1 Introduction
The currently valid Russian regulatory documents on the safety of nuclear power plant (NPP) stipulate the requirements regarding design basis accidents (DBAs) and beyond design basis accidents (BDBAs), including severe accidents (SAs) with core meltdown, in the design of NPP (NP-001-15, NP-082-07, and others).
In particular, it is necessary to compile a list of such accidents, establish the acceptance criteria for the safety of reactor plants (RPs) in relation to each of such accident, and justify meeting these criteria.
If analysis of BDBA consequences with the evaluation of a probability of release does not confirm that the requirements specified in the regulatory documents can be fulfilled (limiting emergency release shall not exceed 10−7 reactor per year), a provision shall be made in the design for additional engineering solutions on accident management to mitigate the consequences of accidents (NP-001-15). The evaluation is conducted based on success criteria (NP-006-16) to assess the efficiency and sufficiency of the measures to be proposed.
To ensure a rigorous calculational justification of BDBAs and SAs, it is necessary to develop an integral computer code (CC) that is in line with the requirements of regulatory documents on verification and certification (RD-03-33-2008, RD-03-34-2000). This code must also clarify the amount of data required to provide information within the scope stipulated by the requirements for the structure of the safety analysis report (SAR) (NP-006-16).
The analysis of the in-vessel stage of SAs for evaluating the time of occurrence of typical events, the behaviors of the basic parameters of RPs, and the release of coolant mass and energy and core materials beyond the reactor pressure vessel boundaries (after damage to the reactor pressure vessel) is of utmost interest to OKB Gidropress JSC as the RP chief design organization.
The CC for system of codes for realistic analysis of severe accidents (SOCRAT)/В1 certified in Rostechnadzor and employed in commercial operation in OKB Gidropress JSC is actively used at the present time for computational modeling of SAs.
Verification, updating, and enhancement of the code are performed in cooperation with the Nuclear Safety Institute of the Russian Academy of Sciences (IBRAE RAN), the developers of the system of codes for SOCRAT code. Considering the application of new modules and models, the scope of the tasks to be performed in OKB Gidropress JSC using CC SOCRAT is continuously extended.
After an accident at the Fukushima Daiichi NPP, special attention is paid to verifying the safety of operating and designing NPP with water-cooled water-moderated power reactors (WWER) under BDBAs (including SAs). Consequently, the scope and list of computational analyses using the SOCRAT code is significantly extended.
An article containing information on the research and development experience is obtained when performing NPP safety justification and research investigations (calculations) for NPP in Russia (WWER-type reactors). In addition, the CC SOCRAT is updated and certified by the Russian Regulatory Body “Rostehnadzor” for SAs calculations. This article could be useful for researchers involved in safety justification worldwide because it describes the experience gained during SAs analysis and demonstrates the fulfillment of Russian regulatory requirements (based on International Atomic Energy Agency (IAEA) requirements) in NPP safety verification.
2 Approaches for analyzing SAs for NPP with WWER RPs
Considering the requirements mentioned in the regulatory documents, as well as the wide spectrum of the tasks demanded by the customers of NPP designs with WWER RPs, the classes of the tasks to be performed by the SAs CC used is stated as follows:
-safety justification of an RP during SAs at the in-vessel stage, including evaluations of the time of occurrence of typical events, behavior of the basic parameters of RP, release of coolant mass and energy and core materials beyond the reactor core boundaries (after damage to the reactor pressure vessel);
-evaluation of fission product release into the environment during BDBAs and SAs to identify measures for personal and public protection;
-verification of hydrogen explosion safety during BDBAs and SAs, including selection of hydrogen recombinator productivity and properties;
-verification of containment integrity during BDBAs and SAs;
-verification of the efficiency and operability of the corium catcher during long-term molten core localization within the containment boundaries, restriction of fission product release, and maintenance of containment integrity;
-verification of efficiency and operability of the in-vessel melt retention system, restriction of fission product release, and maintenance of reactor pressure vessel integrity.
Considering these task classes and the outcomes of additional research and development, the data obtained using the SAs code can be used in the following documents for technical design:
-SAR for NPP with WWER RPs (Chapter 15—“Analysis of accidents” and Chapter 19— “SAs”)
-probabilistic safety analysis (PSA-1 and PSA-2);
-analysis of radiation-related consequences of BDBAs and SAs;
-analysis of hydrogen explosion safety;
-BDBAs and SAs management guide;
-calculational justification of the ex-vessel corium catcher;
-calculational justification of the in-vessel melt retention system.
Thus, within the design boundaries of OKB Gidropress JSC as the Designer General of WWER RPs, the following tasks are currently implemented using the SOCRAT/В1 code:
-safety verification of a RP during SAs;
-verification of emergency procedures for BDBAs (guide on BDBAs management) and severe accident management guideline (SAMG);
-determination of the mass and energy of the melt, coolant, and hydrogen emerging from the RP into the containment;
-verification of efficiency and operability of the in-vessel melt retention system;
-research, development, and other tasks to support design and operation of NPP with WWER RPs;
-participation in elaboration of the concepts of “Virtual Nuclear Island” and “Virtual NPP,” including application of supercomputer technologies.
3 General description of CC SOCRAT
Since the early 2000s, the SOCRAT code (formerly, thermohydraulics (RATEG)/coupled physical and chemical processes (SVECHA)/behavior of core materials relocated into the reactor lower plenum (HEFEST)) has been developed in Russia to analyze a wide spectrum of SAs at NPP with WWER RPs for all stages of an accident scenario [1,2]. Originally, the code was developed for computational justification of CC and analysis of hydrogen safety. However, the capabilities of the code and the list of the phenomena and processes that it can be modeled have considerably expanded. The development stages of the SOCRAT/В1 code are presented in Ref. [1].
