Ludwig : A Training Simulator of the Safety Operation of a CANDUReactor

This paper presents the application Ludwig designed to train operators of a CANDU Nuclear Power Plant (NPP) by means of a computer control panel that simulates the response of the evolution of the physical variables of the plant under normal transients. The model includes a close set of equations representing the principal components of a CANDU NPP plant, a nodalized primary circuit, core, pressurizer, and steam generators. The design of the application was performed using the object-oriented programming paradigm, incorporating an event-driven process to reflect the action of the human operators and the automatic control system. A comprehensive set of online graphical displays are provided giving an in-depth understanding of transient neutronic and thermal hydraulic response of the power plant. The model was validated against data from a real transient occurring in the Argentine NPP Embalse Rı́o Tercero, showing good agreement. However, it should be stressed that the aim of the simulator is in the training of operators and engineering students.


Introduction
A training simulator is a useful tool to improve and assess the human responses under typical normal and abnormal situations of any operator controlled system.The repeatability and consistency offered by computer simulation make it an ideal tool for setting a standard of operator competence.Particularly in the nuclear industry, after the Chernobyl accident, there has been an intensive effort to improve human performance at nuclear power plants (NPP) throughout the world.Today, most NPP are required to maintain a full-scope simulator for regular training and assessment of their operators [1].The standard specifies that an NPP Training Simulation System (TSS) shall be capable of accurately reproducing and predicting the operations and variable relationships within the reference plant [3].
TSS plays an essential role not only in operators training but also in the validation of operation procedures.Some of the main tasks identified to be supported by the TSS are [1]: (i) training on and testing of the control room humansystem interfaces, (ii) support the assessment of the control system functionality before the start-up of the plant, (iii) design and validation of operating and commissioning procedures, (iv) assistance of the continued training, assessment and certification of instructors/trainers and plant control room operators, Likewise, the main benefits of using a TSS are: (i) provision of a validated reference plant model for training and evaluation of operators, (ii) support for rapid evaluation of operating concepts and procedures prior to their implementation, (iii) improvement of the operators' knowledge of the coupling between the physical variables of the plant and the interaction with the control system, (iv) promotion the optimized operation of the plant during start-up, shutdown and recovery procedures, (v) complement on-site testing of the plant control system reducing operation and maintenance costs, (vi) assists in the operators' training under critical scenarios, dangerous to realize on real situations, (vii) supports the certification of operators in a safe environment, (viii) contributes to minimizing equipment damage and maximizing plant availability, (ix) contributes to the prevention of catastrophic failures due to human errors.
The International Atomic Energy Agency (IAEA) has provided an extensive documentation related to NPP training simulators [1][2][3][4][5][6][7][8].In particular, [3] provides guidance with respect to development, implementation and evaluation of training programmes for all NPP personnel, and Appendix 1 of [8] includes a list of IAEA publications related to training and human resource considerations for commissioning of NPP, while [7] categorizes training simulators according to the scope and objectives as the following.

Basic Principles Simulator.
A simulator that illustrates general concepts, demonstrating and displaying the fundamental physical process of a plant.The main goals of using a basic principle simulator are to help trainees understand fundamental physical processes, basic operation of complex systems, and the overall operation of a plant.
Full-Scope Simulator.A simulator incorporating detailed modelling of those systems of the referenced plant with which the operator interfaces in the actual control room environment.

Other-Than-Full-Scope Control Room Simulator (OTFSCRS).
A simulator that does not provide the same human-machine interface as does the plant to which it is referenced.The model of the plant thermohydraulic and neutronics characteristics may be the same as that of a full-scope control room simulator, or may be less comprehensive.Generally, for a simulator of this type, the human-machine interface is provided through computer-driven displays and either touch screens or mouse control of on-screen buttons.These displays and controls may be similar to those of the referenced plant, or may be simplified.
Part-Task Simulator.A simulator that may incorporate detailed modelling of a referenced plant but of only some systems or portions of systems, thereby enabling a trainee to be trained specifically on only parts of a job or task.
The present paper presents the development and implementation of the TSS LUDWIG, belonging to the OTFSCRS type, designed to train operators of the Argentine NPP Embalse, based in a model including a close set of equations representing the essential components of the plant.The design of the application was performed using the objectoriented programming paradigm, incorporating an eventdriven process to reflect the action of the human operators and the automatic control system.A comprehensive set of on-line graphical displays are provided giving an in-depth understanding of transient neutronic and thermal hydraulic response of the power plant.The model was validated against data from a real transient occurring in the plant, showing good agreement.

