Integration of the reliability of passive system in Probabilistic Safety Assessment

1
Integration of the reliability of passive system
in Probabilistic Safety Assessment

• M. Marquès, J.F. Pignatel, P. Saignes, N.
  Devictor (CEA),
• V. La Lumia, S. Mercier (Technicatome).
• Presentation content
• Introduction
• RP2 system principle and characterization
• Different types of malfunctions
• Reliability analysis of RP2 passive system
• Simplified event tree of total loss of power
  supply
• Deterministic evaluation
• Uncertainty analysis
• PSA results and analysis
• Conclusion
• Necessary improvements

2
Introduction

• Emergence of passive safety systems in innovative
  nuclear reactors projects
• These systems present interesting reliability
  features, compared with active safety systems,
  considered less reliable, due to the failures of
  their active components and the possibilities of
  human error.
• Potential failures due to the physical process.
• Necessity to evaluate the reliability of these
  passive systems.
• RMPS project to propose a specific methodology
  to assess the reliability of T-H passive systems.
  
• Integration of passive system unreliability in
  accident analysis
• Example of the integration of the RP2 system in a
  simplified PSA

3
Principle of the RP2 passive system
Residual Passive heat Removal system on the
Primary circuit
4
Modelling and Characterisation

• Modelling with the thermal-hydraulic code CATHARE
  (version 1.5a MOD 3.1) of a complete pressurized
  water reactor PWR 900 MWe with the 3
  independently simulated primary loops equipped
  each with a RP2 system.
• Accidental scenario transient of Total Loss of
  the Power Supplies (or Blackout).
• Mission of the RP2 system is double, on the one
  hand to depressurise the primary circuit, and on
  the other hand to avoid the fusion of the core.
• Failure criterion failure of the system is
  obtained if the maximum temperature of the clad
  or the temperature of the fluid at the core
  output go beyond respectively the values of 500C
  and 450C, in less than 12 hours.

5
Classification of the RP2 System malfunctions

• Malfunctions which could affect the RP2 system
  are of 3 types.
•  
• Passive system components failures
• Non opening per demand of the RP2 valve,
• Broken tubes in the RP2 exchanger.
•  
• Occurrence of an initial non standard
  configuration for the passive system,
• detectable by a monitoring system
• Pool level lower than the low level threshold,
• Pool water temperature higher than the high
  temperature threshold,
• Steam generator level lower than the low level
  threshold,
• Primary pressure higher than the high pressure
  threshold.
• undetectable by any monitoring system
• The rate of incondensable at the inlet of the RP2
  exchanger,
• The fouling of the tubes of the RP2 exchanger.

6
Reliability analysis of RP2 passive system
7
Simplified event tree of total loss of power
supply
8
Uncertain parameters
9
Deterministic evaluation with CATHARE
10
Sequence 1 3RP2, no broken tube
11
Uncertainty analysis with CATHARE
12
Sequences 4 and 5 2 RP2 available, no broken
tube

• Deterministic calculations
• Probabilistic model of the 14 random variables
• Failure probability ? P1 0.24

13
Sensitivity analysis

• 2 RP2 available and no broken tubes (Seq. 4 and 5)

14
Sequences 6, 7 and 8 2 RP2 available, one broken
tube
15
Evaluation of core damage probabilities
16
PSA results and analysis

• Core damage frequency, after a blackout
  7.5.10-8/year.
• Sum of the probabilities of each accident
  sequence leading to the core melt in pressure for
  the transient of blackout on the assumption that
  all the events are independent.
• Sequence 5 represents 96 of the core damage
  frequency.
• This sequence corresponds to a T-H process
  failure when 1 RP2 loop has failed.
• This frequency is at the limit of the
  acceptability, as it does not respect the
  probabilistic objectives 10-7/year for all the
  transient families, which corresponds for a
  transient family to 10-8/year.
• Necessary to re-examine the dimensioning of the
  RP2 system, The probabilistic objective to reach
  is 0.03 for the T-H process failure in case of 2
  RP2 loops available.
• ? These results underline the importance to take
  into account the T-H process failure probability
  to evaluate the reliability of a safety passive
  system

17
Specific limitations of the exercise

• This analysis concerns only one initiating event,
  the Total Loss of Power supplies, other
  initiating events have to be analysed,
• The initiating events created by a failure of the
  RP2, when it is not in demand are not taken into
  account,
• No aggravating event is considered, relative to
  the initiating event of Total Loss of Power
  supplies, else than the RP2 passive system
  failures (component failures or T-H process
  failure) and the safety injection,
• Human factor (operator errors) are not explicitly
  taken into account,
• No mechanical common cause failure between the
  3 RP2 loops have been considered.
• But the thermal-hydraulic common cause failure
  has been taken into account through the global
  CATHARE modelling of the 3 RP2 loops.
• The common cause failure between the monitoring
  systems of the RP2 loop are considered as
  negligible,
• No common cause failure is considered between the
  RP2 passive system and the safety injection.

18
Conclusion

• Proposal of a methodology to integrate the
  passive systems unreliability in PSA and
  application to an example.
• Positive effect of the RP2 passive system on the
  reactor safety.
• Proposal of a new dimensioning of the RP2 in
  order to fully satisfy the reactor safety
  objectives.
• These results confirm that the development and
  the validation of a methodology of reliability
  analysis relative to the safety passive systems
  are a precondition to the implementation of such
  systems on a nuclear reactor.

19
Necessary improvements

• Clear rules for the identification and
  quantification of the uncertainties
• Clear distinction between the prediction of the
  thermal hydraulic code and the true behaviour of
  the passive system under consideration.
• Temporal dependence of the failure (dynamic
  event tree), interaction between active and
  passive systems et human factor ( maintenance and
  inspection)
• Guides and criteria to compare passive and active
  systems
• Applications on a passive real reactor system -
  already existing or planned for future reactors
  in order to test the methodology under real
  conditions. A standard problem exercise is useful
  to demonstrate that the results of the evaluation
  are reproducible