Long-Term Station Blackout Accident Analyses of a PWR with RELAP 5 / MOD 3 . 3

Stress tests performed in Europe after accident at Fukushima Daiichi also required evaluation of the consequences of loss of safety functions due to station blackout (SBO). Long-term SBO in a pressurized water reactor (PWR) leads to severe accident sequences, assuming that existing plant means (systems, equipment, and procedures) are used for accident mitigation. Therefore the main objective was to study the accident management strategies for SBO scenarios (with different reactor coolant pumps (RCPs) leaks assumed) to delay the time before core uncovers and significantly heats up. The most important strategies assumed were primary side depressurization and additional makeup water to reactor coolant system (RCS). For simulations of long term SBO scenarios, including early stages of severe accident sequences, the best estimate RELAP5/MOD3.3 and the verified input model of Krško two-loop PWR were used.The results suggest that for the expected magnitude of RCPs seal leak, the core uncovery during the first seven days could be prevented by using the turbine-driven auxiliary feedwater pump andmanually depressurizing the RCS through the secondary side. For larger RCPs seal leaks, in general this is not the case. Nevertheless, the core uncovery can be significantly delayed by increasing RCS depressurization.


Introduction
Following the accident at the nuclear power plant Fukushima Daiichi in Japan the "stress tests" had to be performed in European countries [1].Stress tests required evaluation of the consequences of loss of safety functions from any initiating event (e.g., earthquake or flooding) causing loss of electrical power, including station blackout (SBO), loss of the ultimate heat sink, or both.SBO scenario involves a loss of offsite power, failure of the redundant emergency diesel generators, failure of alternate current (AC) power restoration and the eventual degradation of the reactor coolant pump (RCP) seals resulting in a long-term loss of coolant.
In the literature there are many examples of station blackout analyses, using severe accident codes for simulations of station blackout scenarios with core damage in the first 24 hours, while several days (long-term) long simulations were very rare due to the scenarios selected, in which the heat sink was not assumed for longer periods of time.For example, in study [2] a TMLB hypothetical scenario of station blackout with no recovery of auxiliary feedwater at a 4-loop Westinghouse pressurized water reactor (PWR) was used to compare MELCOR, MAAP4, and SCDAP/RELAP5 severe accident codes.It was assumed that there is no operator or external intervention and pump seal failures do not occur.The simulations results were shown up to 7 hours.Similarly in the study [3] using ASTEC V1.3 integral code the simulations of a spectrum of break sizes along with SBO in VVER 1000/320 reactor were performed for maximum 10 hours for scenario with the latest lower vessel head failure occurrence.There are several other examples of SBO analyses performed up to 24 hours [4][5][6].
After Fukushima Daiichi longer term SBO analyses have been also performed.The study [7] dealing with Fukushima Daiichi station blackout scenarios using RELAP/SCDAPSIM investigated also a scenario, where emergency core cooling system was assumed to be lost after 70 hours, resulting in the longest simulation times up to 80 hours.It should be noted that RELAP/SCDAPSIM code is designed to predict the behavior of reactor systems during normal and accident conditions including severe accident up to the point of reactor vessel failure.As such it is very appropriate to simulate long-term sequences with core cooling available.Another example of long-term SBO is study [8], in which BWR longterm SBO accident was analyzed using TRAC-BF1 system code.The reactor core isolation cooling system was actuated in the unit 2 reactor and a stable thermal-hydraulic condition was maintained for about three days.After this time the calculation was terminated in 8 hours with complete core uncovery.The transient phenomena up to the severe fuel damage were in good agreement with the observed data at the unit 2 reactor of the Fukushima Daiichi nuclear power plant.In the study [9] a comparative analysis of typical PWR, boiling water reactor (BWR), and pressurized heavy water reactor (PHWR) is described using ISAAC and MAAP codes.No operator actions were credited; therefore the systems not depending on alternate current (AC) were assumed to be working during battery power supply for four hours, resulting in core uncovery in less than 10 hours for all reactors.The simulations were performed until containment failure occurred (the latest in the case of PWR in 113 hours).In the recent study [10] optimization of accident management measures following a station blackout accident in VVER-1000 is presented.Only systems powered by batteries and the passive safety systems (hydroaccumulators), BRU-A valve for secondary side depressurization (can be manually opened), and pressurizer relief and safety valves were assumed available.Two basic procedures were investigated to delay the time to core heatup, primary side and secondary side depressurization.The simulations performed by ATHLET Mod2.2 lasted up to 12 hours.Finally, "stress tests" have been performed for Krško nuclear power plant (NPP), which is a two-loop pressurized water reactor.One of the Krško NPP actions to respond to "stress tests" was to evaluate the prolonged loss of power.The Modular Accident Analysis Program (MAAP) Version 4.0.5 was used to analyze the long-term SBO accident sequences in 2011 [11].The operator action was used to rapidly depressurize the secondary side and then maintain the secondary pressure.Secondary side depressurization leads to the cooldown and depressurization of the primary side.The calculations were performed for different leaks through the reactor coolant pump (RCP) seals, modeled as breaks of different sizes.Namely, following the loss of all AC power, the RCP seals would lose their cooling support systems (the RCP seal injection flow and component cooling water to the RCP thermal barrier heat exchanger would be unavailable) and would undergo a severe thermal transient.The MAAP long-term SBO accident sequences were analyzed with the focus on the containment response after the core damage.
The aim of the long-term SBO analyses presented in Section 3 is to complement analyses performed in [11] by focusing on accident management strategies to delay the time to core heatup in the presence of reactor coolant pump seal leaks, with available secondary side heat sink.The analyses were performed for seven days or until the core heats up to 1500 K, whichever occurs earlier.In addition scenarios with heat sink being lost after four hours have been considered.Namely, for selected PWR the station blackout coping time is four hours [12].

