable outmotion.
RCA CD4071BF Pin 3 High Overspeed detector would disable outmotion.
Pin 4 Low Binary counter U3 hould not reset. Overspeed detector would disable outmotion in excess of 2.8 IPM.
Pin 4 High Overspeed detector would disable outmotion.
Pin 10 Low No effect.
Pin 10 High Overspeed alarm.
Table 5-2 continued
~
Failure .
Component Mode Failure Effect
- U12 Quad 2 Input AND Gate. Pin 3 Low Overspeed detector disabled.
RCA CD4081BF' Pin 3 High Overspeed detector would disabic outmotion.
Pin 4 Low Clock would not run.
Pin 4.High Clock would not run.
Pin 10 Low Clock would not run.
Pin 10 High Clock would not run.
U30 Dual BCD Counter RCA Pin 1 High or Low Clock would not run.
'CD45208F Pin 2 High No effect..
Pin 2 Low Clock would not run.
Pin 3 High or Low No effect. -
Pin 4 High or Low No effect.
Pin 5 High or Low Clock would not run.
Pin 7 Low Binary counter U3 would not reset. Bank speeds would be equivalent to 2.5 IPM.
Pin 7 High Clock would not run.
Pin 5 Follow Pin 1 Bank speeds equivalent to 20.2 IPM.
Pin 9 High or Low Overspeed detector would disable outmotion.
Pin 10 High. No effect.
Pin 11 Low Overspeed detector would disable outmotion.
p v ~v. v v v v v v v- - -
f Table 5-2 continued Failure .
Component. Mode Failure Effect U3-(Continued) -Pin 11 or 12 High No effect.
or Low Pin 13 follow Pin 9 Overspeed detector would only block ou Notion for bank speeds in excess of 22.2 IPM.
Pin 13 High or Low Overspeed detector would disable outmotion.
Pin 15 Low Binary counter U3 would not reset. Overspeed detector would disable outmotion in excess of 2.8 IPM.
Pin 15 High Overspeed detector would disable outmotion.
U6, 12 Stage Binary Counter Pin 2 High Digital comparator would output one pulse for every 272 clock pulses.
Bank speeds equivalent to 7.4 IPM.
RCA CD40408F Pin 2 Low Digital comparator would never output a pulse. Clock would not run.
M Pin 3 High Digital comparator would never output a pulse. Clock would not run.
Pin 3 Low No effect.
Pin 5 High Digital comparator would never output a pulse. Clock would not run.
Pin 5 Low No effect.
Pin 6 High Digital comparator would output one pulse for every 384 clock pulses.
Bank speeds equivalent to 5.3 IPM.
Pin 6 Low Digital comparator would never output a pulse. Clock would not run.
Pin 4 High- Digital comparator would output one pulse for every 144 clock pulses.
Bank speeds equivalent to 14.0 IPM.
~
Pin 4 Low Digital comparator would never output a pulse. Clock would not run.
u_ -_ _ . - - - - ___
Table 5-2 continued Failure- .
Component Mode Failure Effect U6 (Continued) Pin 10 High or Low Clock would not run.
Pin 11 High Clock would not run.
Pin 11 Low Bank speeds equivalent to 3.9 IPM.
'O , Digital Comparator' Any Single Pin Fail Worst case failure mode would'be pin 3 failing high. This produces RCA CD4063BF- High or Low bank speeds equivalent to 14.0 IPM.
Pin 6 Follow Pin 10 Bank speeds equivalent to 126 IPM.
Pin 6 Follow Pin 12 Bank speeds equivalent to 63 IPk.
Pin 6 Foilow Pin 13 Bank speeds equivalent to 32 IPM.
Pin 6 Follow Pin 15 Bank speeds equivalent to 16 IPM.
h Pin 6 Follow Pin 3 Bank speeds equivalent to 8 IPM.
09, 12 Stage Binary Counter Pin 2 High Overspeed detector would only block outmotion for bank speads in excess of 8.1 IPM.-
Pin 2 Low Overspeed detector would disable outmotion.
Pin 3 High Overspeed detector would disable outmotion.
Pin 3 Low No effe"2.
Pin 5 High Overspeed detector would disable outmotion.
Pin 5 Low No.effect.
Pin 6 High Overspeed detector would only block outmotion for bank speeds in excess of 5.8 IPM.
Pin 6 Low Overspeed detector would disable outmotion.
v v v m- m m - - _ _
Table 5-2 continued Failure .
Component Mode Failure Effect U9 (Continued) Pin 4 High Overspeed detector would only block outmotion for bant speeds in excess of 15.4 IPM.
Pin 4 Low Overspeed detector would disable outmotion.
Pin 10 High or Low Overspeed detector would disable outmotion.
Pin 11 High Overspeed detector would disable outmotion.
Fin 11 Low Overspeed detector would block outmotion for bank speeds in excess of 4.3 IPM.
U8, Digital Comparator RCA Any Single Pin Fail Worst case failure would be pin 3 failing high. This would result CD40638F
~
High or Low in overspeed protection being disabled for bank speeds less than 15.4 IPM.
Pin 6 Follow Pin 10 Overspeed protection disabled for bank speeds less than 140 IPM.
Pin 6 Follow Pin 12 Overspeed protection disabled for bank speeds less than 70 IPM.
Pin 6 Follow Pin 13 Overspeed protection disabled for bank speeds less than 35 IPM.
Pin 6 Follow Pin 15 Overspeed protection disabled for bank speeds less than 17.5 IPM.
Pin 6 Follow Pin 3 Overspeed protection disabled for bank speeds less than 9.8 IPM.
-U10, Dual J-K Flip-Flop RCA Pin 13 High or Low Overspeed protection disabled.
.C040278F-Pin 15 High Overspeed detector would block outmotion.
Pin 15 Low Overspeed protection disabled.
Pin 14 High Overspeed detector would block outmotion.
Pin 14 Low No effect.
Table '5-2 continued
-Failure .
- Component Mode Failure Effect U10 (Continued) Pin 12 High Overspeed detection disabled.
Pin 12 Low Overspeed detector would block outmotion.
Pin 7 High Dyerspeed detector would block outmotion.
Pin 7 Low Overspeed detection disabled.
Pin 4 High No effect.
Pin 4 Low No effect.
. Pin 1 High Overspeed detector would block outmotion.
N Pin 1 Low Overspeed detection disabled.
Ull, Dual J-K Flip-Flop Pin 1, 4 or 7 Clock would not run. ;
RCA CD4027BF Failed High or Low Pin 2 Failed High Overspeed detection disabled.
or Low S1, DIP Switch CTS Corp. All At worst case setting of all switches open, the bank would move at.
. CTS 206-7 10.5 IPM with overspeed.
R2, Potentiometer Allen- - Failed High or Low No effect on clock speed or overspeed detection.
Bradley MT2W501 R9, Potentiometer Allen- Failed High Bank speeds less than 5.0 IPM.
Bradley MT2W101 Failed Low Bank speeds equivalent to 6.3 IPM.
- R14 Potentiometer. Allen- Failed High Overspeed protection disabled for bank speeds less than 6.3 IPM.
Bradley MT2W501 -
Failed Low Overspeed detector would block outmotion.
m v v. v v v v. v u- v. v ,
Table 5-2 continued Failure-
-Component Mode Fallure Effect R19, Potenticeeter Allen- Failed Short Bank speeds would increase a maximum of 2.5% to 5.1 IPM.
Bradley MT2W501 Failed Open Clock would not run.
~
-R14,- Quad 2 Insit NAND Gate ~ Pin 4 High- Overspeed detector disabled.
RCA CD4011BF-Pin 4 Low Bank motion disabled.
L.
h i
Table 5-3 Component Failurc- That Result in Auto Interface Board-Clock Mechanism Producing Pulses that Correspond to a Bank Withdrawal of 14 Inches Per Minute or More Failure Rate (40)
Component 10-6/ hour f
. U3, Dual BCD Counter 2.88 ,
U6, 12 Stage Binary Counter 4.62 U7, Digital Comparator 2.88 Total Failure Rate 10.38 t
^
h 'y y - ,' .,- -
- ~ ~+
k = -
- _ a _ _
) i l
element minimal cutsets for the system. Also shown in this table is the failure rate of these components.
Table 5-4 shows the list of component failures that contribute to the failure of the auto interf ace board overspeed detector such that the
) overspeed detector cannot protect against clock pulses corresponding to bank withdrawal of 14 inches per minute or more. The Failure Modes and Effect Analysis for the rod controller drawer clock and overspeed detector mechanism performed by the applicant is shown in Table 5-5 (39). The single component failures that result in the failure of the rod controller drawer
) overspeed protection is shown in Table 5-6.
Referring back to Case A which results in reactivity insertion rates of about 15 cents per second to over 20 cents per second, the addi-
) tional failures in this case compared to Case III which results in a reac-tivity insertion rate of 12.6 cents per second are:
- 1. Auto interface clock failure at about 45 inches per minute
)
- 2. Two rod controller drawers overspeed protection failure.
Thus the incremental probability of occurrence of Case A compared to Case III is:
)
P (Case A) = P1 (Auto interface board producing pulses that correspond to bank withdrawal. rates of 14 inches per minute or more) x 5
P2 (Failure of any two rod controller drawer r overspeeddetectors)-
Pi = 1/2 'A l T where A 1' is the total failure rate of auto interface board clock
) system. From Table.5-5-this value is 10.38x10-6/ hour.
