Abstract
Nordic Boiling Water Reactors (BWRs) employ ex-vessel debris coolability as a severe accident management strategy (SAM). Core melt is released into a deep pool of water where formation of noncoolable debris bed and ex-vessel steam explosion can pose credible threats to containment integrity. Success of the strategy depends on the scenario of melt release from the vessel that determines the melt-coolant interaction phenomena. The melt release conditions are determined by the in-vessel phase of severe accident progression. Specifically, properties of debris relocated into the lower plenum have influence on the vessel failure and melt release mode. In this work we use MELCOR code for prediction of the relocated debris. Over the years, many code modifications have been made to improve prediction of severe accident progression in light-water reactors. The main objective of this work is to evaluate the effect of models and best practices in different versions of MELCOR code on the in-vessel phase of different accident progression scenarios in Nordic BWR. The results of the analysis show that the MELCOR code versions 1.86 and 2.1 generate qualitatively similar results. Significant discrepancy in the timing of the core support failure and relocated debris mass in the MELCOR 2.2 compared to the MELCOR 1.86 and 2.1 has been found for a domain of scenarios with delayed time of depressurization. The discrepancies in the results can be explained by the changes in the modeling of degradation of the core components and changes in the Lipinski dryout model in MELCOR 2.2.
1. Introduction
Severe accidents (SA) progression in nuclear power plants (NPPs) involves a large number of complex interacting phenomena and is normally divided into in-vessel and ex-vessel phases. Analysis of the in-vessel phase of SA progression focuses on the thermal-hydraulic behavior in the reactor pressure vessel (RPV) and primary circuit, degradation and relocation of the core, debris bed formation in the lower plenum, debris bed remelting, and interactions with vessel lower head and structures, such as vessel wall, instrumentation guide tubes (IGTs), and control rod guide tubes (CRGTs), that can result in vessel failure. Melt release characteristics provide initial conditions for the ex-vessel phase of SA progression, which involves phenomena that can threaten containment integrity (e.g., direct containment heating (DCH), fuel-coolant interactions (FCI), hydrogen combustion and detonation, molten-core-concrete interaction (MCCI), and ex-vessel debris formation and coolability). Assessment of severe accident progression is usually performed by means of SA analysis computer codes, such as MELCOR [1, 2] and MAAP, and subject to aleatory uncertainty (e.g., different accident scenarios and human actions) and state-of-knowledge or epistemic uncertainty (models, modeling options, and sensitivity coefficients) [3–5].
Nordic Boiling Water Reactors (BWRs) employ filtered containment venting (FILTRA-MVSS System [6]) and ex-vessel debris coolability (Figure 1) as a Severe Accident Mitigation (SAM) strategy. Success of this strategy is dependent on melt release conditions from the vessel, which were identified as the major contributor to the uncertainty in the risk of containment failure in Nordic BWRs as was shown in [7–10]. Vessel failure and melt release conditions are dependent on the properties and spatial configuration of the relocated debris in the lower plenum. The properties of debris are determined by progression of core degradation scenarios, timing of possible operator actions, recovery of safety systems (time and capacity of depressurization, water injection) [11, 12].
In Risk Oriented Accident Analysis Methodology (ROAAM+) for Nordic BWR [7] the MELCOR code is used to predict the effect of severe accident scenario on the properties of relocated debris in the lower plenum. These properties can be used as initial conditions in the detailed plant component response models for the analysis of vessel failure mode (coupled ANSYSPECM [13]) and in-vessel debris coolability (DECOSIM code [14]).
This paper is a follow-up of our previous work [12] where we performed the analysis of the effect of severe accident scenario on the propertied of relocated debris in the lower plenum of Nordic BWR with MELCOR 1.86 (rev2911). In this paper we perform a comparison between the previously obtained results and the results generated with new MELCOR code versions and respective best practices guidelines. This is particularly important, since a lot of code modifications have been made during last years to improve predictions of severe accident progression. Furthermore, such comparison of different code versions provides important insights about the code behavior, effect of the code models, and modeling parameters in different severe accident scenarios on the process of core degradation and relocation to the lower plenum.
