The passive safety systems of AP1000 are designed to operate automatically at desired set-points. However, the unavailability or failure to operate of any of the passive safety systems will change the accident sequence and may affect reactor safety. The analysis in this study is based on some hypothetical scenarios, in which the passive safety system failure is considered during the loss of coolant accidents. Four different cases are assumed, that is, with all passive systems, without actuation of one of the accumulators, without actuation of ADS stages 1–3, and without actuation of ADS stage 4. The actuation of all safety systems at their actuation set-points provides adequate core cooling by injecting sufficient water inventory into reactor core. The LOCA with actuation of one of the accumulators cause early actuation of ADS and IRWST. In case of LOCA without ADS stages 1–3, the primary system depressurization is relatively slow and mixture level above core active region drops much earlier than IRWST actuation. The accident without ADS stage 4 actuation results in slow depressurization and mixture level above core active region drops earlier than IRWST injection. Moreover, the comparison of cladding surface temperature is performed in all cases considered in this work.
The concept of passive safety systems in nuclear power plants was evolved in the 1980s after the two major accidents of NPP, that is, TMI and Chernobyl. The concept of passive safety system is practically adopted in the design of generation III and III+ reactors such as AP1000 by Westinghouse, EPR by Avera, and APR 1400 by Korea Electric Power Corporation (KEPCO).
The AP1000 is an advanced pressurized water reactor (PWR) designed by Westinghouse. The special features which differentiate AP1000 from other conventional power plants are their passive safety systems. These passive safety systems rely on natural forces such as natural circulation, compressed gas, gravity, and free convection to ensure plant safety in case of accidents. These passive safety systems provide adequate simplifications in plant design and reduce the size and number of components as compared with the plants equipped with active safety systems [
The important AP1000 passive safety systems comprise two core makeup tanks (CMTs), two accumulators, Automatic Depressurization System (ADS), passive residual heat removal heat exchanger (PRHR HX), and in-containment refueling water storage tank (IRWST). The actuation sequence of these systems is based on actuation set-points at various parameters of AP1000 reactor system. As soon as the actuation set-point is reached, the operation of these safety systems provides sufficient core cooling and primary system depressurization. The designed base loss of coolant accident (LOCA) has been simulated by Westinghouse and the behavior and performance of the passive safety system were analyzed and it was concluded that the passive safety systems provide sufficient core cooling and ensure plant safety in case of LOCA [
In the past, many studies have been conducted on safety analysis of AP1000 safety systems is series of postulated accidents including LOCA using best estimate analysis codes such as TRACE, RELAP5, and NOTRUMP [
Most of the currently operating pressurized water reactors are generation II or generation II+ [
The purpose of the paper is to show the importance and performance analysis of passive safety systems in advanced PWRs during unexpected transients. The passive safety systems of AP1000 are designed to operate automatically without operator’s action during the unexpected transients and accidents. It is believed that all the passive safety system will work during accidents. However, there may be a possibility that any of the fully automated passive safety systems fails to operate in the course of the transient or accident. The author has considered some hypothetical scenarios to simulate the effects of failure of any of the safety systems and its consequences on the accident sequence and on the overall safety of the plant.
In this paper, an effort is made to analyze the small break LOCA in AP1000 without actuation/operation of some of the passive safety systems. In this study, a 10-inch small break LOCA is simulated in one of the cold legs of AP1000 by using RELAP5 and the core parameters have been analyzed in case of successful operation of all safety system, without one of the accumulators’ actuation, without actuation of ADS stages 1 to 3, and without actuation of ADS stage 4.
The paper is divided into various sections including Section
AP1000 passive safety systems are based on similar concept of conventional PWR safety systems with some modification and some additional systems. As CMTs for high pressure safety injection, accumulators are for middle safety injection IRWST for low pressure safety injection. The additional safety systems include the PRHR HX for passive core cooling and ADS system for primary loop depressurization [
The main categories of AP1000 passive safety system are the passive core cooling system (PXS) and passive containment cooling systems (PCS). The passive core cooling system is subdivided into passive residual heat removal system (PRHRS) for decay heat removal, passive safety injection system (PSIS) for safety injection, and automatic depressurization system (ADS) for primary loop depressurization. Figure
Schematic diagram of AP1000 passive safety systems.
