Critical Safety Functions Research Articles

Low-Voltage Control Circuits of Formula Student Electric Racing Cars

Formula Student (FS) competitions aim to prepare and encourage engineering students to participate in the progression of automotive and motorsport industries. The built racing cars adhere to strict regulations set by competition guidelines to ensure the safety of both teams and spectators. For electric racing cars, the high-voltage (HV) battery system usually operates within a voltage range between 100 V to 600 V to supply the motor and its controller with the required electrical power. It is essential to ensure that these components are operating effectively to minimize battery and motor current as well as to ensure efficient and reliable performance throughout the race. A low-voltage control system (LVCS), usually operating at 12 V, is used to coordinate a wide array of critical operational and safety functions to control the HV system. These functions include: (1) turning on/off procedures, (2) monitoring speed, voltage, and current, (3) interfacing with pedals, (4) controlling dashboard features, (5) managing lighting, (6) facilitating data communication, and (7) implementing safety protocols. The design and operation of the LVCS are crucial for compliance with safety regulations and enhancing the FS electric racing car (FSERC) performance. This details and discusses the design procedures of the LVCS, using the Lancaster E-Racing (LER) FSERC as a case study. The LER car employs a 400 V battery system to power a 68-kW permanent manet synchronous motor (PMSM) using a three-phase voltage source inverter. Using mathematical analysis, SIMULINK/MATLAB® computer simulations, and the experimental real-data results provided by the LER FSERC, this study seeks to offer valuable insights regarding the LVCS practical implementation and optimization.

Novel design of a personnel protection system for large particle accelerators: balancing safety, reliability, and cost

As the primary safety protection system for particle accelerators, the Personnel Protection System (PPS) not only prioritizes safety but also recognizes the importance of system reliability to ensure the stable operation of the accelerator and foster trust among system stakeholders. When designing the PPS, a distinction can be made between critical safety functions and common functions. There are at least three critical safety functions: firstly, ensuring that personnel are prohibited from accessing the tunnel during accelerator operation; secondly, preventing accelerator activation in the presence of personnel within the tunnel; and thirdly, enabling prompt termination of accelerator operations during emergency situations. To meet the demanding safety integrity level requirement of SIL3, multiple layers of defense and safety redundancy are employed. In order to mitigate the potential risks arising from human errors, significant emphasis is placed on improving the automation and intelligence of the system. This research focuses on the development of a comprehensive novel system that incorporates multiple defense mechanisms to meet the stringent safety and reliability demands of large particle accelerators represented by High Energy Proton Source (HEPS). It designs novel local optimization schemes, including the semi-redundant control system, zero-count interlock, intelligent search and secure, and electromagnetic control key, among others. These pioneering approaches are seamlessly integrated into the comprehensive system, effectively enhancing its capabilities and overall efficiency. Furthermore, this study conducts an analysis of the reliability of interlocking equipment, employing measures such as hierarchical DC power, parallel redundancy, and optimized signal processing to enhance its overall reliability. Finally, a method for determining the Safety Integrity Level (SIL) and assessing the reliability of PPS is developed, and the system's performance is validated.

Improving and Sustaining Resident Physician Handover.

Background Handoffs serve a critical patient safety function in the transition between caregivers. In 2006, the Joint Commission on Accreditation of Healthcare Organizations strongly recommended the implementation of "a standardized approach to 'handoff' communications, including an opportunity to ask and respond to questions."Numerous studies have investigated the quality and efficacy of patient handoffs and the utility of structured handoff curriculums, particularly in the context of patient safety and outcomes. Objective The pediatric residents at Penn State Health (PSH) did not utilize a formal written or verbal handoff tool. Our study facilitated the design of a comprehensive handoff curriculum, including verbal and written components, and the implementationof faculty and multidisciplinary care team involvement coupled with resident training and observations.We investigate the impact of this curriculum longitudinally utilizing validated tools completed by external observers as well as the residents themselves. Methods Prior to SAFETIPS being implemented, residents at a mid-sized Pediatric program were observed giving handovers at various intervals to understand baseline habits.Residents were then educated with the SAFETIPS curriculum and again observed.Trained observers of the handover process completed a validated evaluation form concentrating onseven key domains necessary for effective handover and communication; residents involved in the handover also completed a validated evaluation form.Consent for the project was implied with the observer's presence during the process and our study was exempt from full IRB consideration given its quality improvement design.A mix of summary statistics, stacked dot plots, mixed effects regression, and joint F tests were used to analyze data. Results Mean values on all sections of the handover evaluation Likert scale completed by trained observers tended to increase over time; the variance in responses was likewise much smaller at later time periods.Similarly, all sections of the evaluation tools completed by the resident physicians themselves showed significantly increased scores from pre- to post-implementation of our curriculum.Data revealed a plateauing of results towardlater time points suggestive of skills mastery and sustained improvements. Conclusion Our findings suggest that the introduction of a structured handoff curriculum correlated with improved communication among residents, and such improvements were sustained over time.