2. Approach
Development of accident management guidance should be based on best mechanistic analyses according to IAEA [15]. Severe accident codes are usually used for this purpose. The codes can be divided into two categories that reflect the different level of details required from the analysis: (i) system analysis codes (e.g., MAAP [16], ASTEC [17], and MELCOR [1, 2, 18–21]) that model progression of severe accidents and (ii) modeling tools that focus on specific components or phenomena (e.g., debris coolability, DECOSIM [14]; vessel lower head behavior, ANSYS/PECM[13]; and Zircaloy oxidation, MIDAC [22]) and require initial and boundary conditions provided from the system codes.
In ROAAM+ framework for Nordic BWR, the MELCOR code is used to provide initial conditions for detailed SA phenomena codes.
2.1. Nordic BWR MELCOR Model
The Nordic BWR MELCOR model was originally developed to support accident analysis in power uprated plants with MELCOR 1.8.5. More details can be found in [23]. This model was subsequently used to support the analysis of the effectiveness of severe accident management strategy in Nordic BWRs [7, 10], conducted in the Royal Institute of Technology (KTH), to generate the input to dedicated vessel failure analysis models [13] using MELCOR 1.8.6 [12, 24]. The Nordic BWR MELCOR model was updated to MELCOR 2.1 and lower plenum nodalization was refined, in order to provide better insights regarding in-vessel phase of accident progression and debris behavior in the lower plenum, as well as to get better spatial resolution of the lower plenum debris properties. Current MELCOR model (see Figure 2) of the Nordic BWR has thermal power capacity of 3900 MW. The core consists of 700 fuel assemblies of SVEA-96 Optima2 type, divided into five nonuniform radial rings and eight axial levels. The primary coolant system is represented by 27 control volumes (CV), connected with 45 flow paths (FL), and 73 heat structures (HS). The vessel is represented by a 6-ring, 19-axial level control volume geometry. The vessel breach condition was not implemented in the analysis, since the analysis is expected to provide the initial conditions for the analysis of vessel failure mode with ANSYSPECM [13] and in-vessel debris coolability with DECOSIM code [14] within ROAAM+ framework for Nordic BWR [7, 10]. We use MELCOR code versions 2.1 (rev7544) and 2.2 (rev9541) for prediction of the accident progression [1, 2].
2.2. Overview of MELCOR Code Modeling Parameters
MELCOR is a fully integrated, engineering-level computer code that models the progression of severe accidents in light-water nuclear power plants. MELCOR is developed at Sandia National Laboratories (SNL) for the NRC as a second-generation plant risk assessment tool and the successor to the Source Term Code Package. A broad spectrum of severe accident phenomena in both boiling and pressurized water reactors is treated in MELCOR in a unified framework. These include thermal-hydraulic response in the reactor coolant system (RCS), reactor cavity, containment, and confinement buildings; core heat-up, degradation, and relocation; core-concrete attack; hydrogen production, transport, and combustion; fission product release; and transport behavior [1, 2].
In MELCOR code, new modeling approaches and parameter selections that support the best-estimate analyses were frequently introduced over the last few years [14, 25]. In Table 1 we outline the main changes in selection of the parameters that were introduced in MELCOR code throughout rev2911 (MELCOR 1.86) up to rev9541 (MELCOR 2.2), which can be relevant to the in-vessel phase of accident progression analysis presented in this paper. Note that the parameters in Table 1 are either respective code versions default values or the values suggested by the best practices guidelines.
