Abstract
The passive safety systems of AP1000 are designed to operate automatically at desired set-points. However, the unavailability or failure to operate of any of the passive safety systems will change the accident sequence and may affect reactor safety. The analysis in this study is based on some hypothetical scenarios, in which the passive safety system failure is considered during the loss of coolant accidents. Four different cases are assumed, that is, with all passive systems, without actuation of one of the accumulators, without actuation of ADS stages 1–3, and without actuation of ADS stage 4. The actuation of all safety systems at their actuation set-points provides adequate core cooling by injecting sufficient water inventory into reactor core. The LOCA with actuation of one of the accumulators cause early actuation of ADS and IRWST. In case of LOCA without ADS stages 1–3, the primary system depressurization is relatively slow and mixture level above core active region drops much earlier than IRWST actuation. The accident without ADS stage 4 actuation results in slow depressurization and mixture level above core active region drops earlier than IRWST injection. Moreover, the comparison of cladding surface temperature is performed in all cases considered in this work.
1. Introduction
The concept of passive safety systems in nuclear power plants was evolved in the 1980s after the two major accidents of NPP, that is, TMI and Chernobyl. The concept of passive safety system is practically adopted in the design of generation III and III+ reactors such as AP1000 by Westinghouse, EPR by Avera, and APR 1400 by Korea Electric Power Corporation (KEPCO).
The AP1000 is an advanced pressurized water reactor (PWR) designed by Westinghouse. The special features which differentiate AP1000 from other conventional power plants are their passive safety systems. These passive safety systems rely on natural forces such as natural circulation, compressed gas, gravity, and free convection to ensure plant safety in case of accidents. These passive safety systems provide adequate simplifications in plant design and reduce the size and number of components as compared with the plants equipped with active safety systems [1].
The important AP1000 passive safety systems comprise two core makeup tanks (CMTs), two accumulators, Automatic Depressurization System (ADS), passive residual heat removal heat exchanger (PRHR HX), and in-containment refueling water storage tank (IRWST). The actuation sequence of these systems is based on actuation set-points at various parameters of AP1000 reactor system. As soon as the actuation set-point is reached, the operation of these safety systems provides sufficient core cooling and primary system depressurization. The designed base loss of coolant accident (LOCA) has been simulated by Westinghouse and the behavior and performance of the passive safety system were analyzed and it was concluded that the passive safety systems provide sufficient core cooling and ensure plant safety in case of LOCA [1, 2].
In the past, many studies have been conducted on safety analysis of AP1000 safety systems is series of postulated accidents including LOCA using best estimate analysis codes such as TRACE, RELAP5, and NOTRUMP [2–4]. RELAP5 code is a best estimate thermal hydraulic analysis code for simulation of transients and accidents in pressurized water reactors (PWRs) cooling system. RELAP5 code can be used to model the coupled characteristic of the reactor core and associated coolant systems under various transients and accident conditions such as loss of coolant accident, loss of feed water accident, loss of offsite power, loss of flow accident, and anticipated transients without scram (ATWS) [5].
Most of the currently operating pressurized water reactors are generation II or generation II+ [6]. Keeping in view the plant safety and improved reliability of passive safety systems, the research work is also being performed to employ the passive safety system design features in generation II+ reactor such as Chinese improved pressurized water reactor CPR1000. Zhang et al. performed the transient analysis of emergency passive residual heat removal system (EPRHRS) of CPR1000 and found that the EPRHRS can effectively remove the decay heat from the primary system [6]. Wang et al. studied the performance of passive core makeup tank (CMT) in CPR1000 during steam generator tube rupture and found that the CMT can effectively remove the core residual heat during the transient in addition to the other safety systems [7]. Hu et al. designed an advanced accumulator for CPR-1000 and analyzed its performance during large break loss of coolant accident [8]. Another research of PRHRS is performed by Wang et al. in that the researcher designed PRHRS for CPR1000 and analyzed the behavior during station blackout transient and found that the designed PRHR is capable of employing in CPR1000 [9]. The results of experimental research work showed that the designed passive safety is reliable and meets the safety requirements of CPR1000 [10].
