One of the fundamental safety functions of nuclear power plants is residual heat removal. Nevertheless, during certain scenarios, like the station blackout, or loss of the ultimate heat sink, available active safety systems are often not sufficient to remove the decay heat. A retrofitted turbo-compressor system driven by a self-cooling Brayton cycle could provide autarky even in these beyond design basis accidents and extend the grace period of existing BWRs significantly. By Jeanne Venker

main

Most of the operating generation II boiling water reactors (BWRs) rely solely on active safety systems to remove decay heat during accident scenarios. Furthermore, such reactors depend on their main heat sink, as alternative heat sinks have, at the most, limited capacities and/or need active intervention. For certain beyond design basis accidents, generation II reactors are not sufficiently equipped. During a total station blackout (SBO) or a loss of the ultimate heat sink (LUHS), there is a strong dependence on external measures. In order to control these scenarios independently and to extend the grace period, passive safety systems as well as an unlimited diverse heat sink are necessary that do not depend on external power supply.

Safety requirements for current reactor designs ask for the ability to control certain beyond design basis accidents for 72 hours independently. But approaches regarding passive safety systems and diverse heat sinks which have been investigated for these reactor designs are not retrofittable. For instance, an isolation condenser requires, as an alternative heat sink, a tremendous amount of water. If not originally in place, such a pool or tank cannot be integrated in existing power plants. Therefore, new approaches must be developed.

The turbo-compressor system proposed is an autarkic and retrofittable heat removal system. It is powered by an integrated, self-cooling Brayton cycle, which is driven by the temperature difference between the primary circuit and its diverse heat sink, the ambient air. In addition, as the expansion work gained in the turbine is greater than the necessary compression work, it is possible to generate independent excess electricity, which can be used for various purposes throughout the plant. The working fluid is supercritical carbon dioxide, whose particular properties enable the circuit to be extremely compact. Important for a potential licensing process is not only that the turbo-compressor system does not influence existing safety systems negatively, but also that only minor modifications are needed of existing safety-grade equipment.

According to IAEA categorization criteria, the self-cooling system can be classified as passive, as it does not depend on external power sources and uses internal ones to supply its active components. As the system is solely driven by natural forces such as gravity, pressure, temperature or density differences, it is less vulnerable to externally-caused failures [1], which increases the reliability of this system significantly.

The idea and design of the self-cooling system (international patents pending) was developed by RWE Technology, which belongs to one of the leading European utilities, RWE. In cooperation with the Institute of Nuclear Technology and Energy Systems, corresponding to the University of Stuttgart, the system is analysed with the thermohydraulic computer code ATHLET (Analysis of THermal-hydraulics of LEaks and Transients), developed by GRS (Gesellschaft für Anlagen- und Reaktorsicherheit). This provides insight in the system’s transient behaviour and possible interactions with established safety systems of BWRs for different accident scenarios. The focus of the ongoing study is on beyond design basis accidents, like station blackout, or the loss of the ultimate heat sink. The unavailability to add coolant to the primary circuit, by designated or emergency procedures, is anticipated.

The main features of the turbo-compressor system are:

  • Decay heat removal
  • Utilisation of a diverse heat sink
  • Generation of independent electricity
  • Independence of external power supplies
  • Independence of operator actions or manual initiation
  • No need for external equipment
  • No need for additional water inventories.

Concept

The simplest way to remove residual heat from a boiling water reactor is to attach a heat sink, that is, a heat exchanger, to the primary circuit that condenses steam. This results in a natural circulation within reactor pressure vessel and the corresponding pipes. Similar to the process in concepts involving isolation condensers, the steam rises to the heat exchanger, where it is condensed, and flows back towards the reactor pressure vessel, forced by gravity. In order to maximize the driving force, it is advisable to place the heat exchanger as high as possible above the core. Nevertheless, it needs to be located within the containment, in order to assure the retention of primary system steam.

The adjacent circuit that cools the aforementioned heat exchanger in the present concept is a Brayton cycle. The temperature difference between its heat source and sink, that is, the primary circuit and the ambient air, powers the system. This way the turbo-compressor system is independent of external power sources. In the closed Brayton cycle supercritical carbon dioxide passes through the heat exchanger (1-2 in Figure 1) and therefore heats up. It further flows to a turbine (2-3), expands and continues towards an air-cooled heat exchanger (3-4), where it is cooled down. Afterwards, the fluid passes the compressor (4-1) and regains its initial state. One particular advantage of this self-cooling system is that it not only removes the decay heat from the primary circuit, but produces electricity independently. This can be realised because the expansion work gained in the turbine is great enough to drive the compressor via a single shaft arrangement and to power a generator additionally. A schematic sketch can be seen in Figure 1.

