Table of Contents Author Guidelines Submit a Manuscript
Science and Technology of Nuclear Installations

Volume 2014, Article ID 980418, 10 pages
Research Article

Extended Station Blackout Coping Capabilities of APR1400

Korea Hydro and Nuclear Power, Central Research Institute, 70 Gil, Yuseong-Daero 1312, Yuseong-Gu, Daejeon 305-343, Republic of Korea

Received 17 January 2014; Revised 16 April 2014; Accepted 29 April 2014; Published 25 May 2014

Academic Editor: Enrico Zio

Copyright © 2014 Sang-Won Lee et al. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.


The Fukushima Dai-ichi nuclear power plant accident shows that an extreme natural disaster can prevent the proper restoration of electric power for several days, so-called extended SBO. In Korea, the government and industry performed comprehensive special safety inspections on all domestic nuclear power plants against beyond design bases external events. One of the safety improvement action items related to the extended SBO is installation of external water injection provision and equipment to RCS and SG. In this paper, the extended SBO coping capability of APR1400 is examined using MAAP4 to assess the effectiveness of the external water injection strategy. Results show that an external injection into SG is applicable to mitigate an extended SBO scenario. However, an external injection into RCS is only effective when RCS depressurization capacity is sufficiently provided in case of high pressure scenarios. Based on the above results, the technical basis of external injection strategy will be reflected on development of revised severe accident management guideline.

1. Introduction

One of the representative accidents related to the electric power in nuclear power plants is a Station Blackout (SBO). SBO is initiated by a loss of all offsite power with a concurrent failure of both Emergency Diesel Generators (EDGs). With no Alternate Current (AC) power source, most of the active safety systems that perform safety functions are not available. To prevent SBO scenarios from becoming worse, nonsafety class Alternative AC (AAC) power is installed as a redundancy to provide electricity to the essential equipment that perform safety function [1, 2]. However, if the AAC is also unavailable, only active equipment that are powered by Direct Current (DC) from station batteries or passive systems could work. Normally, Turbine-Driven Auxiliary Feedwater Pumps (TD-AFWP), which extract steam from the main steam line, are only available means to supply cooling water to the steam generators (SG). Reactor Coolant System (RCS) natural circulation and heat transfer to the secondary via the steam generators are the primary means to cool the core because the Reactor Coolant Pumps (RCPs) are unavailable to provide a forced circulation. The capacity of a DC battery is about 4~8 hrs; thus, operator should restore the existing electric power before it exhausts. If electric power cannot be restored within this time due to a complicated situation, SBO with the complete depletion of batteries is a total loss of heat sink situation and proceeds to a severe accident condition. Probabilistic Safety Assessment (PSA) results show that SBO is one of the dominant sequences that lead to the core damage and containment failure in the APR1400 [3] as shown in Table 1.

Table 1: Level 1 PSA initiating event.

The Fukushima Dai-ichi nuclear power plant accident shows that an extreme natural disaster can prevent the proper restoration of electric power for several days, so-called extended SBO [4]. After the Fukushima Dai-ichi accident, several kinds of analyses on SBO are performed. One of them is BWR long term SBO calculation using TRAC-BF [5]. Calculated results are compared with the observed data at the unit 2 reactor of the Fukushima Dai-ichi nuclear power plant and shown to be in good agreement. In PWR, a study shows the effectiveness of availability of long term secondary cooling to delay the time before core uncovers and significant heatup [6, 7]. Results show that the available time for restoration of AC power is extended for at least the batteries capacity extension time. Another study was performed about comparison of extended SBO scenarios against PWR, BWR, and PWHR using MAAP code without operator action [8]. Results show that core damage occurs within 10 hrs after the initial event. Most of the studies are focused on the plant behavior without operator action or improvement of accident management using existing permanent equipment, such as extension of battery capacity and operability of TD-AFW.

As for regulation activity, US NRC recommends strengthening SBO mitigation capability for design basis and beyond design basis external events. Detailed recommendations [9] include(i)establishment of a minimum coping time of 8 hrs,(ii)preparation of the equipment, procedure, and training necessary to implement an extended SBO coping time of 72 hrs for core and spent fuel pool (SFP) cooling,(iii)establishment of preplan and prestage offsite resources to support uninterrupted core and SFP cooling.

