ML11216A099

0523 - R504P - Westinghouse Advanced Technology - 07.4 - Core Damaging Events

ML11216A099
Person / Time
Site:	Three Mile Island
Issue date:	07/01/2008
From:	NRC/HR/ADHRTD/RTTB-PWR
To:
Gary W. Callaway
References
Download: ML11216A099 (14)

Text

TABLE OF CONTENTS 7.4.0 Core Damaging Events................................................................................. 7.4-1 7.4.1 Three Mile Island Accident ................................................................ 7.4-3 7.4.1.1 Sequence of Events............................................................. 7.4-3 7.4.1.2 Accident Contributors ......................................................... 7.4-3 7.4.1.3 PWR response to an open PORV ....................................... 7.4-4 7.4.1.4 Industry And Regulatory Response ................................... 7.4-5 7.4.2 Chernobyl Accident ........................................................................... 7.4-6 7.4.3 Summary............................................................................................. 7.4-7 LIST OF FIGURES Figure 7.4-1 Basic Babcock & Wilcox Plant Systems .................................... 7.4-9 Figure 7.4-2 Mollier Diagram ....................................................................... 7.4-10 Figure 7.4- 3 Plant Response to Open PORV .............................................. 7.4-11 Rev 0708 7.4.i USNRC HRTD

This page intentionally blank Rev 0708 7.4.ii USNRC HRTD

7.4.0 Core Damaging Events Learning Objectives:

1. State how the following parameters respond to a stuck-open pilot-operated relief valve (PORV) following a reactor trip from 100% power:

a. PORV tail-pipe temperature

b. Reactor coolant system pressure

c. Pressurizer level

d. Reactor vessel level

2. State the significance of superheated conditions in the reactor coolant system.

3. State the key operator errors that contributed to core damage during the Three Mile Island (TMI) accident.

4. Describe the event that initiated the core damage sequence at TMI.

5. Discuss industry and regulatory changes that resulted from the accident at TMI.

6. Describe the differences in technology that make U.S. commercial reactors not susceptible to an event similar to the Chernobyl accident.

Rev 0708 7.4.1 USNRC HRTD

This page intentionally blank Rev 0708 7.4.2 USNRC HRTD

7.4.1 Three Mile Island Accident In March of 1979, Three Mile Island (TMI) Unit 2 experienced a loss of normal feedwater, resulting in a reactor trip on high reactor coolant system (RCS) pressure.

Over the next several hours a combination of poor design, equipment failure, and operator error resulted in core uncovery and the melting of approximately 60% of the fuel.

7.4.1.1 Sequence of Events Just prior to the reactor trip, the pilot-operated relief valve (PORV) on the pressurizer opened as designed in response to the increasing RCS pressure, but failed to close when system pressure subsequently decreased. Figure 7.4-1 illustrates the system flowpaths. The operating crew allowed this loss of coolant to continue for more than two hours.

A few minutes after the trip, the operating crew noticed a rapid rise in pressurizer level. Pressurizer level was actually rising due to the formation of steam in the RCS, which was forcing water into the pressurizer, but the crew believed the reactor coolant system was approaching a water-solid condition. The operators responded to the rising pressurizer level by reducing makeup (high pressure injection) flow and by establishing maximum letdown flow. For 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and 19 minutes RCS inventory was continuously depleted through the open PORV and via letdown with essentially no makeup flow.

Forty-six minutes into the event, the letdown radiation monitor indicated that core damage had begun. One hour and 40 minutes into the event, the crew tripped all reactor coolant pumps (RCPs) in response to indications of cavitation. RCP operation had maintained a frothy steam/water flow through the fuel, which was effectively removing some heat. When the operators tripped the RCPs, the steam and water separated, the fuel was partially uncovered, and significant clad oxidation began to occur, followed by fuel melting. RCS hot leg temperature began to indicate superheated conditions. Superheated steam in the hot leg indicated that the core was uncovered, but the crew was not trained to recognize this development. Crew members continued to believe that the core was covered because of the high pressurizer level.

Two hours and 19 minutes into the event, the operators isolated the open PORV, but continued letdown flow. Three hours and 20 minutes into the event, the operators initiated makeup flow to the RCS. This inventory addition quenched the core, but also probably caused considerable shattering of fuel pins. About 60% of the core had melted by this time. In the next several hours the crew struggled to establish natural circulation flow, but a large hydrogen bubble in the RCS restricted flow. Sixteen hours into the event, the crew established a stable cooldown rate.

7.4.1.2 Accident Contributors Equipment failure, poor design, and personnel error all contributed to this accident.

Rev 0708 7.4.3 USNRC HRTD

The only equipment failure directly involved in core damage was the failure of the PORV to close when RCS pressure dropped below the PORV open setpoint.

