Abstract
A severe accident has inherently significant uncertainties due to the complex phenomena and wide range of conditions. Because of its high temperature and pressure, performing experimental validation and practical application are extremely difficult. With these difficulties, there has been few experimental researches performed and there is no plant-specific experimental data. Instead, computer codes have been developed to simulate the accident and have been used conservative assumptions and margins. This study is an effort to reduce the uncertainty in the probabilistic safety assessment and produce a realistic and physical-based failure probability. The methodology was developed and applied to the OPR1000. The creep rupture failure probabilities of reactor coolant system (RCS) components were evaluated under a station blackout severe accident with all powers lost and no recovery of steam generator auxiliary feed-water. The MELCOR 1.8.6 code was used to obtain the plant-specific pressure and temperature history of each part of the RCS and the creep rupture failure times were calculated by the rate-dependent creep rupture model with the plant-specific data.
1. Introduction
The probabilistic safety assessment (PSA) technique has been widely used to evaluate the safety of nuclear power plants (NPPs) in severe accidents resulting in core damage. Whereas the PSA predicts, in general, the progression of an accident from the occurrence of initiating events to failures of fission product barriers by sequential analyses of levels 1, 2, and 3, it basically requires the prediction of phenomenological thermal hydraulic and mechanical behaviors of the reactor coolant system (RCS) and containment as well as the plant-specific design features of components and systems. An additional problem is that the phenomenological behavior at the reactor core and in the RCS after core damage cannot be easily predicted because there are significantly inherent uncertainties resulting from a wide range of accident conditions. Instead of using plant-specific analysis data, from these consequences, previous experimental and analytical research results for NPPs of similar type or engineering judgments have been generally utilized to determine an occurrence of important events and those probabilities in the level 2 PSA.
As an effort to minimize the uncertainties laid in the level 2 PSA, this study is focusing on evaluating the RCS and steam generator (SG) tube creep rupture failure probability under high-pressure severe accident conditions by providing the plant-specific data based on thermal hydraulic and mechanical analysis.
When a severe accident is initiated by transients other than loss of coolant accidents, the RCS pressure is high at the time of core uncovery and initial damage. The pressure of the RCS remains at the set-point of pressurizer safety valves (PSVs) and the RCS inventory gradually reduces due to discharge through periodic opening of PSVs. It had been observed and proven by experimental and theoretical studies that, if this condition continues, the RCS is filled with saturated and/or superheated steam and non-condensable gases, and a severe accident natural circulation flow would be established [Citation1]. The severe accident natural circulation flow is important because it transfers energy from the reactor core to other parts of the RCS. With this redistribution of energy, the progression of an accident would be significantly differentiated. It could delay the core heat-up rate and provide additional time for system recovery or operator response, however, at the same time it could result in the failure of the RCS components. If the RCS piping, such as the surge line or hot-leg fails, the RCS pressure would depressurize by a blow-down to the containment. This could significantly alter the containment response at the time of vessel melt-through. On the other hand, if the failure is located at the SG tubes, a containment bypass path could be established through atmospheric dump valves or safety relief valves, and the fission products released from the fuel would flow through the failed tubes to the secondary side of the SG and to the environment bypassing the containment. A result of sensitivity analysis shows that they would have significant effects on containment failure frequency of the level 2 PSA, because they are directly related to a containment failure.
Because of importance of the foregoing phenomena in the level 2 PSA, they have been modeled as top events of the existing containment event trees [Citation2] in the form of “the temperature-induced RCS boundary creep rupture,” but any other detailed study to derive the relevant branch probability has not been performed yet. Due to a lack of plant-specific severe accident experimental and analytical data, they were determined either by using expert judgments or by referring the previous research results, such as NUREG-1150 [Citation3,Citation4].
The main objective of this article is to propose a methodological framework to predict probabilities on the temperature-induced creep rupture failure of the RCS and SG tube under a station blackout (SBO) severe accident condition. For the purpose, first, major phenomena which could affect the natural circulation flow were investigated by reviewing the previous research results. Second, the MELCOR 1.8.6 code was used to confirm establishment of reactor-to-SG circulation flow pattern and obtain the plant-specific pressure and temperature histories under various initial and boundary conditions [Citation5]. For this work, detailed RCS nodalization was developed, which is expected to be useful for generalized severe accident simulation. Third, uncertainty analysis was performed to estimate conditional probabilities on the temperature-induced RCS boundary creep rupture, where Wilks’ formula and the Latin hypercube sampling (LHS) [Citation6] method were used to generate the cases to be analyzed by the MELCOR 1.8.6 code. Finally, a stand-alone computer program, Creep Rupture Evaluation Code [Citation7] (CREC) was developed to examine creep rupture failure by solving rate-dependent creep rupture model.
