Probabilistic Risk Analysis (PRA) surges as a way to evaluate the risk of Nuclear Power Plants (NPPs) and to quantify it. Its objective was to track sequences of accidents and define mitigate actions to prevent core damage. But when the core is damaged the question is how to avoid releases of radionuclides to the environment. PRA evaluates this scenario too and is input to the Severe Accident Management Guidance (SAMG). This paper aims in the interaction between PRA and SAMG, both under development for the Brazilian NPPs, focusing in one specific Plant Damage State (PDS). The objective is to develop an Accident Progression Event Tree (APET) proposing the mitigate actions for the event, helping to understand the phenomena

Araújo, Jeferson

Guamá, Daniel

Lapa, Celso Marcelo Franklin

Carpe dIEN

2015 International Nuclear Atlantic Conference - INAC 2015 
São Paulo, SP, Brazil, October 4-9, 2015 
ASSOCIAÇÃO BRASILEIRA DE ENERGIA NUCLEAR - ABEN 
ISBN: 978-85-99141-06-9 
 
INSIGHTS OF PROBABILISTIC RISK ANALYSIS ON THE 
DEVELOPMENT OF SEVERE ACCIDENT MANAGEMENT 
GUIDANCE: A CASE STUDY FOR A PLANT SIMILAR TO ANGRA I 
 
Daniel C. de Guamá
1,2
, Celso Marcelo F. Lapa
2
 and Jefferson B. Araújo
3 
 
1
 Eletrobrás Termonuclear S.A. - ELETRONUCLEAR 
Divisão de Segurança Nuclear - DISN.O 
Rodovia Procurador Haroldo Fernandes Duarte, S/N, km 521,56 
23948–000 Angra dos Reis, RJ 
guama@eletronuclear.gov.br 
 
2
 Instituto de Engenharia Nuclear (IEN / CNEN - RJ) 
Rua Hélio de Almeida, 75 
Rio de Janeiro, RJ 
lapa@ien.gov.br 
 
3
 Comissão Nacional de Energia Nuclear - CNEN 
Rua General Severiano, 90 – térreo 
22290-901 Rio de Janeiro, RJ 
jeferson@cnen.gov.br 
 
 
 
Note:  Use 10 point Times New Roman for Affiliation, Post address and Email address 
 
 
ABSTRACT 
 
Probabilistic Risk Analysis (PRA) surges as a way to evaluate the risk of Nuclear Power Plants (NPPs) and to 
quantify it. Its objective was to track sequences of accidents and define mitigate actions to prevent core damage. 
But when the core is damaged the question is how to avoid releases of radionuclides to the environment. PRA 
evaluates this scenario too and is input to the Severe Accident Management Guidance (SAMG). This paper aims 
in the interaction between PRA and SAMG, both under development for the Brazilian NPPs, focusing in one 
specific Plant Damage State (PDS). The objective is to develop an Accident Progression Event Tree (APET) 
proposing the mitigate actions for the event, helping to understand the phenomena. 
 
 
1. INTRODUCTION 
 
Nuclear power plants (NPPs) are basically thermal power plants which primary source of 
heat is the process of nuclear fission, generally (and in Brazil) of enriched Uranium-235. 
 
A typical pressurized water reactor (PWR), as used in the Angra plants, consist in: primary 
system or reactor coolant system (RCS), a closed cycle that includes the reactor vessel and 
exchanges heat with the Steam Generators (SGs) by forced circulation of water through the 
reactor coolant pumps (RCP); secondary system, also a closed cycle, removes heat from the 
primary system through the SGs and provides steam to turn the turbines e then generate 
electrical power; tertiary system, an open cycle, uses sea water, helps remove heat from 
secondary through Condensers in order to inject water back to the SGs, using the feedwater 
pumps (FWs). 
INAC 2015, São Paulo, SP, Brazil. 
 
When using nuclear fission as source of energy, some worries related to contain and avoid 
dispersion of radioactive materials should be taken. The plant project includes active systems 
for emergencies, as pumps and diesel generators, and passive systems as the steel 
Containment in which is the reactor building. 
 
Besides that, the risks to the workers, to the public in general and to the environment should 
be evaluated and controlled. For that all process is subject to safety standards. The 
International Atomic Energy Agency (IAEA) developed a report with the Safety 
Fundamentals [4], defining the principles that should be respected for the purpose to achieve 
the Safety Objective: “to protect people and the environment of the harmful effects of 
ionizing radiation”. 
 
One of the safety principles is the Accident Prevention, and its primary tool is the Defense in 
Depth, which promotes layers of independent barriers, introducing the concept of redundancy 
and ensuring that no single fail would lead to catastrophic results.  
 
