# Accident Management in VVER-1000

Authors: F. D'Auria; A. Suslov; N. Muellner; G. Petrangeli; M. Cherubini
Journal: Science and Technology of Nuclear Installations
 (2008)

---

## Abstract

The present paper deals with the investigation study on accident management in VVER-1000 reactor type conducted in the framework of a European Commission funded project. The mentioned study involved both experimental and computational fields. The purpose of this paper is to summarize the main findings from the execution of a wide-range analysis focused on AM in VVER-1000 with main regard to the qualification of computational tools and the proposal for an optimal AM strategy for this kind of NPP.


---

## Body

## 1. Introduction

Accident management,
as well as related terms “procedures” and “strategies” (instead of management),
constitutes a branch of the nuclear reactor safety. The understanding of the
meaning and the objectives of the AM branch requires the knowledge of the
safety/licensing concepts like design basis accident (DBA), beyond DBA (BDBA),
and severe accident (SA), as well as probabilistic safety assessment (PSA) and
role of human factors (HFs) within nuclear reactor safety. Based on this
terminology, the AM branch occupies a virtual region before or upstream the SA
area and aims at forming an additional boundary to the progression of accidents
that eventually escaped the DBA boundary. This is done consistently with
findings and requirements of the PSA branch, taking into account the HF, the
available NPP components and systems, and their actual status.The words
“procedure” and “strategy” should be distinguished based on their meaning on
the AM terminology. The word strategy is normally used at the level of AM investigation;
rather procedure is typically connected to the AM implementation process. In
the following, a set of AM strategies will be presented based on available
plants equipments.


## 2. Key Definitions and Background

The
following key definitions are at the basis of the AM activity performed within
the project [1].(1)AM: the taking of a set of actions during the evolution
of an event sequence to a BDBA to (a) prevent the escalation of the event into a
severe accident (preventive accident management measures), (b) mitigate the
consequences of a severe accident (SAMG), and (c) return the plant to a long
term safe stable state (accident termination procedures (ATP)).(2)EOP: a set of documents describing the detailed actions to
be taken by response personnel during an emergency. The plant specific
procedures contain instructions to operating staff for implementing preventive
accident management measures for both DBA and BDBA.(3)SAMG: a set of guidelines containing instructions for
actions in the framework of severe accident management (SAM), where SAM is a
subset of AM measures that (a) terminate core damage once it has started, (b)
maintain the capability of the containment as long as is possible, (c) minimize
on-site and off-site releases, and (d) return the plant to a controlled safe
state.Furthermore,
it is considered that suitable EOP is part of any NPP operator book. Deviations
from the EOP lines (e.g., failures outside the DBA boundaries or multiple
failures) established in the operator book bring the system constituted by the
NPP, the operators, and by whatever connected (e.g., control room, logics of
actuation, etc.) into the AM. In particular, the preventive AM procedures, measures,
or strategies aim at avoiding the loss of structural integrity for the core as
an ensemble (i.e., preventing the extraction of fuel bundles or the insertion
of control rods) and the damage of a significant number of fuel rods (typically
>10% of the total number in the core). The above core status is also
referred as “in a BDBA situation before extended degradation.” The terms
“preventive AM strategies” better identify and characterize the activities of
concern in this paper even though it is recognized that the term accident
management is used as a synonymous of preventive AM.The
background preparation for the AM study, other than the state-of-the-art
analysis for AM, implied the availability of computational tools (codes, nodalizations,
boundary conditions), the design and the execution of experiments, the
demonstration of code-nodalization quality, the availability of reference PSA
studies (though PSA was not a primary interest for the project), and the
availability of reference NPP information.The AM
study starts from the observation that the investigation area is very broad: a
large number of actions can be taken by operators utilizing several components
and systems ranging from the main coolant pumps (MCPs) to the boron tanks to the
pressurizer heaters and the spray lines; to the gas removal system to the
fire-work pumps; to the water stored in the FW lines; to the BRU-A and BRU-K
discharge. In order to limit the scope of the investigation, the attention was
focused toward station blackout situations and the use of nonenergized (at
least non large-energy consuming) equipments. Therefore, the depressurization
was selected as main strategy to be pursued following a multiple failure event
to bring the NPP to low pressure keeping the core geometric integrity. When at
low pressure, that is, below the set-point for actuation of the low-pressure
injection system (LPIS), two alternative targets were fixed depending upon the
availability or less of suitable LPIS flow rate; (a) in the former case, the
target is to show that primary system pressure remains at low values
notwithstanding the injection and that stable cooling conditions (including
nonrising pressure) are established; (b) in the latter case, the target is to
delay the time of occurrence of significant core degradation.The final
step of the activity consisted in optimizing the strategy including the
definition of key-operator actions and building up an AM strategy suitable for
implementation in NPP after having demonstrated the effectiveness. Secondary
system depressurization followed by primary system depressurization constituted
the skeleton of the selected AM strategy. The availability of the coolant in
the feedwater lines including the deaerator tanks was assumed. The
demonstration of capability of computational tools to deal with expected
phenomena, including data availability, was achieved. The step was completed
through performing the following activities:(i)
developing a procedure to optimize the design of an AM strategy;(ii)
optimizing the selected strategy that typically includes (a) steam generator
depressurization, (b) passive injection of coolant from the feedwater lines, (c)
primary system depressurization owing to heat removal from steam generators, (d)
continued primary system depressurization caused by delivering of accumulator
water, (e) continued primary system depressurization caused by the opening of
pressurizer relief valve (PORV) till the LPIS set point, and (f) achieving the
targets (a) or (b) of the previous paragraph;(iii)
applying the procedure with minor variants to the analysis of three BDBA scenarios
assumed in Balakovo Unit 3 VVER-1000 NPP also establishing the basis for
passing from an accident management strategy to a procedure.
The
designed strategy and the related AM procedure outline are well accepted by
Balakovo 3 NPP.


