- Email: [email protected]
Studies for the preparation of the Preliminary Safety Reports for the European test blanket systems
Fusion Engineering and Design 86 (2011) 2204–2207
Contents lists available at ScienceDirect
Fusion Engineering and Design journal homepage: www.elsevier.com/locate/fusengdes
Studies for the preparation of the Preliminary Safety Reports for the European test blanket systems Tonio Pinna ENEA UTFUS-TEC Via E.Fermi 45, 00044 Frascati, Rome, Italy
a r t i c l e
i n f o
Article history: Available online 5 February 2011 Keywords: Safety Licensing TBM ITER
a b s t r a c t The scope of this paper is a presentation of the safety issues and of the expected risks associated with the operation of test blanket modules (TBMs) inside the ITER machine. The discussion on the expected risks is done to outline the magnitude of the risks related to the test blankets with respect to the risks expected to operate ITER without the TBMs. The discussion wants to be of general purpose and it does not want to substitute the detailed analyses done in the past and the ones that are presently on going to have a detailed estimation of the risks related to operate test blanket systems (TBSs). Only such detailed analyses will demonstrate compatibility of TBMs with ITER safety requirements. We had reason to address the question on magnitude of TBM risks recently, in conjunction with the preparation of a draft safety reports for the two European TBSs. The key safety issue is associated with unwanted large plasma-disruptions that have the potential to cut right trough the first wall of the TBMs. Such plasma disruptions are currently postulated to occur under several conditions, including the use of the plasma termination system, when called upon to act in response to various initiating events. Under some very unlikely conditions, the through-wall rupture of the test-blanket first wall can lead to exothermic reactions between water/steam and test-blanket materials (lithium and/or beryllium) releasing quantities of hydrogen inside the vacuum vessel. Such releases would be in addition to those estimated for ITER, under similar conditions, but without the presence of the TBSs. The paper discusses this and other safety issues. The conclusion from this work is that the additional risk introduced by the European TBSs is miniscule. This is particularly true if the plasma-physics experiments to be conducted in ITER demonstrate that ITER plasmas are very stable, which, of course, is a necessary condition for a demonstration of fusion power reactor. © 2011 Tonio Pinna. Published by Elsevier B.V. All rights reserved.
1. Forward
2. Introduction
One of the many, but important, scientific and technology objectives of the ITER machine is the testing of materials for the development of a demonstration fusion power reactor. Accordingly, the ITER machine has three ports allocated for such purposes as outlined in [1]. One port will be used to test two blanket concepts proposed by the European Party: the helium-cooled liquid lithium–lead (HCLL) blanket and the helium-cooled lithium pebblebed (HCPB) blanket. All the ITER Parties (China, Japan, India, Korea, Russian Federation and United States) are developing their concepts for Test Blanket Modules (TBMs) as documented in many publications. The scope of this paper is a presentation of the safety issues and of the expected risks associated with the operation of the HCLL and HCPB TBMs inside the ITER machine.
The purpose of the safety report for TBSs is to present an evaluation of the hazards associated with the operation of the TBSs and to ensure that they are adequately controlled or mitigated. In addition, there is the interplay between the TBS and the other systems of ITER that needs to be addressed and demonstrated to be within acceptable bounds. As for ITER without the TBSs it is demonstrated that the safety objectives are achieved by the applying of the Defence in Depth and of the ‘As Low As Reasonably Achievable’ (ALARA) principles, the employing of passive safety features wherever possible, and the taking of benefit from safety characteristics of fusion (such as the limited radioactive inventory, the absence of uncontrolled power excursions and the very low decay heat density), as the same has to be demonstrated for ITER operating with the TBSs. Generally, a safety report is a carefully crafted document, summarizing the overall work on designing taking into account safety issues and safety analyses. The strength of the safety report is in the
E-mail address: [email protected]
0920-3796/$ – see front matter © 2011 Tonio Pinna. Published by Elsevier B.V. All rights reserved. doi:10.1016/j.fusengdes.2011.01.040
T. Pinna / Fusion Engineering and Design 86 (2011) 2204–2207
myriad of supporting documents, particularly at the final stages of the project. However, there is a key difference between the Preliminary Safety Report (PrSR) and the Final Safety Report: not all of the analysis needs to be in place for the PrSR, and where the supporting analysis is not available, a place marker will indicate that it is to come at a later date. Nevertheless, it is important to make all efforts to document as much as possible, at a high level of detail appropriated to the PrSR. At first, the descriptions of the research program and of the systems introduce the TBS PrSR. The description of hazards and safety measures adopted for each hazard follows, as well as, safety design principles and measures, and general safety objectives. Particularly, in defining safety requirements, it has been considered that, as the TBS becomes part of the machine, its design and eventual operation are subject to the same safety and licensing regime as the machine. Therefore, it is essential the same ITER safety design principles be followed for the design of the TBS. Accordingly, on the basis of ITER general safety requirements and on the basis of TBS functional safety constraints (confinement, fusion power shutdown, decay heat removal, monitoring, and control of physical and chemical energies) and of safety analyses, specific TBS safety requirements have been outlined. They are related to: Defence-in-depth, identification of safety important functions and safety important components, safety measures, radiation protection approach and application of ALARA Principle. Clearly, the focus of the PrSR is on safety assessment both on the perspective of public and environment and on the perspective of worker safety. The identified possible accident conditions have been treated in detail both by definition of possible accident sequences, of accident analysis specifications and of available deterministic assessments done to evaluate most severe accident consequences. Here in this paper, TBS accidental events are summarized together with a discussion made to outline magnitude of the additional risks expected from the TBSs with respect to the risks expected to operate ITER without the test blankets, recalling that the safety analyses has shown that ITER will meet regulatory requirements and will result in operation that fully satisfies the safety objectives established for the project, with minimal environmental and public safety impact. Last issue treated in the TBS PrSR has been the “Waste Management & Disposal”. The ITER PrSR was considered in issuing the TBS PrSRs.
