canary ostrich black swan slides 13nov12

Presented at the International Meeting on Severe Accident Assessment and Management: Lessons Learned from Fukushima Daiichi, November 12, 2012, San Diego, CA

The Canary, The Ostrich, and The Black Swan –

Sherrell R. Greene, [email protected], EnergX LLC, Oak Ridge, Tennessee

An Historical Perspective on Our Understanding of BWR Severe Accidents and Their Mitigation

S. R. Greene, EnergX, LLC - 12 Nov 2012

Some definitions...

✤ Canary – a bird prized by miners as an “early warning system” for the presence of deadly gas

✤ Ostrich – a bird, believed by many, to stick its head in the sand to avoid menacing circumstances

✤ Black Swan – the symbol for an event which surprises everyone, but which, when viewed in retrospect, is considered to have been both predictable and inevitable

2


Presentation Overview

✤ Personal Preface

✤ Challenges raised by Fukushima Daiichi accident

✤ History of BWR severe accident knowledge evolution

✤ Detailed findings from historic BWR severe accident analyses

✤ Mega-Lessons from early work

✤ Some hard questions for us all

3


Preface / Personal Perspective: The appropriate approach to nuclear safety requires...

✤ Awareness of One’s Responsibility To Society

- a recognition that if we don’t do our job well, many people can pay the price for a long, long time

✤ A sense of Chronic Uneasiness

- a questioning attitude

✤ Scientific and Technical Humility

- a healthy respect for the limitations of our knowledge

4


Events at Fukushima Daiichi challenge traditional assumptions✤ Two “simultaneous” beyond-design-basis external events will not occur

✤ Accident events in one unit of a multi-unit site do not propagate to or significantly impact another unit on that site

✤ The availability of shared external emergency equipment and the ability of plant staff to respond to events in a single unit are not compromised by events at other units on the same site

✤ Regardless of cause, the world outside the plant boundary is not so impacted by the event as to compromise its ability to provide assistance to the plant

✤ The public risk and consequences of a major event are adequately captured by traditional prompt and latent cancer fatality metrics

5


Few were “thinking the unthinkable” prior to TMI-2

✤ 1957 – WASH-740

✤ 1967 – Reginald Farmer proposes risk-based siting criterion

✤ 1973 – WASH-1250

✤ 1975 – WASH-1400 (“Reactor Safety Study”)

✤ 1979 – Three Mile Island - 2 (TMI-2) Accident

✤ 1980 – NRC launches TMI action plan (NUREG-0660)

6


ORNL was chartered by NRC in 1980 to focus on analysis of BWR severe accidents✤ Focused on risk-dominant accidents from WASH-1400

- station blackout (SBO)- small break loss of coolant accident (SBLOCA)- loss of decay heat removal (LDHR)- anticipated transient without scram (ATWS)

✤ Integrated reactor / primary containment / secondary containment (reactor building) accident sequence analysis

✤ BWR-4 / Mk-I initial focus, followed by Mk-II and Mk-III ✤ Goals were to inform

- on-going risk studies- development of EOPs and SAMGs- experimental programs- accident simulation code development- regulatory actions

7

Produced over 250 papers, reports, and formal

presentations on BWR severe accident phenomenology,

accident sequence progression, fission product

behavior, and accident management strategies

between 1980 and late 1990’s

✤ Intense activity from 1980 ~ 1995: SASA, BWRSAT, Mk-II & Mk-III CPIP, ...


Much of what we need to know about BWR severe accidents was known by the early 1990’s

8

1975 1980 1985 1990 1995 2000 2005 2010

RSSWASH

-1400

TMI-2

Fukushim

a

Dai ich

i

NRCActions

IndustryActions

KeyAnalyses

TMI-2

Acti

on Plan

NUREG-0660

IDCOR

IPE & IPEEE

NUREG-1150PR

A Go

al

Policy S

tatem

ent

BWROG EP/SAG

Rev. 1

NRC Gu

idelines fo

r EOP

Prepara

tion

NUREG-1977

Stati

on Blac

kout

NUREG/CR-2182

, V1&

2

SBLO

CANUREG/CR-26

72, V

1&2

LDHR

NUREG/CR-2973

Mk-II & Mk-III SBO Primary Containment & Rx Bldg. Response Studies NUREG/CR-5565, NUREG/CR-5571

BNL Accident Mitigation Studies, NUREG/CR-5474

In-vessel Accident Mitigation Studies CONF-911-79-2, NUREG/CR-5869

SBO Mk-I Rx Bldg. Response StudiesCONF-8610135-41CONF-8710111-6CONF-880615-1NE&D, 120 (1990)

EPRI Severe A

ccide

nt

Mgnt.