The purpose of the paper is to show the importance and performance analysis of passive safety systems in advanced PWRs during unexpected transients. The passive safety systems of AP1000 are designed to operate automatically without operator’s action during the unexpected transients and accidents. It is believed that all the passive safety system will work during accidents. However, there may be a possibility that any of the fully automated passive safety systems fails to operate in the course of the transient or accident. The author has considered some hypothetical scenarios to simulate the effects of failure of any of the safety systems and its consequences on the accident sequence and on the overall safety of the plant.
In this paper, an effort is made to analyze the small break LOCA in AP1000 without actuation/operation of some of the passive safety systems. In this study, a 10-inch small break LOCA is simulated in one of the cold legs of AP1000 by using RELAP5 and the core parameters have been analyzed in case of successful operation of all safety system, without one of the accumulators’ actuation, without actuation of ADS stages 1 to 3, and without actuation of ADS stage 4.
The paper is divided into various sections including Section 2 which briefly discusses the AP1000 passive safety systems, Section 3 which describes the RELAP5 model of AP1000 reactor used in this analysis, Section 4 which covers the accident sequence of small break LOCA in AP1000 and simulation method, and Section 5 which presents the main results obtained through simulation of AP1000 LOCA with and without some of the passive safety systems and discussion on these results. Finally, Section 6 summarizes the main conclusions of this analysis.
2. AP1000 Passive Safety Systems
AP1000 passive safety systems are based on similar concept of conventional PWR safety systems with some modification and some additional systems. As CMTs for high pressure safety injection, accumulators are for middle safety injection IRWST for low pressure safety injection. The additional safety systems include the PRHR HX for passive core cooling and ADS system for primary loop depressurization [3].
The main categories of AP1000 passive safety system are the passive core cooling system (PXS) and passive containment cooling systems (PCS). The passive core cooling system is subdivided into passive residual heat removal system (PRHRS) for decay heat removal, passive safety injection system (PSIS) for safety injection, and automatic depressurization system (ADS) for primary loop depressurization. Figure 1 provides the schematic diagram of passive core cooling systems. The description of components of passive core cooling systems is given in the following text.
2.1. Core Makeup Tanks (CMTs)
Two cylindrical core makeup tanks filled with cold borated water at same pressure as that of primary loop are the part of AP1000 passive safety system. The volume of each core makeup tank is 70.8 m2 (approx.). The discharge line of the CMT is connected with Direct Vessel Injection (DVI) line and the upper part of CMT is connected with one of the cold legs through a balance line. The CMTs provide relatively high borated makeup water flow at any primary system pressure for a longer duration [11]. CMTs operate in two modes, that is, injection mode and recirculation mode. In the injection mode, CMTs inject cold borated water into primary system and in recirculation mode they receive relatively hot water from cold leg through a balance line (connecting one of the cold legs to upper part of the CMT).
2.2. Accumulators
The AP1000 passive safety system is equipped with two spherical accumulators filled with cold borated water and pressurized with nitrogen gas. The accumulators provide cold borated water with relatively higher flow rate and in short time to the reactor pressure vessel (RPV) through DVI line if the primary pressure drops below 4.83 MPa.
2.3. Automatic Depressurization System (ADS)
The automatic depressurization system (ADS) is one of the important parts of passive core cooling system which depressurizes the primary loop to a pressure where passive safety injection actuates.
The automatic depressurization system (ADS) comprises set of valves which constitutes four stages of ADS. The first three ADS stages connect the pressurizer steam space to IRWST. The 4th stage is divided into two parts, that is, 4a and 4b, connecting the two hot legs to the containment atmosphere [12]. The actuation of ADS-1 and ADS-4a is controlled by water level in CMTs and the actuation of other ADS stages is controlled by time sequence.