In Korea, the government and industry performed comprehensive special safety inspections on all domestic nuclear power plants against beyond design bases external events after the Fukushima Dai-ichi nuclear power plant accident. The major concerns of these inspections were protection against extreme natural hazards, prevention and/or mitigation of severe accidents, emergency preparedness, and the design of structures and equipment against earthquakes and coastal flooding. As a result, a total of 50 recommendations were defined as safety improvement action items. They were classified into 5 categories and will be implemented by 2015.

Some of the action items related to mitigation measures against extended SBO sequences are(i)upgrading the design basis of AAC diesel generators,(ii)installation of a water-proof gate to EDG room,(iii)securing the availability of portable power generator vehicles,(iv)installation of external water injection provision and equipment to RCS and SG.

Among those items, effectiveness of external injection into RCS and SG needs to be examined. Therefore, in this paper, the overall extended SBO coping capability of APR1400 is analyzed to examine the effectiveness of the external water injection strategy and estimate proper operator action timing to reflect on the optimal revised severe accident management guideline. Section 2 presents SBO related procedures to prevent and/or mitigate the sequences as well as the mitigation facilities installed in APR1400. The modeling and analyses results using the MAAP severe accident analysis code are provided in Sections 3 and 4, and a summary of the SBO coping capabilities in APR1400 are discussed in Section 5.

2. SBO Related Operating Procedures and Mitigation Facilities

2.1. SBO Related Operating Procedures

The purpose of this section is to identify the main operator actions to be analyzed and to estimate the operator action timing during a SBO scenario. The APR1400 Emergency Operational Procedure (EOP) and Severe Accident Management Guideline (SAMG) were developed based on the PWR owner’s group reference documents [10, 11] and these documents were modified [12, 13] to reflect the APR1400 plant specific design characteristics [14].

When a SBO occurs, the reactor is tripped by either Reactor Protection System (RPS) trip signal or gravity drop of control rod due to the loss of electric power. Then operators initiate an EOP. After performing standard posttrip action to verify the plant status, the operators confirm the diagnosis of the event and, if properly diagnosed, the SBO procedure is initiated. It is one of the event oriented procedures that recover the essential safety functions more effectively than symptom oriented procedure. If operators cannot diagnose the specific event, functional recovery guideline, especially the RCS heat removal procedure, is performed. The two procedures commonly provide the operator action for recovery of RCS heat removal safety function shown below.

The primary operator action is to recover the AAC power. If it is not successful, core cooling using safety injection tank (SIT) is applicable when RCS depressurization is achieved because APR1400 Safety Injection Pump (SIP) is an active system and needs electricity to activate. So, the operator should perform the RCS and core heat removal using the TD-AFWP and SG Atmospheric Dump Valve (ADV) to cool the RCS via heat transfer to the SG. The TD-AFW flow control valve is powered by a DC battery, and its design capacity is about 8 hrs. If existing electric power is not recovered until battery exhaustion time, there are no further means to cool the RCS. Then, eventually, a core boil-off occurs. When the core exit temperature reaches 922 K (1200 F), SAMG is initiated (Figures 6 and 10).

In SAMG, the operator performs once again the recovery action of the existing electric power or portable external power. This step is a continuously applicable step. Therefore, at the same time, the operator should monitor the 7 major safety functions sequentially and perform corresponding mitigation measures when certain safety functions are challenged. SBO related mitigation measures are mitigation-1 (depressurizes the RCS), mitigation-2 (injection into the SG), and mitigation-3 (injection into the RCS). The schematic flowchart of the procedures is summarized in Figure 1. The right two columns are the revised procedure to reflect the external injection strategy.

Figure 1: Flowchart of the SBO related procedure.
2.2. Design Characteristics to Cope with Extended SBO

To cope with a SBO, the APR1400 is equipped with an AAC power supply with a capacity of at least 2~3 days. Also, an auxiliary charging pump is installed parallel to the existing charging pumps to provide seal injection water to the four RCPs to prevent the leakage of coolant through the RCP seals. DC power from the battery provides a reliable source of power for safety related control and monitoring equipment for at least 8 hrs.

