IAEA International Conference on Topical Issues in Nuclear Installation Safety, 6-9 June, 2017 Investigation of performance of Passive heat removal system for advanced nuclear power reactors under severe conditions Prepared by: Eng. Sameh Melhem, Jordan Atomic Energy Commission/ Jordan Nuclear Power Company 1/16/2019

Content outline Introduction. Description Of PHRS, AES-92 Design. Review of PHRS against Design IAEA requirements Modelling of PHRS for AES-92 design Using RELAP 5 Code. Analysis of RELAP 5 results for Station Black-out Accident Scenario. Summery and conclusion.

Introduction The reliable removal of decay heat, after shutdown following some fault or external event, is one of the major challenges in designing adequately safe nuclear plant. Fukushima accident has highlighted the desirability of making the plant robust against events that have led to complete loss of Power (In particular, to provides a significant grace period). Passive Heat Removal System (PHRS) is one the passive safety features of AES-92 design of NPP proposed to be built in Jordan which removes the residual heat in case of station blackout condition. A review against IAEA requirements (SSR-2/1) for PHRS has been addressed. also deterministic safety analysis of PHRS using RELAP 5 MOD3.2 has been performed

Passive Heat Removal System for JNPP to cope with SBO accident It provides passive removal of the residual heat from the core , including air heat exchangers cooled by the outside air. 1/16/2019

Description of the Passive Heat Removal System components Design Criteria (4 X33%) 1/16/2019

Terminology According to IAEA Glossary, Ultimate Heat sink: A medium to which the residual heat can always be transferred, even if all other means of removing the heat have been lost or are insufficient. This medium is normally a body of water or the atmosphere. Passive component: A component whose functioning does not depend on external input, such as actuation, mechanical movement or supply of power. According to EUR Terminology, Passive system is a system which is essentially self-contained or self-supported, which relies on natural forces, such as gravity or natural circulation, or stored energy, such as batteries, rotating inertia, and compressed fluids, or energy inherent to the system itself for its motive power, and check valves and non cycling powered valves (which may change state to perform their intended functions but do not require a subsequent change of state nor continuous availability of power to maintain their intended functions). There are not much specific requirements or guidance on passive systems in the IAEA Safety Standards. However, After Fukushima the requirements for ultimate heat sink and associated heat transfer chain to the ultimate heat sink (UHS) have been significantly strengthened

Review of PHRS against IAEA Safety requirements № Design IAEA Safety Requirements Compliance of PRHRS design with IAEA requirements 1 According to GS-R-4, Requirement 10: Assessment of engineering aspects It shall be determined in the safety assessment whether a facility or activity uses, to the extent reasonable, structures, systems and components of robust and proven design. Paragraph 4.29. Where innovative improvements beyond current practices have been incorporated in the design, it has to be determined in the safety assessment whether compliance with the safety requirements has been demonstrated by an appropriate programme of research, analysis and testing complemented by a subsequent programme of monitoring during operation. Design of the PHRS was tested on a dedicated facility at OKB GP. References to experimental documentation (design, scaling, and experiments) are provided. The tests were performed in summer and winter conditions. Detailed analyses of the PRHRS were performed using GAMBIT code. The code was extensively validated using experimental data. Performance of the PHRS (with steam generators) during beyond design accidents was addressed using analytical methods that were validated using integral experiments conducted at FEI's GE2M-SG facility including effects of non-condensable gases. Performance of the PRHRS under different wind conditions was addressed by performing wind tunnel experiments on a model of the reactor building.

Review of PHRS against IAEA Safety requirements № Design IAEA Safety Requirements Compliance of PRHRS design with IAEA requirements 2 According to GS-R-4, Requirements 15: Deterministic and probabilistic approaches Both deterministic and probabilistic approaches shall be included in the safety analysis. Paragraph 4.53. : Deterministic and probabilistic approaches have been shown to complement one another and can be used together to provide input into an integrated decision making process. The extent of the deterministic and probabilistic analyses carried out for a facility or activity has to be consistent with the graded approach. Review SSR2/1 DSA and PSA methods were used to assess safety of the AES-92 design. In the design provide the highest impact on the PSA results. It was shown that elimination from the design of only PRHRS would result in an increase in CD frequency by a significant number. The deterministic analysis is elaborated in the presentation. 3 According to SSR-2/1,Requirement 16: Postulated initiating events Paragraph 5.11. : Where prompt and reliable action is necessary in response to a postulated initiating event, provision shall be made in the design for automatic safety actions for the necessary actuation of safety systems, to prevent progression to more severe plant conditions. The automatic response of active safety systems is complemented by an “automatic” start of the passive safety systems of the hydraulic accumulators of stage I, II, III and the PRHRS.

