stationblack-outanalysiswithmelcor1.8.6codefor...

Hindawi Publishing CorporationScience and Technology of Nuclear InstallationsVolume 2012, Article ID 620298, 17 pagesdoi:10.1155/2012/620298

Review Article

Station Black-Out Analysis with MELCOR 1.8.6 Code forAtucha 2 Nuclear Power Plant

Analia Bonelli,1 Oscar Mazzantini,1 Martin Sonnenkalb,2 Marcelo Caputo,3

Juan Matias Garcıa,3 Pablo Zanocco,3 and Marcelo Gimenez3

1 Licensing, Nuclear Safety and Core Design, UG-CNAII-IVCN-Nucleoelectrica Argentina S.A, Lima,B2806AEL Buenos Aires, Argentina

2 Barrier Effectiveness Department, Gesellschaft fur Anlagen und Reaktorsicherheit (GRS) mbH, Schwertnergasse 1,50667 Cologne, Germany, Germany

3 Nuclear Safety Department, Centro Atomico Bariloche (CAB)-Comision Nacional de Energıa Atomica (CNEA),Bustillo Avenue Km. 9.5, Bariloche, Rıo Negro 8400, Argentina

Correspondence should be addressed to Analia Bonelli, [email protected]

Received 30 November 2011; Accepted 13 February 2012

Academic Editor: Alejandro Nunez-Carrera

Copyright © 2012 Analia Bonelli et al. This is an open access article distributed under the Creative Commons Attribution License,which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

A description of the results for a Station Black-Out analysis for Atucha 2 Nuclear Power Plant is presented here. Calculations wereperformed with MELCOR 1.8.6 YV3165 Code. Atucha 2 is a pressurized heavy water reactor, cooled and moderated with heavywater, by two separate systems, presently under final construction in Argentina. The initiating event is loss of power, accompaniedby the failure of four out of four diesel generators. All remaining plant safety systems are supposed to be available. It is assumed thatduring the Station Black-Out sequence the first pressurizer safety valve fails stuck open after 3 cycles of water release, respectively,17 cycles in total. During the transient, the water in the fuel channels evaporates first while the moderator tank is still partiallyfull. The moderator tank inventory acts as a temporary heat sink for the decay heat, which is evacuated through conduction andradiation heat transfer, delaying core degradation. This feature, together with the large volume of the steel filler pieces in the lowerplenum and a high primary system volume to thermal power ratio, derives in a very slow transient in which RPV failure time isfour to five times larger than that of other German PWRs.

1. Introduction

The Central Nuclear Atucha 2 (CNA-2) is a nuclear powerplant (NPP) with a two-loop, 745 MWe, Pressurized HeavyWater Reactor (PHWR), designed by Siemens-KWU andbeing under final construction in Lima, Argentina. The NPPis cooled and moderated by heavy water like a similar unitof smaller power (CNA-I) in operation at the same site since1974.

The reactor pressure vessel is very large and has adiameter of ∼7.4 m. In difference to other PWRs the upperand lower plenum is to a large content occupied by fillerpieces made of steel to reduce the necessary heavy waterinventory (Figure 1). The reactor core consists of 451 verticalnatural Uranium fuel assemblies located in the same numberof coolant channels, connected each to the lower and upper

reactor plenum. Each assembly consists of 37 fuel rods. Thethermohydraulic design of the core divides the channelsinto five zones. For the external zones, specially designedflow limiters (drossels) are installed, so that the coolantflow in each channel zone is proportional to the averagegenerated power in it, achieving almost the same channeloutlet temperature for all the zones (Figure 2). The coolantchannels are within the large moderator (MOD) tank. Forreactivity reasons the moderator in it is maintained at a lowertemperature than the reactor coolant. This is accomplishedby the MOD system (Figure 4), which extracts the moderatorfrom the MOD tank, cools it in the MOD coolers, and feedsit back to the MOD tank.

During full-load operation, 95% of the total thermalpower is generated in the fuel, and the remaining 5%in the MOD tank, because of the neutron moderation.

2 Science and Technology of Nuclear Installations

Section A-B

90◦

180◦0◦

270◦ Control rodpositions

CoolantModerator

Multiway valveSafety injection

Coolant channel

Filling bodies

Filling bodies

Guide tube forcontrol rod

A B

(6915)100

∅7368∅6940

Figure 1: CNA-2 reactor pressure vessel (1 fuel channel and 1 control rod shown only).

Coolant channel

Moderator pipes

1b2b3b5c

0◦

270◦

Unthrottled

Intelthrottle

type

Number ofcoolant

channels

Throttlezone

12345

30364290253

180

828183

8690

95

8488

9197

9399

45

810

8994

98

79

1213

1521

100105

111

124

102

121131

141 135142

140136147

151

101107

128

106 108

125

103109

126

104

123133

146 137144

138149

150

134143

145148

1114

1817

1926

28

1620

2523

2432

3436

120127

2227

3331

2938

4043

45122

130

3035

4239

3746

4850

53129

132

4144

5249

4756

5759

6155

139

5154

6360

5866

6567

7164

69

6268

7472

7078

7677

7973

75

23

685

8792

96

118116115117114112110 113119

180◦

90◦

Figure 2: CNA-2 thermohydraulic zones.

Science and Technology of Nuclear Installations 3

Steam generator 1

Steam generator 2

Main steam pipe 2

Pressurizer relief tank

Pressurizer

Main steam pipe 1

Reactorcoolant pump 1

Loop 1

Loop 2

Reactor coolant pipingand

pressurizing system

AA 272

AA 273

AA 270AA 271

JEF10

JEF10JEF10

Reactor pressure vessel

±0 m

−3.5 m

360◦

0◦

Middle of reactor

building

Surgeline

+14.1 m

270 ◦

180◦

Reactorcoolant pump 2

Figure 3: CNA-2 primary system layout.

Additionally, approximately 5% of the thermal power istransferred from the coolant channels to the MOD tank byheat transfer due to the temperature difference between thesystems. The heat removed from the MOD system is usedfor preheating the feed water of the two Steam Generators(SGs), (Figure 3). The reactor coolant system and the MODsystem are connected by pressure equalization openings ofthe moderator tank closure head. Therefore, the pressuredifferences in the core between the primary coolant andMOD systems are comparatively small, which results in thinwalls for the coolant channels. Furthermore, the connectionbetween the reactor coolant system and the MOD system

permits the use of common auxiliary systems to maintain thenecessary water quality.

Various methods are applied to control reactivity andthus the power output of the reactor. The reactor contains“black” (Hafnium absorbers) and “gray” (steel absorbers)control elements (Figure 1). These control elements areused to control the reactivity and the power distribution,to compensate the buildup of Xenon poisoning followinga reactor power reduction and to shut down the reactor.Additionally, a fast boron injection system, as a secondindependent shutdown system, is provided, which injectsboric acid into the MOD tank. The reactivity can be also


Moderator cooling system

JEB 10

1

2

3

JFC01

JFC13

JFC42JFC33

JFC34

JFC35JFC02

KBA03

CFC24

KAG

KAG

KBA02

KBA01

JFC13

JFC13

JFC12

JFB30

JFB20

JFB10

JFB40

JFC32

JFC25

JFC23

JFC22

JFC15

JFC33

JFC25

JFC

11

JFC11JFC12

JFC14

JFC15JFC31

JFC41

JFC41

JFC45

JFC35

JFC43

JFC21

JFC11JFC23

−3.5 m

JFA20-11.187 mJFA10-7.65 m

−3.702 m

JFC45

−5.8 m

JEA 20

JEB 20

JFA30-11.187 mJFA40-7.65 m

−9.15 m

9.7 m

Figure 4: CNA-2 moderator system layout.

controlled by varying the MOD temperature within a certainrange, which is advantageous for some operating modes.Table 1 shows the main overall data of the plant, whileFigures 3 and Figure 4 show a schematic view of the reactorand moderator system.

