Abstract
RELAP5/SCDAPSIM and MAAP4 are two widely used severe accident computer codes for the integral analysis of the core and the reactor pressure vessel behaviour following the core degradation. The objective of the paper is the comparison of code results obtained by application of different modelling options and the evaluation of influence of thermal hydraulic behaviour of the plant on core damage progression. The analysed transient was postulated station blackout in NPP Krško with a leakage from reactor coolant pump seals. Two groups of calculations were performed where each group had a different break area and, thus, a different leakage rate. Analyses have shown that MAAP4 results were more sensitive to varying thermal hydraulic conditions in the primary system. User-defined parameters had to be carefully selected when the MAAP4 model was developed, in contrast to the RELAP5/SCDAPSIM model where those parameters did not have any significant impact on final results.
1. Introduction
RELAP5/SCDAPSIM and MAAP4 codes are severe accident (SA) analysis codes capable of modelling all important SA phenomena (reactor coolant system response, core material chemical reactions, oxidation, ballooning and rupture of the fuel rod cladding, core heat-up, degradation and relocation to the lower plenum, etc.). The main difference between them is that RELAP5/SCDAPSIM can only model the in-vessel phase of the SA, while MAAP4 is capable to calculate processes in the containment following the release of water, noncondensable gases, and corium from the primary circuit.
RELAP5/SCDAPSIM code [1], designed to predict behaviour of reactor systems during normal and accident conditions, is being developed at Innovative Systems Software (ISS) as part of the international SCDAP Development and Training Program (SDTP). RELAP5/SCDAPSIM uses the publicly available SCDAP/RELAP5 models developed by the US Nuclear Regulatory Commission in combination with proprietary: (a) advanced programming and numerical methods, (b) user options, and (c) models developed by ISS and other members of the SDTP. The code is a combination of RELAP5 code for thermal hydraulics calculation, SCDAP code for severe accident related phenomena, and COUPLE code for a finite element treatment of the reactor pressure vessel (RPV) lower head.
MAAP4 code is an integral system analysis code for assessing severe accidents in light water reactors (LWRs) following large and small break loss of coolant accidents (LOCAs) and transients. The code was developed for Electric Power Research Institute (EPRI) by Fauske and Associates, Inc. [2]. MAAP4 employs simple models for BWRs and PWRs in which the type and number of components and the geometry are predetermined. The user inputs various parameters for each component such as volumes or masses.
MAAP4 version used herein was MAAP4.0.5.
RELAP5/SCDAPSIM is characterized by its detailed, mechanistic models of severe accident phenomena; however, the calculations can be rather time-consuming. RELAP5/SCDAPSIM typically uses on the order of hundreds of hydrodynamic components to model the primary system. MAAP4 calculations require minimal computation time with simplified geometry models.
Regarding the thermal hydraulic model, RELAP5/SCDAPSIM employs detailed RELAP5/Mod3 nonequilibrium, nonhomogenous, six-equation representation of single and two-phase flows. The presence of boron and noncondensable gases is also simulated using separate equations for each. The robust RELAP5 modelling is clearly superior to the thermal hydraulic model of MAAP4 code. MAAP4 utilizes simplified but fast-running models for thermal hydraulics description using a fixed nodalization of the primary circuit. MAAP4 solves a set of lumped parameter, first-order differential equations for conservation of mass and energy. Differential equations for momentum conservation are not employed because MAAP4 considers momentum balances to be quasisteady which reduces the momentum equations to algebraic equations [3].
The objective of the paper was to evaluate influence of thermal hydraulic conditions on core damage progression and to compare code results by applying different modelling options. The intention was not general validation of codes but the examination of code results for the same specific transient by using qualified input models. The analysed transient was station blackout in NPP Krško with a leakage from reactor coolant pump seals. Two groups of calculations were performed where each group had a different break area. Break flow areas differed by a factor of two. Thereby, a study of influence of coolant discharge rate from the primary system on the core heat-up and melting propagation was possible to be carried out.
