DataPDF Available

2006-11-14 Eurosafe Horst Loeffler paper

Authors:
  • Gesellschaft für Anlagen und Reaktorsicherheit (GRS) gGmbH
Data

2006-11-14 Eurosafe Horst Loeffler paper

Figures

Content may be subject to copyright.
Methods and Results of a PSA Level 2
for a German BWR of the 900 MWe Class
Horst Löffler, Dr. Martin Sonnenkalb
Gesellschaft für Anlagen- und Reaktorsicherheit (GRS) mbH,
Schwertnergasse 1, D-50667 Köln
Abstract:
On behalf of the federal Ministry for Environment, Nature Conservation and Reactor Safety (BMU)
GRS has performed a PSA level 2 for a BWR type 69 NPP of the 900 MWe class, equipped with a N2
inerted steel containment and a pressure suppression system. Integral deterministic accident analyses
have been performed with the computer code MELCOR 1.8.5. Additional analyses have been done for
those events and phenomena which are not or not sufficiently covered by MELCOR. The probabilistic
event tree analysis begins with the core damage states received from PSA level 1, and it ends with the
definition of release categories and the determination of their frequencies. Uncertainties about the
frequency of core damage states and about events during the accident progression are taken into
account by means of Monte Carlo simulations. If there is a core damage state there is a high
probability (>50 %) for a very high and rapid release of radionuclides into the environment. This high
conditional probability is due to the very low probability to retain a partly destroyed core inside the
reactor pressure vessel (RPV) and because the containment almost certainly fails at the bottom of the
control rod drives room after melt release from the failed RPV.
1 INTRODUCTION
On behalf of the federal Ministry for Environment, Nature Conservation and Reactor Safety
(BMU), GRS has performed a PSA level 2 for a BWR type 69 NPP of the 900 MWe class.
The PSA level 2 is restricted to full power plant states. The reference reactor is a BWR type
69 of the 900 MWe class, equipped with inerted steel containment and a pressure
suppression system. The PSA level 2 begins when a core damage state develops.
Frequencies and characteristic attributes of the core damage states have been determined in
a PSA level 1. The mean frequency of all core damage states is 2.2·10-6/a. Almost 81
different core damage states have been taken into account in the PSA level 2.
Integral deterministic accident analyses which are an indispensable basis of the PSA have
been performed with the computer code MELCOR 1.8.5. About 20 different accident
scenarios have been calculated. Additional analyses have been done for those events and
phenomena which are not or not sufficiently covered by MELCOR. They are mainly
concerned with the determination of the load limit and the failure mode of important
components (e. g. reactor pressure vessel (RPV), safety- und relief valves, main steam line,
and the containment) under severe accident conditions.
A probabilistic event tree analysis has been performed as key element of the PSA level 2.
The event tree begins with the core damage states received from PSA level 1 and it ends
with the definition of release categories and the determination of their frequencies.
Uncertainties about the frequency of core damage states and about events during the
accident progression are taken into account by means of Monte Carlo simulations. Sensitivity
analyses were made to identify those uncertain input parameters to the event tree which are
most important for the uncertainty of the final results.
2
2 PLANT DESCRIPTION EMPHASIZING CORE MELT ISSUES
The reactor is located inside a steel containment with condensation pool (Fig. 1). The reactor
pressure vessel has many penetrations at its bottom. With regard to core melt scenarios, the
penetrations of instrumentation channels are most important because they contain a
comparatively low fraction of solid structures, so that there is a possibility that core melt
might penetrate them.
The containment consists of a steel shell. The containment bottom (the control rod driving
room) has a steel shell as well, which cannot be cooled and which is not designed to
withstand a core melt attack. Once the reactor pressure vessel bottom has failed and a
significant amount of melt is released into the control rod driving room the containment may
fail. This is the most important containment failure mode. In addition, the sealing between the
removable containment head and the containment body is made from organic material which
will not withstand temperatures above approximately 180 °C. Consequently leaks have to be
assumed at the containment head in scenarios which exceed this limit. The containment is
inerted, so that there is no threat due to hydrogen burns. A filtered vent system is added to
prevent containment over pressure failure.
