RELAP5 Foresight Thermal-Hydraulic Analysis of Hypothesis Passive Safety Injection System under LOCA for an Existing NPP in China

Division of Reactor Engineering Technology Research, China Institute of Atomic Energy, Beijing 102413, China Department of Engineering Physics, University of Wisconsin-Madison, Madison 53706, WI, USA China Nuclear Power Engineering Co., Ltd., Beijing 100840, China Fundamental Science on Nuclear Safety and Simulation Technology Laboratory, Harbin Engineering University, Harbin 150001, Heilongjiang, China


Introduction
Nuclear safety is an extremely important issue for nuclear energy application, especially after the occurrence of Fukushima Dai-ichi nuclear disaster in 2011, after when people become more concerned about the risk of nuclear power [1]. One solution to improve the safety performance under accident conditions is passive safety system application for nuclear power plants (NPPs). Another potential solution for using nuclear energy safely is moving the traditional NPP from lands to ocean to take advantage of infinite cooling source, sea water. Generally, this concept of NPP is called Offshore Nuclear Power Plant (ONPP) [2][3][4].
One of the options in the Chinese ONPP technology roadmap is to compress the mature and reliable Qinshan Phase One loop-type pressurized water reactor (PWR) into compact size. e loop-type PWR will be placed in a gravitybased structure (GBS) that is made of steel reinforced concrete [5]. GBS scheme brings two significant advantages: one is eliminating negative affect caused by the ocean environment motion such as heaving and inclination; the other is that ocean can act as infinite heat sink. However, there exists a disadvantage: to save the building cost for ONPP, the NPP has to be constructed in a limited space. Similar GBS scheme ONPP has been proposed by Korea Advanced Institute of Science and Technology (KAIST), and researchers applied APR1400 loop-type PWR [6] and SMART integral PWR [7] on GBS as new ONPP schemes.
Compact configuration of ONPP leads to simplified and reliable safety system implementation in the reactor hull. Generally, the passive core cooling system (PCCS) including passive safety injection system (PSIS) design has been applied under such circumstance to replace the active ones, and the PCCS can even help realize the unattended operation strategy. Moreover, SBLOCA safety analyses have been carried out by many scholars for PSIS assessment. e typical advanced passive plant has been originated from AP600/AP1000 which adopts PCCS design [8][9][10][11][12][13]. Wang et al. simulated and analyzed cold leg (CL) small-break LOCAs for AP1000 using RELAP5/MOD3.4 codes, including 2-inch, 4-inch, and 8-inch breaks, and the peak cladding temperatures during the process could meet the safety criterion [14][15][16][17]. Di Giuli et al. modeled all the PCCS for the AP1000 and studied a 10-inch small-break LOCA scenario using CESAR codes; when compared to the Westinghouse-developed NOTRUMP code as reference showing a reasonable agreement [18]. Quan et al. conducted long-term IRWST injection core cooling study under AP1000 and CAP1400 SBLOCA scenario by the 1-D thermal-hydraulic analytical model. When compared with ACME integral test data including 2-inch and double-ended direct vessel injection (DVI) breaks of various boundary conditions, the results showed a good agreement [19,20]. Montero-Mayorga investigated SBLOCA with different break sizes with the best estimate TRACE V5.0 codes, and the main results show the similar trend when compared to Westinghouse NOTRUMP code [21]. Other scholars also conducted similar studies on SBLOCA of loop-type PWR, and some even investigated severe accidents phenomena caused by SBLOCA (the PCCS did not put into use on time) [22][23][24][25][26][27]. However, in this paper, a revised PSIS for GBS Qinshan I has been proposed. To evaluate the system performance, 10-inch cold leg SBLOCA even double-ended direct vessel injection (DEDVI) line break has been investigated.

Parameters of the Existing Nuclear Power Plant.
Qinshan Phase One PWR has been operated safely in Province Zhejiang for more than twenty years [28] which is a typical two-loop PWR with a thermal power of 966 MW, and the major system parameters are presented in Table 1 [29].