Furthermore, we list several new models and improvements that can affect in-vessel accident progression, which were introduced with different revisions of MELCOR code [1, 2, 25]:(i)Fuel rod collapse model (oxidized fuel rod collapse temperature) in MELCOR 1.86. It is the temperature at which intact fuel rods are assumed to transition from rod-like geometry to a rubble. MELCOR 1.86 default value (SC1132(1)) is 2500K [18, 19]. Such modeling approach introduces a threshold effect that leads to numerical variance in calculations since fuel failure is highly sensitive to the maximum clad temperature that is calculated. In MELCOR Best Practices as Applied in the State-of-the-Art Reactor Consequence Analyses (SOARCA) Project [26] it is suggested that a new model is used for time to fuel rod collapse versus cladding oxide temperature (see [26] for details). In MELCOR 2.1 and 2.2 the new logic implemented with “time-at-temperature” model ignores the values presented on SC1132(1). “Time-at-temperature” model was used in MELCOR 2.1 and 2.2 calculations presented in this paper.(ii)Revised candling model for canisters. Based on MELCOR candling logic (MELCOR 2.1), after canister fails (canisters facing channel (CN) and/or canisters facing bypass (CB)) and forms PD in a cell, it melts and candles to the cell below. If PD does not exist in the lower cell, canister material (metallic Zr) will candle and freeze onto fuel rods, which then oxidize, leading to an earlier fuel rods failure. In MELCOR 2.2, it is assumed that it is more reasonable to assume that CN material will candle onto CN or CB below, if it exists. Doing this would reduce cliff-edge rod failure when a canister fails and leads to reduced numerical variance in solutions [25].(iii)Correction of decay heat transfer to infinitesimally small fluid volumes (was introduced in rev 8274). The correction was done by dialing back the decay heat transfer to the fluid volumes as this volume becomes small. This is accomplished by linearly reducing the fraction of the decay heat energy to zero, starting when the porosity drops below the maximum of 0.01 and the value specified on SC1505(2) and is completely zero when the porosity (fluid volume) is zero [25].(iv)Lipinski dryout model not used above the core support plate (introduced in rev 7874). The Lipinski dryout model was originally intended for limiting the heat removal from a debris bed with downward flowing coolant to capture the case where dryout occurs and the downward flow of water is counter-balanced by the upward flow of steam. MELCOR uses the Lipinski zero-dimensional correlation [1, 2, 27] to calculate the dryout heat flux, which is then applied as a limiting maximum heat transfer rate from a particulate debris bed. This model was also applied above the core support plate with upward flow of coolant and would lead to problems when the occurrence of particulate debris along with intact components would stop convective heat removal from the intact components in a COR cell [25].
2.3. Sampling of MELCOR Scenario Parameters
Severe accident initiated by the station blackout (SBO) was considered in the analysis presented in this paper. We consider a simultaneous loss of the offsite power (LOOP) and backup diesel generators, which results in the loss of all water injection systems and leads to core damage (HS2 Plant Damage State (PDS): core damage due to inadequate water inventory makeup). This kind of accident is among the major contributors to the core damage frequency (CDF) for Nordic BWR according to the PSA level 1 analysis and is one of the most challenging accident scenarios for BWR’s [28] as illustrated by the Fukushima-Daiichi accident [29, 30].
In this scenario we consider successful operation of Safety Relief Valves (SRV). High- and low-pressure emergency core cooling system (ECCS (HPCI & LPCI)), Containment Sprays (Residual Heat Removal (RHR) System), are considered unavailable. Furthermore, we consider that the power (external grid or diesel generators) can be recovered after some time delay and the emergency core cooling system (ECCS) can be restarted.
According to the considered scenario, the operator can delay activation of the depressurization system to keep the coolant in the vessel; however, for injection of water with low-pressure ECCS (LPCI), depressurization (ADS) has to be activated. We consider that (i) the time delay for activation of the depressurization system (ADS) is in the range from 1200 to 10000 seconds after the initiating event and (ii) the time delay for the activation of low-pressure coolant injection (ECCS) is also in the range from 1200 to 10000 seconds after the initiating event, with maximum (4 injection trains) capacity (see Figure 3). Note that the time of depressurization is always less than the time of water injection.
In the analysis we employ uniform mesh sampling in the space of possible severe accident scenarios represented by the timings combinations of ADS and ECCS, which results in 120 unique combinations. Furthermore, in the analysis we considered 4 different values (except MELCOR 1.86, where only two values were considered) of the maximum time step (0.01, 0.1, 0.5, 1sec) since it was shown previously [24, 31] that the MELCOR maximum time step can affect the code predictions and it is difficult to obtain convergence with respect to the time step. The maximum time step has some nonnegligible effect on the extent of core oxidation, which is linked to the amount of hydrogen produced and the extent of debris oxidation. Such effect can be caused by the complex nonlinear interactions between physical models in MELCOR and thresholds for transition from one regime to another. The results of simulations are presented in the form of median values of MELCOR predicted quantities, obtained with different values of the maximum time step. In total 960 code executions were performed (for both MELCOR 2.1 and 2.2). Furthermore, the results of simulations are used for the development of the database of full model solutions for Core Relocation Surrogate Model development [7, 11].
