Abstract
Ignalina NPP is the only nuclear power plant in Lithuania consisting of two units, commissioned in 1983 and 1987. Unit 1 of Ignalina NPP was shut down for decommissioning at the end of 2004 and Unit 2 is to be operated until the end of 2009. Both units are equipped with channel-type graphite-moderated boiling water reactors RBMK-1500. The paper summarizing the results of deterministic and probabilistic analyses is developed within 1991–2007 by specialists from Lithuanian Energy Institute. The main operational safety aspects, including analyses performed according the Ignalina Safety Improvement Programs, development and installation of the Second Shutdown System and Guidelines on Severe Accidents Management are discussed. Also the phenomena related to the closure of the gap between fuel channel and graphite bricks, multiple fuel channel tube rupture, and containment issues as well as implication of the external events to the Ignalina NPP safety are discussed separately.
1. Introduction: Historical Context
Preparatory works of construction of the Ignalina NPP have been started in 1974, and the first unit of Ignalina NPP was commissioned in December 31, 1983. At the same time the second unit was under construction and construction of the third unit began. The second unit was planned to start to operate in 1986, but because of accident in Chernobyl, works on preparation to operate this unit have been rescheduled. Second unit was commissioned in August 31, 1987. At that time 60% of the third unit have already been constructed, but later construction was suspended and terminated soon. Nowadays because of political reasons, the first unit of Ignalina NPP is shut down; the second unit is planned to shutdown at the end of 2009.
Ignalina NPP with RBMK-1500 reactors belongs to the second generation of RBMK-type reactors (it means that this is most advanced version of RBMK reactor design series in comparison with other RBMK-type nuclear power plants). In comparison with infamous Chernobyl NPP, Ignalina NPP reactors are by a third more powerfully and already from the beginning of operation substantially advanced emergency protection systems (e.g., emergency core cooling and accident localization systems) [1].
After 1990 Lithuania declared its independence; Ignalina NPP with two largest in the world RBMK-1500 reactors came under authority of the Lithuania Republic; however, nobody in the world did not know about the real safety level of these reactors. The first Safety Justification of Ignalina NPP has been prepared by Russian experts of Research and Design Institute for Power Engineering (RDIPE), organization—designer and developer of RBMK reactors, after Chernobyl NPP accident. In this document the analysis of all design basis accidents (except partial breaks of pipes) is presented in sufficient details. The analysis is performed using at that time existing tool—quasistationary derivative approximation method, being based on conservative assumptions and existing experimental data. From the present-day viewpoint such safety justification [2] has lacks.
(i)It was limited only to the systems description and the analysis of design basis accidents.(ii)Computer codes, developed in Russia, have been used for simulations, but these codes have not been extensively verified and validated.(iii)The independent expertise of safety analysis has not been performed.Therefore, at the beginning of the 90s of the last century there were reasonably doubts how such safety justification of Ignalina NPP, presented in the first safety justification, corresponded to the real situation. In 1992 at G7 Munich Summit the decision of closing Soviet-design nuclear power plants, at first of all the nuclear power plants with RBMK and VVER-440/230 reactor types, was accepted. In 1994 Lithuania signed the agreement with the European Bank for Reconstruction and Development (EBRD) Account of Nuclear Safety by which it had undertaken to perform in-depth safety analysis of the Ignalina NPP and not to change fuel channels in the reactor.
Right from the start, when Lithuania assumed control of the Ignalina NPP, the plant, its design, and operational data have been completely open and accessible to Western experts. A large number of international and local studies have been conducted to verify the operational characteristics of the Ignalina NPP and analyze its level of risk. Ignalina NPP is unique nuclear power plant of RBMK type about which information was collected, checked, systematized, and made accessible. Collected and verified database has allowed
(i)to assess present safety level of NPP,(ii)to compare its level with other RBMK-type NPPs safety level,(iii)to plan improvements of plant equipment and operating procedures increasing safety of the NPP.Below, the results of the State of the Art deterministic and probabilistic safety analyses for Ignalina NPP, developed within 1991–2007 by specialists from Lithuanian Energy Institute, are discussed.
