1. DM1 – WP1.5 meeting Stockholm, May 22-23, 2007 1 First safety approach of the DHR system of XT-ADS B. Arien

2. DM1 – WP1.5 meeting Stockholm, May 22-23, 2007 2 General purpose Main objective: identification of the possible failure modes of the DHR system and its weaknesses, its limits Methodological approach: master logic diagram (MLD) method Accidents into consideration:  Loss of heat sink (LOHS)  Loss of flow (LOF)  Combination of LOF and LOHS  Protected and unprotected cases

3. DM1 – WP1.5 meeting Stockholm, May 22-23, 2007 3 Main design assumptions Primary system:  2 groups pump-HX (2 pumps, 4 HXs)  Emergency electrical supply to pumps  Free convection if total loss of pumps Secondary system:  2 independent loops  Emergency electrical supply to pumps  Possibility of natural circulation to be considered Tertiary system: no design information, supposed to work in natural circulation and is treated as a whole Vault system (RVACS): no design information, supposed to work in natural circulation mode and treated as a whole

4. EUROTRANS-DM1: T1.2.2 meeting, February 28, 2007 XT-ADS Sketch of the Secondary System and DHR System (Proposal)

5. SCK  CEN’s proposal

6. DM1 – WP1.5 meeting Stockholm, May 22-23, 2007 6 MLD procedure For each accident type: Step 1: identification of the failure modes that initiate the accident Step 2: development of a MLD for the protected case Step 3: development of a MLD for the unprotected case

7. DM1 – WP1.5 meeting Stockholm, May 22-23, 2007 7 MLD procedure Symbols: DHR system fulfills its function (=.false.) may contribute to DHR system failure (=.true.) question related to any unresolved problem Accident initiating event Failure in DHR system OK unsuccess yes question ? no Qi

8. LOHS accident Secondary pump failure Pipe break in SCS Depressurization in SCS Tertiary cooling system failure HX blockage (secondary side) Blockage by debris Partial blockage HX blockage (primary side) Accompanied by LOF LBE freezing in HX Blockage by debris LOF&LOHS LOHS: step 1

9. Failure of core cooling in LOHS conditions Protected accident Unprotected accident Failure of core cooling under protected LOHS conditions A Failure of core cooling under unprotected LOHS conditions Accelerator shutdown failure B

10. LOHS: step 2 Failure of tertiary cooling system Failure of core cooling under protected LOHS conditions A If single secondary pump failure If total secondary pump failure If tertiary cooling system unavailable If depressur. in 1 SCS loop If depressur. in whole SCS If pipe break in 1 SCS loop If pipe breaks in whole SCS If partial HX blockage (water side) OK Vault System failure Failure of SCS pressurization Vault System failure OK yes DHR possible at atm. p in SCS ? no Q2 Failure of electrical supply to secondary pumps Vault System failure Failure of emergency electrical supply to secondary pumps Free convection fails to take place in the secondary system yes DHR possible by free convection in SCS ? no Q1 unsuccess SCS pipe breaks caused by external accident Vault System failure Over- pressure in SCS Safety valve failures

11. LOHS: step 3 Failure of core cooling under unprotected LOHS conditions B If single secondary pump failure If total secondary pump failure If tertiary cooling system unavailable If depressur. in 1 SCS loop If depressur. in whole SCS If pipe break in 1 SCS loop If pipe breaks in whole SCS If partial HX blockage (water side) Failure of tertiary cooling system Failure of SCS pressurization Failure of pressurization in 1 SCS loop Debris formation in SCS Single secondary pump failure Q3 Failure of emergency electrical supply to secondary pumps Failure of electrical supply to secondary pumps Free convection fails to take place in the secondary system yes Nominal power can be removed by free convection in SCS ? no Q3 unsuccess SCS pipe breaks caused by external accident Over- pressure in SCS Safety valve failures Single pipe break in SCS Over- pressure in 1 SCS loop Safety valve failure

12. LOF accident Primary pump failure HX blockage (primary side) Accompanied by LOF LBE freezing in HX Blockage by debris LOF&LOHS Accidental core bypass LOF: step 1

13. Failure of core cooling under LOF conditions Protected accident Unprotected accident Failure of core cooling under protected LOF conditions C Failure of core cooling under unprotected LOF conditions Accelerator shutdown failure D

14. Failure of core cooling under protected LOF conditions C Primary pumps fail to stop If single primary pump failure OK If total primary pump failure OK If accidental core bypass yes DHR possible in free convection mode and with core bypass ? no Q4 unsuccess Core bypass formation Free convection fails to take place LOF: step 2

