Deterministic Analysis of Beyond Design Basis Accidents in RBMK Reactors

RBMK reactor belongs to the class of graphite-moderated nuclear power reactors that were designed in the Soviet Union in the 1950s. The usage of materials with low neutron absorption in RBMK design allows improving the fuel cycle by using cheap low-enriched nuclear fuel. In total 17 RBMK reactors have been built in Russia, Ukraine and Lithuania. One reactor is still under construction at Kursk Nuclear Power Plant (NPP). All three surviving reactors at Chernobyl NPP (Ukraine) were shutdown (the fourth was destroyed in the accident). Units 5 and 6 at Chernobyl NPP were under construction at the time of the accident; however, further construction was stopped due to the high contamination level at the site and political pressure. In Lithuania two reactors at Ignalina NPP were shutdown in 2004 and 2009. At present time no plans are made to build new RBMK type reactors, but in 2011, 11 RBMK reactors are still operating in Russia (4 reactors in Saint Petersburg, 3 – in Smolensk and 4 – in Kursk).


Specifics of RBMK reactors
A simplified heat flow diagram of RBMK reactor is provided in Figure 1 [1]. The reactor cooling water, as it passes through the core, is subjected to boiling in the fuel channels (2) and is partially evaporated. The steam-water mixture then continues to the large drum separator (3), the elevation of which is greater than that of the reactor. The water settles there, while the steam proceeds to the turbines (5). The remaining steam beyond the turbines is condensed in the condenser (7), and the condensate is supplied by the condensate pumps (8) into the deaerator (9). Deaerated water is returned by the feed pump (10) to the drum separator (4). The coolant mixture is returned by the main circulation pumps (11) to the core, where a part of it is again converted to steam. The reactor power is controlled using control rods (3). This fundamental heat cycle is identical to the Boiling Water Reactor cycle, extensively used throughout the world, and is analogous to the cycle of thermal generating stations. However, compared to BWRs used in Western power plants, the RBMK-1500 and RBMK-1000 have a number of unique features. The comparison of most important parameters of the reactor is presented in Table 1. As it is seen from the presented table, the values of specific power per fuel quantity are very similar for all reactors. The value of power per fuel rod length is the highest for RBMK-1500 reactor. To reach such high value, additional specifically designed spacers, which operate like turbulence enhancers to improve the heat transfer characteristics, are mounted in the fuel assemblies of RBMK-1500. Specific power per core volume in RBMK-1500 is higher than in RBMK-1000 reactor, but in BWR-type reactors this characteristic is approximately 10 times higher.

No.
Parameter BWR * RBMK-1000 RBMK-1500 In RBMK-type reactors a part of Reactor Cooling System (RCS) above the reactor core is located outside the leaktight compartments. In the RBMK reactors design, these compartments are called Accident Localization System (ALS). This is different from the typical PWR or BWR plants, which have full containment [1]. The Drum Separators (DS) and a part of downcomers are contained in the DS compartments, which are connected to the reactor hall. Such compartments are not as strong as the leaktight compartments of ALS.

Specifics of RBMK reactor core
Nuclear fuel used in the RBMK-1500 (the reactor of Ignalina NPP in Lithuania) is slightly enriched with uranium in the form of uranium dioxide. According to RBMK-1500 design, low-enriched (2%) uranium fuel was used since the begging of Ignalina NPP exploitation. Later this fuel was mostly fully replaced by a little higher-enrichment (2.4% and 2.6%; 2.8%) uranium fuel with a burnable erbium absorber. The change of fuel allows improving safety and economic parameters of the plant.
Fuel pellets have a 11.5 mm outer diameter and are 15 mm long. The fuel pellets have hemispherical indentations in order to reduce the fuel column thermal expansion and thermo-mechanical interaction with the cladding. The 2 mm diameter hole through the axis of the pellet reduces the temperature at the center of the pellet, and helps to release the gases formed during the operation. The pellets placed into a tube with an outside diameter of 13 mm compose a fuel rod. The active length of RBMK-1500 fuel rod is approximately 3.4 m.
www.intechopen.com The tube (fuel cladding) material of the fuel rod is an alloy of zirconium with one percent niobium. The fuel rods are pressurized with helium and sealed. The fuel pellets are held in place by a spring. 18 fuel rods, arranged within two concentric rings in a central carrier rod, contain the fuel bundle with an inside diameter of 8 cm [1].
Active core height is 7 m in RBMK type reactors. Thus, the complete fuel assembly is made up of two bundles, which are joined by means of a sleeve at the central plane. The lower bundle of the fuel assembly is provided with an end grid and ten spacing grids. The central tube and the end spacer are also made from the zirconium-niobium alloy. The remaining spacers are made from stainless steel and are rigidly fixed (welded) to the central tube. Apart from the spacers, the top bundle also has intensifying grids, which act as turbulence enhancers to improve the heat transfer characteristics. The fuel tubes are mounted so that axial expansion of the upper or lower bundles takes place in the direction towards the center of the core. The total mass of uranium in one fuel assembly is approximately 110 kg [1].
The fuel channels, where the fuel assemblies are placed, consist of three segments: top, center and bottom. The center segment is an 8 cm inside diameter (4 mm thick wall) tube, made from zirconium-niobium alloy. The top and bottom segments are made from stainless steel tube. The center segment of fuel channel, set in the active core region, and zirconiumniobium alloy warrant the low thermal neutron absorption cross-section.
The fuel channel tubes are set into the circular passages which consist of aligned central openings of the graphite blocks and stainless steel guide tubes of the top and bottom core plate structures to maintain the core region hermetically sealed. The reactor core is constructed of closely packed graphite blocks stacked into approximately 2500 columns with an axial opening. Most of the openings contain fuel channels. A number of them also serve other purposes (e.g. instrumentation, reactivity regulation). The total mass of graphite is about 1700 tons. The fuel channels together with graphite stack are placed inside the leaktight reactor cavity.
The fuel channel tubes also provide cooling for the energy deposited in the graphite moderator of the core region. In order to improve heat transfer from the graphite stack, the graphite rings surround the central segment of the fuel channel. These rings are arranged next to one another in such a manner that one is in contact with the channel, and the other with the graphite stack block. The minimum clearance between the fuel channel and the graphite ring is 1.15 mm, and between ring and graphite stack -1.38 mm. These clearances prevent compression of the fuel channel tube due to the radiation and/or thermal expansion of the graphite stack [1].

Flow paths of radioactivity release to the environment
The consequences of any accident at NPP (radioactivity release to environment) depend on what safety barriers were violated. As for any Light Water Reactor (LWR), 4 safety barriers (Table 2) could be distinguished for RBMK-1500. The provided comparison between the safety barriers of vessel-type reactors and RBMK-1500 indicates that each fuel channel corresponds to the reactor vessel and reactor cavity together with ALS and reactor building perform a function of containment.