The turbo-compressor system starts independently, without the need of supplementary energy to initiate the process. The power failure that causes station blackout also causes the immediate opening of a solenoid valve (SV), which isolates the heat exchanger from the main steam line during normal operation. This way, manual activation is unnecessary for the system to start, and the natural convection to evolve. Once the primary steam heats the carbon dioxide via the heat exchanger, dramatic density changes of the order of ~500 kg/m3 occur within the Brayton cycle. This starts the cooling circuit naturally by buoyancy forces. As an alternative, the Brayton cycle can be initiated by starting the compressor with battery power.

The excess electricity produced in the generator is primarily intended to power air fans, which enhance the heat transfer from the supercritical carbon dioxide to the ambient air due to forced convection at the air-cooled gas cooler. This is extremely important as the amount of heat transferred to the air determines the performance of the whole system. Supplementary excess electricity could be used for various purposes throughout the rest of the plant; for example for lighting, powered instrumentation or HVAC, all of which would be highly useful in accident scenarios. Utilising the ambient air as a diverse heat sink is very beneficial, as it is not only completely separated from regular ultimate heat sinks like rivers or the sea, but offers an indefinite supply of coolant.

Components

The working fluid of the Brayton cycle is supercritical carbon dioxide, which has been chosen because of its properties throughout the operating conditions (9-18 MPa, 40-280°C). Entering the heat exchanger at around 18 MPa and 67 °C, the supercritical carbon dioxide has a relatively high heat capacity (2.8 kJ/kg K) and density (635 kg/m³), which is very favourable in order to minimise the heat exchanger size. Due to the stringent space limitations within the containment, this is an important advantage for a retrofit. Furthermore, the low dynamic viscosity of supercritical carbon dioxide reduces friction losses within the cooling circuit. As the system propels itself and is completely autarkic, fewer losses will broaden its operating range.

The dimensions of the components depend strongly on the specified maximum amount of heat that the system must be capable of transferring to the ambient air. Due to its low density it would require a very large volume of air in order to remove the total amount of decay heat during the beginning of an accident scenario. This would result in unreasonably large installations of air-cooled gas coolers and is therefore hardly practical. Thermodynamic calculations [2] have exemplarily been carried out for a generic boiling water reactor with 3840 MW thermal power. It was shown that for a first approximation a cooling capacity of around 60 MWth is sufficient to cope with the named beyond design basis events and it is unnecessary to remove the complete decay heat from the very beginning of the accident.

The greatest space limitations apply for the heat exchanger that transfers the residual heat from the primary circuit to the cooling cycle, as this component has to be placed within the containment itself. One promising option is a printed circuit heat exchanger [3], as it is extremely compact and has a very high surface-to-volume ratio of about 500 m²/m³. The heat exchanger is joined by diffusion bonding and can therefore withstand extremely high pressures and temperatures, which is important since the CO2 pressure can be as high as 20 MPa. According to calculations, a heat exchanger with a total volume of about 1.2 m³ should be sufficient to transfer 60 MWth under the assumed boundary conditions. This compact design is expected to fit in the containment. If necessary, modular arrangements of heat exchangers are possible, in order to place them between existing equipment.

Radial turbo machinery has been chosen for the Brayton cycle, because radial turbines and compressors perform robustly over a wide range of operating conditions and still provide relatively high efficiencies. This is necessary as the system must be capable to remove varying amounts of decay heat over time. It is intended to be used during the whole accident progression, from the beginning to days after the initializing event. For this reason it is foreseen to install several turbo-compressor units in parallel with the option to be turned off individually, as the decay heat decreases over time. It is likely that the flow machines would be placed in the reactor building, due to their relatively small impeller diameter of less than 10 cm.

The turbo-compressor system utilizes ambient air as an alternative heat sink, which cools the supercritical CO2 and enables an indefinite potential cooling period. The air-cooled gas cooler must ensure the transfer of around 60 MWth to the air, which still implies large installations of coolers. In terms of passivity, it would be best to use natural convection for the heat transfer. As this seems impractical due to the necessary size of the cooler, forced convection will be needed to improve the heat transfer. Estimates indicate that 12 fans with a diameter of 5m are sufficient. The required fan power is less than 700 kW, which can easily be provided by the electricity generated by the Brayton cycle (up to 3 MW). Therefore, the set-up does not depend on external power supplies and the fans are expected to work even in the most severe blackout scenario.

The boundary conditions for the Brayton cycle are firstly the temperature within the primary circuit, as this determines the fluid temperature entering the turbine, and secondly the temperature of the ambient air influencing the temperature before the compressor. The pressure ratio of the turbine and the compressor is almost two and yields a pressure difference of 8.5 MPa. A summary of the boundary conditions and first results of the simulation of the Brayton cycle are presented in Table 1.

