Long-term loss of all AC power supply sources for Belene NPP November 1, 2015 Reliability, Safety and Management Engineering and Software Development Services

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services  Belene NPP design solutions for BDBA and SA, according to Chapters 15 th and 19 th (ISAR);  Engineering safety features for ensuring safety goals;  IE and safety management systems;  Specific analysis of long-term loss of all AC power supply sources for Belene NPP (WWER-1000, B466) ;  Long-term loss of all AC power supply sources for Belene NPP - Graphical representation of the main results. November 1, 20152

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services General categorization for BNPP (WWER model B466) – “3++”  Third generation: four trains reservation of each safety system (safety function);  “ First +” - hermetic double containment structures (primary and secondary containment);  “Second +”- implementation of “core catcher” concept (to avoid “Large Early Releases”). General design approach for accident management  In order to be ensured diversity of safety functions implementation the following two types of safety systems are foreseen:  Active safety system;  Passive safety system. November 1, 20153

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services Full set of safety systems specific for reactors generation 2 is as follows:  Reactor control and protection active systems;  Active high pressure safety systems for core cooling;  Active low pressure safety systems for core cooling;  Passive safety injection system for core cooling – hydroaccumulators first stage;  Emergency diesel generators for the safety systems;  A large dry, air tight containment for design implementation of the safety functions for more than 24 hours. November 1, 20154

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services Additional engineering safety features, specific for reactors third generation, for ensuring safety goals :  An additional secondary containment for ensuring physical protection of the primary containment and providing air tightness of the containment structure;  Containment venting system between the primary and secondary containment space for preventing radioactive releases into the environment for all the operational conditions;  An additional active safety system for planned and emergency decay heat removal through the steam generators;  An additional passive safety system for emergency decay heat removal through the steam generators;  An additional core cooling passive safety system – hydroaccumulators stage 2 (low pressure hydroaccumulators with a large borated water inventory) (4x33%)  An additional passive safety system for emergency reactor shutdown by injecting a highly concentrated borated water;  An additional system for retaining and long term cooling of the molten core in case of severe accident.;  Automatic safety algorithm for primary to secondary leaks accidents management. November 1, 20155

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services Critical Safety Functions Control of the reactivity; - RPS (existing in WWER and PWR designs); - FBIS (new passive RPS – WWER design solution). Reactor core cooling and residual heat removal; - HA first stage (existing WWER and PWR design solution); - HA second stage (new WWER design solution); - Active emergency high pressure injection system (HPIS)- existing in WWER and PWR designs; - Active low pressure injection system (LPIS)- existing in WWER and PWR designs; Primary side heat removal (through the secondary side); - Heat removal by the steam dump devices from the secondary side (existing WWER and PWR design solutions); - Active emergency and planed cool down and heat removal system through SG (new WWER design solution); - Passive residual heat removal system – (using steam generators) - new WWER design solution; Containment integrity. - Primary pre-stressed concrete containment (the inner one - existing in WWER and PWR design solution); - Primary containment spray system – existing in WWER and PWR design solutions; - Secondary (outer one) concrete containment (new WWER design solution); - Containment ventilation system (for secondary containment volume) – new WWER design solution. November 1, 20156

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services November 1, 20157

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services November 1, 20158

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services November 1, 20159

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services Goals of the analysis: The present analysis is conducted in the context of the Fukushima-1 NPP accident and has the following purposes:  Reactor installation thermohydraulic behavior investigation in case of long term loss of all plant AC power sources (more than 24 hours);  Assessment of plant passive safety systems effectiveness for the given transient conditions in order to determine the time window for keeping the reactor installation into safe conditions without core damage;  Assessment of plant operator’s actions effectiveness for the accident consequences mitigation;  Assessment of the spent fuel pool condition in case of long term loss of all plant AC power sources (more than 24 hours). November 1,

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services Computer codes used for the analysis The analysis is conducted through the thermohydraulic code RELAP5/Mod3.4. The input data deck (reactor installation thermohydraulic model) is developed by Risk Engineering Ltd and Worley Parsons PS. It is based on Belene NPP design documentation. The thermohydraulic model of the reactor installation has been developed for the purposes of the Belene NPP Chapter 15-th independent review of specific accident scenarios. Remark: The spent fuel pool analysis is based on simplified methods without using any computer codes. November 1,

