Abstract
Interest in evaluation of severe accidents induced by extended station blackout (ESBO) has significantly increased after Fukushima. In this paper, the severe accident process under the high and low pressure induced by an ESBO for a small integrated pressurized water reactor (IPWR)-IP200 is simulated with the SCDAP/RELAP5 code. For both types of selected scenarios, the IP200 thermal hydraulic behavior and core meltdown are analyzed without operator actions. Core degradation studies firstly focus on the changes in the core water level and temperature. Then, the inhibition of natural circulation in the reactor pressure vessel (RPV) on core temperature rise is studied. In addition, the phenomena of core oxidation and hydrogen generation and the reaction mechanism of zirconium with the water and steam during core degradation are analyzed. The temperature distribution and time point of the core melting process are obtained. And the IP200 severe accident management guideline (SAMG) entry condition is determined. Finally, it is compared with other core degradation studies of large distributed reactors to discuss the influence of the inherent design characteristics of IP200. Furthermore, through the comparison of four sets of scenarios, the effects of the passive safety system (PSS) on the mitigation of severe accidents are evaluated. Detailed results show that, for the quantitative conclusions, the low coolant storage of IP200 makes the core degradation very fast. The duration from core oxidation to corium relocation in the lower-pressure scenario is 53% faster than that of in the high-pressure scenario. The maximum temperature of liquid corium in the lower-pressure scenario is 134 K higher than that of the high-pressure scenario. Besides, the core forms a molten pool 2.8 h earlier in the lower-pressure scenario. The hydrogen generated in the high-pressure scenario is higher when compared to the low-pressure scenario due to the slower degradation of the core. After the reactor reaches the SAMG entry conditions, the PSS input can effectively alleviate the accident and prevent the core from being damaged and melted. There is more time to alleviate the accident. This study is aimed at providing a reference to improve the existing IPWR SAMGs.
1. Introduction
After the Fukushima accident, the severe accident due to extended SBO caused widespread concern. For large distributed reactors, scholars at home and abroad have conducted many studies on severe accidents caused by SBO. Common systematic analysis severe accident analysis codes MAAP and MELCOR have been used to calculate the accident sequence process of different large distributed nuclear power plants under severe accidents caused by SBO, and the mitigation capacity of related safety facilities has been calculated and evaluated [1–4]. In addition, the phenomena in the SBO transient process and safety system design are the hot research area. Korean Atomic Energy Institute [5] (KAERI) developed a phenomenon identification ranking table (PIRT) in the OECD-ATLAS project to identify the main parameters affecting the thermal hydraulic phenomena in SBO transients. Taking into account the important phenomena in the PIRT results, it can be confirmed that ATLAS can simulate the main thermal hydraulic phenomena during the SBO transient as realistically as possible. Chang et al. proposed the design idea of an integrated PSS that can perform various passive safety functions [6]. The simulation results of IPSS show that the decay heat can be fully eliminated in the accident of SBO. Moreover, the molten core can be retained in the vessel by the passive in-stack retention strategy of the integrated PSS.
Above researches have studied the accident process, thermal hydraulic response, and passive safety system evaluation of severe accidents caused by SBO in some large distributed reactors through systematic severe accident analysis codes and have obtained some good research results. However, there are few studies on severe accidents of IPWR. In addition, the system analysis code is relatively simple. It is aiming to cover the whole process of severe accident phenomenon. The system is discretized coarsely, and the conservation equation is simplified. For mechanism phenomena in severe accidents, the model may not be accurate enough. Due to the large difference between the traditional distributed arrangement and the integrated small stack arrangement, the trend of the accident and the change of key parameters may be different during the normal operation or accident. There are few studies on SBO severe accidents on small IPWRs over the world. Therefore, the core degradation mechanism in a small IPWR needs to be further studied due to its special design characteristics and safety characteristics. It could provide reference for severe accident management of small IPWRs.
