ANALYSIS OF BREST-OD-300 SAFETY DURING ANTICIPATED OPERATIONAL OCCURRENCES

ANALYSIS OF BREST-OD-300 SAFETY DURING ANTICIPATED OPERATIONAL OCCURRENCES D.V. Didorin, V.A. Kogut, A.G. Muratov, V.V. Tyukov, A.V. Moiseev (NIKIET, Moscow, Russia) 1. Brief description of the aim and principles of the safety analysis The results of deterministic safety analysis of the BREST-OD-300 power unit are presented with development of initial events (IE) for the anticipated operational occurrences with overlapping of the postulated multiple system or component failures and human errors. An option for development with overlapping of the most significant system and equipment failures including failures of reactor shutdown systems is considered for each initiating event. The initiating events including the following groups of internal effects are considered: - initiating events leading to unauthorized insertion of positive reactivity; - initiating events leading to disruption of heat removal from the reactor core; Performed deterministic safety analysis of these events with consideration for singlefailure principle in the safety systems showed that possible scenarios of anticipated operational occurrences considered according to current safety regulations do not lead to accidents. Only unlikely scenarios with complete failure of both reactor shutdown systems can result in exceeding the safe operation limits. For emergency operating modes requiring actuation of the emergency core cooling system (ECCS) a failure of two out of four loops was considered. Such approach is based on high reliability of the passive reactor cooling system, for which the probability of 3 loops failure per demand is 9 10-8 1/reactor-year. Due to the high heat capacity of the circulation circuit even in case of complete failure of the ECCS there is a reasonably large margin, no less than 24 hours, to take the measures necessary for troubleshooting by means of recovering of the ECCS function or urgent arrangement of residual heat removal by the atmospheric air using the normal cooldown system with emergency power supply. A maximum temperature of fuel cladding of 800 С was adopted as a main criterion for the transient evaluation. For the design-basis accidents a temporary exceeding of this criterion which depends on the maximum temperature of claddings is allowed. The calculations were performed using the DINAR software package. 2. Brief description of the reactor safety-related features In accordance with the regulations, two shutdown systems are considered in the reactor design, each of them being able to independently of one another place the reactor core into subcritical state and keep it subcritical consistent with consideration for a single failure principle or human error. The first shutdown system, EP (emergency protection system), ensures reactor shutdown by insertion of 7 EP rods. The second system, EPR (emergency power reduction system) ensures reactor shutdown by insertion of all reactivity control and compensation members (automatic reactivity control members, shim rods) and is much more efficient than the EP. In response to the emergency protection signals, all CPS control members are inserted. Along with the CPS rods the BREST reactor design provides for an additional reactivity control system PFBS (passive feedback system). The PFBS provides compensation of reactivity effects during the reactor power change within the energy range

from 30 % to 100 % N nom and maintains minimum level of reactivity margin comparable with β eff.. The PFBS consists of 18 independent side reflector channels, the lower part of which is hydraulically connected with the reactor core inlet, and the top part accommodates the gas globes with gas pressure inside of them maintaining the level of the lead coolant in the PFBS channels at the reactor core level at the nominal coolant flow rate. The PFBS operation principle lies in changing the neutron leakage from the reactor core and, accordingly, the reactivity by means of changing the lead column height in the lead reflector blocks according to the reactor coolant head (flow rate). Actuation of the PFBS during operation of the BREST reactor in transient modes with changing of the coolant head (flow rate) progresses as follows: when the coolant head level reduces (emergency or normal shutdown of the RCP), pressure at the reactor core inlet reduces, lead level in the PFBS channels passively decreases consequently increasing neutron leakage from the reactor core and a hence introducing negative reactivity. Respectively, when coolant flow rate increases, the lead level increase in the PFBS introduces positive reactivity. Fast Controlled Power Reduction (FCPR) modes are also considered in the BREST- OD-300 reactor. The FCPR is a preliminary protection system affecting the reduction of set reactor power level with the reduction of the set flow rate or set coolant heating. The FCPR modes are ensured by automatic movement of the automatic reactivity control members, shim rods and passive changing of the lead levels in the channels of the passive feedback system (PFBS) The FCPR actuates according to process parameter setpoints of the primary and secondary reactor circuits. Circulation circuit providing the reactor core cooling is arranged in the metal concrete vessel, therefore the reactor has an integral layout eliminating the possibility of coolant loss caused by pipeline damage. Flow diagram is designed to utilize head level at the core inlet ensuring continuation of coolant circulation in case of power supply loss to the reactor. In order to eliminate the possibility of natural coolant circulation termination the circuit does not include check and isolation valves. In order to provide emergency cooling of the reactor the ECCS is designed, which uses atmospheric air as an ultimate heat sink and operates via natural circulation. 3. Main results of the deterministic safety analysis 3.1. Shutdown of two RCPs Unauthorized shutdown of two RCPs during reactor nominal power operation is considered. The equipment and automatics of the secondary circuit operate normally. Simultaneous shutdown of two RCPs leads to reduction of coolant flow rate almost in half and, therefore, to significant deterioration of heat removal from the reactor core. IE development during design-basis operation of the equipment and systems. In case of simultaneous shutdown of two RCPs under action of the preliminary protection system the automatic reactivity control member provides controlled reactor power reduction proportionally to the total flow rate of all RCPs. The transient process ends in reactor power reduction down to ~ 40 % of the nominal value. IE development scenario with overlapping of multiple failures of the equipment and systems. This mode demonstrates self-regulation property of the reactor. The preliminary protection system failure with failure of automatic reactivity control members was considered as one of the IE development scenarios. Reactor parameters during the transient with shutdown of two RCPs do not reach setpoints of the safety systems actuation.

