Available online at www.sciencedirect.

com

Nuclear Engineering and Design 238 (2008) 975–1001

Deterministic accident analysis for RBMK

F. D’Auria a,∗ , B. Gabaraev b , S. Soloviev b , O. Novoselsky b , A. Moskalev b , E. Uspuras c ,
G.M. Galassi a , C. Parisi a , A. Petrov b , V. Radkevich b , L. Parafilo d , D. Kryuchkov d
a DIMNP, University of Pisa, Pisa, Italy
b NIKIET, Moscow, Russia
c LEI, Kaunas, Lithuania
d PhEI, Obninsk, Russia

Received 22 September 2006; received in revised form 24 February 2007; accepted 1 March 2007

Abstract
Within the framework of an European Commission sponsored activity, an assessment of the deterministic safety technology of the ‘post-Chernobyl
modernized’ Reactor Bolshoy Moshchnosty Kipyashiy (RBMK) has been completed. The accident analysis, limited to the area of Design Basis
Accident, constituted the key subject for the study; events not including the primary circuit were not considered, as well as events originated
from plant status different from the nominal operating conditions. Therefore, the notorious Chernobyl Unit 4 event was outside the scope of the
investigation.
Following the evaluation of the current state of the art in the area including the identification of critical issues, targets for the analysis were
established together with suitable chains of computational tools. The outcomes from this part of the study are (a) the list of transient scenarios
whose parameter values are assumed to constitute the boundaries for the evolution of any relevant safety transient and; (b) a set of computational
tools with characteristics consistent with current technological achievements, suitable for performing safety analyses.
The availability of computational tools, including codes, nodalisations and boundary and initial conditions for the Smolensk 3 NPP, brought to
their application to the prediction of the selected transient evolutions that, however, are not classified as licensing studies. The results demonstrated
proper safety margins and relatively long time constants associated with the huge values for the ratios between mass of moderator and mass of
coolant and unit generated power.
The results at the item above, suggested a qualitative, though non rigorous, comparison between accident analysis aspects in LWR and RBMK
having the main purpose to show strengths in RBMK safety features heavily criticized not always in a consistent way following the Chernobyl
event.
The results of supporting analyses for the present paper are discussed in five companions papers in this Journal volume. The second (over six)
and the third paper deal with the RBMK Main Coolant Circuit and Confinement thermal-hydraulic performance, respectively. Key specific issues
in the RBMK safety technology, constituted by addressing of the “Multiple Pressure Tube Rupture (MPTR)” and by the application of coupled
three-dimensional neutron-kinetics thermal-hydraulics, are discussed in the fourth and fifth papers. The proposal to instrument the core channels
(ICM = Individual Channel Monitoring) has been formulated in this context and is discussed in the sixth companion paper.
© 2007 Elsevier B.V. All rights reserved.

1. Introduction tube’ are interchangeable in many statements of the present

The Reactor Bolshoy Moshchnosty Kipyashiy (RBMK) is a
boiling light water cooled, graphite moderated thermal reactor.
Slightly enriched uranium fuel is adopted for fuel rods that are
assembled in two groups of eighteen to constitute pressurized
Fuel Channels (FC). The words ‘fuel channel’ and ‘pressure
∗ Corresponding author.
E-mail address: dauria@ing.unipi.it (F. D’Auria).
paper and of the companion papers; however, preferably, the
pressure tube is a part of the fuel channels. A zirconium–niobium
tube envelopes the channel to sustain the coolant pressure and is
embedded into square-cross-section graphite blocks. More than
sixteen hundred graphite stacks with embedded fuel channels
constitute the core that is bounded by a steel tank enclosed into
a pressure resistant reactor cavity.
Established fundamental principles, already valid in the 50s,
are at the basis of the design of the reactor system that nowa-
days, following an experience of around 360 reactor-years,

