Primary system accidents

A series of five aerosol transport test (ATT) experiments were done in the large-scale Mar-viken facility investigating the behavior of vapors and aerosols under typical LWR primary system accident conditions. 

Or to use a design in which the core of a conventional pressurised water reactor (PWR) is enclosed within a vessel of boronated water that will flood the core if pressure is lost there is no barrier between the core and the pool of water, which in case pressure in the primary system is lost will shut the reactor down and continue to remove heat from the core by natural circulation. It is calculated that in an accident situation, replenishing of cooling fluid can be done at weekly intervals (in contrast to hours or less required for current light water reactor designs) (Harmerz, 1983 Klueh, 1986). 

SL-1 was a research reactor of the U.S. Army. In the SL-1 accident, a very large fraction of the core was destroyed and most of the primary water was ejected from the primary system. The reactor building filled with steam, which leaked to the environment from gaps in the doors on the operating floor, from open doors in the control room, and from the exhaust on the fan floor. About 10 Ci of noble gas and 80 Ci of iodine were released into the atmosphere. 

In case of a pressure loss accident, the maximum escape rate of the primary coolant is restricted by flow restrictors. A depressurization will take at least two minutes so that destructive dynamic forces in the primary system can be excluded. All heat exchanging components incl. steam reformer are designed to keep their pressure, if there is a pressure loss in the primary system [10]. 

The degree of contamination of the primary coolant by iodine-131 (the most significant isotope) normally assumed in the study of accidents is equal to roughly 10 -10 Bq g , corresponding to a total of the order of tens of terabequerels for the whole primary system (i.e. hundreds of curies). 

Another important component of the primary system is the pressurizer (PR), whose function is that of an expansion volume and of a pressurization component. The latter function being obtained by electric heaters. The pressurizer keeps the circuit water at a higher pressure than its saturation pressure, thereby suppressing the steam production in the primary system. (The pressurizer was significant in the Three Mile Island (TMI) accident.)... 

It has to be remembered that boric acid may precipitate from the solution as various kinds of deposits (crud) which form on the inside primary system surfaces and especially on the hot surfaces of the fuel elements. Subsequently, in case of thermal or hydraulic transients, some of these deposits may peel off from the core giving rise to a reactivity transient. Over the years, no accidents due to this phenomenon have happened, notwithstanding the fact that the boron deposition on core surfaces has been observed and studied. The maximum reactivity which could be released can be evaluated of the order of 0.1 per cent in half a second (Petrangeli, 1967). 

None of these limits is reached in this accident, weighting the scenario as lower among other DBAs. Throughout accident duration, when very soon the primary system saturation conditions are reached (after about 600 s), the average steam-water mixture quality in the primary system always stays at a very low level. 

Figures 4-9-4-11 show the trends of some particularly significant quantities for some steam line break accidents. As it can be seen, the accident causes a quick depressurization and temperature decrease in the primary system, with consequent significant thermal stresses in the structure. The containment pressure, too, may reach significant levels.

This accident might happen if one of the control rod drive housings circumferentially breaks and is projected into the containment by the primary system pressure. In this scenario, the control rod drive and the control rod itself would be expelled (in a few hundredths of a second) and the rod would be completely and rapidly expelled from the core. 

Example of a category 4 accident break of the largest pipe of the primary system (large LOCA)... 

A structural cage around the vessel resistant to the burst of the vessel itself (destructive steam explosion, destructive reactivity accident) or to jet force caused by its perforation in conditions of high pressure in the primary system (the energies involved are illustrated in Fig. 5-3). 

The primary depressurization eliminates at the source, all the severe accident sequences with a pressurized primary system (i.e. direct containment heating, destructive reaction forces due to perforation of the vessel, etc.). Moreover, in case of malfunction of the high pressure cooling systems, it allows the cooling of the core by intermediate pressure accumulators and low pressure systems. 

As far as possible effects of operator actions are concerned, if electric power is recovered before the core is uncovered, cooling is re-established and the accident is terminated without damage, or with only modest damage, to the core. The operator has also to open the PORV in order to decrease the pressure in the primary system and to allow the use of the low pressure injection pumps for cooling the core. If the power is recovered after vessel break, flooding of the cavity will take place as an effect of the containment spray system and consequently the end of the accident destructive processes will occur. 