SCDAP/RELAP5 is characterized by its detailed, mechanistic models of severe accident phenomena; however, the calculations can be rather time-consuming. SCDAP/RELAP5 typically uses on the order of hundreds of hydrodynamic components to model the primary system. SCDAP/RELAP5 employs the detailed mechanistic models for single- and two-phase flow. The one-dimensional, semi-implicit forms of the conservation equations for the two-fluid model are solved. The robust RELAP5 modeling is clearly superior to the thermal hydraulic models of the other codes. Another significant difference is the detail in which the core transitions from an intact state to a degraded state. The most detailed models for material interactions and relocations have been incorporated into SCDAP/RELAP5 [7].
In this paper, the core degradation of high pressure and low pressure in ESBO scenarios for IP200 is simulated by the SCDAP/RELAP5 code. The design characteristics of the IP200 are carefully considered in modeling. Diverse early thermal hydraulic behavior and core degradation process of IP200 in integrated and low power design is compared with a large distributed reactor. Then, the natural circulation in RPV, reaction mechanism of zirconium with the water and steam, core cladding oxidation, and hydrogen generation are studied. As IPWR differs greatly from the large distributed reactor in terms of the system structure and parameter design, it is necessary to evaluate the SAMG entry condition for IP200 severe accident mitigation. Thus, referring to the EPRI TBR and the Westinghouse PWR severe accident management entry conditions, the severe accident entry conditions for the IP200 reactor are determined by calculations. Finally, the effect of the passive safety system on severe accident mitigation is quantitatively evaluated. This study can provide a reference for practical engineering and design of SAMG for IPWR.
2. System Design and Modeling
2.1. Brief Description of IP200
IP200 is a newly developed IPWR by Harbin Engineering University, whose major design parameters could be referenced from previous papers [8–11]. Its main purpose is to generate electricity for the floating nuclear power plant (NPP). It is also able to provide energy for coastal cities and remote islands far from the mainland. The integral system layout is adopted for IP200, which can benefit from the simplified structure, light weight, and the elimination of large diameter piping, hence eliminating large-break loss of coolant accident (LOCA). All the components, including twelve once-through steam generators (OTSGs), four main coolant pumps (MCPs), and the core, are located in the reactor vessel, as shown in Figure 1. The twelve steam generators are spaced evenly at the annulus between the steam generator inlet region and the lower plenum. The twelve steam generators absorb the 220 MW heat energy in the coolant. With the heat energy, feedwater in OTSG tubes becomes superheated steam.
Its passive safety system is mainly composed of three parts: SG water supply tank, core water supply tank, and residual heat-removal exchanger. The passive safety system is fitted with an isolation valve. These valves are closed under normal operation. In the event of an accident, water is injected into the core and the secondary side of the SG by a trigger signal or by the operator manually opening the valve, with the residual heat of the core derived. The integrated pressurized water reactor canceled the large-size pipeline of the main circuit and radically eliminated the large-break accident. However, the marine IP200 reactor still uses the main pump forced circulation, and it is necessary to consider the working conditions of the main pump and the feed pump failed after the power failure. This study assumes the extreme conditions of long-term full-field power-off superposition of emergency power failures, intending to conservatively evaluate the ability of the safety system to mitigate accidents.
2.2. Calculation Model
The SCDAP/RELAP5 program is developed by the US Nuclear Regulatory Commission (NRC) in conjunction with Innovative Systems Software (ISS). The model has been verified by QUENCH/CORA and is widely used in numerical research and safety analysis.
The model of the reactor and safety system is based on the SCDAP/RELAP5 code, and the nodes are shown in Figure 2. The 014/015/016/017 represents the core hot aisle, respectively, and 018 represents the bypass. The built-in pressurizer space is represented by 026, and 037/047 represents the safety valve and the pressure relief valve, respectively, which can be deployed either automatically or manually according to the trigger limit. 115/116 denotes a double-sided heating passage on the primary side of the OTSG, and 314 denotes a secondary side. Feed water and steam are given by separate time-dependent volume boundaries. The core make-up tank (CMT) of the passive safety injection system is indicated by 064. The passive residual heat-removal system (PRHRS) shares part of the pipeline with the secondary circuit, which reduces the complexity of the system. 253 denotes the SG water supply tank, 258/300 denotes the secondary circuit side and the seawater side of the residual heat-removal exchanger, respectively, and 302 denotes the final heat sink (seawater). The fuel assembly is established based on the SCDAP model. The fuel assembly is divided into four layers radially outward and ten layers axially upward with the core bottom center as the reference (Figure 3). To simulate the coolant flow changes when the core loses its geometry in the event of a severe accident, the establishment of the core model considers the flow mixing of each channel.
