Abstract
The Fukushima Dai-ichi nuclear power plant accident shows that an extreme natural disaster can prevent the proper restoration of electric power for several days, so-called extended SBO. In Korea, the government and industry performed comprehensive special safety inspections on all domestic nuclear power plants against beyond design bases external events. One of the safety improvement action items related to the extended SBO is installation of external water injection provision and equipment to RCS and SG. In this paper, the extended SBO coping capability of APR1400 is examined using MAAP4 to assess the effectiveness of the external water injection strategy. Results show that an external injection into SG is applicable to mitigate an extended SBO scenario. However, an external injection into RCS is only effective when RCS depressurization capacity is sufficiently provided in case of high pressure scenarios. Based on the above results, the technical basis of external injection strategy will be reflected on development of revised severe accident management guideline.
1. Introduction
One of the representative accidents related to the electric power in nuclear power plants is a Station Blackout (SBO). SBO is initiated by a loss of all offsite power with a concurrent failure of both Emergency Diesel Generators (EDGs). With no Alternate Current (AC) power source, most of the active safety systems that perform safety functions are not available. To prevent SBO scenarios from becoming worse, nonsafety class Alternative AC (AAC) power is installed as a redundancy to provide electricity to the essential equipment that perform safety function [1, 2]. However, if the AAC is also unavailable, only active equipment that are powered by Direct Current (DC) from station batteries or passive systems could work. Normally, Turbine-Driven Auxiliary Feedwater Pumps (TD-AFWP), which extract steam from the main steam line, are only available means to supply cooling water to the steam generators (SG). Reactor Coolant System (RCS) natural circulation and heat transfer to the secondary via the steam generators are the primary means to cool the core because the Reactor Coolant Pumps (RCPs) are unavailable to provide a forced circulation. The capacity of a DC battery is about 4~8 hrs; thus, operator should restore the existing electric power before it exhausts. If electric power cannot be restored within this time due to a complicated situation, SBO with the complete depletion of batteries is a total loss of heat sink situation and proceeds to a severe accident condition. Probabilistic Safety Assessment (PSA) results show that SBO is one of the dominant sequences that lead to the core damage and containment failure in the APR1400 [3] as shown in Table 1.
The Fukushima Dai-ichi nuclear power plant accident shows that an extreme natural disaster can prevent the proper restoration of electric power for several days, so-called extended SBO [4]. After the Fukushima Dai-ichi accident, several kinds of analyses on SBO are performed. One of them is BWR long term SBO calculation using TRAC-BF [5]. Calculated results are compared with the observed data at the unit 2 reactor of the Fukushima Dai-ichi nuclear power plant and shown to be in good agreement. In PWR, a study shows the effectiveness of availability of long term secondary cooling to delay the time before core uncovers and significant heatup [6, 7]. Results show that the available time for restoration of AC power is extended for at least the batteries capacity extension time. Another study was performed about comparison of extended SBO scenarios against PWR, BWR, and PWHR using MAAP code without operator action [8]. Results show that core damage occurs within 10 hrs after the initial event. Most of the studies are focused on the plant behavior without operator action or improvement of accident management using existing permanent equipment, such as extension of battery capacity and operability of TD-AFW.
As for regulation activity, US NRC recommends strengthening SBO mitigation capability for design basis and beyond design basis external events. Detailed recommendations [9] include(i)establishment of a minimum coping time of 8 hrs,(ii)preparation of the equipment, procedure, and training necessary to implement an extended SBO coping time of 72 hrs for core and spent fuel pool (SFP) cooling,(iii)establishment of preplan and prestage offsite resources to support uninterrupted core and SFP cooling.
In Korea, the government and industry performed comprehensive special safety inspections on all domestic nuclear power plants against beyond design bases external events after the Fukushima Dai-ichi nuclear power plant accident. The major concerns of these inspections were protection against extreme natural hazards, prevention and/or mitigation of severe accidents, emergency preparedness, and the design of structures and equipment against earthquakes and coastal flooding. As a result, a total of 50 recommendations were defined as safety improvement action items. They were classified into 5 categories and will be implemented by 2015.