The reactor coolant system (RCS) (Figure 3) removes theheat generated in the reactor core and transfers it via thesteam generators to the turbine and the generator of theplant. The system is structured similar to that of a pressurizedlight water reactor but consists only of two identical loops,each comprising a steam generator, a reactor coolant pump,and the interconnecting piping, as well as one pressurizerlinked to one loop.

The moderator system (Figure 4) consists of four identicalloops operating in parallel. Each loop comprises a moderatorcooler, a moderator pump, and the interconnecting lines andvalves. The moderator system performs various functionsdepending on the reactor operating mode.

During normal operation the moderator system main-tains the moderator at a lower temperature than that ofthe reactor coolant. The moderator leaves the top of themoderator tank, flows to the moderator pumps, is pumpedthrough the moderator coolers, and flows back to the bottomof the moderator tank through special pipes coming downfrom the top of the RPV. The heat transferred in the

moderator coolers is used to preheat the steam generator feedwater.

For residual heat removal, the moderator system isswitched over to the residual heat removal position by meansof the moderator valves. Under this operation mode, themoderator is extracted from the bottom of the moderatortank (reverse flow to nominal operation) by the moderatorpumps. Passing the moderator coolers, the moderator isinjected through the hot or cold reactor coolant lines intothe core. The moderator system forms the first link of theresidual heat removal chain. The residual heat is transferredfrom the moderator system to the residual heat removalsystem and then to the service cooling water system.

During emergency core cooling the moderator servesas a high-pressure core cooling system. Determinant forthe design of the moderator system is the demand for ahigh reliability during emergency core cooling condition.Therefore, the system consists of four separated loops fromwhich the injection capacity of two moderator circuits(334 kg/s) is sufficient for emergency core cooling operation.For emergency core cooling operation, the moderator systemis switched over in the so-called residual heat removalmode. The moderator pumps take the water again fromthe bottom of the moderator tank and feed through themoderator coolers into the cold and hot reactor coolant


Table 1: CNA-2 PHWR NPP overall data.

CNA-2 overall plant data

Reactor type PHWR

Net power station output ∼745 MWe

Reactor coolant system and moderator system

Total thermal power 2160 MW

Number of coolant channels or fuel assemblies 451

Active core length 5300 mm

Shape of fuel assembly37-rodcluster

Reactor coolant system and moderator system

Coolant and moderator D2O

Total thermal power transferred to the feedwater/main steam cycle

2174 MW

Total thermal power transferred to steam generators 1954.5 MW

Total thermal power transferred to moderatorcoolers

220 MW

Number of coolant circuits 2

Number of moderator circuits 4

Total coolant circulation flow 10300 kg/s

Total moderator circulation flow 890 kg/s

Pressure at reactor vessel outlet 115 bar

Coolant temperature at reactor pressure vessel 278◦C

Average moderator temperature normal/maximum 170◦C/220◦C

Steam pressure at steam generator outlet 54.9 bar

Total steam flow 956 kg/s

lines, respectively, the upper and lower plenum of the RPV.The residual heat removal chain connected to the moderatorcoolers during emergency core cooling is the same as duringresidual heat removal.

The primary flow rate through the moderator coolersand the moderator pumps is 222 kg/s for each pump, the netinjection flow into the reactor coolant system is 167 kg/s foreach pump, taking into account a bypass flow to the suctionline of the moderator pumps. This is designed to reduce thetemperature of the water on the suction side of the pumps.

Additionally to the moderator pumps, the ECCS includes4 low pressure safety injection pumps, 4 water storage tanks,and 4 accumulators. After the emergency core cooling signalis triggered, the water storage tanks inject the inventorydirectly into the containment sump. The safety injectionpumps, with a flow rate of 167 kg/s each, charge the coolantcollected in the containment sump through the moderatorcoolers into the primary system. Accumulators also injectinto the moderator lines downstream the moderator coolers.

Atucha 2 NPP has developed Probabilistic Safety Analy-ses (PSAs) of Levels 1 to 3. While PSA Levels 1 and 3 havebeen made by NA-SA Atucha-2, Argentina, with supportfrom CNEA Instituto Balseiro, Bariloche, Argentina, PSALevel 2 was developed by GRS Cologne, Germany, withsupport from CNEA Instituto Balseiro, Bariloche, Argentina,in regard to the MELCOR modeling of the reactor coolant

and the moderator coolant system, and NA-SA Atucha-2, Argentina, who provided all necessary information onrequest and supported especially the determination ofcontainment and reactor building relevant data. A detailedMELCOR input deck [1] is the basis for the deterministicanalyses in the PSA Level 2, and models all systems,components and buildings of the plant relevant for severeaccidents, as well as the reactor and moderator circuit, thefeed water and steam circuit, the heat removal system KAGconnected to the moderator coolers, the reactor buildingwith the containment and the relevant part of the auxiliarybuilding and the stack. The selection of the buildings tobe modeled in the MELCOR deck has been made basedon a determination of possible radionuclide release pathsfrom the containment into the environment assuming severe(core melt) accidents starting from full power operation. Theuniversal modeling of systems and components and reactorprotection signals allows the usage of the input deck fora large spectrum of LOCAs and transients starting fromnormal plant operation.

This nodalisation has been extensively discussed withNA-SA and reviewed by ARN and its subcontractor SNLbefore final application for PSA Level 2 analyses. It was alsovalidated against a very detailed RELAP5 (version MOD 3.3)model developed by NA-SA and used within the PSA Level1, to match results for the steady state calculations, andsome selected accidents until core heatup in order to gainconfidence on obtained results [2].

As a result of the plant specific PSA Level 1, a numberof relevant Core Damage States have been identified. In thePSA Level 2, MELCOR calculations have been done for eachof the relevant CDS in order to assess the severe accidentprogression and the possible radionuclide releases into theenvironment. The results have been used directly by PSALevel 3 study.

One of the most extensively studied transients has beenthe Station Black-Out, for which a low pressure scenario,a high pressure scenario, and several sensitivity cases havebeen assessed, as this was the dominating sequence accordingto PSA Level 1 analysis. In particular, a review of the LowPressure Station Black-Out (SBO) scenario will be presentedhere, in order to highlight specifics of CNA-2 NPP regardingtiming of the accident scenario, in comparison to other PWRreactors.

2. Brief Description of CNA-2 SBO Sequence

The postulated Station Black-Out event without accumula-tor injection causes reactor scram and the running-off ofboth reactor cooling pumps as well as the moderator pumpsat the time the initiating event was defined, time = 0.0 s. By anautomatic action of the reactor protection system, a 100 K/hcooldown by the steam generators steam dump stations,which is electrically supported by batteries, is initiated. Aftertermination of the cooldown, the primary pressure increasesagain. The safety valve of the pressurizer opens several timesto limit the primary pressure. After 17 cycles of the firstpressurizer safety valve, respectively, 3 cycles of pure water


release, it is assumed that it fails stuck open. Under leakcondition, a permanent flow into the containment occursthrough the pressurizer relief tank with a depressurization ofthe primary systems. The condition for the initiation of theaccumulator injection is reached more than 2 hours after theinitiating event, when the batteries are already empty. Thus,an accumulator injection is not considered for that case, as anactive action is needed to open valves to load the accumulatortanks by nitrogen from the tanks nearby.