0029-5493/$ – see front matter © 2007 Elsevier B.V. All rights reserved.
doi:10.1016/j.nucengdes.2007.03.006
976 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001
shows suitable operational and safety records with the notice-
able exception of the Chernobyl unit 4 event in 1986, Adamov
et al., 1995.
The detailed knowledge of the RBMK system configuration
was not spread in the Western world till the 1986 event. After-
wards, “information batches” of RBMK technology became
available and were unavoidably evaluated in the light of the
Chernobyl event. This caused a search for and a characteriza-
tion of inadequacies not counterbalanced by the identification
of the acceptable safety features, ending-up in an overall neg-
ative judgement from the reactor safety viewpoint. The lack or
the inadequacy of a comprehensive safety related documenta-
tion from the Soviet Union, also connected with the uses of
the reactor, contributed to this judgement. Furthermore, geo-
metric and material features of the reactor and primarily of
the core, were not consistent with capabilities or with the val-
idation domain of computational tools adopted in the Western
world to assess the fulfilment of standard safety requirements,
actually preventing a sound and (Russian) independent evalua-
tion.
The background for the present paper is constituted by, see
also Sorokin et al., 2006:
a) The results obtained from several RBMK safety studies per-
formed by Russia, Ukraine and Lithuania based institutions
in cooperation with international institutions, e.g., TACIS,
1996; TACIS, 1997 and IAEA, 2000.
b) The availability of advanced computational tools includ-
ing numerical codes, detailed input decks and powerful
computers, including three-dimensional neutron kinetics,
e.g., Avvakumov and Malofeev, 1991, Computational Fluid
Dynamics (CFD), e.g., Fluent, 2003 and Finite Elements
(FE), e.g., Ansys, 2002, codes.
c) The completion of a recent EC TACIS Project in which
framework the availability of ‘parallel’ chains of Western
and Russian codes was established allowing the evaluation
of complex accident conditions typical of RBMK, D’Auria
et al., 2005.
The International Atomic Energy Agency (IAEA), the US
Department Of Energy (US DOE), the European Commission
(EC) and various national institutions in UK, France, Germany
and Japan, as a consequence of the Chernobyl event and pri-
marily after the collapse of the Soviet Union (1991) put a lot
of effort, item (a), in investigating and in improving the safety
features of RBMK. The following situation can be depicted at
the early 2000s:
• A number of minor (in the sense of easy to modify) safety defi-
ciencies were identified and corrective actions were proposed
and implemented (not for each individual NPP), Adamov et
al., 1996. Examples are constituted by removal of the positive
reactivity inserted by control rods, as discussed by Landeyro
and Buccafurni, 1991, the introduction of a ‘new’ scram sig-
nal, Kaliatka and Uspuras, 2002, the introduction of new vent
pipes connecting the reactor cavity to the environment, Sureau
et al., 1996, the reduction of positive void coefficient by the
increasing of the uranium enrichment and of the number of
additional absorbers, Gabaraev et al., 2004.
• The thermal-hydraulic performance of the primary circuit in
case of a variety of accident situations was considered as
acceptable, together with the design of the Emergency Core
Cooling Systems (ECCS), even though modifications were
proposed to the logic of actuation of those systems, as dis-
cussed for instance by Meyer et al., 1994 and by Weber et al.,
1994 (see also Uspuras and Kaliatka, 2006).
• Some features of the confinement system were not judged as
acceptable for the Western standards with main reference to
the leakages from various zones of the confinement, the lack
of sufficient protection against the catastrophic break of the
steam drum, e.g., IAEA, 1993.
• An issue was left open that is the catastrophic propagation
of the rupture once one channel is broken, i.e., the Multiple
Pressure Tube Rupture (MPTR). The existence of 1500 (or
more) FC implies the existence of an equal number of pres-
surized piping at the bottom and at the top of the channels as
well as an equal number of valves in the feeding lines (bot-
tom) to control the flow and allow the consistency between FC
mass flow and power. The pressure tube rupture constitutes an
event that has been documented three times in existing RBMK
NPP (Nuclear Power Plants), e.g., in 1975 and in 1992 in the
Leningrad NPP and in 1982 in Chernobyl NPP, as discussed
by Simonov et al., 1994 and by Sureau et al., 1996. In two of
these cases the event was originated by FC blockage (Cher-
nobyl 1982 and Leningrad 1992) while power excursion was
the initiating event in the remaining case. The FC flow-rate-
to-power mismatch ends up with pressure tube overheating
and creep caused rupture also implying the loss of integrity
for the connected graphite bricks. The safety issue reported
as MPTR is connected with the possibility that the rupture of
one FC propagates towards neighbouring channels resulting
disruptive for the core.
The above findings were based upon the applications of com-
putational tools available in the 90s: relevant RBMK safety
issues were analyzed to a level consistent with the capabili-
ties of those tools not designed (in Western Countries) for the
peculiarities of RBMK. The recent availability of powerful com-
puters opened the way for innovative numerical techniques and
new analyses, whose key aspects including limitations, can be
characterized as follows, item (b):
• Increased number of nodes. When performing transient
thermal-hydraulic analysis (but not only) of the RBMK core
there is the need for a great number of cells to properly simu-
late radial and axial temperature profiles in the graphite. This
is essential for predicting the evolution of temperatures and
of stresses in FC tubes, see also D’Auria et al., 2008a.
• Local neutron kinetics flux. The volume of the RBMK core
is 10 times the volume of Boiling Water Reactor (BWR);
this makes important the prediction of the local neutron flux.
Therefore, three-dimensional neutron flux shall be computed