RBMK-1500
Vessel-type reactors Fuel pellet Fuel pellet 1 Fuel cladding Fuel cladding Fuel channel and reactor cooling system Reactor vessel and reactor cooling system Reactor cavity, ALS and reactor buildings Containment Table 2. Safety barriers of RBMK-1500 and vessel-type reactors The fuel pellet contains most of the radioactive material. Some gaseous (e.g. Xenon, Krypton) and volatile (e.g. iodine, caesium) fission products is released from the fuel matrix to the gap between the fuel pellet and fuel cladding, but until the cladding remains intact, the radioactive materials are confined and do not enter into the coolant.
The fuel cladding can fail due to:  thermal-mechanical interactions between the fuel and the cladding,  or thermal-mechanical deformations of the cladding under positive or negative pressure differentials.
The first type of failure is typical for rapid and large power excursions (e.g., reactivity initiated power excursions) where hot and possibly molten UO 2 could come into contact with the cladding material. The RBMK fuel is similar to the fuel of any LWR; however, the probability of fuel damage in RBMK type reactors due to the reactivity initiated accidents is lower, because typical time of reactivity insertion in RBMKs is measured in seconds rather than in microseconds as for other LWR [2]. The second type of cladding failure is associated with cladding temperature excursions, either when the pressure in RCS is higher than the internal pressure (i.e. positive pressure differential), or when the internal pressure is higher than the coolant pressure in RCS (i.e. negative pressure differential). The positive pressure differential is possible in case when the pressure in RCS is maintained high without providing cooling to fuel. Under positive pressure gradients, hot cladding collapses onto the fuel pellet stack and deforms into gaps between the fuel pellets, which causes a failure of cladding. If the gap between fuel pellets is 2 mm or larger, then such fuel failure would appear at fuel cladding temperature of 1200 -1300 o C. The fuel cladding failure temperature decreases if the axial gap between the fuel pellets increases. Normally, the maximum gap between the fuel pellets in any fuel rod is 1.02 mm with the probability of 0.997. Thus, the fuel collapse probability for RBMK-1500 is very low at temperature level below 1200 o C. The ballooning of fuel cladding is relevant to the accidents when the internal pressure is higher than the external one (i.e. negative pressure differential). The example of such accident is a large Loss of Coolant Accident (LOCA), when the fuel cladding temperature increases during a rapid pressure drop in the reactor cooling system. The internal pressure in fuel rods of RBMK-1500 is approximately 1.2 MPa during normal operation. If due to a large LOCA, the pressure in RCS decreased down to atmospheric, then the fuel cladding failure would appear due to ballooning at temperature 850 -1000 o C [2,3]. Another potential for fuel cladding failure is the fuel cladding oxidation. The cladding oxidation is related to an embrittlement of fuel cladding that could potentially lead to a formation of fuel debris that can also obstruct the coolant flow path. The very rapid oxidation (reaction between steam and Zirconium) of fuel cladding starts at temperature level higher than 1200 o C. This chemical reaction is exothermic and if it occurred, a large amount of chemical heat would be generated and could lead to a melting of cladding, a liquefaction of fuel and possibly a blockage of coolant flow paths by relocated fuel materials. Summing-up all possible mechanisms, affecting integrity of fuel cladding, the acceptance criterion 700 o C was used for the safety analysis [2,3]. It means that below such temperature fuel cladding integrity will be warranted.
If the fuel cladding loses its integrity (i.e., if it fails), a key barrier to the release of fission products is breached, and the coolant in the RCS becomes contaminated with radioactive fission products released from the fuel. However, until the RCS remains intact, fission products are confined inside piping and do not enter the compartments. If the RCS piping ruptured, then the contaminated coolant would be released to the compartments (see Figure 2). According to its function and location, the fuel channel of RBMK reactor corresponds to the pressure vessel of vessel-type reactors. Therefore, it is the most important part of RCS. If the Fuel Channel (FC) wall heats up while the internal pressure is elevated, it may expand until it contacts the surrounding graphite blocks [4]. In the RBMK reactor, the deformation of fuel channels is arrested at rather modest uniform strain values due to the contact of the deformed FC with surrounding graphite block. Experiments show that the contacted channel fails only if and when the graphite block is disrupted by the pressure load transmitted to it by the deformed channel. At nominal pressure in FC (7 -8 MPa) the temperature of fuel channel failure is not less than 650 °C and it depends on the heat-up rate. Experiments showed that in case of a higher heat-up rate, when the FC rupture occurs, the temperature values are higher compared to the lower heat-up rate. It was also discovered that in order to obtain the corresponding deformations at lower pressures higher temperatures or higher heat-up rates are required [4]. The acceptance criterion of 650 o C for fuel channel walls was assumed for the safety analysis [2,3].
The fuel channels together with graphite stack are placed inside the leaktight reactor cavity, which is formed by a cylindrical metal structure together with bottom and top metal plates ( Figure 3). If FC ruptured, the steam-water mixture would be released to this cavity and come into contact with hot surfaces of the graphite stack ( Figure 4). The Reactor Cavity (RC) performs the function of containment; therefore, the integrity of the cavity is of high importance. RC consists of the structures shown schematically on the left side of Figure 3, which summarizes the design pressures based on the most conservative assessments. The figure indicates that the minimum of permissible excess pressures is 214 kPa [3] i.e. the pressure, which corresponds to the weight of upper metal plate (2). According to the reports [5,6,7], the more realistic values are: 1) for the upper plate 300 kPa; 2) for the casing (5) 330 kPa and lower plate (6) 380 kPa. Thus, in any case the top metal plate is the weakest point in the structure of reactor cavity, but the excess pressure that could be withstood is at least 300 kPa. The failure of the bottom plate could be expected only in the case of lowpressure accident scenario if the molten fuel would accumulate on it. In such accident scenario the fuel would relocate downwards in the fuel channel boundaries by candling (melting, forming eutectics with the clad and structure, flow downwards, freezing, and then remelting) until it reaches the pipes below RC. Since these pipes become unrestrained if they melt, the molten material would flow out onto the surrounding floor. Thus, the fuel is not expected to accumulate on the bottom plate of RC. At NPP with a full-scope containment, which covers all the piping of reactor cooling system, the coolant would be discharged to the containment, i.e. reinforced and leaktight building capable to withstand excess pressure of 500 -700 kPa. At Ignalina NPP with the RBMK-1500 reactor, a part of RCS above the reactor core is located outside the reinforced compartments. The drum separators and part of downcomers are contained in the DS compartments, whish are connected to the reactor hall (see XI and XII in Figure 4). These compartments are called "reactor buildings" and they can withstand 24.5 kPa excessive pressure, that is a few times lower inside pressure than in the reinforced leaktight compartments I, II, III, IV, V and VI www.intechopen.com In case of an accident, these compartments have installed special valves or hatches that open to release the steam gas mixture to the environment. The part of steamlines and feedwater lines are contained in the turbine hall and deaerators compartments, respectively. If the rupture appears in these compartments then the release is not confined and the retention of fission products depends only on the natural sedimentation processes.
The ALS, RC and the other reactor buildings (DS compartments and reactor hall) of Ignalina NPP perform a function of containment, i.e. they are reinforced and leaktight, but due to its specifics it is usually called confinement. Therefore, in this chapter the term containment will be understood as a function rather than building.