Ambiguous PORV position indication, poor human factors in control room design, and lack of reactor vessel level indication were design deficiencies that contributed to the accident. The position indication for the PORV did not provide a direct reading of actual valve position, but only indicated the status of the actuating solenoid. The indications for the tank that received the PORV discharge were on a back panel, not readily visible from the areas containing frequently operated equipment. These factors made it more difficult to diagnose the stuck-open PORV. There was no indication of actual water level in the reactor vessel. This deficiency made determination of RCS inventory more difficult.

The crew failed to isolate the open PORV and incorrectly reduced makeup flow in response to the rising pressurizer level. Either isolating the PORV or allowing automatic emergency core cooling injection would have prevented core damage. These errors revealed basic inadequacies in the operator training program. The crew had been trained to avoid filling the pressurizer, but was not trained to recognize symptoms of an open PORV or inadequate core cooling.

The crew errors were, for them, applications of what seemed to be common sense.

The first supposed common-sense conclusion concerns the significance of pressurizer level. The pressurizer is higher than the reactor vessel, and these vessels are connected by a large-diameter pipe which contains no valves. It seems reasonable that if the higher tank contains water, then the lower tank must be full. Abetting this conclusion was the lack of direct level indication for the lower tank (the reactor vessel).

In reality, pressurizer level is a reliable indication of RCS inventory only when the core-exit coolant is subcooled. During this accident, the pressurizer remained full while the coolant in the reactor vessel slowly boiled away. The reasons for this are discussed in section 7.4.1.3. The second supposed common-sense conclusion concerns PORV tail-pipe temperature. It seems reasonable that if the pressurizer steam space temperature is 650°F, then the tail-pipe temperature of an open PORV will approach 650°F. This is also a false conclusion which is further discussed in section 7.4.1.3.

7.4.1.3 PWR response to an open PORV Figure 7.4-3 illustrates how a Westinghouse plant responds to events similar to those experienced at the outset of the TMI accident. When a PORV remains open after a reactor trip, RCS pressure drops as the steam space of the pressurizer is vented to the pressurizer relief tank (PRT). When RCS pressure drops to the saturation pressure associated with the core-exit temperature, steam formation in the core causes pressure to stabilize.

The initial tail-pipe temperature of the open PORV is a function of the saturation temperature for PRT pressure. Throttling the vented steam via the PORV is a constant-enthalpy process, as illustrated by the initial throttling arrow in Figure 7.4-2. The properties of the vented steam vary along the constant-enthalpy line from pressurizer conditions to PRT conditions. When steam is vented at 650°F, the process remains Rev 0708 7.4.4 USNRC HRTD

under the vapor dome, so the tail-pipe temperature is dictated by the PRT pressure.

(Lines of constant pressure and temperature are concurrent under the vapor dome.)

Even though the pressurizer steam space is at 650°F, the tail pipe temperature initially rises to only 212°F (saturation temperature for atmospheric pressure). The temperature continues to rise as PRT pressure increases, then drops when the PRT rupture disk vents the PRT to the containment atmosphere. Eventually, as illustrated by the second arrow in Figure 7.4-2, steam is vented from different pressurizer conditions at a different specific enthalpy to a depressurized PRT. The end state of this process is outside the vapor dome, resulting in a PORV tail-pipe temperature of ~ 285°F.

Because of steam formation in the core, water is forced into the pressurizer.

Pressurizer level rises to 100%. As RCS inventory depletes, pressurizer level remains high. The steam formed at the core exit is vented out the open PORV. The pressurizer remains largely full as steam flows up the pressurizer surge line, even as the coolant in the core boils away. For these conditions (core-exit coolant saturated or superheated),

the only reliable indication of RCS inventory is the reactor vessel level indication system (RVLIS). Pressurizer level is a useful measure of RCS inventory only when the coolant is subcooled at the core exit.

7.4.1.4 Industry And Regulatory Response The accident led to sweeping reforms implemented by the industry and the NRC.

The Three Mile Island accident demonstrated to US industry leaders that the industry must do a better job of policing itself to ensure that an event of this magnitude should never happen again. The Institute of Nuclear Power Operations (INPO) was formed by nuclear utilities and staffed by utility personnel. INPO has established standards against which plants are measured. An inspection of each member plant by INPO representatives is typically performed every 18 - 24 months. The Institute's programs include information sharing, events analysis, human performance improvement, training program accreditation, and plant evaluations.

Operator training was extensively revised. The NRC raised the standards for operator examinations. Exams are now more focused on knowledge of plant operations, and the passing grade has been increased to 80%. Licensees are now required to have a simulator facility and to provide comprehensive training in the diagnosis of and recovery from possible plant malfunctions and potential accident conditions.

Nuclear plant emergency operating procedures are now symptom based, with a focus on safety functions. The procedures prior to the TMI accident were based on the premise that the operators would properly diagnose an event and then implement the proper procedure. Current procedures do not rely on the operators ability to diagnose.

Also, current procedures identify critical safety functions that, if met, ensure that the integrity of barriers to radioactive release is maintained, regardless of the initiating event.

