1. V. Kim, V. Kuznetsov, G. Balakan ‑ South-Ukraine NPP, Ukraine G. Gromov, A. Krushynsky ‑ Analytical Research Bureau of SSTC NRS S. Sholomitsky, I. Lola ‑ Energorisk Ltd ANALYSIS AND DEVELOPMENT OF THE AUTOMATED EMERGENCY ALGORITHM TO CONTROL PRIMARY TO SECONDARY LOCA FOR SUNPP SAFETY UPGRADING Yalta, Crimea, Ukraine, September 24-29, 2007. 17 th Symposium of “Atomic Energy Research”

2.  Problem description  Accident progression under design automatics operation without operator actions  Description and criteria of algorithm operation  Result of simulations  Analysis of influence of failures or additional IEs on accident control algorithm realization  Conclusions Contents

3. The primary-to-secondary leak accident is one of the most complex and specific accidents for the VVER type Reactor Unit. Design operation of Unit automatics and systems does not allow reaching a safe stable condition without actions of plant personnel. Such accident historically have belong to BDBA because of low frequency of occurrence, bur now after Rovno NPP accident with multiple SG collector cover liftings this accident have classified as DBA. According to results of the safety analyses under the Level 1 PRA for SU NPP Unit 1, contribution of "small" leaks (break of one tube) into total core damage frequency (CDF) equals to 6% and "large" breaks (collector cover lifting) equals to 11% of CDF. In accordance with Safety program stated by government authority of Ukraine, appropriate safety upgrading should be implemented for overcoming such accidents. Thermal hydraulic analyses of primary to secondary leaks show that the time interval for critical actions during an active phase of the leakage is enough short. The results of simulation of such an accident with FSS show, that an operator quite often makes critical errors or controls the accident not optimally. As means for overcoming of accident, the algorithm of primary-to-secondary leak control has been developed. Problem description

4. Accident progression under design automatics operation without operator actions Leak diameter, mm Time of scram, s Reason of scram Coolant mass through leak before scram, t Leak mass flow rate, kg/s Mass release into atmosphere during 1 hour after scram, t End state InitialSteady 1006 P 1 ≤150 kgf/cm 2, N>75%N NOM 4,9870140140402 Leak not stopped. CD with bypass of containment 8015Same6,0430130130408Same 6037Same8,3260123382Same 4085Same8,6124108276Same 30190Same11615136Same 4  13 749 PRZ level≤ 4.6m 26,7411619.6Same 201280Same20,227262614Same 2  13 2703Same49,519824.5Same 134227Same49,2121121.4Same

5. Accident progression under design automatics operation without operator actions Figure 1 – Time interval before BRU ‑ A opening after TSV closing depending on primary- to-secondary leak diameter (with prohibition of BRU ‑ K operation)

6. Description and criteria of algorithm operation actions Reduction of primary and ESG pressure difference to terminate leak loss of coolant (by injection in PRZ and/or operation of EGES). ESG pressure control below setpoints of SDV operation to prevent radioactive release (by: (a) delay of FASIV closing; (b) prohibition of ESG BRU ‑ A closing; (c) by PRZ injection and EGES operation; (d) restriction of HPIS). Localization of radioactive primary coolant within the ESG (by prohibition of BRU ‑ K after SG level increasing, and further closing of ESG FASIV and let-down of all SGs). Too early FASIV closing leads to pressure increasing in ESG, opening of SGVs with radioactivity release into the environment. Primary inventory and pressurizer level control (by injection from HPIS or primary make-up system). For recovery of PRZ level, injection into PRZ or operation of EGES into the quench tank is needed. Maintaining natural circulation via intact loops and recovery of a margin to saturation (by primary inventory control and secondary cooldown through intact SG). Injection of boron to reach required concentration in primary coolant (by organization of water exchange in primary side by make-up/let-down operation). To provide a transition of Unit to the safe end state, the proposed strategy and algorithm of accident control envisage the following:

7. Description and criteria of algorithm operation actions Criteria used for estimating results of accident control algorithm: Timely termination of loss of primary coolant through the leak. Maintaning primary inventory and reactor level. Sufficient secondary heat removal. Restoration of natural circulation via intact loops. Recovery of a PRZ level. Recovery of a margin to saturation. Keeping reactor subcritical. Minimization of radioactivity release from the primary side and outside the plant. No ESG SDV opening. Minimization of mass of primary coolant dumped through EGES into containment.

