Abstract
A description of the results for a Station Black-Out analysis for Atucha 2 Nuclear Power Plant is presented here. Calculations were performed with MELCOR 1.8.6 YV3165 Code. Atucha 2 is a pressurized heavy water reactor, cooled and moderated with heavy water, by two separate systems, presently under final construction in Argentina. The initiating event is loss of power, accompanied by the failure of four out of four diesel generators. All remaining plant safety systems are supposed to be available. It is assumed that during the Station Black-Out sequence the first pressurizer safety valve fails stuck open after 3 cycles of water release, respectively, 17 cycles in total. During the transient, the water in the fuel channels evaporates first while the moderator tank is still partially full. The moderator tank inventory acts as a temporary heat sink for the decay heat, which is evacuated through conduction and radiation heat transfer, delaying core degradation. This feature, together with the large volume of the steel filler pieces in the lower plenum and a high primary system volume to thermal power ratio, derives in a very slow transient in which RPV failure time is four to five times larger than that of other German PWRs.
1. Introduction
The Central Nuclear Atucha 2 (CNA-2) is a nuclear power plant (NPP) with a two-loop, 745 MWe, Pressurized Heavy Water Reactor (PHWR), designed by Siemens-KWU and being under final construction in Lima, Argentina. The NPP is cooled and moderated by heavy water like a similar unit of smaller power (CNA-I) in operation at the same site since 1974.
The reactor pressure vessel is very large and has a diameter of ~7.4 m. In difference to other PWRs the upper and lower plenum is to a large content occupied by filler pieces made of steel to reduce the necessary heavy water inventory (Figure 1). The reactor core consists of 451 vertical natural Uranium fuel assemblies located in the same number of coolant channels, connected each to the lower and upper reactor plenum. Each assembly consists of 37 fuel rods. The thermohydraulic design of the core divides the channels into five zones. For the external zones, specially designed flow limiters (drossels) are installed, so that the coolant flow in each channel zone is proportional to the average generated power in it, achieving almost the same channel outlet temperature for all the zones (Figure 2). The coolant channels are within the large moderator (MOD) tank. For reactivity reasons the moderator in it is maintained at a lower temperature than the reactor coolant. This is accomplished by the MOD system (Figure 4), which extracts the moderator from the MOD tank, cools it in the MOD coolers, and feeds it back to the MOD tank.
During full-load operation, 95% of the total thermal power is generated in the fuel, and the remaining 5% in the MOD tank, because of the neutron moderation. Additionally, approximately 5% of the thermal power is transferred from the coolant channels to the MOD tank by heat transfer due to the temperature difference between the systems. The heat removed from the MOD system is used for preheating the feed water of the two Steam Generators (SGs), (Figure 3). The reactor coolant system and the MOD system are connected by pressure equalization openings of the moderator tank closure head. Therefore, the pressure differences in the core between the primary coolant and MOD systems are comparatively small, which results in thin walls for the coolant channels. Furthermore, the connection between the reactor coolant system and the MOD system permits the use of common auxiliary systems to maintain the necessary water quality.
Various methods are applied to control reactivity and thus the power output of the reactor. The reactor contains “black” (Hafnium absorbers) and “gray” (steel absorbers) control elements (Figure 1). These control elements are used to control the reactivity and the power distribution, to compensate the buildup of Xenon poisoning following a reactor power reduction and to shut down the reactor. Additionally, a fast boron injection system, as a second independent shutdown system, is provided, which injects boric acid into the MOD tank. The reactivity can be also controlled by varying the MOD temperature within a certain range, which is advantageous for some operating modes. Table 1 shows the main overall data of the plant, while Figures 3 and Figure 4 show a schematic view of the reactor and moderator system.
The reactor coolant system (RCS) (Figure 3) removes the heat generated in the reactor core and transfers it via the steam generators to the turbine and the generator of the plant. The system is structured similar to that of a pressurized light water reactor but consists only of two identical loops, each comprising a steam generator, a reactor coolant pump, and the interconnecting piping, as well as one pressurizer linked to one loop.
The moderator system (Figure 4) consists of four identical loops operating in parallel. Each loop comprises a moderator cooler, a moderator pump, and the interconnecting lines and valves. The moderator system performs various functions depending on the reactor operating mode.
During normal operation the moderator system maintains the moderator at a lower temperature than that of the reactor coolant. The moderator leaves the top of the moderator tank, flows to the moderator pumps, is pumped through the moderator coolers, and flows back to the bottom of the moderator tank through special pipes coming down from the top of the RPV. The heat transferred in the moderator coolers is used to preheat the steam generator feed water.