In addition, post-Fukushima action items including the provision of an external injection system are recently reflected. The RCS external injection flow path is installed at the discharge of the existing Emergency Core Cooling (ECC) pump. SG injection flow paths are also installed along the discharge line of the AFW pump. A total of three commercial external pumps are on standby condition in each unit, one for RCS injection and two for each SG injection. Several water sources in site boundary that are available can be used, such as a raw water tank, two condensate water tanks, and two AFW tanks. Detailed SG external injection flow paths are shown in Figure 2.

Figure 2: Schematics of SG external injection.

3. Numerical Model

Extended SBO analyses on APR1400 are performed using the MAAP severe accident computer code. The MAAP code can analyze severe accidents following large and small break Loss of Coolant Accidents (LOCAs), SBO, and various general transients. Developed for the Electric Power Research Institute (EPRI) by Fauske et al., MAAP4.0.7 is used here. The MAAP4 code can perform integral analyses of reactor system and containment behaviors including core heatup, degradation, relocation, reactor vessel failure, containment failure, and fission product behaviors [15]. MAAP4 has simplified thermohydraulic model and solved first order differential equations for conservation of mass and energy. However, it produces reasonable prediction capabilities comparable to MELCOR and SCDAP [16]. MAAP4 is widely used in Korea in severe accident analysis and level 2 PSA for APR1400 design [17, 18].

A noding diagram for APR1400 is shown in Figure 3. RCS are divided into 14 nodes based on generalized models of PWRs, in which the type and number of components and the geometry are predetermined. RCS system consists of two primary loops; each one consists of one SG, one hot leg, and two RCPs and cold legs. Also, four Pilot Operated Safety and Relief Valves (POSRVs) located on the top of the pressurizer are modeled. Each of the POSRVs has two valves in serial that perform spring loaded safety depressurization function and motor operated steam relief function. Secondary system consists of SG, main feedwater pumps, auxiliary feedwater pump, main steam line, main steam isolation valve (MSIV), 20 main steam safety valves (MSSV), and 4 ADV located upstream of the MSIV. The containment is divided into 14 nodes.

Figure 3: MAAP noding diagram.

In-containment refueling water storage tank (IRWST), one of the advanced design features in APR1400, is modeled as one of the containment nodes as shown in Figure 3. The flow paths from IRWST to suction of safety injection and containment spray pump and return flow path of the discharged coolant from containment spray and/or break flow to the IRWST are modeled. Direct vessel injection flow path is connected to the reactor vessel upper downcomer to incorporate into APR1400 SIS design. However, in-vessel retention (IVR) strategy, one of the representative severe accident mitigation strategies in APR1400, is not considered in this analysis because ex-reactor vessel cooling is not applicable when reactor cavity is in dry condition in SBO sequences.

External primary injection flow path is located at discharge line of SIS piping. Injection flow rate is calculated based on the existing commercial portable pump performance curve and the flow path pressure drop calculation from the external pump to the RCS injection point. External secondary injection flow path is located at discharge line of AFW piping and injection flow rate is also implemented similarly as mentioned above.

The RCP seal leakage flow rate is considered as 1.325 liter/s, most probable flow rate, for each RCP in this calculation [19]. Initial and boundary condition for this calculation is summarized in Table 2.

Table 2: Initial and boundary conditions.

4. Results and Discussion

4.1. Base Case

In this section, the effectiveness of the TD-AFWP operation is analyzed. When a SBO with concurrent failure of AAC occurs, a reactor and turbine trip is initiated. All active systems including emergency core cooling system, shutdown cooling system, and motor driven auxiliary feedwater system become inoperable. Then, the SG pressure rapidly increases to the MSSV opening set-point and releases steam to the environment periodically to maintain secondary pressure boundary integrity. RCS single phase natural circulation is established through the SG heat removal. However, the SG water source is not provided; the SG level is continuously decreased. At this time, the operator initiates an EOP and tries to restore the proper actuation of the TD-AFWP based on SBO procedures. This operator action is assumed 30 min after the initiating event in this calculation.