considering ‘local’ void presence in the core and ‘local’
power shapes in transient conditions, as well as properly
 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001
‘locally’ averaged graphite temperature (see also D’Auria
et al., 2008d). This is specifically relevant when predicting
consequences of FC blockage.
• Stress intensification factor. Geometric discontinuities at the
level of the graphite rings that circumvent the FC and separate
the pressure tubes from the graphite bricks may constitute
the weakest point at the origin of crack propagation. Suit-
able detailed modelling is needed (and performed within the
present framework), see also D’Auria et al., 2008c.
• Increased reliability in predicting transient Critical Heat Flux
(CHF) in long heated channels, dynamic two-phase stability,
steam superheating and transient Counter Current Flow Limit-
ing (CCFL). Conservative analyses without the consideration
for thermal-hydraulic non equilibrium may be worthwhile for
licensing study, but do not give a picture of the transient
system performance and of the actual safety margins. The
capability to simulate phenomena such as those listed above
within the ranges of variation of key phenomena typical for
RBMK core has been achieved (maybe not fully) only in the
last few years with the support of the ‘recently-acquired’ capa-
bility of sufficiently fine noding as also discussed in the first
two bullets above.
• Interaction of high temperature UO2 pieces with graphite.
The break of an FC constitutes a permissible event in RBMK
safety technology; one can anticipate that the event belongs to
the Design Basis Accident (DBA) class, as discussed in Sec-
tion 3 below. In this case high temperature pieces of fuel and
clad may hit irradiated graphite whose temperature may be in
the range of 300–660 ◦ C within an environment constituted
by steam and inert gas. The possibility that such an interaction
induces fast chemical reactions in the graphite constitutes an
example of phenomenon that has not been investigated within
the present context.
The EC TACIS (Technical Assistance to Countries of the
Commonwealth of Independent States) Project R2.03/97, item
(c), started with the conditions depicted under item (a) and was
conducted with consideration of the bullet items under item (b),
D’Auria et al., 2005. The related key objective was to create a
chain of codes suitable for the analysis of unresolved accident
scenarios in RBMK making reference to the MPTR issue. The
achievements of the Project went beyond the commitments; the
suitability of two chains of codes of Western and of Russian
origin was demonstrated and the possibility of MPTR initiated
by the fuel channel blockage was basically excluded also con-
sidering the recent information (2005, TKR facility, Medvedeva
et al., 2004) from the execution of full scale experiments with
key results made available to the Project, D’Auria et al., 2008d.
The variety and the amount of results from the execution
of the Project activities, including the addressing of the MPTR
issue and the availability and the application of two chains of
codes for RBMK deterministic safety analyses and the proposal
for an Individual Channel Monitoring (ICM) system capable to
actuate a scram early enough to prevent FC rupture following
blockage, suggested the present series of six papers, e.g., present
one and papers by D’Auria et al., 2008a–e.
977
All the results of the analyses are documented by D’Auria
et al., 2005 and use is made, for the RBMK transient
thermal-hydraulic system performance, of results documented
by Uspuras and Kaliatka, 2006. In all cases, the presented
results shall not be considered as results from formal licensing-
regulatory analyses, but are functional to the second objective
defined below.
Two are the objectives of the present series of six papers:
(1) To present numerical techniques and computational tools,
including qualification levels and results from the appli-
cations, suitable for deterministic safety analysis of
RBMK.
(2) To demonstrate the results of computational analyses, which
allow making conclusions about the current safety charac-
teristics of the plants with RBMK reactors.
The former objective is pursued in the present paper, but pri-
marily in the papers by D’Auria et al., 2008a–e (see also D’Auria
et al., 2005) that constitute the support for the conclusions that
are derived here. The content of these papers can be summarized
as follows:
- Thermal-hydraulic performance of the primary system
of RBMK following selected accidents, D’Auria et
al., 2008a.
- Thermal-hydraulic performance of confinement system of
RBMK, following selected accidents, D’Auria et al., 2008b.
- The use and the relevance of three-dimensional neutron
kinetics coupled with thermal-hydraulics in RBMK accident
analysis, D’Auria et al., 2008c.
- Addressing the MPTR issue, D’Auria et al., 2008d.
- The proposal for ICM to prevent pressure tube rupture follow-
ing FC blockage, D’Auria et al., 2008e.
The latter objective is pursued primarily in the present paper
that makes use of results documented in the remaining five com-
panion papers. The background and the rationale for achieving
the identified objectives are also part of the present paper. This
also includes an arbitrarily defined list of topics derived from
a spot-based investigation within the safety domain of water
cooled reactors including RBMK. It must also be premised that
well established Probabilistic Safety Assessment (PSA, e.g.,
Mankamo et al., 2000) results have been used, but no inves-
tigation has been carried out to demonstrate the validity or the
quality of these results.
Data, analyses and conclusions in the six companion papers
are related to the current configuration of the Smolensk-3 NPP
(some reported analyses also relate to Ignalina-2 and Leningrad-
3 NPP) and no effort is made to provide any evaluation of safety
for RBMK where the innovation or modernisation feedbacks for
the Smolensk-3 plant are not applicable.
2. Overview and evaluations in the area of RBMK safety
A comprehensive safety evaluation of a complex system
needs the assessment of the key safety features at level of
978 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001