T. is th'e time between successive test intervals.
In this case it is cons'ervatively assumed that the clocking mechanism;is tested once every year. Thus T is equal to 8760 hours0.101 days <br />2.433 hours <br />0.0145 weeks <br />0.00333 months <br />.- Based on'this
)
5-28
y Table 5-4 Component Failures That Contribute to the Failure of the Auto Interface Board Overspeed Detector for Bank Withdrawal Rates at 14 Inches Per Minute or More.
) Failure Rate (40)
Component 10-6/ hour U2, Quad 2 Input OR Gate 0.65
)
U3, Dual Bld Counter 2.88 08, Digital Comparator 2.88 U9, 12 Stage Binary Counter 4.62 U10, Dual J-K Flip-Flop 1.45 Ull, Dual J-K Flip-Flop 1.45 U12, Quad 2 Input and Gate 0.65
)
U14, Quad 2 Input NAND Gate 0.65 Total Failure Rate 15.23
)-
) i l
1 k
5-29 y .
x '
'v , .. - -:.a. ..ny . , -. .
.. .. ~. - . .
Table l5-5, Failure Modes and Effect Analysis of the Rod Controller Drawer Clock and Overspeed Detection Systems (Drawings 148J361, 148J385, 148J382)
Failure Failure Effect Component Mode
.. Drawer Assembly Dwg. 148J361
-R1, Potentiometer Beckman Failed High No effect.
Helipot'Div. .
3351-R-10KL.50ST- FallG Low No effect on withdrawal speeds. Single rod insertion speeds would be limited to 0.36 IPM.
Failed Open Voltage to V/F converter would increase from 4 volts to 4.8 volts.
Single rod withdrawal speeds would increase to 10.9 IPM. Clock would not run for insertion.
1 R2 Potentiometer Beckman Failed High. No effect.
- P Helipot Div.-
No effect on insertion speeds. Single rod withdrawal speeds would be 8 3351-R-10KL.50ST Failed Low j limited to 0.36 IPM.
Voltage to V/F converter would increase from 4 volts to 4.8 volts.
' Failed Open Single rod insertion' speeds would increase to 10.9 IPM. Clock would not run for withdrawal.
' Control Logic PC8 Dwg.
-148J382-
'VR9,'EenterDiodeIN825A
' Failed Short Voltage to.V/F converter would go to zero. Clock would not run.
~ Failed Open Voltage to V/F converter would increase from 4 volts to 9.2 volts.
Clock would run at a speed equivalent to 20.6 IPM.
C10$CapacitorComponent Capacitance Decrease Frequency of V/F converter will increase. Clock speeds equivalent to 45 IPM would occur when the lpF capacitance value decreased to approximately 0.2pF.
A1,(V/FConverter,Wavetet, . Frequency Increase As output frequency increased from 6 Hz to 30 Hz, rod speed would 120.021 increase from 9 IPM to 45 IPM.
Frequency Decrease- Rod speed would be less than 9 IPM.
____i_11_._. ...
. - -~.- - --
Table '5-5. continued Failure .
Component Mode Failure Effect Command Error PC8.Dwg.
~148J379
( LA1,' Amplifier Motorola, Output Failed to Rod speed would increase to 33.8 IPM.
MC1741CL. 115 VDC Output Failed to Clock would not run.
-15 VDC
.CR22.-Diode Motorola, Failed Open No effect
'IN914A-Failed Short Clock would not run.
(:{ClockPCBDwg.148J385-l 'M i
- l. '; Q90 Transistor RCA, 2N1711 Open Clock will not run. .
Short Clock will not run.-
~Q10," Transistor RCA, 2N1711 Open 'No effect. l Short Clock will not run.
l: -Q11. Transistor RCA, 2N1711 Open Clock will'not run.
i Short Clock will not run.
Q1'2, Transistor RCA, 2N2646 Open Clock will not run.
Short Clock will not run. I j _Q13 Transistor RCA, 2N1711 Open Clock will not run.
1
~
, Short- Clock will not run.
l l-I
- ---v -- - - m u ; e --- -- ~-
9> p
.6 .: s :
- y, .
-s. x
\.
- n. t A
Table '5-5 continued Failure -
Component Mode Failure Effect
Command Error PC8.Dwg.
148J379~
A1. Amplifier Motorola, Output Failed to (tod speed would increase to 33.8 IPM.
MC1741CL t15 VDC Output Failed to
~
Clock would not run. ~
-15 VDC _~
CRE2, Diode Motorola, Failed Open No effect
.IN914A Failed Short Clock would not run.
T Clock PCB Dwg. 148J385 u
)Q9,TransistorRCA,2N1711 Open Llock will not run.
Short Clock will not run.
Q10, Transi'stor RCA, 2N1711 Open No effect.
Short Clock will not run.
Q11. Transistor RCA, 2N1711 Open Clock will not run.
Clock will not run.
Short
-Q12, Transistor RCA, 2N2646 Open Clock will not run.
z Short ,., -
Clock will not run.
Q13. Transistor RCA,;2N171k Open Clock will not run.
W .
Short , _
Clock will not run.
x s
\ o e
L[
- / .
~
, D. , .v- V v v v v v .v .vu v v i
J Table l5ES continued Failure .
. Component ,
Mode Failure Effect Dwg. 148J385.(Cont'.d).
.Q1,2 Transistor RCA,'1N1711 Open Overspeed detector will disable rod motion.
! - .Short Dverspeed detector will disable rod motion.-
'.Q2, Transistor,GE.:2N489
. Open 0verspeed detector will disable rod motion.
Short' Overspeed detector will disable rod motion.
'.'Q14,' Transistor ' RCA,' 2N1711 .0 pen Clock will not run.
Short . Clock will not run.
. v. . '
- a, - . . .
Open .0verspeed detector disabled.
%).Q3,{TransistorRCA,2N1711. .
fg s
- Short . .
.Overspeed detector will disable rod moti m.
w w . .. .
JIC1; Flip-Flop:Motorola,; Pins 5, 6, or 10 Overspeed detector will disable rod motion, e i MC664 High or Low '
' ' _. y
' K IC2h ouad!2iluput MAND - Pin 3 Low or High Overspeed detector disabled.
^
~
WlMotorola .MC668' 1 Pin'6 High' Overspeed detctor disabled. .,
rw - .g , . ,
E -
- * ' Pin 6 Low Overspeed' detector will disable rod motion. ; 4
- 4 . . . , ..
Overspeed detector will disable rod motion.
Ti ..j; .
o u, Pin.8-High-n- 77 .. ,
]
9, ~ Pin 8 Low ,
.Overspeed detector disabled. ,
. .. .vm .
r . jlC3 M iip-flop Motorola '
, iPins:5,6,or10 Clock will not run. -l
- High or Low : -
~
" MC664--
'i . . . .
- l. . t. , ,
g g. m .
kh -
- '-i . *
'- 1
'*p,7 -
>/. ,.
. iLA .UE W ~ ~~ ~ ~ 7 V U U-- U N .U' , V 1 s
4 Table [5-5, continued
.,3 Failure p" :
., Component Mode' Failure Effect W , ,
Ng ;Dwg..148J385 (Contd)
?IC4,' Quad 2~ Input NAND. Pin'3 High Overspeed detector will disable rod motion.
i Gate Motorola, MC668 :
. Pin 3 Low 50 effect.
Pin 6 High No,effect.
Pin 6 Low. Overspeed detector will disable rod motion.
. VR1, Zenier Diode' Motorola,
'Open .0verspeed detector disabled.
'IN5225A Short' No effect.
VR6, Zenier Diode'Motorola,. Open- Clock will not run.
- IN5225A.
- Short -No effect.
~
C3,CapacitatorCornelly Capacitance. Decrease- .Overspeed detector permits faster clock rates before stopping rod
' Dub 111er, WCR05W2 motion. Overspeed detector disabled.
, (CR4,LDiode Syntron, S1010 -Open .0verspeed' detector will disable rod motion.
Short LC3 charges faster. . 0verspead detector disabled.
cCRS, Diode Syntron,1S1010 .Open. !Overspeed detector will disable rod motion.
Short' No effect.
i-CR6', Diode Syntrom, S1'010 Open'. Overspeed detector disabled.
Short No effect.
.CR8, Diode Syntron,,1S1010- Open~ No.effect. 0verspeed could be latched via K1 '
-Short- No effect.
s I,
- _ __x___-__ __ _ _ _ _ . - _ _ - _. . ____ _ _ _ _ _ _ _
i Table 5-5.* continued 1
Failure .
Component, ,
Mode Failure Effect p~
Dwg.; 148J385 (Cont'd)
J.CR9, Diode Syntron, S1010- Open or Short No effect.
CR10, Diode Syntron, S1010 Open Overspeed detector disabled.
No effect.
Short
-Q4, Transistor,RCA, 2N1132- Open No effect.. Overspeed.could be latched via Kl.
. Short Overspeed detector would disable rod motion.
~
' 4Q5, Transistor RCA, 2N1711 'Open . Overspeed detector would disable rod motion.
- T; -
Y (-
Short No effect. Overspeed could be latched via Q4..
VR2, Zenier Diode Motorola,. Open .Overspeed detector would disable rod motion.
IN5225A- .
Short -
No effect.
Kl.. Relay C.P._ Clare, Coil Open or: No'effect other than possible spurious operation of the overspeed CR4TN-1009 . Contact Failure' _
detector. Overspeed could be. latched via Q4.
CR11,.. Diode Syntron, 51010' :'Open .No effect.
.Short Overspeed detector would disable rod motion. .
CR13,; Diode Syntron :Open' No effect. Overspeed could be latched via Q4.
.Short' , :No effect.
?CR14, Diode Syntron, S1010 Open or.Short No effect.
4 CRIS, Diode; Syntrori,: 51010 .0 pen'or.Short- No effect.
~
, -CR16, Diode Syntron, S1010 Open or.Short No effect.
