GS

Da

b

a

ARRA

1

msctipcfiF

niireacTwpI

0d

Nuclear Engineering and Design 239 (2009) 2093–2103

Contents lists available at ScienceDirect

Nuclear Engineering and Design

journa l homepage: www.e lsev ier .com/ locate /nucengdes

eneric CANDU 6 plant severe accident analysis employingCAPSIM/RELAP5 code

aniel Dupleaca,∗, Mirea Mladinb, Ilie Prisecarua

Power Engineering Department, University “Politehnica” of Bucharest, 313 Splaiul Independentei, 060042 Bucharest, RomaniaInstitute for Nuclear Research, Campului 1, 115400 Mioveni, Arges, Romania

r t i c l e i n f o

rticle history:eceived 8 April 2009eceived in revised form 30 April 2009ccepted 6 May 2009

a b s t r a c t

The purpose of the present study is to assess the capability of SCDAPSIM/RELAP5 to perform the deter-ministic analysis for postulated severe accidents for CANDU plant and to gain information for potentialimprovements in code modelling. SCDAPSIM/RELAP5 is a widespread and detailed computer code for

severe accident analysis that can be adapted to benchmark the CANDU dedicated tools, MAAP4–CANDUand ISAAC. Simulations of station blackout (SBO) and large loss-of-coolant accident (LOCA) scenarios,which, through further system failures, may eventually lead to severe core damage (SCD) accident ina CANDU 6, are presented. The paper provides details concerning the methodology and nodalizationused, and interprets the results obtained. Comparisons of the SCDAPSIM/RELAP5 simulations with theMAAP4–CANDU code reported results are presented. Also, some insights are given on possible reasons

een

for the discrepancies betw

. Introduction

The CANDU reactor is natural uranium fuelled, heavy wateroderated, and heavy water cooled. The CANDU 6 reactors are

ingle unit pressurized heavy water reactors (PHWR) with a grossapacity of approximately 700 MW(e). The pressure boundary inhe core consists of 380 horizontal pressure tubes, each contain-ng 12 short (0.5 m) fuel bundles. Surrounding each 0.42 cm thickressure tube is a 0.14 cm thick calandria tube (CT). Between thealandria tube and pressure tube (PT) there is an insulating gaslled gap, which reduces normal heat loss to the moderator (seeig. 1).

The heat transport system (HTS) has two identical loops con-ected to a common pressurizer in a figure eight pattern as shown

n Fig. 2. For each loop there are two core passes with coolant flow-ng in opposite directions. During normal operation the pressurizerepresents the link between the two loops. The high-pressuremergency core cooling (HPECC) system design uses gas-drivenccumulator tanks. The medium- and low-pressure emergency coreooling (ECC) stages use pumps to provide emergency core cooling.

hese pumps are first supplied with dousing water and then withater recovered from the reactor-building floor. The two heat trans-ort loops are isolated on a loss-of-coolant accident (LOCA) signal.

n addition, steam generators are rapidly cooled in order to depres-

∗ Corresponding author. Tel.: +40 21 402 9794; fax: +40 21 402 9675.E-mail addresses: danieldu@cne.pub.ro, ddupleac@yahoo.com (D. Dupleac).

029-5493/$ – see front matter © 2009 Elsevier B.V. All rights reserved.oi:10.1016/j.nucengdes.2009.05.007

the SCDAPSIM/RELAP5 and MAAP4–CANDU code predictions.© 2009 Elsevier B.V. All rights reserved.

surize the heat transport system through main steam safety valves(MSSV).

The moderator, contained in the calandria vessel (CV), is main-tained at a temperature of 70 ◦C by a separate cooling circuit. Themoderator surrounding the calandria tubes provides a potentialheat sink following a loss of cooling accident should the emergencycoolant injection fail or be impaired. The calandria vessel is in turncontained within the reactor vault (RV), which provides biologicalshielding during normal operation and maintenance. It is a largeconcrete tank filled with ordinary water. During normal operation,about 0.4% of the core’s thermal output is deposited in the RV andend shields, through heat transfer from the calandria structure andfission heating. This heat is removed via the end shield cooling sys-tem, consisting of pumps and heat exchangers. This large waterinventories surrounding the fuel can passively remove decay heatfrom the fuel for many hours after an accident, playing an importantrole in severe accident prevention and mitigation.

Although there are several developed computer codes that ana-lyze severe accidents for the light water reactors, for CANDU onlytwo codes were developed till present: MAAP4–CANDU (Blahnik etal., 1991) and ISAAC (Song, 2006). Both codes are built under theMAAP4 assumptions, started by using MAAP4/PWR as referencecode and implemented CANDU specific models. Even though these

codes have some different failure criteria for the plant componentsand MAAP4–CANDU has a much more detailed fuel channel modelthan the ISAAC code, they are similar.

SCDAPSIM/RELAP5 code (The SCDAP/RELAP5 DevelopmentTeam, 1996), designed to predict behaviour of PWR/BWR sys-

2094 D. Dupleac et al. / Nuclear Engineering and Design 239 (2009) 2093–2103

reac

tdiS

Fig. 1. CANDU

ems during normal and accident conditions, is currently underevelopment at Innovative Systems Software (ISS) as part of the

nternational SCDAP Development and Training program (SDTP).CDAPSIM/RELAP5 uses the publicly available SCDAP/RELAP5 mod-

Fig. 2. CANDU 6 heat t

tor assembly.

els developed by the US Nuclear Regulatory Commission incombination with proprietary (a) advanced programming andnumerical methods, (b) user options, and (c) models developed byISS and other members of the SDTP. The code is a combination of

ransport system.

ring a

Rse

hccaf

D. Dupleac et al. / Nuclear Enginee

ELAP5 code for thermal–hydraulics calculation, SCDAP code forevere accident related phenomena and COUPLE code for a finitelement treatment of vessel lower head.