## 3. The Qualification Methods and the Role of Uncertainty

A key feature of the activities performed in
nuclear reactor safety technology is constituted by the necessity to
demonstrate the qualification level of each tool adopted within an assigned
process and of each step of the concerned process [2]. Computational tools are
used within the present context that includes (numerical) codes, nodalizations,
and procedures. Furthermore, the users of those computational tools are part of
the play and need suitable demonstration of qualification.The “global” qualification approach proposed by the University of Pisa, based on the UMAE
methodology,  has been adopted including
the tool (fast Fourier transform-based method (FFTBM)) “to measure” or to
quantify the quality of a calculation in specified situations. The
demonstration of code qualification implies the availability of qualified
nodalizations (and qualified users). Criteria and thresholds of acceptability
for calculation results at steady-state and at “on-transient” level are
introduced to this aim [3]. Code-user effect [4] and scaling issue are relevant
in this connection [2, 5].The
application of this methodology guarantees a suitable qualification level of
all the tools invoked in the AM strategy investigation. As stated before, to
study a complex system like an NPP a set of tools is necessary that at the end
constitutes the main instrument of the safety analysts. All those parts should
be qualified following a method able to ensure the reliability of the obtained
results.The code
have been qualified against experiments performed in a test facility, PSB-VVER,
which its correct scaling has been addressed (e.g., [6]) and demonstrated by
the comparison between experimental evidences. It should be mentioned that also
the experimental database against which the codes are usually validated needs
to be qualified. Within the mentioned EC funded project, the qualification of
the experimental data has been proven following among the other things a
quality assurance program. Emphasis should be put to the steps that brought to
the definition of the test matrix. A top-level scientists brainstorming is at
the basis of the design of all experiments trying to define suitable tests for
the code qualification and experiments of major interest for the AM point of
view.The
uncertainty (i.e., the process needed to associate errors to the prediction of
best estimate codes engaged in accident analysis) and its evaluation (i.e., the
capability to establish those errors) play a crucial role when a BE approach in
code application is followed. The BE approach means use of a BE code (relap in
the present contest) and use of BE boundary and initial conditions.At University of Pisa, a specific tool for the
uncertainty evaluation named CIAU has been developed (i.e.,  [2]). The CIAU is based on the accuracy
extrapolation from a database which contains a large number of code runs. Such
code calculations have been validated against experimental data and used to
“fix” the error expected when an NPP transient scenario is calculated.A necessary
condition for the estimation of uncertainty by the use of CIAU is constituted
by the availability of qualified experimental data.


