Analysis of cold leg LOCA with failed HPSI by means of integrated safety assessment methodology

Annals of Nuclear Energy 69 (2014) 144–167

Contents lists available at ScienceDirect

Annals of Nuclear Energy journal homepage: www.elsevier.com/locate/anucene

Review

Analysis of cold leg LOCA with failed HPSI by means of integrated safety assessment methodology J. Gonzalez-Cadelo ⇑, C. Queral, J. Montero-Mayorga Universidad Politécnica de Madrid (Technical University of Madrid), C/Alenza 4, 28003 Madrid, Spain

a r t i c l e

i n f o

Article history: Received 9 January 2013 Received in revised form 29 November 2013 Accepted 6 February 2014 Available online 4 March 2014 Keywords: Accident management Emergency operating procedures Integrated safety assessment Probabilistic safety assessment Small-break LOCA TRACE code

a b s t r a c t The integrated safety assessment (ISA) methodology, developed by the Spanish Nuclear Safety Council (CSN), has been applied to a thermal–hydraulic analysis of cold leg LOCA sequences with unavailable High Pressure Injection System in a Westinghouse 3-loop PWR. This analysis has been performed with TRACE 5.0 patch 1 code. ISA methodology allows obtaining the Damage Domain (the region of space of parameters where a safety limit is exceeded) as a function of uncertain parameters (break area) and operator actuation times, and provides to the analyst useful information about the impact of these uncertain parameters in safety concerns. In this work two main issues have been analyzed: the effect of reactor coolant pump trip and the available time for beginning of secondary-side depressurization. The main conclusions are that present Emergency Operating Procedures (EOPs) are adequate for managing this kind of sequences and the ISA methodology is able to take into account time delays and parameter uncertainties. Ó 2014 Elsevier Ltd. All rights reserved.

Contents 1. 2.

3.

4.

5.

6.

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Materials and methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.1. Almaraz Unit I TRACE model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2. General overview and application of ISA methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2.1. Block A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2.2. Block B . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2.3. Block C . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2.4. Block D . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Path analysis with respect to the break size and depressurization delay. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1. Damage domain for sequences with RCP trip concurrent with break . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2. Damage domain for sequences without RCP trip . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3. Damage Domain comparison (RCP ON/OFF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4. Comparison between ISA and PSA available time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Analysis with respect to the break area size and RCP trip delay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.1. Damage domain for sequences without secondary side cooling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2. Damage domain for sequences with secondary side cooling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Probability density functions of uncertain parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.1. Break size PDF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.2. Beginning of secondary side cooling and depressurization PDF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.3. RCP trip PDF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Risk assessment. Integration of damage domains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.1. Damage Exceedance Probability calculation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

⇑ Corresponding author. Tel.: +34 913367061. E-mail addresses: (J. Gonzalez-Cadelo).

[email protected],

http://dx.doi.org/10.1016/j.anucene.2014.02.001 0306-4549/Ó 2014 Elsevier Ltd. All rights reserved.

[email protected]

145 146 146 147 147 148 148 148 149 150 152 155 156 156 157 158 159 159 159 162 164 164

J. Gonzalez-Cadelo et al. / Annals of Nuclear Energy 69 (2014) 144–167

7.

6.2. Comparison between ISA Conclusions. . . . . . . . . . . . . . . . . Acknowledgments . . . . . . . . . . . References . . . . . . . . . . . . . . . . .

and PSA results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ......................................................................................... ......................................................................................... .........................................................................................

145

165 166 167 167

Nomenclature AFW AM CAMP CL CSN CVCS DD DEF DEP DET EOP FW HPSI HRA IDPSA ISA LBLOCA LOCA

auxiliary feedwater accident management Code Application and Maintenance Program cold leg Spanish nuclear regulatory body chemical and volume control system damage domain damage exceedance frequency damage exceedance probability dynamic event tree emergency operating procedure feedwater high pressure safety injection human reliavility analysis integrated deterministic probabilistic safety analysis integrated safety assessment large-break LOCA loss of coolant accident

1. Introduction Over the past few years, increasing trend towards Risk-Informed Regulation and concerning about classic PSA limitations have led to increasing attention on dynamic PSA methodologies among nuclear analysts. Dynamic methodologies for PSA use a time-dependent phenomenological model of system evolution along with its stochastic behavior to account for possible dependencies between failure events (Aldemir, 2013). In the framework of dynamic PSA, the literature reports on a variety of methods; e.g. (Aldemir, 2013; Dong et al., 2013; Rychkov et al., 2013; Voroyev and Kudinov, 2012; Voroyev et al., 2011; Hakobyan et al., 2008; Kloos and Pesche, 2008, 2006; Sonnenkalb et al., 2004; Kloos and Hofer, 2004; International Atomic Energy Agency, 2012; Nuclear Energy Agency, 2011a) and (Nuclear Energy Agency, 2011b). The different groups which currently work in dynamic PSA have recently joined in an international network called IDPSA, see references (Aldemir, 2013; Zimmerman et al., 2013; Adolfsson et al., 2012) and (Adolfsson et al., 2011) for more details. Methods of probabilistic dynamics enable the analyst to fully account for the interaction of dynamics and stochastics and for the temporal dependency in the evaluation of accident consequences in addition with their initiating event probabilities. As a drawback, probabilistic dynamics operates on the actual time/state space and its computational effort is considerably larger compared to a conventional event tree analysis. For this reason its application is still restricted to specific aspects of PSA. In order to considerably reduce the computer time for the numerous dynamics calculations, these methods generally treat continuous and discrete random transitions in a probabilistic way, through repeated branching of the sequence at systematically chosen points in time according to user specified probability distributions. ISA methodology, developed by the Modeling and Simulation Branch of the CSN, lies within those methodologies, see (Izquierdo et al., 2008; Hortal et al., 2010) and (Aldemir, 2013) for more details. It is an adequate method to perform analysis of the impact of uncertain parameters in nuclear safety issues, especially

LOOP LSTF MBLOCA NPP NSSS PCT PD PDF PSA PORV PWR RCP RCS SBLOCA SG TMI-2 TRC UPM

loss of offsite power Large Scale Test Facility medium-break LOCA nuclear power plant nuclear steam supply system peak cladding temperature previous damage probability density function probabilistic safety assessment pilot operated relief valve pressurized water reactor reactor coolant pump reactor coolant system small-break LOCA steam generator Three Mile Island NPP – unit 2 Time Reliability Correlation Technical University of Madrid

suited for those sequences where some events occur at uncertain times. The quantitative result of this methodology consists of the DEF. This is achieved by means of the identification of the DD of the sequence, which is defined as the region of the space of parameters of interest that results in damage, and constitutes a useful tool for the verification of nuclear safety issues. In this work, an analysis of CL LOCA sequences with failed HPSI has been performed with TRACE 5.0 patch 1 thermal–hydraulic code by means of the ISA methodology. This analysis has been performed with the model of Almaraz NPP, a commercial 3-loop PWR Westinghouse design. Whenever a LOCA occurs in a Westinghouse reactor, operators must follow steps specified by the EOPs, which are summarized in Fig. 1 and described in TECNATOM, 1999. There are expected two main tasks by the crew in this kind of sequences: RCP trip if necessary and cooling RCS at 55 K/h by means of SG depressurization. According to EOP E-0 (Reactor Trip or Safety Injection) RCPs must be stopped if: (a) at least one high pressure safety injection pump is running; and (b) subcooling is lost. Transition to E-1 (Loss of reactor or secondary coolant) is triggered after checking RCS integrity. RCP trip criteria are further checked again in EOP E-1. According to EOP E-1 step 11, transition to EOP ES-1.2 (Post LOCA Cooldown and Depressurization) is triggered if primary pressure is above 15 bar. Once the transition to EOP ES-1.2 has taken place, operator is expected to cool RCS at 55 K/h by means of SG depressurization. The adequacy of RCP trip was reviewed after the TMI-2 accident and it was concluded that there were two main scenarios, depending on HPSI availability (Sheron et al., 1979; Thomson et al., 1980; Montero-Mayorga et al., 2014): (a) If HPSI is available, RCPs must be tripped at the beginning of LOCA sequences in order to avoid worse consequences following a delayed RCP trip. (b) On the other hand, if HPSI is not available, operators must not trip RCPs in order to cool the core through forced convection.

146

J. Gonzalez-Cadelo et al. / Annals of Nuclear Energy 69 (2014) 144–167

Fig. 1. Main steps of Westinghouse EOPs related to SBLOCA sequences.