Since 2004, OKB Gidropress JSC has actively utilized the SOCRAT code for scientific, cross-verification, and design calculations [3–13]. Based on the outcomes of long-term operation of the code, at the present stage, the basic calculated parameters of the code (a set and quality of models, response speed and reliability, available tools for preparation and processing of initial and calculation data) are not inferior to similar parameters of up-to-date foreign SAs code prototypes, which are also used in OKB Gidropress JSC (MELCOR-MELSIM, SCDAP, MARCH, BISTRO). Considering the increasingly stricter requirements of the customers and Supervisory Authorities, further development of the SOCRAT code is required for more comprehensive analysis of the typical phenomena and processes involved in SAs.
Enhancements to the code and broadening of its applicability are being continuously pursued by the code developers (IBRAE RAN) together with OKB Gidropress JSC and other organizations. Currently, the SOCRAT/В1 code can be used to obtain realistic estimates of all parameters important for computational justification of RP safety at the in-vessel stage of SAs with fuel melting.
The SOCRAT/В1 CC was certified in 2010 by the Council of Experts on Qualification Certification of Software at Rostechnadzor, the regulator in Russia (qualification certificate No. 275 of 13.05.2010 for SOCRAT/В1 software) [14].
According to the qualification certificate, SOCRAT/В1 is intended for integrated numerical modeling of the dynamics of the physical, chemical, thermohydraulic, and thermomechanical processes occurring in WWER RPs during SAs. This code can be utilized to assess variations in the basic RP parameters required for computational justification at the in-vessel stage of severe BDBAs, including fuel-melting accidents.
SOCRAT/В1 can also be adopted to determine the sources of hydrogen, the mass and energy of water and steam, and the parameters of the molten core (corium) and steel at the in-vessel stage of SAs for computational verification of the safety of WWER RPs.
SOCRAT/В1 includes the following modules:
-RATEG — Modeling of thermohydraulic processes in WWER RP with regard to coolant flow with gas impurities in two-liquid approximation, and heat transfer in structural components in two-dimensional/one-dimensional approximation;
-SVECHA — Modeling of the core damage processes during SAs considering the interrelation between physical and chemical processes in the core, interaction of materials and media, relocation of flowing-down liquid components, thermomechanics of claddings, and heat transfer via radiation;
-HEFEST — Modeling of thermophysical processes in molten core (corium) and internals occurring in the lower plenum of mixing at the last stage of an SAs, as well as damage to the reactor vessel and the release of materials beyond the vessel.
The RATEG, SVECHA, and HEFEST modules, being part of the SOCRAT/В1 code, include realistic estimation models demonstrating the advanced level of understanding of the key phenomena occurring at the in-vessel stage of SAs at WWER RPs. The RATEG module, intended to model thermohydraulic processes, allows for plotting and applying nodalizations simulating the structural components and equipment of WWER RPs, which are similar to the nodalizations of the advanced thermohydraulic codes used for analyses of DBAs. The SVECHA and HEFEST modules allow for considering the structural features of the reactor pressure vessel bottom, the reactor internals, and the supports of WWER fuel assemblies.
To perform analyses using CC SOCRAT, the experience gained during operation of thermohydraulic codes is utilized, which allows for minimizing the uncertainties in results at the early stage of an accident scenario, including application of the primary and secondary circuit nodalizations, which are similar to the nodalizations used for calculations with thermohydraulic codes; modeling of normal operation systems and safety systems; calculation of the steady-state; calculation of an accident because of an initiating event; and adjustment based on calculation results obtained using thermohydraulic codes.
Currently, an important target is to increase the computation speed by performing parallel calculations and using supercomputers. Within the framework of the “Virtual Nuclear Island” concept, a compact supercomputer has been delivered to OKB Gidropress JSC, and the access to the computing resources of FSUE RFNC “VNIIEF” (Russian Federal Nuclear Center; All-Russian Research Institute of Experimental Physics) has been provided.
Within the framework of the “Virtual Nuclear Island” concept, the base CCs have been adapted for supercomputer technologies in OKB Gidropress JSC. This concept involves adaptation of CC SOCRAT to perform calculations using the FSUE RFNC-VNIIEF supercomputer (based on Linux OS) in the parallel mode. The stages of the project and the respective results are presented in Refs. [17–19].
After CC SOCRAT was improved and adapted for the Linux OS and the parallel calculation technology was implemented, the real-time gain compared with the certified version for Windows OS was determined to be 50% (1.9–2.0 times) with the obtained comparable results (Table 1).
Tab.1 Comparison of the calculation results obtained using SOCRAT/B1 and RELAP5/MOD3.2 |
| Thermohydraulic parameter/signal of control and protection system | Value of the parameter in the RELAP5 code | Value of the parameter in the SOCRAT code |
|---|---|---|
| Reactor outlet temperature reached its maximum value | 4 s/603 K | 2 s/600 K |
| Secondary-side pressure reached a setpoint for turbine stop control valves (SCV-T) closing | 24 s/4.90 MPa | 23 s/4.90 MPa |
| Pressure in the pressurizer reached its local minimum value | 40 s/13.50 MPa | 45 s/13.50 MPa |
| Reactor inlet temperature reached its local minimum value | 46 s/547 K | 34 s/546 K |
| Reactor outlet temperature reached its local minimum value | 52 s/558 K | 53 s/560 K |
| Secondary-side pressure reached a setpoint for steam dump valve to the condenser (BRU-K) actuation | 163 s/6.67 MPa | 162 s/6.67 MPa |
| Pressure in the pressurizer reached its local maximum value | 166 s/15.10 MPa | 171 s/15.40 MPa |
| Reactor inlet temperature reached its set value | 110 s/553 K | 110 s/550 K |
| Reactor outlet temperature reached its local maximum | 130 s/581 K | 140 s/584 K |
| Secondary-side pressure reached a setpoint for BRU-K closing | 189 s/5.28 MPa | 193 s/5.28 MPa |
| Pressure in the pressurizer reached its maximum value | 200 s/14.20 MPa | 200 s/14.10 MPa |
The results obtained using CC SOCRAT [17–19] can be considered to be adequate. They can be used for safety verification of NPP with WWER RPs through SAs analysis and for establishing measures for SAs management. As stated in the qualification certificate for the software, a comparison is required with the results of analysis performed using certified thermohydraulic codes for the initial stage of an accident (for example, TECH-М-97 or KORSAR/GP).
