OECD “International Workshop on Level 2 PSA and Severe Accident Management”, Koeln,
Germany, March 29-31, 2004
Examples for the Influence of Specific Plant Features on PSA
Gesellschaft fuer Anlagen- und Reaktorsicherheit (GRS) mbH,
Schwertnergasse 1, D-50667 Koeln, Germany
Based on the experience with previous PSA Level 2, five examples are shown for specific plant
features which might easily be overlooked, but which can significantly influence accident progression
and PSA Level 2 results:
Closed drain openings at the bottom head of the RPV
RPV support skirt in a BWR
Ventilation ducts in the concrete floor below the reactor cavity
Position of the exhaust from the containment venting system
natural draft driven mass flow through the stack and the ventilation system
These issues had not been on the agenda at the beginning of the PSA. They rather had been detected
later during the PSA process. The lesson learnt from these unexpected issues is that the PSA team
should be given sufficient time to familiarize with the plant and that it should have resources available
to deal with uncommon topics.
LWR, severe accident, PSA, plant specific, core melt, containment, Germany, safety analysis
In recent years GRS has performed a PSA level 2 for a BWR with concrete containment and an inner
steel liner of the 1300 MWe class , for a 1400 MWe PWR of the “Konvoi” type , and presently a
PSA level 2 is being done for a 960-MWe BWR with steel containment. These analyses have been
performed within various contracts, commissioned by federal ministries.
Detailed knowledge of the plant design is one of the important prerequisites to perform an adequate
PSA. However the limitation of resources does not always allow to dig deeply into construction plans
or to do an in-depth plant inspection. Moreover, the plant details which may turn out to be important in
the realm of Level 2 PSA may not be subject to the same attention which is common for systems and
components related to the design basis. Many years after the construction of a plant, details which are
not important for the safe routine operation or for design basis accidents may be difficult to find out.
Therefore there is a risk to bypass or ignore plant specific information which might be essential.
The resources which have to be spent for PSA Level 2 are considerable. Therefore a strong incentive
exists to transfer existing PSA knowledge from one plant to another. This may be valid for some parts
of the PSA, for example for computer code simulations of core melt progressions if the reactor coolant
system is similar. However the examples which will be given in this presentation should be understood
as a warning that the similarity between two plants have to be checked very carefully before results
can be transferred.
Based on the experience with previous PSA Level 2, five examples will be shown for specific plant
features which might easily have been overlooked, but which can significantly influence accident
progression and PSA Level 2 results.
2 Closed drain opening at the RPV bottom of a BWR determines failure
mode of RPV lower head
The bottom head of a BWR has many penetrations for control rods and for instrumentation. Accident
analyses routinely address the question whether core melt which has relocated into the lower head will
locally penetrate these positions and cause a failure of the RPV lower head. The general perception is
that core material will partly penetrate into these structures, but then freeze out, and form some kind of
crust and plug. Therefore a local and early failure of the RPV bottom at these penetrations might not
be very likely.
In a PSA for a German BWR of the type 72 , considerable resources had already been spent on the
issue of the failure of control rods and instrumentation tubes under core melt attack when another kind
of penetration was detected on a drawing of the bottom head. During the production process this
opening had been introduced right in the center of the lower head. Obviously later it turned out that
this opening was not needed, so it had to be closed. A kind of closed pipe stub was positioned above
this opening from inside the RPV (see fig. 1). It is practically impossible to see this closed opening
during a plant inspection.
This particular detail has the following consequences:
- At this position the RPV bottom has practically no resistance against a core material attack.
Analyses of the resistance of other penetrations are meaningless.
- RPV failure at this local position will occur very soon after core melt relocation into the lower
head. This has strong influence on the PSA results.
- It is impossible to protect this penetration by external cooling of the RPV. Thus any
discussions about flooding the RPV from below as a mitigation measure are obsolete.
- This reactor had a large fraction of core melt accidents at high RPV pressure. Since the local
RPV bottom failure at this position is certain, there is no later large scale high pressure failure.
The overall risk of the plant is reduced by this particular penetration.
Fig. 1: Drawing of RPV lower head with detail E (closed drain opening)
Summary: A plant specific detail - a closed opening/hole in the RPV lower head - determines
the RPV failure mode under melt attack.
3 RPV support structure of a BWR influences lower head coolability
The RPV of a BWR is supported by a conical steel skirt. Flooding of the room below the RPV and the
part of the drywell which extends along the cylindrical RPV shell is foreseen as a mitigation measure
which might prevent or delay the failure of the RPV bottom under melt attack. The numerous
penetrations at the lower head would be cooled by water from the outside, so their failure under melt
attack from the inside might at least be less likely. (This reactor has not the type of uncoolable
penetration mentioned in the section above.) If the steel skirt is closed along the whole circumference,
obviously the outer upper corner of the RPV bottom cannot be reached by water, because a gas bubble
is formed during flooding of this room (see fig. 2).