.q Table 5-5l continued
-tailure .
. Component Mode Failure Effect !
Dwg. 148J385 (Con.t'd)
'CR25, Diode Syntron, S1010 .0 pen or..Short No effect on clock speed.
~CR26,. Diode Syntron,-S1010 .0 pen or Short No effect on clock speed.
CR29, Diode Syntron,'S1010 Open-or Short No effect on clock speed.
CR24, Diode.Syntron, S1010 Open- Clock will not-run.
Short' No effect.
.CR27[DiodeSyntron,S1010' -Open. Ko effect.
y ,
Short Clock will not run.-
K. .
LCR28, Diode Syntron,'S1010. 0 pen Clock will-not run.
No effect.
'Short.
CR34, Diode.Syntron, 51010 Open or Short . Clock will.not run. ,
'CR35, Diode'Syntron, S1010 'Open . Clock will not-run.
Short No effect.- ' '
LLogicErrorPC8[Dwg.[148J376
-Q3, Transistor RCA, 2N17114 'Open ! Rod motion disabled.
- i. Short' '0verspeed detector disabled.
Q44 Transistor.Motorola, .Open~
Rod motion disabled. '
'2N4900.- '
'Short- Overspeed detector disabled. ,
V v v u v v- v v . v v., v 4
Table,!5-5! continued Failure '
Component. . Mode Failure Effect
, ; Dwg..148J3/6 (Cont'd) .
.VR8, Zenier-Diode Motorola, Open Rod motion-disabled.
- INS 2338 s..
Short Noeffect..
t
+
J S
.. g j '- .
J. ,
+
7
- . t w
Q ? 9 0
b
\
a b
t 4
S
a i !
l Table 5-6 Component Failures That. Contribute to the' Failure. of the h- Rod Controller Drawer ~ Overspeed Protection Such That Rod Measurements in Excess of 10 Inches Per Minute is Permitted Failure Rate (40)
Component 10-6/ Hour Q3, Transistor 0.05 IC2, Quad 2 Input NAND. Gate 1.04 VR1, Zener Diode 0.24 C3, Capacitor 0.01 CR4, Diode 0.10 CR6, Diode 0.10
. CR10, Diode . 0.10 Q3,Short 0.05 Q4,Short 0.13-
[ Total Failure Rate _ 1.82.
s 4 ,
s b
- r
- 1
.s?
., s
t
/
P1 = 4.54x10-2/ year
,i
~P2 = (15)(1/2 A2 T)2-where the factor of 15 corresponds to the combination of any two drawer; ,
overspeed detectors. from the total of six that can fail and A 2-is the failure rate of the rod controller drawer overspeed detector. From Table 5-6 this value is equal to 1.82x10-6/ hour. ,
Thus P2 = 9.53x10-4/ year
) and P (Case A) = 4.32x10-5/ year:
This implies that in the scenario for Case A, the-probability of-reactivity
)
insertion at a rate of 15 to over 20 cents. per second:is about four to five '
orders of magnitude smaller than the probability of reactivity insertion at a rate of about 12.6 cents .per second. - .
Let us now look at another scenario that could resultiin ~a
) reactivity insertion rai:e of 20 cents per second or. more. The multiple failures necessary for this case are:- -
Case'B' Failures 1 through 5 of Case III'
- 1. ,
- 2. Failures 'of. the auto interface board clock to run- ,
f- 3. : Single / group comand line .failing high ' -
- 4. Failure of one of the rod' controller drawer. clobus and.1'ts associated.overspeed detection mechanism.; ,
); . . .
In this scenario'since the~ auto interface ; board clock is. failed,<
. the rod controller drawer. gets'an out- signal: and no' rod movement pulses.' '
~
Thus, -it' acts as if 'it is in .a sin' le gmode -and produces- its own clock '
~
pulses. At th'is' point it is ' assumed that 5 -out of 6' control rods get pulse's1
~
I .at 9. inches, per minute which is the maximum rate fo'rf a'-single' rod movement
- J .
~
4 0 ,
. 5-38~ -
= . _ _
k r
without overspeed failure, and one of the drawers' clock and overspeed t- detection fails so that one rod is moved at the maximum mechanical speed of 45 inches per minute. Again the actual rod withdrawal 'is anywhere between 14 inches per ~ minute to the maximum mechanical speed of 45 inches per minute.
Thus, the maximum total control rod movement is anywhere betraen 59 inches per minute to a maximum of 99 inches per minute which is higher than the approximate requirement of 86 inches per minute. These rod movements correspond to a reactivity insertion rate of about.14 cents per second to 25 cents per second. Table 5-7 shows the component failures that contribute to f ailure of the rod controller drawer clock mechanism f ailure. Note that
) these component failures- are based on.the Failure Mode and Effect Analysis of Table 5-5.
The incremental ~ probability of occurrence.of Case B compared'to case III is:
P (Case B) = 6 P3 (One rod controller drawer clock producing pulses that correspond to maximum mechanical
~
speed) x
-'P4 (Rod controller drawer.overspeed detector corresponding to the above drawer has failed)
P3 = 1/2 A3 T -
where A3 is the failure rate of any rod control _ler drawer clock. From Table 5-7 this ' failure rate is 5.42x10-6/ hour . . The' time between. consecutive tests
.T is assumed to be one year. Thus,_
) P3 = 2.37x10-2/ year
'P4.= 1/2.A'4 sa 'T
~~
). w'here'i4 is -the 'f ailure rateL.of' the rodi controller [ drawer overspeed .
detector'. 'From Table 5-6 th'is failure rate is 1'.82x10-6/ hour andi
. P4=.7.97x10-3/ year. - -
, ( .
, y ,
{ .
L5-39 t ,
-., , s
+ + w-Wwy s.g g ,,e -g y g. .A
1
?
l
- v. Table h-7 Component Failures That Contribute to the Failure of the Rod Controller Drawer Clock Mechanism i Failure Rate '(40) 3 Component.
10-6/ hour
'VR9, Zener Diode 0.59 .
, C10, Capacitor 0.00~
A1, VIF Converter 2.35 A1, Amplifier -
2.48 Total Failure' Rate . 5.42 W
4 4
h
~'
. c.
~ ~
g 9 %
4
.i <
g
(?
4 s , .c ,
, f. ,
~
S
- I
~
7g4,f7,
[,. y .
N 4 q ,48 g % ', Dr,
)/ 'l Thus, the overall incremental probability of -occurrence of Case-B compared to Case III is equal to
~ ~
P (Case B) = 1.13x10-3/ year j It is clear that th'e incremental probability of reaching Case B is higher than case A and so it is more limiting.
Looking at the results of the scenarios discussed in this section it can be concluded that the probability of bank withdrawal rates- that 1 correspond to reactivity insertion rates of'about 14 cents per second to 20 cents per second is at least about three orders of magnitude smaller than the probability of scenarios that result in a reactivity insertion rate of about 10 to 12 cents per-second.
).
).
6 t
, 1 2
- u *
-)
G 1 g
d J
4
~
~
- 5.4 Relativ'e Likelihod o of a Transient' Overpower (T0i))/ Loss of Flow'(i5F)
Sequence . . _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _
A: separate but related issue concerns the possibility.that a TOP 3equence-initiated by inadvertent control rod withdrawal could :be accompanied by reactor coolant pump trip, thereby creating a combined T0P/LOF accident. In the classical TOP accident, after initiation of-reactivity insertion mechan'sm .the signal for scram is postulated to fail.
Since the same signal is also responsible for tripping of the main coolant' pumps, it is assumed that pump tripping mechanism will also fail. Thus the-p scenario consists of continuous reactivity insertion while main coolant pumps are still running. But if the probability.of pump. trip is significant then the latter-type of accident, namely combined TOP /LOF,: generates a more severe challenge to the plant than the." classical"-TOP, i.e., it could possibly lead to a more energetic accident. The issue of concern here, however, is whether the probability of a T0P/LOF is sufficiently low, in spite of its more energetic character, that the more.likely. TOP driven by continuous reactivity insertion should be considered the bounding HCDA scenario from the standpoint of risk. . This depends somewhat on the most-likely rates of reactivity insertion:via rod withdrawal, the' subject discussed earlier. ,
Let us now consider' the relative likelihood that'a TOP might be accompanied by ~an LOF because of reactor coolant pump trip. Note ~ that we-have not performed a thorough and independent analysis of'the system.;
Rather, .we have discussed system design and operating characteristics with the license applicant's persononel, including the system designers. Our.
attempt here is to explain the basic technical issues and to comment on the, t credibility of th'e applicant's assertions that-the' T0P/LOF:is an event of extremely low probability.
The scenario of immediate interest:begins; with' inadvertent withdrawal of one or more control rodsL with a subsequent. continuous insertion of reactivity. There'are several sequences of. events that can-
- follow depending on the failure of the partaicular; subsystems of- the reactor -
shutdown system' as.it is. delineated in Figure 5-5 (40). . Following the.