3. Accident assessment The accidental conditions, or postulated initiating events, which might give rise to a release of radioactivity, were determined from a Failure Mode and Effect Analysis (FMEA) evaluation. A set of reference accidents was then identified, by grouping individual accident initiators that have similar consequences. The selected reference accidents are those with the highest expected consequences – i.e., those that establish the system safety design requirements. For each of the reference accidents, there may be one or more safety analysis objective. The common safety analysis objective is to demonstrate that there would be no uncontrolled releases of radioactivity to the environment, unless such releases are miniscule – i.e., well below the release guidelines. In any case, the release guidelines will always be respected. Almost all of the reference accidents identified in the PrSR for the TBSs are design basis accidents (DBAs) – i.e., they establish design basis conditions, or simply, safety design requirements. In two cases, the event sequence of the reference accident has been pushed well beyond the design basis. In the realm of safety analysis there has to be a dividing line between what is considered to be within the design basis and what
2205
is to be beyond the design basis. Several considerations contribute into the decision, but the key consideration is event sequence probability. Those event sequences having a very low probability of occurrence are normally analyzed to determine the radiological consequences, but are designated beyond design basis accidents (BDBAs). The purpose of the analysis is to demonstrate that there is sufficient safety margin in the design so that the radiological consequences are not dramatically different than those for design basis accidents. The reference accidents are referring to the “Demo-relevant data acquisition” operation phase (DT – deuterium–tritium phase) with the INTegral module (IN-TBM) as they are the most challenging operating conditions for TBS. Other three modules are foreseen in the former phases (H/He phase and the D-phase), but accident events with these modules should induce consequences that will be enveloped by the consequences expected when the IN-TBM operates. Furthermore, accident events can occur also when a dummy plug is operating. In such a case, because the TBM dummy plug is water cooled by the first wall/shielding blanket (FW/BLK) cooling loop and, because it is managed as all the other equatorial port plugs, the consequences expected for the TBM dummy plug accident will be similar to the ones expected for the overall ITER port plugs – water cooled. The accident analysis for the water-cooled port plug is covered by the accident analysis of the ITER machine. The reference accidents presented in the PrSR can be summarized in terms of the TBS release location – i.e., by release type – such as: • Releases into the vacuum vessel. • Releases inside the tokamak building. • Releases inside the tritium building. 3.1. Releases into vacuum vessel Several of the analyzed reference accidents lead to the release of radioactive material from the TBS into the vacuum vessel (VV). These include accidents initiated by the tokamak (e.g., plasma disruptions and induced breaks in TBM) as well as those initiated by the TBS (e.g., loss of heat sink and ex-vessel loss of cooling accident leading to in-vessel LOCA). For this type of accident, the typical response is the pressurization of the VV leading to the activation of the vacuum vessel pressure suppression system (VVPSS) at 90 kPa, which vents the VV into the suppression tank. The steam and gases discharged into the VV from the TBS and shield-blanket modules causes tokamak dust, accumulated on the inside surfaces of the VV during normal operation, to be mobilized, with some becoming airborne. Once the VVPSS is actuated, the airborne dust inside the VV is transported to the suppression tank, by the pressure difference between the VV and the suppression tank. The suppression tank is always in standby mode and the pressure above it is maintained below atmosphere (at 4 kPa). The chilled water in the suppression tank condenses the steam entering from the VV. The water will also trap particulates, such as tokamak dust and activated products from the TBS. Gases, however, will enter into the air above the suppression tank and cause that volume to be pressurized. Once the pressure in the suppression tank air space reaches 90 kPa, the vent detritiation system is activated. This system has a tritium removal capability and a high-efficiency particulate filter to trap activated dust that may have escaped the scrubbing effect of the water in the suppression tank. The drain tank, which opens one hour after the VVPSS is actuated, drains the water accumulated inside the VV. The releases from the detritiation system into the external environment are thus controlled and small relative to the ITER release guideline values. It is important to note, however, that the radioactive releases from the TBS into the VV are a miniscule fraction
2206
T. Pinna / Fusion Engineering and Design 86 (2011) 2204–2207