For residual heat removal, the moderator system is switched over to the residual heat removal position by means of the moderator valves. Under this operation mode, the moderator is extracted from the bottom of the moderator tank (reverse flow to nominal operation) by the moderator pumps. Passing the moderator coolers, the moderator is injected through the hot or cold reactor coolant lines into the core. The moderator system forms the first link of the residual heat removal chain. The residual heat is transferred from the moderator system to the residual heat removal system and then to the service cooling water system.
During emergency core cooling the moderator serves as a high-pressure core cooling system. Determinant for the design of the moderator system is the demand for a high reliability during emergency core cooling condition. Therefore, the system consists of four separated loops from which the injection capacity of two moderator circuits (334 kg/s) is sufficient for emergency core cooling operation. For emergency core cooling operation, the moderator system is switched over in the so-called residual heat removal mode. The moderator pumps take the water again from the bottom of the moderator tank and feed through the moderator coolers into the cold and hot reactor coolant lines, respectively, the upper and lower plenum of the RPV. The residual heat removal chain connected to the moderator coolers during emergency core cooling is the same as during residual heat removal.
The primary flow rate through the moderator coolers and the moderator pumps is 222 kg/s for each pump, the net injection flow into the reactor coolant system is 167 kg/s for each pump, taking into account a bypass flow to the suction line of the moderator pumps. This is designed to reduce the temperature of the water on the suction side of the pumps.
Additionally to the moderator pumps, the ECCS includes 4 low pressure safety injection pumps, 4 water storage tanks, and 4 accumulators. After the emergency core cooling signal is triggered, the water storage tanks inject the inventory directly into the containment sump. The safety injection pumps, with a flow rate of 167 kg/s each, charge the coolant collected in the containment sump through the moderator coolers into the primary system. Accumulators also inject into the moderator lines downstream the moderator coolers.
Atucha 2 NPP has developed Probabilistic Safety Analyses (PSAs) of Levels 1 to 3. While PSA Levels 1 and 3 have been made by NA-SA Atucha-2, Argentina, with support from CNEA Instituto Balseiro, Bariloche, Argentina, PSA Level 2 was developed by GRS Cologne, Germany, with support from CNEA Instituto Balseiro, Bariloche, Argentina, in regard to the MELCOR modeling of the reactor coolant and the moderator coolant system, and NA-SA Atucha-2, Argentina, who provided all necessary information on request and supported especially the determination of containment and reactor building relevant data. A detailed MELCOR input deck [1] is the basis for the deterministic analyses in the PSA Level 2, and models all systems, components and buildings of the plant relevant for severe accidents, as well as the reactor and moderator circuit, the feed water and steam circuit, the heat removal system KAG connected to the moderator coolers, the reactor building with the containment and the relevant part of the auxiliary building and the stack. The selection of the buildings to be modeled in the MELCOR deck has been made based on a determination of possible radionuclide release paths from the containment into the environment assuming severe (core melt) accidents starting from full power operation. The universal modeling of systems and components and reactor protection signals allows the usage of the input deck for a large spectrum of LOCAs and transients starting from normal plant operation.
This nodalisation has been extensively discussed with NA-SA and reviewed by ARN and its subcontractor SNL before final application for PSA Level 2 analyses. It was also validated against a very detailed RELAP5 (version MOD 3.3) model developed by NA-SA and used within the PSA Level 1, to match results for the steady state calculations, and some selected accidents until core heatup in order to gain confidence on obtained results [2].
As a result of the plant specific PSA Level 1, a number of relevant Core Damage States have been identified. In the PSA Level 2, MELCOR calculations have been done for each of the relevant CDS in order to assess the severe accident progression and the possible radionuclide releases into the environment. The results have been used directly by PSA Level 3 study.
One of the most extensively studied transients has been the Station Black-Out, for which a low pressure scenario, a high pressure scenario, and several sensitivity cases have been assessed, as this was the dominating sequence according to PSA Level 1 analysis. In particular, a review of the Low Pressure Station Black-Out (SBO) scenario will be presented here, in order to highlight specifics of CNA-2 NPP regarding timing of the accident scenario, in comparison to other PWR reactors.
2. Brief Description of CNA-2 SBO Sequence
The postulated Station Black-Out event without accumulator injection causes reactor scram and the running-off of both reactor cooling pumps as well as the moderator pumps at the time the initiating event was defined, time = 0.0 s. By an automatic action of the reactor protection system, a 100 K/h cooldown by the steam generators steam dump stations, which is electrically supported by batteries, is initiated. After termination of the cooldown, the primary pressure increases again. The safety valve of the pressurizer opens several times to limit the primary pressure. After 17 cycles of the first pressurizer safety valve, respectively, 3 cycles of pure water release, it is assumed that it fails stuck open. Under leak condition, a permanent flow into the containment occurs through the pressurizer relief tank with a depressurization of the primary systems. The condition for the initiation of the accumulator injection is reached more than 2 hours after the initiating event, when the batteries are already empty. Thus, an accumulator injection is not considered for that case, as an active action is needed to open valves to load the accumulator tanks by nitrogen from the tanks nearby.
