Modes with violation of the reactor plant cooling conditions on the primary circuit side of a VVER reactor were simulated using the TRAC-PD2 and Open FOAM thermohydraulic codes (TRAC-PD2 1981, OpenFOAM User Guide Version 1.6. 2009, OpenFOAM Programmer’s Guide Version 1.6. 2009) based on energy and mass conservation equations for the three-dimensional unsteady flow of a two-phase mixture. Coupled simulation of the dynamics of neutronic and thermohydraulic processes (TRAC-PD2 1981, OpenFOAM User Guide Version 1.6. 2009, OpenFOAM Programmer’s Guide Version 1.6. 2009, Bolshagin et al. 2009, Galanin 1971, Weinberg and Wigner 1961, Ovchinnikov and Semenov 1988, Report LA-UR-03-1987) aims to improve the qualitative understanding and the quantitative presentation of their effects on safety.

Investigating these modes using the above thermohydraulic codes makes it possible to analyze the course of transients and certain emergency processes without using the industrial testing method, this providing the basis for solving the problems of ensuring the reliability, operational safety and efficiency of nuclear power plants.

A modern nuclear reactor is a complex system studying and calculating which requires more than the use of simple theoretical models. Thermohydraulic calculations are an essential part of most engineering and technological development works in nuclear power. Since, in conditions of an NPP, no technologically conventional way can be used to verify and update the results and findings of an a priori analysis on the basis of commercial tests, investigations based on codes are used in some cases as the tools to study and predict the parameters of thermohydraulic processes in the reactor’s circulation circuit.

The main purpose of the study is to calculate and investigate, based on codes, modes with violation of the reactor plant cooling conditions on the primary circuit side of a VVER reactor in order to determine if calculated parameters conform to the acceptance criteria established by regulatory documents.

Mode, pipe break, failure of heat removal, reactor plant, pressure, stop valve, departure from nucleate boiling, safety factor, high-speed dump valves with discharge to atmosphere (HSDV-A)

Safe operation of a reactor plant requires accurate and timely information on the parameters of its status.

The primary and the secondary circuits of an NPP with the VVER-1000 reactor are interconnected, and a variation in the primary circuit parameters may lead to an anticipated operational occurrence, in particular, to the reactor cooling and a disturbance in the secondary circuit with further development of malfunctions capable to result in an accident. A safety analysis of the NPP makes it possible to identify the malfunctions caused by the reactor core cooling due to a variation in the coolant flow rate. The conditions for ensuring the thermohydraulic reliability of non-boiling (VVER, PWR) and boiling (RBMK, BWR) water-cooled power reactor cores have a special role (Weinberg and Wigner 1961, Ovchinnikov and Semenov 1988, Report LA-UR-03-1987, Safety of Nuclear Power Plants 1994, V-320 Reactor Unit 1987). Besides, the history of nuclear power shows that scarce knowledge on heat exchange on the fuel surface and on hydrodynamics is one of the causes for the occurrence and progression of accidents at NPPs (Safety of Nuclear Power Plants 1994, V-320 Reactor Unit 1987). Therefore, studies into thermophysical and thermohydraulic processes in nuclear power systems form the required basis for decision-making with respect to safe NPP design, repair and operation. The paper presents the results of a computational accident analysis. Calculations were performed for the conditions of operation at the rated reactor power level with regard for its determination and maintenance error which amounts to 4% of the rated power value (3120 MW) (NP-001-15, Afrov et al. 2006, Kirillov and Bogoslovskaya 2000, Kirillov et al. 2010).

A mode with a primary circuit pipe break of the equivalent diameter not less than 100 mm (Dn100) in the cold leg of the main circulation pipeline (MCP) is considered the most dangerous one, in terms of the core thermal state, in the range of potential small breaks. This mode involves the primary coolant circulation failure and formation of hydraulic locks in the U-shaped portions of the MCP’s cold legs (Afrov et al. 2006). Apart from the Dn100 pipe break, consideration may be given to the whole range of breaks with smaller diameters but such situations will be less acute, so the most hazardous of these is considered (Afrov et al. 2006, Kirillov and Bogoslovskaya 2000, Kirillov et al. 2010, Kuznetsov 1989, Kutepov et al. 1986, Petrosyants 1981, Petukhov and Polyakov 1986).

The mode is classified as a design-basis accident and is characterized by the following:

– a decrease in the reactor coolant pressure;

– a decrease in the pressurizer level;

– a pressure increase in the containment.

Improving and extending the service life of effective NPPs and developing new-generation designs with passive safety systems, etc., require an in-depth computational analysis of standard modes, transients, and design-basis and beyond-design-basis accidents at NPPs with the use of codes (Petukhov 1993, Galin and Kirillov 1987, Belozerov et al. 2008, Kazantsev et al. 2009, Bolshov and Strizhov 2006, NUREG/IA-0471, RELAP5/MOD3 1995, LSDyna).

A break in the cold leg of the main circulation pipeline at the reactor inlet may involve the coolant escape through the break, a decrease in the primary circuit pressure, and a reduction in the coolant inventory in the reactor.