The scheme of the interaction and integration of the CC SOCARAT modules during the calculation process is illustrated in Fig. 1.
Figure 1 illustrates the consequences of module invocation for each time step and the flows of the main data transfer between the modules. Figure 1 also indicates the calculation steps and main data types involved in the inter-module exchange. The minuteness grade of this scheme does not presume submission of all the calculations performed inside each module. Figure 2 demonstrates the interactions between the RATEG and containment modules (such as ANGAR/KUPOL).
4 Approaches for development and description of calculation models
Considering the advanced approaches for calculational justification of complicated engineering objects to which NPP with WWER RPs belong, a need arises for complicated integral calculational models that makes it possible for detailed simulation of all the components and equipment that have significant effects on the results to be obtained.
The typical method for model development involves nodalization of real objects into plain nodes, suitable descriptions of each object, and validation based on real objects and actual construction of an NPP. This involves mathematical numerical modeling of real objects, considering both thermo-hydraulic properties and neutron properties. The main hypothesis is to present the experiences gained through accident modeling to prepare the model description and utilize the results of virtual experiments on accident modeling to improve (in a global manner) the understanding of the difficult, complex, and non-stationary processes occurring during SAs. The SOCRAT Russian CC makes such experiments possible, which indicates the accuracy of modeling of SAs processes (i.e., whether the predictions regarding the SAs process and its consequences are correct).
When performing the calculational justification of NPP with WWER RPs, OKB Gidropress JSC selects the approach based on the following sequence [5,12,13]: the compilation of a unified database (document) describing all the basic characteristics and parameters of a specific unit in operation or under design; the development of a base calculation model for one of the CCs that fully describes the object to be modeled (NPP with WWER RP), which provides a simplified description of the systems, components, and equipment not affecting the calculation results; the validation of the base calculational model using reliable results describing the behavior of the object under consideration (NPP with WWER RP), in which the parameters of the steady-state of the WWER RP are often used; The development of partial calculational models on the basis of the base models adapted specifically for a modeled process (emergency process), nodalization detailing, equipment operation algorithms, and requirements of coupled calculations with other codes are specified based on the tasks performed earlier, as well as the requirements for a specific task; the cross-verification of particular calculational models for different CCs. If the boundaries of the qualification certificate issued by “Rostechnadzor” for a specific CC completely cover the range of the phenomena (emergency process) under study, this stage may be ignored. The reports to be handed over to the customers are compiled based on the results of this stage.
The entire set of documented information and models developed according to the list can be generally classified as “mathematical models.”
The complexity of the processes occurring during SAs at NPP with WWER RPs necessitates all the aforementioned tasks to be performed using SOCRAT/B1. In a general case, the development of base and specific models and their validation and cross-verification are time-consuming (approximately half a year) and require the involvement of highly qualified specialists (usually 3–4 specialists for SOCRAT/B1 and 1–2 specialists for thermohydraulic codes).
5 Approaches for SAs modeling using CC SOCRAT/В1
The SAR for an NPP contains information regarding BDBAs, including SAs, according to NP-006-16. Rostechnadzor’s requirements are established for the scope and structure of the SAR for NPP with WWER-type reactors. The report is submitted along with a set of documents to support the application to receive a license for NPP construction and operation.
All BDBAs and SAs scenarios resulting in excessive radiation doses for the NPP personnel and local public are singled out based on the results of the analysis and the standards established for DBAs for radioactivity release and its content in the environment. The scenarios to be considered in the documents pertaining to SAR are summarized in a list for further analysis.
Upon completion of the development of the base calculational model, including validation, the specific models (applied to each scenario in question) are developed.
The qualification certificate [14] for the SOCRAT CC has the following limitation: the calculation results at the initial stage of an accident (before exceeding the maximum design limit of fuel rod damage) must be justified using certified thermohydraulic codes.
One method to validate the mathematical model for the CC is cross-verification with results obtained using other certified codes. Currently, the domestic certified codes TECH-M-97 and KORSAR/GP are adopted to perform computational analysis of the initial stage of an SAs. In this regard, an important challenge is the process of coordinating the behavior of RP parameters determined using the certified thermohydraulic codes TECH-M-97 and KORSAR/GP and using the SAs code SOCRAT, before the transition to the severe stage of the accident (i.e., before exceeding the maximum design limit of fuel rod damage) [7,8,10,12,13].
The spectrum of SAs scenarios is fairly wide and is continuously expanding because of the development, design, and implementation of new equipment, as well as preparation and revisions of new regulatory documents. All the SAs scenarios considered at present in safety computational analysis can be divided into three key types: blackout, loss-of-primary coolant, loss-of-secondary coolant. The aforementioned types of accidents are often combined by additional failures. To ensure that the results to be obtained are adequate, it is necessary to perform cross-verification of the governing scenarios of SAs using certified thermohydraulic codes (TECH-M-97 and KORSAR/GP). The lists of governing scenarios differ depending on the specific design of the RP (type of a plant, additional equipment, etc.).