## 4. The Experimental Database

In the area
of system thermalhydraulics the PSB-VVER is one of the largest facilities (integral
test facility (ITF)) put into operation with a power and volume scaling factor
equal to 1/300 [7]. Data from ITF are necessary to identify phenomena expected
in case of accidents in water-cooled nuclear reactors and to demonstrate the
qualification level of system codes. In addition, the PSB-VVER is the most
qualified facility for the study of the VVER-1000 and the only one in
operation. The created experimental database, applied to the AM study, consists
of four key parts: (a) the ITF description including test specific configuration
and description of components added for the execution of individual experiments,
(b) the results from the characterization or shake-down tests (pressure drops,
heat losses, volume versus height, etc.), (c) the logic of imposed events in
each experiment, and (d) the resulting sequence of main events and the time
trends of a significant number of quantities.Sixteen experiments are part of
the database. The actual quality of the database should be evaluated
considering that for each experiment at least one pretest and one posttest
analysis have been performed and are documented. In connection with the number
of time trends, about forty quantities are considered sufficient to identify
any scenario in ITF and more than two-hundred time trends have been recorded
and are available for each PSB-VVER experiment. An outline of the database can
be derived from Table1 [8].Table 1
Overview of the experimental activities, the
use of the experimental data, and the connection with the AM.
No.TestIdTest typeAdditional failureAM strategyAM set pointNote1Test 1LFW-25LOFWSS depressurization by SG1 and SG4 BRU-A opening aiming at
water injection from external source.T core exit = 350°C2Test 2LFW-28LOFW(1) SS depressurization by SG1 and SG4 BRU-A opening aiming
at water injection from external source.
(2) PS depressurization by PORV openingT core exit = 350°C
T core exit = 300°C & PS
pressure <16 MPa3Test 3PrzVS-01SB LOCAPORV stuck openHPIS interventionPS pressure = 8.8 MPaZaporozhye accident4Test 4CL-0.7-08SB
LOCAHPISSS depressurization by SG2 and SG3 BRU-A opening.T. rod surface = 450°C5Test 5SL-100-01SL break + PRISEHPISPS depressurization by PORV opening and SS cool down
procedure at 60 K/h.After 30 minutes6Test 6LFW-27LOFWPS feed and bleed procedure by PORV opening, HPIS, and LPIS
injection.After 30 minutes7Test 7BO-05SBOSS depressurization by SG1 and SG4 BRU-A opening aiming at
water injection from external sourceT. rod surface = 350°C8Test 8CL-0.5-03SB
LOCAHPIS & LPISPS feed and bleed procedure by PORV opening and make-up
system injection.T. rod surface = 450°C9Test 9PSh-1.4-05PRISEBRU-A stuck openSS cool down procedure with a rate of 60 K/h.After 30 minutes10Test 10NC-6NC——11Test 11CL-0.7-12SB
LOCAHPIS(1) SS cool down procedure with a rate of 30 K/h (2) 1 HPIS recovery.After 30 minutes
T core exit = 350°C12Test 12-1CL-0.7-11SB
LOCAHPIS & LPISSS cool down 30 K/h make-up system.After 30 minutes T. rod surface = 300°C13Test 12-2*CL-0.7-10SB LOCAHPIS & LPISSS cool down 30 K/h
make-up system.After 30 minutes
T. rod surface = 300°CTest repetition14Test 13*BO-06SBOSS depressurization by SG1 & SG4 BRU-A opening aiming
at water injection from external source.T. rod surface = 350°CSingle variant of test no. 7.15Test 14*PSh-1.4-07PRISESS cool down procedure with a rate of 60 K/h.After 30 minutesSingle variant of test no. 9.16Test 15*CL-0.7-13SB LOCAHPIS(1) SS depressurization by SG2 and SG3 BRU-A opening
(2) PORV opening.T core exit = 450°C
after 30 minutesSingle variant of test no. 4.*Additional test.The detailed description of all the
tests is beyond the purposes of the paper however it should be noted the
various types of initiating event taken into account. The experimental set
includes loss of feedwater (LOFW), small break loca (SBLOCA), PORV stuck open, primary
to secondary leak (PRISE), steam line (SL) break, and station blackout (SBO).
The operator actions tested to cope with such kind of accidents are almost
based on depressurization either secondary side or primary side. Different set
point to initiate such operations is also experimentally considered. Finally, the repeatability issue has been also accounted for, performing two times the same experiment [9].


