MAAP Station Blackout Analyses as a Support for the NPP ... · MAAP Station Blackout Analyses as a Support for the NPP Krško ... (Western European Nuclear Regulators ... safety and

Proceedings of the International Conference Nuclear Energy for New Europe, Bovec, Slovenia, Sept. 12-15, 2011

MAAP Station Blackout Analyses as a Support for the NPP Krško STORE (Safety Terms of Reference) Actions

Božidar Krajnc, Bruno Glaser, Robi Jalovec, Srđan Špalj Nuclear Power Plant Krško

Vrbina 12, 8270 Krško, Slovenia [email protected], [email protected], [email protected], [email protected]

ABSTRACT

Following the accident at the nuclear power plant Fukushima in Japan, the European Council declared that the safety of all EU nuclear power plants shall be reassessed taking into account extreme natural events such as earthquake and flooding, which create the challenge to the plant safety and could lead to the severe accident. European Nuclear Energy Forum (ENEF) defines the methodology under the name STORE (Safety Terms of Reference), based on the WENRA (Western European Nuclear Regulators’ Association) “stress tests” specifications, that are focused on the issues learned from the Fukushima accident. The European Commission and ENSREG (European Nuclear Safety Regulatory Group) members adopted the definition of a “stress tests” proposed by WENRA and how they should be applied to nuclear facilities across Europe. Accordingly, Nuclear Power Plant Krško has initiated the program that responds to the STORE actions. Also, in parallel, NEK addressed the strategies specified in NEI 06-12 “B.5.b Phase 2 & 3 Submittal Guideline” [1].

One of the STORE actions is to evaluate the prolonged loss of power and, consequently, to propose the actions and potential short term modifications in order to assure decay heat removal from the core as well as the actions to protect the last fission product barrier, i.e., the containment, what is the ultimate goal of the “Defense in Depth” principle. Thus, the long term Station Blackout (SBO) accident sequences for NPP Krško with loss of normal ultimate heat sink were analyzed using MAAP computer code and the results are presented within this paper.

1 INTRODUCTION

Considering the ENSREG (WENRA) stress tests specifications [2] and similar NEI guidelines [1], it is necessary to evaluate the consequences of loss of safety functions from any initiating event (earthquake or flooding):

• Loss of electrical power, including Station Blackout (SBO) • Loss of the ultimate heat sink (UHS) • Combination of both

The long term Station Blackout (SBO) accident sequences were analyzed with the focus on the containment response after the core damage.

These analyses were performed in order to evaluate and verify existing plant means (systems, equipment and procedures) and, also, the proposed plant modifications (alternative power, water and compressed air supply) and procedure changes (EOP – Emergency Operating Procedures and SAMG – Severe Accident Management Guidelines) to assure long term core cooling and, finally, containment integrity. The focus of the analyses are given to evaluation of the actions performed within procedures (EOP and SAMG), specifically the importance of timely RWST gravity drain to sump and initiation of Fire Protection System

905.2


spray to the containment. Accordingly, several scenarios, with respect to different Reactor Coolant Pump (RCP) seal leakage flow, availability of Turbine Driven (TD) Auxiliary Feedwater (AFW) Pump, possibility of gravitational feed from the Refueling Water Storage Tank (RWST) to the sump, the alternative spray/injection using the fire protection (FP) system, RCS depressurization and containment venting, were evaluated.

2 ANALYSES AND RESULTS

2.1 Analysis Method

The Modular Accident Analysis program (MAAP) Version 4.0.5 is used to analyze long term Station Blackout (SBO) accident sequences for Nuclear Power Plant (NPP) Krško. MAAP is a computer code [3] that can simulate the response of light water reactor power plants like NPP Krško during severe accident sequences, including actions taken as part of accident management. The code quantitatively predicts the evolution of a severe accident starting from full power conditions given a set of system faults and initiating events through events such as core melt, reactor vessel failure, and containment failure. Furthermore, models are included to represent the actions that could stop the accident by in-vessel cooling, external cooling of the RPV or cooling the debris in containment (ex-vessel cooling).

MAAP4 treats the spectrum of physical processes that could occur during an accident including steam formation, core heatup, cladding oxidation and hydrogen evolution, vessel failure, core debris-concrete interactions, ignition of combustible gases, fluid (water and core debris) entrainment by high velocity gases, and fission product release, transport, and deposition. MAAP4 addresses all of the important engineered safety systems such as emergency core cooling, containment sprays, fan coolers, and power operated relief valves. In addition, MAAP allows operator interventions and incorporates these in a flexible manner, permitting the user to model operator behavior in a general way. Specifically, the user models the operator influence by specifying a set of variable values and/or events which are the operator intervention conditions combined with associated operator actions.

