Dn

SD

h

•••••

a

ARRA

1

ib

0h

Nuclear Engineering and Design 260 (2013) 104– 120

Contents lists available at SciVerse ScienceDirect

Nuclear Engineering and Design

j ourna l h om epa ge: www.elsev ier .com/ locate /nucengdes

esign of integrated passive safety system (IPSS) for ultimate passive safety ofuclear power plants

oon Heung Chang, Sang Ho Kim ∗, Jae Young Choiepartment of Nuclear and Quantum Engineering, Korea Advanced Institute of Science and Technology, 373-1, Guseong-dong, Yuseong-gu, Daejeon, 305-701, Republic of Korea

i g h l i g h t s

We newly propose the design concept of integrated passive safety system (IPSS).It has five safety functions for decay heat removal and severe accident mitigation.Simulations for IPSS show that core melt does not occur in accidents with SBO.IPSS can achieve the passive in-vessel retention and ex-vessel cooling strategy.The applicability of IPSS is high due to the installation outside the containment.

r t i c l e i n f o

rticle history:eceived 11 June 2012eceived in revised form 14 February 2013ccepted 12 March 2013

a b s t r a c t

The design concept of integrated passive safety system (IPSS) which can perform various passive safetyfunctions is proposed in this paper. It has the various functions of passive decay heat removal system,passive safety injection system, passive containment cooling system, passive in-vessel retention andcavity flooding system, and filtered venting system with containment pressure control. The objectives ofthis paper are to propose the conceptual design of an IPSS and to estimate the design characters of theIPSS with accident simulations using MARS code. Some functions of the IPSS are newly proposed and theother functions are reviewed with the integration of the functions. Consequently, all of the functions aremodified and integrated for simplicity of the design in preparation for beyond design based accidents(BDBAs) focused on a station black out (SBO). The simulation results with the IPSS show that the decayheat can be sufficiently removed in accidents that occur with a SBO. Also, the molten core can be retainedin a vessel via the passive in-vessel retention strategy of the IPSS. The actual application potential of theIPSS is high, as numerous strong design characters are evaluated. The installation of the IPSS into theoriginal design of a nuclear power plant requires minimal design change using the current penetrationsof the containment. The functions are integrated in one or two large tanks outside the containment.Furthermore, the operation time of the IPSS can be increased by refilling coolant from the containment

outside into integrated passive safety tanks (IPSTs). The coolant in the IPSTs is used for various functionsin accident scenarios. Also, potential problems for the realistic installation of the IPSS are proposed andthe solutions to these problems are schematically described. IPSS is the design for the passive safetyenhancement in preparation for a loss of AC power. Consequently, it is designed for the supplementationand enhancement of current nuclear power plants, not as a replacement. The specific optimization designfor each current or future reactor will be studied as further works.

. Introduction

The decay heat removal is one of the most important problemsn nuclear power plants. The integrity of the reactor core muste preserved by removing the decay heat after a shutdown. Also,

∗ Corresponding author. Tel.: +82 42 350 3856; fax: +82 42 350 3810.E-mail address: proton@kaist.ac.kr (S.H. Kim).

029-5493/$ – see front matter © 2013 Elsevier B.V. All rights reserved.ttp://dx.doi.org/10.1016/j.nucengdes.2013.03.018

© 2013 Elsevier B.V. All rights reserved.

the integrity of the containment has to be protected in the eventof BDBAs to prevent a large release of radioactive materials. Inaddition, all accidents must be appropriately managed by meansof correct interpretations and prompt actions by operators. Fromthree points of views, three important lessons are derived for thesafety of NPPs from the Fukushima accidents.

First, the decay heat must be removed from core even if there isno AC power. The original cause of the Fukushima accident was theoccurrence of a station black-out (SBO). The decay heat could beremoved by passive safety systems during the initial stages of the

S.H. Chang et al. / Nuclear Engineering a

Nomenclature

ADS automatic depressurization systemADV atmospheric dump valveAFWS auxiliary feedwater systemAFWST auxiliary feedwater storage tankBAMP boric acid makeup pumpBDBA beyond design based accidentBWR boiling water reactorCARR center for advanced reactor researchCFS cavity flooding systemCHF critical heat fluxCLI cold leg injectionCMT core makeup tankDBA design based accidentDCH direct containment heatingDVI direct vessel injectionEC emergency condenserECCS emergency core cooling systemEDG emergency diesel generatorERVC external reactor vessel coolingFVS filtered venting systemHPCI high pressure coolant injection systemHPME high pressure melt ejectionHPSIP high pressure safety injection pumpHX heat exchangerIC isolation condenserIPSS integrated passive safety systemIPST integrated passive safety tankIRWST in-containment refueling water storage tankIVR in-vessel retentionLBLOCA large break loss of coolant accidentLOCA loss of coolant accidentLOCV loss of condenser vacuumLPSIP low pressure safety injection pumpMCCI molten corium concrete interactionMDP motor driven auxiliary feedwater pumpMFIV main feedwater isolation valveMSIV main steam isolation valveMSSV main steam safety valveMFL main feedwater lineMFLB main feedwater line breakNPP nuclear power plantRCP reactor coolant pumpRCS reactor coolant systemRV reactor vesselPAFS passive auxiliary feedwater systemPCCS passive containment cooling systemPCCT passive condensate cooling tankPCCWST passive containment cooling water storage tankPCT peak cladding temperaturePDHR passive decay heat removalPRHR passive residual heat removalPSIS passive safety injection systemPWR pressurized water reactorSBLOCA small break loss of coolant accidentSBO station black outSCP shutdown cooling pumpSG steam generatorSGTR steam generator tube ruptureSI safety injection

SIP safety injection pumpSIT safety injection tankTDP turbine driven auxiliary feedwater pump

nd Design 260 (2013) 104– 120 105

accident. On the other hands, many currently operating reactorsare dependent on the restoration of AC power in preparation for aSBO. However, in the Fukushima accident, it took about nine days torestore AC power due to the conditions around the site (Hatamuraand Yotaro, 2011). As shown in the accidents, it seems that the ACpower restoration from the off-site is not easy to mitigate accidents.Also, passive systems are needed to remove decay heat for morethan a few days. Therefore, the enhancement of passive decay heatremoval systems for long time mitigation on the current operatingand future reactors is necessary in some way or other.

For the second lesson, severe accident mitigations are neededin severe accidents. All the NPPs are designed to cope with severeaccidents. However, they have to be enhanced in preparation witha SBO. One of the methods is supplying the water coolant to themolten corium. It is important to decrease the pressure of contain-ment and confine radioactive materials in the water. There was nospecific passive safety system to retain the molten core in the reac-tor vessel in the Fukushima accident. Also, it is estimated that therelease of radioactive materials was quite low at 10 �Sv/h owingto the effect of water scrubbing in Unit 1 and 3. This figure can becompared to the release of 1000–10,000 �Sv/h after the explosionof Unit 2 without confinement by water (TEPCO, 2011). These find-ings show that injecting water into the core, even in the event ofsevere accidents, is feasible in water reactors to cool the coriumand for retaining purposes in the form of a passive method duringa SBO.

Thirdly, the Fukushima accident implies the necessity of theaddition of many passive safety systems, but simplicity and main-tenance of passive safety systems must be also considered to copewith severe accidents. During the Fukushima accident, none of theactive safety systems could be operated due to the SBO caused bythe tsunami. Also, even if there were some passive safety systems,they could not be operated feasibly in the event of human errorsand the system failures due to the lack of accident interpretationmeasures. In the case of unit 1, although the isolation condensers(ICs) had malfunctioned, personnel were under the impression theywere normally operating. In addition, after they knew of the mal-function of the ICs, they could not be repaired due to the lackof accessibility to the inside of the containment. In the case ofunit 3, shift operators became concerned about insufficient waterinjection by the high pressure coolant injection system (HPCI) andswitched off the HPCI manually at 2:42 a.m. on March 13, 2011 inspite of the absence of preparation measures to realize an alter-native water injection source (Hatamura and Yotaro, 2011). Whilethe nuclear power plants at Fukushima were BWRs, the accidentsequence shows the importance of simplicity and maintenance forthe proper and prompt operation of passive safety systems in alltypes of nuclear power plants.

These three lessons about safety systems have to be reflected inthe design of reactors. On the other hand, most current PWRs aredesigned with numerous active safety systems and a few passivesafety systems as well compared to BWRs. There have been manyresearches about passive safety systems for PWRs.