If this action is not successful, the SG inventory is depleted at 1.3 hrs. Then, the RCS pressure reincreases and POSRVs start to open. The RCS inventory is continuously discharged into the containment and core starts to uncover at 1.9 hrs. At this time, hot leg counter current natural circulation is established. Superheated steam from the vessel flows into the SG hot side plenum through the upper part of the hot leg and excessive heatup of heat structure occurs. There is some mixing of the superheated steam in the SG hot side plenum, and some of the relatively low temperature steam returns to the core through lower part of the hot leg. So, there is circumferential temperature stratification in hot leg piping and it could lead to creep rupture. This phenomenon is reflected based on Larson Miller creep rupture failure model in MAAP4. This counter current natural circulation is maintained up to 3.2 hrs until core level is completely depleted. During this time, core degradation and melting occur in the RCS. Eventually, the RCS fails due to the failure of the incore instrument tube caused by molten corium relocation to the lower head at 3.7 hrs. Because high pressure is maintained before RCS fails, a large amount of superheated steam and hydrogen is discharged into containment after RCS fails. Also, interaction between molten core material and cavity water that is discharged from SIT leads to large amount of steam generation in the cavity. So, the containment pressure rapidly increased. Also, hydrogen and noncondensable gas are steadily generated by molten core concrete interaction in the base-mat.

On the other hand, if TD-AFWP actuation is successful, the SG water inventory is recovered before it is depleted and RCS heat removal is reestablished until the battery is exhausted at 8.5 hrs. During this period, the RCS pressure continuously decreases to 8.5 MPa, slightly above the SG pressure, due to heat transfer to the secondary system as shown in Figure 4. TD-AFW flow rate is ~15 kg/s until SG reaches its normal water level. And flow rate continuously decreases as the decay heat level decreases. This condition is maintained if the TD-AFW flow is provided. However, if the operator action to recover the existing electric power is not successful until the battery exhaustion time, the TD-AFW flow rate is terminated. Then, the core starts to boil off after SG inventory dries out as shown in Figure 5. Eventually, the RCS inventory is also depleted and CET reaches 922 K at 12.6 hrs. The operator initiates SAMG, but no mitigation measures are available if the restoration of existing electric power is not successful. Then, the RCS lower head fails at 15.0 hrs.

Figure 4: RCS pressure history.
Figure 5: SG water level.
Figure 6: Core exit and fuel temperature.

This calculation shows that TD-AFW could effectively cool down the RCS until the battery is exhausted and provide approximately 11 hrs of additional time to avoid core uncovering if TD-AFW initiation operator action is successful.

To verify the sensitivity on injection duration, 72 hrs of TD-AFW operational case is analyzed. Results show that the stable core cooling is maintained until the 72 hrs. These results show that the extension of battery capacity to 72 hrs can be an effective way to implement an extended SBO coping time of 72 hrs if TD-AFW operability is maintained. The major sequences of events are summarized in Table 3.

Table 3: Major sequences of events.
4.2. Effectiveness of External Secondary Injection Operator Action

In this section, the effectiveness of an external injection strategy into the SG is examined. The event scenario before the SAMG entry condition is identical to those of previous section. When the CET reaches 922 K, the operator should transfer the procedure from EOP to SAMG. In SAMG, after a technical support center is established, the primary operator action is to recover the existing electric power or prepare the external power generator in site boundary. If the external power generator is active, it provides electric power to essential instrumentation and control valves, including the main control room, the SG level and pressure indicators, containment pressure instrumentation, and the RCS and SG depressurization valves.

Then, SAMG mitigation-2 procedure for a secondary injection initiates. Detailed actions are depressurizing the SG pressure below the pump shutoff head by opening main steam line ADV in each SG. This action is performed manually if external electric power is not available. Then, water is injected into the SG using an external pump. This operator action time is assumed as 30 min. As shown in Figure 7, the SG pressure rapidly decreases when the ADV is fully opened. Then, the SG water level is recovered continuously as shown in Figure 8. At this time, a RCS natural circulation flow path is formed and the RCS is cooled down and pressure decreases. When RCS pressure reaches the Safety Injection Tank (SIT) actuation set-point of 4.0 MPa, the RCS water level is recovered rapidly. The external injection flow rate of each loop is 10 kg/s~15 kg/s initially and decreases to 5 kg/s when SG level is fully recovered by operator action to prevent SG overfilling. Then, the external injection and ADV flow rate are balanced and maintain a stable condition as shown in Figure 9. This flow rate is compatible to removal of decay heat generated in the core. The maximum core exit temperature decreases after 1500 K peak and the core integrity is maintained. The fraction of clad reacted in vessel is within 1% of total amount of clad as summarized in Table 4. Figure 11 shows the integrated water inventory required for 72 hrs of injection to the SG. Approximately, 2500 tons of cooling water is required. The total water inventories of two AFW tanks and CST tanks are 4,000 ton and 1,700 ton, respectively. So, the cooling water source is sufficient to provide up to 72 hrs.

