1. Level 2 PSA for the VVER 440/213 Dukovany NPP and Its Implications for Accident Management Jiří Dienstbier, Stanislav Husťák
OECD International Workshop on “Level-2 PSA and Severe Accident Management”, Cologne, March 2004
9/20/2018

2. Conclusions and plans for near future
Outline
Plant features
History of PSA 2
Methodology used
Main characteristics
Containment failure modes
Large event tree - APET
PSA 1 – PSA 2 interface
Main part of APET
Hydrogen model
Fission product release – source term to the environment
Results
Sensitivity studies
Accident management
Conclusions and plans for near future

3. Plant features
4 units in 2 twin-units, twin units in common building, each unit has its own containment
Mostly rectangular leak tight rooms, pressure suppression system … bubble condenser
Recirculation sump is not at the lowest level, possibility to lose ECC coolant to ventilation
Reactor cavity is the containment boundary including double steel cavity door

4. History PSA 2 for unit 1 First (Revision 0) Limited scope Level 2 PSA
From 1995 to April 1998 as US AID project – contractor SAIC (Science Applications International Corporation) with NRI Řež as subcontractor and with plant support
Based on SAIC-NRI level 1 PSA from 1994
Limited to normal operation at power without ATWS, no shutdown states, no external events
4 fission product groups, point estimates of frequencies, uncertainties treated by sensitivity study
Large event tree (APET) method (program EVNTRE)
MELCOR physical analyses
Knowledge transfer to NRI specialists was a part of the project
Revision 1
Autumn 1998 (SAM proposals updated in autumn 1999) by NRI Řež
Using NRI Řež living PSA 1 from 1998 (partially including new EOP), much different from the PSA 1 in rev.0
Extended to fires and internal floods
Large modification of the event tree – about ½ of questions changed keeping their order
Only small modification of basic events
Revision 2
End of 2002, living PSA used, fully taking into account new EOPs, including ATWS sequences (did not propagate into PSA 2)
Revision of the AICC hydrogen burn model
Containment failure (leak type) due to slow pressurisation by steam and non-condensable gases added

5. Main characteristics Main characteristics Limited scope Level 2 PSA
Similar to IPE for US power plants
Limited to normal operation at power including internal events - fires, floods
Not included: External events like earthquake, low power and shutdown states
4 fission product groups – Cs, Te, Ba, noble gases, only Cs+Ba used for sorting the results to release categories
Large event tree (APET) method, the resulting tree has 100 nodes (usually more than 2 states in each node):
12 nodes PSA 1 – PSA 2 interface (PDS vectors)
Nodes 13 to 85 accident progression
Nodes 86 to 100 related to fission product release to the environment – source term
Program EVNTRE (developed by SNL)
The results are probabilities of 12 release categories + results of binning and sorting
About 90 basic events and several physical parameters
Revision 0 only
MELCOR physical analyses of selected sequences (5 basic sequences + their variations), results used to specify some parameters and basic events
Other activities – plant walkdown, containment feature notebook

6. Containment failure modes
Classification of events timing:
Early … before reactor vessel bottom failure (and about 2 hours later for fission products)
Late … after this time
Failure locations in the containment (several possible) and cavity (or cavity door)
Retention in walls or auxiliary building surrounding containment neglected
Containment fragility curve (after DOE/NE-0086, 1989)
Containment – normal distribution, m = 400 kPa overpressure, s = 80.9 kPa
Cavity – normal distribution, m = 2420 kPa overpressure, s = 460 kPa
Possible containment isolation failure
Ventilation lines P-2 (TL-40), O-2 (TL-70)
Drainage, neglected in revision 2

7. PSA 1 – PSA 2 Interface
PDS (plant damage state) vectors representing first 12 nodes of PSA 2 event tree and characterizing the plant systems at the onset of core damage
Respecting US NRC IPE and IAEA recommendations to reflect PSA 1 results
PDS description
First node representing initiating event
13 events, ATWS, ILOCA (interfacing LOCA other than through SG) screened out because of low frequency in PSA 1
initiating events specific for PSA 2, especially RPV-PTS …reactor vessel rupture due to thermal shock
Other 12 events
Different size LOCA – S-LOCA, MS-LOCA, M-LOCA, LG-LOCA
LOCA leading to water loss outside main sump – IL/RCP, IL/POOL
SGCB … SG collector break and lift off, SGTR … SG tube rupture
SB-OUT … steamline break outside containment, SB-IN … steamline break inside containment
TRANS … transient – very similar PDS vectors to SB-OUT, total loss of feedwater in both
SBO … station blackout – failure of electric power supply including category 2
Flood included as SBO 34
Fires in some of the TRANS and IL/RCP initiators