2.3. Steady-State Calculation
Before simulating an ESBO, this research selects the key parameters of the primary system for steady-state calibration. The calculation time is 1000 s. The results of the steady-state simulation are presented in Table 1. All the steady-state parameters agree well with operating conditions (relative errors less than 2%). The subsequent accident scenarios described in this research are all based on this steady state as the initial condition.
3. Results and Evaluations
For the low-pressure core melt (the pressurizer pressure relief valve (PRV) opening all the time, depressurization) and high-pressure core melt (the pressurizer safety valve with the continuous opening and closing, no depressurization), the program calculates 20,000 s. The ESBO accident begins after 1000 s of steady-state operation, with the water supply to the second circuit lost, and the main pump and emergency power supply are both failed. Considering conservative assumptions, 10 s after the accident, the reactor is emergency shutdown. The decay heat continues to heat up the core, assuming all safety systems are not available. This section compares the core damage process of two scenarios. This section is limited to the in-pile stage of the accident’s progress, that is to say the heating and melting of the core. Detailed results show that compared to the typical large distributed nuclear power plant [12, 13], the time course of the IP200 severe accident is faster.
3.1. Pressure
Figure 4(a) shows the main circuit pressure. In the calculation, the pressurizer safety valve is set to open when the pressurizer pressure exceeds 15.8 MPa and closes when it is lower than 16.0 MPa to simulate the cycle behavior of the safety valve opening and closing. For the high-pressure scenario, the initial pressure will fluctuate greatly after the accident starts (mainly because the reactor takes a while to heat the coolant in the reactor coolant system (RCS) to boil). The pressurizer pressure then fluctuates around 15.8 MPa, until the calculation is terminated. For the low-pressure scenario, the pressurizer PRV will be fully open all the time when the RCS pressure exceeds 15.8 MPa. This safety valve stuck condition caused the TMI-2 accident to occur. Due to the rapid flow of high-pressure coolant from the safety valve, the RCS pressure is rapidly reduced to a pressure equilibrium with the containment (0.1 MPa, 1070 s).
(a)
(b)
(c)
(d)
(e)
(f)
3.2. Water Level
Figures 4(b) and 4(c) show the water level in the pressurizer and core. The most prominent feature of IP200 is that the water capacity of per unit thermal is very low, which will cause a faster loss of the coolant. The initial rise of the pressurizer water level in the high-pressure scenario is due to the rapid rise of pressure to opening the PRV after the accident occurs; when the PRV opens, the coolant is discharged and the coolant is forced to rise to fill the pressurizer space. After 1225 s, as the coolant is continuously discharged, the pressurizer water level begins to shrink and the pressurizer is drained when it is calculated to 3780 s. The core water level is also decreasing, and the core begins to uncover (2.3 m, 4215 s), accompanied by a large amount of steam, until the core water level drops to the core separator (0.8 m, 6070 s) and the core water level is completely dried at 7630 s. In the lower-pressure scenario, the water level of the pressurizer and the core increased briefly in the early stage of the accident, but after 1015 s, the water level began to drop rapidly, and the pressurizer is emptied at 1210 s. The core water level also dropped rapidly, and the core began to be exposed at 1045 s. After that, the core water level dropped slowly until the 7590 s core is completely exposed. At the end of the transient calculation, there is still a smooth water level of 0.33 m in the lower plenum.
