1015 Leveraging Specific Plant Features to Manage Internal Hazards

Leveraging Specific Plant Features to Manage Internal Hazards
Harri Tuomisto
Fortum Power
POB 100, Keilaniementie 1
FI-00048 FORTUM, Espoo, Finland
[email protected]
ABSTRACT
Internal hazards and accident progression are often determined by plant-specific
features. A typical feature of internal hazards and a special concern of accident progression
are that they challenge simultaneously more than one functional level of the defence-in-depth
concept or penetrate more than one of the physical barriers against fission product releases.
Internal hazards can themselves be initiating events, such as common cause failures, internal
fires or floods, missiles, inhomogeneous boron dilution, or primary-to-secondary leakage
accident. Internal hazards can also be created during the accident progression such as
pressurized thermal shock, loop seal issue, boron crystallization, containment sump clogging,
or inherent boron dilution mechanisms. The aim of this paper is to discuss, how various
internal hazards are managed at the Loviisa VVER-440 units. The Loviisa plant configuration
is quite unique, since the original VVER-440 design has been amended with ice condenser
containment, specific reactor coolant pumps and many other features.
1
INTRODUCTION
As a consequence of the Fukushima accident management of external hazards and
severe accident management (SAM) have been subject to an increased attention at nuclear
power plants. The lesson learnt was that there might be cases of paying too little attention to
external hazards in comparison to the risks they might pose for the plant. On the other hand,
the approaches chosen to the SAM vary significantly across the countries and nuclear power
plants. The stress tests and regulatory processes following the Fukushima accident have
clearly identified further need to reinforce mitigation of severe accidents and preparedness
against all credible external hazards as well as increase the plant security. Although the main
attention is currently on the external hazards, one has to keep in mind the fundamental
significance of internal hazards being a continuous threat to the successful defence in depth.
The plant-specific features of the Loviisa VVER-440 units were extensively utilized
when developing and implementing a comprehensive SAM programme to respond to the
plant-specific vulnerabilities. The SAM programme development and implementation was
carried out during the period from 1986 until 2004 [1], [2].
Respectively, the internal hazards and accident progression are often determined by plantspecific features. A typical feature of internal hazards and a special concern of accident
1015.1
1015.2
progression is that they challenge simultaneously more than one level of the defence-in-depth
concept or penetrate more than one of the physical barriers of the fission product releases.
Figure 1: Loviisa power plant in summer and winter
The aim of this paper is to discuss, how the management approaches were developed
and to present how the resolutions were implemented for some of the internal hazards
identified for the Loviisa VVER-440 units. The Loviisa plant configuration is in many
respects quite unique, since the original VVER-440 design has been added with ice condenser
containment, specific reactor coolant pumps and several other features. In many cases we
integrated deterministic and probabilistic analyses to study various possibilities and plant
capabilities to resolve the raised issues. Most of the presented work has been carried out
already many years ago. The reason to revisit these developments is to bring further insights
and perspective to the current work done as post-Fukushima actions on external hazards,
extensive damage conditions and severe accident mitigation.
2
PLANT-SPECIFIC FEATURES
The Loviisa Nuclear Power Plant consists of two VVER-440 units, which started
commercial operation in 1977 and 1980. VVER-440 is a pressurized water reactor that has a
relatively low power core being originally 1375 MWth that gives about 450 MWe from two
turbines (since 1997 with upgraded power 1500 MWth and 500 MWe, respectively). Specific
features of VVER-440 are a specific control assembly design with fuel followers, six primary
loops (equipped with gate valves both in hot and cold legs), horizontal steam generators and
primary loops having so-called loop seals both in the hot and cold leg). The geometry and 3D
structure of the Loviisa primary circuit is shown in Fig. 2.
Figure 2. Primary circuit of Loviisa VVER-440
1015.3
There are also significant design features that are different from the original VVER-440
design, such as an ice-condenser containment, four train emergency core cooling systems and
German I&C system, special type reactor coolant pumps that were all implemented already
during the construction phase. Fig. 3 shows the principal design of the ice-condenser
containment. The implications of ice condenser design at power operation, internal hazards
and SAM were reviewed in an earlier work [3]. The ice condenser design differs significantly
in certain respects from the other 12 ice condenser containments built to Westinghouse
reactors. Loviisa ice condensers comprise of two separate sections, air handling units are
outside containment, and there are no air return fans from the upper compartment to the lower
compartment (but there is a small one-way bypass in the reverse direction).