2. Analysis methodology
As shown in , the present methodology to evaluate the temperature-induced RCS boundary creep rupture failure probability is to combine the existing methods for the creep rupture analysis [Citation1,Citation8–Citation10] with random data coming from the crack depth and the length adopted by getting insight from the probabilistic fracture mechanics. For specifically, the present approach consists of two parts: (1) thermal hydraulic analysis to obtain temperature and pressure histories, and (2) estimation of the creep rupture failure and its occurrence probability. In the thermal hydraulic analysis, the severe accidents are simulated using a computer code. Firstly, all significant phenomena are identified and modeled into the code. In order to specify the thermal hydraulic uncertainties and those bounds resulted from code input and correlations used in the code, a thermal hydraulic uncertainty analysis should be conducted. Whenever necessary, sensitivity analysis can be used to screen out the less effective factors and reduce the effort of simulations. In the estimation of the creep rupture failure probability, the creep rupture models [Citation10] are solved by using the code predictions of pressure and temperature histories as input variables. A few uncertain variables employed in the creep rupture model, such as diameter and thickness of pipe, and length and depth of crack can be considered as distribution functions. Then, a mechanical uncertainty analysis can be conducted by sampling from each simulation data these uncertain variables subject to a distribution form. Finally, a creep rupture failure probability is estimated by dividing the number of cases in which the creep rupture failure occurred, by the total number of simulations.
Figure 1. Schematic of the analysis methodology.
In this article, the SBO sequence with no safety features activation except the reactor protection system (e.g. control rod assembly) is used and no other accident sequences are studied as a representative study. The thermal hydraulic analysis and the estimation of the failure probability will be presented in the following sections.
3. Thermal hydraulic analysis
In this study, the thermal hydraulic uncertainty analysis was conducted for the SBO sequence with no safety features activation, which is based on the MELCOR 1.8.6 code. A detailed MELCOR model was developed to take into account main phenomena and important factors to the creep rupture analysis, including a severe accident natural circulation flow. Then, the uncertainty analysis was performed through MELCOR simulations for 59 LHS samples.
3.1. PIRT and important factors
The previous researches, including experimental and analytical studies, were reviewed to consider the most important phenomena into the code modeling and analysis. The U.S. Nuclear Regulatory Commission sponsored a parallel experimental and analytical effort as a part of enhancing the understanding of severe accidents. The 1/7 scale experiment for commercial plants was performed at Westinghouse [Citation11,Citation12]. In this study, the natural circulation flow in a hot-leg and a SG was observed and major hydraulic parameters were measured. A computational fluid dynamics analysis was also performed comparing experimental results, so that understanding of the mixing in the SG inlet plenum was clarified [Citation13,Citation14]. Lumped parameter code analysis using SCDAP/RELAP5 was also conducted by Sandia National Laboratory (SNL) [Citation15]. Various aspects of severe accident natural circulation were studied intensively at Idaho National Engineering and Environmental Laboratory (INEEL) [Citation5]. They included identification of parameters associated with the natural circulation, benchmarking computer code against experiments, analysis for commercial power plants, and the analysis of phenomena that could disrupt natural circulation flows. Nuclear Regulatory Commission performed the representative analysis, including the predicting thermal hydraulic conditions of selected severe accident scenarios using the SCDAP/RELAP5 code, flawed tube failure modeling, and tube failure probability estimation [Citation8].
In , major factors are listed and the ways to consider them into analysis are presented. The factors can be considered into analysis through two ways. The first way is considering into accident sequence. Because the system condition and accident progression would be greatly different according to the accident sequence, all probable accident sequences considering the system operations and operator actions must be analyzed to obtain the exact failure probability. The second one is to consider them into the computer code modeling. This is mainly about the phenomena. Though the MELCOR code has several features to model severe accident phenomena, so that most of the factors could be considered just by using built-in models, there are limitations. For example, the MELCOR code, the lumped parameter code, has inherent limitations to model the three-dimensional complex natural circulation flow, such as in-vessel and hot-leg natural circulation flow mixing. An existing MELCOR model, as it stands, cannot simulate hot-leg stratified counter-current flows or SG inlet plenum mixing, so nodalization has to be organized specifically for some assumptions.
Table 1. Important factors for the severe accident natural circulation flow.