Подходы к качественной оценке состояния барьеров безопасности на объектах нефтегазовой отрасли

The basic concepts of the idea of safety barriers and proposals for their classification are given. The criteria for assessing the performance of safety barriers, methods for checking their performance during operation of the facility, as well as an approach to a qualitative assessment of their performance at the facility are described. Technical safety barriers mean engineering systems and equipment located at the facility and designed to implement a critical safety function. Administrative safety barriers serve to control the implementation of critical safety tasks performed by the employees. The performance of safety barriers is described by three groups of criteria: efficiency, reliability, stability. The tasks of effective safety barriers management are reduced to preventing, controlling, or reducing the consequences of the implementation of risks at oil and gas facilities. These goals are achieved by assessing the performance of each barrier element and maintaining its performance capability, as well as by analyzing not only technical, but also administrative decisions. The tasks set are solved by the efficient placement and use of safety barriers, ensuring their effectiveness, reliability, and sustainability through current supporting procedures. Based on the results of the assessment of the safety barriers performance, the recommendations are developed on the formation of a list of measures in the field of operational risk management and on reducing the level of risk criticality. The task of assessing the performance of safety barriers is to identify the weak points in the industrial safety of oil and gas facilities by determining the sufficiency and readiness of each existing safety barrier to perform a barrier function.

Assessment of plant response capability in the event of loss of electrical power and loss of ultimate heat sink

This paper presents a stress test method developed for Korean nuclear power plant and assessment results of plant response capability of OPR1000 in an effort to enhance the safety against extreme natural events exceeding the design basis of the plant. Multi-barrier accident coping strategy (MACST) guidelines have been developed to accomplish specific tasks in support of Emergency Operating Procedures (EOP) when the Extended Loss of AC Power (ELAP) and/or Loss of Ultimate Heat Sink (LUHS) is in progress as a consequence of beyond design basis natural events. Provisions to secure critical safety functions are discussed with cliff edge time evaluation at each step of plant response to ELAP and LUHS. It is concluded that the plant can maintain the safe shutdown state through the natural circulation cooldown by steam generator and the electric power and can obtain additional capability and redundancy with off-site equipment to provide coping capability for an indefinite period.

Mission Critical Safety Functions in IEC-61850 Based Substation Automation System - A Reliability Review

The use of Substation Communication Networks (SCN) in power distribution centres of thermal power plants for protection, control and monitoring is increasing as industry’s confidence grows in the application of the IEC-61850 based Substation Automation Systems (SAS). IEC-61508, which is the standard for functional safety, addresses Electrical/Electronic/Programmable Electronic (E/E/PE) safety based technologies in so far as safety lifecycle as well as reliability and verification of safety related systems are concerned. It follows therefore, that Substation Communication Networks (SCN), as well as associated substation equipment that forms part of the overall safety system should satisfy the requirements of functional safety standard IEC-61508. In this paper, Substation Automation System standard (SAS) IEC-61850, Substation Communication Networks (SCNs) as well as dependability evaluation methods are reviewed and discussed.

