1. Introduction

Today, a large amount of research on power plants is concentrated on analyzing severe accidents because evaluating the events in a nuclear power plant (NPP), is highly important taking into account the safety and design considerations [1-4]. Nuclear accidents are divided into the following three categories in order to assess the safety of the nuclear power plant and the radiation consequences: Anticipated operational occurrences (AOOs), design basis accidents (DBAs), and beyond design basis accidents (BDBAs), the latter of which are less probable to occur; however, their consequences would be more serious than those of DBAs. These events may be due to faults in several safety systems and may endanger all or most of the walls protecting against radiation [5-7]. Because the BDBAs are the harshest and most important events, their analysis is of high significance. For instance, some of the severe accidents that resulted in core meltdown include the Three-Mile-Island on March 28, 1979, in the United States, Chernobyl on April 26, 1986, in Ukraine, and the Fukushima accident on March 11, 2011, in Japan. These accidents illustrate the fact that these events may take place even though the probability of their occurrence is low [8-10].

The issue of station blackout (SBO) arose because of the concern about the reliability of emergency alternating current (AC) electrical power generators at nuclear power plants. During the normal plant operation, AC power is typically provided for the safety and non-safety systems of the plant from the main generator transformer. Many systems in a nuclear power plant require AC power to perform their safety functions, both in normal operation and during or following an accident. Typical designs provide for one additional emergency AC power source to that needed for maintaining core cooling for extended periods of an off-site power outage. Station blackout at a nuclear power plant severely hinders the ability to provide cooling to the reactor core by disabling all normal and most emergency core-cooling systems, as well as the containment’s heat removal systems. If AC power was not restored before the capability of the AC-independent systems to remove decay heat was exceeded, the consequences of station blackout could be severe. This wide-ranging dependence of safety systems on AC power is the reason why some nuclear power plant risk assessments have identified station blackout as a major contributor to risk for some plants.

Regarding the significance of the accident, there are several works in this arena. For instance, Park and Lee [11] presented a comparative study of station blackout scenario dynamics initiated by an internal and seismic event in a boiling water reactor. Chiang and Liu [12] introduced mitigation strategies for station blackout for Maanshan pressurized water reactor (PWR). In the same manner, the effectiveness of a makeup tank in an SBO accident for the CANDU reactors with the RELAP5 code [13] and an uncertainty and sensitivity analysis of SBO in the Jules Horowitz Reactor [14] have been studied. Li et al. [15] simulated a severe accident at a Chinese PWR 1000MW (CPR1000) power plant caused by SBO with failure of the steam generator (SG) safety relief valve (SRV). According to their analysis, the SG SRV stuck in the open position could greatly expedite the sequence for a severe accident. In other work, Wang et al. [16] evaluated the core thermal hydraulic response for a hypothetical severe accident caused by SBO with failure of the SG SRV at a Chinese CPR1000 reactor using MELCOR. Their analyses focused on the safety assessment of the reactor core for severe accidents. It was a part of the overall evaluation of safety features of the CPR1000 reactor for residual risk posed by severe accidents. The melting process of nuclear fuel in an accident was evaluated by Ref. [3,6,17].

This work is dedicated to investigating station blackout as one of the severe occurrences in the case where an operator does not intervene. Numerical analysis of the accident in the power plant is performed using the computational MELCOR code. In the first step, a proper nodalization for the Bushehr nuclear power plant (BNPP) is prepared, and the steady state results are evaluated. The safety assessment report (SAR) for this rector is limited to the core heat up in the SBO. Therefore, the necessity of this calculation is the study of the severe core damage and fuel meltdown. During this accident, it is assumed that both the normal power supply sources and the emergency diesel generators are lost. This simulation presents the SBO scenario in the BNPP completely. The thermal response of the plant to this accident is evaluated, and the fuel bundles’ downtime is calculated. The calculated data are compared with published data, and it is shown that the results are in good agreement with reported data.

