Relap5 Analysis of Processes in Reactor Cooling Circuit and Reactor Cavity in Case of Station Blackout in RBMK-1500

Ignalina NPP is equipped with channel-type boiling-water graphite-moderated reactor RBMK-1500. Results of the level-1 probabilistic safety assessment of the Ignalina NPP have shown that in topography of the risk, the transients with failure of long-term core cooling other than LOCA are the main contributors to the core damage frequency. The total loss of off-site power with a failure to start any diesel generator, that is station blackout, is the event which could lead to the loss of long-term core cooling. Such accident could lead to multiple ruptures of fuel channels with severe consequences and should be analyzed in order to estimate the timing of the key events and the possibilities for accident management. This paper presents the results of the analysis of station blackout at Ignalina NPP. Analysis was performed using thermal-hydraulic state-of-the-art RELAP5/MOD3.2 code. The response of reactor cooling system and the processes in the reactor cavity and its venting system in case of a few fuel-channel ruptures due to overheating were demonstrated. The possible measures for prevention of the development of this beyond design basis accident to a severe accident (BDBA) are discussed.


INTRODUCTION
Ignalina NPP is the only nuclear power plant in Lithuania consisting of two units, commissioned in December 1983 and August 1987.Unit 1 of Ignalina NPP was shut down for decommissioning at the end of 2004.Both units are equipped with a channel-type graphite-moderated boiling-water reactors RBMK-1500 [1].The location of the reactor core and its main components is shown in Figure 1.Reactor cooling system of RBMK-1500 has two loops, which are interconnected via the steam lines and do not have a connection on the water part.The water is supplied to 1661 fuel channels (2 in Figure 1) where it is heated to saturation and partially evaporates.The steam and water mixture then flows to the drum separators (16 in Figure 1) of both loops, where the steam is separated from water and directed to the turbines.The water from the drum separators (DS) flows via downcomers to the main circulation pumps (MCP) suction header (11 in Figure 1) and then by the pumps (7 in Figure 1) is supplied to the MCP pressure header (9 in Figure 1), which is connected to 40 group distribution headers (4 in Figure 1) (20 headers in each reactor cooling system loop).Each group distribution header (GDH) provides water to 41-43 fuel channels (2 in Figure 1).The fuel channels (FCs) are made of zirconium and niobium alloy similar to that used for the fuel claddings.The steam after passing the turbines is directed to the con-densers where it is condensed.The condensate is supplied to the deaerators from where it is directed back to reactor cooling system (RCS) by the main feedwater pumps.
Results of PSA for the Ignalina NPP have shown that failure of the core long-term cooling is the main contributor to the frequency of the core damage.The most likely initiating event, which probably leads to the loss of long-term cooling accident, is a station blackout [2].The station blackout is the loss of preferred electrical power supply for local needs with an additional failure on start-up of all diesel generators.Failure of diesel generators leads to the nonoperability of all electrical equipment except the main safety valves, which are connected to batteries.The feeding of RCS by water using regular means is impossible.The results of performed analysis [2] showed that approximately 1.5 hour after the beginning of the accident, the dangerous heating up of fuel elements and FC walls starts if no mitigation measures are taken.This overheating may lead to a rupture of a group of fuel channels.

