- Email: [email protected]
Accident management following loss of residual heat removal during mid-loop operation in a Westinghouse two-loop PWR
Nuclear Engineering and Design 238 (2008) 2173–2181
Contents lists available at ScienceDirect
Nuclear Engineering and Design journal homepage: www.elsevier.com/locate/nucengdes
Accident management following loss of residual heat removal during mid-loop operation in a Westinghouse two-loop PWR J. Birchley a,∗ , T.J. Haste a , M. Richner b a b
Paul Scherrer Institut, CH-5232 Villigen, Switzerland Nordostschweizerische Kraftwerke (NOK) - NPP Beznau, CH-5312 D¨ ottingen, Switzerland
a r t i c l e
i n f o
Article history: Received 14 December 2007 Accepted 19 February 2008
a b s t r a c t The possibility of an accident or component failure during mid-loop operation has been identified in probabilistic studies as a major contributor to core melt frequency and source term risk during shutdown conditions. The wide range of plant states encountered and the unavailability of certain safety features make it difficult to guarantee that safety systems operation will always be sufficient to terminate the accident evolution. In this context analyses are performed using MELCOR 1.8.5 for loss of residual heat removal (RHR) at various times during mid-loop operation of a Westinghouse two-loop PWR. In the absence of recovery of RHR or other accident management (AM) measures, the sequences necessarily lead to a long term core uncovery, heat-up and degradation, loss of geometry and eventual failure of the reactor pressure vessel (RPV). The results show an extensive time window before uncovery and additionally before core damage, which increase progressively with increasing time after shutdown at which loss of RHR occurs. Significant oxidation of the cladding may result in concentrations of hydrogen sufficient for deflagration. The slow evolution implies an opportunity for the plant operators to initiate AM measures even after core uncovery has started. The analyses indicate a substantial time window during the uncovery within which the injection can recover the core without damage. The upper end of the window is determined by the temperature at which heat from cladding oxidation becomes a dominant factor, marking a critical point for the effectiveness of this recovery mode. The results provide confidence in the inherent robustness of the plant with respect to accident sequences of this type. © 2008 Elsevier B.V. All rights reserved.
1. Introduction Operation of a pressurised water reactor (PWR) includes periods of shutdown during which the reactor coolant system (RCS) may be open and the coolant partially drained. An example is when the reactor pressure vessel (RPV) upper head is removed for refuelling. During part of the shutdown period the coolant level is maintained at approximately the middle of the hot and cold legs, a state known as mid-loop operation. The water is kept at a temperature of roughly 50 ◦ C via the residual heat removal (RHR) system whereby subcooled water is injected into one of the cold legs and extracted at a higher temperature from one of the hot legs, thus maintaining a steady and stable state. Core cooling depends on the continuous operation of the RHR, and failure of any part of the system would potentially result in an uncontrolled temperature excursion in case of no alternate cooling is
∗ Corresponding author. Tel.: +41 56 310 2724; fax: +41 56 310 2199. E-mail address: [email protected] (J. Birchley). 0029-5493/$ – see front matter © 2008 Elsevier B.V. All rights reserved. doi:10.1016/j.nucengdes.2008.02.009
aligned. The consequences of such a failure and the opportunity to maintain or restore cooling are the subjects of the present study. This paper describes analyses of a postulated loss of RHR in a PWR, occurring at an early stage during mid-loop operation and for different configurations of the RPV upper head: removed completely, in place and securely fastened, and in place but with the bolts detensioned. The objectives are to characterise the accident evolution up to RPV failure in the event of no restoration of RHR and no recovery measures, to determine the timings of major events, and in particular the latest time during the core uncovery at which injection can arrest the heat-up and refill the core. The present study concentrates solely on the RCS and in-vessel up to RPV failure; therefore topics such as corium–concrete interaction and the associated ex-vessel release of fission products and combustible gases are not investigated. The paper briefly discusses the potential for steam generator (SG) operation to remove heat and prevent core uncovery. The following section describes the plant and sequences investigated. Section 3 describes the MELCOR code (Gauntt, 2000), plant input and choice of physical models, while the accident evolution
2174
J. Birchley et al. / Nuclear Engineering and Design 238 (2008) 2173–2181
is described in Section 4. The main findings are summarised in Section 5.
ature (typically between 0.1 and 0.2 bar). The presence of air in the system persists throughout any transient and can be expected to have a bearing on the accident progression. The secondary sides are isolated from the feed and steam systems, so that steam is relieved only upon exceeding the secondary safety relief set point. The study concentrates on the limiting case of loss of RHR at an early stage during mid-loop operation, specifically 22 h after reactor shutdown. The base scenarios assume no recovery action at all, and therefore result in sustained heat-up and degradation of the core, leading to RPV failure. The slow accident evolution implies opportunity for the operators to prevent uncovery or to recover the core. A series of calculations investigates injection at a minimal rate, slightly more than sufficient to remove the decay heat, at different times and using various other assumptions. Of particular interest is the latest time at which injection of coolant can recover the core without damage. The effect of SG operation to maintain a heat sink is also investigated.
2. Brief description of plant and postulated sequences
3. Analytical tools
The reference plant chosen for the present study is a Westinghouse (W) two-loop PWR of which two identical units are operated at Beznau, Switzerland. Since the start of operation, the steam generators were replaced by Framatome units of greater capacity, while certain other engineered safeguards, in particular the safety injection (SI), were uprated to provide additional redundancy and capacity. Passive autocatalytic recombiners (PARs) were also installed with the objective of avoiding a hydrogen burn and the associated loading on the containment. The nominal plant operating parameters are given in Table 1. The only configurational changes relevant to the present analysis involve the RPV upper head, as indicated above. The pressuriser vent line is opened to facilitate draining and is assumed to remain so for the remainder of the mid-loop operational period. It is noted that a variety of RCS configurations can apply during mid-loop operation, involving openings of various sizes and locations. It is not practical to investigate all possible configurations. However, it is noted that the three chosen configurations span the entire range of size of opening and are likely to provoke contrasting hydraulic responses in the RCS. It is supposed that in any other configuration where the RCS is open at some location, the upper head bolts are detensioned. Thus RCS is less “open” in the base configuration with the upper head secure than in any other case. It is worth remarking that shutdown sequences involving major openings in the RCS, such as when the is head removed, involve the possibility of air ingress and its attendant safety impacts such as accelerated oxidation and increased volatility of certain fission products. However, assessment of air ingress and the related issues are outside the scope of the present study. Regardless of the RPV configuration, the RCS and steam generator are assumed at containment pressure, nominally assumed to be 1 bar. The RHR flow is assumed to be 140 kg/s and 323 K (50 ◦ C) at injection. The space above the water is a mixture of air and steam, the latter at a partial pressure corresponding to the water temper-
The preferred code for analysis of nuclear plant sequences in Switzerland is MELCOR (Gauntt et al., 2000), which is designed to simulate all phases of a plant severe accident, the relevant plant phenomena and components. A main objective is to concentrate on the major characteristics and parameters important for plant safety rather than to capture the processes in detail. The code comprises, typically, simple empirical correlations or parametric statements, and is frequently used in conjunction with coarse-mesh input models. The current production version, MELCOR 1.8.5/release QZ was chosen for the present study.
