I. INTRODUCTION

Severe accident management guidance (SAMG) for a CANDU6 type reactor was developed by KAERI (Korea Atomic Energy Research Institute) [1, 2]. This SAMG has six severe accident guidelines (SAGs). SAGs describe operator actions that may mitigate or terminate the progression of a severe accident and the release of fission products out of the reactor building. One of the six SAGs is the strategy of "reduction of a fission product release."

Wolsong unit 1, which is a typical CANDU6 plant, was recently chosen to be back-fitted with a wet-style containment filtered vent system (CFVS). If the operational strategy of the CFVS is well established, it will greatly reduce the threat from a steam over the pressurization failure mode of the reactor building (or containment). In addition, it will minimize the uncontrolled releases of airborne particulate radio-nuclides and radio-iodine isotopes into the environment by means of controlled filtering.

During a severe nuclear accident, an analysis of the source term and relevant fission product (FP) behavior is an essential part for the accident management of nuclear power plants and emergency planning. This paper presents the mitigation effects of fission product reduction strategies that can be applied to severe accident management for CANDU6 plants. Strategy effects for 'control of the reactor building condition’ and 'reduction of the fission product release’ have been evaluated. The operations of a dousing spray system, local air cooler system, and containment filtered vent system are simulated as severe accident management strategies.

II. METHODOLOGY

Severe accident phenomenological analyses for the evaluation have been performed using the ISSAC (Integrated Severe Accident Analysis Code for the CANDU Plants) 4.03 [3]. The code is "a system-level computer code capable of performing integrated analyses of severe accident progression, supporting level 2 probabilistic safety assessment studies or accident management strategy developments" [4]. It was developed based on MAAP4 [4], and predicts an accident progression by modeling CANDU6-specific systems and expected physical phenomena based on the current understanding of the unique accident progressions.

Based on a previous analysis [5], the accident progression of a CANDU6 type reactor until corium relocation into the calandria vessel bottom is considerably earlier than those for the typical PWR or BWR4. This results from the design differences with other plants. The OPR-1000, a typical PWR, is equipped with turbine driven auxiliary feed water systems and main steam safety valves, which can provide a secondary feed and bleed function for the station blackout (SBO) scenario using battery power. The BWR4/MARK1 plant has mitigation systems of a high pressure coolant injection (HPCI) and reactor core isolation cooling (RCIC) against an SBO accident. The systems are operable with no electric power other than battery power. On the other hand, the failure time of the calandria (vessel) in CANDU6 is greatly delayed compared to the others. The delay is due to the additional cooling water in the calandria vessel and the calandria vault (CV), and the lower volumetric decay heat power of the molten corium on the calandria vessel bottom. In contrast with the calandria vessel integrity, the containment failure of a CANDU6 plant occurs considerably earlier than that of a PWR owing to the lower failure pressure of the containment. CANDU6 has an advantage in maintaining its calandria integrity, and an OPR-1000 PWR has an advantage in its containment integrity during an SBO accident. However, a proper mitigative operation of the vent systems has a potential to delay or prevent the containment failure in a CANDU6 and BWR4/MARK1. Therefore, plant responses against severe core damage scenarios like the Fukushima accident are expected to be very different.

The generic models of the ISAAC evolved from the MAAP4. Some of these models required minor modifications to adapt them to CANDU6 design features and integration with the rest of the code, but fundamentally these models were unchanged from the generic MAAP4 models. As a CANDU6 type reactor differs from typical PWR/BWRs, the CANDU6-specific features are newly modeled and added to the ISAAC code. The CANDU6-specific models include the calandria vessel, end shields, reactor vault, pressure and inventory control, and engineered safety systems (e.g., dousing, emergency core cooling).

The ISAAC evaluates a wide spectrum of phenomena including the steam formation; core heat-up; cladding oxidation and hydrogen evolution; vessel failure; corium-concrete interactions; ignition of combustible gases; fluid entrainment by high-velocity gases; and fission-product release, transport, and deposition. The code also addresses important engineering safety systems and allows a user to model the operator interventions. Furthermore, models are added to characterize the actions that could stop an accident, i.e., in-vessel cooling, external cooling of the reactor vessel, and ex-vessel cooling. Moreover, mathematical solution techniques are implemented to maintain a quick-running code suitable for extensive accident screening and parameter sensitivity analysis applications.