3.2. Development of MELCOR model
The OPR1000 is a pressurized water reactor with the capacity of 1000 MWe. The RCS of the OPR1000 has two heat transfer loops forming a barrier to the release of radioactive materials from the reactor core to the secondary system and containment atmosphere. The main components of the RCS are a reactor vessel, two SGs, and four reactor coolant pumps. These RCS components are symmetrically located on opposite sides of the reactor vessel with a pressurizer on one side, all of the RCS components are located inside the containment building and connected by pipe assemblies. The RCS also includes the interconnecting piping to auxiliary systems, such as the chemical and volume control system, the safety injection system, the shutdown cooling system, and others. Major design information of the OPR1000 is presented in .
Table 2. Major design information of the OPR1000.
The reactor vessel nodalization of developed MELCOR model is presented in . In the SBO severe accident, the steam at the central part of the reactor core would be hotter and less dense than periphery because of a higher power and rise to the top of the upper plenum and flow radially outward. It would be cooled through heat transfer to the structure and flow back down toward the top of the reactor core. To allow two-dimensional flow, the reactor core was modeled by seven radial rings and five axial levels (35 volumes) and upper plenum by seven radial rings and three axial levels (21 volumes). Additional hydraulic volumes were used to model the dome, lower plenum, and down-comer.
Figure 2. MELCOR 1.8.6 nodalization for the reactor vessel.
The RCS nodalization of developed MELCOR model is presented in . The superheated vapor in reactor vessel would enter hot-leg and flow through the top of the hot-leg toward the SG and the returning cooler vapor from the SG flows through the bottom part of the hot-leg toward the reactor vessel. For the counter-current flow, the hot-leg is split into two equal-area pipes [Citation15]. It was modeled by two upper half part volumes and two lower half part volumes. In order to allow for the effect of momentum exchange between the two counter-current or co-current streams in the hot-leg, opposed pumps into the halves of the split pipe was introduced [Citation17]. The pressure boost developed by the pump was made by a function of the relative velocity between two streams of upper and lower volumes of hot-leg by using a MELCOR control-function-base (“QUICK-CF”) pump model. At the inlet plenum, the mixing between the hot vapor from the hot-leg and the reentering cooler vapor from the SG tubes would occur. Based on the Westinghouse experiments and the previous modeling practices, this model assumed the mixing flow fraction in the inlet plenum of 90% and the unmixed volumes each carry 5% of the total inlet plenum flow. The natural circulation SG tube flow nodalization assumed that 35% of the total tubes carry the hot fluid and the other 35% of the tubes carry the cooler fluid [Citation15].
Figure 3. MELCOR 1.8.6 nodalization for the reactor coolant system.
3.3. Representative scenarios analysis
The SBO sequence was analyzed as a reference case for an accident in which the natural circulation flow takes place, whose frequency of occurrence is highest in the OPR1000 level 1 PSA.
Following a simultaneous loss of off-site and on-site AC power, an immediate reactor trip occurs due to a loss of power to the control rod drive mechanism. After the reactor trip, the auxiliary feed water is delivered to one of two SGs using the turbine driven pump. Since the sequence analyzed has no other mitigative operator actions and no power recovery, the heat is removed from the secondary side only by a turbine-driven pump and an atmospheric dump valve during the 4 h. Engineering safety features, such as the high-pressure safety injection and the low-pressure safety injection are not available. The only water available to cool the reactor core in the primary side is the initial RCS inventory. There is no safety injection and the water mass from four safety injection tanks is not available as long as the system remains at an elevated pressure.
In MELCOR simulations, the SBO transient was assumed to occur at 0 s and the calculation continued out to the reactor vessel failure. Since the core decay heat is not completely eliminated by the SGs due to the decreased SG secondary side water level, the pressure and temperature of the RCS increase. The RCS pressure increases to 17.2 MPa, which is the opening pressure of PSVs. The SG tube is dried out at 2938 s and the PSVs start cycling of open/close at 4582 s. Inventory of the RCS and the water level in the vessel continues to decrease due to the discharge through PSVs. The natural circulation flow by gas is established and the counter-current flow in hot-leg can be observed. The reactor core becomes uncovered and the cladding starts to melt at 14,064 s. The UO2 fuel starts to melt at 14,165 s and relocates to the RPV lower head at 14,575 s, and the reactor vessel fails at 18,357 s.
3.4. Results of uncertainty analysis
The uncertainty analysis was conducted to consider the effects of assumptions of phenomenological models in the MELCOR code and variations of plant-specific data. For this, dominant variables which would have significant effects on the accident progression and those distributions were identified, and MELCOR simulations were performed for the random values sampled from these variables.