Nomenclature AM ECCS PAR PWR RCS RHR RPV SG SI W
accident management emergency core cooling system passive autocatalytic hydrogen recombiner pressurised water reactor reactor coolant system residual heat removal reactor pressure vessel steam generator safety injection Westinghouse
Table 1 Nominal operating parameters Parameter
Value
Core Power Reactor coolant system pressure Hot leg temperature Cold leg temperature Primary coolant flow Pressuriser level (above hot leg centreline) Secondary side pressure Steam flow rate
1130 MW 15.5 MPa 585.9 K 554.6 K 6640 kg/s 8.5 m 5.55 MPa 604 kg/s
3.1. MELCOR code The MELCOR thermal–hydraulic module furnishes the thermal and fluid conditions for all of the process and component models. The masses of liquid water, steam and each non-condensable gas species in each cell are calculated, while a simplified, onedimensional treatment of momentum balance is used for the flows. Closure is provided via correlations for the mass, energy and momentum exchanges. Heat conducting structures provide the physical and thermal boundaries for the hydraulic system; these can ablate or undergo failure through thermo-mechanical loads. The core models follow the heat-up, oxidation, fuel dissolution, bulk melting and relocation. The core components include fuel rods, absorber rods, cladding, non-supporting structures such as guide tubes, and supporting structures. Heat generation in the core is by a combination of fission, decay and oxidation. Melting occurs at the melting point of the pure material, or due to eutectic interactions. Loss of intact geometry is assumed according to a temperature criterion, or when melting occurs. Molten material or debris relocates downward and falls to the lower head when the supporting structures fail, according to an empirical correlation or parametric criterion. Fission product release is calculated according to a choice of one or other of the CORSOR correlations (Kuhlman et al., 1985). Transport and deposition of condensed phase fission products and other material released from the core are calculated by a package of standard aerosol correlations (Hinds, 1982). MELCOR includes a semi-empirical burn package which calculates combustion of hydrogen and carbon monoxide based on a model for deflagration speed of a flame propagating across the hydraulic volumes in the containment (Weigand, 1984). Simple criteria are used for initiation, propagation to adjacent volumes and extinction according to the molar fractions of the various gases.
J. Birchley et al. / Nuclear Engineering and Design 238 (2008) 2173–2181
2175
Fig. 1. MELCOR noding for plant.
3.2. Input model and assumptions The basic reference data are given in the KKB facility description and safety analysis report (KKB, 2003). The input model is a coarse node representation of the hydraulic system and structures, comprising about 40 fluid cells for the entire system including the secondary sides and containment, of which about 20 cells are used for the RCS. The hydraulic noding is shown in Fig. 1 which identifies the hydraulic volumes and all the flow paths including those not active in the mid-loop analyses, and indicates also the alternative vessel configurations. The RPV downcomer, lower plenum, core, core bypass and upper plenum (including the upper head) are each represented by a single node. A similarly coarse noding is used for the remainder of the RCS and for the other hydraulic systems. Single nodes are used for each of the hot legs, SG up- and downsides and the crossover legs. It is noted that the coarse noding of the RPV neglects any in-vessel counter-current natural circulation for the vessel head secured case. Neglecting this effect would seem to be conservative since this effect delays core heat-up and Zircaloy oxidation, so it is a reasonable approximation in this study. The RCS is connected to the containment via the pressuriser vent line which is assumed open. This connection is in addition to the pressuriser safety/relief valves and line which is not operated in the present sequences. The flow path used in the input was specified according to data provided by the plant operators (Richner, 2005). The original model assumes the RPV upper head is in place and secured. A first modification comprises the base case which includes a path from the RPV to the containment at the level of the upper head flange, to simulate the lifting of the upper head due to internal pressure, thus taking account of detensioning of the upper head bolts. This path is represented by a valve which
opens progressively to a maximum area of 0.1 m2 as the internal pressure increases from 0.5 to 0.6 bar gauge. The maximum area corresponds to a gap of about 6 mm around the RPV circumference. The opening pressure is obtained by a simple hand calculation from the weight and the area of the RPV. A sensitivity calculation had shown that the transient evolution is not sensitive to the above pressure values. The configuration as represented is otherwise unchanged from the base description. Two additional configurations are defined: (i) the upper head is secure, (ii) the upper head is removed. The first case corresponds to the normal RPV configuration. In the second case the upper head volume and heat structures are deleted and replaced by a junction between the upper plenum and containment with area equal to the full area of the top of the cylindrical part of the RPV. Although structures in the upper plenum might restrict the flow to some extent the area is so large that a moderate reduction is unlikely to affect the flow from the vessel. The reactor core components include the fuel and control rods, spacer grids, the upper and lower structures, which occupy the hydraulic nodes that represent the core and lower plenum. The active core is subdivided into seven equi-length axial nodes, while the non-active components, mainly the lower grid plate and support structures are divided into four axial nodes. The entire core is divided radially into three zones. Somewhat conservative values are used for the axial and radial peaking factors. The containment model consists of four control volumes: the reactor cavity, the lower compartment, the annular compartment. The default assumptions are adopted for the burn package, of which the most important is the 10% molar fraction of hydrogen for ignition. MELCOR can also model the PARs but these are conservatively not included in the present study.
2176
J. Birchley et al. / Nuclear Engineering and Design 238 (2008) 2173–2181
Table 2 Conditions 22 h after reactor shutdown Parameter
Value
Primary system (hot leg) pressure RHR exit (hot leg 1) temperature RHR inlet (cold leg 2) temperature Secondary system pressure Secondary system temperature RHR flow Decay heat level
1.0 bar 332.9 K 321.7 K 1.0 bar 371.7 K 139 kg/s 6.49 MW (0.57%)
MELCOR allows user-defined model parameter values to enable bounding estimates or to address uncertainties, as alternatives to default options mainly used in the present model. These are used to assess uncertainties or provide bounding estimates. 3.3. Establishment of the initial state The initial state for those cases where the upper head is in place is established via an idealized simulation from full power, through reactor shutdown, cooldown and draining. This procedure is not possible if the upper head is removed; in those the desired conditions are imposed, and a null transient is calculated until a stable state is achieved. The initial conditions are given in Table 2. 4. Description of accident evolution
Fig. 3. Liquid levels in RCS (no recovery; base configuration).
and debris fuel temperatures at the different elevations, while the absence of a calculated value implies no such material is present at that location. Fig. 5 shows the hydrogen generation. It is noted that only minor oxidation is calculated in debris regions. Core degradation occurs, at first locally with candling of molten metallic and liquefied fuel, and later globally as more and more of the core pro-
4.1. No recovery or accident management Calculations are performed from loss of RHR at 22, 50, 175 and 600 h after reactor shutdown, for the base configuration and the two sensitivity cases identified above. The general characteristics of the sequence were insensitive to the time of accident initiation, but with slower evolution at the later times. Discussion concentrated on the base case and the earliest timing when decay heat levels are highest. After loss of RHR the water heats up and boiling starts after several hundred seconds, resulting in pressurization of the RCS and lifting of the upper head, allowing the pressure to be relieved. Continued boiling causes the water inventory to be gradually depleted so that the level in the vessel drops, leading to core uncovery and heat-up. The excursion accelerates when the temperatures become high enough to precipitate oxidation of the cladding. Fig. 2 displays the pressures in the RCS, SG and containment and shows the 2.5 bar increase at 10 h due to a hydrogen burn. The progression of core uncovery is indicated by the liquid levels in the RPV shown in Fig. 3. The thick and thin lines of Fig. 4 denote, respectively, intact
Fig. 4. Fuel rod and debris temperatures in core central zone (no recovery; base configuration) (thick lines—intact rods; thin lines—debris).
Fig. 2. RCS, SG and containment pressure (no recovery; base configuration).
Fig. 5. Hydrogen generation (no recovery; base configuration).
J. Birchley et al. / Nuclear Engineering and Design 238 (2008) 2173–2181
2177
Table 3 Loss of RHR at 22 h Parameter (unit)
UH secure
Base
UH removed
Start of core uncovery (s) Onset of oxidation (s) Onset of core degradation (s) Relocation to lower head (s) RPV breach (s) Mass of H2 generated (kg) Peak H2 concentration in containment (%) Peak RCS pressure (bar) Peak containment pressure (bar) H2 burnt mass (kg)
15630 28580 30080
12360 15460 15860
10730 14000 14440
35612 38125 437 9.5
19311 32846 332 (10.0)
21553 30976 305 5.0
51 2.1 –
2.3 (4.0) (324)
2.2 2.2 107
(x) After RPV breach.