Table 4: Major severe accident progression parameter.
Figure 7: Secondary injection RCS and SG pressure.
Figure 8: Secondary injection RCS and SG water level.
Figure 9: Secondary injection flow rate.
Figure 10: Secondary injection core exit and fuel temperature.
Figure 11: Integrated mass inventory of secondary injection.

These calculation results show that the external injection into the SG is an effective procedure to mitigate an extended SBO scenario when this is successfully performed within 30 min after SAMG initiation. Moreover, this strategy can be undertaken without a portable power generator because SG depressurization can be performed by an operator manually.

4.3. Effectiveness of External Primary Injection Operator Action

In this section, the effectiveness of an external injection strategy into the RCS is examined. The event scenario is identical to that in previous section except that the external injection location is the RCS. To inject water into the RCS, SAMG mitigation-1 (RCS depressurization) is prerequisite because external injection pump shutoff head is relatively low. To depressurize the RCS, the preparation of an external power generator is essentially required because the POSRV cannot be opened manually due to the unaccessibility to the inside of the containment. If a portable power generator is in place, the operator opens two out of four POSRVs 30 min after the SAMG entry condition because a portable power generator can provide only one of two electric trains. Then, SAMG mitigation-3 (Injection into RCS) initiates. The RCS pressure trend is shown in Figure 12. After the POSRVs are opened, the RCS pressure reaches the SIT injection set point and the SIT water starts to flow into the core. Then, a large amount of steam and hydrogen is generated in the core due to the direct contact cooling between SIT water and core materials. Due to limited depressurization capacity of POSRV, RCS pressure spikes continuously occur and do not sufficiently decrease to external injection pump shutoff head pressure. As a result, the RCS injection strategy is not successful in this case.

Figure 12: Primary injection RCS pressure.

For a sensitivity on depressurization capacity, 4 POSRV opening cases are analyzed. As shown in Figure 13, 4 POSRV cases sufficiently depressurize the RCS. Primary injection is successful and RCS cool-down is completed.

Figure 13: Primary injection core exit and fuel temperature.

The calculation results show that an external injection into the RCS is only effective when the RCS depressurization capacity is sufficiently provided in case of high pressure severe accident scenarios.

5. Conclusions

After the Fukushima Dai-ichi nuclear power plant accident, mitigation measures against extended SBO sequences were investigated in Korea. Therefore, the overall extended SBO coping capability of the APR1400 is examined to assess the effectiveness of an external water injection strategy.

The following are the conclusions:(i)SBO without operator action leads to a core damage at 2.0 hrs and Rx failure at 3.7 hrs in APR1400;(ii)a TD-AFW can effectively cool down the RCS and provide approximately 12 hrs of additional time for the operator to recover the existing electric power to prevent core damage;(iii)extension of battery capacity can be an effective way to implement an extended SBO coping time of 72 hrs;(iv)an external injection strategy into SG using commercial pump is an effective strategy to mitigate an extended SBO scenario when it is successfully prepared within 30 min after SAMG initiation;(v)an external injection into RCS using commercial pump is only effective when RCS depressurization capacity is sufficiently provided in case of high pressure severe accident scenarios.

Based on the above results, the technical basis on external injection strategy will be implemented on development of optimal revised severe accident management procedure.