Fig. 1 Scheme of the containment of a German NPP with a BWR type 69 reactor
3
The general plant layout is shown in Fig. 2. The containment is located inside the reactor
building (R) which consists of 10 floors and many rooms. There are connecting ducts with
burst membranes between the reactor building and the adjacent turbine building (T). Open
off-gas ventilation ducts connect the turbine building to the stack. Doors lead from the reactor
building (R) to the neighbouring service building (S) and to the environment and as well from
the reactor building (R) to the turbine building (T). These are closed during operation, but
could fail under elevated pressure inside the reactor building e.g. after containment failure.
Fig. 2 Schematic drawing of buildings of a German NPP with a BWR type 69 reactor
3 RESULTS OF THE PSA LEVEL 1
A PSA level 1, which was performed in parallel to the PSA level 2 at GRS, identified the set
of core damage states which have been entered into the event tree analysis of PSA Level 2.
Each core damage state is described by the attributes shown in Tab. 1. Leaks in the decay
heat removal systems can contribute to core damage states due to consequential system
failures, but at the point in time when the core damage state exists, the leak is assumed to
be isolated in all sequences. Therefore the attribute “leak from decay heat removal system”
is an initiating event, but not a core damage state attribute.
In principle a large number of possible combinations of core damage state attributes exist. In
practice, all combinations with frequencies <1.0 10-9/a have been eliminated from the
analysis. This leads to 81 different core damage states. The mean value of the total
frequency of all core damage states is 2.2 10-6/a. The most frequent contribution is due to a
failure to limit the reactor vessel water level in case of a transient in combination with a
failure to isolate the steam lines, leading to water ingress into the main steam lines. This
creates pressure surges which will cause leaks in the steam lines outside the containment.
Subsequent failure to isolate the leak finally results in core damage.
(R)
(T)
(S)
„reactor cavities“
4
Tab. 1 Characteristics of core damage states
Core damage state attributes Possible states of attribute
Reactivity of core in cold condition above/below critical
Integrity of reactor coolant loop inside
containment leak/no leak
Safety valves fail closed / normal condition / open
Pressure in reactor coolant loop > 8 MPa / betw. 8 MPa and 1 MPa / < 1 MPa
Isolation valves of reactor coolant loop valves open, leak outside containment /
valves open, no leak outside containment /
valves closed
High pressure injection systems not functional / functional
Low pressure injection systems not functional / functional
Pressure suppression system not functional / functional
Temperature of wetwell above cavitation limit / below cavitation limit
Containment filtered venting system not functional / functional, not open /
functional, open
Control rod and pump sealing service
water not functional / functional
4 INTEGRAL DETERMINISTIC ACCIDENT ANALYSES
4.1 General approach
The MELCOR application at GRS started in 1990 for BWRs and for PWRs in 1993. Many
different sequences have been calculated for both reactor types within three different PSA
level 2 projects and accident management projects. Furthermore some detailed nodalisation
studies have been prepared in the past, to check nodalisation schemes of core, reactor
circuit, containment and reactor building. The compilation of the MELCOR data set and the
qualification of the nodalisation have always been supported by comparative calculations
with the detailed GRS codes ATHLET-CD, COCOSYS and WECHSL for selected severe
accidents. The results of these comparative analyses showed a good agreement of essential
parameters and of the general description of the plant behaviour during the severe accident
progression [1]. The main reason for this good agreement between integral and detailed
code results is the accuracy of the plant nodalisation schemes used for MELCOR
calculations at GRS. The scheme developed for the BWR type 69 NPP is described in
chapter 4.2.
The case selection of about 20 different accident scenarios calculated in the PSA level 2 has
been made following the recommendations given in the German PSA guideline [4] and taking
into account scenarios specified by the PSA level 1 with a high core damage frequency. The
spectrum of analyses covers transient scenarios with loss of RPV feed water or station black
out, scenarios with different leaks at the reactor circuit inside and outside the containment
and scenarios with a leak at the containment pressure suppression pool (wetwell). The
results of these analyses provided significant insights to understand the typical behaviour of
a BWR type 69 NPP during severe accidents as further described in chapter 4.4 .
