Several weeks ago, Japan's NHK network sent a crew over to interview me about Boiling Water Reactor (BWR) severe accidents and BWR reactor safety in the wake of the March 11 earthquake / tsunami in Japan and the resulting accident at Fukushima Dai-ichi. I understand the interview is to air around mid August. This posting is the text of my notes from the interview...
QUESTION 1. What was analyzed in "SBO at Browns Ferry Unit One-Accident Sequence Analysis"?
ANSWER:
A “Long-Term Station Blackout” sequence was analyzed in the 1981 study. The Browns Ferry Unit 1 plant (A BWR-4/Mk-I) was assumed to be operating at 100% power when an unspecified event was assumed to occur which eliminated all off-site power and disabled the on-site backup emergency diesel generators. Otherwise, the plant was assumed to be undamaged and fully functional.
Using the best available computer models at the time, the ORNL team analyzed the sequence of events following accident initiation, assuming a 4-hour station battery lifetime. A few different variations of the accident were studied, but the basic sequence assumed the then-existing operational procedures and accident mitigation system actuation procedures were followed. The study identified the major accident sequence events, event timing, and characterized the overall accident sequence progression from the initiating event up until primary containment failure
As expected, the simulations indicated that up until the time the station batteries were exhausted at 4 hrs, the plant incurred no damage and could recover normally during that period if diesel generators or off-site power were recovered.
4 hr – loss of reactor vessel injection as batteries are exhausted
5 hr – top of core is uncovered
7 hr – the lower head of the reactor vessel fails
8.5 hr – primary containment drywell EPAs fail
In later studies with a 6-hr battery life, and assuming the reactor is depressurized, reactor vessel failure is delayed until ~ 10.5 hrs, and reactor vessel failure is delayed until ~ 15.5 hrs.
QUESTION 2. Numbers of accident sequence analysis have done on other reactors. Compare to other types, what were the distinctive feature of Browns Ferry Unit One or Mark 1?
ANSWER:
With regard to the reactor, Browns Ferry Unit-1 was originally a 3440 MWt / 1152 MWe BWR-4, with an operating pressure of ~ 1020 psig / 7 MPa an operating temperature of 530 F / 275 ºC. While BWR power levels vary, the operating pressure and temperatures of BFNP-1 were characteristics of most BWRs. PWRs operate at about twice the pressure of BWRs.
With regard to the containment, BFNP-1 is a Mark-I containment similar to Fukushima Dai-Ichi. The primary containment consists of a compact “drywell” which encloses the reactor vessel. The drywell is connected to a large torodial “wetwell”, which contains a ~ 1 million gallon “pressure suppression pool”. All BWR’s employ suppression pools. PWRs do not employ pressure suppression pools. Primarily as a result of this fact, and the much higher operating pressure of PWRs, PWRs generally have larger primary containments around the reactor vessel to accommodate the blowdown of steam and water from the reactor vessel in the event of a loss of coolant accident.
A “reactor building” secondary containment surrounds the primary containment, housing most of the critical operating system components, as well as providing space for the refueling pool and other plant processes. This secondary containment concept is common to all BWRs, but is not employed in the same manner in PWRs.
QUESTION 3. Did you identify vulnerabilities of the design? e.g. shorter meltdown time, size of containment, problems of ECCS, probable hydrogen explosion and etc.
ANSWER: As a newbie at the time in 1981, I was surprised that the estimated station battery lifetime was just 4-6 hours. But this was the norm in nuclear power plants at that time. Other than observing this fact, and its impact on the time to core uncovery and core damage, we did not really draw attention to the need to do anything about it. So long as there were multiple station batteries, multiple onsite emergency diesels, and multiple off-site power feeds (which was the case at Browns Ferry), this just didn’t seem to be a problem. An event that could take-out all of these power supplies, and keep them out of service for days on end simply wasn’t deemed credible.
The time to initial core uncover following loss of station batteries was not really a surprise as it’s basically a hand calculation.
The small size of the primary containment did attract our attention. The primary containment (drywell and pressure suppression pool) was sized to handle a large break loss of coolant accident. Given that BWRs only operate around 1000 psi, (rather than 2000 psi as PWRs do), and given that BWRs employ pressure suppression pools to condense steam from such an accident, the BWR containments are much smaller than PWR containments. However, in the case on an unmitigated long-term station blackout, the small containment size increases the challenge of maintaining primary containment – particularly if the reactor vessel melts through, and even more-so if the reactor is pressurized at the time it melts through. In our analysis, the impact of the small containment size was reflected as rather rapid containment pressurization and heatup following reactor vessel melt-through – which led to failure of the containment electrical penetration assemblies about 1.5 hours after reactor vessel failure.
Though we did not identify it in 1981, in the following years, the possibility of a unique BWR MK-I severe accident containment failure mechanism was identified and extensively studied. Basically, it had to do with the possibility that due to the small size of the drywell, after reactor vessel melt-through, molten core/concrete debris might possibly contact and fail the steel drywell liner that constitutes the primary containment shell. The probably of this failure mechanism was determined to be plant specific, and it was ultimately determined that the probability of this failure occurring was very low if there was just several inches of water on the drywell floor during this phase of the accident.
Relative to the ECCS design, the 1981 study did identify some changes to the HPCI/RCIC system that would reduce the probability of their failure during the station blackout event.
Our 1981 study really did not look at hydrogen explosions, though we did note that several hundred kilograms of hydrogen were generated during the accident. We terminated the analysis when the primary containment failed. However, in subsequent analysis over the next several years, we devoted considerable attention to the behavior of hydrogen once it escaped into the reactor building. We looked in detail at hydrogen burns and detonations in the reactor building, and the likely response of the reactor building to such events. The moment I saw the video of the first explosion at Fukushima, I turned to my wife and said, “They’ve had a hydrogen explosion in the reactor building.”