If no accident management measure is considered, the above transient is to be expected, which results in a severe core damage. This is thus the transient that will be presented here.
On the other hand, a second base case has been analyzed: the Station Black-Out event with accumulator injection. The accumulator injection can only be pursued if the valves of the accumulator system are opened by a manual accident management measure during the first two hours of the sequence (batteries still available) so that the accumulators get pressurized. The results of this calculation show that due to the accumulator injection, core degradation and RPV failure are delayed by at least 5 hours. The increase in the hydrogen generation is small and does not imply a disadvantage of the accumulator injection because it does not mean an additional endangering. Thus, the accumulator injection seems to be a reasonable measure and it will be probably made available for the Station Black-Out event as an accident management measure in order to gain more time for the handling of the accident.
3. Outline of MELCOR Code
MELCOR [3] is a fully integrated, engineering-level computer code whose primary purpose is to model the progression of accidents in light water reactor nuclear power plants. A broad spectrum of severe accident phenomena in both boiling and pressurized water reactors is treated in MELCOR in a unified framework; current uses of MELCOR include estimation of fission product source terms and their sensitivities and uncertainties in a variety of applications.
The MELCOR code is composed of an executive driver and a number of major modules, or packages, that together model the major systems of a reactor plant and their generally coupled interactions. Reactor plant systems and their response to off-normal or accident conditions include the following:(i)thermal-hydraulic response of the primary reactor coolant system, the reactor cavity, the containment, and the confinement buildings,(ii)core uncovering (loss of coolant), fuel heatup, cladding oxidation, fuel degradation (loss of rod geometry), and core material melting and relocation,(iii)heatup of reactor vessel lower head from relocated fuel materials and the thermal and mechanical loading and failure of the vessel lower head, and transfer of core materials to the reactor vessel cavity,(iv)core-concrete attack and ensuing aerosol generation,(v)in-vessel and ex-vessel hydrogen production, transport, and combustion,(vi)fission product release (aerosol and vapor), transport, and deposition,(vii)behavior of radioactive aerosols in the reactor containment building, including scrubbing in water pools, and aerosol mechanics in the containment atmosphere such as particle agglomeration and gravitational settling, and,(viii)impact of engineered safety features on thermal-hydraulic and radionuclide behavior.
Initially, the MELCOR code was envisioned as being predominantly parametric with respect to modeling complicated physical processes (in the interest of quick code execution time and a general lack of understanding of reactor accident physics). However, over the years as phenomenological uncertainties have been reduced and user expectations and demands from MELCOR have increased, the models implemented into MELCOR have become increasingly best estimate in nature. The increased speed (and decreased cost) of modern computers (including PCs) has eased many of the perceived constraints on MELCOR code development. Today, most MELCOR models are mechanistic, with capabilities approaching those of the most detailed codes of a few years ago. The use of models that are strictly parametric is limited, in general, to areas of high phenomenological uncertainty where there is no consensus concerning an acceptable mechanistic approach.
4. MELCOR Model for CNA-2 NPP
Atucha 2 NPP MELCOR nodalisation was made on the basis of knowledge gained by GRS in previous PSA Level 2 studies for PWR and BWR, and state of the art knowledge on the field. The RPV nodalisation can be seen in Figure 5. The reactor model consists, like in a German PWR model [4], of one volume each for downcomer (CV100), lower plenum (CV110), upper plenum (CV140), and RPV head (CV150) plus one for the upper ends of the coolant channels (CV145).
The 451 coolant channels are subdivided in 6 parallel hydraulic groups, different as typically done in other PWR decks. The reason for this is the PHWR core design which is more similar to a BWR core with canisters. The inner part of the core has no flow limiters, while in the core periphery different regions with different flow limiters exist (Figure 2). The number of coolant channels differs in each of the 6 groups. Each channel and the moderator tank are further subdivided into 3 axial levels. In total 21 CVs are used. This modeling takes into account that the water level in the channels and in the moderator tank may be significantly different in case of an accident and that the channels will fail sequentially in different axial levels. If the channel fails, in each axial level a horizontal flow path opens towards the moderator tank. These flow paths are not shown in Figure 5.