Risk-based Structural Response Against Explosion Blast Loads: Systematic One-to-one CFD (flacs) / Nlfea (impetus Afea Solver) Coupling to Derive Quantified Response Exceedance

This paper proposes an advanced and innovative methodology for risk-based structural response assessment against accidental explosions. Focus is shifted from dimensioning load to barrier integrity. A full spatial mapping of blast overpressure transients obtained with Computational Fluid Dynamics (CFD) modelling is used in combination with a Non-Linear Finite Element model (NLFEA). The GexCon-Impetus methodology is so-called advanced due to the innovative extensive one-to-one CFD-NLFEA job solution scheme used over several explosion runs. Using a detailed explosion loads mapping for the response evaluations provides a comprehensive probabilistic description of the response characteristics, easy to combine with risk acceptance criteria and performance requirements. The 3D codes involved are FLACS (CFD) and IMPETUS Afea solver (NLFEA). The response of an offshore fire partition wall is specifically studied against dynamic explosion loads. Detailed modeling of the wall is made in IMPETUS Afea solver. Systematic direct coupling between 90 FLACS risk-based explosion simulations and 90 IMPETUS Afea dynamic response calculations is used. The safety barrier performance is quantified using adequate wall response parameters reported for every explosions. The innovative outcome is a probabilistic picture of the response parameters exceedance. The barrier ability to perform the related safety function(s) is efficiently documented. Of utmost importance, mechanisms that cause possible lack of integrity are highlighted. The results are compared with existing offshore approaches based on the Dimensioning Accidental Load (DAL) concept. A uniform triangular loading and a realistic dimensioning explosion are used. Promoting more consideration of adequate response assessment as part of the safety studies, the paper shows how the advanced method pinpoints limitations of conventional approaches. For the risk owner, it improves the comprehension and implications upon the relation between explosion loads and their consequences on structures carrying critical safety functions. Several benefits result from the GexCon-Impetus approach among which: a more accurate streamlined workflow, an improved understanding of the safety barrier behavior, perception of safety margins, justifications for design optimization, cost & weight savings.

A method for the identification of a set of critical safety functions for a uranium hexafluoride conversion plant

The concept of critical safety functions was developed in order to improve risk management and optimize operational awareness in nuclear reactors after the accident at Three Mile Island. Currently, it is one of the requirements for licensing reactors around the world. However, this concept has not been applied to other units of the nuclear fuel cycle. With the increasing number of nuclear facilities, research on best practices already implemented and proven is necessary. This paper presents a method for identifying critical safety functions to a unit of the nuclear fuel cycle. The method was applied to the design of the conversion unit of uranium hexafluoride of Brazilian Nuclear Industries, identifying a set of nine critical safety functions that will serve as a basis for future implementation of a monitoring system based on critical safety functions.

Safety analysis of LBLOCA in BDBA scenarios for the Bushehr's VVER-1000 nuclear power plant

This paper presents the results of thermal-hydraulic calculations of a large break loss of coolant accident (LBLOCA) analysis for a VVER-1000/V446 unit at Bushehr nuclear power plant (BNPP). LBLOCA is analysis in two different beyond design basis accident (BDBA) scenarios using the RELAP5/MOD3.2 best estimate code. The scenarios are LBLOCA with station blackout (SBO) and LBLOCA with pump re-circulation blockage which have been evaluated in the final safety analysis report (FSAR) of BNPP. A model of VVER-1000 reactor based on Unit 1 of BNPP has been developed for the RELAP5/MOD3.2 thermal-hydraulics code consists of 4-loop primary and secondary systems with all their relevant sub-systems important to safety analysis. The analysis is performed without regard for operator's actions on accident management. The safety analysis is carried out and the results are checked against the acceptance criteria which are the possibility of using water inventory in the emergency core cooling system (ECCS) accumulators and the KWU tanks for core cooling and the available time to operators before the maximum design limit of fuel rod cladding damage is reached. These kinds of analyses are performed to provide the response of monitored plant parameters to identify symptoms available to the operators, timing of the loss of critical safety functions and timing of operator actions to avoid the loss of critical safety functions of core damage. The results of performed analyses show that the operators have 2.9 and 3.1 h for LBLOCA with SBO and LBLOCA with pump re-circulation blockage scenarios, respectively, before the fuel rod cladding rupture. The results are also compared with the BNPP FSAR data.