the concerned NPP design and operation and of the support-

ing safety culture. The systematic consideration of these two
issues is well beyond the objective of journal papers and in
the present case constitutes the subject of the Safety Analysis
Report (SAR) for the RBMK NPP. Some key-elements are dis-
cussed hereafter, distinguishing between design safety features
and licensing background.
In addition to the outline of the RBMK and of the ‘estab-
lished’ safety parameters, an evaluation is provided of the
strength of the safety features, Section 2.2.

2.1. The RBMK configuration

Twelve RBMK units are installed in Russia and Lithuania,

contributing in Russia for about 50% of the electricity generated
by the nuclear source. A detailed source of RBMK information
is constituted by the report authored by Almenas et al., 1998.
The data given below are related to the Smolensk 3 NPP. This
is a “3rd generation RBMK reactor” constructed in the Russian
Federation about 400 km Southwest of Moscow. The unit was
put into operation on January 17, 1990.
The sketch of the overall system including an overview of the
Main Coolant Circuit (MCC) or primary system and of some
zones of the Confinement is given in Fig. 1. Key design values
and operating condition values are reported in Table 1. The Bal-
ance of the Plant system with turbine, condenser and feed-water
lines has configuration and component layout that are typical for Fig. 1. Sketch of the main coolant circuit of a RBMK.
NPP and is not described here.

2.1.1. The main coolant circuit
The steam–liquid mixture produced in the core is driven to
four horizontal steam drums (item 6 in Fig. 1) where physical
separation occurs for the two water phases with steam directed
to the turbine and liquid re-circulated to the core after mixing
with feed-water coming from condenser.
At the exit of the steam drum saturated water mixes
with feed-water and sub-cooled water is collected into Suc-
tion Headers and driven to the Main Coolant Pumps (MCP).
Downstream of the MCP two kinds of collectors are dis-
tinguished (see D’Auria et al., 2008a for more details):
(a) the Pressure Headers and (b) the Group Distribution

Fig. 2. Sketch of the core of a RBMK: (a) structural configuration; (b) overall view.
 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001 979

Table 1
Key design values and operating condition values for RBMK-1000
No. Quantity Unit Value Notes

1 Thermal power MW (th) 3200

2 Number of active FC – 1570* *Or 1661
3 Number of CR channels – 211 Including all CR types
4 Total number of graphite columns – 2488 Includes reflector channels
5 Core active height/height of graphite stacks m/m 7.0/8.0
6 Core diameter m 14 (+0.5) Diameter of the carbon steel tank = 14.5 m.
7 Number of fuel rods per FC – 18 × 2 Two vertical rod bundles
8 Steam drum pressure MPa 6.86
9 Core inlet pressure MPa 7.80
10 Core inlet sub-cooling K 14 ÷ 25
11 Steam Drum (SD) volume m3 162 Four SD are part of the MCC
12 Total MCC volume m3 1334 Including pipelines till feed-water and steam lines
isolation valves. Both core halves
13 Total MCC mass Ton 801
14 Range for FC power MW (th) 0.8 ÷ 3.0 This includes about 6% amount coming from
graphite
15 Range FC mass flow-rate/power Kg/MW-s 2.0 ÷ 5.2
16 MCP flow-rate Ton/s 1.72
17 Steam lines flow-rate Ton/s 0.78
18 Total core flow-rate in CR channels Ton/s 0.32 Atmospheric pressure loop

Headers (GDH). Separate pipelines from GDH feed each
individual FC, with approximately 40 channels fed by each
GDH.
The sub-cooled liquid enters the bottom of the FC at a pres-
sure of about 7.8 MPa and exits the 8 m high channel at a pressure
around 0.65 MPa lower than the inlet pressure with void fraction
around 0.8.
2.1.2. The core
The core is constituted by channels embedded inside graphite
blocks, Fig. 2. The blocks are arranged in more than 2000
graphite columns. A variety of channels are present (see also
Table 1); pressurized and non-pressurized channels shall be dis-
tinguished. Pressurized channels include the FC with fuel rods as
depicted in the sketch of Fig. 3. Non-pressurized channels con-
stitute the lodging for three main types of Control Rods (CR)
and are identified as Control and Protection System (CPS), see
also Section 5.3 below. Reflector and instrumentation channels
also belong to the category of non-pressurized channels.
2.2. The safety features, the structural-passive barriers and
the confinement
Three categories for safety features can be distinguished: (a)
the MCC pressure limitation and discharge system; (b) the MCC
feeding system, primarily the Emergency Core Cooling Sys-

Fig. 3. Fuel channel and fuel rod of a RBMK.

