Japan Earthquake: nuclear plants Fukushima part 2

[Hiddencamper]

http://www.tepco.co.jp/en/nu/fukushima-np/images/handouts_111122_03-e.pdf
says otherwise. Both trains available and functioning, but not at full capacity


According to the document above, the operation was confirmed by observing steam coming out of the appropriate place.


" At 21:30. the operator conducted open op
eration of valve 3A and confirmed
generation of steam. "
(from the same cited document)


I... what? The point I was making was that it was not damaged in any way - yet did not get used in the event.


What rupture disks?


You don't like temp/pressure? Fine. Let's say an earthquake damaged a steam downcomer, so that there is now a big crack in it, above the water level? Now you can't scrub your steam, although there is plenty of water.
I have a lot of doubt about your claim that the wetwell provides sufficient scrubbing, too. I seem to remember dramatic spikes in readings of the counters at plant boundary, corresponding to venting operations.
The operators of the plant were not convinced either, as I recall there was much wringing of hands before venting was even attempted, as there was explicit concern at TEPCO over the pace/effectiveness of the evacuation effort. Venting was delayed too much, actually.



You are basing this belief on what, exactly?

I really appreciate a link. I want to add first off, if the IC was truly functional, unit 1 would not have had an accident. I also want to add that the official report from Japan's national diet concludes that the "IC systems were acknowledged to have largely lost their cooling function." (see page -80- of the following link). That is non-functional. Just like how HPCI was non-functional at unit 1, due to the loss of electric power causing the system to be failed in a state where it could not operate, IC was also failed at unit 1, due to the loss of electric power causing the system to be failed in a state where it could not operate.

http://www.cas.go.jp/jp/seisaku/icanps/eng/02Attachment1.pdf

They additionally state, in their report on the accident, that "The other isolation valves, which had been fully open until that time, were fully or almost fully closed as a result of the fail-safe function triggered by total loss of AC and DC power." On page 34 of the following link.

http://www.cas.go.jp/jp/seisaku/icanps/eng/03IIfinal.pdf

There's also the fact that if you stopped IC for long enough, you lose the ability to have natural circulation due to the generation of various gases and the like. But that's neither here nor there, I just know about this because I know Oyster Creek has safety analysis about it.

With regards to rupture disks, I'm talking about unit 2's rupture disc not operating, which made the accident at unit 2 worse than it needed to be. You can see this on the validated timeline in INPO 11-05 (the publicly available US industry document on the accident), which states on 13-Mar at 1100, the rupture disk failed to break. This is important because a rupture disk would be the primary method of activating a passive filter. Again on the 14th at 1130, they could not break it. Later on the 15th around midnight, when pressure was 40 psi above the rupture disk break pressure, it still did not break.

As for an earthquake damaging a downcomer. Are we talking about a steam downcomer or an SRV downcomer? For a steam downcomer, that's primarily important for LOCA, or immediately after the vessel breaches. With a broken steam downcomer, you would have already opt to flood the containment due to the loss of all ability to cool the core, which would obviate the need for it. The steam downcomers are designed to ensure high pressure/temperature steam is vented to the suppression pool for quenching, to prevent containment damage. If your downcomer breaks, you are likely to damage your containment due to the loss of pressure suppression capability, and you would end up breaching it, making your passive filter useless, and wet spraying and scrubbing, along with containment flooding, more useful.

Spikes in radiation measurements will happen, when you melt fuel, and that fuel then melts through the vessel into the drywell, where it then causes over pressure, such that you now have escaping noble gas inventory being ejected. Appropriate response with portable pumping systems would have directed containment drywell injection prior to the hot debris ejection event (my plant's SAMGs do, and they are nearly identical to every US BWR). Spraying would also be in progress through portable pumps. Ideally though, you would have used your portable equipment to prevent the core damaging event in the first place, but even assuming you failed at that (maybe because your SRVs were depleted...), running containment spray using portable equipment, venting from the wetwell (not the drywell) initially and making use of the vacuum breakers to siphon drywell radionuclide inventory through the pool, those would be useful. There are some cases where drywell filtering may be needed, and the NRC agrees with that, but it's not the only way to skin the cat.

Fully agree venting was delayed much too much though. Unfortunately they did not have the resources, plans, training, or equipment to handle a multi-unit event of this magnitude.

 

[zapperzero]

I really appreciate a link. I want to add first off, if the IC was truly functional, unit 1 would not have had an accident. I also want to add that the official report from Japan's national diet concludes that the "IC systems were acknowledged to have largely lost their cooling function." (see page -80- of the following link). That is non-functional. Just like how HPCI was non-functional at unit 1, due to the loss of electric power causing the system to be failed in a state where it could not operate, IC was also failed at unit 1, due to the loss of electric power causing the system to be failed in a state where it could not operate.

http://www.cas.go.jp/jp/seisaku/icanps/eng/02Attachment1.pdf

They additionally state, in their report on the accident, that "The other isolation valves, which had been fully open until that time, were fully or almost fully closed as a result of the fail-safe function triggered by total loss of AC and DC power." On page 34 of the following link.

http://www.cas.go.jp/jp/seisaku/icanps/eng/03IIfinal.pdf

This refers to the time immediately after the tsunami hit, flooding junction boxes.
But on the very same page they also state:

"It cannot be determined that, between the time of the earthquake and the arrival of the tsunami, there was such damage to the IC lines and tanks as to degrade the cooling function of the IC"

The operator (as stated in the document cited by me above), did later manage to open valve 3A and to confirm that the IC 1 was functioning.

