Abstract
The study simulated the design basis accidents (DBAs) sequences of the HTR-10GT core with THERMIX. When a DBA happens, the protection system will receive a scram signal which shall lead to active measures to shut down the reactor following it. In the paper, three typical DBA cases were studied. They include an accident induced by station blackout, a case caused by the withdrawal of one control rod out of the core by a mistake, and a case resulting from an earthquake, respectively. The simulation results illustrate that the fuel peak temperatures in the core during these accidents are 1066°C, 1201°C and 1067°C, respectively. It is shown that the HTR-10GT has a good safety characteristic.
1. Introduction
Since Lohnert and Reutler proposed the concept of modular high-temperature gas-cooled reactor (HTGR) in the end of the 1970s, various countries have put a lot of attention on development of modular HTGR for its high degree of passive safety and the potential to provide high-temperature fluid for process heat applications [1, 2]. Several reactors of various power levels have been constructed in the 20th century, such as AVR and THTR-300 in Germany, Peach Bottom (as the smaller test reactor) and Fort St. Vrain (as the demo plant) in USA, HTTR (30 MW thermal) in Japan, and HTR-10 (the 10 MW high-temperature gas-cooled test reactor) in China. At present, all HTGRs except for HTTR and HTR-10 are in decommisioning since many years. China is designing and constructing its commercial demonstration HTGR plant which is called HTR-PM (high-temperature gas-cooled reactor-pebble-bed module) now.
China’s HTR-10 was a pebble-bed modular test HTR, which was designed, constructed, and operated by Institute of Nuclear and New Energy Technology (INET) of Tsinghua University. In December of 2000, the HTR-10 reached criticality for the first time and in January of 2003 it achieved full power operation with a thermal power output of 10 MW and a coolant outlet temperature of 700°C [3]. As time goes on, many planned commissioning tests have been performed on HTR-10 to test the performance of the spherical fuel elements and to demonstrate its passive safety characteristics. The designing codes used for the HTR-10 were also validated against the test results at the same time [4–7].
The HTR with a gas turbine in direct cycle mode promises higher electricity generation efficiency. To verify the technology, INET first plans to raise the outlet temperature to 750°C in the HTR-10 core with the same sphere fuels and to replace the steam generator with a gas turbine power conversion unit. The new designed reactor is named HTR-10GT, and its main operating parameters are listed in Table 1.
The preliminary scheme of the HTR-10GT is to replace the steam generator with a helium gas turbine, while keeping pressure boundary of the primary loop system and the layout of the reactor pressure vessel (RPV) unchanged. Figure 1 shows the layout and schematic of the HTR-10GT. The key parameters of the protection system of the HTR-10GT are similar to those of the HTR-10, but the parameters related to the secondary loop, such as flow rate of feedwater and steam fraction, do not apply. The limiting temperature of helium flow passing through the core inlet and outlet is increased by 50°C and 80°C, respectively. In addition, the ratio between flow rates of the primary loop and the secondary loop in the HTR-10 is changed to a normalized value between the flow rate of the primary loop and the power of the gas turbine in the HTR-10GT. The detailed parameters of the protection system of the HTR-10GT are illustrated in Table 2. The operating temperatures of the components contained in reactor pressure vessel and hot gas duct rise as the helium temperatures at the core inlet and outlet increase. However, these temperatures remain well below the components design temperatures of the HTR-10, as a large safety margin has been taken into account.
(a)
(b)
The passive safety characteristics of the HTR-10 have been approved by the National Nuclear Safety Administration (NNSA) of China, after analysis of design basis accidents (DBAs) and beyond design basis accidents (BDBAs) was completed [8]. However, because of the differences between the main operating parameters of the HTR-10 and HTR-10GT, China’s nuclear regulations require that new safety analysis of the HTR-10GT be performed at operating and accidental states and certified. The paper studied three DBA cases induced by station blackout, by one control rod withdrawal out of the core by mistake, and by earthquake. Transient analysis of the three cases was performed using the THERMIX code, and safety characteristics of the HTR-10GT are discussed in detail in the paper. The results will be meaningful to the HTR-PM, as the helium temperature at the core outlet of the HTR-PM is similar to the HTR-10GT.