15. Failure of core cooling under unprotected LOF conditions D If single primary pump failure Single primary pump failure If total primary pump failure no OK yes Nominal power can be evacuated when 1 group is operating ? Q5 unsuccess Failure of electrical supply to primary pumps Failure of emergency electrical supply to primary pumps Nominal power can be evacuated in free convection mode yes ? no Q6 unsuccess OK If accidental core bypass Primary pumps fail to stop yes Nominal power can be evacuated in free convection mode and with core bypass ? no Q7 unsuccess Core bypass formation Free convection fails to take place LOF: step 3

16. LOF&LOHS accident Common cause failure generating LOF and LOHS HX blockage (primary side) Freezing induced by LOF LBE freezing in HX Blockage by debris Partial blockage Independent combinations of LOF and LOHS Dependent combinations of LOF and LOHS LOF&LOHS: step 1

17. Failure of core cooling under LOF&LOHS conditions Protected accident Unprotected accident Failure of core cooling under protected LOF&LOHS conditions E Failure of core cooling under unprotected LOF&LOHS conditions Accelerator shutdown failure F

18. Failure of core cooling under protected LOF&LOHS conditions E Independent combinations of LOF and LOHS LOHS induced by LOF: HX blockage (primary side) Partial HX blockage by debris OK Total HX blockage by LBE freezing Station black-out Common cause failure for LOF and LOHS Vault System failure Overcooling Vault System failure Total primary pump failure Failure of electrical supply to primary pumps Failure of emergency electrical supply to primary pumps yes DHR possible via VS in ‘degraded’ free convection mode ? no Q9 unsuccess DHR possible by total free convection in the primary, secondary and tertiary systems Q8 yes ? no Free convection fails to take place in the secondary system unsuccess Failure of emergency electrical supply LOF&LOHS: step 2

19. Failure of core cooling under unprotected LOF&LOHS conditions F Independent combinations of LOF and LOHS Common cause for LOF and LOHS LOHS induced by LOF: HX blockage (primary side) Partial HX blockage by debris Total HX blockage by LBE freezing Overcooling Total primary pump failure Failure of electrical supply to primary pumps Failure of emergency electrical supply to primary pumps Debris formation in primary system Station black-out Nominal power can be evacuated by total free convection in the primary, secondary and tertiary systems Q10 yes ? no unsuccess Free convection fails to take place in the secondary system Failure of emergency electrical supply LOF&LOHS: step 3

20. DM1 – WP1.5 meeting Stockholm, May 22-23, 2007 20 Problems to be solved Q1: is the DHR possible with the SCS working in free convection mode? Q2: is the DHR possible when the SCS is at atmospheric pressure? Q3: can the nominal power be evacuated with the SCS working in free convection mode? Q4: is the DHR possible with the primary system working in free convection mode and with the presence of a core bypass? Q5: can the nominal power be evacuated when only one pump-HX group is operating in the primary system? Q6: can the nominal power be evacuated with the primary system working in free convection mode ? Q7: can the nominal power be evacuated with the primary system working in free convection mode and with the presence of a core bypass? Q8: is the DHR possible with the primary, secondary and tertiary circuits working in free convection mode? Q9: is the DHR possible via the VS with the primary system working in free convection mode and with a total blockage of the PHXs? Q10: can the nominal power be evacuated with the primary, secondary and tertiary circuits working in free convection mode?

21. DM1 – WP1.5 meeting Stockholm, May 22-23, 2007 21 Cut sets for protected LOF DHR possible in free convection mode and with core bypass ? Q4 Failure of core cooling under protected LOF conditions : Core bypass formation Primary pumps fail to stop and if Q4 true Core bypass formation if Q4 false

22. DM1 – WP1.5 meeting Stockholm, May 22-23, 2007 22 Cut sets for unprotected LOF Nominal power can be evacuated in free convection mode ? Q6 Failure of core cooling under protected LOF conditions : Single primary pump failure and Accelerator shutdown failure if Q5 false Failure of electrical supply to primary pumps Failure of emergency electrical supply to primary pumps and Accelerator shutdown failure if Q6 false Core bypass formation Primary pumps fail to stop and Accelerator shutdown failure if Q7 true Core bypass formation and Accelerator shutdown failure if Q7 false Nominal power can be evacuated when 1 group is operating ? Q5 Nominal power can be evacuated in free convection mode and with core bypass ? Q7

