JPS6117988A - Safety device for nuclear reactor - Google Patents

Abstract

(57) [Summary] This bulletin contains application data before electronic filing, so abstract data is not recorded.

Description

[Detailed Description of the Invention] [Technical Field of the Invention] [Technical Background of the Invention and Problems Therewith] Generally, it is difficult to bring a nuclear reactor to a safe state even if various abnormal events occur in a nuclear power plant. Various safety devices are in place to ensure this. In the case of BV17R plant,
In order to bring the reactor to a safe state when abnormal small fish occur, the following three things basically need to be done. That is, first a) stop the nuclear reaction in the reactor, then b) restore and continue to maintain the cooling water level in the reactor, and then C) reduce the fission products accumulated in the nuclear fuel in the reactor. It is necessary to remove the decay heat released from objects over a long period of time. +(WR In the R plant, the following three safety devices are installed to accomplish the above three things: A. Reactor emergency shutdown system; B.

An emergency core cooling system and a C8 residual heat removal system are installed as safety devices. The design conditions for these safety devices include the most severe design conditions, starting from the range of abnormal event forces that slightly deviate from the normal operation of the BWrt plant, and extending to the range of extreme events that may occur in the unlikely event. Select the event that gives π as the design reference event, and
The design is designed to withstand even the most severe damage. This is the most severe condition L5. It is generally assumed that the abnormal event that can occur is an instantaneous double-sided rupture of the largest diameter liquid-phase piping (usually the reactor coolant recirculation system piping) connected to the reactor pressure vessel. In this way, accidents in which there is a risk that reactor water, which is the coolant inside the reactor, may leak out due to a rupture in a pipe that is directly connected to the reactor pressure vessel, and the nuclear fuel inside the reactor pressure vessel may not be sufficiently cooled, are generally avoided. Loss of coolant accident (hereinafter referred to as L)
It is abbreviated as OCA. ). Since the impact is too great to simply call this an abnormal event, LOCA is generally classified as a design basis accident (hereinafter abbreviated as DBA) in the sense that it is classified as an accident and gives the strictest conditions. being called. This is based on the LOCA regarding the required capacity of the emergency core cooling system and residual heat removal system mentioned above.
This is because this is the accident that requires the largest capacity. Therefore, the conventional design of safety equipment for 13W R plants was based on the assumption that LOCA would occur, without any reason.
Nevertheless, measures have been taken to install emergency core cooling systems and residual heat removal systems with sufficient capacity to bring the reactor to a safe state. However, it has recently been discovered that there is actually some kind of logic behind this design method, which is considered to be the safest. Although this imposes unrealistic demands that may seem excessive, it is a little too demanding for the reliability design of safety devices. Specifically, a design standard called a single failure criterion is applied to the design of current safety devices. This is to ensure that even if one of the safety devices that performs a certain safety function fails, the safety function will not be lost.
The idea is to improve the reliability of the safety device by installing a system safety device and duplicating the entire system.

Therefore, in current BWR plants, all of the major parts of the safety equipment mentioned above are duplicated. This is a design basis accident for these safety devices.The above-mentioned LOCA is an extreme event with the most severe impact among possible accidents, and various safety measures have already been taken to reduce the probability of its occurrence. Because it is implemented.

It is sufficient to consider that only one safety device will fail after a LOCA occurs, and furthermore, there is a sufficient probability that two safety devices will fail, so there is no need to assume that K ffk <. It is based on the premise that there is no such thing. Recent studies have shown that this assumption is technically valid if safety devices such as the emergency core cooling system and the residual heat removal system operate only in extreme events with an extremely low probability of occurrence, such as LOCA. Probabilistic safety assessment (hereinafter referred to as PI)
Abbreviated as A. ) has also been confirmed. Conversely, if safety devices such as the emergency core cooling system frequently operate for some reason during normal operation of a BWR plant, this indicates that there is some problem with the design of the safety system. It can be said that it shows. This is because, as mentioned above, these safety devices are based on the premise of LOCA, which occurs with a very low frequency, and these safety devices cannot be used even in the event of an abnormal event that occurs with a high frequency other than LOCA. This is because the design assumptions did not include that the functionality might be needed. In this way, the safety equipment of the current BWR plant is
The capacity was designed for OCA, an accident event with a very large impact, as a design basis accident (1) BA), and although it has a fairly large capacity, in terms of its reliability design, Because OCA, which is extremely unlikely to occur, is considered a design basis accident, the design is not necessarily reliable.

This is due to the fact that BWR safety devices are not required to operate only in the event of an extremely low-probability accident like LOCA. A specific example will be described below.

First, abnormal events that occur relatively frequently in 8wn plants are generally abnormal transient changes during operation (
There are closures of the main steam isolation valve (hereinafter referred to as M'STV) (hereinafter referred to as "Transient") and water supply pump trips. When a transient such as MSIV closure occurs, the reactor steam generated by the nuclear reaction inside the reactor has no escape port, so the reactor pressure rapidly rises and the relief safety valve automatically operates, but this should not be left as it is. In a very short time, the pressure in the reactor reaches a level that compromises the integrity of the reactor pressure vessel. The above-mentioned emergency reactor shutdown system is provided as a safety device to bring the reactor to a safe state before such a situation occurs. This reactor emergency shutdown system has a safety function that automatically activates in response to a safety protection signal of MSTV closure and reactor pressure high, and rapidly stops the nuclear reaction in the reactor. The method usually used is to insert control rods containing boron, which is a neutron absorbing material, into the reactor at once using water pressure (this is generally called a scram). The reactor emergency shutdown system 1-system, which is a safety device for performing this scram, is also designed based on the single failure criterion as mentioned above, and there are only two main systems, the A system and the B system. do not. Scrum is LO
In the case of a design basis accident such as CA, it is automatically carried out by a safety protection signal such as a low reactor water level, but it occurs less frequently like LOCA (the frequency of occurrence of general company design basis LOCA is 10- (It is said that 4 times per reactor year.) In the case of an accident, consider the probability that both A and B systems of the reactor emergency shutdown system will fail.

