The second group of accidents from the second category of BDBA (total damage of the core or its components with the reactor maintaining its overall structural integrity) are the accidents when heat-up of the reactor core occurs after the reactor shutdown (2.2 — see Figure 5). The heat-up, damage and melting of the reactor core could occur in the late phase after the reactor shutdown due to loss of the long-term cooling. The results of the Level 1 probabilistic safety assessment of the Ignalina NPP showed that in the topography of the risk, transients dominate above the accidents with LOCAs and the failure of the core long-term cooling are the main factors of the frequency of core damage. The initiating events leading to the loss of long term cooling accident are such: [4] impossibility to feed RCS by water. The results of the analysis [20, 25] suggest that approximately 1.5 hours after the beginning of the accident, a dangerous heat-up of fuel rods and FC walls starts. Three ways of potential accident management for the loss of the long-term core cooling were discussed in [25]:

• decay heat removal by ventilation of DS compartments,

• decay heat removal by direct water supply into the reactor cavity,

• de-pressurisation of the reactor coolant system and water supply to the GDH from ECCS hydro-accumulators, deaerators or using non-regular means.

The results showed that the first two ways are inexpedient. The ventilation of DS compartments and the direct water supply into the RC are not sufficient to remove the decay heat from the core. However, the de-pressurisation of RCS and the following water supply from regular and non-regular means to the GDH in the case of loss of long-term cooling gives considerably better results compared with the other two measures. The performed analysis [25] demonstrated that the reactor core cooling by RCS depressurisation and water supply from deaerators give additional four hours for the operator to install water supply from the external (artesian) water source. Thus, this way of accident management is recommended to be included in the RBMK-1500 accident management programme.

In the case of loss of intermediate cooling circuit or loss of service water, the consequences of the accidents will be very similar. In these last cases there are no direct signals for the reactor shutdown; however, these initiating events lead to the loss of feedwater supply and MCP will be tripped due to the insufficient cooling. Reactor scram would appear on secondary parameters and further sequence of the accident will be the same as in case of the station blackout: due to decay heat the water in the core is evaporating and the core heat-up process starts. Core overheating can be avoided by using water stored in the ECCS hydro­accumulators, deaerators and other water sources located at NPP.

Figure 21 shows the behavior of fuel, claddings, channel walls, and graphite stack temperatures, calculated using RELAP5 and RELAP5/SCDAPSIM codes (models presented in Figure 6 and Figure 7), in case of RBMK-1500 reactor blackout, without any additional water supply. Such event, which is developing into a severe accident, serves as an example for the discussion of severe accident phenomena in RBMK type reactors. As it is presented in Figure 21, the failure of fuel channels could occur after ~3 hours. The failure of FCs is expected because the pressure in RCS is nominal, and the acceptance criterion for fuel channel (650 °C) will be reached (Figure 21). It is assumed that after ~3.8 hours the operator opens one steam relief valve to discharge steam from RCS. This action allows depressurizing RCS and prevents ruptures of FCs. If no operator actions were taken (no manual depressurization), then approximately 50 FCs with a higher power level could be ruptured. If all FCs ruptured within short time interval, the reactor cavity would be destroyed and the consequences of the accident would be similar to the Chernobyl accident.

Figure 22 shows the long-term behavior of fuel, claddings, fuel channels, and graphite stack temperatures, calculated using RELAP5/SCDAPSIM code (model presented in Figure 7), in case of RBMK-1500 reactor blackout, with operator intervention (opening one of steam relief valves for RCS depressurization). As the operator starts depressurization, the accident scenario continues at low pressure. Due to the pressure decrease the rest of coolant in pipelines below the reactor core starts boiling and steam cools down the core for a short

time. As it is shown in Figure 22, the temperatures of the core components decrease for a short period of time. However, after 4.3 hours the second (repeated) heat-up of the reactor core elements begins. When the temperature of fuel cladding increases above 800 °C, the failure of fuel claddings occurs due to ballooning. The ballooning happens because at that time the pressure in RCS (outside fuel rods) is close to the atmospheric and the pressure inside fuel rods is high. The conditions for fast oxidation of claddings and fuel channels,

-10 12 3 4

Time, h

Time, h

Fig. 22. Station blackout, when operators depressurizes RCS. Main consequences in case of station blackout

made from zirconium-niobium alloy, are reached after the fuel cladding and fuel channel temperatures exceed 1000 — 1200 °C (~15 hours after the beginning of the accident). Due to steam-zirconium reaction the generation of hydrogen starts. The oxidation and hydrogen generation processes terminated after the pressure in RCS decreases down to atmospheric. This indicates that there is no steam in RCS, thus the steam-zirconium reaction is impossible. Later the processes would continue at low pressure in RCS and RC would remain intact.

