- Email: [email protected]
Cryostat pressurization in ITER during an ex-vessel loss of coolant accident sequence
Fusion Engineering and Design 38 (1998) 343 – 351
Cryostat pressurization in ITER during an ex-vessel loss of coolant accident sequence R. Caporali a, G. Caruso b, L. Di Pace c, G. Franzoni d, M.T. Porfiri c,* a
ANPA, Via V. Brancati 48, 00144 Rome, Italy S.R.S., Vicolo delle Palle 25, 00186 Rome, Italy c ENEA Cr Frascati, Via E. Fermi 45, 00044 Frascati, Rome, Italy d DENER, Politecnico di Torino, Corso Duca Abruzzi 24, 10129 Turin, Italy b
Received 22 July 1997; accepted 1 August 1997
Abstract The paper analyses the pressurization of the ITER cryostat during an ex-vessel loss of coolant accident (LOCA) in the first wall–shielding blanket (FW–SB) primary cooling loop. Since the cryostat is a strong barrier against the release of mobilized hazardous material, its integrity is essential in meeting the ITER safety objectives. The analyses refer to ITER TAC 4 design and were performed by means of a fast running thermal fluid dynamic code that allowed parametric studies. Helium LOCA can be handled by the code, so that the analyses did take into account phenomena such as coil quench and electrical arcing between coil turns, that may occur in tokamaks with superconducting cables in the magnet coils. The main result was that even in the worst conditions the pressure transient in the cryostat does not damage its integrity provided that the plasma facing components (PFC) cooling loops in the vacuum vessel remain undamaged. Hence, if no other energy sources than those coming from an ex-vessel LOCA are added to water, helium and heat structures in the cryostat, the cryostat maintains its integrity. More analyses are needed to evaluate an in-vessel LOCA and the consequent cryostat pressurization transient. In fact this event would add decay heat and exothermic chemical reaction as energy sources to be possibly taken into account in the pressurization transient. These analyses are not within the scope of this work. © 1998 Elsevier Science S.A. Keywords: Loss of coolant accident; Cryostat; Plasma facing components; ITER TAC 4 design
1. Introduction In ITER TAC 4 design the machine core (vacuum vessel) and the components of many machine subsystems (magnets, cooling systems, pumping systems) are to be located inside a cryostat kept under high vacuum conditions [1]. The cryostat is * Corresponding author.
the most important containment barrier for the radioactive products that can be mobilized in ex-vessel accident conditions. Its structural integrity is fundamental, particularly in consideration of its being a passive safety system. An assessment of possible accident sequences and consequences is essential. The safety systems have to mitigate the radiological consequences of the accidents and the
0920-3796/98/$19.00 © 1998 Elsevier Science S.A. All rights reserved. PII S 0 9 2 0 - 3 7 9 6 ( 9 7 ) 0 0 1 0 3 - 8
344
R. Caporali et al. / Fusion Engineering and Design 38 (1998) 343–351
cryostat lowers the radiological effects by orders of magnitude: for this reason it is important to define the possibility of its failure in accident conditions.
2. Reference design and assumptions The parameters used in the simulation refer to the ITER TAC 4 phase of design: Vacum vessel (VV) free volume Cryostat free volume Annular room free volume First wall–shielding blanket (FW–SB) loop (1 out of 12) Water inventory Water pressure Temperature Cryostat–annular room design pressure VV design pressure Helium cooling loop Helium inventory Temperature 4 Pressure Energy stored in TF windings
3650 m3 18 000 m3 1683 m3
74 m3 2.2 MPa 473 K 0.4 MPa 2 MPa 6200 kg K 1 MPa 9.9 GJ
3. Accident initiating event In order to define safety objectives and criteria for ITER plant safety, a thorough systematic analysis of the plant was carried out both to identify all the possible events that might initiate an accident and to follow the development of each in possible accident sequences [2]. The preliminary work to identify initiating events (IEs) was made through a functional failure mode and effects analysis (FFMEA), and the possible accident sequences were determined through a probabilistic safety analysis (PSA) based on a simplified Event-Tree (ET) model [2]. Initiators were found in each plant area and safety-related system: an important category of IEs turned out to be loss of coolant accidents (LOCAs) involving plasma-facing-component
(PFC) cooling circuits, as well as helium cooling circuits for superconducting magnets and additional heating systems. A preliminary analysis on the overall ITER plant led to the identification of only a few failure modes likely to turn into a LOCA in the cryostat [2]; in particular, pipe ruptures in the cooling loops of the vacuum vessel (VV), divertor and first wall. At present the cooling systems design details are not known, and the worst possible LOCA that might result in mobilization of water and radioactivity inventories, would most probably occur in the first wall–shielding blanket (FW– SB) cooling system. In this study it is therefore assumed that a large LOCA in the FW–SB cooling loop would involve all the other LOCAs. The ET, which is a logical model of all the possible sequences that may derive from the accident initiator, is shown in Fig. 1, and two sequences are studied and presented in this paper: the lower branches represent failure of the function reported in the related ET heading. The model also required some simplified, deterministic transient analyses to define the ET branching, as reported in this work.