Heat generation at the reactor core and heat sink at the SG was considered important in identifying dominant important factors, because the natural circulation flow is driven by buoyancy force established by the density difference due to temperature difference. The factors identified from literatures and the coefficients in MELCOR physical models were examined with sensitivity analysis and the most effective uncertainty factors were determined.
The selected variables are presented in . The decay heat as the energy source and the SG tubes number which defer the amount of heat sink were considered important. Because in-core heat transfer and core degradation can change the accident progression, two variables which significantly alter the reactor vessel failure timing in sensitivity analysis were selected.
Table 3. Uncertainty source variables.
Wilks' formula was used to determine the total number of MELCOR calculations which give results of a reliable level [Citation18]. Temperatures of reactor core and RCS components are increased until the reactor vessel fails. Because this study aimed to estimate the probability of the RCS failure and SG tube failure could result in severe consequences, in applying Wilks' formula, the reactor vessel failure timing assumed a concerning output. In other words, the more delayed the reactor vessel failure time, the more probable the SG tubes creep rupture fails. The 59 calculations give the 95% of confidence level about that the latest timing of the reactor vessel failure is beyond the 95th percentile of the unknown failure timing distribution. The analysis result of the latest reactor vessel failure case could be considered as sufficiently conservative output about the SG tubes failure. The LHS method was used to generate the cases.
The MELCOR calculations were conducted until the reactor vessel failure occurred. As the natural circulation flow is established more strongly, the component's temperature would be more rapidly increased and the reactor vessel failure timing would be delayed. The more delayed the reactor vessel failure is, the higher the temperature of components are reached. In , MELCOR calculation results for all cases are presented and the major event occurrence times are presented in . The accident progressions were greatly varied according to input variables.
Figure 4. Temperature and pressure history of RCS components for all cases.
Table 4. Major event timings (seconds).
4. Evaluation of creep rupture probability
4.1. Creep rupture model
The creep rupture failure models are already suggested in the previous studies [Citation10]. During stress and temperature transient, the rate-dependent creep rupture model which introduces a stress multiplier was used.
Table 5. Creep rupture models.
4.2. Estimation of creep rupture failure
In order to calculate the creep rupture index, a simple program was developed using visual basic language, so that the plant-specific data, including the crack length and crack depth are used as random variables. With the temperature and pressure histories, the creep rupture index was calculated and when the sum of creep rupture index reached 1, it was regarded as the creep rupture occurred. In order to consider the variation of the data and to estimate the failure probability, the random variables, such as length and depth of crack, and diameter and thickness of pipe were sampled and the creep rupture index was recalculated repeatedly for this case. The conditional creep rupture probability of a certain part is determined by the following way.
4.3. Evaluation of creep rupture failure probability
As results of the creep rupture failure evaluation, the average failure time of RCS creep rupture for all cases is calculated to 15,206 s. For all cases except only one case among 59 cases, the creep rupture failure of RCS components occurred before the reactor vessel failed. In the case of which the reactor vessel failure time is 17,312 s which is the shortest time, only 17 SG tubes failed among the 100 calculations according to the crack depth and crack length. Compared to the reactor vessel failure time (25,713 s), it could be concluded that the RCS would fail before the reactor vessel fails. As a final result, the conditional probabilities of the creep rupture failure on the SG tubes and the hot-leg were calculated to 0.15 and 0.84, respectively. In other words, the hot-leg was more likely to fail due to the creep rupture. However, the SG tubes failure significantly varies by the crack depth and length. In order to get a more accurate probability, the crack data obtained by analyzing a long period of operation data must be used.
5. Conclusion
The methodology to calculate the failure probability has been developed and applied to the SBO severe accident of the OPR1000. A detailed MELCOR model allowing the simulation of the severe accident natural circulation flow was developed and the uncertainty analysis was conducted. With the plant-specific data and MELCOR predictions, the creep rupture timings for all cases were calculated and the conditional failure probabilities were evaluated. It was shown that the results of thermal hydraulic analysis and probability estimation greatly varied according to the input variables. In order to get a more accurate result, all factors which could have significant effects and their distributions must be considered correctly.
With the methodology developed in this study, an explicit and reliable failure probability can be obtained and it would be helpful to reduce over-conservatism and excessive margins. In addition, the code analysis result itself is useful for designing the plant, assessing the risk, preparing the accident mitigation strategy, and conducting mitigation plans. The statistical outputs could give information about the accident progression with a certain confidence level.