3.3. Temperature Distribution
The maximum core surface temperature in SCDAP is represented by the variable bgmct, which represents the maximum cladding temperature until the cladding melts and the hottest spot in the core. Figures 5 and 6 show the core fuel temperature distribution in the high-pressure and lower-pressure scenario, respectively. The integrated design makes the main circuit placed in RPV, shortens the length of the main circuit, reduces the flow resistance of the pipeline, and is conducive to the formation of the natural circulation of the main circuit. This makes the core temperature rise slower in the early stages of the accident. The maximum surface temperature peak in the high-pressure and lower-pressure scenario is shown in Figure 4(d). In the high-pressure scenario, the Ag-In-Cd alloy begins to melt first due to the heat of decay, and the core temperature begins to rise to 940 K at 5880 s. In the following period of time, the temporary drop in temperature can be noticed, and the temperature starts to rise after falling to 750 K at 6270 s. When the temperature reaches 1001 K at 7705 s, the zirconium alloy and the water vapor begin to react with the zirconium-water reaction, and hydrogen gas is produced (the maximum hydrogen generation rate is 0.086 kg/s at 10015 s) with a large amount of heat released, which causes the core temperature to rise rapidly. During this process, part of the material that is melted is repositioned to a lower temperature location in the lower part of the core, and a blockage is formed in the lower part of the assembly, which causes the flow distribution to transfer from the hotter passage to the cooler passage, exacerbating the melting of the remaining zirconium alloy. When the maximum surface temperature of the core reaches 2874 K, the fuel and oxidized cladding (U‐Zr)-O2 will melt and begin to form a molten pool at 12080 s. Then, the maximum surface temperature of the core reached a maximum of 2996 K at 12965 s and stabilized at 2874 K after 13055 s. For the lower-pressure scenario, as the pressurizer safety valve is opened, the pressure in the primary circuit drops rapidly, and the core flashes to generate a large amount of water vapor. The core is rapidly oxidized, and the temperature rises sharply to 1001 K at 1220 s. The zirconium alloy begins to react with water vapor to generate hydrogen gas, which releases a large amount of heat, further aggravating the temperature rise. The maximum surface temperature of the core quickly reaches 2853 K at 1880 s. The formation of a molten pool begins. The maximum surface temperature of the core reached a maximum of 3130 K at 3835 s and stabilized at 2960 K after 16500 s.
(a)
(b)
(c)
(d)
(e)
(f)
(a)
(b)
(c)
(d)
(e)
(f)
3.4. Hydrogen
Figure 4(e) shows the rate of hydrogen generation and total hydrogen production during transients. The maximum rates of hydrogen generation in high-pressure and lower-pressure scenarios are 0.086 kg/s (10015 s) and 0.439 kg/s (1570 s), respectively, while total hydrogen production is 39.91 kg and 16.16 kg, respectively. In the high-pressure scenario, since the coolant drains slowly and does not boil instantaneously, the core melting process is delayed. About the lower-pressure scenario, the coolant rapidly boils to generate steam and quickly drains through the stuck opening safety valve, which causes the zirconium alloy cladding to oxidize quickly. The total hydrogen production during the high-pressure scenario process greatly exceeds the lower-pressure scenario (although the hydrogen generation rate is very high under the lower-pressure scenario). Figure 4(e) also shows that, for lower-pressure and high-pressure scenarios, almost no hydrogen is produced after 10.850 s and 12.525 s, respectively.
3.5. Core Molten Pool
The molten pool radius and formation time for two transients are shown in Figure 4(f). According to the core node diagram in Figure 3, the core is divided into four layers radially outward and ten layers axially upward with the core bottom center as the reference. Then, according to the calculation results, the temperature of each core node can be obtained, and then the two-dimensional temperature distribution diagram of the longitudinal section of the core can be obtained. Figures 5 and 6 show the core temperature distribution and the formation process of the molten pool in high-pressure and lower-pressure scenarios, respectively. For the lower-pressure scenario, the core begins to oxidize at 1400 s very early. As the heat discharge is deteriorative, the core oxidation range is also expanding, with a large amount of heat released, further increasing the core temperature and causing the core start melting at 1830 s. Then, a molten pool forms at 1880 s. As the accident progressed, the molten pool gradually expanded and continued to develop to the lower part of the core, eventually starting falling from the zone around the core center (not core center) to the lower head at 3855 s. In this process, the maximum radius of the molten pool is 0.726 m at 5895 s. For the high-pressure scenario, the core start oxidation time at 7710 s is delayed by 1.75 h compared with the lower-pressure scenario. Since the water level of the lower head has also been reduced to zero, less water vapor in the RPV is unfavorable for the zirconium-water reaction. The core oxidation process is slower than the lower-pressure scenario, making the core melt at 12075 s after the initial oxidation 1.2 h (430 s under the lower-pressure scenario), and forms a molten pool at 12090 s. After that, the molten pool continued to develop and drop from the center of the core bottom to the lower head at 12975 s. The radius of the molten pool is up to 0.706 m at 12300 s. The duration from core oxidation to corium relocation is about 5265 s, and the maximum temperature of liquid corium is close to 2996 K in the high-pressure scenario. The two data 2455 s and 3130 K are, respectively, in the lower-pressure scenario. The latter has a shorter duration and a higher maximum temperature than the former.
