1. Introduction
To achieve safe operation of nuclear power plants, multiple safety systems are designed to overcome abnormal or transient conditions. Nevertheless, a low probability of multiple systems failure driven by external events could lead to severe accident (SA) conditions. Those conditions lead to core damage, and in some cases, it might breach the vessel or even the containment integrity, and eventually lead to a release of radioactive material into the environment.
The accident in the Fukushima Daiichi site manifested the susceptibility of the nuclear power plants to reach severe accident conditions during an extended station blackout (SBO) event. This has driven significant research on the consequences of having prolonged loss of power to understand and assess the effectiveness of mitigation strategies to hinder the accident progression and mitigate its consequences.
In this research, it is assumed that an extended SBO ensued as a result of the occurrence of hypothetical external events that caused the loss of alternating current (AC) power supplies for all off-site and on-site emergency diesel generators (EDGs) and failure to restore AC power. With a total loss of the ultimate heat sink, the decay heat accumulates within the core and the system progresses into a severe accident, leading to core damage.
For this work, the plant of choice is APR1400 as a representative high power density pressurized water reactor (PWR). This study aims to explore the potential and limitations of the cooling schemes for successful implementation of the In-Vessel Retention (IVR) strategy via External Reactor Vessel Cooling (ERVC) for the high power-density APR1400 reactor. The goal is to identify success window of the hybrid IVR-ERVC given the attendant uncertainties hence verify its effectiveness in maintaining the vessel integrity and accordingly preserving the containment integrity. The result is expected to enhance the public acceptance of nuclear power by minimizing the risk of containment breach and limiting the radioactive materials release.[7]
2. Literature Review
According to Klein-Heßling[4], core coolability during re-flooding, melt relocation, steam explosion during corium relocation into water, and ex-vessel corium coolability are still high-priority concerns in severe accident research given the high level of uncertainty. Prošek and Cizelj[7] pointed out that, in the context of severe accident management (SAM), if the in-vessel retention (IVR) strategy is successful, the entire ex-vessel sequence of extremely complicated events that could jeopardize the containment integrity would be eliminated.
External cooling of the reactor pressure vessel (RPV) can be utilized to achieve this, both as an upgrade in existing facilities and new reactor designs (Gen III/III+ reactors), such as the VVER-440, AP1000, APR1400, HPR1000, and CAP1400.[3]
The integrity of the vessel can only be maintained if the corium-induced vessel wall heat flux is less than the boiling critical heat flux (CHF) on the vessel's exterior.[7] Current research is focused on assessing the success window of IVR strategies, given the high level of uncertainties associated with melt pool convection, vessel wall heat conduction, external boiling heat transfer, external cooling enhancements and their applicability to reactor designs, as well as coolability enhancement strategies as proposed by Ma et al..[3]
It has been shown that opening the pilot-operated safety release valves (POSRVs) within 30 minutes after entering SAM conditions has a substantial influence on core coolability as well as the mass of the molten corium.[3] Furthermore, increasing the external injection flow rate may avert the initial relocation as recommended by Cho et al..[3] Though the concept of in-vessel melt retention has been well-proven for small power reactors (600 MWe)[9], Sehgal[9] was skeptical regarding its feasibility for 1500 MWe reactors. Ex-vessel melt retention approaches are perceived to be more promising.[9]
In this work, a hybrid strategy involving internal and external cooling is proposed and deemed necessary for a high-power density reactor like APR1400. To address the underlying uncertainties, a best estimate plus uncertainty (BEPU) approach is adopted. The phenomena identification and ranking table (PIRT) developed for severe accidents is used to identify key uncertain parameters which are then propagated within the DAKOTA Uncertainty Quantification (UQ) framework following the work of Kajetan, et al..[13]
3. Systems Engineering Approach
The Systems Engineering (SE) methodology is applied to direct the progression of the work and ensure systematic and efficient execution. Starting with the identification of the research objective and outlining the methodology, the SE technique is used to assist the process of developing the uncertainty framework – which is considered as the system of interest – by breaking down the work structure into smaller and more manageable tasks.
3.1 Objective and Methodology
For the successful implementation of this project, a detailed formulation of the project's goals, objectives, and work breakdown structure, as well as the development of a system architecture subject to predefined requirements, are necessary.
As shown in Figure 1, the research objective is to validate the effectiveness of the IVR strategies for APR1400 under an extended SBO condition. This is achieved by developing an UQ framework which involves the development of a thermal hydraulics model along with sampling and propagating key uncertain parameters.