Ice condenser
Figure 3. Loviisa ice condenser containment
After the start-up of Loviisa 1 and 2 in 1977 and 1981, respectively, a large number of
technical improvements have been implemented at the plant. Many of these improvements
have been installed based on an identified internal hazard.
3
VARIOUS INTERNAL HAZARDS
This section collects various internal hazards that were raised mainly during the first
fifteen years operation of the plant. A common feature of these hazards is that they penetrate
multiple functional levels of the defence-in-depth concept, or even multiple physical barriers
against fission product releases. Successful management of the hazards significantly reduces
the overall risk evaluated with probabilistic risk analysis (PRA). The studied and managed
hazards have been listed in Table 1 in two groups: Internal hazards occurring during a
transient or accident, and Internal hazards as an initiating event.
Plant-specific features that create the given hazard or have been utilized for resolving it
are included for each hazard. Table 1 also offers a speculation of the origin of the concern
raised, approximate or indicative period of resolution and references to original works. Some
of the hazards and their treatment are further explained in the following subsections.
1015.4
Table 1: Internal hazards considered in Loviisa safety analyses
Internal hazard
Plant-specific features
Concern raised
from
Resolution
period
Ref.
Internal hazards occurring during an accident
 High neutron fluence on the RPV wall.
 Impurities (Cu, P) in the critical weld
RPV surveillance
results
Regulatory issue
1980 – 2011
1996 cont.
[4] [6] [6]
In-house concern
1984 - 1994
[14]
Regulatory issue
1979-1981
1991-1994
2010-2011
[7] [8]
TMI-2 accident
Regulatory issue
1979-1981
1997-2000
[9]
Regulatory concern
1990-1995
[10] [12]
In-house concern
about equipment
qualification
1987-1990
[3]
Nonunifrom ice sublimation Ice condenser design
In-house concern
Regulatory concern
1980 -
[15] [17]
Skyshine
In-house concern
1980 -
[16]
PTS: pressurized thermal
shock to reactor pressure
vessel (RPV)
Boron crystallization (during  Hot leg loop seals: No reflux boiling
loss-of-coolant accidents)
 Ice condenser: Borax contained in ice
 Fuel assemblies with shroud
Sump clogging by insulation
debris (during loss-of-coolant
accidents)
 Rock wool insulation of pipes
 Sump strainer design
 Fuel assemblies with shrouds
Loop seal issue (during loss-  Loop seals both in the hot and cold legs
of-coolant accidents)
 RCP design
 Horizontal SGs
Inherent inhomogeneous
boron dilution
Superheat in lower
compartment during steam
line break accidents
 Horizontal steam generators
 Loop seals
Isolated lower compartment from the main
containment volume.
Containment roof structure
Internal hazards as an initiating event
PRISE: large primary-tosecondary leakage accident
Horizontal steam generator: primary
collector cover
Regulatory issue
1984-1995
Turbine hall fire
Emergency feed water pumps located in
the turbine hall
In-house concern
Regulatory issue
1980 -
External inhomogeneous
boron dilution
Primary circuit: main gate valves, loop
seals
Regulatory concern
1991-1995
Internal flood
Emergency feed water pumps located in
the turbine hall
In-house concern
1989 -
3.1
[18]
[19][18]
[21]
[10] [11]
[20]
Pressurized Thermal Shock to the Reactor Pressure Vessel
The first surveillance specimen test results of Loviisa 1 in 1980 showed a higher
neutron irradiation embrittlement than expected for a rector pressure vessel (RPV) weld. To
ensure safe operation of the RPV, several modifications were accomplished in the plant. The
reactor core size was reduced in order to reduce neutron fluence on the RPV wall by replacing
36 peripheral fuel assemblies with stainless steel dummies. The temperature of the emergency
core cooling system (ECCS) water tank was increased to 55C, and the temperature in the
ECCS accumulators injecting directly to the downcomer was increased to 100C.