Plant Model
Embalse Nuclear Power Plant is a CANDU 600 Pressurized Heavy Water Reactor located at the shore of an artificial lake on Río Tercero, C órdoba, Argentina.It employs natural uranium, with heavy water for cooling and moderation.It has a thermal power of 2109 MWth and generates 648 MWe of electricity, with a net output of about 600 MWe.
The nuclear fuels are inside pressure tubes through which coolant circulates at elevated pressures.The coolant, after passing through the pipes of pressure, is sent to the steam generator, which transfers its heat to the secondary circuit, then returned to the reactor under the action of circulation pumps.
The mathematical model of the plant consists of a set of differential algebraic equations that was built according to the physical mechanisms involved in each component, based on previous works specific to the Argentine HWR plants [9][10][11].Table 1 details the main state variables used to represent the different components of the plant, and the main equations of each component are listed in Table 2.It should be stressed that the objective of this type of simulators is training of operators and plant safety inspectors on normal transients, not the design and accident analysis, for which appropriate codes are available (e.g., RELAP5).Central requirements of the former are fast execution and flexibility to perform parametric studies.The general features of the model are: (i) primary system divided in a finite number of nodes determined by the instructor, (ii) point reactor kinetics with two groups of delayed neutrons, (iii) axial cosine power profile in the core, (iv) variable-volumes model of the pressurizer, (v) lumped parameter model of the secondary side of the steam generators based on moving enthalpy nodes [12], (vi) steam line divided in a number of nodes determined by the instructor, (vii) lumped parameter model of the turbine, (viii) main control and safety systems relevant during normal operation [9].

Object-Oriented Implementation
The system was designed and implemented following the object-oriented paradigm, which provides properties of reusability and flexibility for further extensions.A one-toone correspondence between the objects of the simulator and the physical components of the plant was enforced (Table 1).
The description of the main objects is the following.Complete Core.The methods are responsible for the calculation of the reactor kinetics, the reactivity feedbacks and the corresponding control actions, power delivery to the coolant in the pressure tubes, and scram.This object provides the two main modes of operation control of the plant, namely, reactor following turbine and turbine following reactor.
Pressurizer.Controls the pressure of the primary system by means of the thermodynamic balance controlled by heaters and safety valves.
Steam Generator Pipe.Calculates the heat transfer from the primary to the secondary system, including the calculation of the downcomer level control.
Pipe.Represents the cold and hot legs of the primary system.
Core Pipe.Represents the pressure tubes of the reactor core.
Pump.Represents the primary pumps providing the pressure head that controls the primary flow rate.
Steam Line Cell.Represents the transport of steam from the steam generators to the turbine.
Turbine.Calculates the electric power output and the exit pressure of the turbine.
Condenser.Calculates and controls the residual thermal power.
Ludwig.Ludwig was implemented using Delphi which is a graphical programming language.The development of the application consisted of two parallel stages: development and coding of mathematical model using object-oriented programming and the development of a graphic interface Reactor control system Steam generators easy to manipulate.To ensure high accessibility and portability, a personal computer with Windows was chosen as platform.Delphi is a powerful and flexible graphical programming language that provides an efficient environment to develop user interfaces and engineering data display.Each component of the plant (pressurizer, core, pipes, etc.) was implemented in an individual class encapsulated with well-defined interfaces.Special modules (e.g., plant mimic, numerical calculation, and interactive control) were integrated to produce a closed and consistent system.This modular approach reduces the programming effort and the complexity of the design.Because each component is independent and self-contained with well-defined interfaces, it can be easily reused, saving time and effort in case of eventual extensions.The multithread technique was applied for CPU sharing between the system code and the graphic interface to ensure prompt response to the user's requests.Simulation codes like Ludwig produce large amounts of text-based outputs.In the case of complicated plant transients, it is not easy to obtain simply a clear understanding of the physical processes underlying this type of output data.Ludwig provides various graphical displays during a transient simulation.This group is designed with two sheets: "plant mimic" and "calculation data, trend graph, and trip event control".Figure 1 shows the home window of Ludwig, consisting of a main tool bar and two visualization modes, namely: a set of user controlled popup windows displaying of the variables required by the user and a plant mimic providing integral visualization.The users can control the visualization and the execution by means of the main tool bar, where buttons for run, stop, pause, restart, and replay are provided.In addition a snapshot function similar to the restart function is available, which does not have a fixed frequency for saving the data.
The plant mimic module is designed to examine the major output variables through a user-designed plant mimic as shown in Figure 1.The mimic is equipped by elementary graphic display units, such as digital meters, level gauges, and dial meters.The indicators added to the background image are mapped one by one with the specific output variables that were selected for experts.
Figure 2 shows the "calculation data" sheet, designed to display numerical values of variables of interest for the user, which can be selected from a tree-view list.The output variables are updated at every calculation time step.In addition, users can check the value of a selected variable in the status bar by locating the mouse cursor on the specific node.
A set of graphic windows show the transient behaviour of selected variables with time.The user can specify variables in the code input data before the simulation, and also can interactively ask for additional graphs during the simulation by clicking the right button of the mouse on the sheet (left in Figure 2).Multiple variables can be displayed in a single graphic window, and the number of trend graph windows is not limited.The scales of the axis are automatically adjusted during the simulation.

