Updating of local blockage frequency in the reactor core of SFR and PRA on consequent severe accident in Monju

ABSTRACT

Fuel subassemblies of sodium-cooled fast reactors (SFRs) are densely arranged and have high power densities. Therefore, the local fault has been considered as one of the possible initiating events of severe accidents. In the conventional analyses for the license of Japanese prototype SFR (Monju), according to the local fault evaluation under the condition of one sub-channel flow blockage in the analyses of design basis accident (DBA), it was confirmed that the pin failures were limited locally without severe core damage. In addition, local flow blockage of 66% central planar in the subassembly was historically investigated as one of the beyond-DBAs. However, it became clear that these deterministic analyses were not based on a realistic assumption by experimental studies. Therefore, probabilistic risk assessment on local fault which was initiated from local flow blockage was performed reflecting the state-of-the-art knowledge in this study. As a result, damage propagation from local fault caused by local flow blockage in Monju can be negligible compared with the core damage due to anticipated transient without scram or protected loss of heat sink in the viewpoint of both frequency and consequence.

KEYWORDS:

• SFR
• sodium-cooled fast reactor Monju
• fuel subassembly
• probabilistic risk assessments
• sever accident
• local fault
• local flow blockage
• core damage frequency

1. Introduction

Local fault accidents have been considered as one of the possible causes of core-disruptive accidents or severe accidents in sodium-cooled fast reactors (SFRs) due to the generally densely arranged fuel pins in the fuel subassemblies. Therefore, safety evaluations have been performed on local fault for the licensing of the Japanese prototype SFR assuming local flow blockage and local overheat of fuel element as representative phenomena [1]. A planar and impermeable blockage of 66% of total flow area in the fuel subassemblies for local flow blockage and improper overpower of 200% for overheat of fuel element were assumed as hypothetical initiating events. These conservative evaluations revealed that fuel pin damage would be limited within a restricted area of the reactor core. However, the initiating events and their magnitudes for local fault vary widely, and the flow of event branches in a number of steps in the detections of abnormality. Thus, drawing up of event tree and its branching probabilities is necessary to overview the local fault. The quantitative evaluations of core damage frequency (CDF) for the local fault are required to compare with the other accident sequences in order to decide the representative accident sequence of the severe accidents. Therefore, probabilistic risk assessments (PRAs) of the local fault caused by the local flow blockage were performed for Japanese Prototype SFR ‘Monju’ in this study. Although the PRAs of local fault have been performed in many countries for SFRs [2–7], following points were focused and advanced in this study.

•	The frequency of initiating event which causes local flow blockage was newly calculated based on the operating experiences of SFRs in the world until now.
•	Fault tree analysis considering human error and failure of equipment was conducted based on the emergency response which is the predetermined action of human and equipment for the alarm described in the operating manual.
•	The branching probabilities were decided in the PRA of the local fault caused by the local flow blockage considering the new knowledge obtained from the experimental research about the formation mechanism of the local flow blockage [8].

As a result, comparisons were enabled by the PRA of the local fault caused by the local flow blockage for Monju with that of the anticipated transient without scram (ATWS), protected loss of heat sink (PLOHS), and the local fault caused by the adventitious fuel pin failure [9].

2. Initiating event

The initiating event for local flow blockage is defined as abnormal flow reduction in a single subassembly of the reactor core by mixing with foreign substances into the subassembly. The frequency of initiating event for local flow blockage was evaluated in three steps which are described in Sections 2.1, 2.2, and 2.3.

2.1. Frequency of mixing with foreign substances into the subassembly

Mixing with foreign substances into the subassembly is caused by mixing with foreign substances into the primary system including reactor core. It may be difficult to detect completely all the instances related to the former (i.e. mixing into the subassembly) because very small substances cause no change in core parameters such as flow rate, temperature, etc. but it is possible to survey the causal abnormal event associated with the latter (i.e. mixing into the primary system) because it is easy to detect the causal event such as air leak due to failure of a certain component. Therefore, at the first step, we focus on mixing with foreign substances into the primary system, which might flow into subassembly; we surveyed operating experiences of 10 reactors: i.e. Joyo, Rapsodie, KNK-II, EBR-II, Fast Flux Test Facillity (FFTF), Prototype Fast Reactor (PFR), BN-600, BN-350, and S-Phenix. The result is shown in column B in Table 1. There are nine instances of mixing with foreign substances into the primary system which might be mixed into the subassembly. Then six of them were judged as not applicable to Japanese Prototype SFR ‘Monju.’

Table 1. Frequency of mixing with foreign substances into the primary system.

