Patent Number: 046577270
Section: description

DETAILED DESCRIPTION OF THE DRAWINGS The normal inventory of radioactive materials within a nuclear power plant, 1, and plant systems, 2, are represented in FIG. 1. The concentration of radioactive material is highest in the fuel, 3, and lowest in the environment, 4,. A progressive decrease of total radioactive material inventory exists as the point of consideration moves from the fuel, 3, to the reactor coolant system, 5, to containment, 6, to plant buildings, 7, and finally to the environment, 4. In addition to the reduction in total inventory, the concentration (the amount of radioactivity per unit volume) decreases to an even greater extent since the volumes of interest typically increase by two orders of magnitude, namely, by a factor of 100, with each step toward the environment. In FIG. 1, the fuel barrier, 8, is the cladding around each fuel element which prevents or retards passage of radioactive materials. The reactor coolant system barrier, 9, is the combination of pipes, pumps, valves, and couplings which confine the primary coolant. The containment barrier, 10, including emergency systems, 11, are the reinforced concrete and/or steel vessel or components represented as a solid line. The dashed lines, 12, around facilities buildings representing building walls are not considered fission product barriers as described and used in the present process. The first part of the present process, represented in FIG. 3, establishes a functional definition of each fission product barrier such that the loss of function of any barrier or each possible combination of losses of functions of multiple barriers results in unique, unambiguous, pervasive symptoms manifested within the control room of a nuclear power plant by indicators which are identifiable the computer and by a licensed operator. The first part of the process comprises: 1. Development of preliminary definitions for barrier function, for each fission product barrier; PA1 2. Identification of all possible indicators of environmental, radiological, or process-related parameters which have the potential to indicate symptoms of fission product barrier degradation throughout the facility during an emergency; PA1 3. Evaluation of the response of each possible indicator to changes in the functional status of each fission product barrier; PA1 4. Adjustment of functional status definitions so as to yield distinguishable symptoms for each possible combination of barrier loss of function, i.e., confirm that the criteria for functional status corresponds to the objectives above; PA1 5. Evaluation of each accident addressed within the safety analysis report for the facility, in regulatory guidance regarding emergency events, and other potential emergency events to determine if the correlation between classification employing the number of fission product barriers breached corresponds to the perceived hazard of each possible accident; PA1 6. Assess each inconsistency to determine if the functional criteria for each barrier require adjustment, or if the perceived hazard stated in regulatory guidance or other documents is inconsistent with actual hazard and that the actual hazard is qualified by the approach to event classification; PA1 7. Evaluate the emergency operating procedures and event mitigating guidelines used by nuclear plant operators to identify the specific challenges to each fission product barrier which are of such a magnitude that prevention of barrier breach is unlikely, such that preemptive presumption of the associated fission product barrier's breach is appropriate, so as to augment emergency response activities at the earliest reasonable time, classifying as if the challenged barrier were breached prior to indications of actual breach. PA1 8. Development of final barrier functional criteria and definitions including preemptive conditions associated with barrier challenge which are deemed to constitute barrier breach; PA1 9. Description of the unique symptoms which correspond to each possible combination of fission product barrier breaches utilizing the results of Steps 1-8 in the symptom logic matrix; PA1 10. Programming of the symptom logic matrix for use on a control room computer. Programming the computer to automatically alert and notify offsite authorities (state and local government officials) of the emergency event classification. PA1 1. Recognition of symptoms; PA1 2. Implementation of mitigating actions as defined in emergency operating procedures; PA1 3. Correlation of symptoms to the logic matrix; PA1 4. Determination of the status of each fission product barrier; PA1 5. Classification of the emergency event. PA1 6. Direct concentration of mitigation activities on remaining functional fission product barriers. PA1 7. Notification of offsite authorities and plant personnel of the emergency event classification. PA1 D=Dose at the site boundary, set at 500 millirems per year; PA1 K.sub.i =Dose conversion factor for the radioactive material released; PA1 X/Q=Diffusion coefficients relating average meteorologic conditions to detection of a release as measured at the site boundary; PA1 f(L.sub.C)=a function of leak rate of containment; PA1 f(L.sub.RCS)=function of leak rate of the reactor coolant system; PA1 C.sub.RCS =Concentration of radioactive material in the reactor coolant system. PA1 One fission product barrier breached--Alert PA1 Two fission product barriers breached--Site Area Emergency PA1 Three fission product barriers breached--General Emergency Upon completion of the first part of the process as presented in Steps 1-10 above the objective of developing a functional definition for each fission product barrier is achieved and a set of facility-specific symptoms which correlate to each possible combination of fission product barrier status is defined in the form of a logic matrix. The logic matrix is programmed using a control room computer. These two results of the first part of the process constitute information necessary to accomplish emergency classification in real time at the nuclear station considered in the process. The second part of the process, represented in FIG. 4, is the application of