INTEGRITY OF FUEL CHANNELS AND REACTOR CAVITY
The fuel channels in RBMK-1500 are placed in graphite stack, which consists of 2488 graphite columns with the vertical bore openings (see Figures 1 and 2).These openings are used for positioning of the channels, which in turn are used for placing fuel assemblies, control rods, and several types of instruments into the core.Coolant in the fuel channels also provides cooling for the energy deposited in the graphite moderator of the core region.In order to improve heat transfer from the graphite stack, the central segment of the fuel channel is surrounded by the 20 mm high split graphite rings (see Figure 2).These rings are arranged next to one another in such a manner that one is in contact with the channel and the other with the graphite stack block.The minimum clearance between the fuel channel and the graphite ring is 1.15 mm and between ring and graphite stack 1.385 mm [1].These clearances prevent compression of the fuel channel tube due to radiation and/or thermal expansion of the graphite stack.The graphite stack is located in hermetically sealed reactor cavity (see Figure 3), which is filled with a helium and nitrogen mixture to prevent the oxidation of the graphite [1].The failure of FC can occur due to pressure and temperature impact on channel walls.If the FC heats up while the internal pressure in RCS is elevated, it may expand until it contacts the surrounding graphite blocks [3].In the RBMK reactor, the deformation of fuel channels is arrested at rather modest uniform strain values due to contact of the deformed FC with surrounding graphite block.Experiments show that the contacted channel fails only if and when the graphite block is disrupted by the pressure load transmitted to it by the deformed channel.The load, which can be supported by the graphite block, was found to average at about 4 MPa [3].Hence, a potential for failure rapidly decreases at pressures below 4 MPa regardless of fuel channel wall temperature.At nominal pressure in FC (7-8 MPa), the temperature of fuel channel failure is not less than 650 The leak-tight reactor cavity (RC) performs the function of containment in the region immediately surrounding the nuclear fuel and graphite.The RC is formed by a cylindrical metal structure together with bottom and top metal plates.The reactor cavity confines the steam release in case of rupture of fuel channels.The steam-water-gas mixture from the reactor cavity is directed via reactor cavity venting system (RCVS) pipelines to two steam distribution devices of the 5th (upper) condensing tray in the accident localization system (ALS) (see Figure 3).Two pipelines d 400 that come from a branch pipe d 600 located above the top plate of RC are interconnected to a pipe d 600 which connects to one steam distribution device [1,4].In the same way, the other two pipelines d 400 from the top plate of RC are connected to the second steam distribution device.On their way these pipelines have branches, which are interconnected in a leak-tight corridor and end up with three membrane safety devices (MSDs).The blowdown pipes from the bottom of RC pass directly to the leak-tight corridor and also end up with three MSDs.
Unfortunately, in case of multiple ruptures of a significant number of fuel channels, the capacity of RCVS is not enough to remove steam-water-gas mixture from the reactor cavity.In this case, the pressure in RC starts to increase and lifting up the upper plate will lose the integrity of the reactor cavity.Then the integrity of the rest fuel channels would be lost as well.Such event would lead to severe consequences similar to Chernobyl accident.Therefore, the integrity of the reactor cavity is of high importance.The permissible pressure for RC is equal to 314 kPa (absolute pressure), that is the pressure of upper plate of biological reactor shielding weight [5].However, in the report [6], the more realistic value of permissible pressure for RC 400 kPa is presented.Thus there are two permissible pressures in reactor cavity: (1) 314 kPa-minimal permissible absolute pressure, (2) 400 kPa-maximal permissible pressure.
The reliability of reactor cavity in case of multiple ruptures of fuel channels was analyzed in the report [4].The coolant release rate through the rupture was calculated using RELAP5/MOD3.2code and the analysis of the RC response was performed using CONTAIN 1.1 code.The processes in reactor cavity (discharge of steam-water mixture from ruptured fuel channels into reactor cavity, evaporation of water due to contact with the hot surfaces of graphite stack, transfer of steam and gas mixture through pipelines of reactor cav- ity venting system into ALS, steam condensation in the condensing pool of ALS) were modeled.The performed analysis showed that under the most conservative assumptions the reactor cavity and its venting system could withstand simultaneous rupture of at least 11-16 FCs (see Figure 4).It is necessary to note that the analysis was performed for the case with RCS filled by coolant (the water levels in drum separators are nominal).Thus, after the FC rupture the steam-water mixture is discharged into the gaps of graphite stack.If the "dropout" model is used in CONTAIN 1.1 code, it is assumed that all the water released from the ruptured FC in liquid fraction leaves from RC to the water drain.If the "dropout" model is not used in CONTAIN 1.1 code, it is assumed that all not evaporated water remains in a dispersed condition, and it may be transferred into RC and through the pipelines into ALS.The last assumption leads to a higher calculated pressure in the RC (see Figure 4).