It is generally clear from an engineering perspective that there is no need to assume its occurrence. However, transients (generally known as transie
The overall frequency of occurrence of nt is 1 to 10 times/year of operation. ), the probability that both the A and B systems of the reactor emergency shutdown system will subsequently fail and the scram will fail may not necessarily be so small that it can be ignored from an engineering perspective. Like this 'f'r;+n5ie
ATWS generally refers to the event that Scrum fails after nt occurs.
Precursor events are already occurring frequently in the United States.

The U.S. Nuclear Regulatory Commission (hereinafter referred to as NRC) has classified this as an unresolved safety issue (IJnreso144cd 5a).
fety l5sues, hereinafter abbreviated as UR8I. )
After more than 10 years of study, a number of design changes have recently been regulated to strengthen the reliability of Scrum IC plant safety equipment. It has been officially added as a requirement, and the long-standing study process is coming to an end. This is a safety device that is extremely important for plant safety, like a nuclear reactor emergency shutdown system.
and.

For the reliability design of safety devices, it is necessary to use only the conventional single failure criterion as a design standard, which is necessary in the case of abnormal events that occur much more frequently than LOCA, such as Transienl. This is nothing other than proof that the US NRC has acknowledged that there may be cases where it is not always sufficient. Note that ATWS is a specific example of an event type in which a transient with a relatively high frequency of occurrence is followed by a double failure of the safety device.
Generally speaking, the recent probabilistic safety evaluation (PR , A) has become international common sense. However, the current mainstream way of designing safety equipment for HWR plants is still to assume LOCA, which occurs with extremely low frequency, and to assume the myth that only one system of safety equipment will fail after that. In other words.

First of all, the reliability of safety devices is designed based on the assumption that the type of event will never occur, but on the other hand, it is also necessary to design the reliability of safety devices based on the premise that the type of event will never occur. There is a possibility that consideration has not been given.

Therefore, the reliability design of safety devices that takes into consideration the double failure of Transient safety devices is required for BW.
This has become an important and urgent issue for the safety of R plants. In addition to the above-mentioned ATWS, there are several important double failures of such transient safety devices. As mentioned above, ATWS is a US NH,
Regulations for C are being tightened, and it is considered that the safety issue has been practically resolved.

Some similar safety issues other than ATWS that are still unresolved will be discussed below.

There are the following three types of double failures of the above-mentioned transient safety devices that have a significant impact on the safety of the BWR plant. That is, a. Supply water loss 'I'ransient + reactor isolation cooling system (
Hereinafter, it will be abbreviated as RCI C. ) Failure 10 High pressure emergency core system failure, b, main condenser function loss Transient + residual heat removal system double failure, and C1 external power loss 'pra1s
ient+emergency diesel generator (hereinafter referred to as I)/G. ) There are three double failures. It is a consensus conclusion from recent probabilistic safety assessments (PI(,A)I/U) that these three events, along with ATWS, are the most likely causes of core meltdown accidents in BWR plants. In addition, regulatory agencies such as the US National Instruments Corporation (NIC)
From the results of analyzing the R plant's failures and failure reports to date, the above three abnormal events are all caused by AT.
It has been statistically concluded that 13 Wr is the most dangerous for the plant, along with WS.
and C, new unresolved safety issues (IJ H, S
We have recently begun considering the addition of this option to the list of I).

Also, for a, Three Mile Island nuclear power plant accident c and below T
Abbreviated as MT accident. ) The company is recommending improvements to manufacturers and electric power companies as safety requirements. In other words, it can be said that the United States has already begun formal consideration of this type of abnormal event of double failure of the Transient safety devices. What should be noted here is that the types of safety problems that have recently attracted attention are completely different from the failure of one system of LOCA safety devices, which is the basis of the current design. The reliability design of safety devices must cover up to double failures, which means that even stricter conditions must be met. Recently, large-diameter piping such as recirculation system piping can cause instantaneous double-sided rupture due to safety measures such as leakage monitoring of reactor water.
It is beginning to be recognized as an academic fact that abnormalities can be detected at the stage of invisible cracks in piping, allowing the reactor to be safely shut down before a major accident occurs.
There is a growing recognition that large-scale LOCAs, such as those currently envisioned as design basis accidents (DBAs), will not occur.

In response to this, some regulatory methods have already been reviewed in the United States and West Germany, but the current situation is that the design of safety devices itself is still done using LOCA as DBA. In this way, even if an accident is unlikely to occur in reality, assuming an extremely large impact as a design basis accident gives an extremely large amount of leeway to the capacity design of safety devices. This means that it has been designed with extremely enhanced safety. However, on the other hand, the capacity of the safety equipment increases,
In order to increase costs, we installed multiple systems of safety devices and designed to improve reliability against the types of events that are likely to occur in reality, such as double failure of transient safety devices. This makes it extremely difficult to do so. Therefore, the following will be related to the three types of safety issues mentioned above.

What problems exist in the reliability design of the current BWR plant safety equipment will be specifically explained based on drawings.

[Problems with the current design]

In Figure 1, the reactor pressure vessel J contains nuclear fuel 2,
The reactor water is converted into steam by the large amount of heat generated when the nuclear fuel fission, and the generated steam is guided to the main turbine 4 through the main steam pipe 3, which rotates the main turbine 4 and uses this as a power source. Electricity is generated by a generator. After rotating the main turbine 4, the furnace steam is led to the main condenser 5,
Here, it is returned to water by contacting a cooling pipe through which low-temperature seawater or the like is passed, and is stored at the bottom of the main condenser 5.