Two cylindrical core makeup tanks filled with cold borated water at same pressure as that of primary loop are the part of AP1000 passive safety system. The volume of each core makeup tank is 70.8 m2 (
The AP1000 passive safety system is equipped with two spherical accumulators filled with cold borated water and pressurized with nitrogen gas. The accumulators provide cold borated water with relatively higher flow rate and in short time to the reactor pressure vessel (RPV) through DVI line if the primary pressure drops below 4.83 MPa.
The automatic depressurization system (ADS) is one of the important parts of passive core cooling system which depressurizes the primary loop to a pressure where passive safety injection actuates.
The automatic depressurization system (ADS) comprises set of valves which constitutes four stages of ADS. The first three ADS stages connect the pressurizer steam space to IRWST. The 4th stage is divided into two parts, that is, 4a and 4b, connecting the two hot legs to the containment atmosphere [
The controlled depressurization of primary loop through ADS during loss of coolant accident facilitates the passive safety injection through core makeup tanks (CMTs) and accumulators and through in-containment refueling water storage tank (IRWST) to mitigate the effects of loss of coolant accident [
A passive residual heat removal heat exchanger is composed of a C-shaped tube bundle immersed in the IRWST which act as heat sink for PRHR HX. PRHR system depends on natural passive processes such as gravity and natural circulation to remove the decay heat from primary system at any pressure [
The IRWST filled with borated water at containment pressure is located inside containment and its discharge lines are connected with both DVI lines. Gravity driven cold borated water is injected by IRWST into primary system when the primary system pressure drops to nearly containment pressure. IRWST provides cooling for relatively longer time.
AP1000 reactor model has been developed in RELAP5. The model includes the primary loop, a part of secondary loop, and the passive safety systems required during LOCA. Nodalization diagram of AP1000 reactor is given in Figure
RELAP5 model for AP1000.
The passive safety systems that were modeled in RELAP5 include the two CMTs, two accumulators, PRHR HX, and IRWST. Two DVI lines were modeled which connect the CMTs, accumulators, and IRWST to reactor pressure vessel (RPV). The PRHR HX heat transfer tubes are lumped into a single component [
The primary system pressure is controlled by pressurizer controller. The controller maintains the primary system pressure by appropriately selecting the function of pressurizer spray, heaters, and relief valve. Trips are utilized to generate the error signal to the controller at particular set-points to start the function of spray valve or proportional heaters. The steam generator water level control is achieved by using built-in controller of RELAP5 by adjusting the feedwater flow. The feedwater valve position is regulated according to the desired feedwater flow, calculated water level in steam generator, and the flow rate of steam.
In this study, a small break loss of coolant accident is considered in one of the cold legs on nonpressurizer side of the primary loop. The 10-inch break size is considered which is the upper limit of small break LOCA. There are four different phases of small break LOCA in AP1000 reactor, that is, blow-down phase, the natural circulation phase, the ADS blow-down phase, and the IRWST injection phase [
As the break opens, the pressure of primary system starts decreasing due to loss of mass and energy from the break [
The draining of CMT balance line causes the water level to drop in CMTs and results in actuation of ADS stage 1 when the water level in either of the core makeup tanks drops to 67.5%. ADS stages 2 and 3 actuate with a specified time delay after actuation of ADS stage 1. The actuation of ADS causes further depressurization of primary loop and when the primary loop pressure reaches close to containment pressure, IRWST starts injecting the water into primary loop. Table
Actuation set-points and time delay assumption considered for AP1000 LOCA [
System/function | Actuation set-points | Time delay (sec) |
---|---|---|
Reactor trip | 12.41 MPa | 2 |
“S” signal generation | 11.72 MPa | 2 |
SG feedwater valves start closing | After reactor trip signal | 3.2 |
Main steam isolation valves start closing | After “S” signal | 4.8 |
Reactor coolant pumps trip | After “S” signal | 6 |
PRHRS isolation valve opens | After “S” signal | 0 |
CMT actuation | After “S” signal | 0 |
Accumulator actuation | 4.83 MPa | 0 |
ADS-1 actuation | After CMT water volume reduces to 67.5% | 20 |
ADS-2 actuation | 70 s after ADS-1 actuation | 30 |
ADS-3 actuation | 120 s after ADS-2 actuation | 30 |
ADS-4a actuation | 20.0% liquid volume fraction in CMT | 2 |
ADS-4b actuation | 60 s after ADS-4a actuation | 2 |
IRWST injection | Pressure < 89.6 kPa + containment pressure | 2 |
The steady-state analysis of AP1000 reactor is performed in RELAP5 with the model described in previous section and the obtained results are given in Table
Comparison of steady-state results.