4. Description of possible accident evolution A LOCA initiating event may evolve into many different sequences, depending on the success or failure of the mitigating actions. A rupture in a FW–SB water cooling line is assumed, followed by a breach of the surrounding duct. Water spills inside the cryostat and onto the adjacent toroidal field coils [3]. A first consequence is a slight pressurization of the cryostat caused by water vaporisation on the inside. The water inventory of 74 m3 at a pressure of 2.2 MPa expands into a room of 18000 m3 at a pressure of 10 − 9 MPa. It is expected that some of the incoming water would freeze on the cold masses of the coil surfaces in few seconds followed, in a few more seconds, by quenching of the superconducting coils. The quench would cause an immediate plasma shutdown because of abrupt changes in the magnetic fields, so no preventive action is needed. The quick overheating of the external layer may generate high mechanical stresses in the
R. Caporali et al. / Fusion Engineering and Design 38 (1998) 343–351
345
Fig. 1. Event tree for first wall and shielding blanket cooling loop LOCA.
coil structure, with overpressurization in the helium cooling circuit. The overpressurization and differential thermal expansion may break some of the conductors, allowing He to spill into the cryostat; at the same time, electrical arcs may be generated across breaks in a series connection. In this case, if energy dumping of the magnet coils fails to operate, the energy stored in the coil system is dissipated in the cryostat as heat generation and the cryostat integrity may be challenged. The PFC cooling loop in the VV may then rupture and a chemical reaction between the beryllium coating and the incoming steam can be initiated. This would cause hydrogen and energy release, which are both additional threats to cryostat integrity. It is believed that if the cooling circuits not
affected by the rupture continue to operate, the decay heat alone would not be able to cause rupture of the VV, with the related consequences. Both in case of in-vessel LOCA and not, if the cryostat maintains structural integrity, the consequences of an accident can be mitigated by actuation of the cryostat detritiation system, which was assumed as a part of the cryostat vacuum pumping system.
5. Description of the consequences The event tree relating (ET) to the initiating event (IE) of loss of coolant accident (LB01) outside the vacuum vessel (VV) is shown in Fig. 1.
346
R. Caporali et al. / Fusion Engineering and Design 38 (1998) 343–351
The accidental consequences are described in the following: WC05: the cryostat detritiation system fails, activation corrosion products are released in the cryostat and a leakage through the cryostat walls is the cause of outside release; WC04: the energy dumping system fails but no mechanical failure is due to arcing. The cryostat detritiation system does not work. The magnet energy is discharged inside the cryostat and transferred to water and helium. The outside release is due to the leakage through the cryostat walls; WC2: the consequences are the same as in the previous case (WC04), plus the effect of the helium inventory exiting from the magnet cooling loop broken because of arcing; WR5: the cryostat integrity fails and a release towards the building surrounding the cryostat takes place. The air detritiation system failure causes a radioactive release through the stack; WC0: a LOCA inside the VV follows the LOCA outside. A Be-water reaction is expected due to the high temperature that may be reached inside the VV if the plasma does not shut-down. If the cryostat detritiation system does not work, a leakage through the cryostat walls might also take place; WC1: if the energy dumping system fails, the accident trend is the same as the previous one but the energy inventory of the magnets must also be taken into account; WR2: if the cryostat walls fail due to both the large energy inventory of the magnets, the beryllium-water reaction and the helium and water outlet from the cooling pipes, the release takes place in the room surrounding the cryostat. The failure of the air detritiation system causes a radioactive release through the stack.
6. Accident modelling
6.1. Code features The CONSEN [4] code was used on a PC to simulate the temperature and pressure transients in the interconnected volumes affected by the accident, by taking into account the relative heat
and mass exchange. The code solves the conservation equations of mass and energy, evaluates the state variables of the fluids (water, air, helium, non condensable gases), and provides zerodimensional (lumped parameters) energy and mass balances. The functions between volumes can be modelled in different ways in order to simulate rupture panels, simple connections, and relief or control valves. The model may also simulate solid structures, which can be completely immersed inside the volumes or can act as boundaries between adjacent volumes. Exchange of energy can be modelled both among the different fluids and between the structures and the fluids. The code allows for heat transfer mechanisms such as nucleate film boiling, condensation, diffusion at liquid–gas interface, natural convection, ice formation, and thermal conduction; other heat transfer mechanisms can be defined as inputs. Code outputs are pressure, temperature, and the inventory of the fluids contained in each volume, the temperature distribution inside the structures, and the energy and flow rates of the fluids exchanged.
6.2. Modelling of the 6olumes and structures The volumes and structures, schematically shown in Fig. 2, were modelled as follows: the cryostat (volume 1) is connected to one FW–SB cooling loop (volume 2) and to one of the toroidal field (TF) coil cooling loops (volume 3); from volume 2 water, initially at 473 K, 2.2 MPa, flows into the cryostat through an opening of 0.049 m2, a double guillotine break in a 17 cm diameter pipe; helium, initially at 4 K and 1 MPa, spills from volume 3 into the cryostat; due to the uncertainty in predicting the number of broken helium pipes of 1 cm diameter each, a parametric analysis was performed as well. The cryostat walls were modelled as a unique 2-m-thick, 6000-m2 wide slab, corresponding to the overall wall surface; the slab, initially at 293 K, exchanges heat on the one side with the ambient air contained in the reactor hall, and on the other side with the fluids contained in the cryostat; the toroidal and poloidal field (TF and
R. Caporali et al. / Fusion Engineering and Design 38 (1998) 343–351
347
Fig. 2. Volumes and structures modelling for the CONSEN code.