If no accident management measure is considered, theabove transient is to be expected, which results in a severecore damage. This is thus the transient that will be presentedhere.

On the other hand, a second base case has been analyzed:the Station Black-Out event with accumulator injection. Theaccumulator injection can only be pursued if the valves ofthe accumulator system are opened by a manual accidentmanagement measure during the first two hours of thesequence (batteries still available) so that the accumulatorsget pressurized. The results of this calculation show thatdue to the accumulator injection, core degradation andRPV failure are delayed by at least 5 hours. The increasein the hydrogen generation is small and does not imply adisadvantage of the accumulator injection because it doesnot mean an additional endangering. Thus, the accumulatorinjection seems to be a reasonable measure and it will beprobably made available for the Station Black-Out event asan accident management measure in order to gain more timefor the handling of the accident.

3. Outline of MELCOR Code

MELCOR [3] is a fully integrated, engineering-level com-puter code whose primary purpose is to model the pro-gression of accidents in light water reactor nuclear powerplants. A broad spectrum of severe accident phenomena inboth boiling and pressurized water reactors is treated inMELCOR in a unified framework; current uses of MELCORinclude estimation of fission product source terms and theirsensitivities and uncertainties in a variety of applications.

The MELCOR code is composed of an executive driverand a number of major modules, or packages, that togethermodel the major systems of a reactor plant and theirgenerally coupled interactions. Reactor plant systems andtheir response to off-normal or accident conditions includethe following:

(i) thermal-hydraulic response of the primary reactorcoolant system, the reactor cavity, the containment,and the confinement buildings,

(ii) core uncovering (loss of coolant), fuel heatup,cladding oxidation, fuel degradation (loss of rodgeometry), and core material melting and relocation,

(iii) heatup of reactor vessel lower head from relocatedfuel materials and the thermal and mechanical load-ing and failure of the vessel lower head, and transferof core materials to the reactor vessel cavity,

(iv) core-concrete attack and ensuing aerosol generation,

(v) in-vessel and ex-vessel hydrogen production, trans-port, and combustion,

(vi) fission product release (aerosol and vapor), trans-port, and deposition,

(vii) behavior of radioactive aerosols in the reactor con-tainment building, including scrubbing in waterpools, and aerosol mechanics in the containmentatmosphere such as particle agglomeration and grav-itational settling, and,

(viii) impact of engineered safety features on thermal-hydraulic and radionuclide behavior.

Initially, the MELCOR code was envisioned as beingpredominantly parametric with respect to modeling com-plicated physical processes (in the interest of quick codeexecution time and a general lack of understanding of reactoraccident physics). However, over the years as phenomenolog-ical uncertainties have been reduced and user expectationsand demands from MELCOR have increased, the modelsimplemented into MELCOR have become increasingly bestestimate in nature. The increased speed (and decreased cost)of modern computers (including PCs) has eased many ofthe perceived constraints on MELCOR code development.Today, most MELCOR models are mechanistic, with capa-bilities approaching those of the most detailed codes of afew years ago. The use of models that are strictly parametricis limited, in general, to areas of high phenomenologicaluncertainty where there is no consensus concerning anacceptable mechanistic approach.

4. MELCOR Model for CNA-2 NPP

Atucha 2 NPP MELCOR nodalisation was made on the basisof knowledge gained by GRS in previous PSA Level 2 studiesfor PWR and BWR, and state of the art knowledge on thefield. The RPV nodalisation can be seen in Figure 5. Thereactor model consists, like in a German PWR model [4],of one volume each for downcomer (CV100), lower plenum(CV110), upper plenum (CV140), and RPV head (CV150)plus one for the upper ends of the coolant channels (CV145).

The 451 coolant channels are subdivided in 6 parallelhydraulic groups, different as typically done in other PWRdecks. The reason for this is the PHWR core design which ismore similar to a BWR core with canisters. The inner partof the core has no flow limiters, while in the core peripherydifferent regions with different flow limiters exist (Figure 2).The number of coolant channels differs in each of the 6groups. Each channel and the moderator tank are furthersubdivided into 3 axial levels. In total 21 CVs are used.This modeling takes into account that the water level in thechannels and in the moderator tank may be significantlydifferent in case of an accident and that the channels willfail sequentially in different axial levels. If the channel fails,in each axial level a horizontal flow path opens towards themoderator tank. These flow paths are not shown in Figure 5.

The MELCOR core model uses a BWR model becauseonly this option allows the melting of the zircaloy coolantchannels, which are modeled by the BWR fuel assembly


CV280

CV250

CV

220

CV

210

FL210

FL260FL270

FL200

CV270

CV200

CV240

CV

235

CV

230

CV

335

CV

330

CV410

CV300

CV340FL400

FL335

FL330FL230

FL235

FL220FL320 FL300

FL280

FL250

CV380

CV350

CV370

FL370FL360

FL375

FL380

FL350

FL595 FL545

FL410

FL310CV422

CV421

CV420

FL420

FL421

CV430

FL422

FL425

CF410 (Heaters)

FL435

FL102

CV

126

CV

166

CV

176

CV

125

CV

165

CV

175

CV

124

CV

164

CV

174

CV

123

CV

163

CV

173

CV

122

CV

162

CV

172

CV

121

CV

161

CV

171

CV

122

CV

162

CV

172

CV

123

CV

163

CV

173

CV

124

CV

164

CV

174

CV

125

CV

165

CV

175

CV

126

CV

166

CV

176

FL16

6

FL16

5

FL16

4

FL16

3

FL16

2

FL16

1

FL17

6

FL17

5

FL17

4

FL17

3

FL17

2

FL17

1

CV140FL141

FL142FL105

FL150

FL340

FL240

CV

100

CV

100

FL13

1

FL13

2

FL14

3

FL13

9

CV150C

V14

5

FL145

CV110

FL110

FL103 FL12

1

FL12

2

FL12

3

FL12

4

FL12

5

FL12

6

FL11

6

FL11

5

FL11

4

FL11

3

FL11

2

FL11

1

CV

310

CV

320

CV360 CF420 (sprays)

FL275

CV260

Figure 5: MELCOR nodalisation scheme of reactor, coolant circuits, and SGs (cross connection inside the core not shown).

canister components. The model consists in total of 7 radialrings and 28 axial levels for the core and the lower plenum.The selection of the radial rings was made taking intoaccount different aspects like the location of flow limiters,the axial and radial power distribution and the burn-upzones. The MELCOR core nodalisation consists of 20 levels.The active part of the fuel consists of 18 levels; 16 ofthem have an identical length of 30 cm while the othertwo (axial levels of upper and lower end of active fuel)are only 25 cm long each. The lengths of the inactive corelevels at the upper end (level 28) and lower end (level 9)of the fuel assembly are 35 cm and 46.5 cm, respectively.The nodalisation consists of additional 8 levels for the lowerplenum, 5 of them are used for the filler pieces and onefor the moderator tank bottom (the lower core supportplate in MELCOR). The remaining two axial levels modelthe free space above the filler pieces and the area of theheavy support grid to the moderator tank bottom (Figure 6).The RPV wall is subdivided in 11 segments as shown in

Figure 6. The RPV segments 9 to 11 will get in contactwith molten material first, after its relocation into the lowerplenum.