Parameters | RELAP5 results | Actual value [ | Error |
---|---|---|---|
Core thermal power (MW) | 3410 | 3410 | — |
Coolant volume flow per loop (m3/s) | 9.93 | 9.94 | −0.01 |
RCS pressure (MPa) | 15.54 | 15.52 | +0.02 |
Core inlet temperature (K) | 553.91 | 553.82 | +0.09 |
Core outlet temperature (K) | 594.19 | 594.25 | −0.06 |
Core average temperature (K) | 574.05 | 574 | +0.05 |
SG secondary pressure (MPa) | 5.62 | 5.61 | +0.01 |
SG feedwater temperature (K) | 499.84 | 499.82 | +0.02 |
In this paper, a 10-inch small break LOCA analysis in one of the cold legs on nonpressurizer side of the primary loop is performed with all required passive safety systems. The actuation set-points for various systems considered in this analysis are shown in Table
Primary system pressure during LOCA.
Liquid discharge flow rate through break.
CMTs flow rate.
PRHR flow rate.
Mixture level in core upper region.
The actuation of IRWST (around 1800 sec) results in increasing mixture level above core active region. The author compared these results with the results found in literature and calculated from other codes and found that the AP1000 model considered in this study provides similar results and the model can be used for further LOCA analysis in AP1000 reactor which includes the effect of failure to actuate some of the passive safety systems on accident sequence and AP1000 reactor parameters during LOCA. The accident sequence of small break LOCA as calculated by RELAP5 is given in Table
Accident sequence during small break LOCA.
Safety system actuation | Time (s) |
---|---|
LOCA starts | 0 |
Reactor trip | 4.9 |
Generation of “S” signal | 6.7 |
Primary coolant pumps trip | 12.7 |
Accumulator injection | 95.2 |
ADS-1 actuation | 735 |
ADS-2 actuation | 805 |
ADS-3 actuation | 925 |
ADS-4 actuation | 1270 |
IRWST injection | 1786 |
AP1000 passive systems are designed to mitigate the consequences of accident to ensure the reactor safety. However, if any of the safety systems is not available or could not actuate during accident sequence, the accident sequence may change and it may also affect the other plant parameters during accident. In this study, an effort is made to analyze the AP1000 reactor parameters and accident sequence if any of the passive safety systems is not available or could not operate during small break LOCA. For this purpose, four cases were considered which are as follows: case-1: with all passive safety systems available; case-2: without actuation of one of the accumulators, case-3: without actuation of ADS stages 1–3; and case-4: without actuation of ADS-4.
Comparison of primary loop depressurization in case-1 and case-2 is shown in Figure
Comparison of pressure drop in case-1 and case-2.
In AP1000 model considered in this work, the accumulator-1 and CMT-1 are connected with the same DVI line and it has been assumed that accumulator-1 did not actuate during LOCA. The comparison of CMT-1 and CMT-2 flow rate in case-2 is given in Figure
Comparison of CMTs flow rate in case-2.
Comparison of CMTs level in case-2.
Due to actuation of only one accumulator, the core water inventory in case-2 is less as compared with case-1 in which both accumulators inject water in the reactor core. Comparison of mixture level above core active region in case-1 and case-2 is given in Figure
Comparison of mixture level above core active fuel region in case-1 and case-2.