With regards to rupture disks, I'm talking about unit 2's rupture disc not operating, which made the accident at unit 2 worse than it needed to be.

You can see this on the validated timeline in INPO 11-05 (the publicly available US industry document on the accident), which states on 13-Mar at 1100, the rupture disk failed to break. This is important because a rupture disk would be the primary method of activating a passive filter. Again on the 14th at 1130, they could not break it. Later on the 15th around midnight, when pressure was 40 psi above the rupture disk break pressure, it still did not break.

from the document you cite:

"The motor-operated containment vent valve (MO - 271) was opened at 0810 on March 13 (T plus 41.4 hours). At the time, containment pressure indicated approximately 50.8 psia (0.35 MPa abs). At 0855, indicated containment pressure reached 52.9 psia (0.365 MPa abs), below the design pressure of 55.1 psig (0.38 MPa gauge), then began to lower. The venting lineup was not yet complete. At 1015 (T plus 43.5 hours), the site superintendent directed operators to vent the Unit 2 containment (see Figure 7.4- 5). Workers used the small generator in the control room, which had been installed to restore some lighting, to energize the solenoid for the large air-operated suppression chamber vent valve (AO-205). At 1100 (T plus 44.2 hours), the vent lineup was completed but indicated containment pressure was lower than the 62 psig (427 kPa gauge)
pressure necessary to open the rupture disk and allow venting, and the rupture disk remained intact."

It worked as intended, iow. Perhaps the set point was too high, yes. This does not in any way invalidate the principle of using a rupture disk...
Later on, we have active equipment failing for lack of power, despite emergency equipment having been brought on site and activated:

"On March 14 at 1101 (T plus 68.3 hours), a hydrogen explosion occurred in the Unit 3 reactor building. The explosion damaged the temporary power supply used to open the Unit 2 suppression chamber vent valve (AO-205), causing the valve to fail closed."

Even later, due to various events, the rupture disk again functions as intended:

"at 2100 (T plus 78.2 hours), operators opened the small suppression chamber air - operated vent valve (AO - 206), establishing the venting lineup (other than the rupture disk).
Indicated containment pressure remained slightly lower than the 62 psig (427 kPa gauge) working pressure of the rupture disk, so venting did not occur."

even later, just before the unexplained explosion-like event, we have another failure of powered equipment:

"Two minutes after midnight on March 15, the operators opened the small air-operated drywell vent valve (AO - 208). The vent line lineup was complete, except for the rupture disk that remained closed.
Containment pressure remained stable at approximately 109 psia (750 kPa abs). The operators rechecked their lineup and found that the small air-operated drywell vent valve had already failed closed."

welp.

As for an earthquake damaging a downcomer. Are we talking about a steam downcomer or an SRV downcomer?
For a steam downcomer, that's primarily important for LOCA, or immediately after the vessel breaches. With a broken steam downcomer, you would have already opt to flood the containment due to the loss of all ability to cool the core, which would obviate the need for it. The steam downcomers are designed to ensure high pressure/temperature steam is vented to the suppression pool for quenching, to prevent containment damage. If your downcomer breaks, you are likely to damage your containment due to the loss of pressure suppression capability

Unless there was some means to vent safely...

Spikes in radiation measurements will happen, when you melt fuel, and that fuel then melts through the vessel into the drywell, where it then causes over pressure, such that you now have escaping noble gas inventory being ejected. Appropriate response with portable pumping systems would have directed containment drywell injection prior to the hot debris ejection event (my plant's SAMGs do, and they are nearly identical to every US BWR). Spraying would also be in progress through portable pumps. Ideally though, you would have used your portable equipment to prevent the core damaging event in the first place, but even assuming you failed at that (maybe because your SRVs were depleted...), running containment spray using portable equipment, venting from the wetwell (not the drywell) initially and making use of the vacuum breakers to siphon drywell radionuclide inventory through the pool, those would be useful. There are some cases where drywell filtering may be needed, and the NRC agrees with that, but it's not the only way to skin the cat.

Other ways may or may not be practicable, as it turns out. Venting through the wetwell can fail (as shown at Fukushima 1-2) repeatedly, portable pumps can be damaged by wholly unrelated events, radiation levels can be to high in the vicinity of manually-operated valves etc etc. These are all things that have happened at Fukushima, not hypotheticals. You propose that there is no need to have a way to deal with them happening again elsewhere.

Fully agree venting was delayed much too much though. Unfortunately they did not have the resources, plans, training, or equipment to handle a multi-unit event of this magnitude.

If only there had been a way for the venting to take place safely, without operator intervention and in the absence of power and instrumentation!

 

[nikkkom]

I really appreciate a link. I want to add first off, if the IC was truly functional, unit 1 would not have had an accident.

By now it is firmly established that IC did not save Unit 1 because TEPCO never considered extended SBO, including EDG failure, to be possible.