The MELCOR core model uses a BWR model because only this option allows the melting of the zircaloy coolant channels, which are modeled by the BWR fuel assembly canister components. The model consists in total of 7 radial rings and 28 axial levels for the core and the lower plenum. The selection of the radial rings was made taking into account different aspects like the location of flow limiters, the axial and radial power distribution and the burn-up zones. The MELCOR core nodalisation consists of 20 levels. The active part of the fuel consists of 18 levels; 16 of them have an identical length of 30 cm while the other two (axial levels of upper and lower end of active fuel) are only 25 cm long each. The lengths of the inactive core levels at the upper end (level 28) and lower end (level 9) of the fuel assembly are 35 cm and 46.5 cm, respectively. The nodalisation consists of additional 8 levels for the lower plenum, 5 of them are used for the filler pieces and one for the moderator tank bottom (the lower core support plate in MELCOR). The remaining two axial levels model the free space above the filler pieces and the area of the heavy support grid to the moderator tank bottom (Figure 6). The RPV wall is subdivided in 11 segments as shown in Figure 6. The RPV segments 9 to 11 will get in contact with molten material first, after its relocation into the lower plenum.
Each of the two loops of the reactor circuit of CNA-2 is modeled separately (Figure 5). The loop 10 is connected via the surge line (CV410) to the pressurizer (CV420-422) and the relief tank (CV430). The two safety valves of the pressurizer are modeled, and the pressurizer heaters and spray systems as well (normal operation spray system and KBA spray). If the pressure rises in the relief tank, a burst membrane will fail and open towards the containment. In addition, a failure of a safety valve stuck open can be simulated, as described here. Each reactor circuit consists of 6 control volumes, one is used for the hot leg, two are used for the SG piping, and three for modeling the cold leg. This is identical to the PWR model used at GRS before. In case of an accident, the injection of heavy water by the volume control system (KBA) into both cold legs is started. In total 70 m³ can be injected.
The SG secondary side is modeled by 4 volumes, the downcomer, the riser, the steam separator region, and the steam dome (Figure 5). The connections between the SG secondary sides volumes by flow paths are shown as well. The steam system is simplified as shown in Figure 7. This scheme has already been used for German PWRs because such a SG model has proved to be best applicable for this plant design type [4].
The moderator system of the plant consists of four loops, as schematically shown in Figure 8. A moderator pump (MCP) and a heat exchanger (MHEx) are located in each loop. Under normal operation, the hot water (D2O) is taken out at the upper end of the moderator tank through a collector and two pipes, leaving the RPV at the same elevation as the reactor loops. The cold water flows back through four pipes connected to the top of the RPV, ending inside in a special collector at the lower end of the moderator tank. The collector was not modeled in the MELCOR deck. The moderator pumps are also used during accident sequences as emergency core cooling pumps. A failure of a MCP due to cavitation is assumed, if the steam temperature in a suction pipe of an MCP equals to the saturation temperature for more than 2 minutes. This simple model takes into account a high steam concentration at the pump entrance. It is a pessimistic assumption related to the possible continued MCP operation under two-phase flow conditions, but such conditions cannot be simulated well with MELCOR.
The moderator heat exchangers are used to preheat the feed water during normal operation and to cool down the primary system by the KAG system during plant shut down. The secondary side (feed water system) flow of two moderator loops provides the feed water to one SG. The heat exchangers of these two loops are located at two different levels in the containment. The nodalisation of the moderator system is shown in Figure 8 and that of the feed water system in Figure 9. Because of the design specifics, a separate modeling of all 4 loops of the moderator circuit was needed. Moderator loops 10 and 20 are connected to RCS loop 10 (with pressurizer) while loops 30 and 40 are connected to the other RCS loop 20. Moderator loops 10 and 40 are the ones having their Heat Exchanger located at a higher position inside the containment, at floor level −8 m. The other two are located at −11.5 m level.
The MELCOR nodalisation follows the same rules as those applied for the reactor circuit. Vertical and horizontal parts of the piping are modeled separately by CVs. The volume of each individual CV should not be too small to avoid numerical instabilities, which was not possible for instance for the heat exchanger volumes. The pipes of each loop are modeled by 3 CVs plus some CVs for the pipes/collectors inside the moderator tank and as well near the RPV. The heat exchanger itself consists of 3 CVs on the primary as well as on the secondary side. In addition, a heat sink/source of 5 MW in each heat exchanger “node pair” is modeled, to enhance the heat transfer from the primary to the secondary side during normal plant operation. This is necessary to obtain realistic heat transfer rates, similar to those to be found in the real plant, as MELCOR has no model for “cross flow heat exchangers.”
