Evaluation of Passive Safety Injection System Performance Under Large Break LOCA for Qinshan PWR

In this work, a brand new passive safety injection system has been designed for the ocean-based Qinshan Phase I nuclear power plant to update and replace the traditional active ones. The passive safety injection system is made up of high pressure, medium pressure, lower pressure safety injection system, and a two-stage automatic depressurization system. To evaluate the safety injection system performance, double-ended cold leg large break LOCA has been analyzed by best-estimated safety analysis RELAP5 code. The main operation and safety parameters such as primary system pressure, safe injection mass flow rates, core water level, and peak cladding temperature have been presented. The results conclude that the safety injection system can act as similar to that of the AP1000, which can assure sufficient core cooling and keep the reactor covered by the cold water under the most severe LBLOCA condition.


INTRODUCTION
Nuclear safety raises more public concern especially after the Fukushima nuclear disaster in 2011, which becomes the top priority of nuclear power (Shropshire et al., 2012). One potential solution is the Offshore Nuclear Power Plant (ONPP) concept which moves the traditional land-based nuclear power to marine-type to take advantage of the ultimate cooling source, seawater (Hirose, 2012;Lee et al., 2015). Another wide-used solution is applying passive safety systems.
One potential roadmap is to configure the existing Qinshan Phase One PWR into a compact size and place it in a gravity-based structure (GBS) (Gerwick, 2002). In a previous GBS ONNP study, researchers from Korea Advanced Institute of Science and Technology (KAIST) made a new concept design that moves traditional large loop-type PWR APR1400 and small integral PWR SMART onto the GBS platform (Lee et al., 2013;Kim et al., 2014). The GBS configuration has no ocean motion like heaving and inclination when comparing to floating nuclear power plants, and the ocean can be the ultimate heat sink.
Currently, the passive core cooling system (PCCS) has been populated to be applied in the new ONNP design, which includes the passive safety injection system (PSIS). In previous studies, lots of investigation has been done to evaluate PSIS performance under LOCA. In Farzad Rahim's study, a large LOCA of double-ended cold leg break has been modeled in the AP1000 reactor. The modeling software applied is MATLAB, and the results are compared with the AP1000 safety analysis reports to conclude AP1000s passivity can guarantee a large variety of safety margins (Rahim et al., 2012). C. Queral applied best-estimate plus uncertainty analysis to obtain more realistic results and larger safety margins using revised TRACE and DAKOTA code. The results show that AP1000 can mitigate effectively the occurrence of a postulate LBLOCA and meet the peak cladding temperature acceptance criteria (Queral et al., 2015). In Riichiro Okawa's research, the TRACE code has been modified to give a more precise estimation of the cladding temperature behavior, a double-ended cold leg large break LOCA in the loss of fluid test was simulated. The analytical results showed good agreement with the experimental data (Okawa and Furuya, 2019). A.K. Trivedi developed a representative RELAP5 model for AP1000 double-ended cold leg break, the calculated results have been compared to the design control document. The analysis confirms that LBLOCA in AP1000 can be successfully modeled using RELAP5/MOD3.5 and that the model can be used for additional severe accident studies such as an SBO using the SCDAP fuel rod component (Trivedi et al., 2016).
In this paper, a newly-designed PSIS for GBS-type Qinshan nuclear power plant has been proposed. To evaluate the system function and performance, double-ended cold leg large break LOCA has been investigated.

QINSHAN PASSIVE SAFETY SYSTEM DESIGN Main Parameters of Qinshan Nuclear Power Plant
Qinshan Phase One nuclear power plant has been safely operated in China mainland for more than twenty years (Wang, 2009), the main system parameters could be found in previous work (Yu Ouyang, 2000).