980 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001
tems (ECCS); (c) the structural-passive barriers including the
confinement system.
The systems and the components belonging to the first two
categories have similar objectives and functions as the cor-
respondent ones in BWR, for instance. The judgement for
acceptability is connected with the compliance of their perfor-
mance with the licensing goals (see below), the choice and the
boundary conditions for the DBA, and the quality/reliability of
the design, the construction and the maintenance of the individ-
ual components and of the actuation logics.
It is beyond the scope of the current set of papers to
provide the judgement identified above. This constitutes the
scope of the SAR as already mentioned. However, the indi-
vidual accident analysis studies performed within the present
framework (i.e., not supported by PSA) and documented in
D’Auria et al., 2008a–c did not bring to the identification
of any substantial drawback or flaw in the design of sys-
tems or components for the identified categories (a) and
(b).
An overall safety layout, including different ‘depth’ barri-
ers connected with the hazard level of the enclosed nuclear
material and the physical separation of zones, characterizes the
RBMK system, safety category (c). This implies a unique over-
all configuration of safety barriers not strictly comparable with
the structural-passive barriers and containment adopted in Light
Water Reactors (LWR). Two sets of safety relevant parame-
ters are used to support this statement and, where applicable,
comparison is provided with safety features of LWR.
The former set deals with the design, namely components,
materials, dimensions and operating conditions:
- Core maximum linear power density: with the same (or com-
parable) fuel rod design, RBMK values are about two times
lower than LWR specific values.
- Core volumetric power density: RBMK values are 20 or 10
times less than in Pressurized Water Reactors (PWR) or in
Boiling Water Reactors (BWR), respectively.
- The absence of a pressure vessel avoids the (residual) risk of
catastrophic (vessel) failure, similarly to Canadian Deuterium
Uranium (CANDU) reactors.
- The risk of steam explosions is basically non-existing in
RBMK (at least if one considers the overall core mass).
- Thermal and ‘neutron-kinetics’ (see D’Auria et al., 2008c)
inertias of the core strongly limit pressurization, depressur-
ization (including the situation of Loss of Coolant Accident
(LOCA)) and fission power change rates, making these param-
eters (in their units, i.e., MPa/s for the first two parameters and
MW/s for the third one, respectively) one order of magnitude
smaller than in LWR.
However, the use of graphite in the core makes the system
prone to accident scenarios that cannot be envisaged in LWR,
i.e., originated by exothermic chemical reactions. It should be
noted that the inflammation of graphite stack is impossible prac-
tically due to stack structure features which ensure hard influx
of oxidizer to graphite surface and very low open graphite area-
to-mass ratio, Alexandrov et al., 2007. Furthermore, the normal
temperature performance of graphite stack excludes the accu-
mulation of Wigner energy, Platonov et al., 2003.
The latter set deals with the barriers to the release of fission
products and the physical separation:
- Safety barriers are constituted in RBMK by fuel matrix, clad,
pressure tube, graphite blocks, the tank encompassing the
graphite stacks and the reactor cavity. The number of physi-
cal barriers to the release of radioactivity is larger in RBMK
than in LWR even though the level of ‘leak-tightness’ may not
be the same. For instance, the graphite stacks do not provide
leak tightness, but in case of failure of the pressure boundary,
radioactivity deposits on the free surfaces are expected.
- The ‘level of segregation’ of the core, i.e., the reactor zone
where radioactive material is confined, is higher in RBMK
compared with LWR; namely, a couple of thousand small
diameter pipes connecting the reactor cavity with the exterior
making unlikely large radioactivity leakages from the core
even following (severe) core damages; in case of LWR large
diameter pipes are in direct contact with the core and are prone
to the transport of large amount of radioactivity in the same
conditions of (severe) core damages. As a consequence, large
LOCA in primary system and containment bypass events in
LWR (e.g., Steam Generator Tube Rupture) could have higher
radiological impact than in RBMK.
- The confinement, typically mentioned as Accident Localisa-
tion System (ALS) in RBMK technology (see D’Auria et al.,
2008b for more details), may be evaluated as ‘weaker’ than
a typical LWR containment, however, it also constitutes an
‘added’ safety feature and not a weak feature for RBMK in
consideration of the item above.
Selected accident scenarios topics and related comparison
RBMK–LWR, Chapter 6 hereafter, constitute a supplement to
the discussion above.
2.3. The RBMK licensing background
An established licensing technology for RBMK exists in Rus-
sia. This is fully consistent with Western technology and is
summarized in a dozen pages by D’Auria et al., 2005; indicative
excerpts are considered here.
2.3.1. The fundaments
The recent and the reference International Atomic Energy
Agency (IAEA) documents are considered, e.g., INSAG, 1999
and IAEA, 2005, dealing with different safety levels. Among the
other things, Design Basis Accidents (DBA) and Beyond DBA
(BDBA) conditions are distinguished.
Within the DBA domain the integrity of the following barriers
shall be ensured: (a) fuel matrix; (b) fuel cladding; (c) circula-
tion circuit pressure boundary and, in particular, the components
most susceptible to damage, namely fuel channel pressure tubes;
(d) metal structures forming the reactor cavity; (e) structural
components of the leak-tight ALS compartments and other com-
partments of the NPP housing circulation circuit pipelines.
 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001
Should any safety barrier fail, BDBA conditions should be
assessed for the following purposes: (a) to assess the degree of
reactor protection and the time available for taking countermea-
sures; (b) to determine the emergency and other signals available
to the operator for identifying the plant status and to devise
appropriate accident management steps; (c) to develop a package
of organizational and technical measures (management strategy)
for prevention and mitigation of the accident consequences; (d)
to assess the possible consequences as input information for
planning protection of the population and the NPP personnel.
The national Regulatory Authority (Rostechnadzor) requires the
use of both the deterministic and the probabilistic approach. If
some initiating events can lead to severe consequences and the
inside features of reactor are not able to prevent this, accident
mitigation means should be foreseen (and assessed by determin-
istic methods) without drawing the attention to the probability
of these events.
2.3.2. RBMK specificities
The peculiar design features of RBMK, Sections 2.1 and 2.2,
are considered in the licensing process.
Key issues, not existing in LWR safety technology, are rep-
resented by the integrity FC pressure tube and by the graphite
blocks. Thermal, fatigue and radiation originated stress condi-
tions must be taken into account. Proper attention is devoted to
the (relatively) small volume of the reactor cavity and to the rup-
ture of large pressurized components like the steam drum and
the pressure header.
Local neutron flux control, owing to the core dimensions, also
constitutes a recognized specific issue in RBMK safety technol-
ogy. On the one hand there is the difficulty to ensure on the basis
of proper measurements, see also D’Auria et al., 2008e, the con-
sistency between FC power and flow-rate. On the other hand,
there is the availability of a large number of CR that operates in
an atmospheric pressure environment.
2.3.3. Acceptability thresholds
Selected acceptability thresholds for the probabilistic analy-
ses adopted in RBMK licensing technology are:
• DBA are characterized by the frequency range of 10−2 –10−4
per reactor year.
• The estimated probability of an event with large release should
be <10−7 per reactor year.
• The estimated probability of severe reactor core degradation
or melting should be <10−5 per reactor year.
Selected acceptability thresholds to be assessed in determin-
istic accident analyses are (see D’Auria et al., 2008a–c for more
details):
• Fuel pellet temperature (maximum value) <2800 ◦ C.
• Volume averaged fuel enthalpy increase <710 kJ/kg.
• Fuel clad temperature <1200 ◦ C for DBA conditions and
<700 ◦ C to prevent clad collapse.
• Fuel channel tube temperature <650 ◦ C in the pressure range
4.0–8.0 MPa.
981
• Reactor cavity pressure <210 and <300 kPa (excess pressure)
for DBA and BDBA, respectively.
• Maximum permissible effective radiation doses to the public
in the early phase of an accident <0.5 cSv for the whole body.
3. The list of bounding events
The identification and the characterization of accident sce-
narios to be considered for numeric simulation constitute a key
for the deterministic safety analysis. The list of applicable sce-
narios and related boundary and initial conditions is included in
individual NPP SAR documents and, typically, may be changed
following upgrades of the unit or updates reflecting current
knowledge.
The latest RBMK SAR documents adopt the list of sce-
narios proposed by the IAEA Safety Report Series No 43,
IAEA, 2005, where ‘Transients’, ‘DBA’ and ‘BDBA’ are dis-
tinguished. The classes of events to be considered in RBMK
licensing are given in Table 2, where DBA scenarios are
identified, together with RIA (Reactivity Initiated Accident)
and ATWS (Anticipated Transient Without Scram) situa-
tions.
Within the framework of the TACIS Project R2.03/97,
D’Auria et al., 2005, a list of relevant RBMK accidents was
identified and the resulting scenarios were analysed; the goals
and the criteria driving the accident selection process can be
summarized as follows:
(a) Relevance to the RBMK safety technology including
situations where established and internationally agreed cal-
culated scenarios are not available.
(b) Emphasis given to the consideration of the largest number
(maybe all) of physical phenomena and of system compo-
nents relevant for the deterministic accident analysis, i.e.,
an attempt has been made to identify ‘physical’ bound-
ing scenarios (in line with the last statement of the last
paragraph under the section ‘The fundaments’ in Chapter
2.3).
(c) Challenging for the computational tools including the chains
of codes with current capabilities.
However, the selection of individual accidents did not address
the licensing classification, e.g., Table 2, and a systematic PSA
study was not performed. Furthermore, no emphasis is given to
transients occurring during refuelling or low power operation.
Six classes of accidents (or better five, i.e., A–E, plus one)
were selected that are relevant to the described targets. The class
identification in Table 3 is given by the statement in parentheses
at the end of each item below.
(A) Design of ECCS and of Engineered Safety Features and
challenging for thermal-hydraulic system codes (ESF and
ECC design).
(B) Design of overall RBMK confinement system and chal-
lenging for coupled primary system and confinement codes
(Confinement).
982 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001

