A number of events at nuclear power plants (NPP), as well as results from probabilistic safety assessment (PSA) studies for NPPs, have indicated that events occurring during shutdown modes may contribute significantly to the overall risk associated with NPP operation. Events occurring during shutdown operational modes represent a significant contribution to the NPP risk due to the fact that both preventive and mitigative capabilities of the plant can be degraded [1] . According to [2] deterministic analyses should be performed for transients that can occur in all planned modes of the plant in normal operation, including operations during shutdown. This plant state was sometimes neglected in early safety analyses. For this mode of operation, the contributors to risk include: the inability to start some safety systems automatically; equipment in maintenance or in repair; reduced amounts of coolant in the primary circuit as well as in the secondary circuit for some modes; instrumentation switched off or non-functional and measurements not made; open primary circuit; and open containment. Every configuration of shutdown modes should be analysed.

In Bulgaria, the main regulatory requirements related to the safety analysis for NPP are specified by the Bulgarian nuclear legislation [3] . The regulation requires that NPP safety analysis shall be included all various plant conditions and operator actions at all modes of operation. In this paper are presented the results obtained during an investigation of WWER-1000 NPP behaviour at shutdown reactor during maintenance as following international and national requirements in nuclear safety. In the paper are presents a thermal-hydraulic analysis of residual heat removal (RHR) system failure due to loss of low pressure pump (LPP) connected in RHR mode. The selected plant state requires draining of the primary circuit coolant to the level of upper part of the MCP vessel.

The purpose of the analysis is to define the timing for reaching the following stages during the development of processes in the reactor system:

・ Loss of subcooling (ΔTSI < 10 K) in the core outlet;

・ Beginning of reactor core uncovery;

・ Beginning of primary circuit cold legs uncovery;

・ Beginning of core outlet temperature increase;

・ The fuel cladding temperature beyond 923.15 K;

・ Estimation of time for operators’ intervention.

The selected plant operating state is maintenance work with unsealed primary circuit by removing the MCP head. The need of such analyses is determined by requirements for validation of EOP at shutdown and low power.

The reference power plant for this analysis is Unit 6 at KNPP site. Systems and equipment of the KNPP, Unit 6 operate according to the design requirements for the corresponding level of reactor power [4] .

The RELAP code is designed to predict the behavior of reactor systems during normal and accident conditions [5] . The analysis of the nuclear power plant’s behavior with thermo-hydraulic code is carried out for its safety justification in case of design disturbances during the processes and malfunctions or failures of the equipment. Several studies related to the WWER-1000 nuclear power plant accident, have been modeled with RELAP5/MOD3.2 [6] - [11] . Most of the publications present accident analyses in the full power operation of the plant. Nowadays nuclear safety regulations require the shutdown state to be more systematically analyzed. In the present paper a transient in shutdown state of the plant is analysed. For the purpose of the paper RELAP5/ MOD3.2 computer code has been used to simulate the WWER-1000/V320 NPP model [12] . The model has been developed at INRNE-BAS for the analyses of operational occurrences, abnormal events, and design basis scenarios. The RELAP5 nodalization schemes of the plant used in the analysis are presented in Figures 1-4. In modifying of the RELAP5 input data describing the model of the reactor WWER-1000 the shutdown and cold conditions and the modifications after the modernization program are taken into account. The actual four-loop system has been modelled by four single loops for primary and secondary sides. The model provides a significant analytical capability for the specialists working in the field of NPP safety. In the RELAP5 model for WWER-1000/V320 NPP included are as follows: Reactor vessel; core region represented by three channels; pressurizer system including heaters, spray and relief valves; safety system-low pressure injection pumps. In the model, also presented is a make-up/drain system, including a connection (control) with the pressurizer. Secondary side is developed too and is presented by eight SG Safety valves, four BRU-A valves, BRU-K valves, steam pipe lines (including main steam header) and turbine, including a regulating valve in front of the turbine. The horizontal steam generator (SG) has been modelled. A separator model and the perforated sheet have been modelled in the SG model too. The MCP has been developed using homologous curves of real pumps.

The reactor is at shutdown and cold condition before outage. The primary circuit is opened by removing MCP heads for performing some maintenance actions. Primary circuit water level is reduced to the upper part of MCP vessel. All control rods are inside the reactor core. Boron concentration is at 16 g/kg. One channel of Low- Pressure Safety Injection System (LPSIS) is on standby. All other characteristics are selected as boundary conditions. The steady-state RELAP5 model for WWER-1000 reactor is presented in Table 1.

Specific assumptions

All systems for normal operation is are unavailable after the initiating event. According to [3] , it is assumed that the operator switches on an LPSIS 30 min after the beginning of the event.

In investigating conditions the safety systems are in following modes:

・ one channel of LPSIS is in residual heat removal mode;

・ the second channel of LPSIS is connected by emergency make-up tank;

・ the third channel of LPSIS is consider to be under maintenance.