	A	B	C
	Operation	Number of experiences	Number of cases
	time	mixing with foreign	applicable
	(Ry: reactor year)	substances (—)	to Monju (—)
(1) JOYO	8.1	1	0
(2) Rapsodie	–	1	0
(3) KNK-II	2.21	0	0
(4) EBR-II	17.1	0	0
(5) FFTF	5.9	0	0
(6) PFR	4.97	1	1
(7) Phenix	14.39	4	0
(8) BN-600	25.7	0	0
(9) BN-350	3.61	0	0
(10) S-Phenix	1.44	2	2
Total	83.42^a	9	3

^aOperation times of (2) Rapsodie were not taken into account for calculation of summing up the operation time of all listed plants in this table.

Two of the remaining three instances (i.e. mixture of oil–sodium reaction products, and aerial mixture to a cover gas (CG) system) were counted conservatively because these types of failure and human error are common, and an effort to prevent them is taken but they could not be eliminated. Although these two might cause anomaly not only in a specific subassembly but also in a whole core, we can evaluate only the severest subassembly in terms of event progression and detection of anomaly as an initiating event for local flow blockage.

The other case was conservatively accounted for the possibility of mixing loose parts which is used in the fabrication stage into the primary system in this study. However, in Japanese Prototype SFR ‘Monju,’ rubber plug is not attached to the subassembly so that a total instantaneous blockage in the subassembly cannot occur due to the same cause.

Frequency of mixing with foreign substances into the primary system was calculated as 3.60 × 10⁻² Ry⁻¹ which corresponds to 2.55 × 10⁻² Ry⁻¹ for calendar time at Monju. This value was calculated by the total of column ‘C: Number of cases applicable to Monju’ divided by the total of column ‘A: Operation times’ in Table 1, and multiplying the load factor. The load factor of Monju was assumed to be 0.71 based on the presumption of 148 days of operation in a cycle and 60 days of interval for periodic inspection and refueling as an average [7]. In this calculation, the operation times of Rapsodie were not taken into account for the total of column ‘A: Operation times’ in Table 1 conservatively as described in Section 2.1.2. Rapsodie (experimental reactor, France).

In this paper, we assumed this numerical value as the frequency of mixing with foreign substances into the subassembly.

2.1.1. Joyo (experimental reactor, Japan)

The operation period is 8.1 reactor years [10]. The Upper Core Structure was damaged due to the disconnection of the irradiation test subassembly named MARICO-2 (Material Testing Irradiation Rig with Temperature Control) in November 2007. In-vessel observation revealed that six pins to connect the handling head and the wrapper tube joint of the MARICO-2 were disconnected [11]. However, this case is not applicable to Monju due to the uniqueness of the initiating incident for this experimental reactor.

2.1.2. Rapsodie (experimental reactor, France)

The operation period was 16 years from 1967 to 1983, but the load factor of this plant was not available in this study. Then, the operation times of this plant were not taken into account conservatively for the frequency estimation of mixing with foreign substances into the primary system. But the following incidents were considered.

The subassembly, Capricorn 1b, failed during the power increase to 20% of full power detected by delayed neutron detector, acoustic, thermocouple, and other signals. The cause was attributed to the dislocation of a templug holder; two pins failed and released small amount of fuel (5 g) into the sodium [12,13]. This case also is not applicable to Monju as well as Joyo.

2.1.3. KNK-II (experimental reactor, Germany)

The operation period which can be confirmed from the plant history [2] is 2.21 reactor years according to the database of Power Reactor Information System (PRIS) from International Atomic Energy Agency (IAEA) [14]. The event of mixing with foreign substances could not be confirmed from the report [2].

2.1.4. EBR-II (experimental reactor, United States of America)

The operation period was 17.1 reactor years according to the Component Reliability Database System for LMFBRs (CORDS) developed with Japan Atomic Energy Agency (JAEA) [15]. Local fault evaluation was performed in 1994 for the safety evaluation of the power reactor innovative small module (PRISM) based on the EBR-II experience [16]. However, there are no reference data about the occurrence of mixing with foreign substance in the report.

2.1.5. FFTF (experimental reactor, United States of America)

The operation period was 5.9 reactor years according to the database of CORDS developed with JAEA [15]. Local fault evaluation was performed in 1994 for the safety evaluation of PRISM based on the FFTF experience [16]. However, there are no reference data about the mixing with foreign substance in the report.

