During an SBO accident, the initiating event is a loss of Class IV and Class III power, causing the loss of the pumps used in systems such as PHTS, moderator cooling, shield cooling, steam generator feed water, and re-circulating cooling water. The reference case of SBO does not credit any of these active heat sinks, but only relies on the passive heat sinks, particularly the initial water inventories of the PHTS, moderator, steam generator secondary side, end shields, and reactor vault. The reference analysis is followed by a series of sensitivity cases assuming certain system availabilities, in order to assess their mitigating effects. This paper also establishes the strategies to mitigate SBO accidents. Current studies and strategies use the computer code of the ISAAC for Wolsong Nuclear Power Plant Unit #1 (WSNPP-1)

The ISAAC[1] computer code provides a flexible, efficient, integrated tool for evaluating the in-plant effects of a wide range of postulated accidents and for examining the impact of operator actions on accident progressions. The generic models of ISAAC evolved from the MAAP4 code developed by Fauske and Associates (FAI), for pressurized and boiling light water reactors. Some of these models required minor modifications to adapt them to CANDU-6 design features and to be integrated with the rest of the code, but fundamentally these models were unchanged from the generic MAAP4 models.

The WSNPP-1 is CANDU-6 Pressurized Heavy Water Reactors (PHWRs). They have 380 horizontal fuel channels surrounded by a cool low-pressure heavy water moderator. Each fuel channel contains twelve fuel bundles within a pressure tube [2]. One bundle consists of 37 elements that contain natural uranium in the form of compacted sintered cylindrical pellets of uranium dioxide (UO₂). Each channel has an end fitting at each end, which allows the fueling machines to attach and facilitate power refueling. The coolant enters the channel from an inlet feeder pipe , connected to the inlet end fitting. the coolant enters the fuel string, flowing within the channels between the fuel elements inside the pressure tube. The coolant leaves the channel via an outlet feeder pipe that is attached to the outlet end fitting. It enters the channel at approximately 11 MPa and 263 ℃; and leaves slightly above 10 MPa and 310 ℃. Figure 1 shows a simplified overview of the PHTS. The core is subdivided into two symmetrically located figures in two loops. Each loop consists of two core passes of 95 channels each. The core has 380 fuel channels arranged in 22 rows and 22 columns.

ISAAC is constructed in modules covering individual regions within the plant: PHTS, pressurizer, steam generator (SG), calandria, reactor vault (RV), end shields, degasser condenser tank (DCT), and reactor building (RB). The code evaluates a wide spectrum of phenomena including steam formation, core heat-up, cladding oxidation and hydrogen evolution, vessel failure, corium-concrete interactions, ignition of combustible gases, fluid entrainment by highvelocity gases and fission-product release, transport, and

[Fig. 1.] CANDU-6 Simplified Circuit Diagram.

[Fig. 2.] Suspended Debris Bed Locations Defined for 9+9 Type Fuel Channels in ISAAC WSNPP-1.

deposition. Also, the important engineered safety systems and operator interventions to mitigate the accident progression are modelled.

The ISAAC input for each loop is described as follows. The three horizontal channels consider the channel power distributions of high, medium, and low at the same elevation. The channel power distribution at WSNPP-1 is shown in Figure 2[3].

The initiating event is a loss of Class IV and Class III power, the LRVs fail to open and the steam and water flow into DCT. It also causes a loss of pumps used in systems such as the PHTS, moderator cooling, shield cooling, steam generator feed water, and re-circulating cooling water. Though any active heat sinks are not credited, the accident progression could be delayed thanks to the passive heat sinks, particularly the initial water inventories of the PHTS, moderator, steam generator secondary side, end shields and reactor vault. The steam generator atmospherics steam discharge valves (ASDVs), condenser steam discharge valves (CSDVs) are assumed fail open. We also did not credit the feed and bleed system, pressurizer heater and pressurizer steam discharge valve

For the analysis of the reference case of SBO, the scenario is considered as a transient, initiated by a loss of offsite AC (Class IV) power, with the subsequent loss of all on-site standby and emergency electric power supplies. If