Each of the two loops of the reactor circuit of CNA-2is modeled separately (Figure 5). The loop 10 is connectedvia the surge line (CV410) to the pressurizer (CV420-422)and the relief tank (CV430). The two safety valves of thepressurizer are modeled, and the pressurizer heaters andspray systems as well (normal operation spray system andKBA spray). If the pressure rises in the relief tank, a burstmembrane will fail and open towards the containment.In addition, a failure of a safety valve stuck open can besimulated, as described here. Each reactor circuit consists of6 control volumes, one is used for the hot leg, two are usedfor the SG piping, and three for modeling the cold leg. This isidentical to the PWR model used at GRS before. In case of anaccident, the injection of heavy water by the volume controlsystem (KBA) into both cold legs is started. In total 70 m3 canbe injected.


Segment 1

Segment 11

Figure 6: MELCOR model of RPV lower head.

SG1CV280

SG2CV380

FL280

FL380

CV290

CV390

CV65

CV65

CV295

CV395

CV60

FL295

FL395FL390

FL290

FL398(safety valve)

FL397(relief valve)

FL298(safety valve)

FL297(relief valve)

Figure 7: MELCOR nodalisation scheme of steam system.

The SG secondary side is modeled by 4 volumes, thedowncomer, the riser, the steam separator region, and thesteam dome (Figure 5). The connections between the SGsecondary sides volumes by flow paths are shown as well. Thesteam system is simplified as shown in Figure 7. This schemehas already been used for German PWRs because such a SGmodel has proved to be best applicable for this plant designtype [4].

The moderator system of the plant consists of fourloops, as schematically shown in Figure 8. A moderatorpump (MCP) and a heat exchanger (MHEx) are located ineach loop. Under normal operation, the hot water (D2O)is taken out at the upper end of the moderator tankthrough a collector and two pipes, leaving the RPV at thesame elevation as the reactor loops. The cold water flowsback through four pipes connected to the top of the RPV,ending inside in a special collector at the lower end ofthe moderator tank. The collector was not modeled in theMELCOR deck. The moderator pumps are also used duringaccident sequences as emergency core cooling pumps. Afailure of a MCP due to cavitation is assumed, if the steamtemperature in a suction pipe of an MCP equals to thesaturation temperature for more than 2 minutes. This simplemodel takes into account a high steam concentration at thepump entrance. It is a pessimistic assumption related to the

possible continued MCP operation under two-phase flowconditions, but such conditions cannot be simulated wellwith MELCOR.

The moderator heat exchangers are used to preheatthe feed water during normal operation and to cool downthe primary system by the KAG system during plant shutdown. The secondary side (feed water system) flow of twomoderator loops provides the feed water to one SG. The heatexchangers of these two loops are located at two differentlevels in the containment. The nodalisation of the moderatorsystem is shown in Figure 8 and that of the feed watersystem in Figure 9. Because of the design specifics, a separatemodeling of all 4 loops of the moderator circuit was needed.Moderator loops 10 and 20 are connected to RCS loop 10(with pressurizer) while loops 30 and 40 are connected tothe other RCS loop 20. Moderator loops 10 and 40 are theones having their Heat Exchanger located at a higher positioninside the containment, at floor level−8 m. The other two arelocated at −11.5 m level.

The MELCOR nodalisation follows the same rules asthose applied for the reactor circuit. Vertical and horizontalparts of the piping are modeled separately by CVs. Thevolume of each individual CV should not be too smallto avoid numerical instabilities, which was not possiblefor instance for the heat exchanger volumes. The pipes ofeach loop are modeled by 3 CVs plus some CVs for thepipes/collectors inside the moderator tank and as well nearthe RPV. The heat exchanger itself consists of 3 CVs on theprimary as well as on the secondary side. In addition, a heatsink/source of 5 MW in each heat exchanger “node pair”is modeled, to enhance the heat transfer from the primaryto the secondary side during normal plant operation. Thisis necessary to obtain realistic heat transfer rates, similar tothose to be found in the real plant, as MELCOR has no modelfor “cross flow heat exchangers.”

The moderator system is connected through separatepipes with the RCS loops (hot and cold leg) and the RPV(upper plenum and downcomer) for emergency core coolingoperation. The injection pipes in each loop are lumpedtogether into one CV with two separate connections (FL)to the injection points. During ECC operation, the system isswitched into the so-called “reverse or commutation mode”(reverse flow with extraction of water from moderator tankbottom and injection into RCS and RPV). The pipe, whichwill be opened for injection, is modeled only by a flowpath in each loop (FL521, FL571, FL621, FL671 in Figure 8).There is a bypass flow of about 50 kg/s per loop downstreamthe heat exchanger back to the suction side of the MCP,which is as well taken into account through flow pathsFL515, FL565, FL615, and FL665. The existence of this bypasssignificantly extends the MCP operation before cavitationoccurs.

The feed water system consists of several CVs in eachloop. The feed water system upstream the MHEx is modeledby a time independent volume (CV50 in Figure 9) only. Asmentioned the heat exchanger secondary side is modeledby 3 CVs in each loop. Downstream, an individual pipesection is modeled and the common feed water pipelineconnected to each SG. The bypass of the MHEx is modeled


CV130

CV511FL513

CV512 CV513FL512FL511

CV

515

CV505

CV520

FL505

FL515

FL570

FL136

FL550

CV134

CV

518

FL670 FL137

FL600

FL518

CV533 CV532 CV531

FL135

FL130

FL528

CV561FL563

CV562 CV563FL562FL561

CV

565

CV555

CV570

FL555

FL565

CV

568

CV683 CV682 CV681

CV611

FL613

CV612CV613

FL612 FL611C

V61

5

CV605

CV620

FL605

FL615

CV

618

CV633CV632CV631

FL650CV661

FL663CV662CV663

FL662 FL661

CV

665

CV655

CV670

FL655

FL565

CV

668

CV583CV582CV581

CV135

CV550

CV500

FL620 FL520

FL500

FL618 FL628

CV131

CV132

FL132

FL131

CV640

CV300

CV100CV140

CV340

CV50

CV590CV50 CV50CV690

CV50CV540

CV140 CV100

Upper plenum

FL568

DowncomerUpper plenum Downcomer

FL578FL668 FL678

FL516 (conmutacion)

FL521 (conmutacion)

FL621 (conmutacion)

FL671 (conmutacion)

FL571 (conmutacion)

FL566(conmutacion)

Accu

injection

(CF5263)

Accu

injection

(CF6263)

Accu

injection

(CF6763)

Accu

injection

(CF5763)

CV240CV200

Hot leg

(loop 1)

Cold leg

(loop 1)

Hot leg

(loop 2)

Cold leg

(loop 2)

JND

(FL519)injection

JND

(FL569)injection

JND

(FL619)injection

JND

(FL669)injection

Redundance 1Redundance 4

Redundance 3 Redundance 2

FL616(conmutacion)

FL666(conmutacion)

Figure 8: MELCOR nodalisation scheme of moderator systems 10 to 40.