of the radioactivity already present inside the VV, which has the potential to be mobilized. Accordingly, the contribution of the TBS radioactive source term to the environmental releases is negligibly small. There are two ITER reference accidents that are relevant to this discussion. The first one is a plasma disruption leading to an invessel LOCA, referred in the ITER safety analyses as “Multiple First Wall Pipe Failure” [2]. The other one is an ex-vessel LOCA, referred as “Large ex-vessel divertor pipe break” [2,3]. The source terms, for tritium, tokamak dust and activated corrosion products (ACPs), considered in the ITER safety analyses (safety assessment values) for the in-vessel LOCA are, respectively, 1000 g of tritium, 1000g of tungsten dust and 330 g of ACPs. The transport pathways are: from VV to suppression tank and from VV to drain tank. As the pressure in the VV and VVPSS returns below atmospheric level within 100 s, there are no significant leaks into the adjacent rooms and therefore no uncontrolled leaks into the environment. The suppression tank venting system is not actuated because the pressure in the suppression tank does not exceed the set point; hence there is no release through the detritiation system (DS). The source terms, for tritium, tokamak dust and ACPs, considered in the ITER safety analyses (safety assessment values) for the ex-vessel LOCA are, respectively: 1000 g of in-vessel tritium, the fraction of divertor loop tritium associated to the fraction of water flashing to steam, 5 kg W vaporized by plasma disruption, 1000 kg W in-vessel dust inventory, 1.3% of the spilled ACP inventory (<10 kg) mobilized as aerosols (<130 g). The transport pathways are: from VV to tokamak cooling water system (TCWS) vault and then to the environment; and from VV to suppression tank, and from suppression tank to the environment via the vented detritiation system. Maximum expected environmental releases from this event presented in [3] were: 1.5 g of tritium, 1.13 g of dust and 0.75 g of ACPs. These small amounts are going to be further reduced (one order of magnitude, e.g., tritium releases are going to be of the order of 1–2 tenths of grams) by the last ITER safety analyses more refined to the last design documents. Although the tritium and activated products source terms for the TBS have not yet been determined in detail, the first calculations evaluated a maximum inventory of mobilizable radioactive material of the order of hundred milligrams. Therefore, compared to the radioactive source terms postulated for the ITER safety analyses it is clear that the TBS contribution would be negligibly small. 3.2. Releases inside the tokamak building Three of the reference accidents analyzed in the PrSR for TBSs lead to radioactive releases inside the Tokamak building: two of them refer to ex-vessel LOCAs and consequences have been already discussed in the section above; one refers to tritium extraction system (TES) break inside port cell (PC). The focus of this section is the release of radioactive material from the TBS that does not involve the VV, i.e., TES pipe break. The radioactive source terms are tritium and activated products. And, it is assumed that the entire inventory of tritium and activated products are discharged in the PC. The PC atmosphere is initially at atmospheric pressure, or just slightly below. The helium purge gas entering the PC, from the TES pipe break, will cause the PC to pressurize. This pressurization may lead to some leakage of radioactivity from the PC into the gallery until the vent detritiation system is activated, by a high radiation signal inside the PC. At this point the leakage will cease and releases to the environment will be via a controlled release route, after filtration and detritiation. There is a relevant ITER reference accident for the TES pipe break – “Failure of a Fuelling Line” [2]. The release is inside the building and the release pathways to the environment are through leakage,
HVAC system and detritiation system. 13.4 g of tritium are released from the ruptured fuelling line directly into the room. Of this, only 0.17 g (<2%) are released to the environment. For the TES pipe break, the tritium source term has not yet been exactly determined, but it is expected to be in the order of hundred milligrams. Moreover, the release is inside the PC, hence leakage from the PC to the gallery and to the environment will be a small fraction of the released quantity. The remaining tritium in the PC is captured by the detritiation system that is continuously active. 3.3. Releases inside the tritium building One of the TBS reference accidents leads to radioactive releases inside the Tritium Building – TES pipe break inside the tritium building. There is one ITER reference accident that is relevant to this TBS reference accident – the “Isotope Separation System Failure” [3]. The total ISS tritium inventory (220 g) was assumed to be released into the cold box surrounding the ISS column. From there 66 mg leak into the ISS room, which is part of the Tritium building, and only 1.1 mg are released to the environment by building leakage, via HVAC during the first hour, and via DS, 65 min after the start of the release. The leakage rate of the Tritium building was considered to be 100% vol/day with a P of 300 Pa. As the pressurization of the tritium building, following a TES pipe break, is expected to be negligible, the leakage pathway is not significant for this TBS reference accident. The tritium source term from the TES pipe break has not yet been estimated, but could be at the maximum in the order of hundred milligrams. Therefore, postulating that also the TES glove boxes failed, the tritium release into the Tritium building could be at maximum in the same order than that from the “Isotope Separation System Failure” reference accident presented in the ITER safety analyses [3]. Consequently, the release related to TES from the Tritium building to the environment could be at maximum of the same order of magnitude, but likely could be negligible given the unimportance of the leakage pathway in the case of TES rupture. 