[Table 1.] Key Input Parameters for WSNPP-1

Key Input Parameters for WSNPP-1

the high pressure, medium pressure and the low pressure emergency core cooling, crash-cooling function, shut-down cooling and shield cooling systems are not available, the accident sequence can result in severe core damage. The PHTS loops are notisolated from each other, and the local air coolers and operator intervention are assumed to be unavailable. The input data of the ISAAC code for the reference case is shown in Table 1 and the results of significant event sequences are summarized in Table 2 [4]. Due to program limitations, the ISAAC can not apply actual plant operating condition. For example, the actual temperature of reactor inlet header is 263 ℃(536K), but ISAAC, uses one input as the inlet and outlet header temperature (583K)

[Table 2.] Sequence of Significant Events for the Reference case of Station Blackout Scenario

Sequence of Significant Events for the Reference case of Station Blackout Scenario

Since the PHTS pumps are not available due to a loss of power, the fuel heats up and the decay heat is transferred to the heavy water coolant. A temperature gradient develops between the coolant in the core and the steam generator region, which promotes natural circulation between the two regions. The decay heat is transferred to the secondary side of the steam generators, which results in a decrease in the PHTS pressure. At this point, the secondary side of the steam generators has sufficient heat sink capacity to absorb the decay heat. Figure 3 shows the pressure behavior in the PHTS loops and in the pressurizer. As expected, both loops show similar behavior.

The heat transfer from the PHTS to the steam generators causes the water in the steam generators secondary side to boil off. As a result, the pressure in the secondary side of the steam generators increases gradually and causes the Main Steam Safety Valve (MSSV) to open and to discharge steam from the secondary side to the environment outside the reactor building. The secondary side steam generator pressure then oscillates at the MSSV set point as the safety

[Fig. 3.] PHTS(Loop 1 :PPS(1), Loop 2: PPS(2))/PZR(PPZ) Pressures for Reference Case(Pa)

valves open and close. The water level in the steam generators decreases, as boil-off proceeds (Figure 4). When water in the steam generators is depleted at about 10,100 s, the steam generators dry out and are no longer a heat sink to remove heat from the PHTS. Thus, the pressure in the

[Fig. 4.] SG#1~4 Water Level for for Reference Case (m)

PHTS starts to increase until it reaches the PHTS liquid relief valve (LRV) set point, 10.16 MPa (a), and fails open resulting in inventory discharge into DCT. The PHTS inventory is lost through the LRVs and the fuel bundles begin to uncover within the pressure tube

The PHTS inventory is gradually lost through the LRVs resulting in fuel channel dry-out. In parallel, the moderator heats up and the water level in the calandria vessel decreases gradually since moderator cooling is not assumed to be available. With the loss of moderator as a heat sink, a lead channel with the highest decay power and the smallest inventory in each loop, which is situated at a high elevation in the calandria vessel, reaches pressures and temperatures unsustainably high for the lead channel, leading to the rupture of the lead channel. With the rupture of the lead channel, the PHTS pressure drops rapidly to about 14,300 s and the loop inventory is blown down into the calandria vessel. With the rapid blow down of the PHTS inventory into the calandria vessel, the pressure inside the calandria vessel reaches the set point of the rupture disc and the calandria vessel rupture discs burst. Temperatures of pressure/calandria tubes, as well as that of the central fuel ring for a selected channel are presented in Figure 5. Figure 5 also shows that the Pressurizer tube (PT), calandria tube (CT) and fuel temperatures remain constant up to about 14,000 s for the 7.1.1 fuel node.

With the loss of the moderator inventory surrounding the fuel channels and as a result of the exothermic zirconium- steam reaction, which generates hydrogen, the fuel channel temperature increases. The fuel channels on the top rows heat up and sag under gravity. The top row of channels sags and contacts the next row of the lower uncovered channel and transfers the load and heat. During the sagging process the longitudinal total strain of the fuel channel increases. The total strain will concentrate between the fuel bundle junctions as the sagging increases and lead to wall-thinning at the junction region between the fuel bundles. The CT will perforate as a result, which will allow

[Fig. 5.] Fuel/pressure Tube/calandria Tube Temperatures in Fuel Node (7,1,1) for for Reference Case (K)

steam to enter the gap between the pressure tube and the CT. The fresh zircaloy surfaces in the gap between the pressure tube and the CTs are exposed to steam and as a result the fuel channel temperatures will rapidly increase from the zircaloy-steam exothermic reaction and produce hydrogen.