When the temperatures of fuel claddings and FC walls reach 1450 °С, the melting of stainless steel grids and zirconium starts at 1760 °С (Figure 22). Probably at the same time the fuel channels will fail. At temperature of 1930-2050 °С and 2330 °С the melting of aluminum oxide (control rods claddings) and boron-carbide (control rods elements) in the separate control rods channels starts. The formation of ceramic (U, Zr, ZrO2) starts at temperature of 2600 °С. The analysis performed using RELAP5/SCDAPSIM code shows that fuel melting (melting of ZrO2 and UO2) starts at low pressure, approximately 50 hours after the beginning of the accident at temperatures of 2690 °С and 2850 °С respectively (Figure 22). Such comparably slow core heat up process is due to the high inertia of graphite stack, which provides a heat sink. Hence, the high pressure melt ejection and direct containment heating — the phenomena more related to PWR design — could not occur at RBMK-1500 reactor due to the limited space inside the reactor cavity. However, to cool down the reactor, it is necessary to start water supply into the fuel channels within the first 15 hours after the beginning of the accident. The water supply in later phases could lead to a fast steam-zirconium reaction and it could accelerate core damage processes.

6. Conclusion

In this paper the specifics of RBMK reactors design was presented. Based on the specific feature of RBMK, possible Beyond Design Basis Accidents were divided into four groups:

• accidents with no severe damage of the core;

• accidents leading to a severe core damage accompanied by containment of the core fragments in the reactor cavity and accident localization system or other reactor buildings;

• accidents when heat-up of the reactor core occurs during the reactor operation or within the first seconds after the reactor shutdown;

• accidents when heat-up of the reactor core occurs after the reactor shutdown.

The deterministic analysis of all these groups of BDBA was performed using a system of thermal hydraulic computer codes RELAP5 and RELAP/SDAPSIM. The consequences of these BDBAs and possible accident mitigation measures were discussed. [5]

when there are no possibilities to inject water in the reactor using regular means, the operators can supply the water into reactor from ECCS hydro-accumulators, later to perform the RCS de-pressurization by opening manually steam relief valve. Finally, after the pressure in RCS is reduced, the low-pressure non-regular water sources can be used (deaerators and artesian water).

• The accidents in the second group (accidents leading to a severe core damage accompanied by containment of the core fragments in the reactor cavity and accident localization system or other reactor buildings) are initiated due to misbalance between energy source and heat sink. If the emergency core cooling system is not activated, or the amount of supplied water is less as required, the core meltdown can occur. Based on the performed deterministic analysis the setpoints for ECCS activation were selected. The capacity of reactor cavity venting system was increased to prevent failure of reactor cavity in case of multiple fuel channel rupture (up to simultaneous rupture of 16 fuel channels).

• The third group contains the accidents when heat-up of the reactor core occurs during the reactor operation or within the first seconds after the reactor shutdown, when decay heat is high. Because fast process of heat-up of fuel rods in this case — there is no time for operator actions in this case. The new algorithms for reactor shutdown and fast emergency core cooling system activation were proposed for RBMK-1500 to prevent overheating of fuel in local flow stagnation or flow blockage in the group of fuel channels cases. Also the new ECCS activation algorithm was developed to cooldown the reactor in the case of loss of natural circulation due to a sharp decrease of pressure in the RCS. To prevent the catastrophic core damage in the anticipated transients without reactor scram case (when main reactor shutdown system fails to shutdown reactor) the additional emergency protection was implemented in the RBMK-1500.

• The forth group of accidents — the accidents when heat-up of the reactor core occurs after the reactor shutdown. The performed analysis shown, that even in the case of failure of all design (regular) and non-regular means to cooldown the rector in the case of loss of long term core cooling, the core heat-up process is slow in RBMK-type reactors. In the station blackout case, to prevent failure of reactor cavity at high pressure, the operators are required to open the steam relief valve manually, to start RCS depressurization. Due to the high inertia of graphite stack, which provides a heat sink, the melting of fuel stats at low pressure not earlier as 50 hours after loss core cooling.

The analysis was performed for the RBMK-1500 reactor (Ignalina NPP, Lithuania), but the main ideas of the accident mitigation are also valid for the RBMK-1000, which are still operating in Russia.

7. Abbreviations

ALS Accident Localization System

ATWS Anticipated Transients Without reactor Scram

BDBA Beyond Design Basis Accidents

BWR Boiling Water Reactor

CPS Control & Protection System

DAZ Acronym for Russian — Additional emergency protection

DS Drum Separator

ECCS Emergency Core Cooling System

FC Fuel Channel

GDH Group Distribution Header

LWR Light Water Reactor

LOCA Loss Of Coolant Accident

LWP Low Water Pipes

MCP Main Circulation Pump

NPP Nuclear Power Plant

RBMK Acronym for Russian — graphite-moderated boiling water reactor type

PWR Pressurized Water Reactor

RC Reactor Cavity

RCS Reactor Cooling System

RCVS Reactor Cavity Venting System

SRV Steam Relief Valve

TCV Turbine Control Valve