2. Deterministic and Probabilistic Ignalina NPP Safety Analyses
In this Section the main Ignalina NPP safety analyses, performed since 1991 till these days, are discussed:
(i)Ignalina NPP Units 1 and 2 safety analysis reports and their review,(ii)modifications of activation algorithms for reactor shutdown and emergency core cooling systems,(iii)second diverse reactor shutdown system development, safety justification, and implementation,(iv)studies of Ignalina NPP 1 and 2 levels of Probabilistic Safety Assessment (PSA),(v)external events at Ignalina NPP Analysis.2.1. Deterministic Ignalina NPP Safety Justification
In 1995-1996 was prepared In-depth Ignalina NPP Unit 1 Safety Analysis Report, using USA and Western Europe methodology and computer codes for providing safety analysis [3]. It was comprehensive international study sponsored by EBRD. The purpose of this international study was to provide a comprehensive overview of plant status with special emphasis placed on its safety aspects. Specialists from the Ignalina NPP, Russia (RDIPE), Canada, and Sweden contributed. During implementation of the project, they have been described more than 50 systems of normal operation, safety important systems, and auxiliary systems. Also analysis of these systems has been performed, considering compliance of these systems to the Lithuanian standards and rules as well to practice of safety used in the West. Analyzing systems, the attention has been concentrated on their consistency to criterion of single failure, as well as to auxiliary safety aspects: maintenance, inspections, and impact of external factors (fire, flooding by water). This analysis of systems has defined the main lacks of systems and has developed conditions for elimination of the deficiencies. The performed review on operation and safety has allowed to identify all possible malfunctions, which can potentially cause an emergency situation.
In the safety analysis report of the Ignalina NPP Unit 1, the comprehensive accident analysis and equipment assessment have been provided; discussed questions concerning equipment ageing, investigated topics related to operators action, and power plant control provided conclusions about safety of Ignalina NPP (NPP safety level was assessed realistically); main lacks have been defined and measures for elimination of the deficiencies have been foreseen. It is the first western-type report on safety for nuclear power plants with RBMK reactors.
One of the basic conclusions in this safety analysis report was such that in this case there was no problem, which would demand immediate shutdown of the Ignalina NPP. Detailed accident analysis (accidents because of different pipelines ruptures, reactivity initiating accidents, equipment failures, transients with additional failure of reactor shutdown system, and fuel channel ruptures in the reactor cavity) has shown that accident occurring because of equipment failures does not cause such condition of the plant station which would cause violation of acceptance criteria; safety system ensures a safe condition of the plant even doing the assumption that operator does not take any action for 10 minutes from the beginning of accident to mitigate an emergency situation. Because of reactivity initiating accidents (exactly such type of initiating event became the reason of accident in the Chernobyl NPP), acceptance criteria of power plant also are not violated, even postulating single failures additionally. It has been shown that Ignalina NPP is reliably protected against loss of the coolant accidents if ruptures of pipelines do not cause local stagnation of flow. In case of one steam line rupture, the acceptance criteria will not be exceeded. But there are two steam lines located in the shaft at the Ignalina NPP; thus, rupture of one steam line can cause rupture of other steam lines, and in this case radiological dozes can be exceeded. Being based on these results of accident analysis, the recommendations for modifications of activation algorithms for reactor shutdown and emergency core cooling systems have been prepared.
It is necessary to note that in parallel with the Ignalina NPP Unit 1 safety analysis report in 1995–1997 it was performed independent Review of the Ignalina Nuclear Power Plant Safety Analysis Report [4]. This study was performed by experts from USA, Great Britain, France, Germany, Italy, Russia, and Lithuania. Independent Review has confirmed the main conclusions of safety analysis report.
In recommendations of Ignalina NPP Unit 1 safety analysis report, it has been shown that Ignalina NPP will be reliably protected from any ruptures of pipelines and steam lines after improving of activation algorithms for reactor shutdown and emergency core cooling systems. According to these algorithms the system will automatically activate on coolant flow rate decrease in single Group Distribution Header (GDH) and sharp pressure decrease in drum-separators. These modifications have been implemented in both Ignalina NPP units. Safety justification of these modifications has been performed in Lithuanian Energy Institute (LEI). Further discussed situation, when conditions for local flow stagnation because of GDH rupture in the fuel channels connected to this affected GDH, is developed [5]. The flow stagnation occurs in the case of the certain size break in GDH. Due to discharge of a part of the coolant through this break, the zero gradient of pressure is developed in fuel channels (7—see Figure 1), that is, pressure in a bottom of the channel is close to pressure in drum separators (1). Coolant flow rate stagnation in fuel channels can be destroyed only in case of early activation of Emergency Core Cooling System (ECCS) (see Figure 2(a)). Thus if ECCS would operate according to design algorithm (reactor cooling water started to supply only after approximately 400 seconds from the beginning of accident); acceptance criteria for both fuel rod cladding and fuel channel walls temperatures in high-power channel would be exceeded (see Figure 2(b) and Figure 2(c)). After implementation of ECCS activation algorithms according to coolant flow rate decrease in separate group distribution headers, water from ECCS starts to supply already after 5–10 seconds from the beginning of flow stagnation. Thus stagnation is broken and fuel channels, connected to affected GDH are reliably cooled (see Figure 2). These modifications of activation algorithms for reactor shutdown and emergency core cooling systems are installed in power plant Unit 1 in 1999, and Unit 2 in 2000.