Fig. 6. Material masses in core (no recovery; base configuration).
gressively undergoes transition to solid debris and then molten corium, before relocating to the lower head and eventually causing failure of the RPV structure 10 h after loss of RHR. Recalling Fig. 2, the degradation is marked by pressure spikes following relocation events and the consequent boiling of residual water. The conversion of metallic to oxide and the ejection of debris are seen from Fig. 6, which shows the masses of core materials remaining in the RPV. The hydrogen partial pressure in the containment volumes is shown in Fig. 7 and indicates the consumption due to the burn after RPV failure. As noted earlier, however, the accident evolution following RPV failure is outside the present study. The RPV configuration, in particular securing of the upper head, has a significant bearing on the accident progression, summarised in Table 3. The RCS pressure, the core liquid level and maximum cladding temperature for the three cases are shown in Figs. 8–10, respectively. In the case of upper head removed there transient evolution is similar, with just slightly earlier timings and RCS pressure the same as in the containment. With the upper head secure, however, depletion of coolant is initially very slow as the pressuriser vent line admits only a small flow at the low pressure. For a time the decay heat is removed by the SGs until the pressure increases to the SG relief valve set point and the secondary coolant boils away. The primary coolant inventory then becomes depleted as the higher pressure causes an increased flow rate through the pressuriser vent line. The core uncovery occurs at a much higher pressure than in the base case.
Fig. 7. Hydrogen partial pressure in containment volumes (no recovery; base configuration).
The later that a loss of RHR occurs the lower the decay heat level, so the accident progression takes place more slowly. Table 4 shows the increasing timescale of the transient evolution following loss of RHR at 50, 175 and 600 h after reactor shutdown. Interestingly, the total hydrogen generation is not a monotonic function of time after injection and suggests the absence of a clear trend for hydrogen mass with time of loss of RHR. Possibly this is an instance of the familiar stochastic nature of certain aspects of severe accident calculations.
Fig. 8. Primary pressure (no recovery, effect of RPV configuration).
Fig. 9. Liquid level in core (no recovery, effect of RPV configuration).
2178
J. Birchley et al. / Nuclear Engineering and Design 238 (2008) 2173–2181
Fig. 10. Maximum fuel rod temperature (no recovery, effect of RPV configuration).
Fig. 11. Liquid level in core (base configuration, effect of injection time).
4.2. Recovery by injection The AM procedure adopted by operators at the reference plant in case of loss of RHR during mid-loop operation is to first align recirculation cooling using the emergency core cooling system (ECCS) system. In case recirculation is not available, the procedure advises to deliver coolant via the SI or charging system, throttled to ca. 10 kg/s (the so called “Feed and Boil” cooling mode). It is considered that this flow would provide ample safety margin and that there is sufficient time to actuate the pumps before core uncovery. In order to demonstrate the margin we investigate the core recovery for the above base case by considering injection of 3.5 kg/s water at 322 K (49 ◦ C) into one of the cold legs, equivalent to one charging pump, at various times during the uncovery. Figs. 11 and 12 show the liquid level and maximum cladding temperature, respectively, assuming injection initiated at 15,000, 15,200 and 15,400 s after the loss of RHR (2640, 2840 and 3040 s after the start of uncovery). In each case the water level is slightly below the core mid elevation at the time. Due to the poor heat transfer in the upper half of the core, the excursion continues until the increased cooling due to refilling overcomes the heat generation. Following injection at the earlier two times the excursion is arrested and cooling is readily established. A delay of a further 200 s leads to an oxidation excursion and some core damage before core refilling and cooling is eventually achieved. The refilling takes place less smoothly in the case of later injection, which may be expected as cooling of the high temperature fuel rods is accompanied by periods of rapid boiling. A crucial factor is the contribution of oxidation heat which becomes important at temperatures above about 1200 K, as demonstrated by the hydrogen generation shown in Fig. 13. The uncovery and recovery sequences are summarised in Table 5. To show more clearly the event sequence, timings are mostly given relative to the start of uncovery or start of injection.
Fig. 12. Maximum fuel rod temperature (base configuration, effect of injection time).
The effectiveness of injection at a low rate is clearly sensitive to initiation time if the oxidation is already underway. MELCOR code adopts the Urbanic–Heidrick oxidation correlation throughout the full temperature range, although temperatures below 1500 K are outside its range of validity. At these temperatures it overestimates the kinetic rate and is generally considered inferior to the
Table 4 Loss of RHR at 50, 175 and 600 h Parameter (unit)
50 h
175 h
600 h
Start of core uncovery (s) Onset of oxidation (s) Onset of core degradation (s) Relocation to lower head (s) RPV breach (s) Mass of H2 generated (kg) Peak H2 concentration in containment (%) Peak RCS pressure (bar) Peak containment pressure (bar) H2 burnt mass (kg)
15800 19760 20185 29200 39777 312 (17) 3.2 (3.5) (210)
25540 32200 32720 45305 60360 252 6.9 2.3 1.7 –
46050 58160 58980 71550 118480 350 9.1 2.7 1.7 –
(x) After RPV breach.
Fig. 13. Mass of hydrogen generated (base configuration, effect of injection time).
J. Birchley et al. / Nuclear Engineering and Design 238 (2008) 2173–2181 Table 5 Loss of RHR at 22 h (with injection) Parameter (unit)
Start of core uncovery (s) Start of injection, tinj (s) Level in core at tinj (m) Maximum core temperature at tinj (K) Onset of oxidation (s) Peak core temperature (K) Time of peak core temperature (s) Time to final quench Time to refill core Mass of H2 generated (kg)
Injection time (s) 15000
15200
15400
12360 +2640 1.26 992 ++35 1185 ++1000 ++3920 ++3940 2
12360 +2840 1.25 1100 −−165 1240 ++1060 ++4010 ++4130 3
12360 +3040 1.25 1185 −−365 2369 ++860 ++3040a ++4180 20
+ Relative to start of uncovery. −−/++ Relative to injection initiation. a For intact rods.
Cathcart-Pawel and Leistikow correlations which are more commonly used in design basis accident analysis (Schanz et al., 2004). The Urbanic–Heidrick model is therefore conservative concerning the upper temperature and latest time to achieve successful recovery by water injection. The progress of refill and quench in the core might be expected to depend on the RPV configuration, due perhaps to the different RCS pressure or the altered steam venting pathway. Analogous calculations were performed for the upper head removed and secure, that is injection of 3.5 kg/s water at 322 K initiated at a maximum core temperature of 1100 K. The results for core liquid level and max-
Fig. 14. Liquid level in core (injection at 1100 K, effect of RPV configuration).
Fig. 15. Maximum fuel temp. (injection at 1100 K, effect of RPV configuration).