This water is returned to the inside of the reactor pressure vessel 1 via the water supply pipe 7 by the water supply pump 6. In this way, the reactor water, which is the coolant in the reactor, turns into heated steam and rotates the main turbine 4, and then is returned to water by the main condenser 5, and is again transferred to the reactor pressure vessel by the water supply pump 6. The water level inside the reactor is designed to remain almost constant at all times. In order to cool the nuclear fuel 2 and efficiently generate reactor steam, it is necessary to forcibly control the flow of reactor water in the reactor pressure vessel 1, and for this purpose, the recirculation system piping 8 is and a recirculation system pump 9 are installed. The recirculation system pump 9 once takes out the reactor water to the outside of the reactor pressure vessel 1 via the recirculation system piping 8,
By returning the reactor water to the reactor pressure vessel 1 again at a high flow velocity, reactor water is forced to flow inside the reactor pressure vessel 1 from the lower end of the nuclear fuel 2 toward the upper end. As described above, during normal operation of the BWR plant, two flows, the flow of reactor steam circulating through the main turbine 4 and the flow of reactor water caused by the recirculation pump 9, are always in operation. In this way, the BW in normal operating condition
The loss of coolant accident, which is the aforementioned design basis accident, occurred in the R plant when the recirculation system piping 8 suffered instantaneous double-sided rupture at the part marked X in FIG.

Here, a double-sided rupture means that the piping is completely ruptured.

In addition, the fracture opening portion is completely shifted from front to back, and the coolant flows out from both the front and rear of the X mark. BWR plants are generally equipped with a device called a pipe whip restraint that can prevent piping from shifting even in the event of a pipe break. Although such double-sided breaks are physically impossible to occur, it is necessary to ensure safety. In consideration of increasing the capacity of the device, it is customary to ignore the effects of such devices. Further, the recirculation system piping 8 is a stainless steel piping with a diameter of approximately 65σ and a wall thickness of approximately 3 crn,
The design is such that it can withstand even if the largest hypothetical earthquake (of course, much larger than the Great Kanto Earthquake) occurs based on the characteristics of the geology around nuclear power plants. It is extremely unlikely that a break will occur. Well, the reason why this piping rupture is assumed to be a design basis accident is because this piping is used for nuclear fuel
This is because the pipe with the largest diameter connected to the lower end of the pipe would have the greatest impact on the cooling capacity of the nuclear fuel medium if it were to break. In other words, what is the current approach to selecting design basis accidents?

Just select the one that has the greatest impact and
It can be said that not much attention has been paid to whether or not ゛ is likely to occur. Now, if this recirculation system piping 8 virtually instantaneously ruptures on both sides, approximately 7
Reactor water at a high temperature and pressure of 0 atm and approximately 280°C blows down through the fracture opening into the dry well 10.
Immediately flashing (boiling under reduced pressure) converts most of it into steam.

As a result, the pressure inside the dry well 10 rises rapidly,
The steam generated inside the drywell 1 due to the pressure pushes down the water level inside the vent pipe 11 and drains the suppression pool stored at the bottom of the suppression pool 12.
It mixes with pool water J3, cools and condenses. As a result, the design is such that the sudden pressure increase inside the dry well 1:1' caused by the blowdown of reactor water in the event of a loss of coolant accident is alleviated. However, in this state, as reactor water continues to flow out from the rupture port, the water level inside the reactor pressure vessel 1 drops rapidly, and the nuclear fuel 2 becomes completely exposed within a few tens of seconds after the accident. . When a loss of coolant accident occurs, the above-mentioned high dry well pressure or low reactor water level is detected and a safety protection signal is issued, and the reactor emergency shutdown system automatically scrams. Although the reaction immediately stops, a large amount of radioactive fission products (burnt remains of the nuclear fuel 2, ie.

Ashes of death. ) has accumulated, and its radioactive decay continues to generate a considerable amount of heat even after the nuclear reaction has stopped. This is called decay heat. Therefore, if the exposed state of the nuclear fuel 2 is prolonged even for a little while, the nuclear fuel 2 will become overheated, and if this continues, in the worst case, a so-called core melting accident will occur, which is the worst possible accident at a nuclear power plant. In order to avoid such a situation, an emergency core cooling system, which is one of the safety devices mentioned above, is provided. The basic configuration of the emergency core cooling system is to inject suppression pool water 13, which is held at the bottom of a suppression pool 12, into the reactor pressure vessel 1 via piping with a pump 14. Although the emergency core cooling system is not shown in the diagram, it actually consists of several systems, one of which is
The system is designed so that its safety functions will not be lost even if the system fails. In addition, the emergency core cooling system, like the nuclear emergency shutdown system, is designed to be automatically activated by a safety protection signal of high dry well pressure or low reactor water level. In this way, even if a loss of coolant accident occurs, the emergency core cooling system is automatically activated to restore the water level in the reactor, so damage to the nuclear fuel 2 can be avoided. The operation of this emergency core cooling system must continue for a long time after the accident in order to maintain the water level in the reactor. Meanwhile, reactor water continues to flow out from the break in the recirculation system piping 8. A considerable amount of decay heat is still being emitted from the nuclear fuel 2 even after the aforementioned 'X/C accident, and this is cooled and removed by the reactor water in the reactor pressure vessel 1, but on the other hand, the heated reactor The water flows into the dry well 10 from the break in the recirculation system piping 8 and increases the atmospheric temperature inside the dry well 10, after which it passes through the vent pipe 11 and is absorbed into the suppression pool water 13. This results in heating of 13. The decay heat generated from the nuclear fuel 12 in this way is ultimately transferred to the suppression pool water 13 by the reactor water flowing out from the fracture port, and this suppression pool water 1
3 is again used as a water source for the emergency core cooling system, returned to the reactor pressure vessel j, and further heated by the nuclear fuel 2VC, repeating the circulation process. As this circulation process is repeated, the temperature of the suppression pool water J3 will gradually rise, but if this is left unchecked, it will exceed the design temperature of the suppression pool 12. The internal pressure of the gas phase portion and the dry well 10 also reaches the saturation pressure, exceeding the design pressure. If the dry well 10 or the suppression pool 12 were to be damaged due to such a cause, the internal pressure that had been applied to the water surface of the suppression pool water 13 would suddenly be lost, and the suppression pool would be damaged.
Part of the pool water 13 boiled under reduced pressure, and the emergency core cooling system pump 14 could no longer obtain the necessary suction head (required NPSH), causing cavitation, making it impossible to inject water into the reactor pressure vessel 1. turn into. If this happens, the water level in the reactor will drop in a short time, and the nuclear fuel 2 will melt due to decay heat. In other words, this would lead to the worst core meltdown accident.

