Level 2 PSA for the VVER 440/213 Dukovany NPP and Its Implications for Accident Management Jiří Dienstbier, Stanislav Husťák OECD International Workshop on “Level-2 PSA and Severe Accident Management”, Cologne, 29-31 March 2004 9/20/2018

Conclusions and plans for near future Outline Plant features History of PSA 2 Methodology used Main characteristics Containment failure modes Large event tree - APET PSA 1 – PSA 2 interface Main part of APET Hydrogen model Fission product release – source term to the environment Results Sensitivity studies Accident management Conclusions and plans for near future

Plant features 4 units in 2 twin-units, twin units in common building, each unit has its own containment Mostly rectangular leak tight rooms, pressure suppression system … bubble condenser Recirculation sump is not at the lowest level, possibility to lose ECC coolant to ventilation Reactor cavity is the containment boundary including double steel cavity door

History PSA 2 for unit 1 First (Revision 0) Limited scope Level 2 PSA From 1995 to April 1998 as US AID project – contractor SAIC (Science Applications International Corporation) with NRI Řež as subcontractor and with plant support Based on SAIC-NRI level 1 PSA from 1994 Limited to normal operation at power without ATWS, no shutdown states, no external events 4 fission product groups, point estimates of frequencies, uncertainties treated by sensitivity study Large event tree (APET) method (program EVNTRE) MELCOR 1.8.3 physical analyses Knowledge transfer to NRI specialists was a part of the project Revision 1 Autumn 1998 (SAM proposals updated in autumn 1999) by NRI Řež Using NRI Řež living PSA 1 from 1998 (partially including new EOP), much different from the PSA 1 in rev.0 Extended to fires and internal floods Large modification of the event tree – about ½ of questions changed keeping their order Only small modification of basic events Revision 2 End of 2002, living PSA 1 2001 used, fully taking into account new EOPs, including ATWS sequences (did not propagate into PSA 2) Revision of the AICC hydrogen burn model Containment failure (leak type) due to slow pressurisation by steam and non-condensable gases added

Main characteristics Main characteristics Limited scope Level 2 PSA Similar to IPE for US power plants Limited to normal operation at power including internal events - fires, floods Not included: External events like earthquake, low power and shutdown states 4 fission product groups – Cs, Te, Ba, noble gases, only Cs+Ba used for sorting the results to release categories Large event tree (APET) method, the resulting tree has 100 nodes (usually more than 2 states in each node): 12 nodes PSA 1 – PSA 2 interface (PDS vectors) Nodes 13 to 85 accident progression Nodes 86 to 100 related to fission product release to the environment – source term Program EVNTRE (developed by SNL) The results are probabilities of 12 release categories + results of binning and sorting About 90 basic events and several physical parameters Revision 0 only MELCOR 1.8.3 physical analyses of selected sequences (5 basic sequences + their variations), results used to specify some parameters and basic events Other activities – plant walkdown, containment feature notebook

Containment failure modes Classification of events timing: Early … before reactor vessel bottom failure (and about 2 hours later for fission products) Late … after this time Failure locations in the containment (several possible) and cavity (or cavity door) Retention in walls or auxiliary building surrounding containment neglected Containment fragility curve (after DOE/NE-0086, 1989) Containment – normal distribution, m = 400 kPa overpressure, s = 80.9 kPa Cavity – normal distribution, m = 2420 kPa overpressure, s = 460 kPa Possible containment isolation failure Ventilation lines P-2 (TL-40), O-2 (TL-70) Drainage, neglected in revision 2

PSA 1 – PSA 2 Interface PDS (plant damage state) vectors representing first 12 nodes of PSA 2 event tree and characterizing the plant systems at the onset of core damage Respecting US NRC IPE and IAEA recommendations to reflect PSA 1 results PDS description First node representing initiating event 13 events, ATWS, ILOCA (interfacing LOCA other than through SG) screened out because of low frequency in PSA 1 initiating events specific for PSA 2, especially RPV-PTS …reactor vessel rupture due to thermal shock Other 12 events Different size LOCA – S-LOCA, MS-LOCA, M-LOCA, LG-LOCA LOCA leading to water loss outside main sump – IL/RCP, IL/POOL SGCB … SG collector break and lift off, SGTR … SG tube rupture SB-OUT … steamline break outside containment, SB-IN … steamline break inside containment TRANS … transient – very similar PDS vectors to SB-OUT, total loss of feedwater in both SBO … station blackout – failure of electric power supply including category 2 Flood included as SBO 34 Fires in some of the TRANS and IL/RCP initiators