PF) coils affected by the accident, the central solenoid and all the mechanical structures were modelled as a unique hollow cylinder (major radius 15 m, minor radius 13 m, height 20 m) contained inside the cryostat. The external surfaces of the coils are assumed initially to be at 80 K. Heat transfer due to radiation is not taken into account in CONSEN 3.1 version. The models of the two volumes, a cylinder for the central solenoid and a slab for the cryostat walls, were made taking into account that the hollow cylinder internal surface, not facing the cryostat, is at a higher temperature, while the slab can be considered as fully immersed in the cryostat volume and has a temperature equal to the building temperature. Not taking into account the effects of heat transmission because of radiation leads to conservative results, because the heat exchange between the structures might reduce the wall temperatures, thus resulting in a milder cryostat pressurization transient.
6.3. Simulation assumptions The sequence evaluated in this work does not consider an in-vessel LOCA, but does consider and analyse other conditions likely to maximize the pressure challenge to the cryostat.
The sequence corresponds to branches 7–9 in the ET in Fig. 1: the effects of the cryostat detritiation system (CYD) and the vent detritiation system (VDS) are not taken into account as these systems have not been definitely defined. A few seconds after the cooling circuit break, it is assumed that the magnet coil external surfaces would be covered by a layer of ice that would cause a temperature increase in the coil surface, which is assumed constant. As a consequence, all the coils would almost immediately quench. The temperature gap between the external layer and the internal surfaces is very high, and the pressure in the helium circuit would rise, thus causing the probable rupture of some conductors, followed by arcing. The number of broken conductors was taken as a parameter to study the consequences challenging the cryostat integrity. It is conservatively assumed that the magnet energy dumping system would fail, and consequently the whole energy inventory stored in the TF windings (99 GJ) would be released to the fluids inside the cryostat. According to studies on superconductivity loss performed for the NET plant [5], it is assumed that the magnetic energy is totally transferred in a time interval of 300 s from the discharge beginning. The same sequence, but assuming that there is no arcing following the rupture of the conductors, has been analysed to point out the effect of the
348
R. Caporali et al. / Fusion Engineering and Design 38 (1998) 343–351
Table 1 Main parameters and results for the accidents Case: LOCA H2O+He
Maximum pressure (MPa)
Maximum temperature (K)
Equivalent break size (m2)
Blow down time (H2O+He) (s)
1 pipe break 10 pipe break 100 pipe break Arcing 1 pipe break Arcing 10 pipe break Arcing 100 pipe break 4 loops arcing 10 pipe break 4 loops arcing 100 pipe break
0.018 0.055 0.09 0.09 0.14 0.2 0.17
315 332 340 364 375 381 381
0.156E-03 0.156E-02 0.156E-01 0.156E-03 0.156E-02 0.156E-01 0.156E-02
\1500 800 450 \1500 1000 500 \1500
0.23
387
0.156E-01
\1500
arc on the energy transfer to the fluids in the cryostat. This consequence corresponds to the group of sequences 4 – 6 in the ET, Fig. 1. In this case, what changes is the mechanism of energy transfer to the fluids entering the cryostat: it is not direct to the fluid as assumed in the case of the arcing, but transmitted through the heat structures.
7. Results The results of the analysis are summarised in Table 1. We will first discuss the case in which no arcing occurs. The pressure transients in the cryostat for three different assumptions on the size of break in the helium pipes (superconductors) are shown in Fig. 3. The fast depressurization of the water loop causes a pressure increase in the cryostat; around 100 s after the beginning of the water LOCA, the pressure reaches a maximum; in a few minutes the water loop is practically emptied; in the long term, when the He is emptied as well, the pressure in the cryostat stabilizes at 0.075 MPa. The time to empty the He loop depends on the break area (i.e. the number of broken conductors in the simulation) and varies from 20 s, for a large break area (100 broken pipes), to 1 h (one He loop broken pipe). The temperature inside the cryostat (Fig. 4) reaches the peak value (340 K) in the case of 100 cooling pipes break due to the higher heat transfer
coefficient with the cryostat walls due to the turbulence in the helium flow (Fig. 5). After 1000 s the temperature in the cryostat is stabilized at 270 K. The flowrate of He and water (Fig. 6) spilled into the cryostat depends on the He loop break area and modifies the peak value of the cryostat pressure. The worst case for a pressure transient in the cryostat corresponds to the largest He loop break, in which case the pressure rises to 0.09 MPa. The pressure transient in the cryostat, for a case in which arcing occurs, is shown in Fig. 6 for three different assumptions on the break size of the helium pipes (superconductors). In comparison with the previous case, the pressure rise in the cryostat is affected by the energy input from arcing (occurring in the first 300 s) and reaches a peak after 200 s; in the long term, when both the water and the He loops are empty, the pressure in
Fig. 3. Pressure transient in cryostat for different numbers of broken pipes of the He loop; no arcing.