8. PSA 1 – PSA 2 Interface Following 11 nodes
HPI ... state of HP ECC injection and recirculation
LPI ... state of the LP ECC injection and recirculation
Sprays ... state of containment sprays
SHR ... secondary heat removal (mainly feedwater availability)
SecDP ... secondary system depressurisation (important only for SHR OK)
PrimDP ... primary system depressurisation by the operator
ECCS_Inv ... location of (decisive part) of ECC water inventory
VE_Cat2 ... state of category 2 electric power (diesels)
VE_CI ... Two events combined:
containment isolation (CI)
recirculation sump isolation against water loss (fSumpI = sump isolation failed)
VE_CHR containment heat removal system status (not including water and electricity availability)
BC_Drain ... location of bubble condenser water:
These nodes have 2 to 4 attributes
Result – 34 PDS vectors (table 2 in the paper), only 5 of them with frequency > 10-6/y
RPV-PTS, SB-OUT, TRANS, IL/RCP, blackout

9. PSA 1 – PSA 2 Interface
Figure 1 Analysis of CDF

10. APET Nodes (questions) 13 to 85
Development of APET - Main event tree as framework including:
primary pressure before vessel failure, ECCs water location, early recirculation, vessel failure
containment failure early
late recirculation
containment status late
Phenomenology
The same as for PWR reactor (importance often different, e.g. in-vessel hydrogen)
Special connected with cavity design and its function as containment boundary
HPME and cavity failure by gases or steam overpressure
Cavity door failure by debris jet impingement
Containment failure by gases transfer from the cavity
Cavity door failures by thermal effects [1) large, 2) small=loss of sealing, a) within 2 hours after VF, b) late]
Technical systems complicated the event tree and required repeating of some questions:
category 2 electric power early and late
primary system depressurisation
sprays early and late
late phase - water in cavity / cavity door status (to avoid feedback)
Quantification of basic events and physical parameters (quantification tables for probability)
MELCOR plant analyses
detailed problems analysed by MELCOR (cavity)
hand calculation, engineering judgement
literature
Hydrogen
Early and late, same models but different assumptions
Production according to scenario and core damage (full, limited), concentration calculated
Type of burn: no burn – diffusion burn – deflagration – detonation specified according to concentration and other
Consequences calculated for deflagration using AICC model and comparing the modified peak pressure with containment strength curve
no burn – diffusion burn no containment failure
detonation always failure
Update of model in revision 2, the strongest effect had the assumption about electric power not a good igniter

11. Fission product release to the environment - source term
Nodes 86 to 100
Early and late release of Cs, Te, Ba, Xe+Kr in % of inventory
Decontamination factors (DF) - primary, containment, sprays
Revolatilization of early released and deposited f.p. also assumed
Calculation (using DF) using user functions and sorting of releases
The result of 100 is sorted to 12 release categories
Thresholds 0.1, 1.0, 10.0 % of inventory for Cs group and 1 order less for Ba group
In revision 2, the results sorted to 5 classes:
1. early high – more than 1% of Cs or 0.1% of Ba with early containment failure
2. late high – the same with late containment failure
3. early low– between 0.1% and 1% of Cs and 0.01% and 0.1% of Ba with early containment failure or no failure
4. late low - the same with late containment failure
5. very low – less than 0.1% of Cs and 0.01% of Ba
The last class specified according to Swedish and Finnish criteria (0.1% 137Cs)
Noble gases release higher, not used in these classes
We think about adding one more category for LERF (>10% of Cs and I early)

12. Summary results

13. Summary results

14. Results Results sorted according to Consequences for PDS vectors
11 “risk vectors” with early or late high release frequency above 10-7/year found
used for scenario analyses recommendations
initiated by RPV-PTS, SB-OUT or TRANS, SBO, IL/RCP, IL/POOL, SGCB
Core damage
Limited 17,7% (38.5% w/o RPV-PTS) or Full
Pressure at vessel bottom head failure
Low (below 0.8 MPa) 91.8% (82.0%)
Most Important phenomena leading to containment failure
% CDF (w/o RPV-PTS)
E_Byp_Rp … ( 1.40)
E_Rp … (17.56)
Hydrogen deflagration or detonation ( 7.70)
Cavity failure (mostly steam explosion) ( 7.72)
E_Leak … (1.69)
Single SG tube break (0.81)
L_Rp … (0.17)
L_Lk … (12.31)
Thermal failure of door sealing
Basemat penetration
Intact containment … (66.93)

