QUESTION: When did you first work on an SBO study?
· The U.S. Nuclear Regulatory Commission launched the Cooperative Severe Accident Research Program (CSARP) in the wake of the 1979 accident at TMI-2. CSARP included a variety of R&D activities. Among them was a focus on detailed systems-level accident sequence analysis for the risk dominant sequences previously identified by the WASH-1400 Reactor Safety Study in 1975. ORNL was selected by the NRC in 1980 as the lead lab for analysis of Boiling Water Reactor severe accident sequences in a program called the BWR Severe Accident Sequence Analysis (SASA) Program. Station blackout (which had been identified by WASH-1400 as an risk dominate sequence for BWRs) was selected as the first accident to be analyzed.
· Independent of NRC activities, the industry launched the Industrial Degraded Core (IDCOR) Rulemaking Program in 1981. IDCOR ran through about 1989, and included independent code and model development, plant analyses, and experiments funded directly by the nuclear industry.
QUESTION: What kind of study was it?
ANSWER:
· The 1981 study was the first detailed analysis of the Browns Ferry Unit-1 unmitigated station blackout scenario. BNFP-1 is a 3440 MWt / 1152 MWe BWR-4/Mk-I plant, larger than Fukushima Dai-Ichi Units 1-5. We focused on identifying the sequence of events in the accident, the timing of these events, analyzing the role of operator actions and various plant systems and equipment, and identifying uncertainties and unknowns in the analysis.
· It is important to understand that our analyses were conducted with computer models that were extremely primitive compared with the computer simulation tools we have available today. Nevertheless, the overall sequence of events developed in the 1981 analysis has held-up as being basically valid through many subsequent analyses since that time.
QUESTION: What was the result of that study? What did you find out?
ANSWER:
· The major accident sequence events and their timings were estimated based on an assumed 4-hr station battery life and some specific assumptions regarding operator actions. The potential role of the operator in delaying the onset of core damage was identified, along with some system hardware modifications that would be beneficial.
QUESTION: In an SBO event, what are the primary risks a plant eventually faces if not resolved?
ANSWER:
· PROVIDED THERE IS NO OTHER PLANT DAMAGE associated with the event that led to loss of off-site power and on-site power, the plant can recover normally without damage, if on-site or off-site power is restored before the station batteries are exhausted.
· Assuming a 4-hr battery lifetime, and no special operator actions, core damage would begin between 1 and 2 hours after the batteries are exhausted (~ 6 hours after the initiating event).
· Unless reactor cooling is restored, the accident sequence would progress through core oxidation, melting and relocation to the lower regions of the reactor vessel. During the period, a few hundred kg of hydrogen would be produced due to interaction between steam and the over-heated fuel assemblies. Eventually, the lower head of the reactor vessel would fail, allowing hot core debris to fall onto the concrete floor of the primary containment “drywell”, where it would interact with the concrete, releasing more hydrogen, other non-condensible gases, and steam. Along the way, various radioactive materials would be released into the primary containment (drywell and wetwell). Eventually, the primary containment would fail due to over-pressure and temperature, releasing its mixture of combustible gases and radioactive material into the surrounding reactor building.
QUESTION: In the case of this hypothetical SBO in the study, what was the sequence of events? (i.e. _ occurs after 10 minutes, after 30 minutes, _ long until containment failure, _ hours until core meltdown?)
ANSWER:
First few seconds
· Recalling that our assumption was that other than losing off-site power and on-site diesel generators, the plant was undamaged…
· Within the first few seconds, the plant senses the loss of power, and vital plant functions transfer their load to the station batteries, which in our case were assumed to last for four hours.
· The reactor “scrams” or shuts down. It’s power level drops from 100% power to a few % within seconds and down 2% or so, slowly decaying for hours and days after this point.
· Normal cooling water to the reactor ceases, and steam flow to the electrical turbines is terminated. The reactor is “isolated”.
· The reactor’s safety/relieve valves (SRVs) function automatically as designed to control reactor pressure, but venting steam from the upper regions of the reactor into the pressure suppression pool
First few minutes
· The plant’s HPCI and RCIC systems trigger and begin injecting water into the reactor vessel. (The plant we analyzed did not have an isolation condenser.) These systems draw water from a large water storage tank called the “condensate storage tank” which sits outside the reactor building. Everything is working as designed during this period.
First 4 hours
· During the next four hours, up until the station batteries are exhausted, the combined effects of HPCI/RCIC system injection, coupled with SRV actuation, keep the reactor core covered and undamaged. However, both the pressure suppression pool and the drywell atmosphere are heating up and slowly pressurizing. The plant could recover normally without damage if power is restored during this period.
@ 4 hours
· Station batteries are depleted, and all water injection to the reactor ceases at 4 hours due to the assumed 4-hr battery lifetime.