2. Analysis Tools and Models
The design basis accidents of HTR-10 were analysed with THERMIX, a thermal hydraulic code system developed by KFA-Jülich (now FZJ) of Germany. The THERMIX code has been applied for the simulation of the helium circulator trip ATWS test. THERMIX has been validated and verified against data from experiments performed at KFA [9], benchmark calculations for the GT-MHR [10], and extensive experimental programs carried out on the THTR-300 [11]. At present, the code is under further validation in INET through data of the tests on the HTR-10 to improve the design methodology for future HTGRs. In the study, THERMIX was used to analyse the DBAs of the HTR-10GT.
The general code structure of THERMIX adopts a two-dimensional cylindrical geometry and consists of a general-purpose steady-state or transient heat conduction code and a quasi-steady-state convection code. The code system consists of a two-dimensional transient solid temperature model (Thermix), a quasi-stationary gas flow model (Konvek), a primary loop model (Kismet), a point-neutron kinetics model (Kinex), and a graphite corrosion model. THERMIX is able to analyse the thermal hydraulic performance of pebble-bed HTGRs under normal operation and accident conditions, including the pebble-bed reactor core as well as the primary loop, the helium blower, and the steam generator. Brief descriptions on the four modules are introduced in the following part and some detailed description of the equations used in the modules can be seen in [12].
2.1. Neutron Kinetics Module
Nuclear physical characteristics are predicted by a conventional point kinetics model with six groups of delayed neutrons in this module. Fission power is estimated through a balance of feedback reactivity and external reactivity. The former reactivity results from temperature variation of fuel, moderator, and reflector as well as change of xenon concentration, while the latter one is induced by movement of control rods or external inserted reactivity such as water ingress. In addition, decay heat is calculated by kinetic equations of the fission products.
2.2. Solid Heat Conduction Module
The conduction module includes a two-dimensional transient temperature model for solid materials and a one-dimensional transient temperature model for spherical fuel elements. Time-dependent general heat conduction equation is solved with temperature-dependent material properties in this module. In the simulation, a two-dimensional rotation symmetrical model in , geometry is established for heat conduction of the HTR-10GT. The computational model consists of 35 radial and 61 axial mesh points, as shown in Figure 2. It describes most of the HTR-10GT components such as pebble-bed core, graphite reflectors, carbon bricks, and reactor pressure vessel with 44 different material regions.
2.3. Gas Convection Module
A quasi-stationary gas flow model is used in the convection module to simulate the complex flow conditions inside a pebble-bed HTGR. This module solves steady-state continuity, momentum, and energy equations of gas in the reactor, coupled with a given time-dependent temperature profile of solid structures. The computational model covers main flow passages in the HTR-10GT, for example, reactor core, cold helium channels, cold and hot helium plenums, and control rod channels.
2.4. Primary Circuit Module
In this module, pressure, temperature, and mass flow rate of coolant in the primary loop are calculated. A quasi-stationary model, consisting of steady-state continuity, momentum, and energy equations of fluid, is used to predict the above-mentioned parameters. The calculating model of the HTR-10GT primary loop contains hot gas duct, power conversion unit in steam generator vessel, and so forth.
3. Description of the Accidents
All transients of the HTR-10GT, including DBA and BDBA, have been described in the “final safety analysis report” by the INET. Three typical accidents will be presented to illustrate the safety characteristics of the HTR-10GT in the following. In accident analyses, we always assume conservatively that the first scram signal fails to work. The protection system will scram the reactor when the second protective parameter reaches its limiting value.
The simulation study comprises three DBA cases of the HTR-10GT. The first one is induced by station blackout. Once a station blackout occurs, the helium blower and the steam turbine will shut down immediately, leading to a loss of coolant flow and a decrease of heat exchange from the primary loop. As the core continues to be heated up, the fuel temperature will rise and the pressure and temperature in the primary loop will increase, too. The core power declines due to negative temperature feedback. As soon as the offsite power is lost, the control rods drop automatically by gravity. On the other hand, the protection system would detect a scram signal when the pressure, the flow rate of the primary loop, or the turbine power reaches specified values.
The second case is induced by a control rod withdrawal out of core by mistake. The positive reactivity inserted is determined by location of the control rod in the reflectors and operating state. The performed analysis is for typical operating conditions with full rated power of an equilibrium core and with reactivity of a control rod less than 1%. The total reactivity inserted by a control rod withdrawal is shown in Figure 3. In this case, the protection system receives three scram signals: too high neutron flux in the relative power level referenced to the rated power (≥1.23), too high helium temperature at core outlet (≥800°C), and too large absolute sliding rate of the primary system pressure (≥0.031 MPa/min).