Categorization of the beyond design basis accidents for RBMK reactors
Based on the presented specifics of RBMK, two categories of Beyond Design Basis Accidents (BDBA), i.e. core damage types in RBMK reactors were proposed by RBMK designers from Russia (Kurchatov Institute and Research and Development Institute of Power Engineering) [8]:  damage of the core or its components with the reactor maintaining its overall structural integrity;  total damage of the core, resulting in the loss of general structural integrity of the reactor system.
Such grouping of accident is very important regarding accident management. If the core or its components remain structurally intact (first category of core damage), then the controlling actions (accident management) for limiting and delaying damage of the core, as well as prevention of confinement damage and mitigation of fission products release are possible. If the general structural integrity of the reactor system is lost, then depending on the degree to which the general structural integrity of the reactor is maintained, (second category of core damage), the emergency plan has to be activated in order to protect the public (sheltering, evacuation, etc.).
The first category of core damage can be further subdivided into the following accident groups (Fig. 5):  no severe damage of the core (1.1);  severe core damage accompanied by containment of the core fragments in the reactor core, accident localization system or other reactor buildings (1.2).
Accidents, leading to a complete reactor core damage, with loss of structural integrity of the reactor can also be divided into two groups [9]:  accidents when heat-up of the reactor core occurs during reactor operation or within the first seconds after the reactor shutdown, when decay heat is high (2.1);  accidents when heat-up of the reactor core occurs after the reactor shutdown (2.2).
Damage of the core or its components with the reactor maintaining its overall structural integrity Total damage of the core resulting in the loss of the general structural integrity of the reactor system As it was mentioned, such grouping of accidents is the starting point for the development of the measures for accident management. However, the development of accident management guidelines requires performing deterministic analysis of all possible accidents in each group. Based on this analysis the accident consequences, available time for possible operator actions and possible modifications of emergency systems may be determined.
In the next chapter the deterministic analysis of reactor core and reactor cooling system is presented, whereas the modeling of the process in the RBMK confinement is presented in the monograph [10].

Models for the deterministic analysis of BDBA
Models developed for the thermal-hydraulic analysis of processes in the reactor core and reactor cooling system are presented below. The models of RBMK-1500 are developed using system state-of-the-art code RELAP5 and RELAP/SCDAPSIM.