Guid

ance Te

ch.

Basis

Report,

TR-1018

69BW

ROG EP/SAG

Rev. 0

911

Chernobyl

Safet

y Goal

Policy S

tatem

ent

51 FR 30

028

Mk-I Drywell Flooding StudyCONF-820609

ORNL/M-1015CONF-8810155-12

ORNL/M-1019NE&D 121 (1990)

CONF-91107-1BWR Rx Vessel Failure Mode Studies

IPE Ge

neric

Lette

r

GL 88-20

NRC NTTF Report

Sandia Siting StudyNUREG/CR-2239

SOARCA StudyNUREG–1935

IPE-->IPEE

E Ge

neric

Lette

r

GL 88-20

, Supplem

ent 4

Severe Accident Management Operator Human Factors Study

NUREG/CR-3887

Modifi

cation

s to S

afety Goal

Policy S

tatem

ent, S

ECY-00-00

77

IPE Su

bmittal

Guida

nce

NUREG-1335

Severe Accide

nt

Policy S

tatem

ent

50 FR 32

138

Prior

itization

of

Generic

Safe

ty Is

sues

NUREG-0933

Severe Accident Issues Closure PlanSECY-88-147

BNL BWR LTSBO Analysis, NUREG/CR-5850


1981 BWR station blackout (SBO) severe accident analysis revealed fundamental insights

✤ Station battery life determines accident sequence timing

✤ Short time to core damage following loss of DC power

✤ Instrumentation limitations would greatly hinder operator’s ability to diagnose and manage accident

✤ Operator’s role in managing / mitigation event is crucial

✤ Manual depressurization identified as key accident management strategy

✤ Automatic HPCI/RCIC suction shift detrimental

✤ Drywell failure into reactor building via electrical penetrations was most likely primary containment failure mode

9


BWR small break loss of coolant (SBLOCA) severe accident was analyzed in 1982✤ Chorus of control room indicators and alarms hampers operator’s ability to rapidly

diagnose accident

✤ Much of the safety-related equipment required for accident diagnosis and management might be compromised by break flow


✤ Rapid depressurization was most important emergency action

- EOPs prevented depressurization for breaks < ~ 0.35 m3/s (5600 gpm)

✤ HPCI/RCIC operation threatened unless operator took actions beyond existing EOPs

- variety of low pressure injection systems could over-fill reactor vessel

✤ Late-phase repressurization of reactor vessel possible

✤ Containment flooding could prevent reactor vessel failure

10


BWR Loss-of-Decay Heat Removal (LDHR) severe accident was analyzed in 1983

✤ Control rod drive hydraulic system (CRDHS) is critical response system

✤ Maintenance of well-mixed pressure suppression pool buys significant time

- several options, but EOPs were not in place

✤ Primary containment pressurization rate is sequence dependent

✤ HPCI & RCIC systems are at risk


✤ Drywell coolers major benefit if available

✤ Primary containment venting identified as key mitigation procedure

- early venting required to avoid exceeding installed vent system design pressure

11


The potential role of BWR reactor buildings in severe accidents was investigated in 1984-1990✤ Reactor building (RB) designs are highly plant specific✤ RBs might retain 90% of radioactive aerosols in some sequences✤ Primary containment failure mode & location has major impact on RB accident

mitigation effectiveness✤ Three RB systems can have major impact on its accident mitigation effectiveness

- Fire suppression sprays- Standby Gas Treatment System (SGTS)- Reactor Building Standby Ventilation System (RBSVS)

✤ Hydrogen deflagrations/detonations can greatly compromise RB effectiveness

- peak RB hydrogen detonation pressures ~ 221 kPa / 32 psia (4 X design pressure)

✤ Key approaches to maximizing RB accident mitigation effectiveness are

- reduce probability of RB bypass (e.g. drywell head seal failure)- ensure reactor building integrity (e.g. avoid hydrogen detonations)- improve reactor building fission product retention

12


BWR Mk-I severe accident mitigation options were studied from 1982 through early 1990’s✤ Drywell flooding to cool reactor pressure vessel (RPV) and primary

containment liner

- tension between priority of injecting water into the RPV if core / debris is coolable vs. time required to flood containment