2.1.6. PFR (prototype reactor, United Kingdom)

The operation period was 4.97 reactor years according to the database of PRIS [14]. At the end of 1991, PFR was shut down since 29 June when the reactor was manually tripped for overheating of the top bearing of primary sodium pump 2. The cause of the overheat was considered to be the spill from the filter on primary sodium pump 2 valve due to high pressure difference from the blocking by oil–sodium reaction products. It is also considered that partial blockage of the pump casing overflow pipe led to the problem [17]. This case is counted as one time during operation period which is applicable to Monju.

2.1.7. Phenix (prototype reactor, France)

The operation period was 14.39 reactor years according to the database of PRIS [14]. In the summer of 1989, three emergency shutdowns were activated by negative reactivity signals. An analysis of the three events revealed that six purging systems of subassemblies located in the diagrid were blocked by impurities [18]. Corrective measures were taken in order to avoid the presumed phenomena which would induce the emergency shutdowns. Nevertheless, similar event occurred again in September 1990 [17]. Thus, this case should not be counted in the uncertain cause.

2.1.8. BN600 (prototype reactor, Russia)

The operation period has been 25.7 reactor years according to the database of PRIS [14]. The event of mixing with foreign substances could not be confirmed from the published report [17].

2.1.9. BN350 (prototype reactor, Republic of Kazakhstan)

The operation period was 3.61 reactor years according to the database of PRIS [14]. Only data in post-Soviet era were included in the database. The event of mixing with foreign substances was not found in the published report [17].

2.1.10. Super Phenix (demonstration reactor, France)

The operation period was 1.44 reactor years according to the database of PRIS [14]. Two events occurred during the period. In June–July 1990, there was an air leak into an auxiliary circuit which caused extensive contamination of the primary sodium [17]. During the start-up of the reactor, it was noted that a newly set up subassembly was heated up slightly more than the neighboring subassemblies because a rubber plug was left within the subassembly after an unusual fabrication [18].

2.2. The probability of the blockage by the mixed foreign substances in subassembly

As the foreign substances, four items, namely loose part (Metal), reaction products of sodium (aerial mixture to a CG system and breakdown of sodium cold trap), sticker and rubber material (failure of the sticker structure of the CG boundary or misplacing the rubber material used in the fabrication stage), and oil (breakdown of dynamic component), are considered according to the past study [8]. However, the counter measures which are committed in licensing document of Monju [1] are taken to prevent the local flow blockage accidents as follows.

Figure 1. Inlet of subassembly.

–	Material selecting, design, manufacturing, setting, testing, and inspecting of a fuel element are conducted based on each standard and quality control, and construction operation is performed sufficiently.
–	The purity in the primary system is maintained under the appropriate management.
–	The inlet of subassembly has a lot of holes as shown in Figure 1 to prevent the simultaneous blockage to keep the coolant flow.

Because of these counter measures, most possible foreign substances which can mix into the fuel subassemblies are considered to be metal particles with small diameters. Then, the branching probability about the blockage by the metal small particle was determined. Occurrence of local fault caused by local flow blockage had not been reported in an actual plant except the accident in Enrico Fermi Reactor which had no design measurement in the early stage of SFR development. Then, the scale of blockage is indefinite when it happens in plant. For the evaluation of Monju for the license, the coolant flow was not assumed at all in the blockage due to the hypothetical analysis condition of impermeable plate in that. However, it has been studied experimentally for practical use of SFR to date [8]. As a result of the blockage experiment, it was concluded as follows.

Figure 2. Effect of particle sizes on blockage formation (identical to Figure 4 in [6]).

Figure 3. Geometrical relationship among wire, pins, and blockages.

Figure 4. Blockage pattern.

–	The behavior of a foreign particle depends heavily on the particle size. The particles of limited diameter range can contribute to form the blockage in the wire-wrapped fuel pin bundle as described in Figure 2.
–	It is quite unrealistic to consider the blockage which covers the adjoining sub-channels, a six-sub-channel blockage surrounding a pin for example. No mechanism was found for the propagation of sub-channel blockage to adjoining sub-channels. Then, the blockage of multiple sub-channels takes the pattern depicted in Figure 3 due to the geometrical relationship between the spacer wire and the fuel pins.
–	Almost all the blockages consist of the particles larger than the diameter of the spacer wire, because a smaller particle can easily bypass the blocked location. Therefore, the final blockage would be highly porous.
–	In the extremely conservative test, blockage or accumulation of the particles formed at the inlet part of the bundle with all the other sub-channel patterns as shown in Figure 4. Each accumulation in a sub-channel mostly consists of a few particles not including the particles smaller than spacer wire diameter, and the maximum blockage length is about 10 mm.