23. DM1 – WP1.5 meeting Stockholm, May 22-23, 2007 23 Cut sets for protected LOHS if Q1 true Failure of core cooling under protected LOHS conditions : Failure of tertiary cooling system Vault System failure and if Q2 false and Failure of SCS pressurization Vault System failure DHR possible at atm. p ? Q2 Vault System failure and Failure of electrical supply to secondary pumps Failure of emergency electrical supply to secondary pumps Free convection fails to take place in the secondary system Vault System failure and Failure of electrical supply to secondary pumps Failure of emergency electrical supply to secondary pumps if Q1 false DHR possible by free convection in SCS ? Q1 SCS pipe breaks caused by external accident Vault System failure and Overpressure in SCS Vault System failure and Safety valve failures and

24. DM1 – WP1.5 meeting Stockholm, May 22-23, 2007 24 Cut sets for unprotected LOHS (a) Failure of core cooling under unprotected LOHS conditions : if Q3 true and Free convection fails to take place in the secondary system Failure of electrical supply to secondary pumps Failure of emergency electrical supply to secondary pumps Accelerator shutdown failure SCS pipe breaks caused by external accident and Accelerator shutdown failure and Failure of SCS pressurization Accelerator shutdown failure and Accelerator shutdown failure Debris formation in SCS Failure of tertiary cooling system Accelerator shutdown failure and Depressur. of 1 SCS loop Accelerator shutdown failure and Single pipe break in SCS Accelerator shutdown failure and Single secondary pump failure Accelerator shutdown failure and Free convection fails to take place in the secondary system Nominal power can be removed by free convection in SCS ? Q3 Overpressure in 1 SCS loop and Accelerator shutdown failure Safety valve failure and Overpressure in SCS and Accelerator shutdown failure Safety valve failures and

25. DM1 – WP1.5 meeting Stockholm, May 22-23, 2007 25 Cut sets for unprotected LOHS (b) Failure of core cooling under unprotected LOHS conditions : if Q3 false and Failure of electrical supply to secondary pumps Failure of emergency electrical supply to secondary pumps Accelerator shutdown failure SCS pipe breaks caused by external accident and Accelerator shutdown failure and Failure of SCS pressurization Accelerator shutdown failure and Accelerator shutdown failure Debris formation in SCS Failure of tertiary cooling system Accelerator shutdown failure and Depressur. of 1 SCS loop Accelerator shutdown failure and Single pipe break in SCS Accelerator shutdown failure and Single secondary pump failure Accelerator shutdown failure and Nominal power can be removed by free convection in SCS ? Q3 Overpressure in 1 SCS loop and Accelerator shutdown failure Safety valve failure and Overpressure in SCS and Accelerator shutdown failure Safety valve failures and

26. DM1 – WP1.5 meeting Stockholm, May 22-23, 2007 26 Cut sets for protected LOF&LOHS Failure of core cooling under protected LOF&LOHS conditions : DHR possible via VS in ‘degraded’ free convection mode ? Q9 Independent combinations of LOF and LOHS Station black-out Vault System failure and Failure of emergency electrical supply Free convection fails to take place in the secondary system and if Q8 true Station black-out Vault System failure and Failure of emergency electrical supply and if Q8 false Failure of electrical supply to primary pumps Failure of emergency electrical supply to primary pumps and Overcooling Vault System failure if Q9 true Failure of electrical supply to primary pumps Failure of emergency electrical supply to primary pumps and Overcooling if Q9 true DHR possible by total free convection in the primary, secondary and tertiary systems Q8 ?

27. DM1 – WP1.5 meeting Stockholm, May 22-23, 2007 27 Cut sets for unprotected LOF&LOHS Failure of core cooling under unprotected LOF&LOHS conditions : Failure of electrical supply to primary pumps Failure of emergency electrical supply to primary pumps and Overcooling Accelerator shutdown failure Debris formation in primary system Accelerator shutdown failure and Independent combinations of LOF and LOHS Accelerator shutdown failure and Station black-out and Accelerator shutdown failure Failure of emergency electrical supply and if Q10 false if Q10 true Station black-out and Accelerator shutdown failure Failure of emergency electrical supply and Free convection fails to take place in the secondary system and Nominal power can be evacuated by total free convection in the primary, secondary and tertiary systems Q10 ?

28. DM1 – WP1.5 meeting Stockholm, May 22-23, 2007 28 Conclusions and future work A qualitative analysis was performed:  to provide first indications on the DHR performance  to guide the future work Some unresolved questions require a quantitative analysis Design needs to be completed  Choice of the SCS (Ansaldo or SCKCEN) RELAP (or TRAC) model has to be developed for the simulation of the whole system in most of the transients CFD model of the primary system has to be developed  Free convection simulation  Calibration of the RELAP model Reassessment of the DHR system behaviour in accidental situations