Do's and Don'ts of Personal Protective Grounding

Temporary protective grounding serves a critical safety function when working on electrical power systems. Although many field service personnel are well familiar with the requirements of using temporary protective grounds, many others have only a partial understanding of important aspects of it. This paper reviews the more important aspects of the application of temporary protective grounds, including sizing, order of placement and removal, results of misapplication, and common rules for working with temporary protective grounds.

Status of Severe Accident Management Guidelines at Kozloduy Nuclear Power Plant

The objective of this paper is to present the current organization of the Emergency Procedures including Emergency Operating Procedures (EOP) and Severe Accident Management Guidelines (SAMG) in Kozloduy Nuclear Power Plant (KNPP) as a function of the severity of the accident conditions. Special attention is paid to SAMG. It is described when the SAMG are used and at which conditions in a transition between the EOPs and the SAMG should be made. The Critical Safety Function Restoration Guidelines and their connections with SAMGs and EOPs are also discussed. The arrangement of SAMG is described in detail, since in the KNPP exist 2 types of SAMGs for Main Control Room (MCR) and for the Accident Management Centre (AMC) and they contain the same strategies, but they are different in format. Both types are symptom oriented procedures, but those for MCR are in 2-column-format with interconnections, whereas those for the AMC are developed in a logical manner and simplified for people, who take decisions. In the paper, they are also discussed the adopted strategies in existing SAMG that should be followed to recover from a damaged core condition and to prevent or mitigate the release of fission products. In the paper, they are also described a number of technical measures for management and mitigation of severe accidents, which are implemented in KNPP before and after the Fukushima accident. Many of them are common for WWER-1000 type of reactors, but some of them are unique and plant specific. This information can be useful for operators of other WWER type reactors or even PWR reactors.

Steam Line Break investigation at full power reactor for VVER-1000/V320

This paper presents the results of thermal-hydraulic calculation of “Steam Line Break” analysis at full power reactor for VVER-1000/V320 units at Kozloduy Nuclear Power Plant (KNPP), done during the development of symptom based emergency operating procedures (SB EOPs) for this plant. The RELAP5/MOD 3.2 computer code has been used in performing the analyses in a VVER-1000 Nuclear Power Plant (NPP) model. A model of VVER-1000 based on Unit 6 of Kozloduy NPP has been developed for the systems thermal-hydraulics code RELAP5/MOD 3.2 at the Institute for Nuclear Research and Nuclear Energy–Bulgarian Academy of Sciences (INRNE–BAS), Sofia.The main purpose of the analysis is to estimate the parameters of the monitored plant which are used to identify symptoms that are used by operators to identify the plant's state and the critical safety function (CSF). The results of the thermal-hydraulic analyses have been used to assist KNPP specialists in analytical validation of EOPs.The performed analysis is based on a previously used bounding approach in analytical validation of SB EOPs. Based on this approach a list of scenarios has been performed, involving a different number of safety systems with or without operator actions. The presented thermal-hydraulic calculations of the accident scenarios involve the loss of CSF “Subcriticality” for VVER-1000/V320 units at KNPP.

Investigation of main coolant pump trip problem in case of SB LOCA for Kozloduy Nuclear Power Plant, WWER-440/V230

This paper presents the results of thermal-hydraulic calculation of accident scenarios that involve the trip of main coolant pump (MCP) in case of Small break loss of coolant accident (SB LOCA) for WWER-440/V230 units at Kozloduy Nuclear Power Plant (KNPP), done in support of the development of Symptom Based Emergency Operating Procedures (SB EOPs) for this plant. The main purpose of these analyses is to show how the different time of MCP switching off results in primary inventory depletion in case of SB LOCA and it is reflect on peak cladding temperature. According to this, the SB LOCA scenario is regarded from the point of view of an inadequate core cooling. Therefore, the primary concern is Critical Safety Function (CSF) “Core cooling” and “Primary inventory”. High core residual heat, minimal safety injection flow and other initial conditions challenging the mentioned CSFs are the main particularities of the accepted scenarios.The RELAP5/MOD3.2 computer code has been used to perform the analyses in a WWER-440 Nuclear Power Plant (NPP) model. A model of WWER-440 based on Unit 4 of Kozloduy NPP has been developed for the system’s thermal-hydraulics code RELAP5/MOD3.2 at the Institute for Nuclear Research and Nuclear Energy – Bulgarian Academy of Sciences (INRNE-BAS), Sofia.