5
4.2 MELCOR nodalisation scheme
MELCOR is a fully integrated computer code whose primary purpose is to model the
progression of severe accidents in LWRs. A broad spectrum of severe accident phenomena
is treated in MELCOR in a unified framework. MELCOR modelling is general and flexible,
making use of a "control volume" approach in describing the plant system. No specific
nodalisation of a system is forced on the user, which allows a choice of the degree of detail
appropriate to the task at hand. Reactor specific geometry is imposed only in modelling the
reactor core. Even here, one basic model suffices for representing either a BWR or a PWR
core, and a wide range of levels of modelling detail is possible.
For the BWR type 69 applications a detailed thermal hydraulic model of the reactor which
consists of 15 volumes and 25 flow paths was developed. The qualification was made by
code to code comparisons versus a detailed ATHLET model. The core model developed
consists of 6 radial core rings and 15 axial core levels taking into account the radial and axial
power profile as well as some other plant specifics. An ORIGEN calculation was made to
define the initial radio nuclide inventory of the core and the time dependent decay power for
a given core status (EOC – end of cycle). With the detailed reactor nodalisation and including
some models of other operating systems a satisfactory steady state calculation with a
realistic representation of the void fraction in the core and the steam separation in the
separator and steam dryer region was reached, which was important as well to get a realistic
RPV water level tracking. The latter one determines the timing of many actions in the early
phase of accidents and is important as well for the early phase of severe accidents.
The nodalisation schemes used for the BWR type 69 containment and the adjacent buildings
are very detailed as well. The selection was made in a way to represent the main probable
release paths of radio nuclides into the environment as requested in the German PSA
guideline [4] and takes into account that “dead end” rooms are to be avoided, if not existing
in the real plant. Most of the separate compartments are modelled as a single volume
(minimum). Especially those which dominate the possible convection flow regime are
modelled separately; some other small ones are lumped together. Furthermore a realistic
definition of flow path opening heights as well as momentum exchange terms was important
to allow a realistic modelling of water drainage between different rooms of the buildings in
parallel to the gas convection to transport the water to the reactor building sump respectively
its lowest floor.
In principle the containment has been subdivided into two halves with exception of the upper
head of the containment, the wetwell and the reactor cavity, which contains the control rod
drives. This model allows a realistic calculation of temperature and gas distributions, main
convection flow patterns as well main aerosol transport processes.
The nodalisation of the reactor building and the turbine building consists of more than 50
volumes in both buildings. The reactor building model consists of about 35 rooms located on
10 different floors. The rooms are interconnected by many doors, air ventilation system
channels and on selected locations by burst membranes and flaps. Plant inspections showed
that the doors are often not leak tight. In the MELCOR input deck such small gaps are
simulated by a remaining opening fraction of the relevant flow path. The failure of the doors
is dependent on a different p according to the door opening direction and its design. In
addition a re-closure of doors in case of reverse flows was modelled assuming a 10 %
remaining open fraction of a failed door. Two separate cavities had to be defined outside the
containment in the lower part of the reactor building (see “cavities” marked in Fig. 2).
6
Ventilation systems installed inside the containment as well as in most of the buildings are
designed to remove heat released from the RCS into the containment as well as from other
components into the buildings and to keep a small sub-pressure to avoid leakages from the
plant into the environment. Relevant systems of the BWR type 69 unit have been modelled in
a simplified manner in the MELCOR input deck. Some of the systems are in operation in the
BWR type 69 NPP even under accident conditions. Even if the systems are out of operation
during accidents ducts of air ventilation systems with open connections to the rooms exist
which interconnect several rooms. So the ducts contribute to convection processes between
different rooms and should be modelled in an appropriate manner.
In this BWR type 69 NPP the off-gas line from the turbine building to the stack stays always
open (only check valves available) and a buoyancy force driven mass flow through the stack
leads to a steady small off-gas mass flow. During the long term phase this phenomenon
significantly contributed to a small sub-pressure in the buildings and a reverse mass flow
direction into the buildings through e.g. leaks and open doors caused by the containment
failure. This was important not only for the source term calculation. The phenomenon was
rechecked by a COCOSYS calculation and a separate model found in the literature.