The accidents considered [7,8,10,12,13] for the AES-2006 design include “NPP blackout with failure of steam generators heat removal system (SG PHRS),” “large break (LB) loss of coolant accident (LOCA) with failure of an emergency core coolant system (ECCS) active part,” and “small break (SB) LOCA with failure of an ECCS active part.”
The analysis of the findings from these documents has indicated that insignificant differences between some parameters obtained using the CC SOCRAT and the certified thermohydraulic codes TECH-M-97 and KORSAR/GP do not affect general accident scenarios. The specified differences are caused by variations in the modeling of the thermohydraulic processes as well as in the nodalization topology.
Different values of coolant flow through the reactor core under the conditions of natural circulation are caused by differences in the calculational models for steam generators. SOCRAT and KORSAR/GP use different multi-element models of steam generators. The differences in the topology of these multi-element models lead to the differences in the heat exchange between the primary and secondary circuits under natural circulation. This causes the differences in some parameters of the primary and secondary circuits: coolant flow through the core, primary pressure, pressurizer level, steam generator levels, and pressures.
Insignificant differences in the flows from (PCFS) (HA-2) are caused by different approaches used for modeling PCFS (HA-2). The TECH-M-97 code utilizes a special calculation model for PCFS (HA-2). However, in SOCRAT and KORSAR/GP, PCFS (HA-2) is modeled based on boundary conditions.
The differences in the primary coolant mass values obtained using TECH-М-97, SOCRAT, and KORSAR/GP are explained mainly by the different coolant releases into a pipeline break, which occur because of the use of different critical flow models. The consequence is that a higher water level in the reactor core is obtained using KORSAR/GP, and accordingly, time of the heating-up of the core internals in calculation using the CC SOCRAT.
There are insignificant differences between the values of steam flow through steam dump valve to the atmosphere (BRU-A). Hence, the differences in the steam generator pressures are caused by the use of different models of BRU-A operation.
The KORSAR/GP version compiled to run in multicore processors is used for calculations, which significantly shortens the computational time. The steam-zirconium model for the aforementioned version is currently under testing and improvement. Thus, the calculations using KORSAR/GP are performed without considering steam-zirconium reactions during fuel rod heating, which causes deviations in the values presented in graphs (maximum fuel rod cladding temperatures).
Based on the results of pre- and post-test calculations during experiments at the PSB-WWER test bench [22] using KORSAR/GP (considering the model simulating the steam-zirconium reaction) and TECH-М-97, as well as based on the results of post-test calculations using SOCRAT, the capability to model LOCA adequately is verified in principle for all the presented CCs. The difference in the times for heating up the fuel rod claddings among the used CCs is approximately 10% of the experimental values.
Based on the calculation results for the considered BDBA [7,8,10,12,13], with the support from the certified thermohydraulic codes, the SOCRAT SA CC allows for modeling the main processes and phenomena involved BDBAs, including severe core damage. The obtained results are compatible to those derived from the certified thermohydraulic codes TECH-M-97 and KORSAR/GP.
If the developed mathematical model for SOCRAT is adjusted in accordance with the results of calculations performed using the TECH-M-97 and/or KORSAR/GP, it will be possible to perform calculations that agree well with those for the initial stages of accidents.
The calculations performed in OKB Gidropress JSC using the certified SOCRAT/В1 CC for safety verification pertain to the in-vessel phase (before meltdown of the reactor pressure vessel and release of the entire mass of the melt and solid fragments) of the SAs. The measures to manage the accident and mitigate its consequences are planned accordingly, such that the maximum design limit of fuel rod damage is not exceeded, if possible.
The objectives of the calculations performed using SOCRAT/В1 for the in-vessel stage of BDBAs include the evaluation of time for the following main events; the beginning of fuel heating; the melting of the core and internals and transport of the molten materials to the lower head of the reactor pressure vessel (formation of a melt pool); the damage to the lower head of the reactor vessel and release of the melt and solid fragments into the reactor concrete cavity; the determination of the parameters of the melt (mass, temperature, fractional composition) flowing outside the reactor pressure vessel during vessel damage and the melt flowing into the reactor concrete cavity; and the determination of the parameters of the coolant (steam and water) and hydrogen flowing from the RP into the containment space during the accident, beginning with an initiating event and ending with the melt being released into the reactor concrete cavity.
These processes are presented schematically in Fig. 7.
Operational safety objectives are established for each level of BDBA severity, i.e., the objectives that the operating personnel at the NPP shall strive to achieve to avoid or limit damage to safety-related equipment and/or systems or to limit the release of radioactive materials into the environment.
Based on the computational analyses of BDBAs, the NPP conditions are determined. Using these conditions, the criteria for BDBA occurrence are identified, and the source of the BDBA can be traced by referring to the level of severity.
The section containing the BDBA analysis in the SAR for NPP identifies all engineering systems at the NPP (including the non-safety-related systems) that can be involved possibly for their out-design purpose and under out-design conditions of operation, to achieve the operative safety objectives and mitigate the accident consequences at each level of severity. The redundancy of the systems fulfilling similar functions is considered as well. Possible usage of the materials and equipment located at neighboring units as well as beyond the NPP site is described, and facilities for their delivery are planned. Success criteria for personnel actions are established to achieve the operational safety objectives at each level of accident severity. These criteria are defined based on the NPP conditions.
For calculations to verify the safety (Preliminary SAR (PSAR), In-depth Safety Assessment Report (ISAR), Final SAR (FSAR)), the acceptance criteria must be met.
