Panel Session: Reliability of Passive Systems

Passive systems are embedded into the nuclear technology safety and design. In relation to safety, accumulators are one example of vital passive systems strictly needed to mitigate consequences of Large Break LOCA. In relation to design, the configurations of both PWR and BWR primary system is based on natural circulation: the mutual positions of core and steam generators in the case of PWR and the elevation of the feed water nozzle in the BWR vessel are determined to ensure (at least) removal of decay heat when active systems noticeably, centrifugal pumps are not available.

Immediately after the Chernobyl accident in 1986, the passive systems received new attention by industry and scientists.

Therefore, the importance of passive systems is well established in nuclear technology. Here one may add that passive systems include components like valves, pipes, heat exchangers and phenomena like draining of a tank, formation of incondensable gas bubbles, stratification and natural circulation. The discussion about reliability of passive systems shall include the components and the phenomena: a more detailed list of subjects can be found in the call for participation to the session. Special focus is given to the reliability of thermal-hydraulic phenomena expected during the operation of passive systems.

The topic of reliability of phenomena occurring in passive systems was introduced before the year 2000, merging ideas from PSA and thermal-hydraulics.

Passive systems and associated phenomena, other than accumulators and related discharge, range from density locks, to bubble condenser, to CMT circulation and draining, to containment shell cooling by falling liquid film. Even a comprehensive list of passive systems and associated-expected thermal-hydraulic phenomena is beyond the boundaries for the present notes.

Focus is given below to natural circulation (NC); in this case, system layout and geometry constitute key parameters: here attention is given to well-designed NC systems.

NC implies the use of gravity force for transferring thermal power from an assigned heat source to an assigned heat sink. The driving forces depend upon differences in fluid density between a rising side, referred as chimney, and a descending side, referred as down comer. When water is used as acting fluid assuming typical (design detail) elevation differences between source and sink, driving head expressed in meters of liquid water at ambient pressure and temperature is of the order of 10-1 and 100, when single-phase and two-phase conditions are concerned in the system design, respectively. Those values should be compared with values of the same quantity in the range 101÷102 when (typically centrifugal) pumps are installed in similar loops, called forced circulation (FC) loops, designed to transfer the same thermal power from the source to the sink. Noticeably, same thermal power is transferred by NC and FC loops with differences in driving forces for two or three order of magnitude.

Personal connection with NC

At the beginning of my professional engagement as researcher at University of Pisa, end of 70’s, I had the task to (contribute to) design a loop to simulate SBLOCA in BWR (the loop, named PIPERONE was also used for OECD/NEA/CSNI ISP 21).

1^st connection: The NC between core and down comer with decreasing down comer level is the key phenomenon for designing the loop. A scaling procedure brought to the design of the loop (full height, full linear power of electrical heaters in the ‘after-scram’ conditions) and the boundary conditions for the experiments.

2^nd connection: The occurrence of the Chernobyl accident in 1986 caused the stop of the ‘current’ nuclear program in Italy, but doors remained open for innovation. In this context, new reactor proposals like AP-600 and SBWR received (financed) attention in the Country and preparatory experiments were performed (in PIPER-ONE facility) to simulate the ‘new’ passive systems. Other than official documents reporting results of planned-financed experiments, at least three ‘measured facts’ could not receive sufficient attention and a suitable documentation:

1. Once dry-out occurs in a NC system (LWR core type) gravity driven NC may not be sufficient for reflood, or local pressure drop at QF location may reveal greater than the available gravity head.
2. Connecting two reservoir tanks at different elevations with proper siphons to prevent draining of liquid from the high elevation tank in the low elevation tank is not effective when the piping is heated up and so the liquid in the lower siphon: chugging with violent flashing trigger unstable NC and mass exchange between upper and lower tank.
3. Instability is the ‘normal’ condition in a boilingcondensing NC system: this also includes the detection of ‘standing’ (or not propagating) oscillations: as a difference from typical DWO which imply propagation of pressure waves from the bottom to the top of the core region, standing oscillations were measured (in the course of a NC experiment) such that pressure at the inlet and the outlet of the heat source was constant but pressure drops inside the heat sources were oscillating with maximum amplitude in the region of highest linear power.

Notes about NC systems

Two complementary and interconnected aspects are discussed below:

1. The NC system design and operation;
2. The NC system reliability associated with the NC phenomenon

NC system design and operation: A nearly infinite number of NC systems can be designed including mutual locations of heat sink and heat sources: these can be found in the literature and include a variety of sketches (e.g. continuous change in the piping inclination brings to the ‘infinite’ number). Each geometry fixed loop may have another infinite number of configurations where pressure drops and heat transfer coefficients are (continuously) changed (e.g. smooth or sharp edges, differences in equivalent diameter when flow area is not changed, different materials, etc.). Furthermore, each ‘final’ NC system may operate in an infinite number of locations within a multidimensional space identified by quantities like pressure, temperature, velocity and density.

Finally we do have:

• Infinite layout/geometry configurations;
• Infinite pressure-drops-&-material configurations;
• Infinite operational points within a multi-D variable space.

Therefore, different degrees of freedom do exists when designing a passive system and not all designs work satisfactorily. For instance, if one builds a chimney in a room to burn wood for possible radiation heating, he may get smoke in the room and little heating if many parameters are not considered. Even worse, the chimney may work in some circumstances and, when the weather changes smoke suddenly enters the room.