MAAP is fast running code and most of the processes are modeled using ordinary differential equations without spatial dependency and phenomenological models were used. Such code is capable to predict correct overall behavior of the system, but local conditions are approximate due to both used models and rather crude subdivision (nodalization) of the object. Different parts of the model, including containment, have recommended ways how to prepare subdivision dependent on the type of the plant.

The plant itself, its systems and regions is modeled within the parameter file and the event sequence is externally controlled through input decks. A structured (symbolic) language can be used to model operator actions, control output of variables or model the deficiencies in the engineered safety features.

The MAAP parameter file primarily represents a database describing Krško nuclear power plant in some detail. It focuses on reactor coolant system, engineered safeguards and containment. The second important role of the parameter file is to supply control parameters, user and code controlled messages, print file parameters aimed at accurate simulation of plant operation. The NPP Krško parameter file is described in NEK ESD-TR-02/00, rev.0, NEK MAAP4 Parameter File Notebook [4].

2.2 Transient Description and Basic Assumptions

SBO scenario involves a loss of offsite power, failure of the redundant emergency diesel generators, failure of AC power restoration and the eventual degradation of the RCP seals resulting in a long term loss of coolant. It is assumed that AC power exists only on the

905.3


AC buses powered by inverters connected to the station batteries. Loss of all AC power results in unavailability of all normal electrical equipment and most of the safety electrical equipment. The only possible corrective actions are reactor trip and residual heat removal using steam generator (SG) safety and relief valves and turbine (steam) driven auxiliary feedwater (TD-AFW) pump. The loss of coolant increases the probability of core melt. The potential locations for coolant losses are primary coolant pump seals and pressurizer valves, depending on the conditions in the primary system during the loss of power.

Following the loss of all AC power the RCP seals would lose their cooling support systems and would undergo a severe thermal transient. The charging and letdown system would not be available so that there would be no make-up water supply to the seals. Component cooling water to the RCP thermal barrier heat exchanger would also be unavailable. Leakage of RCS fluid through the RCP seals would be a small loss of coolant accident (LOCA) without makeup capability which will lead to core uncovering and heat-up, and possibility for core damage. Depending on the availability of the heat sink and the RCP seal leakage rate, the SBO transient can result in vessel and containment failure.

The seal leakage rate is 21 gpm/RCP which can be applied to the plants using a high temperature o-ring RCP seal package, like those in NPP Krško [5]. However, the sensitivity cases with higher RCP seals leak flow rates are analyzed to access their influence on accident progression. The containment failure pressure is assumed to be equal to the pressure that defines containment overpressurization severe challenge, i.e., the set-point P04 from SCG-2 (Severe Challenge Guideline - Depressurize Containment) [6]. Therefore, the containment failure can be interpreted also as containment depressurization. The containment failure/depressurization pressure is 5.1 kp/cm2 (gauge) [7], which corresponds to a 15% probability of containment failure minus 0.5 bar, based on Individual Plant Examination (IPE) Level 2 analyses WENX 95/24 [8].

For a loss of all AC power event, the control room operator response would be directed by the ECA-0.0, “Loss of all AC power” procedure [9]. This procedure is focused on conserving the RCS inventory and assuring adequate decay heat removal until AC power can be re-established. The key action that is modeled in these analyses is to depressurize the steam generators (SG) using SG power operated relief valves (SG PORVs) to cooldown and depressurize the RCS (ECA-0.0, Step 17).

2.3 Results of the Analyses

2.3.1 Base Case

Following the loss of all AC power, RCP seals will lose their cooling and it is assumed that the coolant will be discharged through the seals from the beginning of the transient. The assumed seal leakage rate is 21 gpm/RCP. In addition letdown line is isolated, which consequently leads to the opening of letdown relief valve to pressure relief tank (PRT), increasing the coolant loss until RCS pressure decreases below valve set-point (42.2 kp/cm2).

Operator action to rapidly depressurize the secondary side to 20 kp/cm2 (~2 MPa), using SG PORVs, leads to primary side cooldown and depressurization (Figure 1). The RCS pressure decrease results in accumulator injection which lasted until the RCS pressure drops below 20 kp/cm2 when it is assumed that accumulators are successfully isolated. Turbine Driven AF pump does not require electric power and can operate if SG pressure is above 7 kp/cm2, so it can provide AFW injection. Taking into account the assumption that the AF regulator valves are operable (nitrogen or alternative compressed air supply is available) and that condensate storage tanks (CST) can be refilled, the secondary side heat sink is available towards the whole transient. The primary coolant loss is rather low and rapidly decreases

905.4


when the RCS water level falls below the leakage elevation (the break flow is pure steam). Consequently, the core does not uncover within 7 days (Figure 2), so the RCS and the containment integrity are not endangered.