PSA 1 – PSA 2 Interface Following 11 nodes HPI ... state of HP ECC injection and recirculation LPI ... state of the LP ECC injection and recirculation Sprays ... state of containment sprays SHR ... secondary heat removal (mainly feedwater availability) SecDP ... secondary system depressurisation (important only for SHR OK) PrimDP ... primary system depressurisation by the operator ECCS_Inv ... location of (decisive part) of ECC water inventory VE_Cat2 ... state of category 2 electric power (diesels) VE_CI ... Two events combined: containment isolation (CI) recirculation sump isolation against water loss (fSumpI = sump isolation failed) VE_CHR ... containment heat removal system status (not including water and electricity availability) BC_Drain ... location of bubble condenser water: These nodes have 2 to 4 attributes Result – 34 PDS vectors (table 2 in the paper), only 5 of them with frequency > 10-6/y RPV-PTS, SB-OUT, TRANS, IL/RCP, blackout

PSA 1 – PSA 2 Interface Figure 1 Analysis of CDF

APET Nodes (questions) 13 to 85 Development of APET - Main event tree as framework including: primary pressure before vessel failure, ECCs water location, early recirculation, vessel failure containment failure early late recirculation containment status late Phenomenology The same as for PWR reactor (importance often different, e.g. in-vessel hydrogen) Special connected with cavity design and its function as containment boundary HPME and cavity failure by gases or steam overpressure Cavity door failure by debris jet impingement Containment failure by gases transfer from the cavity Cavity door failures by thermal effects [1) large, 2) small=loss of sealing, a) within 2 hours after VF, b) late] Technical systems complicated the event tree and required repeating of some questions: category 2 electric power early and late primary system depressurisation sprays early and late late phase - water in cavity / cavity door status (to avoid feedback) Quantification of basic events and physical parameters (quantification tables for probability) MELCOR plant analyses detailed problems analysed by MELCOR (cavity) hand calculation, engineering judgement literature Hydrogen Early and late, same models but different assumptions Production according to scenario and core damage (full, limited), concentration calculated Type of burn: no burn – diffusion burn – deflagration – detonation specified according to concentration and other Consequences calculated for deflagration using AICC model and comparing the modified peak pressure with containment strength curve no burn – diffusion burn no containment failure detonation always failure Update of model in revision 2, the strongest effect had the assumption about electric power not a good igniter

Fission product release to the environment - source term Nodes 86 to 100 Early and late release of Cs, Te, Ba, Xe+Kr in % of inventory Decontamination factors (DF) - primary, containment, sprays Revolatilization of early released and deposited f.p. also assumed Calculation (using DF) using user functions and sorting of releases The result of 100 is sorted to 12 release categories Thresholds 0.1, 1.0, 10.0 % of inventory for Cs group and 1 order less for Ba group In revision 2, the results sorted to 5 classes: 1. early high – more than 1% of Cs or 0.1% of Ba with early containment failure 2. late high – the same with late containment failure 3. early low– between 0.1% and 1% of Cs and 0.01% and 0.1% of Ba with early containment failure or no failure 4. late low - the same with late containment failure 5. very low – less than 0.1% of Cs and 0.01% of Ba The last class specified according to Swedish and Finnish criteria (0.1% 137Cs) Noble gases release higher, not used in these classes We think about adding one more category for LERF (>10% of Cs and I early)

Summary results

Summary results

Results Results sorted according to Consequences for PDS vectors 11 “risk vectors” with early or late high release frequency above 10-7/year found used for scenario analyses recommendations initiated by RPV-PTS, SB-OUT or TRANS, SBO, IL/RCP, IL/POOL, SGCB Core damage Limited 17,7% (38.5% w/o RPV-PTS) or Full Pressure at vessel bottom head failure Low (below 0.8 MPa) 91.8% (82.0%) Most Important phenomena leading to containment failure % CDF (w/o RPV-PTS) E_Byp_Rp … 0.64 ( 1.40) E_Rp … 23.78 (17.56) Hydrogen deflagration or detonation 12.34 ( 7.70) Cavity failure (mostly steam explosion) 10.47 ( 7.72) E_Leak … 0.77 (1.69) Single SG tube break 0.37 (0.81) L_Rp … 0.16 (0.17) L_Lk … 16.06 (12.31) Thermal failure of door sealing 12.54 7.76 Basemat penetration 2.67 1.85 Intact containment … 58.62 (66.93)