the results of Steps 1-10 above in real time during an emergency event. The second part of the process accomplishes real time emergency event classification by the computer, by licensed nuclear plant operators, managers or other responsible technical personnel, by computer, or by plant personnel using the computer as an event classification decision aid. The second part of the process consists of presentation of and recognition of symptoms, correlation of facility symptoms to the barrier function criteria, description of the symptoms generated during the first part of the process to identify the fission product barriers breached, classification of the emergency event per the number of fission product barriers breached using the logic matrix, and automatic notification of offsite authorities. The process also identifies the fission product barriers which have been breached and are non-functional and identifies the remaining barriers for which efforts to mitigate degradation can be applied to prevent the release of large amounts of radioactive material to the environment. The real time application of the process consists of: It should be noted that the real time application of the process is a continuous looping process executed by the computer, by the operator, or by the operator using the computer as a decisional aid. Continuous assessment, comparison, recognition, mitigating procedure implementation, and classification are actions taken by the operator. Continuous assessment, comparison, recognition, classification and notification are actions taken by the computer. Live time variations in symptoms, errors, failures of equipment, or other considerations are updates to the process input information which are accommodated by cycling through the assessment, comparison, recognition, mitigation and classification process to yield an updated emergency event classification and overall assessment of the actual hazard to the health and safety of the public. This process is continued throughout the duration of the emergency event by the computer or by the operators. STEPS IN APPLICATION OF THE PROCESS To determine the severity of any event which occurs in a nuclear plant, implement the subject process as diagrammed in FIGS. 2 and 3. Input The inputs (30) consist of details which characterize a particular nuclear generating station; these details include specific plant characteristics, including plant system volumes, power levels, instrumentation types and ranges, equipment types, locations and orientations, performance characteristics of plant systems and components, and other basic information which are fixed parameters associated with each machine (nuclear power plant), such as plant operating requirements (34), plant accident analysis results (36), and emergency operating procedures (38). The process is generally as follows: Step 1 Functional criteria for each fission product barrier are quantitative definitions of barrier function established by the process. To establish the functional criteria the relationship of EQU Dose.alpha.f(L.sub.F).times.f(L.sub.RCS).times.f(L.sub.C) is employed. Specifically, the allowable leakage of either the reactor coolant system or the containment is initially chosen to be a specific value based upon plant characteristics associated with the particular nuclear power plant of interest. For all reactor types this leakage value is set significantly above allowable leakage rates permitted for continuous, normal plant operation. Generally, for pressurized water reactors the reactor coolant system leakage limit is determined by the pumping capability of the reactor water purification charging pumps. For boiling water reactors the leakage limit is determined by the ability of plant instrumentation to detect leakage within the containment with high confidence. Typical limits of reactor coolant system leakage are in the 100 gallon per minute range; however, plant-specific parameters determine the specific values for a particular plant. The function of each fission product barrier is to prevent the transport of large amounts of radioactive material to the environment. The adequacy of the barrier is demonstrated by the absence of an indication of such transport of radioactive materials. As a practical matter, limiting the amount of material which may be transported across each barrier is related to the characteristics of each nuclear power plant's site. If all fission product barriers are functional the consequences associated with the transport of radioactive material to the environment will be limited to a value below that stated in federal regulations which prohibit radiation doses to the public in excess of certain values. The process entails selection of allowable reactor coolant system leakage based upon system characteristics, the selection of containment leakage, and the calculation of the concentration of radioactive materials in the reactor coolant system which corresponds to and is indicative of loss of function of the reactor coolant system as a fission product barrier. The Code of Federal Regulations, Title 10, Part 20, identifies limits of exposure of personnel to radioactive materials. Exposures to the general public are to be limited such that the total exposure will be maintained below 500 millirems per year for an individual located at the boundary of a nuclear power plant site. A preliminary initial value of the containment leak rate which corresponds to a breach of the containment fission product barrier is selected to be four times the allowable total leakage permitted by Title 10, Part 50, Appendix J, or two percent by volume per day, by the process. The formulas EQU D=K.sub.i .times.X/Q.times.R EQU R=f(L.sub.C).times.f(L.sub.RCS).times.C.sub.RCS or, restating, EQU D=K.sub.i .times.X/Q.times.f(L.sub.C).times.f(L.sub.RCS).times.C.sub.RCS or EQU C.sub.RCS .alpha.