. reactivity insertion:there.are-several.sensois in the teactor s that;are ,
- designed to detect'the increase- in power. The' primary Reactor- Shutdown g e y
t A *
- - 1 1
I i
i
) '
REACTIVITY INSERTION i
I 1
l 1
PRIMARY REACTOR l SHUTDOWN SYSTEM REACHES THE TRIP POINT SASED ON 115%
I POWER TRIP POINT -
i t-PRIMARY REACTOR PRIMARY REACTOR PRIMARY REACTOR SHUTDOWN SYSTEM SHUTDOWN SYSTEM SHUTDOWN SYSTEM SCRAMS THE ELECTRICAL MECHANICAL REACTOR ,
. FAILURE FAILURE
)
ACCIDENT CONTINUOUS TERMINATED REACTIVITY I ION -
INSERTION STOPPED, PRIM ARY -
k . PRIMARY PUl[lPS S D RUNNING A
SECONDARY SECONDARY
/ REACTOR- REACTOR SHUTDOWN SYSTEM SHUTDOWN SYSTEM REACHES REACHES-TRIP POINT TRIP POINT NEXT PAGE NEXT PAGE 1
1 Figure 5-5. DIFFERENT SEQUENCY OF. EVENTS FOLLOWING A ROD WITHDRAWAL ACCIDENT y . LS43 ,
SECONDARY REACTOR SECONDARY REACTOR SHUTDOWN SYSTEM SHUTDOWN SYSTEM j
REACHES TRIP POINT 2 REACHES TRIP POINT SECONDARY REACTOR SHUTDWON SYSTEM
) l SECONDARY REACTOR SECONDARY REACTOR SECONDARY RSS SECONDARY RSS SHUTDOWN SYSTEM SHUTDOWN SYSTEM i un Ano } ELECTRICAL MECHANICAL ELECTRICAL FAILURE MECHANICAL FAILURE FAILURE FAILURE
) B PUMPS TRIPPED, PUMPS TRIPPED, REACTIVITY. REACTIVITY CONT!NUOUS INSERTION REACTIVITY INSERTION, INSERTION STOPPED- STOPPED PRIMARY PUMPS RUNNING
)
PRIMARY-SECONDARY PRIMARY SECONDARY j i TOP l INTERLOCK SYSTEM INTERLOCK SYSTEM i LOF l l LOF }
OPERATES CORRECTLY FAILS C F. G' PUMPS TRIPPED, PUMPS TRIPPED,
] CONSERVATIVELY CONTINUOUS' REACTIVITY INSERTION REACTIVITY INSERTION STOPPED
~.
- l : LOF - I i TOP /LOF I'
~D 'E Figure 5-5.' (CONTINUED)
- 5-44 7 .
. . . .. . . . . . .-... - - -..w - . - .....-. - . . . . - - - - - .
)
a
. System gets a sc' ram signal as soon as 115s rsted power i.s reached. If the f
( scram. signal trips the' primary reactor shutdown system, the accident is terminated as is shown in sequence A. -
There are two ' alternatives to this. First there can be:a primary reactor shutdown system electrical failure in which case the scram signal does-not reach the primary reactor shutdown system. The second possibility is primary reactor shutdown system mechanical failure. Following the sequence of. primary reactor shutdown system electrical failure, it is argued that since the same signal. disengages'the primary control rods and trips the
) primary coolant pumps 'then f ailure to scram mu'st be ~ accompanied with f ailure to trip the pumps. In other words for-the pumps to be tripped an additional: failure in the electrical circuit from the point of scram _ signal generation to the point of pump trip is necessary which would make this event much less likely than failure to scram and trip the pumps._ Thus, at
> this point reactivity is being inserted.to the core and primary ~ coolant
~
pumps are also running. Following this the. secondary reactor ~ shutdown system will reach its trip point in a short period of time. Again there are three alternatives here. First.if the secondary. shutdown system scrams-the
~
~
) reactor, the accident' is terminated .as is shown in sequence B. 'The second alternative is that there;is an electrical failure in the secondary shutdown system. In this. case the reactivity is'being inserted continuously and pumps are running. Thus we have_ the classical transient overpower scenario shown.as sequence C. The last alternative ~ 1s the mechanical- failure of the..
secondary shutdown system. In;the current design ofsthe CRBRP shutdow'n.
-system, there is an interlock mechanism between the primary and secondary shutdown systems.. Based on this interlock mechanism,-if the secondary shutdown system reaches the trip point land receives a signal for scrama-
) backup signalf is also.sent to the primary . system to make.sure' it has -
scrammed. 'Sirce the electrical portion of the secondary shutdown .sys' tem .is functioning this will; trip the pumps and2 scram the reactor. Thus; realisti-> ,
cally a- protected lossLof flow condition ;isHreache'd.D The applicant' .
. Lindicates. that if. for? whatever- reason the' primary reactor _ shutdown. system.-
does 'not -scram the' reactor, this Jinterlock mechanism "atT.least should.jstopf the reactivity . insertion. .Thus,s conservatively an . unprotected lossiof flow-accident. can result ~ as is _shown in sequence.D.' ;Iff this ' interlock -mechanism" fails, then we get :into a situation lwhere-reactivity;is being inserted into -
k
~
the core,' both primary. and'-secondary shutdown; systems have failed to scram
~
s f '
8 i . ,y , j r ~i l
1 4
l
, -th reactor, and the pumps are tripped due to secondary shutdown system trip signal. In this case, a combined T0P/LOF has resulted as is shown in.
sequence E. .
~1 The last sequence that must be considered is the mechanical failure' of the primary' shutdown system following a scram signal as is shpwn in Figure 5-5.. In this case the pumps are tripped since t'he electrical portion of the primary shutdown sys' tem is functioning but no reactivity insertion is possible due to mechanical failure of the primary shutdown system. Next, the secondary reactor shutdown system reaches the' trip point. ,
t If the scram.by the secondary shutdown system is successful the accident is terminated as is shown in sequence B.. Otherwise there could be either an electrical or mechanical failure of the secondary shutdown system. 'In both 4
cases, pumps are tripped and reactivity insertion has stopped. Thus, we have a loss of flow accident as is shown in sequences F^and G.
F Looking at Figure 5-5, it can be seen that starting with a rod
~
withdrawal accident, there are eight end po'ints for the various accident-sequences. In three cases the accident is terminated, .in another three o cases a ioss of flow accident results.' In one case a transient overpower accident and in another case a combined transient overpower, loss of- flow accident results. For the combined T0P/LOF.to happen, there needs to.be.
- 1. An electrical-failure of the primary reactor shutdown system, and
- 2. A mechanical failure of the secondary reactor shutdown system,'and< .
- 3. Failure of the interlock between the primary andl secondary--
): shutdown system.
In contrast for a classical TOP-to happen, there need to be ,
- 1. ~An electrical' failure of the' primary reactor shutdown system,,and-
- 2. 'Anelectricalfailureofthesecondahyreactorshutdownsystem.
~
^
Since the secondary shutdown. system 'is. designed to 'be able to scram ~the L ' reactor with t'he niost reactive contpol rod stuck mechanical failure of tiwo A
-~
es l
l or more control rods is necessary to fail to scram the system. . Complete. l l failure of the secondary scram system consists. of essentially.a mechanical common mode f ailure of five secondary contro.1. rods. Compared to the I electrical f ailure' of' the secondary shutdown system, this common. mode -
mechanical f ailure of the secondary shutdown system is judged to be very unlikely.
Thus, from a qualitative analysis of a possible sequence 'of events following a rod withdrawal accident, it seems that the combined T0P/LOF accidents are much less ~likely than either the TOP or LOF accidents.
).
L
)
). -
f.!
g.
. a s
t
)-- .
s a
~
)J
^
^
. .-T5!47" -.
~
y
')
5.5 Sumary ano Conclusions
,) - . . _
One of the critical parameters in the analysis of the Clinch River Breeder Reactor Plant's (CRBRP) response to a transient overpower (T0P) accident is the rate of reactivity insertion in the core as a result of the 3 TOP initiator. This is due to the f act that at high reactivity insertion rates the location of the fuel pin failure is closer to the central region i of the core. This results in the fuel movement toward the center of the core and thus creation of a more reactive configuration that could possibly lead to an energetic as opposed to a benign termination of the accident.
3 Current studies indicate that reactivity insertion rates of 20 cents per second or more are necessary to create an energetic hypothetical core dis-ruptive accident (HCDA). To investigate the possibility of such high rates of ~ reactivity insertion and its likelihood compared to lower rates of 3 reactivity insertion several rod withdrawal accidents which are the primary means of reactivity insertion in the CRBRP were analyzed. It was shown that to get reactivity insertion rates of about 10 to 12 cents per second, about seven subsystems of the reactor control system must fail. To get to reactivity insertion rates 'of 20 cents per second or more an additional 3 three or four subsystems must f ail. The two most likely scenarios that could result in reactivity insertion rates of 20 cents per second or more were analyzed in detail. It was shown that rod withdrawal accidents. that-could lead to a reactivity 1nsertion rate of about 14 cents per second to 23 e cents per second are at least three oruers of magnitude less likely than rod withdrawal accidents that lead to reactivity insertion rates of 10.to 12 cents per second. It is also crucial to point out that although the numeri-cal value of the probability of rod withdrawal accidents that lead to
, reactivity insertion rates of about 10 to.12 cents per second was not-J calculated, based on the number of failur'es of subsystems required for this accident and the type of electronic circuitry tnat have'to fail, it is reasonable to conclude that this event by itself is very unl.ikely. Thus, overall the probability of rod withdrawal accidents: resulting in high reac -
J tivity insertion. rates'of 20 cents per second or more is judged to.be extremely low.
A separate but related topic concerning the relative likelihood of a combined transient overpower (TOP)-and loss of flow (LOF) accident was ~
analyzed. In the classical analysis of the, TOP, it is. postulated that y 5 failure to scram also results in failure to . trip the main coolant pumps I'
~
since the same signal scrams the reactor and trips the pumps. A qualitative analysis of the sequence of events that follow a rod withdrawal accident was performed. It was shown.that among eight possible sequences of events
. leading to various outcomes such as benign termination of the accident, TOP, LOF or T0P/LOF, only. one sequence could lead to. the combined T0P/LOF acci-f dent. For this sequence to happen a combination of thre'e failures must occur. These f ailures include, electrical failure of the primary reactor .
shutdown. system, mechanical failure of the secondary reactor shutdown system
. and f ailure of the primary-secondary interlock mechanism.- Based on our .