Hypothesis Revised Design of Passive Safety Injection
System. In the original active safety injection system design, high-pressure and low-pressure safety injections are both driven by pump. In case the electric power is totally lost in GBS-based ocean nuclear power plants, the LOCA will cause extremely severe disasters. To eliminate this possibility, we revise the safety injection system from active one to passive one. e revised-design PSIS of Qinshan One aims at providing safety injection to the reactor coolant system (RCS) to provide sufficient core cooling for the complete range of loss of coolant accidents, up to and including the double-ended rupture of the largest primary loop reactor coolant system piping. e PSIS consists of two core makeup tanks (CMTs), two accumulators (ACCs), one high-elevation tank (HET) and related pipes, valves, and instruments (as shown in Figure 1). e whole PSIS contains the following subsystems: passive high-pressure safety injection system, medium-pressure safety injection system, lowpressure safety injection system, and automatic depressurization system (ADS). Gravity injection is applied by the CMTs, ACCs, and HET instead of safety injection pump driven force. Besides, ADS valves will be activated open to release primary pressure, in which way to realize successful safety injection. At normal operation, the PSIS is isolated with the primary system by isolation valves. However, when LOCA occurs, the isolation valves will open and the PSIS will put into use.

High-Pressure Safety Injection System.
e highpressure safety injection system (HPSIS) contains two CMTs, plus related pipes and valves. e CMTs provide a relatively high flow for a longer duration which are placed at an elevation slightly above the reactor coolant system (RCS) loop in the containment and filled with cold boron water that provides adequate core shutdown margin. e inlet pressure balance lines of CMTs are connected to the cold legs, and on which there is a normally open valve to avoid water hammer and maintain the CMTs at RCS pressure. e discharge line of CMTs is connected to reactor pressure vessel (RPV) by DVI pipelines. Besides, there are two paralleled normally closed air-operated isolation valves and two serial check valves on the DVI pipelines which are directly connected to the RPV downcomer annulus and prevent reverse flow through this line. Once receiving a safeguards actuation signal, the two parallel isolation valves will open to align the corresponding CMT to the RCS.
CMT operation is divided into two processes, steamcompensated injection and water recirculation. During steam-compensated injection, steam is provided to the CMTs to compensate the water that is injected into the RCS. During water recirculation, hot water from the cold leg enters the CMTs, and the cold water in the tank is driven to the RCS.

Medium-Pressure Safety Injection System.
e medium-pressure safety injection system (MPSIS) consists of two ACCs, the related pipelines, and valves. e ACCs are located on the floor just below the CMTs in the containment. ey provide a very large flow rate for a limited duration of several minutes which compressed nitrogen in the upper space realize safety injection rapidly. One normally open isolation valve and two serial check valves are arranged on the ACC discharge pipelines which are connect to DVI lines. During the normal operation, the check valves in series isolate the RCS. Once the primary system pressure drops below the static ACC pressure in the accident, the check valve will open and water is forced into the RCS by the gas pressure.

2
Science and Technology of Nuclear Installations

Low-Pressure Safety Injection System.
e low-pressure safety injection system (LPSIP) is relied on the HET that provides a lower flow, but for a much longer time. e HET is located at a high elevation above the primary loops and linked to the DVI pipelines, and the injection flow is driven by gravity to cover the reactor in the accident. HET injection can drain the RCS only after its adequate depressurization by the ADS. e 16% of upper volume is filled with pressurized nitrogen (0.2 MPa), and the temperature is the same as that of the containment. One normally open isolation valve, two paralleled check valves, and two paralleled burst valves are arranged on the discharge line. e burst valve will be activated by the signal of ADS and the gravity injection can only be realized after the RCS depressurization.
e HETprovides an additional source of water for longterm core cooling. As the reactor system depressurizes and mass is lost out the break, mass is added to the reactor vessel from the core makeup tanks and the accumulators. When the system is depressurized below the IRWST delivery pressure under severe accident conditions, flow from the IRWST continues to maintain the core in a coolable state. Two lines connect the lower part of the IRWST with both DVI lines. e borated water inside the tank will drain by gravity into the RCS when its pressure is close to the containment pressure.