The controlled depressurization of primary loop through ADS during loss of coolant accident facilitates the passive safety injection through core makeup tanks (CMTs) and accumulators and through in-containment refueling water storage tank (IRWST) to mitigate the effects of loss of coolant accident [2].
2.4. Passive Residual Heat Removal Heat Exchanger (PRHR HX)
A passive residual heat removal heat exchanger is composed of a C-shaped tube bundle immersed in the IRWST which act as heat sink for PRHR HX. PRHR system depends on natural passive processes such as gravity and natural circulation to remove the decay heat from primary system at any pressure [13, 14].
2.5. In-Containment Refueling Water Storage Tank (IRWST)
The IRWST filled with borated water at containment pressure is located inside containment and its discharge lines are connected with both DVI lines. Gravity driven cold borated water is injected by IRWST into primary system when the primary system pressure drops to nearly containment pressure. IRWST provides cooling for relatively longer time.
3. Description of RELAP5 Model
AP1000 reactor model has been developed in RELAP5. The model includes the primary loop, a part of secondary loop, and the passive safety systems required during LOCA. Nodalization diagram of AP1000 reactor is given in Figure 2. AP1000 adopts a special two-loop design; each loop comprises one hot leg, two cold legs, one steam generator, and two primary coolant pumps. The reactor pressure vessel (RPV) model is composed of downcomer, lower and upper plenum, upper and lower heads, core flow, and a bypass channel. The core active region is divided into two channels, namely, average and hot channel. Each channel is further divided into 22 axial control volumes. Fuel rods are represented by heat structures attached with each axial control volume in average and hot channel. The author has obtained the radial and axial core power distribution in hot and average channel from their previous study carried out for neurotic and burnup analysis of AP1000 reactor [15]. The inlets and outlets of RPV such as hot legs, cold legs, and DVI are represented by corresponding hydrodynamic components.
The passive safety systems that were modeled in RELAP5 include the two CMTs, two accumulators, PRHR HX, and IRWST. Two DVI lines were modeled which connect the CMTs, accumulators, and IRWST to reactor pressure vessel (RPV). The PRHR HX heat transfer tubes are lumped into a single component [4, 5, 16]. The heat transfer from PRHR HX to IRWST is carried out through heat structures which connect the corresponding control volumes of PRHR HX and IRWST. The ADS stages are modeled through a valve component. IRWST is modeled as a pipe component which is further divided into various vertical control volumes. A pipe component connects the IRWST bottom volume to the DVI line for gravity driven injection into the core. The lumped parameters component model for accumulators is adopted as the provision is given in RELAP5 [5].
The primary system pressure is controlled by pressurizer controller. The controller maintains the primary system pressure by appropriately selecting the function of pressurizer spray, heaters, and relief valve. Trips are utilized to generate the error signal to the controller at particular set-points to start the function of spray valve or proportional heaters. The steam generator water level control is achieved by using built-in controller of RELAP5 by adjusting the feedwater flow. The feedwater valve position is regulated according to the desired feedwater flow, calculated water level in steam generator, and the flow rate of steam.
4. Small Break LOCA Simulation and Accident Sequence
In this study, a small break loss of coolant accident is considered in one of the cold legs on nonpressurizer side of the primary loop. The 10-inch break size is considered which is the upper limit of small break LOCA. There are four different phases of small break LOCA in AP1000 reactor, that is, blow-down phase, the natural circulation phase, the ADS blow-down phase, and the IRWST injection phase [14, 17, 18].
As the break opens, the pressure of primary system starts decreasing due to loss of mass and energy from the break [4]. Reactor scram signal is generated when the primary system pressure reduces to 12.41 MPa and reactor power reaches decay heat level due to reactor shutdown. The safety system actuation signal (“S” signal) is generated when the primary system pressure further reduces to 11.72 MPa. The generation of “S” signal trips the reactor coolant pumps after a short time delay and also actuates the core makeup tanks (CMTs) and PRHR HX. CMTs inject cold borated water into the primary system and receive the relatively hot water through the balance line and a natural circulation loop established. Another natural circulation loop is established by actuation of PRHR HX, where hot water enters into PRHR HX and transfers the residual heat to IRWST and relatively cold water injected into the primary system. The two accumulators actuate when the primary system pressure drops to 4.83 MPa and inject cold borated water into primary system.