The moderator system is connected through separate pipes with the RCS loops (hot and cold leg) and the RPV (upper plenum and downcomer) for emergency core cooling operation. The injection pipes in each loop are lumped together into one CV with two separate connections (FL) to the injection points. During ECC operation, the system is switched into the so-called “reverse or commutation mode” (reverse flow with extraction of water from moderator tank bottom and injection into RCS and RPV). The pipe, which will be opened for injection, is modeled only by a flow path in each loop (FL521, FL571, FL621, FL671 in Figure 8). There is a bypass flow of about 50 kg/s per loop downstream the heat exchanger back to the suction side of the MCP, which is as well taken into account through flow paths FL515, FL565, FL615, and FL665. The existence of this bypass significantly extends the MCP operation before cavitation occurs.
The feed water system consists of several CVs in each loop. The feed water system upstream the MHEx is modeled by a time independent volume (CV50 in Figure 9) only. As mentioned the heat exchanger secondary side is modeled by 3 CVs in each loop. Downstream, an individual pipe section is modeled and the common feed water pipeline connected to each SG. The bypass of the MHEx is modeled only by one FL in each loop. For emergency feed water injection, the startup and shutdown pumps (LAJ) are used and simulated by mass sources directly into the feed water line at the SGs. In each feed water loop a relief valve is modeled, which limits the maximum pressure, if the system is switched off.
The containment nodalisation scheme is similar in principle to the modeling of the main rooms of the German PWR [4], but much more detailed related to the smaller rooms inside the containment. A general view of the CNA II nodalisation scheme developed for the containment and reactor building is shown in Figure 10. Each colored zone is an individual CV.
Inside the containment and the annulus of the reactor building different floors are located. The developed containment nodalisation consists of 33 control volumes (CVs) and about 90 flow paths (FLs). Several small rooms have been lumped together. Larger rooms are modeled separately. The dome area was subdivided to allow the calculation of convection loops (as described in [4]). The main reasons for this large level of detail are phenomena related to the hydrogen issue and the need for a detailed modeling of a larger number of small compartments located nearby the tilting machine (an automatic machine in charge of transporting new and burned fuel elements from the spent fuel pool to the refueling machine). The open flow paths have been determined based on containment drawings. About 480 heat structures have been defined to simulate the walls, floors, and ceilings and some of the equipment not modeled by the primary and the moderator circuit.
The detail of the annulus model and that of parts of the auxiliary model are similar to the containment. In addition, all relevant air ventilation systems are modeled. More details are given in [1].
5. Initial Data and Boundary Conditions
The boundary conditions and assumptions concerning the failure of systems are briefly summarized in this section. The initiating event is loss of power, accompanied by the failure of four out of four diesel generators. All remaining plant safety systems are supposed to be available; only boron shutdown system is not considered, because it has not been accounted for in the MELCOR model for CNA-2. For the depressurization, it is assumed that during the Station Black-Out sequence the pressurizer safety valve fails stuck open after 3 cycles of water discharge, respectively, 17 cycles in total.
Due to the lack of electrical power supply, the so-called commutation of the moderator loop to ECC mode does not occur.
During that base case, an accumulator injection does not occur because the automatic initiation of the accumulators does not take place before the capacity of the batteries is lost. An accident management measure in order to open the valves of the accumulator system before the batteries get empty is not considered for this base case.
6. MELCOR Input Deck Qualification by Comparison to RELAP5
The qualification of the MELCOR input deck was performed by a comparison with the detailed RELAP5 (version MOD 3.3) input deck developed by NA-SA. This model was used in the early phases of the project, to match the steady state calculations between the two codes, and thus validate the MELCOR model. Furthermore, RELAP5 version uses D2O thermal properties while MELCOR uses H2O. This has a minor effect on the general excellent results, which is shown by the following figures from [2] for the SBO transient. Shown are the first ~4 h of the same scenario, described more in detail in Section 7. For these analyses the containment input deck in MELCOR was not used, as such does not exist in RELAP5 nodalisation either.
Figure 11 shows the primary and secondary pressure. After ~40 min the SG steam valves are closed automatically to limit the further level decrease. Therefore, the secondary pressure rises again. After nearly 2.5 h the pressurizer safety valve was assumed to fail stuck open so that the pressure decreases rapidly. Figure 12 shows the SG water level. Besides some minor differences in the first minutes of the accident, caused by the simpler nodalisation of the SG secondary side with influence on the water level determination, the dry-out of the SG is calculated to be the same. 2 m water level in the SGs is reached almost at the same point in time. This is important for the calculation of the natural circulation in the reactor circuit, shown in Figure 13. The circulation stops at about 2.5 h when the SGs are empty. Nearly identical behaviour was calculated by both codes. Figure 14 shows a comparison between the Cladding Temperatures calculated by MELCOR and by RELAP5. The core heatup phase shows a very good agreement between the two models as well. For more details of the event progression please refer to next chapter.