For the PSA study we performed, the plant drawings did not give us decisive information on this issue.
During the shutdown phase of the reactor plant, personnel was requested to inspect this location. The
situation which was encountered by the staff is as follows: There is one rather large inspection opening
within the support skirt. This opening is closed by a bolted steel plate. The seals of this plate do not
seem to be perfectly tight. The upper edge of the opening does not completely reach the uppermost
corner of the gas space within the support skirt.
Within the PSA this has the following consequences:
- There is a small volume above the opening which can never be reached by water. But the size
of this uncoolable space might be small enough to have no significant effect on the overall
- Since the seals of the opening in the support skirt are not gastight, water from below will
gradually replace escaping gas und finally will reach the upper edge of the opening. Thus
almost the whole RPV bottom will be wetted.
- If steam is produced at the RPV lower head outside, the leaks of the seals are not sufficient to
let all this steam pass. Therefore the steam would replace the water and consequently this part
of the RPV bottom cannot be cooled.
- Without flooding the most likely failure mechanism of the RPV bottom is a local leak at a
penetration. With flooding the most likely failure mechanism is a large rupture along the
upper circumferential ring which has the poorest cooling conditions (see above). To some
extend it is questionable whether it makes sense to flood the room below the RPV up to that
Summary: The existence and status of openings, covers and seals in the RPV support skirt influences
the coolability of the RPV lower head and the RPV failure mode.
Fig. 2: RPV support skirt with uncoolable upper edge
4 Ventilation ducts in concrete basemat below reactor cavity determine
corium relocation and possible containment failure in a PWR
Most drawings of the reactor building and the containment do not show details about ventilation ducts,
drain lines or cable ducts which may be imbedded in the concrete structures. In a PSA for a German
PWR , core concrete analyses at first assumed that there is a massive concrete basemat below the
reactor cavity. When a detailed input data set for a containment analysis was prepared it turned out
that there is a network of ventilation ducts embedded within the concrete (see fig. 3). These ducts have
significant cross sections (about 30 cm x 50 cm). Further investigations revealed that these ducts
together with pressure equalizing flaps in the lower part of the cavity determine potential pathways for
the core material which had not been envisaged before.
Fig. 3: Ventilation ducts in concrete below reactor cavity determine corium relocation in a PWR
In the PSA the situation after RPV bottom failure was evaluated as follows:
- Initially the reactor cavity is dry, pressure equalizing flaps have been pushed open, allowing
the ventilation ducts to be filled with sump water.
- Core concrete interaction in the dry cavity reaches the ventilation ducts a few hours after RPV
failure, probably at various locations.
- Core melt will enter the ventilation ducts and water will flow from the ducts into the cavity.
This contact between sump water and corium is much earlier than former analyses without
ventilation ducts predicted. In the former analysis only a radial erosion of the cavity structure
may have led to sump water ingression.
- The relocation process of the core melt within the ducts is difficult to evaluate. There is a
certain probability that corium reaches the containment sump.
- In the containment sump the core melt will fill up a local cavity, size about 1 m³. This part of
the melt is not coolable, and it is situated above the thinnest part of the concrete. This might
be the position of the first penetration of the containment steel shell which is embedded in the
- There will be long lasting interactions between core material, concrete and water, which will
continuously create corium particles floating in the sump water. Parts of the particles will
settle into the sump suction lines, creating a particle bed in the line outside the containment.
There is a certain probability that this particle bed dries out, heats up and threatens the
integrity of the sump suction line. This would mean a failure of the containment.
Summary: The network of ventilation ducts in the concrete basemat below the reactor cavity will
determine sump water access to the core melt in the reactor cavity and it influences further relocation
of the core melt, including potential containment failure modes.
5 Hydrogen threatens containment venting system
In a PSA for a German PWR of the 1400 MWe class  it was concluded that there is a significant
probability for a sustained core concrete interaction after RPV bottom failure. This interaction creates
a large amount of noncondensible gases, e. g. hydrogen and carbon monoxide. Since the containment
is equipped with passive autocatalytic recombiners (PARs), these gases will be oxidized in a
controlled manner, practically excluding containment failure due to pressure loads of a global ignition.
The production of gases and the recombination process is so powerful that the oxygen will be used up
at some time (approx. within 24 hr after RPV failure). With core concrete interaction still going on, the
hydrogen and carbon monoxide will accumulate in the containment atmosphere.
When the containment venting (mitigation measure) will be initiated after some days, the atmosphere
typically contains about 10% of hydrogen, 75% of steam and the balance is mostly nitrogen. This
mixture is led through a water filled venturi scrubber where the steam condenses. Consequently
downstream of the venturi scrubber the hydrogen volume fraction is about 40%.