The decisions of plant modifications were based on the brittle fracture calculations for
postulated large break and medium size break LOCAs. Soon it was realized that potential risk
from slower overcooling events characterized by high system pressure (Pressurized Thermal
Shock, PTS) might be higher than from postulated LOCAs. An extensive PTS analysis started
1015.5
with deterministic assumptions. Structural analysis assessments include detailed 3D fracture
mechanics calculations assuming nonuniform temperature and heat transfer fields in the RPV
downcomer. Since a lot of uncertainties remained and system interactions are very complex,
the assessment was complemented with a probabilistic PTS study [4]. Probabilistic
assessment covered all potential PTS initiators, and all the plant conditions including full
power, hot zero power and plant cooldown and heatup phases, and a large number of
transients were included. The probabilistic approach gives a quantitative estimate of the
importance of the PTS issue in relation to the overall safety [5]. New modifications were done
such as upgrading the whole secondary circuit safety actuation signals. The critical weld area
of the RPV of Loviisa 1 was thermally treated in 1996 to recover the ductile properties of
weld material. [6]
The RPV licensing is based on the deterministic assessments, even though the
probabilistic PTS risk is updated regularly. Only a few transients (typically six) have been
selected to represent assumed limiting cases according to the deterministic failure criteria for
design basis events. The selection of these transients is based on the PTS risk results and they
satisfy also the deterministic considerations. External flooding of the reactor vessel has been
included to the considered transients.
3.2
Inhomogeneous boron dilution
The boron dilution transients covered originally in the scope of the Safety Analysis
Report dealt solely with homogeneous external dilution. Water of low or zero boron
concentration being injected to the primary circuit, was assumed to mix quite perfectly with
all the primary coolant inventory. No significant safety concerns remained in regard to the
homogeneous dilution.
When reactivity accidents were reassessed independently after the Chernobyl accident
in various countries, inhomogeneous external dilution events were recognized. Steam
generators, chemical and volume control system, diluted accumulator or diluted refueling
water storage tank and diluted containment sump were identified as potential sources of
diluted water. Dilution may occur during any operating conditions. The sequence of events
may vary significantly in different scenarios such as pure water from the secondary side flow
to the primary circuit due to maintenance errors during shutdown, reactor coolant pumps
(RCP) may stop during inadvertent dilution thus initiating slug formation or inadvertently
diluted accumulators may leak into the primary circuit. Probabilistic risk assessment turned
out to be a viable tool for analysing the importance of these events.
Because of the complex geometry of the primary loops and the main gates valves in
both the hot and cold legs, there are various extra aspects of slug formation and transport in
VVER-440 reactors. The risk of a serious reactivity accident was found to be too high.
Consequently, various actions were taken, including changes in automation, operating
procedures and equipment [11]. The measures ensure interruption of dilution when one or
more RCPs stop, maintain adequate boron concentration in the pipelines of the make-up water
system, and flush the loop by reverse flow before starting a RCP. A new dilution tank was
installed in 1994 containing mild boron solution with minimum controlled boron
concentration (1200 ppm below the hot zero power critical boron concentration). After the
performed modifications the frequency of a serious reactivity accident due to an external
boron dilution is much less than 10-6 per reactor year.
When primary coolant inventory decreases during such accidents as small break
LOCAs, anticipated transient without scram (ATWS) and primary-to-secondary leakage
1015.6
accidents, a boiling/condensing heat transfer mode may be established between the core and
steam generators. During such inherent dilution conditions condensate with very low boric
acid concentration can accumulate in the loop seal leading to creation of a nonborated slug.
The slug can be transported to the core after re-establishing the natural circulation or starting a
RCP in the primary circuit. Another inherent dilution mechanism considered is a possible
backflow of water from the steam generator secondary side to the primary circuit during
primary-to-secondary leakage accidents.
The mechanism of inherent boron dilution was introduced by Finnish regulatory
authority STUK [12] and inherent dilution research program was initiated. In an OECD
Specialist Meeting on Boron Dilution in 1995 [10], a series of papers were presented on slug
formation and transport at Loviisa. The experience gained from these studies were later
disseminated through European research project EUBORA [13], which emphasized the fluid
mixing phenomena in mitigating the consequences of such dilution events.
Interestingly enough, we had carried out an extensive experimental and analytical
research programme in collaboration with VTT and Lappeenranta University of Technology
during 1980’s concerning a reverse problem i.e. a possibility of boron crystallization in the
reactor during long-term phase of LOCAs. The identified threat was that solidified boric acid
could block the fuel assemblies and lead to heatup of the fuel. The issue was finally solved
through detailed consideration of the specific features of Loviisa reactors. [14]
3.3
Primary-to-Secondary Leakage Accidents (PRISE)
PRISE is a particular concern for VVERs that are equipped with horizontal steam
generators. The original design of primary collectors inside the steam generator made a fair
likelihood for large PRISE with equivalent leakage to tens of tube failures. Design measures
have been taken to eliminate this leakage path.