2. A brief description of the nuclear power plant of Bushehr

The nuclear power plant of Bushehr is a Russian pressurized light water reactor (WWER1000). The primary side includes four loops with horizontal steam generators, main rotating pumps, a pressurizer, and the reactor core. The core of reactor also consists of 163 hexagonal fuel assemblies (FAs) each containing 311 fuel rods. The secondary side includes turbines, a condenser, generator, and the rest of equipment dependent on them. The pressurized light water plays the moderator, cooling, and reflectivity role in the primary side [7]. Figure 1 shows a cross section of the overall view of the BNPP with the coordination of its sections in respect to the height from the base, and Table 1 represents the plant main operating specifications. In this reactor, the emergency core cooling system (ECCS) is designed to supply boric acid solution to the reactor for core cooling and to flood the system with the required velocity as determined by depressurization in accidents. Pipelines from these accumulators are connected directly to the reactor, and in this case, the boric acid solution is supplied to the reactor pressure and collection chambers. The accumulators work in low and high pressures. The set points are 2.7 and 5.88 MPa. The containment spray system is designed for operation under emergency conditions arising from leakage of the primary coolant system and leakage of the secondary side inside the containment. Under normal operating conditions, the system does not operate and is in the standby mode. The system elements in the course of operation are subject to periodic tests. During emergency conditions, the system reduces the pressure, temperature, and radioactive iodine isotope concentration inside the steel containment.

Figure 1Full-screen View

Overall view of the Bushehr nuclear power plant

3. Preparing the MELCOR model for the WWER1000 of the BNPP

To perform an analysis of an accident in a power station, the nodalization model of the plant needs to be prepared. In this work, using the MELCOR 1.8.6 code [18, 19], a model is dedicated to inspecting severe occurrences in nuclear power plants. The model must be satisfactory in steady state and transients. In the thermal-hydraulic codes, particularly in the MELCOR code, the most difficult part of designing a model for a nuclear power plant is designing the reactor’s core [20]. In this work, the design of the reactor’s core is simplified using a new method in the MELCOR code to evaluate the steady state results of the rest of equipment. Then, the core is professionally modeled using the core package while the rest of equipment is examined in their steady states. This method results in simplification of designing the core according to the sensitivity and the complexity of the core package for hexagonal fuel assemblies. This method has been implemented in the MELCOR code considering the thermo-hydraulic specifications of the core using volume control, current flow, heat structure, control functions, and tabular functions packages, which will be briefly described later. The core in this simplification is divided into three different control volumes: hot, average, and cold channels. Figure 2a shows a view of the reactor nodalization in this state. Table 2 includes the categorization of each channel according to the FA’s power peaking factors. The specifications of the used heat structures in the channels are provided in Table 3.

Figure 2Full-screen View

(Color online) (a) Simplified view of the reactor nodalization; (b) Overall nodalization of the primary side of the power plant

There is also a pressurizer (PRZ) in the BNPP, which is connected to the hot leg of the primary side from the second loop (Fig. 2b). The PRZ is modeled as a two-phase volume, the volume of available water is taken to be 55 m³, and the volume of steam is taken to be 24 m³. It is noteworthy that the PRZ is at the saturated temperature, and the safety tank is designed with a volume of 30 m³.

To simulate the steam generator (SG), modeling a number of 11000 U tubes is considered. The tube side in the SG is in three horizontal stages (Fig. 3a) [21]. These stages are placed in the shell side supported with feedwater. The secondary side is modeled as a source and sink. After simplifying the core in this case, modeling of the overall system is done (Fig. 2b). Now, when evaluating the model in the steady state, it would be easier using the core package. The core package computes the heat response of the core and the inner parts of the lower empty space. In addition, the lower grid, structural materials of the core and the lower head during the meltdown, destruction, and debris formation could be calculated with this package [22]. To nodalize the core in this package, the core section and the lower plenum are divided into a number of axial levels and radial rings. In this simulation, the core and the lower plenum are divided into five radial rings and nineteen axial levels. Three of these five rings contain the core, and the fourth and fifth rings contain the bypass and the downcomer parts, respectively. The first seven of the nineteen axial levels are dedicated to the lower plenum, and the eighth and nineteenth levels are dedicated to the holding planes of the core. The inactive part of the fuel and the tenth to eighteenth levels are dedicated to the active core (FAs). Figure 3b shows a view of nodalization for the core and the lower plenum. In addition, Table 4 shows the simplified steady state and the main steady state results along with the final safety analysis report (FSAR) [7].