Methodology Description
First station blackout accident is described for the selected plant.Then, the RELAP5/MOD3.3[13] used for calculations is described and the input model for selected PWR.Finally, the simulated SBO scenarios are described.
2.1.Station Blackout Accident Description.U.S. NRC 10 CFR 50.2 defines the station blackout as a complete loss of AC electric power to the essential and nonessential switchgear buses in a nuclear power plant (i.e., loss of offsite electric power system concurrent with turbine trip and unavailability of the onsite emergency AC power system).It does, however, not include the loss of AC power to buses fed by station batteries through inverters or by alternate AC sources, nor does it assume a concurrent single failure or design basis accident.Loss of all AC power results in unavailability of all normal electrical equipment and most of the safety electrical equipment.For the selected Krško PWR the only possible corrective actions are reactor trip and residual heat removal using steam generator safety and relief valves and (steam) turbine-driven auxiliary feedwater (TD AFW) pump.Due to the modifications performed in 2000 and after, no electric power is needed to operate TD AFW pump [11].This may be a major difference as compared to the typical PWR designs.The heat removal relies on additional nitrogen gas or alternative compressed air supply to the auxiliary feedwater control valves for filling both steam generators with TD AFW pump and to steam generator power operated relief valves (SG PORVs) for releasing steam from steam generators.In this way, the secondary side heat sink may be assumed available during the whole considered transient lasting seven days.
Following the complete loss of AC power the RCP seals would lose their cooling support systems, as the seal flow is lost.Component cooling water to the RCP thermal barrier heat exchanger would also be unavailable.Leakage of RCS fluid through the RCP seals would occur without makeup capability which may eventually lead to core uncovering, core heatup, and possibly core damage.Also, letdown line is isolated, which consequently leads to the opening of letdown relief valve to pressure relief tank, increasing the coolant loss until RCS pressure decreases below valve set-point (4.23 MPa).
The above design with the secondary side heat sink available on one hand and RCP seal leak on the other hand leads to the need for long-term station blackout simulations.Namely, it is expected that heat sink is sufficient, but due to RCS inventory loss sooner or later the core will uncover.With some exceptions, like Fukushima unit 2 accident simulation [8], most of the simulations described in Section 1 rely on power from batteries, including simulations performed for selected PWR dealing with extension of station blackout coping capability [12].This means that equipment was available during first four to eight hours of the transient only (depending on station blackout coping time), which leads to early core damage.[947] afw03c

