The second category of core damage (see Figure 5), accidents with loss of the general structure integrity of the reactor and ALS, can potentially be due to the possibility of multiple ruptures of fuel channels at high pressure in RCS. The structural integrity of RBMK-1500 reactor depends on the integrity of the reactor cavity, which with a conservative strength margin was designed for conditions of an anticipated accident caused by the rupture of a single channel (in the nominal operating regime of a reactor). During operation of all nuclear power plants with RBMK reactors, there were three cases of fuel channel rupture, but the neighboring channels were not damaged [4]. This shows that the neighboring fuel channel — graphite cells have sufficient strength and elasticity and that the load caused by the rupture of a single channel is small. The accidents, leading to the complete reactor core damage, with loss of the structural integrity of the reactor can be divided into two groups [9]:

• accidents when heat-up of the reactor core occurs during the reactor operation or within the first seconds after the reactor shutdown, when decay heat is high (2.1, see Fig. 5);

• accidents when heat-up of the reactor core occurs after the reactor shutdown (2.2, see Fig. 5).

The first group of accidents (2.1) includes accidents when the heat-up of the reactor core occurs in the beginning of the accident (a few seconds after reactor scram activation) when decay heat in the core is high and the temperatures of fuel cladding and FC walls in the group of channels can reach the dangerous limits. An example of such accidents is the group of accidents, when the local flow stagnation occurs in the group of fuel channel during the LOCA. This situation is possible in the partial break case [12, 22]. It was mentioned earlier that partial rupture of lower water pipe could lead to the flow stagnation in the affected fuel channel. In the case of GDH partial rupture, the flow stagnation can occur in all fuel channels connected to this affected GDH. Under adverse conditions, the partial break of MCP pressure header can cause flow stagnation in the fuel channels of one affected loop. Since there is no sufficient time for actions of the operator in this case, the short-term accident management measures (automatic actuation of safety systems) are necessary. New reactor protection against coolant flow rate decrease through GDH generated signal for early ECCS activation is implemented in RBMK-1500 in this case. This short-term measure leads to the disturbance of the coolant flow rate stagnation in the group of fuel channels [12] and all parameters of RCS, thus, the reactor remains within safe limits.

Other examples of the first group of accidents (2.1) can also be the initiating events, namely:

• Anticipated Transients Without reactor Scram (ATWS);

• GDH blockage;

• Loss of natural circulation due to a sharp decrease of pressure in the RCS.

The analysis of ATWS (performed for the RBMK-1500 in 1996) demonstrated [3] the lack of inherent safety features in the RBMK design. The power is not reduced by means of inherent physical processes such as steam generation. The reactivity loss due to the fuel temperature rise (Doppler Effect) is not sufficient. The consequences of the accident for RBMK-1500 reactor, during which the loss of preferred electrical power supply and failure of automatic reactor shutdown occurred, are presented in Figure 20. The analysis was performed using RELAP5 model, presented in Figure 6.

Due to the loss of preferred electrical power supply all pumps are switched off (see Figure 20 (a)); therefore, the coolant circulation through the fuel channels is terminated. Because of the lost circulation, fuel channels are not cooled sufficiently and for this reason, the temperature of the fuel channel walls starts to increase sharply. As it is seen from Figure 20 (b), already after 40 seconds from the beginning of the accident, the peak fuel channel wall temperature in the high power channels reaches the acceptance criterion of 650 oC. It means that because of the further increase of the temperature in the fuel channels, plastic deformations begin, i. e. because of the influence of internal pressure, the channels can be ballooned and ruptured. During the first seconds of the accident, the main electrical generators and turbines are switched off as well. Steam generated in the core is discharged through the steam discharge valves, but their capacity is not sufficient Therefore, the pressure in the reactor cooling system increases and reaches acceptance criterion 10.4 MPa approximately after 80 seconds from the beginning of the accident (see Figure 20 (c)). Further increase of the pressure can lead to a rupture of pipelines.

Thus, the analysis of the anticipated transients without the shutdown demonstrated that in some cases the consequences can be quite dramatic for the RBMK-1500 reactors. Hence, in 1996 the priority recommendation was formulated as follows: to implement a second diverse shutdown system based on other principles of operation,. The implementation of such system requires much time and financial sources, thus at first it was decided to implement a compensating measure: a temporary shutdown system. This temporary system was called by the Russian abbreviation „DAZ" („Dopolnitelnaja avarijnaja zacita" — „Additional emergency protection"). This system used the same control rods as well as design reactor shutdown system, however, signals for this system control were generated independently in respect of the design reactor shutdown system. The analysis performed to justify the selected set points for reactor scram activation showed that after the implementation of DAZ system, the reactor is shutdown on time and cooled reliably; moreover, the acceptance criteria are not violated even in case of transients when the design reactor shutdown system does not function. Figure 20 presents the behavior of the main parameters of the reactor cooling system in case of the loss of the preferred electrical power supply and simultaneous failure of the design reactor shutdown system [23]. In this case two signals for activation of DAZ system (reactor shutdown) are generated: on the increase of pressure in the drum-separators and on the decrease in the coolant flow rate through the main circulation pumps. In Unit 1 DAZ system was installed in 1999, in Unit 2 in 2000. Later (in 2004) the second diverse shutdown system
was installed in the Ignalina NPP Unit 2. After these modifications the frequency of ATWS at Ignalina NPP became negligible (<10-7/year).

щ 8000

ад.5

6000 з

S

•s mg

4000

в о

I 2

в

2000

о о

О

0

The GDH blockage for RBMK-1500 also depends on such group of accidents when during normal operation a group of fuel channels is overheated and multiple rupture of FC can occur. It is shown [12] that the coolant flow through the ECCS bypass line is not enough to cool down the fuel channels connected to the blocked GDH. The critical heat flux would appear in some fuel channels and cause failure of fuel claddings and FC walls. In the year 2000 a new reactor scram (emergency shutdown) signal based on coolant flow rate decrease through GDH was implemented at Ignalina NPP. The new signal ensures the timely reactor shutdown so that the dangerous fuel cladding and FC walls temperatures are not reached [12]. Therefore, this accident is moved from the group of severe accidents into the group of accidents without core damage.

The accidents when the loss of natural circulation occurs due to a sharp decrease of pressure in the RCS (due to break of steamlines) are presented in section 5.2.4. Some parts of steamlines are located in the compartments without pressure gauges. Thus, there is no direct signal indicating that the steamline break occured in these compartments (as in the other cases the pressure increase in compartments indicates coolant discharge through the break). It means that signals for the reactor shutdown and ECCS activation will be generated with delay on the basis of secondary parameters (e. g., water level decrease in DSs). On the other hand, a sharp pressure drop in the RCS is a characteristic feature in the case of RBMK steamline break; it destroys the natural circulation of coolant through the core. The flow stagnation in the core together with the late reactor shutdown can cause overheating of group of fuel channels. This was mentioned in the safety analysis report of Ignalina NPP [3] and the review of safety analysis report [24]. In the year 1998 — 1999 a new reactor scram signal based on fast pressure decrease in DS was implemented at Ignalina NPP. This modification allowed avoiding the overheating of a group of fuel channels.