RELAP5 MODEL OF REACTOR COOLING AND REACTOR CAVITY VENTING SYSTEMS FOR RBMK-1500
To evaluate the response of reactor cavity and its venting system, the special RELAP5/MOD3.2model was developed.For the modeling of processes in reactor cooling system during DBA, the RELAP5 code is used in Lithuanian Energy Institute since 1993.This code, designed mostly for analysis of thermal-hydraulic processes in vessel-type reactors, has been adapted to simulate RBMK-1500 reactor.The simplified scheme of modeled objects is presented in Figure 5.
The RCS is simulated by one loop.Such model simplification is possible due to the fact that both real loops in the cooling system in the case of loss of long-term cooling are at the same conditions in reality.The intact (10 in Figure 5) and ruptured equivalent fuel channels (11 in Figure 5) are modeled by multiple axial and radial control volumes.Heat transfer among the equivalent fuel channels is approximated by means of heat exchange through the graphite moderator gaps to the reactor cavity gas circuit.In the developed model, not only the elements of reactor cooling system (DSs, MCPs,  pressure and suction headers, GDHs, steam lines) but also the reactor cavity and its venting system were modeled.As it is shown in the scheme, the steam-water mixture from the ruptured fuel channels (11 in Figure 5) is discharged into volume inside reactor cavity formed due to graphite stack deformation after steam-water mixture discharge (15 in Figure 5).This volume is connected using small gaps between graphite bricks between bottom, top, and lateral spaces in reactor cavity (14, 16, 17 in Figure 5).After the pressure increases in these volumes, the steam is discharged through the pipelines (18 in Figure 5) of RC venting system into ALS condensing pool (19 in Figure 5) by steam discharge device (21 in Figure 5).For simplification of the calculations it was assumed that condensing pool is filled with water and space above the condensing pool (20 in Figure 5)-with steam at atmospheric pressure and saturated conditions.If the pressure in RC and pipelines of RC venting system exceed 160 kPa (absolute pressure), the valves (22 in Figure 5) are opening.These valves modeled membrane safety devices.Developed model was tested comparing the calculation results with the results received using CONTAIN 1.1 code.For the benchmark, the cases of 6 and 12 ruptured fuel channels were selected.The calculated pressure increase in RC is presented in Figure 6.As it is shown in the figure, in both cases the RELAP5/MOD3.2calculated peak pressure is very close to pressure value calculated by CONTAIN 1.1 code without dropout model.This is because water is evaporating after contact with hot graphite and metal structures.After few seconds, the pressure in RC is decreasing because the MSDs are opening and capacity of steam discharge of RCVS is increasing.Any way, in case of simultaneous rupture of 12 FC, the minimal level of RC limit pressure (314 kPa) is exceeded.The power distribution of separate groups of fuel channels (power histogram) for maximum permissible reactor thermal power 4200 MW is presented in Figure 7.In RELAP5 model, eight equivalent fuel channels represent the reactor core.The equivalent fuel channels represent the heat generation in a group of real channels as well as hydraulic properties of this group.In case of station blackout, the overheating starts in fuel channels with higher power, thus more attention was attached for these groups of fuel channels.There are 2 channels with power 3.75 MW, 4 channels with 3.48 MW, 6 channels with 3.41 MW, 10 channels with 3.34 MW, and 22 channels with 3.29 MW (see Figure 7).

Response of reactor cooling system
The results of performed station blackout in RBMK-1500 analysis [2] showed that the water reserve in drum separators is evaporated within the first 2500 seconds.The nominal pressure in RCS is maintained by opening the main safety valves.In this initial period of accident, the reactor core is cooled by natural circulation in RCS.Later the remaining coolant in fuel channels is evaporating and channels are cooled in bubble mode.If no accident management measures are taken, 5000 seconds after the beginning of the accident the heat up of fuel elements and fuel channels begins.The faster temperature increase is observed in the fuel channels with the highest initial power level.The behavior of fuel, cladding, fuel channel wall, and graphite stack temperatures for fuel channel with average power level, in case of RBMK-1500 reactor blackout, without operator intervention are presented in Figure 8.The analysis, performed using RELAP5/MOD3.2code, demonstrated that after ∼11800 seconds from the beginning of the accident, more than 40 FCs with the highest initial power level could rupture.The steamwater mixture will be discharged into reactor cavity and the pressure in RCS starts to decrease (see Figure 9).
At time moment t > 12 000 seconds, the pressure in fuel channels decreases below 4 MPa.The FC walls, affected by internal pressure, are expanding until they contact the surrounding graphite blocks.The further failure of fuel channels is prevented by support of graphite blocks.Due to depressurization, the rest of water in pipelines below the core starts to boil.The steam is rising through the fuel channels, which leads to a short-term cooldown process.However, after few minutes the flow rate of steam is decreasing and the temperature of core components starts to increase again (see Figure 8).