The draining of CMT balance line causes the water level to drop in CMTs and results in actuation of ADS stage 1 when the water level in either of the core makeup tanks drops to 67.5%. ADS stages 2 and 3 actuate with a specified time delay after actuation of ADS stage 1. The actuation of ADS causes further depressurization of primary loop and when the primary loop pressure reaches close to containment pressure, IRWST starts injecting the water into primary loop. Table 1 provides the actuation set-points considered in this study of small break loss of coolant accident analysis [4].
5. Results and Discussion
5.1. Steady-State Results
The steady-state analysis of AP1000 reactor is performed in RELAP5 with the model described in previous section and the obtained results are given in Table 2. The calculated steady-state parameters are found in close agreement with the results found in literature. These steady-state results are adequate to perform further transient/accident analysis using the same model.
5.2. Small Break Loss of Coolant Accident (SBLOCA) with All the Passive Systems Available
In this paper, a 10-inch small break LOCA analysis in one of the cold legs on nonpressurizer side of the primary loop is performed with all required passive safety systems. The actuation set-points for various systems considered in this analysis are shown in Table 1. The pressure drop in primary loop during small break LOCA is given in Figure 3. The liquid discharge flow rate from break is given in Figure 4. Similarly, the flow rate through CMTs and PRHR HX and the mixture level above the core active region are calculated and the results are given in Figures 5–7, respectively. Figure 7 shows the mixture level above the active core region. Results indicate that the mixture level starts decreasing after around 1250 sec at nearly the same time when flow through CMTs starts decreasing as shown in Figure 5. The actuation of CMT establishes a natural circulation flow path. The flow through CMTs depends on the overall coolant conditions in the loop where CMT is connected. CMT-1 is connected to the loop where LOCA took place. The flow through break point assists the flow through both CMTs. However, this effect is relatively more on CMT which is connected to the loop on LOCA side. As can be seen in Figure 5, the flow rate of CMT-1 is higher than CMT-2 from 375 sec to 625 sec and CMT-1 drains earlier than CMT-2. Therefore, the flow rate of CMT-2 is comparatively higher than CMT-1 in the later part of the accident sequence when the water level in CMT-1 decreases to low level.
The actuation of IRWST (around 1800 sec) results in increasing mixture level above core active region. The author compared these results with the results found in literature and calculated from other codes and found that the AP1000 model considered in this study provides similar results and the model can be used for further LOCA analysis in AP1000 reactor which includes the effect of failure to actuate some of the passive safety systems on accident sequence and AP1000 reactor parameters during LOCA. The accident sequence of small break LOCA as calculated by RELAP5 is given in Table 3.
5.3. Small Break Loss of Coolant Accident without Some Passive Safety Systems
AP1000 passive systems are designed to mitigate the consequences of accident to ensure the reactor safety. However, if any of the safety systems is not available or could not actuate during accident sequence, the accident sequence may change and it may also affect the other plant parameters during accident. In this study, an effort is made to analyze the AP1000 reactor parameters and accident sequence if any of the passive safety systems is not available or could not operate during small break LOCA. For this purpose, four cases were considered which are as follows: case-1: with all passive safety systems available; case-2: without actuation of one of the accumulators, case-3: without actuation of ADS stages 1–3; and case-4: without actuation of ADS-4.
5.3.1. Case-2: Without Actuation of One of the Accumulators
Comparison of primary loop depressurization in case-1 and case-2 is shown in Figure 8. The accumulator water injection flow rate depends on the pressure difference between the accumulator pressure and the pressure in primary loop. The primary loop depressurization with only one accumulator actuation is relatively faster than that with actuation of both accumulators. Both accumulators’ injection causes relatively slow primary loop depressurization during the initial phase of LOCA due to additional pressure exerted by accumulator’s pressurized discharge flow caused by compressed nitrogen gas in accumulators and due to additional accumulator’s water inventory in the core.