2. Code Models for NPP Krško
2.1. RELAP5/SCDAPSIM Model
The RELAP5/SCDAPSIM model of NPP Krško (NEK) was based on the RELAP5/Mod3.3 model [4] and qualified at the steady-state level [5]. That model has been used for many years now at FER (Faculty of Electrical Engineering and Computing), Zagreb, for accident analyses of plant behaviour following large spectrum of initializing events in all modes of operation. NEK RELAP5/Mod3.3 nodalization scheme is shown in Figure 1. Such detailed nodalization was not based solely on the plant geometrical data but it also took into account operating conditions of the plant systems.
For the purpose of simulation of core melt progression, core fuel assemblies were divided in five regions by grouping similarly powered fuel assemblies together; see Figure 2. Furthermore, to apply correct thermal hydraulic boundary conditions for the fuel rods, five thermal hydraulic channels were modelled in a manner that each group of fuel assemblies was put in a separate hydraulic channel.
When a portion of the core has melted, it may occupy completely the flow channel and therefore block the coolant flow in the axial direction. The flow will be then diverted in the radial direction. To enable the coolant to flow also in the radial direction, hydraulic channels in the core were interconnected radially by crossflow junctions.
2.2. MAAP4 Model
The NEK MAAP4 model [6] was used for the development of NEK Severe Accident Management Guidelines (SAMG) and Krško Full Scope Simulator (KFSS) which simulates various severe accident sequences. Krško SAMGs have been developed based on the Krško IPE (Individual Plant Examination) insights, generic WOG SAMGs [7], and plant specific documents [8–10]. MAAP4 code has been used in Krško IPE to determine success criteria for accident sequences.
As already mentioned MAAP4 uses fixed and coarse nodalization that enables fast code execution. Primary system is represented by six water pools and 19 heat sinks. The core is divided into seven concentric radial rings and 13 axial rows. The active fuel region is represented by ten rows; the core support plate, the lower tie plate, and the lower gas plenum are represented by two bottom rows, and the upper tie plate and the upper gas plenum are represented by the top axial row.
All deterministic thermal hydraulic analyses within the NEK IPE project were performed by MAAP3B, Ver. 18 [11]. Since then (end of 1994) that analysis tool has been further improved and new versions have been issued. The version MAAP4.0.5 was used in the presented analyses. MAAP3B was revised to include major model improvements in areas of the core heat-up, lower plenum phenomenology, corium-concrete interactions, containment and auxiliary building thermal hydraulics, and hydrogen combustion. Furthermore, new models were added to characterize actions that could stop the accident, that is, the in-vessel and the ex-vessel cooling. The mathematical solution techniques were implemented to maintain a quick-running code suitable for extensive accident screening and parameter sensitivity applications. As a part of the development, the code underwent a complete design review.
3. Analysis and Results
3.1. Description of the Scenario
The analyzed accident was station blackout (SBO) with a leakage from the reactor coolant system (RCS) through reactor coolant pump (RCP) seals following their degradation. It was assumed that off-site and on-site (emergency diesel generators) AC power was unavailable. Therefore, the primary system coolant inventory was decreasing due to the unavailability of the high-pressure (HPSI) and the low-pressure safety injection (LPSI) flow. Water was injected only from the accumulators because their operation did not depend on the availability of electrical power. Steam generators (SGs) acted as a heat sink since the turbine driven auxiliary feedwater (TD AFW) pump delivered water to SGs. TD AFW flow was controlled in a manner to maintain the SG narrow range level between 10% and 50%. Those values were in compliance with ECA-0.0 “Loss of all AC power’’ procedure [12].
Two groups of calculations were performed (Table 1) where each group had a different break area and, thus, a different leakage rate from the RCS. For the first group, the break area was taken from the WOG 2000 RCP seal leakage model [13]. In WOG 2000 model, series of discharge rates with their respective probabilities were defined. For the presented case, the scenario with the highest leakage rate was chosen: the break area was 10-5 m2 for the first 780 seconds and it increased afterwards to m2. For the second group, the break area was two times higher ( m2) but it remained constant throughout the transient. The reason for performing calculations with different break flow areas was to check the influence of thermal hydraulic conditions on accident progression. The smaller break area meant slower depressurization of the RCS and later actuation of the accumulators, thus, the earlier core dryout. The larger break area meant an earlier loss of RCS coolant which would force accumulators’ actuation in the earlier phase of the accident. The specific differences between those two cases will be discussed in separate sections.