In this paper, only the sequences with unavailable HPSI are analyzed. The analysis for sequences with available HPSI is published in a separated paper (Montero-Mayorga et al., 2014). Although RCP trip is not expected for LOCA sequences without HPSI (following EOPs guidance), several issues make this case worthy of analysis:  Comparison with non-tripped RCP transients will endorse the EOPs if better, or will reveal weaknesses in EOPs if worse.  The possibility of occurrence of a LOOP concurrently to scram would preclude the continuous RCP operation, so unintended RCP trip is possible in this kind of sequences, e.g. (Nuclear Regulatory Commission, 2002).  Finally, there is evidence of operator tendency to trip the RCP because of high-vibration conditions, despite of EOPs guidelines, e.g. (Nuclear Regulatory Commission, 2000). The main goals of this work are the following ones: (a) To verify the adequacy of EOPs related to this scenario (LOCA with unavailable HPSI) through thermal–hydraulic simulations performed with TRACE code and by following ISA guidance. (b) To assess the impact of secondary-side depressurization and RCP trip as AM actions in LOCA with unavailable HPSI sequences. (c) To prove ISA capability as an independent way to verify EOPs and support PSA analysis. This article is divided into several sections, summed up in the following:  Section 2 describes both the details on the TRACE model used for simulating and a brief overview of ISA methodology.  In Section 3, ISA methodology is applied to sequences with variable break size and depressurization beginning time, in order to obtain DDs of sequences with RCP trip simultaneous to the break and without RCP trip.

 In Section 4, ISA methodology is applied to sequences with variable break size and reactor coolant pump trip time, in order to obtain DDs of sequences with secondary-side depressurization at 600 s from break and without depressurization.  Section 5 presents PDFs for uncertain parameters considered in this work (break size, RCP trip time and depressurization beginning time).  Finally, section 6 contains the application of ISA methodology in order to obtain the DEP of the different sequences, by the integration of PDFs (obtained in Section 5) inside the DDs obtained in sections 3 and 4.  Section 7 summarizes the main conclusions of ISA application for cold leg LOCA sequences with unavailable HPSI. 2. Materials and methods This section describes both the details on the TRACE model used for simulating (Section 2.1) and a brief overview of ISA methodology (Section 2.2). 2.1. Almaraz Unit I TRACE model Almaraz NPP consists of two PWR located in Cáceres (Spain). Commercial operation started in April 1981 (Unit I) and in September 1983 (Unit II). Each unit has a PWR Westinghouse with three loops with a nominal power of 2739 MWt and 977 MWe. The original SGs were replaced between 1996 and 1997 and, at present, it is equipped with three Siemens KWU 61 W/D3 steam generators. Reactor coolant pumps are single-stage, centrifugal model W-11011-Al (93-D) designed by Westinghouse. Almaraz I NPP TRACE model (see Fig. 2) is composed of 252 thermal–hydraulic components (2 VESSEL, 52 PIPE, 71 TEE, 41 VALVE, 3 PUMP, 20 FILL, 27 BREAK, 36 HEAT STRUCTURE and 3 POWER component), 685 SIGNAL VARIABLES, 1532 CONTROL BLOCKS and 47 TRIPS (Queral et al., 2010a). With regards to the primary circuit, the following components have been modeled:

J. Gonzalez-Cadelo et al. / Annals of Nuclear Energy 69 (2014) 144–167

147

Fig. 2. Nodalization of the Almaraz NPP TRACE model.

 Reactor vessel, modeled by a VESSEL component, which includes the core region, guide tubes, support columns, core bypass, and the bypass to the vessel head via downcomer and via guide tubes.  Nuclear core power is modeled with axial and radial cosine power shape distributions. Core power is distributed to nine HEAT STRUCTURE components located each one in one core sector.  The three loops, with its pumps, steam generators and pressurizer in loop 2 (containing heaters, relief/safety valves and pressurizer spray system).  CVCS, safety injection system and ACC. With regards to the secondary circuit, the following components have been modeled:  The steam lines up to the turbine stop valves, with the relief, safety and isolating valves.  The steam dump with the eight valves.  FW and AFW systems. Feed water pumps coastdown and auxiliary mass flows are included as boundary conditions. The control systems and protection and engineering safeguards systems-signals that have been modeled are:  Pressurizer level control: CVCS isolating discharge signal, CVCS charge flow and heaters.  Pressurizer pressure control: including proportional and backup heaters, spray lines and PORVs.  Steam generators level control system.  Steam dump control.  Turbine control.  Protection and engineering safeguard system-signals: Emergency shutdown system (SCRAM); safety injection; pressurizer safety valves logic; auxiliary feedwater system activation; relief, safety and isolating valves logic of steam lines; normal feedwater system isolation, turbine trip and pump trip. This model has been validated with steady and transient conditions (Queral et al., 2010a) and verified with a large set of transients, e.g. (Queral, 2002; González et al., 2005; Queral et al., 2008; Queral, 2010b, 2011; Gonzalez-Cadelo et al., 2012) and (Jimenez et al., 2013). Details on validation matrix of Almaraz TRACE model are included in Queral et al. (2010a). Steady states and transients used for verification were: A. Steady states at several power rates, namely: 100%, 75%, 25%, 10%, 3%, 2% and 1% of nominal power.

B. Transients at full power with and without human actions, which include: Turbine trip with different kinds of failure, opening of a pressurizer PORV, Main Steam Line break, Total Loss of Feedwater without AFW system and Feed & Bleed, SG tube rupture, small-break LOCA, medium-break LOCA and large-break LOCA. C. Transients at low power and shutdown plant condition, consisting of loss of Residual Heat Removal System with different primary configurations: Closed primary system, midloop conditions; one or two pressurizer PORVs open, pressurizer manway open, and vessel vent valve open.

2.2. General overview and application of ISA methodology The ISA methodology aims at providing with an adequate method to perform a general uncertainty analysis, with emphasis in those sequences where some events occur at uncertain times. For a given safety limit or damage limit (PCT in this paper), the numerical result of this methodology consists of the exceedance frequency of that limit, generically referred to as DEF, for the sequences originated from a relevant set of initiating events. This is done along with the delineation of the DET and the identification of the DD of the sequences that contribute to the total DEF. The DD of a sequence is defined as the region of the space of uncertain parameters of interest (break size, secondary-side-depressurization beginning time and RCP trip time for the case analyzed in this paper) where the limit is exceeded. In order to consider all the parametric and temporal uncertainties, it is currently under consideration the possibility of separating them into two groups: (a) Main uncertain parameters, which would be assessed by means of DDs as illustrated in this work, and (b) the rest of the uncertainties (including epistemic one), whose consideration will be included in the methodology by means of Monte Carlo sampling. This kind of application is still under development stage. A schematic description of the ISA methodology is given by the flow diagram of Fig. 3 which shows the main blocks that constitute it and the overall interactions among them.

2.2.1. Block A The Sequence Generation module performs the simulation of the reference DET originating from an initiating event. DETs follow the evolution of the plant according to the occurrence or not of events that change the plant dynamics. These results allow identifying the candidate sequences to be analyzed in detail in the Path Analysis module (Block B).

148

J. Gonzalez-Cadelo et al. / Annals of Nuclear Energy 69 (2014) 144–167

PATH ANALYSIS: DAMAGE DOMAINS SEEKING

RISK ASSESSMENT: EXCEEDANCE FREQUENCY CALCULATION

BLOCK B

BLOCK D

BLOCK A

BLOCK C

SEQUENCE GENERATION AND SIMULATION CONTROL

CLASSICAL PROBABILITY AND DELAY TIMES QUANTIFICATION

Fig. 3. ISA methodology general diagram.

2.2.2. Block B The Path Analysis module takes each sequence of interest from block A and spawns multiple simulations with different values of uncertain parameters and/or time delays (human actions or stochastic phenomena). Each such simulation, called a path, can end either in a success or damage state. Those paths ending in damage state are said to belong to the Damage Domain (DD) of the sequence. Although DDs have as many dimensions as the number of uncertainties involved in each sequence, in this analysis only three uncertain parameters are taken into consideration: break size, beginning of secondary side cooling and RCP trip time.

iii.

iv. 2.2.3. Block C The probability and time delay quantification module provides the necessary information to calculate in Block D (Risk Assessment) the probabilities and the contribution to DEF of each sequence of interest. v. 2.2.4. Block D The Risk Assessment module calculates the DEF by integrating on the DD region, obtained from Block B (Path Analysis module), and the probability density functions obtained in Block C (Probability module). Block A is not explicitly performed in this paper, because it has been carried out in other previous work (Queral et al., 2012b) and the sequence of interest has been previously selected. Therefore, such sequence is directly introduced in Block B in order to identify the DD. The application of ISA is presented in following sections. ISA methodology has been successfully applied in other analysis: Loss of Component Cooling System (see Ibañez et al., 2010), Upper and Lower Head SBLOCA (Queral et al., 2011a; GonzalezCadelo et al., 2012), Hot Leg LOCA (Gomez-Magan et al., 2012), Total Loss of Feedwater System (Queral et al., 2013b), Station blackout (Queral et al., 2013a, 2012a), Steam generator tube rupture (Jimenez et al., 2013) and hydrogen concentration inside containment. ISA methodology has several important differences with respect to the classic PSA, as indicated below: i. Success criteria: Event tree headers in PSA are usually defined at safety function level, i.e., each header represents the failure of a safety function. System success criteria are therefore needed to develop the header fault trees. In the ISA context, however, event tree headers represent hardware states (system trains working or not) or operator AM actions. PSA fault trees are used in ISA methodology to calculate the probability of each system configuration, not to quantify failure probabilities. ii. Header branches: In PSA event trees, header intervention, i.e., demand of a safety function, is decided on the basis of generic analyses. On the other hand, demand for header intervention in ISA is a simulation result. As a consequence,

vi.