As a representative passive pressurized water-cooled reactor,AP1000 developed by Westinghouse incorporates many passivesafety systems (Schulz, 2006). The main reactor coolant system(RCS) is identical to that of 2/4 loop PWRs, meaning two steam gen-erators and four reactor coolant pumps (RCP). The main passivesafety system consists of passive emergency core cooling system(ECCS) and passive residual heat removal system (PRHR), as shownin Fig. 1. Passive ECCS is the mitigation system for a loss of coolantaccident (LOCA). When a LOCA occurs, core makeup tanks (CMTs)

can supply coolant into the core in the reactor vessel at a high pres-sure injection because they are connected to the cold lines of theRCS during operation of the reactor. After the injection from theCMTs, the coolant in the accumulators is injected into the core as

106 S.H. Chang et al. / Nuclear Engineering and Design 260 (2013) 104– 120

core

aat(iwAcigrtbc

ccomhistitiihHsu

pepta(

steam line, are closed for isolation of the turbines and condensers.At the same time, valves on the line connected to the HXs in passivecondensate cooling tank (PCCT) are opened. The steam from thesteam generator goes to the condensation HX through the steam

Fig. 1. AP1000 RCS and passive

mid-level pressure injection. After depressurization by either theutomatic depressurization system (ADS) or the break of the LOCA,he refueling water in in-containment refueling water storage tankIRWST) can be injected into the reactor vessel by gravity, as IRWSTs installed at an elevation higher than that of the reactor vessel. The

ater in the IRWST is originally used as supply water for refueling.lso, the sump has the function of gathering the water spilled in theontainment. As a main part of the preparation for non-LOCA, theres PRHR in the RCS. A loop is installed from the hot leg to the steamenerator. In the loop, a PRHR heat exchanger (HX) is installed toemove the decay heat. Finally, the decay heat is transferred fromhe core to the water in the IRWST through the PRHR HXs. It cane operated even at a high pressure about 15.0 MPa for shutdownooling.

As the AP1000 is used in steel containment, direct containmentooling is possible by water and natural air, shown in Fig. 2. Passiveontainment cooling system (PCCS) in the AP1000 mainly consistsf two systems. The first spills out the water from passive contain-ent cooling water storage tank (PCCWST) which is installed at the

ighest elevation of the containment. Heat from the containments removed by the evaporation of the water on the surface of theteel containment. The second method utilizes the flow path forhe intake and discharge of outside air. Heat from the containments transferred to the outside air along the designed flow path. Ashe PCCS from the containment outside can form a high heat sink,nternal condensation and natural recirculation in the containmentnside is possible with a lower heat source. The AP1000 achievesigh passive safety due to its use of various passive safety systems.owever, it is difficult to apply the concepts of the proposed passive

afety systems to other reactors to enhance the safety due to theses of original designs such as the IRWST and steel containment.

The center for advanced reactor research (CARR) in Korea pro-osed a new concept of a passive PWR termed the CP-1300 (Changt al., 1996). The CP-1300 is a CARR passive PWR-1300 MWe. CARR

roposed the concept for decay heat removal by natural circula-ion through the steam generator on the secondary side. It has beenpplied in researches on passive auxiliary feedwater system (PAFS)Bae et al., 2012). The PAFS was developed for use in the design

cooling system (Schulz, 2006).

of Advanced Power Reactor Plus (APR+) in Korea. Fig. 3 shows theconcept of the PAFS. For decay heat removal, the main feedwa-ter isolation valves (MFIVs) and the main steam isolation valves(MSIVs), which are installed on the main feedwater line and main

Fig. 2. Passive containment cooling system in the AP1000 (Schulz, 2006).

S.H. Chang et al. / Nuclear Engineering a

sPtlidcoccera2t

tt

Fig. 3. Concept of the PAFS in the APR+ (Cho et al., 2012).

upply line. It is condensed in the HX by heat transfer into theCCT. The condensed water comes back into the steam generatorhrough the return water line. This process forms the natural circu-ation by the steam generator as a lower heat source with the HXsn the PAFS forming a higher heat sink. In the design of the PAFS, theesign parameters of the HXs and pipes crucially affect the coolingapacity for decay heat removal. Some researchers have workedn designing a condensation HX for the PAFS and evaluating theooling performance using the thermal hydraulic system analysisode MARS (Multi-dimensional Analysis for Reactor Safety) (Baet al., 2012). It was concluded that PAFS satisfies the overall crite-ia for performance in the APR+ design. Other research conductedccidents analyses of the PAFS using the MARS code (Cho et al.,012). The analysis results show that the PAFS has enough capacity

o remove decay heat during the DBAs.

For the PCCS of PWRs, two concepts have been proposed fromhe research by CARR (Chang et al., 1996). They are designed toransfer the heat from the containment to the tank outside the

Fig. 4. APR1400 RCS and cu

nd Design 260 (2013) 104– 120 107

containment through internal or external condensers (Lee et al.,1997). When using external condensers, the steam and air mixtureflows into the steam intake in the containment and is condensedto water in the external condensers outside the containment.Finally, the condensed water and air are drained to the IRWST orare sprayed into the atmosphere of the containment. When usinginternal condensers, the steam–air mixture in the containment iscondensed on the outer surface of the condenser tubes. The heatfrom the containment is transferred to the condensers connectedto the tank outside the containment. The coolant in the condenserstransfers the heat to the tank by natural circulation. Related tothese two concepts for the PCCS, another study conducted acomparative assessment of PCCS concepts (Lee et al., 1997).

The previous studies of passive safety systems mainly focusedon applications for future reactors. However, it is also importantto propose new passive safety systems for the safety enhancementof currently operating PWRs given the lessons of the Fukushimaaccident, even if they cannot easily be applied.

The safety of a NPP can be enhanced by the application ofadditional passive safety systems in the enhanced preparation foraccidents involving a SBO condition. For the installation of new pas-sive safety systems in current nuclear power plants, the effects ofdesign changes must be minimized. These changes must not affectthe original functions and performances of the current systems asmuch as possible. Minimal changes from a new installation will behelpful to licensibility as well. This concept can be applied to futuredesigns of all types of nuclear power plants with design changesbased on the same design concept. To address the problems ofthe system complexity and accessibility as demonstrated by theFukushima accident, new safety systems need to be integrated andsimplified for maintenance and accessibility.

The objectives of this research are to propose and estimate anew safety system that solves safety issues related to the decay

heat removal and severe accident mitigation to prevent therelease of radioactive materials. It is an integrated passive safetysystem (IPSS) that can be operated by natural phenomena such asgravity, natural circulation and pressure differences. The five main

rrent safety system.

108 S.H. Chang et al. / Nuclear Engineering and Design 260 (2013) 104– 120

y Syst

fsiawsa

2

pu(oAcsa

r(pam

sbidanh

oIaahd

Fig. 5. Integrated Passive Safet

unctions of an IPSS are: (a) passive decay heat removal, (b) passiveafety injection, (c) passive containment cooling, (d) passiven-vessel retention and cavity flooding, and (e) filtered ventingnd pressure control. Analyses of the newly proposed functionsere conducted for SBO, SBO with MFLB, SBO with LBLOCA and for

evere accidents by MARS. Also, the design characteristics of IPSSre evaluated considering a realistic application.

. Concept of the IPSS design

Safety systems are divided into two groups: are active andassive. Most evolutionary PWRs have active safety systems thatse AC power from off-site power or emergency diesel generatorsEDGs) during accidents. Active safety systems have the advantagesf easily allowing a power increase and using proven technologies.ccordingly, if there is AC power, safety of a nuclear power plantan be easily achieved during DBAs. On the other hand, passiveafety systems are operated by means of natural phenomena suchs gravity, natural circulation and pressure differences.

Passive safety systems have the following advantages: (a) higheliability, (b) minimization of human errors, (c) simplification, andd) easy modularization. However, it is difficult to increase theower when using a passive safety system. In comparison withctive safety systems regarding their actuation and application,ost passive safety systems must be proven.Based on the advantages and disadvantages of active and pas-

ive safety systems, both active and passive safety systems muste installed in nuclear power plants for enhanced safety. However,

t is difficult to change the original design of a NPP in many casesue to the licensing and operation considerations so as to adapt andditional passive safety system inside the containment. Also, if aew design is applied to a nuclear power plant, numerous analysesave to be conducted again regarding its overall assessment.

