Presented at the International Meeting on Severe Accident Assessment and Management: Lessons Learned from Fukushima Daiichi, November 12, 2012, San Diego, CA
The Canary, The Ostrich, and The Black Swan –
Sherrell R. Greene, [email protected], EnergX LLC, Oak Ridge, Tennessee
An Historical Perspective on Our Understanding of BWR Severe Accidents and Their Mitigation
S. R. Greene, EnergX, LLC - 12 Nov 2012
Some definitions...
✤ Canary – a bird prized by miners as an “early warning system” for the presence of deadly gas
✤ Ostrich – a bird, believed by many, to stick its head in the sand to avoid menacing circumstances
✤ Black Swan – the symbol for an event which surprises everyone, but which, when viewed in retrospect, is considered to have been both predictable and inevitable
2
S. R. Greene, EnergX, LLC - 12 Nov 2012
Presentation Overview
✤ Personal Preface
✤ Challenges raised by Fukushima Daiichi accident
✤ History of BWR severe accident knowledge evolution
✤ Detailed findings from historic BWR severe accident analyses
✤ Mega-Lessons from early work
✤ Some hard questions for us all
3
S. R. Greene, EnergX, LLC - 12 Nov 2012
Preface / Personal Perspective: The appropriate approach to nuclear safety requires...
✤ Awareness of One’s Responsibility To Society
- a recognition that if we don’t do our job well, many people can pay the price for a long, long time
✤ A sense of Chronic Uneasiness
- a questioning attitude
✤ Scientific and Technical Humility
- a healthy respect for the limitations of our knowledge
4
S. R. Greene, EnergX, LLC - 12 Nov 2012
Events at Fukushima Daiichi challenge traditional assumptions✤ Two “simultaneous” beyond-design-basis external events will not occur
✤ Accident events in one unit of a multi-unit site do not propagate to or significantly impact another unit on that site
✤ The availability of shared external emergency equipment and the ability of plant staff to respond to events in a single unit are not compromised by events at other units on the same site
✤ Regardless of cause, the world outside the plant boundary is not so impacted by the event as to compromise its ability to provide assistance to the plant
✤ The public risk and consequences of a major event are adequately captured by traditional prompt and latent cancer fatality metrics
5
S. R. Greene, EnergX, LLC - 12 Nov 2012
Few were “thinking the unthinkable” prior to TMI-2
✤ 1957 – WASH-740
✤ 1967 – Reginald Farmer proposes risk-based siting criterion
✤ 1973 – WASH-1250
✤ 1975 – WASH-1400 (“Reactor Safety Study”)
✤ 1979 – Three Mile Island - 2 (TMI-2) Accident
✤ 1980 – NRC launches TMI action plan (NUREG-0660)
6
S. R. Greene, EnergX, LLC - 12 Nov 2012
ORNL was chartered by NRC in 1980 to focus on analysis of BWR severe accidents✤ Focused on risk-dominant accidents from WASH-1400
- station blackout (SBO)- small break loss of coolant accident (SBLOCA)- loss of decay heat removal (LDHR)- anticipated transient without scram (ATWS)
✤ Integrated reactor / primary containment / secondary containment (reactor building) accident sequence analysis
✤ BWR-4 / Mk-I initial focus, followed by Mk-II and Mk-III ✤ Goals were to inform
- on-going risk studies- development of EOPs and SAMGs- experimental programs- accident simulation code development- regulatory actions
7
Produced over 250 papers, reports, and formal
presentations on BWR severe accident phenomenology,
accident sequence progression, fission product
behavior, and accident management strategies
between 1980 and late 1990’s
✤ Intense activity from 1980 ~ 1995: SASA, BWRSAT, Mk-II & Mk-III CPIP, ...
S. R. Greene, EnergX, LLC - 12 Nov 2012
Much of what we need to know about BWR severe accidents was known by the early 1990’s
8
1975 1980 1985 1990 1995 2000 2005 2010
RSSWASH
-1400
TMI-2
Fukushim
a
Dai ich
i
NRCActions
IndustryActions
KeyAnalyses
TMI-2
Acti
on Plan
NUREG-0660
IDCOR
IPE & IPEEE
NUREG-1150PR
A Go
al
Policy S
tatem
ent
BWROG EP/SAG
Rev. 1
NRC Gu
idelines fo
r EOP
Prepara
tion
NUREG-1977
Stati
on Blac
kout
NUREG/CR-2182
, V1&
2
SBLO
CANUREG/CR-26
72, V
1&2
LDHR
NUREG/CR-2973
Mk-II & Mk-III SBO Primary Containment & Rx Bldg. Response Studies NUREG/CR-5565, NUREG/CR-5571
BNL Accident Mitigation Studies, NUREG/CR-5474
In-vessel Accident Mitigation Studies CONF-911-79-2, NUREG/CR-5869
SBO Mk-I Rx Bldg. Response StudiesCONF-8610135-41CONF-8710111-6CONF-880615-1NE&D, 120 (1990)
EPRI Severe A
ccide
nt
Mgnt.