2179
imum temperature are compared in Figs. 14 and 15, respectively. Apart from the timing of injection, these signature variables do not depend strongly on the configuration. In particular the substantial margins against oxidation excursion and core damage remain. Further sensitivity studies showed that the rate of injection (3.0 or 3.5 kg/s), and temperature of injected coolant (288, 322 or 373 K (15, 49 or 100 ◦ C)) have a minor effect on the recovery process and time window for injection. The result is also unaffected by assuming a lower void limit in the two-phase region (0.2 or 0.4), equivalent to reducing the maximum level swell from 40% to 20%. 4.3. Operation of steam generators A possible accident management action following a loss of RHR is to operate the SG secondary sides to maintain a heat sink. This action can maintain the core in a covered state is situations when the RCS is closed and the pressure is high enough to drive the heat transfer by condensation in the SG tubes. Experimental and analytical studies were performed in connection with the CEA conducted BETHSY programme (Dumont et al., 1994) and more recently in the frame of OECD sponsored PKL programme (Jasiulevicius, 2005; Queral et al., 2006). We again consider the scenario following loss of RHR at 22 h but concentrate mainly on the case where the upper head is in place and secure. We note that the coarsely noded lumped parameter description of the SGs provides only a very approximate treatment of the condensation process in the complex geometry and in the presence of non-condensable gas. The aim is to identify the potential for heat removal by SG operation rather than provide an accurate evaluation of the thermal–hydraulic parameters. The simulations assume that operation of SGs enables the tubes to remain covered and the secondary side pressure to be maintained at 1.0 bar, which are imposed as boundary conditions. The opening area of the SG relief valves and the low decay heat level implies that an overpressure of 0.1 bar gauge is sufficient to relieve the steam, so that model is considered to provide a good enough approximation. Fig. 16 shows the total pressure in the RPV upper plenum and steam pressures in various parts of the RCS, while Fig. 17 shows the liquid levels in the RCS. The results strongly indicate that the core remains covered and the decay heat is removed with only a moderate pressure increase, up to 2.6 bar. We can interpret the pressure response as follows. As steam is generated in the core the air is compressed into the SG and region downstream, to leave some of the tube volume at a steam pressure high enough for condensation to take place (the active zone). The conditions stabilise when this is sufficient for condensation to bal-
Fig. 16. Liquid levels in RCS (upper head secure, SG operated).
2180
J. Birchley et al. / Nuclear Engineering and Design 238 (2008) 2173–2181
the case that the upper head is in place but with the bolts detensioned the head becomes raised at an RCS pressure below that necessary to condense the steam. The steam is then vented directed from the RPV. As can be seen from Fig. 18, SG operation retards the depletion of coolant but does not otherwise change the accident progression. Therefore SG operation is an effective measure only if the RCS is essentially sealed. 5. Conclusions
Fig. 17. Total and steam pressures in RCS (upper head secure, SG operated).
ance the boiling in the core (ca. 3 kg/s). Beyond this zone the steam pressure (and temperature) is in equilibrium with secondary side and no further condensation takes place. The active zone occupies only a small fraction of the SG tubes in the present situation where the heat load is small. This interpretation applies strictly only to the idealised case where the flow geometry is simple, i.e. no multiple flow paths, no counter-current flow limitation, no leakage. We note also that the conditions are not completely steady due to the small leakage of steam (ca. 0.1 kg/s) through the pressuriser vent line. Depletion at this rate would lead to the start of core uncovery only after at least 3 days. Concerning the other factors mentioned ¨ and above, it has been observed experimentally in BETHSY 7.2 (Noel Deruaz, 1994) that the flow may differ from tube to tube, with steam flow and condensation in some of the tubes active and stagnation in others. This behaviour would perhaps reduce the efficiency and modify the effective heat transfer area. The degree of mixing of steam and non-condensable gas in the passive region is also uncertain, which is shown by analyses to modify the bulk condensation efficiency (Harwood and Stanev, 1993). Detailed discussion of these effects is beyond the scope of the present study, but it can be easily shown that a halving of the overall condensation efficiency would increase the RCS pressure to about 2.9 bar, i.e. an increase of only 0.3 bar. The above remarks apply only if leakage of coolant is small enough to maintain the RCS at a few bars overpressure. Condensation would not occur in the SG if the loss of RHR occurs when the upper head is removed, or with other open RCS configurations. In
The transient evolution has been investigated following loss of RHR at an early stage during the period of mid-loop operation. The base case scenario assumes the RPV upper head is in place but with the bolts detensioned, the vent line from the top of the pressuriser is open, and the SG secondary sides are isolated from the main feed and steam systems. The time-span of the study is until RPV failure. The calculated results exhibit a steady depletion of primary coolant, a progressive top to bottom uncovery of the core, accelerated heating due to oxidation of the Zircaloy cladding, core degradation and relocation to the lower plenum, and RPV failure. Core uncovery begins more than 3 h after the loss of RHR and RPV failure occurs at about 9 h. Later occurrences of loss of RHR during mid-loop operation show similar accident evolution, with progressively longer timescales. Sensitivity studies on RPV configuration show similar accident behaviour if the upper head is removed but with some differences in timing. There is strong pressurisation of the RCS if the upper head bolts are secure and a delayed accident evolution. Generation of typically 300–400 kg of hydrogen results in concentrations in the containment up to 10%, a value which coincides with the criterion for ignition used in MELCOR. In any case it should be assumed that RPV failure would probably provoke deflagration, even if the ignition criterion has not already been reached. The burning of such quantities of hydrogen results in a pressure total load of about 4 bar, which is well within the total strength of the containment. The slow accident evolution implies a substantial time window within which AM action may prevent or terminate a core uncovery. Coolant injection, even at a slow rate, is highly effective in halting the excursion and recovering the core, provided it is initiated before core has heated up to the point, approximately 1200 K, at which oxidation heat is important. The assumption of very low injection rate and adoption of the conservative Urbanic–Heidrick model for oxidation kinetics suggests the present estimate, 15,200 s after the loss of RHR, is a lower bound for latest injection time to recover the core without damage. The effectiveness of injection corresponding to one charging pump (ca. 3.5 kg/s) underlines the margin provided by the nominal AM procedure (injection at ca. 10 kg/s). Moreover, this result is insensitive to RPV configuration, variations in the exact injection conditions, or assumptions two-phase level swell. SG operation at ambient pressure provides the possibility to maintain a heat sink and prevent core uncovery. However, the effectiveness of this action depends on there being no significant leakage of primary coolant. This is possible for the reference plant only if the RCS is closed with the RPV upper head and secure. Acknowledgements The authors are pleased to acknowledge the financial support and technical input from Nordostschweizerische Kraftwerke AG, Kernkraftwerk Beznau (KKB) on whose behalf the present study was performed. References
Fig. 18. Liquid levels in RCS (upper head bolts detensioned, effect of SG operation).
Dumont, D., et al., 1994. Loss of residual heat removal during mid-loop operation: BETHSY experiments. Nucl. Eng. Des. 149, 365–374.
J. Birchley et al. / Nuclear Engineering and Design 238 (2008) 2173–2181 Gauntt, R.O. et al., 2000, MELCOR Computer Code Manuals: Version 1.8.5, NUREG/CR6119. Harwood, C. and Stanev, I.E., 1993, RELAP5/MOD2 Analysis of BETHSY Test 7.2c: Reflux Condenser Mode Steam Generator Operation with Noncondensable Gas in the Primary Side, RELAP5 Seminar, Boston, USA. Hinds, W.C., 1982. Aerosol Technology: Properties, Behaviour and Measurement of Airborne Particles. John Wiley & Sons Inc. Jasiulevicius, A., October 2005. Benchmark Calculations of PKL Test E3.1 using TRACE Code. In: Presented at PKL Analytical Workshop, Pisa, Italy. Kernkraftwerk Beznau, Block 2, 2003, Final Safety Report. Kuhlman, M.R. et al., 1985, CORSOR Users Manual, NUREG/CR-4173. ¨ B., Deruaz, R., 1994. Reflux condenser mode with non-condensable gas: assessNoel, ment of CATHARE against BETHSY Test 7.2C. Nucl. Eng. Des. 149, 291–298.
2181
´ ´ Queral, C., Gonzalez, I., Exposito, A., 2006. Analysis of the cooling capability of steam generators during the loss of residual heat removal system at midloop operation with closed primary system. Ann. Nucl. Energy 33, 1102– 1115. Richner, M., 2005, private communication. Schanz, G., Adroguer, B., Volchek, A., 2004. Advanced treatment of Zircaloy cladding high-temperature oxidation in severe accident code calculations, Part I. Experimental database and basic modelling. Nucl. Eng. Des. 232, 75– 84. Weigand, G.G. (Ed.), August 1984, Thermal-hydraulic Process Modelling in Risk Analysis: An Assessment of the Relevant Systems, Structures and Phenomena, SAND84-1219, NUREG/CR-3986.