Simulations were performed using simulation driver, implemented in MATLAB, which performs automatic generation of input files, execution of the MELCOR code on multiple parallel calculation threads, adaptive refinement of the maximum time step and restarting in case of crashed calculations, and extraction of the data into the database of solutions and postprocessing of the results.
3. Results
Figures 4, 5, and 6 show the fuel damage conditions at the time of initiation of water injection (a) and at the time of transition ( after water injection (b). The time of transitions () is defined as the time of core support plate failure plus 3600sec; this value was chosen based on the pattern analysis performed in [12] and used as a time point for one-way coupling between MELCOR code and DECOSIM [14] and ANSYS/PECM [13, 32] codes, used for analysis of in-vessel debris coolability and vessel failure mode (see [12] for details).
(a)
(b)
(a)
(b)
(a)
(b)
We use fuel damage descriptors, similar to those proposed by EPRI in [33], where the dark blue color on the maps in Figures 4, 5, and 6 represents intact core condition; light blue color, oxidized core condition (core significantly oxidized but intact); red color, badly damaged core (core significantly oxidized and not intact, some core structural components have melted and relocated downward); brown color, core debris relocated to the lower plenum (significant quantities of core debris relocated to the lower plenum, due to core support plate failure).
It is instructive to note that scenarios resulting in relocation of significant quantities of core debris to the lower plenum (brown domain) are likely to lead to vessel lower head breach, melt release, and ex-vessel consequences that can damage the containment. The scenarios with intact core (dark blue domain), oxidized core condition (light blue domain), and badly damaged core condition (red domain) are most likely to lead to in-vessel accident termination/in-vessel melt retention.
The results presented in Figures 4, 5, and 6 show that there is significant difference in MELCOR 2.2, compared to MELCOR 2.1 and 1.86—both before water injection (Figures 4(a), 5(a), and 6(a)) and after water injection (Figures 4(b), 5(b), and 6(b)). This difference can be attributed to the changes in the canister failure modeling in MELCOR 2.2 and to the effect of the Lipinski model [25], which will be discussed in detail further in this paper. The difference in results between MELCOR version 1.86 (Figures 4(a) and 4(b)) and MELCOR 2.1 (Figures 5(a) and 5(b)) can be explained by the effect of “time-at-temperature” fuel failure modeling approach [14] used in MELCOR 2.1 and 2.2, which can result in slight delay in transition from oxidized to badly damaged core condition. Furthermore, the domain of scenarios with intact core conditions is very similar between all MELCOR code versions used in the analysis, with a difference between MELCOR 1.86 and 2.1, 2.2. All code versions use the same cut-off threshold for minimum oxidation temperature of Zircaloy and steel; thus, this difference might be due to higher core heat-up rates due to differences in the default values of the gap thickness or radiative heat transfer parameters.
Figure 7 shows the time of core support plate failure in response to mechanical and thermal loads of the debris resting above it. Note that in the scenarios where the accident can be stopped during early in-core phase, without core support plate failure and massive debris relocation to the lower plenum, the time of core support plate failure was set to zero ; this can result in long tails of the distributions of the differences between different code versions (i.e., when the core support failure is predicted by one code version and not predicted by another code version). The results show that there is significant difference in predictions of the time of core support plate failure in MELCOR code version 2.2 compared to 2.1, 1.86. The fraction of scenarios with core support failure is significantly lower in MELCOR 2.2 (~40% of the cases) compared to MELCOR 1.86/2.1, which is also reflected in the fraction of scenarios with large debris mass in the LP—predicted by the MELCOR code versions 2.1 and 1.86 in comparison to version 2.2 (Figures 8(a) and 8(b) vs. Figure 8(c)).