In order to avoid such a situation, the residual heat removal system, which is one of the safety equipment mentioned above, is provided.

The basic configuration of the residual heat removal system is as shown in Figure 1.
5, a heat exchanger 16, and piping and valves connecting these to the suppression pool water 13 and the gas phase portion of the suppression pool 12, the reactor pressure vessel 1, and the dry well 1i. The residual heat removal system can change the destination of the suppression pool water 13 by switching the valve. In this way, the residual heat removal system pumps up the suppression pool water 13 with the pump 15 and transfers it to the heat exchanger 16. After cooling in the dry well 10 or the gas phase of the suppression pool 2, it is possible to cool these gas phase and the suppression pool water 13 itself. In this way, the residual heat removal system is designed to cool the dry well 10 and suppression boule 12 after an accident and prevent them from overheating or overpressure damage.・
If piping is selected to guide the pool water 13 to the reactor pressure vessel 1, it can also be used to maintain the water level of the reactor, and also has the function of an emergency core cooling system. Although not shown in FIG. 9, in order to make the heat exchanger 16 function, it is necessary to operate a secondary system for circulating cooling water such as seawater into the heat exchanger 16. Also.

The residual heat removal system is A system and B system in a conventional BWR plant.
It consists of two systems. In Figure 1, one of these
Although only one system is shown, two systems are actually installed because the design is based on the single failure criterion mentioned above. The residual heat removal system is different from the reactor emergency shutdown system and emergency core cooling system mentioned above.

Since it is not needed immediately after an accident, there is no particular need for automatic activation by a safety protection signal. However, since the pump 15 is actually used as an emergency core cooling system immediately after an accident, it is designed to automatically start in an operation mode that uses piping leading to the reactor pressure vessel 1. Shortly after the accident, after confirming that the reactor water level could be stably maintained, operators manually switched the valves from the central control room.
0 or the suppression boolean 12 to the cooling mode. In this way, the residual heat removal system removes the decay heat generated from the nuclear fuel 2 even after a loss of coolant accident, and removes the decay heat generated from the nuclear fuel 2.
and the suppression pool 12 are collectively referred to as this. ) is designed to prevent overtemperature and overpressure damage and maintain its integrity. As explained above, the emergency core cooling system and the residual heat removal system are designed based on the assumption that a loss of coolant accident is a design basis accident, and further applies a single failure criterion.

However, as mentioned above, it is not only the loss of coolant accident, which is a design basis accident, that actually requires the safety functions of these safety devices in a BWR plant. For example, in FIG. 1, when the nuclear reactor is in normal operation, the water supply pump 6 may suddenly stop. If this happens, the supply of water to the reactor will stop, and the water level in the reactor will fall rapidly because the balance of water in the reactor will be disrupted. This is the so-called water supply loss Tr.
It is ancient. In this case, as the water level drops, it is first necessary to scram the reactor and then activate the emergency core cooling system to restore the water level. In this case, if the emergency core cooling system fails multiple times and the water level in the reactor cannot be maintained, a core melting accident will occur.

As described above, after a transient occurs, the emergency core cooling system or other reactor water replenishment capacity is lost, leading to a core meltdown accident, and the accident sequence separation valve (MSTV) 17 may suddenly close. This is the so-called MSIV closed Tran.
It is sient.

In this case, as mentioned above, the steam that continues to be generated in the reactor pressure vessel 1 will have no place to escape, and the reactor pressure will rise rapidly, but the safety protection signal of the reactor pressure high will prevent the scram from occurring. Once done, the nuclear reaction stops. Further, in order to reduce the pressure in the reactor, a relief safety valve 18 is automatically activated, and the design is such that reactor steam is guided into the suppression pool water 13 through a steam release pipe 19 and condensed.

In this case, the decay heat that continues to be generated from the nuclear fuel 2 is transferred to the suppression pool water 13 by the reactor steam moving in the steam release pipe 19, increasing the temperature of the suppression pool water. The amount of decay heat generated is no different from that in the case of a loss of coolant accident, so even in the case of this MSTV closed tran-sient, if the suppression pool water 13 is not cooled by the residual heat removal system, the reactor will be contained. The integrity of the vessel would be lost, ultimately leading to a core meltdown. In this way, the furnace steam cannot be guided to the main condenser 5 for cooling.
In the case of sient, the function of a residual heat removal system is essential. Another type of 'l'ra1sient is a main condenser vacuum loss transient, which occurs due to a small leak in the main condenser 5 or loss of external power supply. Furthermore, even if the relief safety valve 18 opens for some reason and then becomes stuck and cannot be closed (so-called ansient of the relief safety valve stuck open), the furnace steam will continue to be released into the suppression pool water 13. , operation of the residual heat removal system is essential.

When the function of the residual heat removal system is required as in these cases, if the residual heat removal system fails twice and the suppression pool water cannot be cooled, the reactor containment vessel may become overheated or Overpressure damage would eventually lead to a core meltdown. In probabilistic safety evaluation, this accident sequence in which the function of the residual heat removal system is lost after the K transient occurs, leading to a core meltdown accident, is generally referred to as a TW sequence. In addition, in the event of a so-called external power loss 'l'ransient, in which the external power supply is lost, if the emergency diesel generator fails twice, the electric drive system within the plant will become almost unusable, and this situation will continue. For example, if this continues for 10 hours, the water level within the reactor cannot be maintained, resulting in a core meltdown. General VC5tatio is a situation where all AC power sources in a plant become unusable.
It's called Blackout.