An IPSS can be simply achieved by the application of large tanksutside the containment shown in Fig. 5. The specific design of anPSS consists of integrated passive safety tanks (IPSTs), pipes, valves

nd HXs which serve the main functions. IPSTs can be installed atny high location such as the top of an auxiliary building for a highead. The number of IPSTs can be one or more depending on theesigned thermal power and the condition of the nuclear power

em (IPSS) on a loop-type PWR.

plant. Two IPSTs are recommended for the consideration of singlefailure. Also, IPST can be installed as an atmospheric or pressurizedtank. In this paper, the IPST which is open to the atmosphere is pro-posed. In addition, IPST can be cooled by natural air even if the effectis small. An IPSS has five design functions. They are described interms of their respective conceptual performance measures below.

For the actual explanation of each function for an IPSS applica-tion, the OPR1000 (Optimized Power Reactor 1000 MWe) and theAPR1400 (Advanced Power Reactor 1400 MWe) designs developedby Korea are adopted for the reference reactor in this chapter.

One of the typical active PWRs is the APR1400 developed byKorea. The basic RCS is similar to that of the AP1000. There are twosteam generators and four RCPs. In preparation for a LOCA, thereare four safety injection pumps (SIP) which are operated by off-site AC power or EDG. They supply coolant from the IRWST to thereactor vessel by a method of direct vessel injection (DVI). This isdesigned even for operation within the high pressure of the RCS.Also, there are four safety injection tanks (SITs) which are operatedby means of the pressure difference during a LOCA. For the decayheat removal, there is an auxiliary feedwater system (AFWS) thatruns on a secondary circuit. Steam is generated in steam genera-tor and then goes to a small turbine connected to a turbine drivenauxiliary feedwater pump (TDP). The TDP is operated by a smallturbine. It can be operated under DC power. The main role of theTDP is to supply water from the auxiliary feedwater tank to thesteam generator. Decay heat removal using the TDP is one of thecurrent preparation strategies for a SBO in both the OPR1000 andAPR1400.

2.1. Passive decay heat removal

Two types of passive decay heat removal (PDHR) systems areproposed for the first function of the IPSS. They use steam gen-erators in the secondary circuit as a heat sink. The first design ofthe PDHR needs a HX in the IPST for natural circulation, though thesecond does not need this due to the gravity injection from the IPST.

For the first design of the PDHR, the decay heat can be removedthrough the steam generators shown in Fig. 6. The first conceptof the PDHR using a secondary condenser (SCs) was proposedwith the development of the CP-1300 (Chang et al., 1996). The

S.H. Chang et al. / Nuclear Engineering and Design 260 (2013) 104– 120 109

ocsstvl

(amsP

acatiimlwc

a9caictbit

docsdsg

Fig. 7. Second concept of the passive decay heat removal system in the IPSS.

Fig. 6. First concept of the passive decay heat removal system in the IPSS.

riginal concept was developed from the concept of an emergencyondenser (EC) used in BWRs. The design concept has been used inmall modular reactors too. One of the representative examples ishutdown condensing system in SIR reactor (IAEA, 1996). Becausehe steam generators are integrated and installed in the reactoressel, the heat source can be lower than the reactor design of theoop type. Also, due to small thermal power, it can be easily applied.

For large power reactor, the Advanced Power Reactor PlusAPR+) developed in Korea as the post-reactor of the APR1400dopts the concept of a PAFS instead of a conventional AFWS usingotor driven auxiliary feedwater pumps (MDPs) and TDPs in the

econdary circuit. The concept of the PAFS is identical to that of theDHR.

The first design of the PDHR in IPSS consists of the pipes, valvesnd HXs in the IPSTs. After a shutdown, the MSIV and the MFIV arelosed. At the same time, the valves on the lines of the PDHR systemre opened by DC power to form natural circulation. Accordingly,he steam goes to the HXs in the IPSTs, after which it is condensedn the HXs of the IPSTs. The water condensed from the HXs is vapor-zed again in the steam generators. From the momentum, heat and

ass transfer, two phase natural circulation is formed in the closedoop. The specific type and design of the HXs shown for the HXs

ith the vertical tubes in Fig. 6 can be changed depending on theondensation conditions of each plant.

The second concept of a PDHR is shown in Fig. 7. In normal oper-tion, steam generators are operated at a pressure between 6 and

MPa. With the occurrence of a SBO, the pressure in the secondaryircuit must decrease for water injection by gravity. Therefore,tmospheric dump valves (ADVs) which are installed for depressur-zation in the secondary circuit become open in accordance with theonditions which open the main steam safety valves (MSSVs). Afterhe pressure decrease in steam generators, the valves on the lineetween the IPST and the steam generator are opened. The water

n the IPST can be injected into the steam generator according tohe difference in the water level.

As the second design requires fewer components than the firstesign, it is simple to operate. Also, the applicability of the sec-nd type is higher than that of the first due to the required designhanges. As some reactors are designed to have a fire hose to theteam generator for decay heat removal during a SBO, the second

esign can use the current lines by connecting the IPSTs to theteam generators. However, because the steam heated in the steamenerators is not used again in the second design, the designed

operation time of the second design would be shorter than that ofthe first design. According to the characteristics of reactors, eitherthe first or the second design can be adopted and installed in a reac-tor. Considering the systems to be installed, the simpler design isthe second, which is the direct gravity injection design for steamgenerators. However, the first design offers a greater capacity todecay heat than the second design. Also, several studies have shownthat the first concept of the PDHR can play the original role incurrent active systems such as the AFWS (Bae et al., 2012).

The PDHR system is operated during accidents which require aremoval of decay heat from the core. These include a loss of con-denser vacuum (LOCV), a steam generator tube rupture (SGTR), asmall break loss of coolant accident (SBLOCA) and a station blackout (SBO). For a main feedwater line break (MFLB), even if one steamand feedwater line cannot be used, the decay heat can be removedvia the other line through the other IPST for both types of PDHRs.Accordingly, the water inventory per IPST has to be designed suchthat one IPST can remove the decay heat for the design basis timewhich is determined for the reactor. In APR1400, the decay heathas to be removed for 8 h to reach the state of a cold shutdown inthe RCS. Analytical studies of the heat removal capability of PAFSshowed that the PDHR system can also perform well during LOCVand MFLB (Cho et al., 2012).

During a LOCA, the inventory in the RCS decreases dependingon the size and location of the break. In the case of a SBLOCA, asthe coolant inventory slowly decreases, the initial treatment has tobe the decay heat removal. With a slow rate of depressurization,it is not easy to inject the coolant into the core. Also, the steamgenerator can be used as a heat sink in the RCS due to the sufficientinventory of the coolant. On the other hand, in the case of a LBLOCA,as the coolant inventory rapidly decreases, the initial treatment hasto be a coolant injection into the core. The steam generator cannotbe used as a heat sink, even if there is a system to remove decayheat in the secondary circuit. Also, even if the coolant is injectedinto the core, it is continuously spilt due to the break. This meansthat a continuous injection is needed for the mitigation of a LBLOCA.In addition, there is a possibility that both the safety injection intoreactor vessel and the decay heat removal through steam gener-ators are needed for inventory in the RCS. This situation requiresthe functions of PDHR and PSIS from IPSS. Consequently, a functionto remove decay heat by injecting the coolant into the reactor ves-sel is specifically described in the next section as a passive safety

injection system (PSIS).

110 S.H. Chang et al. / Nuclear Engineering and Design 260 (2013) 104– 120

2

sHItadti

iactapoi

ifbpiivvrt

oibitIibwpimat

concept of a passive IVR strategy, as shown in Fig. 10. The passive

Fig. 8. Passive safety injection system.

.2. Passive safety injection

There are passive safety systems that use a gravity injection,uch as the low-pressure IRWST injection in AP1000 (Schulz, 2006).owever, problems can arise when attempting to control the

RWST during BDBAs due to the accessibility to the inside of con-ainment. Also, an elevation change of the IRWST is impossible for

currently operating reactor for the low-pressure injection. A newesign concept using a high head from an elevated tank is proposedo enhance the passive safety with the high accessibility due to thenstallation of IPST outside the containment for BDBA.

The objective of the PSIS in the IPSS is to inject coolant from IPSTsnto a reactor vessel for decay heat removal in cases of a LOCA with

SBO. Also, as boron is added to the IPSTs, the reactivity can beontrolled. The PSIS shown in Fig. 8 is designed with a pipe fromhe IPST to the reactor vessel. This is a system that supplements anctive safety injection system such as the SIPs in APR1400 for lowressure and long term injection. Accordingly, the PSIS is mainlyperated during a LOCA upon the failure of all active safety systemsn case of a loss of AC power.