in PSA there are two possible branches for a header (failure with probability PF and success with probability 1  PF), but ISA considers three possible branches for a header (demanded with failure with probability PDPF, demanded with success with probability PD(1  PF), and not demanded with probability 1  PD). Available times: In PSA the available time of a header has a different value for each sequence. In ISA methodology it is a function of the uncertain times and parameters and also the status of the systems that have been demanded during the sequence. End state: In PSA event trees there are two possible final states for a sequence: damage or success with complementary probability 0 or 1. However, in ISA methodology the final state of a sequence is a random variable: damage with probability PD and success with probability PS which fulfill PD + PS = 1. Human actions: In PSA, an AM action is considered to have failed if it is not performed within a pre-specified time interval (available time). An action delayed beyond the available time is treated as non-performed action. In ISA methodology, however, AM actions are events occurring at uncertain times. A delayed action is still a performed action even if it is not able to avoid a damage condition (limit exceedance). As a consequence, a PSA success sequence, when analyzed in ISA context, may contain a non-empty DD resulting from excessive delays of AM actions. Failure probabilities: In PSA the system failure probabilities may depend on the dynamics of the sequence only in a limited and qualitative way. However, ISA allows to use process variables (e.g., temperature or void fraction values in a pump) in order to vary failure rate of components. This issue will not be explored in this paper.

Fig. 4. RCS pressure. Sequences with no depressurization and with RCP trip.

J. Gonzalez-Cadelo et al. / Annals of Nuclear Energy 69 (2014) 144–167

149

vii. Damage condition: In level 1 PSA the damage condition is the LOCA acceptance criterion, Maximum PCT of 2200 F (1477.15 K). In ISA methodology, several conditions could be imposed at the same time in the same analysis. This possibility allows obtaining the DEF for all the safety variables. Following sections contain detailed ISA application, and several ISA-PSA differences are illustrated in Sections 3.4 and 6.2. Other differences have been illustrated in other works previously referenced.

3. Path analysis with respect to the break size and depressurization delay

Fig. 5. Core collapsed liquid fraction. Sequences with no depressurization and with RCP trip.

This application of ISA methodology to CL LOCA sequences without HPSI has involved the analysis of secondary-side depressurization effects (EOP ES-1.2 step 6, see above) on different break size LOCA transients. Path analysis (Block B in Fig. 3) has been applied to two different scenarios: without RCP trip (as expected in EOPs) and with RCP trip coincident with break (unexpected action due to LOOP or human error). The performance of simulations by fixing RCP trip time allows obtaining a DD with break size and depressurization beginning time as uncertain parameters. In this analysis, simulations have been performed with the following assumptions: 1. Break diameters from 1 to 6 in. (27 diameters were considered). 2. Break at 4650 s of simulation, in order to simulate a suitable stationary-state. 3. HPSI unavailable (0 out of 2 trains). 4. Availability of all ACCs (3 out of 3 ACCs). 5. Availability of one LPSI train (1 out of 2 trains). 6. RCP trip at a fixed time.

Fig. 6. PCT. Sequences with no depressurization and with RCP trip.

The analyses have been performed in three stages: firstly, the DD with RCP trip has been obtained (Section 3.1); later, the DD without RCP trip has been also obtained (Section 3.2); and finally, both DDs have been compared in Section 3.3.

Fig. 7. CL LOCA with no HPSI and with RCP trip. Seeking of DD – Stage 1.

150

J. Gonzalez-Cadelo et al. / Annals of Nuclear Energy 69 (2014) 144–167

3.1. Damage domain for sequences with RCP trip concurrent with break Simulations have been carried out by following several steps, in order to build the DD with a minimal computational effort. These steps were: Step 1. First, failure of secondary side depressurization is assumed (tSG ? 1) with the result of no manual depressurization in secondary side. A transient (path) is simulated for each considered break diameter (100 , 1.2500 , 1.500 . . .), as shown in Figs. 4–6. In these sequences a final state is reached, resulting in either a damage state (if PCT > 1477 K at any time) or a successful one, Fig. 6. Those final states are depicted in a

time/break-size diagram, Fig. 7. Simulated damage paths are depicted in there at the time when damage is reached because any simulation assuming depressurization after that time also reaches damage at the same time. The line which connects those damage paths is named PD line. Step 2. By taking into account that EOPs establish that RCS cooldown must undergo a maximum rate of 55 K/h it is possible to obtain a manual depressurization inefficiency time. This time is defined as the maximum time when manual depressurization is possible without overriding cooldown limit included in EOPs (55 K/h). The line which connects those inefficiency times is named inefficiency line, as depicted in Fig. 7. Step 3. In a third step, simulations are performed for each break size with a depressurization time of 600 s. Such time is the

Fig. 8. CL LOCA with no HPSI and with RCP trip. Seeking of DD – Stage 2.

Available time

Fig. 9. CL LOCA with no HPSI and with RCP trip. Final DD.

J. Gonzalez-Cadelo et al. / Annals of Nuclear Energy 69 (2014) 144–167

151

Fig. 10. ACC and LPSI-injection-time comparison (w/wo depressurization).

Fig. 11. PCT. Sequences with depressurization at 600 s from break and RCP trip.

Fig. 13. PCT. 1.500 and 200 Diameter break sequences with RCP trip and w/wo depressurization.

Fig. 12. RCS pressure. 1.500 and 200 Diameter break sequences with RCP trip and w/wo depressurization.

Fig. 14. Core collapsed liquid fraction. 1.500 and 200 Diameter break sequences with RCP trip and w/wo depressurization.

152

J. Gonzalez-Cadelo et al. / Annals of Nuclear Energy 69 (2014) 144–167

minimum time for reaching step 6 in EOP ES-1.2 (which leads the operator to depressurization), as considered in HRA models. Damage and success transients are depicted in Fig. 8. Step 4. In a fourth step, several simulations are performed for each break size, by varying depressurization time between 600 s (previous step) and inefficiency line. Transients simulated, reaching damage or success, are depicted in their corresponding coordinates of DD, in a way which makes easy the distinction between success and damage paths, see Fig. 8. Step 5. Damage domain is then obtained by drawing the line which separates damage and success paths, as shown in Fig. 9. A deeper analysis of these simulations allows obtaining several conclusions:  Primary pressure, core level and PCT of PD simulations (step 1) are depicted in Figs. 4–6, respectively. As shown in Fig. 4, larger break diameters lead to faster depressurization in the primary system, as expected from the fact that RCS inventory is earlier depleted through larger breaks. This fact is also shown in Fig. 5, where core level is depicted. Due to fast depressurization, ACC discharge and LPSI actuation occurs early in the transient, and therefore large enough breaks prevent core damage, as shown in Fig. 6.  A detailed analysis of PD line, Fig. 7, shows three separated trends: (a) In a first interval, between 1 and 2 in., a decreasing trend is appreciated; as expected because of the fact that the larger the break is, the greater the discharge of coolant results, and hence the damage is reached earlier. (b) In a second interval, between 2 and 3.25 in., the initial decreasing trend is replaced by a slightly increasing trend, caused by ACC actuation, which delays damage conditions. (c) Finally, from 3.25 in. on, there are not damage conditions, because of the large break flow, which depressurizes the RCS fast enough to allow a quick ACC and LPSI actuation and avoid damage.  The effect of manual depressurization on ACC and LPSI actuation is shown in Fig. 10, where early-depressurization effect is compared to no-depressurization effect on injection times. As

shown in that figure, manual depressurization has a beneficial effect on small-break sizes, by bringing forward both ACC and LPSI injection; but it has no effect for larger breaks.  PCT evolution of transients considered in step 3 is depicted in Fig. 11, where it can be appreciated that only break diameters of 2.5 and 3 in. reach damage conditions. Thereby, an early secondary-side depressurization prevents core from damaging in a wide range of breaks. The comparison between evolution of those transients which reach damage conditions without depressurization but not if depressurizing at 600 s have been depicted in Figs. 12–14 (RCS pressure, PCT and core level) for break diameters of 1.5 and 2 in. As shown in those figures, secondary-side depressurization is necessary in order to avoid PCT limit exceedance (Fig. 13) and prevent core uncovery (Fig. 14). Otherwise, sequences reach damage conditions.  The border of DD minus the considered minimum time for depressurization (600 s) corresponds to the available time in order to begin secondary side cooling as a function of break size, as shown in Fig. 9. In this case, it is concluded that: (a) In a first interval, between 1 and 2 in., available time decreases with increasing diameter. (b) For break diameters 3.2500 < Ø < 200 there is not any available time, and cooling at 55 K/h is not enough in order to avoid core damage. (c) Finally, from 3.25 in. on, available time is infinite, due to the fact that manual depressurization is not necessary for avoiding core damage. This result is a generalization of classic PSA available time, which corresponds to single values in each break range (SBLOCA, MBLOCA and LBLOCA), not to functions depending on uncertain parameters. In following subsection, an analogous analysis is performed in order to obtain the DD of sequences with RCP running throughout the transient. 3.2. Damage domain for sequences without RCP trip This case accomplishes the guidelines of EOPs. Simulations have been carried out in several steps, analogous to those

Fig. 15. CL LOCA with no HPSI and without RCP trip. Seeking of DD – Stage 1.