Primary make-up system is conservatively excluded in the model.

The scenario was discussed with KNPP experts as the most reasonable from an engineering point of view. In this way it can be stated that the scenarios are prepared based on engineering judgment and experience of the authors in analysis plant events.

The purpose of the analysis is to determine the development of the accident and to evaluate the time the oper-

ators from main control room (MCR) have before taking the necessary actions to prevent core damage in cases where this time is under 30 minutes.

The calculated sequence of events for the base case and operator action scenarios are presented in Table 2. Comparisons of the most important parameters’ behaviour for the two scenarios are shown in Figures 5-12. The calculations are performed up to 15,500 s into transient time for the base case and up to 6000 s for the operator action scenario.

As a result of the LPP failure the water temperature starts to increase, leading to an increase in the coolant volume due to a change in the density of water, and after about 396 s is observed filling volume which simulates

the upper part top of the unsealed MCP and there is significant loss of coolant, which stops at 1400 s as a result of evaporation of water, which boils at 390 s. Thus the loss of coolant up to 1400 s is as the leakage at initial moment (due to coolant expansion), and the evaporation of coolant through unsealed MCP. Loss of subcooling (boiling of the coolant) in the core outlet is shown in Figure 5.

The behavior of the water level in the reactor core for the both scenarios is shown in Figure 6. After discontinue of the decay heat from the reactor core through an LPP it starts coolant reheating and therefore small water over the core, it quickly reaches boiling point. This is supported by both the increase of the temperature for the first 390 s (reaches 100˚C) and the rapid loss of the water level above the core, which for this type of accident is below the level of the primary circuit hot legs. One of the characteristics of this accident is that the reactor coolant level is 0.20/0.35 m under upper part of the MCP vessel. Although the residual heat is less (11.5 MW), by Figure 6 shows how fast (after 723 seconds―see Table 2) the core begins to uncover. Uncovering the core is the result of boiling water at the core outlet. Thus for base case, after about 3503 s, when the primary circuit cold legs uncover, the reactor core is cooling only by the water which is in the reactor vessel and has already begun the uncovering of the upper end of the core. Due to the boiling of the coolant at a pressure close to atmospheric, with slight changes, the low decay heat, for a long time no rise in temperature of the fluid is observed, i.e. no core heating is observed, which eventually occurs after significant core uncovery at 5951 s. At 8243 s fuel cladding temperature of the core outlet reaches 923.15 K, which is a condition for leaving SB EOP and transition to SAMG.

Fluid heat up over the reactor core is shown in Figure 7, using the steam temperature because in RELAP5 the liquid temperature reaches only a saturation temperature, which depends only on pressure―i.e. steam is overheated. For base case after 5951 s begins core reheating and there is overheated steam over the reactor core (Figure 6).

For the scenario with operator action it is assumed that 30 minutes after the beginning of the accident, the operator actuates one LPP. As a result of operator actions is prevents overheating of reactor core and coolant.

The fuel cladding temperatures are presented on Figure 8. For base case the fuel cladding temperatures have increased with the beginning of the core uncovery and at 8243 s have reached the boundary value―923.15 K of transition between EOPs and SAMG. For operator action scenario the fuel cladding temperatures do not reach this boundary value.

The behavior of the primary pressure is shown in Figure 9. Initially the pressure is about atmospheric, and slightly increases up to about less than 2 atmospheres due to boil water in the core and in the presence of hydro-lock in primary circuit cold leg, which do not allow free movement of the steam to the point of the primary circuit depressurization―upper part of the MCP#2. The pressurizer (PRZ) level is presented in Figure 10. LPSIP flow rate is presented in Figure 11, Figure 12 illustrated leakage flow rate through unsealed MCP to containment.

In the paper is discussed the thermal-hydraulic calculation of loss of RHR system at shut down plant state and unsealed primary circuit for WWER-1000/V320 units at KNPP. As a result of the thermo-hydraulic analysis the following general conclusions are formulated:

The operator has a short time to avoid a partial core uncovery. The reason is the minimum coolant volume in the primary circuit and unavailability of secondary side. The partial core uncovery, which is observed in the first 10 - 30 minutes, does not lead to the core heating up, due to low residual power for this plant state.

Simultaneously, it should be noted that due to the characteristic of the initial state, namely atmospheric pressure and an inlet temperature of the core 343.15 K and minimum residual heat, beginning of reactor core heat up occurs after 5950 s, thefuel cladding temperature reached the 923.15 K (boundary value of transition between EOPs and SAMG) at 8243 s. This shows that even if there is an insignificant core uncovery, the operator will have enough time for organizing of alternative core cooling before reactor core heat up occurs.

Pavlin Groudev,Marina Andreeva, (2016) Study of Accident Progression in Unsealed WWER-1000/V320 Reactor during Maintenance. Journal of Power and Energy Engineering,04,68-78. doi: 10.4236/jpee.2016.48007