The NRC was extensively reorganized to better focus on safe operation of the plants. Resident inspectors were placed at each site.

Rev 0708 7.4.5 USNRC HRTD

NUREG-0737, Clarification of TMI Action Plan Requirements, summarizes the changes in regulations in response to the accident. The changes include the areas of shift manning, operator training, control room design, accident monitoring instrumentation systems, operating procedures, and operating experience review.

Reactor vessel level monitoring systems were added to PWR plants after the TMI accident.

The NRC revised emergency planning rules and guidance to provide for improved capability for a wide range of accidents.

In summary, the changes that resulted from the TMI accident changed virtually every area of plant operation and regulation.

7.4.2 Chernobyl Accident Chernobyl 4 was a Soviet RBMK-l000 type reactor rated at 3200 MW thermal power and 1000 MW electric output. The RBMK-l000 is a graphite-moderated boiling water reactor that contains 1661 parallel, vertical pressure tubes loaded with fuel assemblies.

This type of reactor exhibits a positive void coefficient of reactivity, because the moderator is graphite instead of water. In the RBMK design, the coolant does not provide neutron moderation. As a result, the coolant is a poison. Coolant voiding adds positive reactivity. The fuel temperature coefficient of reactivity (Doppler) is negative.

In normal operation, the overall core power coefficient is negative at and near full power but becomes positive at lower power levels.

The Chernobyl Unit 4 operators were performing a turbine generator coastdown test as part of a plant shutdown. Due to delays in conducting the test, reactor power level dropped lower than the test requirements, with a resultant positive power coefficient at the lower power. When reactor power level became unstable, the crew responded by disabling much of the reactor protection system. The test was then initiated by tripping a turbine generator, which caused four of eight reactor coolant pumps to coast down without a trip. With a decrease in coolant flow but no decrease in power, a significant amount of voiding developed rapidly in the core. The positive void coefficient caused the reactor to become prompt critical. Even though the operators manually tripped the reactor, the trip was too late to be effective. Two power peaks occurred about one second apart. The power levels of these two peaks were estimated to be 11,000% reactor power and 47,000% reactor power, respectively. The first power peak destroyed the core of reactor number 4. The second peak, which was much more powerful, shot burning lumps of graphite and reactor fuel into the air. These lumps landed in various places and caused many fires. In all, the explosion created a crater with burning graphite and about 30 fires in other places around the plant. The main reactor fire continued to burn for nine days, releasing a large amount of radioactive material into the environment.

The sequence of events that occurred at Chernobyl is not possible at reactor plants in the United States. The reactor designs used in the U.S. always have negative overall power coefficients. The RCS voiding that drove Chernobyl prompt critical would cause Rev 0708 7.4.6 USNRC HRTD

a U.S. reactor to be subcritical. Also, there are no credible accidents at U.S. reactors that will instantly breach all fission product barriers. The moderator in U.S. reactors (water) will not burn.

Many on-site fatalities resulted from the Chernobyl disaster. An international study concluded that in the general population, nine child fatalities from thyroid cancer can be linked to the accident. Additional deaths are possible, but not documented. In contrast, the TMI accident has not led to any documented health problems either in the work force or in the general population to date.

The only significant impact of the Chernobyl accident on the United States was in the public perception of nuclear power. Since there are few design similarities, this accident did not lead to significant changes in plant design, operation, or regulation in the United States.

7.4.3 Summary The most significant United States commercial reactor accident occurred at Three Mile Island Unit 2 in 1979. Due to a combination of equipment failures, design deficiencies, and operator errors, about 60% of the core melted, and the plant was permanently shut down. No member of the general public received a significant radiation dose, and no plant worker suffered any documented adverse health effects from the accident. It is possible to re-create this accident sequence at any U.S.

pressurized water reactor. The event led to sweeping changes in the industry.

The most significant international commercial reactor accident occurred at Chernobyl Unit 4 in 1986. The reactor was blown apart by a steam explosion induced by a reactivity transient, followed by a graphite fire. The sequence of events at Chernobyl cannot occur in the types of reactors operating in the U.S.

Rev 0708 7.4.7 USNRC HRTD

This page intentionally blank Rev 0708 7.4.8 USNRC HRTD

Figure 7.4-1 Basic Babcock & Wilcox Plant Systems Rev 0708 7.4.9 USNRC HRTD

Throttling process from pressurizer at lower pressure to depressurized PRT Initial throttling Figure 7.4-2 Mollier Diagram Rev 0708 7.4.10 USNRC HRTD

For these trends, the reactor tripped from 100%, one PORV was opened, and ECCS flow was disabled. These are essentially the conditions during the early portions of the TMI accident.

Figure 7.4- 3 Plant Response to Open PORV Rev 0708 7.4.11 USNRC HRTD

This page intentionally blank Rev 0708 7.4.12 USNRC HRTD