Review of PHRS against IAEA Safety requirements № Design IAEA Safety Requirements Compliance of PRHRS design with IAEA requirements 4 According to SSR-2/1, Requirement 17: Internal and external hazards Paragraph 5.20. The design shall be such as to ensure that items important to safety are capable of withstanding the effects of external events considered in the design, and if not other features such as passive barriers shall be provided to protect the plant and to ensure that the required safety function will be performed. The AES-92 design provides an effective protection against all types of external initiators that have limited potential or low probability of damaging the reactor building and reactor unit items. This can be explained by implementation of PHRS, which does not require any active system operation and can be automatically actuated in black-out conditions (such as Fukushima). The most important is the PHRS that is designed to operate under extreme environmental conditions. For example due to its passive actuation and layout (four independent natural circulation loops connected to the steam generators secondary sides) this system can function in event of external fires with very low failure probability.

Review of PHRS against IAEA Safety requirements № Design IAEA Safety Requirements Compliance of PRHRS design with IAEA requirements 5 According to SSR-2/1, Requirement 32: Design for optimal operator performance Paragraph 5.58. The design shall be such as to promote the success of operator actions with due regard for the time available for action, the conditions to be expected and the psychological demands being made on the operator. Paragraph 5.59. The need for intervention by the operator on a short time scale shall be kept to a minimum, and it shall be demonstrated that the operator has sufficient time to make a decision and sufficient time to act. Measures have been taken in the design to promote the success of operator actions and to prevent errors occurring. The main measures are as follows: Passive systems have been incorporated to carry out the safety functions that need to be performed after the occurrence of an initiating event. These systems such as PHRS do not require operator actions to actuate them or for their operation; Interlocks are incorporated into the design to prevent the operators carrying out incorrect actions. The design aim is that no operator actions should be required in the first 30 minutes following an initiating event. This is achieved by the incorporation of passive systems and automatic initiation of active systems.

Review of PHRS against IAEA Safety requirements № Design IAEA Safety Requirements Compliance of PRHRS design with IAEA requirements 6 According to SSR-2/1, Requirement 53: Heat transfer to an ultimate heat sink: The capability to transfer heat to an ultimate heat sink shall be ensured for all plant states. Paragraph 6.19A. Systems for transferring heat shall have adequate reliability for the plant states in which they have to fulfill the heat transfer function. This may require the use of a different ultimate heat sink or different access to the ultimate heat sink. Paragraph 6.19B. The heat transfer function shall be fulfilled for levels of natural hazards more severe than those considered for design, derived from the hazard evaluation for the site. For DBAs and also for DECs without loss of primary circuit integrity, heat removal to the ultimate heat sink is provided for an indefinite time. If the active systems are available, then the service water acts as the ultimate heat sink, to which heat is transferred through the intermediate circuit. If the active systems are unavailable, then the outside atmosphere acts as the ultimate heat sink, to which heat is transferred via heat exchangers of the PHRS.

Review of PHRS against IAEA Safety requirements № Design IAEA Safety Requirements Compliance of PRHRS design with IAEA requirements 7 According to SSR-2/1, Requirements 61: A protection system shall be provided at the nuclear power plant that has the capability to detect unsafe plant conditions and automatically to initiate safety actions to actuate the safety systems necessary for achieving and maintaining safe plant conditions. Paragraph 6.32: The protection system shall be designed: (1) to be capable of overriding unsafe actions of the control system; (2) with fail-safe characteristics to achieve safe plant conditions in the event of failure of the protection system. In addition to the inherent scram feature in case of power loss, passive safety systems have functional capability to cool the plant even in the case of complete loss of power. 8 According to SSR-2/1,Requirement 68: Emergency Power supply Paragraph 6.44. The combined means to provide emergency power (such as water, steam or gas turbines, diesel engines or batteries) shall have a reliability and type that are consistent with all the requirements of the safety systems to be supplied with power, and their functional capability shall be testable. One of the set of the batteries of each train powers required power for thee monitoring of the operation of PHRS during 24 hours (with possibility of 72 hours) without recharging.