Contents lists available at ScienceDirect
Nuclear Engineering and Design journal homepage: www.elsevier.com/locate/nucengdes
Accident management following loss of residual heat removal during mid-loop operation in a Westinghouse two-loop PWR J. Birchley a,∗ , T.J. Haste a , M. Richner b a b
Paul Scherrer Institut, CH-5232 Villigen, Switzerland Nordostschweizerische Kraftwerke (NOK) - NPP Beznau, CH-5312 D¨ ottingen, Switzerland
a r t i c l e
i n f o
Article history: Received 14 December 2007 Accepted 19 February 2008
a b s t r a c t The possibility of an accident or component failure during mid-loop operation has been identified in probabilistic studies as a major contributor to core melt frequency and source term risk during shutdown conditions. The wide range of plant states encountered and the unavailability of certain safety features make it difficult to guarantee that safety systems operation will always be sufficient to terminate the accident evolution. In this context analyses are performed using MELCOR 1.8.5 for loss of residual heat removal (RHR) at various times during mid-loop operation of a Westinghouse two-loop PWR. In the absence of recovery of RHR or other accident management (AM) measures, the sequences necessarily lead to a long term core uncovery, heat-up and degradation, loss of geometry and eventual failure of the reactor pressure vessel (RPV). The results show an extensive time window before uncovery and additionally before core damage, which increase progressively with increasing time after shutdown at which loss of RHR occurs. Significant oxidation of the cladding may result in concentrations of hydrogen sufficient for deflagration. The slow evolution implies an opportunity for the plant operators to initiate AM measures even after core uncovery has started. The analyses indicate a substantial time window during the uncovery within which the injection can recover the core without damage. The upper end of the window is determined by the temperature at which heat from cladding oxidation becomes a dominant factor, marking a critical point for the effectiveness of this recovery mode. The results provide confidence in the inherent robustness of the plant with respect to accident sequences of this type. © 2008 Elsevier B.V. All rights reserved.
1. Introduction Operation of a pressurised water reactor (PWR) includes periods of shutdown during which the reactor coolant system (RCS) may be open and the coolant partially drained. An example is when the reactor pressure vessel (RPV) upper head is removed for refuelling. During part of the shutdown period the coolant level is maintained at approximately the middle of the hot and cold legs, a state known as mid-loop operation. The water is kept at a temperature of roughly 50 ◦ C via the residual heat removal (RHR) system whereby subcooled water is injected into one of the cold legs and extracted at a higher temperature from one of the hot legs, thus maintaining a steady and stable state. Core cooling depends on the continuous operation of the RHR, and failure of any part of the system would potentially result in an uncontrolled temperature excursion in case of no alternate cooling is
∗ Corresponding author. Tel.: +41 56 310 2724; fax: +41 56 310 2199. E-mail address: [email protected] (J. Birchley). 0029-5493/$ – see front matter © 2008 Elsevier B.V. All rights reserved. doi:10.1016/j.nucengdes.2008.02.009
aligned. The consequences of such a failure and the opportunity to maintain or restore cooling are the subjects of the present study. This paper describes analyses of a postulated loss of RHR in a PWR, occurring at an early stage during mid-loop operation and for different configurations of the RPV upper head: removed completely, in place and securely fastened, and in place but with the bolts detensioned. The objectives are to characterise the accident evolution up to RPV failure in the event of no restoration of RHR and no recovery measures, to determine the timings of major events, and in particular the latest time during the core uncovery at which injection can arrest the heat-up and refill the core. The present study concentrates solely on the RCS and in-vessel up to RPV failure; therefore topics such as corium–concrete interaction and the associated ex-vessel release of fission products and combustible gases are not investigated. The paper briefly discusses the potential for steam generator (SG) operation to remove heat and prevent core uncovery. The following section describes the plant and sequences investigated. Section 3 describes the MELCOR code (Gauntt, 2000), plant input and choice of physical models, while the accident evolution
2174
J. Birchley et al. / Nuclear Engineering and Design 238 (2008) 2173–2181
is described in Section 4. The main findings are summarised in Section 5.
ature (typically between 0.1 and 0.2 bar). The presence of air in the system persists throughout any transient and can be expected to have a bearing on the accident progression. The secondary sides are isolated from the feed and steam systems, so that steam is relieved only upon exceeding the secondary safety relief set point. The study concentrates on the limiting case of loss of RHR at an early stage during mid-loop operation, specifically 22 h after reactor shutdown. The base scenarios assume no recovery action at all, and therefore result in sustained heat-up and degradation of the core, leading to RPV failure. The slow accident evolution implies opportunity for the operators to prevent uncovery or to recover the core. A series of calculations investigates injection at a minimal rate, slightly more than sufficient to remove the decay heat, at different times and using various other assumptions. Of particular interest is the latest time at which injection of coolant can recover the core without damage. The effect of SG operation to maintain a heat sink is also investigated.
2. Brief description of plant and postulated sequences
3. Analytical tools
The reference plant chosen for the present study is a Westinghouse (W) two-loop PWR of which two identical units are operated at Beznau, Switzerland. Since the start of operation, the steam generators were replaced by Framatome units of greater capacity, while certain other engineered safeguards, in particular the safety injection (SI), were uprated to provide additional redundancy and capacity. Passive autocatalytic recombiners (PARs) were also installed with the objective of avoiding a hydrogen burn and the associated loading on the containment. The nominal plant operating parameters are given in Table 1. The only configurational changes relevant to the present analysis involve the RPV upper head, as indicated above. The pressuriser vent line is opened to facilitate draining and is assumed to remain so for the remainder of the mid-loop operational period. It is noted that a variety of RCS configurations can apply during mid-loop operation, involving openings of various sizes and locations. It is not practical to investigate all possible configurations. However, it is noted that the three chosen configurations span the entire range of size of opening and are likely to provoke contrasting hydraulic responses in the RCS. It is supposed that in any other configuration where the RCS is open at some location, the upper head bolts are detensioned. Thus RCS is less “open” in the base configuration with the upper head secure than in any other case. It is worth remarking that shutdown sequences involving major openings in the RCS, such as when the is head removed, involve the possibility of air ingress and its attendant safety impacts such as accelerated oxidation and increased volatility of certain fission products. However, assessment of air ingress and the related issues are outside the scope of the present study. Regardless of the RPV configuration, the RCS and steam generator are assumed at containment pressure, nominally assumed to be 1 bar. The RHR flow is assumed to be 140 kg/s and 323 K (50 ◦ C) at injection. The space above the water is a mixture of air and steam, the latter at a partial pressure corresponding to the water temper-
The preferred code for analysis of nuclear plant sequences in Switzerland is MELCOR (Gauntt et al., 2000), which is designed to simulate all phases of a plant severe accident, the relevant plant phenomena and components. A main objective is to concentrate on the major characteristics and parameters important for plant safety rather than to capture the processes in detail. The code comprises, typically, simple empirical correlations or parametric statements, and is frequently used in conjunction with coarse-mesh input models. The current production version, MELCOR 1.8.5/release QZ was chosen for the present study.