Some of the action items related to mitigation measures against extended SBO sequences are(i)upgrading the design basis of AAC diesel generators,(ii)installation of a water-proof gate to EDG room,(iii)securing the availability of portable power generator vehicles,(iv)installation of external water injection provision and equipment to RCS and SG.
Among those items, effectiveness of external injection into RCS and SG needs to be examined. Therefore, in this paper, the overall extended SBO coping capability of APR1400 is analyzed to examine the effectiveness of the external water injection strategy and estimate proper operator action timing to reflect on the optimal revised severe accident management guideline. Section 2 presents SBO related procedures to prevent and/or mitigate the sequences as well as the mitigation facilities installed in APR1400. The modeling and analyses results using the MAAP severe accident analysis code are provided in Sections 3 and 4, and a summary of the SBO coping capabilities in APR1400 are discussed in Section 5.
2. SBO Related Operating Procedures and Mitigation Facilities
2.1. SBO Related Operating Procedures
The purpose of this section is to identify the main operator actions to be analyzed and to estimate the operator action timing during a SBO scenario. The APR1400 Emergency Operational Procedure (EOP) and Severe Accident Management Guideline (SAMG) were developed based on the PWR owner’s group reference documents [10, 11] and these documents were modified [12, 13] to reflect the APR1400 plant specific design characteristics [14].
When a SBO occurs, the reactor is tripped by either Reactor Protection System (RPS) trip signal or gravity drop of control rod due to the loss of electric power. Then operators initiate an EOP. After performing standard posttrip action to verify the plant status, the operators confirm the diagnosis of the event and, if properly diagnosed, the SBO procedure is initiated. It is one of the event oriented procedures that recover the essential safety functions more effectively than symptom oriented procedure. If operators cannot diagnose the specific event, functional recovery guideline, especially the RCS heat removal procedure, is performed. The two procedures commonly provide the operator action for recovery of RCS heat removal safety function shown below.
The primary operator action is to recover the AAC power. If it is not successful, core cooling using safety injection tank (SIT) is applicable when RCS depressurization is achieved because APR1400 Safety Injection Pump (SIP) is an active system and needs electricity to activate. So, the operator should perform the RCS and core heat removal using the TD-AFWP and SG Atmospheric Dump Valve (ADV) to cool the RCS via heat transfer to the SG. The TD-AFW flow control valve is powered by a DC battery, and its design capacity is about 8 hrs. If existing electric power is not recovered until battery exhaustion time, there are no further means to cool the RCS. Then, eventually, a core boil-off occurs. When the core exit temperature reaches 922 K (1200 F), SAMG is initiated (Figures 6 and 10).
In SAMG, the operator performs once again the recovery action of the existing electric power or portable external power. This step is a continuously applicable step. Therefore, at the same time, the operator should monitor the 7 major safety functions sequentially and perform corresponding mitigation measures when certain safety functions are challenged. SBO related mitigation measures are mitigation-1 (depressurizes the RCS), mitigation-2 (injection into the SG), and mitigation-3 (injection into the RCS). The schematic flowchart of the procedures is summarized in Figure 1. The right two columns are the revised procedure to reflect the external injection strategy.
2.2. Design Characteristics to Cope with Extended SBO
To cope with a SBO, the APR1400 is equipped with an AAC power supply with a capacity of at least 2~3 days. Also, an auxiliary charging pump is installed parallel to the existing charging pumps to provide seal injection water to the four RCPs to prevent the leakage of coolant through the RCP seals. DC power from the battery provides a reliable source of power for safety related control and monitoring equipment for at least 8 hrs.
In addition, post-Fukushima action items including the provision of an external injection system are recently reflected. The RCS external injection flow path is installed at the discharge of the existing Emergency Core Cooling (ECC) pump. SG injection flow paths are also installed along the discharge line of the AFW pump. A total of three commercial external pumps are on standby condition in each unit, one for RCS injection and two for each SG injection. Several water sources in site boundary that are available can be used, such as a raw water tank, two condensate water tanks, and two AFW tanks. Detailed SG external injection flow paths are shown in Figure 2.