Sensitivity studies Sensitivity studies are the only method to assess uncertainty here Revision 0 PSA 2 23 sensitivity studies Showing importance of some basic events like steam explosions Including accident management Changing only basic events and parameters, no event tree change Revision 1 Accident management and preventive measures only Also small event tree changes if needed Most efficient Cavity flooding and external vessel cooling Primary system depressurisation by operator Combining depressurisation with other measures

Sensitivity studies Revision 2 case without RPV-PTS shown before case without RPV-PTS and IL/RCP with coolant loss (plant modification) CDF decreased to 1.15*10-5 / year LERF decreased to 2.30*10-6 /year primary system depressurisation in SAMG Low efficiency - mostly low pressure accident and depressurisation in EOP higher probability of hydrogen early ignition as in the previous revisions Early containment failure due to hydrogen 4% higher hydrogen source “medium”=50% oxidation, “high”=80% (instead of 35% / 50%) LERF = 1.53*10-5, more than 50% of CDF is early containment failure lower containment strength 300 instead of 400 kPa median, similar results like for higher hydrogen source lower containment strength and higher hydrogen source Early containment rupture 69% CDF, LERF = 2.06*10-5 / year, hydrogen the only risk lower steam explosion probability in the cavity 0.1 (instead of 0.5) for high molten fraction, 0.01 (0.1) for low molten fraction containment failure by steam explosion 1.41% CDF (10.43%)

Severe accident management Present situation Dukovany concentrated on core damage prevention in the past CDF decreased considerably, more than one order of magnitude This was due to plant modification and symptom oriented EOP Plant modifications not included in the last revision of PSA 2 modification to eliminate ECC coolant loss from MCP motor deck (IL/RCP) to start soon intensive study of RPV-PTS to decrease its probability Isolation of cavity drainage for eliminating ECC water loss after RPV-PTS also ventilation line isolation would be needed using fire pumps for feedwater, filling of SG from tank by gravity – lower blackout CDF After these modifications, CDF below 10-5/year can be reached SAMG needed to decrease high early release WOG generic severe accident management guidelines (SAMG) modified to VVER 440/213 Theory Accident Management can be divided into “levels of defense” Measures to restore cooling shortly after core damage and stop the accident in the vessel Measures to prevent containment failure Measure to mitigate release for failed or bypassed containment Higher level usually less efficient Good “defense in depth” concept to have all levels VVER-440 with high natural leak requires level 3 also for intact containment PSA 2 indicates hydrogen as the highest priority, cavity (door) as the second highest priority

Severe accident management Hydrogen The plant is equipped with PAR for DBA, they are too slow PHARE 94 2.07 showed that even extension of PAR is a problem – too large area needed to eliminate risk of DDT MELCOR 1.8.5 analyses indicate negligible risk for self-ignition at 10% of hydrogen Caused by large differences in local concentration Controlled combustion seems the most promising, igniters needed NRI prepares a project to start in 2005 to analyze their number and location Cavity and cavity door protection More complex, the strategy depending on plant modifications – wet or dry cavity Decision to use in-vessel retention by external cooling not yet taken If not accepted, we can partially flood the cavity and cool the door Risk of steam explosion in the cavity must be analyzed High pressure melt expulsion must be prevented especially for water in the cavity Existing SAG primary system depressurisation sufficient Dry cavity strategy … simple thermal protection of cavity door - cheap solution Other issues can be covered by procedures, except: Reduction of the release in primary to secondary accidents Improvement of habitability of the control room

Conclusions and plans for near future Limited scope PSA 2 proved to be a very good tool especially when comparing risk importance of individual phenomena Extension to shutdown states needed and should start soon Before next revision of limited scope PSA 2 for power states (in 2006 ?), some problems have to be solved Most of them already included in other project: better containment strength calculation … results in 2004 better scenarios … MELCOR 1.8.5 analyses in 2004 including SAMG decreasing conservatism of natural leak from the intact containment …retention in walls and external building … 2004 improved knowledge of steam explosions including cavity strength … ??