Abstract
Measured plant data from various abnormal events are of great importance for code validation. The purpose of the study was to validate the RELAP5/MOD3.3 Patch 03 computer code with the abnormal event which occurred at Krško Nuclear Power Plant (NPP) on April 10, 2005. The event analyzed was a malfunction, which occurred during a power reduction sequence when regular periodic testing of the turbine valves was performed. Unexpected turbine valve closing caused safety injection signal, followed by reactor trip. The RELAP5 input model delivered by Krško NPP was used. In short term, the calculation agrees very well with the plant measured data. In the long term, this is also true when operator actions and special plant systems are modeled. In the opposite, the transient would progress quite differently. Finally, the calculated data may be supplemental to plant measured data when the information is missing or the measurement is questionable.
1. Introduction
Usually the validation has been performed using experimental data from scaled-down test facilities. Several code assessments of best estimate codes using experimental data were reported in the literature [1, 2]. An overview on the use of experimental data in nuclear reactor thermal hydraulics is given in [3]. Validation activities for thermal-hydraulic system codes and scaling issues are concisely described in [4]. It is stated that for validation purposes are important especially validation matrices of separate effects test and integral test facilities. It is also noted that the data from NPP can be used, if available, and that the data obtained are the ones recorded by the system of control of the plant. Typically, real plant data are limited mostly to operational events such as malfunction of valves, pumps, or other components, resulting in complex plant response [5–8]. However, real plant data are full scale and have true geometry; therefore they are of great importance for code validation and for better understanding of the unit response to deviations from normal operation.
In this paper an abnormal event, which occurred at Krško Nuclear Power Plant (NPP) on April 10, 2005, has been studied with the RELAP5/MOD3.3 Patch 03 computer code [9]. For the analysis the RELAP5 input model delivered by Krško NPP was used. This is a full two-loop plant model including major components of the primary and secondary system. The limitations of the delivered model for this transient were that the secondary side was modeled up to the turbine only and that no auxiliary systems consuming steam after transient were included. Namely, the steam flow is very important for the behavior of the secondary pressure and consequently the primary pressure. Both pressures dictate the operation of the control and safety systems. The analysis was performed for uprated power conditions (2000 MWt) with new steam generators and cycle 21 settings, corresponding to the plant state after outage and refuelling in September 2004.
A malfunction occurred during a power reduction sequence when regular periodic testing of the turbine valves was performed. This caused plant trip, while all the safety systems responded according to the design specification, so the event caused no hazard to the environment or plant staff and did not challenge the plant safety. The scope of the analysis was to analyze the transient and compare the results with calculations.
The analysis was divided into five phases. The first four phases were performed to obtain steady-state conditions. In the first phase steady state at 100% power level was demonstrated. In the second phase the power was reduced from 100% to 91.72% level. In the third phase one cycle of turbine governor valve closing and opening was simulated in order to obtain as close as possible initial conditions. In the fourth phase the steady state at 91.72% was verified by comparing calculated initial conditions with plant data, which were available for 53 seconds before the transient start. Finally, in the last phase the transient was analyzed for 1825 seconds as the measurement was stopped at that time.
2. Input Model, Event, and Analysis Scenario Description
For the abnormal event analysis the RELAP5/MOD3.3 Patch 03 computer code released in April 2006 was used. The basic RELAP5/MOD3.3 thermal-hydraulic model uses six equations: two mass conservation equations, two momentum conservation equations, and two energy conservation equations. The system of basic equations is enclosed with empirical correlations. For more details the reader is referred to [9].
2.1. RELAP5 Input Model Description
To perform the analysis, Krško NPP has provided the qualified base RELAP5 input model, so-called “master input deck,” which has been used for several analyses, including reference calculations for Krško full scope simulator verification [10–12]. The simplified scheme of the Krško NPP nodalization is presented in Figure 1. A full two-loop plant model, delivered by Krško NPP, has been used for the analysis. It includes the new Siemens-Framatome replacement steam generators type SG 72 W/D4-2. The analysis was performed for uprated power conditions (2000 MWt) with new steam generators (SGs) and cycle 21 settings, corresponding to the plant state after outage and refuelling in September 2004.