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services Initial events leading to loss of all AC power sources In the analysis performed, the prime causes for the accident are natural disasters like typhoon and earthquake with a degree of impact which exceeds the design bases and leads to the total loss of heat sink and/or loss of all AC power supply sources. The following examples are given:  Typhoon occurrence with potential of plant electrical transmission lines degradation and/or spray ponds depletion;  A large earthquake leading to plant infrastructure destruction;  A large earthquake in combination with a plant site flooding, which leads to loss of the plant connection to the electrical grid and loss of the emergency diesel-generator station’s power supply. November 1,

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services Scope of the analysis 1. Thermohydraulic analysis for the following accident scenarios:  Scenario A1 – Loss of all AC power sources with the availability of 2 out of 4 PHRS trains and operator actions for switching PHRS into cooling mode, 1.9 h after the accident initiation (with „conservative” initial conditions (CS));  Scenario A2 – Loss of all AC power sources with the availability of 4 out of 4 PHRS trains and operator actions for switching PHRS into cooling mode, 1.9 h after the accident initiation (with “best estimate” initial conditions (BE)). November 1,

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services Cases analysed (cont’d) 2. Spent fuel pool analysis for the following cases:  Case 1 – Based on Belene NPP units 1&2 ISAR, Chapter 15-th [1] with the following conservative assumptions: 163 fuel assemblies moved from the reactor after 3 days and 51 fuel assemblies stored in the SFP for 30 days. The total decay heat power in the smaller pool is MW at initial SFP water level m, the SFP water temperature 60 degC and pressure 0.1MPa.  Case 2 - Based on Belene NPP units 1&2 ISAR, Chapter 15-th [1] and additional calculations with the following “best estimate” assumptions: reactor installation is into plant operating state for refueling before removing the reactor core into SFP, in the smaller pool are situated 214 fuel assemblies with storage from 1 to 4 years. The total decay heat power in the smaller pool is MW, the SFP water temperature 60 degC and pressure 0.1MPa. November 1,

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services Initial conditions for Scenario A1 and A2 November 1,

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services Assumptions for the analysis For Scenario A1 the following assumptions are made:  As result of the loss of all AC power sources, the delivery of sealing water for the MCP is interrupted. In compliance with [1] the maximal leak through the MCP sealings is 0.05 m 3 /h ( kg/s at primary pressure 16 MPa and primary coolant density about 750 kg/m 3 ). It is assumed that during the transient progression a non- compensable leak through all the MCP sealings occurs, with a volumetric flow rate of 0.05 m 3 /h for the first 24 h after the accident initiation (according to [2] in case of loss of all AC power sources, degradation of the MCP sealings does not occur for 24 h after the accident initiation);  Availability of 2 out of 4 PHRS trains;  Operators switch the available PHRS trains into cooling mode, 1.9 h after the accident initiation. For Scenario A2 the same assumptions are made with the exception that 4 out of 4 PHRS channels are available. November 1,

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services Main conclusions of the analysis As a result of the thermohydraulic analysis conducted the following main conclusions are formulated:  The plant passive safety systems perform effectively their function for reactor installation to be kept in safe condition without core uncovery and further core damage for a very long time period;  The time periods for reaching the core upper part uncovery at relatively constant mass flow rates through the MCP sealings leaks are 159 and 231 days for Scenario A1 and A2 respectively;  A scenario without PHRS switching into cooling mode is not analyzed, because according to the plant design, lead-acid batteries 220 V DC for the passive safety systems are foreseen. These batteries are designed for beyond design and severe accidents and their requested discharge time is 24 h; November 1,

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services Main conclusions of the analysis (cont’d)  Operator actions for switching the available PHRS trains into cooling mode leads to primary pressure decreasing and borated water injection from hydroaccumulators first and second stage consecutively (Figure -4). About two months after the accident initiation, core uncovery and further core damage are not observed. The total primary mass inventory is 267 and 289 tons for Scenario A1 and A2 respectively (Figure ‑ 1). The PRZ vessel collapsed level is above 8 m for both of the scenarios analyzed. It means that there is a huge primary coolant inventory maintained and the PRZ level even exceeds the nominal one. The inventory is maintained by hydroaccumulators second stage (960 m 3 ).  The maximal fuel cladding temperature does not exceed its initial value of 350 o C for the whole transient period analyzed – about two months (Figure ‑ 2). All the reactor installation parameter’s values are in compliance with the plant design; November 1,