Figure 3Full-screen View

(a) Nodalization of the SG and the secondary side of the power plant; (b) Nodalization of the core and the lower plenum

4. The SBO scenario in the BNPP

In this study, the SBO accident without an operator’s management is studied. Therefore, both the normal and emergency power supplies are not considered and, consequently, the cooling pumps of the reactor, and the auxiliary and the main feedwater of the secondary side are lost. The makeup blowdown of the primary system is lost, and this results in losing the connection to the valves discharging the vapor to the turbine. The PRZ electricity system fails and the heaters and sprays are not active. The turbine stopping valves are closed after 0.6 s, and the emergency protection of the turbine is activated. Note that when these valves are open, vapor may be transferred from the SG to the steam turbine, and hence, the inventory of the SG would be discharged faster. Henceforth these valves are closed to compensate for the pressure drop as well as to control the inventory discharge in the SG. The pressure of the SG would be kept between 6.27 and 7.15 MPa by opening the safety valves releasing the vapor to the atmosphere. The sudden shutdown signal would be sent after 1.4 s and there would be a station blackout in the whole nuclear power plant. This would result in reactor shutdown and the core power would reach the decay-heat level. Control rods would move inside in 0.3 s for emergency protection. In the fifth second, the valves in charge of discharging vapor to the atmosphere (BRU-A) would be opened owing to the SG pressure reaching 7.15 MPa. They would be closed at the lower set point. At 3000 s after the accident, the water inside the SG would be discharged and eventually, at 6800 s, the water in the primary side would be totally lost and would result in a significant temperature increase and the core would be damaged [7].

5. Interpretation of results in the SBO simulation for the BNPP

When the SBO takes place, the shutdown command is issued within 1.4 s after the accident and the reactor scrams (Table 5).

Owing to the decay of fission products, the generative heat of the reactor reaches seven percent of the initial reactor power (Fig. 4). During the accident, the valves transferring the feedwater to the SG and the valves for releasing the steam to the atmosphere (BRU-K) are closed. The SG pressure is also increased even though the entrance and exit valves for the water and steam are closed. This rising pressure is due to the heat transfer between the shell (secondary side) and the tubes (primary side) of the SG. However, safety valves do not allow the pressure to get higher than 7.15 MPa (the lower set point is 6.27 MPa). These valves are the so-called BRU-A valves. The generated steam is released to the atmosphere after the pressure reaches 7.15 MPa, and this process continues until the inventory of the SG is completely depleted.

Figure 4Full-screen View

(Color online) Power of the core

Figures 5a and b show the water level and pressure in the SG, respectively. It is noteworthy that the difference between the depletion time and the pressure of the SG in Figs. 5a and b is due to the nodalization type and the different numerical code used (MELCOR & ANGAR). Following the reactor scram, the pressure of the primary side would drop as well but the lack of heat removal would compensate for this pressure drop as much as possible, thus slowing the pressure-dropping process. The pressure would gradually increase as the water level decreases in the secondary side of the SG. As soon as the SG is completely depleted, the temperature of the primary side is increased greatly, which is followed by the large increase of the pressure in the first circuits.

Figure 5Full-screen View

(Color online) (a) Water level in a steam generator; (b) Pressure of the steam generator

This rise of pressure results in a higher water level in the PRZ. This process continues until the pressure safety valve in the PRZ is opened. This compensates for the pressure of the PRZ and consequently, the pressure of the primary side remains between 17.2 MPa and almost 18.1 MPa. The water level will remain fixed as long as natural circulation in the primary side is significant. As soon as water circulation stops, it starts to evaporate rapidly. The water level in the PRZ would decrease to compensate for the evaporated water from the reactor core. However, this reduction in volume cannot prevent the evaporation in the first side and as time goes on, the generated decay heat would not allow the PRZ level to go lower than its specific value. Figures 6a and b depict the pressure and the water level in the PRZ, respectively. The rise of the water level in the PRZ may be justified by the fact that owing to the depletion of the SG during approximately 3000 s, the water level in the SG would be low because the water would only have heat transfer with the first series of U tubes. These tubes are located in the lowest level of the steam generator. Because more than 80% of the hot water in the U tubes is in higher levels (refer to Fig. 3), there would be less heat removal from the first side, and the pressure in the PRZ would increase. Once the reactor scram has taken place, the pressure and the temperature drop. When heat is removed from the first side, the temperature of the primary side is approximately fixed. As soon as the SG is depleted and there is no heat removal from the first circuit, the temperature is increased.

Figure 6Full-screen View

(Color online) (a) Pressure in the PRZ; (b) Water level in the PRZ

The coolant temperature moderately increases in the core through the decrease of natural circulation at approximately 5200 s. This decrease results in more evaporation of the coolant as well, and because, from this moment on, there would be no heat removal, the temperature of fuel rods would increase rapidly. This leads to the core heating up. In this stage, the damage of fuel rods and the core are expected. The hot leg temperatures are depicted in Fig. 7a and the coolant flow rate in the primary side after reactor shutdown is depicted in Fig. 7b.

