qqq

Status of Ignalina's Safety Analyses Reports

Dr. Habil. E. Uspuras

Laboratory of Nuclear Installation Safety

Lithuanian Energy Institute

3 Breslaujos

3035 Kaunas

Lithuania

International Conference on the Strengthening of Nuclear Safety in Eastern Europe, Vienna, 14-18 June 1999

OUTLINE

Introduction: A Historical Contexts

Safety Justification Report of the Ignalina NPP (TOB)

"In-Depth Safety Assessment of the Ignalina NPP" Project

Recommendations of the Ignalina Safety Panel

Follow-up Safety Analyses of the Ignalina NPP

Ignalina PSA Level 1 Project

Conclusions

Introduction: A Historical Contexts

Since commissioning of the Ignalina NPP in 1983 a number of the safety analyses have been conducted.

1988 - Safety Justification Report of the Ignalina NPP (TOB)

1992-96 - Level 1 Probabilistic Safety Assessment of the Ignalina NPP

1996 - Evaluation of the RBMK-1500 Accident Confinement System

1995-96 - In-Depth Safety Assessment of the Ignalina NPP (SAR)

1995-97 - Review of the Safety Analysis Report (RSR)

1997-99 - Safety analyses recommended by SAR, RSR and Ignalina Safety Panel

Safety Justification Report (TOB)

Safety Justification Report of the Ignalina NPP has been issued shortly after Chernobyl accident

Issues discussed in the TOB are limited by System Descriptions and Accident Analysis

Accident Analysis in the TOB have been performed for design power level of 4800 MW

Russian developed computer codes which were never been widely validated to demonstrate that its are adequately represent a reality have been used for analysis.

In-Depth Safety Assessment Project (1)

This is the first attempt to perform Western-style safety analysis for any Soviet-design NPP

The assessment consists of two elements: the Safety Analysis Report (SAR) and independent Review of the Safety Report (RSR)

A panel of international nuclear safety experts, the Ignalina Safety Panel, was established with aim to monitor and supervise the scope and production of the SAR and its review process and to make an independent recommendations to the Lithuanian Government, Ignalina NPP, VATESI and donor countries regarding continues plant operation and implementation strategies for the SAR and RSR recommendations.

In-Depth Safety Assessment Project (2)

The objectives of the SAR were:

to demonstrate that the plant is adequately safe;

to identify and evaluate any factors which may limit the safe operation of the plant in the foreseeable future;

to assess the plant's safety standards and practices, recommend and additional improvements which are reasonable practicable and provide estimates of their cost and schedules

In-Depth Safety Assessment Project (3)

The SAR project was organised in 10 Task Groups and the RSR structure reflected this. The groups were:

TG1 Plant Description

TG2 History of Safety and Performance

TG3 Fault Schedule

TG4 System Analysis

TG5 Accident Analysis

TG6 Equipment Qualification

TG7 Management of Ageing

TG8 Role of Operator

TG9 Safety Management

TG10 Demonstration of Acceptability

Fault Schedule (TG3)

Objective: Demonstration that all faults are either

adequately protected against or

sufficiently unlikely that the lack of protection against them is justified.

It was checked that this list of faults presented in the Fault Schedule was complete according to the Guidelines.

No sequences were found which would have required a modification of the 'essential items' list of accidents specified in the Guidelines.

A number of accident sequences which form part of a Western Safety Analysis Report were not explicitly addressed in the shortened Ignalina SAR.

Accidents Initiated by Equipment Failure

No plant conditions expected from this class of events that would result in violation of the design criteria with respect to

fuel damage,

integrity of pressure boundary,

regulatory dose limits.

The analyses have shown that the Ignalina NPP protective systems are adequate to bring the plant into a safe state following one of the assumed initiators, provided that operator actions occur within about 10 minutes.

A number of events typically considered in Western SARs were not analysed or considered.

Loss of Coolant Accidents (1)

In general Ignalina NPP is adequately protected against breaks that occur in the reinforced leak-tight compartments if they do not result in local flow degradation.

Some LOCA sequences may lead to low flow conditions requiring either faster Emergency Core Cooling System activation or increased injection rates to avoid cladding temperature excursions.

Loss of Coolant Accidents (2)

The SAR analyses of LOCAs revealed several plant deficiencies. Some Plant Modifications are required:

Installation of an early ECCS initiation signal to compensate for stagnation flow in a GDH, based on low flow in multiple channels.

Installation of new reactor trip and ECCS initiating signals to compensate for breaks outside the confinement, based on the dP/dt signal in the drum separator.

Modifications which ensure that the emergency core cooling water is delivered to the affected reactor half.

Further analysis is required to support the proposed hardware installations and to resolve critical issues.

Multiple Pressure Tube Ruptures Issue

Recommendations on the safety Improvements at the Ignalina NPP concerning MPTR issue:

A reactor scram actuation on "low flow" in a few channels connected to one GDH must be installed as soon as possible.

ECCS initiation should be derived on reactor scram on "low flow".