J. Gonzalez-Cadelo et al. / Annals of Nuclear Energy 69 (2014) 144–167

153

summarized in previous section for the case of RCP trip concurrent with break:

A deeper analysis of these simulations allows obtaining several conclusions:

 In a first step, the PD line is obtained (see Fig. 15). In this case there is not inefficiency line due to the effect of running pumps, which repressurize the RCS whenever cold water is injected from ACCs or LPSI, and therefore manual depressurization is not clearly inefficient at any fixed time.  Later, simulations are performed for each break size with a depressurization beginning time of 600 s (tSG = 600 s). In this case there is not any damage sequence, Fig. 16.  Finally, several simulations are then performed for each break size, by sampling depressurization time between 600 s and PD line, see Fig. 16. These simulations allow obtaining the DD in a similar way to previous analysis, see Fig. 17.

 A detailed analysis of PD line, Fig. 15, shows that there is previous damage only between 2.5 and 3.25 in. This fact is due to forced convection, which prevents core damage for small breaks even with a high void fraction inside core during long periods of time.  Regarding LPSI injection behavior for PD paths, there are three separated trends: (a) Firstly, it is appreciated a monotonous decreasing trend between 1 and 2.5 in., as expected because of the fact that the larger the break diameter, the greater the loss of coolant and the depressurization, so the earlier the LPSI injection.

Fig. 16. CL LOCA with no HPSI and without RCP trip. Seeking of DD – Stage 2.

Minimum available time

Available time

Fig. 17. CL LOCA with no HPSI and without RCP trip. Final DD.

154

J. Gonzalez-Cadelo et al. / Annals of Nuclear Energy 69 (2014) 144–167

Fig. 18. ACC and LPSI-injection-time comparison (w/wo depressurization).

is understood when RCS pressure is depicted in both cases, see Fig. 19. RCS pressure is suddenly collapsed by ACC injection in both cases but, 1. In the case of non-manually-depressurized sequences, depressurization due to ACC discharge is large enough to reach the LPSI-injection pressure (10 bar), and therefore LPSI injection takes place. 2. However, LPSI-injection pressure is not reached for manually-depressurized sequences, because ACC discharge is slightly different, thereby preventing LPSI injection.

Fig. 19. RCS pressure. 2.500 and 300 Diameter break sequences without RCP trip and w/wo depressurization.

(b) In a second interval, between 2.5 and 4 in., the initial decreasing trend is replaced by a complex trend, caused by the actuation of accumulators. (c) Finally, from 4 in. on, LPSI injection line recovers its decreasing trend again because of the large break flow, which depressurizes the primary system fast enough to minimize thermal–hydraulic phenomena.  The effect of manual depressurization on ACC and LPSI actuation is shown in Figs. 18 and 19. It is observed that there are different behaviors along the sequence and depending on break size: (a) Manual depressurization brings forward ACC discharge for break diameters smaller than 3 in. as shown in Fig. 18. There is no effect for larger break sizes. (b) LPSI-injection pressure is reached earlier in cases with manual depressurization than in cases which are not depressurized for small and large breaks (Ø < 1.500 and Ø > 2.7500 ), but it is reached later for intermediate breaks (1.500 < Ø < 2.7500 ), see Fig. 18. Intermediate-break behavior

(c) After the fast depressurizing trend due to ACC discharge, Fig. 19, RCS pressure is greatly increased due to core boiling. Such bounce effect, which only takes place if RCPs are running at low-RCS pressure, stops LPSI injection for non-manually-depressurized cases. (d) Once the RCS is repressurized in both cases due to the bounce effect, secondary-side depressurization prevents RCS from maintaining high pressure for a long time, thereby allowing continuous LPSI injection. On the other hand bounce effect is repetitively happening if no manual depressurization is performed, avoiding continuous LPSI injection, as shown in Fig. 19.  In order to compare the evolution of those transients which reach damage conditions without depressurization to those ones which do not if depressurizing; RCS pressure, PCT and core level have been depicted in Figs. 19–21, respectively, for break diameters of 2.5 and 3 in. As shown in those figures, secondary-side depressurization is necessary in order to avoid PCT limit exceedance (Fig. 20) and prevent extended core uncovering (Fig. 21). Manual depressurization is needed in order to effectively begin LPSI actuation, because LPSI injection while RCPs are running is cause of the aforementioned bounce effect at low pressures, which slightly repressurizes the RCS (interrupting LPSI injection until it is depressurized again), as previously said.  As in previous case, DD border is related to the available time to begin secondary-side cooling. As shown in Fig. 17, in this case such DD border has a minimum value of about 4000 s, and

J. Gonzalez-Cadelo et al. / Annals of Nuclear Energy 69 (2014) 144–167

155

Fig. 20. PCT. 2.500 and 300 Diameter break sequences without RCP trip and w/wo depressurization.

Fig. 22. PCT. 200 Diameter break sequences without depressurization and w/wo RCP trip.

Fig. 21. Core collapsed liquid fraction. 2.500 and 300 Diameter break sequences without RCP trip and w/wo depressurization.

Fig. 23. Core collapsed liquid fraction. 200 Diameter break sequences without depressurization and w/wo RCP trip.

therefore there is always a minimum available time (3400 s = 4000–600 s) for beginning of secondary side cooling in order to avoid damage. This result is completely different to the previous one, and it proves that maintain RCPs running is a better choice in this kind of sequences. 3.3. Damage Domain comparison (RCP ON/OFF) In order to understand the differences between transients with/ without RCP trip, the evolution of PCT, core liquid level and primary pressure are depicted in Figs. 22–24 for two simulated cases of PD line. In those figures it is possible to appreciate that RCP trip implies a great difference in the evolution of transient. As shown in Fig. 22, damage condition is not reached in the case of transient with running pumps, and core level evolution (Fig. 23) is clearly different to the case where RCPs are tripped. Such difference in inventory behavior is due to the repressurization triggered by safety injection when primary pumps are running. In Fig. 24 it is possible to appreciate that primary system in the transient without RCP trip is repressurized, shutting off LPSI injection at 5000 s from break, showing the aforementioned bounce effect due to LPSI actuation while pumps are running and no depressurization action takes place. Comparison of both DDs, with and without RCP trip, see Fig. 25, shows that:

Fig. 24. RCS pressure. 200 Diameter break sequences without depressurization and w/wo RCP trip.

1. RCP trip is not an adequate action, as it worsens evolution of transients (i.e., the DD of running pumps is surrounded by DD of tripped pumps). 2. There is always a larger available time with RCP ON (running RCPs) than with RCP OFF (tripped RCPs). This result also confirms that RCP ON option is always better than RCP OFF at the beginning of the transient.

156

J. Gonzalez-Cadelo et al. / Annals of Nuclear Energy 69 (2014) 144–167

Fig. 25. Damage Domain comparison (RCP trip ON/OFF).

However, a new analysis is needed in order to understand if it is possible to trip RCPs along the transient avoiding core damage. 3.4. Comparison between ISA and PSA available time In classic PSA, LOCA events are divided depending on break size with regards to several plant considerations, and LOCA categorization is chosen with regards to phenomena of a single reference sequence, and maintained for the rest of the sequences considered in the event tree. Thus, while such categorization is adequate for the reference sequence, it could be inadequate for other ones. From a generic point of view, LOCA events can fall into three main categories: SBLOCA, MBLOCA and LBLOCA. The boundaries between SBLOCA and MBLOCA and between MBLOCA and LBLOCA are plant dependent, and each licensee considers for PSA its own values, which are discussed in PSA support documents. Such values and LOCA categories are illustrated in Table 1, where there are shown two cases whose data have been obtained from the PSAs of similar Westinghouse-design NPPs. Taking into account these LOCA classification it is possible to estimate available time for each one of the categories from information contained in DDs, as illustrated in Fig. 26 and Table 2. It must be noted that DD boundaries do not only depend on the definition of SBLOCA, MBLOCA and LBLOCA, but also on the analysis tools being applied. LOCA categorization has two main consequences:  In classic PSA each LOCA category has its own available time for performing AM actions, due to that fact, different categorizations lead to different available times, and thus to different PSA results (e.g. SBLOCA with RCP off). Table 1 LOCA classification depending on break diameter for different Spanish plants. Break diameter (in.)

Case I

Case II

SBLOCA MBLOCA LBLOCA

0.4–1.500 1.5–4.000 >4.000

0.4–2.000 2.0–6.000 >6.000

 Although LOCA categorization does not lead to any difference in available time (as in the case of RCPs ON), PSA results would be different, as a consequence of considering the same available time to different break size ranges. As shown in Fig. 26, it is found that, in general, for each transient there is an adequate LOCA classification taking into account DD boundaries; e.g., the LOCA categorization for the sequence which corresponds to RCPs ON (right side of Fig. 26) seems to be more adequate if it is considered the following categorization: SBLOCA < 2.500 ; 2.500 < MBLOCA < 3.2500 and LBLOCA > 3.2500 .