The broken channels accumulate to form a porous ‘suspended debris bed’ on the stronger and colder channels underneath, which are immersed in the moderator. The suspended debris mass builds up with time and as the calandria vessel (CV) inventory decreases the debris continues to produce hydrogen and release fission products stemming from their exposure to steam. As the debris mass increases steam access to the interior of the debris, mass becomes more difficult and hydrogen and fission products are released into the reactor building through the CV rupture discs. Since the CV is immersed in the reactor vault water, the radioactive heat from the suspended debris bed is absorbed by the colder CV wall. However, some molten material is expected to be formed from the U0₂-Zr eutectic reactions within the suspended debris bed, which will gradually relocate into the moderator below. During this quenching process the molten corium interacts with the water (Molten Corium Interaction (MCI)) and small-size particulate debris will be formed, which will relocate to the bottom of the CV (Figure 6) to become part of the terminal debris bed and coat the vessel wall to subsequently become part of the crust. Solid debris can also relocate from higher elevations of the core region to lower elevations within the suspended debris bed, when space is available to accommodate them.

As the accident progresses and the CV inventory decrease, more and more debris accumulate on the colder supporting fuel channels immersed in the remaining water. The supporting channels have a limited load-bearing capacity to support the debris load. When the load on the supporting channels exceeds a critical value the supporting

[Fig. 6.] Corium Mass Behavior in Loops and CV(MCMTCT) for for Reference Case (kg)

channels will fail at the CT/tube sheet rolled joint. The suspended debris bed including the supporting channels and the channels below in the remaining moderator will collapse and fall into the moderator, where the debris will be quenched. The phenomenon of rapid debris relocation into the CVbottom by this process is called ‘Core Collapse’. When the suspended debris bed mass exceeds the userspecified value, as described above, the core material in the suspended bed and most of the intact channels relocate to the bottom of the CV at about 57,500 s. The reactor vault water would still be below the saturation temperature and continue to keep the CV wall cool. The resulting terminal debris bed will be initially porous and will be covered with the residual water in the CV. The terminal debris bed at the bottom will contain fuel channel debris containing oxidized segments of PT, CT, UO₂ and a small quantity of fragmented Zr-U-O material, which relocated from the suspended debris as molten material from UO₂-Zr interaction.

A significant quantity of the moderator inventory is discharged into the reactor building when the fuel channels rupture pressurizes the CV. Several top fuel channel rows are uncovered during this process. After the initial rapid moderator expulsion, the moderator continues to discharge gradually into the reactor building as a result of the continued moderator boil off due to the heat transfer from the core. The moderator temperature and pressure in the CV increase as a result of the loss of moderator cooling and heat transfer from the core. The moderator in the CV reaches the saturation temperature at about 14,290 s. At this time, the pressure inside the CV reaches 238 kPa(a), which is the set point of the rupture disk (Figure 7). As a result, the rupture disk fails and the moderator is lost through the relief ducts (Figures 8).

Following core material relocation, the remaining water in the CV eventually boils off releasing hydrogen and fission products if the water is not replenished: the debris will form a compacted terminal bed. Figure 9 shows the

[Fig. 7.] Pressure in Calandria Vessel for for Reference Case (Pa)

[Fig. 8.] Water level in Calandria Vessel for for Reference Case (m)

[Fig. 9.] Corium Mass Composition in Calandria Vessel for for Reference Case (kg)

behavior of the corium mass composition in the CV. The hydrogen reaction will cease once all of the steam in the CV is used up by the zircaloy-steam reaction. The compacted terminal debris bed inside the CV is still surrounded

[Fig. 10.] Water level in Reactor Vault for for Reference Case (m)

by water in the reactor vault, which will keep the outer layers of the terminal debris bed facing the reactor vault at a cool temperrature. With the absence of in-vessel cooling assumed here, the core debris will begin to melt near the top of the terminal debris bed. The top layers of the compacting debris bed will radiate heat to the colder top CV walls and will form a crust on the top surface. The melting process will generate a U/Z/O alloy, called corium, which will gradually spread from the center region of the terminal debris bed outwards and penetrate the solid debris surrounding the molten corium. due to high heat transfer from the CV wall to the reactor vault water the molten material will eventually solidify. The molten corium pool is surrounded on all sides by the crust. As long as the critical heat flux at the CV wall/reactor vault interface is not exceeded, the solid crust, insulating like a crucible, will be in place and will contain the molten corium inside the CV. The corium will be maintained inside the CV by this in-vessel retention strategy.