4.3 ATLAS visualisation of MELCOR results
The plant analyser ATLAS [6] basically is a tool to visualize the results of complex accident
simulation codes. ATLAS is developed since many years at GRS and has grown to a
multifunctional tool with many applications in the field of nuclear plant safety. Fundamental to
these developments was the open design of the ATLAS architecture. By its general interface
to simulation models, it offers the capability to easily attach different simulation codes.
Fig. 3 ATLAS graphics to visualise MELCOR results, core melting and hydrogen release
through the RPV depressurization lines to the wetwell in a BWR type 69
7
The best-estimate codes ATHLET/ATHLET-CD and COCOSYS used for thermo hydraulics
and containment simulation and the integral codes ASTEC and MELCOR used for severe
accident analyses are connected to ATLAS. A large number of dynamic effects are included
in all graphics developed.
Fig. 3 shows an example of the visualisation of physical phenomena inside the reactor (core
melting) and the containment and the adjacent rooms of the reactor building. In this case the
hydrogen concentration is shown in all parts of the reactor pressure vessel and the
containment and the adjacent rooms of the reactor building according to a colour scale.
Furthermore the core degradation is shown by the temperature in the core according to a
second colour scale. This is only one example of the large number of physical parameters -
including information on the aerosol and noble gas transport - which can be selected from
the MELCOR simulation results. The visualisation is used as well for training purposes [7].
4.4 Typical phases of severe accidents in a BWR type 69
Based on general information available on the behaviour of a NPP with a BWR and on the
detailed MELCOR analyses results severe accidents can be subdivided in several phases.
After an initial event the early phase is characterised by several system actions until the core
dry-out starts. Typically for BWRs early in an accident an automatic depressurisation of the
RPV occurs which leads to a rapid decrease of the coolant inventory inside the RPV, if no
injection system is available. The core heat up and degradation often occurs at a low
pressure level. According to the MELCOR results the total amount of H2 generated during the
core degradation phase (in-vessel phase) varies in a broad band and is equivalent to an
oxidation rate of 15-70 % of the total Zr amount of the reactor. The higher amounts of H2 (up
to 1100 kg) have been calculated for high pressure core melt scenarios while the lower
values (100 – 330 kg) are typical for low pressure core melt cases which are often
developing under steam starved conditions (the lowest values). Hydrogen combustions
inside the containment are prevented due to the N2 inertisation as long as the containment is
intact.
The MELCOR analyses showed a continuous relocation of molten core material from the
core into the lower plenum of the RPV. Typically the relocation path is via the core bypass
between the fuel assembly canisters as the control rods melt early in a severe accident and
create new free space there. So a formation of a large molten pool inside the core like in a
PWR is not probable. After the dryout of the lower head or even before it occurs the RPV
fails locally due to melt attack at the multiple penetrations in the bottom head. Due to the
automatic depressurisation of the RPV this happens typically at low system pressure.
After RPV failure in a BWR type 69 NPP the melt and the remaining water in the lower head
is released into the control rod driving room (cavity) – the lower part of the containment. As
the containment steel shell is not designed to withstand any melt attack (after RPV failure) for
a longer time, the steel shell will fail soon after the melt release into the control rod driving
room. This first part of the ex-vessel phase is very short (some minutes) and the containment
will fail in most cases under elevated pressure unless the sealing of the containment head
cover fails prior or unless other containment leakages are assumed.
Depending on the scenario a different amount of hydrogen is accumulated in the
containment before its failure. The containment filtered venting system was not used or
requested to be used in most of the scenarios before the containment failed due to melt
attack, as the initial criteria (containment pressure) have not been reached. Only in some of
the high pressure scenarios the filtered vent system was used and about 50 % of the large
amounts of H2 released into the containment during core melting were released into the
environment. So typically >100 kg up to 500 kg of hydrogen is stored inside the containment
8
at the time of containment failure due to melt attack to the steel shell in the control rod driving
room.