Insights

The basic strategy of the turbo-compressor system is to remove the decay heat and reduce the primary system pressure during a station blackout. In contrast to the automatic depressurisation system, the turbo-compressor system minimises the loss of coolant inventory. This is essential, because designated means of coolant addition are expected to be unavailable due to the power failure.
For the simulation of the additional heat removal system, an input deck of a generic BWR has been extended by the necessary piping, the compact heat exchanger and the solenoid valve. Furthermore, the Brayton cycle is modelled with its corresponding components, a radial turbine, compressor and the compact heat exchanger. The air-cooled heat exchanger is represented by a controlled heat sink. In the current status of the modelling, the Brayton cycle is not yet coupled to the modified BWR input. Instead, for the presented simulations, the mass flow rate and temperature of cool supercritical CO2 as well as the pressure in front of the turbine are imposed as boundary conditions.

First simulations of the retrofitted BWR revealed that the self-cooling system works as anticipated and can remove the residual heat as required under safety aspects. The decay heat exceeds the removed heat for a short period of time during the beginning of the station blackout, which causes a pressure increase within the isolated primary circuit. However, this can be controlled by the automatic depressurisation system and has only a relatively small impact on the overall behaviour of the plant. The reactor pressure vessel (RPV) pressure stays within acceptable limits during all times.

In the reference reactor, three diversified blow-off valves are intended to stay open under these conditions, in order to decrease the primary circuit pressure and to facilitate the injection of coolant. However, in the anticipated scenario, all means of safety injection are supposed to be unavailable and an injection of coolant is not possible. Moreover, primary steam is continuously blown into the pressure suppression pool which causes the water level within the reactor pressure vessel to decrease over time. After twenty minutes the level reaches the set point at which the automatic depressurisation is activated and additional safety and relief valves open. Although meant to facilitate the safety injection, this scenario actually limits the benefit of an additional heat removal system and reduces the potential of the self-cooling system itself, as it works most efficiently under high-pressure conditions.

In order to extend the grace period with the self-cooling system into the range of days, two options may be considered. Up to now it is common sense to rapidly depressurise the primary circuit of a boiling water reactor following a station blackout or loss of ultimate heat sink. But it might be necessary to rethink whether the opening of the safety and relief valves should be requested in any accident scenario without distinction. If the turbo-compressor system is retrofitted and provides an option to remove the residual heat while preserving most of the cooling inventory, depressurisation may be deferred. It shall be favourably considered, when plant conditions are stable again, power supply is restored and/or external support is accessible. This would also include an adaption of the opening and closing criteria of certain safety and relief valves for the relevant scenarios, such that the coolant inventory is not unnecessarily lost.

Alternatively, the decreasing water level could be countered by means for coolant supply. Due to the available excess electricity of the Brayton cycle (up to 2.3 MW), existing water injection systems of the power plant could be utilised. One particularly promising source for water could be the high pressure seal injection water system for the reactor pressure vessel recirculation pumps. These pumps draw less than 100 kW and can inject approximately 16 m³/h of water at full system pressure. In addition, it is expected that water from the feedwater tank will be inserted passively, once its pressure overcomes the decreasing primary circuit pressure, during the late stages of an accident.

Below, results of three simulated test cases are discussed in more detail.

  • Case 1: The reference case is an anticipated SBO at a generic BWR with 3840 MW thermal power (green line in Figures 2&3).
  • Case 2: Case 1 retrofitted with an additional heat removal system (dark blue line in Figures 2&3)
  • Case 3: Case 2 with an adapted automatic depressurisation system (red line in Figures 2&3).

Figure 2 shows RPV pressure following the station blackout. This was simulated with the German severe accident code ATHLET. In the reference case, the opening of the blow-off valves represents the only option to depressurise the primary circuit. The automatic depressurisation is activated after 10 minutes due to the low water level signal, which is triggered as the water level falls below 1.5m above the core. Several safety and relief valves are opened and the system pressure decreases rapidly. In case 2, the residual heat removal is combined with the open blow-off valves, which results in a greater pressure reduction. Nevertheless, before reaching a designated pressure level, that is, the set point for closing the depressurisation valves, the automatic depressurisation is activated and more safety and relief valves are opened due to the decreased water level.

Alternatively, in case 3, the automatic depressurisation system has also been adopted. For station blackout scenarios, continuous depressurisation is deferred. This way the blow-off valves are closed as long as the RPV pressure stays within acceptable limits and no other safety-related criteria triggers the opening of blow-off valves. During the beginning of the scenario, the decay heat exceeds the heat removed by the turbo-compressor system which results in an increase in the RPV pressure. Reaching 77 bar (7.7 MPa), one of the safety and relief valves is opened due to a high system pressure signal. The blow-off valve stays open until the system pressure decreases to 74.5 bar, which causes the intermittent behaviour seen in Figure 2. After 50 minutes the removed heat overcomes the decreasing decay heat, causing a slow pressure reduction.