As a conclusion, not only the light versus heavy water issue is excluded as a possible cause of discrepancies in results, but also the differences between a coarser MELCOR nodalisation, and a much more detailed RELAP5 nodalisation.
7. Results of MELCOR Simulation
Starting from normal plant operation a Station Black-Out (SBO) was assumed at time 0:00 h:min. The main cooling pumps and moderator pumps run down due to the loss of electrical power supply. Injection of water into the reactor cooling circuits is not available because of the loss of all pumps. The containment is successfully isolated due to the SBO condition (fail-safe principle of isolation valves).
Due to the loss of heat sinks, both the primary and secondary side pressures start to increase. On the secondary side, the cooldown by a rate of 100 K/h is initiated. This cooldown is available because the relief valves of the secondary side steam dump stations are supported electrically by batteries. The secondary side pressure decreases, while pressure increase on the primary side is bounded (Figure 15). The water level of the steam generators is continuously decreasing due to the cooldown process and falls below 2 m at 0:43 h and 0:43 h, respectively (Figure 16). Thus, the isolation of both steam valves and steam dump stations occurs (reactor protection signals JR65 and JR66). After steam isolation, small steam leakages of the pilot valves are considered.
Due to the lack of heat release from the primary circuit, the water level inside the pressurizer rises. After completion of the 100 K/h cooldown, the primary pressure starts to increase again. At 0:52 h the primary pressure reaches 12.45 MPa for the first time (Figure 15). The first opening of the pressurizer safety valve occurs at 0:55 h. Subsequently, the valve opens intermittently in order to limit the primary pressure. During the first cycles of the valve only steam is blown into the relief tank. Following, a water steam mixture is released into the relief tank. The burst disk of the relief tank fails at 2:31 h because a pressure gradient over the disk of 1.4 MPa is reached. Altogether, the safety valve makes 17 cycles before it fails stuck open. For the last three cycles only water is discharged into the relief tank. After the safety valve fails stuck open, a continuous leak flow through the relief tank occurs. Due to the leak flow through the relief tank (Figure 17) the primary pressure starts to decrease (Figure 15).
Up to about 2:40 h a free convection flow can be observed at the two upper loops of the moderator system. For each of the lower moderator loops the flow disappears with initiation of the Station Black-Out event, as the moderator heat exchangers are located below the core height.
The JR31 ECCS signal is triggered at 2:31 h. The containment pressure rises due to the leak flow. Thus, several burst membranes located at the steam generator boxes and pressurizer box fail. The flooding signal JR36 occurs at 2:43 h because the primary pressure has fallen below 6.6 MPa. However, the water of the flooding tanks cannot be discharged into the sump due to the lack of electrical power supply.
Owing to the permanent loss of coolant, the water level inside the cooling channels of the core decreases. At about 3:30 h the cooling channels are nearly empty. At that time the water level inside the moderator tank is still located at two thirds of the total height of the tank (Figure 18). From this time on, the decay heat is evacuated from the fuel elements to the coolant channel walls by convection and radiation, as far as they are cooled from the outside by the moderator tank water. The temperature increase shows, specially in the lower parts of the core, a plateau at about 3 h to 4:30 h of the transient (Figures 21 and 22) which evidences the decay heat evacuation by radiation as already stated. As a consequence, the water level inside the moderator tank continues decreasing (Figure 18).
Simultaneously, the water level of the pressurizer slowly decreases (Figure 19). Because of the exposure of the cooling channel, the core starts to heat up in the upper part (Figure 20). The heatup of the lower parts of the core follows with a delay (Figures 21 and 22). The water discharged through the relief tank flows into the containment sump and is lost for core cooling, because safety injection pumps are not available due to the total loss of electrical power supply.
The first radionuclides—noble gases and volatile radionuclides—are released from the fuel elements gap after bursting of the cladding starting at ~3:56 h. The gap release starts in the central part of the core and migrates to the outer radial core rings. After 5:10 h, all radial core regions have got a gap release. The radionuclides form aerosols which are released together with steam through the open relief tank into the containment. Some of the aerosols may deposit as well inside the RCS.
The core heatup accelerates when the oxidation process of the zircaloy cladding and coolant channels starts at about 3:30 h (Figure 20). The hydrogen formed by the oxidation is mainly released through the relief tank into the upper containment compartment where the relief tank is located. After 10 h some of the hydrogen generated inside the pressure vessel is stored inside the Reactor Cooling System (Figure 23). In this analysis no combustion was calculated neither in the rooms near the relief tank nor in other rooms. Hydrogen fractions during the first 10 hours are small because of the presence of Passive Autocatalytic Recombiners (PARs). The amount of hydrogen removed by the PARs installed in the containment compared to the generated amount is shown in Figure 23.