3.2. Modelling of the Hot Leg Natural Circulation
After the hot legs have been voided and prior to the loop seal clearing, a countercurrent natural circulation between the reactor vessel, hot legs, and steam generator U-tubes may develop [14]. Superheated vapour enters the top of the hot leg displacing saturated vapour, which then flows back to the reactor vessel along the bottom of the hot leg. When hotter vapour enters the steam generator inlet plenum, it will rise toward the steam generator U-tubes. Vapour enters some of the tubes, displacing cooler steam that was in the tubes. Displaced vapour enters the outlet plenum, then reenters other steam generator tubes, forcing vapour into the inlet plenum. A density gradient is thus established between the tubes which supports the natural circulation. Once the loop seals have cleared, the natural circulation will be terminated.
Hot leg countercurrent flow can affect the structural integrity of the RCS piping. Heating of the pipes and steam generator tubes may lead to melting and creep rupture failure of those components.
Hot leg natural circulation model is an integral part of the MAAP4 code and no specific rearrangement of the input deck is needed to invoke that model. On the other hand, to allow the hot leg countercurrent flow in the RELAP5/SCDAPSIM code, the primary system should be renodalized in a manner to split the hot legs and U-tubes as shown in Figure 3. In addition, the loss coefficients need to be adjusted to correctly simulate mixing in the SG inlet plenum. Preliminary calculations with the new model did not reveal any increase of the creep failure probability of the RCS piping, contrary to the findings of MAAP4 calculations. In the accident with a high leakage rate from the RCS, the loop seals will clear early during the transient; so the impact of the hot leg natural circulation will not be so significant. Nevertheless, in MAAP4 calculations the hot leg pipe creep failure did occur; so this phenomenon cannot be ruled out. MAAP4 predicted high RCS piping temperatures (1300 K) which were the direct cause for the pipe failure. RELAP5/SCDAPSIM piping temperatures were lower (650 K), and so the pipes remained intact.
Taking this into account, two different MAAP4 calculations were performed, one with the hot leg creep failure and one without it. That was necessary in order to make correct comparison between the two codes.
3.3. Group 1 Cases
3.3.1. MAAP4 Calculation
Two MAAP4 calculations were performed: one that takes into account and the other that does not take into account the creep rupture of the hot leg piping. Those two calculations were performed to examine the influence of the hot leg piping failure on the core damage progression and to make a comparison with RELAP5/SCDAPSIM results. Namely, contrary to MAAP4 calculation, RELAP5/SCDAPSIM did not calculate the creep failure of the hot leg; so to compare correctly the two codes, the creep failure had to be turned off in the MAAP4 calculation.
Hot leg creep failure at 10300 seconds caused primary system pressure to decrease rapidly (Figure 4). When pressure dropped to 5 MPa, accumulators started to inject water in the RCS. In the case of no hot leg creep failure, accumulators gradually injected water in small intervals because the primary system depressurized at a slower rate. More water was injected in the core when the hot leg failed because all water inventory from the accumulators was discharged into the RCS. Collapsed water level in the RPV is shown in Figure 5. After the breach of the hot leg, water level increased instantly providing higher rate of heat removal from the core and its supporting structures.
Figure 6 shows the core maximum temperature for the two cases. The core started to melt in the center and later the process of melting progressed toward the core baffle. Once the core baffle failed, corium slumped through the bypass region between the core baffle and the core barrel in the RPV lower head. In the case with no hot leg creep rupture the core baffle failed at 11500 seconds, and when the hot leg rupture was taken into account the baffle failed at 16700 seconds. Accordingly, the RPV wall failed later in the second case.
Although the hot leg failure did not have almost any influence on the maximum core temperature, the structures at the core periphery for the case with the creep failure were much better cooled, their temperatures were lower, and so the core baffle failed later.