Nomenclature AM ECCS PAR PWR RCS RHR RPV SG SI W
accident management emergency core cooling system passive autocatalytic hydrogen recombiner pressurised water reactor reactor coolant system residual heat removal reactor pressure vessel steam generator safety injection Westinghouse
Table 1 Nominal operating parameters Parameter
Value
Core Power Reactor coolant system pressure Hot leg temperature Cold leg temperature Primary coolant flow Pressuriser level (above hot leg centreline) Secondary side pressure Steam flow rate
1130 MW 15.5 MPa 585.9 K 554.6 K 6640 kg/s 8.5 m 5.55 MPa 604 kg/s
3.1. MELCOR code The MELCOR thermal–hydraulic module furnishes the thermal and fluid conditions for all of the process and component models. The masses of liquid water, steam and each non-condensable gas species in each cell are calculated, while a simplified, onedimensional treatment of momentum balance is used for the flows. Closure is provided via correlations for the mass, energy and momentum exchanges. Heat conducting structures provide the physical and thermal boundaries for the hydraulic system; these can ablate or undergo failure through thermo-mechanical loads. The core models follow the heat-up, oxidation, fuel dissolution, bulk melting and relocation. The core components include fuel rods, absorber rods, cladding, non-supporting structures such as guide tubes, and supporting structures. Heat generation in the core is by a combination of fission, decay and oxidation. Melting occurs at the melting point of the pure material, or due to eutectic interactions. Loss of intact geometry is assumed according to a temperature criterion, or when melting occurs. Molten material or debris relocates downward and falls to the lower head when the supporting structures fail, according to an empirical correlation or parametric criterion. Fission product release is calculated according to a choice of one or other of the CORSOR correlations (Kuhlman et al., 1985). Transport and deposition of condensed phase fission products and other material released from the core are calculated by a package of standard aerosol correlations (Hinds, 1982). MELCOR includes a semi-empirical burn package which calculates combustion of hydrogen and carbon monoxide based on a model for deflagration speed of a flame propagating across the hydraulic volumes in the containment (Weigand, 1984). Simple criteria are used for initiation, propagation to adjacent volumes and extinction according to the molar fractions of the various gases.
J. Birchley et al. / Nuclear Engineering and Design 238 (2008) 2173–2181
2175
Fig. 1. MELCOR noding for plant.
3.2. Input model and assumptions The basic reference data are given in the KKB facility description and safety analysis report (KKB, 2003). The input model is a coarse node representation of the hydraulic system and structures, comprising about 40 fluid cells for the entire system including the secondary sides and containment, of which about 20 cells are used for the RCS. The hydraulic noding is shown in Fig. 1 which identifies the hydraulic volumes and all the flow paths including those not active in the mid-loop analyses, and indicates also the alternative vessel configurations. The RPV downcomer, lower plenum, core, core bypass and upper plenum (including the upper head) are each represented by a single node. A similarly coarse noding is used for the remainder of the RCS and for the other hydraulic systems. Single nodes are used for each of the hot legs, SG up- and downsides and the crossover legs. It is noted that the coarse noding of the RPV neglects any in-vessel counter-current natural circulation for the vessel head secured case. Neglecting this effect would seem to be conservative since this effect delays core heat-up and Zircaloy oxidation, so it is a reasonable approximation in this study. The RCS is connected to the containment via the pressuriser vent line which is assumed open. This connection is in addition to the pressuriser safety/relief valves and line which is not operated in the present sequences. The flow path used in the input was specified according to data provided by the plant operators (Richner, 2005). The original model assumes the RPV upper head is in place and secured. A first modification comprises the base case which includes a path from the RPV to the containment at the level of the upper head flange, to simulate the lifting of the upper head due to internal pressure, thus taking account of detensioning of the upper head bolts. This path is represented by a valve which
opens progressively to a maximum area of 0.1 m2 as the internal pressure increases from 0.5 to 0.6 bar gauge. The maximum area corresponds to a gap of about 6 mm around the RPV circumference. The opening pressure is obtained by a simple hand calculation from the weight and the area of the RPV. A sensitivity calculation had shown that the transient evolution is not sensitive to the above pressure values. The configuration as represented is otherwise unchanged from the base description. Two additional configurations are defined: (i) the upper head is secure, (ii) the upper head is removed. The first case corresponds to the normal RPV configuration. In the second case the upper head volume and heat structures are deleted and replaced by a junction between the upper plenum and containment with area equal to the full area of the top of the cylindrical part of the RPV. Although structures in the upper plenum might restrict the flow to some extent the area is so large that a moderate reduction is unlikely to affect the flow from the vessel. The reactor core components include the fuel and control rods, spacer grids, the upper and lower structures, which occupy the hydraulic nodes that represent the core and lower plenum. The active core is subdivided into seven equi-length axial nodes, while the non-active components, mainly the lower grid plate and support structures are divided into four axial nodes. The entire core is divided radially into three zones. Somewhat conservative values are used for the axial and radial peaking factors. The containment model consists of four control volumes: the reactor cavity, the lower compartment, the annular compartment. The default assumptions are adopted for the burn package, of which the most important is the 10% molar fraction of hydrogen for ignition. MELCOR can also model the PARs but these are conservatively not included in the present study.
2176
J. Birchley et al. / Nuclear Engineering and Design 238 (2008) 2173–2181
Table 2 Conditions 22 h after reactor shutdown Parameter
Value
Primary system (hot leg) pressure RHR exit (hot leg 1) temperature RHR inlet (cold leg 2) temperature Secondary system pressure Secondary system temperature RHR flow Decay heat level
1.0 bar 332.9 K 321.7 K 1.0 bar 371.7 K 139 kg/s 6.49 MW (0.57%)
MELCOR allows user-defined model parameter values to enable bounding estimates or to address uncertainties, as alternatives to default options mainly used in the present model. These are used to assess uncertainties or provide bounding estimates. 3.3. Establishment of the initial state The initial state for those cases where the upper head is in place is established via an idealized simulation from full power, through reactor shutdown, cooldown and draining. This procedure is not possible if the upper head is removed; in those the desired conditions are imposed, and a null transient is calculated until a stable state is achieved. The initial conditions are given in Table 2. 4. Description of accident evolution
Fig. 3. Liquid levels in RCS (no recovery; base configuration).
and debris fuel temperatures at the different elevations, while the absence of a calculated value implies no such material is present at that location. Fig. 5 shows the hydrogen generation. It is noted that only minor oxidation is calculated in debris regions. Core degradation occurs, at first locally with candling of molten metallic and liquefied fuel, and later globally as more and more of the core pro-
4.1. No recovery or accident management Calculations are performed from loss of RHR at 22, 50, 175 and 600 h after reactor shutdown, for the base configuration and the two sensitivity cases identified above. The general characteristics of the sequence were insensitive to the time of accident initiation, but with slower evolution at the later times. Discussion concentrated on the base case and the earliest timing when decay heat levels are highest. After loss of RHR the water heats up and boiling starts after several hundred seconds, resulting in pressurization of the RCS and lifting of the upper head, allowing the pressure to be relieved. Continued boiling causes the water inventory to be gradually depleted so that the level in the vessel drops, leading to core uncovery and heat-up. The excursion accelerates when the temperatures become high enough to precipitate oxidation of the cladding. Fig. 2 displays the pressures in the RCS, SG and containment and shows the 2.5 bar increase at 10 h due to a hydrogen burn. The progression of core uncovery is indicated by the liquid levels in the RPV shown in Fig. 3. The thick and thin lines of Fig. 4 denote, respectively, intact
Fig. 4. Fuel rod and debris temperatures in core central zone (no recovery; base configuration) (thick lines—intact rods; thin lines—debris).
Fig. 2. RCS, SG and containment pressure (no recovery; base configuration).
Fig. 5. Hydrogen generation (no recovery; base configuration).
J. Birchley et al. / Nuclear Engineering and Design 238 (2008) 2173–2181
2177
Table 3 Loss of RHR at 22 h Parameter (unit)
UH secure
Base
UH removed
Start of core uncovery (s) Onset of oxidation (s) Onset of core degradation (s) Relocation to lower head (s) RPV breach (s) Mass of H2 generated (kg) Peak H2 concentration in containment (%) Peak RCS pressure (bar) Peak containment pressure (bar) H2 burnt mass (kg)
15630 28580 30080
12360 15460 15860
10730 14000 14440
35612 38125 437 9.5
19311 32846 332 (10.0)
21553 30976 305 5.0
51 2.1 –
2.3 (4.0) (324)
2.2 2.2 107
(x) After RPV breach.