R. Caporali et al. / Fusion Engineering and Design 38 (1998) 343–351
349
Fig. 4. Temperature transient in cryostat for different numbers of broken pipes of the He loop; no arcing.
Fig. 6. Pressure transient in cryostat for different numbers of broken pipes of the He loop with arcing.
the cryostat stabilizes again at 0.075 MPa because of the effect of the high thermal inertia of the cryostat structure (Fig. 7). In the short term, as in the previous case, the worst pressure transient in the cryostat is in correspondence with the largest break in the He loop, and the pressure rises to 0.20 MPa. In this case the blowdown time for water and helium is longer than in the previous case because of the higher cryostat pressurization due to the arc energy (Fig. 8). In addition to the previous analyses, a third simulation was made to check the cryostat seals, assuming also mobilization of the inventory of the water contained in three FW – SB cooling loops. The results of the pressure transient are shown in Fig. 9 for the two cases of 10 and 100 He broken pipes. Also in this condition the pressurization of the cryostat is below the design pressure (0.4 MPa) and equal to 0.23 MPa.
In the three cases the pressure peak is about half the design pressure value: for this reason the safety margin can be considered sufficient, especially if one takes into account that a fast running code was used and some simplifying hypotheses were done.
Fig. 5. Flow rate transient in cryostat for different numbers of broken pipes of the He loop; no arcing.
Fig. 7. Temperature transient in cryostat for different numbers of broken pipes of the He loop with arcing.
8. Uncertainties in the results There are three areas of uncertainty in these analyses: cryostat leak rate, level of modeling detail, and Consen verification and validation. The cryostat leak rate is not taken into account and this is a conservative assumption, even if the impact on analyses results is expected to be small, at least in the short term. The code does not allow to take into account dynamic phenomena, but this should have a minor impact on the results because of the large
350
R. Caporali et al. / Fusion Engineering and Design 38 (1998) 343–351
Fig. 8. Flow rate transient in cryostat for different numbers of broken pipes of the He loop with arcing.
volume of the cryostat. Also, given the scope of these analyses in defining the maximum pressurization level in accident conditions and the tool used (fast running code), the detail degree in the model is limited and this may cause some uncertainties in the results. It is believed that the error is towards the conservative side, because hydraulic resistances are not modeled, which causes a faster blowdown transient. It is also very conservative to assume that the overall magnetic energy is transferred to the helium coolant through the arc: it is reasonably expected that a consistent share of it should at first be transferred to the magnet structures, and thus resulting in a pressurisation transient much milder. The code itself is based on a set of well-known and validated mathematical correlations: the verification and validation effort for the overall Consen code is under way with the comparison of the
Fig. 9. Pressure transient in cryostat for different numbers of broken pipes in the He loop with arcing; four water cooling loops.
Fig. 10. Temperature transient in cryostat for different numbers of broken pipes in the He loop with arcing; four water cooling loops.
Consen results with experimental data obtained in the ICE-LOVA facility in JAERI (Japan).
9. Conclusions For a LOCA inside the cryostat, it can be concluded that even in the worst conditions (i.e. large break in the He loop, release of the overall energy inventory of the affected coils to the fluids inside the cryostat), the pressure transient inside the cryostat never exceeds its design pressure (design value is 0.4 MPa absolute), unless the accident implies a consequent LOCA inside the VV triggered by lack of cooling of a FW–SB sector. This result is reflected in the ET model, where the cryostat integrity is not challenged in the sequences following the success of the PFC cooling, except in the case of arcing directly damaging the structure (sequences 10–12).
Fig. 11. Flow rate transient in cryostat for different numbers of broken pipes in the He loop with arcing; four water cooling loops.
R. Caporali et al. / Fusion Engineering and Design 38 (1998) 343–351
The cryostat can be challenged if cooling of the PFCs is no longer assured and an in-VV LOCA occurs: an extended Be-water reaction might occur with hydrogen and energy release. Such an accident would mobilize the activated dust inside the cryostat because of the by-pass between the VV and the cryostat through the broken FW – SB cooling pipes. The overall accident evolution is based on conservative assumptions, which take into account the most severe phenomena that might occur in the accident sequences described above, following magnet energy release. For some sequences (break of 100 pipes in the He cooling loop, arcing and consequent break of four water cooling loops), the cryostat structure might actually fail, but more refined analyses are
.
351
needed, with large transient codes and detailed design information (Figs. 10 and 11).
References [1] ITER TAC 4 Design Report, San Diego Joint Work Site, 1994. [2] R. Caporali, S. Ciattaglia, G. Cambi, T. Pinna, ITER plant functional breakdown, FFMEA, IE identification, qualitative ET and preliminary list of accident sequences, ENEA FUS-TECN S&E TR9/94, Rome, June 1994. [3] L. Di Pace, et al., Cryostat pressurization accident assessment using a computerized model (CONSEN), 18th SOFT, 22 – 26 August 1994, Karlsruhe, Germany. [4] G. Caruso, Manuale d’uso CONSEN’, S.R.S. Doc 41600R01, Rome, November 1994. [5] R. Meyder, et al., Preliminary safety assessment of the NET magnet system, September 1991.