[Figure 1] Engineering Method
To simulate the complexity of the underlying phenomena for such transient conditions, the best estimate thermal-hydraulics code, ASYST, is employed. ASYST (Adaptive SYStem Thermal hydraulics), is developed by Innovative Systems Software (ISS). As for the uncertainty quantification framework, DAKOTA is used to apply the statistical tools for sampling and propagation of the uncertainty within the thermal hydraulics model.
APR1400 is selected as a representative nuclear power plant (NPP) to assess the effectiveness of the IVR strategies for a typical high power density reactor. Figure 2 shows the main building blocks of the work, arranged in accordance with the objective hierarchy. It is essential to first collect all necessary data such as: key systems and components description and geometric details, initial and boundary conditions, as well as emergency operating procedures (EOPs) and severe accident management guidelines (SAMGs) and high level candidate actions (HLCAs) necessary for the development of the thermal hydraulic model. Next, key underlying phenomena are identified and hence used to derive the uncertain parameters and gather statistical information for the UQ process.
[Figure 2] Objective Hierarchy
Developing the thermal-hydraulic model is the subsequent building block as can be seen in Figure 2. To verify the model, the steady-state performance is compared to the corresponding conditions outlined in the APR1400 Design Certification Document (DCD). With a deviation of 5%-10%, the results from the steady-state analysis of the thermal-hydraulic model are deemed to be in reasonable agreement with the DCD. Then, a transient simulation for an extended SBO scenario is modeled, and the results of the unmitigated base case are compared to previously published data for validation. Afterward, various mitigation strategies are implemented to satisfy the stakeholders’ criteria and prove that the IVR strategy with ex-vessel cooling can be securely implemented in APR1400 to maintain the vessel's integrity.
After ensuring the proper response of the developed thermal hydraulic model, a range of uncertain parameters are passed into the statistical sampling tool to be propagated into the thermal hydraulic model within the DAKOTA environment. When a statistically representative sample size is achieved, the uncertainty bands for various key system parameters are evaluated and hence the success window of the IVR-ERVC strategy is identified as illustrated in Figure 2.
3.2 Work Breakdown Structure
According to the Systems Engineering approach, the work breakdown structure is defined:
1. Develop, verify, and validate a thermal-hydraulics model of APR1400 for steadystate operation according to the DCD.
2. Verify the base case scenario based on the PRA study in the DCD for the most severe scenario.
3. Identify the relevant phenomena that occur during such an accident, and hence derive the key uncertain parameters.
4. Implement operator actions according to EOP and SAMG to assess their effectiveness and feasible timeframe.
5. Analyze the influence of operator actions on the success window of the IVR strategies, with and without ex-vessel cooling.
6. Propagate the list of key uncertain parameters to determine the success window of the IVR strategy for the selected scenario.
3.3 Stakeholders Identification
Four types of stakeholders with a keen interest (economic, social, environmental, and technical) in ensuring the system's safety and reliability. Figure 3 depicts the stakeholders involved in the various stages of the NPP project development, from the conceptual stage to decommissioning.
[Figure 3] Stakeholders Identification
3.4 Concept Development
3.4.1. Requirements analysis
The requirements addressed in this study are classified into three groups: mission, originating, as well as system and component requirements, as outlined in Table 1.
<Table 1> Requirements of the IVR-ERVC Cooling Strategy under Extended Station Blackout Conditions
The mission requirements can be traced back to stakeholder needs. The originating requirements represent the practical implementation of the objectives and aspirations of the stakeholders as identified by the acceptance criteria for the analysis; whereas the systems and components requirements refer to the details and constraints applied at the system/component level to assess the system's response and effectiveness of the proposed mitigation strategy.
3.4.2 System Architecture
To conduct this analysis, the thermal-hydraulics model of the APR1400 undergoing a severe accident scenario is developed and validated before it is passed into the uncertainty framework following the system architecture which involves both physical and functional architectures. Figure 4 illustrates the physical architecture which shows the coupling between the thermal hydraulic model – developed using ASYST – to DAKOTA environment via a Python interface to manage the communication between the two codes (ASYST and DAKOTA).
[Figure 4] Functional Architecture of IVR-ERVC
Within the uncertainty quantification framework, key uncertain parameters are randomly sampled to cover the entire range defined by the provided probability distribution function. In each iteration, the interface passes those randomly assigned values from DAKOTA to the relevant sections in ASYST input deck to simulate the system response. Once the ASYST results are obtained, specific parameters of interest are relayed back to DAKOTA for post-processing.