Further analysis is required to support the proposed hardware installations and to resolve MPTR critical issues.

Reactivity Initiated Accidents

Acceptance criteria met, even if single failures are assumed.

Major Issue

Several fuel bundles of a new type were loaded into the Ignalina Unit 1 and Unit 2 core since 1996

Increased enrichment of 2.4 % U-235 and contain Erbium as burnable poison.

Issue not addressed in the SAR.

Further analysis is required.

Steam Line Failures

The SAR analysts propose a number of hardware modifications and changes in regulations and procedures to overcome the design weaknesses and to better protect the surrounding population against radiological exposures after Steam Line rupture events, first of all

providing early, automatic reactor trip and emergency coolant injection for all break locations.

Further analysis is required to support the proposed hardware installations and to resolve critical issues.

Anticipated Transients Without Scram

For RBMK reactors ATWS are not design basis accidents and no previous analyses of such accidents were performed. The ATWS studies in the Ignalina SAR are the first of the kind of for RBMK reactors.

These analyses have a different purpose from DBA studies. The purpose of the ATWS studies in SAR was to identify the need for possible future design modifications to the shutdown system, to determine the minimum time available for accident mitigation and to make a step towards developing accident management measures and procedures.

The SAR analysis shows that some ATWS scenario can lead to unacceptable consequences.

ATWS (2)

The apparent lack of the effective inherent safety features in RBMK reactors leads to one high priority recommendation, that a second fast acting, independent and fully diverse reactor shutdown system needs to be installed. However, development and implementation of the second shutdown system requires 3-4 years.

VATESI has required Ignalina NPP to develop and implement a compensatory measures for existing CPS/EPPS

Major Safety Issues Originated from SAR

Second Shutdown System

CPS compensatory measures

Reactor scram and ECCS actuation on low flow in one GDH

Reactor scram and ECCS actuation on dP/dt signal in drum separator

ALS Safety Case

RCS Safety Case

Additional Accident Analysis

Safety analyses for core with new fuel design

Follow-up Safety Analyses

1997 - the Safety Case for the CPS has been completed

1997-98 - the Safety Cases for structural integrity of the reactor cooling system the accident localisation system have been developed

1997-98 - Analytical base for development of the additional shutdown system DAZ as well as Safety Case for DAZ system have been developed

1997-99 - Safety analyses for core with new fuel design have been continuously performed before loading of new party of fuel into the core

1998-99 - Analytical bases for implementation of proposed modifications concerning new signals for early actuation of reactor trips and ECCS well as Safety Cases for these modifications have been developed

DAZ Project (1)

Lithuanian Regulatory Body VATESI has required Ignalina NPP to develop and implement a compensatory measures for Control and Protection System before Unit 1 will be allowed to restart from its 1998 outage.

Joint Lithuanian - USA project for development and implementation of RBMK-1500 Additional Shutdown System (DAZ) has been initiated in 1997

The ISAG personnel performed an analysis that supports the selection of the input process parameters and setpoints as well as developed an accident analysis for DAZ Safety Case

DAZ Project (2)

It was shown that in case of transients with failure of existing Control and Protection System but with actuation of DAZ system reactor is adequately protected and any safety criteria are not violated

After implementation of DAZ system at the Ignalina plant ATWS would be moved from the beyond design basic accidents to the design basic accident class

The DAZ system is already implemented at Unit 1 and will be implemented at Unit 2 in 1999

Loss of off-site power supply with failure of existing Control and Protection System and activation of DAZ system. Pressure in the main circulation circuit

Local flow stagnation accidents

In any transport circuit, the coolant flows from high pressure point to a low pressure point, and it is distributed among various parallel flow paths (i.e. among the core passes, and the fuel channels within the core passes) according to hydraulic resistance of individual flow paths.

In principle, breaking a downstream pipeline can transiently accelerate the flow through one or more flow paths, or breaking an upstream pipeline can reverse the flow. It follows that a partial break upstream of the reactor core may also be postulated that just reduces the flow-driving pressure gradient across a flow path to near the zero. The pressure gradient may be reduced right after the break (i.e., when the decay power and the pressure are still elevated), or in longer term (i.e., when the ECCS is activated).

A partial break that result in the largest power-cooling mismatch (i.e., in highest temperatures) is called the critical break.

Local flow stagnation accidents (Cont.)

Partial breaks in large diameter piping were not investigated at the design stage of the Ignalina NPP, simply because they were not considered credible. Once a critical flaw size is reached in the wall of large diameter pipe, it is anticipated that the break rapidly propagates to an opening, which is equivalent to twice the cross-sectional area of the pipe (i.e., to the full break size).

Local flow stagnation could occur in coolant transport circuit, if flow-driving pressure gradient across a flow path reduces to near zero. For RBMK type reactors the following local flow stagnation are possible:

in one fuel channel following a partial break of one lower water communication line,

in a group of fuel channels (i.e., between 38 and 43 channels in one core pass) following a partial break of the group distribution header or guillotine break of GDH accompanied by failure to close of the check valve at the neighbouring group distribution header,

in one loop of the coolant transport circuit (i.e., about 830 channels) following a partial break of pressure header.