Fuel channels response
The dependence between the fuel-channel rupture limiting temperature and pressure inside the channel for the heat up rate ≤ 1 • C/s was determined from experiments [3] as follows: In this equation, the unit of temperature T is • C, unit of pressure p is MPa.The comparison of channel rupture limiting temperature and peak FC wall temperatures for channels with different power, calculated by RELAP5, is presented in Figure 10.As it is seen from the presented figures, the failure of channels with 3.75 MW initial power appears at time t = 11 000 seconds.After the FCs rupture, the coolant through the rupture is discharged into the reactor cavity.The bottom part of fuel assembly (upstream the rupture) is cooled by boiling water from GDH side.The top part (downstream the rupture) is cooled by reverse flow of steam from DS side (see Figure 11(a)).Thus after the rupture, the coolant flow rate through the failed channel will be restored.After restoration of cooling, the peak fuel cladding and channel wall temperatures start to decrease (see Figure 11(b)).Because the temperatures of fuel cladding and channel wall are low, the geometry of fuel assembly remains without any changes, probably.After the rupture of two channels with higher initial power 3.75 MW at time moment t = 11 000 seconds, the overheating of remaining fuel channels with fuel assemblies is continued.The temperature limits for channels with 3.48 MW initial powe are reached at time moment t = 11 740 seconds.Rupture of these fuel channels leads to speed up the depressurization process.As it was already mentioned before, due to depressurization the rest of water in pipelines below the core starts to boil.The generated steam start is discharged through the failed channels into the RC, but some part of steam accesses intact channels.The coolant flow rate through intact channel with initial power 3.25 MW is presented in Figure 12(a).As it is shown in the presented figure, due to depressurization after rupture of few fuel channels, the coolant flow rate in single channel reaches 0.1-0.2kg/s.Such value comprises approximately 1.5-3% from nominal coolant flow rate.Because the RBMK channels are rather long, such small steam flow rate is not capable to cool down the reactor core within few seconds.As it is shown in Figure 12(b), the channel wall temperature in the bottom part starts to decrease after FCs rupture, while in the top part of channel the temperature is increasing.It is because the small steam flow rate through the channel transports the accumulated heat into upper part.The decrease of channel wall temperature in upper part starts only after approximately 60 seconds from the beginning of significant pressure decrease in RCS.Due to this phenomenon, after rupture of few fuel channels, the heat up process in channels with similar and little lower initial power is accelerated.As it is presented in Figure 13, the rupture of fuel channels with initial power levels 3.29-3.41MW will appear within a short-time period.The temperature of FC wall in channels with initial power level 3.25 MW is a little below the channel rupture limiting temperature.It was assumed in the modeling that the channels with initial power level 3.25 MW and below remain intact.Thus it was assumed that totally 44 channels will fail.
When the channel pipe wall is heated up at a high pressure in RCS, it can be deformed in a radial direction (i.e., to be ballooned) up to contact with the graphite block (see Figure 2).In this case, more heat is transferred from graphite through FC to the coolant.In addition, it is necessary to take into account that FC walls temperatures will decrease more slowly as in the case when channels geometry is without changes.