The last case calculated is caused by earthquake. When an earthquake occurs in the HTR-10GT, the compactness of the pebble bed will increase due to violent shaking, which will lead to a decreasing neutron leakage rate. There is also a relative shift between the top of the active core and the control rods in the reflectors. This results in a positive reactivity insertion. The horizontal acceleration at the surface of the earth induced by an earthquake is 2.0 m/s2 during normal operation. The shaking experiments on pebble beds in Germany showed that horizontal forces caused by an earthquake would result in a densification of the pebble-bed core, reaching a peak after 3~4 minutes as earthquake forces continue. The initial packing fraction of a randomly composed pebble-bed core is 0.61. If the surface horizontal acceleration increases from 2.0 m/s2 to 10 m/s2, the peak packing fraction of the bed increases from 0.615 to 0.64, as specified in the HTR-10 final safety analysis report. In our analysis, a conservative hypothesis is taken demonstrating that the packing fraction of the HTR-10GT core increases during the earthquake from 0.61 to 0.64—the maximum value attainable in a random packing of spheres. The total reactivity inserted by an earthquake is 1.24% and 0.788%, calculated by VSOP, for an initial core and an equilibrium core, respectively, which can be seen in Figure 4. The time-dependent variation of reactivity in the plot will be used in the analysis. After an earthquake, the HTR-10GT protection system will receive two scram signals: too high neutron flux in relative power level referenced to the rated power (⩾1.23) and too short reactor period (⩽20 s).
The accident detection and protection system of the HTR-10GT is triggered by scram signals. As mentioned above, the first scram signal is assumed to be skipped in the analysis. After the second scram signal, the protection system takes actions to shut down the reactor, which include dropping the control rods into the reflectors by gravity, shutting down the primary circuit blower, stopping the gas turbine, and isolating the primary circuit. The accidents mentioned above are classified to level II accidents [8], which may happen once a year, and the reactor can restore normal operation after shutdown and taking some measures. During these accidents, the reactor can scram and residual decay heat will be removed from the reactor vessel by the reactor cavity cooling system through heat transfer in form of conduction, convection, and radiation among in-vessel structures and the core.
4. Hypothesis and Calculating Conditions
The spherical fuel elements containing coated TRISO particles can effectively retain all relevant radioactive fission products up to the temperature of 1620°C. In the first phase of the HTR-10 project, the coated particle fuel was experimentally proven to keep its integrity and retain the radioactive fission products effectively up to 1250°C. So the maximum temperature of fuel elements is set as 1230°C under all accident conditions for HTR-10. For the HTR-10GT, the peak fuel temperature permitted in accidents is set to be 1230°C in the beginning. After more tests on spherical fuel elements, the setting point of fuel peak temperature in accidents is increased to 1620°C, which is used in the HTR-PM and the second phase of the HTR-10GT designing.
The study analyses typical operating cases of the HTR-10GT in full power for the three accidents consequences. The assumed conditions when the accidents occur are the following:(i)The core operating power is the rated power with an addition of 5% due to measuring error.(ii)The cooling flow passing through the core is 86% of the rated pump flow.(iii)The core is in an equilibrium state and the total reactivity inserted by a control rod withdrawal is 1%.(iv)One control rod in the reflector is drawn up at a speed of 1 cm/s.(v)The first scram signal is skipped and the protecting system takes actions following the second signal.(vi)The worst effect of instruments measuring error is considered when scram signals are triggered.(vii)Longest time delay before the protecting measures action is considered.(viii)When the reactor scrams, the flow rate in the primary loop decreases to 0.0 kg/s in 0.25 seconds and the gas turbine is bypassed in 0.25 s (which is an extremely conservative condition).
5. Computational Results
For the HTR-10GT, the initial core and the equilibrium core have different physical characteristics. In fact, there is no truly initial core for the HTR-10GT, as the HTR-10 will have been operating for years. However, the three cases studied here are based on an initial core similar to that of the HTR-10 in order to better compare the accident consequences. Of course, the cases for an equilibrium core were simulated, too.