The injection line can be connected by the method of cold legnjection (CLI) and by direct vessel injection (DVI), but DVI is pre-erred to CLI due to its wider applicability. At least three valves muste installed on the connection line of the PSIS. The isolation of bothressure boundaries for the RCS and the containment is crucial dur-

ng the operation of the reactor. Therefore, an RCS isolation valves installed near the reactor vessel. Also, a containment isolationalve is installed near the boundary of the containment. The thirdalve is a check valve to prevent a counter flow. As the flow from theeactor vessel to the IPST can release radioactive materials outside,he valve is installed on the injection line.

If a LOCA occurs and the active ECCS cannot be operated, valvesn the injection line are opened by DC power. The passive safetynjection from the difference in the water level can be achievedy natural depressurization due to the large loss of coolant dur-

ng a LBLOCA. In a case of SBLOCA, depressurization of the RCS byhe ADS is the most important step when injecting coolant fromPSTs. The ADS is normally operated by the actuation signal whichs generated from the overpressure in RCS. It can be also operatedy manual action of an operator. Most of the PWRs have the ADShich decreases the pressure through the valves installed on theressurizer. The depressurization lines are connected to the sparger

n the big tanks such as IRWST in APR1400 and AP1000. Further-

ore, the decrease of the RCS pressure is crucial in order to prevent

high-pressure melt ejection (HPME), which is regarded as one ofhe most severe accidents.

Fig. 9. Passive containment cooling system.

2.3. Passive containment cooling

To protect the containment integrity, decreasing the tempera-ture and pressure in the containment during all types of accidentshas to be accomplished. For containment cooling, most nuclearpower plants use containment cooling pumps as an active safetysystem. Containment cooling pumps supply water for the contain-ment cooling spray. The temperature and pressure can decreasedue to the released droplets from containment spray.

The cooling method adopted in IPSS is a closed loop using aninternal condenser, as shown in Fig. 9. This design concept to coolthe gases in the containment was proposed in a previous paper (Leeet al., 1997). The operation of passive containment cooling is initi-ated by the valve open on the circulation line. The valves poweredby DC power are used. The criterion for the valve open is deter-mined from the design pressure of containment. From the valveopen, it forms a natural circulation loop with the heat source onthe HX in the containment and the heat sink in the IPST.

This also functions a supplementary safety system for the activesafety feature in NPPs. It has to be installed and operated to enhancethe safety of NPPs during BDBAs. From an overall assessment ofprevious works, this PCCS was estimated as simpler than any othersystem based on the operation of the system (Lee et al., 1997). How-ever, a seismic problem has to be considered in the actual design.Considering the level of water inventory effectiveness and relatedeconomics, it is estimated that this design is better than the con-cept of the steel containment cooling design using a PCCWST inthe AP1000. The size of the HX would be the key parameter for thecooling performance of this PCCS.

2.4. Passive in-vessel retention and cavity flooding

In-vessel retention through external reactor vessel cooling (IVR-ERVC) is the key strategy for the mitigation of severe accidents.Korean advanced nuclear reactors such as the APR1400 and APR+adopt an IVR strategy to protect the integrity of the reactor vessel inorder to mitigate a core melt accident. However, the system for theIVR is set to fill the cavity using shutdown cooling pumps (SCPs) inthe APR1400. Chances are that there would be no electrical powerfor the operation of the SCPs during a severe accident. Accordingly,the installation of pipes from IPSTs to the cavity can accomplish the

IVR strategy enhances the current IVR strategy as a backup sys-tem of the active system. The valve on the passive IVR line will beopened by DC power from a battery when the melting of the core

S.H. Chang et al. / Nuclear Engineering and Design 260 (2013) 104– 120 111

iimwai(tet

IivtIs

flEwbcCiAf0a

2

laoeAf

ebtf

Fig. 10. Passive in-vessel retention and cavity flooding system.

ndicates. The cavity can be filled with water from the IPST accord-ng to the water elevation difference. For the APR1400, the cavity

ust be filled within 40 min up to the elevation of the cold legs,hich is the target elevation in the IVR-ERVC strategy. In addition,

pproximately 360 tons would be refilled from the IPST to the cav-ty for 8 h to perform the function of a boric acid makeup pumpBAMP) under the current active IVR-ERVC strategy. The water haso be refilled in order to maintain the water elevation as the waterlevation decreases due to water vaporization over a time of morehan 8 h.

There have been many researches about the coolability for theVR conditions after the water is filled in the cavity. The main issues the critical heat flux (CHF) on the outer surface of the reactoressel bottom head. The concept of IPSS only proposes the methodo fill the water as an initiation method for the IVR-ERVC strategy.t is expected that the sequence would be the same as the originaltrategy after the filling.

This design concept can also perform the function of a cavityooding system (CFS) for the ex-vessel cooling of a molten core.ven in the event of the failure of the IVR strategy, the coolingater from the IPST has to be supplied to the reactor cavity, driven

y gravity. After that, the coolant can cool down the debris in theavity and scrub fission products away. The main objective of theFS is to prevent direct containment heating (DCH) by mitigat-

ng the effects of molten corium concrete interaction (MCCI). InPR1400, the reactor cavity is designed to have a heat transfer area

or corium cooling. The criterion is that the area must be larger than.02 m2/MWt (Lee et al., 2009). Passive CFS can be also adopted as

means of severe accident mitigation in the OPR1000.

.5. Filtered venting and pressure control

Mitigation of severe accidents has led to the suggestion or instal-ation of a filtered venting system (FVS) on most European plantsnd some US plants (Schlueter and Schmitz, 1990). Several designsf a FVS were introduced after TMI accidents. The USNRC consid-red of the use of FVS in its long-term rulemaking (USNRC, 1980).lso, the IAEA suggested a FVS with various designs as a last-resort

eature to cope with beyond-design events (IAEA, 1994).Posterior to the Fukushima accident, the importance of a FVS,

specially a water-scrubbing venting system and a pressure controlecame obvious. There is a containment venting system throughhe suppression chamber that is meant to prevent containmentrom over pressurization in the Fukushima units. However, the

Fig. 11. Filtered venting system of the IPSS.

analysis of the Fukushima accident reported that the radiation doseincreased from 10 �Sv/h to 1000–10,000 �Sv/h after unexpecteddepressurization of the dry well in Unit 2 (TEPCO, 2011). The drywell is assessed to have been broken due to the pressure, consider-ing that its pressure suddenly decreased from 730 kPa to 155 kPa atthe same time. On the other hand, Units 1 and 3, which releasedradioactive materials through the suppression chamber, saw anincrease in the background dose of less than 10 �Sv/h. The accidentsequence shows the need for a FVS and controlled depressurizationfor severe accidents.

As a proven technology, the water-scrubbing system in MARKI suppression pools conservatively reduce radioactive material to1/5 and 1/10 of the original figures of the Mark II and Mark IIIpools (Dallman et al., 1990). The fully developed FVS of the Barse-bäck plant in Sweden was predicted to remove aerosol particlesand elemental iodine at a rate of more than 99.9% (Schlueter andSchmitz, 1990). IMI Nuclear has a developed commercial systemwith a water scrubber. Moreover, AREVA made a contract of theinstallation of the systems for Cernavoda plants in Romania.

The FVS in IPSS design shown in Fig. 11 has several character-istics. One of them is controlled depressurization without a largeincrease in the dose. The design of the FVS includes a Venturiscrubber system, a steam/moisture separator and a dry fiber filterwith a charcoal filter. The Venturi scrubber can remove radioactiveaerosols such as CsOH and CsI and elemental iodine by spargin,into the water. The dry fiber filter and charcoal filter can strain outre-vaporized aerosol and iodine from scrubbing water. This sys-tem is expected to reduce aerosol to 1/10,000 and elemental iodineto 1/1000 of the original amounts. In addition, N2 inert gas and achemical pH control system, which prevent hydrogen explosionsand control elemental iodine, respectively, are options dependingon the plant. All of these systems are operated according to the pres-sure difference as the driving force and are initiated by a rupturedisk.

The FVS and pressure control system are suitable for maintain-ing the containment integrity by providing passive venting. Thepressure increase caused by the formation of non-condensablegases can be controlled by filtered venting. Also, the steamaccompanied with radioactive materials can be filtered for depres-surization. Overall, the destruction of the containment induced bya pressure increase can be prevented by depressurization even if

a small amount of radioactive materials is released through thesystem.