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services Main conclusions of the analysis (cont’d)  For both scenarios analyzed, the cold overpressure protection limits of the reactor vessel are not violated even though the primary cool-down speed exceeds the design values for Scenario A2. Due to the obvious effectiveness of PHRS when 2 out of 4 trains are available in cool-down mode (Scenario A1) and the maximal reached cool-down speed is 40 o C/h, it could be recommended 2 out of 4 PHRS trains to be used in cool-down mode especially when the decay heat power is relatively low and there is no primary LOCA caused by primary pipeline break;  As a result of the loss of all AC power supply sources and the resulting secondary pressure increasing, a short term SDA opening and minimal loss of secondary water inventory to the atmosphere is observed. This is foreseen in the plant design by the large SG secondary water inventory. PHRS maintains the secondary pressure within the limits of 5.1 and 6.05 MPa, but when PHRS trains are switched into cooling mode, the maximal secondary side pressure decreases to 0.2 MPa and 0.1 MPa for Scenario A1 and A2 respectively (Figure ‑ 5, Figure ‑ 6). It is obvious that the assumption for availability of 2 out of 4 PHRS trains does not lead to reopening of SDA of SG with non-operable PHRS trains. Therefore, the PHRS operation ensures that a large SG secondary side water inventory is kept, which contributes the decay heat removal by the intact PHRS trains for a very long period of time; November 1,

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services Main conclusions of the analysis (cont’d)  Operator actions of closing the MCP sealing’s valves could avoid primary coolant loss for the first 24 h of the accident initiation;  In accordance with [1] (SFP analysis – Case 1), the time period for reaching the spent fuel assemblies uncovery in the smaller pool of the SFP is 28 h in case of conservative assumptions. Therefore, keeping the spent fuel pool into safe condition without spent fuel assemblies uncovery and further damage, is strongly dependent on timely operator actions for the SFP cooling restoration and/or undertaking operator actions for borated water injection into the SFP from an external source. The SFP feed water mass flow rate which is necessary to compensate the evaporation process is 8.11 kg/s;  In accordance with the data in [1] and the additional calculations performed (SFP analysis – Case 2), the time period for reaching the spent fuel assemblies uncovery in the smaller pool of the SFP is 626 h when the initial SFP water level is m (full level) and 174 h when the initial SFP water level is m (water level during repair of SFP lining). The SFP feed water mass flow rate which is necessary to compensate the evaporation process is 0.39 kg/s. In this case, plant operators have prolonged time period for undertaking actions for SFP feeding from an external source. November 1,

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services November 1,

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services Figure -1 Total primary mass inventory for Scenarios A1 and A2 November 1,

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services Figure -2 Primary pressures for Scenarios A1 and A2 November 1,

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services Figure -3 Maximal fuel cladding temperatures for Scenarios A1 and A2 November 1,

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services Figure -4 Pressurizer collapsed levels for Scenarios A1 and A2 November 1,

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services Figure -5 Secondary pressures (SG1 ÷ SG4) for Scenario A1 November 1,

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services Figure -6 Secondary pressures (SG1 ÷ SG4) for Scenario A2 November 1,

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services [1] Belene NPP Unit 1,2. Technical Design. Appendix 1. Interim Safety Analysis Report. Chapter 15. Accident Analyses; [2] Отчет об испытаниях на герметичность блока уплотнения ГЦН-195М во время его отключения продолжительностью на 24 часа на рабочих параметрах первого контура при одновременном отключении всех вспомагательных систем ОТ-152-Т. November 1,

RISK ENGINEERING LTD. Reliability, Safety and Management Engineering and Software Development Services Headquarters: 10, Vihren str. Sofia 1618 Bulgaria Tel Fax: November 1,

November 1, 2015 THANK YOU!