When performing computational analyses of BDBAs, two types of criteria are considered: one for versions without core melting and the other for versions with core melting.
The RP safety for versions without core melting is verified, as a rule, based on the acceptance criteria:
-the primary and secondary pressure should not exceed the design pressure by 15% (with consideration of transient dynamics and a time of safety device actuation);
-no local melting of fuel;
-the maximum design limit of fuel rod damage should not be exceeded, i.e., the fuel rod cladding temperature should not exceed 1200°С, the local fraction of fuel rod cladding oxidation should not exceed 18% of the initial wall thickness, and the fraction of zirconium reacted should not be less than 1% of its mass in the fuel rod claddings;
-the fuel matrix integrity should be maintained while considering the operating conditions of the fuel.
The results obtained using the certified thermohydraulic codes TRAP-97 or KORSAR/GP are accepted as a basis for verification of meeting these criteria.
The RP safety for versions with core melting is verified, as a rule, based on the following acceptance criteria:
-the primary and secondary pressure should not exceed 115% of the design pressure (with consideration of transient dynamics and a time for safety device actuation);
-if the core remains cannot be cooled inside the reactor vessel, the pressure in the primary coolant system at the point of melting should not exceed 1 MPa;
-the limiting pressures and temperatures for ensuring containment integrity should not be exceeded.
The following approaches are additionally considered:
-it is necessary to consider the capability to manage BDBAs, which will be required after an accident occurs and based on which the detailed instructions are prescribed;
-the systems whose functioning does not involve active components may be considered as factors mitigating the consequences of the accident or limiting the reactivity release.
The SAR for an NPP describes the sequences of events, actuations, failures of systems, and equipment for BDBA scenarios included in a list for a specific NPP. An accident scenario is presented in the form of a table containing the main stages and the respective durations.
Considering the aforementioned criteria, the safety verification calculations involve calculations for different accident scenarios:
-calculation with regard to the operating personnel’s actions aimed at accident management;
-calculation with regard to the operating personnel’s actions aimed at accident management to reduce the primary pressure when damage to the reactor pressure vessel reduces the pressure below 1.0 MPa (for example, a forced opening of pilot-operated relief valves (PRZ PORV) and/or emergency gas removal system (EGRS) by operating personnel);
-calculation with regard to the accident management actions of operating personnel to prevent core heating, and transition of the accident to a severe stage with uncontrolled release of radioactive products outside the NPP (for example, RP cooling through BRU-A with water supply into the primary or the secondary circuit).
A description of the thermohydraulic processes occurring in the primary and secondary circuits of the RP are provided for all BDBAs (including SAs). The scope of the information to be provided should cover the following parameters and initial conditions:
-reactor power;
-heat flux characteristics;
-pressure variation in circuits during an emergency transient;
-temperature variation of fuel rod claddings and fuel in the core components;
-coolant flowrates in the reactor and loops;
-primary coolant parameters at the inlet and outlet of the hottest channels of the reactor core;
-heat-engineering fuel characteristics;
-secondary coolant parameters;
-coolant flowrate in different systems affecting the scenario of an emergency transient;
-mass (fraction) of zirconium reacted with water steam in the core;
-hydrogen release from the reactor core and primary circuit;
-flowrate and enthalpy of coolant flowing out of the circuit.
The thermohydraulic processes occurring in the containment rooms are simulated for accidents involving the release of coolant and/or core materials from the primary circuit into the containment. The scope of the information to be provided shall cover the following parameters:
-pressure in the rooms;
-heat flux characteristics.
The SAR for an NPP describes the strategy of the corrective personnel’s actions under BDBA conditions, which are aimed at achieving the safety objectives at all possible levels of accident severity. The calculations indicate that implementation of the planned strategy during a BDBA caused by manifestation of any of the identified vulnerabilities at all possible levels of accident severity ensures either termination of the accident processes or significantly mitigates the consequences of the accident.
The thermohydraulic processes occurring in the reactor concrete cavity or fuel catcher, if included in the design, are simulated for SAs involving core material melting and falling out of the reactor pressure vessel into the containment.
The results of the SAs in-vessel stage calculations performed using the certified CC SOCRAT/В1 serve as initial data for subsequent calculations.
The scope of the presented information should cover at least the following parameters:
-change in the aggregate state of the melt components;
-variation in the temperature of the melt and cavity concrete or the structural components of a catcher;
-characteristics of heat fluxes;
-operation of the cooling systems of a catcher;
-change in configuration of the core cavity because of concrete damage;
-change in the thickness of the reactor compartment base plate at fuel melt location;
-mass (fraction) of zirconium and other metals reacted with steam;
-characteristics of steam explosions (energy released, parameters of shock waves affecting the reactor vessel and other structures of the RP and the containment).
The SAR for an NPP shall contain the analysis of the release and spreading of radioactive materials. The results of the SAs in-vessel stage calculations performed using the certified CC SOCRAT/В1 serve as initial data for subsequent calculations. The results also serve as the initial data for calculations to verify hydrogen explosion safety.
Based on the information presented in the section containing the BDBA analysis in the SAR, conclusions are drawn regarding the efficiency of the measures planned to manage BDBAs.
Based on the information in the SAR, the Russian Rostechnadzor assesses the sufficiency of the justifications for siting, construction, commissioning, operation, and decommissioning of an NPP at a specific site. These objectives are to avoid exceeding the assigned irradiation doses for personnel and the local public, comply with the standards for the release of radioactive substances and their content in the environment during normal operation and under DBAs, and determine the capability to mitigate the consequences of BDBAs.