The moderator inside the CV is depleted at about 43,800 s; therefore, no steam source is available to cause a pressure increase. The water in the RV acts as a heat sink to cool the external CV wall. Steam generated in the CV is released from the reactor vault into the reactor building. The water level in the RV reaches the CV bottom at about 157,000 s (Figure 10). Thus, the CV bottom heats up rapidly from the heat generated by the core debris inside, and the CV fails due to creep. When the CV fails, the debris relocates into the RV, where it is cooled by the water.

The pressure and water levels in the RV and end shields increase gradually after the initiating event. This behavior is caused by the loss of shield and moderator cooling and by heat transfer from the core to the moderator and the end shield. The reactor vault and end shield have combined vent lines, and two rupture disks are connected to the combined vent lines to relieve over-pressure caused by boiling of the reactor vault and end-shield water. At about 14,300 s, the rupture discs burst and steam is discharged from the

[Fig. 11.] Concrete Ablation Thickness for for Reference Case (m)

[Fig. 12.] Pressure Behavior in SG Room for for Reference Case (Pa)

end shields to the reactor building. Water in the reactor vault begins to boil off at about 60,000 s resulting in a gradual decrease of the reactor vault water level.

At about 156,840 s, the CV bottom fails and corium in the CV relocates into the reactor vault floor. Eventually, all water in the RV dries out at about 175,000 s. The corium then reacts with the concrete floor. When the eroded depth of the concrete reaches 2 m, the concrete floor of the RV is considered failed at about 434,000 s (Figure 11). Following the reactor vault failure, the corium interacts with the water in the basement.

Figure 12 shows the pressure in the reactor building node representing the steam generator room. After accident initiation, the reactor building pressure gradually increases, since water is discharged into the reactor building through the PHTS LRVs. The rapid increase (or decrease) of reactor building pressure as shown in Figure 12 at the approximate times of 14,300 s, 74,300 s, 156,800 s, and 434,000 s can be explained by the following processes, which occur at those respective times: (1) rupture of PT and CT, (2) reactor building failure, (3) CV failure and corium relocation into the reactor vault and (4) corium relocation into the basement after RV failure. As mentioned above, at about 60,000 s, water in the RV reaches the saturation temperature and begins to boil off, thus gradually increasing the reactor building pressure. At about 74,300 s, the reactor building pressure reaches the failure set point of 426 kPa(a), resulting in reactor building failure.

During the reference case of SBO sequence, hydrogen is generated as a result of the following reactions: (1) Zrsteam reaction in the fuel channels and in the suspended debris beds during core debris oxidation and (2) molten core-concrete interaction. The results show that the mass of hydrogen generated in the PHTS and CV is about 642 kg prior to CV failure, and is about 2,880 kg as a result of molten corium-concrete interaction in the reactor vault (Figure 13). Figure 14 represents a total mass of hydrogen removed by PARs, which reaches to about 355 kg.

[Fig. 13.] Hydrogen Mass Generated from Core and MCCI for for Reference Case (kg)

[Fig. 14.] Total mass of Hydrogen Removed from PARs for for Reference Case (kg)

The results of the reference case of SBO show that the RB fails at approximately 20.6 hours after the accident initiation and the calandria fails at 43.6 hours. Severe core damage began at 1.2 hours and the RB failed at 7.3 hours. Therefore, the symptoms of the SBO processes could be understood. The following analysis cases reflect SBO counter actions. The venting strategy is also modeled at 300 kPa (d) for the RB integrity.

The heat transfer from the PHTS to the steam generators causes the water in the steam generator secondary side to boil off. As a result, the pressure in the secondary side of the steam generators gradually increases and causes the MSSVs to open and discharge steam from the secondary side to the environment outside the RB. The water level in the steam generators decreases as the boil off proceeds. When the water in the steam generators is depleted at approximately 10,100 s, the steam generators dry out and are no longer a heat sink that can remove heat from the PHTS. The PHTS inventory is lost through the LRVs and the fuel bundles start to be uncovered within the pressure tubes. The PHTS inventory is gradually lost through the LRVs resulting in the fuel channel dry-out. In parallel, the moderator heats up and the water level in the calandria vessel gradually decreases since the moderator cooling is assumed to be unavailable. With the loss of the moderator as a heat sink, the lead channel with the highest decay power and the smallest inventory in each loop, which has a high elevation in the calandria vessel, reaches high pressures and temperatures such that the lead channel will be unable to sustain the pressures. As a result, the lead channel ruptures. With the rupture of the lead channel, the PHTS pressure drops rapidly at approximately 14,315 s, and the loop inventory is blown down into the CV. With the rapid blow down of the PHTS inventory into the CV, the pressure inside the CV reaches the set point of the rupture disc and the CV rupture discs burst.