The article [6] describes about the FP model of ISAAC: "ISAAC contains FP behavior models that calculate the release of FPs from the core and the transport and deposition in the primary heat transport system (PHTS) and in the reactor building (R/B) as well as the release of FPs into the environment. The code sorts the initial masses of 22 FP elements into twelve groups and then tracks the mass of each group in each of four physical states (vapor, aerosol, surfaces-deposited, and corium -contained) in the various components of the PHTS and R/B".

Table 1 shows the twelve fission product groups for the 22 elements. The elements are grouped according to their chemical and transport characteristics. Group 12 is reserved for UO₂ fuel. Some elements such as cesium, rubidium, and tellurium are present in more than one group. Cs and Rb are in groups 2 and 6, and Te is in groups 3 and 11.

A station blackout scenario (SBO) is simulated as an initiating event of sequence. The definition of an SBO for CANDU6 is useful to quote from the reference [6]: "In SBO, where all off-site power is lost and the diesel generators (DGs) fail. The scenario has been taken as a very low-frequency, but high-risk, accident event. All current generation reactors are only partially designed to cope with an SBO. During an SBO event, the initiating event is a loss of Class IV and Class III power, causing a loss of pumps used in systems such as the primary heat transport system, moderator cooling, shield cooling, steam generator feed water, and recirculating cooling water." The Class IV power supplies AC loads that can be interrupted indefinitely without affecting the personnel or plant safety and the Class III power supplies AC loads that can tolerate a short interruption (1 to 3 minutes) required to start the standby generators without affecting the personnel or plant safety, but are required for a safe plant shutdown.

"The SBO base case does not credit any of these active heat sinks, but relies only on passive heat sinks, particularly the initial water inventories of the PHTS, moderator, steam generator (SG) secondary side, end shields, and calandria vault (CV)" [6].

III. BRIEF OUTLINES OF CANDU6 DESIGN FEATURES

The application was performed for Wolsong-1 plant as a reference plant of a typical CANDU6. A CANDU6 is a heavy water-moderated, natural uranium-fuelled, pressurized heavy water reactor with a thermal output of about 2 140 MW_th. A brief design features of CANDU6 is well described in the previous study[7]: "A PHTS consists of two loops and each loop has 190 horizontal fuel channels that are surrounded by a heavy water moderator inside a horizontal calandria vessel". The calandria vessel is housed in and supported by a light water-filled steel-lined concrete vault, called a calandria vault (CV), which provides thermal shielding. A significant quantity of heavy water surrounding the fuel acts as a heat sink to remove the decay heat after a reactor shutdown. The heavy water moderator ( 2.16×10⁵ kg) in the calandria is a unique CANDU feature that provides a passive heat sink for certain accident scenarios. "The CV is built of ordinary concrete and is filled with about 5.0×10⁵ kg of light water which functions as a biological shield under normal operating conditions and as a passive heat sink under certain severe accident scenarios. For example, if hot dry debris is collected in the calandria bottom after a core relocation, the CV water will remove the decay heat from the calandria through the calandria wall. In-vessel retention through external vessel cooling, which is considered an important accident management program in a PWR, is inherent in the CANDU design [7].

As the CANDU6 has the above-mentioned additional water inventory, the role of a containment heat removal system such as a dousing spray or local air coolers becomes important to control the containment pressure below the failure pressure. "The dousing spray system is designed to limit the magnitude and duration of the containment over-pressure. The system is automatically initiated when the containment pressure exceeds 14 kPa_(g)" [7]. However, the effect of dousing sprays on long-term heat removal is not significant because the sprays are designed only for short- term use. The containment design pressure of the modeled CANDU6 plant is 0.124 MPa_(g), the median value of a containment failure pressure is 0.426 MPa_(g), and the total net volume is approximately 48 000 m³. At this failure pressure, the concrete on the wall starts cracking and the pressure can be relieved. The design parameters of the Wolsong-1 plant are summarized in Table 2.

IV. ANALYSIS CASES AND ASSUMPTION

The base case of an SBO accident sequence has been modeled with the loss of class IV, and all back-up power including loss of all on-site standby and emergency electric power supplies. A reactor shutdown is initiated immediately after an accident initiation. The high/medium/low pressure emergency core cooling, crash-cooling function, shut-down cooling, moderator cooling, and shield cooling systems are unavailable. Operator intervention for the local air coolers is not credited. The passive containment dousing spray system is working. The main steam isolation valves (MSIVs) are not modeled, and instead the turbine bypass valves and turbine stop valves are closed, which results in the same pressure behavior in the four SGs. Liquid relief valves (LRVs) and pressurizer relief valves are assumed to discharge the PHTS inventory into the R/B through the degasser condenser tank. There is an assumption that the relocated molten corium on the calandria bottom will be coolable in the CANDU6 plant because the so-called in-vessel corium retention by external vessel cooling is very feasible [8]. For the molten core concrete interaction (MCCI) calculation, the molten corium has been assumed to be spread into the entire floor of the CV (54.2 m²).

