The simple answer to a serious problem My First Template The simple answer to a serious problem The Nitrogen Threat A CLOSED ITEM ? An study about the threat of the nitrogen injection to the RCS, and the strategies to cope with this issue in our nuclear plants. By Arnaldo Laborda Rami www.asvad-nuclear.com 1

TO MAKE OUR NUCLEAR PLANTS SAFER My First Template The Main objective TO MAKE OUR NUCLEAR PLANTS SAFER Revealing the inner enemy that can lead us to disaster stabbing our cooling systems directly from its inside Introducing ASVAD. The new valve who can protect us from the nitrogen injection threat 2

The presentation: Index My First Template The presentation: Index The Nitrogen threat. The FSG-10 guide. The FSG-10 drawbacks and challenges. The alternative: The ASVAD safety valve. Benefits using ASVAD. Conclusions. Questions & Answers. 3

1 The Nitrogen threat. 4

The Nitrogen threat After Fukushima accident, the nuclear industry starts a wide upgrade in front to the beyond- design-events. One of the worst events is the Long Term Station Black-Out (LTSBO) or also known as Extended Loss of AC Power (ELAP). The PWROG wrote the Flex Support Guidelines (FSG’s) to cope with these events. One of the complications of the ELAP accident is the nitrogen injection to RCS from the accumulators. The FSG-10 is a specific guide focused in avoid the nitrogen injection. 1 5

The Nitrogen threat All PWROG plants had adapted FSG-10 guide in their emergency procedures, and only with this action they had justified their own ability to cope with this threat. NRC team had revised the plans to cope with ELAP accident, and approved all these plants strategies after a long reviewing process. Nitrogen issue, is now a closed item in all the plants strategies. No further actions are expected about it. 2 6

The Nitrogen threat This presentation shows a brief explanation about how the plant reacts to ELAP event. Also shows why the nitrogen injection is a risky complication of this event. The second part discusses the FSG-10 guide step by step. Each step has their own drawbacks. After a deeper examination, a lot of important questions arise about the feasibility of the FSG- 10 strategy to avoid the nitrogen injection. Without a robust tool to cope with this issue, the nitrogen threat is still an UNRESOLVED ITEM. 3 7

ELAP : The accident first hours My First Template ELAP : The accident first hours THE FIRST PROBLEM: THE LOSS OF AC POWER (12”) Steam Relief Valves controls the SG’s pressure and the RCS cooldown. (5”) The main steam valves also are closed. Secondary circuit is lost. M (2’- 5’) In the RCS circuit the “natural circulation” mode is established. M Water CST (1’) The pressure and the level inside the RCS circuit starts to fall… (40”) The auxiliary feed water turbine supplies water to SG’s. (3,5h) Until the passive injection from the accumulators starts refilling the RCS… (5”) All the main feed valves are closed. (15’) Without seal injection, the RCP seals fails, and become a permanent RCS leakage. FLEX Equipment must be deployed and ready to operate after a short time (0”) All the pumps stop, and valves become closed or in position. The control rods stops the nuclear reaction in the core, but residual heat must be removed from the core. NATURAL CIRCULATION 8

ELAP: During the accident (4h – 40h) THE MAIN PROBLEM: THE LOSS OF COOLANT (2h) Operators control the RCS pressure & temperature with the SG’s PORV. (FSG-2) The RCS leak fills the containment building with radioactive steam. M Water CST (0h-40h) The “natural circulation” mode still transfers the excess of heat from the core. Auxiliary feed pump still provides water to SG’s cooling the RCS. (45h-50h) But passive injection from ECCS accumulators is near its end… Then, operators must enter into the FSG-10 guide to try to isolate or vent accumulators (3h) The RCP leak decreases, but is still the main RCS leak. FLEX Equipment must be ready to refill the RCS (FSG-1). NATURAL CIRCULATION 9

