failure of the emergency diesel generator is assumed as it gives the severest result for the single component failure that could occur among the systems which are required to achieve the safety function of core cooling, that is among the ECCS system, the safety protection system required to start the system, and the power supply system. From the viewpoint of confinement of radioactive materials, a different single failure would be assumed.

4. Operator action

In the safety evaluation, an appropriate time margin, which is necessary for an operator to start an action to cope with an event, should be taken into consideration. That is, after adequate information is given to the operator who will make an appropriate judgment, at least 10 minutes is given in the evaluation before starting an operation. Concerning operator’s actions, some countries like Germany apply a design policy that forbids any operator's action for several to 30 minutes at the beginning of an anomaly, leaving the power plant to respond automatically. Unlike this policy, an operator’s action for mitigation is accepted but the action in the initial time period is disregarded in the safety evaluation in Japan.

5. Treatment of control system

Since BWRs are direct cycle plants, operation conditions of such systems, as the flow control system of the primary system (recirculation system), the feed water flow control system, and the turbine system, directly affect the safety analysis results. For example, if the turbine system is neglected, the reactor pressure change cannot be calculated and the change of void ratio by the reactor pressure change that affects the core reactivity cannot be determined.

The evaluation of "anticipated Operational occurrences" for BWRs is performed expecting the control system functions of opening and closing the turbine bypass valve are working, as shown in Section 7.2.4. This is because, even if a malfunction of a control system occurs, it will not result in a significantly serious situation as superior mitigation functions of other systems and components can be expected to function. This allows the safety evaluation to be based on the actual conditions. Moreover, in the concept

of defense in depth, an "anticipated operational occurrence" is considered as the initiating event for the second level safety measures, and in order to cope with it, the control system is dealt with first, and when it fails, the "accident" is considered for the safety system.

On the other hand, in the "accident" evaluation, when a control system has a function to mitigate the accident, a conservative viewpoint is taken and the control system is assumed not to work.

2. Anticipated Operational Occurrences

1. Assumption of Event

As “anticipated operational occurrences”, potential events are selected that may happen one or more times in the lifetime of a reactor facility and may bring about excessive damage to the core and/ or reactor coolant pressure boundaries if they are left uncontrolled. The following 12 events in three categories of impact are analyzed as potential events for BWRs.

1. Abnormal change in reactivity or power distribution in the core

1. Abnormal withdrawal of control rods during reactor startup

2. Abnormal withdrawal of control rods during power operation

2. Abnormal change in heat generation or heat removal in the core

1. Partial loss of the reactor coolant flow

2. Inadvertent startup of a shutdown loop of a reactor coolant system (except for ABWR)

3. Loss of offsite power

4. Loss of feed water heater

5. Malfunction of a reactor coolant flow control system

3. Abnormal change in reactor coolant pressure or reactor coolant inventory

1. Loss of load

2. Inadvertent closure of a main steam isolation valve

3. Failure of the feed water control system

4. Failure of the reactor pressure control system

5. Complete loss of feed water flow

The criteria of "anticipated operational occurrences" are provided in Table 7.1.1. Items

1. through (3) in the table are criteria related to

7-5

NSRA, Japan

Time(S)

[Source] Application for Approval of Reactor Establishment or Alternation, Fukushima Daini Nuclear Power Station, June, 2003 (Unit3,9x9Afiiel)

Figure 7.2.1 Transients of the event, abnormal withdrawal of control rods during reactor startup

A and B channels were bypassed.

In this event, the reactor is scrammed by the signal of the SRNM short period, and the highest value of the fuel enthalpy is about 92 kJ/kg-UO₂. The highest value of the reactor pressure is about 7.06MPa [gage].

In such reactivity insertion events, it is better to evaluate the enthalpy produced in the fuel which is closely related to fuel failure rather than pay attention to the existence of a boiling transition or the temperature rise of the cladding tube. Therefore, for the evaluation of the enthalpy guide, the highest enthalpy of UO₂ is about 92 kJ/kg-UO₂, and it is sufficiently less than 712 kJ/kg-UO₂ (170 cal/g-UOa) which is the enthalpy guide shown in the reactivity insertion guides.

In this transient, the increment from the initial value of fuel enthalpy is about 17 kJ/kg-UO₂.When

NSRA, Japan

7-6

15

5

10

Time (s)

Figure 7.2.3 (1) Transients of the event, loss of load (25% bypass plant) (1)

Figure 7.2.3 (4)

Transients of the loss of load (100% bypass plant)

7-7

NSRA, Japan