The reactor power will passively decrease due to lead level reduction in the PFBS channels and temperature feedbacks. Upon that, the power and the coolant flow rate change almost synchronously, the EPR setpoint on a power and flow rate mismatch is not reached. Steam generators in the loops with RCPs tripped are isolated in the secondary side by the feedwater flow controllers. In the loops with RCPs tripped a slightly ( 1 %) negative coolant flow rate is established. Safety systems are not operating in this mode. In this mode the reactor parameters do not exceed the safe operation limits (Figs. 1 2). N; G, rel. units 1,2 1 0,8 0,6 G 0,4 N 0,2 0 0 50 100 150 200 250 Fig. 1. Reactor power and reactor core coolant flow rate behavior Т, С 1400 1200 Т fue 1000 l 800 600 400 Т SG inlet Т clad Т core outlet 200 Т SG outlet Т core inlet 0 50 100 150 200 250 Fig. 2. Behaviour of fuel, fuel cladding, lead coolant at the reactor core and SG inlets and outlets temperatures 3.2. Initiating events leading to unauthorized insertion of positive reactivity Unauthorized withdrawal of two groups of automatic reactivity control members is considered.

Initial state: steady state operation of the power unit at the nominal power. The equipment and automatics of the secondary circuit operate normally. The operating reactivity margin at the nominal power in the equilibrium refueling mode is 0.4 β eff, and it is assumed that two groups of the automatic reactivity control members are in the middle position, and the shim rods are removed from the reactor core. Consequently, the CPS failure with two groups of automatic control members being removed one-by-one from the reactor core with maximum speed that results in the introduction of full positive reactivity margin of 0.4 β in 30 s, is considered as an IE. Upon that, the IE is overlapped with the automatic blocking of continuous removal of the automatic control members from the reactor core for more than 150 mm, otherwise the considered initiating event can not be realized. IE development during design-basis operation of the equipment and systems. Unauthorized insertion of positive reactivity results in power increase and heating of the reactor core. To prevent undesired transient development and its escalation into an accident, actuation of the following two systems is considered in the BREST-OD-300 reactor design: the EPR according to the signal of exceeding of 110 % Nnom setpoint; the EPR according to the signal of exceeding of 115 % Nset setpoint; the FCPR-4 according to the coolant temperature of 580 С at the outlet of the reactor core central part. Their actuation results in early power reduction or reactor shutdown without actuation of the emergency protection. IE development scenario with overlapping of multiple failures of the equipment and systems. IE development scenario with overlapping of multiple failures of the equipment and systems or human errors is given in Table 1. Sequence of actuation of systems and equipment with consideration for design logic of their operation Table 1. IE development scenario Actuation setpoint Failures considered in the scenarios Notes, expert assessment of actions, consequences 1) Actuation of EPR 110 % Nnom Failure Increase of the reactor core 2) Actuation of EPR 115 % Nset Failure Increase of the reactor core 3) Actuation of Fast Controlled 580 С at the reactor Failure Increase of the reactor core Power Reduction-4 central zone outlet 4) EP 120 % Nnom Failure Increase of the reactor core 5) EPR Mismatch of power and coolant head level Failure Increase of the reactor core 6) EP 600 С at the reactor EP failure Increase of the reactor core central zone outlet 7) Actuation of SG safety 620 С at the reactor Increase of the reactor core device, isolation steam valves central zone outlet, and feedwater isolation valves, termination of heat removal shutdown of feedwater pump-2 from the primary circuit 8) EPR Signal for closure of all feedwater isolation valves Failure Increase of the reactor core 9) RCP shutdown 520 С at SG outlet Transition to natural circulation, decrease in heat removal from the reactor core,