In most German plants the venting discharge is led in a separate pipe to the top of the stack. Therefore
the risk of hydrogen burns exists only at the top of the stack which seems to be insignificant. Since the
PSA team knew this situation in other plants it at first did not realize that the plant under investigation
is different. So the team initially concentrated on the availability and reliability of the venting process,
including human actions. Later during the process it was discovered that the label “KLE79” on the
system drawing does not mean the stack (as had been assumed), but that it is the air exhaust system
This has significant implications.
In this particular plant under consideration the gas flow from the venting system is discharged into
exhaust air ventilation ducts on the roof of the auxiliary building which lead to the stack. It is almost
inevitable that in these ventilation ducts or in the stack highly inflammable mixtures develop. The
discharge from the venting system will last for a long time (24 hours according to system
specification) so that there is a high probability for a ignition.
The consequences of such a hydrogen burn are difficult to evaluate. At least the ventilation ducts will
fail, so that the release height is at the roof level of the building instead at the stack. More severe
consequences would be a damage to parts of the building, including the venting filter system, leading
to an unfiltered release. Large scale building damage and/or damage at the stack (which serves not
only this unit, but also another unit on the site) cannot be excluded.
Summary: The plant specific exhaust position of the containment venting system may lead to
hydrogen burns which would influence location (by damage to ventilation lines) and amount (by
venting filter failure) of releases to the environment.
6 Natural draft driven gas flow through the stack determines fission
After melt through of the bottom of a steel containment in a German BWR the melt together with
gases is released into a room of the reactor building. The containment failure at a higher pressure
causes a pressure wave in the building. Later, core concrete interaction produces hydrogen, which may
ignite and lead to another pressure peak. Detailed simulations of the accident progression demonstrate
that a number of doors will be damaged, creating a flow path between the interior of the building and
the environment. Pressure relief flaps on top of the turbine hall open for a short period only and close
again soon after the initial pressure wave is over.
The reactor under consideration has check flaps in the off-gas ventilation ducts leading from the
buildings into the stack. The opening direction of the flaps is towards the stack. In normal operation
these flaps are pushed open by the working fans. When the fans are shut down (as is the case in severe
accidents) one might assume that the flaps close. In this situation at first sight it seems obvious that the
release of fission products into the environment is through the damaged doors.
To evaluate the threat due to hydrogen and the fisson product transport within the various buildings, a
detailed model of the plant had been set up for the integral code MELCOR and the containment code
COCOSYS. These accident simultions, including the stack, showed that the natural draft developed by
the stack is so strong that the check flaps would be pushed open. Moreover the continuous release of
gases through the stack leads to a small sub-pressure in the buildings resulting in an inward flow from
the environment into the buildings through the damaged doors. The large volumes of the buildings and
the long way for the fission products into the stack lead to a significant reduction of the releases. In
addition, the releases at the stack outlet are much more elevated than at the damaged doors. Both
factors will lead to reduced radiological consequences in the environment.
Conclusion: The plant specific combination of stack height, opening pressure of the ventilation check
valves, and failure resistance of doors inside the building influence amount and location of fission
product release into the environment.
Five examples for plant specific features are given which can significantly influence the results of a
PSA level 2:
- At the bottom of the RPV closed drain openings may exist. The type of closure or plug can
determine the kind of RPV failure under melt attack, rendering obsolete any discussions about
core melt behavior in the RPV lower head or about RPV bottom coolability.
- The particular construction of the RPV support structure in a BWR could prevent RPV
cooling by flooding from below, even if the water level extends well above the RPV bottom.
This would as well influence the RPV lower head failure mode.
- In the concrete floor below the reactor cavity ventilation ducts may exist. When the concrete
erosion due to core melt reaches these ducts, the further melt progression and corium
distribution will be determined by these ducts.
- The hydrogen production during a molten core concrete interaction may jeopardize other parts
of the plant, if the containment venting system is not designed properly to cope with this
threat. This is valid even if the containment is equipped with hydrogen recombiners.
- The reactor building and turbine building in connection with the stack and the ventilation
system can produce a natural draft which directs radioactive releases through the stack, even if
the buildings have leaks at ground level and the ventilation fans are shut off.
It is interesting to note that these issues had not been on the agenda at the beginning of the PSA. They
rather had been detected later during the PSA process. There is no guarantee that further issues are
lurking which at present are not yet taken into account.
The lesson learnt from these unexpected issues is that the PSA team should be given sufficient time to
familiarize with the plant and that it should have resources available to deal with uncommon topics.
 Löffler, H.: Probabilistic and Deterministic Analysis of Severe Accidents for a Boiling Water
Reactor, 4th International Conference on Probabilistic Safety Assessment and Management
(PSAM), Sept. 13-18, 1998, New York City, USA
 Gesellschaft fuer Anlagen- und Reaktorsicherheit (2001): Bewertung des Unfallrisikos
fortschrittlicher Druckwasserreaktoren in Deutschland, Entwurf zur Kommentierung, GRS-175,