PRISE management is tricky as there are various and sometimes contradictory
objectives:




strict limits have to be met for the doses caused by releases (design basis domain)
accident progression to core damage has to be prevented
excessive PTS to the RPV has to be prevented
inherent boron dilution mechanisms have to be prevented
The analyses from the each objective’s viewpoint have to be made separately [18].
Cases of PTS and boron dilution were discussed above. Extensive plant modifications were
done to obtain the design basis goal for the doses.[19]
3.4
Sump strainer clogging
Sump strainer clogging due to insulation debris was identified as an internal hazard
already in early days of plant operation. Containment sump strainers were designed and tested
to withstand the clogging. After the Barsebäck incident in 1992, new aspects related to debris
formation and properties called for a complete redesign and replacement. [7] Experience in
sump straner testing and design was utilized for a number of other VVER plants.
Recently the debris issue was raised again, now concerning possible blocking of fuel
assemblies in the core by small fiber debris.[8]
3.5
Hazards arising from the containment design
Ice condensers suffer from nonuniform sublimation of loaded ice, which raises a
concern of ice condenser bypass and containment overpressure during accidents with steam
1015.7
release into the lower compartment. [15] [17] A steam line break leaking to the lower
compartment can cause temporary elevated temperature levels that exceed the equipment
qualification values because of the limited volume. [3]
The containment roof structure is not massive and γ radiation from noble gases released
to the containment during accidents can penetrate the roof easily. Backscattering of this
radiation down to the plant area, i.e so-called skyshine, can restrict moving on-site and cause
significant difficulties to accident management actions. [16]
3.6
Turbine hall fire and internal flood
These hazards are typically treated as “external events” in PRA. The risk arising from
fires in the turbine hall was identified to be quite high. Plant modifications for ensuring
residual heat removal have reduced the risk, since operation of systems located in the turbine
hall is no longer necessary.[21] The new autonomous emergency feedwater system (with
directly diesel-driven pumps) was installed into a dedicated building. Additionally, a number
of structural changes have been performed to improve fire protection in the turbine hall.
One of the most important findings was that water jets from feedwater system on top of
the control building could fail the floor and harm I&C and electrical systems. Another
important initiator was a break in the circulating water system in the turbine building. This
event could lead to flooding of the reactor building basement through cable tunnels and fail
reactor coolant pump seal cooling pumps and ECCS equipment. Walls have been built to
prevent this sequence. High sea level could lead to same consequences during annual outage
when the circulating water system is under maintenance and isolated from the sea by a
temporary dam. A new procedure and a higher dam have been established. These changes
have reduced the risk nearly with two orders of magnitude.[20]
Table 2. Potential penetration of defence-in-depth caused by internal hazards
Internal hazard
Functional level
1
2
3
4
Extra challenge to physical barriers
5
Fuel cladding
Primary circuit
Containment
PTS: pressurized thermal shock
Boron crystallization
Sump clogging
Loop seal issue
Inherent inhomog. boron dilution
Superheat in lower compartment
Nonunifrom ice sublimation
Skyshine
PRISE
Turbine hall fire
External inhomog. boron dilution
Internal flood
Explanation of colours in penetration of physical barriers:
Caused by initiating event
4
Direct threat
Potential threat
CONCLUSIONS
Internal hazards can be a serious threat to nuclear safety as they can penetrate more than
one functional level and physical barriers of the defence-in-depth concept. Their resolution
requires good understanding of various disciplines, application of multiphysics methods and
integration of deterministic and probabilistic analyses.
Many of the identified internal hazards and particularly their resolution are related to
plant-specific features and necessitate a plant-specific assessment.