4. Analysis with respect to the break area size and RCP trip delay Analogously to path analysis (Block B) performed in the previous section with respect to the break size and depressurization delay, in this section the relevance of RCP trip on different break size LOCA transients is analyzed by fixing the secondary-side depressurization beginning time. As previously pointed out, operator is led to RCP trip in EOP E-0 and EOP E-1, but only if HPSI is available. Therefore operator must not trip RCPs in considered sequences, which have unavailable HPSI. However, human error or plant state and circumstances during accident (LOOP concurrent with break, high vibration conditions in pumps, etc.) can trigger unintended RCP trip, so it is necessary to analyze such possibility. In this analysis, simulations have been performed with the following assumptions: 1. Break diameters from 1 to 6 in. 27 diameters were considered. 2. Break at 5000 s of simulation, in order to simulate a suitable stationary-state. 3. HPSI unavailable (0 out of 2 trains). 4. Availability of all accumulators (3 out of 3 accumulators). 5. Availability of one LPSI train (1 out of 2 trains). 6. Secondary-side depressurization beginning at a fixed time.

157

J. Gonzalez-Cadelo et al. / Annals of Nuclear Energy 69 (2014) 144–167

SBLOCA

MBLOCA

LBLOCA

SBLOCA

SBLOCA

MBLOCA

LBLOCA

MBLOCA SBLOCA

MBLOCA

Fig. 26. SG depressurization available time estimated from DDs for different PSA categorizations: Case I (upper figures) and Case II (lower figures).

Table 2 SG depressurization available time estimated from DDs for different PSA categorizations. LOCA category

Break diameter 00

RCPs OFF

RCPs ON

Case I

SBLOCA MBLOCA LBLOCA

0.4–1.5 1.5–4.000 >4.000

1900 s 0s 1

1 3400 s 1

Case II

SBLOCA MBLOCA LBLOCA

0.4–2.000 2.0–6.000 >6.000

100 s 0s 1

1 3400 s 1

(depressurization at 600 s from break), which is analyzed in next section. Simulations have been carried out following several steps, analogous to those followed in previous analysis:

4.1. Damage domain for sequences without secondary side cooling

1. PD and LPSI injection lines match with those obtained in previous RCP-ON DD, Fig. 14, due to the fact that the conditions are the same ones. 2. Second step is to simulate transients with earliest possible RCP trip (concurrent with break, tRCP = 0). These cases do not require to be simulated again; because they correspond to PD paths obtained in Section 5.1. 3. In a third step, several simulations have been performed for each break size, by varying RCP trip delay time time between 0 s (concurrent with break) and PD line (or 25,000 s, for break sizes which have not previous damage). 4. Final DD for considered sequences is depicted in Fig. 28. It has been achieved directly from Fig. 27, by considering only damage domain border and previous damage line.

This is not a realistic case, but a bounding one, which allows to conclude the effect of RCP trip for considered break sizes in the worst situation (no cooling and depressurization by means of SGs), as well as the importance of secondary-side depressurization by comparing with the DD for the cases with early depressurization

In this case, the DD shows that it is not possible to find a time interval for RCP trip in order to avoid core damage for all break sizes, as shown in Fig. 28. This result proves the necessity of secondary side cooling, which is analyzed in following section.

Firstly, the DD for the case without secondary side cooling is performed. Secondly, the DD with secondary side cooling is performed, and finally both DDs are compared.

158

J. Gonzalez-Cadelo et al. / Annals of Nuclear Energy 69 (2014) 144–167

Fig. 27. CL LOCA without HPSI and without SG depressurization. Seeking of DD.

Fig. 28. Cold Leg break without HPSI and without SG depressurization (final DD).

4.2. Damage domain for sequences with secondary side cooling The DD analyzed in this section corresponds to transients with early manual depressurization (tSG = 600 s). As stated previously, this is considered as the minimum time for reaching step 6 of EOP ES-1.2, which establishes the beginning of cooling and depressurization by means of SGs. This DD is the most important due to the fact that this kind of sequences (early SG depressurization and uncertain RCP trip) corresponds to that considered as the most probable situation in case of LOCA without HPSI. Simulations have been carried out in several steps, analogous to those summarized in previous section. It is interesting to remark that, in this case, paths with continuous pump operation without trip (tRCP ? 1) do not undergo damage condition, so in this case there is not PD line. Simulated paths for different RCP trip delays and break sizes are depicted in Fig. 29.

In order to define more precisely the DD border, PCT value for simulations has been depicted in Fig. 30, where pattern has been completed by bilinear interpolation. Final DD has been achieved directly from Fig. 30, by considering only damage domain border, see Fig. 31. As shown in that figure, DD is composed of two separated regions of damage: a. A damage region for the cases with early RCP trip, when break diameter is in the interval between 2.5 and 3 in. b. Another isolated damage region around 2.5 in. break diameter and RCP trip delay time of 3000 s. This result shows that if RCP trip is performed later than 4000 s from break damage can be avoided for all the break sizes. However 4000 s could be too much time in order to avoid RCP trip whenever pumps undergoes high vibrations. Therefore it is convenient to

J. Gonzalez-Cadelo et al. / Annals of Nuclear Energy 69 (2014) 144–167

159

Fig. 29. CL LOCA without HPSI and with depressurization at 600 s (seeking of DD).

(a) Early manual depressurization prevents core from reaching damage conditions for most break sizes, regardless RCP trip time. (b) There is a small range of breaks in which there is a damage region for both cases (2.400 < Ø < 3.1500 ). A similar analysis was performed in Montero-Mayorga et al. (2014) for CL LOCA with available HPSI sequences. The comparison among DDs with/without available HPSI shows that intermediatebreak region presents a damage region in both cases, see Fig. 35. 5. Probability density functions of uncertain parameters This section contains the probability data needed in ISA methodology (Block C in Fig. 3), for the three uncertain parameters of interest: break size, beginning of secondary side depressurization and RCP trip time; a literature review has been carried out in order to obtain frequency and PDF of every uncertain parameter in order to integrate inside each DD obtained by means of ISA methodology. 5.1. Break size PDF

Fig. 30. 3D PCT map depicted on CL LOCA without HPSI and with manual depressurization at 600 s.

avoid RCP trip at least during the first 1000 s in order to avoid one of those damage regions. In order to understand why the DD is composed by two damage regions a deeper analysis has been performed for the 2.5-in.-diameter break at different RCP trip times. Damage sequences (RCP trip at 0 and 3000 s from break) show a long core uncovery time due to the aforementioned bounce effect, which delays continuous LPSI injection; see Figs. 32–34 for more details. Once analyzed Damage Domains for CL LOCA with unavailable HPSI sequences with/without secondary-side depressurization, it is possible to compare results in order to prove adequacy of EOPs. Both DDs, corresponding to that depicted in Figs. 28 and 31, are combined in Fig. 35, where it can be concluded that:

An extended literature review of break-size frequency has been carried out in Gosselin et al. (2007), where authors mention mainly two important previous works regarding the frequency of LOCA. First of those works (Poloski, 1999) provides the frequencies obtained for different LOCA categories, as shown in Table 3. The second one, (Tregoning et al., 2005), also provides LOCA frequencies, which are summarized in Table 4. In this paper, selected PDF for LOCA corresponds to the normalized mean current-day frequency estimation included in Tregoning et al. (2005). In order to obtain probability estimations for sizes analyzed in this paper (between 1 and 6 in.), logarithmic interpolation for frequencies of break sizes included in Table 4 and then normalization have been carried out (see resulting probabilities in Fig. 36). 5.2. Beginning of secondary side cooling and depressurization PDF Human reliability becomes an important issue when considering accident management in nuclear safety. The study of PSA

160

J. Gonzalez-Cadelo et al. / Annals of Nuclear Energy 69 (2014) 144–167

Fig. 31. CL LOCA without HPSI and with manual depressurization at 600 s (final DD).

Fig. 32. RCS pressure. 2.5-in.-DIAMETER-LOCA with depressurization and different RCP trip times.

Fig. 34. PCT. 2.5-in.-Diameter-LOCA with depressurization and different RCP trip times.

sequences helps to identify human actions whose failure has a large impact on the accident evolution. In this analysis, LOCA sequences without HPSI, secondary side depressurization becomes critical for transient evolution. As shown previously, in step 6 of EOP ES-1.2 operator is led to cool down RCS by means of SGs depressurization, at a maximum rate of 55 K/h. This action could be modeled by a lognormal distribution, as suggested in Dougherty (1988), determined by three unknown parameters: tSG, l and r:

( ^f SG ðtÞ ¼

Fig. 33. Core liquid fraction. 2.5-in.-Diameter-LOCA with depressurization and different RCP trip times.

0 ;

t 6 tSG 

2 1 pffiffiffiffi SG Þl exp ½lnðtt 2r2 ðtt SG Þr 2p

 ;

t > t SG

ð1Þ

where tSG is the minimum time for reaching manual-depressurization begin (step 6 of EOP ES-1.2), and l and r are independent parameters, and they are related to the mean and standard deviation of the sample (t and St, respectively) by well-known mathematical relationships. The minimum-time value for reaching step 6 of EOP ES-1.2 depends on the author. In this work, tSG has been considered

161

J. Gonzalez-Cadelo et al. / Annals of Nuclear Energy 69 (2014) 144–167

Fig. 35. Damage Domain comparison (secondary-side depressurization on/off).