The design peculiarities of CANDU type reactors, especially the

orizontal fuel channel and the moderator separated from theoolant, do not allow a straightforward application of the advancedore degradation models. However, the analysis of design basisccidents and the modelling of experiments in specially designedacilities can be successfully performed.

Fig. 3. Heat transport sy

nd Design 239 (2009) 2093–2103 2095

The RELAP5 stand alone code was successfully applied tothermal–hydraulic analysis of CANDU plants. Assessments of codeagainst experimental facilities RD-14 and RD-14M and comparisonwith CATHENA (Hanna, 1998) results have shown the applicability

of RELAP5 code to CANDU reactors (Lee and Kim, 2000; D’Auria,2001; IAEA, 2004; Prisecaru et al., 2005, 2006; Prosek et al., 2006;Dupleac et al., 2007).

The COUPLE code was also successfully employed for the analy-sis of the late phase of severe accident in CANDU 6 reactor, a bed of

stem nodalization.

2 ring a

dtw

a(ime

ctec

paeTMuvSb

2

otalhcann

096 D. Dupleac et al. / Nuclear Enginee

ry solid debris or a molten pool of core material already formed athe bottom of the calandria and externally cooled by reactor vaultater (Dupleac et al., 2008).

SCDAP was assessed by simulation of a large loss-of-coolantccident (LLOCA) with a coincidence of a loss of emergency coolingLOECC) (Mladin et al., 2009a) and new models were developed andmplemented in SCDAP code to improve the capabilities of code to

odel for early phase degradation in a CANDU fuel channel (Mladint al., 2009b).

The purpose of this study is to assess the SCDAPSIM/RELAP5 codeapability for analysis of severe accident in CANDU plants and ishe first attempt to simulate the entire scenario from the initiatingvent till the failure of calandria vessel using SCDAPSIM/RELAP5ode.

This paper describes the results of the analysis for a CANDU 6lant when undergoing (a) large loss-of-coolant accident and (b)station blackout (SBO) with an assumed unavailability of sev-

ral critical safety systems, which can lead to severe core damage.he consequence analysis was performed using RELAP/SCDAPSIMod3.4 (bi7) version. Comparisons of the SCDAPSIM/RELAP5 sim-

lations with reported results obtained using the MAAP4–CANDUersion 4.0.4A+ code are presented (Petoukhov and Mathew, 2006).ome insights are given on possible reasons for the discrepanciesetween SCDAPSIM/RELAP5 and MAAP4–CANDU predictions.

. Code model for CANDU 6 plant

The SCDAPSIM/RELAP5 model for CANDU 6 plant was basedn RELAP5/Mod.3.4 model already assessed for CANDU 6 reactorhermal–hydraulic analysis (Prisecaru et al., 2005, 2006; Dupleac etl., 2007). The plant model includes the representation for the twooops, fuel channels, inlet headers, feeders and end fittings, outlet

eaders, feeders and end fittings, steam generators (SG) and asso-iated reactor coolant pumps, pressurizer and the high pressurend medium emergency core cooling injection stages. The RELAP5odalization scheme for HTS is shown in Fig. 3. Fig. 4 shows theodalization scheme for the SG and main steam lines. Although

Fig. 4. Nodalization scheme for th

nd Design 239 (2009) 2093–2103

a detailed model for SG and main steam lines, for the turbine andcondenser are represented by time-dependent volumes (TDVs) andthe feed water train is modelled as time-dependent volume andtime-dependent junction.

For the LLOCA scenario, a trip valve simulates the HTS break.The double-ended guillotine break is assumed to occur at reactoroutlet header (ROH) #7 in HTS loop 2. The ROH7 is considered to bebroken in two equal parts with a discharge area equal to the cross-sectional area of the reactor outlet header. The total discharge areais 0.2594 m2.

The CANDU 6 core has 380 fuel channels arranged in 22 rowsand 22 columns. A simplified core nodalization was used to rep-resent the total number of fuel channels. For this study, only twocharacteristic channels per pass, eight in total, are considered. Thesetwo characteristic channels per pass represent the average channelslocated in the upper, respectively the lower half of the calandriavessel. This is the minimum representation required to adequatelyrepresent the fuel channels behaviour after the discharge of themoderator from the CV as moderator pressure increases when boils.

The 12 bundles in a CANDU fuel channel were modelled as 12axial nodes. In a fuel channel, the 37 fuel elements of the fuel bundle,the pressure tube and the calandria tube are modelled using SCDAPcore components (The SCDAP/RELAP5 Development Team, 1996)(Fig. 5).

In the present study, all fuel elements which belong to the samefuel bundle are considered to have the same power. The pressuretube, the CO2 filling the annular space between PT and CT, and thecalandria tube are modelled using shroud components. Details forthe pressure tube, annular space, and calandria tube model can befound in Mladin et al. (2009a).