(a)
(b)
(c)
In the Ignalina NPP Unit 1 safety analysis report, they have been investigated not only basic design accidents (discussed above) but also Anticipated Transients Without reactor Shutdown (ATWS). Investigations of such accidents are carried out at the licensing process for USA and Western Europe nuclear power plants; however, for the NPPs with RBMK-type reactors such analysis has been performed for the first time. Consequences of accident for RBMK-1500 reactor during which loss of preferred electrical power supply and failure of automatic reactor shutdown occur [6] are presented in Figure 3. Due to loss of preferred electrical power supply, all pumps are switched (see Figure 3(a)) off; therefore, the coolant circulation through fuel channels is terminated. Because of the lost circulation, fuel channels are not cooled sufficiently; therefore, temperature of the fuel channels walls starts to increase sharply. As it is seen from Figure 3(b), already after 40 seconds from the beginning of the accident, the peak fuel channel wall temperature in the high-power channels reaches acceptance criterion 650°C. It means that because of the further increase of temperature in fuel channels plastic deformations begin—the channels because of influence of internal pressure can be ballooned and ruptured. On the first seconds of accident the main electrical generators and turbines are switched off as well. Steam generated in the core is discharged through the steam discharge valves; however, their capacity is not sufficient. Therefore the pressure in reactor cooling circuit increases and approximately after 80 seconds from the beginning of accident reaches acceptance criterion 10.4 MPa (see Figure 3(c)). The further increase of pressure can lead to rupture of pipelines.
(a)
(b)
(c)
Thus the analysis of anticipated transients without shutdown has shown that in some cases the consequences can be dramatic enough. Therefore the priority recommendation has been formulated: to implement the second, based on other principles of operation, diverse shutdown system. However development, designing, and implementation of such system needed few years (in the Ignalina NPP Unit 2, this system was installed in 2004), so the compensating means, which were used in transition period while second diverse shutdown system was developed, has been implemented. This temporary system was called according Russian abbreviation “DAZ”, “Dopolnitelnaja avarijnaja začita”—“Additional emergency protection”. This system used the same control rods as well as design reactor shutdown system; however, signals for this system control were generated independently in respect of design reactor shutdown system. In Lithuanian Energy Institute for DAZ system, they have been selected not only set points of activation but also the safety justification was performed. Performed analysis has shown that after implementation of DAZ system the reactor is shut down in time and cooled reliably as well; acceptance criteria are not violated even in case of transients when design reactor shutdown system is not functioning. In Figure 3 is shown the behavior of the main parameters of reactor cooling circuit in case of loss of preferred electrical power supply and simultaneous failure of design reactor shutdown system. In this case two signals for activation of DAZ system (reactor shutdown) are generated: on increase of pressure in drum separators and on decrease in the coolant flow rate through the main circulation pumps. In Unit 1 DAZ system was installed in 1999 and in Unit 2 in 2000.
The Second Diverse Shutdown System (DSS) has been designed and installed in Ignalina NPP Unit 2 in 2004. In the first unit of Ignalina NPP this system has not been installed because reactor has been shut down in 2004. Therefore, nowadays Ignalina NPP reactor emergency protection (emergency shutdown) system consists of two independent shutdown systems: first, BSM controls manual control rods and shortened absorber rods, which are inserted into the core from bottom. This system performs the normal reactor shutdown function and can maintain a reactor in subcritical state. Second system AZ controls 24 fast acting reactor shutdown rods as well as additionally 49 rods, which belong to both—BSM and AZ systems. AZ system performs emergency protection function. Also the Additional Hold-down System of the reactor is installed. This system allows to prepare and inject water and neutron absorber gadolinium mixture into control rods cooling circuit. Thus, the reactor remains in subcritical state even in the case of failure of BSM system.