Table 2
Class of events considered in RBMK deterministic safety analysis with identification of the DBA, IAEA, 2005
No. Event group Accident scenarios Class

1 Anomalies of Core coolant temperature

2 Anomalies of system pressure Transient
–
3 Anomalies of core coolant flow-rate (T)
4 Increase of core coolant inventory
5.1 Guillotine break of GDH
5.2 Guillotine break of down-comer
5.3 Break in inlet pipeline of FC
5.4 Break in outlet pipeline of FC
5.5 Break of FC inside RC
5.6 Break of the main feed-water pipeline
5.7 Break of the main steam line
LOCA
5.8 Failure to close of the Main Steam Valve
5.9 Break of a small diameter pipeline outside the ALS
5.10 Inadvertent safety/relief valve opening DBA
5.11 Main Steam Valve stuck open
5.12 Rupture of water communication line
5.13 Rupture of a pressure line inside the reactor cavity
5.14 Rupture of a pipeline in the blow-down and cooling system
6.1 Voiding of the CPS cooling circuit
6.2 Erroneous refuelling
6.3 RIA Prolonged withdrawal of CR at both full and low power
6.4 CR drop including the absorber part of short rods falling out of the core
6.5 Nitrogen ingress into reactor coolant system after actuation of ECCS
7 ‘Critical’ LOCA
8 ATWS – BDBA
9 Fuel handling accidents

(C) Addressing local fission power generation and cou-
pled three-dimensional Neutron Kinetics thermal-hydraulic
codes (3D NK-TH).
(D) Addressing the structural integrity of FC and the MPTR
issue and challenging for coupled structural-mechanics
thermal-hydraulics codes. This also includes the evalua-
tion of nuclear fuel performance and of fuel-FC-graphite
damage phenomena and the adoption of related codes (FC
rupture and MPTR).
(E) Fission product generation and transport and use of codes
classified as severe Accident codes in Western Regulatory
Authorities (FP generation and transport).