Figure 4 shows the functional architecture of the simulated system, reflecting the implementation and evaluation of the IVR strategy with ex-vessel cooling during an extended SBO condition. Three primary functions required for the analysis are defined. Using the thermal hydraulic model and implementing the operator actions according to the EOPs and SAMGs involves depressurization and injection to maintain cooling and core coverage as a means to mitigate the extended SBO scenario.
To identify the success window of the IVR strategy, various uncertainties associated with manufacturing tolerances, initial and operating conditions as well as models, correlations, and operator actions, need to be considered.
3.4.3 Engineering Development
3.4.3.1 Thermal-Hydraulic Model
For the development of the thermal hydraulic model, it is crucial to determine the initial and boundary conditions, along with the geometric parameters of essential components and structures that affect the APR1400 system's response during the accident according to the DCD of APR1400 NPP.
For this analysis, the plant model was created to mirror the NPP system description reflecting the major primary and secondary system and components of APR1400. The plant involves two loops along with the reactor coolant system (RCS).
A key component of the RCS is the reactor pressure vessel (RPV) which carries the coolant via two hot legs to the u-tubes to the SGs where they dump the heat. Four cold legs connect the u-tubes to the RPV via four reactor coolant pumps (RCPs) for coolant circulation. The pressurizer (PRZ) is connected to one of the hot legs via a surge line of to maintain the design pressure and accommodate pressure and temperature changes during plant operation. The core is modeled using five channels with appropriate axial and radial power distributions. The RPV hosts the reactor core, intake and output nozzles, downcomer, upper and lower plenums.
3.4.3.2 Transient Analysis with EOPs and SAMGs Implementation
To mitigate the accident, various operator actions within the EOPs and SAMGs were executed to assess their effectiveness. A range of safety systems, such as the main steam safety valves (MSSVs), pilot operated safety relief valves (POSRVs), atmospheric dump valves (ADVs), as well as the safety injection tanks (SITs) have been implemented. Additionally, external injection lines for implementing FLEX portable pumps, alongside an ex-vessel cooling channel to simulate submerging the Reactor Pressure Vessel (RPV) in a water-flooded cavity to remove heat using natural circulation, have also been integrated within the thermal hydraulic model.
One of the end goals of this research is to examine the behavior of the plant and determine the pertinent phenomena under the accident conditions including core degradation, molten pool behavior, corium relocation in the lower head, and hence evaluate the corresponding vessel response.
As mentioned earlier, the APR1400 model is implemented in ASYST featuring precise geometric representation of the key systems and components. ASYST has been augmented with supplementary modules, enabling it to effectively model severe accident phenomena. It furnishes multi-dimensional, multi-fluid models to simulate the behavior of diverse components during severe accidents such as core structures, late-phase debris relocation, containment behavior, and fission product release.[10] Within ASYST, the SCDAP module simulates processes related to the core, while enhancements in the late-phase modeling involving relocation to the lower head is handled via the COUPLE module. The code also utilizes heat structures, core components, and debris models to calculate heat transfer and evaluate the temperature and hence estimate the melting and rupture times of various materials. For the vessel rupture calculation, it applies the critical heat flux correlation as a function of the contact angle.[10]
3.4.3.3 Uncertainty Quantification
Key phenomena expected to considerably influence the NPP response to the accident scenario under consideration, have been meticulously identified following the phenomena identification and ranking table (PIRT) approach and drawing insights from pertinent research papers on severe accidents. Next, a list of the most relevant uncertain parameters have been derived based on PIRT.[14] These parameters, inclusive of statistical details such as standard deviation and probability distribution function, encompass critical aspects like fuel rod manufacturing tolerances, thermal-hydraulic conditions, molten pool conditions, thermo-physical properties and key heat transfer models and correlations as well as operator actions. To address the underlying uncertainties, the ASYST model is executed many times within the DAKOTA uncertainty quantification framework until a statistically representative sample is achieved.
[Figure 5] Physical Architecture with Sub-System Interaction and Integration
3.5 Verification and Validation
It is essential to validate the nodalization by achieving nominal steady conditions consistent with that reported in APR1400 Nuclear Power Plant Design Control Document (DCD).[1] Key primary and secondary system parameters are cross validated against the data outlined in the DCD, with an error of less than 5% as illustrated in Table 2.
<Table 2> Steady-State Validation
Following the SE approach, the verification and validation (V&V) processes are conducted at different stages of development according to the V-Model illustrated in Figure 6 to ensure that all acceptance criteria are satisfied.