The model consists of 469 control volumes, 497 junctions, and 378 heat structures with 2107 radial mesh points. Modelled are important components as the reactor vessel, pressurizer surge line, pressurizer (PRZ) vessel, pressurizer spray lines and spray valves, pressurizer power operated relief valves (PORV), and safety valves. Primary piping includes hot leg, primary side of steam generator by inlet and outlet plenum, among which a single pipe is representing the U-tube bundle, intermediate leg and cold leg with reactor coolant pump (RCP). Loops are symmetrical except for the pressurizer surge line and chemical and volume control system connections layout (charging and letdown). Modeled is emergency cooling system (ECCS) with high-pressure injection system (HPIS), accumulators, and low-pressure injection system (LPIS).
The parts of the steam generator secondary side are represented by riser, separator and separator pool, downcomer, and steam dome. Main steamlines have main steam isolation valves (MSIVs), SG relief, and safety valves. Turbine valve and steam dump flow are regulated by corresponding logic. Main feedwater (MFW) piping is modelled till the MFW pump, which is modelled as time-dependent junction. Auxiliary feedwater (AFW) is injecting above the SG riser.
Besides, a considerable number of control variables and general tables are part of the model. They represent protection, monitoring, and simplified control systems used only during steady-state initialization, as well as main plant control systems: rod control system, pressurizer pressure control system, pressurizer level control system, steam generator level control system, and steam dump.
The plant protection systems defined using trip logic include reactor trip, safety injection (SI) signal, turbine trip, steamline isolation, main feedwater isolation, and auxiliary feedwater start.
2.2. Event Description
The Krško NPP technical specifications required that the turbine overspeed protection system will be demonstrated operable at least once per 31 days by cycling each of the high pressure turbine governor and stop valves trough at least one complete cycle from the running position. The test procedure consists of two steps. In the first step the turbine (and by this reactor power) must be reduced below 92% to fulfil the test conditions. In the second step the test of turbine governor and stop valves is performed.
In the first step the turbine power is reduced until governor valve number 4 is closed. Then the turbine power is reduced for another 7% until the nuclear power is less than or equal to 92%. Then the closure of governor valves is changed from sequential to single mode of operation. The position of governor valves is checked to be less than or equal 35% of opening. On the opposite, the power should be additionally reduced before the test start.
In the second step of testing turbine valves, the allowed maximum position of governor valves is defined to be 55% of opening. To fulfil this, “valve position limit display” button is pushed to read “flow demand” and “valve position limit.” Then the valve position limit is raised to 160% and valves are tested one by one. The valve is first closed and then opened to its initial value. When all valves are tested, the valve position limit is decreased to the value at test start (less than or equal 35% of opening). When lowering valve position limit, the value should not be below “flow demand” value. On the opposite, the governor valves start to close. In the case of the above-described event these really happened. The valves were closing for 5 seconds from 35.5% to 12.2% position, then stabilized for 12 seconds, and after that the position starts to increase to 14%, followed by full valve closure. The valve positions indicate that the operator sets the valve position limit below flow demand and after 16 seconds he tried to restore the turbine flow. This resulted in reactor trip in next 2 seconds or less (it should be noted that data were available for each 2 seconds). Setting the valve position limit below the flow demand was the first operator error. When operator noticed decreased electrical power output he tried to correct the setpoint to the desired (higher) value but he was not aware of the steam dump operating. The increased steam flow demand resulted in the high steam flow causing the steam generator pressure drop, therefore the SI signal was generated on low steamline pressure. On SI signal the reactor trip signal was generated followed by turbine trip. SI signal started also both AFW pumps with 25 seconds delay.
The measured data were available for 1878 seconds and were sampled every 2 seconds. The data for the first 52 seconds represent the steady state while at 54 seconds the governing valves were already closing indicating that the transient started. Therefore, it was assumed that governor valves started to close at 53 seconds. This time is transient start time (). The remaining data up to 1878 seconds represent the transient, lasting 1825 seconds.