Investigation of nuclear power plant behaviour at low power and cold conditions during an overpressurization in primary circuit

This paper discusses the results obtained during an investigation of WWER-1000 Nuclear Power Plant (NPP) behaviour at low power and cold conditions during an overpressurization in the primary circuit. The reference nuclear power plant for this analysis is Unit 6 at Kozloduy NPP (KNPP) site. The systems and equipment of the KNPP, Unit 6 operate according to the design requirements for the corresponding level of reactor power. In this paper is also presented an analysis of the additionally installed equipment for situations such as cold overpressurization. This equipment was mounted during the Modernization program in KNPP. In the paper is analysed the response of the new equipment together with other NPP available safety systems during the postulated transient in shutdown state. For the purpose of this analysis a RELAP5/MOD3.2 computer code has been used to simulate the transient for WWER-1000/V320 NPP model. A model of WWER-1000 based on Unit 6 of Kozloduy NPP has been developed for the RELAP5/MOD3.2 code at the Institute for Nuclear Research and Nuclear Energy – Bulgarian Academy of Sciences (INRNE-BAS), Sofia. The low power and cold conditions and the modifications after the modernization program, have been taken into account.The main purpose of this analysis is to estimate the parameters of the monitored plant which are used to identify symptoms that are used by operators to identify the plant’s state and the Critical Safety Function (CSF). The analysis is also used to define the timing needed to reach the following stages during the progression of processes in the reactor system:•Reaching the saturated temperature at the outlet of the assembly.•Beginning of reactor core uncover.•Heating up of fuel.•Defining the transition time between Emergency Operating Procedures (EOPs) and Severe Accident Management Guidance (SAMG) at temperature of 923.15K.•Restoring of water level in the core.•Defining the CSF “Integrity” status and the time of its loss.The results of the thermal–hydraulic analysis have been used to assist KNPP specialists in analytical validation of EOPs at low power and cold conditions.The performed analysis is based on a previously used bounding approach in analytical validation of Symptom Based EOPs (SB EOPs). The presented thermal–hydraulic calculations of the accident scenarios involve the loss of Critical Safety Function (CSF) “Integrity” for WWER-1000/V320 units at Kozloduy Nuclear Power Plant (KNPP). During the analysis is also discussed the behaviour of CSF “Core cooling”. The most specific in this analysis compared to the analyses of NPP accidents at full power is the lack of some important safety systems due to NPP regulations. Based on this approach a list of scenarios has been performed, involving a different number of safety systems with or without operator actions. The other specific characteristic of the accidents in NPP at low power and cold conditions is that even though all process are progressing significantly slower compared to full power, the operator actions should always bring the reactor system under safety conditions.

OPERATOR BEHAVIORS OBSERVED IN FOLLOWING EMERGENCY OPERATING PROCEDURE UNDER A SIMULATED EMERGENCY

A symptom-based procedure with a critical safety function monitoring system has been established to reduce the operator's diagnosis and cognitive burden since the Three-Mile Island (TMI) accident. However, it has been reported that a symptom-based procedure also requires an operator's cognitive efforts to cope with off-normal events. This can be caused by mismatches between a static model, an emergency operating procedure (EOP), and a dynamic process, the nature of an ongoing situation. The purpose of this study is to share the evidence of mismatches that may result in an excessive cognitive burden in conducting EOPs. For this purpose, we analyzed simulated emergency operation records and observed some operator behaviors during the EOP operation: continuous steps, improper description, parameter check at a fixed time, decision by information previously obtained, execution complexity, operation by the operator's knowledge, notes and cautions, and a foldout page. Since observations in this study are comparable to the results of an existing study, it is expected that the operational behaviors observed in this study are generic features of operators who have to cope with a dynamic situation using a static procedure.