). Qualitative assessment of this sequence of events compared' to the sequence-of events that could lead to a T0F or LOF it was concluded that the combined.
T0P/LOF is much less likely than TOP or LOF.
?
)
l l
).
9 5-49 b .-
. p -
y 6.0 Performance Review of the CRBRP Containment Cleanup System 6.1 Introduction The CRBRP Containment Cleanup System (CCS) is designed to remove i fission products and reduce offsite dose from gas releases in the event of a core disruptive accident. As was discussed i_n- detail in Chapter 4, following a core meltdown and' vessel and guard vessel melt-through, .the l
sodium molten fuel and steel will interact with the concrete in the cavity.
This interaction results'in production of considerable amounts of water !
y _ vapor and other gases such as CO 2 . The water vapor then interacts with
. sodium to produce hydrogen which along with other aerosols and fission. .
product compounds are transported to 'the upper containment. The hydrogen burns in the upper containment by interacting with the oxygen until all the ;
oxygen is consumed. At that point the hydrogen will continue to build up in-1 the upper containment atmosphere. To avoid any ' possibility of hydrogen explosion currently there is.a criteria for initiation of vent and purge i system once the hydrogen concentration reaches a level of 6%. At this point the proper functioning of the containment cleanup system is extremely *
)L crucial to avoid any possible release of radioactivity to the outside.
environment. The proper-functioning of the containment-cleanup system includes some very demanding performance requirements such as minimum cleanup efficiency of 99% for solid and liquid material and 97% for vapors.
k In this chapter a review of 'the containment cleanup system: .
including various issues that could affect the performance and efficiency of.
the system is presented. This review is focused on both the expected performance of- the CCS relative to its major design requirements of sodium
{ and fission product removal'and the reliability of the CCS.~.
In the'next'section the perfor'mance. requirements and the design features of the containment cleanup system is reviewed. The identif Pation-
, and evaluation of.the performance issues that could affect the efficiency _.of:
E ' the C'CS ~are presented .in' Section 6.3. Issue's related to the conditions and:
results of the small-scale . experiments land' their app 11'cability to the: .
" performance of the'CCS are discussed in this'section. Possible-areas of! '
!. concern 'or uncertainty related 'to fcctors such as fission productiremoval,
['~
sodium removal, internal hydrogen explosion ?line p' lugging, gas cooling; u .
l ~6-1. _
. 1 -
- requirements and over-all reliability of the system are also presented in this section. Finally, the conclusion, insights and recommendations are
- presented'in Section 6.4.
, 6.2 Performance Requirements and Design of the Containment Cleanup System 5
l The containment cleanup system for CRBR -is being designed by Burns .
I and Roe' based on performance requirements called out by Westinghouse (10).
The design draws its major concepts from systems tested by HEDL and bases
- its performance estimates on experimental data from these HEDL tests (41).
!. As developed by Westinghouse the CCS s' hall meet the following requirements:
- 1. The containment cleanup system ' efficiency shall be a minimum of i 99% for vented materials in th'e solid or liquid' state, 97% for j vapors (NaI, Se02 , and Sb23 0 ) subject to condensation in the j: cleanup system, and 0% for noble gases. These efficiencies shall
- apply when subjected to the vent rates shown on Figure 6.1 and f' containment atmosphere temperatures shown' on Figure 6.2 with' a
~
containment atmosphere density of 0.07 lb/ft3 (10). Beyond -150 l- hours, containment atmosphere temperatures up .to 250.0F shall-j apply. The CCS.shall be. capable of performing.all of its intended.
t functions in the presence of Ar, N2, H 2, H 20, CO, CO2 , 02 ,:Na20 ,
j N220 , Na0H, Na2 003 , fission products, and compounds resulting from j fission product reactions.
p
- 2. The containment cleanup system shall remain functional. at an
! aerosol mass flow ra'te of up. to 5,600 lb/hr. and aitotal mass of 1
~300,000 pounds of : aerosol entering the cleanup - system. 'Thei principalconstituents'ofthc4aerosolare(NaOHandNa2,<ther 0 proportions of which can vary from O to 100%.of the-aerosol,~ and-Na2003 which can vary from 0 to 8% of the. aerosol.-
- --
- The aeros'ol particle properties are:. ,
+ p 4-
?
g . ,
~
1 i
~
6-2
______'_________.. m. . , . . _ . . . -
. _ , _. . , , . , , _ . . _ , - _ . . - -,m
(*
} 28,000 '
26,000 -
} 24,000 -
22,000 . -
) 20,000 -
18,000 -
) 16,000 -
5 D 14,000 -
1 3 #
j 12,000 -
E w
' > 10,000 -
)-
8,000 -
6,000 -
3 4,000 -
2,000 -
0 I I I '
O 20 40 so 80 100 120 140 180 TIME (HOURS)
)-
. Figure 6.1. ~ MAXIMUM CONTAINMENT. VENT RATES 6-3'
~ ~~ ~~
a-B~ ;
l 5
i 1600
)
" r 1400 -
1200 -
F 1000 -
E
) Q 800 -
E n.
2
- 600 -
)
400 - .
f 200 -
) 6 0 I I I I i 's i 0 20 40 60 80 - 100 120 140 160.
TIME (HOURS) .
).
Figure 6.2. MAXIMUM CONTAINMENT ATMOSPHERE TEMPERATURE
+
'% a 6-4 f
l l
MassMeanRadius(microns): 5 < r50 < 10 !
AerodynamicEquivalentRadius(microns): 2.3 < AER < 4.7 I
- Density (g/cc)
- 2.1 < p < 2.5
- Mass Geometric Standard Deviation
- 3.0 < c < 3.5
- 3. The containment cleanup system shall remain functional at fission products power levels in the accumulated filter aerosol of:
~
3 Time Fission Product Power (hours) (MW) 0- 0 24 3.1x10-5 48 0.16*-
, 96 0.16*
.i 240 0.11-720 - 0.05 i
- Maximum value.
l 4. The containment cleanup system . des'ign sha.ll be capable of performing all its intended functions with the following chemical.
and physical states of the 10 most radiologically significant fission products _in the containment atmosphere:
L 9
4
- =
6-51 .
I s
l
l L
- Maximum Percentage of the Fission Products by Chemical and Physical Form
)'- l Elemental 0xide Element Vapor Liquid or Solid Vapor Liquti or Solid Se 1% 1% 100% 100%
Rb 1 1 1 100 Sr 1 1 1 100 Zr 1 1 1. 100-j._ Sb 1 1 100' 100 Te 1 1 1 100 Cs 1 1 1~ 100 Ba 1 1 1: 100 Ce 1 1 1- 100 .
) NaI I 1 1 33 100~
- 5. The exhaust from the containment cleanup system shall have a temperature compatible with operation' of the TMBDB Exhaust-Plant Effluent Radiation Monitoring System.
- 6. The containment' cleanup' system operations;shall be'by remote
[ manual actuation' from th~e control room.
- 7. The containment cleanup system shall have a-primary mission life of 2,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> with a secondary mission life of 5,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />. - ,
).
To meet the above requirement the CCS.has been designed _similarly-.
to an' experimental model evaluated by HEDL (41). The system has ;three ' air-cleaning elements: a spray / gas quench. tower,7 a venturi scrubber:and'a -:
b ,
~
polypropylene filter; These' are supported by,auxilliary pumps, and a single - ,
. holding tank. 'A schematic for this. design is shown in Figure 6.3.1 l l
Hot gas with a temperature' range of_700 to 1100oF containing
~
[ ,
sodium particulates enters the quench tower' and is washed'and cooled by al ou i.
l P y
e .
l
\
p . -- . %
L d -._J L_..__
7: __ .
~ ~
/ , ,
/
)-
AIR INTAKE ,
./
[
./
.c I
l g; 1,/ ,
l PURGE All : ----
) l Ii, CONTAINMENT ISOLATION DISCHARGE :
GAS I VALVES k ~
l,_, VENT
)
%x Q :=::,=
BLOWER ,
1 \
l
- QUENCH TANK a
_ l
_ E.2 ; 2 .
o o VENTURI o' I t
SCRUB 8ER ,,r 1 3r ir l
o MAKEUP -
i
)f- ,, WATER I
^ -~
SOLUTION TANK .j l SUPPLY RSB* RCS SOLUTION -._. J. .
PUMP ,,
).
i
).
' Figure 8.3.. SCHEMATIC OF THE CRBRP CONTAINMENT CLEANUP SYSTEM -
\
T .
l
~
. '6-7 i
); '
.= - .. .
P recirculating spray of water containing Na0H (produced primarily from the
- y. reaction of Na20 in the' gas with H2 0). Upo'n exiting the quench tower the gas enters the venturi scrubber where more particulates are removed and the~
temperature lowered further using the same recirculating solution fed to the quench tower. Finally the gas enters the polypropylene filter section where ,
the submicron particulates are- removed. The filter is constantly sprayed
) '
with the same solution used in the quench tower and the venturi scrubber.
The liquid for cooling and scrubbing the gas is pumped from a common holding tank to all three air cleaning elements during the gas purge cycle.