Reactor cooling system model of RBMK-1500
The RELAP5 computer code has been developed by Idaho National Engineering Laboratory [11]. It is a one-dimensional non-equilibrium two-phase thermal-hydraulic system code. The RELAP5 code has been successfully applied to PWR and BWR reactors. Since 1993 The RELAP5 model of the Ignalina NPP was used in the Lithuanian Energy Institute for the analyses of thermal-hydraulic response of the plant to various transients. The RELAP5/MOD3.2 model of the Ignalina plant (nodalization scheme) is presented in Figure 6.
The model consists of two loops. The left loop of RCS model consists of one equivalent core pass. Two drum separators are modeled as one "branch" type element (1). All downcomers are represented by a single equivalent pipe (2), further subdivided into a number of control volumes. The pump suction header (3) and the pump pressure header (8) are represented as branch objects. Three operating MCPs are represented by one equivalent element (5) with check and throttling-regulating valves. The stand-by MCP is not modeled. The bypass pipes (7) between the pump suction header and the pump pressure header is modeled with the manual valves closed. This is in agreement with a modification recently performed at the Ignalina NPP. All FCs of this left core pass are represented by an equivalent channel (12) operating at average power and coolant flow.
Compared to the model for the left loop, in the right one, the loop section between the pressure header and the DS is represented in a more detailed manner. The MCP system is modelled in more detail also (it is modelled with three equivalent pumps). The right loop model consists of three equivalent core passes. First core pass represents one single GDH with an equivalent FC of average power. Second core pass represents single GDH with failed to close check valve. A few equivalent channels of different power levels represent fuel channels, connected to this GDH. The other core pass represents the other 18 GDHs. The channels of this pass are simulated by an equivalent FC of average power. The steam separated in the separators is directed to the turbines via steam pipes (15). Two Turbine Control Valves (TCVs) organize steam supply to the turbines. The guillotine break of MCP pressure header (17) in the right loop model of RCS is modelled by a valve (18). The flow area of this valve is double of pressure header flow area. The valve (18) is connected to the volume (19), which represents the compartments covered by RCS pipelines.
www.intechopen.com The fuel assemblies in reactor core are described as heat structure elements. The fuel c h a n n e l s w i t h f u e l a s s e m b l i e s w e r e d i v i d e d into a few (depending on the needs of modeling) equivalent groups according to the power and coolant flow rate values. For the core power of 4200 MW, the channel average power is assumed to be 2.53 MW, the maximum channel power is 3.75 MW and minimum channel power is 0.88 MW. It was assumed that approximately 95% of generated fission and decay power is generated in the fuel, and 5% in the graphite stack. More detail about the Ignalina NPP model, developed using RELAP5 code, is presented in [12,13]. Model validation is performed by comparing calculation results and measurements using separate effect tests [14] and measurements at Ignalina NPP (integrate effects measurements) [13]. The experience of use of computer code for modeling of reactor cooling circuit in RBMK showed, that RELAP5 is very suitable for this task. One dimensional code is perfect for the modeling of thermal hydraulic and heat transfer processes in the RCS, which consists of many long pipelines without any cross flow.
For the analysis of processes, which occur in the reactor core (fuel channels of RBMK type reactors) at significant overheating of fuel assemblies up to fuel melting, specific computer tool for the analysis of processes during severe accident analysis should be used. For our purposes we used RELAP/SCDAPSIM code [15] that is an integrated, mechanistic computer code, which models the progression of severe accidents in light-water-reactor nuclear power plants. The entire spectrum of in-vessel severe accident phenomena, including reactorcoolant-system thermal-hydraulic response, core heat up, degradation and relocation, and lower-head thermal loads, is treated in this code in a unified framework for both boiling water reactors and pressurized water reactors. Unfortunately, the RELAP/SCDAPSIM code has some limitations, related to the application for RBMK-type reactors:  SCDAPSIM gives a possibility to define PWR or BWR fuel bundles with a user-defined fuel enrichment, but does not give a possibility to include a plant specific core content (fuel with burnable erbium absorber, which is used in RBMK-1500);  RELAP/SCDAPSIM code does not include transport of fission products from fuel through the RCS piping and their release to confinement;  Heat generation is defined only once for all heat structures, i.e. fuel rod, fuel channel, graphite and Control & Protection System (CPS) channels. Therefore, the consideration of heat removal by CPS channels is very complicated.
These limitations of RELAP/SCDAPSIM code were taken into account in modelling of BDBA in RBMK reactors: (1) the BWR fuel rod type was used for the modeling of RBMK fuel rods, (2) the transportation of fission products from fuel through cooling circuit was not evaluated because code limitation, (3) in order to avoid the troubles with the modeling of heat transfer from one fuel channel to another through graphite columns in radial direction in the core -the single channel model was used. Such model is acceptable for a rough analysis. The nodalization scheme of such model is presented in Figure 7. In order to perform the analysis, the following boundary conditions should be assumed for the model elements, modeled as time dependent volumes and junctions:  pressure and water temperature in the group distribution header (3);  pressure in the drum separators (1);  coolant flow rate through the fuel channel with average power (2).
This model is described in more detail in the papers [16,17] and the monograph [18]. As it was mentioned, the first category of BDBA (damage of the core or its components with the reactor maintaining its overall structural integrity see Figure 5) is divided into two groups: (1.1) no severe damage of the core; (1.2) severe core damage accompanied by the containment of core fragments in the reactor core, accident localization system or other reactor buildings.
The examples of accidents for RBMK-1500 in the first group (1.1, see Figure 5) are the failure of the final heat sink systems with the loss of their functions or staff error, failure of group of reactor Control & Protection System (CPS) rods, failure of one or more channels in the reactor Emergency Core Cooling System (ECCS) short-term or long-term subsystems, failure of the system which supplies feedwater during a prolonged period of time, and other failures. This group of accidents involves additional failures of the equipment in the safety systems (additional to failures considered by the single failure principle). Usually the accidents of first group (no severe damage of the core) are analyzed in order to justify the effectiveness of the functional backup, as well as to assess the conditions and the time available for the backup systems to be actuated. As a rule, this belongs to the field of the accident management on the basis of symptom-oriented emergency operating procedures.
Thus, in case of a postulated failure of CPS rods movement during reactor operation at power, the actions taken by the operators to shutdown the reactor and to hold it in a subcritical state were determined. The reactor can be shutdown and maintained subcritical by inserting one CPS rod into the core, decreasing the water temperature in the CPS cooling circuit or decreasing the temperature of the graphite stack [8]. At Ignalina NPP the Additional Hold-down System is implemented in case of CPS malfunction to prevent reactor re-criticality by injecting the liquid poison (Gadolinium Nitrate) into the CPS cooling circuit [19].
During reactivity initiated accidents the situation can occur when the group of control rods is withdrawn erroneously. Under adverse conditions it is possible that the signal for local Automatic control will not be generated and the local power increase can occur in a group of fuel channels. Validated calculations using the experimental data showed that this increase could reach 2-2.5 times of the nominal channel power, but it does not cause significant coolant flow decrease in the fuel channels (due to the increased channel resistance in the steam zone) and overheating of the fuel channels [9]. Since this chapter mainly deals with the thermal-hydraulics, more detailed examples with reactivity initiated accidents are not presented there.
Another example could be the loss of long-term cooling. The performed deterministic calculations showed that the reactor core cannot be damaged without the make-up by feedwater during any transient after full reactor shutdown in approximately 1.5 hours [8,20]. One high pressure pump is sufficient to cool down the reactor for one hour after the reactor shutdown. If the water supply from one pump is re-established, all the parameters of RCS and reactor remain within safe operation limits. However, if the high pressure pumps are not available, the manual operators' actions are required. In [18] the optimal reactor core cooldown scenario for RBMK-1500 in case of station blackout was developed (see Figure 8 - Figure 10). The modeling of such scenario was performed using RELAP5 model presented in Figure 6.
In the analysis presented below, it is considered that the operator takes early actions: 15 minutes after the beginning of the accident the operator begins to supply cold water from ECCS hydro-accumulators into GDH of both RCS loops. After approximately 1.5 hours from the beginning of the accident, the peak fuel cladding temperature exceeds 400 o C ( Figure 8). According this signal, the operator opens one steam relief valve to decrease pressure in RCS (Figure 9). At the same time the operator takes actions to maintain the water supply by gravity from deaerators and prepares the connection for water supply from the artesian water source. The activation of ECCS hydro-accumulators after 15 minutes from the beginning of the accident provides only a small amount of water due to equalization of pressures in hydro-accumulators and GDH. Additional amount of water from hydroaccumulators is injected when the pressure in RCS decreases (~2 h after the beginning of the accident). The water supply from ECCS hydro-accumulators and opening of one steam relief valve would result in the increase of water level in RCS (Figure 10). At the time moment t = 2.5 h, the water supply from ECCS hydro-accumulators stops. Approximately 170 m 3 of water is injected from ECCS hydro-accumulators.  When the pressure in RCS decreases down to 1.2 MPa (pressure in deaerators), the water flow from the deaerators begins (t = 3.8 h). There are four deaerators, which contain 480 m 3 of water with temperature of ~ 190 o C. After the connection of deaerators to RCS, the pressure decrease leads to boiling of water in deaerators. The initial flow rate of water from deaerators does not warrant adequate cooling of the core -the temperature of core components is increasing at the time interval t = 3 -5 h (Figure 8). To increase the flow rate of water from deaerators, at the time moment t = 5.3 h the operator opens one additional Steam Relief Valve (SRV). As it is seen from Figure 8, this action improves the core cooling conditions and the temperature of core components starts to decrease. The pressure in RCS decreases down to the pressure in artesian water system (~ 0.6 MPa) only more than 13 hours after the beginning of the accident. A complete connection of artesian water to RCS is permitted only after the decrease of pressure in RCS down to the level of pressure in the www.intechopen.com Deterministic Analysis of Beyond Design Basis Accidents in RBMK Reactors 51 artesian water source. These measures should prohibit the injection of coolant from RCS into the pipeline of artesian water. After the connection of artesian water source to supply water into reactor, the water level in reactor core starts to increase, which means the success of core cooling. The mentioned operators' actions lead to a slow decrease of pressure in RCS, the fuel rods claddings and channels walls temperatures become not higher than 600 o C.  The results of the mentioned neutron-physical and thermal-hydraulic investigations have served as the basis for expanding the region where the accidents of the first group with multiple failures can be controlled using the symptom-oriented emergency operating procedures, and they have made it possible to determine the actions to be taken by personnel in order to prevent severe core damage.

Analysis of accidents leading to severe core damage accompanied by containment of core fragments in the RC, ALS or other reactor buildings
Accidents in the second group (1.2, see Figure 5) are analysed in order to develop the measures to preserve the structural integrity of the reactor or to determine the required means and time available for subsequent cooling of the reactor core. The accidents of this group are conventional severe accidents with core meltdown as a result of misbalance between energy source and heat sink. The development of such accidents in RBMK has much in common with overheating processes of vessel-type reactors, but it differs by the RBMK features mentioned above.
The heating and melting of a RBMK core can potentially occur as a result of misbalance between heat generated in the core and removed by reactor cooling system and emergency core cooling systems. A typical example of such accident is the damage of the boundaries of the circulation loop (LOCA type accident), accompanied by the failure of the ECCS or additional loss of feedwater.
The LOCAs, according the PSA terminology for RBMK-1500, were categorized according to the rupture size and location in the RCS. A large LOCA means a rupture of the biggest diameter pipes in RCS, i.e. pipes with diameter of 300 -1000 mm. Medium LOCA is a rupture of pipes with diameter of 100 -300 mm, whereas small and very small LOCA signifies a rupture of pipes with diameters of 50 -100 mm and 30 -50 mm respectively. The location of LOCAs in the RCS is groped into 4 zones (see Figure 11). Pipelines located in Zone 1 have large diameters: ~1000 mm -the main circulation pumps pressure and suction headers, ~600 mm -MCP connecting pipelines and ~300 mmgroup distribution header piping. Therefore, large and medium LOCAs are possible in this zone. Pipelines located in Zone 2 have smaller diameter than the ones in Zone 1: ~300 mm -GDH piping and ~50 mm -lower water piping. Piping of Zone 4 (outside ALS compartments) consists of a part of downcomers (~600 mm diameter), feedwater lines of 500 mm diameter and steamlines of 600 mm diameter. Fuel channel break in the reactor cavity (LOCA in Zone 3) is a separate type of accident. The analysis of LOCAs in Zones 1, 2 and 4 was performed using RELAP5 model, presented in Figure 6.