3.4. Discussion and summary of BDBA Two accidents have been analyzed in the TBS PrSR as being beyond the design basis, on the basis of accident probability. The two accidents are: - severe plasma disruption cutting right through the TBM first-wall and the first-wall cooling tubes/channels of a adjacent watercooled shielding blanket module (the TBM first wall damage exposes all breeder units to the VV environment), and - ex-vessel LOCA with induced in-vessel LOCA and severe plasma disruption causing the failure of some shield-blanket modules, with a consequential ingress of cooling water inside the VV. Both of these BDBAs are extreme cases of their respective DBAs. The reason for including these BDBAs into the TBS safety analysis was to demonstrate that, despite the increased severity of the assumptions associated with the BDBAs, their radiological impact would not be disproportionately larger, relative to their respective DBAs. More specifically, the intent was to show that stretching the severity of the accident to the limit would not produce a step change in the radiological impact of an order of magnitude. The basic difference between the two tokamak-initiated accidents is the potential damaging of the plasma disruption. The extent of the damage postulated for the BDBA (a through-wall cut of the TBM first wall) was deliberately chosen to precipitate a reaction between the steam environment (from damage to adjoining shieldblanket module) inside the VV and the beryllium pebbles in the
T. Pinna / Fusion Engineering and Design 86 (2011) 2204–2207
breeder units – in the case of the HCPB – or, the lithium–lead breeding material – in the case of the HCLL. The steam/beryllium reaction, or the steam/lithium reaction, is exothermic, adding more thermal energy to the VV, and produces hydrogen, which is a potential fire and explosion hazard, both inside the VV and in downstream systems. The basic difference between the two ex-vessel LOCAs is the extent of damage resulting in the TBM box, following the LOCA. For the DBA analysis, the integrity of the box remained intact, while for the BDBA the integrity of the TBM box was breached, by throughwall melting of the first wall. The BDBA analyses have not been completed, but the preliminary results presented in the PrSR and related documents suggest that their impact on the machine, and on the environment, is not significantly different from that of their respective DBAs. More specifically, with respect to hydrogen production coming from the pebble bed Be of HCPB, the BDBA adds less than 100 g of hydrogen to the VV. Even if this quantity is likely to increase, once a more detailed analysis has been performed, the quantity of hydrogen generated by the TBM pebble bed is at least an order of magnitude lower than that estimated for the ITER DBA (in-vessel LOCA), which is 2.7 kg. For the HCLL, instead, BDBA adds 2.5 kg of hydrogen to the VV, on the assumption that all the lithium would react to produce hydrogen. This quantity is likely to decrease significantly, once a proper analysis has been performed. At any rate, it lets us conclude that also for HCLL, at maximum, hydrogen production from the TBS BDBA is of the same order of magnitude as the one from the ITER DBA.
2207
4. Analysis conclusions The accident analysis for the TBS is incomplete and still at an early stage for making definitive conclusions. Nevertheless, the preliminary results obtained to date tend to indicate that the TBS reference accident results are likely to be within the boundary established by the ITER accident analysis envelope. Moreover, these results indicate that there are no conditions under which a TBS accident would push the machine envelope beyond its design basis. Similarly, there are no conditions under which a machine accident would involve the TBS (specifically the TBM) in a way that would cause the machine envelope to be pushed beyond its design basis. Acknowledgments This work, supported by the European Communities under the contract of Association between EURATOM and ENEA, was carried out within the framework of F4E. The views and opinions expressed herein do not necessarily reflect those of the European Commission. References [1] V. Chuyanov, et al., TBM program implementation in ITER, Fusion Engineering and Design 85 (2010) 2005–2011. [2] T. Pinna, S. Raboin, J. Uzan-Elbez, N. Taylor, Methodology for reference accidents definition for ITER, Fusion Engineering and Design 75–79 (2005) 1103–1107. [3] S. Reyes, L. Topilski, N. Taylor, B.J. Merrill, L.L. Sponton, Updated modeling of postulated accident scenarios in ITER, Fusion Science and Technology 56 (2009) 789–793.