The three accidents mentioned above, TQUV sequence, TW fuse, and 5tation blackout, are among the most likely causes of core meltdown accidents in BWR plants, along with the ATWS mentioned above. This is the consensus conclusion of recent probabilistic safety assessments. Now, I will explain in detail why this result is obtained based on the diagram.

Figure 2 shows the system configuration of the emergency core cooling system and residual heat removal system in the case of the BWI (/5 plant).These safety devices of BWR15 are arranged in three main categories. First, in the first section, a reactor isolation cooling system 21 and a high pressure core spray system 23 are installed.
driven by.

Since the turbine 22 uses the reactor steam of the nuclear reactor as its direct driving source, it does not require any AC power source. In addition, the reactor isolation surface cooling system 21 is not officially included in the emergency core cooling system.
Rather, it should be called an auxiliary water supply system, but since it has almost the same function as the high-pressure core spray system for the TQUV sequence, it is shown side by side here. The reactor isolation surface cooling system is driven by the turbine 22 using reactor steam, so it has the ability to replenish reactor water in areas where the reactor pressure is high, but loses that ability when the reactor pressure drops by 1°C. do. On the other hand, the high-pressure core spray system 23 has the ability to spray and inject the suppression pool water from one side of the nuclear fuel using an electrically driven pump, and has the ability to inject water at all reactor pressures from high pressure to low pressure. have.

The high-pressure core spray system requires an AC power source to operate,
An external power source is used as the AC power source, but considering the low reliability of the external power source, a dedicated emergency diesel generator (II 24) is installed. Next, the second category includes a low-pressure water injection system. (q25 and low pressure water injection system fBl 26 have been installed as emergency core cooling systems. The low pressure water injection system (1-3
126 is also used as a residual heat removal system, and is a heat exchanger fBl 2
I own 7. All of these low-pressure water injection systems have the function of injecting suppression pool water into the reactor pressure vessel using an electrically driven pump, but they only perform flooding by simply injecting water, and do not have any particular spray function.

In addition, these low-pressure water injection systems have a furnace pressure of about 15 atmospheres or less Vc.
Unless it decreases by f, the water injection function cannot be performed.

AC power is required to drive these low-pressure water injection systems.
For this purpose, an external power source and an emergency diesel generator (FF
+28 is used. The low-pressure water injection system fBl 26 is designed to be used as a residual heat removal system by switching to the dry well and suppression pool cooling mode by an operator operating a valve from the central control room. Next, a low pressure core spray system 31 and a low pressure injection system fAl 29 are installed in the third section. The low-pressure core spray system 31 has the ability to spray and inject suppression pool water from above the nuclear fuel using an electrically driven pump, or, unlike the above-mentioned high-pressure core spray system, the reactor pressure is reduced to about 20 atmospheres or less. Otherwise, the water injection function cannot be started. The function of the low-pressure water injection system (A) 29 is exactly the same as that of the low-pressure water injection system fBl 26, and it has a heat exchanger fAl 30 and is used as a residual heat removal system by two manual switching operations. An AC power source is required to drive these low-pressure core spray system 31 and low-pressure water injection system (Al 29), and for that purpose an external power source and an emergency diesel generator ([132] are used. This is an explanation of the system configuration of the core cooling system and residual heat removal system, but for the sake of simplicity, only the main equipment is shown in the figure, and piping and valves are omitted as they are the same as shown in Figure 1. (This method is the same below.) The system configuration of W Ft/5 is B
It was completed by making numerous design improvements based on the experience gained up to WR/4. Later, a model called BWR/6 was also made.

This is mainly an improvement of the core part, and the system configuration of the safety device is the same as that of BW r (, / 5) without any changes. This means that the system configuration of BWR15 is based on the recirculation system piping. As long as instantaneous double-sided rupture is considered a design basis accident, BW
This shows that the R plant has become a complete product with no room for improvement.

However, from the perspective of probabilistic safety evaluation that emphasizes probability, there is still plenty of room for improvement in the system configuration of BWR15. In the world of probabilistic safety evaluation, this is not an extremely unlikely accident like a loss of coolant accident;
This is because an evaluation method is used that naturally draws attention to abnormal events that occur once to 10 times a year, such as Transient. For example, in the safety design of nuclear power plants, it is said that it is not necessary to take into account those whose occurrence frequency is less than 10-7 times/reactor year (
It has been adopted as a regulatory policy in the United States, Japan, and other countries. ) Using this, a simple probabilistic study yields the following. The probability that a major rupture L OCA will occur is 10-4 times/reactor-year, and the probability that one system of safety equipment will fail is l]0
'-2~10-'' times/Demand, respectively, from the tail, the probability that a major rupture I, o CA will occur and a single failure of the safety device will be superimposed on it] (1-6~
IO'Saliva - year, and it is an event that needs to be considered at the last minute. However, the probability that the safety device will cause a double failure is 10-8 to 10-10 times/reactor-year, so it can be said that there is no need to take this into account. Therefore, in this sense, large rupture LOC, which is the currently used design method,
It can be said that the combination of A-1-failure basis is reasonable. However, considering the case where a transient occurs, the probability that a double failure of the safety device will occur after that is 10-'' to 10-6 times/reactor/year, which is the judgment standard 1.
0-7 times/furnace/year", so it is necessary to take this into account. Also, 'I'ransie
The probability that a triple failure of the safety device will overlap with nt is also 10-5~
10-' times/furnace/year, which must be taken into consideration if the reliability of the safety device is extremely poor. As described above, the implications of the results of the probabilistic safety evaluation can be said to be significant from the perspective of the reliability design of safety devices, that is, the ability to withstand failures of safety devices. If we consider this problem in terms of the system configuration of BWR,/5 mentioned above, we will see the following.