It shall be pointed up that it is essential to provide whichever sources of heat sink (FW, AF or alternative using FP) and assure its long-term availability (condensate water or alternative source). This also includes the need for power and nitrogen or alternative compressed air supply for valves operation. These actions can prevent core damage and stops the progression of accident to the containment.

0 50000 100000 150000 200000 250000 300000 350000 400000 450000 500000 550000 600000T I M E (SE C O N D S)

Press

ure (

kP/cm

2)

0

20

40

60

80

100

120

140

160

180

RCS Pressure SG1 Pressure SG2 Pressure

Figure 1: RCS and SG pressure

0 50000 100000 150000 200000 250000 300000 350000 400000 450000 500000 550000 600000T I M E (SE C O N D S)

Temp

eratur

e (K

)

4 60

480

500

520

540

560

580

600

620

640Core Exit Temperature

Figure 2: Core Exit Temperature

2.3.2 Case with Seal Leakage 75 gpm/RCP

This scenario is similar to the Base Case with exception of leak flow rate which is assumed 75 gpm/RCP. This leak flow rate is large enough to cause substantial core damage even if the turbine driven AF pump and condensate water are available throughout whole transient. The heat sink is not sufficient to prevent the core damage since the accident is primarily governed by the higher RCS inventory loss. The core has uncovered at 3 days and 17 hours (Figure 3) and the core relocation starts one day after. There are no conditions for hot leg creep rupture since the RCS pressure is rather low and the reactor vessel failed by creep rupture 5 days and 2 hours after transient start. During the period from core uncovery to reactor vessel failure a substantial amount of hydrogen (320 kg) is produced in the core from Zirconium-Water reaction (Figure 4). A rather high amount of water which is spilled from RCS and accumulators prevents the MCCI (Molten Core Concrete Interaction) in the reactor cavity. After the vessel failure the containment pressure steadily increases. Nevertheless, in 7 days it does not reach the value at which the containment should be depressurized (5.1 kp/cm2 gauge). The containment pressure at 7 days is 4.7 kp/cm2 absolute.

Table 1: Sequence of main events for SBO scenario with Seal Leakage 75 gpm/RCP EVENT TIME (days, hours)

Accumulator water depleted 20.5 hours Core has uncovered 3 days, 17 hours Maximum core temperature has exceeded 2499 K 4 days, 12 hours Relocation of core materials to lower head started 4 days, 19 hours Hot leg creep rupture N/A Reactor vessel failed 5 days, 1.7 hours Containment failed N/A

905.5


0 50000 100000 150000 200000 250000 300000 350000 400000 450000 500000 550000 600000T I M E (SE C O N D S)

Temp

eratur

e (K

)

5 00

1000

1500

2000

2500

3000Max. Fuel Temperature Core Exit Temperature

Figure 3: Maximum Fuel Temperature and Core Exit Temperature

0 50000 100000 150000 200000 250000 300000 350000 400000 450000 500000 550000 600000T I M E (SE C O N D S)

Hydro

gen

Mass

(KG)

0

50

100

150

200

250

300

350Hydrogen Mass

Figure 4: Mass of Hydrogen produced in core

Three additional cases more were analyzed with the same leak rate (75 gpm/RCP), in

which the operator action to inject water using the Fire Protection (FP) System is assumed. These cases assume the injection of 20 m3/h, 40 m3/h and 80 m3/h of water from the Fire Protection System respectively.

It was supposed that the water is injected into the SG compartments and this can be one of the late and ultimate measures taken to protect the containment. The FP flow rate depends on the availability and characteristics of FP pumps. To access the influence of the different FP spray flow rates it is arbitrarily assumed that the spraying starts after the vessel failure when the containment pressure started to rise and reached the value of almost 3 kp/cm2 (500000 sec - 5 days and 29 hours). As expected, the benefit of such action is evident, what can be seen from Figure 5. The containment pressurization can be considerably reduced (FP flow 20 m3/h) or stopped and, further on, the pressure can be decreased for higher FP flow rates (40 m3/h, 80 m3/h). The use of portable pumps via FP system is one of the added actions in the new revision of SAMGs (SAG-4).