Validation of the Model
The simulator was validated against experimental data recorded during two different normal transient of the NPP Embalse Río Tercero.The first event took place on December 1988 with the reactor operating at nominal power.A failure of the power supply affected a control bar introducing a constant reactivity input of 0.45 mk/sec, and simultaneously two of the main primary pumps went out of service.Data of the response of the neutronic power and the pressure at the exit headers of the pressure tubes is available for 40 seconds.Figure 3 shows the evolution of the reactor power and the primary pressure.The event begins at t = 10 sec.There is a Generador 1 Generador 2 Tiempo 3,000,000,000 2,500,000,000 2,000,000,000 1,500,000,000 1,000,000,000 500,000,000 0 10 20 30 40 50 60  power peak of 115% of the nominal value lasting about 1 sec.The latter triggers the reactor scram, which in turn induces a switch of the operation mode of the plant from normal to alternative.Due to the negative reactivity injection during the scram the power decreases to 5% of the nominal value in 35 sec.On the other hand, the pressure rises due to the power increase and the loss of flow.This triggers the opening of the pressurizer valves, but only when the power decreases the primary pressure decreases.Later, when the power reaches 5% of the nominal value, the response of pressure control system can be appreciated.It can be seen that the comparison with the plant data is very good.Figures 4 to 6 show the evolution of different relevant variables illustrating the response of the plant during the transient.The primary flow rate (Figure 4) decays in 20 seconds to its half value following to the loss of two of the primary pumps.The total reactivity is dominated by the scram system (Figure 5).The decomposition in the temperature and void contributions shows the influence of the physical variables on the neutronic response.The pressurizer level is reduced due to the pressure drop of the primary system (Figure 6).The "bump" at 20 sec is a consequence of the control action of the heaters.
Figure 7 shows the response of one of the steam generator during the transient.Due to the switch of control mode to turbine-following-reactor, the turbine power demand decreases, and, consequently, the feedwater and steam flows also decrease.The level of the steal generator decreases due to the decrease of the primary temperature and the secondary pressure.
The second event occurred on February 1984 with the reactor operating at 88% of nominal power.This time a failing control bar introduced a constant reactivity input of 0.35 mk/sec.The evolution of the primary and secondary variables are depicted in Figures 8 and 9, showing similar trends as the 1988 event.

Conclusions
The training simulator Ludwig of the CANDU Nuclear Power Plant Río Tercero was presented.The system was   completely designed and implemented following the objectoriented paradigm in Delphi language, providing graphical interfaces to assist the learning process.The mathematical Reactivity response during the event of positive reactivity insertion.Reactivity due to control failure (dash red), scram system (solid red), coolant temperature (solid blue), void (dash blue), fuel temperature (dash black), and total reactivity (solid black).validated against real data of safety shutdown events of the plant, showing good agreement.Due to the flexibility of the code, it can easily be extended to other CANDU plants, and also it can be coupled with more sophisticated codes like RELAP5.Power transferred to the lake Q p :

Nomenclature
Fraction of power transferred from the primary to the secondary side of the steam generator Q TH : Net power transferred to the coolant s: S p e c i fi ce n t r o p y t: T i m e T R : Coolant temperature T C : F u e lt e m pe ra t u r e V p : Primary volume v L : S p e c i fi cl i q u i dv o l u m e v V : S

Figure 1 :
Figure 1: Ludwig mimic interface of the plant.

Figure 2 :
Figure 2: Ludwig graphic window.Tree of variables (left) and display of data (right).

Figure 3 :
Figure 3: Event 1. Reactor power (•) and primary pressure (•) responses to a positive reactivity injection and the loss of two primary pumps.The curves correspond to the simulation results.

Figure 4 :Figure 5 :
Figure 4: Evolution of the primary flow rate showing the effect of the primary pumps failure during event 1.

Figure 8 :Figure 9 :
Figure 8: Event 2. Reactor power (•) and primary pressure (•) responses to a positive reactivity injection and the loss of two primary pumps.The curves correspond to the simulation results.

Table 1 :
List of components and variables of Ludwig.
c : Residual thermal power Condenser

Table 2 :
Main equations of each component of the plant.
p e c i fi cv a p o u rv o l u m e W: Flow rate W a : Feedwater flow rate to the steam generator W b : Discharge flow rate to the condenser W b1 , W b2 : Flow rates of the primary pumps W CC : : Reactivity associated to the fuel temperature Γ TR : Coolant temperature reactivity coefficient Γ TC : Fuel temperature reactivity coefficient Γ V : Void reactivity coefficient α: Voidfraction α V : Void fraction in the pressurizer vapour zone α L : Void fraction in the pressurizer liquid zone ρ f : Saturated liquid density η: Efficiency τ c : Characteristic time delay. TC