The base case analysis is followed by three sensitivity cases assuming certain system availabilities to assess their mitigating effects. Case 1 is similar to the base case, except that the dousing tank inventory is injected into the SGs and no water is available as a dousing spray. The SG crash cool-down is available to depressurize the SGs. The dousing tank inventory is assumed to be injected into four SGs when the pressure is decreased enough after a crash cool-down operation.

Case 2 the operation of the CFVS. If the R/B sprays or local air coolers are unavailable, the depressurization by the CFVS can be considered an alternative mitigation strategy. For example, the CFVS is under construction in Wolsong-1. In the CFVS, it is assumed that the diameter of the orifice is 0.2548 m, the CsI removal rate is 99.99 %, and it is operated between 225 kPa(a) and 151 kPa(a) [9].

Case 3 is the recovery of a local air cooler system. This local air cooler system consists of 35 units. Among them, sixteen local air coolers have a safety function and are capable of operating in the harsh environment caused by an accident. After a loss of Class IV power, the sixteen local air coolers operate in Class III power. Twelve out of the sixteen local air coolers, which have a safety function during an accident, are assumed to be operable at 10 h after an accident initiation.

V. ANALYSIS RESULTS

In the base case analysis, the transient is initiated by a loss of all AC power with all emergency core cooling systems unavailable, and the sequence progresses to a severe core damage accident. The water in the SG secondary side boils off as the heat is transferred from PHTS to SGs. As a result, the SG secondary side pressure increases gradually and the main steam safety valve (MSSV) is open and the steam is discharged from the SG to the environment outside the R/B. As the boil-off proceeds, the water in the SGs is depleted at about 2.8 h (Table 3) and the SGs are no longer a heat sink of the PHTS. Thus, the PHTS pressure starts to increase until it reaches the set point of PHTS liquid relief valve (LRV) (10.16 MPa). A fuel channel dryout occurs as the PHTS inventory is gradually lost through the LRVs.

In parallel, as the water level in the calandria vessel decreases gradually, a fuel channel with the highest decay power ruptures at 4 h, where the moderator cooling is assumed to be unavailable.

After the fuel channel rupture and corium relocation, the remaining water in the calandria vessel dried out and the fission products released from the calandria vessel into an R/B. The moderator of the calandria vessel is depleted at about 12.2 h (Table 3). The water in the calandria vessel acts as a heat sink to cool the external calandria vessel wall. Steam generated in the calandria vault (CV) is released into the R/B. When the water level in the CV reaches the calandria vessel bottom, the vessel bottom heats up rapidly by the decay heat of the corium inside, and the vessel fails owing to creep. When the calandria vessel fails at 46.2 hours, the debris relocates into the CV, where it is cooled by the water.

Figure 1 shows the pressure behavior in an R/B for all cases. After accident initiation, the R/B pressure increases gradually, because water is discharged into the R/B through the PHTS LRVs. The pressure peaks as shown in the base case of Figure 1 at approximate times of 4.0 h, 12.2 h, 22.7 h, 46.2 h, and 130.6 h can be explained by the following processes, which occur at these respective times: (1) a fuel channel rupture, (2) water dryout in the calandria vessel, (3) R/B failure, (4) calandria vessel failure and corium relocation into the CV, and (5) corium relocation into the basement after CV bottom failure by MCCI. The water in the CV reaches the saturation temperature at about 17.0 h, and begins to boil off, thus gradually increasing the R/B pressure. At about 22.7 h, the R/B pressure reaches the failure set point of 426 kPa_(a), resulting in R/B failure.

Fig. 1.Full-screen View

(Color online) Pressure behaviors in the R/B for all cases.

In Case 1, the dousing tank inventory is injected into SGs and no water is available for the dousing spray. The SG crash cool-down is available to depressurize the SGs. The dousing tank inventory is assumed to be injected into four SGs when the pressure is decreased enough after the crash cool-down operation. The decay heat can be removed through the SGs, resulting in delaying the accident progression for a significant duration, as shown in Case 1 of Table 3 and Fig. 1.