Reactor cavity response
The main challenge in reactor blackout case is the possible failure of reactor cavity.It is very important to maintain the pressure in reactor cavity below the maximal permissible pressure (400 kPa).
The total discharge of coolant into the reactor cavity from the ruptured fuel channels is presented in Figure 14.At first the rupture of two FCs with the highest initial power level 3.75 MW occurs.After approximate 700 seconds, the cascade failure of 22 FCs with initial power level up to 3.25 MW can occur.The discharged coolant increases the pressure in the reactor cavity.The rupture of two FCs leads to pressure increase in the RC up to 112 kPa (see Figure 15).After additional rupture of 4 FCs, the MSDs with activation pressure 160 kPa (absolute pressure) are opened.As it is shown in Figure 15, after the rupture of 44 fuel channels, the maximum pressure in RC reaches 600 kPa.Both (minimal and maximal) limiting pressures for RC are exceeded.Probably, RC integrity will be lost.
Thus the result demonstrated that the RCVS is not capable to remove a huge amount of steam in case of multiple ruptures of fuel channels due to overheating in station blackout case.Thus in station blackout case, the operators should start to depressurize the RCS manually before the ruptures of FCs begin.For the RCS depressurization, the steam discharge devices should be open manually.Operators should follow the water level in RCS or fuel temperature and do not allow reaching the FCs failure conditions.The results of performed calculations were used for development of severe accident management strategies at Ignalina NPP.

DISCUSSION ON MEASURES PREVENTING PROGRESSION OF TRANSIENT TO A SEVERE ACCIDENT
The performed analysis demonstrated that, in station blackout case, if no actions were taken from operators, the rupture of more than 40 fuel channels with the highest initial power level can occur.If this happened, the reactor cavity venting system would not be able to remove a huge amount of steam and the maximum pressure in RC would reach 600 kPa.This pressure value exceeds both (minimal and maximal) limiting pressures for RC.Probably, RC integrity will be lost.Such event would lead to very severe consequences: a large radioactivity release.
On the other hand, the RELAP5 analysis demonstrated that the dangerous level of fuel channel walls temperatures is reached only ∼11 800 seconds (3.3 hours) after the beginning of the station blackout.This long-time period specifies potential opportunities for the management of the accident consequences.
At first, the operators should start the RCS depressurization process to prevent rupture of fuel channels.Later, in case of station blackout it is possible to fulfill different nonregular means for reactor core cooling as follows.The first two measures for reactor core cooling have been discussed in [2].Because in the long-term the biggest part of the residual heat is accumulated in the graphite bricks and the pressure in the reactor cavity is close to the atmospheric, the direct water supply into reactor cavity looks a very sensible measure.Unfortunately, the performed analysis [2] showed that the gaps between graphite columns in the graphite stack are very small, graphite is hot, and supplied water does not reach deep lines of the graphite blocks.Thus this measure does not allow to cool down the center of the reactor core.Equipment and piping in the DS compartments have a rather large surface area: drum separators, steam header, part of the steam lines, part of the downcomers, steam-water piping, and part of the channels, which is above the core.During the normal operation, the maximum air temperature in DS compartments is ∼270 • C.However, the ventilation of these compartments by air is not enough effective.The performed analysis [2] shows that heat removal capacity in this case is ∼6-8 MW.These figures are small compared to the reactor decay heat.
The boron carbide (B 4 C) rods of control and protection system (CPS), which are used for reactor power control and shutdown, are placed in separated channels which are placed in the graphite stack.211 CPS channels are distributed evenly in the reactor core.The CPS channels are filled with water supplied by the low pressure system totally independent from the reactor cooling system [1].In case of station blackout, the water supply in the CPS rods cooling channels is interrupted due to loss of power to pumps.However, there is a possibility to connect the tank with artesian water to the bottom part of CPS channels.The supplied water starts to boil and vapour will escape from pipelines, connected to the top part of channels.The preliminary analysis performed using RE-LAP5/MOD3.2code shows that such cooling, when 211 CPS channels are cooled by saturated steam, allows to remove up to 15 MW of the generated heat from the reactor core.The decay heat, generated in the reactor, decreases down to such a power level only approximately 100 hours after the beginning of the accident.Thus the heat removal from the core through CPS channels in case of station blackout is not effective enough and cannot remove all heat from reactor core.But such restoration of water supply into CPS channels allows to slowdown the core heat up process and may be used in combination with other measures.
In [2], it was shown that the depressurization of RCS and the following water supply from nonregular means (low pressure sources) to the GDH in the case of loss of longterm cooling gives considerably better results compared with the others measures.It was recommended to use as a water source the hydroaccumulators, deaerators, and artesian water supply, which has independent power supply from plant.There are 16 hydroaccumulators (pressurized tanks) with total volume of 25 m 3 each, which is just more than half-full with water of ∼30 • C. The remaining part of the volume is filled with nitrogen gas at 9.8 MPa pressure.Approximately 170 m 3 of water could be used to replenish RCS coolant reserves.There are four deaerators, which contain 480 m 3 of water in one unit of RBMK-1500.Initial pressure in the deaerators is 1.2 MPa, water temperature is ∼190 • C. The artesian water can be used only after deep depressurization of RCS because the excessive pressure in artesian water supply lines is approximately 0.6 MPa and water temperature is ∼10 • C. Analysis results of plant blackout with water supply from emergency core cooling system accumulators and deaerators showed that this measure allows to avoid dangerous level of temperatures at least 5-6 hours after the beginning of the accident.Later the connection between RCS and source of artesian water can be arranged.The discussion about the selection of signals, which can be used by operators for indication of RBMK-1500 reactor core heat up process, is presented in [2].The preventive measures, which should be used is this case, also are discussed there.All mentioned measures are included in the severe accident management strategies at Ignalina NPP, which are currently developed.