Calandria is modelled as two parallel pipe components withthree sub-volumes having vertical orientation. Each pipe com-

ponent simulates half of the calandria volume representing themoderator surrounding fuel channels of one HTS loop. The analo-gous volumes of the two parallel pipes are connected through crossflow junctions. The four calandria pressure relief ducts are modelledas pipe components with three sub volumes having vertical orien-

e SG and main steam lines.

D. Dupleac et al. / Nuclear Engineering and Design 239 (2009) 2093–2103 2097

taic

dtas1PTi

swt

mb

Fig. 5. SCDAP model of the fuel channel.

ation. Calandria Over Pressure Rupture Disk (OPRD) is modelled astrip valve and connects calandria with containment. Containment

s modelled as a TDV with atmospheric condition. Fig. 6 shows thealandria vessel model.

Once the fuel channels collapse on the bottom of the calan-ria vessel, the debris and the calandria wall are modelled usinghe COUPLE module. The models included with COUPLE in SCDAPre capable of calculating the heat up of the debris and of theurrounding structures (The SCDAP/RELAP5 Development Team,996). A two-dimensional finite element mesh is generated by COU-LE based on the coordinates input of a selected number of nodes.he COUPLE model for the bottom of the calandria vessel is shownn Fig. 7.

The heat generated in the corium is conducted through the ves-el wall, it is eventually removed from the calandria vessel by theater in the RV surrounding the CV, and is transferred directly to

he containment by radiation.A fictitious heat slab on the top of the COUPLE debris bed is

odelled to allow for radiative heat transfer between the debrised and the upper calandria wall. The temperature of this fictitious

Fig. 6. Calandria vessel nodalization.

Fig. 7. COUPLE meshes (the numbers refer to the CV outside wall nodes).

heat slab is the same as the temperature of the top debris bed nodes.The model used for late phase of the severe accident calculation isshown in Fig. 8.

3. Analysis methodology, assumptions and failure criteria

The analysis is carried out in two steps. In the first step, theentire plant is modelled. The aim of this step is to study the CANDUplant behaviour until the core collapse occurs and to determine thetime when this occurs. In the second step, after the core collapses,the model depicted in Fig. 8 is employed. The aim of this step is tostudy the debris and calandria vessel behaviour. Also, the instanceof calandria vessel failure results from this step of analysis.

The analysis assumptions for the LLOCA and SBO scenarios arethe same as in Petoukhov and Mathew (2006). For both scenarios,the following analysis assumptions were made:

- Reactor shutdown is initiated immediately after accident initia-tion.

- Moderator cooling and shield cooling are assumed unavailable(pumps and heat exchangers are not credited).

- Shutdown cooling system is unavailable.- Main and auxiliary feed water are assumed unavailable.- Steam generator main steam safety valves (MSSVs) are available.- Turbine main stop valves are closed after accident initiation.- No operator interventions are credited.

For the station blackout scenario, the additional analysisassumptions are:

- Class IV power and all onsite standby and emergency electricpower supplies are unavailable.

- Emergency core cooling system (including high-, medium- andlow-pressure injection) is unavailable.

- HTS loop isolation is not credited.- Steam generator safety valves are available, they open and close

at the set point to relieve pressure.- Crash cool-down system is not credited.- Air-operated atmosphere steam discharge valves are fail-closed

and are not considered in the case of SBO.- Pressurizer steam bleed valves are considered unavailable in the

SBO case. They are fail-closed.

- Moderator cover gas system bleed valves (connecting the CV and

vapour recovery system) are assumed available.

For the large LOCA scenario, the following additional assump-tions were made:

2098 D. Dupleac et al. / Nuclear Engineering and Design 239 (2009) 2093–2103

vere a

----

tfffp

3

biaofiatoctp

3

sM“t(ottarm

Fig. 8. Late phase of the se

ECCS high-pressure and medium-pressure injection are available.ECCS low-pressure injection is unavailable.HTS loop isolation is credited.Crash cool-down system is available.

In addition to the analysis assumptions and models employed,he results of the analysis will strongly depend on the failure criteriaor components such as fuel channel, calandria vessel, etc. The sameailure criteria as in Petoukhov and Mathew (2006) were adoptedor this study. A brief description of the failure criteria used in theresent analysis is given below.

.1. Fuel channel failure criteria

Fuel channel failure is defined as a perforation in its pressureoundaries followed by mass transfer between the environment

nside the PT and the CV, which means that both the PT and CTre perforated. The mechanism for fuel channel failure dependsn the level of pressure in the HTS. The channel is assumed toail under high pressures and temperatures when the balloon-ng criterion is satisfied, based on the experimental results forn isothermal PT (Mochizuki et al., 1993). At low HTS pressures,he fuel channels may fail due to local melt-through or saggingf the pressure and calandria tubes. In the present study the fuelhannel is considered to fail if the average calandria tube tempera-ure becomes greater than 900 K at high pressure or 1800 K at lowressure.

.2. Fuel channel disassembly criteria

Disassembly is a process during which fuel and channeltructural materials are separated from the original channel. InAAP4–CANDU code the disassembled channels relocate into

holding bins”, which are artificial bins that are constructed to keeprack of disassembled core parts until they are released into the CVPetoukhov and Mathew, 2006). These artificial bins allow somef the fuel channel debris (suspended debris) to be supported by

he colder fuel channels immersed in the moderator below prioro the core collapse criteria listed below is satisfied. In our analysis,lthough disassembled core parts are tracked, the suspended debrisemains in their initial locations until the core collapse criteria iset. In the present study, an axial segment of the fuel channel is

ccident calculation model.

deemed to be disassembled if and when the average temperatureof CT walls reaches 1500 K.