The failure of the coolant channels starts in the upper part of the four inner core rings at 5:16 h. At 5:20 h the damage of the middle part of the inner rings already starts. This process opens additional flow connections between the damaged parts of the coolant channels and the moderator tank. Thus, some water flows from the moderator tank into the lower intact parts of the cooling channels where the water level is increased (Figure 18). Up to 8:20 h the lower plenum of RPV is still full of water. Then, its evaporation starts due to first small relocation of core materials. Inside the moderator tank and cooling channels the water is fully evacuated at about 9 hours after event initiation (Figure 18).
The ongoing core heatup causes a failure of the fuel assemblies and the core failure process spreads radially to the core periphery and axially downwards. This is shown by an abrupt decrease in temperatures in Figures 20 to 22. Failure temperature for fuel rods is around 2300 K. The reason for this is the following: in CNA-2, fuel elements are hanging from a special construction located in the upper part of the channels above the core, which allows the so-called on-line refuelling. As the “fall-down” process of a fuel assembly inside the coolant channel after support failure cannot be modelled by MELCOR, some assumptions have to be made about the failure of the fuel assembly. The mechanical failure of fuel rods is assumed to result from a combination of loss of intact, unoxidized cladding material; thermal stress; molten zircaloy, which “breaks out” from ZrO2 shell at 2400 K; and the collapse of standing fuel rods (that will form particulate debris) based on a cumulative damage function. Due to swelling and thermal expansion, the mechanical stresses inside the pellets increase with temperature. Therefore, a function was build-modelling the fuel integrity with time at temperature taking into account that a long free standing largely damaged fuel column is nonrealistic. As a conclusion failure is shown at a lower temperature than the one usually found in experiments, because a loss of integrity concept for fuel elements is being applied.
Together with the core degradation, significant amounts of noble gases and volatile radionuclides are released from the fuel. The failure of the control rods before the coolant channel failure is of less importance for the core melting process of CNA-2 compared to LWR because of the small masses of control rod material. Recriticality is not a topic as reflooding of a partly destroyed core is not calculated.
The upper (Figure 20) and middle (Figure 21) parts of the fuel in the inner rings fail in two phases at ~5:30 h and ~6:30 h. The failure of the whole five inner core rings is completed at about 9:30 which is shown in Figure 22 as an abrupt decrease in temperature. At that time the outer sixth core ring is still intact, because of the low decay power level. Then, the core debris of the five inner rings accumulates on the moderator tank bottom. The first significant material relocation into the lower plenum after local failure of the moderator tank bottom of radial ring 3 happens at 11:17 h. Thereafter, the particulate debris and melt, respectively, are released into the lower plenum, start evaporating the remaining water and heat up/melt the lower core/moderator tank support grid and the filler pieces in the lower plenum from the top. The water of the lower plenum has been fully evaporated at 12:14 h. As the melt spreads radially on the filler pieces, it gets into contact with the RPV bottom head side wall as well, which heats up (Figures 24 and 25). In the next almost 12.5 hours besides the core debris/melt, additional several tons of metallic melt are formed from the filler pieces and an additional significant amount of radionuclides are released into the RCS. After 19:44 h the outer radial core ring (6th Ring) totally collapses instantaneously due to the loss of support from below and relocates into lower plenum. At this point, the mechanical loading to the RPV wall is very limited, determined by the mass of melt, filler pieces, and the RPV bottom itself. This means that creeping effects are probably proceeding slowly, as the pressure difference across the wall is almost zero. Therefore, RPV failure is assumed in the MELCOR calculation if the outer RPV wall temperature in a segment reaches 1573 K (1300°C). This consideration is also done because no pressure difference exists across the wall in the late phase of the analyzed transient, which otherwise drives the 1D creep rupture model in MELCOR. The RPV failure is calculated to take place at 23:45 h after event initiation (temperature peak for segments 10 to 12 in Figure 25).
8. Discussion of Results
Several publications on SBO transients for PWR reactors can be found in the open literature. In particular, information on the expected timing of core uncovery and beginning of core heatup for a German PWR reactor of type KONVOI has been selected from PSA level 2 results of GRS [5] to be compared with the very specific characteristics of CNA-2 PHWR.
Table 2 shows some selected data comparing results of the Low Pressure SBO transient for CNA-2, with a German PWR type KONVOI SBO transient considering depressurization as a result of creep rupture failure of the surge line after core melting has started. In difference to CNA-2, in the German PWR the hot leg accumulators will inject after depressurization and stop the core degradation for some time. This will happen even if the batteries are already depleted. If the accumulator injection was neglected, the RPV would probably fail up to one hour earlier.