To be more precise: (1) operators had no training what to do, and accident manuals had no description what to do in such situation, and (2) valves leading to/from IC weren't designed so that they don't fail close without power in a way which makes impossible for them to be opened, even manually.

Both of these errors are easy to fix.

 

[nikkkom]

Now for beyond design basis accidents, you have to assume going into the BDBA that all your permenently installed equipment failed. This makes sense, because in order to get into a BDBA, you had to lose all your onsite equipment.

It reads as if you are unaware about Fukushima disaster. Which can't be true, so you must be willfully ignoring it. Pretty scary. It means that you need to experience another meltdown, somewhere in US this time, to see the light.

"All your permenently installed equipment" does not need to fail for plant to get into a serious accident. It is enough for it to be merely without power! IT IS EMPIRICALLY PROVEN NOW! How many Fukushimas need to happen for you to admit it?

Fukushima had shown that there must be passive systems, which need no power and no operator intervention at all, or can be actuated manually (meaning with bare hands, as in a valve which can be opened by rotating a handle). Filtered vent is one such system.

Why do you fight it? Because, gasp, it needs some significant paperwork?? THAT is more important than preventing thousands of square miles and millions of people from being dusted with Cs-137?

 

[Rive]

If only there had been a way for the venting to take place safely, without operator intervention and in the absence of power and instrumentation!

It's an interesting question.

With the leaks, the pressure (therefore: the boiling point) were kept high and so the main of the water were still there to act as a heat puffer. Heat were removed with high pressure, high temperature steam.

With a vent through a rapture disk the boiling point would fall to 100 degree -> almost all the water would had gone within hours, at low pressure, low temperature (therefore along with much less heat).

PS.: BTW the first cask left U4.
http://translate.googleusercontent.com/translate_c?depth=1&hl=en&ie=UTF8&prev=_t&rurl=translate.google.com&sl=ja&tl=en&u=http://photo.tepco.co.jp/date/2013/201311-j/131121-01j.html&usg=ALkJrhg1vKOQzhihL7wG9YCHGgHS-d0B7Q

 

[zapperzero]

http://photo.tepco.co.jp/library/131121_01/131121_03.jpg
is censored
what the heck?

 

[Rive]

On every photo (in the previous galleries too) some parts of the casks and the handling machinery is blurred because of some safety reasons.

(Sounds stupid for me, actually.)

 

[Hiddencamper]

It reads as if you are unaware about Fukushima disaster. Which can't be true, so you must be willfully ignoring it. Pretty scary. It means that you need to experience another meltdown, somewhere in US this time, to see the light.

"All your permenently installed equipment" does not need to fail for plant to get into a serious accident. It is enough for it to be merely without power! IT IS EMPIRICALLY PROVEN NOW! How many Fukushimas need to happen for you to admit it?

Fukushima had shown that there must be passive systems, which need no power and no operator intervention at all, or can be actuated manually (meaning with bare hands, as in a valve which can be opened by rotating a handle). Filtered vent is one such system.

Why do you fight it? Because, gasp, it needs some significant paperwork?? THAT is more important than preventing thousands of square miles and millions of people from being dusted with Cs-137?

I agree that you can get into a significant accident without all of your permanently installed equipment failing, however, the definition of a BDBA that we are required by regulation to design to requires us to assume that we've lost pretty much all on site permanently installed equipment. That's the starting point from the regulator's perspective. Even many passive components are assumed to fail due to the extreme common mode failure phenomenon. I'm looking at this from the perspective of what the regulator is requiring us to design to. Under the assumptions we are given, if I put something in that doesn't meet the regulator's definitions, that means its not going to "work" in a severe accident. Remember all of this goes back to what the regulator is willing to accept, and when the regulator starts off from day 1 saying that a BDBA assumes failure of all onsite permanent equipment with certain exceptions, that's how you have to start from a design perspective. For example, under those definitions and regulations, a passive filter on its own may not work, or even worse, it could affect how my plant responds to its design basis accidents.

Unfortunately what you think things should be, and the practical side of things, do not work that way in nuclear.

side bar: I take personal offense to your claim that I would need to experience another meltdown. I'm here like you all are to have discussions about Fukushima, nuclear accidents, etc, and the hostility here is ridiculous.

 

[nikkkom]

I'm looking at this from the perspective of what the regulator is requiring us to design to.

I propose that you look at it from a different perspective: "let's assume that some failure modes *demonstrated* at Fukushima may happen on our plants too".

This includes:
- unfiltered venting
- failure to vent before meltdown
- inadequate radiometers
- lack of robust emergency lighting
- ...(read accident destription and you can easily add a few more)...

If I would see nuclear industry taking active steps to improve the areas which *demonstrably* failed (we don't need to guess "can this happen?" - we KNOW it can), I would have hope the industry has a future.

I'm seeing something else instead: pointless discussions "what is 'design basis accident' and what is beyond that" (as if anyone cares how you call it!), procrastination with implementing even the most obvious fixes...

Frankly, by this point I prefer endless fields of PV panels in Arizona to this mess.

 

[zapperzero]

I agree that you can get into a significant accident without all of your permanently installed equipment failing, however, the definition of a BDBA that we are required by regulation to design to requires us to assume that we've lost pretty much all on site permanently installed equipment.