Cryostat pressurization in ITER during an ex-vessel loss of coolant accident sequence R. Caporali a, G. Caruso b, L. Di Pace c, G. Franzoni d, M.T. Porfiri c,* a
ANPA, Via V. Brancati 48, 00144 Rome, Italy S.R.S., Vicolo delle Palle 25, 00186 Rome, Italy c ENEA Cr Frascati, Via E. Fermi 45, 00044 Frascati, Rome, Italy d DENER, Politecnico di Torino, Corso Duca Abruzzi 24, 10129 Turin, Italy b
Received 22 July 1997; accepted 1 August 1997
Abstract The paper analyses the pressurization of the ITER cryostat during an ex-vessel loss of coolant accident (LOCA) in the first wall–shielding blanket (FW–SB) primary cooling loop. Since the cryostat is a strong barrier against the release of mobilized hazardous material, its integrity is essential in meeting the ITER safety objectives. The analyses refer to ITER TAC 4 design and were performed by means of a fast running thermal fluid dynamic code that allowed parametric studies. Helium LOCA can be handled by the code, so that the analyses did take into account phenomena such as coil quench and electrical arcing between coil turns, that may occur in tokamaks with superconducting cables in the magnet coils. The main result was that even in the worst conditions the pressure transient in the cryostat does not damage its integrity provided that the plasma facing components (PFC) cooling loops in the vacuum vessel remain undamaged. Hence, if no other energy sources than those coming from an ex-vessel LOCA are added to water, helium and heat structures in the cryostat, the cryostat maintains its integrity. More analyses are needed to evaluate an in-vessel LOCA and the consequent cryostat pressurization transient. In fact this event would add decay heat and exothermic chemical reaction as energy sources to be possibly taken into account in the pressurization transient. These analyses are not within the scope of this work. © 1998 Elsevier Science S.A. Keywords: Loss of coolant accident; Cryostat; Plasma facing components; ITER TAC 4 design
1. Introduction In ITER TAC 4 design the machine core (vacuum vessel) and the components of many machine subsystems (magnets, cooling systems, pumping systems) are to be located inside a cryostat kept under high vacuum conditions [1]. The cryostat is * Corresponding author.
the most important containment barrier for the radioactive products that can be mobilized in ex-vessel accident conditions. Its structural integrity is fundamental, particularly in consideration of its being a passive safety system. An assessment of possible accident sequences and consequences is essential. The safety systems have to mitigate the radiological consequences of the accidents and the
0920-3796/98/$19.00 © 1998 Elsevier Science S.A. All rights reserved. PII S 0 9 2 0 - 3 7 9 6 ( 9 7 ) 0 0 1 0 3 - 8
344
R. Caporali et al. / Fusion Engineering and Design 38 (1998) 343–351
cryostat lowers the radiological effects by orders of magnitude: for this reason it is important to define the possibility of its failure in accident conditions.
2. Reference design and assumptions The parameters used in the simulation refer to the ITER TAC 4 phase of design: Vacum vessel (VV) free volume Cryostat free volume Annular room free volume First wall–shielding blanket (FW–SB) loop (1 out of 12) Water inventory Water pressure Temperature Cryostat–annular room design pressure VV design pressure Helium cooling loop Helium inventory Temperature 4 Pressure Energy stored in TF windings
3650 m3 18 000 m3 1683 m3
74 m3 2.2 MPa 473 K 0.4 MPa 2 MPa 6200 kg K 1 MPa 9.9 GJ
3. Accident initiating event In order to define safety objectives and criteria for ITER plant safety, a thorough systematic analysis of the plant was carried out both to identify all the possible events that might initiate an accident and to follow the development of each in possible accident sequences [2]. The preliminary work to identify initiating events (IEs) was made through a functional failure mode and effects analysis (FFMEA), and the possible accident sequences were determined through a probabilistic safety analysis (PSA) based on a simplified Event-Tree (ET) model [2]. Initiators were found in each plant area and safety-related system: an important category of IEs turned out to be loss of coolant accidents (LOCAs) involving plasma-facing-component
(PFC) cooling circuits, as well as helium cooling circuits for superconducting magnets and additional heating systems. A preliminary analysis on the overall ITER plant led to the identification of only a few failure modes likely to turn into a LOCA in the cryostat [2]; in particular, pipe ruptures in the cooling loops of the vacuum vessel (VV), divertor and first wall. At present the cooling systems design details are not known, and the worst possible LOCA that might result in mobilization of water and radioactivity inventories, would most probably occur in the first wall–shielding blanket (FW– SB) cooling system. In this study it is therefore assumed that a large LOCA in the FW–SB cooling loop would involve all the other LOCAs. The ET, which is a logical model of all the possible sequences that may derive from the accident initiator, is shown in Fig. 1, and two sequences are studied and presented in this paper: the lower branches represent failure of the function reported in the related ET heading. The model also required some simplified, deterministic transient analyses to define the ET branching, as reported in this work.