3.3. Core collapse criteria

When the load bearing capacity is exceeded by a large amountof debris lodged on top of the supporting channels, these fuel chan-nels collapse. Under those conditions the supporting channels areexpected to pull out from the rolled joints. The suspended debrisbed mass per HTS loop, which will trigger channel pullout from therolled joints, was estimated from the accumulated channels massrequired to exceed the peak stress at the CT rolled joint (Petoukhovand Mathew, 2006). A value of 25,000 kg per one HTS loop wasused in the current analysis, the same value as in MAAP4–CANDUcalculations (Petoukhov and Mathew, 2006).

3.4. Calandria vessel failure criteria

The SCDAPSIM/RELAP5 criterion used to determine the con-ditions at which the CV fails is the failure by creep based onLarson–Miller or Manson–Haferd parametric models, dependingon the material and stress. Time to rupture is a function of aver-age wall temperature and stress. Stress is calculated with inner andouter radiuses and pressures, for cylindrical structures.

4. Results and discussion

The results and discussion, for the consequence analysis usingSCDAPSIM/RELAP5 for two postulated scenarios in a CANDU 6 sta-tion – large LOCA and station blackout – are presented below inSections 4.1 and 4.2 for each of the two scenarios. The key inputparameters used in this study are presented in Table 1.

4.1. Large LOCA scenario

In the present analysis, we consider a large LOCA scenario ini-tiated by a guillotine rupture of the ROH in HTS loop 2, followed

by a double-sided blow-down of the HTS coolant. Table 2 lists thesequence of significant events observed during this simulation. Abrief description of the major phenomena and the processes relatedto the plant response for the large LOCA scenario are presentedbelow.

D. Dupleac et al. / Nuclear Engineering and Design 239 (2009) 2093–2103 2099

Table 1Key input parameters for CANDU 6 plant (Petoukhov and Mathew, 2006).

Thermal reactor power (MW) 2,064ROH pressure (MPa) 10.0SG secondary side pressure (MPa) 4.78Reactor inlet header coolant temperature (K) 539ROH coolant temperature (K) 583Moderator temperature in calandria vessel (K) 342Water temperature in RV (K) 324.5Uranium dioxide mass in the core (kg) 98,815Zircaloy mass in the core (including pressure and

calandria tubes) (kg)38,647

D2O inventory in HTS (without pressurizer) (kg) 93,200D2O inventory in pressurizer (m3) 37.7D2O inventory in calandria vessel (kg) 227,000H2O inventory in RV (kg) 465,324H2O inventory in each SG secondary side (kg) 38,000

Table 2Time sequence of significant events for large LOCA scenario (s).

Event MAAP4–CANDU RELAP5/SCDAPSIM

ROH guillotine rupture 0.0 0.0LOCA signal 6 7HPECC initiation 6 14HPECC terminated and MPECC

initiation98 229

MPECC terminated 1,100 1,170Steam generator is dry (intact loop) 2,614 3,320 and 3,584Fuel bundles are uncovered inside

fuel channels2,860 1,954

Steam generator is dry (broken loop) 14,386 Not dryAt least one channel is dry 17,940 2,482CV water pool is saturated 19,826 5,990Fuel bundles are uncovered inside

fuel channels in intact loop22,060 7,620

At least one channel is dry in intactloop

25,180 8,500

CV rupture disk is open 26,236 7,100PT and CT rupture, intact loop 35,066 8,900Beginning of the core disassembly 36,381 10,969CWC

orftttlE

ore collapse onto the CV bottom 50,781 12,485ater is depleted inside CV 68,068 21,540

V bottom wall failed due to creep 199,308 149,410

Fig. 9 shows the pressure in the two HTS loops: pass 2 reactorutlet header, ROH3, and pass 4 reactor outlet header, ROH7. As aesult of the break in the ROH 7, the HTS pressure in loop 2 decreasesaster than in loop 1. When the pressure in loop 2 reaches 5.5 MPa,he HTS loop isolation valves are closed. ECCS high-pressure injec-

ion (HPI) into loop 2 starts when its pressure reaches 4.14 MPa, anderminates at about 229 s. Since the loop 1 pressure is greater thanoop 2 and is initially higher than the HPI ECCS pressure, water fromCCS HPI goes only into loop 2. After ECCS injection terminates, the

Fig. 9. Pressure in the two HTS loops: LLOCA case.

Fig. 10. Steam generators water level: LLOCA case.

pressure in the intact loop (loop 1) increases as a result of core decayheat, and because of the unavailability of the auxiliary feed waterand shutdown cooling systems. The pressure in loop 1 reaches aconstant value of about 10 MPa and oscillates as a result of the peri-odical opening and closing of the LRVs. The pressure in loop 1 thendrops rapidly at about 8900 s, due to fuel channel failure in loop 1.

The channel rupture is caused by ballooning at high tempera-ture and high pressure when the temperature of the pressure andcalandria tubes in intact loop rises to 900 K. After channels rupturein loop 1 occur, a direct path between loop 1 and calandria vesselis established.