3. Numerical Model
Extended SBO analyses on APR1400 are performed using the MAAP severe accident computer code. The MAAP code can analyze severe accidents following large and small break Loss of Coolant Accidents (LOCAs), SBO, and various general transients. Developed for the Electric Power Research Institute (EPRI) by Fauske et al., MAAP4.0.7 is used here. The MAAP4 code can perform integral analyses of reactor system and containment behaviors including core heatup, degradation, relocation, reactor vessel failure, containment failure, and fission product behaviors [15]. MAAP4 has simplified thermohydraulic model and solved first order differential equations for conservation of mass and energy. However, it produces reasonable prediction capabilities comparable to MELCOR and SCDAP [16]. MAAP4 is widely used in Korea in severe accident analysis and level 2 PSA for APR1400 design [17, 18].
A noding diagram for APR1400 is shown in Figure 3. RCS are divided into 14 nodes based on generalized models of PWRs, in which the type and number of components and the geometry are predetermined. RCS system consists of two primary loops; each one consists of one SG, one hot leg, and two RCPs and cold legs. Also, four Pilot Operated Safety and Relief Valves (POSRVs) located on the top of the pressurizer are modeled. Each of the POSRVs has two valves in serial that perform spring loaded safety depressurization function and motor operated steam relief function. Secondary system consists of SG, main feedwater pumps, auxiliary feedwater pump, main steam line, main steam isolation valve (MSIV), 20 main steam safety valves (MSSV), and 4 ADV located upstream of the MSIV. The containment is divided into 14 nodes.
(a) RCS noding diagram
(b) Containment noding diagram
In-containment refueling water storage tank (IRWST), one of the advanced design features in APR1400, is modeled as one of the containment nodes as shown in Figure 3. The flow paths from IRWST to suction of safety injection and containment spray pump and return flow path of the discharged coolant from containment spray and/or break flow to the IRWST are modeled. Direct vessel injection flow path is connected to the reactor vessel upper downcomer to incorporate into APR1400 SIS design. However, in-vessel retention (IVR) strategy, one of the representative severe accident mitigation strategies in APR1400, is not considered in this analysis because ex-reactor vessel cooling is not applicable when reactor cavity is in dry condition in SBO sequences.
External primary injection flow path is located at discharge line of SIS piping. Injection flow rate is calculated based on the existing commercial portable pump performance curve and the flow path pressure drop calculation from the external pump to the RCS injection point. External secondary injection flow path is located at discharge line of AFW piping and injection flow rate is also implemented similarly as mentioned above.
The RCP seal leakage flow rate is considered as 1.325 liter/s, most probable flow rate, for each RCP in this calculation [19]. Initial and boundary condition for this calculation is summarized in Table 2.
4. Results and Discussion
4.1. Base Case
In this section, the effectiveness of the TD-AFWP operation is analyzed. When a SBO with concurrent failure of AAC occurs, a reactor and turbine trip is initiated. All active systems including emergency core cooling system, shutdown cooling system, and motor driven auxiliary feedwater system become inoperable. Then, the SG pressure rapidly increases to the MSSV opening set-point and releases steam to the environment periodically to maintain secondary pressure boundary integrity. RCS single phase natural circulation is established through the SG heat removal. However, the SG water source is not provided; the SG level is continuously decreased. At this time, the operator initiates an EOP and tries to restore the proper actuation of the TD-AFWP based on SBO procedures. This operator action is assumed 30 min after the initiating event in this calculation.