Table 3 PWR LOCA frequencies per reactor (y1), from [Pol-99].

Small-Break LOCA Medium-Break LOCA Large-Break LOCA

Mean value

5th Percentile

95th Percentile

5.0E04 4.0E05 5.0E06

1.0E04 1.0E06 1.0E07

1.0E03 1.0E04 1.0E05

600 s, as stated in some PSAs. There are two data sources in order to estimate lognormal parameters l and r: (a) Operator training exercises, and (b) TRC model. Regarding operator training exercises, there are few publicly accessible data:  T1. One report published by EPRI in 1991, which includes data of operator actuation times in the case of SBLOCA with failed HPSI in a Westinghouse PWR (among other accidental sequences), see Table 5 (Spurgin et al., 1991).  T2. Another report published by KAERI in 2005, which includes detailed data of operator actions in SBLOCA sequences with available HPSI, (Park and Jung, 2005). There is another source of lognormal parameters l and r, which is taking them directly from Time Reliability Correlation model (TRC)

Fig. 36. PDF of LOCA diameter in PWRs. Normalized values from [Tre-05].

used in PSA. By this way, estimated values are the following (for time in seconds): l = 4.7, r = 1.2, tSG = 600. However, this method has the disadvantage that TRC model data used in PSA are not always accessible. By following anyone of previous sources it is possible to estimate lognormal parameters l and r. Resulting lognormal distribution corresponds to that depicted in Fig. 37. Lognormal parameters and other statistical properties are summarized in Table 6.

Table 4 PWR LOCA frequencies per reactor (y1), from [Tre-05]. Break size (in.)

0.5 1.625 3 7 14 31

Current-day estimate

End-of-plant-license estimate

(25 years fleet average operation)

(40 years fleet average operation)

Mean value

5th Percentile

50th Percentile

95th Percentile

Mean value

5th Percentile

50th Percentile

95th Percentile

7.3E3 6.4E4 1.6E5 1.6E6 2.0E7 2.9E8

6.9E4 7.6E6 2.1E7 1.4E8 4.1E10 3.5E11

3.9E3 1.4E4 3.4E6 3.1E7 1.2E8 1.2E9

2.3E2 2.4E3 6.1E5 6.1E6 5.8E7 8.1E8

5.2E3 7.8E4 3.6E5 3.6E6 4.8E7 7.5E8

4.0E4 8.3E6 4.8E7 2.8E8 1.0E9 8.7E11

2.6E3 1.6E4 7.6E6 6.6E7 2.8E8 2.9E9

1.8E2 2.9E3 1.4E4 1.4E5 1.4E6 2.1E7

162

J. Gonzalez-Cadelo et al. / Annals of Nuclear Energy 69 (2014) 144–167

Table 5 Measured actuation times (in seconds) for different operators groups in a PWR simulator following Westinghouse EOPs in a scenario of SBLOCA with failure of HPSI [Spu-91]. Event/action

Crew #1

Crew #2

Crew #3

Crew #4

Crew #5

Crew #6

Reactor trip Diagnose failure of HPSI Diagnose LOCA (enter E-1) Maintain adequate charging flow Begin cooldown/depressurization

0 110 578 338 1238

0 221 428 545 787

0 334 580 481 1608

0 132 347 402 823

0 336 519 672 1832

0 298 762 1091 1716

Fig. 37. Lognormal distributions. T1, T2 and TRC models.

5.3. RCP trip PDF Table 6 Statistical parameter estimation from specified sources. CASE

l

r

t (s)

St (s)

tmode (s)

P95 (s)

T1 T2 TRC

6.4354 5.4486 4.7

0.5711 0.8113 1.2

1334 923 838

456 312 430

1050 720 627

2195 1483 1435

Fig. 38. DD for sequences without SG depressurization, with assumed high vibration curve.

Although it is possible to mock up the secondary-side depressurization PDF, it is difficult to model in the same way the RCP trip PDF for sequences without LOOP. That is due to the fact that PSA includes only human performance models for actions which are expected to be performed (i.e. secondary-side depressurization), not for those actions which should not be performed (i.e. RCP trip). In the case of LOCA with unavailable HPSI, it is expected that operator does not trip RCPs, as shown previously. Nevertheless, there is a possible way in order to estimate RCP trip time in sequences without LOOP. The necessity of such estimation arises from the fact that, in these sequences, RCP could be operated in a wrong way (i.e. RCP vibration which could lead to pump trip as in TMI-2 accident, see for example (Haskin et al., 1997). Indeed, studies on human reliability, e.g. (Nuclear Regulatory Commission, 2000), state that operators have a strong tendency to stop pumps with suspected vibration noise. In order to take into account that fact, there are other possible ways for estimating RCP trip time. In this work, such estimation has been performed by considering that a void fraction (a) greater than 0.9 is enough for triggering unintended RCP trip. Such consideration is used as RCP trip criterion in thermal–hydraulic code MAAP (Hammersly, 2007). The way in which such void fraction determines RCP trip depends on considered model: in MAAP, RCP trip occurs deterministically when void fraction (a) in pumps equals 0.9; but in this work it has been considered that when such void fraction value is reached, the human failure rate at any time for RCP trip by high pump vibration will be constant from that moment on. The time at which void fraction is greater than 0.9 in RCPs for the first time is depicted as a

163

J. Gonzalez-Cadelo et al. / Annals of Nuclear Energy 69 (2014) 144–167

Fig. 39. DD for sequences with SG depressurization at 600 s, with assumed high vibration curve.

Fig. 40. Density probability considered for undesired RCP trip by high vibration.

Fig. 41. Cumulative density function for considered RCP trip time distributions.

Table 7 Considered values for parameter h, and properties of f (t). Case

Value

f(t) Properties

h1 = 4.42E04 s

1

#2

h2 = 1.16E03 s

1

#3

h3 = 2.32E03 s1

#4

h4 = 3.67E02 s1

#1

25% Probability of RCP trip between t0 and t0 + 10 min 50% Probability of RCP trip between t0 and t0 + 10 min 75% Probability of RCP trip between t0 and t0 + 10 min 100% Probability of RCP trip between t0 and t0 + 10 min

black line in Figs. 38 and 39. As shown in those figures, that curves cross over DDs, so damage probability due to RCP trip is not negligible for both cases. This issue will be analyzed in detail in Section 6. It is a well-known result of reliability engineering, e.g. (Nachlas, 2005), the hazard function, h(t), defined as the instantaneous conditional probability of failure given survival to any time, which corresponds algebraically to the rate at which surviving components fail:

hðtÞ ¼

f ðtÞ RðtÞ

ð2Þ

In previous equation, f(t) and R(t) are, respectively, the density function of failing (instantaneous probability that a component fails at time t) and the reliability function (probability that survival time exceeds t). By taking into account relations among R(t) and h(t) it can be obtained an analytical expression for failing PDF from Eq. (2), Nachlas, 2005, equivalent in this work to undesired RCP trip density probability function:

 Z t  fRCP ðtÞ ¼ hðtÞ  exp  hðsÞds

ð3Þ

t0

By taking h(t) as a constant instantaneous failure rate, and considering that f(t) = 0 for any time before void fraction equals 0.9, it can be concluded that density function for undesired RCP trip is algebraically described by:

fRCP ðtÞ ¼



0 ;

t < t0

h  expðhðt  t0 ÞÞ ;

t P t0

ð4Þ

164

J. Gonzalez-Cadelo et al. / Annals of Nuclear Energy 69 (2014) 144–167

where t0 represents the time at which void fractions equals 0.9 for the first time, and parameter h is the constant failure rate for the RCPs to be tripped by high vibration at t0, as illustrated in Fig. 40. In order to assure a realistic value for parameter h (there is lack of empirical data for improper RCP trip in this kind of transients), a wide range of values have been considered as representative alternative values for parameter h (see Table 7 and Fig. 41). 6. Risk assessment. Integration of damage domains Once simulations have been carried out and DDs have been sought, Block D of ISA methodology (see Fig. 3) leads to calculus of Damage Exceedance Probability (DEP). Calculus of DEP is performed by means of integrating uncertainparameter PDFs inside DDs, by applying Eq. (5), where fi corresponds to PDF of parameter xi, and membership function D equals 1 if point (x1, x2, . . ., xn) lies in DD, and 0 otherwise.

DEP ¼

Z

Z

Z ...

x1

x2

Dðx1; x2 ; . . . ; xn Þ 

xn

Dðx1; x2 ; . . . ; xn Þ ¼ 1; Dðx1; x2 ; . . . ; xn Þ ¼ 0;

n Y

f a ðxa Þdxa

ð5Þ

a¼1

ðx1; x2 ; . . . ; xn Þ 2 DD ðx1 ; x2 ; . . . ; xn Þ R DD

Eq. (7) constitutes a more useful, discrete version of Eq. (5).

ð6Þ

DEP ¼

XX i

j

...