Fig. 6. Material masses in core (no recovery; base configuration).
gressively undergoes transition to solid debris and then molten corium, before relocating to the lower head and eventually causing failure of the RPV structure 10 h after loss of RHR. Recalling Fig. 2, the degradation is marked by pressure spikes following relocation events and the consequent boiling of residual water. The conversion of metallic to oxide and the ejection of debris are seen from Fig. 6, which shows the masses of core materials remaining in the RPV. The hydrogen partial pressure in the containment volumes is shown in Fig. 7 and indicates the consumption due to the burn after RPV failure. As noted earlier, however, the accident evolution following RPV failure is outside the present study. The RPV configuration, in particular securing of the upper head, has a significant bearing on the accident progression, summarised in Table 3. The RCS pressure, the core liquid level and maximum cladding temperature for the three cases are shown in Figs. 8–10, respectively. In the case of upper head removed there transient evolution is similar, with just slightly earlier timings and RCS pressure the same as in the containment. With the upper head secure, however, depletion of coolant is initially very slow as the pressuriser vent line admits only a small flow at the low pressure. For a time the decay heat is removed by the SGs until the pressure increases to the SG relief valve set point and the secondary coolant boils away. The primary coolant inventory then becomes depleted as the higher pressure causes an increased flow rate through the pressuriser vent line. The core uncovery occurs at a much higher pressure than in the base case.
Fig. 7. Hydrogen partial pressure in containment volumes (no recovery; base configuration).
The later that a loss of RHR occurs the lower the decay heat level, so the accident progression takes place more slowly. Table 4 shows the increasing timescale of the transient evolution following loss of RHR at 50, 175 and 600 h after reactor shutdown. Interestingly, the total hydrogen generation is not a monotonic function of time after injection and suggests the absence of a clear trend for hydrogen mass with time of loss of RHR. Possibly this is an instance of the familiar stochastic nature of certain aspects of severe accident calculations.
Fig. 8. Primary pressure (no recovery, effect of RPV configuration).
Fig. 9. Liquid level in core (no recovery, effect of RPV configuration).
2178
J. Birchley et al. / Nuclear Engineering and Design 238 (2008) 2173–2181
Fig. 10. Maximum fuel rod temperature (no recovery, effect of RPV configuration).
Fig. 11. Liquid level in core (base configuration, effect of injection time).
4.2. Recovery by injection The AM procedure adopted by operators at the reference plant in case of loss of RHR during mid-loop operation is to first align recirculation cooling using the emergency core cooling system (ECCS) system. In case recirculation is not available, the procedure advises to deliver coolant via the SI or charging system, throttled to ca. 10 kg/s (the so called “Feed and Boil” cooling mode). It is considered that this flow would provide ample safety margin and that there is sufficient time to actuate the pumps before core uncovery. In order to demonstrate the margin we investigate the core recovery for the above base case by considering injection of 3.5 kg/s water at 322 K (49 ◦ C) into one of the cold legs, equivalent to one charging pump, at various times during the uncovery. Figs. 11 and 12 show the liquid level and maximum cladding temperature, respectively, assuming injection initiated at 15,000, 15,200 and 15,400 s after the loss of RHR (2640, 2840 and 3040 s after the start of uncovery). In each case the water level is slightly below the core mid elevation at the time. Due to the poor heat transfer in the upper half of the core, the excursion continues until the increased cooling due to refilling overcomes the heat generation. Following injection at the earlier two times the excursion is arrested and cooling is readily established. A delay of a further 200 s leads to an oxidation excursion and some core damage before core refilling and cooling is eventually achieved. The refilling takes place less smoothly in the case of later injection, which may be expected as cooling of the high temperature fuel rods is accompanied by periods of rapid boiling. A crucial factor is the contribution of oxidation heat which becomes important at temperatures above about 1200 K, as demonstrated by the hydrogen generation shown in Fig. 13. The uncovery and recovery sequences are summarised in Table 5. To show more clearly the event sequence, timings are mostly given relative to the start of uncovery or start of injection.
Fig. 12. Maximum fuel rod temperature (base configuration, effect of injection time).
The effectiveness of injection at a low rate is clearly sensitive to initiation time if the oxidation is already underway. MELCOR code adopts the Urbanic–Heidrick oxidation correlation throughout the full temperature range, although temperatures below 1500 K are outside its range of validity. At these temperatures it overestimates the kinetic rate and is generally considered inferior to the
Table 4 Loss of RHR at 50, 175 and 600 h Parameter (unit)
50 h
175 h
600 h
Start of core uncovery (s) Onset of oxidation (s) Onset of core degradation (s) Relocation to lower head (s) RPV breach (s) Mass of H2 generated (kg) Peak H2 concentration in containment (%) Peak RCS pressure (bar) Peak containment pressure (bar) H2 burnt mass (kg)
15800 19760 20185 29200 39777 312 (17) 3.2 (3.5) (210)
25540 32200 32720 45305 60360 252 6.9 2.3 1.7 –
46050 58160 58980 71550 118480 350 9.1 2.7 1.7 –
(x) After RPV breach.
Fig. 13. Mass of hydrogen generated (base configuration, effect of injection time).
J. Birchley et al. / Nuclear Engineering and Design 238 (2008) 2173–2181 Table 5 Loss of RHR at 22 h (with injection) Parameter (unit)
Start of core uncovery (s) Start of injection, tinj (s) Level in core at tinj (m) Maximum core temperature at tinj (K) Onset of oxidation (s) Peak core temperature (K) Time of peak core temperature (s) Time to final quench Time to refill core Mass of H2 generated (kg)
Injection time (s) 15000
15200
15400
12360 +2640 1.26 992 ++35 1185 ++1000 ++3920 ++3940 2
12360 +2840 1.25 1100 −−165 1240 ++1060 ++4010 ++4130 3
12360 +3040 1.25 1185 −−365 2369 ++860 ++3040a ++4180 20
+ Relative to start of uncovery. −−/++ Relative to injection initiation. a For intact rods.
Cathcart-Pawel and Leistikow correlations which are more commonly used in design basis accident analysis (Schanz et al., 2004). The Urbanic–Heidrick model is therefore conservative concerning the upper temperature and latest time to achieve successful recovery by water injection. The progress of refill and quench in the core might be expected to depend on the RPV configuration, due perhaps to the different RCS pressure or the altered steam venting pathway. Analogous calculations were performed for the upper head removed and secure, that is injection of 3.5 kg/s water at 322 K initiated at a maximum core temperature of 1100 K. The results for core liquid level and max-
Fig. 14. Liquid level in core (injection at 1100 K, effect of RPV configuration).
Fig. 15. Maximum fuel temp. (injection at 1100 K, effect of RPV configuration).