CV

540

CV250

CV

690

FL540

FL690FL545

CV

640

CV595

CV

590

FL640

FL590

CV605 CV615 CV515 CV505

CV565 CV555CV655 CV665

CV511CV512CV513

CV683CV682CV681

CV561CV562CV563

CV531 CV532 CV533CV631CV632CV633

CV611 CV612 CV613

CV583 CV582 CV581

CV661 CV662 CV663

CV65

CV65CV65

CV545

CV65

CV50

Moderator

ModeratorModerator

Moderator

FL530

FL531 FL532 FL533

FL680 FL681 FL682 FL683

FL632FL633 FL631

FL630

FL582FL583 FL581 FL580

SG1CV350SG2

FL542(relief valve)

FL692(relief valve)

FL642(relief valve)

FL592(relief valve)

FL595

Figure 9: MELCOR nodalisation scheme of feed water systems 10 to 40.

only by one FL in each loop. For emergency feed waterinjection, the startup and shutdown pumps (LAJ) are usedand simulated by mass sources directly into the feed waterline at the SGs. In each feed water loop a relief valve ismodeled, which limits the maximum pressure, if the systemis switched off.

The containment nodalisation scheme is similar inprinciple to the modeling of the main rooms of the GermanPWR [4], but much more detailed related to the smallerrooms inside the containment. A general view of the CNAII nodalisation scheme developed for the containment andreactor building is shown in Figure 10. Each colored zone isan individual CV.

Inside the containment and the annulus of the reactorbuilding different floors are located. The developed con-tainment nodalisation consists of 33 control volumes (CVs)and about 90 flow paths (FLs). Several small rooms have

been lumped together. Larger rooms are modeled separately.The dome area was subdivided to allow the calculation ofconvection loops (as described in [4]). The main reasonsfor this large level of detail are phenomena related to thehydrogen issue and the need for a detailed modeling ofa larger number of small compartments located nearbythe tilting machine (an automatic machine in charge oftransporting new and burned fuel elements from the spentfuel pool to the refueling machine). The open flow paths havebeen determined based on containment drawings. About480 heat structures have been defined to simulate the walls,floors, and ceilings and some of the equipment not modeledby the primary and the moderator circuit.

The detail of the annulus model and that of parts of theauxiliary model are similar to the containment. In addition,all relevant air ventilation systems are modeled. More detailsare given in [1].


1.60.6

60

60

60

175

150

1.6 0.6

SMJ01UJA

+24.465

500/125 Mg

140100

JA 10.35

JA10.25

JA09.35

JA08.51JA08.42

JA10.37

JA09.37JA09.45

JA08.37

JA07.51

JA07.37

JA06.37

AN001

JA05.37JB05.80

JB06.18

JB07.14

JB08.20

JB06.17

JB04.20

JB04.15

JB02.16

JB01.16 JB01.20

JB02.20

JB01.13

JB03.13

JA03.20

JA05.35

JA04.35

JA03.35

JA02.36

JA02

.02

JA08.35

JA07.33

JA06.33

JA10.5

JA10.25

JA10.60

JA09.61

JA10.58

JA09.73JA09.58

JA08.69

JA07.69

JA08.52

JA08.58

JA07.52

JA 8.61

JA 07.61

JA05.50 JA05.58

JB04

.60

JA05.46

JA04.49

JB03.51

JB03.50

JB02.50 JB02.53

JA04.50

JA02.51

JA03.5

JA 06.61

JA07.58

JA06.58 JB06.5

JB07.41

JB08.41

JA09.01

JA08.01

JA07.01

JA06.01

KLA35AN001AN002

KLA35

KLA50

AN003AN004

KLA51AN001

AN001BC 001

AN002

JMV12JMV 10

KLB39AN001

KBA60BC001

KLA32AN001

KLA31AN001

KLA34AN001

JA05.01

JA04.01

JA03.01

JA02.01

JA10

BB001

JEA10

JFA10

BC001

BC001

JFA20BC001 JEB10

KTG20

AP001

AP001

JEA20BC001

JEB10KLB31

AN002KLB31

AP001

I

I

JFA40

JFB40AB001

BC001

150

80

60

AN002

KLA33AN001

AN001

JFA30BC001

JB01.56 JB01.50 JB01.54AP001

∇−12

∇−8.5

∇−4.4

∇−12

∇−14.8

175

30

100

30

∇−8.5∇−8.6

∇− 4.4

∇−3.5

JMV 12JMV 21BZ 001

30

90

30

∇ + 12.5

∇ + 15.4

80

30

60

60

60

KAA10BC001

∇−14.8

∇ + 0

∇+24.16

∇+18.8

∇+15.4

∇+10.4∇+10.1

∇+7.018∇+8.5

∇+5

∇+0.5∇±0

∇−2.6∇−3.6

∇−6.6∇−5.2

∇−10.6

∇−14.1

∇−18.6 2 QUX

UJBKTG23

150

150

130

∅60.4

∅56

∅42

Figure 10: MELCOR nodalisation scheme of containment and reactor building annulus (principle scheme).

5. Initial Data and Boundary Conditions

The boundary conditions and assumptions concerning thefailure of systems are briefly summarized in this section. Theinitiating event is loss of power, accompanied by the failure offour out of four diesel generators. All remaining plant safetysystems are supposed to be available; only boron shutdownsystem is not considered, because it has not been accountedfor in the MELCOR model for CNA-2. For the depressur-ization, it is assumed that during the Station Black-Outsequence the pressurizer safety valve fails stuck open after 3cycles of water discharge, respectively, 17 cycles in total.

Due to the lack of electrical power supply, the so-calledcommutation of the moderator loop to ECC mode does notoccur.

During that base case, an accumulator injection does notoccur because the automatic initiation of the accumulatorsdoes not take place before the capacity of the batteries is lost.

An accident management measure in order to open the valvesof the accumulator system before the batteries get empty isnot considered for this base case.

6. MELCOR Input Deck Qualification byComparison to RELAP5

The qualification of the MELCOR input deck was performedby a comparison with the detailed RELAP5 (version MOD3.3) input deck developed by NA-SA. This model was usedin the early phases of the project, to match the steady statecalculations between the two codes, and thus validate theMELCOR model. Furthermore, RELAP5 version uses D2Othermal properties while MELCOR uses H2O. This has aminor effect on the general excellent results, which is shownby the following figures from [2] for the SBO transient.Shown are the first∼4 h of the same scenario, described more


0

2

4

6

8

10

12

14

0 0.5 1 1.5 2 2.5 3 3.5 4 4.5

Pre

ssu

re (

MP

a)

Time (hs)

RELAP PRZ RELAP SG1MELCOR PRZ MELCOR SG1

Figure 11: Pressures in primary and secondary systems.

in detail in Section 7. For these analyses the containmentinput deck in MELCOR was not used, as such does not existin RELAP5 nodalisation either.

Figure 11 shows the primary and secondary pressure.After ∼40 min the SG steam valves are closed automaticallyto limit the further level decrease. Therefore, the secondarypressure rises again. After nearly 2.5 h the pressurizer safetyvalve was assumed to fail stuck open so that the pressuredecreases rapidly. Figure 12 shows the SG water level. Besidessome minor differences in the first minutes of the accident,caused by the simpler nodalisation of the SG secondary sidewith influence on the water level determination, the dry-outof the SG is calculated to be the same. 2 m water level inthe SGs is reached almost at the same point in time. Thisis important for the calculation of the natural circulationin the reactor circuit, shown in Figure 13. The circulationstops at about 2.5 h when the SGs are empty. Nearly identicalbehaviour was calculated by both codes. Figure 14 shows acomparison between the Cladding Temperatures calculatedby MELCOR and by RELAP5. The core heatup phase showsa very good agreement between the two models as well. Formore details of the event progression please refer to nextchapter.