Guid
ance Te
ch.
Basis
Report,
TR-1018
69BW
ROG EP/SAG
Rev. 0
911
Chernobyl
Safet
y Goal
Policy S
tatem
ent
51 FR 30
028
Mk-I Drywell Flooding StudyCONF-820609
ORNL/M-1015CONF-8810155-12
ORNL/M-1019NE&D 121 (1990)
CONF-91107-1BWR Rx Vessel Failure Mode Studies
IPE Ge
neric
Lette
r
GL 88-20
NRC NTTF Report
Sandia Siting StudyNUREG/CR-2239
SOARCA StudyNUREG–1935
IPE-->IPEE
E Ge
neric
Lette
r
GL 88-20
, Supplem
ent 4
Severe Accident Management Operator Human Factors Study
NUREG/CR-3887
Modifi
cation
s to S
afety Goal
Policy S
tatem
ent, S
ECY-00-00
77
IPE Su
bmittal
Guida
nce
NUREG-1335
Severe Accide
nt
Policy S
tatem
ent
50 FR 32
138
Prior
itization
of
Generic
Safe
ty Is
sues
NUREG-0933
Severe Accident Issues Closure PlanSECY-88-147
BNL BWR LTSBO Analysis, NUREG/CR-5850
S. R. Greene, EnergX, LLC - 12 Nov 2012
1981 BWR station blackout (SBO) severe accident analysis revealed fundamental insights
✤ Station battery life determines accident sequence timing
✤ Short time to core damage following loss of DC power
✤ Instrumentation limitations would greatly hinder operator’s ability to diagnose and manage accident
✤ Operator’s role in managing / mitigation event is crucial
✤ Manual depressurization identified as key accident management strategy
✤ Automatic HPCI/RCIC suction shift detrimental
✤ Drywell failure into reactor building via electrical penetrations was most likely primary containment failure mode
9
S. R. Greene, EnergX, LLC - 12 Nov 2012
BWR small break loss of coolant (SBLOCA) severe accident was analyzed in 1982✤ Chorus of control room indicators and alarms hampers operator’s ability to rapidly
diagnose accident
✤ Much of the safety-related equipment required for accident diagnosis and management might be compromised by break flow
✤ Operator’s role in managing / mitigation event is crucial
✤ Rapid depressurization was most important emergency action
- EOPs prevented depressurization for breaks < ~ 0.35 m3/s (5600 gpm)
✤ HPCI/RCIC operation threatened unless operator took actions beyond existing EOPs
- variety of low pressure injection systems could over-fill reactor vessel
✤ Late-phase repressurization of reactor vessel possible
✤ Containment flooding could prevent reactor vessel failure
10
S. R. Greene, EnergX, LLC - 12 Nov 2012
BWR Loss-of-Decay Heat Removal (LDHR) severe accident was analyzed in 1983
✤ Control rod drive hydraulic system (CRDHS) is critical response system
✤ Maintenance of well-mixed pressure suppression pool buys significant time
- several options, but EOPs were not in place
✤ Primary containment pressurization rate is sequence dependent
✤ HPCI & RCIC systems are at risk
✤ Operator’s role in managing / mitigation event is crucial
✤ Drywell coolers major benefit if available
✤ Primary containment venting identified as key mitigation procedure
- early venting required to avoid exceeding installed vent system design pressure
11
S. R. Greene, EnergX, LLC - 12 Nov 2012
The potential role of BWR reactor buildings in severe accidents was investigated in 1984-1990✤ Reactor building (RB) designs are highly plant specific✤ RBs might retain 90% of radioactive aerosols in some sequences✤ Primary containment failure mode & location has major impact on RB accident
mitigation effectiveness✤ Three RB systems can have major impact on its accident mitigation effectiveness
- Fire suppression sprays- Standby Gas Treatment System (SGTS)- Reactor Building Standby Ventilation System (RBSVS)
✤ Hydrogen deflagrations/detonations can greatly compromise RB effectiveness
- peak RB hydrogen detonation pressures ~ 221 kPa / 32 psia (4 X design pressure)
✤ Key approaches to maximizing RB accident mitigation effectiveness are
- reduce probability of RB bypass (e.g. drywell head seal failure)- ensure reactor building integrity (e.g. avoid hydrogen detonations)- improve reactor building fission product retention
12
S. R. Greene, EnergX, LLC - 12 Nov 2012
BWR Mk-I severe accident mitigation options were studied from 1982 through early 1990’s✤ Drywell flooding to cool reactor pressure vessel (RPV) and primary
containment liner
- tension between priority of injecting water into the RPV if core / debris is coolable vs. time required to flood containment
✤ Depressurizing the reactor pressure vessel
- and ensuring it stays depressurzied
✤ Restoring (low pressure) injection into RPV
- and ensuring low-pressure injection is controlled and maintained