LOCA in Zone 1
In case of break in Zone 1, a huge amount of coolant used for the reactor core cooling is discharged through the break. Consequently, the reactor core cooling is extremely worsened or terminated at all in the group of the fuel channels. GDH check valve prevent coolant water leaking from the core in the opposite direction. Depending on the location of the break, the cooling of FCs connected to one group distribution header (in the case of GDH break) or in all channels of one RCS loop (in the case of MCP pressure or suction header break) can be lost. The emergency protection (reactor shutdown) is activated within the first seconds due to the pressure increase in the reinforced leaktight compartments. Cooling of the reactor core is restored after the activation of ECCS. After 2 -3 seconds the short-term subsystem of ECCS (two trains of hydro accumulators and one train from the main feedwater pumps) is activated. This subsystem starts to supply water into GDH downstream check valve and is designed to cool down the reactor within the first 10 minutes. Later the long-term subsystem of ECCS, which consists of 6 ECCS pumps and 6 auxiliary feedwater pumps, is activated. The long-term subsystem of ECCS supplies the water to both loops of RCS. The fuel cladding and fuel channel wall temperatures start to decrease after the ECCS activation.
In the case of large LOCA in Zone 1, the pressure upstream fuel channels decreases very fast. To prevent the reverse of coolant flow in the channels, the check valves are installed in each GDH. The failure of some of these valves effects the cooling conditions of channels connected to the affected GDH and may change the consequences of the accident. For example, in the case of the MCP pressure header break, the channels connected to the GDH with failed to close check valve are cooled by the reverse coolant flow from the drum separators (Figure 12). At the beginning of the accident, these FCs are cooled by the saturated water flow, but later (after DSs get empty) only by the saturated steam. Due to the worsened cooling conditions, fuel cladding temperatures in the channels connected to GDH with failed to close check valve increases higher than in the other channels of the affected RCS loop.
The feature of LOCA type accidents in Zone 1 is the heat-up of the fuel in the affected RCS loop during the first seconds of the accidents. It should be noted that the first fuel cladding temperature increase asserts only at the very beginning of the accident and takes a very short time: no more than 30 seconds. In the case of the MCP pressure header break with additional failures of short-term subsystem of ECCS, a short-term violation of an acceptance criterion for fuel rods cladding of 700 o С is observed in a considerable group of channels. Such increase of temperatures is related with stagnation of coolant flow rate after the GDHs www.intechopen.com Nuclear Power Plants 54 check valves closing. This stagnation is terminated with the start of ECCS water supply. If the loss of the preferred AC power of the Unit does not occur simultaneously, so the stagnation is terminated after 10 s from the start of water supply from ECCS pumps. The excess of acceptance criteria for fuel rod cladding of 700 o С is probable in FCs, initial power of which is higher than 2.5 MW (see Figure 13). There are 370 of such FCs in the affected RCS loop (see Figure 14). If the loss of preferred AC power takes place simultaneously, the stagnation is prolonged (ECCS pumps are started after the start of diesel generators). In this case the acceptance criterion for fuel rod cladding is violated in FCs which have the initial power higher than 2.0 MW. There are 670 of such FCs in the affected RCS loop (see Figure  14). However, the peak temperature of FCs walls is much below than the acceptance criterion for the FC wall (650 o С). The detailed analysis was performed to evaluate the possibility of failure of those fuel rods where cladding temperature exceeds 700 o С. This analysis was performed using RELAP/SCDAPSIM model presented in Figure 7. The calculated pressure inside the fuel rods remains below pressure outside fuel ( Figure 15). Thus, the ballooning of fuel rod claddings do not occur in the fuel channels with initial power less than 3.4 MW. The detailed analysis allows removing the surplus conservatism in the analysis (Figure 14).
Another fuel cladding temperature increase starts approximately 200 seconds after the beginning of the accident and is caused by the decrease of the reversed coolant flow, which in turn is due to the pressure decrease in DSs of the affected loop of RCS ( Figure 12). A considerable temperature increase is possible only in case of operator non-intervention. Operator has a possibility to reduce coolant discharge through the break by closing the maintenance valves. These actions lead to the water level increase in the affected DS and improve cooling conditions of the fuel channels. The fuel channels of the intact RCS loop is reliably cooled with water supplied by the MCPs and ECCS long-term cooling subsystem.   For the case of medium LOCA in Zone 1 a detailed analysis is not carried out as the consequences this event is covered by medium LOCA in Zone 2. Short-term increase of temperatures of fuel rod cladding and FC walls is not observed at the initial stage of the accident at the GDH break upstream the check valve (medium LOCA in RCS Zone 1), but is traced at the break downstream the check valve (LOCA in Zone 2).

LOCA in Zone 2
The consequences of LOCA in Zone 2 are similar to the consequences of LOCA in Zone 1. In both cases the break location is upstream the reactor core. Moreover, the phenomena in both cases are similar. In case of GDH break the coolant supply is terminated through 39 -43 fuel channels connected to the distribution header of this group. In case of GDH guillotine break downstream check valve, the coolant in FCs connected to the affected GDH starts to flow in the opposite direction from DSs ( Figure 16). Loss of the coolant from DS is compensated by There are no pipelines with a diameter bigger than 300 mm, thus the large LOCAs in Zone 2 were not analyzed. For the medium LOCA in Zone 2, the following was considered: GDH guillotine break, GDH partial break resulting into stagnation of coolant flow rate and GDH guillotine break at failure to close the check valve in the adjacent GDH:  The analysis of GDH guillotine break at complete ECCS failure and at operation of one, two or three ECCS pumps demonstrated that for reliable cooling of the core at a long stage two ECCS pumps are enough. With such number of ECCS equipment, after one hour from the beginning of the accident, the ECCS water flow rate starts to exceed water discharge through the break. However, short-term increase in temperatures of fuel rod cladding and FC walls at the initial stage of accident in FCs, connected to the broken GDH, is inevitable in any case. The excess of acceptance criterion for fuel rod cladding (700 o С) is probable in 12 FCs. A more detailed analysis (using RELAP/SCDAPSIM model presented in Fig. 7) shows that this short temperature peak does not lead to the failure of any fuel rods.  In the case of coolant flow rate stagnation in channels, multiple FCs breaks are probable after approximately 20 s from the beginning of the accident if the reactor is not shutdown on time. On the contrary, if a reactor is shutdown quickly (until the FCs heat up), the acceptance criterion for channels walls will not be violated and the channels will remain intact. The conditions for the reactor long-term cooling remain similar to GDH break: the operation of two ECCS pumps is necessary.  In the case of GDH break with a failure to close the check valve in the adjacent GDH, ECCS water supply worsens the cooling conditions of the channels connected to the GDH with failed to close check valve. It occurs that ECCS water interferes with the reverse coolant flow rate through these FCs. Stagnation of coolant flow rate is formed in these FCs. However, ECCS water supply helps to fill DSs and to ensure cooling of channels in the intact RCS loop and the channels connected to the 18 GDHs of the affected RCS loop. The analysis of GDH break with failure to close the check valve in the adjacent GDH is carried out at the operation of 1 -4 ECCS pumps. The results of the analysis showed that for the reliable cooling of FC, connected to other 18 GDHs of the affected RCS loop, it is necessary to have not less than two operating ECCS pumps in long-term cooling subsystem. The channels connected to the GDH with failed to close check valve will be cooled because of radial heat transfer between the adjacent graphite blocks.
For the small LOCA in Zone 2, guillotine and partial breaks of lower water pipe were considered:


The results of the analysis of guillotine break of the lower water pipe showed that the reactor core is reliably cooled during the first minutes after the accident in this case. One ECCS pump is enough for the reactor long-term cooling. The pump should be started during the first hour after the beginning of the accident.  The performed analysis demonstrated that in the worst case, at partial break of the lower water pipe, the signal on the reactor shutdown on pressure increase in ALS compartments can not be generated. If the partial break causes stagnation of the coolant flow rate through the affected FC, it will lead to the heat up and break of this channel. The peak temperature of fuel in the affected channel will not reach the temperature of melting, i.e. 2800 о С. After the break of the channel pipe, pressure in the reactor cavity increases, which results in the formation of a signal on the reactor shutdown. After the fuel channel wall break the conditions of flow stagnation will be destroyed and the broken parts of fuel channel and fragments of fuel assemblies below and above the break will be cooled by coolant flow from the top and bottom. The remaining intact fuel channels will also be reliably cooled. It is necessary to note that for RBMK type reactors the rupture of a single FC is a design basis accident. Such accident would correspond to a small breach in the reactor vessel of BWR. Steam-gas mixture from RC will be discharged through the reactor cavity venting system to the left tower of ALS. The steam will be condensed, fission products will be scrubbed in the condensing pool, but will not be discharged to the environment. Thus, the damaged fuel assembly will be contained in the reactor cavity.

LOCA in Zone 3
A single fuel channel break is the accident when the fuel channel is overheated during the reactor operation on power at nominal pressure. In case of other accidents that are included in this group (1.2, see Figure 5), the overheating of fuel can occur after the reactor shutdown at low pressure in RCS, because the strength of f u e l c h a n n e l s a t n o m i n a l p r e s s u r e a t t h e temperature margin of 650-800 o C is limited [4]. Otherwise (if FC walls temperature exceeds this limit in few fuel channels during normal pressure in the circuit) multiple ruptures of fuel channels can occur. As design basis accident for RC is a single FC rupture, the accident with multiple ruptures of fuel channels is included into the group of accidents when the reactor core is completely damaged and the integrity of the reactor constructions is not preserved. The reactor cavity venting system at Ignalina NPP with RBMK-1500 reactor was improved providing the additional flow path to ALS, i.e. the RCVS capacity was increased to withstand a multiple rupture of fuel channels. Figure 18 presents the summary of the analysis performed to estimate the number of fuel channels that can be ruptured simultaneously in the beginning of the accident, i.e. at nominal RCS pressure and temperature, and reactor power of 4200 MW th , the integrity of the reactor cavity would be maintained. A detailed analysis is presented in [21]. The coolant release rate was calculated using code RELAP5 (model presented in Figure 6) and the analysis of the Reactor Cavity and ALS response was performed using code CONTAIN. The performed analysis showed that making the most conservative assumptions, the reactor cavity could withstand simultaneous rupture of at least 11-16 FCs.

LOCA in Zone 4
Pressure sharply decreases in DSs and RCS in the case of LOCA in Zone 4, but coolant circulation through the reactor core can be destroyed only in the latest stages of the accident, when pressure in RCS drops below 0.4 MPa. Thus, the characteristic fuel cladding and channel walls temperature peak within the first seconds of the accident (in case of LOCA in Zone 1 and Zone 2) is not met there. Guillotine breaks of one and two steamlines were considered for the large LOCA in RCS Zone 4:


The results of the analysis showed that at LOCA in Zone 4 the operation of ECCS shortterm subsystem is not necessary, i.e. the temperature of fuel rod cladding and FC walls is much lower than acceptance criteria without operation of this subsystem.  For reliable cooling of the reactor core in long-term post-accidental period, it is necessary to have not less than two ECCS pumps in operation in the case of two steamlines break, and not less than one pump in the case of one steamline break.  In case of breaks in Zone 4 without the reactor shutdown (break of steamlines), the temperature rises much more slowly (especially the temperature of FCs walls). This specifies that such breaks in Zone 4 are less dangerous, than breaks in Zone 1 (Fig. 19).
In the case without the reactor shutdown, the melting of the core at low pressure in RCS is probable, but does not result in the immediate damage of the reactor cavity.