After an SBO at 5 hours, the dousing water (total capacity of 2,056 m³ of water) is taken to the SG through

[Table 3.] Mitigating Analysis Cases for SBO

Mitigating Analysis Cases for SBO

PV 7/41. The moderator makeup is also taken at the same time. The highest sheath temperature at each node is approximately 2,000 K and this is described in Figure 15. Here, the fuel channel breakup occurred at 14,315 s (~4 hrs), but there was no molten corium. After the accident initiation, the RB pressure gradually increases because water and steam are discharged into the RB through the PHTS LRVs. Figure 16 shows the pressure in the RB node representing the steam generator room . Figure 17 shows that the mass of hydrogen generated in the PHTS and calandria vessel is approximately 0.65% in Case 1.

Based on Case 1 and the reference case studies, the time of the channel breakup was found. For this case, the makeup with the dousing water to SG through PV 7/41 was made within 2 hours and the moderator makeup and LAC were not taken. The key results are described at Table 4. Here, a 66 hr delay was found when compared with Case 1 at the channel breakup time, but the molten corium and RB vent exist and are required at the moderator makeup and LAC within 3 days and 4 days after the SBO. Without the moderator makeup, core melting cannot be prevented.

This case study was undertaken in order to understand the effectiveness of the LAC; if the LAC can be used, venting of the RB is not required.

Based on the studies of Cases 1, 2, and 3, a strategy where the makeup from the dousing to the SG occurred within 2 hours, the moderator makeup occurred within 24 hours, and the LAC was available within 48 hours was established. Figure 18 shows the highest sheath temperature at each node. The highest sheath temperature is approximately 1,420 K and the fuel channel breakup occurred at 310,828 s (~3.6 days), but there was no corium. Figure 19 shows the pressure in the RB node representing the steam generator room . Figure 20 shows that the mass of hydrogen generated in the PHTS and calandria vessel was approximately 0.83% of hydrogen concentration.

[Table 4.] Summary of Results

Summary of Results

[Fig. 15.] Fuel Sheath Peak Temperature (Loop 1 :TCRHOT(1), Loop2 : TCRHOT(2)) Trend in Case 1 (K).

[Fig. 16.] RB Pressure Trend in Case 1 (Pa).

[Fig. 17.] Hydrogen Concentration in Case 1

[Fig. 18.] Fuel Sheath Peak Temperature (Loop 1 :TCRHOT(1), Loop2 : TCRHOT(2)) in Case 4 (K).

[Fig. 19.] RB Pressure Trend in Case 4 (Pa).

[Fig. 20.] Hydrogen Concentration in Case 4.

The results demonstrate that the reference case of SBO, these results are used to understand the severe accident progression for various cases and to update the current documents related to severe accidents including the PSA reports and severe accident management guidelines (SAMG).

If the strategy of the dousing water to SG occurs within 2 hours, the moderator makeup within 24 hours, and the LAC is available within 48 hours can be implemented, the fuel breakup will be delayed by 3.6 days and there is no molten corium. If the LAC is not available, venting must occur within 4 days. As a result of Case 4, the best process is using dousing water to SG within 2 hours, the moderator makeup within 24 hours, and the LAC being available within 48 hours.

The simulations were performed using the severe accident analysis code of ISAAC 4.03 and a WSNPP-1 specific parameter file. All results will be used to understand the severe accident progression for various cases and to update the current severe accident related documents including the PSA reports and severe accident management guidelines (SAMG).

If the dousing water to SG can occur within 2 hours, the moderator makeup within 24 hours, and the LAC becomes available within 48 hours, the integrity of the RB can be maintained and a value lower than 0.83% of hydrogen can be obtained. The highest sheath temperature was approximately 1,420 K and the fuel channel breakup occurred at 310,828 s (~3.6 days), but there was no molten corium.