As the containment fails at elevated pressure a sharp pressure increase is the result in the
adjacent rooms of the reactor building. Also hydrogen stored in the containment is released
together with some steam and N2 into the adjacent rooms. Doors and burst membranes may
fail and create different release paths through the buildings and into the environment. In
addition the released hydrogen may lead to combustion outside the containment in the
reactor building or the turbine hall. Damage to the building structures can not be prevented in
all cases. Special calculations for such consequences have not been made in the PSA level
2.
The melt will accumulate first in a small sump below the control rod driving room and then
spread on the large floor area of this “central” lining room inside the reactor building. A melt
spread further onto floors of the reactor building can not be ruled out for all cases but was not
assumed in the MELCOR analyses. MCCI will take place in the two cavities of the lining
room of the reactor building mainly under dry but locally as well under wet conditions and
combustible gases are continuously released into the reactor building. Later on combustible
gases may form locally as well, depending e.g. on the continuous release of gases through
the stack and some other plant specifics.
The filtered containment venting system is useful only before the containment fails by core
melt attack. A spray system located in the drywell may be used in addition to limit the
pressure increase or to decrease the airborne content of aerosols in the containment. Both
systems have not been able to significantly influence the accident progression. As the
weakness of the containment to withstand any core melt attack was one significant
contribution to early high releases of fission products into the environment in the PSA level 2
additional strategies are under discussion to prevent the RPV failure or to further limit the
consequences of an early containment failure.
5 PROBABILISTIC ANALYSIS
5.1 General approach
The overall probabilistic approach is comparable to the NUREG-1150 study [2], and it is in
line with the appropriate IAEA [3] and German guidelines [4], [5] for PSA level 2. The
probabilistic accident progression analysis basically consists of a large event tree with 81
branching points. The event tree is evaluated with the well known EVNTRE code. The
branching probabilities represent stochastic variability. Variability due to lack of knowledge is
represented by a Monte Carlo simulation of the event tree, where the uncertain input data
are sampled. In this sampling process also the uncertainties of the core damage frequencies
from PSA level 1 have been included. This procedure makes it possible to determine those
issues whose lack of knowledge contributes most to the uncertainty of the final results.
The MELCOR code does not cover all relevant phenomena sufficiently. Therefore additional
analyses have been performed for specific issues, e. g. related to failure limits and modes of
the containment or of the reactor coolant loop. These analyses have lead to bandwidths of
failure conditions which have been entered into the probabilistic event tree analysis.
Furthermore, some MELCOR results have been checked by independent assessments, e. g.
related to the buoyancy force driven off-gas flow through the stack, which influences the long
term release path of the radionuclides to the environment. All these analyses finally
9
contribute to probabilistic statements which are part of the probabilistic analysis. This is why
they are mentioned in short here.
5.2 Configuration of the event tree
The following list shows the most important aspects which are taken into account in the event
tree:
Definition of the core damage states
- The first part of the event tree is used to define the different core damage states and
their related frequencies, including uncertainties resulting from PSA level 1
Inside PRV before its failure:
- Failure of reactor coolant loop components under high pressure and high temperature
loads (if they occur), and associated consequences
- Start of water injection into RPV, in particular after RPV depressurization
- Retention of partly molten core inside RPV by in-vessel flooding, or by control rod and
MCP service water flow
- Melt-water interaction up to steam explosion loads inside RPV and associated
consequences
Outside RPV before its failure:
- Pressure inside containment
- Containment leaks (due to high temperature or due to pressure surge when reactor
coolant loop components fail)
In connection with RPV bottom failure under corium attack:
- Time, size of leak and system pressure, when RPV bottom fails (taking into account
the penetrations at the RPV bottom)
Inside containment after RPV failure:
- Composition of atmosphere (stored amount of hydrogen)
- Core melt distribution on bottom of control rod room and melt attack until penetration
of bottom of control rod room
- (Containment pressure and direct containment heating have not been analysed
explicitly because this type of containment will fail anyway very soon after RPV failure
die to core melt attack)
Outside the containment, inside adjacent building:
- Core-concrete interaction
- Pressure and composition of atmosphere
- Potential hydrogen burns and associated consequences
- Release paths for radionuclides, including buoyancy force effect of the stack (passive
flow from turbine building)
- In case of containment bypass: early contamination due to radio nuclides released
from core
Release category definition:
- Grouping the large number of accident sequences according to their “radiological
relevance” and the time available for plant external emergency measures
- Grouping according to the release paths into the environment was done additionally.