Taking into account the blocking mechanism above, event of trapping foreign substances in the sub-channel is highly unlikely occurrence, considering the size and amount which can be mixed into the subassembly. The ‘highly unlikely’ corresponds to the probabilistic rank of ‘3’ using Table 2 to keep self-consistency. The parameter ‘S’ is defined for the probability of blockage formation by the foreign substances which can be mixed into the fuel subassemblies (FSAs). Then, the representative value of 0.05 corresponding to ‘highly unlikely’ in Table 2 was applied to the blockage probability of ‘S.’

Table 2. Frequency of mixing with foreign substances into the primary system.

Probabilistic	Qualitative	Representative	Range of
rank	representation	value	application
1	Indeterminate	0.5	0.7–0.3
2	Unlikely	0.2	0.3–0.1
	Likely	0.8	0.7–0.9
3	Highly unlikely	0.05	0.1–0.01
	Highly likely	0.95	0.9–0.99
4	Extremely unlikely	<0.01	<0.01
	Extremely likely	>0.99	>0.99
5	Impossible	ϵ	ϵ
	Certain	1 − ϵ	1 − ϵ

Furthermore, event of large scale blockage is extremely unlikely occurrence even in the case where the size of the foreign substances was suitable for the trapping by the wire. The ‘extremely unlikely’ corresponds to the probabilistic rank of ‘4’ using Table 2 to keep self-consistency. The parameter ‘L’ is defined for the probability of large scale blockage formation. Then, the representative value of 0.01 corresponding to ‘extremely unlikely’ in Table 2 was applied to the blockage probability of ‘L.’

Then, the branch probabilities of blockage occurrence for small scale (a) and large scale (b) were calculated as follows when the foreign substances are mixed into the primary system.

(a)	Small scale blockage: $$\begin{array}{c}\hfill S\times \left(1-L\right)=0.05\times \left(1-0.01\right)=0.0495\end{array}$$
(b)	Large scale blockage: $$\begin{array}{c}\hfill S\times L=0.05\times 0.01=0.0005\end{array}$$

The assumption of instantaneous blockage in almost all flow areas would be inappropriate in our study considering the experimental knowledge shown in Figure 2 indicating the maximum blockage rate below 50%. The blockage rate in this study was set less than 50% of the flow area. It takes a certain time to grow the blockage to the large scale by accumulation of the foreign substances of limited size range suitable for the blockage. The time was estimated to be long enough to take manual measures due to the recognition of abnormalities by the CG method until reaching the preset value of delayed neutron detector for automatic shutdown. In the past analysis for the license of Monju, a planar and impermeable instantaneous blockage of 66% was assumed hypothetically. These evaluations revealed that automatic shutdown by the method of delayed neutron detector is effective to prevent the core damage in such a conservative condition. Thus, the method of delayed neutron detector for the automatic shutdown was assumed to be effective in high reliability, even under the condition of large scale blockage.

2.3. Frequency of initiating event

By combining the results of Sections 2.1 and 2.2, the frequency of ‘small scale blockage’ and ‘large scale blockage’ as the initiating events were evaluated as follows.

(a)	Small scale blockage: $$\begin{array}{c}\hfill 2.55\times {10}^{-2}\times 0.0495=1.26\times {10}^{-3}\end{array}$$
(b)	Large scale blockage: $$\begin{array}{c}\hfill 2.55\times {10}^{-2}\times 0.0005=1.28\times {10}^{-5}\end{array}$$

3. Event tree analysis for failure propagation from local flow blockage

3.1. Development of event tree

Depending on operation policies, reactors can continue their operation even after the occurrence of local fault until the automatic shutdown by the failure. However, according to the operation policy of Monju which is referred in this PRA study, operators prepare for the operation stop, once they recognize any pin failures.

After fuel pin failure, operator crews can take actions along the operation procedure as shown in Figure 5. For developing an event tree, it is important to understand a relationship between the failure propagation and the alert and reactor trip level of detectors of fuel pin failure, which is shown in Table 3. These figures and tables are essentially same as the case of adventitious fuel pin failure [7]. Based on this operation procedure and the latest knowledge on experiments and analyses, the failure propagation is summarized in four stages as follows:

• Stage 1: cladding defect size over alert threshold of delayed neutron detector and precipitator,

• Stage 2: pin failure propagation to the peripheral six pins until refueling,

• Stage 3: cladding defect size over reactor trip threshold of delayed neutron detector, and

• Stage 4: damage propagation over alert threshold of thermocouple at the outlet of subassembly.

Figure 5. Main operation procedures after fuel pin failure in Monju.