RELAP5 Input Model Description.
To perform the analyses, Krško NPP has provided the base RELAP5 input model, which has already been used for several analyses, including reference calculations for Krško full scope simulator verification [14,15].The analyses were performed for uprated conditions (2000 MWt) with the new steam generators (SGs).
The base model consists of 469 control volumes, 497 junctions and 378 heat structures with 2107 radial mesh points.It was slightly modified for the purpose of these analyses.Direct injection of TD AFW into steam generators (AFW piping was removed from the RELAP5 model) was modeled as it was shown that the influence on results is negligible, while simulation runs about ten times faster.The input model without TD AFW piping consisting of 432 control volumes and 459 junctions and 378 heat structures (the number of heat structures remained unchanged) is shown in Figure 1.
Modeling of the primary side includes the reactor vessel, both loops, the pressurizer (PRZ) vessel, pressurizer surge line (SL), pressurizer spray lines and valves, two pressurizer power operated relief valves (PORVs) and two pressurizer safety valves, chemical and volume control system (CVCS) charging and letdown flow, and RCP seal flow.The reactor vessel (RPV) consists of the lower downcomer, lower head, lower plenum, core inlet, reactor core, core baffle bypass, core outlet, upper plenum, upper head, upper downcomer, and guide tubes.The primary loop is represented by the hot leg, primary side of the steam generator (SG), intermediate leg with cold leg loop seal, and cold leg, separately for loop 1 and loop 2. Loops are symmetrical except for the pressurizer surge line and the chemical and volume control system connections layout.The primary side of the SG consists of the inlet and outlet plenums, tube sheet, and the U-tube bundle represented by a single pipe.Emergency core cooling The secondary side consists of the SG secondary side (riser, separator and separator pool, downcomer, and steam dome), main steam line, main steam isolation valves (MSIVs), SG relief and safety valves, and main feedwater (MFW) piping.The TD AFW injects above the SG riser.The main steam line no. 1 has the same number of volumes as the main steam line no.2. The geometry data of both pipelines nevertheless differs.The turbine valve is modeled by the corresponding logic.The turbine is represented by time-dependent volume.The MFW and AFW pumps are modeled as time-dependent junctions.They are pumping water from the time-dependent volumes, which represent the condensate storage tank.
The control systems are not needed for the SBO simulation.Further details on the plant signals and control system schemes are available in [16].
Besides the main assumptions described in Section 2.1, for each scenario additional assumptions were used as shown in Table 1.Two different groups of scenarios were simulated: S0 scenarios with TD AFW pump assumed available all the time and S1 scenarios with TD AFW pump assumed available only during the first four hours.The four-hours assumption is based on the supply of nitrogen gas to control auxiliary feedwater control valves.For longer operation additional nitrogen supply is needed.The calculations were performed up to 604800 s (7 days) or heatup of the core up to 1500 K, whatever occurred first.The TD AFW pump does not require electric power and can operate if SG pressure is above 0.79 MPa (7 kp/cm 2 gauge).Therefore, a successful TD AFW injection to the SGs can be assumed for the whole transient analysis duration of seven days.
The seal leak rate of 1.32 l/s per RCP is assumed as representative for the plants using a high temperature O-ring RCP seal package, like those in NPP Krško [11].Different seal leak rates per reactor coolant pump were assumed in the sensitivity study (3.15 l/s, 4.73 l/s, 6.31 l/s, 9.46 l/s, and 18.93 l/s) for scenarios with TD AFW pump assumed available all the time (S0 scenarios).Leaks were modeled with equivalent break areas, estimated by assuming the density of 753.5 kg/m 3 and nominal pressure and temperature conditions (15.51 MPa, 578 K).This means that at lower pressures the RCP mass leak will be lower.While the RCS pressure was greater than 4.23 MPa, the letdown (LD) leak was modeled (5.68 l/s) in addition to RCPs leaks.In addition, the scenario with the largest RCP leak was simulated with assumed injection into RCS.This was achieved by using the positive displacement pump (PDP) assumed to be powered by an alternate diesel generator.
Besides simulating scenarios with TD AFW available whole transient time also scenarios with TD AFW available (S1 scenarios) only during the first four hours were performed for the base case with the RCP seal leak rate of 1.32 l/s at nominal conditions.Besides the base case (S1-21), also the cases with primary side depressurization were analyzed using one (S1-21v1) and two PRZ PORVs (S1-21v2).In the last case (S1-21p) injection by PDP charging pump was assumed.