QUESTION 4. In 1976, three engineers left GE calling for shut down of Mark 1 plants and demanded to take necessary steps to ensure the safety of the nuclear reactors. They claimed that Mark 1 has design problems. How did you think of their claims?
ANSWER:
I am not familiar with that situation nor their claims, so I really cannot comment on it.
QUESTION 5. GE3 evaluated Mark 1 "the most dangerous" plants. How do you think of their assessment as a person who did SBO sequence analysis?
ANSWER:
I am not familiar with that situation, so I cannot comment on it.
The BWR severe accident studies continued at ORNL for almost twenty years. Also, and more importantly, the NRC issued a requirement in 1988 that every U.S. nuclear plant conducted a so-called “Individual Plant Examination” or “IPE”. The IPE’s were designed to systematically examine each plant’s vulnerability to severe accidents. NRC summarized the overall insights from these IPEs in NUREG-1560 in late 1997.
It is the case that, taken as a whole, the IPEs completed in the 1990s indicated that BWR Mk-I plants were, in general, somewhat more likely to fail during a severe accident than later Mk-II or Mark-III designs.
However, there was considerable “scatter” in the estimated severe-accident induced containment failure probabilities for all BWR and PWR containment designs, and there was considerable overlap in the calculated containment system failure rates for plants of all types.
The IPE studies also found that PWR containments were somewhat more vulnerable than BWR containments to containment isolation failures during severe accidents – that is, containment leakage through existing pathways – rather than damage to the containment structure itself.
Perhaps most importantly, the IPE’s collectively indicated there was no significant difference between the probability an early large release of radioactivity during severe accidents in a BWR Mk-I plants and other BWRs and PWRs.
So, taken in total, there was no basis from the IPE studies to conclude Mk-I plants presented an unacceptable level of safety.
(REFERENCE: U. S. Nuclear Regulatory Commission NUREG-1560, Vols. 1-5, "Individual Plant Examination Program: Perspectives on Reactor Safety and Plant Performance," Final Report, December 1997.)
QUESTION 6. Did you have any recommendations to make Browns Ferry/Mark 1 safer?
ANSWER:
Three key insights from that first study were the benefit of:
- changing the HPCI/RCIC system operating logic for selecting its emergency water source during the station blackout;
- changing the operating procedures to allow the reactor operator to take manual control of the reactor safety relief valves to assure the heat from the reactor was distributed evening around the pressure suppression pool so as to avoid containment over-pressurization;
- modifiying the emergency operating procedures to assure the reactor operators depressurized the reactor vessel prior to significant core damage and reactor vessel failure.
A number of follow-on studies over more than twenty years, identified a several opportunities to improve the ability of the plants to cope with beyond-design-basis severe accidents. These opportunities generally fell into three categories:
- changes in operator actions
- modifications to existing plant systems, and
- addition of new systems.
Operating procedure insights that emerged during those years included changes relating to control of reactor water inventory, containment venting, and drywell flooding, among others.
Several potential plant modifications were identified including: modification to the containment venting system; addition of backup power or pneumatic air supply to various existing reactor and containment cooling systems; the addition of dedicated containment flooding systems; and small, but important modifications to the reactor support skirt to enhance the effectiveness of containment flooding in cooling the reactor vessel.
QUESTION 7. How did you feel when you first heard about Fukushima Daiichi incident?
ANSWER:
My first response was one of shock at the size of the earthquake and the resulting tsunami, and deep regret for the death, destruction and damage the quake and tsunami had caused throughout Japan.
With regard to the Fukushima Dai-Ichi plant, my immediate response was typically analytical. I was wondering:
- What was the overall plant damage state – which systems, components, and structures had been damaged by the quake and the tsunami?
- Where were the emergency diesel generators (EDGs), the EDG fuel supplies, and related switchgear located – and were they accessible and functional?
- What was the station battery lifetime, where were the station batteries and their associated switchgear located – and were they accessible and functional?
- What were the Fukushima Dai-Ichi Emergency Procedure Guidelines and Severe Accident Management Guidelines for such events?
As I said before, I knew the moment I saw the video of the first explosion that there had been a hydrogen detonation in the reactor building. That would have been an obvious conclusion for anyone who had studied these types of accidents.
QUESTION 8. Was your SBO study of 1981 used to advantage to improve safety measures?
ANSWER:
I believe so. However, our study was but the first of many such analyses performed between 1980 and the late 1990s.There was an intensive effort on the heels of the TMI-II accident in 1979, that lasted for 20 years or longer to understand the accidents, understand how to reduce the vulnerability of the plants to such accidents, and to improve their ability to cope with such accidents should they occur. Both the NRC and the nuclear industry focused enormous attention on the subject with long-term experimental research, computer code development, and plant-specific accident probabilistic safety assessments (PSA) and individual plant examinations (IPE) analyses.
ORNL, supporting the NRC, focused on BWR severe accidents through the late 1990s. During that time, ORNL studied all of the “risk-dominant” BWR severe accidents. A number of emergency operating procedure improvements, severe accident management guideline improvements, and equipment improvements were identified during that time. A number of them were implemented, though I cannot say which ones were implemented on a plant-specific basis.
QUESTION 9. Do you know if Japanese government or TEPCO knew about the SBO sequences analysis you did?
ANSWER:
I do not know. Again, our study was not the most important – just the first. I would hope they had some access to the large body of plant-specific BWR PSA and IPE studies done by the NRC and the U.S. nuclear industry – as well as U.S. BWR emergency operating procedures and severe accident management guidelines.