2.3. Analysis Scenario Description
The RELAP5/MOD3.3 Patch 03 analysis was divided into two parts. In the first part, the power was reduced and closing and opening of governor valve was simulated. The purpose of simulating this part was to obtain the RELAP5 initial conditions as close as possible to the plant initial conditions before the reactor trip. It consists of four phases as shown in Table 1. In the first phase, steady state at 100% power level was demonstrated. In the second phase, the power was reduced from 100% to 91.72% level and steady state at reduced level was demonstrated. In the third phase, one cycle of turbine governor valve closing and opening was simulated in order to obtain as close as possible initial conditions. In total, there are four turbine governor valves. The stop valves were not simulated as they close when governor control valve is fully closed. When the governor valve starts to open, the stop valves open too. Also for the third phase, the steady state was demonstrated. When at time −500 seconds the time dependent junction component was replaced by valve component this caused some transient in the steam flow. Therefore, steady-state calculation with valve component was performed in the fourth phase at 91.72% power level, giving slightly different plant condition because of replacing time dependent junction. This steady state was compared with the plant data, which were available for 53 seconds before the transient start. By simulating part 1 there was no need to use artificial controls to achieve steady-state condition at 91.72% level. It should be also noted that during real testing of turbine governor valve, the position of other three governor valves is adjusted automatically to keep the reduced power constant. Also, the plant data were not available at 100% power to verify initial conditions before power reduction. The novel feature of the above approach is that the initial conditions were obtained by just maneuvering the plant, that is, opening and closing the turbine governor valve.
In the second part, which is the fifth phase, the transient leading to reactor trip and plant response to turbine and reactor trip was simulated. The time zero was denoted for the transient start. This means that part 1 analysis lasted from −4000 seconds to 0 second, while the transient was analyzed from 0 second till 1900 seconds.
3. Results
Figure 2 shows the results for part 1 analysis, while Figures 2 and 3 present short and long term results for part 2 analysis. In part 1 analysis, the power was reduced from nominal value (100%) to test conditions at around 91.72% and opening of turbine governor valve was simulated. In part 2 analysis, the turbine governor valve closure with reactor trip at 91.72% power level, and associated operator actions were simulated.
(a)
(b)
(c)
(d)
(a)
(b)
(c)
(d)
(e)
(f)
(g)
(h)
3.1. Part 1 Analysis—Achieving Steady State at 91.72% Level
Figure 2 shows some important calculated variables during simulated governor valve opening and closing and explains how initial condition at 91.72% power level was obtained. The calculated data (labelled “RELAP5 calculation”) are shown in the time interval (−4000 seconds–0 second) while the measured steady-state data (labelled “NPP measurement”) were available for interval (−53 seconds–0 second) only. The power reduction scheme was such that flow was reduced from nominal value 1086 kg/second to 991 kg/second simulating the turbine valve test initial conditions. Then the simulation of closing and opening of one governor valve was performed without operating other turbine governor valves. This caused rod insertion and withdrawal. For closing and opening, 5 minutes were assumed for 25% power reduction from 91.72% power level and 5 minutes for power increase. This is less than 5% of nominal power per minute load reduction. In this way, the steam dump operation was prevented. When the VALVE component was introduced back into the input model at −3500 seconds, short oscillation is introduced which quickly stabilizes during the fourth phase.
The obtained initial conditions are shown in Table 2. The first two columns describe the plant variables and their units. The third column shows average value of plant measured initial condition. The data were averaged in the time interval (−53 seconds–0 second) because the measured values were slightly oscillating for some variables. The time 0 second was chosen as start of reactor trip transient. For this time, the plant measured initial conditions are given in the fourth column, which in some cases differ from average steady-state values. In the fourth column is given design accuracy for the measured channels. The design accuracy can be obtained by calibrating the channels. The real accuracy is lower as time drift and environmental effect should be taken into account too. Finally, in the last three columns steady-state values at the end of the second, the third, and the fourth phases are given. In the sixth column are given calculated initial conditions after initial power reduction below 92% (rod insertion at time −2000 seconds), in the seventh initial conditions after rods withdrawal (at time −500 seconds), and in the last column the initial conditions at the time of transient start (). When comparing the RELAP5 initial conditions with measured initials conditions, with the exception of feedwater flow for loop 2, all values are within design accuracy.