1 ering a

3

sTo

(

(

(

(

ci

(

(

12 S.H. Chang et al. / Nuclear Engine

. Design characteristics of the IPSS

The main functions of the IPSS concept proposed for the passiveafety enhancement of nuclear power plants have been described.he following noticeable points are reviewed regarding the conceptf the IPSS:

a) All of the safety systems adopted in the IPSS are operated inthe passive ways without any AC power. As multiple passivesafety concepts can be kept and achieved during severe acci-dents such as the Fukushima accident, nuclear power plants canbe preserved by each function of the IPSS. The multiple-passive-safety-system implies that the IPSS has multiple systems foreach step during accidents in spite of the failure of a step. TheIPSS can mitigate a BDBA before a severe accident. Even if it failsand a severe accident occurs, the IPSS can mitigate severe acci-dents based on a SBO to prevent the large release of radioactivematerials.

b) The IPSS is an integrated and simplified design. The IPSS isdesigned for five functions according to the IPSTs and therelevant components, including the HXs, pipes and valves.Therefore, during severe accidents, when active and passivesafety systems in the containment cannot be used, utilities canmitigate accidents mainly via the IPSS, which has integratedfunctions. In addition, the IPST, which is the key system for theIPSS, can function as a heat sink, a water source and/or a mediumfor scrubbing radioactive materials. It is basically designed to besimply operated and easily refilled with the water from the out-side of the containment. During the Fukushima accident, even ifthere had been passive safety systems in the containment, theywould have failed to be operated for long time. Also, the utilitiescould not easily have coped with the accidents. This is relatedto the complexity of the safety systems for managing accidents.On the other hand, as the IPSS is the final safety system of NPPsfor BDBA, the operator can resort to it in a case of the failuresof the current active and passive safety systems. Various safetyfunctions are integrated in the IPSS. Also, it is easy to understandand operate each function due to the simplified design.

(c) Very long-term cooling for decay heat removal is achieved bythe IPSTs which are installed outside the containment. Dur-ing an accident, the safety duration time can be increased byrefilling coolant from the containment outside into the IPSTs.As there were some accidents in which a human could notaccess the inside of the containment, this worsened the sit-uation. Accordingly, if the systems connected to the IPSS arepreserved during an accident, refilling into the IPSTs is one ofthe most effective ways to mitigate the results of an accident.

d) The IPSS has good characteristics in terms of the accessibilityand maintenance. These are also related to the presence of theIPSTs outside the containment. Easy accessibility and mainte-nance can mitigate an accident such as the failure of the IPSTs.If the problems related to IPSTs are solved outside, they couldperform the functions of an IPSS in the integrated and simplifieddesign.

e) The containment pressure can be controlled by the FVS. One ofthe IPSS functions is to serve as a FVS. This can be operated as ameans of containment pressure control. One problem is that thecontainment pressure cannot be controlled when radioactivematerials are released outside the containment. Two problemscan be solved by the application of the FVS in the IPSS.

Owing to the above positive characteristics regarding the con-ept of the IPSS, it is expected that the degree of safety enhancements very high. On the other hand, there are several considerable

nd Design 260 (2013) 104– 120

problems to be solved from a realistic point of view pertaining toconstruction and operation, as follows:

(a) A structural evaluation is required for the application of theIPSS on the roof of an auxiliary building. This is significantlyrelated to the seismic design of the containment as well as theIPST and auxiliary buildings. It is expected that a realistic appli-cation is possible from the examples of the installation of thelarge tanks in the AP1000 and APR+. On the roof of the AP1000,there is a PCCWST whose water inventory is about 3000 tons.As the proposed level of the IPST bottom is about 30 m fromthe ground level, the level of the PCCWST is much higher thanthat of the IPST. Also, it is assumed that the level of the IPSTis identical to that of the PCCT in the APR+. Even if the inven-tory is increased from 1700 tons to 2000 tons, it may be foundthat the installation is possible with an enhancement of thestructural supports and the seismic design. Finally, based onprevious designs of large tanks for safety systems, structuralenhancement measures have to be applied during the design ofthe IPSS.

b) The design of the IPSS can cause an increase in the degree ofpenetration of the containment. However, in order to apply itto currently operating reactors, the containment cannot be pen-etrated for new holes. Thus, the IPSS must use currently existingpenetration holes when applied. Also, the IPSS needs new con-nections from the IPSTs to components. The IPSS can simply usethe lines of the fire hose for the connection to the components.It needs some modifications by the connections on the reactorvessel and steam generator from the IPSTs. On the other hand,it is expected that it is best to apply the IPSS to the future NPPsbased on the original design. Although lots of new safety sys-tems proposed by engineers are innovative and valuable, theycannot be applied to current and future NPPs due to the real-istic problems related to the design modifications. However,the IPSS can be simply installed in currently operating PWRsby the application of one or more IPSTs. It does not require arearrangement of the current main components in the origi-nal design of a NPP. Finally, the containment may need to bereevaluated with the new installation of the IPSS for licensing.To approve the changed design, the small design changes withthe IPSS can offer high licensibility for current NPPs. The prac-tical application of the IPSS must be considered for trying tomake minimal design changes for the safety enhancement.

(c) The initiation of the IPSS must be defined for the operationmode. The IPSS is a supplementary system for the current safetysystems and does not substitute for their functions. Accordingly,a clear operation strategy for the IPSS has to be defined for eachreactor. If active safety systems by AC power can be operatedwell, it is clear that the IPSS does not need to be operated. Evenif a SBO occurs, there is the possibility that the functions of theIPSS must not be operated based on the conditions of the nuclearpower plant, such as a success of TDP operation or an early ACpower restoration. Finally, the IPSS requires an operation strat-egy for each function with consideration of the criteria of thetarget NPP.

d) The specific size of the IPST is determined by the thermalpower, multiple operation modes and the marginal time forAC power restoration and the refilling of water. The IPSS canserve multiple functions with the opening of valves. However,it is dependent on the water inventory in the IPST. The waterinventory in the IPST is directly related to the operation timepertaining to the marginal time of both AC power restoration

and the refilling of water into the IPST. For example, the PSISand the PCCS are operated in the case of SBO with LBLOCA.Its marginal time is clearly shorter than the case of a SBO. Aschematic inventory of 2000 tons as proposed in this paper is

S.H. Chang et al. / Nuclear Engineering and Design 260 (2013) 104– 120 113

MARS

(

Fig. 12. Nodalization diagram of the

designed for the capacity of decay heat removal and in con-siderations of the structure. The inventory of the IPSS must bedesigned according to the thermal power, adopted functionsand the marginal time to refill the water. For example, the sizeof the IPST can be decreased for application to small modularreactors due to the low thermal power. Accordingly, the IPSScan fulfill different tasks simultaneously. However, the opera-tion must be reflected in the marginal time. In addition, whenIPSS is applied to currently operating reactors, some functionswill be selected and others will not be installed for a realisticapplication. This is determined after a thorough evaluation ofthe conditions of each plant.

e) The operations of all functions excluding the FVS in the IPSS areinitiated from the operations of valves powered by DC power.The FVS is activated by the rupture disks. To determine thedegree of passivity, several broad categories of passivity weredrawn for a qualitative evaluation and classification in an IAEAreport (IAEA, 1991). The passive safety systems can be dividedinto four categories according to their characteristics. The func-tion of the FVS is included in category C, which is characterizedby no power source and moving mechanical parts. As the FVSis designed to be operated by rupture disks, it does not requirea power source. However, the other systems are included incategory D, which requires energy from batteries. Accordingly,

the reliability of IPSS is wholly dependent on the controls andreliability of the valves. In addition, isolation valves for main-taining the pressure boundary for the RCS and the containmentmust be installed on the pipes. For example, on the connection

model for the SBO in the OPR1000.

line from the IPST to the core for a passive ECCS, a RCS isola-tion valve and a containment isolation valve are installed witha check valve to prevent a counter flow. In addition, the appli-cation of manual valves has to be estimated in consideration ofthe severe condition like the failure of electrical systems.

4. Case studies

For an accident analysis using a system code, the OPR1000 isadopted for the reference reactor in Sections 4.1–4.3. As OPR1000is not designed for an IVR-ERVC, the APR1400 is adopted as thereference reactor specifically in Section 4.4 for an accident analysisinvolving a severe accident.

In order to prove the performance of the PDHR and the PSISduring SBO and the accidents that accompany a SBO, the MARS(Multi-dimensional Analysis of Reactor Safety) code was used inthe simulations (Jeong et al., 1999; KAERI, 2006). Fig. 12 shows theoriginal nodalization diagram of the OPR1000 used for the refer-ence simulation. Table 1 shows the design values and the calculatedresults of the steady state for the OPR1000 (Cho and Ahn, 2010).