Figure 3 shows the water/vapour temperature in a representative channel in the upper core region against time for a boiling water reactor following a station blackout. The activation of the automatic depressurisation for case 1, the reference case, causes the core temperature to decrease due to the rapidly decreasing system pressure. Subsequently, the temperature starts to rise quickly, which indicates that the top of the core is uncovered. In case 2, the temperature stays almost constant until the automatic depressurisation is activated, 30 minutes after the initiating event. The subsequent opening of the blow-off valves results in a pressure and therefore saturation temperature drop, before the temperature starts to increase. It can be seen that core uncovering can be postponed for about 40 minutes.

In case 3, the core is steadily covered with water as most of the coolant stays within the primary circuit. Once the removed heat exceeds the decay heat and the system pressure decreases, the temperature reduces as well. With the adopted automatic depressurisation system, the turbo-compressor system is capable of removing the decay heat and to control the accident scenario during the simulated time of 72 hours.

Additional systems

Some of the existing boiling water reactors are also equipped with a Reactor Core Isolation Cooling System (RCIC). Steam-driven turbo pumps are thereby provided to inject coolant from the wetwell into the reactor pressure vessel in case of power, or ultimate heat sink, failure. Since this system does not remove any heat from the containment, it only buys some time to recover electricity supplies or to implement external emergency procedures. In combination with the passive heat removal system, the RCIC could be useful, as it provides an autarkic option to compensate for lost coolant. Therefore it would also be able to substitute coolant losses due to opened safety and relief valves. However, it should be reconsidered in which cases the opening of blow-off valves and therefore the depressurisation of the primary circuit is beneficial, as the turbo-compressor system is most efficient under high-pressure conditions.

Isolation condensers (IC) that are in place in some of the presently-operating BWRs facilitate a temporary heat sink to the primary circuit, in case electricity supplies and/or the ultimate heat sink are unavailable. Primary steam is drawn upwards by natural convection, comparable to the process in the turbo-compressor system. The steam is then condensed as its latent heat is transferred to the surrounding water inventory of the IC. But this cooling supply of water is limited, which is why this passive system operates only temporarily and cannot control the suggested scenarios. In contrast, the turbo-compressor system possesses an unlimited heat sink, that is, the ambient air, and can provide long-term autarky to the plant. In addition, the generated excess electricity could be used for various purposes throughout a station blackout. The isolation condenser itself is not retrofittable, due to its size and the necessary water inventory.

The interaction of the self-cooling system with such existing safety systems will be investigated in the future.
The turbo-compressor system is also a retrofit option to pressurised water reactors [4]. For example, it could serve as an emergency condenser on the secondary side which condenses steam leaving one of the steam generators. On the other hand it could condense the primary bleed in the pressurizer blow-down tank. The condensed water could then be re-injected by pumps, powered by excess electricity of the Brayton cycle. Theoretically, the turbo-compressor system could also be used for autarkic cooling of spent fuel pools at water temperatures of about 70-80°C.

Despite the promising results of the simulation of the self-cooling system there are still open issues that have to be discussed; for instance, the acceptability of an additional containment penetration that is needed by the system, or the dependency of the heat sink on electricity and the related probability of failure of electrical equipment. These aspects have to be reviewed thoroughly in the near future.

Conclusion

The autarkic, self-cooling system provides residual heat removal even in severe, beyond design basis scenarios like station blackout and loss of ultimate heat sink. The turbo-compressor system is retrofittable for existing boiling water reactors due to its compactness and transfers the decay heat to the ambient air, serving as an alternative heat sink that provides an almost indefinite potential. Simply driven by the temperature difference between the primary circuit and the ambient air, this system is expected to be capable to extend the grace period of a nuclear power plant significantly.

References

[1] IAEA, Safety Related Terms for Advanced Nuclear Plants, chapter 2, IAEA, IAEA-TECDOC-626, Vienna (1991).
[2] J. Venker, Concept of a Passive Cooling System to Retrofit Existing Boiling Water Reactors, Proceedings of the 2013 International Congress on Advances in Nuclear Power Plants, ICAPP 2013, Jeju Island, Korea (2013).
[3] HEATRIC; Compact heat transfer solutions, http://www.heatric.com (19.12.2012)
[4] D. von Lavante, D. Kuhn and E. von Lavante, Self-Propelling Cooling Systems: Back-Fitting Passive Cooling Functions to Existing Nuclear Power Plants, Proceedings of the 20th International Conference on Nuclear Engineering, ICONE 20, Anaheim, USA (2012).

 

Author

Jeanne Venker, RWE Technology GmbH, Huyssenallee 12-14, 45128 Essen; Institute for Nuclear Technology and Energy Systems (IKE), University of Stuttgart, Pfaffenwaldring 31, 70569 Stuttgart, Germany