✤ Depressurizing the reactor pressure vessel

- and ensuring it stays depressurzied

✤ Restoring (low pressure) injection into RPV

- and ensuring low-pressure injection is controlled and maintained

✤ Boron injection to off-set melting and relocation of control blades

13


Mk-II primary containment response to station blackout severe accidents was studied in 1988-1995✤ Short-term & long-term station blackout sequences

✤ Assessment impact of hardware improvements

✤ Key findings

- Six U.S. Mk-II containment designs differ in significant ways

- Automatic Depressurization System (ADS) actuation timing impacts accident sequence timing (Rev. 4 vs. Rev 3 EPG comparison)

- Drywell flooding effectiveness is questionable‣ downcomer design & location constrains flooding options‣ shutoff head of pumps available for drywell flooding is exceeded @ ~ 12

hours into STSBO- Drywell floor melt-through / containment failure at 8 - 10 hrs in STSBO and

~ 21 hours in LTSBO

14


Mk-III primary containment response to station blackout severe accidents was studied in 1988-1995

✤ Six different short-term station blackout sequences‣ operator actions: none, hydrogen igniters, vacuum breakers,

and containment venting- Unlike Mk-I & Mk-II, Mk-III containments aren’t inerted- Key findings

‣ Automatic Depressurization System (ADS) actuation timing impacts accident progression

‣ Containments would probably not fail on over-pressure‣ Wetwell hydrogen concentrations reach detonable limits in as little as 2 hours

in absence of operator actions‣ Wetwell venting can “inert” the wetwell (due to oxygen depletion) for a few

hours – rendering drywell igniters ineffective‣ Ex-vessel debris interactions drive drywell temperatures to auto-deflagration‣ Containment venting with existing lines does not significantly reduce the

probability of drywell & wetwell hydrogen detonations‣ Provision of assured power to ignitors should be examined

15


Legacy of 1980-1995 studies are “Mega-Lessons”✤ Realistic simulation of BWR severe accidents requires BWR-specific models

✤ Plant-specific design differences matter

✤ Existing plant instrumentation & control room indicators are often inadequate for severe accident management

✤ Purely symptom-based severe accident management approaches may not be optimal – or even sufficient

✤ Timely reactor depressurization is often the most important action

✤ Potential role and value of reactor buildings in severe accident mitigation is often overlooked

✤ Skilled and informed operators are the key to accident management

✤ Major plant modifications for severe accident mitigation don’t pass the traditional “Backfit Rule” cost/benefit analysis

16


Where’s “our head” today?

✤ The basic facts about BWR severe accident behavior have been known since the 1980’s

✤ Event progression at Fukushima Daiichi was consistent with scenarios analyzed 30 years ago

✤ Consequences of Fukushima-like accidents are unacceptable

- public safety & trauma- investment loss- societal economic impacts

✤ Current U.S. public risk goals do not shield us from Fukushima-like accidents

17


The Fukushima Dai ichi accident raises fundamental questions

✤ Will the Nuclear Industry and Regulators fall victim to “crisis learning” trap of focusing on the “ills that brought on the crisis” rather than the “thinking that brought on the presenting ills”?

✤ Will the Nuclear Industry and Regulators be preoccupied with and paralyzed by the fear of unintended consequences?

✤ Will the Nuclear Industry and Regulators go beyond the expedient to do what is in its own self-interest and the long-term interest of society?

✤ How can Industry respond to Fukushima without diluting operating focus & over-taxing human resources?

18

INDUSTRY


Moving “beyond the expedient” should include...

✤ Embracing reality that plant-specific design features are important

✤ Development (and backfit) of dedicated severe accident instrumentation & indicator packages

✤ Re-examination of the adequacy of symptom-oriented severe accident management approach

✤ Re-examination and retooling (if/as needed) of the interfaces between onsite (EOPs, SAMGs, EDMGs) and off-site emergency actions

✤ Development of more realistic and credible methods of practicing and “stress testing” all accident mitigation procedures (EOPs, SAMGs, EDMGs, etc.)

✤ Development of a true societal risk goal

✤ Re-examination of the Backfit Rule

19


Thank you...

20

canary ostrich black swan slides 13nov12

Documents

decay heat

control room

bwr severe

severe accident

drywell ooding

nuclear industry

reactor building

ep