Nuclear fission

9.3Examples of ACCIDENT PROGRESSION in shutdown state

9.3.1An example from Belgian PWRs

Current Belgian L2 PSA performed by Tractebel Engineering (TE) considers shutdown states including situations with RPV closed as well as with RPV open but excluding the refuelling state which is also not taken into account in the L1 PSA framework.
Moreover, shutdown states with RPV open are considered covered by the shutdown state identified as mid-loop configuration (lowest allowable primary water inventory with core in RPV) with the RCS open via the pressurizer vent or manhole. Specific analyses of shutdown states with RPV open are thus not performed. The mid-loop situation is indeed bounding in this case regarding the accident progression as it is faster due to the lower primary inventory and the higher decay heat (studies performed while going from full power to cold shutdown).
Concerning the evaluation of fission products release and transport from the degraded core towards the containment, the pressurizer manhole is assumed open during the mid-loop situation which is enveloping the case having only the pressurizer vent open. The assessment of the fission product transport is thus impacted for those situations in the sense that a new important path is open linking directly the RCS to the containment.
The following accident definition is based on a supporting calculation performed with MELCOR 1.8.6 in the frame of the Belgian L2 PSA studies. The unit considered is a three loop PWR 1000 MWe. The initiating event considered is a loss of Shutdown Cooling (SC) while the plant is in mid-loop situation but conservatively considering that the shutdown of the reactor occurred 24 h before the initiating event. Moreover, none of the three Steam Generators (SG) is considered available as nozzle dams are assumed to be placed on the hot legs and cold legs of the 3 loops. The RPV is closed but the RCS is open through the pressurizer manhole. The base case considered here conservatively assumes that safety systems are unavailable and/or that human actions are not performed. The timings provided hereunder are therefore certainly shorter than those to be expected with an open RPV as the water inventory would in this case be higher.
Following the loss of the SC system, the core decay heat begins to heat the primary fluid. The temperature starts to increase, first in the core and then in the hot legs. As a result, the density decreases in the hot legs and unheated water comes from the cold legs to the downcomer to match the density head. Therefore, the liquid levels increase in the hot legs but decrease in the cold legs. Because of the nozzle dams, the liquid is finally forced into the surge line.
At around 1000 s, the temperature reaches the saturation and water starts to boil. The resulting pressure increase intensifies the flooding of the surge line and this latter on becomes full of water. Liquid level in the pressurizer then starts to increase. At 1200 s, the pressurizer is full of water which flows by the pressurizer manhole into the containment. This leads to an important loss of the primary inventory. After a while the liquid level in the pressurizer decreases and only vapour flows through the pressurizer manhole into the containment (1800 s).
Meanwhile, operators have passed through Emergency Response Guidelines (ERG’s) procedures. As the RCS liquid level was not high enough, they have been instructed to inject water in the primary circuit by using the gravitational drain from the Refuelling Water Storage Tank (RWSTs) to the hot legs through the SI/SC lines. However, it is assumed that this action cannot be performed. A few steps later, one is instructed to open the pressurizer PORVs but this action is not considered, since the manhole of the pressurizer is open. Containment is then closed and evacuated. Operators are then asked to start two fans of the cooled containment ventilation but the system is not available. No other actions are instructed in the ERG procedures.
At around 5000 s, the criteria to enter the SAMGs are fulfilled⁹. Simultaneously to the evaluation of the NPP state, the operators have to perform parallel actions. One of these consists in starting of the ventilations of the annular space and of the auxiliary building.
After a while, temperature in the core increases and liquid levels in the hot legs decrease until no more water remains in the loops. However, the high velocity of the steam through the junction linking the hot leg and the surge line prevents water being in the surge line and in the pressurizer to fall back into the RCS.
As a result, upper elements of the core become uncovered and temperature still increases. At around 5800 s the cladding temperature of 1100 K is reached. From this moment on, the Zircaloy in the cladding is oxidised by the primary coolant, producing ZrO₂ and H₂. Due to the exothermic reaction, the cladding temperature increase is accelerated. Shortly after, the PARs in the compartment of pressuriser is activated. At around 6800 s, the melting temperature is reached, relocation of the core starts. At the same time, liquid in the surge line and in the pressurizer is boiled off through the opened pressurizer manhole. Further, at 8600 s, the PARs are activated in all containment compartments, and the containment pressure reaches 1.3 bar. Thanks to the PARs, the equivalent hydrogen concentration (i.e. including the penalising effect of CO) increases but remains under 4% during the early phase. At the same time, the oxygen concentration drops from 20% initially to 10% shortly before vessel failure, and the vapour concentration increases from 10% to 40% during the early phase. The probability of containment leak or rupture due to hydrogen burn is evaluated to be negligible during the early phase (i.e. <10^-14/reactor.year).
Finally vessel failure occurs at around 18000 s as no systems are recovered to inject water in the primary circuit. During the late phase, although the equivalent hydrogen mole fraction increases and stabilises around 0.12 at long term, the oxygen mole fraction drops rather quickly (after about 47000 s) below 0.05, and remains around 0.01 after 61000 s. Meanwhile, the vapour mole fraction increases gradually from 0.3 at vessel failure to 0.5 at the end of calculation (i.e. 300000 s). The probability of containment leak due to hydrogen burn remains insignificant (of order of magnitude of 10^-9/reactor.year).
The MCCI starts after vessel failure, leading to a slow pressurisation of the containment. The containment pressure is about 2.6 bars at the end of calculation (i.e. 300000 s).
Note that the results on the fission products release from the degraded core during the early phase in this shutdown supporting calculation are quite similar to the results of a Large-break Loss Of Coolant Accident (LLOCA) calculation with only available pressurizer and steam generator relief valves at full power. Indeed, almost all fission products produced during the early phase are released from the primary loop to the containment through the opened pressurizer manhole.
All along this accident progression, the radioactive releases towards the environment remain under the intervention threshold for food chain protection, the RCS pressure never reach the trigger to enter the specific guidance related to the RCS depressurization issue since the RCS is open and the containment pressure does not reach the trigger to enter the specific guidance related to the containment overpressure issue.
As no means to inject into the RCS are available, the gravitational drain from the RWST to the containment should be started but it is considered in this scenario that this human action could not be performed. As cooled ventilation and spray pumps are unavailable, no means are available to cool the containment.