[Figure 6] Systems Engineering V-Model
Verification aims to confirm the correct implementation of the system, ensuring the flow of work to be aligned with the design criteria and adheres to established standards and regulations.
This process involves a thorough examination of design documentation, specifications, of critical elements like cooling pumps, heat exchangers, and instrumentation. Additionally, it employs computer simulations or modeling to validate the system performance under various conditions, including those encountered during an extended SBO scenario. The model prediction is then meticulously analyzed to assess the system's response such as temperature patterns, coolant flow rates, and the effectiveness of heat dissipation
It is essential to recognize that both verification and validation processes are continuous and iterative in nature, requiring the prompt resolution of identified issues or opportunities for enhancement. This iterative approach aims to bolster the system's dependability and safety, particularly in the context of an SBO event.
The focus of implementing the IVR-ERVC strategy is to maintain the integrity of the RPV for 72 hours, which has implies preserving the containment integrity and therefore preventing radioactive material release. Stringent criteria demand ensuring the vessel integrity with a 95% probability and 95% confidence level under extended SBO conditions, when considering various uncertainties.
Without AC power, all motor driven equipment (RCP, SIP, MFWP), in addition to AAC, emergency diesel generators. Further, after 8 hours, the batteries are depleted at which point, the TD-AFWPs are assumed to be unavailable. The FLEX portable equipment must be aligned within 2 hours. The plant incorporates feed and bleed operations to manage severe accidents, which can be implemented using logic trips and time-dependent volumes for depressurization and injection operations with timeframes specified for various operator actions following the SAM entrance condition is programmed These measures collectively establish a robust response for the APR1400 NPP under an extended SBO severe accident scenario.
3.6 Preliminary Results
As a result of the SBO, and concurrent trips of the reactor and turbine control valves, the Reactor Coolant Pumps (RCPs) coast down, the Main Steam Isolation Valves (MSIVs) shut, and the main feedwater is lost. Following the reactor trip, the power undergoes a sudden decrease attributed to the negative reactivity insertion from the control rods, as demonstrated in Figure 7.
[Figure 7] APR1400 Reactor Power
The rapid decrease in coolant circulation correlates with the large amount of heat building up and steam formation in the RPV. As a result, the temperature rises, the primary coolant expands, and the PZR pressure increases until it reaches the POSRVs activation set point as depicted in Figure 8. Following the rapid cycling of the POSRVs, a large amount of the inventory is lost, and the core uncovers.
[Figure 8] Pressurizer Pressure
The loss of cooling results in a temperature rise, reaching a core exit temperature (CET) of 922 K which indicates the SAM entrance condition at 1.91 hours as demonstrated in Figure 9.
[Figure 9] CET and SAM Entrance Condition
Meanwhile, the steam generator pressure is maintained by the opening and closing of the MSSVs as illustrated by Figure 10. It should be noted that until the pressurizer POSRVs activation setpoint is reached, the only way to cool the RCS is the secondary side heat removal via natural circulation. However, the heat removal by natural circulation terminates as the steam generators become depleted.
[Figure 10] Steam Generators Pressure
When the CET reaches the saturation point, boiling occurs in the RPV which causes the liquid water in the core to vaporize, resulting in a drop in the collapsed water level as can be depicted via Figure 11.
[Figure 11] Collapsed Water Level
This results in a drop in the heat transfer coefficient, causing a rapid increase in the core temperature. Once the zircaloy melting temperature is reached, oxidation of the cladding material is accelerated and hydrogen is generated in the core as shown in Figure 12, simultaneously releasing the heat of the exothermic reaction. With loss of clad integrity, fission products are released. Ultimately, hydrogen production decreases, due to oxygen deprivation as the fuel loses its coolable geometry and a molten pool begins to develop in the core.
[Figure 12] Hydrogen Generation
As other core materials reach their melting points, the molten pool increases, as can be seen in Figures 13 and 14. Consequently, the oxide shell fractures under the pool weight, and the corium relocates to the lower head at 3.9 hours. Shortly afterwards, and as a result of being subjected to elevated temperatures for an extended period, the vessel material experiences creep rupture, as demonstrated in Figure 15 which marks the vessel breach.
[Figure 13] Debris Height
[Figure 14] Radius of Molten Pool
[Figure 15] Creep Rupture Flag Activation
4. Conclusion
The purpose of this study is to investigate the success window of the in-vessel retention (IVR) strategy with ex-vessel cooling, in the event of an extended loss of power for APR1400. A model has been developed to simulate the critical phenomena of a severe accident scenario, and the performance of APR1400's thermal-hydraulic response during the event of an extended SBO is evaluated and analyzed.