2179
imum temperature are compared in Figs. 14 and 15, respectively. Apart from the timing of injection, these signature variables do not depend strongly on the configuration. In particular the substantial margins against oxidation excursion and core damage remain. Further sensitivity studies showed that the rate of injection (3.0 or 3.5 kg/s), and temperature of injected coolant (288, 322 or 373 K (15, 49 or 100 ◦ C)) have a minor effect on the recovery process and time window for injection. The result is also unaffected by assuming a lower void limit in the two-phase region (0.2 or 0.4), equivalent to reducing the maximum level swell from 40% to 20%. 4.3. Operation of steam generators A possible accident management action following a loss of RHR is to operate the SG secondary sides to maintain a heat sink. This action can maintain the core in a covered state is situations when the RCS is closed and the pressure is high enough to drive the heat transfer by condensation in the SG tubes. Experimental and analytical studies were performed in connection with the CEA conducted BETHSY programme (Dumont et al., 1994) and more recently in the frame of OECD sponsored PKL programme (Jasiulevicius, 2005; Queral et al., 2006). We again consider the scenario following loss of RHR at 22 h but concentrate mainly on the case where the upper head is in place and secure. We note that the coarsely noded lumped parameter description of the SGs provides only a very approximate treatment of the condensation process in the complex geometry and in the presence of non-condensable gas. The aim is to identify the potential for heat removal by SG operation rather than provide an accurate evaluation of the thermal–hydraulic parameters. The simulations assume that operation of SGs enables the tubes to remain covered and the secondary side pressure to be maintained at 1.0 bar, which are imposed as boundary conditions. The opening area of the SG relief valves and the low decay heat level implies that an overpressure of 0.1 bar gauge is sufficient to relieve the steam, so that model is considered to provide a good enough approximation. Fig. 16 shows the total pressure in the RPV upper plenum and steam pressures in various parts of the RCS, while Fig. 17 shows the liquid levels in the RCS. The results strongly indicate that the core remains covered and the decay heat is removed with only a moderate pressure increase, up to 2.6 bar. We can interpret the pressure response as follows. As steam is generated in the core the air is compressed into the SG and region downstream, to leave some of the tube volume at a steam pressure high enough for condensation to take place (the active zone). The conditions stabilise when this is sufficient for condensation to bal-
Fig. 16. Liquid levels in RCS (upper head secure, SG operated).
2180
J. Birchley et al. / Nuclear Engineering and Design 238 (2008) 2173–2181
the case that the upper head is in place but with the bolts detensioned the head becomes raised at an RCS pressure below that necessary to condense the steam. The steam is then vented directed from the RPV. As can be seen from Fig. 18, SG operation retards the depletion of coolant but does not otherwise change the accident progression. Therefore SG operation is an effective measure only if the RCS is essentially sealed. 5. Conclusions
Fig. 17. Total and steam pressures in RCS (upper head secure, SG operated).
ance the boiling in the core (ca. 3 kg/s). Beyond this zone the steam pressure (and temperature) is in equilibrium with secondary side and no further condensation takes place. The active zone occupies only a small fraction of the SG tubes in the present situation where the heat load is small. This interpretation applies strictly only to the idealised case where the flow geometry is simple, i.e. no multiple flow paths, no counter-current flow limitation, no leakage. We note also that the conditions are not completely steady due to the small leakage of steam (ca. 0.1 kg/s) through the pressuriser vent line. Depletion at this rate would lead to the start of core uncovery only after at least 3 days. Concerning the other factors mentioned ¨ and above, it has been observed experimentally in BETHSY 7.2 (Noel Deruaz, 1994) that the flow may differ from tube to tube, with steam flow and condensation in some of the tubes active and stagnation in others. This behaviour would perhaps reduce the efficiency and modify the effective heat transfer area. The degree of mixing of steam and non-condensable gas in the passive region is also uncertain, which is shown by analyses to modify the bulk condensation efficiency (Harwood and Stanev, 1993). Detailed discussion of these effects is beyond the scope of the present study, but it can be easily shown that a halving of the overall condensation efficiency would increase the RCS pressure to about 2.9 bar, i.e. an increase of only 0.3 bar. The above remarks apply only if leakage of coolant is small enough to maintain the RCS at a few bars overpressure. Condensation would not occur in the SG if the loss of RHR occurs when the upper head is removed, or with other open RCS configurations. In
The transient evolution has been investigated following loss of RHR at an early stage during the period of mid-loop operation. The base case scenario assumes the RPV upper head is in place but with the bolts detensioned, the vent line from the top of the pressuriser is open, and the SG secondary sides are isolated from the main feed and steam systems. The time-span of the study is until RPV failure. The calculated results exhibit a steady depletion of primary coolant, a progressive top to bottom uncovery of the core, accelerated heating due to oxidation of the Zircaloy cladding, core degradation and relocation to the lower plenum, and RPV failure. Core uncovery begins more than 3 h after the loss of RHR and RPV failure occurs at about 9 h. Later occurrences of loss of RHR during mid-loop operation show similar accident evolution, with progressively longer timescales. Sensitivity studies on RPV configuration show similar accident behaviour if the upper head is removed but with some differences in timing. There is strong pressurisation of the RCS if the upper head bolts are secure and a delayed accident evolution. Generation of typically 300–400 kg of hydrogen results in concentrations in the containment up to 10%, a value which coincides with the criterion for ignition used in MELCOR. In any case it should be assumed that RPV failure would probably provoke deflagration, even if the ignition criterion has not already been reached. The burning of such quantities of hydrogen results in a pressure total load of about 4 bar, which is well within the total strength of the containment. The slow accident evolution implies a substantial time window within which AM action may prevent or terminate a core uncovery. Coolant injection, even at a slow rate, is highly effective in halting the excursion and recovering the core, provided it is initiated before core has heated up to the point, approximately 1200 K, at which oxidation heat is important. The assumption of very low injection rate and adoption of the conservative Urbanic–Heidrick model for oxidation kinetics suggests the present estimate, 15,200 s after the loss of RHR, is a lower bound for latest injection time to recover the core without damage. The effectiveness of injection corresponding to one charging pump (ca. 3.5 kg/s) underlines the margin provided by the nominal AM procedure (injection at ca. 10 kg/s). Moreover, this result is insensitive to RPV configuration, variations in the exact injection conditions, or assumptions two-phase level swell. SG operation at ambient pressure provides the possibility to maintain a heat sink and prevent core uncovery. However, the effectiveness of this action depends on there being no significant leakage of primary coolant. This is possible for the reference plant only if the RCS is closed with the RPV upper head and secure. Acknowledgements The authors are pleased to acknowledge the financial support and technical input from Nordostschweizerische Kraftwerke AG, Kernkraftwerk Beznau (KKB) on whose behalf the present study was performed. References
Fig. 18. Liquid levels in RCS (upper head bolts detensioned, effect of SG operation).
Dumont, D., et al., 1994. Loss of residual heat removal during mid-loop operation: BETHSY experiments. Nucl. Eng. Des. 149, 365–374.
J. Birchley et al. / Nuclear Engineering and Design 238 (2008) 2173–2181 Gauntt, R.O. et al., 2000, MELCOR Computer Code Manuals: Version 1.8.5, NUREG/CR6119. Harwood, C. and Stanev, I.E., 1993, RELAP5/MOD2 Analysis of BETHSY Test 7.2c: Reflux Condenser Mode Steam Generator Operation with Noncondensable Gas in the Primary Side, RELAP5 Seminar, Boston, USA. Hinds, W.C., 1982. Aerosol Technology: Properties, Behaviour and Measurement of Airborne Particles. John Wiley & Sons Inc. Jasiulevicius, A., October 2005. Benchmark Calculations of PKL Test E3.1 using TRACE Code. In: Presented at PKL Analytical Workshop, Pisa, Italy. Kernkraftwerk Beznau, Block 2, 2003, Final Safety Report. Kuhlman, M.R. et al., 1985, CORSOR Users Manual, NUREG/CR-4173. ¨ B., Deruaz, R., 1994. Reflux condenser mode with non-condensable gas: assessNoel, ment of CATHARE against BETHSY Test 7.2C. Nucl. Eng. Des. 149, 291–298.
2181
´ ´ Queral, C., Gonzalez, I., Exposito, A., 2006. Analysis of the cooling capability of steam generators during the loss of residual heat removal system at midloop operation with closed primary system. Ann. Nucl. Energy 33, 1102– 1115. Richner, M., 2005, private communication. Schanz, G., Adroguer, B., Volchek, A., 2004. Advanced treatment of Zircaloy cladding high-temperature oxidation in severe accident code calculations, Part I. Experimental database and basic modelling. Nucl. Eng. Des. 232, 75– 84. Weigand, G.G. (Ed.), August 1984, Thermal-hydraulic Process Modelling in Risk Analysis: An Assessment of the Relevant Systems, Structures and Phenomena, SAND84-1219, NUREG/CR-3986.