Contents lists available at ScienceDirect
Fusion Engineering and Design journal homepage: www.elsevier.com/locate/fusengdes
Studies for the preparation of the Preliminary Safety Reports for the European test blanket systems Tonio Pinna ENEA UTFUS-TEC Via E.Fermi 45, 00044 Frascati, Rome, Italy
a r t i c l e
i n f o
Article history: Available online 5 February 2011 Keywords: Safety Licensing TBM ITER
a b s t r a c t The scope of this paper is a presentation of the safety issues and of the expected risks associated with the operation of test blanket modules (TBMs) inside the ITER machine. The discussion on the expected risks is done to outline the magnitude of the risks related to the test blankets with respect to the risks expected to operate ITER without the TBMs. The discussion wants to be of general purpose and it does not want to substitute the detailed analyses done in the past and the ones that are presently on going to have a detailed estimation of the risks related to operate test blanket systems (TBSs). Only such detailed analyses will demonstrate compatibility of TBMs with ITER safety requirements. We had reason to address the question on magnitude of TBM risks recently, in conjunction with the preparation of a draft safety reports for the two European TBSs. The key safety issue is associated with unwanted large plasma-disruptions that have the potential to cut right trough the first wall of the TBMs. Such plasma disruptions are currently postulated to occur under several conditions, including the use of the plasma termination system, when called upon to act in response to various initiating events. Under some very unlikely conditions, the through-wall rupture of the test-blanket first wall can lead to exothermic reactions between water/steam and test-blanket materials (lithium and/or beryllium) releasing quantities of hydrogen inside the vacuum vessel. Such releases would be in addition to those estimated for ITER, under similar conditions, but without the presence of the TBSs. The paper discusses this and other safety issues. The conclusion from this work is that the additional risk introduced by the European TBSs is miniscule. This is particularly true if the plasma-physics experiments to be conducted in ITER demonstrate that ITER plasmas are very stable, which, of course, is a necessary condition for a demonstration of fusion power reactor. © 2011 Tonio Pinna. Published by Elsevier B.V. All rights reserved.
1. Forward
2. Introduction
One of the many, but important, scientific and technology objectives of the ITER machine is the testing of materials for the development of a demonstration fusion power reactor. Accordingly, the ITER machine has three ports allocated for such purposes as outlined in [1]. One port will be used to test two blanket concepts proposed by the European Party: the helium-cooled liquid lithium–lead (HCLL) blanket and the helium-cooled lithium pebblebed (HCPB) blanket. All the ITER Parties (China, Japan, India, Korea, Russian Federation and United States) are developing their concepts for Test Blanket Modules (TBMs) as documented in many publications. The scope of this paper is a presentation of the safety issues and of the expected risks associated with the operation of the HCLL and HCPB TBMs inside the ITER machine.
The purpose of the safety report for TBSs is to present an evaluation of the hazards associated with the operation of the TBSs and to ensure that they are adequately controlled or mitigated. In addition, there is the interplay between the TBS and the other systems of ITER that needs to be addressed and demonstrated to be within acceptable bounds. As for ITER without the TBSs it is demonstrated that the safety objectives are achieved by the applying of the Defence in Depth and of the ‘As Low As Reasonably Achievable’ (ALARA) principles, the employing of passive safety features wherever possible, and the taking of benefit from safety characteristics of fusion (such as the limited radioactive inventory, the absence of uncontrolled power excursions and the very low decay heat density), as the same has to be demonstrated for ITER operating with the TBSs. Generally, a safety report is a carefully crafted document, summarizing the overall work on designing taking into account safety issues and safety analyses. The strength of the safety report is in the
E-mail address: [email protected]
0920-3796/$ – see front matter © 2011 Tonio Pinna. Published by Elsevier B.V. All rights reserved. doi:10.1016/j.fusengdes.2011.01.040
T. Pinna / Fusion Engineering and Design 86 (2011) 2204–2207
myriad of supporting documents, particularly at the final stages of the project. However, there is a key difference between the Preliminary Safety Report (PrSR) and the Final Safety Report: not all of the analysis needs to be in place for the PrSR, and where the supporting analysis is not available, a place marker will indicate that it is to come at a later date. Nevertheless, it is important to make all efforts to document as much as possible, at a high level of detail appropriated to the PrSR. At first, the descriptions of the research program and of the systems introduce the TBS PrSR. The description of hazards and safety measures adopted for each hazard follows, as well as, safety design principles and measures, and general safety objectives. Particularly, in defining safety requirements, it has been considered that, as the TBS becomes part of the machine, its design and eventual operation are subject to the same safety and licensing regime as the machine. Therefore, it is essential the same ITER safety design principles be followed for the design of the TBS. Accordingly, on the basis of ITER general safety requirements and on the basis of TBS functional safety constraints (confinement, fusion power shutdown, decay heat removal, monitoring, and control of physical and chemical energies) and of safety analyses, specific TBS safety requirements have been outlined. They are related to: Defence-in-depth, identification of safety important functions and safety important components, safety measures, radiation protection approach and application of ALARA Principle. Clearly, the focus of the PrSR is on safety assessment both on the perspective of public and environment and on the perspective of worker safety. The identified possible accident conditions have been treated in detail both by definition of possible accident sequences, of accident analysis specifications and of available deterministic assessments done to evaluate most severe accident consequences. Here in this paper, TBS accidental events are summarized together with a discussion made to outline magnitude of the additional risks expected from the TBSs with respect to the risks expected to operate ITER without the test blankets, recalling that the safety analyses has shown that ITER will meet regulatory requirements and will result in operation that fully satisfies the safety objectives established for the project, with minimal environmental and public safety impact. Last issue treated in the TBS PrSR has been the “Waste Management & Disposal”. The ITER PrSR was considered in issuing the TBS PrSRs.