Sequence of actuation of systems and equipment with consideration for design logic of their operation Actuation setpoint 10) EPR More than 2 RCPs tripped 11) Normal cooldown system 430 С at the ECCS outlet 12) ECCS 450 С at the ECCS outlet Failures considered in the scenarios Failure Failure Failure of two ECCS loops Notes, expert assessment of actions, consequences insertion of negative reactivity by the PFBS Heating of the reactor core and the primary circuit Primary circuit heating Residual power removal Results of the IE development analysis for the case of overlapping of failures of all safety systems involved in coping the IE, are presented in Figures 3 4. The reactor power in this case reaches 1.45 Nnom. According to temperature setpoint at the core outlet of 620 С the steam generators are shut off by means of isolation gate valves with their subsequent draining. Temperature of cladding of the most heat rated fuel elements reaches 1025 С, the lead coolant temperature at the SG inlet is 815 С. Partial damage to the reactor core fuel elements with high burnup, but not exceeding the limit set for accidents, is possible. Circulation circuit integrity is maintained. The probabilistic safety analysis showed that the possibility of an accident with failure of two reactor shutdown systems at introduction of maximum reactivity margin does not exceed 10-8 1/year. N; G, rel. units 1,6 1,4 N 1,2 1 0,8 0,6 0,4 0,2 G 0 0 200 400 600 800 1000 Fig. 3. Reactor power and reactor core coolant flow rate behavior

Т, С 1800 1600 Т fue l 1400 1200 1000 800 Т clad 600 400 Т core outlet Т SG inlet 200 Т SG outlet Т core inlet 0 200 400 600 800 1000 Fig. 4 Behaviour of fuel, fuel element cladding, lead coolant at the reactor core and SG inlets and outlets temperatures It should be noted that according to the experimental data, damage pressure on a SG tube even with the weakened plane (flat up to 2 mm deep) exceeds 40 MPa at coolant temperature of 950 С. However, such high steam pressure is not reached even in the case of failure of the safety devices and, besides, the external secondary pipelines will break first, followed by the release of nonradioactive steam and pressure drop. Nevertheless, an analysis of non-initiating of steam relief devices of the SG at lead temperature increase up to 815 С with loss of 8 (according to the number of modules) steam generator tubes integrity and entry of steam-water mixture into the primary circuit is performed. In this case the pressure in the reactor gas plenum increases, and the radioactive products are localized by the steam generator leakage localization system. A possibility of multiple ruptures of SG tubes (more than 8) is 10-8 1/year. 3.3. Blackout of the power unit Power unit blackout with shutdown of four RCPs and termination of feedwater supply during nominal power operation is considered as an IE leading to the worst deterioration of the reactor core heat removal conditions. IE development during design-basis operation of the equipment and systems. Reduction of coolant flow rate results in lowering of the lead levels in the channels and insertion of negative reactivityof 0,7 eff, the reactor power starts to decrease passively. Loss of auxiliary power causes generation of EP signal in response to the CPS control member drives and reactor is shut down. Besides, two reactor shutdown systems must be actuated in response to several other signals RCP trip, feedwater pumps trip, failure of the turbine condenser, coolant temperature increase, mismatch of power and flow rate. Primary coolant natural circulation is established; residual reactor power removal is provided by the passive air-cooled ECCS. After closure of the SG isolation gate valves the feedwater supply from the secondary circuit is terminated and the turbine shuts down. IE development scenario with overlapping of multiple failures of the equipment and systems.

Failures of the two reactor shutdown systems are postulated. Reactor power is reduced only by temperature feedbacks and the PFBS. Residual power removal is provided by two loops of the ECCS (another two ECCS loops failed). Figures 5 7 shows behavior of reactor parameters in case of postulated failure of both reactor shutdown systems in response to all generated signals. Maximum cladding temperature of the most heat rated fuel element for 45 s exceeds 800 С and reaches 890 С. Lead temperature at the SG inlet increases up to 670 С, whereas the steam generator is cut-off from feedwater and steam, and the steam from the SG is released through the safety device into the atmosphere. No loss of sealing of the SG tubes. N; G, rel. units 1,2 1 0,8 0,6 0,4 N 0,2 0 G 0 50 100 150 200 250 300 350 Fig. 5. Reactor power and reactor core coolant flow rate behavior Т, С 1300 1200 1100 Т fue l 1000 900 800 Т clad 700 600 500 400 300 Т core outlet Т SG inlet Т SG outlet Т core inlet 0 50 100 150 200 250 300 350 Fig. 6. Behaviour of fuel, fuel element cladding, lead coolant at the reactor core and SG inlets and outlets temperatures during blackout

Т, С 800 750 700 650 600 550 500 450 400 350 Т fuel Т clad Т SG inlet Т core outlet Т SG outlet Т core inlet 300 0 5000 10000 15000 20000 25000 30000 35000 Fig. 7. Behaviour of fuel, fuel element cladding, lead coolant at the reactor core and SG inlets and outlets temperatures during long-term cooldown 4. Main results of deterministic safety analysis with postulated multiple system and equipment failures According to the results of deterministic safety analysis of the BREST-OD-300 power unit the development of IE of the anticipated operational occurrences with overlapping of multiple system or equipment failures or human errors do not result in severe accidents. The analysis showed high safety level of the BREST-OD-300 power unit.