) At the start of the purge the tank contains 130,000 gallons of water (no Na0H or fission fragments) to pump through the gas cleaning elements. As the purge continues the sodium compounds.in the gas react with the water to form Na0H. Reactive fission products are also dissolved or entrained in the water and eventually removed to the holding tank. During the reaction and
) gas cooling processes in the quench tower and the venturi scrubb_er some water evaporates. The loss in solution volume froin evaporation is replen-ished through makeup water added to the holding tank. No active cooling is provided. Heat is removed by natural convection from tank and piping sur-
]- faces and by the addition of makeup water.
D=
1 W
6-8 -
- 3. ' ' ,
...+.-,.e . + . ,,
v, ;
-6.3 Identification and Evaluation of Performance Issues l
) ,
The containment cleanup system is responsible for removing sodium <
and its associated radioactive materials from containment vent gas. This will reduce the consequences to the public by f actors of 30 to 10,000 depending on the degree of removal. Removing both large and small particu-
) lates from the vent gas for an extended period of time is key to the per-formance of the CCS. To achieve this performance, all components of the system must function as intended. In the following paragraphs we identify the major issues related to operation of the CCS and review several in
) detail.
The b'asic purpose of the CCS is to remove particulates from the vent gas to minimize their release to the environment. The analysis.by Westinghouse CRBRP-3 (10) indicates that the particles should have an aero-
) dynamic equivalent diameter of about 5 to 10 microns. Their analysis also indicates that sodium densities as high as 50 or 60 g/m3 could be associated with the gas stream entering the CCS.
y The expected performance of the CCS in removing this sodium aerosol was reviewed based on general technical literature and specific experiments conducted by HEDL (41). From an overall standpoint, the selection of the quench tower, the venturi scrubber 'and the polypropylene f abric filter system appears reasonable for the following reasons:
- 1. The initial air cleaning equipment, the quench tower, is expected to be moderately efficient (greater than .95%) for removirg large particles (greater than 5 microns). This is based on the general
?
literature (42) and on the specific tests. performed by HEDL. In the HEDL tests, about 97% of the sodium particles having an average diameter of 3 microns were removed in the quench towers. Further-more, this equipment is expected to be versatile in its ability to handle input streams with variable sodium aerosol loading.
- 2. The system of two wet scrubbers (the quench tower. and the venturi scrubb'er) followed by the fabric filter should remove the particle si tes expected in the' purge gas. The wet scrubber will re.sove a.
); major fraction of the particles greater than about 0.5 micron. in '
6-9 -
=_
L r ,
a ;
., 4 size while the fabric filter will remove particles as small as .01 , !
- _'p ' j. ,
microns. Again, this general performance is reported in the general technicai literature (42) and was seen in the HEDL tests. ,
,j l The perfe$ nance of the CCS in removing sodium aeroscls is estimated to be greater than the 99% ; efficiency requirement. This is based on literature estimates and is in agreement with the HEDL tests. A comparison of some of
~
the relevant design (scaling) parameters for the quench tower is presented
-in Tabl,e 6.1. One parametbr change, mean particle size, should result in CCS qu'ench tower performance which is.better than that experienced in the
) HEDL tests. Two parameter changes should result in CCS quench tower per-formance which is poorer than the HEDL tests.
The first parameter is Na concentr ation e in the aerosol and the T
ser.cnd is gas to liquid (ficq "atio. While no quantitative estimate of the
? degradation due to thesq two factors is available, the degree of degradation
'si not expected to be majo[ based on an examination of the HEDL results.
The fourth variable shown in Table 6.1, namely residence time, shows that the proposed residence time is> in the- range tested by HEDL.
).
A scaling analysis, which does not appear to have been performed, involves the calculation of power input. - This appears to be a very appro-priate analysis for this syste's (43,44). Tnis analysis requires detailed information on gas and liquid'frfction losses in. the .. system.
L ,
Another parameter not'shown in the table which could have some impact on quench tower dfficiency -is the concentration of sodium in the quench tower solution. . Higher' sodium concentrations in the quench solution y could reduce the rate of_ reaction / dissolution of sodium particles- and conse -
.quently reduce the scr6bbeiefficiency'.if reaction rate is a controlling f.
performance parameter. Thisldoes not, however, appear to be the case based.
' -~
on the analysis of the' limited HEDL> experimental results.: '
r b Additional details wbch are not' available concerning -the design ,
7 .ofthe.aircleaningcomponentsintheCCSinclude:
c o- number, po ition and type of: spray nordesWithin:the quench tower 47, .h -
n
+
Y ? -
(
4 6-10 W i,;
';. f , ,
f,: ~
.. ~-i
, f
~ U
.y
+
- * ?
< - . b ^
3 W
4 Table 6.1 Comparison of Design and Scaling Parameters :'
~ for the Quench' Tank -
,o CRBR- -
b Containment. ..
Cleanupfi. Performance' , * .
s'
' ~ '.
Impdt HECA. System'- . 7f
Experimental Exprp.ted" Cor. pared to 3 Conditions Conditions. Results ofJ ' - - .
Parameter (HEDL"ank) (CRBR CCS) HC0!: Tests Maximum Na loading in 10; .. 50 Poordr~ '
t 1 "
input aerosol (gria/m3) . ,
D ,~ f of -
4 . / ~
Mean Particle Dicmeter (p) 23/ ,
- 0-20 . Better .
?
y
, r.
Na flow / Liquid flow (9Na/1) .1-3 2d' -~J -
Porder -
-[,,
,. .. .. . , ~ ,
3 s.
j
~a
//, .
Residence time (sec) 4-31 - 16 -
No Charige -
/
, p. , v g- ,
(w (' q. # %
a
[ .'
u#g
., > y. - ~-_
w fr 6 j ,,.h
$ %c y ,
, i .
~
) s,J 9 / ,
,- w he g
""Q. M yO l ' s. .; '-r w
e
^-
.. s . .. 1 , _ . .
g!' A b kl
,-v. y ' e'"u"',, .
,y
^ b' *~,
. p ,
p.*
, , - e" , , m. _ ..-** ./. -
,e, ' * .+ 's eP
,1 ,_
, s. #
h W, - ~ l :-
8 ;( - ,
,*g. > rL ? i l - ;-f' , j,.
- * ,1 9 ,
,.') h ' / >r_; ? " ~'
c
.t
- ~ <; ,+
p -y:gn i ...
- ;j - ,
, 'r. , ,
c{ r- ; .
l.
>- > , , ~ Q
~
f' ' 'O f. ! c; , 'j.y ' ~~
_ v ,j. y 4 qe#'
e/~ ,, g,. ,, p~
[ ,, , * [( U#Q (
- p <
%r sT /
.t: .$ Ih 3
.? ;7" 7 p ;,
- g. ,.
Qg,. .z y .
' r.y a .
[ 'k A, , # [ b '**"'# ;,
.,n ,- L,#
~
g ;
Y7y g <, ,n~
. t.
~ /,
- q ., # .j# 3*/# >-
i
'? M
,- ,f~ ;,.r* _ .i.; *D
- c, s. '
a s ,
6-11. / % s ,m,;
+ R; *
.s 7*. . y 3 4 v _. c. . ..
c (j " . yv s c . s
, , , . 3
4 i .
L oo type of air distributor for the quench tower inlet gas, g In summary, the design of the CCS system appears to be based on a sound conceptual approach. There are'however a few areas of concern such as the g effect of higher maximum sodium concentrations, lack of power input analysis 1 and scaling analysis that introduces uncertainty in the overall performance estir: ate of the CCS. Additional analysis and possibly testing would improve
{ '4
' conf)dence in the performance of the design.
?
., } 'In addition to sodium aerosol removal, a major requirement of the
_ P CCS is the removal of liquid or solid state fission products. While no 1 direct measurement of. removal efficiency for the non-gaseous fission E _ Idoducts has feen made,[cstimates of removal efficiency have been made.
These estim e:F are based on examinations of fission product chemhtry and on exper.imental results with I i:aI designed to simulate condensible vapors.
_ 7
) These examinations of fission product chemistry and the NaI removal experi-g ments are discus:ed in the following paragraphs.
w -
p - . In general the fission products are normally grouped according to E 'thA r> general chemice,1 characteristics: The noble gases (Kr, Xe), the
~ iidogens'(I,'Sr)/ the'alkall metuls (Cs, Rb), some semi-volatile elements
_ (Te., Se, Sb)-ar[sombnon-volatile elements '(noble metals, lanthanides and i octinides). 7,he volatile or partfally ve) . tile fission products which
,inchie ",the, halogens," the alkali metals and the semi-nlatile elements but
- ~, excludd the_ noble gas's e are assumed to co-aggl,omerate with the sodium based es
. .parf!cles.2
.y - ,
7, ,
, This conceptual moael of co-agglomeration is based on both experi-
'r/antal and theoretich) work 3hich has been performed at DOE laboratories m
?;
r '(ANL, 5%L, ORUL) and is commercial institutions such as General Electric.
E These modejs aopear to be very widely acce'pted, appear reasonable and there-fore were not reviewed in this effort (45).
si 7 7;
, The Nal experiments cohddct9d by HEDL involved the injection of g ,J .' ': fated NaQp a sodium termol-stream just prior to the gases entering the
, g' ";' quench tant J4H; These experitaents, while they may not be fully represen-g y,' 3 jf tative of ths, expected conditions for the CCS, showed an apparently small f j ?,Y amount of Mo-agglomeration and a much larger amount of Nal nucleation to L "" b j .;r": 6 .
N hh
- ,y C
n
?,Q*)
g% ~,r l,; ' 'ah k ., ~
~
=
- s. ; i 6-12
..e < a
, [ .
p__ gg 2 ) .
ny "
,, a. __. . . . .
produce small particles. These separately nucleated particles were very small in size (0.1 to 1 microns) and only some attached to the bulk Na aerosol. This conclusion is based on the experimental observation that the fibrous filter removed a major portion. of the NaI mass (91%) even though it ~
was only designed to be a final cleanup filter and not supposed to see high mass loadings.