Analysis of accidents when heat-up of the reactor core occurs during the reactor operation or within the first seconds after the reactor shutdown
The second category of core damage (see Figure 5), accidents with loss of the general structure integrity of the reactor and ALS, can potentially be due to the possibility of multiple ruptures of fuel channels at high pressure in RCS. The structural integrity of RBMK-1500 reactor depends on the integrity of the reactor cavity, which with a conservative strength margin was designed for conditions of an anticipated accident caused by the rupture of a single channel (in the nominal operating regime of a reactor). During operation of all nuclear power plants with RBMK reactors, there were three cases of fuel channel rupture, but the neighboring channels were not damaged [4]. This shows that the neighboring fuel channelgraphite cells have sufficient strength and elasticity and that the load caused by the rupture of a single channel is small. The accidents, leading to the complete reactor core damage, with loss of the structural integrity of the reactor can be divided into two groups [9]:  accidents when heat-up of the reactor core occurs during the reactor operation or within the first seconds after the reactor shutdown, when decay heat is high (2.1, see Fig. 5);  accidents when heat-up of the reactor core occurs after the reactor shutdown (2.2, see Fig. 5).
The first group of accidents (2.1) includes accidents when the heat-up of the reactor core occurs in the beginning of the accident (a few seconds after reactor scram activation) when decay heat in the core is high and the temperatures of fuel cladding and FC walls in the group of channels can reach the dangerous limits. An example of such accidents is the group of accidents, when the local flow stagnation occurs in the group of fuel channel during the LOCA. This situation is possible in the partial break case [12,22]. It was mentioned earlier that partial rupture of lower water pipe could lead to the flow stagnation in the affected fuel channel. In the case of GDH partial rupture, the flow stagnation can occur in all fuel channels connected to this affected GDH. Under adverse conditions, the partial break of MCP pressure header can cause flow stagnation in the fuel channels of one affected loop. Since there is no sufficient time for actions of the operator in this case, the short-term accident management measures (automatic actuation of safety systems) are necessary. New reactor protection against coolant flow rate decrease through GDH generated signal for early ECCS activation is implemented in RBMK-1500 in this case. This short-term measure leads to the disturbance of the coolant flow rate stagnation in the group of fuel channels [12] and all parameters of RCS, thus, the reactor remains within safe limits.
Other examples of the first group of accidents (2.1) can also be the initiating events, namely:  Anticipated Transients Without reactor Scram (ATWS);  GDH blockage;  Loss of natural circulation due to a sharp decrease of pressure in the RCS.
The analysis of ATWS (performed for the RBMK-1500 in 1996) demonstrated [3] the lack of inherent safety features in the RBMK design. The power is not reduced by means of inherent physical processes such as steam generation. The reactivity loss due to the fuel temperature rise (Doppler Effect) is not sufficient. The consequences of the accident for RBMK-1500 reactor, during which the loss of preferred electrical power supply and failure of automatic reactor shutdown occurred, are presented in Figure 20. The analysis was performed using RELAP5 model, presented in Figure 6.
Due to the loss of preferred electrical power supply all pumps are switched off (see Figure  20 (a)); therefore, the coolant circulation through the fuel channels is terminated. Because of the lost circulation, fuel channels are not cooled sufficiently and for this reason, the temperature of the fuel channel walls starts to increase sharply. As it is seen from Figure 20 (b), already after 40 seconds from the beginning of the accident, the peak fuel channel wall temperature in the high power channels reaches the acceptance criterion of 650 o C. It means that because of the further increase of the temperature in the fuel channels, plastic deformations begin, i.e. because of the influence of internal pressure, the channels can be ballooned and ruptured. During the first seconds of the accident, the main electrical generators and turbines are switched off as well. Steam generated in the core is discharged through the steam discharge valves, but their capacity is not sufficient Therefore, the pressure in the reactor cooling system increases and reaches acceptance criterion 10.4 MPa approximately after 80 seconds from the beginning of the accident (see Figure 20 (c)). Further increase of the pressure can lead to a rupture of pipelines.
Thus, the analysis of the anticipated transients without the shutdown demonstrated that in some cases the consequences can be quite dramatic for the RBMK-1500 reactors. Hence, in 1996 the priority recommendation was formulated as follows: to implement a second diverse shutdown system based on other principles of operation,. The implementation of such system requires much time and financial sources, thus at first it was decided to implement a compensating measure: a temporary shutdown system. This temporary system was called by the Russian abbreviation "DAZ" ("Dopolnitelnaja avarijnaja začita" -"Additional emergency protection"). This system used the same control rods as well as design reactor shutdown system, however, signals for this system control were generated independently in respect of the design reactor shutdown system. The analysis performed to justify the selected set points for reactor scram activation showed that after the implementation of DAZ system, the reactor is shutdown on time and cooled reliably; moreover, the acceptance criteria are not violated even in case of transients when the design reactor shutdown system does not function. Figure  20 presents the behavior of the main parameters of the reactor cooling system in case of the loss of the preferred electrical power supply and simultaneous failure of the design reactor shutdown system [23]. In this case two signals for activation of DAZ system (reactor shutdown) are generated: on the increase of pressure in the drum-separators and on the decrease in the coolant flow rate through the main circulation pumps. In Unit The GDH blockage for RBMK-1500 also depends on such group of accidents when during normal operation a group of fuel channels is overheated and multiple rupture of FC can occur. It is shown [12] that the coolant flow through the ECCS bypass line is not enough to cool down the fuel channels connected to the blocked GDH. The critical heat flux would appear in some fuel channels and cause failure of fuel claddings and FC walls. In the year 2000 a new reactor scram (emergency shutdown) signal based on coolant flow rate decrease through GDH was implemented at Ignalina NPP. The new signal ensures the timely reactor shutdown so that the dangerous fuel cladding and FC walls temperatures are not reached [12]. Therefore, this accident is moved from the group of severe accidents into the group of accidents without core damage.
The accidents when the loss of natural circulation occurs due to a sharp decrease of pressure in the RCS (due to break of steamlines) are presented in section 5.2.4. Some parts of steamlines are located in the compartments without pressure gauges. Thus, there is no direct signal indicating that the steamline break occured in these compartments (as in the other cases the pressure increase in compartments indicates coolant discharge through the break). It means that signals for the reactor shutdown and ECCS activation will be generated with delay on the basis of secondary parameters (e.g., water level decrease in DSs). On the other hand, a sharp pressure drop in the RCS is a characteristic feature in the case of RBMK steamline break; it destroys the natural circulation of coolant through the core. The flow stagnation in the core together with the late reactor shutdown can cause overheating of group of fuel channels. This was mentioned in the safety analysis report of Ignalina NPP [3] and the review of safety analysis report [24]. In the year 1998 -1999 a new reactor scram signal based on fast pressure decrease in DS was implemented at Ignalina NPP. This modification allowed avoiding the overheating of a group of fuel channels.