It is assumed that the MCP break is accompanied by the NPP blackout which results in the loss of power supply to the reactor coolant pumps (RCP) and their mechanical rundown. The coolant flow rate through the core decreases and the core heat removal worsens. With no special measures taken, this may lead to the fuel and cladding heat-up and further melting (Afrov et al. 2006).

The safety systems the design includes ensure the reactor shutdown, post-emergency cooling of the core, and transfer of the reactor plant into a safe state.

The reactor power reduction from the initial value to the decay power level is ensured by the reactor emergency protection (EP).

The emergency core cooling system (ECCS) is responsible for the compensation of the primary coolant leakage and the core cooling during loss-of-coolant accidents. The ECCS consists of

– a passive portion which includes the ECCS tank system; and

– an active portion which includes the emergency and scheduled cooldown system.

This mode may involve the primary coolant circulation failure and formation of hydraulic locks in the U-shaped portions of the MCP’s cold legs. The circulation failure is identified from the amount of the separated primary circuit water at the time when its level coincides with the upper generatrix of the reactor’s upper nozzle.

The emergency mode with a Dn100 pipe break in the MCP’s cold leg is analyzed with regard for the plant blackout taking place additionally at the time of the accident start as the most favorable time for the potential departure from nucleate boiling to occur.

Table 1 presents the chronological sequence of events (actuation of systems and devices), as well as the interlocks and setpoints leading to this actuation for the accident under consideration (Safety of Nuclear Power Plants 1994). The following equipment failures were taken into account in the analysis:

Table 1.Download as CSV 

Actuation sequence of systems ad devices (initial event – a Dn100 pipe break in the MCP’s cold leg).

Time, s	Event	Cause of event
0	Trip of	Loss of power supply from all external and internal ac sources (unit blackout)
	– all RCPs;
	– the secondary circuit’s main and auxiliary feedwater systems;
	– the primary circuit’s makeup and blowdown system;
	– HSDV-As;
	– the pressurizer system power supply
1,4	Generation of the EP actuation signal	Unit blackout
1,9	Control members start to move	EP action
2	Start of diesel generators (DG) and their stepped loading	Unit blackout
6	Closure of the turbine generator stop valves	EP action
14	HSDV-A opening	HSDV-A opening setpoint (7.154 MPa) reached
40	Start of the emergency boron injection and emergency cooldown pumps	Unit blackout
80	HSDV-A closure	HSDV-A closure setpoint (6.27 MPa) reached
95	Start of boric solution supply to pipelines of loops 1, 4 by emergency injection pumps	Primary circuit pressure of 7.8 MPa reached
120	Start of emergency feedwater supply to SGs 1, 4	Stepped DG loading program 900 mm SG water level reduction against rated value
190	Start of boric solution supply to reactor from ECCS tanks	Reactor pressure of 5.88 MPa achieved
428	Start of boric solution supply to the cold and hot pipelines of loops 1, 4 by emergency cooldown pumps	Primary circuit pressure of 1.02 MPa reached
1250	Termination of emergency feedwater supply to SGs 1, 4	150 mm SG water level increase against rated value (2.4 m)
1670	Termination of boric solution supply to reactor from ECCS tanks	Emptying of ECCS tanks
4200	Emptying of tanks with boric solution	Emergency boron injection and emergency cooldown pumps switched over to the sump
16000	End of modeling

– sticking of one most efficient control member at the uppermost position;

– a failure of one active ECCS component (one high-pressure pump and one low-pressure pump).

The initial accident stage is characterized by major disturbances in the primary coolant parameters. The maximum flow rate at the initial instant of the emergency process (P = 16.0 MPa) is 1020 kg/s. The highest pressure decrease rate in the primary circuit takes place in the initial 95 s of the accident during which the pressure goes down from 16.0 to 7.8 MPa.

After the accident starts, the EP actuation takes place and the reactor power decreases to the decay heat level in response to the blackout with a delay of 2 to 3 s. The RCP rundown starts. Due to the depressurized primary circuit, the pressure in it decreases rapidly which causes the coolant to boil (the coolant starts to boil in the reactor’s upper mixing chamber approximately at the 40^th second, and the coolant starts to boil in the reactor’s lower mixing chamber approximately at the 95^th second). This lead to a decrease in the primary circuit pressure drop rate. The coolant flow rate through the break is higher than the flow rate from the emergency boron injection pumps. This causes a decrease in the primary coolant inventory.

After the respective pressure setpoints are reached, boric solution starts to be fed into the primary circuit from safety systems

– by two emergency boron injection pumps, from tanks with the borated water inventory (at the 95^th s) when the pressure in the MCP’s hot and cold legs decreased to 7.8 MPa;

– from two ECCS tanks into the lower mixing chamber (LMC) and from two tanks into the upper mixing chamber (UMC) at the 190^th s when the pressure in the reactor decreased to 5.88 MPa. After the ECCS tanks are emptied, the ECCS pumps are switched automatically over to the intake of the coolant accumulated in the sump with its supply to the primary circuit;

– by two emergency cooldown pumps from tanks with the borated water inventory (at the 428^th s) when the pressure in the MCP’s hot and cold legs decreased to 1.02 MPa.