X Dðx1;i ;x2;j ;...;xn;k Þ  f1 ðx1;i Þ  f2 ðx2;j Þ    fn ðxn;k Þ

ð7Þ

k

Two-dimensional DDs to be considered are those depicted in Fig. 42, corresponding to those obtained previously. In that figure, DDs depicted in the upper part of the figure correspond to those sequences in which RCPs are tripped (upper-left) and running (upper-right), and vertical axis corresponds to secondary-side depressurization beginning time. On the other hand, those DDs depicted in the lower part of Fig. 42 correspond to sequences in which SG depressurization is not carried out (lower-left) and is performed at 600 s from break (lower-right), and vertical axis corresponds to RCP trip time. In this work, previously calculated joint PDFs (Section 5) are integrated inside the DDs (Sections 3 and 4) in order to obtain DEP for each case. DDs simulated can be drawn as a part of a three-dimensional DD, in order to investigate the appearance of this one (see Fig. 43, which contains those DDs depicted in Fig. 42). 6.1. Damage Exceedance Probability calculation Next step of ISA methodology consists of DEP calculation. In order to do this, Eq. (7) has been applied to DDs depicted in Fig. 42. DEP values obtained have been summarized in Table 8 (for different depressurization models) and Table 9 (for different

Fig. 42. DDs to be integrated: RCP off (upper-left), RCP on (upper-right), without SG depressurization (bottom-left) and with SG depressurization at 600 s (bottom-right).

J. Gonzalez-Cadelo et al. / Annals of Nuclear Energy 69 (2014) 144–167

165

Fig. 43. Three-dimensional DD appearance with simulated DDs corresponding to RCP on and off, and manual depressurization at 600 s and never.

Table 8 DEP for variable depressurization beginning time. SG depressurization model

RCPs tripped Variable depress. (DEPtrip) RCPs running Variable depress. (DEPno trip) DEPtrip DEPno trip

T1

T2

TRC

8.2E2

7.5E2

7.5E2

4.9E6

2.1E6

2.1E5

1.7E4

3.5E4

3.7E3

unintended RCP trip models). In both tables the ratio between probabilities found out from DDs has been also included for all the considered models, in order to quantify the differences between performed and not performed AM actions. It must be noted that DEP for sequences with variable SG depressurization beginning time, summarized in Table 8, has been calculated by considering depressurization cases 1, 2 and TRC (see Section 5.2); while DEP for sequences with variable RCP trip time, summarized in Table 9, has been calculated by considering unintended RCP trip models #1, #2, #3, and #4 (see Section 5.3). In all the cases, the probability density function assumed for break size is that built from mean values (see Section 5.1). Several conclusions can be obtained from values summarized in Tables 8 and 9:

Table 9 DEP for variable RCP unintended trip time.

6.2. Comparison between ISA and PSA results

Unintended RCP trip model

Variable RCP trip No depress. (DEPno depress) Variable RCP trip Depress. at 600 s (DEPdepress) DEPno depress DEPdepress

1. Regardless the mathematical model considered for headers with time uncertainty is amended; DD must not be recalculated, so probability-data modifications can be easily included in ISA estimation only by integrating new PDFs inside the DD again. 2. Globally, convenience among AM actions can be quantified through DEP estimation. Thus, for example, it is clear that tripping RCPs is less safe than not tripping (with independence of mathematical model considered), because DEPs are smaller in this case. Indeed, DEP is reduced by three or four orders of magnitude when maintaining RCPs running, as shown in the last row of Table 8. On the other hand, it is clear that early depressurization contributes to minimize DEP, regardless the considered model for unintended RCP trip (see Table 9). The quantification of depressurizing at 600 s compared to the lack of any depressurization leads to two orders of magnitude in the DEP, as shown in the last row of Table 9. 3. There are sequences where mathematical models considered for headers uncertainty have greater impact on results. That is, for example, the case of DD with RCPs not tripped and uncertain depressurization beginning time, where Damage Exceedance Probability estimation varies in one order of magnitude from 2.13E6 (case 2) to 2.06E5 (TRC model). It must be noted that in general some sequences can show great sensitivity to mathematical models, so it is a matter of critical importance to accurately determine which model is most realistic in order to perform a best-estimate calculation.

#1

#2

#3

#4

8.9E1

9.5E1

9.7E1

9.7E1

5.4E3

7.2E3

6.5E3

3.8E3

1.6E2

1.3E2

1.5E2

2.6E2

As shown in Section 3.4 (Fig. 26 and Table 2), available times considered for classic PSA can be estimated by means of DDs. Integration of PDFs inside such DDs leads to the results presented in Table 10. These results show that, LOCA categorization has two main consequences on PSA results:  In classic PSA each LOCA category has its own available time for performing AM actions which depends on the selected LOCA categorization (e.g. case I or case II), and

166

J. Gonzalez-Cadelo et al. / Annals of Nuclear Energy 69 (2014) 144–167 Table 10 DEP for variable depressurization beginning time. SG depressurization model

RCPs tripped Variable depress. (DEPtrip) RCPs running Variable depress. (DEPno trip) DEPtrip DEPno trip

TRC (PSA-case I)

TRC (PSA-case II)

TRC (ISA methodology)

2.5E1

1

7.5E2

1.4E3

2.6E4

2.1E5

1.7E2

3.9E3

3.7E3

Table 11 DEF for variable depressurization beginning time. SG depressurization model

RCPs tripped Variable depress. (DEFtrip) RCPs running Variable depress. (DEFno trip)

TRC (PSA- case I) (y1)

TRC (PSA- case II) (y1)

TRC (ISA methodology) (y1)

2.9E7

1.15E6

8.6E8

1.6E9

3.0E10

2.4E11

 Should LOCA categorization does not lead to any difference in AM available time, PSA results would be different, as a consequence of considering the same available time to different break size ranges. Therefore different LOCA categorizations considered in PSA lead to different DEPs (in this case such difference consists of one order of magnitude, as shown in Table 10). As a later step in ISA methodology application, once obtained the DEP it is possible to obtain the Damage Exceedance Frequency (DEF), by multiplying the DEP of a sequence by the frequency of its initiating event and the probabilities of assumed header statuses (in this case, the unavailability of HPSI). This value is only approximated to the actual one, which is obtained by means of the Boolean product of fault trees. By taking into account typical values considered in classical PSA, such as a frequency for the initiating event of 1.15E3 y1 and a probability for HPSI unavailability of 1E3, then the approximated DEF for a CL LOCA without HPSI is that summarized in Table 11 for the TRC model, both for ISA and PSA (cases I and II). By comparing PSA results with ISA ones (Tables 10 and 11), it can be concluded that PSA results are more conservative than ISA ones in any case (due to the fact that PSA available time has been estimated from DDs in a conservative manner). Regarding frequencies (Table 11), results show that PSA conservatism can overweight LOCA sequences without HPSI within core damage frequency. 7. Conclusions Several conclusions can be obtained from the presented work: 1. ISA methodology endorses EOPs guidance for LOCA with unavailable HPSI, and RCP trip has been proven to be undesired for transients without HPSI, as Westinghouse EOPs establish. Early RCP trip increases the damage probability and, in this sense, DDs and DEPs obtained by means of ISA methodology prove the adequacy of EOPs. 2. This analysis also shows that secondary-side depressurization is needed in order to minimize the bounce effect of the RCS pressure, induced by the pumps operation and the LPSI injection beginning. Early secondary-side depressurization reduces the

damage probability and, also in this case, DDs and DEPs obtained by means of ISA methodology prove the adequacy of EOPs 3. Unintended RCP trip becomes an important issue in this kind of sequences. The possibility that RCPs could be tripped in this kind of transients, due to LOOP occurrence or high RCP vibration conditions, suggests that classic PSA should be improved in order to consider RCP trip header (currently non-considered). 4. ISA methodology allows verify available time in different AM actions as a function of other uncertain parameters. In this sense, available time for secondary-side depressurization can be obtained as a function of break size. 5. Whenever the probability associated to any header uncertainty (PDF associated to any of the dimensions of the DD) is revised and amended, DDs need not to be obtained again. Indeed, amended PDFs only have to be integrated inside the corresponding DD in order to calculate the new DEP. On the other hand, Monte Carlo methods require a new uncertain-parameter sampling for any new PDF selection, and therefore to perform again all the simulated paths. As general conclusions on ISA methodology, several main ideas must be remarked:  ISA methodology has proved to be a powerful tool to the nuclear safety analyst, allowing not only estimating a realistic damage probability, but constituting a way to easily verify strengths and analyze weaknesses of EOPs contents and plant designs.  ISA methodology minimizes the need of expert judgment in order to perform safety assessment, because the methodology includes clear guidance to be carried out. Only selection of uncertain headers and models for such uncertainty are in hands of the analyst.  In order to consider all the parametric and temporal uncertainties, it is currently under consideration the possibility of separating them into two groups: (a) Main uncertain parameters, which would be assessed by means of DDs as illustrated in this work, and (b) the rest of the uncertainties (including epistemic one), whose consideration will be included in the methodology by means of Monte Carlo sampling. This kind of application is under development stage.