Please note that for power reduction, the turbine flow was modeled by RELAP5 component TMDPJUN, with which linear flow decrease and increase can be prescribed. The benefit of having linear power decrease was to see how the plant would respond to linear power decrease, what would be very difficult with the VALVE component (valve opening is not linear with the steam flow). It should be noted, that this does not happened in the plant, but was just the tactics for achieving steady-state conditions. The nonlinear closing and opening could be performed by VALVE component too, but it would require more time as 5%/minute decrease is the maximum allowed load reduction. Another steady state had to be calculated when TMDPJUN component was replaced by VALVE component representing turbine governor valves.
The reason why simple power reduction scheme was not performed to reduce the power from 100% to 91.72% was that in the case of just lowering the power to 91.72% by inserting rods due to power mismatch between reactor power and turbine power some initial conditions are different from initial conditions when withdrawing rods (see Figures 2(b) and 2(d)). The reason is the deadband in the temperature error signal (between the reference temperature and the auctioneered average reactor coolant system (RCS) temperature). The difference when the rods stop to move in and start to move out is 1.4 K. Such a difference causes difference in the pressure on the secondary side too (1 K temperature change corresponds to 0.125 MPa pressure change).
Due to rod movement, the reactor power changes as it is shown in Figure 2(a), following the turbine power, which is modelled as a linear function of turbine flow. The RCS average temperature did not decrease immediately as expected when power was decreased but increased in the initial 150 seconds of the second phase (till −2850 seconds) due to delay caused by a combination of loop transport time, resistance temperature detectors manifold arrangement, and instrument processing time (see Figure 2(b)). Then the temperature started to linearly drop to new steady-state value. Same phenomenon repeated at the beginning of the third phase (temperature increase with later decrease). When power is increased the opposite happened. The temperature first decreased and then started to increase at −1530 seconds (the turbine governor valve starts to open at −1700 seconds).
Proportional heaters compensate the pressurizer pressure during power changes. During power decrease, the pressure initially increases and then returns to its nominal value, and vice versa during power increase (see Figure 2(c)). Finally, the steam generator 1 pressure shown in Figure 2(d) is increasing during turbine valve closing and decreasing during turbine valve opening. When the turbine valve stops to move, the SG pressure changes the direction and stabilizes at certain value depending on the value of RCS average temperature.
3.2. Part 2 Analysis–Transient with Reactor Trip
The time sequence of main events during the transient is shown in Table 3. This time sequence was determined based on the measured data of plant variables. The measured data showed that the turbine governor valves were closing for 5 seconds from 35.5% to 12.2% position, and then stabilized for 12 seconds. When the position starts to increase to 14% (opening caused by operator), there was full closure of turbine valves. The power level showed that the reactor was tripped. The reason for the reactor trip was low steamline pressure generating SI signal. The low steamline pressure signal resulted from the turbine flow increase. As at 15 seconds, the valve position was 12.2% and at 17 seconds was already 14.1% it was assumed that operator starts to open the turbine governor valves at 16 seconds. On SI signal also main feedwater isolation and main steamline isolation valve signal are generated, SI pump is actuated, and letdown and charging are isolated.
It should be noted that the sequence of events was determined from the measured data, which were used for the plots; therefore the values are rounded to seconds. For example, the core power starts to drop after 19 seconds. The exact time of reactor trip could not be determined because delay in signals and rod drop time is not exactly known.
To obtain the correct time sequence of events in short term, it was needed to model the operator actions, resulting in closure and subsequent opening of turbine governor valve. How this influences the steam mass flows from the steam generators number 1 and 2, is shown in Figures 3(g) and 3(h), respectively. Please note that steam flow in the calculations depends on the position of turbine valves and SG PORVs. In the calculation, the turbine valves were closed at 20 seconds while the SG PORVs open at 27 seconds. After the trip, the calculated steam flow was smaller than in the plant. From the measured data, it could be concluded that steam dump was operating after turbine governor valve closure. In the RELAP5 model these systems were not modelled in detail what resulted in small differences.
Figure 3(a) shows the power drop when the reactor is tripped. The measurement of power range channel is based on the neutron flux. After reactor shutdown, only a part of decay heat is due to neutron flux from delayed neutrons and spontaneous fission neutrons. Decay heat comes also from other sources as unstable fission products and unstable actinides. Therefore, the measured neutron flux is lower than in the reality and this is the major reason for disagreement with the calculation. The decay heat is simulated with RELAP5 while the measured data do not show correctly this decay.