300000 350000 400000 450000 500000 5500 00 600000T I M E (SE C O N D S)

Pres

sure

(kp/

cm2)

1 .5

2

2.5

3

3.5

4

4.5

5NO FP FP 20 m3/h FP 40 m3/h FP 80 m3/h

Figure 5: Containment pressure, comparison for different injection using the Fire Protection System

2.3.3 Case with Auxiliary Feedwater not Available

This scenario differs from the base case only in the assumption that the auxiliary feedwater is not available after 4 hours. This is, actually, the loss of heat sink and it has major influence on the transient. The transient is similar to the base case for the first 4 hours, i.e., operator successfully performed cooldown and depressurization of RCS using SG PORVs

905.6


but, after the heat sink is lost, the RCS temperature and pressure started to increase (Figure 6 and Figure 7). RCS pressure reached the value of pressurizer safety valves setpoint which rapidly increased the RCS coolant loss. This creates the condition (high pressure and temperature) for hot leg creep rupture 11.8 hours. The leak through hot leg rupture depressurize the RCS and uncovers the core resulting in the production of high amount of Hydrogen (330 kg) from Zirconium-Water reaction. Further on the core relocates to the lower plenum and the reactor vessel fails at 16 hours from the beginning of transient. Consequently the containment pressure start to rise rather fast and, finally, the containment fails in 22 hours (5.1 kp/cm2 (gauge), Figure 8). In addition, there is a high amount of hydrogen produced by Molten Core Concrete Interaction (MCCI) after the core relocates into the cavity (more than 1800 kg in 7 days, Figure 9). The comparison with Base Case scenario emphasized the need for a heat sink (AFW) since it is essential to prevent core damage and stop the progression of accident to the containment if the HPIS (High Pressure Injection System) and LPIS (Low Pressure Injection System) are not available.

Table 2: Sequence of main events for base case with AFW unavailable EVENT TIME (hours)

Core has uncovered 10.4 hours Accumulator water depleted 11.9 hours Maximum core temperature has exceeded 2499 K 11.7 hours Hot leg creep rupture 11.8 hours Relocation of core materials to lower head started 14.5 hours RV failed 16 hours Containment failed 22 hours

0 10000 20000 30000 4000 0 50000 60000 70000 80000T I M E (SE C O N D S)

Temp

eratur

e (K

)

5 00

600

700

800

900

1000

1100

1200

1300

Core Exit Temperature

Figure 6: Core Exit Temperature

0 10000 20000 30000 4000 0 50000 60000 70000 80000T I M E (SE C O N D S)

Pres

sure

(kp/c

m2)

2 0

40

60

80

100

120

140

160RCS Pressure SG1 Pressure SG2 Pressure

Figure 7: RCS and SG pressure

0 10000 20000 30000 4000 0 50000 60000 70000 80000T I M E (SE C O N D S)

Pres

sure

(kp/c

m2)

1 .5

2

2.5

3

3.5

4

4.5

5

5.5

6Containment Pressure

Figure 8: Containment pressure

0 50000 100000 150000 200000 250000 300000 350000 400000 450000 500000 550000 600000T I M E (SE C O N D S)

Hydr

ogen

Mas

s (K

G)

0

200

400

600

800

1000

1200

1400

1600

1800

2000

H2 - Containment MCCI

Figure 9: Mass of Hydrogen produced by MCCI in containment

905.7


2.3.4 Case with RWST Gravity Drain to Containment

This scenario differs from the previous case in the assumption that RWST gravity drain to containment is established after 9 hours from the beginning of transient. This action prevents Molten Core Concrete Interaction and to extends the time to the containment failure. Containment failed in 39 hours compared with 22 hours for the case without RWST draining. The main reason to analyze this case is to highlight that any possible means to flood the containment using RWST gravity draining shall be assured in timely manner if it is judged that the RCS integrity would not be maintained. It must be emphasized that RWST gravity draining would not be possible in some situations if it is waited for the Core Exit Temperature indication (650 oC – SAMG entry set-point) because, at that time, the containment pressure can rise over the gravity head of the RWST (Figure 10). If this action is attempted to be performed on earlier set-point (370 oC – FR-C.1 Response to Inadequate Core Cooling) it may not be effective and it is only about 40 minutes from 370 oC or 650 oC. Even if the RWST is attempted to be drained on H-1 (Containment pressure > 0.28 kp/cm2, SAG-6) the limited amount of water may be injected. In addition, the care must be taken for the RWST inventory which shall be accounted for any further need to inject to RCS.

Pres

sure

(k

p/cm

2)

1.5

22.

53

3.5

44.