3.3.2. Comparison between MAAP4 and RELAP5/SCDAPSIM Calculation
Figures 7–10 show different variables as calculated by the two codes. MAAP4 calculation did not take into account the possibility of the hot leg creep rupture in order to be consistent with RELAP5/SCDAPSIM calculation.
A good agreement in the primary system pressure (Figure 7) prior to accumulator actuation between the two codes is apparent which meant that both codes calculated the same rate of coolant discharge from the RCS. Boiling of water injected from the accumulators caused significant increase of pressure as calculated by RELAP5/SCDAPSIM. That pressure increase terminated further water injections for the next 3000 s and left the core dry. MAAP4 calculation did not show such behaviour of the RCS. Pressure slightly oscillated around 4 MPa, accumulators were more or less active all the time, and the bottom part of the core was covered as long as water was injected into the reactor vessel (Figure 8).
Core maximum temperature (Figure 9) was also pretty well reproduced. A larger discrepancy was observed in the hydrogen production rate, although final amount of produced hydrogen differed by less than 10% (Figure 10). Most of hydrogen was produced in the period of initial core dryout (8000 s–9000 s) which was well reproduced by both codes.
Composition of molten material in the RPV lower head shortly after the baffle failure and material relocation
is shown in Table 2.
Time of the core baffle failure and the RPV failure is shown in Table 3.
Following the core baffle failure, all molten material from the core slumped to the lower head as calculated by RELAP5/SCDAPSIM. MAAP4 did not predict any major slumping until after the stoppage of water injection at 16500 seconds. Throughout that period integrity of core support structures and the crust surrounding molten corium was maintained by continuous water/steam flow. Therefore, only small amount of material was relocated to the lower head after the initial breach of corium through the core baffle. In the initial melting phase, there was more ZrO2 melted than UO2 because ZrO2 has lower melting temperature; so more ZrO2 slumped to the lower head. As the degradation process continued, mass of molten UO2 became higher than mass of molten ZrO2 due to its larger core inventory.
RELAP5/SCDAPSIM calculated earlier core degradation than MAAP4 code. The reason for that discrepancy was the difference in prediction of thermal hydraulic behaviour of the primary system as it had been already discussed. Another reason was the way how codes handle the core degradation process. RELAP5/SCDAPSIM uses very detailed models based on phase diagrams to calculate temperature and quantity of reacted materials. MAAP4 uses more general models of conservation of mass and energy for different materials and structures whose results depend strongly on selection of user-defined parameters.
RPV lower plenum temperature distribution was calculated using on one hand the COUPLE code, a two-dimensional, finite element heat conduction code incorporated in the RELAP5/SCDAPSIM code and, on the other hand, a much simpler MAAP4 RPV lower head model. The COUPLE model of the NEK lower head is shown in Figure 11.
Time of the RPV failure was evaluated using Larson-Miller parameter model [15] for the creep rupture which is incorporated in both codes. It can be seen from Table 3 that the timing of the RPV wall failure differed in order of magnitude for the two codes. The reason was the difference in the application of the creep rupture model [16]. The creep rupture in RELAP5/SCDAPSIM was calculated using the average wall temperature, while in MAAP4 the creep damage term was evaluated at each temperature node. Each of these two approaches had its advantages and disadvantages, but in the scope of the presented analysis, it was not so essential to correctly calculate time of the RPV failure. It was more important to give the answer to the question: “will the RPV resist molten corium attack or not?’’ Since in the analyzed case no SI was available and no cavity flooding was provided, RPV finally failed opening a path for fission products to escape into the containment.
3.4. Group 2 Cases
3.4.1. MAAP4 Calculation
Similar to Group 1 cases, two MAAP4 calculations were performed: one that takes into account the creep rupture and the other that does not take into account the creep rupture of the hot leg piping.