DSS justification was one of the main projects increasing a level of NPP safety. Specialists from LEI together with experts from the countries of Western Europe checked and have assessed the design documentation, carrying out independent calculations, thus helping Lithuanian regulatory body (VATESI) to make the appropriate decisions concerning implementation of mentioned system at Ignalina NPP [7]. In conclusions of review it has been shown that implementation of second diverse reactor shutdown system protects a reactor in case of failure of design reactor shutdown system. Implementation of this system has ensured that any initiating event cannot cause accident with damage of the reactor core as well as decreases core damage probability from up to .
In 2002 the safety analysis report for Ignalina NPP Unit 2 has been developed. This report contains the description of systems, list of postulated accidents, engineering assessment of reactor cooling system, accident analysis, assessment of fuel channels structural integrity, assessment of reactor safety acceptability, and other chapters. The accident analysis in this report was performed using best estimate approach with uncertainty and sensitivity analysis. According to the international practice, the best estimate approach is used mainly for analysis of loss of coolant accidents in reactor cooling system. In Lithuania the best estimate approach was successfully applied not only for loss of coolant accidents but also for reactor transients and accident confinement system response analyses. The uncertainty and sensitivity analysis allows to avoid the unnecessary conservatisms as well as to assess and address the existing safety margins. The safety analysis report and its review were the main documents required for license for Ignalina NPP Unit 2. Both documents demonstrated the increased safety level after implementation of above mentioned modifications and satisfaction to requirements of regulating documents.
2.2. Ignalina NPP Probabilistic Safety Assessment
The Ignalina NPP first-level PSA “BARSELINA” project (1991–1996) was initiated in 1991 [8]. It was the first PSA for nuclear power plants with RBMK-type reactors. From the beginning this project was carried out by nuclear energy experts from Lithuanian, Russian, and Swedish institutions, and since 1995 it was carried out by efforts of experts from Lithuania (Ignalina NPP, LEI) and Sweden. Main objective of deterministic analysis was to show that nuclear power plant reliably copes with accidents, and basic purpose of PSA 1 level is to assess probability of reactor core damage to create a basis for severe accident risk assessment and management. Performed Ignalina NPP PSA 1 level study is predicted by assumption that the main radioactive source is reactor core. This PSA is performed for maximum permissible reactor operating power. Only internal initiating events have been analyzed—transients, loss of the coolant accidents, common cause failure, and internal hazards (fire, flooding, and missiles). Results of the analysis have shown that after implementation of recommendations from BARSELINA [8], safety analysis report, and its independent review [3, 4], probability of Ignalina NPP core damage is about . According to the international requirements, this parameter for the operating nuclear power plants should not exceed per year and for new NPPs, which are in process of construction, . Therefore Ignalina NPP fulfils this requirement. Analysis has shown that, in Ignalina NPP, risk topography dominates transients, instead of loss of the coolant accidents. The risk of core damage most of all increases transients with loss of long-term core cooling. It is the positive fact meaning that up to consequences of severe accidents there is enough time. Thus operators supervising reactor operation can undertake corrective measures, and it means that Ignalina NPP has great potential opportunities for implementation of the program on management of severe accidents. It is necessary to note that procedures and means on severe accident management are already implemented at Ignalina NPP Unit 2 [9, 10].
According to the international requirements, probability of the large reactivity release outside nuclear power plant should not exceed per year for new NPPs, which are in process of construction and for NPPs in operation . Scenarios and probabilities of the large reactivity release outside nuclear power plant are objects of investigations for PSA level 2. Ignalina NPP PSA level 2 project was performed in 1999–2001 [11] and it was the first project of such type for nuclear power plants with RBMK reactors. This project was carried out by efforts of experts from Lithuania (LEI) and Sweden. Performing PSA level 2 as initial data used results of level 1. According to PSA level 1 investigated accident scenarios consequences and its similarity criteria on radioactive contamination, the conditions of damage of the reactor have been developed and possibilities of accident management were assessed. Results of PSA level 2, it have shown that barrier of the large reactivity release after core damage is 1.5. This barrier is smaller in comparison with modern nuclear power plants having function of containment, which reaches 10 and more. Being based conservative assumptions and estimation of parameters, in PSA level 2 was calculated that general estimation of large discharge frequency is per year. Therefore, Ignalina NPP according to the probability of large reactivity release outside nuclear power plant is not the worst in comparison with the plants of the USA and Western Europe, constructed in the same years.