✤ Boron injection to off-set melting and relocation of control blades
13
S. R. Greene, EnergX, LLC - 12 Nov 2012
Mk-II primary containment response to station blackout severe accidents was studied in 1988-1995✤ Short-term & long-term station blackout sequences
✤ Assessment impact of hardware improvements
✤ Key findings
- Six U.S. Mk-II containment designs differ in significant ways
- Automatic Depressurization System (ADS) actuation timing impacts accident sequence timing (Rev. 4 vs. Rev 3 EPG comparison)
- Drywell flooding effectiveness is questionable‣ downcomer design & location constrains flooding options‣ shutoff head of pumps available for drywell flooding is exceeded @ ~ 12
hours into STSBO- Drywell floor melt-through / containment failure at 8 - 10 hrs in STSBO and
~ 21 hours in LTSBO
14
S. R. Greene, EnergX, LLC - 12 Nov 2012
Mk-III primary containment response to station blackout severe accidents was studied in 1988-1995
✤ Six different short-term station blackout sequences‣ operator actions: none, hydrogen igniters, vacuum breakers,
and containment venting- Unlike Mk-I & Mk-II, Mk-III containments aren’t inerted- Key findings
‣ Automatic Depressurization System (ADS) actuation timing impacts accident progression
‣ Containments would probably not fail on over-pressure‣ Wetwell hydrogen concentrations reach detonable limits in as little as 2 hours
in absence of operator actions‣ Wetwell venting can “inert” the wetwell (due to oxygen depletion) for a few
hours – rendering drywell igniters ineffective‣ Ex-vessel debris interactions drive drywell temperatures to auto-deflagration‣ Containment venting with existing lines does not significantly reduce the
probability of drywell & wetwell hydrogen detonations‣ Provision of assured power to ignitors should be examined
15
S. R. Greene, EnergX, LLC - 12 Nov 2012
Legacy of 1980-1995 studies are “Mega-Lessons”✤ Realistic simulation of BWR severe accidents requires BWR-specific models
✤ Plant-specific design differences matter
✤ Existing plant instrumentation & control room indicators are often inadequate for severe accident management
✤ Purely symptom-based severe accident management approaches may not be optimal – or even sufficient
✤ Timely reactor depressurization is often the most important action
✤ Potential role and value of reactor buildings in severe accident mitigation is often overlooked
✤ Skilled and informed operators are the key to accident management
✤ Major plant modifications for severe accident mitigation don’t pass the traditional “Backfit Rule” cost/benefit analysis
16
S. R. Greene, EnergX, LLC - 12 Nov 2012
Where’s “our head” today?
✤ The basic facts about BWR severe accident behavior have been known since the 1980’s
✤ Event progression at Fukushima Daiichi was consistent with scenarios analyzed 30 years ago
✤ Consequences of Fukushima-like accidents are unacceptable
- public safety & trauma- investment loss- societal economic impacts
✤ Current U.S. public risk goals do not shield us from Fukushima-like accidents
17
S. R. Greene, EnergX, LLC - 12 Nov 2012
The Fukushima Dai ichi accident raises fundamental questions
✤ Will the Nuclear Industry and Regulators fall victim to “crisis learning” trap of focusing on the “ills that brought on the crisis” rather than the “thinking that brought on the presenting ills”?
✤ Will the Nuclear Industry and Regulators be preoccupied with and paralyzed by the fear of unintended consequences?
✤ Will the Nuclear Industry and Regulators go beyond the expedient to do what is in its own self-interest and the long-term interest of society?
✤ How can Industry respond to Fukushima without diluting operating focus & over-taxing human resources?
18
INDUSTRY
S. R. Greene, EnergX, LLC - 12 Nov 2012
Moving “beyond the expedient” should include...
✤ Embracing reality that plant-specific design features are important
✤ Development (and backfit) of dedicated severe accident instrumentation & indicator packages
✤ Re-examination of the adequacy of symptom-oriented severe accident management approach
✤ Re-examination and retooling (if/as needed) of the interfaces between onsite (EOPs, SAMGs, EDMGs) and off-site emergency actions
✤ Development of more realistic and credible methods of practicing and “stress testing” all accident mitigation procedures (EOPs, SAMGs, EDMGs, etc.)
✤ Development of a true societal risk goal
✤ Re-examination of the Backfit Rule
19
S. R. Greene, EnergX, LLC - 12 Nov 2012
Thank you...
20