If this action is not successful, the SG inventory is depleted at 1.3 hrs. Then, the RCS pressure reincreases and POSRVs start to open. The RCS inventory is continuously discharged into the containment and core starts to uncover at 1.9 hrs. At this time, hot leg counter current natural circulation is established. Superheated steam from the vessel flows into the SG hot side plenum through the upper part of the hot leg and excessive heatup of heat structure occurs. There is some mixing of the superheated steam in the SG hot side plenum, and some of the relatively low temperature steam returns to the core through lower part of the hot leg. So, there is circumferential temperature stratification in hot leg piping and it could lead to creep rupture. This phenomenon is reflected based on Larson Miller creep rupture failure model in MAAP4. This counter current natural circulation is maintained up to 3.2 hrs until core level is completely depleted. During this time, core degradation and melting occur in the RCS. Eventually, the RCS fails due to the failure of the incore instrument tube caused by molten corium relocation to the lower head at 3.7 hrs. Because high pressure is maintained before RCS fails, a large amount of superheated steam and hydrogen is discharged into containment after RCS fails. Also, interaction between molten core material and cavity water that is discharged from SIT leads to large amount of steam generation in the cavity. So, the containment pressure rapidly increased. Also, hydrogen and noncondensable gas are steadily generated by molten core concrete interaction in the base-mat.
On the other hand, if TD-AFWP actuation is successful, the SG water inventory is recovered before it is depleted and RCS heat removal is reestablished until the battery is exhausted at 8.5 hrs. During this period, the RCS pressure continuously decreases to 8.5 MPa, slightly above the SG pressure, due to heat transfer to the secondary system as shown in Figure 4. TD-AFW flow rate is ~15 kg/s until SG reaches its normal water level. And flow rate continuously decreases as the decay heat level decreases. This condition is maintained if the TD-AFW flow is provided. However, if the operator action to recover the existing electric power is not successful until the battery exhaustion time, the TD-AFW flow rate is terminated. Then, the core starts to boil off after SG inventory dries out as shown in Figure 5. Eventually, the RCS inventory is also depleted and CET reaches 922 K at 12.6 hrs. The operator initiates SAMG, but no mitigation measures are available if the restoration of existing electric power is not successful. Then, the RCS lower head fails at 15.0 hrs.
This calculation shows that TD-AFW could effectively cool down the RCS until the battery is exhausted and provide approximately 11 hrs of additional time to avoid core uncovering if TD-AFW initiation operator action is successful.
To verify the sensitivity on injection duration, 72 hrs of TD-AFW operational case is analyzed. Results show that the stable core cooling is maintained until the 72 hrs. These results show that the extension of battery capacity to 72 hrs can be an effective way to implement an extended SBO coping time of 72 hrs if TD-AFW operability is maintained. The major sequences of events are summarized in Table 3.
4.2. Effectiveness of External Secondary Injection Operator Action
In this section, the effectiveness of an external injection strategy into the SG is examined. The event scenario before the SAMG entry condition is identical to those of previous section. When the CET reaches 922 K, the operator should transfer the procedure from EOP to SAMG. In SAMG, after a technical support center is established, the primary operator action is to recover the existing electric power or prepare the external power generator in site boundary. If the external power generator is active, it provides electric power to essential instrumentation and control valves, including the main control room, the SG level and pressure indicators, containment pressure instrumentation, and the RCS and SG depressurization valves.
Then, SAMG mitigation-2 procedure for a secondary injection initiates. Detailed actions are depressurizing the SG pressure below the pump shutoff head by opening main steam line ADV in each SG. This action is performed manually if external electric power is not available. Then, water is injected into the SG using an external pump. This operator action time is assumed as 30 min. As shown in Figure 7, the SG pressure rapidly decreases when the ADV is fully opened. Then, the SG water level is recovered continuously as shown in Figure 8. At this time, a RCS natural circulation flow path is formed and the RCS is cooled down and pressure decreases. When RCS pressure reaches the Safety Injection Tank (SIT) actuation set-point of 4.0 MPa, the RCS water level is recovered rapidly. The external injection flow rate of each loop is 10 kg/s~15 kg/s initially and decreases to 5 kg/s when SG level is fully recovered by operator action to prevent SG overfilling. Then, the external injection and ADV flow rate are balanced and maintain a stable condition as shown in Figure 9. This flow rate is compatible to removal of decay heat generated in the core. The maximum core exit temperature decreases after 1500 K peak and the core integrity is maintained. The fraction of clad reacted in vessel is within 1% of total amount of clad as summarized in Table 4. Figure 11 shows the integrated water inventory required for 72 hrs of injection to the SG. Approximately, 2500 tons of cooling water is required. The total water inventories of two AFW tanks and CST tanks are 4,000 ton and 1,700 ton, respectively. So, the cooling water source is sufficient to provide up to 72 hrs.
