Safety assessment for ITER-FEAT tritium systems

Transcription

1 Fusion Engineering and Design 63/64 (2002) 181/186 Safety assessment for ITER-FEAT tritium systems T. Pinna a,, C. Rizzello b a ENEA FUS TEC / Thermonuclear Fusion Division, Via E. Fermi 45, I-00044, Frascati, Rome, Italy b TESI Sas-Servizi di ingegneria per la chimica, la sicurezza e l ambiente, Via Bolzano Roma, Rome, Italy Abstract The design of the equipment and confinement barriers of ITER-FEAT should be consistent with the basic safety requirement that no emergency plan involving evacuation of the nearby population is required in case of the worst credible accident. Extensive probabilistic and deterministic analyses have been done to select abnormal event sequences, and to ensure that all potential consequences are within project guidelines. The paper deals with the work done for the tritium systems. A Bottom /Up methodology based on component level Failure Mode and Effect Analysis has been applied to point out accident initiators. Once possible accident sequences have been identified, detailed deterministic analyses on bounding events confirmed that the accidents in tritium plant are not a concern from a safety point of view. The no-evacuation goal of ITER-FEAT is attained also for accidents where ultimate safety margin are challenged, as in case of hydrogen-air reactions in cold box or in hard shell, enclosing the process equipment of the isotope separation system. # 2002 Elsevier Science B.V. All rights reserved. Keywords: ITER-FEAT; Detonation; Tritium; FMEA 1. Introduction The design of the equipment and confinement barriers of ITER-FEAT should be consistent with the basic safety requirement that no emergency plan involving evacuation of the nearby population is required in case of the worst credible accident. Extensive analyses have been done to point out the overall abnormal event sequences Corresponding author. Tel.: / ; fax: / addresses: pinna@frascati.enea.it (T. Pinna), claudiorizzello@libero.it (C. Rizzello). that could arise from failures or malfunctions in the plant systems, to verify and ensure that all potential consequences are within project guidelines. A Bottom /Up methodology based on component level Failure Mode and Effect Analysis (FMEA) has been applied to point out a complete and detailed list of accident initiators [1]. Consequences arising from initiators have then been studied in terms of plant damages, radioactive mobilization and possible release [2]. This paper describes the overall process applied for the tritium systems safety analysis and related main results /02/$ - see front matter # 2002 Elsevier Science B.V. All rights reserved. PII: S ( 0 2 )

2 182 T. Pinna, C. Rizzello / Fusion Engineering and Design 63/64 (2002) 181/ Failure mode and effect analysis Three systems have been assessed up to now: tokamak and exhaust processing system (TEP), storage and delivery system (SDS), isotope separation systems (ISS).The set of the most important components for safety analyses have been identified on the base of design information reported in the plant design description documents, on Process and Instrumentation Diagrams and, in Outline Flow Diagrams. Then, the different operating states in which the various components normally operate have been considered, both in order to assess consequences related to single failures and, in order to evaluate annual frequencies of failures and malfunctions. Burn and dwell, baking, hot stand-by, cold stand-by, accountancy operations and storage are the main operating states considered for the various components. For each component all the possible failure modes, in the various operating states, have been evaluated pointing out frequencies and category classification (according to [3], see below), failure causes and possible actions to prevent the failure, consequences and actions to prevent and mitigate the consequences. Classes defined in the ITER*/Generic Site Safety Report [3] for the event categorization, in terms of frequencies, are the following:) / I) Operational events, occurrence /1 times/year II) Events likely during project life, occurrence from 1E-2 to 1 times/year III) Events unlikely during project life, occurrence from 1E-4 to 1E-2 times/year IV) Extremely unlikely events, occurrence from 1E-6 to 1E-4 times/year V) Extremely unlikely events, occurrence B/1E-6 times/year From the overall set of component elementary failures, a limited set of initiators has then been selected as postulated initiating events (PIEs) considering both severities of the accidents and, of the faulted plant conditions. Typically, the initiators most representative from a safety point of view in terms of expected frequency and radiological consequences have been selected. Then, each elementary failure has been classified in one PIE and, conservatively, the total frequency of the PIE has been estimated by adding the ones expected for each elementary initiator. The PIEs so defined have been useful to aggregate the set of accident initiators that must be considered in the deterministic transient analyses, being them, the most challenging events for the plant (the related consequences are expected to be the most severe of those from the aggregated set of elementary initiators). The conservative approach, followed in this way to operate, can be refined if it should lead to an unnecessary heavy burden on the systems from safety perspective, for instance if events with an expected range of frequencies should cause consequences not acceptable by safety requirements and design guidelines. All elementary failures not inducing safety relevant consequences have been classified in a PIE named N/S (Not Safety relevant). Although such failures are not important for safety studies, they could be important on defining plant availability and the maintenance strategy. A sample of the FMEA tables is reported in Fig. 1. To manage the FMEA results, a dedicated tool has been developed by ENEA [4]: this tool generates, for each PIE, a complete list of the elementary failures that contribute to cause the event and evaluates the related total frequencies (see the sample of Fig. 2). The total number of PIEs identified by assessing elementary failures related to the different components of the tritium systems is nine, the complete list is reported in Table Accident sequences analysis For each PIE, the impact of the initiating event on the plant has been investigated and, the safety functions required to protect the plant and mitigate the consequences have been identified. Event sequences are developed by considering the success/failure of the systems implementing the required safety functions. ITER plant safety is based on the principle of the defence in depth. In tritium systems this