Carrying out the complex analysis about influence on Ignalina NPP units safety [12] by LEI, the following external events have been investigated:
(i)aircraft crash,(ii)extreme wind and tornado,(iii)flooding and extreme showers,(iv)external fire.Aircraft or other flying objects crash that caused accidents in Ignalina NPP will have local character because of its big territory. According to the Lithuanian civil aviation data, it has been assumed that average congestion is up to 50000 flights per one year within the 50-kilometer zone around NPP. Three zones have been defined by a radius up to 15, 50, and 85 meters around the reactor in the territory at Ignalina NPP (15—according to reactor dimensions, 85—according to reactor building size). Probability of air crash on a 85-meter zone around the reactor center, assuming that aircraft weight is 5700 kg as well as assuming that half of these flights carry out planes of western manufacturers and other half—Soviet, is 1/year. Even doing more conservative assumptions (heavy planes falling frequency equalized to easy planes falling frequency), probability of air crash on a 85-meter zone around the reactor center will be 1/year. The obtained heavy plane crash probabilities are less than the probabilities obtained in probability analyses for the majority of the West-European and American NPPs.
Tornado may cause huge damage and destruction. From all buildings of nuclear power plant, the tornado is most dangerous for a technical water supply system building, because it is located in the open territory on a coast of lake. Tornado and hurricane winds do not create danger for buildings of reactor and technical systems. Contrariwise probability of tornado and hurricane winds is 1/year. Therefore it is possible to approve that their influence on reactor safety is insignificant.
Rise of a water level in Lake Druksiai represents the greatest danger to pump station on the lake, since the service water system is the nearest NPP construction to the lake. Water level elevation of Lake Druksiai up to a level of 144.1 m is not possible practically; therefore, there is no danger on flooding of pump station. The platform of the other Ignalina NPP construction is located at a level of 148-149 m above the sea level. Rise of a water level in the lake Druksiai up to such mark is impossible and flooding does not represent the direct danger for Ignalina NPP.
Besides lake, another external flooding source is extreme showers. In territory of Ignalina NPP there is drainage system and all compartments which are located below a critical mark of a level are connected to this system; therefore, the water leaks in case of internal flooding. Thus, extreme showers do not cause external flooding of the reactor building. For probabilistic external flooding analysis the mathematical model to assess peak water level elevations of the lake Druksiai has been developed. Probabilistic assessment of water level elevation in the lake has been performed. Maximum amount of precipitation (not less than 279.7 mm in 12 hours) probability is 1/year. Such event will not have influence on reactor safety.
Probabilistic analysis of external fire. Ignalina NPP is situated in the region, where 30% of territory is occupied by forests (40% are grassland and 30% are occupied by lakes and swamps). The edge of the closest forest is less than one kilometre from territory of Ignalina NPP. On the territory of the NPP there are only separate trees and grass. The global fire of a forest with a high wind to the NPP side can cause the smoke cover on the territory of Ignalina NPP. The smoke does not influence work of reactor mechanisms but will complicate work of the personnel. Fire probability of forest, which is in 10-kilometer zone around Ignalina NPP and there are more than 2000 ha woods, is 1/year. It is a high probability, but any fire cannot affect safety of the reactor considerably.
3. Ignalina NPP Safety Assessment in Case of Specific RBMK Problems
Discussing safety of RBMK-type nuclear power plants, three vulnerabilities more often are mentioned generally:
(i)containment issue,(ii)problem of gas gap closing between fuel channels and graphite blocks,(iii)problem of multiple fuel channel ruptures.Below, specificity of RBMK-1500 in respect of these problems is discussed.