4. PSS Input
4.1. SAMG Entry Conditions
The primary task of the SAMG is to determine the entry conditions of severe accident, which determine the transition of the plant from the Emergency Operating Procedures (EOPs) to the SAMG. The transition point from accident prevention to accident mitigation should be set at the point before the “core is about to be damaged” or “the core begins to break.” The choice of the transition point may affect the extent and sequence of subsequent threats to the fission product barrier.
The main monitoring parameters are identified by the basic report of guidelines for severe accident management EPRI TBR [14]: damage to the reactor coolant system, including cladding oxidation, damage to the core, and accumulation of most core debris into containment (outside the PRV). The determination of the inlet conditions is based on the core oxidation mechanism in the EPRI TBR and is determined by extensive analytical work. Studies have shown that the zirconium-water reaction is more obvious when the core temperature is 1273–1373 K. Failure to take timely measures may result in extensive damage to the core. Therefore, the severe accident management guidelines should be transferred before the core temperature reaches this temperature. Usually, the entry condition of the Westinghouse PWR severe accident management is that the core outlet temperature reaches 650°C [15]. For IP200, because it is different from large distributed reactors, a separate analysis is needed to determine the severe accident entry conditions.
This paper selects the ESBO accident in high-pressure and lower-pressure scenarios to analyze the entry conditions of severe accidents.
Selecting the fuel temperature continues to rise and exceeds 1 300 K as a distinct starting point for the zirconium-water reaction. For the high-pressure scenario, according to Figure 4(d), it can be seen that, after the core is completely exposed, the fuel temperature gradually increases due to the decrease of heat transfer capacity, and the fuel temperature rises to 1001 K at the time point 1 (7705 s), with the zirconium-water reaction beginning to occur. By the time point 2 (8620 s), the fuel temperature rises to 1300 K and the zirconium-water reaction become apparent. The severity of the oxidation reaction can be assisted by the generation of hydrogen and the rate of hydrogen production. Figure 7(a) shows the change in the hydrogen rate over time and total hydrogen production in the core. It can be seen that, after the corresponding time point 2 at the fuel temperature of 1 300 K, the hydrogen production rate has increased significantly. At time point 2, the total hydrogen production in the core is relatively small, and then hydrogen is produced in large quantities. Therefore, it can be said that the drastic zirconium-water reaction is about to start at the time point 2, and the core will deteriorate sharply if no effective mitigation measures are taken. At time point 2, the core outlet temperature is 1267 K. For the lower-pressure scenario, after the core is in extensive exposure, the heat transfer capacity is reduced and the fuel temperature is gradually increased. By the time point 1 (1235 s), the fuel temperature rises to 1001 K with the zirconium-water reaction beginning to occur. At the time point 2 (1405 s), the fuel temperature rises to 1300 K, and the zirconium-water reaction becomes apparent. If no effective mitigation measures are taken, the core will deteriorate sharply. Figure 7(b) shows the total core hydrogen production and the hydrogen generation rate in the lower-pressure scenario. At time point 2, the core outlet temperature is 1083 K. Conservative considerations can bring the core outlet temperature to 1083 K as the severe accident entry condition.
(a)
(b)
4.2. Passive Safety System Input
This section analyzes the thermal hydraulic response after the ESBO has occurred, and the accident process reaches the severe accident management entry condition, triggering the corresponding passive safety system input. The effectiveness of the passive safety system for accident mitigation is evaluated. The accident process is shown in Table 2.