10
5.3 Probabilistic results for specific issues
Probability figures given in the following sections are mean values of the Monte Carlo
simulation and they refer to the condition of a core melt accident.
High pressure core melt sequences: The fraction of core damage states with high pressure
is low (<3 %) and due to a high probability for a stuck open safety valve or failure of a hot
steam line there is essentially no high pressure RPV bottom failure.
Retention of partially molten core inside RPV: There is a small fraction (<2 %) of all
sequences where depressurisation of the RPV occurs and where the low pressure
injection systems are functional right from the beginning. In this case they start injecting
early enough to quench the melting core.
In-vessel steam explosion: The probability for alpha-mode failure is very small (0.2 %).
There is a probability of about 3 % that a steam explosion related pressure surge causes a
leak in one of the main steam lines.
Release paths before containment failure: There is a significant probability (20 %) for
accidents with containment bypass due to failure to isolate failed main steam lines. In
addition there is a 24 % probability for a leakage of the containment head sealing due to
elevated temperature.
RPV failure due to core melt impact: almost all sequences (98 %) lead to RPV bottom
failure. The failure mode is always a small leak at one of the penetrations for
instrumentation. (The control rod drive tubes are less vulnerable to core melt.)
Containment failure: After RPV failure the containment will always fail due to melt trough of
the bottom steel shell (control rod driving room). The pressure is in most cases elevated,
but below the initiation criteria for the containment filtered vent system.
Damages to buildings: Pressure waves are created inside the buildings adjacent to the
containment when the containment fails at elevated pressure or when hydrogen
combustions occur inside the buildings. The majority of accidents (85 %) develops damage
to doors which lead from the reactor building to the turbine building and the service
building. No significant retention potential for radionuclides have been assumed for the
service bulding. There is a 4 % probability for significant reactor building damage at the
roof. With 11 % probability the buildings remain intact.
Quantity of released fission products: see next chapter.
5.4 Overall probabilistic results
5.4.1 Frequency of radiological relevance groups
To enable the evaluation of the numerous accident sequences of the event tree, a concept of
“radiological relevance” has been applied as follows. The relative radiological impact (short
term health effects due to a release of the respective core inventory) of four radiologically
relevant elements (Kr, J, Cs, Te) has been estimated. The released quantity of each of these
elements has been determined for each accident sequence, and the sum of their radiological
impact has been calculated. This impact of a particular accident sequence is put in relation to
the impact of the virtual release of the total inventory of iodine into the environment and this
11
relation is called “radiological relevance”. So if an accident sequence has a radiological
relevance of 0.01, it has the same impact as the release of 1 % of the iodine core inventory.
The Tab. 2 shows that there is a high probability for significant radiological relevance if there
is a core melt accident. This is the consequence of some unfavourable plant properties (see
chapter on plant description) with regard to core melt retention.
Tab. 2 Frequency of radiological relevance groups including uncertainties
Radiological
relevance 5 %-Fractile
(10-6/a) Median
(10-6/a) Mean
(10-6/a) 95 %-Fractile
(10-6/a)
>0.1 0.13 0.57 1.58 3.55
0.01 - 0.1 0.01 0.18 0.62 2.34
0.001 - 0.01 0.0 <0.001 0.001 0.04
10-4 - 10-3 0.0 0.0 <0.001 <0.001
10-5 - 10-4 0.0 0.0 <0.001 0.0
10-6 - 10-5 0.0 0.0 0.0 0.0
5.4.2 Frequency of release categories
For an evaluation of the potential accidental consequences not only the radiological
relevance is of interest, but also the time which is available for taking countermeasures
external to the plant. Therefore the highest radiological relevance groups have been
separated according to the approximate time which passes between leaving the design base
(it is assumed that emergency measures external to the plant will not be implemented
before) and the time when the release occurs. This period of time is called external time
reserve. The Tab. 3 shows that the external time reserve is small. There is only an
insignificant probability for an external time reserve of more than 5 hours.