Automatic Depressurization System.
e ADS is divided into two stages: ADS stage 1 and ADS stage 2. e twostage ADS will be actuated by different CMT water level and RCS pressure setpoints, and after actuation, the valve will keep open status.  ADS stage 1 contains two serial valves whose inlets are connected to the upper header of pressurizer (PRZ), while the discharge outlets are connected to the relief tank where the discharge steam will be condensed. Besides, the ADS stage 1 also makes functions for discharging noncondensable gas of the pressurizer.
ADS stage 2 contains two paralleled pipelines which are linked to the RCS hot legs (HLs) and discharging directly to the reactor hull. ere are one isolation valve and one burst valve on the ADS stage-2 pipelines, which can realize nonleakage at normal operation and quick opening at accidents.

Modeling Nodalization in RELAP5
e whole nuclear power plant including the primary system (RPV, SG, PRZ, reactor coolant pump, pipelines, and valves) and passive safety injection system is modeled by RELAP5, while the feed water, steam consumption, relief tank, and reactor hull are simplified as boundary conditions. e RELAP5 code nodalization scheme is shown in Figure 2. e reactor core is modeled by hot channel, average channel, and bypass channel. e valves 167 and 267 stand for main steam isolation valves that will isolate the steam from the secondary loop at accident conditions. e control volume pipes 314 and 414 stand for CMTs, while components ACC 300 and 400 represent accumulators. In addition, the ACC tank is simulated by pipe 500. e depressurization valves of ADS stage 1 are simulated by control volume valves 611, 613, 711, and 713, and those of ADS stage 2 are modeled by valves 641, 643, 645, 647 and 741, 743, 745, and 747, respectively. SBLOCA including 10-inch break on CL and DEDVI line breaks has been analyzed using the above RELAP5 system model. e RELAP5 nodalization of SBLOCA position is shown in Figure 3. e trip valve component 521 simulates the LOCA position, while the time-dependent volume 524 is on behalf of reactor hull.
In the DEDVI line break nodalization scheme (as shown in Figure 4), single volume 510 and control volume pipe 408 stand for the break line. e break position is simulated by trip valves 551 and 561, and trip valve 422 is used to connect the break line. When the DEDVI line break accident occurs, the trip valve 422 will close immediately to simulate the double-ended break; meanwhile, the trip valves 561 and 511 will open to simulate the coolant loss. When the SBLOCA occurs, the RCS pressure will decrease rapidly from initial 15.2 MPa to 5.2 MPa (which is secondary loop pressure) and the depressurization rates will be determined by the critical flow at the break position [30]. Once the PRZ pressure reaches the low-pressure setpoint, the reactor trip signal and safety protection "S" signal were actuated. Meanwhile, the CMTs' isolation valves will open, and the natural circulation between the CMTs and RCS will be established. e PRZ will be discharged almost empty at the end of blowdown phase and filled with steam. Similarly, the coolant flash evaporation will occur in the RPV upper head which will also be drained soon.

Natural Circulation Phase.
After the reactor trips, the reactor coolant pump (RCP) will operate in coastdown mode and the residual heat will be removed by natural circulation. In addition to the residual heat removal system, the heat can be removed by injection water from CMTs and coolant loss. e flash evaporation at the CMT inlet pipelines indicates the end of CMT natural circulation, after when the CMT water level will decrease. Once the CMT water level reaches the low water level setpoint (8.65 m), the ADS stage 1 will actuate according to the signal.