First, if a loss of water supply 'r'ransient occurs, the reactor water level will drop, a scram will occur, and
Furthermore, when the water level drops 1-, the reactor isolation cooling system 21 and the high-pressure core spray system 23 are designed to automatically start up to maintain the reactor water level. However, as mentioned above, these two
The probability of a double failure occurring in one water injection system exceeds the criterion of 10-' reactor years. Therefore, it is necessary to assume such an event as a subject of design consideration. If such an event were to occur, all other low-pressure emergency core cooling systems would have to be used because the reactor would be under high pressure. Therefore, if the operators do not succeed in depressurizing the reactor by manually activating the relief safety valve, a core meltdown will occur, but the probability that operators will succeed in this type of manual operation in such an emergency is is not necessarily high. This is because manually activating the safety relief valve when the water level in the reactor is already low will only accelerate the decrease in reactor water, causing a kind of coolant loss accident. This is because there is too much mental resistance for the operators. In this way water supply loss Transien
The accident that was triggered by the double failure of the high-pressure water injection system after 30 minutes and led to a core meltdown is exactly the same as the TQUV sequence described above. Next, the main steam isolation valve closes (MSTV closes)
In the case of a transient, the reactor pressure rises suddenly, causing a scram, and the safety relief valve is automatically activated to transfer reactor steam to the suppression pool, causing the temperature of the suppression pool water to gradually decrease. Rise. Operators must manually turn on the low pressure water injection system (Bl 2) before the suppression pool water temperature reaches the limit value.
6 and the low-pressure water injection system (Al 29) are designed to switch to the suppression pool cooling mode of the residual heat removal system to prevent overtemperature or overpressure damage to the reactor containment vessel.However, as mentioned above, The probability of double failure in these two residual heat removal systems exceeds the criterion of 10-7 times/furnace-year.

It is necessary to assume such events as a subject of design consideration. Assuming such an event, there are only two residual heat removal systems, so the reactor pressure vessel will overheat or overpressure, and the emergency core cooling system pumps will need to meet the required suction head (necessary NFSI). -1) is no longer obtained and the reactor is shut down, resulting in a core meltdown accident. The accident that leads to a core melting accident due to a double failure of the residual heat removal system after an MSTV closed transient etc. has occurred in this way is exactly the same as the above-mentioned TW sequence. Next, let's consider a case where the emergency diesel generator triple-fails after an external power loss transient occurs.

The probability of this event occurring may exceed the aforementioned 10-7 times/reactor-year. In Japan, the reliability of these power sources is much higher than in other countries.

It can be said that there is no need to assume such a 5tation blackout event. On the other hand, in countries such as the United States, where the reliability of power supplies is poor, 5tation Bla
The assumption of ckout is originally necessary for a court lady. 5tatio
n When a blackout occurs, the only system that can operate is the reactor isolation cooling system, and its operation lasts approximately 8 days.
It cannot continue beyond time. This is because a DC power source (battery) is required to control the operation of the reactor isolation cooling system, and its capacity is only about 8 hours. Therefore, the Ruto reactor core meltdown accident continued even after the 51st ation blackout occurred. As mentioned above, the current BWR,/5 system configuration is designed to be sufficiently reliable against loss of coolant accidents, but I'ransient K, which occurs much more frequently,
However, we cannot deny the possibility of a double failure of the safety device,
There is a risk of causing a core meltdown accident. This is also clear from the results of probabilistic safety evaluation. Figure 3 shows BWR
This figure shows the results of probabilistic safety evaluation for 15 plants. The size of the circle indicates the probability of core meltdown for the entire plant. Among these, contribution 33 due to the TC sequence accounts for about 1/3 of the core melting probability. TC sequence is another name in the probabilistic safety assessment for ATWS mentioned above. The contribution 33 due to this TC sequence can be reduced to 1/10 or less by adopting the design enhancement measures determined by the US NRC mentioned above. Next, a double failure of the residual heat removal system led to a core meltdown accident1.
The contribution 34 of the W sequence also accounts for about 1/3 of the total core melting probability. Also, TQUV sequence and 5ta
The total contribution of tion 1 (lacko++t, 35, accounts for about 1/3 of the total probability of core melting. The contribution of 36 due to loss of coolant accident accounts for only about 1/30 of the total probability of core melting, and Most of this is the contribution of small I and OCAs caused by small-diameter pipe ruptures, etc., and the contribution of large L OCAs, which are currently considered as design basis accidents, is too small to be shown in the diagram. In this way, it can be said that the current system configuration of the safety equipment of BW f'(/5) has sufficient reliability against major LOCA, which is the design basis accident. For large transients, the reliability of safety devices is considerably lower than for large LOCAs, and it can be said that the possibility of a core meltdown triggered by a transient is much greater.

[Purpose of the invention]

Therefore, the present invention considers the above-mentioned situation VC@, and if only the coolant loss accident causes f', g (, Trans
-Has sufficient reliability and ability to respond to 1ent.

The purpose of this invention is to provide a safety device for a nuclear reactor that can sufficiently reduce the probability of a core meltdown occurring.

[Embodiments of the invention]

An embodiment of the present invention will be described below based on the drawings. The present invention has three major system configurations of the safety device as shown in Fig. 4.
It is divided into two categories. First, in the first section, a reactor isolation cooling system 4 and a low pressure injection system (CI 43) are installed.
driven by.

Since the turbine 42 uses the reactor steam of the nuclear reactor as its direct driving source, it does not require any alternating current power source.

Note that the reactor isolation cooling system 41 may not be officially included in the emergency core cooling system, so it is not included in the second section. It may be placed in a third section or in a completely different section. This occurs because the reactor isolation cooling system does not require an emergency diesel generator to drive it.
It is ty. On the other hand, the low pressure water injection system (fc) 43 is also used as a residual heat removal system and has a heat exchanger (q44). It also has the function of injecting heat into the lid drywell and suppression pool by remotely and manually switching the valves so that the operator can use it as a residual heat removal system.