The analysis results of Case 2 show that the R/B pressure is controlled between the CFVS actuation and closure pressures during most accident periods, but two peak spikes appeared to be uncontrolled. The first peak occurs at the time of the calandria vessel failure (44.2 h) when corium is relocated into the CV water. The second peak occurs at the time of a CV bottom (concrete floor) penetration failure (119.3 h) by MCCI when corium is relocated into the basement water, which results in an R/B failure.

Twelve out of the sixteen local air coolers are assumed to be recovered at 10 hours after an accident initiation for Case 3. There is no pressure buildup in R/B owing to the sufficient cooling capacity of the air coolers.

In this paper, an analysis is focused on the FP release from a core, the fission product distribution inside a plant, and the fission product release from an R/B into the environment. The FP behavior during an accident is strongly dependent on the thermal hydraulic or severe accident phenomenological conditions that were previously discussed.

CsI is selected as the representative FP. The reason is expressed by a previous study [10]: "Among the FP groups, the noble gas and cesium iodine groups are considered more volatile. Noble gas, which is a chemically inert material, poses a considerably lesser danger to human health. Instead, iodine is one of the elements vital to the proper functioning of the human body. Iodine exits from damaged fuel rods predominantly as cesium iodine (CsI) during severe accidents rather than as molecular iodine (I₂)."

Figure 2 illustrates the CsI behavior as a representative FP for the base case. The CsI release into the PHTS occurs after the fuel damage. Since fuel channels are ruptured at 4.0 hours after the accident initiation (Table 2), CsI can be transported into the containment. Moreover, when molten fuel relocation starts, the CsI is included in the molten corium. The CsI in the corium is released into the R/B only after the MCCI starts, and the water of the calandria vault is dried out at about 57 hours. About 5.8%, 91.5% and 2.6% of the initial CsI mass are distributed in the PHTS, R/B, and the environment, respectively. The release time of FPs into the environment is about 22.7 h.

Fig. 2.Full-screen View

(Color online) CsI distribution for Base Case.

The operation of the dousing spray in Case 1 delays the R/B failure and FP release into the environment (Fig. 3). About 6.0%, 86.7% and 6.9% of the initial CsI inventory is distributed in the PHTS, R/B, and environment, respectively. Figure 4 shows the results of Case 2 where a CFVS operation prevents the R/B failure during a very long time, and reduces the FP release rate significantly. The release rate of CsI is reduced to 0.03%. However, the FP release initiation occurs very early (6.5 h) owing to the CFVS operation. Meanwhile, the control of the R/B condition using LACs (Case 3) maintains the building integrity without any FP release into the environment owing to a sufficient cooling capacity (Fig. 5).

Fig. 3.Full-screen View

(Color online) CsI distribution for Case 1.

Fig. 4.Full-screen View

(Color online) CsI distribution for Case 2.

Fig. 5.Full-screen View

(Color online) CsI distribution for Case 3.

VI. SUMMARY

In this paper, the mitigation effects of tentative FP reduction strategies that can be applied to a severe accident management for CANDU6 plants was evaluated based on the ISAAC computer program. The alternate usage of a dousing spray system, the recovery of a local air cooler system, and the operation of a containment filtered vent system are considered as severe accident management strategies of "control of the reactor building condition" and "reduction of the fission product release."

The decay heat can be removed through the injection of dousing tank inventory into SGs with a crash cool-down operation, which results in delaying the accident progression for a significant duration. Meanwhile, even if the operation of CFVS is not an effective risk management policy because of an early FP release, the strategy can be proposed to prevent a catastrophic R/B failure and reduce the amount of FP release effectively. The most effective means for the R/B integrity is LAC recovery as long as the power can be recovered. The control of the R/B condition using LACs maintains the building integrity without any FP release into the environment owing to a sufficient cooling capacity of the air coolers in CANDU6 plants.

The limitations of this analysis may result from uncertain severe accident phenomena, for example, the fuel melting process, calandria vessel failure mechanism, reactor building failure mode, and fission product release/ transport. Uncertainties should be inherently very large for an analysis of severe accident phenomena. In addition, an assessment that relies on one computer code is not necessarily reliable in an absolute manner though a relative comparison of SAMG strategies on the same basis would be very useful.

Unlike a light water reactor, the evaluation results for the accident management strategies of a heavy water reactor are very limited. Therefore, this study is aimed at the development of feasible accident management strategies for CANDU6 plants that have yet to be addressed.