Automatic Depressurization Blowdown Phase.
After the open of ADS stage-1 valves, the primary system pressure will decrease rapidly and the heat will be transferred to the relief tank which plays a role of heat sink. When the CMT water level drops to low water level setpoint, the ADS stage 2 will put into use as the responding to the signal. Besides, ADS stage 2 has a stronger depressurization ability than ADS-1. Furthermore, when the RCS pressure drops below 4.8 MPa (ACC working pressure), ACC will begin to inject cold water into the RPV through the DVI pipelines.

Long-Term Cooling Phase.
As the RCS depressurizes and coolant is lost out of the break, cold water is added to the RPV from the CMTs and ACCs. As long as the RCS decreases to 0.2 MPa, the isolation valves of LPSIS will open, after when the cold water from HET will inject into RPV directly. While, the ADS plays a key role combining three safety injection systems effectively to realize consecutive safety injection flow.

10-Inch Cold Leg SBLOCA Results and Analyses.
e accident case simulates a 10-inch (25.4 cm) SBLOCA happening in the bottom of a CL which is connected to the CMT balance line. e comparison of initial steady-state simulation results and design parameters are presented in Table 2.
e transient sequences of the event are given in Table 3. e break occurs at time zero, the pressurizer pressure starts to fall rapidly (as shown in Figure 5). Coolant will be lost out of the break position, due to the break size, the leakage mass flow is significant (as shown in Figure 6). When comparing the RCS pressure transients to AP1000 safety analysis, the variation tendencies are similar [31]. At 2 s, the RCS pressure drops to the reactor trip setpoint, the reactor will shut down and the steam generator steam lines will be isolated at the same time. After one-second delay, the pressure drops to 12.25 MPa ("S" signal setpoint) and the CMT isolation valves will open according to the signal. After 8 s, the reactor will be cooled by natural circulation. At the initial period of the accident, the coolant will be driven by both RCP (coastdown operation) inertia and density difference. As long as the CMT is put into use, they will start to  Science and Technology of Nuclear Installations inject borated water into the RCS for covering the reactor core and assuring the shutdown margin (as shown in Figures 7 and 8). As the accident proceeds, the mass flow rate and water level of CMTs both decrease. As the accident proceeds, the water level of the reactor core begins to decrease as shown in Figure 9, but the core still remains completed submerged. At 62 s, RCS pressure drops to 4.8 MPa which is the setpoint for ACC injection actuation (as shown in Figure 5). As soon as the ACCs are put into use, the RCS pressure drops more rapidly (as shown in Figure 5). After approximate 20-second ACC injection into the downcomer, the reactor core water level becomes to increase (as shown in Figure 9), and the RCS pressure will maintain nearly constant until the ADS stage 2 opens (as shown in Figure 5). e ACC will discharge to fully empty state at 350 s (as shown in Figure 10). e CMT water level decreases to 3.9 m (20% full inventory), and the ADS stage-2 isolation valves will open. ere will be rapid depressurization after the ADS stage-2 actuation, and the RCS begins long-term cooling which is delivered by HETs (as shown in Figure 11). e CMT will discharge fully empty after 1200 s. During the whole accident process, the maximum cladding temperature is within the safety margin 1477.2 K (as shown in Figure 12). When compared to cladding temperature transient of AP1000 safety analysis [31], the trends of both studies are similar, which suggests that our PSIS has a qualified safety performance as AP1000 does.

2-Inch Cold Leg SBLOCA Results and Analyses.
In this case, a 2-inch small break occurs at the bottom of cold leg connected to the CMT balance line. e event sequence for this accident is shown in Table 4. e break opens at time zero, and the pressurizer pressure begins to fall (as shown in Figure 13). e pressurizer pressure drops below the reactor trip setpoint, leading to the reactor to trip after the delay and isolate the steam generator steam lines. e CMT isolation valves will open after the "S" signal, once the valves open, the CMT begins to inject borated water into the RCS (as shown in Figures 14 and 15). e reactor coolant pump will also trip and begin to coast down after the "S" signal with a fivesecond delay. As the accident proceeds, the loops drain to the reactor vessel, due to the smaller size when compared to 10-inch SBLCOA, the break mass flow rate becomes smaller (as shown in Figure 16). After the pressure reaches the setpoint, the ADS stage-1 valves open and a more rapid depressurization will happen.