The heat removal capacity of the residual heat removal system is assumed to be 50% of the capacity required based on current analytical methods in the event of a loss of coolant accident. An AC power source is required to drive the low-pressure water injection system (Q43, so an external power source and an emergency diesel generator (1
145 is used. Next, in the second section, a high pressure core spray system (B+ 46) and a low pressure injection system (Bl 47) will be installed as emergency core cooling systems.A high pressure core spray system (B14) will be installed as an emergency core cooling system.
6 has the ability to spray and inject suppression pool water from above the nuclear fuel using an electrically driven pump, and has the ability to inject water at all reactor pressures from high pressure to low pressure. On the other hand, the low pressure water injection system 1314.
The performance and function of 7 is exactly the same as that of the low pressure water injection system FC143, and it is also used as a residual heat removal system.
It has a heat exchanger (B148). AC power is required to drive these high-pressure core spray system fBl 46 and low-pressure injection system (B) 47, and for this purpose an external power supply and an emergency diesel generator fill 49 are required. use.

Next, the third section includes a high pressure core spray system (Al 50
.

Low pressure water injection system TAI 51, heat exchanger fA152. and an emergency diesel generator fllll 53, but their performance and functionality is dependent on the high pressure core spray system fB146. Low pressure water injection system (Bl 4.7.
Heat exchanger (B8) and emergency diesel generator flu
) Each is exactly the same as that of 49. In addition, in the above explanation, categories 1, 2゜3 or A, B, C and r,
Symbols such as IT, I, etc. are used, but these are used for convenience to distinguish strains of the same species, and the order has no essential meaning, and 2.3 has been updated. Of course, it is okay to rename it as Category 2°3.1.

Also, for simplicity, only the main equipment is shown in the diagram.

The piping, valves, etc. are the same as those shown in FIG. 1, so they are omitted as described above.

Furthermore, heat exchanger (Al 52. Heat exchanger (B+14
s and the heat exchanger (C) 44 each include a secondary system for circulating cooling water, but this is also not shown for simplicity, but it is a safety feature of the nuclear reactor according to the present invention. It goes without saying that it is an essential part of the device.

Next, the operation of this embodiment will be explained.

First, if a supply water loss transient occurs, the reactor water level drops, a scram is performed, and when the water level drops further, the reactor isolation cooling system 41. High pressure core spray system (Al50) and high pressure core spray system (Bl4
6 automatically start according to the respective start-up water levels. As mentioned above, the probability that up to two of these three water injection systems will fail exceeds the judgment standard IO', so it is necessary to consider this as a design target. If such an event is assumed.

However, due to the high pressure of the reactor, none of the other low pressure emergency core cooling systems could be used immediately.

In this example, there are three high-pressure water injection systems, so even if two of them fail, the water level in the reactor can be maintained by the remaining high-pressure system, thereby avoiding a core meltdown accident. can do.

Additionally, because the high-pressure water injection system can maintain the water level in the reactor, there is no need for operators to manually activate the safety relief valve to depressurize the reactor and activate the low-pressure emergency core cooling system. Next, close the main steam isolation valve (MSTV close) Tr
In the case where an ancient nuclear reactor occurs, the reactor pressure rises rapidly, a scram occurs, and the relief safety valve automatically operates to transfer reactor steam to the suppression pool, causing the temperature of the suppression pool water to gradually rise.

The operator controls the suppression pool water temperature (low-pressure water injection system fAl 51 by remote manual control before reaching the U value).
The low pressure water injection system (B147.) and the low pressure water injection system (043) are switched to the suppression pool cooling mode of the residual heat removal system to prevent the reactor containment vessel from overheating or overpressure damage.These three residual heat removal systems As mentioned above, the probability that up to two of them will fail is the criterion 10-
Since it exceeds 7 times/reactor/year, it needs to be taken into consideration in the design. Even if such an event is assumed, there are three residual heat removal systems in this embodiment, so even if two of them fail, the remaining one system will cool the suppression pool water. It is possible to avoid a core meltdown accident. Although the vessel in one system of the residual heat removal system has only 50% of the capacity required based on current analysis methods in the event of a loss of coolant accident,
Analysis of probabilistic safety evaluation has confirmed that 30% to 50% capacity is sufficient. This is because the probabilistic safety assessment makes more realistic assumptions about the criteria for determining the integrity of the reactor containment vessel. Conversely, the criteria for determining the integrity of the reactor containment vessel currently used in the safety analysis of loss of coolant accidents are extremely unrealistic and too strict; Since it is only necessary to consider up to a single failure of the residual heat removal system as shown in 2, in this embodiment, up to two of the three residual heat removal systems can be used, and 100% heat removal capacity is achieved with 2 x 50%. This makes it possible to fully respond to the current safety analysis in the event of a loss of coolant accident.

The nuclear reactor safety device of the present invention, which has the above-described effects, provides the following effects. There are two high-pressure water injection systems: a reactor isolation cooling system and two high-pressure core spray systems.
Since there are three systems in total, even if we consider a double failure of the high-pressure water injection system after a loss of water supply is confirmed, there is no need for operators to manually start the relief valve, and the TQUV sequence significantly reduces the probability of a core meltdown accident. can be reduced. Also.

Even if we consider the double failure of the residual heat removal system when a 'l'ransient occurs in which the heat removal function of the main condenser is lost, such as when the main steam isolation valve is closed, the residual heat removal system is Since there are three systems, the TW fuse can reduce the probability of a core meltdown accident.The effects of these factors can be quantitatively shown using the results of a probabilistic safety assessment as shown in Figure 5. .In Fig. 5, first, the reason why the TW sequence input 55 is only reduced by about half is because
This is because the residual heat removal system requires a secondary system as mentioned above, and the contribution of failure of this secondary system is evaluated to be large.
In reality, it can be considered to have a large effect. Also,
Since the contribution of TQUV sequence is reduced to about 1/10 or less, TQ[, JV sequence and 5tat
The total contribution by ion Blackout is 56 BW
This is reduced to about half compared to R15. 5tat
The contribution from ion Blackout is 3 when the number of emergency diesel generators is the same as B W R/5 in this example.
Since it is a base, there is no reduction in BWR compared to BWR15. Sarashin In Figure 5, the contribution 54 due to the TC sequence is USN
The result is shown when measures to strengthen the design of R and C are adopted, so the BWR is thicker (reduced) compared to the case of the current BWR, 15.