In a way to measure the effectiveness of the barriers it is used the deterministic analysis, 
which predicts the plant response to initiators events postulated or the design basis accident 
(DBA). The premise is if the plant can resist to these accidents, it will resist to any other. 
 
Worries about safety come since the beginning of nuclear industry and the need for a 
quantitative risk analysis was the first reason to develop the famous WASH-1400 - Reactor 
Safety Study (RSS) [5]. It does not introduce the idea of probabilistic analysis to evaluate the 
risk for nuclear reactors, but gives shape and functionality to PRA. However, RSS was not 
welcome at the time of its publication due to raise controversial issues like comparing NPP 
risk with common risks usual for the general public as airplane crash and meteors fall. 
 
An accident at the Three Mile Island 2 NPP in March 1979 gave credibility to RSS, 
especially because the accident sequence was predicted in the analysis. A failure in the 
pressurizer relief valve kept it opened causing a loss of coolant accident (LOCA). Then the 
safety injection system started as expected. Operators misunderstood the start of the pumps 
and shut them down. As pressure dropped, a steam bubble was forming in the core that was 
serious damaged [2]. 
 
Besides being the worst nuclear accident inside USA, TMI-2 is also considered the most 
important in terms of lessons learned. Like TMI, Chernobyl and most recent Fukushima 
accidents prove that rare events may happen e that is why they have to be studied.  
 
1.1. Probabilistic Risk Analysis 
 
PRA works complementary to deterministic analysis to get assess the combination of 
individual failures that might lead to catastrophic results.  
 
The probabilistic risk analysis introduced by RSS and used today, takes event trees to model 
the accident sequences and fault trees to model equipment, systems and components (ESCs). 
The RSS innovate the way to evaluate risk for join these analysis and consider the common 
cause failure and human error, until that time neglected. 
 
INAC 2015, São Paulo, SP, Brazil. 
 
The event tree starts with an initiator event and assesses the functions that have to success to 
avoid core damage. The functions are made by fault trees model ESCs required to achieve 
their tasks. 
 
PRA is divided into levels according to the focus of analysis, and the result of each level is 
input to the next level. Level 1 analysis quantifies risk of reactor core damage. After core is 
already damaged, Level 2 analyzes the probability of release due the Containment failure or 
bypass. Level 3 assesses the impact of a radionuclides release in the neighborhood of the 
plant. 
 
1.2. Severe Accident Management 
 
The accidents mentioned above, besides being considered as “beyond design basis” (BDBA), 
are considered severe, because their reactors cores were significantly damaged.  
 
They showed the importance to have ways to mitigate the accident after core damage. Since 
emergency operational procedures (EOPs) are made to prevent core melt, they do not provide 
appropriate response to avoid the complications of the accident.  
 
The Severe Accident Management Guidance (SAMG) gives countermeasures that, in some 
cases, go against the philosophy of EOPs. When core melted, the worry became into avoid 
uncontrolled release of radionuclides for the environment. They are called “guides” cause, 
different of procedures, just gives directions on how to lead with the plant state. 
 
The general objective of SAMG is to terminate the emergency condition [3], and the only 
way to do this is satisfying three goals: return and maintain core to a controlled and stable 
state; to maintain containment in a controlled and stable state; and to finish fission products 
release. 
 
1.3. Interaction Between PRA and SAMG 
 
When finished, PRA Level 1 gives the accident sequences that generate core damage or not. 
To model Level 2 the core damage sequences are grouped into states which plant parameters 
will probably be similar. These groups are called Plant Damage States (PDSs). They are the 
initiators events of Level 2 and from them it will be developed the Accident Progression 
Event Tress (APETs). 
 
The APET evaluates functions related to systems and equipment (just like event trees on 
Level 1) that will be required during the accident and the occurrence of physical phenomena 
that might happen after core damage, like Hydrogen combustion. 
 
Different of Level 1, Level 2 can result in various end states, the Release Categories (RC). 
They are divided according to type, place and amount of fission products release. But it is 
usual to group the RCs responsible for early and large releases, known as LERF (large early 
release frequency), which is more relevant due to possible consequences (PRA Level 3). 
 
As Level 2 analysis cover studies of actions that have to be taken after core melting, 
evaluation of plant parameters, physical phenomena etc., PRA was used as input for the 
development of SAMG. 
INAC 2015, São Paulo, SP, Brazil. 
 
 
SAMG is not made to handle each specific accident. It gives suggestions for actions, 
depending on plant conditions aiming the reestablishment of core cooling, keeping core 
inside vessel and the integrity of containment. In this sense, the grouping of sequences from 
Level 1 into PDSs reduced the amount of possible states to analyze and supported the 
definitions of SAMG’s entries. Furthermore, SAMG actions are modeled in the APET, 
computational calculus of primary and containment are made on PRA. 
 