The design concept of IPSS is described in the previous chapters.The practical dimensions of IPSS for the simulations are designedand shown in Table 2 as an application example. They are deter-mined from the consideration of original design of OPR1000. Also,

it reflects the SBO coping time of the reference reactors. Thetotal inventory in the IPST is mainly dependent on the thermalpower and safety coping time of the reactors. These simulationswere progressed in the assumption that the existent safety and

114 S.H. Chang et al. / Nuclear Engineering and Design 260 (2013) 104– 120

Table 1Comparison of design values and calculated results at steady-state for the OPR1000.

Parameters OPR1000(Designed)

MARS

Primary side Core power [MWt] 2815 2815Hot leg flow rate [kg/s] 7700 7717Hot leg temperature [K] 600.3 600.5Cold leg temperature [K] 569.2 569.0Pressurizer Pressure [MPa] 15.51 15.51

btt

4

eTtaatiitsfBitc

Ttalr

hT1nirfai

TD

Table 3Sequence of the SBO without and with the IPSS.

Time (s) SBO without IPSS SBO with IPSS

0 SBO occurrence5 Reactor trip

Turbine tripMFW isolation

2000 TDP operation (fail)2300 ADV open

IPSS operation2872 Steam generator dry out3600 Early AC power restoration (fail)4415 Core melt

Secondaryside

Feedwater mass flow rate [kg/s] 721.02 721.13Steam generator pressure [MPa] 7.38 7.38

ackup systems failed. Although it is sure that the probability ofhe assumption is so small, the objective of the IPSS is enhancinghe safety in the accidents with a SBO.

.1. Station black out

A SBO is defined as a complete loss of AC electric power to thessential and nonessential switchgear buses in NPPs (USNRC, 1956).here are numerous SBO scenarios dependent on the success orhe failure of each scenario step. The crucial current provisions for

SBO in the OPR1000 are summarized into two steps under thessumption of a successful reactor trip. First, the PDHR system ini-iated by DC power must be operated. In PWRs, TDPs are designedn OPR1000 to remove decay heat in the secondary circuit, as shownn Fig. 4. Also, for an active safety system in the secondary circuito remove decay heat, MDPs which can be operated by AC powerupply the coolant from secondary tanks referred to as auxiliaryeedwater storage tanks (AFWSTs) into the steam generators. InWRs, the IC removes the decay heat in the main loop. The steam

s naturally discharged from the core to HXs and is condensed inhe HXs. The condensed water goes back to the core by naturalirculation.

The second crucial provision for a SBO is to restore the AC power.his can be achieved by a connection to off-site power or by repair ofhe EDG. The restoration of AC power must be performed as quicklys possible under any condition. As the capacity of DC power isimited, it simply supplies the marginal time to supply AC power toeactors during a SBO.

Accordingly, the severest SBO scenario is the failure of the decayeat removal system and the failure of early AC power restoration.he criterion of early AC power restoration normally is set around

h. As there is no system to remove decay heat in the SBO sce-ario, it will cause early core damage and a containment failure

n spite of a reactor trip. In addition to these conditions, strategieselated to emergency preparedness on site, such as an injection

rom fire trucks, are exempt in this simulation. It is clear that therere many scenarios pertaining to a SBO; however, a simple scenarios adopted in the simulation to show the successful performance

able 2imensions of the IPSS application example for OPR1000.

Parameters Dimensions

IPST IPST number 2Water volume [m3] 2 × 2000Length × Width × Height [m] 13.5 × 13.5 × 11.1IPST pressure [MPa] 0.1 (atmospheric)IPST temperature [K] 300

Absolute elevation Water level in IPST [m] 41.6Bottom of IPST [m] 30.5Nozzle on steam generator [m] 12.8Nozzle on reactor vessel [m] 3.3Ground [m] 0Cavity floor [m] −13.7

of the IPSS in this paper, even if it is a limited and conservativeassumption.

The nodalization for the application of the IPSS in the OPR1000is shown in Fig. 13. The height and length of the components in theIPSS are designed under the design parameters of the OPR1000.The assumption that the IPST is installed on top of the auxiliarybuilding is applied in the simulation to simulate the elevation dif-ference for the water injection from the IPST. The water inventoryof an IPSS is set at 2000 tons from the necessary water inventoryfor each function. The height of the IPST is 11.1 m. The initialtemperature of the water in the IPST is set to 300 K. Because thefirst concept of the PDHR was successfully simulated and reportedin the previous studies, passive steam generator injection from theIPST as the second design of the IPSS PDHR is simulated with theinstallation of the IPSS in the OPR1000, as in Fig. 7. The elevationdifference between the top of the IPST and the injection hole of thesteam generator is 28.8 m based on the current OPR1000 design.

The severest SBO scenario that could cause core damage wassimulated. The additional event pertaining to a SBO was the failureof TDPs operation at 2000 s after the occurrence of the SBO and thefailure of AC power restoration within 3600 s. Based on the SBO con-ditions and the additional events, two cases are mainly simulated.The first is the sequence of a SBO without the IPSS and the secondis that of a SBO with the presence of the IPSS. The main sequencesare described in Table 3. The schematic simulation results are alsoincluded in Table 3. The simulation time is set to 8 h to cope withthe SBO according to the performance of the functions.

The PDHR of the IPSS is designed to be operated upon the failuresof the TDPs. There is a delay time of 300 s between the notification ofthe failure of the TDP and the initiation of IPSS operation. The grav-ity injection from the IPST to the steam generators can arise fromdepressurization in the secondary circuit. For depressurization, thecondition is set such that the ADVs are open at the same time ofthe IPSS operation. In the simulation, a single failure is assumed forthe valves. Finally, two ADVs are open at 2300 s in the simulation.The decrease of pressure is shown in Fig. 14. In addition, the open-ing pressure of the MSSVs is set to 8.6 MPa and the assumption ofa single failure is also applied. The result of the simulation showsthe opening of two MSSVs at 7 s after the overpressure signal in thesecondary circuit. Therefore, the pressure in the steam generatordoes not increase.

The simulation of the SBO without the IPSS results in steam gen-erator dry out at 2872 s from the limited assumption of the failureof the TDPs. Also, the core melts at 4415 s in the simulation fromthe failure of AC power restoration for 1 h.

On the other hand, in the case of the SBO with the IPSS, thesteam generators can be filled from the mass flow formed by thewater level difference between the IPST and the steam generators.The pressure variation of steam generators and PDHR injection line

is shown in Fig. 15. The pressure of PDHR injection line means thepressure of the lowest part in the pipe which is connected from IPST

S.H. Chang et al. / Nuclear Engineering and Design 260 (2013) 104– 120 115

S and

t0

wtAtmt

thermo-hydraulics. In the simulation, the case with the IPSS can

Fig. 13. Nodalization diagram for the PSI

o the valve. The pressure for the operation of PDHR is designed at.38 MPa shown at 0 h in Fig. 15.

The mass flow rate by gravity injection is presented in Fig. 16ith a comparison to those by the TDPs and MDPs. The case of

he TDP shows the results from the current provision of the SBO.lso, the values of the MDPs are presented for the comparison with

he performance of the active safety system. It is estimated that the

ass flow rate from the IPST to the steam generator is large enough

o remove the decay heat.

Fig. 14. Steam generator pressure variation in the initial period of SBO.

the PDHR #2 of the IPSS in the OPR1000.

Even if the mass flow rate decreases due to the decrease inthe water level in the IPST, the decay heat can be removed by adirect steam generator injection of more than 8 h. Fig. 17 showsthe values of the peak cladding temperature (PCT) in each case. ThePCT is the key criterion for the mitigation of accidents. Also, sta-bilization of the PCT indicates the safety of the reactor in terms of

cool the core faster than that with the TDP under the given con-ditions. Fig. 18 concerning the pressure in the RCS shows that thecase with the IPSS will not cause the pressure to increase in the RCS.

Fig. 15. Pressure variation of steam generator and PDHR injection line for totalsimulation time.

116 S.H. Chang et al. / Nuclear Engineering and Design 260 (2013) 104– 120

Fig. 16. Comparison of mass flow rate from each auxiliary feedwater system.

Fig. 17. Peak cladding temperature with and without the IPSS PDHR.

Fig. 18. RCS pressure with and without the IPSS PDHR.

Fig. 19. Mass flow rate from the IPST to the SG #1 (intact).

The results of the SBO simulation show that the second concept ofPDHR in IPSS can sufficiently remove the decay heat. The injectioninto the steam generators is possible with the control of ADVs.