SHIPP methodology: Predictive accident modeling approach. Part II. Validation with case study

System Hazard Identification, Prediction and Prevention (SHIPP) is a systematic methodology to identify, evaluate, and model the accident process, thereby predicting and preventing future accidents in a process facility. In this methodology, process hazard accidents are modeled using safety barriers rather than causal factors. The fault tree and event tree analysis techniques enhance the accident model to represent a holistic picture of the cause-consequence mechanism of the accident process. Quantitative analysis has two aspects: updating and prediction. The Bayesian theory updates failure probability and consequence occurrence probability when a new observation arrives. The predictive model forecasts the probability of a number of abnormal events occurring in the next time interval. The qualitative and quantitative capabilities of the SHIPP methodology help to design and implement safety strategies into a process system. This methodology was presented in Part I of a series of two papers. This paper (Part II) presents the results of a case study carried out on a liquefied natural gas (LNG) facility. It is conducted with the sole purpose of testing the SHIPP methodology. Gas production and liquefaction were considered as a boundary for accident analysis. This paper illustrates accident model development and cause-consequence analysis for the LNG facility. The updated results demonstrate that the probabilities of abnormal events dramatically change over time as new information is observed. Using accident precursor data for the year 2009, the predictive model estimates that the mean of abnormal events occurring in the next time interval is 22. The qualitative and quantitative analyses provide insight to identify critical safety areas and functions, and to determine the likelihood of failure of these measures. Combining management oversight and engineering analyses, the SHIPP methodology provides a comprehensive, systematic approach to manage a system risk.

Investigation of primary to secondary leakage at low power during “Hydro-test” for VVER440/V230 at Kozloduy NPP

This paper presents the thermal–hydraulic investigation “Primary to secondary leakage at low power” for analytical validation of Symptom Based Emergency Operating Procedures (SBEOPs) at low power for VVER440/V230 units 3 and 4 at Kozloduy NPP. The main purpose of this analysis is to provide the response of monitored plant parameters to identify symptoms available to the operators and define timing for reaching the following stages during the development of processes in the reactor system, after primary to secondary leakage: • Reaching the saturated temperature at the outlet of the assembly. • Beginning of reactor core uncovery. • Define the time for reaching maximum level in the damaged SG. • Termination of natural circulation after decreasing of water level in reactor vessel below the hot nozzles. • Defining the time for opening SVs of damaged SG. • Define the CSF status and the time of loss of Critical Safety Functions. The thermal–hydraulic analysis for analytical validation of Symptom Based Emergency Operating Procedures (SBEOPs) at low power of reactor for VVER440/V230 units 3 and 4 at Kozloduy NPP is performed with RELAP5/MOD3.2 computer code. The RELAP5/MOD3.2 model of Kozloduy NPP VVER-1000 for investigation of operational occurrences, abnormal events, and design basis scenarios have been developed and validated in the Institute for Nuclear Research and Nuclear Energy – Bulgarian Academy of Sciences (INRNE–BAS) Sofia, and Kozloduy NPP. The model provides a significant analytical capability for the specialists working in the field of NPP safety.

Loss of ‘Core cooling’ at low power and cold condition of VVER-1000/V320

This paper presents the results of thermal–hydraulic calculation of accident scenarios that involve the loss of critical safety function (CSF) “Core cooling” for VVER-1000/V320 units at Kozloduy nuclear power plant done during the development of symptom based emergency operating procedures (SB EOPs) for this plant at low power and cold condition. The main purpose of this analysis is to provide the response of monitored plant parameters to identify symptoms available to the operators and define timing for reaching the following stages during the development of processes in the reactor system: ○ Reaching the saturated temperature at the outlet of the assembly; ○ Beginning of reactor core uncovery; ○ Heating up of fuel; ○ Defining the transition time between EOPs and SAMG at temperature of 923 K; ○ Restoring of water level in the reactor; ○ Defining the CSF “Core cooling” status and the time of its loss. The results of the thermal–hydraulic analyses have been used to assist KzNPP specialists in analytical validation of EOPs at low power and cold condition. The principal acceptance criteria for EOPs are averting the onset of core damage. The RELAP5/MOD3.2 computer code has been used in performing the analyses in a VVER-1000 nuclear power plant (NPP) model. A model of VVER-1000 based on Unit 6 of KzNPP has been developed for the systems thermal–hydraulics code RELAP5/MOD3.2 at the Institute for Nuclear Research and Nuclear Energy – Bulgarian Academy of Sciences (INRNE – BAS), Sofia. The low power and cold condition and the modifications after the modernization program are taken into account.