Acknowledgements
This project has been carried out under the Nuclear Research and Development Program by Ministry of Education, Science and Technology (MEST), Korea.
References
- Bayless , P.D. 1995 . Severe Accident Natural Circulation Studies at the INEL , Idaho National Engineering Laboratory . NUREG/CR-6285 (INEL-94/0016)
- Probabilistic Safety Assessment for Ulchin Units 3&4 [Containment Performance Analysis], Korea Hydro & nuclear power Co., Ltd, 411 Yeongdongdae-ro Seoul, Korea, 2004 [in Korean]
- Breeding , R.J. 1990 . Evaluation of Severe Accident Risks: Surry Unit 1 , Albuquerque, NM 87185 : Sandia National Laboratories . NUREG/CR-4551
- NRC . 1990 . Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants , Washington, DC 20555 : Nuclear Regulatory Commission . NUREG-1150, Final Summary Report
- Gauntt , R.O. 2005 . MELCOR Computer Code Manuals, vol.1: Primer and User's Guide, Version 1.8.6 , Albuquerque, NM 87185-0739 : SAND 2005-5713, Sandia National Laboratories . NUREG/CR-6119
- McKay , M.D. , Conover , W.J. and Beckman , R.J. 1979 . A comparison of three methods for selecting values of input variables in the analysis of output from a computer code . Technometrics , 221 : 239 – 245 .
- Lee , B. 2009 [in Korean] . Development of Probability Evaluation Methodology for High Pressure/Temperature Gas Induced RCS Boundary Failure and SG Creep Rupture , Daedeok-daero 989-111 Daejeon, Korea : Energy Research Institute . KAERI/TR-3756/2009, Korea Atomic
- NRC, SGTR Severe Accident Working Group . 1998 . Risk Assessment of Severe Accident-Induced Steam Generator Tube Rupture , Washington, DC 20555-0001 : Nuclear Regulatory Commission . NUREG-1570, U.S
- Gauntt , R.O. Uncertainty Analyses using the MELCOR Severe Accident Analysis Code . Workshop on Evaluation of Uncertainties in Relation to Severe Accidents and Level 2 Probabilistic Safety Analysis .
- Liao , Y. and Vierow , K. 2005 . MELCOR analysis of steam generator tube creep rupture in station blackout severe accident . Nucl. Technol , 152 : 302 – 313 .
- Stewart , W.A. , Pieczynski , A.T. and Srinivas , V. 1990 . Experiments on Natural Circulation in a Pressurized Water Reactor Model for Degraded Core Accidents Palo Alto , CA EPRI Project No.RP2177-5 Final Report, EPRI
- Stewart , W.A. , Pieczynski , A.T. and Srinivas , V. 1990 . Experiments on Natural Circulation in a Pressurized Water Reactor Model with High Pressure SF6 Palo, CA , , Alto Draft EPRI Report, EPRI
- Boyd , C.F. 2003 . CFD Analysis of 1/7th Scale Steam Generator Inlet Plenum Mixing During a PWR Severe Accident , Washington, DC 20555-0001 : Commission . NUREG-1781, U.S. Nuclear Regulatory
- Boyd , C.F. 2004 . CFD Analysis of Full-Scale Steam Generator Inlet Plenum Mixing During a PWR Severe Accident , Washington, DC 20555-0001 : Commission . NUREG-1788, U.S. Nuclear Regulatory
- Martinez , G.M. 1994 . Independent Review of SCDAP/RELAP5 Natural Circulation Calculations , Albuquerque, New Mexico 87185 and Llvermore, California 94550 : National Laboratories . SAND91-2089, Sandia
- IAEA . 2005 . Natural Circulation in Water Cooled Nuclear Power Plants: Phenomena, Models, and Methodology for System Reliability Assessments , Wagramer Strasse 5, P.O. Box 100 A-1400 Vienna, Austria : International Atomic Energy Agency . IAEA-TECDOC-1474
- Park , J. and Lee , J. 1997 [in Korean] . MELCOR Natural Circulation Model for SGTR Sequence During the Severe Accident in a 3 Loop Westinghouse PWR , 62 Gwahak-ro Daejeon, Korea : Safety . KINS/AR-482, Korea Institute of Nuclear
- Nutt , W.T. and Wallis , G.B. 2004 . Evaluation of nuclear safety from the outputs of computer codes in the presence of uncertainties . Reliab. Eng. Syst. Safe , 93 : 57 – 77 .