Analysis of accidents when heat-up of the reactor core occurs after the reactor shutdown
The second group of accidents from the second category of BDBA (total damage of the core or its components with the reactor maintaining its overall structural integrity) are the accidents when heat-up of the reactor core occurs after the reactor shutdown (2.2 -see Figure 5). The heat-up, damage and melting of the reactor core could occur in the late phase after the reactor shutdown due to loss of the long-term cooling. The results of the Level 1 probabilistic safety assessment of the Ignalina NPP showed that in the topography of the risk, transients dominate above the accidents with LOCAs and the failure of the core long-term cooling are the main factors of the frequency of core damage. The initiating events leading to the loss of long term cooling accident are such:  loss of intermediate cooling circuit;  loss of service water;  station blackout.
The station blackout (the most likely initiating event) is the loss of normal electrical power supply for local needs with an additional failure on start-up of all diesel generators. In the case of loss of electrical power supply MCPs, the circulating pumps of the service water system and feedwater supply pumps are switched-off. The failure of diesel generators leads to the non-operability of the emergency long-term core cooling subsystem. It means the impossibility to feed RCS by water. The results of the analysis [20,25] suggest that approximately 1.5 hours after the beginning of the accident, a dangerous heat-up of fuel rods and FC walls starts. Three ways of potential accident management for the loss of the long-term core cooling were discussed in [25]:  decay heat removal by ventilation of DS compartments,  decay heat removal by direct water supply into the reactor cavity,  de-pressurisation of the reactor coolant system and water supply to the GDH from ECCS hydro-accumulators, deaerators or using non-regular means.
The results showed that the first two ways are inexpedient. The ventilation of DS compartments and the direct water supply into the RC are not sufficient to remove the decay heat from the core. However, the de-pressurisation of RCS and the following water supply from regular and non-regular means to the GDH in the case of loss of long-term cooling gives considerably better results compared with the other two measures. The performed analysis [25] demonstrated that the reactor core cooling by RCS depressurisation and water supply from deaerators give additional four hours for the operator to install water supply from the external (artesian) water source. Thus, this way of accident management is recommended to be included in the RBMK-1500 accident management programme.
In the case of loss of intermediate cooling circuit or loss of service water, the consequences of the accidents will be very similar. In these last cases there are no direct signals for the reactor shutdown; however, these initiating events lead to the loss of feedwater supply and MCP will be tripped due to the insufficient cooling. Reactor scram would appear on secondary parameters and further sequence of the accident will be the same as in case of the station blackout: due to decay heat the water in the core is evaporating and the core heat-up process starts. Core overheating can be avoided by using water stored in the ECCS hydroaccumulators, deaerators and other water sources located at NPP. Figure 21 shows the behavior of fuel, claddings, channel walls, and graphite stack temperatures, calculated using RELAP5 and RELAP5/SCDAPSIM codes (models presented in Figure 6 and Figure 7), in case of RBMK-1500 reactor blackout, without any additional water supply. Such event, which is developing into a severe accident, serves as an example for the discussion of severe accident phenomena in RBMK type reactors. As it is presented in Figure 21, the failure of fuel channels could occur after ~3 hours. The failure of FCs is expected because the pressure in RCS is nominal, and the acceptance criterion for fuel channel (650 °C) will be reached ( Figure 21). It is assumed that after ~3.8 hours the operator opens one steam relief valve to discharge steam from RCS. This action allows depressurizing RCS and prevents ruptures of FCs. If no operator actions were taken (no manual depressurization), then approximately 50 FCs with a higher power level could be ruptured. If all FCs ruptured within short time interval, the reactor cavity would be destroyed and the consequences of the accident would be similar to the Chernobyl accident. Figure 22 shows the long-term behavior of fuel, claddings, fuel channels, and graphite stack temperatures, calculated using RELAP5/SCDAPSIM code (model presented in Figure 7), in case of RBMK-1500 reactor blackout, with operator intervention (opening one of steam relief valves for RCS depressurization). As the operator starts depressurization, the accident scenario continues at low pressure. Due to the pressure decrease the rest of coolant in pipelines below the reactor core starts boiling and steam cools down the core for a short time. As it is shown in Figure 22, the temperatures of the core components decrease for a short period of time. However, after 4.3 hours the second (repeated) heat-up of the reactor core elements begins. When the temperature of fuel cladding increases above 800 °C, the failure of fuel claddings occurs due to ballooning. The ballooning happens because at that time the pressure in RCS (outside fuel rods) is close to the atmospheric and the pressure inside fuel rods is high. The conditions for fast oxidation of claddings and fuel channels,  made from zirconium-niobium alloy, are reached after the fuel cladding and fuel channel temperatures exceed 1000 -1200 °C (~15 hours after the beginning of the accident). Due to steam-zirconium reaction the generation of hydrogen starts. The oxidation and hydrogen generation processes terminated after the pressure in RCS decreases down to atmospheric. This indicates that there is no steam in RCS, thus the steam-zirconium reaction is impossible. Later the processes would continue at low pressure in RCS and RC would remain intact.
When the temperatures of fuel claddings and FC walls reach 1450 о С, the melting of stainless steel grids and zirconium starts at 1760 о С (Figure 22). Probably at the same time the fuel channels will fail. At temperature of 1930-2050 о С and 2330 о С the melting of aluminum oxide (control rods claddings) and boron-carbide (control rods elements) in the separate control rods channels starts. The formation of ceramic (U, Zr, ZrO 2 ) starts at temperature of 2600 о С. The analysis performed using RELAP5/SCDAPSIM code shows that fuel melting (melting of ZrO 2 and UO 2 ) starts at low pressure, approximately 50 hours after the beginning of the accident at temperatures of 2690 о С and 2850 о С respectively ( Figure 22). Such comparably slow core heat up process is due to the high inertia of graphite stack, which provides a heat sink. Hence, the high pressure melt ejection and direct containment heating -the phenomena more related to PWR designcould not occur at RBMK-1500 reactor due to the limited space inside the reactor cavity. However, to cool down the reactor, it is necessary to start water supply into the fuel channels within the first 15 hours after the beginning of the accident. The water supply in later phases could lead to a fast steam-zirconium reaction and it could accelerate core damage processes.

Conclusion
In this paper the specifics of RBMK reactors design was presented. Based on the specific feature of RBMK, possible Beyond Design Basis Accidents were divided into four groups:  accidents with no severe damage of the core;  accidents leading to a severe core damage accompanied by containment of the core fragments in the reactor cavity and accident localization system or other reactor buildings;  accidents when heat-up of the reactor core occurs during the reactor operation or within the first seconds after the reactor shutdown;  accidents when heat-up of the reactor core occurs after the reactor shutdown.
The deterministic analysis of all these groups of BDBA was performed using a system of thermal hydraulic computer codes RELAP5 and RELAP/SDAPSIM. The consequences of these BDBAs and possible accident mitigation measures were discussed.


For the first group of accidents (accidents with no severe damage of the core) it was showed: (1) In the case of erroneously withdrawn of a group of control rods, the local power increase appears in the adjacent fuel channels, but this do not lead to overheating of the fuel in these channels. The operators have possibility to compensate this local power increase by inserting remaining control rods. In the case the local power exceeds limits -the reactor will be shutdown automatically by activation of emergency shutdown system. (2) In the case of loss of long-term cooling, when there are no possibilities to inject water in the reactor using regular means, the operators can supply the water into reactor from ECCS hydro-accumulators, later to perform the RCS de-pressurization by opening manually steam relief valve. Finally, after the pressure in RCS is reduced, the low-pressure non-regular water sources can be used (deaerators and artesian water).  The accidents in the second group (accidents leading to a severe core damage accompanied by containment of the core fragments in the reactor cavity and accident localization system or other reactor buildings) are initiated due to misbalance between energy source and heat sink. If the emergency core cooling system is not activated, or the amount of supplied water is less as required, the core meltdown can occur. Based on the performed deterministic analysis the setpoints for ECCS activation were selected. The capacity of reactor cavity venting system was increased to prevent failure of reactor cavity in case of multiple fuel channel rupture (up to simultaneous rupture of 16 fuel channels).  The third group contains the accidents when heat-up of the reactor core occurs during the reactor operation or within the first seconds after the reactor shutdown, when decay heat is high. Because fast process of heat-up of fuel rods in this case -there is no time for operator actions in this case. The new algorithms for reactor shutdown and fast emergency core cooling system activation were proposed for RBMK-1500 to prevent overheating of fuel in local flow stagnation or flow blockage in the group of fuel channels cases. Also the new ECCS activation algorithm was developed to cooldown the reactor in the case of loss of natural circulation due to a sharp decrease of pressure in the RCS. To prevent the catastrophic core damage in the anticipated transients without reactor scram case (when main reactor shutdown system fails to shutdown reactor) the additional emergency protection was implemented in the RBMK-1500.  The forth group of accidentsthe accidents when heat-up of the reactor core occurs after the reactor shutdown. The performed analysis shown, that even in the case of failure of all design (regular) and non-regular means to cooldown the rector in the case of loss of long term core cooling, the core heat-up process is slow in RBMK-type reactors. In the station blackout case, to prevent failure of reactor cavity at high pressure, the operators are required to open the steam relief valve manually, to start RCS depressurization. Due to the high inertia of graphite stack, which provides a heat sink, the melting of fuel stats at low pressure not earlier as 50 hours after loss core cooling.
The analysis was performed for the RBMK-1500 reactor (Ignalina NPP, Lithuania), but the main ideas of the accident mitigation are also valid for the RBMK-1000, which are still operating in Russia.