There's something like a cognition bug here. You design to deal with design basis accidents, by definition. Beyond design basis means just that, stuff that your design isn't really expected to deal with. At the very most, you can make an effort to fail gracefully, whatever that means in context...

Now, the class of design basis accidents SHOULD include Fukushima-like events (prolonged loss of onsite power, both DC and AC) but doesn't, apparently. This doesn't seem to trouble you at all.

side bar: I take personal offense to your claim that I would need to experience another meltdown. I'm here like you all are to have discussions about Fukushima, nuclear accidents, etc, and the hostility here is ridiculous.

When you come up with gems like this, it's also a bit justified:

Unfortunately what you think things should be, and the practical side of things, do not work that way in nuclear.

Unfortunately? That's all you have to say?

 

[LabratSR]

side bar: I take personal offense to your claim that I would need to experience another meltdown. I'm here like you all are to have discussions about Fukushima, nuclear accidents, etc, and the hostility here is ridiculous.

Well I, for one, really appreciate your input.

 

[nikkkom]

It's an interesting question.

With the leaks, the pressure (therefore: the boiling point) were kept high and so the main of the water were still there to act as a heat puffer. Heat were removed with high pressure, high temperature steam.

With a vent through a rapture disk the boiling point would fall to 100 degree -> almost all the water would had gone within hours, at low pressure, low temperature (therefore along with much less heat).

Boiling of water takes about the same amount of energy as heating it to 500 C. You don't lose that much cooling capacity by letting it boil at lower temperature.

If water would have been allowed to boil inside RPVs at low pressure, it would still cool them (as long as it lasted), and the steam would have drastically fewer contaminants (basically, it would be on par with usual BWR first loop water).
After it all boiled away, the fuel would melt "dry", not generating highly contaminated steam as was observed oozing out of Unit 3 for days.

(In truth, since even depressurized RPVs would have some residual water in the lower head, there still would be highly contaminated steam after fuel melts, just less of it).

 

[etudiant]

Well I, for one, really appreciate your input.

Add me to that list as well, hiddencamper!
Your inputs, coming from a base of real world experience rather than theory/ideal, are a major resource.
Don't let it get to you when others lash out, they are simply frustrated by the regulatory and hardware mechanisms.

 

[Most Curious]

Hiddencamper, add me to the list of those who appreciate your perspective and "insider" knowledge of plant systems and design.

I am here to learn and understand, mostly from folks far more knowledgeable than myself, not to sort through anti-nuclear agendas. The media does a fine job of presenting inaccurate agenda driven gibberish so no more is needed.

I will certainly agree some things should have been done differently at Fukushima such as locations of emergency power systems, better use of the IC of unit 1 and better operator training. (Which can ALWAYS be improved at any major installation, nuclear or not.) Clearly, dispersion of hydrogen from melting reactors did not go as planned, adding greatly to plant damage and in radioactive release. Of course, had the meltdowns been prevented, many of these issues would not have come up at all...

Those of us not really in the know as to how changes in plant design are made can only guess at the complexity added by regulation - as only ONE factor. Hopefully, there will be some value come from the comments made by those of us too ignorant to know what can't be done - much like the bumblebee being ignorant of the fact it can't fly.

I have no doubt the events of Fukushima will be studied for at least the next century; lessons will be learned and improvements made. That is great and everyone will pat themselves on the back for a job well done - until the next event which will point out additional areas in need of improvement, and possibly indicate previous "improvements" weren't such a good idea after all. So goes the scientific process and increase in mankind's knowledge, long after personal agendas are forgotten.

To gain maximum benefit for us all in matters nuclear, we need to attract folks directly involved in the industry to make the rest of us more useful in adding our limited brainpower to so many complex problems. In order to attract the comments from such people we need to welcome them and try not to be offensive. In reality, they are here for the same reason as the rest of us - to learn. We should be pleased they are also willing to educate the rest of us.

Just my 2 cents worth.

 

[a.ua.]

Well I, for one, really appreciate your input.

+1...

 

[Hiddencamper]

Sorry to make a rift here everyone.

As for zapper, you mention that I don't seem concered enough that a "fukushima" accident isn't in the DBA.

First off, if I got to a Fukushima accident, it probably means my DBA probably wasn't determined correctly. The DBA is supposed to include the worst case environmental impacts to the plant. So if I got to Fukushima, then it means that I never determined my DBA right. I then have to ask, how do I know putting a "Fukushima" accident in the license requirements is going to actually cover a Fukushima accident, when I couldn't even determine my normal accidents correctly. This is why Fukushima needs to be covered as a beyond design accident.

The DBA for a nuclear plant is essentially as follows: Worst case initial conditions (reactor overpower, lowest lake level, hottest temperaturs, lowest emergency generator fuel storage, etc etc), all safety systems in service, initiating accident, single limiting failure, no human action for 30 minutes, plant is automatically stabilized/made safe, cold shutdown achieved within 36 hours and maintained for 30 days. No core damage if it is an anticipated event. Minimal release is allowed for abnormal events (once in the life of the plant type events). Only postulated events like a LB-LOCA allow for any fuel damage or release approaching the limits of your license.