While the work is still in progress, a preliminary result for the unmitigated SBO was presented in this paper. Once the unmitigated scenario is established, the emergency operating procedures (EOPS) and severe accident management guidelines (SAMG) will be systematically applied.
Since APR1400 is a large-scale high-power-density reactor, it is foreseen that it may be necessary to combine internal and external cooling for a successful IVR strategy. This would involve combining depressurization and external water injection into the RCS, as well as external cooling of the vessel. Research findings will determine if ex-vessel cooling can be achieved by natural circulation alone or if forced flow conditions would be need to cool the vessel from the outside. It is deemed imperative to assess the underlying uncertainties for the identification of the success window of the IVR strategy that ensures the vessel integrity.
Acknowledgments
This research was supported by the 2023 Research Fund of the KEPCO International Nuclear Graduate School (KINGS), Republic of Korea.
References
- APR1400 Design Control Document, Tier 2, Korea Electric Power Corporation (KEPCO) and Korea Hydro & Nuclear Power Co., Ltd. (KHNP.)
- S. M. Cho, S. J. Oh, A. Diab, Analysis of the in-vessel phase of SAM strategy for a Korean 1000 MWe PWR, Journal of Nuclear Science and Technology (2018).
- W. Ma, Y. Yuan, B. R. Sehgal, In-Vessel Melt Retention of Pressurized Water Reactors: Historical Review and Future Research Needs, Engineering, 2(1),103-111 (2016). https://doi.org/10.1016/J.ENG.2016.01.019
- Klein-Hessling, W., Sonnenkalb, M., Jacquemain, D., Cl ment, B., Raimond, E., Dimmelmeier, H., & Lindholm, I. (2014). Conclusions on severe accident research priorities. Annals of Nuclear Energy, 74, 4-11. https://doi.org/10.1016/j.anucene.2014.07.015
- Allison, C. M., Hohorst, J. K., Ezzidi, A., Naitoh, M., & Pericas, R. (2020). Development and Preliminary Assessment of the new ASYST-ISA Integral Analysis BEPU Code using the PBF SFD-ST Bundle Heating and Melting Experiment, a Typical BWR Under Fukushima-Daiichi-Accident-Like Thermal Hydraulic Conditions and PWR for a Steam Line Break in the Containment. In Proceedings of ICAPP (pp. 15-19).
- Theofanous, T. G. In-vessel retention as a severe accident management strategy. No. NEA-CSNI-R-1998-18. 1999.
- Prosek, A., & Cizelj, L. (2013). Long-term station blackout accident analyses of a PWR with RELAP5/MOD3. 3. Science and Technology of Nuclear Installations, 2013.
- Alexandra-Maria Udrescu and Aya Diab. (2020). A SE Approach to Assess the Success Window of In-Vessel Retention Strategy. Journal of Systems Engineering, 16 (2), 27-37.
- Sehgal, B. R. Accomplishments and challenges of the severe accident research. Nuclear Engineering and Design 210.1-3 (2001): 79-94. https://doi.org/10.1016/S0029-5493(01)00433-2
- Innovative Systems Software (ISS), Idaho, USA (2020). ASYST VER.3 User Reference Manual-advanced Fluid Systems Thermal Hydraulics Analysis.
- Knudson, D. L., Rempe, J. L., Condie, K. G., Suh, K. Y., Cheung, F. B., & Kim, S. B. (2004). Late-Phase Melt Conditions Affecting the potential for In-Vessel Retention in High Power Reactors. Nuclear Engineering and Design, 230(1-3), 133-150. https://doi.org/10.1016/j.nucengdes.2003.11.029
- Kossiakoff, A., Biemer, S. M., Seymour, S. J., & Flanigan, D. A. (2020). Systems engineering principles and practice. John Wiley & Sons.
- Rey, K. A., Hruskovic, J., & Diab, A. (2023). Analysis of Control Element Assembly Withdrawal at Full Power Accident Scenario Using a Hybrid Conservative and BEPU Approach. Nuclear Engineering and Technology, 55(10), 3787-3800. https://doi.org/10.1016/j.net.2023.06.044
- Sadek, S., Grgic, D., Allison, C., & Perez-Ferragut, M. (2022). Uncertainty study of the in-vessel phase of a severe accident in a pressurized water reactor. Energies, 15 (5), 1842.