Here we deal with well-designed NC systems (WDNCS) simply stating that “WDNCS=system working satisfactorily for a given (eventually narrow) range of operating conditions” and not entering into the question “how to get a WDNCS (?)”.

WDNCS suffer of the following characteristics drawbacksdesign/ operational level:

1. Actual operational conditions necessarily move outside the range of conditions for which the system works satisfactorily: this is due to the multi-D space of operating conditions and the impossibility to test at the design level all possible combinations of parameters [the SOAR on BWRS gives an idea of the number and sources of instability in a thermalhydraulic loop].
2. Current technology advancements do not allow the evaluation of important parameters with sufficient precision (e.g. HTC, pressure drop coefficients at geometric discontinuities, etc.) to establish whether any operational point is stable or unstable.
3. Once outside the (narrow) operational conditions, the operation of a WDNCS may become unstable (see the item below for a noticeable situation).
4. A typical WDNCS designed for externally driven-supplied thermal flux (e.g. constant) may become unstable when the same heat flux is a (even weak) function of system parameters (e.g. HTC function of fluid velocity).
5. Coupling two stable WDNCS may lead to an unstable (coupled) system.

A FC system may also be affected by the same drawbacks; however, the availability of a (powerful) engine causes a negligible impact of the same drawbacks upon the targeted system operation. The (in-principle) advantages of WDNCS over FC systems are not discussed here.

NC system reliability: Before introducing the concept of reliability of a passive system let’s make a distinction among the terms accuracy, uncertainty and reliability (better to say, what we do mean here; rather than rigorous definitions, attributes of those terms are stated below).

Accuracy implies the comparison between two data (sets), typically, calculation results and experimental measures. The accuracy is a known error. Uncertainty refers to a computational tool or, better, to a calculation performed by a computational tool. The uncertainty is an unknown error. Reliability refers to a system, namely to phenomena occurring during the operation of WDNCS.

The evaluation of reliability of passive system needs a computational tool. It is assumed (or expected) that the concerned computational tool is qualified: this also implies that accuracy results are available for the operational conditions of the WDNCS and related values are smaller than threshold values (e.g. typically sufficient to correctly calculate stable or unstable system performance). In this situation the uncertainty of the prediction is negligible.

This statement does not ‘cover’ the following potential errors:

1. The error associated with the values of the pressure drop coefficients; those values constitute an input for the code; in other terms the code capabilities are acceptable if proper values are supplied (therefore the possible error in estimating the value of local pressure drop coefficients shall be part of a reliability analysis, see below);
2. The prediction of fluid motion at very low Re numbers or very small velocities like those occurring rat start-up of NC or following stability events when flow reversal and restart may occur.

Furthermore, as already mentioned, the reliability of components part of WDNCS is not addressed by the present notes (e.g. probability of opening of a valve following a signal, possibility of piping rupture owing to thermal stress after the start of NC, etc.).

A sample (not exhaustive) list of parameters affecting the reliability of (thermal-hydraulic phenomena expected during the operation of) WDNCS is provided below. As a result of any of the listed items, the capability to remove thermal power from the heat source is prejudiced.

1. Instability occurrences (see the discussion in the previous section).
2. Presence of small fractions of incondensable gases which may prevent the triggering of NC or stop the on-going NC flow rate.
3. (Very) minor inclination pipe designed to be horizontal. For instance, following the installation of an originally designed horizontal pipe feeding a heat exchanger (heat sink) an inclination may occur (within construction tolerances) towards the heat exchanger or towards the heat source: liquid in the possible mixture at the inlet of the horizontal pipe will behave very differently depending upon the inclination and the overall NC phenomenon is affected.
4. Heat losses (like heat transfer in the rising part of a chimney in a room) may largely affect triggering of NC and the flow rate during NC.
5. Small leakages from large isolating valves (e.g. MSIV) are tolerated: however, when the MSIV closure is needed to allow the operation of any NC system (e.g. SG cooling) the leakage may stop the NC flow rate.
6. The local pressure drop coefficients (same discussion may apply in relation to the roughness of a pipe) are known with some error: the error may have a large impact upon the predicted NC flow rate.
7. A similar observation as in the previous section applies here: a FC system may also be affected by the same drawbacks; however, the availability of a (powerful) engine causes a negligible impact upon the targeted system operation.

Passive systems alone (e.g. those based on NC), with noticeable exceptions (e.g. accumulators in case of LBLOCA), appear inconsistent with the requirements of DiD in nuclear reactor safety. Rather a good design of NPP (e.g. new reactors and SMR) implies proper consideration of passive features which must support the unavoidable operation of active (e.g. pump based in the case of NC) systems.

Furthermore,

1. Reliability analysis of passive system performance is needed.
2. Thermal-hydraulic system codes are suitable to perform reliability analyses.
3. Uncertainty of a calculation should be distinguished from the reliability of a passive system.
4. (Minor) errors in the values of pressure drop coefficients at geometric discontinuities shall be part of reliability analysis.
5. A systematic evaluation of code capabilities is needed, with main reference to the situations at very low Re number.
6. Regulatory framework may need amendments for the acceptance of passive systems.