ELAP: The accident worsens (45h - 60h) A NEW PROBLEM: THE NITROGEN INJECTION The nitrogen reaches the top of SG’s tubes. Now, the “natural circulation” is stopped. M Water CST The nitrogen comes to the upper part of reactor vessel displacing the water… Nitrogen will remain inside RCS disturbing the long term cooling and threatening the core integrity The reflux cooling mode begins… but is a less efficient mode and is also disturbed by the nitrogen. Without enough steam to spin the AFW turbine, their injection to SG’s stops. When the water ends, the nitrogen enters into the RCS The RCP seals continue leaking. If the FLEX Equipment can’t be able to maintain the RCS pressure above the nitrogen pressure, then… NATURAL CIRCULATION REFLUX COOLING 10

> NITROGEN: How BIG is the problem? 35 ºC 60 ºC 90 ºC 390 m3 The total volume of the RCS is around 340 m3 (4 loop). Each ECCS accumulator has 14 m3 (~650 Kg) of nitrogen at 45 Kg/cm2. After RCS depressurization, this means 390 m3 at 1,5 Kg/cm2 (at ambient temperature. Just one accumulator has enough nitrogen to fill the whole RCS volume. During the accident, temperature will rise in the RCS further expanding even more the gas. 35 ºC 60 ºC 90 ºC M > 390 m3 1000 m3 670 m3 340 m3 M There is one accumulator in each loop. Then, the problem IS THREE OR FOUR TIMES BIGGER !!! 11

2 The FSG-10 12

The FSG-10 Purpose Entry Conditions Provides directions to isolate or vent the accumulators to allow RCS to be further depressurized for long-term cooling. Entry Conditions Is entered from ECA-0 during a station blackout (LTSBO or ELAP). From FSG-8 or FSG-9. From other plant specific procedures. 13

The FSG-10 in brief 1 Determine when isolation is required. Determine if isolation valves can be powered from FLEX equipment. Deploy FLEX equipment to Re-energize Accumulator Discharge Isolation Valves. Close the Isolation Valve. Verify the closure of the valve. De-energize it. Repeat the actions 3, 4 & 5 to each valve. If not achieved try to vent accumulators. End of the procedure. 2 3 4 5 6 7 8 14

3 The FSG-10 steps 15

Step 1 Issues: The FSG-10 steps Determine when isolation is needed. Safety Injection Tank isolation MUST BE DONE prior to depressurize SG’s below 300* psig. Issues: Operators must be watchful over the SG’s or RCS pressure evolution. Depending on the RCS leak, the depressurization can be faster (and uncontrolled) than expected. This is a TIME CRITICAL operation. If available, the WR SIT level accuracy will be seriously affected by the temperature stratification (effect on the capillary tubes). If started too soon, it will be lost a lot of makeup water wasted inside accumulator. If started too late, it will be nitrogen injection to RCS. The correct moment is difficult to be known without the proper instrumentation. *plant specific 16

Step 2 Issues: The FSG-10 steps Determine if isolation valves can be powered from FLEX equipment. If not, go to step 7 (plan B). Issues: A FLEX source of AC power is needed. No Flex, no isolation. It can be time critical to deploy these elements. Deploy couldn’t be easy. Depending where the valve’s electrical controls is, a heavy and long cable have to be deployed to feed these circuits. Depending on the accident extension, could not be possible to deploy these elements to all valves. Just one fail, means nitrogen injection. The weather can help… or difficult the work (night, rain, wind, snow…). 17

Step 3 Issues: The FSG-10 steps. Deploy FLEX equipment to Re-energize valves. Deploy a cable from the FLEX to the Valve’s MCC. Connect it and energize the circuits. If not achieved, go to Step 7 (Plan B). Issues: Unless using pre-installed cabling, deploying a heavy and long cable across dark and closed rooms can be a big challenge. Correct phase order must be met. The cable’s route has to be clearly specified in the procedure. Operators should not improvise on this task. This task can take a lot of time and operator efforts until the connection is ready. Some padlocks will be broken. 18