When the pressure difference between the ECC medium pres-sure injection (MPI) water source (dousing tank) and the HTSreaches the set point of 114 kPa, MPI starts at about 229 s and wateris pumped only into the broken HTS loop. MPI continues until 1170 s,when water in the dousing tank is no longer available.

The SG main steam safety valves (MSSVs) are opened, 30 s afterreceiving the LOCA signal, to initiate crash cool-down at about 37 s,which decreases the pressure in the secondary side of the steamgenerators. As a result of the blow-down through the open MSSVsand the boil-off of water from the secondary side of the steam gen-erators, the water level in all four-steam generators decreases. Thesteam generators located in the intact loop is the major heat sinkfor this loop. As the heat generated in the corresponding fuel chan-nels is transferred through the secondary side of SGs, they dry outby about 3320 s and 3584 s, respectively (Table 2 and Fig. 10). Inthe broken loop, initially the main heat sink is the break itself. Asthe loop pressure decreases near the containment pressure and theflow rate through the break becomes small, the moderator becomesthe major heat sink for the broken loop. Since the flow rate throughthe fuel channels of the broken loop is very small, the heat gener-ated in these fuel channels is rather transferred to moderator viapressure tubes and calandria tubes than transported to the steamgenerators. Thus, the behaviour of the SGs of the broken loop is dif-ferent than those of SG of the intact loop. Consequently, after animportant decrease of the water level in the SGs of broken loop, thewater level remains nearly constant during the entire period of thesimulation in these steam generators.

Because of the HTS inventory loss, fuel channels dry out andfuel heats up. The moderator temperature and pressure in calandriavessel increase because of the loss of moderator cooling and theheat transfer from the core. Pressure inside the calandria vesselreaches the set point of the rupture disk, 238 kPa, and the CV rupturedisks open at 7100 s (see Table 2). This phenomenon is associated

with a rapid decrease in the calandria vessel water level, as shown inFig. 11. After the initial sudden moderator expulsion, the moderatorcontinues to discharge gradually into the containment as a resultof continued moderator boil off due to the heat transfer from thecore.

2100 D. Dupleac et al. / Nuclear Engineering and Design 239 (2009) 2093–2103

bdaMiwvitd

wd

dtcsRf

4

inawgp

Fl

Fig. 13. Pressure in the two HTS loops: SBO case.

Fig. 11. Calandria vessel water level: LLOCA case.

Therefore, the fuel, PT and CT temperature increase is assistedy a moderator level decrease in the CV. When the fuel channelisassembly criteria are satisfied, the number of channel sectionsre accounted for, but the channels remain in place, contrary toAAP4–CANDU where these channels are relocated into the “hold-

ng bins”. When the accumulated mass of the channel sectionshich satisfy the fuel channel disassembly criteria exceeds the

alue of 25,000 kg/per loop, the disassembled channels and thentact channels relocate into the CV bottom at about 12,485 s. Theemperature of fuel clad, pressure tube and calandria tube for bun-le 7 located in top channel of pass 4 are shown in Fig. 12.

The debris relocated into the CV bottom is quenched by theater remaining in the CV at this time. The calandria vessel water isepleted at about 21,540 s (Fig. 11) as a result of moderator boil-off.

After the moderator inside the calandria vessel is depleted, theebris relocated into the CV bottom heats up rapidly. Water inhe RV acts as a heat sink and cools the CV wall maintaining thealandria vessel integrity. Eventually, water in the RV reaches theaturation temperature and boils-off. When the water level in theV falls to the CV bottom level, the CV bottom heats up rapidly and

ails due to creep at about 149,410 s.

.2. Station blackout scenario

Table 3 lists the sequence of significant events observed dur-ng the SBO scenario simulation. As HTS loop isolation valves are

ot closed, both loops in this case show similar pressure behaviours shown in Fig. 13. Initially the pressure in both loops decreasesith time as the heat extracted from the coolant at SGs location is

reater than the heat input to the coolant due to the loss of fissionower from the reactor core. The heat transfer from the HTS to the

ig. 12. Temperature of fuel clad, pressure tube and calandria tube for bundle 7ocated in top channel of pass 4: LLOCA case.

Fig. 14. Steam generators secondary side pressure: SBO case.

steam generators causes the water boil-off in the steam generatorsecondary side and the increase of the pressure in the secondaryside of the steam generators. When the steam generator secondarypressure reaches the set point for the opening of MSSVs, the steamis discharged from the secondary side to the environment out-side the containment. The secondary side steam generator pressurethen oscillates at the MSSV set point as the MSSVs open and close(Fig. 14). The water level in the steam generators decreases as a

result of boil-off (Fig. 15).

Initially, the core decay heat is transported by coolant to SGby natural circulation. When the SG secondary side inventory isdepleted at ∼8872 s, the SG dry out and are no longer a heat

Fig. 15. Steam generators water level: SBO case.

D. Dupleac et al. / Nuclear Engineering and Design 239 (2009) 2093–2103 2101

Table 3Time sequence of significant events for station blackout scenario (s).