6 Main tasks for SAs analysis in OKB Gidropress JSC in 2010
6.1 Safety assessment after Fukushima accident
After the accident at the Fukushima NPP (Japan), the management of State Corporation “Rosatom” decided to assess the current status of Russian NPP safety and develop the necessary measures to improve NPP stability under abnormal external hazards [23].
In accordance with the directive of the Federal Environmental, Industrial and Nuclear Supervision Service of Russia, special-purpose inspections were conducted at all the NPP operated in Russia, to assess the safety of the power units under extreme external hazards that could cause SAs. The aforementioned inspections were conducted considering the “stress-test” methodology recommended by the Western European Nuclear Regulators Association (WENRA). JSC “Rosenergoatom” compiled an industry-specific plan for activities to improve the safety of NPP operated in Russia, titled “Updated measures to mitigate consequences of BDBA at NPP,” based on the outcomes of the special-purpose inspections presented in “Reports on NPP safety analysing under extreme external hazards” for each NPP considered.
OKB Gidropress JSC prepared the “Technical requirements for additional design solutions aimed at preventing disturbances of safety barriers at NPP with WWER” [23] within the framework of the objectives stipulated in the “Updated measures to mitigate consequences of BDBA at NPP.”
The objective of the aforementioned calculations is also to identify the safety deficiencies (required for application of additional equipment and systems and for specifying or planning additional measures for management of BDBA, etc.) of NPP units with WWER-1000 and WWER-440 RPs, based on additional computational analyses of the governing scenarios of BDBAs while considering natural abnormal external events.
Detailed computational analyses have been performed for the following governing scenarios of BDBA:
-blackout with loss of onsite and offsite power supply to the plant from normal operation sources and with a failure of all diesel-generators during unit shutdown for refueling, including two versions for each type of RP (V-187, V-320, V-338, V-179, V-213, V-230): ① calculating the accident without considering the operating personnel’s actions aimed at managing the accident and without considering improvements according to additional design solutions; ② calculating the accident considering the operating personnel’s actions aimed at managing the accident and considering improvements according to additional design solutions;
-blackout with loss of on-site and off-site power supply to the plant from normal operation sources, and with a failure of all diesel-generators during unit operation at power, including three versions for each type of RP (V-187, V-320, V-338, V-179, V-213, V-230): ① calculating the accident without considering the operating personnel’s actions to improve accident management, and without considering additional design solutions; ② calculating the accident considering the operating personnel’s actions aimed at managing the accident, and without considering improvements by additional design solutions; and ③ calculating an accident considering both the operating personnel’s actions aimed at managing the accident and the improvements made by additional design solutions.
The considered accidents are categorized under SAs caused by core melting. The in-vessel phase (to meltdown the reactor vessel and complete the release of the whole mass of melt and solid fragments) of an accident is determined according to the approaches described in Sections 4 and 5 of the present report.
6.2 Computational analyses to justify the in-vessel melt retention
The feasibility and practicability of realizing the reactor vessel external cooling device (RVECD) with regard for an actual configuration of Refs. [24,25] have been assessed for NPP with RP WWER-440 operated in Russia. Accordingly, Units 3 and 4 of Kola NPP (design V-213) have been considered in detail. A peer review was conducted to determine the feasibility of applying the external cooling device of the reactor vessel for other units.
The module HEFEST, which is a component of the certified CC SOCRAT/В1, is used to evaluate thermal loads onto the reactor vessel during SAs with fuel melting.
For the analyses, the governing conditions were considered under BDBA with severe damage of the reactor core for which the in-vessel melt retention is necessary:
-“LB LOCA (Dnom 500) combined by a complete failure of ECCS active part”;
-“LB LOCA combined by high pressure emergency core cooling system (HP ECCS) and low pressure emergency core cooling system (LP ECCS) failures when changeover from water intake from SG box sumps.”
For operating NPP with RP WWER-1000 in Russia, the feasibility and practicability of realization of the melt retention and reactor vessel cooling system (SUROK) considering a previous actual configuration [26] have been determined. With this, the units of design V-320 were considered in detail. A peer review was conducted to realize the feasibility of application of the reactor vessel external cooling device for other units.
“NPP blackout” with the beginning of melt produced at the reactor pressure vessel, that occurs after 12 h and 24 h of the initiating event is selected as the governing condition for analyzing a feasibility of applying the external reactor vessel cooling at operating NPP with RP WWER-1000. For further analysis, the most unfavorable combinations of melt components and melt component temperatures are selected (multi-variant computation analyses are conducted using super computers).
According to the results of calculations performed using the CC SOCRAT/В1, melt retention is impossible for version “12 h” (thermal conductivity is exceeded, no residual wall thickness of the reactor vessel, etc.). For version “24 h,” considering the application of the profiled channel around the reactor pressure vessel (under-reactor metal work), there is a margin to departure from nucleate boiling (DNB) and the thermomechanics criteria are met.
A provision is made for SUROK for the medium-power reference design-NPP with WWER-600 at the stage of development of conceptual solutions [27]. Currently, the technical design of the system, including the engineering, process, and calculation work, are under elaboration.
Preliminary computational estimates of the process of the core melt retention within the reactor pressure vessel, which were performed for WWER-600 RP in 2011–2012 [28–30], indicated that none of the criteria of the core melt retention within the reactor pressure vessel is violated. Furthermore, there is a certain margin in terms of mechanical strength and heat flux in implementing melt retention within the reactor pressure vessel.
Similar results were derived for the design of NPP with WWER-TOI RP [28–30] subject to a successful functioning of passive safety systems within 72 h from an initiating event-“LB LOCA and NPP blackout.” The results indicate that the in-vessel melt retention concept can be implemented under the aforementioned conditions for a 1300 MW WWER (WWER-TOI RP).