In view of the interaction between PRA and SAMG, this work looks for better understand this 
process, using for that a case study of a stated PDS, relevant for Brazilian units. An APET 
will be developed and from it to find the necessary steps to avoid the accident evolution.   
This work does not aims to quantify the branch probabilities.  
 
 
2. METHODOLOGY 
 
As cited before, PDS groups accident sequences of Level 1 according to the plant conditions 
in the course of the accident [1]. The groups will be defined based on three criteria: type of 
accident, primary pressure and the availability of heat sink by secondary system in case of 
LOCA. 
 
About type, accident sequences can be classified into LOCA (including here, vessel rupture 
and steam generator tube rupture – SGTR) and transients.  
 
Regarding primary pressure, the distinction between high or low will define the potential of 
vessel failure and the ejection of melted material in Containment. 
 
The availability of secondary system for heat sink is relevant in case of LOCA due to 
presence of steam on the containment atmosphere, a key factor because the Hydrogen (H2) 
production. The higher the steam concentration, lower the risk of H2 combustion. 
 
The PDS choice was based on your relevance for Angra Unit 1. As the major contributors for 
Angra 1 CDF are transients, especially loss of offsite power (LOOP), it was chosen for this 
study.  
 
From this initiator event, it has two PDSs, one for high and one for low pressure at the 
primary system (let’s call TH and TL). Sequences of Station Blackout (LOOP with failure of 
diesel generators), without offsite power recovery, are not considered in this PDS. 
 
To better understand the course of the accident, the analysis will be divided in three parts:  
- Initial phase: immediate response of the plant to severe accident; 
- Intermediate phase: phenomena before or directly related on vessel failure; 
- Final phase: phenome after vessel failure. 
 
Given that, the analysis will discuss the phenomena that could happen due to the event and 
will investigate what functions should be done to mitigate the event.  
 
Conservatively, this analysis will not take into account recovery actions of functions already 
assessed. 
INAC 2015, São Paulo, SP, Brazil. 
 
 
3. RESULTS AND DISCUSSIONS 
 
Just like event trees on Level 1 of the PRA, the APET try to outline chronologically the 
physical events and processes that can occur in a severe accident. The plant response and the 
actions taken in accident management should also be evaluated in light of the objectives of 
this work. 
 
The development of APET is important to visualize what the relevant factors for the non 
release of fission products into the containment. 
 
First, it is necessary to verify that the containment may or may not be biased, or efforts to 
prevent the release of radionuclides may be in vain. Thus, the primary function that must be 
satisfied is the insulation of the containment (IC). 
 
Despite the fact that the core is molten, some basic functions related to core maintenance on 
the vessel shall be carried out and the most important measure in the event of a severe 
accident is to inject water anyway in the reactor vessel. For this, it shall be necessary first 
depressurizes it. 
 
If the scenery is of high pressure, TH probably all depressurization actions have failed so far. 
However, due to complications of an accident, human actions should be taken. In order that 
the second function to be satisfied is the depressurisation of the primary (PD). 
 
Getting success in the above function, a means of injecting water has to be provided. The low 
pressure safety injection pumps are the preferred means to do so, since the cooling effect may 
in the long term. If the function succeeds, the final stage would be something like the TMI-2 
accident, with partial core meltdown, but without significant release. 
 
In case of not succeed in PD function, the pressurization can weaken the primary structures 
inducing breaks in the RCS, the most likely place would be one of the hot legs, or the SGs 
tubes before the pressure vessel failure, that it is the most likely to occur if the SG is 
depressurized. There are two relevant phenomena in this scenario: Break induced in the RCS 
(IR) and induced break in the tubes of SGs (ISR). 
 
If IR happen, it will be lead to a low-pressure setting on the primary (TH-2L), but still 
without any release. If it is considered that safety injection will occur, conservatively is 
expected that a release of radionuclides (RR) will occur, by the safety valves of the affected 
SG. If neither event occurs, it will give a high-pressure scenario in the primary (TH-2H). 
 
At this point we begin the analysis to the middle stage of progression of the accident. As it 
was not possible to cool the core to this stage, no action can prevent the phenomena described 
below. 
 
As discussed above, the intermediate phase comes from previous or directly related to the 
pressure vessel failure phenomena. At this point we can highlight the three most important: 
ignition of hydrogen (HI) present within the vessel; energy interaction between fuel and 
coolant (FCI) inside the vessel; and explosion due to high pressure in the vessel (HPE). 
 
INAC 2015, São Paulo, SP, Brazil. 
 
In the low pressure setting (TH-2L), HPE phenomenon will not take place. In the high 
pressure setting (TH-2H) three phenomena are likely to occur. 
 
Because of the difficulty of measuring the impact of these phenomena in the containment 
conservatively it was considered that if any of them happen in addition to the damage to the 
reactor vessel, so the contention is damaged then there is the release of radionuclides (RR). 
 