Results
In total 44 calculations were performed for eleven scenarios at four different SG depressurization pressure set points.The calculations were performed up to 604800 s (7 days) or heatup of the core up to 1500 K, whatever occurred first.Figures 2 through 4 show the impact of depressurization on SBO, when heat sink is available during the whole transient.Figures 5 and 6 show the impact of RCP seal break size on the SBO with heat sink available during the whole transient time.Figure 7 through 10 show the impact of water injected into RCS using the PDP charging pump.Figure 11 shows the impact of available pressurizer PORVs or PDP charging pump on the development of the SBO for the cases with the heat sink available only during the first four hours.that with cooling of RCS through the break and the heat transferred to SGs the SG pressures start to decrease due to using steam to power TD AFW.Therefore also RCS pressure starts to decrease.Finally, from Figure 2 it can be concluded that the depressurization is beneficial from the point of time available before the core uncovery (see Figure 3) and the significant core heatup (see Figure 4).Only the base case S0-21 (all considered depressurizations) and S0-50 case (largest considered depressurization) indicate no core uncovery and heatup during the assumed 7-days-long transient.

Impact of RCP Seal Break Size on SBO: Heat Sink Available
Whole Transient Time.selected depressurizations.Additionally, RCS mass inventory is shown in Figure 6. Figure 6 shows that when RCS mass inventory drops below approximately 40 tons, the core starts to heat up.RCP break size (scenario S0-21) does not cause the core heatup in the first seven days due to sufficient RCS mass inventory.For other break sizes the relation between the break size and time of core heatup is almost inversely proportional.The larger the break size is the shorter the time of core heatup occurrence is.The results show that besides the smaller RCP break size also the depressurization significantly delays the core uncovery and core heatup (refer to Section 3.5, Table 2).

Impact of Injected Water into RCS on SBO: Heat Sink
Available Whole Transient Time.The comparison of the cases with the largest break size depressurized to 1.57 MPa with and without water injected into RCS is shown in Figure 7.The only difference in comparing the S0-300 and S0-300p scenarios is that PDP charging pump with the capacity to inject 2.2 kg/s into RCS is assumed to start four hours after transient start in S0-300p scenario.Namely, it is not sufficient just to cool the primary system, because the RCS inventory depletion may cause the core uncovery and heatup.The RCS inventory is maintained through the injection of cold water, if available.The simulation clearly shows that the capacity of installed PDP charging pump powered by alternate diesel generator would be sufficient to keep the core uncovered for all assumed break sizes, provided that secondary side heat sink is available.From Figure 7(a) it can be seen that the RCS pressure follows the secondary side depressurization in the first half of simulation time.Later, cooling through the breaks and steam consumed by the TD AFW pump is sufficient, provided that RCS injection by PDP charging pump is available.Core exit temperature (Figure 7(b)) shows that core heatup does not occur, when injection into RCS is available.The core collapsed liquid level is shown in Figure 7(c).Initially the level dropped due to stopped injection from accumulators and then remains around 90% in case with injection.Figure 7(d) shows the average fuel cladding temperature, which is decreasing.The mass discharged from the RCS (Figure 7(e)) and injected mass (Figure 7(f)) do not depend on the depressurization in the second half of simulation time.The injected mass to and discharged mass from RCS are practically balanced.The RCS system is efficiently cooled through the RCP seal breaks, by injection of cold water and through the secondary side cooling.The selected S0-300p case clearly shows that the RCS injection may be very important in preventing core uncovery.Particularly in the cases with larger RCP seal breaks this may well be the only way to prevent core heatup during the first seven days.
Figure 8 shows the plant state at time 80394 s, when the S0-300 (at 15.7 MPa depressurization set point) scenario calculation was stopped due to cladding temperature reaching 1500 K.The core is almost completely uncovered and the upper part of the core is heated up to 1500 K.The void fraction color map indicates that in the primary system some water is left in both loop seals and in both accumulators due to RCS pressure preventing further discharge.None of the safety system pumps is working (red color denoting stop position).Finally, some values of important parameters are displayed.For example, the decay heat power is 10 MW and RCS pressure about 1.5 MPa (see also Figure 2(f)).
On the other hand, Figure 9 shows S0-300p scenario with available injection into RCS.The RCS system is full of water,  and only U-tubes are slightly uncovered.Natural circulation provides heat transfer from the core to steam generators.Also it can be seen that one steam generator PORV is in open position.The detailed condition in the core is shown in Figure 10.When the core is covered with water, the heat transfer in the core is better.Also, the decay heat transferred from the core depends on the core flow which is oscillating and therefore decay heat power and transferred power may not be balanced continuously.Finally, arrows on Figure 10 show the direction of the flows in the reactor vessel.The red arrows indicate reverted flow.The main flow is from cold legs through downcomer via core to the hot legs.It can be seen that hot leg (HL) and cold leg (CL) flows are much smaller, when the core is uncovered.