As a conclusion, not only the light versus heavy waterissue is excluded as a possible cause of discrepancies inresults, but also the differences between a coarser MELCORnodalisation, and a much more detailed RELAP5 nodalisa-tion.

7. Results of MELCOR Simulation

Starting from normal plant operation a Station Black-Out(SBO) was assumed at time 0:00 h:min. The main coolingpumps and moderator pumps run down due to the loss ofelectrical power supply. Injection of water into the reactorcooling circuits is not available because of the loss of allpumps. The containment is successfully isolated due to theSBO condition (fail-safe principle of isolation valves).

0

2

4

6

8

10

12

14

0 0.5 1 1.5 2 2.5 3 3.5

Col

laps

ed w

ater

leve

l (m

)

Time (hs)

RELAP SG1RELAP SG2

MELCOR SG1MELCOR SG2

Figure 12: Steam generator 10 and 20 water levels.

0

200

400

600

800

1000

0 0.5 1 1.5 2 2.5 3 3.5 4 4.5

Time (hs)

RELAP CL MELCOR CLRELAP HL MELCOR HL

Mas

s fl

ow r

ate

(kg

s−1)

−200

Figure 13: Primary loops mass flow rates.

0

200

400

600

800

1000

1200

1400

1600

1800

0 0.5 1 1.5 2 2.5 3 3.5 4 4.5

Time (hs)

RELAP 1/2 active zoneRELAP 2/3 active zoneRELAP end active zone

MELCOR 1/2 active zoneMELCOR 2/3 active zoneMELCOR end active zone

Tem

pera

ture

(◦ C

)

Figure 14: Cladding temperatures at different axial positions.


0

2

4

6

8

10

12

14

1 3 5 7 9 11 13 15

Pre

ssu

re (

MP

a)

Time (hr)

PRZSG10SG20

−1

Figure 15: Pressure in pressurizer and SG10 and SG20.

0

2

4

6

8

10

12

1 3 5 7 9 11 13 15

SG w

ater

leve

l (m

)

Time (hr)

SG10-liquid levelSG10-collapsed level

SG20-liquid levelSG20-collapsed level

−1

Figure 16: SG10 and SG20 water levels.

Due to the loss of heat sinks, both the primary andsecondary side pressures start to increase. On the secondaryside, the cooldown by a rate of 100 K/h is initiated. Thiscooldown is available because the relief valves of the sec-ondary side steam dump stations are supported electricallyby batteries. The secondary side pressure decreases, whilepressure increase on the primary side is bounded (Figure 15).The water level of the steam generators is continuouslydecreasing due to the cooldown process and falls below 2 m at0:43 h and 0:43 h, respectively (Figure 16). Thus, the isolationof both steam valves and steam dump stations occurs (reactorprotection signals JR65 and JR66). After steam isolation,small steam leakages of the pilot valves are considered.

Due to the lack of heat release from the primary circuit,the water level inside the pressurizer rises. After completionof the 100 K/h cooldown, the primary pressure starts toincrease again. At 0:52 h the primary pressure reaches12.45 MPa for the first time (Figure 15). The first openingof the pressurizer safety valve occurs at 0:55 h. Subsequently,the valve opens intermittently in order to limit the primarypressure. During the first cycles of the valve only steam is

0

50

100

150

200

250

300

350

400

450

1 3 5 7 9 11 13 15

Time (hr)

WaterSteam

−1

−50

PR

Z-R

T m

ass

flow

rat

e (k

g/s)

Figure 17: Flow rate through pressurizer relief tank—water andsteam.

blown into the relief tank. Following, a water steam mixtureis released into the relief tank. The burst disk of the relieftank fails at 2:31 h because a pressure gradient over the diskof 1.4 MPa is reached. Altogether, the safety valve makes 17cycles before it fails stuck open. For the last three cyclesonly water is discharged into the relief tank. After the safetyvalve fails stuck open, a continuous leak flow through therelief tank occurs. Due to the leak flow through the relieftank (Figure 17) the primary pressure starts to decrease(Figure 15).

Up to about 2:40 h a free convection flow can be observedat the two upper loops of the moderator system. For eachof the lower moderator loops the flow disappears withinitiation of the Station Black-Out event, as the moderatorheat exchangers are located below the core height.

The JR31 ECCS signal is triggered at 2:31 h. The con-tainment pressure rises due to the leak flow. Thus, severalburst membranes located at the steam generator boxesand pressurizer box fail. The flooding signal JR36 occursat 2:43 h because the primary pressure has fallen below6.6 MPa. However, the water of the flooding tanks cannot bedischarged into the sump due to the lack of electrical powersupply.

Owing to the permanent loss of coolant, the water levelinside the cooling channels of the core decreases. At about3:30 h the cooling channels are nearly empty. At that timethe water level inside the moderator tank is still locatedat two thirds of the total height of the tank (Figure 18).From this time on, the decay heat is evacuated from thefuel elements to the coolant channel walls by convectionand radiation, as far as they are cooled from the outside bythe moderator tank water. The temperature increase shows,specially in the lower parts of the core, a plateau at about 3 hto 4:30 h of the transient (Figures 21 and 22) which evidencesthe decay heat evacuation by radiation as already stated. Asa consequence, the water level inside the moderator tankcontinues decreasing (Figure 18).

Simultaneously, the water level of the pressurizer slowlydecreases (Figure 19). Because of the exposure of the cooling


0

1

2

3

4

5

6

7

1 3 5 7 9 11 13 15

RP

V w

ater

leve

l (m

)

Time (hr)

Channel 1Channel 2Channel 3Channel 4

Channel 5Channel 6Moderator tank

−1

Figure 18: Water level in coolant channel rings 1 to 6 and mode-rator tank.

0

2

4

6

8

10

12

14

1 3 5 7 9 11 13 15

PR

Z w

ater

leve

l (m

)

Time (hr)

PRZ water levelPRZ collapsed level

−1

Figure 19: Pressurizer water level.

channel, the core starts to heat up in the upper part(Figure 20). The heatup of the lower parts of the core followswith a delay (Figures 21 and 22). The water dischargedthrough the relief tank flows into the containment sump andis lost for core cooling, because safety injection pumps arenot available due to the total loss of electrical power supply.

The first radionuclides—noble gases and volatile radio-nuclides—are released from the fuel elements gap afterbursting of the cladding starting at ∼3:56 h. The gap releasestarts in the central part of the core and migrates to the outerradial core rings. After 5:10 h, all radial core regions havegot a gap release. The radionuclides form aerosols which arereleased together with steam through the open relief tankinto the containment. Some of the aerosols may deposit aswell inside the RCS.

The core heatup accelerates when the oxidation processof the zircaloy cladding and coolant channels starts at about3:30 h (Figure 20). The hydrogen formed by the oxidation

0

500

1000

1500

2000

2500

1 3 5 7 9 11

Upp

er c

ore

tem

pera

ture

(K

)

Time (hr)

Channel R1Fuel R1Channel R2Fuel R2Channel R3Fuel R3


−1

Figure 20: Temperature of fuel and coolant channels in R1 to R6 ofupper core.