3 T. Pinna, C. Rizzello / Fusion Engineering and Design 63/64 (2002) 181/ Fig. 1. Sample of FMEA table developed for ITER-FEAT tritium system. principle is implemented by the use of successive barriers preventing the release of radioactive materials to the environment. The rationale is to limit the dilution of tritium within each barrier system, so that, it can be recovered before it can penetrate to the next barrier. The first confinement is a high-integrity primary containment that is normally the processing equipment, connecting pipe, storage containers etc. All process components and piping containing significant quantities of tritium are protected by a secondary enclosure. This is used to avoid the dispersion of the tritium accidentally spilled from process equipment into the operating areas. Such enclosures include glove boxes, cold boxes and caissons. Secondary confinement enclosures are equipped for the detection and the recovery of any tritium spill. All tritium related equipment in the tritium plant is enclosed within a building that constitutes the tertiary barrier of confinement. Enclosures and rooms in the tritium plant are equipped by devices able to automatically isolate the ventilation systems and switch on the detritiation systems in case of accidental release of tritium. The effectiveness of fuel cycle system isolation and, the effectiveness of containment barriers in reducing the leakage and/or permeation of tritium through engineered safeguards have been assessed by evaluating the amount of tritium released from process equipment for the reference accidents. The bounding accident conditions for the PIE TPL1 (Table 1) are associated to the failure of a Fuelling Surge tank in SDS. This because, as shown in Table 2, the tritium inventory and the process flow rate combine in the larger release of tritium into the glove box atmosphere. To the amount of tritium released during pressure equalisation between process line and GB have been added the amount of tritium releasable for a delay

4 184 T. Pinna, C. Rizzello / Fusion Engineering and Design 63/64 (2002) 181/186 Fig. 2. Sample of elementary failures listed for a PIE. Table 1 Total list of PIEs identified by the FMEA on tritium systems Code Description Category TPL1 Break of tritium process line inside glove box containment of tokamak exhaust processing system II TPL2 Leak of tritium process line inside glove box containment of tokamak exhaust processing system II TSL1 Break of tritium storage and delivery system process line inside glove box containment II TSL2 Leak of tritium storage and delivery system process line inside glove box containment I TPC1 Break of tritium process line inside ISS cold box containment III TPC2 Leak of tritium process line inside ISS cold box containment III TPH1 Break of tritium process line inside ISS hard shell containment II TPH2 Leak of tritium process line inside ISS hard shell containment II TPO3 Release of tritiated effluents to environment due to pressure and temperature fluctuations on ISS cryogenic distillation column 1 II N/S Not Safety relevant initiator