3. Accident assessment The accidental conditions, or postulated initiating events, which might give rise to a release of radioactivity, were determined from a Failure Mode and Effect Analysis (FMEA) evaluation. A set of reference accidents was then identified, by grouping individual accident initiators that have similar consequences. The selected reference accidents are those with the highest expected consequences – i.e., those that establish the system safety design requirements. For each of the reference accidents, there may be one or more safety analysis objective. The common safety analysis objective is to demonstrate that there would be no uncontrolled releases of radioactivity to the environment, unless such releases are miniscule – i.e., well below the release guidelines. In any case, the release guidelines will always be respected. Almost all of the reference accidents identified in the PrSR for the TBSs are design basis accidents (DBAs) – i.e., they establish design basis conditions, or simply, safety design requirements. In two cases, the event sequence of the reference accident has been pushed well beyond the design basis. In the realm of safety analysis there has to be a dividing line between what is considered to be within the design basis and what
2205
is to be beyond the design basis. Several considerations contribute into the decision, but the key consideration is event sequence probability. Those event sequences having a very low probability of occurrence are normally analyzed to determine the radiological consequences, but are designated beyond design basis accidents (BDBAs). The purpose of the analysis is to demonstrate that there is sufficient safety margin in the design so that the radiological consequences are not dramatically different than those for design basis accidents. The reference accidents are referring to the “Demo-relevant data acquisition” operation phase (DT – deuterium–tritium phase) with the INTegral module (IN-TBM) as they are the most challenging operating conditions for TBS. Other three modules are foreseen in the former phases (H/He phase and the D-phase), but accident events with these modules should induce consequences that will be enveloped by the consequences expected when the IN-TBM operates. Furthermore, accident events can occur also when a dummy plug is operating. In such a case, because the TBM dummy plug is water cooled by the first wall/shielding blanket (FW/BLK) cooling loop and, because it is managed as all the other equatorial port plugs, the consequences expected for the TBM dummy plug accident will be similar to the ones expected for the overall ITER port plugs – water cooled. The accident analysis for the water-cooled port plug is covered by the accident analysis of the ITER machine. The reference accidents presented in the PrSR can be summarized in terms of the TBS release location – i.e., by release type – such as: • Releases into the vacuum vessel. • Releases inside the tokamak building. • Releases inside the tritium building. 3.1. Releases into vacuum vessel Several of the analyzed reference accidents lead to the release of radioactive material from the TBS into the vacuum vessel (VV). These include accidents initiated by the tokamak (e.g., plasma disruptions and induced breaks in TBM) as well as those initiated by the TBS (e.g., loss of heat sink and ex-vessel loss of cooling accident leading to in-vessel LOCA). For this type of accident, the typical response is the pressurization of the VV leading to the activation of the vacuum vessel pressure suppression system (VVPSS) at 90 kPa, which vents the VV into the suppression tank. The steam and gases discharged into the VV from the TBS and shield-blanket modules causes tokamak dust, accumulated on the inside surfaces of the VV during normal operation, to be mobilized, with some becoming airborne. Once the VVPSS is actuated, the airborne dust inside the VV is transported to the suppression tank, by the pressure difference between the VV and the suppression tank. The suppression tank is always in standby mode and the pressure above it is maintained below atmosphere (at 4 kPa). The chilled water in the suppression tank condenses the steam entering from the VV. The water will also trap particulates, such as tokamak dust and activated products from the TBS. Gases, however, will enter into the air above the suppression tank and cause that volume to be pressurized. Once the pressure in the suppression tank air space reaches 90 kPa, the vent detritiation system is activated. This system has a tritium removal capability and a high-efficiency particulate filter to trap activated dust that may have escaped the scrubbing effect of the water in the suppression tank. The drain tank, which opens one hour after the VVPSS is actuated, drains the water accumulated inside the VV. The releases from the detritiation system into the external environment are thus controlled and small relative to the ITER release guideline values. It is important to note, however, that the radioactive releases from the TBS into the VV are a miniscule fraction
2206
T. Pinna / Fusion Engineering and Design 86 (2011) 2204–2207