3.1. RBMK Reactor Containment Issue
In case of accident in nuclear power plant (rupture of reactor cooling circuit pipelines), the coolant with radioactive materials will spread into reactor and compartment-enclosed reactor cooling circuit. In many (but not in all) reactors of the USA and the Western Europe, function of containment carries out visible from afar, photogenic, semicircle form protection enclosure. Usually nonexistence of containment is treated as deficiency of RBMK reactors. However such containment as for vessel-type reactors is technically impossible to implement for RBMK reactors. In the Ignalina NPP the function of containing accidentally released radioactive material is accomplished by an extensive system of interconnected steel lined, reenforced concrete compartments called the Accident Localization System (ALS). The ALS uses the “pressure suppression” principle employed by G.E. designed boiling-water reactors. The ALS encloses the large Ignalina NPP reactor core, the coolant pumps, and all of the piping providing coolant to the core. It is not necessary to enclose the pipes above the reactor core, which carry the exiting two-phase (steam-water) mixture to the drum separators, because if one of them is breached, coolant flow to the fuel channels (which is provided by pipes entering the core from below) will not be interrupted. Significant amounts of radioactive material can escape only if fuel rods are over-heated. Breaches in the exiting pipes will not reduce coolant flow; therefore, the fuel rods will not overheat.
The effectiveness of the ALS has been verified by extensive international analysis and experimental programs. They all show that even if events leading to release of radioactive materials are postulated, these materials will be contained by the ALS; thus, the ALS performs the function of containment [13]. The minimal amounts (due primarily to non-condensable noble gases) which would eventually reach the environment, would not exceed the amounts that would be released by Western built reactors provided with the more familiar, prominently visible “dome containments”.
3.2. Problem of Gas Gap Closing between Fuel Channels and Graphite Blocks
The fuel channels of RBMK-type reactor are separated from the graphite bricks by gaps maintained by graphite rings. These rings are arranged next to one another in such a manner that one is in contact with the channel, and the other with the graphite stack block (see Figure 4). As a result of exposure to neutron radiation and temperature, the diameters of graphite columns gaps decrease, and fuel channel tube expands; thus, the gap between them decreases.
The availability of the gap between graphite bricks and fuel channels is the main condition limiting the operation of RBMK-type reactors. These graphite fuel channel tubes gaps allow
(i)unimpeded (axial and radial) thermal expansion and contraction of the fuel channels,(ii)predictable noncontacting heat transfer from graphite bricks (temperature higher than 500°C) to fuel channels (temperature 300–320°C) across the gaps,(iii)leakage of helium-nitrogen mixture, which provides heat transfer from graphite to coolant and protects graphite against oxidation. Furthermore helium-nitrogen mixture is part of fuel channel integrity monitoring system.The control of gap between fuel channels and graphite blocks at Ignalina NPP Unit 1 and 2 is carried out from the beginning of its operation and now the largest database and experience of assessment of gap among all RBMK type reactors is saved. After gap closure some functions of the control not only are lost but also worsen characteristics of the reactor. Increasing probabilities of damage of the channel and deformations of graphite, withdrawing of the channel from a reactor if necessary becomes complicated and the temperature of graphite and the fuel channel changes. In Ignalina NPP Unit 1 reactor the average gap between fuel channels and graphite up to final shutdown of the reactor from an initial level (3–2.7 mm) has decreased three to four times. This decreasing in Unit 2 is insignificant. Estimation of such small gap is very sensitive to errors of measurements, uncertainties of used models, and strategy of selection of fuel channels for measurements.
As it is known, after signing the agreement with the EBRD Account of Nuclear Safety in 1994, Lithuania has undertaken not to change fuel channels and not to operate Ignalina NPP reactor after closing even one gas gap between graphite stack and fuel channels. In Ignalina NPP in-depth safety report [3], which has been prepared by the international experts in 1996, it was predicted that at Ignalina NPP Unit 1 it happens not later than in the beginning of 1999.
In Lithuanian Energy Institute complex investigations on the problem of gap closure between fuel channels and graphite blocks at Ignalina NPP have been carried out. Assessment of the gap between graphite stack and fuel channels has very big importance because results of this problem are very important in making of the decision on duration of Ignalina nuclear power plant operation. At development of a technique on assessment of gap and strategy of measurements, the thermal-hydraulic, structural and probabilistic calculations have been performed. The detailed analysis [14] has shown that in Ignalina NPP In-depth safety analysis report [3] the assessment of the gap between fuel channels and graphite blocks at Ignalina NPP Unit 1 reactor has been performed using simplified deterministic calculations. Therefore obtained results were too pessimistic and conservative, predicting closure of the gap in set of channels in 1998–2000.