4-5 hours
· The water level in the reactor drops as water is boiling off and the steam is dumped to the pressure suppression pool through the safety relief valves. The water level drops to the top of the core in approximately 1-hr after battery depletion.
5-6.5 hours
· The core begins to overheat as the water level in the reactor continues to drop below the top of the fuel. The fuel heats up, and various fuel assembly and control plate materials interact with the hot steam releasing a few hundred kg of hydrogen into the reactor and (via the safety/relief valves) into the pressure suppression pool. The different core components and materials overheat and melt at different temperatures, but the overall effect is for the core to melt and relocate downward into the lower regions of the reactor vessel – ultimately interacting with the lower head of the reactor vessel and the various penetrations in the lower head.
@ 7 hr
· The bottom head of the reactor vessel fails due attack from the hot core debris inside the reactor vessel
7 – 8.5 hr
· Molten core debris escapes the reactor vessel and falls upon the concrete floor of the primary containment drywell.
· The hot core debris interacts with the drywell floor concrete, releasing steam, a variety of non-condensible gases, and radioactive aerosols (smoke) into the drywell atmosphere.
· The primary containment drywell pressure and temperature increase due to the effects of the core-concrete interactions
· The flexible seals in the primary containment drywell electrical penetrations fail due to the combined effect of high pressure and high temperature.
It should be noted that the timings of major sequence events (such as core uncovery, reactor vessel failure, etc.) are very sensitive to the assumed battery life and key assumptions about operator actions to depressurize the reactor. I recall a later re-analyses of the SBO sequence with an assumed battery life of 6-hr rather than 4-hr, and with an assumption the operators take steps to depressurize the reactor. Reactor core uncovery time for that sequence was estimated to be delayed until ~ 10.5 hrs (rather than 5 hrs), and reactor vessel failure was estimated to be delayed till ~ 15.5 hrs after the initiation of the event (rather than 7 hrs).
QUESTION: What system safeguards are critical to deal with an SBO event? What do you think about what countermeasures or coping measures are needed in this scenario?
ANSWER:
· The specific answers to the question will vary from plant to plant. In general, the functions that must be maintained are reactor core and containment cooling to avoid core damage and containment failure.
· In general, the following types of countermeasures can help assure the key reactor and containment cooling functions are maintained:
o Assured power supply: multiple off-site power feedlines to the plant, multiple emergency diesel generators with secure fuel sources, and multiple, long-life station batteries, combined with the ability to physically import units from off-site when/if needed. The physical placement of these resources on-site, and the manner and location in which they are interfaced with and connect to the power plant are also important.
o Assured cooling water supply: a secure, large condensate storage tank capable of supplying water to the HPCI/RCIC system for extended periods (this was not an issue in our SBO analyses). Alternatively, dedicated diesel-powered portable pumps can be staged to provide this function from other water sources.
o Assured reactor vessel pressure control: Reactor vessel depressurization has been shown to be a very useful severe accident mitigation technology. SRV operability is essential to accomplish such depressurizations. An assured control air supply is required to maintain SRV operability for the long periods of time involved in an SBO. This can be provided by secure bottled gas systems.
o Assured containment cooling: A secure means of cooling the primary containment pressure suppression pool and drywell atmosphere under SBO conditions. A number of options are possible, but the use of diesel-driven RHR pumps and drywell coolers powered by backup power systems are options.
o Assured containment pressure control: the ability to vent the primary containment if necessary to relieve containment pressure while scrubbing radioactive material from the vented gas and avoiding hydrogen explosions is very important.
o Remedial reactor vessel cooling and debris cooling: the ability to flood the primary containment with water up to about 2/3 the height of the reactor vessel, coupled with simple modifications to the reactor support skirt, can be effective in preventing reactor vessel failure and cooling any core debris that escapes the reactor.
o Assured station condition monitoring: Instrumentation that continues to function in an SBO to provide the operators critical information about the state of the reactor, containment, and critical systems.
o Assured operator preparedness: The power plant operators can play critical roles in managing the accident. Realistic, focused training of the operators to cope with the real-life circumstances to be expected in an SBO is essential.
All of these insights emerged from the work performed 1975 and 2000.
QUESTION: How do you feel about the dangers of an SBO?
ANSWER:
· Numerous studies have shown the importance of SBO as a contributor to the overall risk profile of commercial BWR nuclear plants. During the past thirty years, nuclear plant designers, regulators, operators here in the U.S. have devoted a great deal of attention to this fact and have taken a number of actions to respond accordingly. Nevertheless, the Fukushima Dai-Ichi accident demonstrates there’s more work to be done. The nuclear industry must and will learn and improve from this unfortunate event.
No comments:
Post a Comment