Systematic approach for the analytical validation of Kozloduy NPP, VVER-1000/V320 symptom based emergency operating procedures

This paper presents the development and application of methodology used in analytical validation of emergency operating procedures (EOPs) for Kozloduy Nuclear Power Plant (KNPP), VVER-1000/V320 units. EOPs provide generic guidance to a reactor plant operator in maneuvering the plant to a safe, stable condition in the event of an unexpected plant transient or emergency. These procedures have been analytically validated in order to provide technical justification that the prescribed operator actions are reasonable, effective and prudent. This evaluation is accomplished by systematically evaluating the procedures using specialized thermal-hydraulic computer codes designed for nuclear reactor plant simulation. Thermal-hydraulic computer code calculations have been performed to simulate the symptoms presented to the operator to diagnose challenges to the critical safety functions (CSFs). The accomplished emergency operating procedures' (EOPs') analyses are designed to provide the response of monitored plant parameters to identify symptoms available to the operators, timing of the loss of critical safety functions and timing of operator actions to avoid the loss of critical safety functions or core damage. The principal acceptance criteria for EOPs are averting the onset of core damage. The RELAP5/MOD3.2 computer code has been used in performing the analyses in a VVER-1000 Nuclear Power Plant (NPP) model. EOPs' analysis methodology assumes realistic boundary conditions in validating operator actions. A model of VVER-1000 based on Unit 6 of KNPP has been developed for the system's thermal-hydraulic code RELAP5/MOD3.2 at the Institute for Nuclear Research and Nuclear Energy of Bulgarian Academy of Sciences (INRNE-BAS), Sofia, and was used for simulating the bounding scenarios. The work was possible through participation of leading specialist from KNPP and with the assistance of Pacific Northwest National Laboratory (PNNL), under the International Nuclear Safety Program (INSP) of the United States Department of Energy.

RELAP5/MOD3.2 blackout investigation for validation of EOPs for KNPP VVER-1000/V320

This paper presents the results of thermal–hydraulic calculation of the “Blackout” analysis for VVER-1000/V320 units at Kozloduy nuclear power plant (KNPP), done during the development of symptom based emergency operating procedures (SB EOPs) for this plant. These kinds of analyses are designed to provide the response of monitored plant parameters to identify symptoms available to the operators, timing of the loss of critical safety functions and timing of operator actions to avoid the loss of critical safety functions of core damage. The results of the thermal–hydraulic analyses have been used to assist KNPP specialists in analytical validation of EOPs. The principal acceptance criteria for EOPs are averting the onset of core damage. The response of the VVER-1000/V320 nuclear steam supply system to the loss of all ac power initiating event is analyzed to identify the behavior of important VVER process variables. A limited set of potential operator actions have been evaluated. An investigation of plant response to different combinations of component availabilities in which the operator can be effective in averting core melt is presented in the paper. The RELAP5/MOD3.2 computer code has been used in performing the analyses in a VVER-1000 nuclear power plant (NPP) model. A model of VVER-1000 based on Unit 6 of Kozloduy NPP has been developed for the systems thermal–hydraulics code RELAP5/MOD3.2 at the Institute for Nuclear Research and Nuclear Energy – Bulgarian Academy of Sciences (INRNE – BAS), Sofia and was used for simulation of “Blackout” transient. To analyze blackout transient for VVER-1000/V320, the acceptance criterion which was used was fuel cladding temperature not more than 1473 K (1200 °C). This report was possible through the participation of leading specialists from Kozloduy NPP and with the assistance of Pacific Northwest National Laboratory (PNNL), under the International Nuclear Safety Program (INSP) of the United States Department of Energy.