A fukushima accident requires assumptions that go far beyond the DBA definition. As such, it really fits in with the other accidents, that are non-DBA. Examples of these are station blackout and ATWS. Things that have a high liklihood of occurring, or an unacceptably high consequence if it did occur. Under beyond dba, my initial conditions are what the regulator tells me. Unlike a DBA, I don't need to use the most limiting conditions, instead I only need to demonstrate reasonable assurance that I can protect against the event. This means I'm allowed to use portable equipment, manual operator actions, I'm allowed to assume I start from realistic conditions, I'm allowed to violate my operating license (if it is required for the health and safety of the public), I'm allowed to repurpose equipment as necessary. The goal is to meet the requirement of the accident. For SBO, I have to survive my coping time without violating any design limits of the plant. For BWR ATWS, I have to be able to reduce power independent of the scram system to a point where the plant can survive without violating its safety or design limits long enough for boron injection to complete. My initial conditions and success criteria of the event are what the regulator tells me.

A Fukushima event requires something beyond the definition of the DBA to get there. It fits in best with the select DBAs which have a high liklihood or consequences.

As for DBAs and design criteria for plants, I personally am a huge fan of re-validating, using present day methods, the DBAs for all plants. In the US, plants are revalidating their seismic/structural/flooding, and I think that's a huge step in the right direction. If Fukushima has shown us anything, its that as your methods change, you may find hazards you did not originally expect (or design for)

 

[rmattila]

Just to keep some international perspective, here's my post from two years ago:

Even though the design bases in pretty much all Western nations were initially based on the NRC:s criteria from the 1960's, the definitions have since diverged.

Here in Finland, for example, severe accidents were included in the design bases in the 1980's, with specific criteria for failure assumptions (pretty much all "normal" safety systems and instrumentation assumed lost), containmet loads, equipment qualification for the core meltdown conditions, allowable releases (100 TBq Cs-137) etc., and backfittings (filtered ventings, passive containment flooding systems etc.) were made at the old plants. For new plants, a more robust core catcher has been required since the early 1990's.

A more recent development has been a systematic approach to so called "design extension conditions" (DEC), which were outside the original design bases. These conditions include e.g. situations with a common cause failure in any of the safety systems, other complex accident sequences or very rare natural events, and the category has its own design rules and acceptance criteria (to be demonstrated when applying a construction or operating permit and ever 10 years during operation).


So all in all, the design basis of plants consists of three event categories based on the conservatively estimated frequency of the initiating event:

1. the "old-fashioned" design basis conditions
DBC1, normal operation
DBC2, anticipated operational occurrences, f > 1e-2/a
DBC3, Class 1 postulated accidents, 1e-2/a < f < 1e-3/a
DBC4, Class 2 postulated accidents, f < 1e-3/a

2. Design extension conditions, events with an estimated frequency between 1e-4/a and 1e-7/a
DEC A, DBC2-3 with a CCF in a safety system
DEC B, complex accident sequence (=multiple failures)
DEC C, very rare events (such as a collision of a large passenger aircraft)

3. Severe accidents, events exceeding the acceptance criteria for DECs
total sum of all severe accident even trees shall be lower than 1e-5/a.

Summing up, the cutoff frequency for events to be considered in the design is of the order of 1e-7, and there's the additional reuirement that the sum for all such events shall be lower than 1e-5. And the severe accident systems shall be able to fulfill their design basis so that the probability for exceeding the acceptance criteria for severe accidents is lower than 5e-7/a.

Since all these event categories contain explicit design rules and acceptance criteria, it is natural to include them all in the concept "design basis" of the plant. I have the impression that many other countries are also taking steps in this direction, so it may become internationally more common to redefine the "design basis" to go beyond the traditional DBC2-4 events with a single (or double in some countries) failure.

 

[Hiddencamper]

Just to keep some international perspective, here's my post from two years ago:

fascinating thank you!

 

[Hiddencamper]

Hey guys, with Fukushima pulling spent fuel out, there is a lot of noise in the media about "inadvertent criticality" in the SFP.

As far as I know, the SFPs utilize boron plated racks and the fuel assemblies are positioned to ensure keff < 0.95 at all times. I mean, in all seriousness, not only should it not occur, but even if there was a threat, that could be dealt with simply by adding boron to the SFP inventory prior to moving rods.

What doesn't make any logical sense, is the fact that they are claiming that removing the rods may cause criticality. Yes moving rods means you are shifting the local reactivity profile, but the overall net effect of removing a rod would be to reduce reactivity in that cell of the SFP. I also don't see how removing or moving any individual fuel assembly would be capable of defeating that < 0.95 keff in the SFP. The fuel had to be placed in that position originally, so removing it should not put you even close to such an event. So logically it seems completely out of the picture.

What I'm curious is if anyone knows where this claim came from. Was this simply the type of stuff from Arnie Gunderson or a handful of others who have a tendency to exaggerate claims, or was there some official source that mentioned there was a possibility here? Has TEPCO or any official agencies (Japan or international) mentioned anything here?

In my searches, I haven't seen anything, and I think it's likely a quack claim, but I'm interested in seeing where it came from.