Sorry!... No comments… I’ve forgot the darkness…. Step 3 The FSG-10 steps. Step 3 A real Flex deployment as example… NO COMMENTS... No comments… 19

Step 4 Issues: The FSG-10 steps Close the Isolation Valve. To be able to close the valve, many elements must work properly to achieve it: The FLEX generator, all the involved electrical elements (switches, relays, protections…), the cabling, the AC motor, torque limiters, limit switches, gears, the valve itself...(don’t forget operators)) If only one element fails, all the operation fails. In this situation the containment ambient is harsh, and it will hinder the element’s proper operation. When the connection is made to a bus duct, the bus itself has to be operable, with the unused equipment stripped. If we have to close the valve locally in the deep and dark room, walkie-talkies could not work. We could need other actuations as placing jumpers to bypass remote orders, reposition of biestable relays, etc. 20

Step 4 The FSG-10 steps To be used in the dark? These relays have to be disconnected to allow the valve closure. Step 4 A REAL diagram as example… Any of these elements can fail. Even the fail of a secondary element can be important in this step (as the lamps indicators). To be used in the dark? 21

Step 5 Issues: The FSG-10 steps Verify the Valve closed. Deenergize it. If not achieved, try again or go to (plan B). Issues: What can be done if the isolation fails? Cross the fingers?. It could be difficult to verify the closure of the valve. The simple indication of the limit switches can not guarantee the full closure. No other process instrumentation signals can determine it. If the valve remains not fully closed, it will be a slow -but continuous- nitrogen injection to RCS. Even properly closed, the valve can still leak nitrogen… during ALL the long-term cooldown. Remember that these valves…. Are not Leak-Proof and then usually are not leak tested…. Never!! . 22

Step 6 Issues: The FSG-10 steps Repeat steps 3 to 5 to all the remaining isolation valves. If achieved, go to end. If not, to 7 (plan B). Issues: All of these maneuvers must be done (more or less) AT THE SAME time over all the accumulators. It’s a TIME CRITICAL action. All the accumulators are discharging at the same RCS pressure and will be empty of coolant approx. at the same time. If closure is done simultaneously, Flex generator can fail by overload. If the maneuver is not done quickly, it can be nitrogen injection from the last isolated accumulators. The cabinets are usually in different rooms. Operators need to move from one to other and disconnect and reconnect them again… Again, if only one element fails, all the operation fails. 23

Step 7 (plan B) Issues: The FSG-10 steps Verify available the motive force for Accumulator Vent Isolation Valves. If not available, go to Step 8. Issues: When there is no AC power available, there isn’t any compressed air available either. If the air is available, fully operative pneumatic pipes are also needed (without leaks). Pneumatic distribution is not a safety related system. These valves need both electric power and air to operate. These valves are closed when they are de-energized. To exhaust all the nitrogen is necessary to constantly energize the valve during some time. It is even more challenging to recover these valves than the isolation valves. 24

The FSG-10 steps. WHAT DO YOU THINK ABOUT IT ?... A REAL procedure from a plant as example… OK, but when? This sentence resumes all the FLEX & cabling deployment Is there power on valves? WHAT DO YOU THINK ABOUT IT ?... Close the valves Other issue If not achieved, try to convince someone to go to Containment !!! Well explained? Well organized? All the instructions are too simple to manage a complicated environment… Who will be able to fulfill this procedure? THIS SHOULD BE A JOKE !!! (But unfortunately… not in this procedure) 25

You have burnt your options, but the accident still continues!!… The FSG-10 steps Step 8 End of the procedure. No further actions can be taken. You have burnt your options, but the accident still continues!!… And now, with the nitrogen inside… Issues: If it is achieved, good work... you’re lucky heroes! If not, do not blame yourself. It’s difficult to achieve it. Ask your managers why they did not implement the ASVAD safety valve to avoid the nitrogen injection. 26