0

500

1000

1500

2000

2500

1 3 5 7 9 11

Mid

dle

core

tem

pera

ture

(K

)

Time (hr)



−1

Figure 21: Temperature of fuel and coolant channels in R1 to R6 ofmid core.

is mainly released through the relief tank into the uppercontainment compartment where the relief tank is located.After 10 h some of the hydrogen generated inside thepressure vessel is stored inside the Reactor Cooling System(Figure 23). In this analysis no combustion was calculatedneither in the rooms near the relief tank nor in otherrooms. Hydrogen fractions during the first 10 hours are smallbecause of the presence of Passive Autocatalytic Recombiners(PARs). The amount of hydrogen removed by the PARsinstalled in the containment compared to the generatedamount is shown in Figure 23.


0

500

1000

1500

2000

2500

1 3 5 7 9 11

Low

er c

ore

tem

pera

ture

(K

)

Time (hr)

Channel R1

Fuel R1

Channel R2

Fuel R2

Channel R3

Fuel R3

Channel R4

Fuel R4

Channel R5

Fuel R5

Channel R6

Fuel R6

−1

Figure 22: Temperature of fuel and coolant channels in R1 to R6 oflower core.

0

200

400

600

800

1000

1200

1400

5 15 25 35 45 55

Time (hr)

PRZ RTCoreCont MCCI

Annul MCCIRecombinedBurned

−5

H2

mas

s (k

g)

Figure 23: Hydrogen mass generated in core and from MCCI incontainment, released from leak and recombined by PARs.

The failure of the coolant channels starts in the upperpart of the four inner core rings at 5:16 h. At 5:20 h thedamage of the middle part of the inner rings already starts.This process opens additional flow connections between thedamaged parts of the coolant channels and the moderatortank. Thus, some water flows from the moderator tank intothe lower intact parts of the cooling channels where the waterlevel is increased (Figure 18). Up to 8:20 h the lower plenumof RPV is still full of water. Then, its evaporation starts due tofirst small relocation of core materials. Inside the moderatortank and cooling channels the water is fully evacuated atabout 9 hours after event initiation (Figure 18).

The ongoing core heatup causes a failure of the fuelassemblies and the core failure process spreads radially to thecore periphery and axially downwards. This is shown by anabrupt decrease in temperatures in Figures 20 to 22. Failuretemperature for fuel rods is around 2300 K. The reason forthis is the following: in CNA-2, fuel elements are hangingfrom a special construction located in the upper part ofthe channels above the core, which allows the so-called on-line refuelling. As the “fall-down” process of a fuel assemblyinside the coolant channel after support failure cannot bemodelled by MELCOR, some assumptions have to be madeabout the failure of the fuel assembly. The mechanical failureof fuel rods is assumed to result from a combination of loss ofintact, unoxidized cladding material; thermal stress; moltenzircaloy, which “breaks out” from ZrO2 shell at 2400 K; andthe collapse of standing fuel rods (that will form particulatedebris) based on a cumulative damage function. Due toswelling and thermal expansion, the mechanical stressesinside the pellets increase with temperature. Therefore, afunction was build-modelling the fuel integrity with timeat temperature taking into account that a long free standinglargely damaged fuel column is nonrealistic. As a conclusionfailure is shown at a lower temperature than the one usuallyfound in experiments, because a loss of integrity concept forfuel elements is being applied.

Together with the core degradation, significant amountsof noble gases and volatile radionuclides are released fromthe fuel. The failure of the control rods before the coolantchannel failure is of less importance for the core meltingprocess of CNA-2 compared to LWR because of the smallmasses of control rod material. Recriticality is not a topic asreflooding of a partly destroyed core is not calculated.

The upper (Figure 20) and middle (Figure 21) parts ofthe fuel in the inner rings fail in two phases at ∼5:30 hand ∼6:30 h. The failure of the whole five inner core ringsis completed at about 9:30 which is shown in Figure 22as an abrupt decrease in temperature. At that time theouter sixth core ring is still intact, because of the lowdecay power level. Then, the core debris of the five innerrings accumulates on the moderator tank bottom. The firstsignificant material relocation into the lower plenum afterlocal failure of the moderator tank bottom of radial ring3 happens at 11:17 h. Thereafter, the particulate debris andmelt, respectively, are released into the lower plenum, startevaporating the remaining water and heat up/melt the lowercore/moderator tank support grid and the filler pieces inthe lower plenum from the top. The water of the lowerplenum has been fully evaporated at 12:14 h. As the meltspreads radially on the filler pieces, it gets into contact withthe RPV bottom head side wall as well, which heats up(Figures 24 and 25). In the next almost 12.5 hours besidesthe core debris/melt, additional several tons of metallic meltare formed from the filler pieces and an additional significantamount of radionuclides are released into the RCS. After19:44 h the outer radial core ring (6th Ring) totally collapsesinstantaneously due to the loss of support from below andrelocates into lower plenum. At this point, the mechanicalloading to the RPV wall is very limited, determined bythe mass of melt, filler pieces, and the RPV bottom itself.


0

200

400

600

800

1000

1200

1400

1600

1800

2000

2.5 7.5 12.5 17.5 22.5 27.5

Tem

pera

ture

RP

V in

ner

sid

e (K

)

Time (hr)

Segment 1Segment 2Segment 3Segment 4Segment 5Segment 6


f

−2.5

Figure 24: Temperature of RPV bottom wall at inner side.

This means that creeping effects are probably proceedingslowly, as the pressure difference across the wall is almostzero. Therefore, RPV failure is assumed in the MELCORcalculation if the outer RPV wall temperature in a segmentreaches 1573 K (1300◦C). This consideration is also donebecause no pressure difference exists across the wall in thelate phase of the analyzed transient, which otherwise drivesthe 1D creep rupture model in MELCOR. The RPV failureis calculated to take place at 23:45 h after event initiation(temperature peak for segments 10 to 12 in Figure 25).

8. Discussion of Results

Several publications on SBO transients for PWR reactors canbe found in the open literature. In particular, information onthe expected timing of core uncovery and beginning of coreheatup for a German PWR reactor of type KONVOI has beenselected from PSA level 2 results of GRS [5] to be comparedwith the very specific characteristics of CNA-2 PHWR.

Table 2 shows some selected data comparing results of theLow Pressure SBO transient for CNA-2, with a German PWRtype KONVOI SBO transient considering depressurizationas a result of creep rupture failure of the surge line aftercore melting has started. In difference to CNA-2, in theGerman PWR the hot leg accumulators will inject afterdepressurization and stop the core degradation for sometime. This will happen even if the batteries are alreadydepleted. If the accumulator injection was neglected, the RPVwould probably fail up to one hour earlier.

As it can be seen, time of start core uncovery is almostone hour later for CNA-2 NPP than for the Reference PWRand mainly caused by the failure of the pressurizer SVstuck open and the nonfunctional accumulators. This can be

0

200

400

600

800

1000

1200

1400

1600

1800

2.5 7.5 12.5 17.5 22.5 27.5

Tem

pera

ture

RP

V o

ute

r si

de (

K)

Time (hr)



−2.5

Figure 25: Temperature of RPV bottom wall at outer side.

explained by two means. Firstly, the Primary System volume-to-core power ratio for CNA-2 doubles that of the referencePWR, which means that there is a larger mass of water tobe evaporated to reach complete emptiness of the primarysystem. This, combined with the very low values of CNA-2decay heat, results in a great advantage.