5.1. Accident Induced by Station Blackout
Tables 3 and 4 indicate the key events following a station blackout of the HTR-10GT. The accident consequences of the HTR-10 induced by station blackout are compared in Tables 3 and 4, too. Figures 5–10 show the plots of important parameters of HTR-10GT in accident for both the startup core and the equilibrium core, which consist of reactor power, peak fuel temperature, average fuel temperature, temperature feedback reactivity, total reactivity, and primary system pressure.
Once a station blackout occurs, the helium blower and the gas turbine would shut down quickly. 20 seconds later, the first scram signal “absolute sliding rate of the turbine power” reaches its setting value of 28%/min, but it is skipped. The second signal is detected after 38.2 s and 66.9 s for the initial core and the equilibrium core, respectively. Then the protection system takes actions to scram and the HTR-10GT shuts down immediately. The peak fuel temperature in the accident is calculated to be 1066°C and 989°C for the startup core and the equilibrium core, respectively. For the HTR-10, the corresponding temperatures are 1033°C and 944°C. The peak fuel temperature of the HTR-10GT is about 45°C higher than that of the HTR-10. The difference between the peak fuel temperatures of the HTR-10GT and HTR-10 is consistent with the difference in the steady-state core outlet temperatures.
From Table 3, we can see that the second scram signal “absolute sliding rate of the system pressure” of the HTR-10GT reaches its setting value later than the HTR-10. This is due to the fact that the system pressure of the HTR-10GT is lower than the HTR-10. Figure 10 shows a plot of the transient system pressures during the accident. From the corresponding plots of the temperature feedback reactivity and the total reactivity in Figures 6 and 7, one can see that the second signal is detected much later for an equilibrium core than an initial core. The shutdown in an initial core takes place earlier and its power decreases more quickly than in an equilibrium core, as shown in Figure 5. Figures 8 and 9 depict the peak and average fuel temperatures. As the peak fuel temperature is lower than 1230°C, it can be concluded that the HTR-10GT remains in a safe condition in a station blackout accident scenario.
5.2. Accident Induced by a Control Rod Withdrawal out of the Reflectors
Tables 5 and 6 show the important events since a control rod is withdrawn out of the reflectors at a speed of 1 cm/s by mistake. The accident consequences of the HTR-10 are also compared in Tables 5 and 6. Figures 11–18 depict plots of important parameters of the HTR-10GT in accident for both an initial core and an equilibrium core, which consist of reactor power, peak fuel temperature, average fuel temperature, temperature feedback reactivity, total reactivity, flow rate of primary loop, system pressure, and helium temperature at core inlet and outlet.
When a control rod is withdrawn out of the reflectors in 155 seconds by mistake, core power increases quickly due to a positive reactivity inserted. The reactivity worth of one control rod of the HTR-10GR is shown in Figure 3, which is larger than that of the HTR-10. As core power increases, the first scram signal triggered by high flux is ignored in the simulation. The second signal triggered by high helium temperature occurs about half a minute later. Then all control rods begin to drop due to the shutting down actions taken by the protection system, which leads to the HTR-10GT shutting down safely.
From Table 5, we can see that neutron flux of the HTR-10GT core increases more quickly than that of the HTR-10, because the absolute value of its feedback coefficient of reactivity caused by temperature change becomes smaller as the core operating temperature increases. Thus, for the HTR-10GT, the power increases rapidly and the peak power is higher, which leads to an earlier scram signal for the second time. The peak fuel temperature increases in the accident by about 30°C, which is smaller than 50°C—the helium temperature increased at the core outlet.
The plot in Figure 11 shows that the power of an initial core in accident increases slower than an equilibrium core, so the peak power is lower, which results in a higher peak fuel temperature. This is due to the fact that the initial core has a small value of absolute temperature reactivity feedback coefficient, as shown in Figure 17. One can also see in Figure 12 that the initial core of the HTR-10GT has a higher peak of fuel temperature, while the equilibrium core has a higher average temperature of fuel, as shown in Figure 13. This is also a result of the reactivity characteristics of the HTR-10GT core. Figure 16 shows the helium temperature at the core inlet and outlet.
When the second scram signal is detected, the protection system takes shutdown actions. Dropping control rods leads total reactivity to decrease quickly, as shown in Figure 14. In Figure 15, we can see that isolating the primary loop makes the helium flow in it nearly stop. The curves in Figure 18 show that the system pressure remains almost unchanged for both cores during the accident. The peak fuel temperature in accident is calculated to be 1201°C and 1066°C for the initial core and the equilibrium core, respectively, while for the HTR-10 the temperatures are 1170°C and 1041°C, respectively. The peak fuel temperature of the HTR-10GT is higher than that of the HTR-10, but both are lower than 1230°C. The HTR-10GT remains in safe conditions in a control rod withdrawal accident scenario [13–15].
