Severe accident progression without operator action

An abstract of the technical paper
October 7, 2015
Ottawa, Ontario, Canada

Prepared by:
CNSC staff
Ottawa, ON, Canada

Abstract

After the Fukushima Daiichi accident in 2011, one of the many actions committed to by the Canadian Nuclear Safety Commission (CNSC) in its Integrated Action Plan was an assessment and video representation for the public of how a full station blackout could progress in a CANDU reactor in Canada. This video was posted online in January 2013. The CNSC has now followed up with this technical paper, which assesses the timing of a hypothetical blackout, using the Darlington Nuclear Generating Station for illustration.

For the assessment, it was necessary to make the extremely unrealistic assumption that operators take absolutely no action after a full station blackout. The assessment is not used to determine the effect of releases, but rather to assess the potential time and magnitude of releases to determine what operator action can be taken to prevent releases. The assessment identifies the multiple points when operator action becomes critical to stop the progression of an accident. Also, the assessment shows there is adequate time for operator action.

CNSC staff reviewed and agreed with the results of the Darlington Level 2 probabilistic safety assessment (PSA) performed by Ontario Power Generation (OPG), including the analysis of OPG's highly unlikely station blackout scenario, which assumed no operator intervention took place. In this scenario, external electrical power sources, standby diesel generators and emergency power generators are unavailable.

CNSC staff's summary of OPG's data paid attention to how reactors currently operating in Canada offer multiple layers of defence-in-depth to prevent accidents. The postulated initiating event of a prolonged station blackout in itself is extremely unlikely and would require multiple failures of plant safety systems to occur. It also depends on the control room staff failing to perform the most basic control room actions in accordance with established safety procedures.

In such a hypothetical event, a release of radioactivity into the environment due to severe core melt can occur at around 11 hours (first stage of release) after this unmitigated station blackout begins. Twenty-three hours into the scenario, the containment integrity can be compromised due to structural failure, leading to a second stage of release at around 25 hours. Lastly, molten core–concrete interaction is expected to occur at around 58 hours, at this point releasing additional fission products into the containment and the environment.

The results of the MAAP4-CANDU severe accident analysis performed by OPG as part of its Level 2 PSA for Darlington indicate that a simple action carried out by the control room staff would provide approximately 8 to 10 hours of additional passive core cooling by supplying readily available water to the boilers. Based on operating procedures, control room staff are instructed to open safety relief valves to depressurize the boilers and allow gravity to feed the water into the boilers. This action could be accomplished from the main control room or secondary control area, and the control room staff would have over 1 hour to perform it. Following this action, field operators would have ample time to connect the portable emergency mitigating equipment and thus secure a continuous supply of coolant to the boilers. Successful connection of emergency mitigating equipment could fully halt progression of the accident. Such actions are regularly exercised and are highly likely to succeed in terminating accident progression and preventing releases of radioactive material to the environment.

The likelihood of such an accident described in this scenario is very low because of the multiple safety defences in place. Nonetheless, since the Fukushima accident, nuclear power plants in Canada have implemented numerous safety enhancements focusing on the prevention and mitigation of severe accidents. These safety enhancements would further reduce the likelihood of severe core damage resulting from a prolonged station blackout and the potential for radioactive releases.

To view the technical paper:

• Severe accident progression without operator action (PDF)