While this information is quite limited, a few statements can be
.ade about the expected performance of the CCS. Theory predicts and experi-mental evidence support the theory that semi-volatile fission products will co-agglomerate with the bu1K of the sodium aerosol. The extent of co-agglomeration appears to be unclear based on the HEDL tests. To the extent that co-agglomeration is incomplete, the duty requirements for the fibrous filter increase. This shif ting of the fission product duty to the fibrous filters increases the demand for reliable performance from this component and might serve as an additional failure mechanism.
Internal Hydrogen Explosion 1 Because sodium reacts with water to produce hydrogen, the potential for 1 hydrogen explosions within the CCS must be examined. This analysis examined the planned operating method for the CCS and concluded that some potential for a hydrogen explosion exists only during the vent cycle. The bases for t this conclusion are:
- 1. Af ter about 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> an estimated 8,700 lb-moles of sodium will have been suspended and transported from the reactor cavity area to the containment vessel. The major reactants available for this
+
system appear to be water from the concrete (maximum estimated i amount is 1200 lb-moles) and oxygen from the initial atmosphere within the containment vessel (maximum estimated amount is 2,950 lb-moles). The overall reaction.for reaction of Na with water and -
combustion of the resulting hydrogen is 2 Na + 2 H2 O + 1/2'02 -&2 Na0H + H2 .-
On this basis, the 1200 lb-moles of water will react with 600 lb-i moles of oxygen to consume 1200 lb-moles of elemental sodium.. The 6-13 -
q
D remaining elemental sodium (7,500 lb-moles) and remaining oxygen j (2,350 lb-moles) can then react. If they react to form Na2 02 then about 2800 lb-moles of elemental sodium remains and can be introduced to the CCS. If however they react to form Na20 , then essentially all of the eleme =tal sodium will be consumed by chemical reaction. The reaction stoichiometry in the actual CRBR 3 system will depend on rc2ction rates and mixing patterns. It does appear however that some elemental sodium may enter the CCS during the vent cycle.
] 2. During the purge cycle, outside air is introduced into the containment structure to sweep out reaction generated hydrogen.
Oxygen can be introduced at a rate of up to 6.7 lb-moles / min.
This should be adequate to rapidly consume any unreacted sodium and thereby eliminate the hydrogen generation potential'..
- 3. To obtain a hydrogen concentration of 6% (a combustible concentra-tion) in a gas stream flowing at the rate of 20,000 cfm would D require that hydrogen be generated at the rate of about 2.3 lb-moles / minute. This would require an elemental sodium reaction rate of about 4.6 lb-moles / minute. This rate can only be possible during vent conditions and possibly early in the ourge cycle.
Related to the issue of possible hydrogen explosion, it is crucial to ensure that at the time of initiation of the purge only a minimal amount of free sodium is present in the upper containment atmosphere. If this is not the case the criteria for initiation of the purging which is currently based on accumulation of 6%
D hydrogen should be re-examined and the possibility of earlier purging before oxygen starvation should be considered.
- 4. No hydrogen accumulations are expected as long as Burns and Roe implement their assertion that the high points of the process equipment are to be vented. If this is performed properly, it ;
provides a hydrogen explosio'n safeguard.
D g 6-14' i 1
Liquid Line Plugging' This 'is considered a realistic threat to the system because some solid formation in the scrubber solution recirculation system was reported in the HEDL tests. Specific components making up the solids were not .iden-tified. The concentrated Na0H (%109) solution in the scrubber will contain insoluble components associated with the sodium aerosol (oxides and car- 6 bonates). If these solids are not properly handled, pumps might be subjected to undesirable errosive conditions or filters and nozzles might' become plugged. -These conditions result in a decrease or loss of scrubber solution
}_ flow which in turn would reduce particulate removal efficiency and gas cooling. Failure of the polypropylene filter would be possible. The result of this f ailure sequence would be increa' sed fission product release and' increased population exposure.
I While no satisfactory failure rate data for this system is availa-ble some bounding estimates can be obtained from Satannah River documents and from the HEDL experiments. Savannah River has presented some filter failure . .'tes of about 1E-6/ hour (46). This is for a well-designed systein
) and therefore represents a lower frequency bound. On the other extreme, the HEDLet'sts reported cleaning strainers between tests. Based on the fre-quency of cleaning of these strainers an approximate upper bound f ailure rate of IE-3/ hour can be deducted..
Gas Line Plugging A second potential failure mode is the plugging of the gas lines for the CCS. The primary threat in' this instance appears to be to the inlet f . line which tnes gases from the containment building and ducts them into the
- quench tower. The problems of sodium compounds depositing in' the line 'are documented in HEDL experiments., This line pluggage could prevent,the con
- tainment structure purge which would in turn lead to the poss.ibility of a containment dome threatening hydrogen' buildup.- -
)
[ . l A correlai. ion which is applicable. to a system on the . scale off CCS does not appear to be readily available,at the present time. :Los Alamos-
' National Laboratory is examining this specific issue in detail for NRC.
g )
i f 16-15 L'
1 4
4 Gas Cooling An additional performance requirement for the wat scrubbers of the CCS as designed is to cool the hot gases from the containment area (temperatures ranging from about 7000F to about 10000F). Temperatures less than 2000F are required to prevent temperature induced failure of the fibrous (polypropylene) filter (46).
Analysis by Burns and Roe suggest that the laximum expected temperature of the gas stream as it enters the :'olypropylene filter is 175 + ,
150F. SAI performed an independent verification of these a 'perature predictions by developing and using a simplified model to predict the temperature of gas exiting from the CRBR containment cleanup system. The model is based on the concept of a single stage equilibrium contacting of the input gas stream of constant composition and a recirculating liquid strean.
The gas leaving the spray tower is in thermal equilibrium with the incoming liquid. The partial pressure of water in the exiting gas phase is also in equilibrium with the incoming liquid. Sodium enters with the incoming gas stream as Na20 and reacts with water to produce Ha0H and heat.
The heat of rea: tion and solution are assumed to be absorbed in the liquid phase. There are no assumed heat losses from the system other than the exiting gas stream (i.e., no scrubber solution cooling was analyzed).
Vapor pressure equations, heat capacity equations, heat of vapori-zation equations and heat balances were developed and solved using numerical techniques on the desktop computer. The results are considered to be a i bounding calculation because the assumption of thermal equilibrium between gas stream and liquid may not be completely valid. Actual gas temperatures may be a few degrees higher unless convective losses from the pieces of equipment become significant.
The results of the independent analysis are presented in Figure 6.4. It shows the results of some parametric analysis examining the effect of different inlet gas temperatures, sodium addition times (inversely.
related to inlet sodium concentration) and total sodium added to the CCS.
) For reported design conditions (about 300,000 lbs of sodium added and-6-16 L .
g g 5 I I W
L o 2 8
- e g e O z E E l $
d I -
I = 1 %
=
l
- f I / $ggm I .I *
- WE"D I I o I / a -
8, w* "m E z
I f Er Ah E
I / o ce '
/
i
/
l /lN o .
i h 8 a es 80 o >t I j .
/ z
' f 8
/ /
e /
hwEm o -m
-' / f
- 5 'j o Q>
' N $
+
m s! ./ *
/ /
0 -
r / e i
' z
= s
/ ,/ o f u, :
- E o %/ ' / -8" ,9 z o e-l&,
4 "
I- u, 2 0 O @
u n I , , i ,
o o g @ E O 8
'_ y E n e v- '- "
s do '3MnlyW3dlN3113'INI SVD W3111:1 BN31AdOWdKIOd m
6-17'
l average gas temperatures less than 11000F) it does not appear that the 2000F
- limit will be exceeded although it will be approached, particularly for high inlet sodium concentrations. The figure also shows that greater amounts of sodium entering the CCS could present problems with regard to the 2000F limit.
l In general, the SAI analysis tends to support the Burns and Roe analysis although the SAI numbers are slightly higher. This could be the result of different values assumed for heats of reaction / solution or other parameters. The SAI analysis does however point out the potential problems associated with sodium inputs greater than the design basis 300,000 lbs.
It appears that while the polypropylene filter is a temperature sensitive CCS component it should not be threatened if design base conditions are maintained and if thermal equilibrium is achieved between the scrubber solution and the gas exiting the venturi scrubber.
So f ar in this section the expected performance of the CCS is based on the assumption of normal operation of the various components. The purpose of the rest of this section is to identify and discuss components which, if failed, could lead to severe consequences.
64 Sumary and Conclusions t
A review and analysis of the CCS was performed for the purpose' of identifying potential problems with the expected design or operation Of the system. In general it appeurs that the system should operate as intended.
i There also appears to be some small potential problem associated with the co-agglomeration of semi-volatile fission products. This uncertainty about the co-agglomeration means that there may be an.increned potential for there being a higher mass duty on the fibrous polypropylene filter.
f In addition, there is a potential problem of poor reliability for certain components of the system. Of greatest concern from the reliability viewpoint are the scrubber solution recirculation system, the CCS feed air
-s.
)
6-18 L
i-E . . . . . . _ _ _ _ _ _ _ . _ _ _ _ _ _
ducting system and finally the potential for hydrogen explosion. Because this analysis only examined the first and last of these issues, potential solutions are only presented for these two.
The concern about the reliability of the scrubber recirculation system stems from the potential buildup of solids which could plug filters and jets. Several design options would appear to have the potential to reduce the reliability concern. One or more of these options might be used to improve the expected CCS reliability. The options conceived in the course of this analysis are:
i
- 1. Substitution of the polypropylene fabric air filter with a mate-rial less sensitive to temperature would serve to reduce the consequences of a decrease or loss of scrubber solution flow.