CONCLUSION
The paper presents the analysis of loss of the long-term core cooling accident for RBMK-1500 reactor.The reactor model was developed using thermal-hydraulic state-of-the-art RE-LAP5/MOD3.2code.In the model, the elements of reactor cooling system, reactor cavity, its venting system, and condensing pool were modeled.
The performed analysis demonstrated that, in station blackout case, the multiple ruptures of fuel channels will occur.It is necessary to note that after the rupture of few fuel channels with the highest initial power, the coolant will be discharged from the cooling system that will lead to a pressure decrease in RCS.However, this depressurization is very slow and cannot prevent the rupture of other overheated FCs.
Totally, a rupture of more than 40 fuel channels with the highest initial power level would occur.
In this case, the reactor cavity venting system is not able to remove a huge amount of steam and the maximum pressure in RC reaches 600 kPa.This pressure value exceeds both (minimal and maximal) limiting pressures for RC.Probably, RC integrity will be lost.Such event would lead to very severe consequences: a large radioactivity release.
On the other hand, the dangerous level of fuel channel walls temperatures is reached only ∼11 800 seconds (3.3 hours) after the beginning of station blackout.This longtime period specifies potential opportunities for the management of the accident consequences.To prevent such catastrophic consequences, the operators should start to depressurize the RCS manually before the ruptures of FCs begin.Later, different possibilities to cool down the reactor core can be used.
The proposed measure "manual depressurization of reactor cooling system" was not included in the symptom-based emergency operating procedure.The results of performed calculations were used for the development of severe accident management strategies at Ignalina NPP.Currently, the special procedure for operators in case of loss of the longterm core cooling, which includes manual depressurization of RCS, is under development.

ALS:
Accident localization system, CPS: Control and protection system, DBA: Design basis accident, DS: Drum separator, FC: Fuel channel, GDH: Group distribution header, LOCA: Loss of coolant accidents, MSDs: Membrane safety devices, MCP: Main circulation pump, NPP: Nuclear power plant, PSA: Probabilistic safety assessment, RBMK: Russian acronym for "large power channel reactor", RC: Reactor cavity, RCS: Reactor cooling system, RCVS: Reactor cavity venting system.

Figure 4 :
Figure 4: Pressure in the reactor cavity as a function of a number of ruptured FCs [4].

Figure 6 :
Figure 6: Behavior of absolute pressure in RC in case of 6 and 12 FCs rupture.

Figure 9 :
Figure 9: Pressure behavior in the reactor cooling system.

Figure 10 :
Figure 10: Temperature of FC wall in channels with different initial power level.

Figure 11 :Figure 12 :Figure 13 :
Figure 11: (a) Coolant flow rate and (b) peak temperatures in failed fuel channel with initial power level 3.75 MW.
(i) Direct water supply into reactor cavity.(ii) Ventilation of DS compartments.(iii) Restoration of water supply into control and protection system rods cooling circuit.(iv) Depressurization of RCS and water supply from nonregular means (low pressure sources).