Tab. 3 Frequency of external time reserve including uncertainties
External time
reserve Radiological
relevance 5 %-Fractile
(10-6/a) Median
(10-6/a) Mean
(10-6/a) 95 %-Fractile
(10-6/a)
<1.5 h 0.09 0.37 0.61 1.81
1.5 - 5 h 0.003 0.08 0.94 1.73
>5 h
>0.1 <0.001 0.004 0.03 0.09
<1.5 h <0.001 <0.001 0.03 0.17
1.5 - 5 h 0.001 0.16 0.59 2.26
>5 h
0.01 - 0.1 0.0 0.0 0.002 0.003
The small external time reserve does not imply that the sequences as a whole are always
short. There are sequences which develop over many hours, for example if the heat removal
from the wetwell fails, so that its temperature gradually increases. But during this time there
is still no imminent core threat, and plant external emergency measures will probably not yet
be implemented under such circumstances. If, however, core cooling begins to fail (in the
example above due to cavitation of pumps), then there is not much time left before significant
releases from the plant have to be expected.
12
5.4.3 Sources of uncertainty
In Tab. 2 and Tab. 3 above the uncertainty of the results is characterized by the 5 %-, 50 %-
(median) and 95 %- fractiles and by the mean value. This uncertainty represents the integral
influence of the lack of knowledge from all those uncertain parameters which have been
sampled in the Monte Carlo simulation of the event tree. The total number of sampled
parameters is almost 200. The first 81 represent the uncertainty about the frequency of the
core damage states, and the remainder is related to the various uncertain issues of the
accident progression.
Fig. 4 shows the relative influence of each of these uncertain parameters on the most
severe release category, which is the one with a radiological relevance of more than 0.1 and
an external time reserve of less than 1.5 hours.
Uncertainty and Sensitivity Analysis
The166 Ordinary Product-Moment Correlation Coefficients
Sample Size= 5000, Transf.= 0
-1
-0.8
-0.6
-0.4
-0.2
0
0.2
0.4
0.6
0.8
1
0 5 10 15 20 25 30 35 40 45 50 55 60 65 70 75 80 85 90 95 100 105 110 115 120 125 130 135 140 145 150 155 160 165 170 175 180 185 190
Index of Parameter
FKKAZ1
Fig. 4 Relative contribution of uncertain input parameters to uncertainty of large early
release frequency
It is obvious that the uncertainty about the frequency of the core damage states which is a
PSA level 1 issue (parameter index 1 – 81) is much more important than any of the issues
which relate to the level 2 field (parameter index >81). This can easily be explained by the
fact that the reference reactor has a low potential for mitigating the effects of a core melt
accident. Consequently there is only a comparatively small uncertainty contribution from the
accident evolution, and a relatively large contribution from the events before core damage.
This however does not mean that each and every phenomenon in the level 2 field is well
understood. It rather shows that these uncertainties do not much influence the final result. It
has to be pointed out here that this plant specific. PSA studies for other reactors exist as
well, where the level 2 uncertainties are at least equally important as the level 1
uncertainties.
13
6 SUMMARY AND CONCLUSIONS
The PSA level 2 for the BWR reference plant employs the traditional approach, consisting
mainly of detailed deterministic accident analyses with a well qualified integral code
(MELCOR), and a probabilistic event tree analysis. Uncertainties in knowledge are taken into
account by means of a Monte Carlo simulation of the event tree evaluation. A well defined
interface from level 1 to level 2 of the PSA enables a consistent analysis from the initiating
events to the source terms. The approach proves to be practical and useful.
The deterministic and probabilistic results show that this plant has no significant mitigation
potential in case of a core melt accident to prevent a containment failure after the RPV has
failed and melt is released. Therefore the frequency for large and early releases is not much
lower than the frequency for core damage states. Furthermore, the uncertainties of the final
results depend much more on uncertainties in the level 1 field than on uncertainties related to
the accident progression in the level 2 field.