In 2014, an integrated computational analysis was performed for NPP with WWER-600 RP by applying a realistic approach [31]. A rigorous calculation of a postulated SAs (break of MCP Dnom 850 in case of blackout) was performed for a realistic (specified) estimation of the core melt retention process within the reactor pressure vessel. This SA was chosen as the governing accident for RP with WWER-600 because it is characte-rized by the minimum time from the initiating event, to exceeding the maximum design limit of fuel rod damage. The passive safety systems, included in the RP with WWER-600, are designed in such a way that exceeding the formal criteria (maximum design limit of fuel rod damage) is reached under the governing accident, and not until 24 h from the initiating event.
Because of the analysis [31] using the module HEFEST (CC SOCRAT), specified values of heat flux which limit the margin for DNB are obtained, as well as the actual state of the molten materials (relocation time, masses, temperature, and power distribution). Additionally, the chronological sequences of the occurrence of events and the processes occurring during the accident (beginning with the initiating event and ending with melt producing at the reactor vessel bottom) are established.
Attempt was made to perform similar calculations for other designs of NPP with high- power WWER RP.
6.3 Additional tasks
-calculation of governing SAs within the framework of elaboration of SARs for operating NPP with WWER RP (Balakovo NPP—Units 1–3, Kalinin NPP—Units 1–3, Rostov NPP—Units 1–4, etc.), including the justification of accident management measures;
-calculational justification of emergency instructions for the AES-2006 design (Leningrad NPP-2 and Novovoronezh NPP-2);
-elaboration of documents for licensing the NPP with WWER-1000 and WWER-1200 RP being under design (NPP “Hanhikivi-1,” NPP “Paks-2,” Tianwan NPP (Units 7–8), NPP “Xudapu” (Units 3–4), etc.);
-SAs calculations and cross-verification with thermohydraulic codes applied to AES-2006 (Novovoronezh NPP-2) within the framework of implementation of “Virtual NPP” concept;
-research and development to support SARs for NPP being in operation and under design with WWER-1000 RP and WWER-1200 RP (AES-2006);
-additional design and research work for NPP with WWER-1000 RP and WWER-1200 RP.
7 Perspective trends of work
7.1 Computational analyses for SAMG
According to the recent regulatory requirements and the approaches to be implemented, the elaborated SAMG is symptom orientated. It should include a personnel’s actions based on the symptoms of ongoing events and states of the RP, as well as the prediction of expected conditions during accident propagation. These actions are performed to restore the governing (or critical) safety functions and to mitigate radiation consequences of the accidents.
Another principal provision to be considered for elaborating the SAMG is a systematic approach based on the use of the postulated list of severity levels of the unit state while propagating an accident. The application of this approach can justify the completeness and sufficiency of several presentative scenarios of SAs, which, in turn, is a robust and logical basis for elaboration of a personnel’s response actions. A rigorous calculational justification will be required for all the criteria, parameters, and instructions under consideration.
The certified CC SOCRAT makes it possible to describe all the physical models, including the development phase, when performing calculations of the in-vessel stage of SAs during calculational justification of SAMG.
Respective studies were performed in 2015–2018 for AES-2006 design (Leningrad NPP-2 and Novovoronezh NPP-2-2). A series of studies for “Akkuyu” NPP, “Rooppur” NPP, etc. is planned for 2021–2023.
7.2 Computational analyses to justify the in-vessel melt retention for NPP with WWER-440 RP and WWER-1000 RP
Based on the outcomes of the scientific and engineering council of SC “Rosatom” and “Rosenergoatom” Concern, which was held at the end of 2013, it is decided to continue work for NPP with WWER-440 RP, both in terms of developing design solutions and conducting research and development. Currently, the formation of a preparatory stage of the work and compilation of a program for conceptual design development is underway. A provision is established for a series of additional computational analyses of SAs, as well as calculations of melt behavior during long-term in-vessel retention using the CC SOCRAT.
Considering the derived results for NPP with WWER-1000 RP [26], a decision on application of SUROK has not yet been made. OKB Gidropress JSC specialists proposed to perform additional research aimed at a reasonable choice of the containment melt retention strategy-melt spreading or in-vessel retention. The proposed program of study is planned for 2.5 years. The study can facilitate additional analyses of SAs and melt behavior, both in the reactor pressure vessel and during interaction with concrete (in case of a concept of melt spreading in the reactor concrete cavity).
7.3 Uncertainty analysis
Adaptation of CC SOCRAT to the use of parallel computations by supercomputers can also be applied effectively within the framework of uncertainly analysis [17,18]. Domestic regulatory documents (NP-001-15) require the use of realistic models for analyzing a scenario of SAs. This represents a need for an uncertainly analysis of the results to be obtained. The uncertainty analysis implies multiple (in the order of a hundred) calculations with varying initial and boundary conditions and material properties, as well as model, operational and other uncertainty parameters. Because the calculational models in SOCRAT are realistic, its usage in design calculations demand a rigorous uncertainty analysis.
A special-purpose module VARIA [32] is developed and actively used in IBRAE RAN to fulfil the objectives related to sensitivity and uncertainty analyses (multi-variant calculations).
By multi-variant calculation, a series of tens or hundreds of calculations of a similar type is implied with different inputs. The objective of these calculations is the sensitivity analysis of the results to be obtained to variation of the inputs. Sensitivity and statistical analyses of scattering of results are required for realistic safety justification based on the best estimate codes (best estimate codes+ uncertainty analysis). This approach has already been applied abroad for a long period. There are several procedures that are built into integral codes or are used separately. For example, in France, the SUNSET code is used for this purpose.