## 5. The Key Results

The proposed strategy
suitable for implementation in existing VVER-1000 NPP is based upon(i)
depressurization of the
steam generators through the BRU-A and BRU-K, if needed,(ii)
delivery of the coolant stored in
the deaerator tanks to the steam generator(s) exploiting the driving force
constituted by the vaporization subsequent to the depressurization,(iii)
depressurization of the
primary system through the PORV and the gas removal system,(iv)
cooling of primary system
ensured (for a period) by accumulators.
All of this implies no
hardware changes in NPP and only introduction of suitable control logic for the
involved components (BRU-A, BRU-K, PORV, gas removal system, and FW line
valves). Therefore, assumed as 1 MEURO the daily operational cost of the NPP,
the cost for the implementation of the procedure are negligible. The result of
PSA studies performed in relation to PWR demonstrates that the consideration of
“passive” depressurization has the potential to reduce the risk of core melt
for a factor ten. However, the uncertainties for evaluating the risk will be
considered, and specific PSA analyses for VVER-1000 should be completed (both
of these activities are outside the project boundaries).Within the project activities,
[8, 10, 11], it has been demonstrated that the “grace period” (i.e., the
time period between the start of the accident and before a substantial core
degradation occurs) following a station blackout, including the failure of
diesel generators, for the selected VVER-1000 Balakovo NPP changes from about
two hours to more than ten hours if the considered AM strategy is implemented.
The key results from the application of the procedure are illustrated in Figure 1: the time when loss of geometric integrity occurs for the core is reported as
a function of the pressure at which the event happens. Each of the dots in
Figure 1 is the result of an “AM” optimization calculation performed with
reference to the Balakovo Unit 3 VVER-1000 NPP.Figure 1
“AM map” for VVER-1000 NPP following station
blackout.Following a station blackout
event including failure of emergency feedwater, any NPP has a “survival period”
that is typical of the order of two hours. This corresponds to the
yellow-region in the left part of Figure1. When AM procedures are applied, the
grace period (i.e., the survival time for the core) moves toward the right part
of the diagram. Furthermore, the failure may occur at low or at high pressure,
with the former situation being the preferable one from the safety stand point.Therefore the scenarios that are
identified by bullets in the bottom right part of the diagram are the
preferable ones and imply the demonstration of optimization for the selected AM
strategy. Additional information available from Figure1 includes the following.
(a) uncertainty in predicting failure time is represented by leaning violet bars;
(b) time span during which the PS pressure stays below 2 MPa is proportional to
the length of horizontal black bars; (c) violet bullets reported in the bottom
and top right of the diagram are “virtual” scenarios end points. These are
obtained assuming that all the coolant stored in the NPP at the beginning of
the transient is available to cool down the core assuming a constant PS
pressure of 4.5 MPa and 17.5 MPa, respectively.The final result can be
summarized as follows.(i)
NPP
failure time is expected at about 10000 seconds, that is, a bit less than three
hours without AM.(ii)
The
use of AM (without any energy needed, apart for proper actuation of valves)
“moves” the NPP failure time at about 45000 seconds, that is, at about 13 hours.(iii)
The
maximum theoretical failure time is estimated at about 65000 seconds, that is,
about 18 hours.


## 6. Conclusions

Various AM strategies were
investigated. However, the reference strategy for the project is constituted by
the depressurization of the steam generators followed by the primary system
depressurization that is actuated at an optimized time when the conditions of
“maximum subcooling” in the loop are achieved. In those conditions, coolant
loss from the primary system and depressurization rate are, respectively,
minimized and maximized.In between and as a consequence
of the two AM depressurisation actions, “passive bleed” of steam generators and of primary
loop occurs from deaerator tanks and from accumulators that is sufficient to
keep the core cooled with a suitable margin to DNB.The objective of the selected AM
strategy is two-fold: (a) to keep cooled the core for the longest time without
the availability of external energy sources, (b) to keep the primary system
pressure at the lowest level consistent with the first objective and with the
overall strategy to minimize the risk of primary system failure at high
pressure. The optimized AM strategy has been applied to the analysis of SBO
resulting in a large increase of the plant grace time.



---

*Source: 318956-2008-06-04.xml*