Hot leg failed due to creep at 5200 seconds, 5000 seconds earlier than in the case with a smaller break. Accumulators were actuated prior to the hot leg failure and continuously injected water afterwards. Hot leg break caused primary system pressure to decrease rapidly (Figure 12). The consequence was that accumulators drained out almost immediately. In the short term that was positive because injection of a large amount of water forced the core temperature to decrease. On the other hand, in the longer term, there was no more water available for core quenching once the temperature increased again. In the case of no hot leg creep failure, accumulators gradually injected water, but contrary to the calculation with the smaller break area, they injected more water which was enough to prevent the core temperature to increase above the UO2 – ZrO2 eutectic temperature for more than seven hours. The higher water injection rate was due to the larger pressure drop in the RCS.
Looking at Figures 13 and 14, it can be seen that continuous water injection from the safety systems at a high rate is enough to keep the core covered and its temperature at a low value although there is a large break on the RCS piping.
For the reasons explained above, in the case with no hot leg creep rupture, the core baffle failed at 29000 seconds and when the hot leg rupture was taken into account, the baffle failed at 13100 seconds. Although the analyzed transients were not representative for the real plant situations, they showed that thermal hydraulic phenomena dictate the SA progression. Correct thermal hydraulic modelling of the plant systems is therefore essential for an SA simulation, especially in the longer term.
3.4.2. Comparison between MAAP4 and RELAP5/SCDAPSIM Calculation
Comparing to the case with the smaller break area, discrepancy between the results was more pronounced. Whereas the calculated RCS pressure (Figure 15) was similar for the two codes, the water level in the reactor vessel (Figure 16), the core maximum temperature (Figure 17) and produced hydrogen (Figure 18) varied significantly.
The core dried out in approximately one hour (Figure 16). At the same time, RCS pressure dropped to 5 MPa and the accumulators started to operate. RELAP5/SCDAPSIM predicted that the core was quenched for the next 3000 seconds. Injection of water in the hot core at 6800 seconds resulted in the high oxidation rate and the immediate jump in the temperature (Figure 17). MAAP4 results show that the first time when the accumulators were actuated, the core was immediately overheated due to oxidation (Figures 17 and 18). It is interesting to notice that all hydrogen was produced during that period as calculated by MAAP4, while RELAP5/SCDAPSIM predicted release of hydrogen any time when there was water injected into the core.
As calculated by MAAP4, energy released during oxidation accumulated mostly in the core material and, therefore, the core temperature rose swiftly. Amount of the oxidation energy transferred to fluid was very small compared to total released energy; thus, it did not affect the RCS pressure (Figure 15). After the oxidation escalation and increase of the core temperature to more than 3000 K, MAAP4 calculated successful quenching of the core. Decrease of temperature prevented any significant core damage. On the other hand, when the core temperature reached 2800 K in the RELAP5/SCDAPSIM calculation, no quenching onward was possible. The core started to melt and the process of core degradation proceeded rapidly with no possibility for stopping it.
The heat released due to oxidation in MAAP4 calculation in the short period when the accumulators were turned on was later successfully removed. RELAP5/SCDAPSIM calculated that the energy accumulated in the fuel due to oxidation was too high to be removed by water injected from the accumulators only. The emergency core cooling system (ECCS) is therefore necessary to be operable in order to prevent core damage when looking the RELAP5/SCDAPSIM results. On contrary, MAAP4 results indicate that water from the accumulators is enough to cool the core and that SI pumps are not needed in the early phase of an accident.
Composition of molten material in the RPV lower head shortly after the baffle failure and material relocation is shown in Table 4.
Time of the core baffle failure and the RPV failure is shown in Table 5.
Results in those two tables are reasonable taking into account previous discussion. There is a difference in MAAP4 results comparing to the case with a smaller break. In that former case MAAP4 predicted that only a few hundred kilograms of molten material would relocate to the lower head. Now, when the baffle failed, more than 60% of the total core inventory was removed from the core. The reason was that there was no more water injected to the vessel at 29000 seconds when the slumping began. The integrity of core support structures and the crust surrounding molten corium could not be maintained by flow of water.