(a)
(b)
(c)
(d)
(a)
(b)
(c)
(d)
MELCOR 2.2 predicts that in the scenarios with late depressurization (in the range of ~4000-7000 sec, Figures 7(c) and 8(c)) and reflooding, it is possible to stop the accident progression in the core region and prevent relocation into the LP. The differences between all code versions used in the analysis are summarized in form of cumulative distributions of the differences of predictions of (Figure 7(d)). According to the presented distributions, the predictions of by MELCOR 1.86 and 2.1 are very consistent with each other and the minor differences (~10% of the cases, tails of the distribution) are due to the changes in the modeling of the fuel failure (temperature threshold in MELCOR 1.86 vs. “time-at-temperature” model in MELCOR 2.1). The large discrepancy in predictions of by MELCOR 2.2 compared to 1.86, 2.1 is most likely due to the changes in the modeling of canister degradation and relocation, and Lipinski dryout model, which will be discussed in Section 4.
Figure 8 shows the mass of relocated debris in the lower plenum at the time (1h after core support plate failure). The results show that there is significant difference in MELCOR code version 2.2 rev9541, compared to MELCOR 2.1 rev7544 and MELCOR 1.86 rev2911. MELCOR 2.2 (see Figure 8(c)) predicts a very small mass of the debris in LP for the scenarios with late depressurization (ADS time in the range of ~4500-9000sec) and late water injection; in these scenarios the accident progression is stopped in the core region, and the debris is retained above the core support plate (Figures 7(c) and 8(c)).
The results obtained with MELCOR code versions 1.86 and 2.1 look very consistent with each other, and the differences in predictions can be explained by the differences in fuel failure modeling between MELCOR 1.86 and 2.1. MELCOR 1.86 uses the temperature threshold (TRDFAI, oxidized fuel rod collapse temperature, defined as sensitivity coefficient SC1132-1 = 2500K, [18]), while MELCOR 2.1 uses “time-at-temperature” model, where the fuel assembly lifetime at 2500K equals 1h and at 2700K equals 30sec [14, 25]. The effect of this difference can be also observed in the mass averaged temperature of the debris in core (all axial levels above the core support plate) shown in Figure 9, which is significantly higher in MELCOR 2.1 compared to MELCOR 1.86, especially in the domain of scenarios with late depressurization.
(a)
(b)
Figure 8(d) illustrates the summary of the results (Figures 8(a), 8(b), and 8(c)) in the form of cumulative distributions of the differences of predictions of the relocated debris mass by different code versions. The results show that in most of the cases (~60%) the difference in predictions between MELCOR 1.86 and 2.1 is within ~20-50 tons. In approximately 10% of the cases the difference exceeds 100 tons, and it typically happens in the so-called “transition” domain of scenarios, located on the periphery of the small relocation domain, where scenarios that result in failure of the core support and massive debris relocation to the lower plenum in MELCOR 1.86 can be recovered in MELCOR 2.1, which is also evident from the results of core damage states analysis (Figures 4 and 5).
Figure 10 shows the results of the hydrogen mass generated during the accident, predicted by MELCOR 1.86 (a), 2.1 (b), and 2.2 (c). From a qualitative perspective, the results obtained with different code versions are, in general, consistent with each other; e.g., in all cases the delay in depressurization leads to increased hydrogen mass generated.
(a)
(b)
(c)
(d)
From a quantitative perspective, the difference between MELCOR 1.86 and 2.1 is approximately within 400kg. Furthermore, in scenarios with early depressurization MELCOR 1.86 predicts larger mass of the hydrogen generated compared to MELCOR 2.1 and 2.2. In scenarios with late depressurization MELCOR 1.86 predicts smaller mass of hydrogen generated compared to MELCOR 2.1 and 2.2. The latter difference can be explained by the differences in the modeling of fuel failure. MELCOR 2.1/2.2 uses more advanced “time-at-temperature” fuel rod collapse model [14, 30], which results in longer periods of time during which the intact core structures are exposed to oxidation and thus generation of larger amounts of hydrogen. In scenarios with late ADS activation, the major amount of hydrogen is generated during slow recession of water level in the core region. The process of core degradation follows the TMI-like “wet-core” scenario in which the core is exposed to oxidation for a longer period, resulting in higher oxide fraction in the debris (Figure 11).
(a)
(b)
(c)
(d)
Figure 11 shows the fraction of metallic debris in the LP as a function of ADS and ECCS activation time. The timing of ADS activation has a major apparent effect on the fraction of metallic debris and the amount of hydrogen produced in the scenarios with large mass of relocated debris. In scenarios with late ADS activation, the major amount of hydrogen is generated during slow recession of water level in the core region. The process of core degradation follows the TMI-like ‘‘wet-core” scenario in which the core is exposed to oxidation for a longer period, resulting in higher oxide fraction in the debris.