The specialists from LEI developed the integrated technique on assessment and control of risk of gas gap reduction. This allowed to develop strategy of measurement of holes diameters in graphite columns and replacement of fuel channels. This strategy has ensured existing of gap in Unit 1 reactor up to its final shutdown and by that has allowed considerably to prolong time of Ignalina NPP Unit 1 operation (until the end of 2004).
Change of a gas gap in the second unit of a reactor very much differs from that of the first unit because in a reactor of Unit 2 they are used zirconium tubes of fuel channels having different hardened surfaces and the rate of their ballooning is two times slower in comparison with tubes in reactor of Unit 1. Tendencies of change of graphite stack diameters in the second Unit are very similar to those of the first unit.
3.3. Problem of Multiple Fuel Channel Ruptures
In case of fuel channel rupture a two-phase flow is discharged to gaps between graphite stack. Part of graphite blocks can be and damaged cracked by coolant jet impingement; graphite columns can be displaced and coolant passes into the reactor cavity. Because graphite stack is hotter than the coolant, the pressure in tight reactor cavity increases. The leak tight Reactor Cavity (RC) performs the function of containment in the region immediately surrounding the nuclear fuel and graphite. The RC is formed by a cylindrical metal structure together with bottom and top metal plates. The reactor cavity confines the steam release in case of rupture of fuel channels. The steam-water-gas mixture from the reactor cavity is directed via Reactor Cavity Venting System (RCVS) pipelines to two steam-distribution devices of the 5th (upper) condensing tray in the Accident Localization System (Figure 5). Two pipelines mm that come from a branch pipe mm located above the top plate of RC are interconnected to a pipe mm which connects to one steam-distribution device [1]. In the same way the other two pipelines mm from the top plate of RC are connected to the second steam-distribution device. On their way these pipelines have branches, which are interconnected in a leak-tight corridor and end up with three Membrane Safety Devices (MSDs). The blowdown pipes from the bottom of RC pass directly to the leak-tight corridor and also end up with three MSDs.
In the case of multiple fuel channel tube ruptures, if the RCVS does not assure relief of steam-water-gas mixture from RC, the pressure increase in the RC will lift top plate of the RC. Those structural integrity of the RC and the rest fuel channels would be lost as well. Such event would cause very severe consequences similar to Chernobyl accident. Therefore it is important to maintain RC integrity, which is assured if pressure in the RC is below permissible pressure (314 kPa, abs), that is, the pressure of upper plate of biological reactor shielding weight [15].
Rupture of one fuel channel is design basis accidents for RBMK-1500 reactors. Probability of such rupture is 1/year. According to design, the reactor cavity venting system assured the integrity of RC in the case of up to 3 fuel channels ruptures. This system has been modernized in 1996 as shown in Figure 5.
Moscow Research and Design Institute for Power Engineering (RDIPE), designer and developer of RBMK reactors, specialists in 1996 have analyzed pressure behavior in the Reactor Cavity in case of multiple fuel channel rupture [15]. Results of these calculations have shown that acceptance criterion maximum permissible load (310 kPa) to upper reactor cavity plate will be exceeded in case of 9 fuel channels rupture (according to RDIPE calculations). In RDIPE calculations the coolant discharge through the rupture conservatively was assumed equal to 32 kg/s through one fuel channel. This flow rate has been selected as constant versus time. Because of such conservative assumptions, amount of discharged coolant into reactor cavity is largest and number of channels, when permissible pressure in reactor cavity is not exceeded, will be minimal.
Such analysis is conservative with impact of uncertainties. The best estimate analysis of Ignalina NPP response to multiple fuel channels tubes rupture was performed at the Lithuanian Energy Institute. Sensitivity and uncertainty analysis was performed as well [16]. At performance of the analysis it has been considered that results of calculations can be influenced by uncertainties such as the plant initial conditions, assumed at the modeling, as well as assumptions and correlations of CONTAIN code. Summarizing the results of the uncertainty and sensitivity analysis, it was concluded that the capacity of RCVS comprises from 11 up to 19 ruptured fuel channels, that is, channels (Figure 6).
It is necessary to note that the analysis was performed for the case with reactor cooling system filled by coolant (the water levels in drum separators are nominal). Thus, after the fuel channels rupture, the steam-water mixture is discharged into the gaps of graphite stack. If the “dropout” model is used in CONTAIN 1.1 code, it is assumed that all the water released from the ruptured fuel channels in liquid fraction leaves from RC to the water drain. If the “dropout” model is not used in CONTAIN 1.1 code, it is assumed that not all evaporated water remains in a dispersed condition, and it may be transferred into RC and through the pipelines into ALS. The last assumption leads to higher calculated pressure in the RC (see Figure 6).