AAC:Alternative AC
ADV:Atmospheric dump valve
AFW:Auxiliary feedwater
CET:Core exit temperature
CST:Condensate storage ank
ECC:Emergency core cooling
EDG:Emergency diesel generator
EOP:Emergency operational procedure
IRWST:In-containment refueling water storage tank
LOCA:Loss of coolant accident
MAAP:Modular accident analysis package
MSIV:Main steam isolation valve
POSRV:Pilot operated safety and relief valve
PSA:Probabilistic safety assessment
RCP:Reactor coolant pump
RPS:Reactor protection system
SAMG:Severe accident analysis guideline
SBO:Station blackout
SIS:Safety injection system
SIT:Safety injection tank
SFP:Spent fuel pool
TD-AF:Turbine driven auxiliary feedwater
RCS:Reactor Coolant System.

Conflict of Interests

The authors declare that there is no conflict of interests regarding the publication of this paper.


  1. U.S. NRC, “Station Blackout,” Regulatory Guideline 1.155, 1988.
  2. U.S. NRC, “Station Blackout Rule,” Regulations Title 10 Code of Federal Regulations, 1988.
  3. KHNP, “Probabilistic safety assessment and severe accident,” APR1400 Standard Safety Analyses Report, 2002. View at Google Scholar
  4. TEPCO, Overview of the Earthquake & Tsunami and Nuclear Accident : The Great East Japan Earthquake and Current Status of Nuclear Power Stations, 2011.
  5. T. Watanabe, M. Ishigaki, and M. Hirano, “Analysis of BWR long-term station blackout accident using TRAC-BF1,” Annals of Nuclear Energy, vol. 49, pp. 223–226, 2012. View at Publisher · View at Google Scholar · View at Scopus
  6. A. Prošek and L. Cizelj, “Long-term station blackout accident analyses of a PWR with RELAP5/MOD3.3,” Science and Technology of Nuclear Installations, vol. 2013, Article ID 851987, 15 pages, 2013. View at Google Scholar
  7. A. Volkanovski and A. Prošek, “Extension of station blackout coping capability and implications on nuclear safety,” Nuclear Engineering and Design, vol. 255, pp. 16–27, 2013. View at Publisher · View at Google Scholar · View at Scopus
  8. S.-Y. Park and K.-I. Ahn, “Comparative analysis of station blackout accident progression in typical PWR, BWR, and PHWR,” Nuclear Engineering and Technology, vol. 44, no. 3, pp. 311–322, 2011. View at Publisher · View at Google Scholar · View at Scopus
  9. U.S. NRC, Recommendations for Enhancing Reactor Safety in the 21st Century, The Near-Term Task Force Review of Insight from the Fukushima Dai-ichi Accident, 2011.
  10. PWROG, Emergency Procedure Guidelines Rev.5.2, CEN-152, 2001.
  11. PWROG, Severe Accident Management Guideline, MUHP-2310, 1994.
  12. KHNP, Emergency Operational Guidelines for APR1400, Rev.01, 2002.
  13. KHNP, APR1400 Severe Accident Management Guideline, 2012.
  14. S. J. Cho, B. S. Kim, M. G. Kang, and H. G. Kim, “The development of passive design features for the Korean Next Generation Reactor,” Nuclear Engineering and Design, vol. 201, no. 2, pp. 259–271, 2000. View at Publisher · View at Google Scholar · View at Scopus
  15. EPRI, MAAP4-Modular Accident Analysis Program for LWR Power Plants, 1994.
  16. K. Vierow, Y. Liao, J. Johnson, M. Kenton, and R. Gauntt, “Severe accident analysis of a PWR station blackout with the MELCOR, MAAP4 and SCDAP/RELAP5 codes,” Nuclear Engineering and Design, vol. 234, no. 1–3, pp. 129–145, 2004. View at Publisher · View at Google Scholar · View at Scopus
  17. C. H. Park, D. Y. Lee, I. J. U. C. Lee, K. Y. Suh, and G. C. Park, “Comparative study of loss-of-coolant accident using MAAP4.03 and RELAP5/MOD3.2.2,” in Proceedings of the 10th International Conference on Nuclear Engineering (ICONE '02), pp. 22032.1–22032.8, April 2002. View at Scopus
  18. J. Hwan Jeong, M. G. Na, S. P. Kim, and J. Woon Park, “Analysis of severe accident scenarios in APR1400 using MAAP4 code,” in Proceedings of the International Conference on Atomic Physics (ICAPP '02), 2002.
  19. Westinghouse, WOG2000 RCP Seal Leakage Model for Westinghouse PWRs, 2002.