4. Description of possible accident evolution A LOCA initiating event may evolve into many different sequences, depending on the success or failure of the mitigating actions. A rupture in a FW–SB water cooling line is assumed, followed by a breach of the surrounding duct. Water spills inside the cryostat and onto the adjacent toroidal field coils [3]. A first consequence is a slight pressurization of the cryostat caused by water vaporisation on the inside. The water inventory of 74 m3 at a pressure of 2.2 MPa expands into a room of 18000 m3 at a pressure of 10 − 9 MPa. It is expected that some of the incoming water would freeze on the cold masses of the coil surfaces in few seconds followed, in a few more seconds, by quenching of the superconducting coils. The quench would cause an immediate plasma shutdown because of abrupt changes in the magnetic fields, so no preventive action is needed. The quick overheating of the external layer may generate high mechanical stresses in the
R. Caporali et al. / Fusion Engineering and Design 38 (1998) 343–351
345
Fig. 1. Event tree for first wall and shielding blanket cooling loop LOCA.
coil structure, with overpressurization in the helium cooling circuit. The overpressurization and differential thermal expansion may break some of the conductors, allowing He to spill into the cryostat; at the same time, electrical arcs may be generated across breaks in a series connection. In this case, if energy dumping of the magnet coils fails to operate, the energy stored in the coil system is dissipated in the cryostat as heat generation and the cryostat integrity may be challenged. The PFC cooling loop in the VV may then rupture and a chemical reaction between the beryllium coating and the incoming steam can be initiated. This would cause hydrogen and energy release, which are both additional threats to cryostat integrity. It is believed that if the cooling circuits not
affected by the rupture continue to operate, the decay heat alone would not be able to cause rupture of the VV, with the related consequences. Both in case of in-vessel LOCA and not, if the cryostat maintains structural integrity, the consequences of an accident can be mitigated by actuation of the cryostat detritiation system, which was assumed as a part of the cryostat vacuum pumping system.
5. Description of the consequences The event tree relating (ET) to the initiating event (IE) of loss of coolant accident (LB01) outside the vacuum vessel (VV) is shown in Fig. 1.
346
R. Caporali et al. / Fusion Engineering and Design 38 (1998) 343–351
The accidental consequences are described in the following: WC05: the cryostat detritiation system fails, activation corrosion products are released in the cryostat and a leakage through the cryostat walls is the cause of outside release; WC04: the energy dumping system fails but no mechanical failure is due to arcing. The cryostat detritiation system does not work. The magnet energy is discharged inside the cryostat and transferred to water and helium. The outside release is due to the leakage through the cryostat walls; WC2: the consequences are the same as in the previous case (WC04), plus the effect of the helium inventory exiting from the magnet cooling loop broken because of arcing; WR5: the cryostat integrity fails and a release towards the building surrounding the cryostat takes place. The air detritiation system failure causes a radioactive release through the stack; WC0: a LOCA inside the VV follows the LOCA outside. A Be-water reaction is expected due to the high temperature that may be reached inside the VV if the plasma does not shut-down. If the cryostat detritiation system does not work, a leakage through the cryostat walls might also take place; WC1: if the energy dumping system fails, the accident trend is the same as the previous one but the energy inventory of the magnets must also be taken into account; WR2: if the cryostat walls fail due to both the large energy inventory of the magnets, the beryllium-water reaction and the helium and water outlet from the cooling pipes, the release takes place in the room surrounding the cryostat. The failure of the air detritiation system causes a radioactive release through the stack.
6. Accident modelling
6.1. Code features The CONSEN [4] code was used on a PC to simulate the temperature and pressure transients in the interconnected volumes affected by the accident, by taking into account the relative heat
and mass exchange. The code solves the conservation equations of mass and energy, evaluates the state variables of the fluids (water, air, helium, non condensable gases), and provides zerodimensional (lumped parameters) energy and mass balances. The functions between volumes can be modelled in different ways in order to simulate rupture panels, simple connections, and relief or control valves. The model may also simulate solid structures, which can be completely immersed inside the volumes or can act as boundaries between adjacent volumes. Exchange of energy can be modelled both among the different fluids and between the structures and the fluids. The code allows for heat transfer mechanisms such as nucleate film boiling, condensation, diffusion at liquid–gas interface, natural convection, ice formation, and thermal conduction; other heat transfer mechanisms can be defined as inputs. Code outputs are pressure, temperature, and the inventory of the fluids contained in each volume, the temperature distribution inside the structures, and the energy and flow rates of the fluids exchanged.
6.2. Modelling of the 6olumes and structures The volumes and structures, schematically shown in Fig. 2, were modelled as follows: the cryostat (volume 1) is connected to one FW–SB cooling loop (volume 2) and to one of the toroidal field (TF) coil cooling loops (volume 3); from volume 2 water, initially at 473 K, 2.2 MPa, flows into the cryostat through an opening of 0.049 m2, a double guillotine break in a 17 cm diameter pipe; helium, initially at 4 K and 1 MPa, spills from volume 3 into the cryostat; due to the uncertainty in predicting the number of broken helium pipes of 1 cm diameter each, a parametric analysis was performed as well. The cryostat walls were modelled as a unique 2-m-thick, 6000-m2 wide slab, corresponding to the overall wall surface; the slab, initially at 293 K, exchanges heat on the one side with the ambient air contained in the reactor hall, and on the other side with the fluids contained in the cryostat; the toroidal and poloidal field (TF and
R. Caporali et al. / Fusion Engineering and Design 38 (1998) 343–351
347
Fig. 2. Volumes and structures modelling for the CONSEN code.