It is necessary to note that during operation of RBMK reactors there were only three cases of ruptures of separate fuel channels:
(i)at Leningrad NPP Unit 1 in 1975,(ii)at Chernobyl NPP Unit 1 in 1982,(iii)at Leningrad NPP Unit 3 in 1992.In any of these cases adjacent channels have not been damaged. Thus, in reality there was no so-called “cascade rupture of fuel channels” when rupture of one channel causes ruptures of other channels. Experiments made on the large-scale TKR-Test facility at Electrogorsk Research and Engineering center for NPP safety [17] have shown also that cascade rupture of fuel channels is impossible.
4. Conclusions
Requirements of nuclear power plants safety depend on the accumulated experience, a level of a technical society evolution, which always raises, and from position of the state. About safety level of Ignalina NPP it was worried after Chernobyl accident in 1986. The first modernizations of reactors have been implemented at that time. RDIPE, designer and developer of RBMK reactors, experts have prepared the first safety justification for operating power plant in 1989. When Lithuania assumed control of the Ignalina NPP in 1991, a large number of studies on safety level have been conducted. It is necessary to note Safety Analysis Reports for Ignalina NPP Units 1 and 2, Safety Justifications of Reactor Cooling System, and Accident Localization System. The Ignalina nuclear power plant is distinguished from all RBMK-type reactors for the matter is that many international studies to investigate design parameters as well as level of their risk have been performed. Ignalina NPP, its design, and operational data have been completely open and accessible to Western experts. At first the effective initial help in questions of nuclear safety has been provided by Sweden and after by other countries (Germany, United Kingdom, USA, etc.), capable to perform expertises of the safety analysis. A public list of EC Phare projects, supporting the modernization of Ignalina NPP, is available under http://ie.jrc.ec.europa.eu/dissem/.
The detailed analysis of accidents has shown that design basis accidents do not cause such condition of the plant, which postulates violation of acceptance. As well safety systems of the plant ensure a safe condition of the plant even doing the assumption that operator does not take any action for 30 minutes from the beginning of accident to mitigate an emergency situation.
The performed Probabilistic Safety Analysis of levels 1 and 2 has allowed to compare safety level of Ignalina NPP with the reached level on other nuclear power plants and to plan how to improve NPP safety systems and operational procedures. Investigations have shown that Ignalina NPP according to the probability of large radioactivity release outside nuclear power plant is not the worst in comparison with the plants of the USA and the Western Europe, constructed in the same years.
On the basis of the performed investigations the recommendations on safety improvement were developed by efforts of local and foreign experts. These recommendations were brought into Ignalina NPP Safety Improvement Programs (SIP-1, SIP-2, or SIP-3) which implementation strictly was checked by Lithuanian regulatory body VATESI. These means have allowed to improve safety level of the Ignalina NPP constantly. These works do not stop even on forthcoming final shutdown of the plant. In outcome of last significant project the Severe Accident Management Guide is developed. Now this guide is under implementation at Ignalina NPP. Severe Accident Management Guide will supplement Symptom-Oriented Emergency Operating Procedures and will provide safe elimination of accident consequences in all range of accidents.
Nomenclature
| ALS: | Accident localization system |
| ATWS: | Anticipated transients without reactor shutdown |
| AZ: | Russian acronym for “emergency protection system” |
| BSM: | Russian acronym for “normal reactor shutdown system” |
| DAZ: | Russian acronym for “additional emergency protection” |
| DSS: | Diverse shutdown system |
| EBRD: | European Bank for Reconstruction and Development |
| EC: | European Community |
| ECCS: | Emergency core cooling system |
| GDH: | Group distribution header |
| LEI: | Lithuanian Energy Institute |
| MSD: | Membrane safety device |
| NPP: | Nuclear Power Plant |
| PSA: | Probabilistic Safety Assessment |
| RC: | Reactor Cavity |
| RCVS: | Reactor Cavity Venting System |
| RBMK: | Russian Acronym for “Water-Graphite Boiling Reactor” |
| RDIPE: | Research and design institute for power engineering |
| VATESI: | Lithuanian acronym for “lithuanian state nuclear power safety inspectorate”. |