Table 3
Classification of class of events suitable for RBMK deterministic accident analysis with identification of suitable codes and accident scenarios, D’Auria et al., 2005
Class no. ID of accident class Codes (+) Accident scenarios Class and no. in Table 2

A1 LOCA-PH-FIGDH BDBA
A2 LOCA-SL DBA – 5.7
A ESF and ECCS design KORSAR RELAP5
A3 LOOP-ATWS BDBA–
A4 GDH-BLOCKAGE –
B1 GDH-BLOCKAGE-SA –
KORSAR, COCOSYS CONTAIN,
B Confinement B2 LOCA-PH-FIGDH BDBA
RELAP5
B3 LOCA-SL DBA – 5.7
C1 FC-BLOCKAGE **

UNK, BARS, KORSAR HELIOS, C2 GDH-BLOCKAGE –

C 3D NK-TH*
RELAP5-3D, NESTLE C3 CR-G-WITHDRAWAL DBA – 6.3
C4 CPS-LOCA DBA – 6.1
RAPTA, STAR-CD, KATRAN, D1 FC-BLOCKAGE **
D FC rupture and MPTR U-STACK FRAP, FLUENT, D2 FC-LOCA DBA – 5.5
RELAP5, ANSYS **
VICTORIA, COCOSYS E1 FC-BLOCKAGE
E FP generation and transport
MELCOR E2 GDH-BLOCKAGE-SA –
F ICM proposal RELAP5 F1 FC-BLOCKAGE **

(+) The codes used at NIKIET are reported in bold character (REFP is the present substitute for VICTORIA).
* The coupled 3D NK-TH codes require derivation of proper cross sections (or functions): related codes are listed.
** For some aspects, see DBA – 5.5.
 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001
(F) Focused to establishing the Individual Channel Monitoring
(ICM) proposal to prevent FC rupture following blockage,
as discussed by D’Auria et al., 2008e (ICM proposal).
Accident scenarios are identified in each class as presented in
Tables 3 and 4. In the first table, the correspondence is derived
with the classification available from Table 2.
The accident originated by the full blockage of a FC (C1,
D1, E1 and F1 in Tables 2 and 3) has been assigned a pivot
role within the present context, as discussed in more detail by
D’Auria et al., 2008d: (a) thermal-hydraulic phenomena occur
like dry-out, critical flow at time of pressure tube rupture and
flow reversal at the top of the channel; (b) neutron kinetics is
relevant to calculate fission power in the affected bundle fol-
lowing channel voiding and fuel heat-up; (c) fuel performance
is important because of the unavoidable high temperatures and
consequent metal water reaction, clad collapse and substan-
tial rod deformation; (d) pressurization of reactor cavity occurs
as well as mixing of steam and non-condensable gas, there-
fore, confinement thermal-hydraulics is relevant; (e) mechanical
stresses occur upon neighbouring graphite stacks causing FC
deformation; (f) the rupture of pressure tubes causes heavily
damaged fuel to enter the reactor cavity, thus, making relevant
the area of fission product transport.
Furthermore the FC break shall be considered as a DBA
because of the probability of occurrence: three such NPP events
are documented, D’Auria et al., 2008d, however radiation dose
criteria are not exceeded, Uspuras and Kaliatka, 2006.
4. The computational tools
The computational tools include, as already mentioned, the
numerical codes, the nodalizations and the relevant boundary
and initial conditions related to the Smolensk 3 NPP in the
present case. The application of computational tools, primar-
ily for licensing analyses, requires systematic demonstration
of quality and suitable documentation detail. All of this is far
beyond the scope of journal paper and, even, does not constitute
the objective of the performed activity.
Rather, within the scope of the performed activity, there is
the ‘as-far-as-possible’ demonstration of quality for codes, the
development of nodalizations, the implementation of boundary
and initial conditions as available and the achievement of results
from computer calculations.
Furthermore, terms like ‘capable code’ and ‘suitable code’
have been introduced, D’Auria et al., 2005. A code is ‘capa-
ble’ when it is able to simulate the phenomena and the physical
scenarios expected during the assigned NPP accident. A code
is ‘suitable’ when a user can run the code addressing (or calcu-
lating) the expected phenomena within a reasonable time with
reasonable resources.
It should be noted that the term ‘capable’ is less binding for
a code than the term ‘qualified’ and a quantification is provided
in the mentioned document for the items ‘reasonable resources’
and ‘reasonable time’, i.e., a user effort of 10 man-months and
a computer time of one dozen hours, respectively.
983
4.1. The numerical codes
The numerical codes adopted within the present context are
those listed in the third column of Table 3. The description or
even the outline of the goals and of the structure for those codes
is beyond the scope of a journal paper. However, the area for the
application of the codes can be deduced from the second column
in the same table and from the diagrams in Figs. 4 and 5 that are
applicable for the Russian and the Western codes, respectively.
References for the source of the numerical codes can be found
in D’Auria et al., 2008a–c.
Topological subjects relevant to the deterministic safety
analysis of RBMK are identified in Figs. 4 and 5 and the corre-
spondence with the range of application of numerical codes is
established. The topological subjects include:
• Five fission product barriers: the fuel pellet, the clad, the
pressure boundary of the primary cooling system and the
confinement regions corresponding to the reactor cavity, the
(ALS) and the reactor building.
• The materials and components constituting the NPP hard-
ware: the coolant, the fuel and the moderator are examples of
‘materials’; the control rods, the pressure tube and the zones
of the confinement are examples of ‘components’.
• The technological areas (for deterministic safety analysis)
include the system thermal-hydraulics, the computational
fluid-dynamics, the structural mechanics, the neutron kinet-
ics with the cross section generation and the fission product
release and transport.
4.2. The nodalizations
Nodalizations were developed for both Western and Russian
codes by modelling the materials and components (e.g., Fig. 4),
by making reference to the technological areas (e.g., Fig. 4)
and by considering the features of codes (Figs. 4 and 5) with
the target of demonstrating codes capability and suitability, but
also to assess the integrity of the fission product barriers (e.g.,
Fig. 4).
Nodalizations are typically the result, e.g., D’Auria et al.,
1995 and D’Auria et al., 2003, of wide range brainstorming
processes whose outcome depends upon the code features, the
available computer power, the expertise of the user and the target
for the analyses.
An idea of the nodalizations developed within the context
of the present framework, can be derived from Table 5. More
details, namely including sketches for the developed nodaliza-
tions are provided by D’Auria et al., 2008a–c, where information
about the qualification level is given too.
4.3. The boundary and the initial conditions
Boundary conditions for NPP accident analyses are consti-
tuted by huge amount of data ranging from (in the present
case) the mass of water in the steam drum, to the individual
fuel bundle burn-up, to the material properties of irradiated
graphite, to the thickness and the Young module for the tank
984 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001