PF) coils affected by the accident, the central solenoid and all the mechanical structures were modelled as a unique hollow cylinder (major radius 15 m, minor radius 13 m, height 20 m) contained inside the cryostat. The external surfaces of the coils are assumed initially to be at 80 K. Heat transfer due to radiation is not taken into account in CONSEN 3.1 version. The models of the two volumes, a cylinder for the central solenoid and a slab for the cryostat walls, were made taking into account that the hollow cylinder internal surface, not facing the cryostat, is at a higher temperature, while the slab can be considered as fully immersed in the cryostat volume and has a temperature equal to the building temperature. Not taking into account the effects of heat transmission because of radiation leads to conservative results, because the heat exchange between the structures might reduce the wall temperatures, thus resulting in a milder cryostat pressurization transient.
6.3. Simulation assumptions The sequence evaluated in this work does not consider an in-vessel LOCA, but does consider and analyse other conditions likely to maximize the pressure challenge to the cryostat.
The sequence corresponds to branches 7–9 in the ET in Fig. 1: the effects of the cryostat detritiation system (CYD) and the vent detritiation system (VDS) are not taken into account as these systems have not been definitely defined. A few seconds after the cooling circuit break, it is assumed that the magnet coil external surfaces would be covered by a layer of ice that would cause a temperature increase in the coil surface, which is assumed constant. As a consequence, all the coils would almost immediately quench. The temperature gap between the external layer and the internal surfaces is very high, and the pressure in the helium circuit would rise, thus causing the probable rupture of some conductors, followed by arcing. The number of broken conductors was taken as a parameter to study the consequences challenging the cryostat integrity. It is conservatively assumed that the magnet energy dumping system would fail, and consequently the whole energy inventory stored in the TF windings (99 GJ) would be released to the fluids inside the cryostat. According to studies on superconductivity loss performed for the NET plant [5], it is assumed that the magnetic energy is totally transferred in a time interval of 300 s from the discharge beginning. The same sequence, but assuming that there is no arcing following the rupture of the conductors, has been analysed to point out the effect of the
348
R. Caporali et al. / Fusion Engineering and Design 38 (1998) 343–351
Table 1 Main parameters and results for the accidents Case: LOCA H2O+He
Maximum pressure (MPa)
Maximum temperature (K)
Equivalent break size (m2)
Blow down time (H2O+He) (s)
1 pipe break 10 pipe break 100 pipe break Arcing 1 pipe break Arcing 10 pipe break Arcing 100 pipe break 4 loops arcing 10 pipe break 4 loops arcing 100 pipe break
0.018 0.055 0.09 0.09 0.14 0.2 0.17
315 332 340 364 375 381 381
0.156E-03 0.156E-02 0.156E-01 0.156E-03 0.156E-02 0.156E-01 0.156E-02
\1500 800 450 \1500 1000 500 \1500
0.23
387
0.156E-01
\1500
arc on the energy transfer to the fluids in the cryostat. This consequence corresponds to the group of sequences 4 – 6 in the ET, Fig. 1. In this case, what changes is the mechanism of energy transfer to the fluids entering the cryostat: it is not direct to the fluid as assumed in the case of the arcing, but transmitted through the heat structures.
7. Results The results of the analysis are summarised in Table 1. We will first discuss the case in which no arcing occurs. The pressure transients in the cryostat for three different assumptions on the size of break in the helium pipes (superconductors) are shown in Fig. 3. The fast depressurization of the water loop causes a pressure increase in the cryostat; around 100 s after the beginning of the water LOCA, the pressure reaches a maximum; in a few minutes the water loop is practically emptied; in the long term, when the He is emptied as well, the pressure in the cryostat stabilizes at 0.075 MPa. The time to empty the He loop depends on the break area (i.e. the number of broken conductors in the simulation) and varies from 20 s, for a large break area (100 broken pipes), to 1 h (one He loop broken pipe). The temperature inside the cryostat (Fig. 4) reaches the peak value (340 K) in the case of 100 cooling pipes break due to the higher heat transfer
coefficient with the cryostat walls due to the turbulence in the helium flow (Fig. 5). After 1000 s the temperature in the cryostat is stabilized at 270 K. The flowrate of He and water (Fig. 6) spilled into the cryostat depends on the He loop break area and modifies the peak value of the cryostat pressure. The worst case for a pressure transient in the cryostat corresponds to the largest He loop break, in which case the pressure rises to 0.09 MPa. The pressure transient in the cryostat, for a case in which arcing occurs, is shown in Fig. 6 for three different assumptions on the break size of the helium pipes (superconductors). In comparison with the previous case, the pressure rise in the cryostat is affected by the energy input from arcing (occurring in the first 300 s) and reaches a peak after 200 s; in the long term, when both the water and the He loops are empty, the pressure in
Fig. 3. Pressure transient in cryostat for different numbers of broken pipes of the He loop; no arcing.