The RCS average temperature is shown in Figure 3(b). After transient initiation, the temperature starts to increase until reactor is tripped in 17 seconds. Then the temperature is a function of cooling the primary system (by primary side injection) and the secondary heat sink.
In Figure 3(c) is shown pressurizer pressure. The initial pressure increase is calculated very well. The pressure is rapidly increasing until the pressurizer sprays are actuated. It can be seen that proportional sprays”. very efficiently reduce the pressure increase before reactor trip. When the reactor is tripped, the pressurizer pressure further decreased. Initial agreement is very good including peak pressure. However, it can be seen that after 25 seconds the calculated pressure shows repressurization of the primary system. The reason is the difference between calculated and measured steam flows (see Figures 3(g) and 3(h)). It should be noted that in the calculation position of turbine governor valve was simulated till 17 seconds when the valve closed on turbine trip in 3 seconds, while from the plant measured data, the steam flows start to drop at 21 seconds. In the case of calculation termination of steam flow caused SG pressure increase what deteriorated cooling of the primary side resulting in repressurization. However, when secondary side cooling was re-established by SG PORV opening at 27 seconds, the RCS pressure starts to decrease again. In addition, some cooling on the primary side was established by HPIS injection, while in the calculation the injection started in 50 seconds. No adjustment was made in the input model to tune the HPIS injection, SG PORV operation, and steam flows.
The steam generator pressure was calculated very well as shown in Figure 3(e). The first SG pressure peak is due to governor valve closure and the second peak due to the turbine trip. When the operator opened the turbine governor valves, the SG pressure after first peak started to decrease; therefore, SI signal was generated on low steamline pressure. The second peak caused the SG PORV valve opening.
The steam generator levels also agree well initially as shown in Figure 3(f). The reactor trip caused turbine trip and main feedwater isolation. The closure of the turbine valves and core heat transferred to the steam generators resulted in the steam pressure increase (see Figure 3(e)), which had a shrink effect on the steam generator level instrumentation. On SI signal with 25 seconds delay, the AFW injection was started removing the decay heat and filling the steam generators. Following the main feedwater isolation, the steam generator level is affected by auxiliary feedwater and released steam. However, it was observed that in the time period from 26 seconds to 73 seconds, when SG PORV 1 is operated, the calculated level is higher than the measured data. An explanation for this behavior could be in the RELAP5 input model; the damping of the oscillating water flow between the downcomer and the riser in the steam generators is underpredicted.
In the long term, the secondary pressure dictates the transient progression. The measured data for AFW flow were used in the calculation to simulate the operation of AFW pumps. To obtain exact match of SG pressures, small steam flow was modeled also as indicated by the measured data (see Figures 4(g) and 4(h)). Namely, the plant is designed such that after the main steamline isolation after the turbine trip there is some steam flow to the gland steam system. The steam in the steam generators is generated based on the available heat (mostly decay heat). From Figure 4(h), it can be seen that the measured value of steam flow is much higher than the maximum value of generated steam for one steam generator (label “calculation limiting”). Therefore, the steam flow was tuned in such a way to obtain as much as possible good agreement of SG pressures. The value of steam flows in the calculation is physically feasible, but it is not known if it was so in the reality. Also, the transient is very sensitive to this variable. Without assuming any steam flow after reactor trip or assuming measured data for steam flow, the SG pressure would be overpredicted (requiring SG PORV opening) or underpredicted. In the case of tuning steam flows all other calculated variables are in excellent agreement with the measured variables as shown in Figure 4. The measurement of power range channel is based on the neutron flux as already mentioned; therefore, the measured data are lower than the calculated power based on the decay heat (Figure 4(a)). Due to the steam generator pressure tuning (Figure 4(e)) also the RCS average temperature (Figure 4(b)) and SG level (Figure 4(f)) are closely matched. There is some discrepancy in the pressurizer pressure and level (Figures 4(c) and 4(d)) because the SI flow in the calculation was different from the measured data. It was decided not to tune the calculated SI flow to the measured data (SI pumps operated approx. 5 minutes). Later, the primary system is filled by operation of pressurizer sprays and charging flow.