When these effects are combined, the overall probability of core meltdown can be reduced to about 1/3 compared to the current BWR15. Furthermore, in this embodiment, the two high-pressure core spray systems and the three low-pressure water injection systems have exactly the same design.

This is extremely advantageous in parts procurement, maintenance inspections, repairs, etc., and it also has the effect of eliminating the complexity of managing a total of five types of systems, such as the current BWI (15). It is also expected that the reliability of the system will be improved by reducing the number of incorrect connections and operational errors during maintenance and inspection.

In addition, in this embodiment, the heat removal capacity of the residual heat removal system is set to 3 x 50% = 150% in total of the three systems, which is compared to the conventional BWR.
This is a 50% reduction compared to No. 15, where the total of the two systems is 2X]OO% = 200%.

This also applies to all secondary systems in the residual heat removal system.
This means that the capacitance is designed to be reduced by 0%, which results in a large cost reduction effect. This is because the secondary system of the residual heat removal system accounts for the largest proportion of the total cost of the emergency core cooling system and the residual heat removal system. As a modification of this embodiment, it is also conceivable to design the heat removal capacity of the residual heat removal system to be 3X100%. In this case, the cost reduction effect cannot be obtained, but it is assumed that two systems of safety devices are in an unusable state due to N-2 (single failure and maintenance), which is a regulatory requirement in European countries. This has the effect of creating a design that can accommodate even the most demanding situations. Also, in this embodiment, the high pressure side is a spray system and the low pressure side is an injection system, but on the contrary, the high pressure side may be an injection system and the low pressure side a spray system, or both the high pressure side and the low pressure side may be injection systems. Even if the above-mentioned method is used, the above-mentioned effects can be obtained in exactly the same way.

Next, another embodiment of the present invention will be described based on the drawings. FIG. 6 is a system configuration diagram showing another embodiment of the nuclear reactor safety device according to the present invention. In this embodiment, a fourth division is newly provided, which includes a low-pressure water injection system fl)l 6 ] and a heat exchanger (D+ 62 and an AC power supply) for using the low-pressure water injection system (D+ 61 as a residual heat removal system). An emergency diesel generator (■) 63 is installed as an emergency diesel generator.
Second. The third section is basically similar to the embodiment shown in FIG. However, it is assumed that there are two types of heat removal capacity of the four residual heat removal systems: 4 x 10% and 4 x 50%. According to this embodiment, as shown in FIG. 7, since the residual heat removal system has been further strengthened to a Vc4 system, the contribution 72 due to the TW flux is reduced to 1/10 or less compared to the case of BWR15. In addition, since the number of emergency diesel generators has been increased to four, the contribution of 5tation blackout has also been reduced, and the contribution of TQUV sequence and 5tation blackout have been reduced.
tion! The total contribution of 31 ack-outs is 71.
This is significantly reduced compared to the case of WR15. This has the effect of reducing the probability of core meltdown to 1/10 or less of that in the case of BWR15. Other effects are basically the same as the embodiment shown in Figure 4, but the secondary system of the residual heat removal system is
If you design with 3% = 133%, the cost will be even higher.
You can get the effect of down. Even with a 4 x 33% design, it has a heat removal capacity of 3 x 33% = 100% under the current single failure standard, and the design is compatible with the current safety analysis of loss of coolant accidents. There is.

If the 4×50% design is adopted, the effect of cost reduction cannot be obtained, but the effect of being able to meet N-2, which is a regulatory requirement in European countries, at a lower cost can be obtained. In this embodiment as well, the spray system and the injection system can be selected arbitrarily, and the effect produced remains the same.

〔Effect of the invention〕

In this way, the nuclear reactor safety device according to the present invention enhances the ability of the BWR plant to respond to various types of transient K.

The probability of occurrence of core meltdown 11 is significantly reduced, and.

Costs can be reduced and BWR plants can be further advanced.

[Brief explanation of drawings]

Figure 1 is an explanatory diagram showing an overview of the overall movement of a conventional BWR plant during normal operation and in the event of an accident, and Figure 2 is an overview of the safety equipment system of the current BWR/5 reactor. The configuration diagram shown in Figure 3 is the current BWI (
/ 5 is an explanatory diagram showing the magnitude of the core melting probability by contribution, Figure 4 is a block diagram showing the outline of the system of the nuclear reactor safety device according to the present invention, and Figure 5 is the nuclear reactor safety device according to the invention. An explanatory diagram showing the magnitude of the probability of core melting of a BWR plant employing the BWR plant according to contribution, FIG. 6 is a block diagram showing an outline of the system of another embodiment according to the present invention, and FIG. 7 is a diagram showing another implementation according to the present invention. It is an explanatory diagram showing magnitude of core melting probability of a BWR plant which adopted an example by contribution. 1... Nuclear reactor pressure vessel, 2... Nuclear fuel. 3...Main steam pipe, 4...Main turbine. 5...Main condenser, 6...Water pump. 7... Water supply pipe, 8... Recirculation system piping. 9...Recirculation system pump, 10...Dry well. 21... Reactor isolation cooling system, 22...
・Turbine. 23...High pressure core spray system. 31...Low pressure core spray system. 25, 26.29...Low pressure injection system.

Claims (2)

[Claims] (1) The first section is equipped with a residual heat removal system (including a secondary system) that can also be used as a low-pressure emergency core cooling system and an emergency diesel generator to drive it. Each of the 3 sections will be equipped with a high-pressure emergency core cooling system, a residual heat removal system (including a secondary system) that can also be used as a low-pressure emergency core cooling system, and an emergency diesel generator to drive them. A safety device for a nuclear reactor, further comprising one reactor isolation cooling system installed in any division. (2) Added a fourth section and added a residual heat removal system (including a secondary system) that can also be used as a low-pressure emergency core cooling system and an emergency diesel generator to drive it. A safety device for a nuclear reactor according to claim 1, which is installed.