1.2 Analysis of accidents with no severe damage of the core

As it was mentioned, the first category of BDBA (damage of the core or its components with the reactor maintaining its overall structural integrity see Figure 5) is divided into two groups: (1.1) no severe damage of the core; (1.2) severe core damage accompanied by the containment of core fragments in the reactor core, accident localization system or other reactor buildings.

The examples of accidents for RBMK-1500 in the first group (1.1, see Figure 5) are the failure of the final heat sink systems with the loss of their functions or staff error, failure of group of reactor Control & Protection System (CPS) rods, failure of one or more channels in the reactor Emergency Core Cooling System (ECCS) short-term or long-term subsystems, failure of the system which supplies feedwater during a prolonged period of time, and other failures. This group of accidents involves additional failures of the equipment in the safety systems (additional to failures considered by the single failure principle). Usually the accidents of first group (no severe damage of the core) are analyzed in order to justify the effectiveness of the functional backup, as well as to assess the conditions and the time available for the backup systems to be actuated. As a rule, this belongs to the field of the accident management on the basis of symptom-oriented emergency operating procedures.

Thus, in case of a postulated failure of CPS rods movement during reactor operation at power, the actions taken by the operators to shutdown the reactor and to hold it in a subcritical state were determined. The reactor can be shutdown and maintained subcritical by inserting one CPS rod into the core, decreasing the water temperature in the CPS cooling circuit or decreasing the temperature of the graphite stack [8]. At Ignalina NPP the Additional Hold-down System is implemented in case of CPS malfunction to prevent reactor re-criticality by injecting the liquid poison (Gadolinium Nitrate) into the CPS cooling circuit [19].

During reactivity initiated accidents the situation can occur when the group of control rods is withdrawn erroneously. Under adverse conditions it is possible that the signal for local Automatic control will not be generated and the local power increase can occur in a group of fuel channels. Validated calculations using the experimental data showed that this increase could reach 2-2.5 times of the nominal channel power, but it does not cause significant coolant flow decrease in the fuel channels (due to the increased channel resistance in the steam zone) and overheating of the fuel channels [9]. Since this chapter mainly deals with the thermal-hydraulics, more detailed examples with reactivity initiated accidents are not presented there.

Another example could be the loss of long-term cooling. The performed deterministic calculations showed that the reactor core cannot be damaged without the make-up by feedwater during any transient after full reactor shutdown in approximately 1.5 hours [8, 20]. One high pressure pump is sufficient to cool down the reactor for one hour after the reactor shutdown. If the water supply from one pump is re-established, all the parameters of RCS and reactor remain within safe operation limits. However, if the high pressure pumps are not available, the manual operators’ actions are required. In [18] the optimal reactor core cooldown scenario for RBMK-1500 in case of station blackout was developed (see Figure 8 — Figure 10). The modeling of such scenario was performed using RELAP5 model presented in Figure 6.

In the analysis presented below, it is considered that the operator takes early actions: 15 minutes after the beginning of the accident the operator begins to supply cold water from ECCS hydro-accumulators into GDH of both RCS loops. After approximately 1.5 hours from the beginning of the accident, the peak fuel cladding temperature exceeds 400 oC (Figure 8). According this signal, the operator opens one steam relief valve to decrease pressure in RCS (Figure 9). At the same time the operator takes actions to maintain the water supply by gravity from deaerators and prepares the connection for water supply from the artesian water source. The activation of ECCS hydro-accumulators after 15 minutes from the beginning of the accident provides only a small amount of water due to equalization of pressures in hydro-accumulators and GDH. Additional amount of water from hydro­accumulators is injected when the pressure in RCS decreases (~2 h after the beginning of the accident). The water supply from ECCS hydro-accumulators and opening of one steam relief valve would result in the increase of water level in RCS (Figure 10). At the time moment t = 2.5 h, the water supply from ECCS hydro-accumulators stops. Approximately 170 m3 of water is injected from ECCS hydro-accumulators.

When the pressure in RCS decreases down to 1.2 MPa (pressure in deaerators), the water flow from the deaerators begins (t = 3.8 h). There are four deaerators, which contain 480 m3 of water with temperature of ~ 190 oC. After the connection of deaerators to RCS, the pressure decrease leads to boiling of water in deaerators. The initial flow rate of water from deaerators does not warrant adequate cooling of the core — the temperature of core components is increasing at the time interval t = 3 — 5 h (Figure 8). To increase the flow rate of water from deaerators, at the time moment t = 5.3 h the operator opens one additional Steam Relief Valve (SRV). As it is seen from Figure 8, this action improves the core cooling conditions and the temperature of core components starts to decrease. The pressure in RCS decreases down to the pressure in artesian water system (~ 0.6 MPa) only more than 13 hours after the beginning of the accident. A complete connection of artesian water to RCS is permitted only after the decrease of pressure in RCS down to the level of pressure in the

artesian water source. These measures should prohibit the injection of coolant from RCS into the pipeline of artesian water. After the connection of artesian water source to supply water into reactor, the water level in reactor core starts to increase, which means the success of core cooling. The mentioned operators’ actions lead to a slow decrease of pressure in RCS, the fuel rods claddings and channels walls temperatures become not higher than 600 oC.

Fig. 10. RCS de-pressurization and water supply into reactor from ECCS hydro­accumulators, deaerators and artesian water source in case of station blackout. Calculated water level behavior in RCS

The results of the mentioned neutron-physical and thermal-hydraulic investigations have served as the basis for expanding the region where the accidents of the first group with multiple failures can be controlled using the symptom-oriented emergency operating procedures, and they have made it possible to determine the actions to be taken by personnel in order to prevent severe core damage.