Modelling of PHRS for AES-92 design Using RELAP 5 Code. RELAP5 3.2.2.Beta program designed especially for the modeling of a wide range of operational, emergency and transitional processes that may occur in equipment (systems) equipped with nuclear or electric heat sources and using as the main heat transfer medium with water in one- or two-phase state. Basic characteristics RELAP5 program are as follows: A one-dimensional model of two-phase flow, including: two mass conservation equations two energy equations. two equations of conservation of momentum one-dimensional neutron kinetics model. hydrodynamic modeling system using the following basic components: Pipe, simple volume ("single volume") boundary condition ("time-dependent volume" and "time-dependent junction") simple connection ("single junction") "branch" (branching flow models) pump, valve (various types) 1/16/2019

RELAP 5 Nodalization of VVER-1000 AES-92 JNPP 1/16/2019

RELAP 5 Nodalization of PHRS 1/16/2019

PHRS Power Characteristics (MW) T, C° Pressure of the steam generator, MPa 8.63 7 6 4.1 3 2 1 0.5 0.3 0.25 0.2 0.1 41° 8.3 7.8 7.4 6.5 5.8 5.1 3.8 2.9 2.3 2.1 1.4 0.9 38° 8.46 8 7.63 6.74 6.06 5.25 4.01 3.06 2.42 2.21 1.56 1.03 27° 9.4 8.9 8.5 7.5 6.8 4.7 3.6 2.7 2.2 1.6 -8° 12.1 11.5 11.1 10.1 9.3 8.4 6.9 5.6 4.6 4.2 3.9 -27° 13.5 13 12.6 10.6 9.6 8.1 6.7 5.5 3.7 -37° 14.3 13.78 13.3 12.2 11.3 10.3 8.71 7.22 6.01 5.13 3.94 1/16/2019

Initial and boundary conditions used in this analysis of SBO accident Parameter Value Thermal Power, MW 3000 Coolant temperature at the reactor inlet, C° 291.0 Coolant Pressure at the reactor outlet, MPa 15.7 Coolant flow rate through the reactor, /h 86000 Pressurizer level , m 8.17 Collapsed level in SG, m 2.356 Steam pressure at the SG outlet, MPa 6.27 Feed water Temperature, C° 220.0 Air Ambient Temperature, C° 41 In the analysis, the following assumptions were considered: All PHRS channels are available with delay of 30s in order to be connected from the moment of losing all AC Power sources. A delay of 30 s until the PRHRS channels reach the full power capacity. The PHRS power characteristics (taken from the experimental data) are assumed at ambient air temperature of 41 C°. Primary Circuit is leak tight. 1/16/2019

Analysis of RELAP 5 results for SBO Accident Scenario 1/16/2019

Analysis of RELAP 5 results for SBO Accident Scenario 1/16/2019

Analysis of RELAP 5 results for SBO Accident Scenario 1/16/2019

Analysis of RELAP 5 results for SBO Accident Scenario 1/16/2019

Analysis of RELAP 5 results for SBO Accident Scenario 1/16/2019

Analysis of RELAP 5 results for SBO Accident Scenario 1/16/2019

Summery and conclusion The performance of PHRS was investigated quantitatively by means of thermal-hydraulics software RELAP MOD 3.2 and qualitatively by reviewing its design against the IAEA safety requirements Though there are not much specific requirements or guidance on passive systems in the IAEA Safety Standards but the design of PHRS in AES-92 design complies with the general safety requirements Deterministic Analysis of PHRS using RELAP Mod 3.2 gives the full picture of the behaviour of such system, PHRS works properly for unlimited period of time as long as the primary circuit is leak tight, it is capable to cool the core and remove the residual heat in case of SBO with no available AC power sources, it is also capable to maintain all safety parameters within the design limits and safety margins

Thank you for your attention 1/16/2019