On the other hand, the existence of two separatedsystems, namely, the coolant and the moderator systems, hasas a consequence a very specific means of heat evacuation ofthe decay heat produced in the fuel elements. As it has beenseen in a previous section, fuel channels are nearly empty atabout 3:30 h, but water level in the moderator tank is stillat two-thirds of the total height of the tank at that time.Although upper parts of core channels start to heat up (andeventually fail), the bottom of the fuel channels is in contactwith water from the outside, which cools them mostly dueto radiation heat transfer. The existence of such a heat sinkderives in an increase of channel failure timing, which in theend derives into a later relocation to LP, and a larger timeto implement Severe Accident Management Procedures priorto RPV breach. It should be mentioned that in the GermanPWRs, Accident Management Measures are implemented todepressurize the secondary side and the reactor circuit beforethe core heats up to use all water resources, but at least theaccumulators, to gain time for other measures. More detailsare given in [5].

It is important to highlight that the correct modeling ofradiation heat transfer from the empty fuel channels to thepartially full moderator tank is of particular importance forthe PHWR and strongly influences the time at which themoderator tank empties. The comparison between RELAP5and MELCOR shows that the applied MELCOR model is ableto predict this process very well.

This behavior has also been observed on all other tran-sients calculated by MELCOR for the PSA Level 2 analysis


Table 2: CNA-2 PHWR NPP versus German PWR—timing of events in an SBO.

Plant characteristicCNA-2 PHWR low

pressure SBO MELCOR

Ref. German PWRKONVOI low pressure

SBO MELCOR

Core thermal power (MW) (total) 2160 3765

Core decay power (MW) at reactor scram 129.6 241.9

Total volume of primary system (m3) 520 415

Primary system volume to core power ratio (m3/MW) 0.241 0.110

Event listed for CNA-2 PHWR/Event listed for PWR Time (h:m) Time (h:m)

SG dryout ∼2:00 0:57

PRZ SV failure stuck open 2:31 —

Start of uncovery of core/moderator tank 3:00/3:00 ∼2:10/—

Total uncovery of core/moderator tank 3:30/9:00 ∼4:30/—

Gap release from fuel 3:56 2:22

Beginning of core channel failure (PHWR), respectivelyCore failure and debris formation (PWR)

5:16 2:35

Failure of surge line due to creep rupture followed byaccumulator injection

— 2:55

Fuel relocation to moderator tank bottom (PHWR)Molten pool formation in core (PWR)

>5:30 >4 h

Failure of moderator tank bottom (PHWR)/coresupport plate (PWR) and debris relocation to lower head

11:17 5:02

RPV failure 23:45 6:22

of CNA-2, and as well for LOCAs in the reactor circuit. Anexception is LOCAs in the piping of the moderator system,in which the moderator tank gets empty relatively fast, beingthis CNA-2 specific heat sink lost.

9. Conclusions

In the paper, a description of the results of a Station Black-Out sequence for Atucha 2 Nuclear Power Plant calculatedwith MELCOR 1.8.6 YV3165 code has been presented. Forthe described transient, loss of power was assumed as aninitiating event, accompanied by the failure of four out offour diesel generators. All remaining plant safety systemswere considered to be available. For the depressurization ofthe system, it was assumed that during the Station Black-Outsequence the pressurizer safety valve failed stuck open after17 cycles, respectively, 3 cycles of a blowdown of water.

An overview of CNA-2 NPP design characteristics waspresented, together with the description of MELCOR nodal-isation of the plant performed by GRS in the frame ofPSA Level 2 Analysis. This input deck was set according toprevious works performed by GRS for other German NPPsas well as state of the art recommendations. The qualificationwas done together with CNEA through a comparison ofresults obtained with a RELAP5 input deck used at NA-SAfor PSA Level 1.

A very detailed description of the accident sequencewas then presented, highlighting CNA-2 specific thermal-hydraulic plant behaviour as well as specific phenomena.Special attention was given to the fact that, at about 3:30 hafter the start of the transient, fuel channels get empty while

the moderator tank is still partially full. The moderator tankacts then as a heat sink to decay heat, which is evacuated byradiation heat transfer. The moderator is further evaporatedlowering its level. This feature derived from the fact thatcooling and moderator systems are separated, together with ahigh primary system volume to thermal power ratio, resultsin a very slow transient. As a consequence, calculated RPVbreach time for CNA-2 Low Pressure SBO transient is almostfour to five times larger than that of other German PWRs.

Nomenclature

CNA-2: Central Nuclear Atucha-2 (Atucha 2 NuclearPower Plant)

CNEA: Comision Nacional de Energıa AtomicaGRS: Gesellschaft fur Anlagen-und Reaktorsicherheit

(GRS) mbHKBA: Volume control system of CNA-2LOCA: Loss of coolant accidentLP: Lower plenumLWR: Light water reactorMCP: Moderator pumpsNA-SA: Nucleoelectrica Argentina Sociedad AnonimaNPP: Nuclear power plantPARs: Passive autocatalytic recombinersPHWR: Pressurized heavy water reactorPSA-L2: Probabilistic Safety Analysis—Level 2PWR: Pressurized water reactorRCS: Reactor cooling systemRPV: Reactor pressure vesselSNL: Sandia National Laboratories


SBO: Station Black-OutSG: Steam generator.

References

[1] M. Sonnenkalb and T. H. Steinrotter, “Probabilistic SafetyAnalysis (PSA) Level 2 for CNA II, CNA II—MELCOR InputDeck Description,” Tech. Rep., GRS 01/2010, 2011.

[2] J. M. Garcia et al., “CNAII MELCOR and RELAP modelscomparison,” CNEA number 41-033-10, Rev.1, 2011.

[3] R. O. Gauntt et al., “MELCOR Computer Code Manuals, Vol.1: Primer and Users’ Guide, Version 1.8.6 September 2005,”Sandia National Laboratories Albuquerque, NM 87185-0739,NUREG/CR-6119, Rev. 3, SAND 2005-5713.

[4] M. Sonnenkalb, “Summary of MELCOR Applications to Ger-man NPPs,” in Proceedings of the Cooperative Severe AccidentResearch Program/MELCOR Code Assessment Program Meeting,Albuquerque, NM, USA, 2005.

[5] “GRS mbH, Bewertung des Unfallrisikos fortschrittlicherDruckwasserreaktoren in Deutschland,” GRS-175, 2001.

TribologyAdvances in

Hindawi Publishing Corporationhttp://www.hindawi.com Volume 2014

International Journal of

AerospaceEngineeringHindawi Publishing Corporationhttp://www.hindawi.com Volume 2010

FuelsJournal of


Journal ofPetroleum Engineering


Industrial EngineeringJournal of


Power ElectronicsHindawi Publishing Corporationhttp://www.hindawi.com Volume 2014

Advances in

CombustionJournal of


Journal of


Renewable Energy

Submit your manuscripts athttp://www.hindawi.com


StructuresJournal of

International Journal of

RotatingMachinery


EnergyJournal of


Hindawi Publishing Corporation http://www.hindawi.com

Journal ofEngineeringVolume 2014

Hindawi Publishing Corporation http://www.hindawi.com Volume 2014

International Journal ofPhotoenergy


Nuclear InstallationsScience and Technology of


Solar EnergyJournal of


Wind EnergyJournal of


Nuclear EnergyInternational Journal of


High Energy PhysicsAdvances in

The Scientific World JournalHindawi Publishing Corporation http://www.hindawi.com Volume 2014

stationblack-outanalysiswithmelcor1.8.6codefor...

Documents