Flow rate in the maximum loaded channel connected to the

accidental GDH in case of early ECCS initiation

Peak fuel cladding temperatures in the maximum loaded channel

connected to the accidental GDH in case of early ECCS initiation

Peak pressure tube wall temperatures in the maximum loaded channel

connected to the accidental GDH in case of early ECCS initiation

Conclusions on local flow stagnation accidents

A strategy for destruction of local flow stagnation both in intermediate and long term has been developed. This include an analysis of the loss-of-coolant accident conditions whose lead to the local flow stagnation in fuel channels and determination of the necessary actions such as ECCS injection management or main circulation circuit de-pressurization as well as the justification of the actuation of the new early ECCS initiation signal which compensates for stagnation flow.

Results of analysis demonstrated that after implementation of the developed management strategy for destruction of local flow stagnation Ignalina nuclear power plant will be adequately protected not only in the case of the guillotine breaks of pipelines, but also following partial breaks which could result local flow degradation.

New early reactor trip and ECCS actuation systems have been installed at both Ignalina NPP units in May 1999.

ALS Safety Case

The purpose of the project was to perform a detailed structural analysis of Ignalina NPP ACS.

The complex analysis of safety of Ignalina NPP ACS, including analysis of experience of operation, engineering assessment, thermal-hydraulic and structural analysis is performed.

The obtained results of calculations, results of the performed non-destructive testing and carried out experimental tests on an determining of the mechanical characteristics of concrete and reinforcement bars have not revealed essential lacks which because of would be impossible the further operation of ACS of Ignalina NPP unit 1.

The structural integrity of ACS during maximum design basis accident by results of the non-linear analysis will not be violated.

For increase of a level of safety of ACS the recommendations are given.

RCS Safety Case

The main objective of the Reactor Cooling System Safety Case is to perform the detailed structural analysis of the MCC of Ignalina NPP according to the requirements of the Safety Panel of Ignalina NPP, expert groups of SAR and RSR.

The complex analysis of safety of RCS, including analysis of experience of operation, engineering assessment, thermal-hydraulic and structural analysis is performed.

The carried out complex analysis of the most important for safety components of the reactor cooling system of Ignalina NPP has not revealed shortcomings, which could become the reason for not allowing the further operation.

The RBMK-1500 reactor cooling system of Ignalina NPP principally corresponds to ASME standards.

The Barselina Project

The Barselina Project was initiated in 1991

A multilateral co-operation between Lithuania, Russia and Sweden up till phase 3, phase 4 has been performed as a bilateral co-operation between Lithuania and Sweden.

The long-range objective is to establish common perspectives and unified bases for assessment of severe accident risks and needs for remedial measures for the RBMK reactors.

Scope of the PSA Study

The source of radioactivity:
- The reactor core

Operational states:
- Full power range

Initiating events:
- Internal initiating events (transients, LOCA and Common Cause Initiators). Internal hazards - area events - fire, flooding and missiles

Applications

Evaluation of plant modifications

Modifications initiated by PSA

PSA evaluation of proposed plant modifications

Risk follow-up

PSA evaluation of Technical Decisions

Implementation of the plant modifications procedure

Results

In risk topography transients dominate over LOCA

Long term core cooling failure gives dominating contributions to core damage frequency

The implementation of plant modifications both reduce the risk of core damage accidents and reduce the environmental consequences of most accidents

Core Damage Frequencies for IE Groups

	AS	AI	AL	DS	DI	DL
LOCA Z1	9,12E-08	8,04E-09	1,05E-09	4,54E-10	1,85E-07	3,80E-10
LOCA-Z2	2,15E-08	3,46E-09	2,03E-09		7,38E-10
LOCA-Z3	2,06E-09	2,58E-11	7,82E-11
LOCA-Z4	6,34E-08	7,42E-09	1,63E-09		1,55E-12
LOCA (total)	1,78E-07	1,89E-08	4,79E-09	4,54E-10	1,86E-07	3,80E-10
Area Events		1,34E-09	4,60E-07
Blockages	1,61E-07	8,46E-13	5,94E-09
Transients	4,79E-07	1,47E-08	1,97E-06
Total	8,18E-07	3,50E-08	2,44E-06	4,54E-10	1,86E-07	3,80E-10

Total A+D 3,48E-06

Conclusions

The Ignalina NPP is unique among all RBMK reactors in the scope and comprehensiveness of safety analyses which have been conducted to verify its design parameters and analyse its level of risk.

The international studies such as Barselina, SAR, RSR and follow-up safety analyses provide a verified, state of the art base of knowledge which make it possible to assess the present level of plant safety, compare this level with other reactor plants and plan improvements plant which enhance the level of safety.

Safety analyses have determined that in terms of PSA indexes Ignalina NPP is comparable to Western reactors.

However, completed safety analyses shown some weaknesses of the Ignalina NPP. Therefore, plant safety improvement process should be continued.