Thanks

 

[LabratSR]

TEPCO video of fuel extraction from Fukushima Daiichi pool 4

http://youtu.be/rLvu57X474M

 

[jadair1]

Hey guys, with Fukushima pulling spent fuel out, there is a lot of noise in the media about "inadvertent criticality" in the SFP.


Tepco is not removing spent fuel rods at this time, they are currently removing unused assemblies and this should take until some time in the new year.

As far as I know, the SFPs utilize boron plated racks and the fuel assemblies are positioned to ensure keff < 0.95 at all times. I mean, in all seriousness, not only should it not occur, but even if there was a threat, that could be dealt with simply by adding boron to the SFP inventory prior to moving rods.

There is some speculation that the Boron plated racks have been degraded by salt water and high heat in the pool, I do not know how credible this information is.

What doesn't make any logical sense, is the fact that they are claiming that removing the rods may cause criticality. Yes moving rods means you are shifting the local reactivity profile, but the overall net effect of removing a rod would be to reduce reactivity in that cell of the SFP. I also don't see how removing or moving any individual fuel assembly would be capable of defeating that < 0.95 keff in the SFP. The fuel had to be placed in that position originally, so removing it should not put you even close to such an event. So logically it seems completely out of the picture.

I don't believe anyone is claiming that the succseful removal of rods will increase the chance of a criticallity in the pool, rather it is the chance that an unsuccessful extration could lead to a criticality some how.

What I'm curious is if anyone knows where this claim came from. Was this simply the type of stuff from Arnie Gunderson or a handful of others who have a tendency to exaggerate claims, or was there some official source that mentioned there was a possibility here? Has TEPCO or any official agencies (Japan or international) mentioned anything here?

Several sources have made this claim, some more credible than others. Do you actualy believe Tepco or the NSA are credible sources?


In my searches, I haven't seen anything, and I think it's likely a quack claim, but I'm interested in seeing where it came from.

Thanks

I'm sorry, it's late and I'm tired so I'm not going to find the links for you but it is not only Gunnersan and Busby making these claims but several other nuclear engineers with experience in spent fuel.

 

[Rive]

Boiling of water takes about the same amount of energy as heating it to 500 C. You don't lose that much cooling capacity by letting it boil at lower temperature.

You lose mass as it boils (and goes away). That lost mass will carry away heat belonging to only 100 C, instead of 500C. It's quite a difference, especially because the difference will boil away even more water at low temperature.

What I'm curious is if anyone knows where this claim came from. Was this simply the type of stuff from Arnie Gunderson or a handful of others who have a tendency to exaggerate claims, or was there some official source that mentioned there was a possibility here? Has TEPCO or any official agencies (Japan or international) mentioned anything here?

In my searches, I haven't seen anything, and I think it's likely a quack claim, but I'm interested in seeing where it came from.

Thanks

As I recall, in the early days it was considered as a worst case scenario: if the pools are partially out of water then the cladding gets fire and the fuel breaks down. Then the damaged geometry might lead to criticailty in the remaining water. At that point it was taken seriously.
As the water level was secured, the story evolved to the 'the whole building breaks down and so' stage as the catastrophe it would cause was too tempting to let it drop -> the story went gundersened.



From officials, as I recall the possibility of criticality of U3 pool (where the fuel geometry might be severely damaged) in the early days is still on the table. This idea also has some supporting evidences, as thermal images and the excess radiation measured above the upper parts of U3.

I, personally, think that there are other explanations too. However as the geometry there might be affected by removing the debris, this line should not be dropped easily.

 

[nikkkom]

You lose mass as it boils (and goes away). That lost mass will carry away heat belonging to only 100 C, instead of 500C.

Not quite. It will carry away thermal heat *and* "heat" of vaporization, which is quite substantial for water.

More to it: as water heats up, heat of vaporization goes down (eventually reaching zero at critical temperature where difference between liquid and gas disappears). So to boil a liter of water at 200 C does not take as much energy as to do so at 100 C.

 

[rmattila]

I suppose the criticality issue arises from someone trying to explain the concept of criticality to a listener who has watched too much Ghostbusters, and hence the "if two rods touch each other" meme was born..

Qualitatively, there are three issues that might reduce the margin to criticality: loss of absorber plates in between the assemblies, grid distortion and dropping of an assembly on top of the rack. Based on the footage,#1 is not an issue in unit 4. And in the case of dense racks, the magnitude of #2 and 3 is at most a few hundred pcm, insignificant compared to the min 5000 pcm initial margin. I don't know about the Japanese practice, but at least here the 5000 pcm margin is required even if the entire rack was filled with the most reactive one-year-spent assemblies; so in real life, there probably is a few thousand pcm extra margin.

 

[nikkkom]

Hey guys, with Fukushima pulling spent fuel out, there is a lot of noise in the media about "inadvertent criticality" in the SFP.

I think it is usual uninformed hysterionics.

 

[nikkkom]

Sorry to make a rift here everyone.

As for zapper, you mention that I don't seem concered enough that a "fukushima" accident isn't in the DBA.

First off, if I got to a Fukushima accident, it probably means my DBA probably wasn't determined correctly. The DBA is supposed to include the worst case environmental impacts to the plant. So if I got to Fukushima, then it means that I never determined my DBA right. I then have to ask, how do I know putting a "Fukushima" accident in the license requirements is going to actually cover a Fukushima accident, when I couldn't even determine my normal accidents correctly. This is why Fukushima needs to be covered as a beyond design accident.