8. First stage: prohibition of ESG BRU ‑ A closing PRZ spray injection and EGES operation closing of ESG FASIV (with delay) and let-down of all SGs prohibition of BRU ‑ K after SG level increasing Second stage: restriction of HPIS secondary cooldown through intact SGs injection of boron Result of simulations

9. Characteristics of process Leak diameter, mm 10080806040304x13202x1315 Termination of loss of coolant through leak, s 800500 60010002000102022501050 Coolant mass through leak after reactor scram, t 7572705445192814 Coolant mass through ESG SDV, kg 000000000 Steady natural circulation via intact loops Yes Recovery of PRZ level, s8007507807501100700700no700No Recovery of margin to saturation, s 191017501780175019002020203020002050 Primary inventory (minimum / on algorithm completion), t 216 / 260 222 / 265 228 / 265 230 / 268 232 / 275 232 / 235 225 / 230 232 / 235 228 / 230

10. Result of simulations Figure 2 – Integrated mass flow rate through PRISE leak (after scram) under algorithm operation depending on leak equivalent diameter

11. accident control using algorithm in case of HPIS failure (failure of primary inventory control SF); accident control using algorithm in case of PRZ spray and EGES failure (failure of primary pressure decrease and limitation SF); accident control using algorithm in case of EGES valve failure to close after opening (failure of primary pressure control SF); accident control using algorithm in case of HPIS pump failure to turn switch to recirculation mode (failure of primary pressure limitation SF); accident control using algorithm in case of secondary cooldown failure (failure of heat removal from primary to secondary SF); accident control using algorithm in case of false signal» primary-to-secondary leak” occurrence; accident control using algorithm in case of additional IE “primary leak inside the containment from cold leg”; accident control using algorithm in case of additional IE “primary leak inside the containment from pressurizer steam dome”; accident control using algorithm in case of additional IE “loss of offsite power”; accident control using algorithm in case of additional IEs “loss of offsite power” and ESG SDV failure to close after opening (failure of secondary pressure control SF) Analysis of influence of failures or additional IEs on accident control algorithm realization For efficiency analysis of suggested accident control algorithm in case of failures or additional IEs the following beyond design basis accidents (BDBA) have been modeled:

12. Analysis of influence of failures or additional IEs on accident control algorithm realization Emergency process Stop outside containment, s Mass through leak, t Mass through SDV, t Natural circulation Recovery of PRZ level, s Margin to saturation,s Primary inventory ( min/end), t End state 100 mm PRISE LOCA failure of HPIS Yes, 400710YesNo2290196/275 ОК-OK 100 mm PRISE LOCA failure of PRZ spray and EGES Yes, 65083832,1YesNo1200216/260 ОК(RS)- OK 100 mm PRISE LOCA failure of EGES to close Yes, 400740Yes480No215/253 ОК-L 100 mm PRISE LOCA failure of HPIS off No130(1h ) 40 (1h)HPIS680320216/320 NO(RG) 100 mm PRISE LOCA failure of secondary cooldown Yes, 400810No750No217/273 OK-L False start of algorithm No PRISE00500 1820257/275 OK-OK 100 mm PRISE LOCA IE «11 mm leak from cold leg» Yes, 400810Yes6801800215/273 ОК-L 100 mm PRISE LOCA IE «50 mm leak from cold leg» Yes, 400540YesNo700209/235 ОК-L 15 mm PRISE LOCA IE «50 mm leak from PRZ» Yes, 40050Yes250No230/242 ОК-L 100 mm PRISE LOCA IE «LOSP» Yes, 4007110,24503802540219/264 ОК(RG)- OK 100 mm PRISE LOCA IE «LOSP» and stick of SDV No600 (1h) 530 (1h) No 3100133/220 NO(RG)

13. Application of accident control algorithm demonstrates: stopping loss of primary coolant inventory for all emergency scenarios except (HPIS pump failure to turn switch to recirculation and SDV sticking); sufficient primary coolant inventory during accident and stable natural circulation in intact loops (except scenario with failure secondary cooldown) that is able for heat removal from the core; short time opening of ESG SDV happened in case of failure of primary pressure control and in case of loss of offsite power, nevertheless, algorithm performance allow to minimize a number of SDV openings and significantly limit mass of primary coolant dumped into the environment; in case of secondary cooldown failure positive result of algorithm consist in limitation of ESG pressure and exclusion of radioactivity release into the environment through ESG SDV; in case of SG SV failure to close after opening the primary pressure may decrease down to LPIS operation; positive effect of applying of accident control algorithm in case of failure to switch HPIS to recirculation consist in significant decrease of primary coolant radioactivity release into the environment through ESG SDV. Also it leads to increase of time margins for performing of required actions by plant personnel Analysis of influence of failures or additional IEs on accident control algorithm realization

14. Application of the algorithm for majority of considered above BDBA scenarios allows to meet acceptance criteria and safety functions. For the rest scenarios it ensures increase of time margins for required operator actions Analysis of influence of failures or additional IEs on accident control algorithm realization

15. The results of analysis of primary-to-secondary side breaks allow to reveal and generalize characteristic features of transient progression. The analyses confirm efficiency of algorithm application. Application of algorithm for some of the beyond design scenarios ensures fulfillment of safety functions and acceptance criteria, and for other part it, at least, facilitates course of emergency process and performance of required recovery actions. Realization of the suggested algorithm, possessing sufficient universality, allows to transfer the power unit in a safe stable condition for all considered range of primary-to-secondary leaks. Conclusions