4.2. Main feedwater line break with SBO

A MFLB indicates the occurrence of a break in the main feed-water line connected to the steam generator. It causes the loss ofthe water inventory in the secondary circuit. For the function ofthe PDHR in the IPSS, this means that one line for the PDHR can-not be available. Accordingly, the water inventory in one IPST hasto be designed based on a single failure of the IPSS. APR+ adoptsthe concept of a PAFS in the secondary circuit. The applicability ofthis was positively reviewed and estimated (Cho et al., 2012). Forthe simulation in the MFLB with a SBO, a passive steam generatorinjection for the PDHR of the IPSS in the OPR1000 is adopted andcalculated. The overall sequence is identical to that of the SBO withthe IPSS, including the operation time of the PDHR. One differenceis the occurrence of the MFLB at the same time as the SBO in thesimulations.

The decay heat from the core is transferred to one intact steamgenerator in the MFLB. One steam generator plays the role of a heatsink for natural convection in the RCS. Fig. 19 shows the mass flowrate variation for 8 h, which is similar to that in the case of only aSBO. However, concerning the water level in the steam generatorsin Fig. 20, the mass flow rate formed from the IPST to the steam gen-erator fluctuates in comparison with that when cooling two steamgenerators. This is caused by the duration of the low water level inthe intact steam generator. From 40 min to 3 h, the water level in thesteam generator cannot be recovered by the prompt vaporizationof the injected water.

From the role of the heat sink by one steam generator, the massflow rates in the hot and cold legs on the first RCS line are formed bynatural circulation, as shown in Fig. 21. On the other hand, Fig. 22shows there would be a very small flow through the second RCSline connected to the second steam generator, which has a break ofthe main feedwater line. As it loses the function of a heat sink, theheat cannot be transferred by the second RCS line.

Consequently, Fig. 23 shows that the decay heat can be suf-ficiently removed for 8 h in the MFLB with a SBO. There was notemperature increase of the cladding at all core levels. Core level

1 means the lowest part of the fuel and core level 6 means thehighest part of that. The IPST connected to the steam generatorcan perform as a water source. The values of the water inventoryin the two IPSTs are presented in Fig. 24. The water inventory in

S.H. Chang et al. / Nuclear Engineering and Design 260 (2013) 104– 120 117

Fig. 20. Water level in the steam generators.

tT8A

Fig. 21. Mass flow rate on the first RCS loop (intact MFL).

he first IPST decreases while that in the second does not changed.

his also means that the decay heat can be removed for more than

h when using one IPSS for a SBO. Although the failure of the earlyC power restoration is assumed, one IPSS can ensure the safety of

Fig. 22. Mass flow rate on the second RCS loop (broken MFL).

Fig. 23. Cladding temperature on core levels.

a NPP during a MFLB with a SBO. Also, the first type of IPSS PDHRwould show a longer operation time due to the recirculation of thewater in the closed loop, as presented in the Fig. 6.

4.3. Large break loss of coolant accident with SBO

The concept of the PSIS in the IPSS is newly proposed in thispaper. In order to estimate the performance and applicability ofthe PSIS in the IPSS, a simulation was set up and conducted foran OPR1000 LBLOCA with a SBO to consider a BDBA. A LBLOCA isadopted because it is regarded as a boundary accident in DBAs. Also,the failure of active safety injections is assumed. In the originalOPR1000 design, there are three types of safety injection systems.As active safety systems, two high pressure safety injection pumps(HPSIPs) and two low pressure safety injection pumps (LPSIPs) aredesigned in preparation for a LOCA. Given the high pressure of theRCS, the HPSIPs are operated for a high flow head and a low massflow rate. At a low pressure, the LPSIPs are operated for a low flowhead and a high mass flow rate. As a passive safety system, thereare four SITs which are pressurized by nitrogen gas for operation atthe design pressure. At about 4.2 MPa in the RCS, coolant is injected

from the SIT to the reactor vessel by the CLI. The safety systems arepresented in Fig. 25.

In this simulation, a double-ended guillotine break on the coldleg is set. Fig. 25 shows the nodalization diagram for the LBLOCA.

Fig. 24. Water inventory in two IPSTs (intact and broken MFL).

118 S.H. Chang et al. / Nuclear Engineering and Design 260 (2013) 104– 120

MARS

TaTaaAidotP

IanPw

TS

in the PSIS injection lines and the IPST are maintained before theoperation of the PSIS. Due to the opening of the valve on the injec-tion pipe, the pressure on the injection pipe varies with that in the

Fig. 25. Nodalization diagram of the

he guillotine break is simulated by the open of two valves whichre the component number 011 and 013 on the cold leg in Fig. 25.he diameter of the cold leg is 30 in. The LBLOCA with a SBO occurst 0 s. The nodalization of the PSIS in IPSS presented in Fig. 13 islso applied to the model in Fig. 25. The height of the IPST is 11.1 m.s the DVI is adopted for the PSIS of the IPSS, the injection line

s connected to the component of 220-02 in the reactor vessel. Theifference in the levels between the bottom of the IPST and the partn the reactor vessel is 27.2 m. As this is surely greater than that ofhe PDHR line, the design pressure of the gravity injection for theSIS is higher than that for the PDHR.

The sequence of the LBLOCA with the SBO is described in Table 4.t is assumed that the four SITs are available, as they are not oper-

ted by AC power. Also, there is a delay time of 50 s between theotifications for the failures of the SIPs and the operation of the IPSSSIS. Also, for a comparison estimation of the IPSS PSIS, an accidentithout both active safety systems and the IPSS is also simulated.

able 4equence of the LBLOCA with the SBO by the IPSS application.

Time (s) LBLOCA with SBO

0 LBLOCA occurrenceSBO occurrence

0.1 Reactor tripTurbine tripMFW isolation

5 1 SIT injection (broken leg)15 3 SIT injection (intact leg)37 HPSIP and LPSIP (fail)87 IPSS PSIS operation

model for a LBLOCA in the OPR1000.

In addition, a LBLOCA without a SBO is simulated for a performanceestimation of the IPSS. The total simulation time is 1000 s.

Fig. 26 shows the pressure variations in the main parts. The pres-sure of the downcomer in the reactor vessel sharply decreases dueto the large break in a cold leg. The pressure for the operation ofPSIS is designed at 0.5 MPa shown at 0 s in Fig. 26. The pressures

Fig. 26. Pressure variation in reactor vessel and IPSS.

S.H. Chang et al. / Nuclear Engineering and Design 260 (2013) 104– 120 119

rfsati

tatTasttfsdmco3

fa

F

Fig. 27. Comparison of mass flow rate from each safety injection.

eactor vessel downcomer. This also means that the mass flow rateormed from the IPST to the core significantly depends on the pres-ure in the reactor vessel downcomer. Because IPSTs are designeds open tank for atmosphere, the pressure difference is created byhe water level and the pressure of the reactor vessel. Therefore,ntentional depressurization would be important in case of SBLOCA.

Fig. 27 shows the mass flow rate formed by the PSIS comparedo those of the current HPSIP and LPSIP in the OPR1000. As therere two LPSIPs in the OPR1000, the mass flow rate from the PSIS haso be doubled from that of the LPSIP under the design of two IPSTs.he flow area is determined from the mass flow rate of LPSIP. Also,s a single failure must be assumed, one injection line of the PSIS isimulated. If the pressure is low enough to inject the coolant fromhe IPST into the reactor vessel, a gravity injection would occur. Inhe OPR1000 case, the target pressure of reactor vessel downcomeror the operation of the PSIS is about 400 kPa. In the MARS codeimulation, after 38 s, the pressure is 168 kPa due to the pressureecrease from the large break. After 89 s, which is the expectedoment of initiation of the passive injection, the passive injection

an arise around 190 kPa, which is low enough for the operationf the PSIS. Finally, the mass flow by a gravity injection is about

00 kg/s in the simulation time.

The water inventory variation in the reactor core is presentedrom each safety injection condition in Fig. 28. For the comparison,

condition without any safety injection (SI) was also simulated and

ig. 28. Water inventory variation in reactor core from each safety injection.

Fig. 29. Peak cladding temperature from each safety injection.

presented. The simulation with no safety injection was automati-cally finished, as the PCT exceeds the simulation trip condition at361 s after the occurrence of the LBLOCA, as shown in Fig. 29. Thevalue of the PCT exceeds 1204 ◦C, which is the criterion tempera-ture for a LBLOCA. On the other hand, in the PSIS case, the passivesafety injection from the IPST results in a sufficient water elevationin the reactor vessel. This also proves that the value of the PCT wasstabilized as low. Also, it was simulated that the water inventoryof the reactor core by the PSIS is higher than that of the LPSI due tothe high mass flow rate. For an actual application to reactors, thediameter of the injection line could be optimized considering theperformance and applicability of the original design. Also, this isrelated to the safety duration time of the IPSS for a LBLOCA with aSBO before refilling the IPST with water.