If none of them will happen, takes place then occur the third stage of the analysis. 
 
The third phase comprises the phenomena that may occur after pressure vessel failure. 
While they should already be operating from the beginning of the accident, Containment 
Spray (CS) and Fan Coolers (FC) will be relevant at this stage of the accident. However, 
because they are designed for accidents conditions, its functions may be even harmful to the 
scenario, the FC may even serve as an ignition source for the H2. 
 
After the breakup of the reactor vessel, the corium (molten material comprising the core and 
all the material that it merged) should cross the steel containment and then interact with the 
concrete. The corium-concrete reaction intensify the generation of H2, which in turn is highly 
explosive at high concentrations. The attenuating factor of the likelihood of this occurring is 
the ambient pressure: the higher the pressure, the greater must be the H2 concentration to be 
explosive. 
 
Thus, if the spray coolers or fans are operating when the vessel is already broken, the 
containment should not be challenged as the pressure, but the possibility of explosion H2 is 
more critical and must be taken into consideration. 
 
Therefore, as the operation of  both systems can aggravate the scenario, other parameters 
should be evaluated for the decision binds them or not. At this stage of the accident, then it 
should be considered only the operation of the spray cooling due to its function and 
containment inert atmosphere. 
 
The functions evaluated in the third phase will consider the ability to cool the corium outside 
the reactor vessel and prevent fails in contention. 
 
The first question seeks to prevent the corium cross the concrete containment dissipating into 
the environment. The second may be due to the combustion of H2 or failure of one's 
contention due to the conditions in which is being submitted. 
 
Even without the occurrence of any phenomenon that jeopardizes the integrity of the 
containment, at any given time, it will be no necessary to depressurize it. Thus, at this stage 
of the accident, there are no final state where no release can occur. 
 
It is not considered the possibility of injection after IR, therefore now if this has already 
occurred, possibly the nucleus is already badly damaged. Given this, when injecting water 
into the molten core, the probabilities of occurrence of the phenomena described in the 
intermediate phase are high. 
 
There was a vacuum on the thermohydraulic analysis that must be done in order to validate or 
not the presented scenarios. 
INAC 2015, São Paulo, SP, Brazil. 
 
 
 
4. CONCLUSIONS  
 
As shown, the first Level 2 PRA result is the development of the accident timeline. Another 
contribution is the modeling of the phenomena and to quantify the probability of occurrence 
of them. Since the mounting of the accident scene background required for the development 
of Severe Accident Management procedures (SAMGs). The creation of APET PRA also 
defines the priority functions. So the SAMG defines what actions should be taken and when 
they should be. In modeling severe accident was even possible to verify that actions would be 
taken in design basis accidents, can aggravate it. Thus, it was possible to demonstrate 
qualitatively, using a case study, the PRA provides the necessary support for the formulation 
of SAMG. 
 
ACKNOWLEDGMENTS 
 
This paper was supported by CNPQ and CAPES. We would like to thank Eletronuclear and 
CNEN.  
 
 
REFERENCES 
 
1. “Development and Application of Level 2 Probabilistic Safety Assessment for Nuclear 
Power Plants”, Specific Safety Guide No. SSG-4, International Atomic Energy Agency - 
IAEA, Vienna (2010). 
2. “INES - The International Nuclear and Radiological Event Scale User’s Manual”, 2008 
Edition, International Atomic Energy Agency - IAEA, Vienna (2013). 
3. “Severe Accident Management Programmes for Nuclear Power Plants”, Safety Guide No. 
NS-G-2.15, International Atomic Energy Agency - IAEA, Vienna (2009). 
4. “Fundamental Safety Principles”, Safety Fundamentals No. SF-1, International Atomic 
Energy Agency – IAEA, Vienna (2006). 
5. William Keller, Mohammad Modarres, “A historical overview of probabilistic risk 
assessment development and its use in the nuclear power industry: a tribute to the late 
Professor Norman Carl Rasmussen”, Reliability Engineering & System Safety, Volume 
89,  pp. 271-285 (2005).  


Insights of probabilistic risk analysis on the development of severe accident management guidance: a case study for a plant similar to Angra I

http://carpedien.ien.gov.br:8080/bitstream/ien/2352/1/INSIGHTS%20OF%20PROBABILISTIC%20RISK%20ANALYSIS%20ON%20THE%20DEVELOPMENT%20OF%20SEVERE%20ACCIDENT%20MANAGEMENT%20GUIDANCE%20A%20CASE%20STUDY%20FOR%20A%20PLANT%20SIMILAR%20TO%20ANGRA%20I.pdf

Insights of probabilistic risk analysis on the development of severe accident management guidance: a case study for a plant similar to Angra I

Abstract

Similar works

Full text

Available Versions

Carpe dIEN