As it can be seen, time of start core uncovery is almost one hour later for CNA-2 NPP than for the Reference PWR and mainly caused by the failure of the pressurizer SV stuck open and the nonfunctional accumulators. This can be explained by two means. Firstly, the Primary System volume-to-core power ratio for CNA-2 doubles that of the reference PWR, which means that there is a larger mass of water to be evaporated to reach complete emptiness of the primary system. This, combined with the very low values of CNA-2 decay heat, results in a great advantage.
On the other hand, the existence of two separated systems, namely, the coolant and the moderator systems, has as a consequence a very specific means of heat evacuation of the decay heat produced in the fuel elements. As it has been seen in a previous section, fuel channels are nearly empty at about 3:30 h, but water level in the moderator tank is still at two-thirds of the total height of the tank at that time. Although upper parts of core channels start to heat up (and eventually fail), the bottom of the fuel channels is in contact with water from the outside, which cools them mostly due to radiation heat transfer. The existence of such a heat sink derives in an increase of channel failure timing, which in the end derives into a later relocation to LP, and a larger time to implement Severe Accident Management Procedures prior to RPV breach. It should be mentioned that in the German PWRs, Accident Management Measures are implemented to depressurize the secondary side and the reactor circuit before the core heats up to use all water resources, but at least the accumulators, to gain time for other measures. More details are given in [5].
It is important to highlight that the correct modeling of radiation heat transfer from the empty fuel channels to the partially full moderator tank is of particular importance for the PHWR and strongly influences the time at which the moderator tank empties. The comparison between RELAP5 and MELCOR shows that the applied MELCOR model is able to predict this process very well.
This behavior has also been observed on all other transients calculated by MELCOR for the PSA Level 2 analysis of CNA-2, and as well for LOCAs in the reactor circuit. An exception is LOCAs in the piping of the moderator system, in which the moderator tank gets empty relatively fast, being this CNA-2 specific heat sink lost.
9. Conclusions
In the paper, a description of the results of a Station Black-Out sequence for Atucha 2 Nuclear Power Plant calculated with MELCOR 1.8.6 YV3165 code has been presented. For the described transient, loss of power was assumed as an initiating event, accompanied by the failure of four out of four diesel generators. All remaining plant safety systems were considered to be available. For the depressurization of the system, it was assumed that during the Station Black-Out sequence the pressurizer safety valve failed stuck open after 17 cycles, respectively, 3 cycles of a blowdown of water.
An overview of CNA-2 NPP design characteristics was presented, together with the description of MELCOR nodalisation of the plant performed by GRS in the frame of PSA Level 2 Analysis. This input deck was set according to previous works performed by GRS for other German NPPs as well as state of the art recommendations. The qualification was done together with CNEA through a comparison of results obtained with a RELAP5 input deck used at NA-SA for PSA Level 1.
A very detailed description of the accident sequence was then presented, highlighting CNA-2 specific thermalhydraulic plant behaviour as well as specific phenomena. Special attention was given to the fact that, at about 3:30 h after the start of the transient, fuel channels get empty while the moderator tank is still partially full. The moderator tank acts then as a heat sink to decay heat, which is evacuated by radiation heat transfer. The moderator is further evaporated lowering its level. This feature derived from the fact that cooling and moderator systems are separated, together with a high primary system volume to thermal power ratio, results in a very slow transient. As a consequence, calculated RPV breach time for CNA-2 Low Pressure SBO transient is almost four to five times larger than that of other German PWRs.
Nomenclature
| CNA-2: | Central Nuclear Atucha-2 (Atucha 2 Nuclear Power Plant) |
| CNEA: | Comisión Nacional de Energía Atómica |
| GRS: | Gesellschaft für Anlagen-und Reaktorsicherheit (GRS) mbH |
| KBA: | Volume control system of CNA-2 |
| LOCA: | Loss of coolant accident |
| LP: | Lower plenum |
| LWR: | Light water reactor |
| MCP: | Moderator pumps |
| NA-SA: | Nucleoeléctrica Argentina Sociedad Anónima |
| NPP: | Nuclear power plant |
| PARs: | Passive autocatalytic recombiners |
| PHWR: | Pressurized heavy water reactor |
| PSA-L2: | Probabilistic Safety Analysis—Level 2 |
| PWR: | Pressurized water reactor |
| RCS: | Reactor cooling system |
| RPV: | Reactor pressure vessel |
| SNL: | Sandia National Laboratories |
| SBO: | Station Black-Out |
| SG: | Steam generator. |