(D)/f(L.sub.C) are used to determine C.sub.RCS where Since the values of f(L.sub.RCS) and f(L.sub.C) have been set at initial values related to plant system characteristics and requirements, the value of C.sub.RCS is determined employing the above relationship. Typical values of C.sub.RCS determined by this approach are in the range of 500 microcuries per cubic centimeter for power reactors. These initial values are employed as test values which are refined by the process to develop final criteria which define fission product barrier function. Step 2 The process utilizes input information to develop a detailed plant-specific diagram similar to FIG. 1 in which normal operating limits, normal operating conditions, volumes, system physical parameters, and specific monitoring parameters and their ranges of indication by specific instruments are identified. The result of this step is a composite diagram of all possible symptom indicators available within a nuclear generating station to aid analysis of any emergency event's actual level of hazard, using the process. These symptom indicators are related to the three fission product barriers by the process. Step 3 The response of each process parameter monitor is evaluated for an assumed breach of each fission product barrier. The response as a function of time is determined employing simplifying assumptions such as uniform instantaneous mixing, normal average plant conditions prior to the assumed breach, system performance at specified values, instantaneous transition from normal fission product barrier performance to a degraded condition, absence of equipment failure, and operation in accordance with license conditions. The existence of the three fission product barriers results in eight possible combinations of individual barrier failures. Each possible combination is evaluated on the basis of the results described. Step 4 The results of Step 3 are considered to determine if unique, pervasive, and unambiguous symptoms associated with each combination of barrier failure are attained. If such symptoms are not obtained the functional criteria associated with each barrier are modified either by increasing or decreasing the allowed leakage or parameter associated with determination of function. The process of Steps 2, 3, and 4 is repeated until the objective of determining unique symptoms is accomplished for each possible fission product barrier combination. Step 5 Upon completion of the development of a set of fission product barrier functional criteria which yield unique symptoms, the various accidents addressed in the facility safety analysis, regulatory guidance or commitments to regulatory guidance are evaluated to identify which if any of the fission product barrier criteria as determined in Steps 1 through 4 would be satisfied by the conditions associated with such events. Realistic accident analysis results are employed such that the comparison to barrier function is a comparison of best engineering estimates to the functional criteria. (Typical accident analyses are very conservative and as such tend to significantly overestimate the consequences of specific events. Best engineering estimates are employed in this evaluation of consequences of accident events so as to provide the most reasonable correlation to what would be experienced in real time during an actual event.) Step 6 The criteria for event classification by the process determines the number of fission product barriers which have been breached and relates the event classification to that number. Established regulatory guidance and agreements between federal regulatory agencies and individual utilities identify specific perceived levels of event classification for the various accidents addressed in Step 5. That perceived level of event classification is compared to the level of event classification determined in Step 5 employing the set of fission product barrier functional criteria developed by Steps 1 through 4. The objective of this comparison is to identify all direct agreements and inconsistencies between classification employing the functional criteria and perceived classification. Each inconsistency is evaluated to determine the actual level of hazard. Best engineering estimates are employed in the evaluation of each inconsistency to determine if the perceived hazard level of established guidance and agreements is correct. The influence of time is included in this evaluation, i.e., events which may result in subsequent degradation of safety, should no mitigating actions be taken, are evaluated to determine the best estimate of the relationship between safety degradation and time (without mitigation). Inconsistencies are either determined to be preemptive over-conservatisms or errors in the perceived hazard as noted in guidance or commitments, or deficiencies in the criteria associated with fission product barrier function. In the event of the identification of a deficiency in the criteria associated with fission product barrier function the process Steps 1 through 6 are repeated with modified criteria until all inconsistencies are removed or determined to be due to presumptive over-conservatism or errors in the guidance or commitments. Step 7 Commensurate with the performance of Steps 5 and 6, the emergency operating procedures for the nuclear generating facility are evaluated to identify symptoms which by best engineering estimates are indicative of conditions which indicate imminent degradation of safety as manifested by functional loss of a fission product barrier. (Example: Temperature indication above the fuel cladding temperature threshold for rapid strain-related clad creep due to internal pressure is indicative of the onset of rapid swelling and rupture of fuel cladding which will be manifested by a transport of radioactive material to the reactor coolant system at a near future time.) Such precursor indications to functional loss of fission product barriers are identified as additional conditions which are deemed to constitute indications of barrier breach and are added to the criteria of Step 1. The process Steps 1 through 6 are accomplished including such additional precursor indications. Step 8 The final fission product barrier functional criteria as determined by completion of the process Steps 1 through 7 above are identified and presented in a definitive statement for each fission product barrier. Step 9 A symptom description of each possible combination of fission product barrier breaches is developed employing those indications