4.4. Severe accident from SBO

After the occurrence of a SBO, if the recovery of AC power failsfor long time, the temperature of the core would sharply increase,after which the core would be melt. There are numerous scenariosof SBOs related to the recovery of the AC power, the integrity ofthe passive decay hear removal system and the allowable responsetime. Even if the performances of the PSIS and the PDHR in IPSS areproperly estimated, preparation for a severe accident is necessaryas core IVR strategy. The installation of the IPSS represents a passivesafety enhancement for severe accidents.

The design containment pressure is 514 kPa. During severe acci-dents, the containment pressure would be less than 514 kPa, butthis is still high. However, as the elevation of the cavity is lowenough to fill the cavity, passive IVR through ERVC can be achievedto fill the water up to the elevation of the cold leg center line fromthe bottom of the cavity. In the APR1400, the difference in the levelsbetween the top of the IPST and the cavity is about 51 m, as shownin Fig. 10. The mass flow rate can be simply calculated from thedesign of the cavity filling line diameter. For example, the adoptionof an eight-inch filling line connected from the IPST to the cavity inthe APR1400 creates the variation of the water inventory in the IPSTand the cavity during a SBO, as shown in Fig. 30. Here, zero secondsdenotes the initiation of the IVR-ERVC strategy after the recogni-tion of the core exit temperature. This can be achieved in less than40 min, which is the original design time of the APR1400 by the SCP.The necessary mass for the IVR-ERVC is about 750 tons. In addition,

as the water level decreases due to vaporization by heating fromthe reactor vessel, water has to be supplied continuously. The waterlevel in the IVR strategy is maintained by refilling the water via the

120 S.H. Chang et al. / Nuclear Engineering a

FE

BI

mctfitaCrrbpio

5

ttvmeisItSttwIppIf

pd

ig. 30. Water inventory variation in IPST and cavity by filling the cavity for IVR-RVC.

AMP in the APR1400. Also, the water can be supplied from thePST to the cavity to making up for the low level of water.

This calculation proves that the function of P-IVR in IPSS canake a successful performance in severe accidents by filling the

avity. With the application of the P-IVR function, the strategy ofhe CFS for core ex-vessel cooling can be also achieved by passivelling. Even if the water inventory in the IPST is not enough to fillhe cavity for the passive IVR during SBO, passive CFS can mitigate

MCCI by cooling the corium in the cavity. APR1400 also adoptsFS by means of gravity filling from the IRWST. However, someeactors do not adopt passive CFS for ex-vessel cooling. After theesponse time of the SBO, the action for refilling the IPST has toe accomplished as a first response. The operation method of theassive IVR strategy related to the filling of the water into the cavity

s proposed in this paper. The successful duration related to the CHFn the surface of the reactor vessel is not considered.

. Conclusions

The IPSS proposed in this paper can perform the functions ofhe PDHR, PSIS, PCCS, P-IVR and CFS, and FVS with pressure con-rol. The enhanced passive safety concept can be simply achievedia the installation of one or more large tanks outside the contain-ent. Some main functions of the IPSS were newly proposed and

valuated. Other main functions of the IPSS were reviewed andntegrated from previous studies. With the MARS code as a systemimulation code, the accidents related to the performance of thePSS functions were simulated. All of the accidents were assumedo occur under a SBO condition. These were a SBO, a MFLB with aBO, a LBLOCA with a SBO and a severe accident from a SBO. All ofhe simulation results show that the IPSS can sufficiently removehe decay heat even if there is no AC power. The result of the MFLBith a SBO highlighted the need to consider a single failure of the

PSS. Also, the initiation of IVR-ERVC strategy can succeed by theassive filling of the IPSS. It is estimated that each function can beerformed under the safety criterion and can be integrated in the

PSS for easy control due to the level of simplicity in preparation

or complex accidents.

Most previous and current safety systems are operated by ACower. Also, it is difficult to control the inside of the containmenturing severe accidents. On the other hand, the functions of the IPSS

nd Design 260 (2013) 104– 120

can be operated by natural phenomena such as natural circulation,gravity and pressure difference. In addition, due to the installationof the containment outside, maintenance and accessibility of theIPSS are easy. The concept of very long-term cooling can be alsoachieved by refilling from the outside containment into IPSTs forcontrolling the water level.

The IPSS can be applied to current or future designs of NPPs,including large power PWRs, small modular reactors and Gen-IVreactors with the design adoption and modification from the designconcept of IPSS. The installation and application of the IPSS can beeasily accomplished, as it requires only minimal design changes tothe original design of NPPs. The number of IPSTs is expected to beone or two depending on the thermal power and the selected func-tions for each reactor. For considering the single failure, two IPSSare recommended. Finally, from the enhanced safety, it is expectedthat the large early release frequency can be decreased. If there hadbeen a passive safety system like the IPSS at the Fukushima NPPs,a severe accident may have been avoided.

The IPSS is designed as a type of passive safety enhancement,not as a basic safety system for dealing with DBA. Accordingly, itdoes not replace current safety systems including safety pumps. Itsupplements current safety systems and provides additional pas-sive safety with numerous passive functions. It contains multiplesystems for each step from an accident sequence. For example, ifthe PDHR or PSIS does not operate well, the function of the passiveIVR would mitigate the accident.

This paper proposes the conceptual design and estimates theapplicability of the IPSS based on accident simulations and on aqualitative evaluation. The optimized calculations of specific designparameters for each component and overall analyses are the furtherworks for each specific reactor.

References

Bae, B.U., Yun, B.J., Kim, S., Kang, K.H., 2012. Design of condensation heat exchangerfor the PAFS (Passive Auxiliary Feedwater System) of APR+ (Advanced PowerReactor Plus). Ann. Nucl. Energy 46, 134–143.

Chang, S.H., et al., 1996. Conceptual design and safety analysis of advanced reactors.CARR/SDSA-9601. Center for Advanced Reactor Research, KAIST, Korea.

Cho, Y.J., Ahn, S.H., 2010. Assessment of MARS-KS using OPR-1000 nuclear powerplant transients. ICAPP 1, 1543–1550.

Cho, Y.J., et al., 2012. Analytical studies of the heat removal capability of a passiveauxiliary feedwater system (PAFS). Nucl. Eng. Des. 248, 306–316.

Dallman, R.J., Galyean, W.J., Wagner, K.C., 1990. Containment venting as an accidentmanagement strategy for BWRS with Mark I containments. Nucl. Eng. Des. 121(3), 421–429.

Hatamura, Y., 2011. The Interim Report of Investigation Committee on the Accidentat Fukushima Nuclear Power Stations of Tokyo Electric Power Company.

IAEA, 1991. Safety related terms for advanced nuclear plants. IAEA-TECDOC-626,Vienna.

IAEA, 1994. Status of advanced containment systems for next generation waterreactors. IAEA-TECDOC-752, Vienna.

IAEA, 1996. Design and development status of small and medium reactor systems1995. IAEA-TECDOC-881, Vienna.

Jeong., J.J., et al., 1999. Development of a multi-dimensional thermal-hydraulicsystem code, MARS 1.3.1. Ann. Nucl. Energy 26 (18), 1611–1642.

KAERI, 2006. MARS code manual volume II: input requirements. Korea AtomicEnergy Research Institute, KAERI/TR-2811/2004, Daejeon, Korea.

Lee, S.S., Kim, S.H., Suh, K.Y., 2009. The design features of the advanced powerreactors 1400. Nucl. Eng. Technol. 41 (8), 995–1004.

Lee, S.W., Baek, W.P., Chang, S.H., 1997. Assessment of passive containment cool-ing concepts for advanced pressurized water reactors. Ann. Nucl. Energy 24,470–471.

Schlueter, R.O., Schmitz, R.P., 1990. Filtered vented containments. Nucl. Eng. Des.120 (1), 93–103.

Schulz, T.L., 2006. Westinghouse AP1000 advanced passive plant. Nucl. Eng. Des.236, 1547–1557.

Tokyo Electric Power Company, Inc. (TEPCO), 2011. Fukushima Nuclear AccidentAnalysis Report (Interim Report).

USNRC, 1956. NRC Regulations 10 CFR 50.2.USNRC, 1980. NRC action plans developed as a result of the TMI-2 accident, NUREG-

0660.