MELCOR 1.86 (Figure 11(a)) and 2.1 (Figure 11(b)) predictions of the fraction of metallic debris are very consistent with each other, and the difference in predictions (Figure 11(d)) is within ~10% in most of the cases. MELCOR 2.2 predicts the domain with very large metallic fraction (red domain, over 75%) which corresponds to scenarios with very small debris mass (see Figure 8(c)). In such scenarios molten materials (mostly metallic), e.g., control rode blades, drain from the core through the openings in the core support plate. The temperature of the LP debris in such scenarios gradually decreases with time, since there is no heat generating materials. In the scenarios with late depressurization (in the range of ~4000-7000 sec) and late reflooding, MELCOR 2.2 predicts that the accident progression is stopped in the core region without massive relocation into the LP; the debris in these scenarios is resting on the top of the core support plate and in coolable configuration.
It is important to note that more detailed model sensitivity analysis is necessary in order to evaluate the effect of user input parameters and sensitivity coefficients on code predictions (such as hydrogen mass), which will be addressed in a separate work.
4. Discussion
In this section we discuss in detail possible reasons for the discrepancies in the results between different MELCOR code versions. First, in order to identify the source of the discrepancies in the results between MELCOR 1.86/2.1 and MELCOR 2.2, we performed a set of calculations with MELCOR 2.2 with all sensitivity coefficients set to MELCOR 1.86 default values (by setting “EXEC_GLOBAL_DFT” to 1.86 in MELCOR input file).
The results (Figure 12) show that the domain of scenarios where the accident can be stopped in the core region and massive debris relocation to the lower plenum can be avoided, has significantly reduced in size compared to the results illustrated in Figure 7(c).
The remaining discrepancy in the results can be attributed to the changes in the MELCOR models. Based on the literature review [14, 25], the possible explanations for the discrepancy in the results between MELCOR code version 1.86/2.1 and MELCOR 2.2 are the changes in the process of early core degradation, in particular canister material candling as was discussed in Section 2.2. Furthermore, in MELCOR 2.2 (all revisions after 7874, see Section 2.2 and [25] for details), the Lipinski dryout model is not used above the core support plate, which may result in higher convective heat removal rate from the core in MELCOR 2.2 compared to MELCOR 1.86/2.1.
We performed a comparison of two identical cases with MELCOR 2.2 and 2.1. Figure 15 shows the difference in the mass of Zr conglomerate on fuel cladding (CL) and canister (CN+CB) as predicted by MELCOR 2.1 rev7544 and MELCOR 2.2 rev9541. The core damage state at 8800sec (time of core support plate failure in MELCOR 2.1) is shown in Figure 13(a) as predicted by MELCOR 2.2 and in Figure 13(b) as predicted by MELCOR 2.1. There is considerably larger mass of the debris resting on the top of the core support plate in the latter case predicted by MELCOR 2.1. Larger mass of the debris results in significantly higher structural and thermal loads on the core support plate.
(a)
(b)
Figures 14(a) and 14(b) illustrate core damage state as predicted by (a) MELCOR 2.2 and (b) MELCOR 2.1 at 12400sec (i.e., 3600sec after initial core support plate failure in case (b)). Fuel and particulate debris temperature plots in Figure 14(a) show that, after reflooding, the debris resting on core support plate is quenched and accident progression is stopped in the core region, while in Figure 14(b) the major part of core materials has relocated into the LP.
(a)
(b)
The results show that there is a significant difference in the amount of heat removed from the core and in-core debris during the early phase of accident progression between MELCOR 2.1 and 2.2 (see Figures 16 and 17). MELCOR 2.2 predicts larger amount of heat removed from the core compared to MELCOR 2.1, which can be attributed to the effect of Lipinski dryout model.