The DBA for a nuclear plant is essentially as follows: Worst case initial conditions (reactor overpower, lowest lake level, hottest temperaturs, lowest emergency generator fuel storage, etc etc), all safety systems in service, initiating accident, single limiting failure, no human action for 30 minutes, plant is automatically stabilized/made safe, cold shutdown achieved within 36 hours and maintained for 30 days. No core damage if it is an anticipated event. Minimal release is allowed for abnormal events (once in the life of the plant type events). Only postulated events like a LB-LOCA allow for any fuel damage or release approaching the limits of your license.

A fukushima accident requires assumptions that go far beyond the DBA definition. As such, it really fits in with the other accidents, that are non-DBA. Examples of these are station blackout and ATWS. Things that have a high liklihood of occurring, or an unacceptably high consequence if it did occur. Under beyond dba, my initial conditions are what the regulator tells me. Unlike a DBA, I don't need to use the most limiting conditions, instead I only need to demonstrate reasonable assurance that I can protect against the event. This means I'm allowed to use portable equipment, manual operator actions, I'm allowed to assume I start from realistic conditions, I'm allowed to violate my operating license (if it is required for the health and safety of the public), I'm allowed to repurpose equipment as necessary. The goal is to meet the requirement of the accident. For SBO, I have to survive my coping time without violating any design limits of the plant. For BWR ATWS, I have to be able to reduce power independent of the scram system to a point where the plant can survive without violating its safety or design limits long enough for boron injection to complete. My initial conditions and success criteria of the event are what the regulator tells me.

A Fukushima event requires something beyond the definition of the DBA to get there. It fits in best with the select DBAs which have a high liklihood or consequences.

As for DBAs and design criteria for plants, I personally am a huge fan of re-validating, using present day methods, the DBAs for all plants. In the US, plants are revalidating their seismic/structural/flooding, and I think that's a huge step in the right direction. If Fukushima has shown us anything, its that as your methods change, you may find hazards you did not originally expect (or design for)

Camper.
Who cares about terminology? You can call Fukushima scenario however you want. Beyond design basis accident. Very serious accident. Or "holy crap we totally fubared our risk of flooding assessment" accident.

This is *unimportant*.

What is important that it *did happen*, and had shown that Western NPPs' preparedness for accidents is not as good as you believed.

Now you can use it to learn lessons... or not. The future of the industry depends on whether you will do that.

 

[zapperzero]

Sorry to make a rift here everyone.
As for zapper, you mention that I don't seem concered enough that a "fukushima" accident isn't in the DBA.
First off, if I got to a Fukushima accident, it probably means my DBA probably wasn't determined correctly.

Yes. The problem here is that the design basis for Fukushima 1 was practically the same as for similar reactors in the US.

The DBA is supposed to include the worst case environmental impacts to the plant. So if I got to Fukushima, then it means that I never determined my DBA right. I then have to ask, how do I know putting a "Fukushima" accident in the license requirements is going to actually cover a Fukushima accident, when I couldn't even determine my normal accidents correctly. This is why Fukushima needs to be covered as a beyond design accident.

It doesn't follow!
You must change the process that produces license requirements until it gives sane results.

The alternative is to just say, as TEPCO is saying now, "beyond design basis, guys, sorry, nothing more we could do" - when there are clearly things that could have been done and design changes that would have prevented much/most/all of the trouble.

The DBA for a nuclear plant is essentially as follows: Worst case initial conditions (reactor overpower, lowest lake level, hottest temperaturs, lowest emergency generator fuel storage, etc etc), all safety systems in service, initiating accident, single limiting failure, no human action for 30 minutes, plant is automatically stabilized/made safe, cold shutdown achieved within 36 hours and maintained for 30 days. No core damage if it is an anticipated event. Minimal release is allowed for abnormal events (once in the life of the plant type events). Only postulated events like a LB-LOCA allow for any fuel damage or release approaching the limits of your license.

Funny how actual accidents don't fit in this category...

A fukushima accident requires assumptions that go far beyond the DBA definition.

It follows that the DBA must change!

As such, it really fits in with the other accidents, that are non-DBA. Examples of these are station blackout and ATWS. Things that have a high liklihood of occurring, or an unacceptably high consequence if it did occur. Under beyond dba, my initial conditions are what the regulator tells me.
Unlike a DBA, I don't need to use the most limiting conditions, instead I only need to demonstrate reasonable assurance that I can protect against the event.

You are off the hook, in other words! Cleared of ultimate responsibility! Act of God! BDBA! The plant is expected to fail catastrophically and if it doesn't, well that just comes down to luck.

This means I'm allowed to use portable equipment,

which may or may not get there

manual operator actions,

which may or may not be possible in the event because lolradiation

I'm allowed to assume I start from realistic conditions,

meaning, all systems nominal

I'm allowed to violate my operating license (if it is required for the health and safety of the public), I'm allowed to repurpose equipment as necessary

.
Always assuming that it is present, operable and undamaged...

The goal is to meet the requirement of the accident. For SBO, I have to survive my coping time without violating any design limits of the plant.

