Capability of APROS in design and validation of I and C systems

There are two WWER-440 type reactors in Loviisa. The first unit was commissioned in 1977 and the second in 1980. The availability of the plant as well as the operational experiences of the Instrumentation and control systems are good. However, it is obvious that the lifetime of the original I and C systems is not sufficient to guarantee the good availability of the plant in the future. Due to this fact a project for the renewal of the existing I and C systems has been started at Loviisa Nuclear Power Plant (NPP). In the project the analog I and C systems will be replaced with a digital I and C systems in four phases during from 2006-2014. Simulators will be utilized extensively in the project to assure that the renewal of I and C systems can be realized safely and economically. The engineering simulator will be used in the design and validation of the modernized I and C systems. The development simulator is aimed for the design, testing and acceptance of the new Man Machine Interface (MMI). The testing simulator will used for the testing of the new I and C systems and for retuning of the controllers mainly during the Factory Acceptance Tests. The training simulator will be used to familiarize the operators and other technical personnel to the operation of the new monitor-based control room facilities. APROS simulation software will be the main simulation tool in development and assessing of the new I and C configuration as well as in training of the plant personnel. First a brief description of the APROS code and APROS model of Loviisa plant including the model validation extent is discussed. Then the development and design of the new I and C system of Loviisa NPP is presented. As an example the application where trip of three reactor coolant pumps (RCP) assuming different failures during the transient is presented. An essential APROS feature in this study is the capability of the code to simulate the control rod movement. This feature is needed especially in WWER-440 type reactor analyses since besides the control rod movement during normal operation there are four different reactor protection modes. During two protection modes control rod groups are moving individually with the velocity based on protection mode. APROS 5.02 computer code has been applied in the analyses of three RCPs trip in Loviisa 1 NPP. The main assumption was that the plant operates as designed excluding the defined failures. APROS input model of Loviisa was a best-estimate model and did not include any conservative features. These analyses indicated that from the modeling point of view the temperature measurement time constant was found to have an effect on the results. Therefore, in APROS model of Loviisa time constant of every temperature measurement is modeled. When using APROS the modeling is very easy since there is measurement component available in the code and the user only has to give the time constant as an input value. Four cases dealing with stop of three RCPs were analyzed. In the base case the reactor operated as designed. In the first variation ROM was assumed not to be available and on the second variation in addition to ROM also actuation of fast shutdown was assumed to fail. The last variation was a kind of an ATWS case where no control rod movement was assumed. Based on the results it can be concluded that if ROM fails reactivity feedback reduces thermal power until slow shutdown is actuated from high upper plenum temperature. Slow shutdown is not, however, capable to reduce upper plenum temperature fast enough below set point value and also fast shutdown is actuated 20 s later. This results in situation where fission power 'dies' and reactor power generation from this point of time onwards is based on decay heat generation. When assuming that no control rods movement takes place, reactor power decreases down to 62 % level as a result of reactivity feedback. The level is higher than desired 50% and therefore e.g. turbine bypass valves are needed to prevent secondary side pressure from rising. In this case reactivity feedback is based on BOC situation. If end of cycle (EOC) is assumed reactivity feedback is stronger and power is decreasing close to 50% level without any control rod movement. From the reactor safety point of view there is not any need to actuate fast shutdown in case of three RCPs stop since it results in excessive change of the primary circuit parameter values. If all lower level reactor protection modes are assumed to fail, reactor most probably trips from high upper plenum temperature. If more than three RCPs stop, reactor trip takes place from signal more than three RCPs are not running. The analyzed cases do not cause any major safety problem. Actuation of fast shutdown should be avoided if possible since it results in similar situation as if reactor trip would take place. Based on the results of these analyses new actuation set point of fast shutdown is considered when new I and C system is designed for Loviisa NPP. APROS was found to be an excellent tool in these kinds of analyses