of the radioactivity already present inside the VV, which has the potential to be mobilized. Accordingly, the contribution of the TBS radioactive source term to the environmental releases is negligibly small. There are two ITER reference accidents that are relevant to this discussion. The first one is a plasma disruption leading to an invessel LOCA, referred in the ITER safety analyses as “Multiple First Wall Pipe Failure” [2]. The other one is an ex-vessel LOCA, referred as “Large ex-vessel divertor pipe break” [2,3]. The source terms, for tritium, tokamak dust and activated corrosion products (ACPs), considered in the ITER safety analyses (safety assessment values) for the in-vessel LOCA are, respectively, 1000 g of tritium, 1000g of tungsten dust and 330 g of ACPs. The transport pathways are: from VV to suppression tank and from VV to drain tank. As the pressure in the VV and VVPSS returns below atmospheric level within 100 s, there are no significant leaks into the adjacent rooms and therefore no uncontrolled leaks into the environment. The suppression tank venting system is not actuated because the pressure in the suppression tank does not exceed the set point; hence there is no release through the detritiation system (DS). The source terms, for tritium, tokamak dust and ACPs, considered in the ITER safety analyses (safety assessment values) for the ex-vessel LOCA are, respectively: 1000 g of in-vessel tritium, the fraction of divertor loop tritium associated to the fraction of water flashing to steam, 5 kg W vaporized by plasma disruption, 1000 kg W in-vessel dust inventory, 1.3% of the spilled ACP inventory (<10 kg) mobilized as aerosols (<130 g). The transport pathways are: from VV to tokamak cooling water system (TCWS) vault and then to the environment; and from VV to suppression tank, and from suppression tank to the environment via the vented detritiation system. Maximum expected environmental releases from this event presented in [3] were: 1.5 g of tritium, 1.13 g of dust and 0.75 g of ACPs. These small amounts are going to be further reduced (one order of magnitude, e.g., tritium releases are going to be of the order of 1–2 tenths of grams) by the last ITER safety analyses more refined to the last design documents. Although the tritium and activated products source terms for the TBS have not yet been determined in detail, the first calculations evaluated a maximum inventory of mobilizable radioactive material of the order of hundred milligrams. Therefore, compared to the radioactive source terms postulated for the ITER safety analyses it is clear that the TBS contribution would be negligibly small. 3.2. Releases inside the tokamak building Three of the reference accidents analyzed in the PrSR for TBSs lead to radioactive releases inside the Tokamak building: two of them refer to ex-vessel LOCAs and consequences have been already discussed in the section above; one refers to tritium extraction system (TES) break inside port cell (PC). The focus of this section is the release of radioactive material from the TBS that does not involve the VV, i.e., TES pipe break. The radioactive source terms are tritium and activated products. And, it is assumed that the entire inventory of tritium and activated products are discharged in the PC. The PC atmosphere is initially at atmospheric pressure, or just slightly below. The helium purge gas entering the PC, from the TES pipe break, will cause the PC to pressurize. This pressurization may lead to some leakage of radioactivity from the PC into the gallery until the vent detritiation system is activated, by a high radiation signal inside the PC. At this point the leakage will cease and releases to the environment will be via a controlled release route, after filtration and detritiation. There is a relevant ITER reference accident for the TES pipe break – “Failure of a Fuelling Line” [2]. The release is inside the building and the release pathways to the environment are through leakage,
HVAC system and detritiation system. 13.4 g of tritium are released from the ruptured fuelling line directly into the room. Of this, only 0.17 g (<2%) are released to the environment. For the TES pipe break, the tritium source term has not yet been exactly determined, but it is expected to be in the order of hundred milligrams. Moreover, the release is inside the PC, hence leakage from the PC to the gallery and to the environment will be a small fraction of the released quantity. The remaining tritium in the PC is captured by the detritiation system that is continuously active. 3.3. Releases inside the tritium building One of the TBS reference accidents leads to radioactive releases inside the Tritium Building – TES pipe break inside the tritium building. There is one ITER reference accident that is relevant to this TBS reference accident – the “Isotope Separation System Failure” [3]. The total ISS tritium inventory (220 g) was assumed to be released into the cold box surrounding the ISS column. From there 66 mg leak into the ISS room, which is part of the Tritium building, and only 1.1 mg are released to the environment by building leakage, via HVAC during the first hour, and via DS, 65 min after the start of the release. The leakage rate of the Tritium building was considered to be 100% vol/day with a P of 300 Pa. As the pressurization of the tritium building, following a TES pipe break, is expected to be negligible, the leakage pathway is not significant for this TBS reference accident. The tritium source term from the TES pipe break has not yet been estimated, but could be at the maximum in the order of hundred milligrams. Therefore, postulating that also the TES glove boxes failed, the tritium release into the Tritium building could be at maximum in the same order than that from the “Isotope Separation System Failure” reference accident presented in the ITER safety analyses [3]. Consequently, the release related to TES from the Tritium building to the environment could be at maximum of the same order of magnitude, but likely could be negligible given the unimportance of the leakage pathway in the case of TES rupture. 