The results of the VIP programme confirm the importance of proper severe accident management, as the presence of a small amount of water may be decisive. Also the avaUability of a voluntary depressurization of the primary system is essential, which removes the possibility of many possible scenarios of vessel rupture. The programme also confirmed the need to actively continue studies and research on the external cooling of the pressure vessel in case of severe accident. 

This appendix details a simple calculation program that allows the rough evaluation of transients and accidents in the primary system of a PWR. It can however be adapted to other types of water reactors. 

Calculation tools of this kind are very useful to the designer or to the overall system analyst (even if they leave the true specialists of the branch rather puzzled), as they allow the study of many cases and for transient times as long as are desired. It has been observed, with reference to the Three MUe Island accident, that if the time length of the calculated transients had been prolonged beyond the intervention time of the safety systems, the adopted thermal-hydraulic codes (RELAP and so on) could have shown the danger of getting to a situation where the pressurizer is substantially full of liquid while the reactor vessel is nearly empty. As it is known, this situation may cause the operators to erroneously think that all of the primary system is full and therefore make them shut off the safety injection systems. In fact, the calculations performed were stopped precisely at the moment of their intervention. 

Saturation conditions are assumed in the primary system and, therefore, the initial phase of the pressurizer voiding during an accident cannot be simulated. This phase is not of great interest for the prevention of severe core damage which remains the field of deepest interest in the context for which the program has been written. The principal anal rtical instruments are the mass and energy conservation equations. 

The heat exchanged (in either direction) by the primary system with the steam generators during the accident can be simulated by a term decreasing from a given value at an initial time down to zero at a given subsequent time. This term may simulate, for example, the heat absorbed by the residual water of the secondary side of the steam generators after a stop of the feedwater flow. 

The operators, concentrating their attention on the fact that the level in the pressurizer was higher than normal, were erroneously convinced that the primary system was full of water and that therefore the core was safe. They, unfortunately, made, at this point and later in the course of the accident, some fatal manoeuvres, all consistent, however, with this erroneous conviction of theirs. One of the operators, about two and a half minutes after the start of the HPI pumps, stopped one of them and reduced the water flow rate of the other to a minimum. Subsequently a controlled spillage of the primary water was started. During the subsequent inquiries, he said The rapidly growing pressurizer level at the start of the accident made me believe that the high pressure injection (HPI) was excessive and that soon we would have the primary system completely full of water . 

In the subsequent years, the technical thinking on the accident at ENEA-DISP led to the development of a proposal for the Core Rescue System (CRS) (see Appendix 10) based on the voluntary depressurization of the primary system and on the injection of cooling water by passive systems (Petrangeli et al., 1993). This type of system was subsequently adopted in various new reaetor designs (e.g. on the AP 600 Westinghouse reaetor). In particular, the voluntary depressurization system of the primary circuit, publicly proposed for the first time (for pressurized reaetors) in the eourse of the mentioned studies in Italy, has beeome a permanent feature in the new PWR plant designs. 

The Emergency Injection System prevents core exposure in case of LOCA. The system consists of tanks with borated water connected to the RPV. In the event of such accident, the primary system is depressurized with the help of the emergency condensers and at low pressure the rupture disks break starting the RPV flooding with borated water. 

Safety evaluation studies have been conducted for confirming the physical phenomena and integrity of the reactor fiiel elements and the structures in the primary system during the normal operation, scram transients, and the early stage of postulated accidents. Recently major emphasis has been placed on an evaluation of passive safety features such as decay heat removal by natural circulation. 

The primary cooling ciicuit in a PWR is a high-integrity, pressure-resistant system that will contain any fission products released from the fuel in an accident until the internal pressure exceeds the values that would actuate the pressure relief devices. A simple, conqiact primary system will be easier to qualify and inspect and to protect from seismic events and external hazards. The RPV penetrations should be as few as possible and of small diameter. All primary system openings would be kept sealed for die duration of autonomous operation. 

These design objectives were carried over to the work on the power reactor PIUS, basically a pressurized water reactor (PWR) in which the primary system has been rearranged in order to accomplish an efficient protection of the reactor core and the nuclear fuel by means of thermal-hydraulic characteristics, in combination with inherent and passive features, without reliance on operator intervention or proper functioning of any mechanical or electrical equipment. Together with wide operating margins, this should make the plant design and its function, in normal operation as well as in transient and accident situations, much more easily understood and with less requirements on the capabilities and qualifications of the operators. 

---