For the high-pressure scenario, when the core outlet temperature reaches 1083 K, the PRHRS input is triggered with the core heat derived, so that the main circuit pressure reduces rapidly (Figure 4(a)). When the pressure drops to 11.72 Mpa, the CMT starts injecting. Injection of CMT cools the high temperature of steam in the RPV, and the core surface temperature rapidly drops below 1000 K (Figure 4(d)). At this point, severe zirconium-water reaction in the core has not yet occurred, making CMT injection very effective in preventing core damage. From Figure 4(c), we can see that the water level in the RPV rises and floods the core again. At the same time, PRHRS forms a stable natural circulation between the main circuit and the second circuit and continuously brings out the residual heat of the core, so that the PCT reduces rapidly to below 500 K, which can effectively prevent the core damage caused by the zirconium-water reaction, avoid the massive generation of hydrogen, and effectively guarantee core integrity.
For the lower-pressure scenario, when the pressure is below 11.72 MPa, the CMT is working (Figure 4(c)) and the core is refilled with water. At this time, the core outlet temperature is 583.3 K. Since the pressure is rapidly reduced to pressure balance with the containment (Figure 4(a)), the coolant loss begins to become very slow and the core is always submerged during the calculation time. The residual heat is stably derived from the evaporated coolant, and the core surface temperature is rapidly reduced to below 500 K (Figure 4(d)), avoiding the occurrence of the zirconium-water reaction and hydrogen generation (Figure 4(e)), preventing core damage (Figure 4(f)). The integrity of the core is effectively guaranteed over a long period of time.
5. Conclusions
In this paper, the ESBO accidents in small IPWR-IP200 for high-pressure and low-pressure scenarios are studied. It is observed that the core degradation is very fast. The duration of core degradation is faster, and the core damage is earlier in the low-pressure scenario. The reactor core will melt in both types of selected scenarios. In addition, the PSS input can effectively alleviate the accident and prevent the core damage. The main conclusions are as follows:(1)The most prominent feature of IP200 is that the water capacity of per unit thermal is very low. This will make the core degradation very fast. And the time course of IP200 severe accident is faster than that of the large distributed reactor. Furthermore, the upper part of core will melt firstly. The duration from core oxidation to corium relocation in the lower-pressure scenario is 53% faster than that of the high-pressure scenario. The maximum temperature of liquid corium in the lower-pressure scenario is 134 K higher than that of the high-pressure scenario. This is caused by the core uncovering earlier in the lower-pressure scenario, and the core decay heat is higher at this time.(2)The hydrogen generated in the high-pressure scenario is higher when compared to the low-pressure scenario due to the slower degradation of the reactor core. The core hydrogen generation rate in high pressure is lower than that of the low-pressure scenario, but the core degradation duration is longer in the high-pressure scenario, so the final hydrogen production is higher. The higher hydrogen production will also bring the bigger risk of hydrogen combustion or explosion.(3)The core damage time in the low-pressure scenario is 2.8 h earlier than that of the high-pressure scenario. There will be lesser threat to the integrity of the RPV with less hydrogen production in the low-pressure scenario but will be rapid coolant loss, and the containment pressure increases. And it will allow more time to prevent core damage but will result in a risk of overpressure for the RPV in the high-pressure scenario.(4)The core outlet temperature reaches 1083 K when the IP200 reactor is in the transition point, which can be used as an entry condition for IP200 severe accident management. When the entry conditions for severe accident management are reached, the PSS input can effectively alleviate the accident and prevent the core damage, which is very important for obtaining the subsequent processing time of the accident.
Nomenclature
| CMT: | Core make-up tank |
| ESBO: | Extended station blackout |
| EOP: | Emergency operating procedure |
| IPWR: | Integrated pressurized water reactor |
| LOCA: | Loss of coolant accident |
| MCP: | Main coolant pump |
| NPP: | Nuclear power plant |
| OTSG: | Once-through steam generator |
| PRHRS: | Passive residual heat-removal system |
| PSS: | Passive safety system |
| PWR: | Pressurized water reactor |
| PRV: | Pressure relief valve |
| RPV: | Reactor pressure vessel |
| RCS: | Reactor coolant system |
| SAMG: | Severe accident management guideline |
| SBO: | Station blackout. |
Data Availability
The table and graph data used to support the findings of this study are included within the article.
Conflicts of Interest
The authors declare that they have no conflicts of interest.