Table 3. Frequency of mixing with foreign substances into the primary system.

Name of alert	Alert or reactor	Corresponding
or reactor trip	trip threshold	Step and (stage)
Alert of high count rate at the precipitators in cover gas method	FP gas release (0.01% of one fuel pin)	Step 1 (Stage 1)
Alert of very high count rate at the precipitators in cover gas method	Fuel pin failure (0.01% of total fuel pins^a (three pins))	Step 2 (Stage 1)
Alert of high count rate at the NaI counter in cover gas method	Fuel pin failure (0.02% of total fuel pins^a (six pins))	Step 3 (Stage 2)
Alert of high count rate at delayed neutron detectors in delayed neutron method	Breached cladding area (over 200 mm^2)	Steps 1, 2, 3 (Stage 1)
Reactor trip at delayed neutron detectors in delayed neutron method	Breached cladding area (over 5000 mm^2)	Step 4 (Stage 3)
Alert from thermocouple at the outlet of subassembly	More than 66% of flow blockage within one subassembly	Step 5 (Stage 4)

^aTotal number of fuel pins: 33,462.

Based on these stages, mitigation measures for reactor shutdown were also summarized in five steps as follows:

• Step 1: manual reactor shutdown by the alert from delayed neutron detector and precipitator,

• Step 2: normal reactor shutdown by the second alert from precipitation,

• Step 3: normal reactor shutdown by the alert from NaI detector,

• Step 4: automatic reactor shutdown by the trip signal from delayed neutron detector, and

• Step 5: manual reactor shutdown by the alert from thermocouple.

The normal reactor shutdowns are conducted by the gradual insertion of control rod by the normal rod-drive systems which are adopted in the predetermined normal stop operations. On the other hand, the manual reactor shutdowns are conducted by the scram signals which are called by operators after the abnormality recognitions.

As described in Section 2.3, two initiating events depending on the blockage scale were assumed, i.e. small scale blockage and large scale blockage. Main event tree was developed for those two initiating events as shown in Figure 6. In this event tree, Stages 1–4 are described as event tree headings (2), (4), (7), and (9), respectively, and failures in Steps 1–5 are described as event tree headings (3), (5), (6), (8), and (10), respectively.

Figure 6. Main event tree for local fault caused by local flow blockage.

In the event tree, we assume that local flow blockage occurs by the foreign substances which mix into the core. Unless the cladding fails, fission product gas is not released. Then, the precipitators of CG method cannot detect the abnormally caused local flow blockage, and the operation continues normally without shutdown until the fuel exchanges. The event sequence ends up with No. 1 or 13 in the event tree.

If failure propagation reaches Stage 1 so that the precipitators of CG method detect the abnormality with alert level, the operators doubt the possibility of fuel failure. If the cladding defect size exceeds 200 mm² which is the alert threshold in Delayed Neutron method, manual reactor shutdown will be initiated. This is success in Step 1.

Even if Step 1 fails, normal reactor shutdown will be initiated after the detection of 0.01% of total driver fuel pin failures at the precipitators in CG method or after the detection of 0.02% of total driver fuel pin failures at the NaI detectors in CG method, i.e. success in Steps 2 or 3, respectively. More than three or six fuel pin failures are necessary for normal reactor shutdown by precipitators or NaI detectors, respectively, because the number of driver fuel pin in the core is 33,462 in Monju. This indicates that Steps 2 and 3 are taken after the failure propagation reaches Stage 2.

In Stage 3, the cladding defect size exceeds 5000 mm². This indicates that failure propagation reaches the reactor trip level in delayed neutron method and Step 4 will be initiated.

Even if the automatic shutdown fails, failure propagation reaches Stage 4 and there is another pass of manual shutdown by operators recognizing the abnormality from the alert threshold of thermocouple at the outlet of subassembly, i.e. success in Step 5.

In these sequences except the automatic reactor shutdown by delayed neutron signals, human factor significantly contributes to the consequence. Then, the difference of propagation rate in the early stage of local fault phenomena with the case causes adventitious fuel pin failure. They depend on the initiating scale of blockage described in Section 2.2.

3.2. Quantification of event tree headings

Although the quantification of branch probabilities for phenomenological headings ((2), (4), (7), (9), (11), and (12)) were determined through the engineering judgment based on the knowledge on experiments and analyses, it was standardized using Table 2 in order to keep consistency in this event tree analysis.

Each branch probability is described below in each case of the blockage scale.