Impact of Equipment Operation on SBO:
Heat Sink Available during the First Four Hours. Figure 11 shows dependence of SBO scenario with base case RCP seal break on equipment used when heat sink is only available during the first four hours (S1 scenarios).The additional equipment assumed is pressurizer PORVs and PDP charging pump.In S1-21 scenario, after TD AFW pump is lost, the SG and RCS pressures start to increase.When SG safety valves open, the SG and RCS pressures stop to increase.By opening of SG valves the steam generators empty and the RCS pressure starts to increase again.Pressurizer safety valves limit further pressure increase, which rapidly increased RCS inventory loss resulting in core uncovery and heatup.The capacity of PDP charging pump (case S1-21p) is not sufficient to cool the core, when secondary side heat sink is lost.It may nevertheless contribute to the substantial postponement of the core uncovery and core heatup, when compared to base case not assuming PDP charging pump (S1-21).
In scenarios with directly depressurizing the RCS using the pressurizer PORVs, from the view of core uncovery and heatup the operator action is not helpful.When two pressurizer PORVs are used (case S1-21v2), the core uncovery and heatup are even a bit faster compared to case with using one pressurizer PORV (case S1-21v1).However, primary side depressurization may be beneficial for the later phases of the accident, as it may minimize the dispersion of core debris in the reactor cavity.Table 2.The criterion for core uncovery was that the core collapsed liquid level falls below 80%.The criterion for significant core heatup was 1500 K.For the cases when calculation was aborted before the temperature 1500 K was reached for the hottest average fuel cladding, the results were linearly extrapolated based on the calculated core heatup rates (bold cells).
The calculated results of S0 scenarios with secondary side heat sink available during the whole transient show that the time before core uncovery or significant core heatup can be significantly prolonged by depressurization.For S1 scenarios with secondary side heat sink available during the first four hours, the benefit is seen for S1-21 and S1-21p scenarios, while in the case of S1-21v1 and S21-v2 scenarios depressurizing the RCS through pressurizer PORVs this is not so evident (the time period of depressurizing the RCS by secondary side was few hours only).