In AP1000 model considered in this work, the accumulator-1 and CMT-1 are connected with the same DVI line and it has been assumed that accumulator-1 did not actuate during LOCA. The comparison of CMT-1 and CMT-2 flow rate in case-2 is given in Figure 9. CMTs injection starts on generation of “S” signal. When the primary system pressure drops below 4.83 MPa, both accumulators start injecting cold borated water into the core through DVI line. The high accumulator flow rate may partially or fully impede the CMT flow rate temporarily through DVI line due to backpressure or friction pressure drop [14, 16, 19]. The actuation of accumulator results in reduction of flow rate through CMT-2. CMT-1 maintains relatively continuous flow rate during recirculation and draining mode of operation. Therefore, CMT-1 drains earlier than CMT-2. Figure 10 shows the comparison of water level in both CMTs. The CMT-2 level drops much earlier than CMT-1 which results in early actuation of ADS stages and IRWST.
Due to actuation of only one accumulator, the core water inventory in case-2 is less as compared with case-1 in which both accumulators inject water in the reactor core. Comparison of mixture level above core active region in case-1 and case-2 is given in Figure 11. The results show that the decrease in mixture level above core active region is much earlier in case-2. The water inventory again starts increasing after IRWST actuation at around 1500 sec (much earlier than case-1).
5.3.2. Case-3: Without Actuation of ADS-1–3
The ADS stages are important for primary system depressurization which facilitates the passive safety systems to inject cold water into the core. The comparison of primary system depressurization in case-1 and case-3 is given in Figure 12. The pressure drop in case-3 is relatively slower due to nonavailability of ADS stages 1–3. This slow depressurization causes slow CMTs draining as shown in Figure 13, which results in the delayed actuation of ADS stage 4 at low CMT level.
The mixture level above core active region without ADS stages 1–3 is given in Figure 13. The nonavailability of ADS stages 1–3 causes the mixture level above the active fuel region to remain for longer time as compared with case-1 and case-2 because of absence of large flow area for primary system depressurization through ADS stages 1–3. Due to relatively slower depressurization, the CMT level drops somewhat later in case-3 as compared with case-1 as shown in Figure 14. The relatively slow draining of CMTs causes delayed actuation of ADS-4 and IRWST. The mixture level above core active region drops much earlier than actuation of IRWST which may cause core uncovery and may result in rise in fuel rod temperatures in later stages of LOCA.
The comparison of cladding surface temperature of the axially central portion of fuel rod in a hot channel during LOCA is shown in Figure 15. The cladding surface temperature is lower in case-2, which indicates that flow through CMTs provides better core cooling as the accumulator flow impedes the one of the CMT flow in case-1. However, without one accumulator injection (case-2), the water inventory in core drops quickly. The accumulators provide water inventory in the core which protect the core from uncovery. Cladding temperature is relatively higher in case-3 because the loss of energy and mass is only through break flow and not from ADS-1–3. Moreover, the actuation of ADS helps the flow through CMTs for core cooling and the unavailability of ADS-1–3 reduces, to some extent, the core cooling capability due to slow CMTs draining. The actuation of ADS-4 results in reduction of cladding surface temperature in case-3 which becomes nearly equal to case-1 in the later stage of LOCA. However, the mixture level above core active fuel region drops before IRWST actuation which may result in core uncovery and it can be predicted that the fuel rod temperatures may increase significantly in the later stage of LOCA.