3.2.1. Small scale blockage (a)

In the small scale blockage, it is hard to assume the propagation of fuel failure because the temperature rising rate is slow [7]. However, the branch probabilities of 0.5 were assumed for the event tree headings (2), (4), (7), and (9) conservatively because the failure propagation cannot be denied completely by the existence of blockage.

The event tree headings (3), (5), (6), (8), and (10) are related to failure of reactor shutdown to prevent the failure propagation. These measures for the reactor shutdown are exactly the same as the case of adventitious fuel pin failure [7]. The probabilities shown in Tables 4 and 5 are applied to this study.

Table 4. Results of fault tree analysis for common systems shared by frontline systems.

Headings		Failure probability
I	Support systems (i.e. power supply) required for manual reactor shutdown	2.30E-06
II	Common system required for manual reactor shutdown by the alert from precipitators or NaI detectors (argon gas sampling line)	7.60E-04
III	Common component required for precipitators (three signal lines and calibration error)	4.01E-04
IV	Common component required for precipitators (two signal lines)	1.69E-08
V	Prevention of common cause failure and calibration error in manual and automatic shutdown using delayed neutron method	4.01E-04
VI	Single channel commonly required in both manual and automatic shutdown using delayed neutron method (i.e. detector, control circuits, and power supply for loop-A)	2.71E-06
VII	Support system required in manual and automatic shutdown using delayed neutron method (i.e. power supply for loop-B)	1.95E-06
VIII	Support system required in manual and automatic shutdown using delayed neutron method (i.e. power supply for loop-C)	1.95E-06
IX	Components required only for manual shutdown	2.91E-06
X	Components required for reactor shutdown (i.e. reactor trip breakers and control rods)	6.41E-08

Table 5. Results of fault tree analysis for main event tree headings (frontline systems).

			Prerequisites for
	Headings	Probability	common shared system^a
(3)	Failure of manual reactor shutdown by the alert from delayed neutron detectors and precipitators	4.26E-04	Success in I, II, III, IV, V, VI, (VII or VIII), IX, and X
		4.27E-04	Success in I, II, III, IV, V, VII, VIII, IX, and X; and failure in VI
		1.0	Failure in I, II, III, IV, V, (VI and VII), (VI and VIII), (VII and VIII), IX, or X
(5)	Failure of normal reactor shutdown by the second alert from precipitators	4.26E-04	Success in I, II, III, IX, and X
		1.0	Failure in I, II, III, IX, or X
(6)	Failure of normal rector shutdown by the alert from NaI detectors	8.28E-04	Success in I, II, IX, and X
		1.0	Failure in I, II, IX, or X
(8)	Failure of automatic reactor shutdown by the trip signal from delayed neutron detectors	5.77E-13	Success in V, VI, (VII or VIII), and X
		7.60E-07	Success in V, VII, VIII, and X; and failure in VI
		1.0	Failure in V, (VI and VII), (VI and VIII), (VII and VIII), or X
(10)	Failure of manual reactor shutdown by the alert from thermocouples at the outlet of fuel subassembly	1.42E-03	Success in I, IX, and X
		1.0	Failure in I, IX, or X

^a‘Success in I,’ for example, denotes here that the support systems (i.e. power supply) required for manual reactor shutdown, shown in Table 4 as ‘I,’ are available, and ‘Failure in I’ means that they are unavailable.

In the case that fuel damage propagates over alert threshold of thermocouple at the outlet of subassembly, there is possibility of failure in decay heat removal after reactor shutdown and of damage propagation to the peripheral subassemblies as well as the case of adventitious fuel pin failure [7]. Therefore, the branch probabilities of 0.2 and 0.8 were applied for the event tree headings (11) and (12), respectively.

3.2.2. Large scale blockage (b)

From the knowledge of blockage experiments [6], the flow path in subassembly is kept even if the large scale blockage occurs so that there is no significant difference in possibility of damage propagation between large and small in the blockage scale. The branch probability of 0.5 was applied to the event tree headings (2), (4), (7), and (9).

As for the possibility of failure in reactor shutdown, the manual shutdown cannot be expected in case of large scale blockage, because the progress speed of the phenomena would be fast. Therefore, there is no branch in the event tree headings (3), (5), (6), and (10) and the probability of heading (8) is the same as that in the small scale blockage. Since there is no branch to success at the event tree heading (10), no branch is needed at the event tree headings (11) and (12).