Discussion of Results.
The results of the simulations of long-term SBO show that the strategies to depressurize the RCS of PWR through secondary side in the case when secondary side heat sink is available can significantly delay the core uncovery and core heatup.In the case the turbine driven auxiliary feedwater pump is not available, portable fire protection pumps could be used to supply water into both steam generators, if steam generators are depressurized to 1.57 MPa.These pumps have enough capacity to maintain the level in both steam generators to provide natural circulation on primary side and by this enable decay heat removal.According to simulation results for the base case RCP seal leak rate, which is 1.32 l/s per RCP at nominal conditions for NPP Krško [11], the plant could be cooled with passive and mobile equipment at least one week.
However, the sensitivity study for all other possible RCP leaks showed that existing positive displacement charging pump could be very efficient in preventing the core uncovery due to RCP seal leaks in combination with secondary side decay heat removal.Such pump which does not need cooling can provide charging flow to compensate inventory losses in RCS due to RCP seal leaks and borate RCS to prevent the recriticality during cooling.
The study also showed that existing positive displacement pump capacity is not sufficient to prevent the core heatup, when secondary side heat sink is lost.In such a case an alternate safety injection system with sufficient capacity would be needed to enable feed and bleed cooling.The calculations are long lasting and therefore with transient time also the uncertainties may increase.The major concern could be timing of core uncovery and rod heatup.However, it was not in the scope of this study to treat the uncertainties.In the paper [17] describing the comparison of the short-term SBO results obtained by MAAP4 and CENTS computer codes it is indicated that the overall trends of key parameters are similar, and there are differences in the timing of significant occurrences (e.g., SG dryout, core uncovery).Also it is stated that although the timings and durations of key occurrences and actuations vary, MAAP4 predictions of core uncovery tend to be conservatively biased.This was confirmed also for Krško NPP MAAP 4.0.5 final calculations (in [11] preliminary results are presented).For example, as shown in Table 2 the RELAP5/MOD3.3for scenario S0-75 depressurized to 1.57 MPa core uncovery was predicted to occur in 3 days and 17 hours, while in the case of MAAP 4.0.5 calculations in 2 days and 17 hours.Finally, in [17] it was stated that a new MAAP5 code incorporates a momentum equation to model the primary side natural circulation flow rate and a more detailed SG model to more accurately predict secondary side behavior.Therefore, using MAAP5 would provide even better basis for evaluation of MAAP conservatism with respect to RELAP5/MOD3.3results.Also uncertainty analysis for RELAP5/MOD3.3would provide useful insights.In the study [18] describing short-term SBO uncertainty analysis for RELAP5/MOD3.2 it was shown for reference calculation with core uncovery occurring at 4000 s the time of core uncovery occurrence can vary up to 700 s (i.e., 18%).Therefore, sufficient time margins should be taken into account, when considering presented RELAP5/MOD3.3calculated times.

Conclusions
The long-term station blackout sequences for the Krško twoloop pressurized water reactor with loss of normal or all secondary side heat sinks were analyzed.The latest version of RELAP5/MOD3.3computer code with the verified standard model of a two-loop PWR was used for simulations.Different accident management strategies for SBO scenarios for different RCP seal leaks were investigated.The main strategies investigated were depressurization actions and the impact of assumed equipment operation.
The results suggest that with the expected magnitude of RCPs seal leaks, the core uncovery during the first seven days could be prevented by using the TD AFW pump and manually depressurizing the RCS through the secondary side depressurization.If the RCPs seal leaks are larger, the capacity of the RCS makeup through existing charging pump could be sufficient in addition to TD AFW pump to prevent the core uncovery and the consequential core heatup at least seven days after SBO initiation.Further it is shown that if the TD AFW (and any other heat sink) ceases to be available after 4 hours, the core will start to heat up in about 10 hours or less.The results also show that primary side depressurization through the secondary side is beneficial and core uncovery and heatup could be much delayed by using such strategy.Finally, the "stress tests" are required for severe accident management, if core is in the reactor vessel, to indicate time before water level reaches the top of the core and time before fuel degradation.It was demonstrated that RELAP5/MOD3.3could be efficiently used to indicate the required times besides the severe accident codes.
Description.RELAP5/MOD3.3 is best estimate thermal-hydraulic computer code delivered Science and Technology of Nuclear Installations 3

Figure 7 :
Figure 7: The case with the largest RCP break with (S0-300p) and without (S0-300) water injected into RCS by PDP: (a) RCS pressure, (b) core exit temperature, (c) core collapsed liquid level, (d) average fuel cladding temperature, (e) total mass discharged from RCS, and (f) total mass injected into RCS.

3. 5 .
Times Available before Core Uncovery and Significant Core Heatup.The times available before core uncovery and significant core heatup for simulated SBO cases are shown in

Figure 9 :
Figure 9: The case with the largest RCP leak (S0-300p) depressurized to 1.57 MPa with assumed RCS injection at time 80394 s.

Figure 10 :
Figure 10: The case with the largest RCP leak (S0-300p) depressurized to 1.57 MPa with (left) and without (right) assumed RCS injection at time 80394 s.

Figure 11 :
Figure 11: Dependence of parameters on equipment operation: (a) RCS pressure, (b) RCS mass inventory, (c) average fuel cladding temperature, and (d) total mass discharged from RCS.

Table 1 :
Set of scenarios analyzed for each of the four depressurization cases.

Table 2 :
Times available before core uncovery and significant heatup as a function of depressurization.