J. Gonzalez-Cadelo et al. / Annals of Nuclear Energy 69 (2014) 144–167

 ISA could not only be applied to verify EOPs and PSA results, but also during design stage of future nuclear power plants, as Generation-IV ones, for example. Impact of design modifications on safety margins for current plants could also be taken into account by means of ISA methodology.

Acknowledgments The authors acknowledge the support by the Spanish Nuclear Regulatory Body, UNESA and Almaraz-Trillo AIE for the technical and financial support under the agreement STN/1388/05/748 (CAMP-Spain project) which has allowed performing this work. This work has been also partially funded by the Spanish Ministry of Competitiveness and Economy within ISAMAR project: ENE2011-28256. Its support is gratefully acknowledged. References Aldemir, T., 2013. A survey of dynamic methodologies for probabilistic safety assessment of nuclear power plants. Ann. Nucl. Energy 52, 113–124. Dong, G.K., Seung-Hoon, A., Soon, H.C., 2013. A combined deterministic and probabilistic procedure for safety assessment of beyond design basis accidents in nuclear power plant: application to eccs performance assessment for design basis LOCA redefinition. Nucl. Eng. Des. 260, 165–174. Dougherty, E.M., 1988. Human Reliability Analysis: A Systems Engineering Approach with Nuclear Power Plant Applications. John Wiley & Sons, New York, US. Gomez-Magan, J.J. et al., 2012. Calculation of damage frequencies without success criteria hypothesis. Application to MBLOCA sequences. In: PSAM 11 & ESREL 12. González, I. et al., 2005. TRACE model of almaraz nuclear power plant. Nucl. Energy New Eur. 1, 1. Gonzalez-Cadelo, J., Queral, C., Montero-Mayorga, J., 2012. Accident Management actions in a lower head SBLOCA with HPSI failed. In: Proceedings of the 20th International Conference on Nuclear Engineering (ICONE20), California, US. Gosselin, S.R. et al., 2007. Probabilities of Failure and Uncertainty Estimate Information for Passive Components – A Literature Review. NUREG/CR-6936. Hakobyan, A. et al., 2008. Dynamic generation of accident progression event trees. Nucl. Eng. Des. 238, 3457–3467. Hammersly, R.J., 2007. MAAP4 Computer Code Manual. Electric Power Research Institute. Haskin, F.E. et al., 1997. Perspectives in Reactor Safety. NUREG/CR-6042. Hortal, J. et al., 2010. Application of the damage domain approach to the calculation of exceedance frequencies. In: 10th International Probabilistic Safety Assessment & Management Conference (PSAM10), Seattle, US. Ibañez, L. et al., 2010. Damage domain approach as a strategy of damage exceedance computation. In: Proc. Int. Conf. Nuclear Energy for New Europe, Slovenia. International Atomic Energy Agency, 2012. IAEA Technical Meeting on Combining Insights form Deterministic and Probabilistic Safety Analyses. June 2012, Pisa, Italy. Izquierdo, J.M. et al., 2008. SCAIS (Simulation Code System for Integrated Safety Assessment): Current status and application. ESREL 08, Valencia, Spain. Jimenez, G. et al., 2013. Analysis of the operator action and the single failure criteria in a SGTR sequence using best estimate assumptions with TRACE 5.0. Ann. Nucl. Energy 58, 161–177. Kloos, M., Hofer, E., 2004. Dynamic Event Trees for Probabilistic Safety Analysis. GRS, Garsching, Germany. Kloos, M., Pesche, J., 2006. MCDET. A probabilistic dynamics method combining monte carlo simulation with the discrete dynamic event tree approach. Nucl. Sci. Eng. 153, 137–156. Kloos, M., Pesche, J., 2008. Consideration of human actions in combination with the probabilistic dynamics method Monte Carlo Dynamic Event Tree. J. Risk Reliab. 222. Montero-Mayorga, J., Queral, C., Gonzalez-Cadelo, J., 2014. Effects of delayed RCP trip during SBLOCA in PWR. Ann. Nucl. Energy 63, 107–125. Nachlas, J.A., 2005. Reliability Engineering. Probabilistic Models and Maintenance Methods. CRC Press, Boca Raton, US. Nuclear Energy Agency, 2011a. Safety Margin Evaluation – SMAP Framework Assessment and Application. NEA/CSNI/R(2011) 3.

167

Nuclear Energy Agency, 2011b. OECD/CSNI Workshop on Best Estimate Methods and Uncertainty Evaluations, Barcelona, Spain. US Nuclear Regulatory Commission, 2000. Technical Basis and Implementation Guidelines for A Technique for Human Event Analysis (ATHEANA). NUREG1624, Rev. 1. US Nuclear Regulatory Commission, 2002. Westinghouse Technology Advanced Manual. Technical Training Center. Park, J., Jung, W., 2005. Analysis of Human Performance Observed under Simulated Emergencies of Nuclear Power Plants. KAERI/TR-2895/2005, South Korea. Poloski, J.P. et al., 1999. Rates of Initiating Events at U.S. Nuclear Power Plants: 1987–1995. NUREG/CR-5750. Queral, C. et al., 2002. Conversion of the thermal hydraulics components of Almaraz NPP model from RELAP5 into TRAC-M. Nuclear Energy for new Europe. Queral, C., Exposito, A., Jimenez, G., 2008. Verification and validation of Almaraz NPP TRACE model. ICAPP ‘08, Anaheim, California. Queral, C. et al., 2010. Assessment of TRACE 4.160 and 5.0 Against RCP Trip Transient in Almaraz I Nuclear Power Plant. NUREG/IA-0233. Queral, C. et al., 2010. Application of the integrated safety assessment methodology to MBLOCA sequences. In: The 8th International Topical Meeting on Nuclear Thermal-Hydraulics, Operation and Safety (NUTHOS-8), Shanghai, China. Queral, C. et al., 2011a. Accident management actions in an upper head SBLOCA with HPSI failed. Nucl. Technol. 175, 572–593. Queral, C. et al., 2011. Calculation of damage exceedance frequencies in cold leg MBLOCA sequences. In: 19th International Conference on Nuclear Engineering (ICONE 19), Chiba, Japan. Queral, C. et al., 2012. Application of ISA Methodology to SBO and LOCA Sequences’’, Integrated Deterministic/Probabilistic Safety Assessment Workshop, Stockholm, Sweden. Queral, C. et al., 2012. Dynamic Event Trees Including Time Uncertainty in Human Actions. Application to LOCA sequences. Technical Meeting on Combining Insights from Deterministic and Probabilistic Safety Analyses. NEA/IAEA, Pisa, Italy. Queral, C. et al., 2013. application of integrated safety assessment methodology to SBO sequences. In: 21st International Conference on Nuclear Engineering (ICONE 21), China. Queral, C. et al., 2013. Application of integrated safety assessment methodology to feed & bleed sequences. In: 21st International Conference on Nuclear Engineering (ICONE 21), China. Rychkov, V., 2013. Risk Informed Safety Margins Characterization Through Failure Domain Quantification. Loss of Main and Auxiliary Feed Water Example. Yet Another Approach to Assess the Model Uncertainty. EDF R&D. PSAM 2013, Tokyo, Japan. Sheron, B. et al., 1979. Generic Assessment of Delayed Reactor Coolant Pump Trip During Small Break Loss-of-coolant Accidents in Pressurized Water Reactors. NUREG-0623. Sonnenkalb, M., Peschke, J., Kloos, M., Krzycacz-Hausmann, B., 2004. MCDET and MELCOR. An Example of a Stochastic Module Coupled with an Integral Code for PSA Level 2. International Workshop on Level 2 PSA and Severe Accident Management, Germany. Spurgin, A.J. et al., 1991. Operator Reliability Experiments Using Power Plant Simulators. EPRI-NP-6937-L. TECNATOM, 1999. Operating Practices Course. Introduction to Accident Analysis (in Spanish). PF3T-LA-M12. Thomson, C.M. et al., 1980. Inadequate Core Cooling Studies of Scenarios with Feedwater Available. Technical Report WCAP-9753. Westinghouse Electric Corporation. Tregoning, R. et al., 2005. Estimating Loss-of-Coolant Accident (LOCA) Frequencies Through the Elicitation Process. NUREG-1829. Voroyev, Y., Kudinov, P., 2012. Development of methodology for identification of failure domains with GA-DPSA. In: 11th International Probabilistic Safety Assessment and Management Conference and the Annual European Safety and Reliability Conference 2012, PSAM11 ESREL 2012, Helsinki, Finland. Voroyev, Y., Kudinov, P., 2011. Development and Application of a Genetic Algorithm Based Dynamic PRA Methodology to Plant Vulnerability Search. PSA 2011. American Nuclear Society, LaGrange Park. Adolfsson, Y. et al., 2011. Proceedings of the Deterministic/Probabilistic Safety Analysis Workshop (October 2011). . Adolfsson, Y. et al., 2012. Proceedings of the IDPSA-2012 Integrated Deterministic– Probabilistic Safety Analysis Workshop (November 2012). . Zimmerman, M. et al., 2013. Proceedings of the DSA & PSA Workshop. Combining Deterministic and Probabilistic Methods for Comprehensive Safety Margin Assessment. NURETH-15 (May 2013).