Do you rely on it ? & & = Success? Current strategies weakness Current strategies rely on: Know the correct moment to perform it. Have enough time to perform it. The deployment of some ACTIVE elements and its proper actuation. The Flex AC Power Generator availability. The cabling deployment to the valves. The valve’s ability to isolate the accumulators. The proper organization actuation. Their capabilities to perform the work. The adequate operator’s training. Time critical actions & ACTIVE elements & Organization efforts = Success? This is a long chain of active elements! Just one fail, it means nitrogen injection. Do you rely on it ? 27

End of FSG-10 Fortunately now, we have a good alternative to the FSG-10 and their drawbacks. Is time to know the ASVAD Valve… KEEP CALM and breathe easily... Nobody must go to containment….☺ And now we don’t need to rely on the luck. 28

4 The ASVAD valve 29

A S V A D The ASVAD safety valve The SIMPLE SOLUTION to the nitrogen injection issue. A S V A D AUTOMATIC SAFETY VALVE FOR ACUMULATOR DEPRESSURIZATION 30

How ASVAD is installed? RCS M NITROGEN BORATED WATER EXAUST ASVAD It only needs a manual isolation valve and few feet of pipe. ASVAD Is installed in the nitrogen side of the accumulator. 31

What is inside ASVAD? Pressure chamber. Safety Floater. Upper container. Locking cylinder. Closing piston. Fixing cylinder. Shut-off plug. Opening spring. Spring container. Fixing screws. Opening piston. Upper cover. 32

How ASVAD works? The ASVAD operating principle is the imbalance of forces. At normal pressure, there is a force upwards that overcomes the spring force. This force keeps the shut-off plug closed. This is the normal operating position. During the water injection, the nitrogen expands, and the pressure in the accumulator drops until a certain value is reached. Now, the force of the opening spring is enough to move the shut-off plug off its seat, opening the path from the pressure chamber to the outlet exhaust ports. Once this happens, the pressure drops quickly in the bottom pressure chamber, and the shut-off plug reaches its full opened state. This provides an open path to exhaust all the residual nitrogen in the accumulator. 33

Manual operation mode To unconditionally open the ASVAD, can be done applying pressurized air to the “open” inlet. The air pressure pushes the opening piston downwards, pushing the shut-off subassembly stem until the plug opens. This maneuver can be done to depressurize the accumulators if necessary. To unconditionally close the ASVAD, can be done applying pressurized air to the “close” inlet. The air pressure pushes the closing piston upwards, pushing up the shut-off subassembly until the plug closes. This maneuver can be done after a previous depressurization to allow refilling the accumulator. When the air is exhausted, both pistons return to their initial position, and ASVAD remains armed. 34

Optional redundancy Finally, there is an ASVAD design feature to avoid leaks from RCS even in case the accumulator non-return valve leaks. After actuating, the ASVAD remains open. If there is an in-leakage, the accumulator water level will rise until reaching the ASVAD pressure chamber. Once the water fills the chamber, the security floater starts to float and rises until completely covering the open shut-off plug and seat to stop the leak. 35

5 Advantages of ASVAD 36

Main advantages of ASVAD All the time AVAILABLE from the first moment. It FULLY AVOIDS the nitrogen injection problem. NO EXTERNAL ENERGY is needed. NO OPERATOR assistance is required. Acts at the CORRECT MOMENT and over all the accumulators. Acts AUTOMATICALLY sensing the accumulator pressure. Once actuated, it vents COMPLETELY the accumulator. No further delayed nitrogen injections are possible. Its action CAN BE VERIFIED by the available instruments (accumulator or containment pressure & temperature). Operators CAN FORGET about Nitrogen Injection Problem, and focus on perform other recovering tasks. 37

More advantages of ASVAD HIGH RELIABILITY due its robust and simple design. HARD ENOUGH to bear the post-Loca environment. EASY TO BE INSTALLED in the accumulator system. EASY TO BE LICENSED. Not adding a new failure mode to the system. INTRINSICALLY SAFE. No EMC. No software. Cyber-attack proof.☺ QUALIFIED for nuclear use. Its a nuclear class 1 valve. EASY TO BE OPERATED. It can be remotely actuated if needed. EASY TO BE MAINTAINED. No wear in the valve. Easy to be disassembled. Few spares needed. With minimal maintenance cost. EASY TO BE TESTED. It can be functional and leak tested. EASY TO BE ADJUSTED. To the desired pressure actuation. CHEAP. Not an expensive modification is needed. HIGH QUALIFIED LIFE. No further investment$ required. 38