3.4. Discussion and summary of BDBA Two accidents have been analyzed in the TBS PrSR as being beyond the design basis, on the basis of accident probability. The two accidents are: - severe plasma disruption cutting right through the TBM first-wall and the first-wall cooling tubes/channels of a adjacent watercooled shielding blanket module (the TBM first wall damage exposes all breeder units to the VV environment), and - ex-vessel LOCA with induced in-vessel LOCA and severe plasma disruption causing the failure of some shield-blanket modules, with a consequential ingress of cooling water inside the VV. Both of these BDBAs are extreme cases of their respective DBAs. The reason for including these BDBAs into the TBS safety analysis was to demonstrate that, despite the increased severity of the assumptions associated with the BDBAs, their radiological impact would not be disproportionately larger, relative to their respective DBAs. More specifically, the intent was to show that stretching the severity of the accident to the limit would not produce a step change in the radiological impact of an order of magnitude. The basic difference between the two tokamak-initiated accidents is the potential damaging of the plasma disruption. The extent of the damage postulated for the BDBA (a through-wall cut of the TBM first wall) was deliberately chosen to precipitate a reaction between the steam environment (from damage to adjoining shieldblanket module) inside the VV and the beryllium pebbles in the
T. Pinna / Fusion Engineering and Design 86 (2011) 2204–2207
breeder units – in the case of the HCPB – or, the lithium–lead breeding material – in the case of the HCLL. The steam/beryllium reaction, or the steam/lithium reaction, is exothermic, adding more thermal energy to the VV, and produces hydrogen, which is a potential fire and explosion hazard, both inside the VV and in downstream systems. The basic difference between the two ex-vessel LOCAs is the extent of damage resulting in the TBM box, following the LOCA. For the DBA analysis, the integrity of the box remained intact, while for the BDBA the integrity of the TBM box was breached, by throughwall melting of the first wall. The BDBA analyses have not been completed, but the preliminary results presented in the PrSR and related documents suggest that their impact on the machine, and on the environment, is not significantly different from that of their respective DBAs. More specifically, with respect to hydrogen production coming from the pebble bed Be of HCPB, the BDBA adds less than 100 g of hydrogen to the VV. Even if this quantity is likely to increase, once a more detailed analysis has been performed, the quantity of hydrogen generated by the TBM pebble bed is at least an order of magnitude lower than that estimated for the ITER DBA (in-vessel LOCA), which is 2.7 kg. For the HCLL, instead, BDBA adds 2.5 kg of hydrogen to the VV, on the assumption that all the lithium would react to produce hydrogen. This quantity is likely to decrease significantly, once a proper analysis has been performed. At any rate, it lets us conclude that also for HCLL, at maximum, hydrogen production from the TBS BDBA is of the same order of magnitude as the one from the ITER DBA.
2207
4. Analysis conclusions The accident analysis for the TBS is incomplete and still at an early stage for making definitive conclusions. Nevertheless, the preliminary results obtained to date tend to indicate that the TBS reference accident results are likely to be within the boundary established by the ITER accident analysis envelope. Moreover, these results indicate that there are no conditions under which a TBS accident would push the machine envelope beyond its design basis. Similarly, there are no conditions under which a machine accident would involve the TBS (specifically the TBM) in a way that would cause the machine envelope to be pushed beyond its design basis. Acknowledgments This work, supported by the European Communities under the contract of Association between EURATOM and ENEA, was carried out within the framework of F4E. The views and opinions expressed herein do not necessarily reflect those of the European Commission. References [1] V. Chuyanov, et al., TBM program implementation in ITER, Fusion Engineering and Design 85 (2010) 2005–2011. [2] T. Pinna, S. Raboin, J. Uzan-Elbez, N. Taylor, Methodology for reference accidents definition for ITER, Fusion Engineering and Design 75–79 (2005) 1103–1107. [3] S. Reyes, L. Topilski, N. Taylor, B.J. Merrill, L.L. Sponton, Updated modeling of postulated accident scenarios in ITER, Fusion Science and Technology 56 (2009) 789–793.