R. Caporali et al. / Fusion Engineering and Design 38 (1998) 343–351
349
Fig. 4. Temperature transient in cryostat for different numbers of broken pipes of the He loop; no arcing.
Fig. 6. Pressure transient in cryostat for different numbers of broken pipes of the He loop with arcing.
the cryostat stabilizes again at 0.075 MPa because of the effect of the high thermal inertia of the cryostat structure (Fig. 7). In the short term, as in the previous case, the worst pressure transient in the cryostat is in correspondence with the largest break in the He loop, and the pressure rises to 0.20 MPa. In this case the blowdown time for water and helium is longer than in the previous case because of the higher cryostat pressurization due to the arc energy (Fig. 8). In addition to the previous analyses, a third simulation was made to check the cryostat seals, assuming also mobilization of the inventory of the water contained in three FW – SB cooling loops. The results of the pressure transient are shown in Fig. 9 for the two cases of 10 and 100 He broken pipes. Also in this condition the pressurization of the cryostat is below the design pressure (0.4 MPa) and equal to 0.23 MPa.
In the three cases the pressure peak is about half the design pressure value: for this reason the safety margin can be considered sufficient, especially if one takes into account that a fast running code was used and some simplifying hypotheses were done.
Fig. 5. Flow rate transient in cryostat for different numbers of broken pipes of the He loop; no arcing.
Fig. 7. Temperature transient in cryostat for different numbers of broken pipes of the He loop with arcing.
8. Uncertainties in the results There are three areas of uncertainty in these analyses: cryostat leak rate, level of modeling detail, and Consen verification and validation. The cryostat leak rate is not taken into account and this is a conservative assumption, even if the impact on analyses results is expected to be small, at least in the short term. The code does not allow to take into account dynamic phenomena, but this should have a minor impact on the results because of the large
350
R. Caporali et al. / Fusion Engineering and Design 38 (1998) 343–351
Fig. 8. Flow rate transient in cryostat for different numbers of broken pipes of the He loop with arcing.
volume of the cryostat. Also, given the scope of these analyses in defining the maximum pressurization level in accident conditions and the tool used (fast running code), the detail degree in the model is limited and this may cause some uncertainties in the results. It is believed that the error is towards the conservative side, because hydraulic resistances are not modeled, which causes a faster blowdown transient. It is also very conservative to assume that the overall magnetic energy is transferred to the helium coolant through the arc: it is reasonably expected that a consistent share of it should at first be transferred to the magnet structures, and thus resulting in a pressurisation transient much milder. The code itself is based on a set of well-known and validated mathematical correlations: the verification and validation effort for the overall Consen code is under way with the comparison of the
Fig. 9. Pressure transient in cryostat for different numbers of broken pipes in the He loop with arcing; four water cooling loops.
Fig. 10. Temperature transient in cryostat for different numbers of broken pipes in the He loop with arcing; four water cooling loops.
Consen results with experimental data obtained in the ICE-LOVA facility in JAERI (Japan).
9. Conclusions For a LOCA inside the cryostat, it can be concluded that even in the worst conditions (i.e. large break in the He loop, release of the overall energy inventory of the affected coils to the fluids inside the cryostat), the pressure transient inside the cryostat never exceeds its design pressure (design value is 0.4 MPa absolute), unless the accident implies a consequent LOCA inside the VV triggered by lack of cooling of a FW–SB sector. This result is reflected in the ET model, where the cryostat integrity is not challenged in the sequences following the success of the PFC cooling, except in the case of arcing directly damaging the structure (sequences 10–12).
Fig. 11. Flow rate transient in cryostat for different numbers of broken pipes in the He loop with arcing; four water cooling loops.
R. Caporali et al. / Fusion Engineering and Design 38 (1998) 343–351
The cryostat can be challenged if cooling of the PFCs is no longer assured and an in-VV LOCA occurs: an extended Be-water reaction might occur with hydrogen and energy release. Such an accident would mobilize the activated dust inside the cryostat because of the by-pass between the VV and the cryostat through the broken FW – SB cooling pipes. The overall accident evolution is based on conservative assumptions, which take into account the most severe phenomena that might occur in the accident sequences described above, following magnet energy release. For some sequences (break of 100 pipes in the He cooling loop, arcing and consequent break of four water cooling loops), the cryostat structure might actually fail, but more refined analyses are
.
351
needed, with large transient codes and detailed design information (Figs. 10 and 11).
References [1] ITER TAC 4 Design Report, San Diego Joint Work Site, 1994. [2] R. Caporali, S. Ciattaglia, G. Cambi, T. Pinna, ITER plant functional breakdown, FFMEA, IE identification, qualitative ET and preliminary list of accident sequences, ENEA FUS-TECN S&E TR9/94, Rome, June 1994. [3] L. Di Pace, et al., Cryostat pressurization accident assessment using a computerized model (CONSEN), 18th SOFT, 22 – 26 August 1994, Karlsruhe, Germany. [4] G. Caruso, Manuale d’uso CONSEN’, S.R.S. Doc 41600R01, Rome, November 1994. [5] R. Meyder, et al., Preliminary safety assessment of the NET magnet system, September 1991.