The ADS stages are important for primary system depressurization which facilitates the passive safety systems to inject cold water into the core. The comparison of primary system depressurization in case-1 and case-3 is given in Figure
Comparison of pressure drop in case-1 and case-3.
Mixture level above core active region without ADS stages 1–3 (case-3).
The mixture level above core active region without ADS stages 1–3 is given in Figure
Comparison of CMT level in case-1 and case-3.
The comparison of cladding surface temperature of the axially central portion of fuel rod in a hot channel during LOCA is shown in Figure
Comparison of cladding inner wall temperature.
In case-4, the failure of ADS-4 is considered during small break LOCA. The comparison of primary system depressurization is given in Figure
Comparison of primary system depressurization during LOCA in case-1 and case-4.
Comparison mixture level above core active region in case-1 and case-4.
Comparison of CMT water level in case-1 and case-4.
The comparison of cladding surface temperature at the axially central portion of the fuel rod in hot channel in case-1 and case-4 is given in Figure
Comparison of cladding surface temperature in case-1 and case-4.
AP1000 is an advanced PWR which is equipped with passive safety systems. The passive safety system ensures reactor safety during accidents and transients. The passive safety systems are designed to operate automatically at desired set-points. However, there may be a possibility that any of the fully automated passive safety systems fails to actuate in the course of the transient or accident.
The analysis in this study is based on some hypothetical scenarios, in which the passive safety system failure is considered during the loss of coolant accidents. The importance and effects of passive safety systems and the effect of their availability/nonavailability on the accident sequence and on the overall plant safety are analyzed during small break LOCA.
Small break loss of coolant accident (SBLOCA) analysis is carried out in one of the cold legs of AP1000 reactor using RELAP5. The effect of various passive safety systems has been analyzed in LOCA sequence. Four different cases are considered including LOCA with the normal actuation sequence of all passive safety systems, without actuation of one of the accumulators, without actuation of ADS stages 1–3, and without actuation of ADS stages 4a and 4b. The steady-state results are nearly in agreement with the plant parameters available in literature. The comparison of results calculated in all cases shows that small break LOCA with normal sequential actuation of all passive safety systems provide adequate core cooling and provide sufficient water inventory into the core which ensures the reactor core is covered with water and safeguards the reactor safety.
The primary loop depressurization with only one accumulator actuation is relatively earlier than with actuation of both accumulators. The accumulator actuation reduces the CMT flow temporarily. However, in the case where only one accumulator actuation is considered, the CMT (on nonactuation accumulator’s DVI line) maintains relatively continuous flow and drains much earlier than other CMT. The early CMT draining causes early actuation of ADS and IRWST. Due to actuation of only one accumulator, less water inventory is injected into the core and the mixture level above core active region drops much earlier as compared with both accumulators’ injection. However, the mixture level increases with early actuation of IRWST.
In case of LOCA without ADS-1–3 actuation, the pressure drop is relatively slower due to nonavailability of ADS stages 1–3. This slow depressurization causes slow CMTs draining which results in the delayed actuation of IRWST. The mixture level above the active fuel region remains for longer time as compared with case-1 and case-2 because of absence of large flow area for primary system depressurization through ADS stages 1–3. The mixture level above core active region drops much earlier than actuation of IRWST which may cause core uncovery and may result in rise in fuel rod temperatures in later stages of LOCA.
The calculated results show that failure of ADS-4 could not depressurize the primary system to a pressure where IRWST could operate before the mixture level drops to core active fuel region. The effect of failure of ADS-4 on CMTs flow is relatively less as compared with the case where ADS-1–3 are not available for depressurization.
The comparison of cladding surface temperatures shows that the actuation of ADS helps the flow through CMTs for core cooling and the unavailability of ADS-1–3 reduces, to some extent, the core cooling capability due to slow CMTs draining. The failure of ADS-4 causes relatively higher cladding temperatures during LOCA which may increase significantly during later stage of LOCA if core uncovery occurs due to delayed actuation of IRWST.
The authors declare that there is no conflict of interests regarding the publication of this paper.