5.3.3. Case-4: Without Actuation of ADS-4
In case-4, the failure of ADS-4 is considered during small break LOCA. The comparison of primary system depressurization is given in Figure 16. The calculated results show that failure of ADS-4 could not depressurize the primary system to a pressure where IRWST could operate before the mixture level drops to core active fuel region. The pressure difference with and without ADS-4 actuation in Figure 16 seems small due to the vertical scale of the graph; however, the difference is significant in the sense that, without actuation of ADS-4, the IRWST injection is not started before the mixture level drops to core active fuel region. The mixture level above core active region is given in Figure 17. The effect of failure of ADS-4 on CMTs flow is relatively less as compared with case-3. The actuation set-point of ADS-4 is at CMT low level and at that time most of the CMT water has already been injected into the reactor core. Therefore, in case-4, the effect on CMT in not significant as compared with case-3. The comparison of CMT level during LOCA is given in Figure 18.
The comparison of cladding surface temperature at the axially central portion of the fuel rod in hot channel in case-1 and case-4 is given in Figure 19. The results show that the actuation of ADS-4 provides better core cooling. The failure of ADS-4 causes relatively higher cladding temperatures during LOCA which may increase significantly during later stage of LOCA if core uncovery occurs due to delayed actuation of IRWST.
6. Conclusion
AP1000 is an advanced PWR which is equipped with passive safety systems. The passive safety system ensures reactor safety during accidents and transients. The passive safety systems are designed to operate automatically at desired set-points. However, there may be a possibility that any of the fully automated passive safety systems fails to actuate in the course of the transient or accident.
The analysis in this study is based on some hypothetical scenarios, in which the passive safety system failure is considered during the loss of coolant accidents. The importance and effects of passive safety systems and the effect of their availability/nonavailability on the accident sequence and on the overall plant safety are analyzed during small break LOCA.
Small break loss of coolant accident (SBLOCA) analysis is carried out in one of the cold legs of AP1000 reactor using RELAP5. The effect of various passive safety systems has been analyzed in LOCA sequence. Four different cases are considered including LOCA with the normal actuation sequence of all passive safety systems, without actuation of one of the accumulators, without actuation of ADS stages 1–3, and without actuation of ADS stages 4a and 4b. The steady-state results are nearly in agreement with the plant parameters available in literature. The comparison of results calculated in all cases shows that small break LOCA with normal sequential actuation of all passive safety systems provide adequate core cooling and provide sufficient water inventory into the core which ensures the reactor core is covered with water and safeguards the reactor safety.
The primary loop depressurization with only one accumulator actuation is relatively earlier than with actuation of both accumulators. The accumulator actuation reduces the CMT flow temporarily. However, in the case where only one accumulator actuation is considered, the CMT (on nonactuation accumulator’s DVI line) maintains relatively continuous flow and drains much earlier than other CMT. The early CMT draining causes early actuation of ADS and IRWST. Due to actuation of only one accumulator, less water inventory is injected into the core and the mixture level above core active region drops much earlier as compared with both accumulators’ injection. However, the mixture level increases with early actuation of IRWST.
In case of LOCA without ADS-1–3 actuation, the pressure drop is relatively slower due to nonavailability of ADS stages 1–3. This slow depressurization causes slow CMTs draining which results in the delayed actuation of IRWST. The mixture level above the active fuel region remains for longer time as compared with case-1 and case-2 because of absence of large flow area for primary system depressurization through ADS stages 1–3. The mixture level above core active region drops much earlier than actuation of IRWST which may cause core uncovery and may result in rise in fuel rod temperatures in later stages of LOCA.
The calculated results show that failure of ADS-4 could not depressurize the primary system to a pressure where IRWST could operate before the mixture level drops to core active fuel region. The effect of failure of ADS-4 on CMTs flow is relatively less as compared with the case where ADS-1–3 are not available for depressurization.
The comparison of cladding surface temperatures shows that the actuation of ADS helps the flow through CMTs for core cooling and the unavailability of ADS-1–3 reduces, to some extent, the core cooling capability due to slow CMTs draining. The failure of ADS-4 causes relatively higher cladding temperatures during LOCA which may increase significantly during later stage of LOCA if core uncovery occurs due to delayed actuation of IRWST.
Competing Interests
The authors declare that there is no conflict of interests regarding the publication of this paper.