55

5.5

6

0 5000 10000 1500 0 2000 0 25000 30000 3500 0 4000 0 45000T I M E (SE C O N D S)

Tem

pera

ture

(K

)

500

600

700

800

900

1000

1100

1200

1300

1400

Core Exit Temperature Containment Pressure

pCONT=0,28 kp/cm2

t = 35600s

TCET=370°C

t = 38000s

TCET=650°C

t = 40700s

Figure 10: Core Exit Temperature and Containment Pressure - Setpoints used in EOPs and SAMG

3 CONCLUSION

The results of these analyses show that, during the long-term SBO, it is essential to provide the heat sink (FW, AF, FP) in order to prevent core damage and stop the progression of accident to the containment. It must be also emphasized that any possible means to inject water to flood the containment (RWST gravity draining or Fire Protection system) shall be assured in timely manner if it is judged that the RCS integrity would not be maintained. This action can prolong the time to the containment failure and substantially decrease the amount of hydrogen produced by MCCI in the containment. In addition, the spraying of the containment with water through the FP system, even actuated lately in the accident, can further reduce the pressure rise thus protecting the containment integrity.

It can be concluded that the existing plant resources (systems, equipment and procedures), together with the proposed STORE modifications (alternative power, water and compressed air supply, procedure changes), assure that the consequences of long-term SBO can be successfully mitigated.

905.8


REFERENCES

[1] NEI 06-12 B.5.b Phase 2 & 3 Submittal Guideline, Rev 2, 2006

[2] ENSREG Stress Tests Specifications, May 2011.

[3] MAAP 4.0.5 Users Manual, Fauske and Associates,

[4] NEK ESD-TR-02/00, rev.0, NEK MAAP4 Parameter File Notebook

[5] WOG 2000 Reactor Coolant Pump Seal Leakage Model for Westinghouse PWRs, WCAP-15603, Revision 1-A, June 2003.

[6] Severe Accident Management Guidelines (SAMG), rev.4, February 2010

[7] NEK ESD-TR23/00, rev.2, Krško Severe Accident Management Setpoint Calculation

[8] WENX 95/24, Individual Plant Examination of Krško Nuclear Power Plant, Level 2 Report, Westinghouse, August 1995

[9] NEK EOP-3.5, ECA-0.0, “Loss of all AC Power”, Rev. 14, 2009.

[10] NEK ESD-TR-05/11, rev.0, Station Blackout Analyses as a Support for the NPP Krško STORE Actions and the Strategies Addressed in B.5.b Phase 2 & 3 Submittal Guideline

[11] Westinghouse, “Krško IPE Level 2 Main Report”, WENX/95/24, 1995.

[12] Ch. DeBock, J. Hantjens, A. Kroes, R. Prior, “Krsko Nuclear Power Plant Reactor Cavity Flooding Evaluation Report”, WENX-00-08, rev.1, 2001.

[13] I.Basic, B.Krajnc, MAAP4.0.5 Sensitivity Analysis of the Molten Corium Coolability, IAEA Topical Meeting on Advanced Safety Assessment Methods for Nuclear Reactors, Korea Institute of Nuclear Safety, Daejon, Republic of Korea, 30 October – 2 November 2007

ABBREVIATION LIST

AC Alternating Current AFW Auxiliary Feed Water CET Core Exit Temperature CST Condensate Storage Tank CVCS Chemical and Volume Control System DCH Direct Containment Heating ECCS Emergency Core Cooling System ENEF European Nuclear Energy Forum ENSREG European Nuclear Safety Regulatory Group EOP Emergency Operating Procedures EU European Union FP Fire Protection

905.9


FW Feedwater HPIS High Pressure Injection System LOCA Loss of Coolant Accident MAAP Modular Accident Analysis Program MCCI Molten Core Concrete Interaction NEK Nuclear Power Plant Krško NPP Nuclear Power Plant PDP Positive Displacement Pump PRT Pressurizer Relief Tank, Quench Tank PZR Pressurizer RCP Reactor Coolant Pump RCS Reactor Coolant System RHR Residual Heat Removal PORV Power Operated Relief Valve RPV Reactor Pressure Vessel RWST Refueling Water Storage Tank Rx Reactor SAMG Severe Accident Management Guidelines SB LOCA Small Break Loss of Coolant Accident SBO Station Blackout SG Steam Generator STORE Safety Terms Of REference TDAFP Turbine Driven Auxiliary Feedwater Pump UHS Ultimate Heat Sink WENRA Western European Nuclear Regulators’ Association

Documents

MAAP Station Blackout Analyses as a Support for the NPP ... · MAAP Station Blackout Analyses as a Support for the NPP Krško ... (Western European Nuclear Regulators ... safety and