7 REFERENCES
1. M. Sonnenkalb,
Application of the Integral Code MELCOR for German NPPs and use within Accident
Management and PSA Projects, Technical Meeting on Severe Accident and Accident
Management, Toranomon Pastoral, Minato-ku, Tokyo, Japan, March 14-16, 2006
2. U.S. Nuclear Regulatory Commission
Severe Accident Risks:
An Assessment for five U.S. Nuclear Power Plants
NUREG-1150, December 1990
3. Procedures for Conducting Probabilistic Safety Assessment of Nuclear Power Plants
(Level 2), IAEA Safety Series No. 50, Vienna, May 1995
4. Methoden zur probabilistischen Sicherheitsanalyse für Kernkraftwerke, BfS,
Facharbeitskreis Probabilistische Sicherheitsanalyse für Kernkraftwerke, August 2005
5. Daten zur probabilistischen Sicherheitsanalyse für Kernkraftwerke, BfS, Facharbeitskreis
Probabilistische Sicherheitsanalyse für Kernkraftwerke, August 2005
6. D. Beraha, M. Sonnenkalb, W. Pointner, V. Maidanek,
Analysesimulator ATLAS - Simulation des Ablaufs von Störfällen und Unfällen, Paper
presented at 20. GRS-Fachgespräch, Köln, 13./14. November 1996
7. M. Sonnenkalb, J. Rohde ,
Phenomenology and Course of Severe Accidents in PWR-Plants - Training by Teaching
and Demonstration, Paper presented at 2nd OECD Specialist Meeting on Operator Aids
for Severe Accident Management (SAMOA-2), EDF/SEPTEN Lyon, France, September
8-10, 1997
ResearchGate has not been able to resolve any citations for this publication.
Application of the Integral Code MELCOR for German NPPs and use within Accident Management and PSA Projects
  • M Sonnenkalb
M. Sonnenkalb, Application of the Integral Code MELCOR for German NPPs and use within Accident Management and PSA Projects, Technical Meeting on Severe Accident and Accident Management, Toranomon Pastoral, Minato-ku, Tokyo, Japan, March 14-16, 2006
Analysesimulator ATLAS -Simulation des Ablaufs von Störfällen und Unfällen, Paper presented at 20. GRS-Fachgespräch
  • D Beraha
  • M Sonnenkalb
  • W Pointner
  • V Maidanek
D. Beraha, M. Sonnenkalb, W. Pointner, V. Maidanek, Analysesimulator ATLAS -Simulation des Ablaufs von Störfällen und Unfällen, Paper presented at 20. GRS-Fachgespräch, Köln, 13./14. November 1996
Phenomenology and Course of Severe Accidents in PWR-Plants -Training by Teaching and Demonstration, Paper presented at 2nd OECD Specialist Meeting on Operator Aids for Severe Accident Management
  • M Sonnenkalb
  • J Rohde
M. Sonnenkalb, J. Rohde, Phenomenology and Course of Severe Accidents in PWR-Plants -Training by Teaching and Demonstration, Paper presented at 2nd OECD Specialist Meeting on Operator Aids for Severe Accident Management (SAMOA-2), EDF/SEPTEN Lyon, France, September 8-10, 1997
Procedures for Conducting Probabilistic Safety Assessment of Nuclear Power Plants (Level 2)
Procedures for Conducting Probabilistic Safety Assessment of Nuclear Power Plants (Level 2), IAEA Safety Series No. 50, Vienna, May 1995
Analysesimulator ATLAS -Simulation des Ablaufs von Störfällen und Unfällen
  • D Beraha
  • M Sonnenkalb
  • W Pointner
  • V Maidanek
D. Beraha, M. Sonnenkalb, W. Pointner, V. Maidanek, Analysesimulator ATLAS -Simulation des Ablaufs von Störfällen und Unfällen, Paper presented at 20. GRS-Fachgespräch, Köln, 13./14. November 1996