Passive Safety Injection System Design
The passive safety injection system is shown in Figure 1. It consists of two core make-up tanks (CMT), two accumulators (ACC), a high-elevation tank (HET), and corresponding pipes, valves, and instruments (Sun et al., 2020). To ensure that the primary system pressure can be successfully reduced to the pressure setpoint of the passive safety injection system under accident conditions, an automatic depressurization system has been designed. The opening of the ADS valves under different pressure levels can relieve the primary system pressure to ensure a successful safe injection.
The cold water source of the passive safety injection system comes from two CMTs, two ACCs, and the HET. The safety injection flow of ACC is very large, which can flood the core within a few minutes. While the safety injection flow of CMT is much smaller than that of ACC but the duration is longer. Lastly, the safety injection time of the HET is the longest, and the safety injection flow is the smallest. The above-mentioned safety injection all adopt passive operation mode without any external power.
The high-pressure safety injection system consists of two CMTs and corresponding pipes and valves. The CMTs are located in the containment at a position slightly higher than primary system pipes. The CMTs are filled with boron water whose temperature is the same as the containment temperature. The CMT outlet pipe is connected to the reactor pressure vessel through a direct vessel injection pipeline. The DVI pipes are connected to the downcomer of the reactor pressure vessel.
The function of the medium pressure safety injection system is realized by two ACCs and the corresponding pipes and valves. The ACCs are filled with water and pressurized nitrogen in the upper part. When the pressure drops below that of the pressurized nitrogen, the medium-pressure safety injection system will trigger to provide cold water injection.
The low-pressure safety injection system is made up of the HET and the corresponding pipes and valve. The safety injection is relied on gravity to submerge the core. The 16% upper part is filled with 0.2 MPa nitrogen, and the temperature is the same as that of the containment.
The ADS is made up of two stages. The ADS will be triggered by CMT water level and RCS pressure setpoints, and the valve will keep open after actuation.

RELAP5 MODEL OF THE PASSIVE SAFETY INJECTION SYSTEM
The primary system and revised design of PSIS are modeled by RELAP5. The RELAP5 code nodalization scheme is shown in Figure 2.
The control volumes 314 and 414 pipes simulate the CMTs, the accumulator components 300 and 400 simulate the ACC, and the control volume 500 pipe simulates the HET. The valve components 611, 613, 711, and 713 simulate ADS-1 pressurerelief valves; and the valve components 741, 743, 745, and 747 simulate ADS-2 pressure-relief valves. The ADS configuration is shown in Figure 3.
Among the large-break LOCA, the double-ended cold leg break is the most severe one. The RELAP5 nodalization is shown in Figure 4.

SIMULATION AND ANALYSIS
Large Break LOCA Accident Sequence Generally, the sequence of a PWR large break LOCA can be divided into four periods: high-pressure blowdown, refilling, reflood, and long-term cooling. In the blowdown period, there will be a rapid discharge of coolant at the break location until the critical flow rate is reached. During this period, the coolant flow rate will drop, even backflow may occur. Therefore, the first peak cladding temperature (PCT) will occur during this period. Subsequently, due to the redistribution of the residual heat, the temperature of the fuel cladding surface will be more evenly distributed. However, the vapor-liquid two-phase flow in the core is still insufficient to transfer the heat, and the cladding temperature will rise which causes the second PCT to appear. In the third stage, the core will be reflooded again, and the nitrogen pressure in the ACCs will compress the injection into the core. During the long-term cooling period, the system pressure continues to drop until it equals that of the reactor hull. Then cooling water will inject continuously injected from the HET into the reactor vessel.
Compared with the abovementioned four periods of the large-break LOCA, the passive safety injection system performance will be different. After the accident, the safety protection signal will be triggered. After 5s, the main coolant pump will shut down, and the main feedwater isolation valve will be quickly closed to isolate the feedwater. The blowdown will continue until the RCS pressure drops to reactor hull pressure.  When the safety protection signal is triggered, the CMTs' pipeline will open to inject immediately which means the highpressure injection period begins. The density difference between hot and cold coolant in CMTs will provide the natural circulation driven-force of the injection. Later on, after vapor enters the CMTs, the density difference between the high-temperature vapor and liquid provides the driven force.
The isolation valve on the ACC outlet pipeline is normally open so that once the primary system pressure is lower than the setpoint (4.8 MPa), the cooling water from the ACCs will inject through the check valve immediately. The temperature of the injection water in the ACCs is about the same as that of the reactor hull. The height of the ACCs location will also provide a certain driven force. When the primary system pressure drops to 0.2 MPa, the isolation valve on the low-pressure safety injection pipeline will open. Meanwhile, the cooling water from the HET will inject directly into the reactor core. Since the HET locates at a high elevation in the reactor, the cooling water in the tank can be injected by gravity after the RCS is depressurized.
The design of the ADS enables the high, medium, and lowpressure injection to work effectively together, to ensure that the injection is continuous.