Even with this ridiculous amount of slack, you still get more! What is it now? 24 hours without external power?

For BWR ATWS, I have to be able to reduce power independent of the scram system to a point where the plant can survive without violating its safety or design limits long enough for boron injection to complete. My initial conditions and success criteria of the event are what the regulator tells me.

You are implying that operators have no input in the regulatory process, maybe? Because that's not true.

A Fukushima event requires something beyond the definition of the DBA to get there. It fits in best with the select DBAs which have a high liklihood or consequences.

That's exactly what TEPCO is saying. Of course, they are lying even by their own definition. For example, the plant was supposed to be protected against tsunamis and TEPCO knew (and told the regulators, even) that there could be tsunamis higher than their seawall.

As for DBAs and design criteria for plants, I personally am a huge fan of re-validating, using present day methods, the DBAs for all plants. In the US, plants are revalidating their seismic/structural/flooding, and I think that's a huge step in the right direction.

It is very good that they are looking at seismic, structural and flooding damages. However the ultimate cause for the catastrophic failures at Fukushima was an extended station blackout, including loss of DC power. This can happen in many ways, not just by flooding.

If Fukushima has shown us anything, its that as your methods change, you may find hazards you did not originally expect (or design for)

It hasn't shown anything of the sort. The tsunami hazard was well known when the plant was being designed (there was/is even a puny wave-breaker dike thing). Nothing new there. The problem was with the regulator allowing TEPCO to assume they would only have to defend against the smallest tsunami ever, functionally no different from a large storm.

 

[zapperzero]

Just to keep some international perspective, here's my post from two years ago:

Thank you! I had been looking for it!

 

[rmattila]

My primary concern at Western plants and Defence-in-depth thinking is that the plant's internal electricity grid appears to be recognized simply as provider of power to the equipment, not as a means for fault propagation. There are several possible failure modes in the plants' busbars, including lightning overvoltages (or the main generator going crazy), undervoltages, phase shifts, frequency errors, harmonics etc. that can potentially damage any equipment connected galvanically to the main busbars.

Yet, whenever you go to an international meeting about the lessons learned from Fukushima, the talk is all about how portable diesel generators connected to some points within the plant's internal grid will solve all electricy-related issues.

We are now backfitting the old plants with an arrangement capable of cooling the core even if all equipment connected to the plant's main busbar-including valve actuators with very few exceptions - are postulated lost due to beyond design basis electrical failure. This requirement is included in the new regulatory guide published next week, and old plants will also be required to fulfil it. Probably this will mean direct diesel-driven pumps or RCICs with special emphasis on the operability of valve line-up. Check valves inside the containment, and possibly fail-open valves outside it.

 

[zapperzero]

http://www.tepco.co.jp/en/news/libr...209002&bclid=347242463002&bctid=642054611002v

 

[westfield]

I'm trying to discuss what the plant ALREADY has installed to meet its design basis requirements. SGTS is not inadequate for design basis accidents, its only inadequate in an extended total loss of power with damage to your permanently installed plant systems. This means a filtered vent is not required to maintain the public safe during design basis accidents. In no case during a DBA would you need a passive filtered vent to make the plant safe. The installation of a passive filtered vent does not help you at all for any design accident, and provides very little if any net benefit. From an engineering/reactor designer perspective its more of a warm fuzzy, because you already have nuclear safety grade equipment which performs that function. (Now if we were designing a new plant, you sure as **** can bet that I would design a passive filter in, but talking about existing plants, you already have something for that)

<snip)

That's my view on it as a plant design engineer.

Ok, that's clearer. I'm trying to broaden my understanding of why these hardened vent systems are even fitted to these plants when they are not filtered, it's like they never intend to use them.
I appreciate your real life knowledge in the subject. NPP designer I am not :)

Are you able to clarify something.

Disregarding which venting system, is venting (to the environment) at close to or exceeding the design pressure of the RPV considered something that might be required in a DBA or would that be only in the BDBA realm?

 

[westfield]

http://www.tepco.co.jp/en/news/libr...209002&bclid=347242463002&bctid=642054611002v

I guess introducing the crud from SFP4 to the common fuel pool isn't something that bothers them. I have no basis for thinking it would be an issue but it seems odd to me that they wouldn't clean them somehow as they transferred them.

Not as odd as the blurring of the videos though.

 

[zapperzero]

it seems odd to me that they wouldn't clean them somehow as they transferred them.

I don't suppose anyone bothered to make (and test!) a procedure for that.

 

[Rive]

I guess introducing the crud from SFP4 to the common fuel pool isn't something that bothers them.

They made some cleaning before moving the bundles.
http://www.tepco.co.jp/news/2013/images/131112a.pdf
Page seven.

Ps.: sorry, I can't check the vid from here, I had to guess what's it about.

 

[westfield]

They made some cleaning before moving the bundles.
http://www.tepco.co.jp/news/2013/images/131112a.pdf
Page seven.

Ps.: sorry, I can't check the vid from here, I had to guess what's it about.

Good guess. The vid showed a fair amount of sediment falling from bottom of the fuel assembly as it was extracted from the cask and moved through the gate into the pool of the common fuel pool.
Presumably some of the sediment from each transfer remains in the cask as well.