Figure 7Full-screen View

(Color online) (a) Hot leg temperature; (b) Coolant flow rate in the primary side

The volume of water in the reactor (core) and its components is compared with FSAR [7] in Fig. 8a.

Figure 8Full-screen View

(Color online) (a) Total volume of water in the reactor’s components; (b) Coolant volume in core, steam generator and PRZ

It is evident that in approximately 5200 s, with coolant evaporation, the water level decreases. In general, as is shown in Fig. 8b, when the water in the SG is depleted, the water level in the PRZ increases greatly, and the density decreases as the coolant heats up. This effect can be seen in Figs. 6a and b where the PRZ (pressurizer) water level begins to increase as the hot leg temperature and the water density decrease. The water available in the core is evaporated and consequently, the volume of the PRZ is decreased when the flow of water in the first side stops. Eventually, after approximately 1600 s, the water in the first side would be completely evaporated and the temperature of the fuel rods would increase to their melting point and the melt down would occur. It candles from the highest fuel rods in the most critical cell of the core and is transferred to the lower cells.

For instance, in Fig. 9a, which relates to the most critical ring in this design, the only cells that do not melt down are cells 309 and 310, while in Figs. 9b and 9c, which have less power than ring 3, axes 9, 10 and 11 do not melt down.

Figure 9Full-screen View

(Color online) (a) Fuel temperature in the ring with the highest power (ring 3); (b) Temperature of the fuel rods in ring 1; (c) Temperature of the fuel rods in ring 2

The main mechanism of hydrogen production in the reactor pressure vessel (RPV) is the reaction between the vapor and fuel cladding at high temperature. As shown in Fig. 10a, owing to a decrease in the RPV water level, fuel clads starts to heat up and oxidation between the fuel clads and the hot steam starts. In this work, the total generated hydrogen in the RPV is calculated to be approximately 366 kg. Figure 10b shows the decay and oxidation energy release in the core. The clad oxidation and hydrogen generation is an exothermic reaction. The amount of the released energy leads to fuel-rod failure and lower head meltdown. The cumulative energy generated by oxidation in the RPV is 52 GJ while the total decay heat is 1068 GJ. The inability to remove the heat from the core would damage the reactor vessel, especially the lower head where melting materials are accumulated. Figure 10c shows the RPV fails at 11300 s and debris ejects from the RPV lower head to the cavity. The total debris mass ejected through the vessel break is 145.2E3 kg.

Figure 10Full-screen View

(a) Hydrogen mass; (b) Released energy; (c) Debris mass

6. Conclusion

In this work, initially the steady state of the Bushehr power plant was modeled using the MELCOR computational code and the results were validated using the FSAR of the BNPP. The station blackout of Bushehr power plant was implemented, and desirable results were obtained. This work presents the available time for preventing in-core damage and FA meltdown. In this analysis, the response of the reactor components is reported as well. It is shown that, although the probability of a station blackout occurring is very low, it can happen, and without a well-established control procedure, the occurrence leads to a severe accident. In this accident, the safety systems fail to intervene, and without manual action on the part of the operator, the core of the reactor would be damaged, and it may melt down. The reason for this is the fact that when the active core cooling systems fail to work properly, not only would the water needed for the primary cooling system not be provided, but the reactor decay residual heat would also not be removed. Hence, in the case of SBO without operator action, there would be less time available for restoring AC power and a severe occurrence such as Fukushima accident may even take place. By the above analysis, one may get the following conclusions:

1. In this station blackout scenario, the water of the primary side would be evaporated, and the core would melt down because the active core cooling systems are lost.

2. As long as there is water in the primary circuit, there would not be a great increase in the temperature of the core. As soon as the water of the primary cooling side is evaporated, the temperature would increase in the core. If water is injected to the primary side during the accident or if the cooling water of the primary side is evaporated later, the melt down of the core would be delayed. This process is possible with manual action on the part of the operator.

3. If no safety system is activated and if the operator does not manage the accident, the FAs of the core would melt. It is shown that the operator has appropriate time for manual action for controlling the accident or mitigating the consequences. The auxiliary core cooling tanks could be manually connected if the pressure of the core decreases to approximately 5.88 MPa and 2.7 MPa.