Doubled-Ended Cold Leg LOCA Analyses
The case simulates a doubled-ended cold leg large break which contributes to the core damage frequency (CDF) most significantly among the design basis conditions (Westinghouse, 2003). The comparison of initial steady-state simulation results and design parameters were presented in the previous study (Sun et al., 2020). The relative error is within 1%, which could illustrate the accuracy of the RELAP5 simulation model. The transient sequence of the LOCA accident is presented in Table 1.
The break occurs at 0 s, the primary system pressure drops rapidly (as shown in Figure 5). The primary system coolant will discharge out from the cold leg break, due to the double-ended break characteristics, the mass flow rate of the coolant loss is massive (as shown in Figure 6). When compared with the AP1000 primary system change of the same LOCA situation, the rapid pressure change is similar (Westinghouse, 2011). The pressure drop tendency is slower than that of the active safety injection system in the original Qinshan design, which suggests improvement in accident mitigation (Yan and Baoshan, 1989).
At 2 s, the RCS pressure drops to the setpoint of the reactor trip, the reactor would shut down and the steam generator steam will be isolated at the same time. Due to the large break of the double-ended rupture, the pressure drops dramatically, reaching the critical saturation pressure quickly and flashing evaporation emerges in the system. At this stage, the coolant boils into steamwater two phases. The pressure and coolant mass flow rate drop at the same time, resulting in deterioration of the heat transfer, and departure from nucleate boiling (DNB).  After a 1-s delay, the pressure drops to 12.25 MPa ("S" signal), the CMT will put into use at this pressure setpoint. After 8 s, the reactor will be cooled by natural circulation. Once the CMTs operate, they will inject borated water into the primary system to submerge the reactor core and assure sufficient reactivity (as shown in Figure 7). As long as the LBLOCA proceeds, the water level of CMTs keeps decreasing (as shown in Figure 8).
About 14 s after the high-pressure safety injection is put into use, the primary system pressure quickly drops to the setpoint of the medium-pressure safety injection (4.8 MPa). Meanwhile, the medium-pressure safety injection water flows through two check valves and is directly injected into the reactor pressure vessel. The flow rate is relatively small. Due to the large coolant loss at the break, the medium-pressure safety injection water was injected into the lower downcomer of the reactor after 14 s, and the core water level began to rise. Therefore, the accident transients entering the refilling stage. The RCS pressure will maintain nearly constant until the ADS stage 2 opens (as shown in Figure 5). The water level of the reactor dropped to the lowest (0.30 m) in the 30 s after the accident, which was lower than the bottom of the reactor core (2.04 m). The reactor core has been exposed for about 41 s.
The ACC will drain to a fully empty stage at about 200 s (as shown in Figure 9). When the CMTs' water level decreases to the low-level setpoint (20% full inventory), the ADS stage-2 will put into use. Once the ADS stage 2 operates, the primary system pressure will depressurize rapidly, and the long-term cooling stage begins which is mainly relied on the HETs (as shown in Figure 10).
Due to zero flow rate or even backflow of the reactor core, the first peak cladding temperature (PCT) of the fuel occurred   approximately 38 s after the break (as shown in Figure 11). Due to the large flow loss at the break, the medium pressure safety water was injected into the lower plenum of the reactor until 14 s later, and the core water level began to rise, which is the refilling stage. During the beginning of this stage, the core was completely exposed for a short period which led to the second PCT. During the whole accident process, the PCT 1174K is within the safety margin (as shown in Figure 11). When compared to the previous AP1000 safety analysis results, the variation of PCT showed a similar tendency, which implies the PSIS in our study has a qualified similar safety function as that of the AP1000 (as shown in Figure 12). When compared to the original active safety system analysis of the Qinshan reactor, the PCT delays about 100 s, which implies the advantage of the passive safety system design (Yan and Baoshan, 1989).

CONCLUSION
In this paper, a PSIS that contains CMTs, ACCs, HET, and ADS for GBS type ONNP based on Qinshan design has been proposed. To evaluate the system performance, the double-ended large break LOCA safety analyses were carried out. The results illustrate the PSIS can mitigate large break LOCA. For the large break LOCA, safety injection from CMTs, ACCs, and HET can keep the reactor core submerged and the PCT under control. However, the rapid primary system relief drained the CMTs and ACCs, which highlights long-term cooling by HET as extremely important.
In all the most significant difference between the third and second generation nuclear power plant is the passive safety system. The passive safety injection system proposed in this paper could help Chinese nuclear engineers improve the system design of the novel ocean-based nuclear power plant.

DATA AVAILABILITY STATEMENT
The original contributions presented in the study are included in the article/supplementary material, further inquiries can be directed to the corresponding author.