Event MAAP4–CANDU RELAP5/SCDAPSIM

Class IV and Class III Power loss 0 0Reactor shutdown 0 0First opening of MSSV 22 10SG secondary side is dry 8,864 8,872 (loop 2), 8,886 (loop 1)LRVs first opening 9,128 9,628At least one channel is dry (complete boil-off) 15,617 12,680 (loop 2), 13,110 (loop 1)Pressure and calandria tubes are ruptured 15,871 13,062 (pass 1), 13,680 (pass 2), 13,870 (pass 3), 13,280 (pass 4)Calandria vessel rupture disk 1 is open 15,892 13,070Moderator in calandria vessel reaches saturation temperature 15,934 13,100Beginning of the core disassembly 17,315 21,104Core debris collapse onto the CV bottom 22,722 22,249All the core collapsed onto the CV bottom 29,686 22,383Water is depleted inside calandria vessel 31,989 33,805Calandria vessel failed due to creep 152,749 154,010

s(i1(

cscraHsa

continued moderator boil-off due to the heat transfer from the core.

Fig. 16. Pass 4 fuel channel flow rate: SBO case.

ink to remove heat and the natural circulation on HTS is ceasedFigs. 16 and 17). Following this moment, the pressure in the HTSncreases until it reaches the HTS liquid relief valve set point,0.16 MPa (a), and then oscillates at the relief valve set pointFig. 13).

Continuous loss of inventory through the LRVs results in fuelhannel dry-out and subsequent heat-up of the calandria and pres-ure tubes at the HTS pressure of 10.16 MPa (a). When averagealandria tube wall temperature reaches 900 K, the fuel channeluptures at ∼13,062 s (Table 3). The rupture of fuel channels causes

rapid blow-down from the HTS into the calandria vessel and theTS pressure to drop drastically at this moment (Figure 13). The

ame assumption as in MAAP4–CANDU for the blow-down flowrea is used: the blow-down flow area is equivalent to the flow

Fig. 17. Pass 2 fuel channel flow rate: SBO case.

Fig. 18. Calandria vessel water level: SBO case.

area of a single fuel channel and the blow-down is from both endsof the ruptured fuel channel (Petoukhov and Mathew, 2006).

When HTS inventory is discharged into CV due to the PT and CTrupture, the pressure inside the calandria vessel increases rapidlyand reaches the set point of the rupture disk, 238 kPa (a), and theCV rupture disks open at ∼13,070 s. This phenomenon is associatedwith a rapid decrease in the calandria vessel water level (Fig. 18).After the initial rapid moderator expulsion, the moderator con-tinues to discharge gradually into the containment as a result of

After initial rapid moderator expulsion about half of the fuelchannels located on the upper side of CV becomes uncovered. Con-sequently, fuel, PT and CT temperatures increase rapidly. When

Fig. 19. Temperature of fuel clad, pressure tube and calandria tube for bundle 7located in top channel of pass 4: SBO case.

2 ring and Design 239 (2009) 2093–2103

tmsHr

dvWlb

4r

ctaao

--

s

SFte

ctHatia1

tdtftd(ceb

dpSbtalc

bwbt

ture (core disassembly) and core debris relocation on the calandriavessel bottom. Also, the experimental data available for CANDUreactors in these areas are much fewer than the ones for the PWRsystem.

102 D. Dupleac et al. / Nuclear Enginee

he pressure and calandria tubes reach disassembly conditions, theass of accumulated suspended debris beds is traced. Once the

uspended debris bed mass in the core exceeds 25,000 kg per oneTS, the core material in the suspended bed and the intact channels

elocates to the bottom of the calandria vessel at ∼22,249 s (Fig. 19).As a result of the core collapse, the moderator inside the calan-

ria vessel is depleted at ∼33,805 s (Fig. 18). The water in the reactorault acts as a heat sink to cool the external calandria vessel wall.hen the water level in the reactor vault decreases below the debris

evel, the calandria vessel bottom starts to heat up rapidly. The CVottom fails due to creep at ∼154,010 s.

.3. Comparison of SCDAPSIM/RELAP5 and MAAP4–CANDUesults

Results presented in Table 2 and Table 3 show quite signifi-ant differences on the timing of the most significant events forhe Large LOCA sequence computed by the SCDAPSIM/RELAP5nd MAAP4–CANDU codes, whereas for SBO sequence the resultsre similar. Major sources of disagreement between the resultsbtained using these codes are explained by following reasons:

Differences in HTS nodalization;Differences in the models employed in two codes.

Both types of differences are more important for the fast tran-ients (i.e. LLOCA) than for the slow transients (i.e. SBO).

Regarding the differences in HTS nodalization, the SCDAP-IM/RELAP5 model uses a detailed PHT nodalization as shown inig. 3, whereas the MAAP4–CANDU code uses a coarse nodaliza-ion, employing only fourteen nodes in each HTS loop (Petoukhovt al., 2006).

Concerning the differences in models used, MAAP4–CANDUode has a simple HTS thermal hydraulic model. For example,he coolant pressure is the same in all nodes within the sameTS loop. An important difference between the two codes is thebsence of the momentum balance equation in MAAP4–CANDU forhermal–hydraulics calculations. Actually, the core flow is assumedn MAAP4–CANDU calculation by imposing a pressure differencecross the fuel channel as user input parameter (Blahnik et al.,991).

During large LOCA in CANDU plants, the flow behaviour throughhe core is very complex and it is practically impossible to be pre-icted without detailed calculation. The different flow rates throughhe core prediction by the two codes are highlighted by the dif-erent behaviours of the steam generators in the simulation withhe two codes. For the intact loop, the time of SGs dry out pre-icted by SCDAPSIM/RELAP5 and MAAP4–CANDU is relatively close3320 s for SCDAPSIM/RELAP5 and 2614 s for MAAP4–CANDU). Theoolant flow in the intact loop after the pumps shutdown is gov-rned by natural circulation. In this case the flow rate can accuratelye computed analytically.