Science and Technology of Nuclear Installations
When the ACC setpoint reaches, ACC begins to inject, and the injection flow is shown in Figure 17. After the ACCs begin to inject, the flow from both CMTs will reduce. e ADS-2 actuation will lead to a more rapid depressurization process, and then the CMTs and ACCs begin to drain more rapidly until they are empty. When compared to the 10-inch CL break situation, the pressure drop speed and the CMTs' and ACCs' drain process of the 2-inch break are much slower. e 2-inch break situations exhibit large margin to core uncovery. During the whole accident process, the maximum cladding temperature is within the safety margin 1477.2 K (as shown in Figure 18).

DEDVI SBLOCA Results and Analyses.
e case simulates a DEDVI line break SBLOCA, where the line is connected to the reactor downcomer of the diameter is 7.8-inch (20.0 cm). e most significant discrimination between DEDVI line break and other SBLOCAs (hot leg and cold leg) is that only half of the total emergency core cooling system capacity is available. e broke loop PCCS, consisting a CMT, an ACC, and an HET, has become totally unavailable. Furthermore, the DEDVI line break SBLOCA has been considered as the most significant contribution to the core damage frequency (CDF) [32]. e accident transient sequences are given in Table 5.
e break is supposed to open immediately at 0 s. e RCS system experiences a rapid depressurization period as shown in Figure 19. e reactor trips according to the lowpressure setpoint. e safety protection "S" signal actuates at 6 s, the CMT on the loop-2 (the broken loop) begins to drain rapidly and discharge through the DVI line straight to the containment (as shown in Figures 20-22). When the pressure reaches ACC setpoint, the ACC of the operating loop begins to inject and that of the broke loop starts to discharge directly to the containment (as shown in Figure 23). e reactor core level starts to fall after the line break. Once the operating loop CMT and ACC begin to inject the downcomer, the core water level will recover (as shown in Figure 24). e core continues draining, until getting sufficient injection after the HET injection (as shown in Figure 25). Because of losing one-loop safety injection, the recover process of reactor core and water level will be extended. During the whole accident process, the maximum cladding temperature is within the safety margin (as shown in Figure 26).
In general, the results obtained with RELAP5 showed a similar trend with AP1000 NOTRUMP analyses. Although the system design and operation are different in both NPPs,   Science and Technology of Nuclear Installations              the comparison indicates that our PSIS design can realize the same safety function like AP1000 PCCS does.

Conclusions
In this paper, a compact passive safety injection system for GBS type Qinshan Phase One reactor has been presented. To evaluate the system performance, 10-inch SBLOCA, 2-inch CL break, and DEDVI line break safety analyses were carried out using RELAP5. e results illustrate that the passive safety injection systems are able to mitigate SBLOCAs: (1) For 10-inch break, injection for CMTs, ACCs, and HET can prevent fuel cladding from excessive heating and keep the core submerged. However, the fast depressurization let CMT and ACC drain rapidly, which makes long-term cooling by HET extremely important. (2) For 2-inch CL break, due to the smaller break size, the accident process is relatively slow but severe. e CMTs in the natural circulation period are important to cool down the core until the pressure drops enough to actuate the ACC injection. (3) DEDVI line break test suggests that the reactor can remain safe even with half of total emergency core cooling system capacity available which makes the revised PSIS fulfill the single failure criteria.
In all, the passive safety injection system has been proposed to replace the original second generation active one based on NPP design parameters and engineering experience. is research can help Chinese engineer develop their own third-generation NPP technology passive safety systems.