The code VARIA is adapted for assessing an effect of variation of the input parameters onto a result of modeling the processes both by the integral code SOCRAT and by its stand-alone modules (including the module HEFEST) [32].
The respective study has been performed for HANHIKIVI NPP to elaborate the supporting topical reports and thereby elaborate the SAR. In 2021–2022, a similar study will be performed for Tianwan NPP (Units 7 and 8), Balakovo NPP (Unit 1), etc.
7.4 Calculations for PSA-2
Reporting documentation for PSA-2 should be included into a set of documents in the SAR for newly designed units to be submitted to receive a license for construction of the Unit—for operating units of PSA-2.
When making PSA-2, a complete set of the accident sequences with an accidental release must be identified, probabilities of their occurrence must be estimated, probabilistic safety parameter(s) must be calculated, and compliance of these parameters with the requirements of regulatory documents must be verified.
According to the requirements for the scope of PSA-2, it is necessary to submit the results of the BDBA parameter calculations performed within the framework of PSA-2 under elaboration, or the results of the BDBA parameter calculations performed within the framework of other researches. The results must be used for the purpose of PSA-2 for which applicability is justified in the PSA-2 documentation.
Most of the processes and phenomena to be considered can be fulfilled using CC SOCRAT.
A respective study is planned for HANHIKIVI NPP within the scope of development of technical design.
7.5 CC SOCRAT modernization to extend the list of the events and processes to be modeled
In 2014–2020, a significant scope of work on SOCRAT code verification was performed based on the results of NEA/OECD ATLAS and PKL experiments. The pre- and post-test study results indicate a high level of modeling using the SOCRAT code, as well as a high qualification of the users in OKB Gidropress JSC and IBRAE RAN.
The work of updating SOCRAT SP is planned within the framework of advanced research and development. Gained experience in design calculations, and a status of approaches to computational modeling of SAs in Russia, as well as considering foreign approaches to be implemented in design with water-cooled water-moderated type NPP, numerous trends are identified which are caused both by specific-plant features of NPP with WWER RP under design (passive safety systems, behavior of non-condensable gases, CC, severity of the requirements for radiation safety, etc.) and by extension of knowledge in individual subjects (experimental investigations in Russia and abroad, extension of databases on processes and phenomena), which cannot be described to a sufficient extent by available models and modules involved in SOCRAT [3–5].
Updating the CC SOCRAT with regard to advanced approaches should be based on improvement of available models and modules of the code SOCRAT. In addition, the realistic estimates of the parameters of NPP with WWER RP must be provided in safety analyses in terms of SAs, which is currently a crucial task in the justification of WWER-TOI RP. Furthermore, the experience of scientific and design organizations both in main processes and phenomena typical for SAs, and the consideration of available data on accidents at Three Mile Island (TMI) NPP and “Fukushima” Daiichi NPP are vital components for updating SOCRAT.
8 Conclusions
An extensive experience in the analysis of BDBA, including SAs at RP, was gained in OKB Gidropress JSC over the past two decades. Considering a long-term positive experience in the use, successful certification in Rostechnadzor, as well as a wide spectrum of capabilities, the CC SOCRAT/B1 was used in OKB Gidropress JSC as a base SAs code.
The participation in international benchmarks, along with collaborative reports of developers and users of the thermohydraulic and SAs CCs [3–13], indicated that the code SOCRAT provides an adequate modeling of principal thermohydraulic and physical-and-chemical processes in RP in comparison with other codes. Adaptation of SOCRAT for supercomputer technologies within the framework of “Virtual Nuclear Island” made it possible to perform multi-variant calculations and uncertainty analysis using the supercomputer based on RFNC-VNIIEF, as well as the compact supercomputers with which the main design and engineering organizations of State Corporation “Rosatom” was equipped.
Within the design boundaries of OKB Gidropress JSC, using the code SOCRAT/B1 at present, the following tasks were solved:
-safety justification of a RP during SAs;
-justification of guidelines on BDBA and SAMG;
-determination of mass and energy for melt, coolant, and hydrogen emerging from RP into the containment;
-justification of the efficiency and operability of the in-vessel melt retention system;
-research and development conducted for the other work devoted to support design and operation of NPP with RP WWER;
-participation in the development of “Virtual NPP” concepts, including the work on application of supercomputer technologies.
Several approaches were considered to develop computational models and analyze SAs using CC SOCRAT. This process was structured in the OKB Gidropress JSC. It demonstrated a noticeable decrease in human-factor effect onto the results, and consequently reduced the probability of deriving erroneous results.
This paper presented the principal results of the study performed in 2010–2020 in OKB Gidropress JSC using the CC SOCRAT, as well as a list of the studies planned for 2021–2023.
In general, the list of the SOCRAT/B1 code validation studies was sufficient and covered all the important processes for SAs development with fuel melting, from the initiating event to corium output generated from the Reactor Pressure Vessel (RPV) processes during core reheating; fuel melting and relocation on the RPV bottom head owing to the LOCAs in the primary circuit; oxidation of core materials and reactor internals, and hydrogen evolution and its propagation over the primary circuit into the containment outlet; and processes during the melt retention on the RPV bottom, RPV failure, and melt release into the localization device.
The CC SOCRAT validation matrix contains several thermohydraulic effects, with a typical design and BDBAs. These effects appear at the early stage of SAs development, i.e., during thermohydraulic processes in the primary and secondary circuits during SB LOCA; thermohydraulic processes at LB LOCA, including core draining and reflooding; containment processes during the loss of coolant accidents in the primary circuit; and in-service processes of the passive safety systems of WWER-type reactor designs.