5.3. Accident Induced by Earthquake
Tables 7 and 8 depict the important events in the HTR-10GT following an earthquake. The accident consequences of the HTR-10 are also compared in Tables 7 and 8. Figures 19–26 show the plots of key parameters of the HTR-10GT in accident for both an initial core and an equilibrium core, which consist of reactor power, peak fuel temperature, average fuel temperature, temperature feedback reactivity, total reactivity, flow rate of primary loop, system pressure, and helium temperatures at core inlet and outlet.
In less than 150 seconds after an earthquake occurs, a total reactivity of 1.24% is inserted into the startup up core and 0.788% is inserted into the equilibrium core. Core power begins to go up as soon as the positive reactivity insertion starts. Then the core temperature increases and the reactor will shut down by itself due to negative temperature reactivity feedback, even though there is no shutdown action. The first scram signal triggered by a short period measurement is soon received but is ignored as assumed. Two seconds later, the second signal (high flux) is detected and the protection system scrams the reactor. The peak fuel temperatures in the accident are 1067°C and 980°C for the initial core and the equilibrium core, respectively, while for HTR-10 the temperatures are 1038°C and 945°C, respectively. The peak fuel temperature of HTR-10GT in accident is about 30°C higher than that of HTR-10. Shortly afterwards, the HTR-10GT reactor shuts down safely. Both fuel peak temperatures are lower than 1230°C. The HTR-10GT remains in a safe condition in an earthquake accident scenario.
Tables 7 and 8 tell us that the earthquake accident consequences in the HTR-10GT progress more quickly than in the HTR-10, because the HTR-10GT operates at a higher temperature and it has a faster temperature feedback. The peak fuel temperature of the HTR-10GT is higher than that of HTR-10, which leads to a fast reactivity feedback that causes the peak power of HTR-10GT less than that of HTR-10. The peak fuel temperature increase in the accident is about 30°C, which is lower than 50°C—the helium temperature increased at core outlet.
Comparing Figures 11 and 19, one can find that the core power increases more quickly in the earthquake accident than in the control rod withdrawal case for different positive insertion speeds. Because of the temperature negative feedback of reactivity, the peak and average fuel temperatures only rise a little as shown in Figures 20 and 21. Total reactivity plotted in Figure 22 and temperature feedback reactivity plotted in Figure 25 illustrate a relatively short time to reach peaks of power and temperature. One can also see that in the earthquake accident the flow rate in the primary loop as shown in Figure 23 and the helium temperature of core as plotted in Figure 24 proceed smoothly. In the scram, the system remains in a high pressure condition, which can be seen in Figure 26, and it shows a similar behavior to that in a control rod withdrawal accident. In an earthquake accident, protection system takes measures to scram and leads to safe shutting down, which is similar to a control rod withdrawal accident.
6. Conclusions
The HTR-10GT is the second phase of HTGR technology development in China. It is based upon the reactor core of HTR-10 and replaces the steam generator with a helium turbine generator. Although its physical core remains the same as HTR-10, the HTR-10GT has different operating parameters and its core runs at a higher temperature. So thermal hydraulic safety analysis must be performed for the final safety analysis report. Under the new operating parameters, three design basis accidents were simulated with the THERMIX code system.
From the preceding analysis, it can be concluded that, in the simulated DBAs of the HTR-10GT, there is no chemical reaction in the core and the peak fuel temperature is 1201°C, which has a tolerance to the safe margin of 1230°C. As the spherical fuel elements containing TRISO coated particles can effectively retain radioactive fission products up to the temperature of 1620°C under the given normal operating conditions, there is negligible additional radioactivity release expected and no fuel element damage in DBAs induced by either a station blackout, an inadvertent control rod withdrawal, or an earthquake. The HTR-10GT remains in safe condition in all three cases.
Conflicts of Interest
The authors declare that there are no conflicts of interest regarding the publication of this paper.
Acknowledgments
The authors would like to thank Professor Zhou Zhiwei and Dr. Zheng Yanhua for kindly contributing to the study. This work has been supported by the National S&T Major Project (Grant no. ZX06901).