These calculation results show that the external injection into the SG is an effective procedure to mitigate an extended SBO scenario when this is successfully performed within 30 min after SAMG initiation. Moreover, this strategy can be undertaken without a portable power generator because SG depressurization can be performed by an operator manually.
4.3. Effectiveness of External Primary Injection Operator Action
In this section, the effectiveness of an external injection strategy into the RCS is examined. The event scenario is identical to that in previous section except that the external injection location is the RCS. To inject water into the RCS, SAMG mitigation-1 (RCS depressurization) is prerequisite because external injection pump shutoff head is relatively low. To depressurize the RCS, the preparation of an external power generator is essentially required because the POSRV cannot be opened manually due to the unaccessibility to the inside of the containment. If a portable power generator is in place, the operator opens two out of four POSRVs 30 min after the SAMG entry condition because a portable power generator can provide only one of two electric trains. Then, SAMG mitigation-3 (Injection into RCS) initiates. The RCS pressure trend is shown in Figure 12. After the POSRVs are opened, the RCS pressure reaches the SIT injection set point and the SIT water starts to flow into the core. Then, a large amount of steam and hydrogen is generated in the core due to the direct contact cooling between SIT water and core materials. Due to limited depressurization capacity of POSRV, RCS pressure spikes continuously occur and do not sufficiently decrease to external injection pump shutoff head pressure. As a result, the RCS injection strategy is not successful in this case.
For a sensitivity on depressurization capacity, 4 POSRV opening cases are analyzed. As shown in Figure 13, 4 POSRV cases sufficiently depressurize the RCS. Primary injection is successful and RCS cool-down is completed.
The calculation results show that an external injection into the RCS is only effective when the RCS depressurization capacity is sufficiently provided in case of high pressure severe accident scenarios.
5. Conclusions
After the Fukushima Dai-ichi nuclear power plant accident, mitigation measures against extended SBO sequences were investigated in Korea. Therefore, the overall extended SBO coping capability of the APR1400 is examined to assess the effectiveness of an external water injection strategy.
The following are the conclusions:(i)SBO without operator action leads to a core damage at 2.0 hrs and Rx failure at 3.7 hrs in APR1400;(ii)a TD-AFW can effectively cool down the RCS and provide approximately 12 hrs of additional time for the operator to recover the existing electric power to prevent core damage;(iii)extension of battery capacity can be an effective way to implement an extended SBO coping time of 72 hrs;(iv)an external injection strategy into SG using commercial pump is an effective strategy to mitigate an extended SBO scenario when it is successfully prepared within 30 min after SAMG initiation;(v)an external injection into RCS using commercial pump is only effective when RCS depressurization capacity is sufficiently provided in case of high pressure severe accident scenarios.
Based on the above results, the technical basis on external injection strategy will be implemented on development of optimal revised severe accident management procedure.
Abbreviations
| AAC: | Alternative AC |
| ADV: | Atmospheric dump valve |
| AFW: | Auxiliary feedwater |
| CET: | Core exit temperature |
| CST: | Condensate storage ank |
| ECC: | Emergency core cooling |
| EDG: | Emergency diesel generator |
| EOP: | Emergency operational procedure |
| IRWST: | In-containment refueling water storage tank |
| LOCA: | Loss of coolant accident |
| MAAP: | Modular accident analysis package |
| MSIV: | Main steam isolation valve |
| POSRV: | Pilot operated safety and relief valve |
| PSA: | Probabilistic safety assessment |
| RCP: | Reactor coolant pump |
| RPS: | Reactor protection system |
| SAMG: | Severe accident analysis guideline |
| SBO: | Station blackout |
| SIS: | Safety injection system |
| SIT: | Safety injection tank |
| SFP: | Spent fuel pool |
| TD-AF: | Turbine driven auxiliary feedwater |
| RCS: | Reactor Coolant System. |
Conflict of Interests
The authors declare that there is no conflict of interests regarding the publication of this paper.