15. Sensitivity studies
Sensitivity studies are the only method to assess uncertainty here
Revision 0 PSA 2
23 sensitivity studies
Showing importance of some basic events like steam explosions
Including accident management
Changing only basic events and parameters, no event tree change
Revision 1
Accident management and preventive measures only
Also small event tree changes if needed
Most efficient
Cavity flooding and external vessel cooling
Primary system depressurisation by operator
Combining depressurisation with other measures

16. Sensitivity studies Revision 2 case without RPV-PTS shown before
case without RPV-PTS and IL/RCP with coolant loss (plant modification)
CDF decreased to 1.15*10-5 / year LERF decreased to 2.30*10-6 /year
primary system depressurisation in SAMG
Low efficiency - mostly low pressure accident and depressurisation in EOP
higher probability of hydrogen early ignition as in the previous revisions
Early containment failure due to hydrogen 4%
higher hydrogen source
“medium”=50% oxidation, “high”=80% (instead of 35% / 50%)
LERF = 1.53*10-5, more than 50% of CDF is early containment failure
lower containment strength
300 instead of 400 kPa median, similar results like for higher hydrogen source
lower containment strength and higher hydrogen source
Early containment rupture 69% CDF, LERF = 2.06*10-5 / year, hydrogen the only risk
lower steam explosion probability in the cavity
0.1 (instead of 0.5) for high molten fraction, 0.01 (0.1) for low molten fraction
containment failure by steam explosion 1.41% CDF (10.43%)

17. Severe accident management
Present situation
Dukovany concentrated on core damage prevention in the past
CDF decreased considerably, more than one order of magnitude
This was due to plant modification and symptom oriented EOP
Plant modifications not included in the last revision of PSA 2
modification to eliminate ECC coolant loss from MCP motor deck (IL/RCP) to start soon
intensive study of RPV-PTS to decrease its probability
Isolation of cavity drainage
for eliminating ECC water loss after RPV-PTS also ventilation line isolation would be needed
using fire pumps for feedwater, filling of SG from tank by gravity – lower blackout CDF
After these modifications, CDF below 10-5/year can be reached
SAMG needed to decrease high early release
WOG generic severe accident management guidelines (SAMG) modified to VVER 440/213
Theory
Accident Management can be divided into “levels of defense”
Measures to restore cooling shortly after core damage and stop the accident in the vessel
Measures to prevent containment failure
Measure to mitigate release for failed or bypassed containment
Higher level usually less efficient
Good “defense in depth” concept to have all levels
VVER-440 with high natural leak requires level 3 also for intact containment
PSA 2 indicates hydrogen as the highest priority, cavity (door) as the second highest priority

18. Severe accident management
Hydrogen
The plant is equipped with PAR for DBA, they are too slow
PHARE showed that even extension of PAR is a problem – too large area needed to eliminate risk of DDT
MELCOR analyses indicate negligible risk for self-ignition at 10% of hydrogen
Caused by large differences in local concentration
Controlled combustion seems the most promising, igniters needed
NRI prepares a project to start in 2005 to analyze their number and location
Cavity and cavity door protection
More complex, the strategy depending on plant modifications – wet or dry cavity
Decision to use in-vessel retention by external cooling not yet taken
If not accepted, we can partially flood the cavity and cool the door
Risk of steam explosion in the cavity must be analyzed
High pressure melt expulsion must be prevented especially for water in the cavity
Existing SAG primary system depressurisation sufficient
Dry cavity strategy … simple thermal protection of cavity door - cheap solution
Other issues can be covered by procedures, except:
Reduction of the release in primary to secondary accidents
Improvement of habitability of the control room

19. Conclusions and plans for near future
Limited scope PSA 2 proved to be a very good tool especially when comparing risk importance of individual phenomena
Extension to shutdown states needed and should start soon
Before next revision of limited scope PSA 2 for power states (in 2006 ?), some problems have to be solved
Most of them already included in other project:
better containment strength calculation … results in 2004
better scenarios … MELCOR analyses in 2004 including SAMG
decreasing conservatism of natural leak from the intact containment …retention in walls and external building … 2004
improved knowledge of steam explosions including cavity strength … ??