ASVAD VS FSG-10 ASVAD FSG-10 ASVAD FSG-10 39 Sensing the pressure, it knows when actuate. ASVAD does not need energy. ASVAD is already installed. ASVAD is always ready to act. ASVAD needs nobody. When the water ends… The simple valve will does its job... over all the accumulators. Operators will see its effects. ASVAD will preclude any further injection. This threat is FULLY AVOIDED. INSTALL & FORGET (Until Outage) FSG-10 Operators must decide when isolate. A Flex generator is needed… And installed near the electric cabinets Operators deploy the cables to the valves. Operators connect the cables. Operators order the valve to close. The whole system have to operate. Flex Generator, cabling, connections, Electrical circuits, AC Motor, gears, Torque & limit switches, the valve, Operators…. There is no accurate way to know if achieved. Repeat the same work in the rest of valves. Even closed, it still can leak nitrogen to RCS. The risk of nitrogen injection is still present and nothing more can be done unless venting. But venting is still more complicated than isolating. Chores to do regularly: Equipment maintenance & testing, operators training, procedures revision, do simulacrums… ASVAD FSG-10 39

6 Conclusion 40

The Nitrogen Threat (TNT)  ASVAD M Current strategies Simple N2 Auto Active Components Organization efforts Passive Safe FLEX Procedure Nitrogen is like a missile right to our RCS “veins” Currently we only have weak strategies to avoid its effects. But it is like a giant with feet of clay… Fortunately, now we could install ASVAD… the best passive protection. 41

Do you remember the Defense in Depth concept? Conclusion Do you remember the Defense in Depth concept? LET’S SOLVE THIS THREAT DEFINITELY ! It’s in our hands. It’s our responsibility. It’s our opportunity ! Nuclear Industry still relies too much in the human response to accidents. It could be OK, but not as the main (and last) response. The FSG-10 guide has important DRAWBACKS to rely on their effectiveness. Too much human work, too much elements, and time critical actions. Installing ASVAD in the accumulator, it will stay PROTECTED for years against the nitrogen injection (without any human effort). ASVAD is a simple and RELIABLE valve. It will be ready all the time, waiting for the moment to act. It is the FIRST and the STRONGEST SAFETY BARRIER to avoid the nitrogen injection. ASVAD is completely AUTONOMOUS. It does not need anything more to perform their operation. 42

The stair of the professional behavior. I make it happen We’re here now…. trying to make it happen. here? I’m a performer I find a solution We found a solution and have developed it. I take the responsibility We started on seeking solutions. I recognize the reality We’re aware of the nitrogen problem. here? I hope it go well… I’m a victim I can’t do nothing… Where are you? Where do you want to be? I blame others Can we DO it NOW? I’m not aware of the reality here?

4 IAEA Fundamental Safety Principles ( SF-1 ) Principles to remember… RESPONSIBILITY: The licensee retains the prime responsibility for safety throughout the life time of facilities and activities. GOVERNMENT ROLE: The Government authorities have to ensure that arrangements are made for preparing programmes of actions to reduce radiation risks. PREVENTION OF ACCIDENTS: All practical efforts must be made to prevent and mitigate accidents. The primary means of preventing and mitigating the consequences of accidents is ‘defense in depth’. EMERGENCY PREPAREDNESS AND RESPONSE: Arrangements must be made for emergency preparedness and response for nuclear or radiation incidents. 44

5 Questions Now is your time to act… www.asvad-nuclear.com My First Template 5 Questions Now is your time to act… More information at: info@asvad-nuclear.com or www.asvad-nuclear.com 45

Thanks ! 46