4. Results and discussions

Table 6 shows the analysis results of the frequency of core damage induced from local flow blockage in this study. Dominant sequence in our analysis is the sequence without scram which is initiated by the large scale blockage, i.e. No. 18 in the event tree shown in Figure 6, and its contribution is 97%. The remaining contribution of 3% is due to the sequences initiated by the small scale blockage, i.e. No. 11 and 12 in Figure 6. While the frequency of initiating event of small scale blockages is larger than that of large scale ones as mentioned in Section 2.3, its contribution to the CDF decreases, owing to the slow progression speed of the event and Steps 2, 3, and 5 in the mitigation measures, i.e. success paths to No. 4, 5, and 9 in the event tree of Figure 6.

Table 6. Core damage frequency from local flow blockage.

		With scram (failure of
	Without scram	decay heat removal) (Ry^−1)
Core damage frequency from local flow blockage
Small scale blockage	∼5.1 × 10^−12	∼3.9 × 10^−12
Large scale blockage	∼3.2 × 10^−10	–

Following improvements were conducted in the analysis:

(1)	reflecting O. investigation result of SFR operating history in the world and experimental knowledge for the mechanism of the blockage in the subassembly to the initiating event frequency of local flow blockage,
(2)	considering the human factor based on the emergency operating procedure of Monju, and
(3)	conducting Fault Tree Analysis (FTA) which considers functional dependency among the systems and components in Monju.

These improvements were fundamentally same as the work of PRA on the adventitious fuel pin failure [7]. The initiating event frequency of local fault caused by local flow blockage described in Section 2.3 was much smaller than that of the adventitious fuel pin failure as shown in Table 7. However, the CDF when the local blockage occurs was much larger than that when the local fault is caused by the fuel-element-failure propagation from adventitious-fuel-pin failure (FEFPA) as shown in Table 7. This is due to the fast progression speed of the local flow blockage where the manual shutdown cannot be relied on, unlike the case of FEFPA.

Table 7. CDF from local flow blockage compared with those from FEFPA and the frequencies of their initiating events.

			Core damage frequency (CDF)
		Initiating event		With scram (failure of
		Frequency (Ry^−1)	Without scram (Ry^−1)	decay heat removal) (Ry^−1)
Local flow blockage
Small scale blockage	This work	1.26 × 10^−3	∼5.1 × 10^−12	∼3.9 × 10^−12
Large scale blockage		1.28 × 10^−5	∼3.2 × 10^−10	–
FEFPA	[6,7]
Adventitious fuel pin failure		2.4	∼9.6 × 10^−13	∼7.3 × 10^−13

The CDF from local flow blockage compared with those in conventional study is shown in Table 8. Our results indicate about 10⁻¹ or 10⁻² times smaller value compared with the conventional studies by Japan Nuclear Energy Safety Organization (JNES) [5] on the frequencies of damage propagation to 37 subassemblies or a molten fuel pool formation in one subassembly induced from the flow blockage.

Table 8. CDF from local flow blockage compared with those in past work.

			With scram (failure of
		Without scram (Ry^−1)	decay heat removal) (Ry^−1)
CDF from local flow blockage	This work
Small scale blockage		∼5.1 × 10^−12	∼3.9 × 10^−12
Large scale blockage		∼3.2 × 10^−10	–
Damage propagation more than 37 subassemblies	Past work by JNES [5]	(1.59 × 10^−9)
Molten fuel pool formation in one subassembly		(4.6 × 10^−8)
Whole core accident from Local Fault (LF)	Past work by Vaughan [3]	(1.9 × 10^−9)

In the work by JNES [5], three scales of blockages and their frequencies were considered as follows:

(i)	Causing temperature rise as 5 °C at the outlet of subassembly: 10−2 [Ry−1].
(ii)	Significant shortening the life time for creep failure of fuel clad: 4 × 10−6 [Ry−1].
(iii)	Causing bulk boiling of coolant: 5 × 10−8 [Ry−1].

The blockage scale like (iii) corresponds to the blockages of 80% of flow area, according to the JNES report [5], while the large scale blockages were estimated to be less than 50% of flow area in this work as described in Section 2.3. According to the JNES report [5], the scale of blockage (ii) corresponds to 35% of flow area. Then, the result of this study is comparable with the blockage scales like (i) and (ii) by JNES. While contribution of the risk from the blockage scales like (i) was neglected in the study of JNES, it was considered to be success paths initiated from the small scale blockage, i.e. No. 1 through 8 in Figure 6 in this study.