5 T. Pinna, C. Rizzello / Fusion Engineering and Design 63/64 (2002) 181/ Table 2 Possible tritium release into glove box System/Components T inventory (g) Process flow rate (g/min) T released during pressure equalisation (g) Front-end permeator and feed buffer tank Fuel storage beds B/100 6 B/5 Fuelling line to tokamak Fuelling surge tank Impurity detritiation 12 B/1 2 in the isolation of the process line (15 s), obtaining a total amount of 14.5 g of tritium in GB. Following the intervention of glove box tritium monitors glove box detritiation system is activated to recover the spilled tritium. During the clean up a little amount of tritium escapes from the glove box atmosphere into the operating room, mainly by permeation through the gloves. In such a sequence, the maximum concentration of tritium reached in the room is estimated to be mg T/m 3, lower than the threshold value of room tritium monitors, which is 0.35 mg T/m 3. Therefore, the atmosphere detritiation system is not activated and tritium is dispersed to the environment through the exhaust ventilation. This accident would lead to a tritium dispersion to the environment of 0.16 mg, well below the design release limit of 1 g prescribed by the ITER*/ Generic Site Safety Report [3] for category II events. Releases of hydrogen isotopes from the ISS equipment to the cold box or the hard shell containment (HSC) have been considered in PIEs TPC1 and TPH1 (Table 1). In case an imperfect leak-tightness of the cold box exists, an abnormal accumulation of air in the cold box occurs because the condensation on the surfaces of the enclosed cryogenic equipment (such phenomena makes difficult the detection of imperfect cold box tightness, because a simple monitoring of vacuum pressure is not sufficient). A spill of hydrogen isotopes into the cold box (TPC1 event) could lead to the reaction of hydrogen with the air trapped on cryo-surfaces. An overpressure, due to a hydrogen-air reaction and to the resulting thermal expansion, is generated if the concentration of air and hydrogen in the cold box attain the flammable limits. This depends both on the amount of spilled hydrogen and on the mass of accumulated air. By considering the whole inventory of ISS (11 m 3 */450 moles of hydrogen isotopes) discharged into the cold box, high peaks of pressure, larger than the design value of the cold box, can be reached only in case of air in-leakages too large to be credible. The main concern for hard shell confinement is the simultaneous failure of a process pipe or equipment (TPH1 event) and a pneumatic pipe (e.g. for pneumatic valves actuation); here no consequence of concern are expected provided that: (a) an inert gas is used for pneumatic actuations, and (b) the pressure in the pneumatic pipes is kept lower than the design pressure of the HSC. The ultimate safety margins of the plant has been assessed too, to confirm that a further degradation of systems would not lead to cliff edge effects. This assessment includes some possible aggravating factors, i.e.: failure to isolate the broken/failed system/component, a consequential failure of nearby systems, e.g.: loss of electric power, etc. Particular aggravating failures considered studying the ultimate safety margins are the failures involving the process system and the related containment at once (double failure accidents) as a reaction of H 2 -air could take place. This accident scenario includes a turbulent jet fires or an explosion inside the operating area. If hydrogen isotopes are ignited at the point of release, then a turbulent jet fire occurs. The thermal expansion of gas resulting from an adiabatic reaction (this is a conservative assumptions) leads to the venting to the environment through

6 186 T. Pinna, C. Rizzello / Fusion Engineering and Design 63/64 (2002) 181/186 the exhaust ventilation of 18.4 m 3 of air, containing 2.6 g of tritium in form of oxide. This air is expelled prior that the atmosphere detritiation system could come into operation. The obtained result is still below the limits given by the safety design targets (5 g T/event in HTO form) [3]. If the released hydrogen isotopes have the time to mix with air prior to be ignited, then an explosion inside an operating area can occur. The investigation of such accident has been made by means of a model for hydrogen diffusion in air that requires the assessment of the flow rate and the pressure of the released hydrogen. The amount of H 2 for which, ignition conditions could be reached (a cloud within the flammable limits) has been estimated in 10 g, while the amount of H 2 within the limits of concentration in air compatible with a detonation is only 0.22 g of H 2. Due to the low amount of hydrogen isotopes involved, the consequences related to an explosion or a detonation are milder than the ones related to turbulent jet H 2 fire. 4. Conclusions The study confirms that the accidents in tritium plant are not a concern from a safety point of view and that also for accidents where ultimate safety margin are challenged, the no-evacuation goal of ITER-FEAT is attained, as for example in case of Hydrogen-air reactions in cold box or in hard shell, enclosing the process equipment of the ISS. References [1] T. Pinna, C. Rizzello, Failure mode and effect analysis for tritium systems of ITER FEAT, ENEA FUS-TN-SA-SE-R- 017 (May 2001). [2] C. Rizzello, T. Pinna, Accident sequences analysis related to ITER FEAT fuel cycle systems, ENEA FUS-TN-SA-SE-R- 004 (May 2001). [3] ITER Generic Site Safety Report (GSSR) (July 2001). [4] T. Pinna, R. Caporali, L. Burgazzi, Selection of accident sequences for the new design of ITER, Proceeding of the Fifth PSAM International Conference on Probabilistic Safety Assessment and Management, Osaka, Japan, November 27/Decmber 1, /159.