On the contrary, for the broken loop, the SGs behaviours pre-icted by the two codes are very different. The MAAP4–CANDUredicts the SGs dry out at about 14,386 s, whereas the SCDAP-IM/RELAP5 does not predict the SGs dry out. These differentehaviours arise since the SCDAPSIM/RELAP5 calculates the stagna-ion of flow through the core (Fig. 20), whereas the MAAP4–CANDUssumes a flow rate through the core. Furthermore, for the intactoop SCDAPSIM/RELAP5 predicts flows in opposite directions forhannels of the same pass (Fig. 21).

Thus, in MAAP4–CANDU calculation, the heat generated in theroken loop fuel channels is transported to the steam generators,hereas in SCDAPSIM/RELAP5 calculation the heat generated in the

roken loop fuel channels is not transported to the steam genera-ors. Instead, this heat is transferred to the moderator.

Fig. 20. Pass 4 fuel channel flow rate: LLOCA case.

The SCDAPSIM/RELAP5 predicts a faster time for the moment atwhich the fuel channel is dry. The SCDAPSIM/RELAP5 prediction is2482 s for the broken loop and 8500 s for the intact loop, whereasthe MAAP4–CANDU prediction is 17,940 s and 25,180 s, respectively.Comparison of MAAP4–CANDU with CATHENA code, which is thecomputer code used for CANDU safety analysis, shows the tendencyof MAAP4–CANDU code to predict the dry out of the fuel channelsignificantly delayed than CATHENA (Brown et al., 2005). Contrary,SCDAPSIM/RELAP5 prediction is accurate compared to CATHENA(Dupleac et al., 2007).

SCDAPSIM/RELAP5 calculates a significant amount of heat trans-ferred to the moderator in the early phase of the accident, contraryto the MAAP4–CANDU calculation. Consequently, the moderatorreaches the saturation temperature, starts to boil and reaches therupture disk set point more quickly in SCDAPSIM/RELAP5 calcula-tion. The earlier CV rupture disk opening is the key factor of themuch shorter time calculated by SCDAPSIM/RELAP5 until calan-dria vessel failure. After this moment, the moderator level dropsdrastically, as shown in Fig. 11, uncovering about half of the core.

For SBO scenario, until the loss of SGs as heat sink due tosecondary side water depletion, the natural circulation flow ratethrough the HTS can be analytically calculated. Consequently, in thiscase the thermal hydraulic behaviour of HTS is similarly predictedby the two codes, resulting in comparable timing of the accidentcalculated by SCDAPSIM/RELAP5 and MAAP4–CANDU codes.

Generally, severe accident analyses are associated with a highdegree of uncertainty. In addition, for CANDU reactors, there is stilla lack of mechanistic models for the degradation of the core struc-

Fig. 21. Pass 2 fuel channel flow rate: LLOCA case.

ring a

mieMtdiuspc

5

oseCo

s

2

3

4

siraobbiaaTa

Song, Y., 2006. An introduction of developing history of ISAAC code for PHWR severe

D. Dupleac et al. / Nuclear Enginee

Within the SCDAPSIM/RELAP5 code, the modelling of theechanical and thermal processes of the uncovered fuel channels

s not achieved yet. Therefore, a simplified approach is consid-red, with same engineering based disassembly criteria as in theAAP4–CANDU code. Such an approach may differ from a realis-

ic evolution of the temperature and material composition of theegraded core that eventually dries-up and interacts with the wall

nto the calandria vessel bottom, possibly inducing accident timingncertainties. In the absence of representative integral experimentsimulating severe accidents in CANDU type reactors, whether sim-le or detailed, the course of the degradation process remainsonceptual only.

. Conclusions

A SCDAPSIM/RELAP5 model of CANDU 6 was constructed inrder to perform analysis of a postulated large loss-of-coolant andtation blackout accident with an assumed unavailability of sev-ral critical safety systems, which can lead to severe core damage.alculated results are compared in the paper with reported resultsbtained using the MAAP4–CANDU code for similar scenarios.

The general conclusions from the study can be synthetically pre-ented as follows:

1. The results obtained in this study demonstrate the SCDAP-SIM/RELAP5 code capability for analysis of severe accident inCANDU plants. The current core components available in SCDAP,fuel rod and shroud components, can adequately model theCANDU fuel channels behaviour during severe accidents whencompared to MAAP4–CANDU results.

. The COUPLE was used as a separate module, because no inputfrom the core degradation is possible for a CANDU severe acci-dent with the code standard version.

. A comparison of the results produced for two CANDU6 severe accident scenarios using SCDAPSIM/RELAP5 andMAAP4–CANDU shows a noticeable difference in the timing ofthe major events for the large LOCA, whereas the timing for theSBO is similar. The main reason for this discrepancy is the dif-ferent thermal–hydraulic model and nodalization employed tosimulate the HTS.

. The detailed HTS thermal–hydraulic models made the SCDAP-SIM/RELAP5 code appropriate for development and verificationof severe accident management programs.