identified in Step 3 as being key indications of barrier function. Step 2 identified all possible indications; this step identifies those indications which are useful in determining the overall status of the three fission product barriers. Each indicator which responds to a fission product barrier breach as determined by Step 3 is included in the set of key indicators of barrier status. The response of each of these key indicators to the particular fission product barrier breach associated with the indicator is included in the symptom description of that barrier's breach. Upon completion of this step a logic matrix similar to FIG. 5 is developed. This logic matrix identifies each symptom which is indicative of status of any fission product barrier. The detailed logic matrix includes the conditional symptoms which when combined with other symptoms are also indicative of the status of a particular fission product barrier. The logic matrix enables programming of the computer to classify emergency events or to act as a decisional aid to the operator in classifying events. FIG. 4 presents the steps in real time application of the process. Step R-1. Plant emergency symptoms are recognized by the computer or by operators within the control room using plant process and radiation monitoring information related to the key indicators identified in the logic matrix (FIG. 5); Step R-2. Operators implement emergency operating procedures to mitigate the symptoms of the emergency event and to assess the magnitude of hazard to each fission product barrier. Symptoms which are indicative of conditions which cannot be mitigated prior to the breach of a fission product barrier are identified by such procedures. Such symptoms are additional input to the computer and are included within the computerized logic matrix. Step R-3. The computer and the operator correlate the composite of recognized symptoms to the specific symptoms listed in FIG. 5 and to the status of the three fission product barriers. Specific symptoms relative to the loss of each barrier are determined to exist or not exist. The logic matrix which describes the symptoms associated with all possible combinations of fission product barrier breach is used. Step R-4. The computer or operator assesses barrier status by reviewing of the correlation developed in Step R-3. The existence of a condition which by definition constitutes the breach of a barrier or the persistent indication of subsequent manifestation of symptoms indicative of fission product barrier breach are identified for each barrier. In addition, when only one barrier is functional, the computer or operator evaluates the relationship between indications, rates of change of indications, and mitigation activities to assess the capability to mitigate symptoms related to impending breach of the functional fission product barrier. The evaluation estimates the time remaining to barrier breach for the specific conditions indicated by the symptoms if such symptoms are associated with a degradation process which cannot be mitigated. When the time to barrier breach is less than the time required to implement offsite protective actions the condition is presummed to be indicative of barrier breach and breach of that remaining barrier is deemed to occur for the purpose of event classification. Offsite protective actions include notification of offsite authorities, mobilization of emergency response personnel, and evacuation of the general population at risk due to the event. Step R-5. The computer and the operator classify the emergency event by counting the number of fission product barriers which have exhibited definitive indications of an imminent loss of function, and then applying the following relationship: Step R-6. Operators direct their mitigation activities toward the remaining functional fission product barriers so as to optimize the level of protection from release of radioactive materials to the environment. Step R-7. The computer automatically alerts offsite authorities and notifies them of the emergency classification determined by the process. Examples of symptoms which are identified to be indicative of barrier breaches are noted in the table in FIG. 5. Some of the exemplary symptoms which are identified and sensed provide indications of one or more barriers breached and some symptoms when compared to normal indications provide indications of one or more specific barriers breached. The absence of such symptoms indicated no barriers breached, which is the desired condition. In preferred embodiments of the invention, the conditions are identified so that the sensing of conditions associated with breaches provide at least orders of magnitude increases in indications or off-scale indications in comparison to normal conditions so that a positive response follows rather than just an indication of a slight change in measured parameters. The preferred response includes the controlling of signaling which in alternative embodiments is the off-scale indications of groups of indicators, lamps, sound, printer, computer display and telecommunications of particular barriers breached and of levels of emergency according to numbers of barriers breached. In particular embodiments of the invention, signals are given upon the sensing of identified conditions which are positive identifications of impending breach of one or more barriers. In preferred embodiments of the invention, the mitigating activities controlled by the response are the controlling and setting up of machines and circuits to transfer heat specifically by depressurizing and/or adding water. In preferred embodiments of the system, the mitigation equipment operates machines and sets up circuits to use functional unbreached barriers. Once the mitigation equipment has begun functioning the equipment continues to function until conditions within the plant permit repair of the breached barrier to a fully functional status. While the invention has been described with reference to specific embodiments, modifications and variations of the invention may be constructed without departing from the scope of the invention. The scope of the invention is defined in the following claims.