1015.8
REFERENCES
[1] H. Tuomisto, T.G. Theofanous: "A consistent approach to severe accident management", Nuclear
Engineering and Design 148 (1994) 171-183
[2] P. Lundström, O. Kymäläinen, H. Tuomisto, "Implementation of Severe Accident Management strategy at
the Loviisa NPP", OECD Workshop on the Implementation of Severe Accident Management Measures,
Villigen, Switzerland, 10-12 September 2001
[3] H. Tuomisto, "Specific mitigative features of the Loviisa ice condenser containments", Int. Conf. on
Nuclear Containment, Cambridge, UK, 23-25 September 1996
[4] M. Komsi, R. Ahlstrand, T. Larm, B. Mohsen, A. Neuvonen, H. Tuomisto, U. Vuorio: "The probabilistic
PTS study of the Loviisa Unit 1 reactor pressure vessel", Int. Topical Conf. on Probabilistic Safety
Assessment and Risk Management PSA'87, Zürich, Switzerland, 30.8.-49.1987, Vol.III, pp. 823-828
[5] H. Tuomisto, P. Rajamäki: "Experience from overcooling transient selection, thermal hydraulic analyses
and structural calculations in the Loviisa assessments", Topical Mtg on WWER-440/230 Reactor Pressure
Vessel Pressurized Thermal Shock Analysis, Pieštany, Slovak Republic, May 22-26, 1995
[6] J. Kohopää, H. Jokineva, ”Loviisa 1 successfully annealed”, Nuclear Engineering International, November
1996, pp. 18-19
[7] T. Hyrsky: “Sump strainers at Loviisa plant”, Proc. OECD/NEA Workshop on the Barsebäck Strainer
Incident, Stockholm, Sweden, 25-27 January 1994.
[8] S. Tarkiainen, O. Hongisto, T. Hyrsky, H. Kantee, I. Paavola: " Safety impact of the insulation fibers
penetrating sump strainers and accumulating in Loviisa VVER-440 fuel bundles", Proc. 7th Int. Scientific
and Tech. Conf. "Safety Assurance of NPP with VVER", 17 - 20 May 2011, Podolsk, Russian Federation
[9] H. Tuomisto: "Experimental and analytical studies of loop seal effects in the primary circuit", Proc. of
Spec. Mtg on Experimental and Modelling Aspects of SBLOCA, IAEA-TC-427.5, Budapest, Hungary, 3-7
October 1983, pp. 63-67
[10] Proc. of OECD/NEA Specialist Meeting on Boron Dilution Reactivity Transients, NEA/CSNI/R(96)3,
State College, PA, USA, 18-20 October 1995
[11] P. Siltanen, M. Antila, “Extended protection against reactivity accidents caused by slugs of diluted water in
the Loviisa reactors”, 2nd Symposium of AER, Paks, Hungary, 21-26 September 1992
[12] J. Hyvärinen: “An inherent boron dilution mechanism in pressurized water reactors”, Nuclear Engineering
and Design 145 (1993) pp. 227-240
[13] H. Tuomisto et al, "EUBORA - Concerted Action on boron dilution experiments", FISA-99, Symposium on
EU Research on Severe Accidents, Luxembourg, 29 November - 1 December 1999, pp. 588-596
[14] J. Tuunanen, H. Tuomisto, P. Raussi: "Experimental and analytical studies of boric acid concentrations in a
VVER-440 reactor during the long-term cooling period of loss-of-coolant accidents", Nuclear Engineering
and Design 148 (1994) pp. 217-231
[15] H. Tuomisto, O. Hongisto: "Ice melting progress in a nonuniformly loaded ice condenser facility", Nuclear
Engineering and Design 120 (1990) 67-74
[16] T. Eurajoki: “Severe accident skyshine radiation analysis by MCNP”, Transactions of the American
Nuclear Society, Vol. 71, ANS Winter Meeting, Washington DC, 13-18 Nov 1994
[17] O. Vanhanen: “Maintenance experience of Loviisa ice condensers”, Int. Ice Condenser Symposium, 15-18
April 1991, Charlotte, NC, USA
[18] H. Kantee, H. Tuomisto, "Large primary-to-secondary side leakage accidents in Loviisa VVER-440
reactor", 1993 RELAP5 International Users Seminar, Boston, MA, USA, July 6-9, 1993
[19] B. Mohsen, K. Jänkälä: "Management of primary-to-secondary leaks at Loviisa nuclear power plant", Proc.
3rd Int. Seminar on Horizontal Steam Generators, 18-20 October 1994, Lappeenranta, Finland, pp. 220-225
[20] K. Jänkälä, B. Mohsen, J.K. Vaurio “Flood risk assessment of Loviisa NPP”, Proc. Probabilistic Safety
Assessment and Management, PSAM-III, ESREL ‘96, June 24–28, 1996, Crete, Greece
[21] M. Lehto, K. Jänkälä, B. Mohsen, J.K. Vaurio, "Fire risk analysis for Loviisa 1 during power operation,"
Proc. Int. Topical Mtg on Probabilistic Safety Assessment (PSA'96), Park City, Utah, USA, September 29 October 3, 1996, Vol. 1, pp. 507-514