The experience gained in running these severe accidentequences will allow us to focus on the area where possiblemprovements of SCDAP models are needed. The improvements areelated to: the modification on shroud component for taking intoccount the oxidation of the outer surface that could model thexidation of the calandria tube exposed to steam during moderatoroil-off, the modelling of the mechanical and thermal interactionetween rows of fuel channels that are progressively uncover-

ng and a detailed core degradation process model. Advances inny of these directions will lead to an important step towardsmechanistic model for core disassembly in a CANDU reactor.

he early phase models are basically existent in the SCDAP codend improvements are already done in this area (Mladin et al.,

nd Design 239 (2009) 2093–2103 2103

2009b). Also, the late phase models included with COUPLE cantreat the behaviour of the terminal debris bed on the bottom ofthe calandria vessel. Therefore, the main task of the SCDAP adap-tations for CANDUs relates to the modelling of core disassemblyphenomena.

Acknowledgement

The authors acknowledge the support of the Romanian Ministryof Education and Research under the Project No. 71-096.

References

Blahnik, C., Kim, C.S., Nijhawan, S., Thuraisingham, R., 1991. Modular accident analy-sis program for CANDU reactors. Proceedings of the 12th Annual CNS Conference,June 9–12, Saskatoon, Canada.

Brown, M.J., Petoukhov, S.M., Mathew, P.M., 2005. Influence of coolant phase separa-tion on event timing during a severe core damage accident in a generic CANDU6 plant. Workshop on evaluation of uncertainties in relation to severe acci-dents and level 2 probabilistic safety analysis, Aix-en-Provence (France), 7–9November.

D’Auria, F., 2001. The role of experimental database in the validation ofthermal–hydraulic system codes. In: Proceedings of FLUIDOS-2001, VII Inter-national Seminar on Recent Advances in Fluid Mechanics, Physics of Fluids andAssociated Complex Systems, 17–19 October, Buenos Aires, Argentina.

Dupleac, D., Prisecaru, I., Ghitescu, P., Negut, G., 2007. Thermal–hydraulic analysis ofCANDU 6 100% reactor outlet header break using RELAP5 code. In: Proceedingsof ICAPP’ 07 Nice, May 13–18, France.

Dupleac, D., Prisecaru, I., Mladin, M., Negut, G., 2008. SCDAP/RELAP5 investigationon coolability of severely degraded CANDU 6 core—preliminary results. In: Pro-ceedings of ICAPP ‘08, Anaheim, CA, USA.

Hanna, B.N., 1998. CATHENA: a thermal–hydraulic code for CANDU analysis. Nucl.Eng. Des. 180 (March (2)), 113–131.

International Atomic Energy Agency, 2004. Intercomparison and Validation of Com-puter Codes for Thermalhydraulic Safety Analysis of Heavy Water Reactors.IAEA-TECDOC-1395, Vienna.

Lee, S., Kim, I.G., 2000. RELAP5 simulation of thermal–hydraulic behavior in a CANDUreactor assessment of RD-14 experiments. J. Nucl. Technol. 130, 18–26.

Mladin, M., Dupleac, D., Prisecaru, I., 2009a. SCDAP/RELAP5 application to CANDU6fuel channel analysis under postulated LLOCA/LOECC conditions. Nucl. Eng. Des.239 (February (2)), 353–364.

Mladin, M., Dupleac, D., Prisecaru, I., 2009b. Modifications in SCDAP code for earlyphase degradation in a CANDU fuel channel. Ann. Nucl. Energy 36 (5), 634–640.

Mochizuki, H., Koike, M.H., Sakai, T., 1993. Core coolability of an ATR by heavywater moderator in situations beyond design basis accidents. Nucl. Eng. Des.144, 293–303.

Petoukhov, S.M., Mathew, P.M., 2006. Status of MAAP4-CANDU code envelopmentand simulation of severe core damage accidents for a generic CANDU 6 plant.Technical Meeting on Severe Accident and Accident Management ToranomonPastoral, Minato-ku, Tokyo, Japan, March 14–16.

Petoukhov, S.M., Awadh, B., Mathew, P.M., 2006. CANDU 6 severe core damage acci-dent consequence analysis for steam generator tube rupture scenario usingMAAP4-CANDU V4.0.5A: preliminary results. In: Proceedings of ICAPP ‘06, June4–8, Reno, USA.

Prisecaru, I., Dupleac, D., Biro, L., 2005. A study of RELAP5 capability to performthe analysis of CANDU 6 reactors accidents. In: The 11th International TopicalMeeting on Nuclear Reactor Thermal–Hydraulics (NURETH-11), October 2–6,Avignon, France.

Prisecaru, I., Dupleac, D., Ghitescu, P., Biro, L., 2006. A parametric study of a largebreak in reactor inlet header of CANDU6 reactors using RELAP5 code. In: Pro-ceedings of ICAPP ‘06 Reno, June 4–8, NV, USA.

Prosek, A., D’Auria, F., Richards, D.J., Mavko, B., 2006. Quantitative assessment ofthermal–hydraulic codes used for heavy water reactor calculations. Nucl. Eng.Des. 236 (February (3)), 295–308.

accident analysis in Korea. In: 15th Pacific Basin Nuclear Conference, 15–20October, Sydney, Australia.

The SCDAP/RELAP5 Development Team, 1996. SCDAP/RELAP5/MOD3.2 CodeManual. Volume II: Damage Progression Model Theory, NUREG/CR-6150 INEL-96/0422, Revision 1, October.