The operation of accumulators in this mode in conditions of a sufficiently high content of steam in the circuit and the Dn100 pipe break leads to the coolant separation and the circulation failure in the MCP. The primary coolant natural circulation fails at the 7^th minute of the process with formation of hydraulic locks in the U-shaped portions of the MCP’s cold legs.

In all of the considered modes, however, the maximum fuel and cladding temperatures do not exceed the values for normal conditions of operation (1990 and 350 °C respectively). No departure from nucleate boiling occurs on the fuel surface. No steam-zirconium reaction threshold is reached throughout the emergency process.

Figs 1–4 present diagrams of variations in the core pressure, in the core and ECCS flow rates, and in the coolant density and levels.

Due to the depressurized primary circuit, the pressure in it starts to drop rapidly (see Fig. 1) which leads to the coolant boiling in the mixing chambers, initially in the upper chamber and then in the lower chamber. The boiling causes the density of the steam-water mixture to vary as well (Fig. 3). Further, due to this, the primary circuit pressure decrease rate becomes smaller. The coolant flow rate through the break exceeds the flow rate from the emergency boron injection pumps (see Fig. 2). This, along with the presence of the steam-water mixture, leads to a decrease in the amount of the coolant in the primary circuit (see Fig. 4).

Figure 1. 

Coolant pressure at the core outlet (1) and in the pressurizer (2).

Figure 2. 

Coolant flow rate through the break (1) and total coolant flow rate from the ECCS (2)

Figure 3. 

Average core coolant density

Figure 4. 

Water volume in the primary circuit (1) and in the reactor (2) (in the event of a break with an equivalent diameter of 100 mm at the reactor inlet).

The fulfillment of the acceptance criteria is analyzed in accordance with the following list (V-320 Reactor Unit 1987).

Criterion 1. The pressure in the primary coolant system and in the steam generator steam lines shall not be more than 15 % higher of the design value, that is, the primary and secondary coolant pressure shall not exceed 20.24 and 9.02 MPa respectively. The coolant flow rate through the break exceeds the flow rate from the emergency boron injection pumps.

As shown by the calculation results for a small break in the Dn100 primary circuit, the primary coolant pressure throughout the emergency process does not exceed the design value. The maximum secondary coolant pressure does not exceed the HSDV-A opening pressure (7.154 MPa).

Therefore, the limiting primary and secondary coolant pressure values are not reached and the acceptance criterion is met.

Criterion 2. The absence of instantaneous fuel failure is checked using the following design requirements:

– fuel pellets do not melt even locally;

– the radially averaged enthalpy of the fuel pellet shall not exceed 840 and 963 J/g for irradiated and fresh fuel respectively.

Since the values of the maximum fuel temperature in the fuel element do not exceed their original (initial) values throughout the emergency process and the radially averaged enthalpy of fuel does not exceed the threshold value, the requirements of the criteria are met.

The analysis of the calculation results has shown that the conditions of heat exchange in the core throughout the emergency process are such that there are no preconditions for the following requirements to fail to be fulfilled:

a) the maximum fuel cladding temperature achievable in emergency conditions shall not exceed 1200 °C;

b) the cladding local oxidation depth shall not exceed 18 % of the initial thickness;

c) the share of the reacted zirconium shall not exceed 1 % of its mass in the fuel cladding;

d) the estimated variation of the core geometry (cladding deformation and fuel failure) is such that post-emergency cooldown of the core is possible;

e) the CPS rod melting shall not take place even locally; the movement of the CPS rods in the reactor shall not fail due to potential deformations in fuel assemblies, the CPS rods and in-core devices;

е) interaction among different FA components shall not lead to the melting of these components;

f) such safe state of the core shall be achieved at which conditions are created for keeping the reactor in a subcritical state, for its post-accident cooldown, and for disassembly of the core and the reactor internals.

The primary coolant system is kept safe, that is, short-term and long-term cooling of the core is achieved.

Design-basis accidents have been analyzed for the time period from the start of the initial event to the time the equipment cooldown parameters are reached with steady operation of safety systems. The calculation results show that the reactor core is flooded with cooling water and the fuel and cladding temperature do not exceed the initial value throughout the emergency process. If all design limits of the emergency core cooling are observed, acceptance criterion 3 is met.

Criterion 3. The pressure in the primary coolant system and in the SG steam lines is kept lower than the permissible design limits given the potential brittle failures and changes in the viscous properties.

The results of the computational safety analysis show that the above acceptance criteria are fulfilled in this mode.

Figure 5. 

Maximum temperatures: 1 – fuel; 2 – fuel cladding.

A thermohydraulic analysis has been performed for a design-basis accident with a small primary circuit pipe break of the equivalent diameter not less than 100 mm for the V-320 reactor plant.

The core parameters, including the neutronic characteristics, were selected such that to ensure that conservative results are obtained in terms of the analyzed acceptance criteria.

The analysis has shown that

– the acceptance criteria that characterize the reactor plant safety are met in the considered accident;

– protective automatic actions of safety systems bring the reactor plant into a controlled safe state.