Figure 19 shows the temperature of the RPV lower head wall after molten material slumped to the lower plenum. MAAP4 predicted that temperature would rise at a much higher rate than RELAP5/SCDAPSIM. In order to check those findings, an additional calculation was made by using commercial FEM code ANSYS. The results were similar to RELAP5/SCDAPSIM results. That is not so unusual since RELAP5/SCDAPSIM uses FEM model as well to simulate lower head thermal response. Correct temperature distribution through the RPV wall is essential when performing detailed structural analyses. Present FEM codes allow such 3D analyses and RELAP5/SCDAPSIM results could be used as boundary conditions for those calculations.
There are many reasons for large differences in the results of the two codes. First of all, models included in codes are different: not only thermal hydraulic models but also models that simulate core damage progression. RELAP5/SCDAPSIM is a mechanistic code, while MAAP4 is a parametric code that uses more phenomenological models. The analyzed transient was quite demanding and necessitated careful preparation of the input data and initial and boundary conditions. Due to those reasons, the uncertainties of the input data were not taken into account because the differences between code predictions could not be covered by the uncertainties only.
3.5. Influence of User-Selected Parameters
Severe accident codes generally use a large set of user-defined parameters to cover uncertainties in the analytical description of SA processes. MAAP4 code is regarded as a parametric code because its results rely on proper selection of many of parameters describing phenomena starting from an early stage of core degradation to the late stage of containment fission products behaviour. RELAP5/SCDAPSIM code utilizes more mechanistic models and user-defined parameters are primarily used in sensitivity calculations.
There are a large variety of user-defined parameters in MAAP4 code which significantly influence the results. For example, there is a set of parameters used in modelling the failure of the oxide shell on the outside cladding surface. By changing values of some of those parameters, the melt progression inside the core could be altered. Another set of input data that was tested was the set of parameters used in simulation of debris jet interaction with the water pool in the lower plenum. That set of data had a big impact on thermal behaviour of the wall of the RPV lower head. The last issue that was tested was the stratification of molten material in the lower head. Surprisingly, whatever corium configuration was chosen ((1) oxidic melt + metallic melt + particulate debris, (2) mixed melt + particulate debris, (3) mixed melt without any solid debris), there was almost no influence on RPV wall temperatures. Thus, in the case of stratification of molten material, no heat focussing effect by the molten metal layer was calculated to occur.
Influence of few RELAP5/SCDAPSIM parameters was also tested, and it was found that their influence on core degradation kinetics and the timing of the lower head failure was negligible. Nevertheless, the user influence on RELAP5/SCDAPSIM results cannot be ruled out because correct modelling requires a qualified and experienced user with the good knowledge of plant systems and their interconnections.
4. Conclusion
Capabilities of RELAP5/SCDAPSIM and MAAP4 codes in simulating in-core severe accident progression were compared, focussing on influence of thermal hydraulics and selection of user-defined parameters. The input decks for both codes were prepared taking into account the actual geometric and operational data of NPP Krško making them qualified for a comprehensive and systematic analysis.
The correct prediction of RCS thermal hydraulic behaviour is important for the later SA progression. Oxidation rate and removal of heat from the core are dictated by the availability of coolant; thus, production of hydrogen and core heat-up and degradation depend primarily on RCS thermal hydraulics. Calculations have shown that MAAP4 results are more sensitive to variations of the RCS pressure and the coolant discharge rate from the break. Increase of the break area substantially affected the timing of both core melt process and the failure of the RPV lower head. RELAP5/SCDAPSIM, on contrary, regardless the size of the break area, predicted RPV damage almost at the same time, meaning that in the case of a large break, whatever the size of the break actually was, the core would lose its geometry early during the transient unless mitigation measures are undertaken before.
A number of user-defined parameters, especially in MAAP4 code, have to be entered during preparation of an input deck. While in RELAP5/SCDAPSIM code those parameters are used only in sensitivity calculations, in MAAP4 code their selection could significantly alter the results. The solution is to use values of the parameters recommended by MAAP4 developers or ones which are experimentally measured and confirmed.
The comparison between the codes showed not only some similar trends but also large disagreements in the obtained results. Code validation against plant and experimental data is therefore a necessary tool in testing code’s accuracy. Nevertheless, both codes showed capability of modelling complex interactions between core materials and overall core behaviour during harsh severe accident conditions.