(a)
(b)
(c)
(d)
(e)
(f)
(g)
(h)
Important was the finding that RELAP5 computer code calculation suggests some steam flow and later it was found out that there is some larger steam flow to the gland steam system in a special case of steamline isolation after turbine trip, which occurred in the analyzed event. Namely, the gland steam system was not included in the base RELAP5 input model.
3.3. Quantitative Assessment
The obtained results shown in Figure 4 were quantitatively assessed using fast Fourier transform based method (FFTBM). Both the original FFTBM [13] and improved FFTBM by signal mirroring were used [14]. Simplified quantitative assessment by applying FFTBM was done to confirm the conclusions done based on the analysis above. The readers not familiar with FFTBM can refer to references [1, 14]. For the purpose of this paper, it is important to know that lower is the average amplitude (AA), higher is the accuracy and that total accuracy below 0.3 means very good calculation. For primary pressure the AA below 0.1 means acceptable accuracy. Table 4 shows the AA for three time intervals, the time interval (−20 seconds–0 second) for steady state, short-term (0 second–80 seconds), and long-term (0 second–1800 seconds) results.
The results for time interval (−20 seconds–0 second) showed that the initial condition is very well predicted. This confirms the results in Table 2, where it is shown that all variables shown in Table 4 are within design accuracy of measuring channels. For the short- and long-term calculation the accuracy is rather similar, indicating very good calculation. When comparing original FFTBM and improved FFTBM by signal mirroring, as expected the differences are due to the unphysical edge effect (difference between the first and last data point of the signal) contributing to frequency spectrum in the original FFTBM. When edge is present in the experimental (measured) signal, this gives lower AA in the case of original FFTBM, that is, core power and steam generator narrow range level. For information, how edge effect could be eliminated by signal mirroring, the reader can refer to [14].
4. Conclusions
In this study, plant measured data for abnormal event resulting in the reactor trip at Krško NPP were used for validation of the RELAP5/MOD3.3 Patch 03 computer code. The analysis was divided into two parts. In the first part, an approach by maneuvering the plant was proposed to achieve steady-state conditions. In the second part, the turbine governor valve closure with reactor trip and the associated operator actions were simulated.
The calculated initial conditions at 91.72% power level were achieved close to the plant initial conditions by just maneuvering the plant. These results suggest that the input model for RELAP5 code is a good representation of the plant. The results of the abnormal event analysis showed good agreement between the calculated and measured data in the short term. This is true also for long term when operator actions are properly modeled.
The limitation of the plant measured data for code validation is that some information was not available or reliable. Namely, the calculated results showed that the transient evolution is very sensitive to the steam flow after reactor trip. In the short term, it would be very valuable to have separate measurements of steam flow to steam dump and through SG relief valve. This would clarify differences in flow a few seconds after reactor trip. Important is the finding that in the long term the measured data indicate steam flow after main steamline isolation. To match the secondary pressure also RELAP5 computer code calculation suggests some steam flow. After investigating design documentation it was found out that there is some steam flow to the gland steam system in a special case of steamline isolation after turbine trip, which occurred in the analyzed event. Namely, the gland steam system was not included in the base RELAP5 input model. But, the study of maximum steam generated based on decay heat showed that measurement of steam flow was not reliable. Therefore, the steam flow was tuned in such a way to obtain close agreement between the calculated and measured steam generator pressure. In this way also all other plant variables agree very well with the plant measured data.
In general, the conclusion is that the RELAP5/MOD3.3 Patch 03 computer code is capable of simulating the abnormal event but it requires qualified input model. In the presented study, proper modelling of operator actions and gland steam system is needed to obtain good quantitative agreement. Finally, the calculated data may be supplemental to the plant measured data when the information is missing or the measurement is questionable.
Acknowledgments
The authors acknowledge the financial support from Krško NPP and Slovenian Nuclear Safety Administration within CAMP program (Project no. 397-23/2004/18) and from the state budget by the Slovenian Research Agency (Program no. P2-0026 and Research Project no. J2-6542). The RELAP5/MOD3.3 Krško NPP base input model is courtesy of Krško NPP.