(a)
(b)
In order to evaluate the effect of Lipinski dryout model on the results, a set of additional simulations were performed with MELCOR 2.1 rev7544 (2 sets with different max. time steps; the results are presented as expected values of code predictions) with the Lipinski dryout model switched off, to identify the effect of the model on the timing of core support plate failure and final core damage state. Note that, in MELCOR 2.1, the Lipinski model can be switched off only for the whole COR package (core and lower plenum); therefore we are only looking of the core damage states for comparison with MELCOR 2.1 and 2.2 results presented in Figures 5 and 6. The results are presented in Figure 18, which show that reflooding of the badly damaged core, prior to failure of the core support plate and debris slumping into the lower plenum (core damage states (red) at the time of ECCS activation, Figure 18(a)), results in successful quenching of the core debris above the core support plate and termination of the accident in core region (Figure 18(b)).
(a)
(b)
The remaining difference in the final core damage states between MELCOR 2.1 with Lipinski model switched off and MELCOR 2.2 is most likely due to the effect of the changes in the modeling of canister material degradation and candling, which according to [25] should result in longer time to failure of the fuel assemblies, and changes in the default values of sensitivity coefficients.
5. Conclusions
In this paper we addressed the effect of the new models, best practices modeling approaches for using the MELCOR code, and default values of sensitivity coefficients on the in-vessel phase of severe accident progression in Nordic BWR in different accident scenarios. The simulations of in-vessel phase of severe accident progression in Nordic BWR have been performed using different versions of the MELCOR code (MELCOR 1.86 rev2911, MELCOR 2.1 rev7544, and MELCOR 2.2 rev9541) and respective “best practices” guidelines and default values for user defined parameters and the code sensitivity coefficients [14, 25]. The simulations were performed for different severe accident scenarios defined in terms of the timings of different safety systems recovery.
The results of the analysis showed that the MELCOR code versions 1.86 and 2.1 generate qualitatively similar results, and most of the differences between the code versions (1.86, 2.1) can be explained by the changes in the modeling of the fuel rod collapse. MELCOR 1.86 employs temperature threshold for oxidized fuel failure, while MELCOR 2.1 employs more advanced “time-at-temperature” model developed during SOARCA study [14].
We found a significant difference in predictions of the total debris mass and time of core support plate failure between MELCOR code versions 1.86/2.1 and 2.2. MELCOR 2.2 predicts that in scenarios with late depressurization (in the range of ~4000-7000 sec) and reflooding, it is possible to prevent massive core relocation into the LP and effectively stop accident progression. The possible explanations for this difference are (i) changes in the modeling of degradation of the core components (e.g., canister degradation and candling) and (ii) changes in the Lipinski dryout model, which is not used above the core support plate in MELCOR 2.2.
From the severe accident scenario perspective, all MELCOR code versions predict that a delay in depressurization, followed by water injection, can significantly delay failure of the core support plate and debris relocation to the lower plenum. Based on the results, the accident can be stopped and debris can be quenched in the core region up to ~1h after initiating event in MELCOR 1.86 and ~1.5h in MELCOR 2.1 and over ~2.5h after initiating event in MELCOR 2.2. This can provide valuable insights into the time available to operators for successful recovery of safety systems that provide the possibility of arresting the core within the reactor pressure vessel, and hence provide the best possibility of limiting the releases. The human reliability analysis regarding recovery actions is based on the available time for the operator action. It can be noted that the dominating sequences for loss of feedwater from PSA level 1 are due to loss of external power supply and failure of backup power systems. The time for possibility of manual recovery of backup power systems and the time for possibility of return of offsite power are therefore very important for the quantitative results in PSA L1. It is important to note that extensive uncertainty analysis is required to properly identify the time margins available for operator actions, which will be addressed in a separate contribution.
Data Availability
The MELCOR code results and postprocessed data used to support the findings of this study are available from the corresponding author upon request.
Conflicts of Interest
The authors declare that they have no conflicts of interest.
Acknowledgments
The work is supported by the Swedish Nuclear Radiation Protection Authority (SSM), Swedish Power Companies, Nordic Nuclear Safety Research (NKS), Swiss Federal Nuclear Safety Inspectorate (ENSI) under the APRI-MSWI program at the Royal Institute of Technology (KTH), Stockholm, Sweden. The simulations were performed on resources provided by the Swedish National Infrastructure for Computing (SNIC) at PDC Center for High Performance Computing (PDC-HPC).