- 2. Installation of two scrubber accumulation tanks, one serving the quench 'ower and the other serving the venturi scrubber and the fibrous filter. This would tend to concentrate most of the sodium and fission products in the first system and allows the second i system to serve a polishing and backup role.
- 3. Introduce makeup water directly to the quench tower and the venturi scrubber. This would assure that at least some scrubber solution would be available even if the recirculating. flow dimin-ished.
The potential problem about hydrogen explosion occurs when elemental sodium is in the containment vessel. An operational change that may reduce
> the risk of hydrogen explosion would be to monitor oxygen in containment as well as hydrogen. If the free oxygen content becomes too low, vent and purge operations could be initiated regardless of the hydrogen concentration because a zero oxygen concentration indicates the possibility of elemental ~
6-19.
l.
Appendix A. References
)
- 1. Williams, D.C. et. al, "LMFBR Accident Delineation Stude Phase I Final
~
Report," NUREG/CR-1507, SAND 80-1267, November 1980.
)..
~
- 2. Copus, E.R., " Estimated Reoccurence Frequencies for Initiating Accident Categories Associated With the Clinch River Breeder Reactor Plant Design," NUREG/CR-2681, SAND 82-0720, April 1982.
) 3. Fauske, H.K., R.E. Henry and J.T. Madell, "SHRS Success / Failure Criteria," Presentation to the Nuclear Regulatory Commission, July 23, 1982, Bethesda, Maryland.
3 4. Najafi, B., "An Estimate of Release Frequencies for CRBRP Potential Core Disruptive Accident," Science Applications, Inc., SAI-348-83-PA, Draft, January 1983.
- 5. CRBRP Safety Study, An Assessment of Accident Risks in the CRBn. , March
) 1977.
- 6. CRBRP' Preliminary Safety Analysis Report, Project Management Corrioration, April 1975. .
) 7. Reactor Safety Study, An Assessment of Accident Risks in U.S.
Commercial Nuclear Power Plants, NUREG-75/014, WASH-1400, October 1975.
- 8. Swain, A.D. and H.E. Guttmann, " Handbook of Human Reliability Analysis
) With Emphasis on Nuclear Power Plant Application's," NUREG/CR-1278,
-October 1980.
9 '. Reliability ' Assessment of CRBRP Reactor Shutdown System, Rev.1, WARD-y D-0118, . App. 9.2, November 1975.
- 10. "CRBRP-3, Hypothetical Core Disruptive Accident _ Considerations in
. CRBRP, Volume 2, Assessment of Thermal Margin Beyond .the _ Design Basis,"
lCRBRP Project Management Office,-March 1980.
A-1,
, . , .+ r , _, 4
I
- 11. Brinsfield, W.A., A.R. Marchese and P. O'Reilly, " Sensitivity Study of CRBRP Containment Response to a Core Meltdown Accident," Proceeding of the International Meeting on Fast Reactor Safety Technology, Seattle, Washington, August 1979.
- 12. Baker, L., et. al., " Post Accident Heat Removal Technology," ANL/ RAS 77-2, January 1977.
- 13. Baker, L., " Core Debris Behavior and Interactions With Concrete,"
Nuclear Engineering and Design, Volume 42, June 1977.
- 14. Meacham, S. A. , "The Interaction of Tennessee Limestone Aggregate Concrete With Liquid Sodium," WARD-D-0141, December 1976.
, 15. Hassberger, J.A., R.K. Hillard and L.D. Muhlestein," Sodium-Concrete Reaction Test," HEDL-TME-74-36, June 1974. .
- 16. Hassberger, J.A., " Intermediate Scale Sodium-Concrete Reaction Tests,"
HEDL-TME-77-99, March 1978.
- 17. Smaardyk, J.E., et. al., "Large-Scale . Sodium Interactions With Concrete," Trans. Am. Nuclear hoc., 27, 508 (1977).
> 18. King, D.C., et. al., " Sodium-Interaction With Limestone Concrete Test.
Results", Trans. Am. Nucl. Soc., 26,521(1978).
- 19. Acton, R.U., et. al., " Sodium Interaction With Concrete and Firebricx,"
Proceedings of the International Meeting on Fast Reactor Safety Technology, Seattle, Washington, August 1979.
l i
- 20. Siegel, J.M., Presentation to the Nuclear Regulatory Commission, April 6, 198.2.
- 21. Peak, R.D., " Users Guide to CACECO Containment Analysis Code," HEDL-TC-859, June 1977.-
- 22. Postma, A.K., L.D. Muhlestein, and R.P. Colburn, ."A Review of Sodium Concrete Reactions," HEDL-TME-81-7, Decemb.er 1981.
>- A-2
-[ : , 4. ( e - '
- 7. p ,j 7 (; .g n; y : .a ' ~ f .. F .n. y ;.,,9 ', -l . _ .
- . .E[
- ;.L..fc
- 23. Muhlestein, L.D. and A.K. Postma, " Sodium-Concrete Reaction Executive Summary Report: Application to Limestone Concrete," HEDL-TME-82-15, June 1982.
- 24. Bradbury, P., " Extent and Rate of Sodium / Concrete Reactions,"
Presentation to the Nuclear Regulatory Commission, August 17, 1982.
- 25. Ball, T.W., "TMBDB - Core Debris Eff ects Melting Scenario,"
Presentation to the Nuclear Regulatory Commission, August 17, 1982.
- 26. McKeown, M., " Basis for Decisions on Evacuation," Presentation to the Nuclear Regulatory Commission, August 17, 1982.
- 27. Gleuxber, E.L., "Ex-Vessel. Core Retention Concept fer Early Sized LMFBRs," GEAP-14121, August 1976.
- 28. Fink, J.K., et. al., " Interaction of Certain Refractory Materials With Sodium," ANL-75-74, May 1976.
- 29. Meechan, S.A., " Sodium Capability of CRBR Parallel Design Ex-Vessel Core Restrainers," WARD-D-0097, April 1975.-
- 30. Appleby, E.R., " Compilation of Data and Descriptions for United States,
~
and Foreign Liquid Metal Fast Breeder Reactors," Hanford Engineering Development Laboratory, HELD-TME-75-12, August 1975.
- 31. Gasser, R.D., et. al., " Review of Thermal Margins Beyond Design Basis for Postulated HCDA's in the CRBRP," Brookhaven National Laboratory, Draft, April 1982.
- 32. Theofanous, T.G.,' Presentation to the ACRS Subcommittee on CRBR CDA Energetics, November 19, 1982. -
- 33. Meyer,- J.R., et. al., "An' Analysis and Evaluation Of The Clinch River Breeder Reactor Core. Disruptive Accident Energetics," NUREG-0122, March
_ 1977.
1 .
,e g 3 r 7A-3,_.
. m. .
.A -tm.:
l l
- 34. Dh ir, V.K., et. al., "LMFBR Fuel Analysis Task A: 0xide Fuel Dynamics," NUREG-0146/UCLA-ENG-76114, January 1977. _
- 35. Kastenberg, W.E. and V. Frank, " Preliminary Analysis of the Transient Overpower Accident for CRBRP," UCLA Engineering Report fuCLA-ENG-7557 (July 1975).
- 36. McElroy, J.L., et. al., " Clinch River Bret :]r Reactor Plant: An Analysis of Hypothetical Core Disruptive Events in the Clinch River Breeder Reactor Plant," General Electric Topical Report #CRBR-GEFR-00103, General Electric Company, Sunnyvale, California, April 1978.
- 37. Theofaneous, T.G., Purdue University, Private Communication, December ~
1982.
- 38. Deutsch, K.L., " Control System Failures Resulting in Ramp Reactivity Insertions," Presentation to the Nuclear Regulatory Commission, November 15, 1982.
- 39. Deutsch, K.L., Westing' house Advanced Reactor Division, Working Meeting, December 1982.
.t
- 40. Military Standardization Handbook, " Reliability Prediction of Electron-ic Equipment," MIL-HDBK-217C, April 1979.
- 41. Hillard, R.K., et al., " Aqueous Scrubber Air Cleaning System T Demonstration for Containment Venting and Purging with Sodium Aerosols," CSTF ACl-AC4, Hanford Engineering Development Laboratory,
,HEDL-TME-81-1, March 1981.
- 42. Perry and Chilton, Chemical Engineer's Handbook, Fifth Edition, McGraw-Hill, New York, 1973.
- 43. Calvert, Seymor, "How to Choose a Particulate Scrubber," gemical Engineering, August 29, 1977, p. 54-68.
- 44. Semran, Konrad, " Practical Process Design of Particulate Scrubbers," *- '
l Chemical Engineering, September 26, 1977. p. 87-91.
(
A ! _
_ . -3
)
- 45. Cybulskis, P., " Effects of Engineered Safety Features on the' Risk of I Hypothetical LMFBR Accidents," Nuclear Safety, Vol.19, No. 2, March-April 1978.
- 46. Dexter, A.H. and W.C. Perkins, " Compound Failure Rate Data With
,) Potential Applicability to a Nuclear Fuel Reprocessing Plant," E.I. du Pont de Nemours and Co., Savannah River Laboratory, DP-1633, July 1982.
- 47. Hillard, R.K., et al., " Venturi / Fibrous Scrubber System Performance During Containment Venting and Purging with Sodium Aerosols - CSTF
). Tests AC-5 and AC-6," Hanford Engineering Development Laboratory, HEDL-TME-80-47, August 1980.
L)
)
)
y 4
?
~
A-5.
) -
.