The details of CDFs between those of this study and JNES were compared as shown in Table 9. First point which needs attention is the occurrence frequency of combination of the initiating event and the event progression to the extent where the mitigation action is taken. It is shown in row 3 of Table 9 that the values are about 10⁻⁷ orders in both cases in this study and JNES study. There are no significant differences. On the other hand, there is a difference of a few orders of magnitude in the failure probability of the mitigation system as shown in row 4 of Table 9. The estimation for the blockage mechanism described in Section 2.3 can induce different treatments about the mitigation systems. Moreover, the success path was considered after the failure of mitigation system in JNES study described in row 6 of Table 9. In this study, the failure of mitigation system is regarded as the core damage. Because of these factors, difference was generated in CDFs between this study and JNES study [5].

Table 9. Analyzing the difference in CDF between our work and JNES work.

		This work			JNES work (Figures 2.5–3 in [5])
(1)	Initiating event	Large scale blockage	1.28 × 10^−5	(Ry^−1)	35% of flow area blockage	4.00 × 10^−6
(2)	Event progression	Failure propagation to the trip level by Delayed Neutron Detection (DND)	6.25 × 10^−2	(/demand)	Failure propagation to the maximum level saved by any mitigation system	8.00 × 10^−2	(/demand)
(3)	(1) and (2)	–	7.97 × 10^−7	(Ry^−1)	–	3.20 × 10^−7	(Ry^−1)
(4)	Failure of the mitigation system	(x) Failure of DND	4.01 × 10^−4	(/demand)	(x) Failure of thermocouple	4.75 × 10^−1	(/demand)
		(y) –	–	–	(y) Failure of CG, Delayed Neutron (DN), etc.	3.28 × 10^−1	(/demand)
		(x) and (y)	4.01 × 10^−4	(Ry^−1)	(x) and (y)	1.56 × 10^−1	(Ry^−1)
(5)	(3) and (4)		3.20 × 10^−10	(Ry^−1)		4.98 × 10^−8	(Ry^−1)
(6)	Event progression		1	(/demand)	To progress forming a molten fuel pool	2.00 × 10^−1	(/demand)
(7)	(5) and (6)	CDF without scram	3.20 × 10^−10	(Ry^−1)	Forming a molten fuel pool in a subassembly	1.0 × 10^−8	(Ry^−1)

Vaughan [3] evaluated the frequency of whole core damage initiated from local fault as 1.9 × 10⁻⁹ Ry⁻¹ , which includes not only the local flow blockage but also the ‘adventitious pin failure’ and ‘overrated subassembly loaded’ as initiating events. Since the contribution from individual initiator is unclear, we compared the frequency of core damage due to the local fault including all of these initiators. In our study, it is clear that the contribution from adventitious pin failure is negligibly small from the past study of adventitious pin failure [7] shown in Table 6. And ‘overrated subassembly loaded’ could be eliminated by the counter measure as described in Section 2.2. From this consideration, the frequency of core damage due to the local fault would be 3.3 × 10⁻¹⁰ Ry⁻¹ . This is smaller than the evaluation by Vaughan [3].

Table 10 also shows the CDF of the ATWS and PLOHS in Monju [19]. The frequency of damage propagation to the peripheral subassembly without or with scram was smaller than CDFs of ATWS and PLOHS. Furthermore, the consequence of whole core accident from local fault caused by local flow blockage without or with scram was not greater than that of ATWS or PLOHS because almost all the subassembly will be damaged at ATWS or PLOHS [20]. Therefore, damage propagation from local fault caused by local flow blockage in Monju can be negligible compared with the core damage due to ATWS or PLOHS in the viewpoint of both probability and consequence.

Table 10. CDF from local flow blockage compared with those from ATWS and PLOHS.

		Without scram	With scram
		(Ry^−1)	(failure of decay heat removal) (Ry^−1)
CDF from local flow blockage
Small scale blockage	This work	∼5.1 × 10^−12	∼3.9 × 10^−12
Large scale blockage		∼3.2 × 10^−10	–
CDF from ATWS and PLOHS	[20]	∼3 × 10^−8 in ATWS	∼5 × 10^−8 in PLOHS

5. Conclusion

Frequency of damage propagation to the peripheral subassemblies was quantified as 3.3 × 10⁻¹⁰ Ry⁻¹ in Monju based on the event tree analysis. Therefore, frequency of whole core damage was much smaller than this value due to the other detection and reactor shutdown systems after the damage propagation to the peripheral subassemblies. It was clarified in this study that damage propagation from local fault caused by local flow blockage in Monju can be negligible compared with the core damage due to ATWS or PLOHS in the viewpoint of both probability and consequence.

Acknowledgments

The authors wish to thank Mr. Yamamoto of JAEA for the helpful operation data of ‘Joyo’ and would like to express their gratitude to Mr. Imaizumi of our colleague who checked the English of this paper.

Disclosure statement

No potential conflict of interest was reported by the authors.