Fig. 4. Connection between topological subjects and codes adopted in Russia for the deterministic safety analysis of RBMK, D’Auria et al., 2005.

Fig. 5. Connection between topological subjects and codes adopted at University of Pisa for the deterministic safety analysis of RBMK, D’Auria et al., 2005.
 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001 985

Table 4
Characterization of scenarios suitable for RBMK deterministic accident analysis, D’Auria et al., 2005
Identification Codes adopted for achieving results Reasons for the selection
documented in the present paper
No.* ACRONYM explanation

A1 LOCA-PH-FIGDH: LOCA in Pressure Largest primary system break with single

Header with failure to isolate GDH failure. Challenging core cooling and the
Relap5
ECCS design
A2 LOCA-SL: LOCA originated by a break in Highest depressurization rate. Challenging
Steam Line core cooling and the ECCS design
A3 LOOP-ATWS: Loss of on Site Power with Challenging core cooling and the neutron
the ATWS condition kinetics model of the thermal-hydraulic
system codes
A4 GDH-BLOCKAGE: Full blockage of the Check of the capability of the ‘ECCS
GDH bypass’ to cool the core.
B1 GDH-BLOCKAGE-SA: Full blockage of the Cocosys and Relap5 Challenging the venting capability of the
GDH with the ‘Severe Accident’ assumption reactor cavity (part of the confinement)
of no bypass line available
B2 LOCA-PH-FIGDH: See A1 Contain and Relap5 Challenging the ALS (part of the
confinement) structural resistance (same as
A1)
B3 LOCA-SL: See A2 Contain Challenging the reactor building (part of the
confinement) venting capability (same as
A2).
C1 FC-BLOCKAGE: Full blockage of one fuel Relap5- Challenging the calculation of the local
channel 3D©/Nestle fission power generation (same as D1)
C2 GDH-BLOCKAGE: See A4 To assess and to understand the local core
response (same as A4).
C3 CR-G-WITHDRAWAL: Continued Korsar-Bars Challenging
withdrawal of a CR bank (or group). RIA
C4 CPS-LOCA: Voiding (or LOCA) of the CPS Relap5-3D©/Nestle (reac-
tiv-
D1 FC-BLOCKAGE: See C1 Relap5-Ansys Katran-U Stack Driving accident for the study. Challenging
ity
various phenomenological areas and codes
ini-
D2 FC-LOCA: Rupture of one FC Contain & Relap5 Fluent-Ansys To assess the ballooning model in the fuel
ti-
Korsar-Rapta pin mechanics area.
ated
E1 FC-BLOCKAGE: See C1 Cocosys acci-
To assess the hydrogen and the fission
Mel- dent)
products source term and transport (same as
cor sce-
D1)
E2 GDH-BLOCKAGE-SA: See B1 nario
To assess the hydrogen and the fission
for
products source term and transport in one
core
extreme conditions (same as B1)
integrity
F1 FC-BLOCKAGE: See C1 Relap5 To formulate the ICM proposal (same as D1)
* See Table 3.

that encompasses the graphite stacks, to the free volume of
the reactor cavity, to the net flow areas of the valves/openings
connecting various zones of the confinement with the environ-
ment.
Again, it is beyond the scope for a journal paper to discuss
even only the relevant boundary conditions values. However,
Figs. 1–3 and Table 1 give an idea of these values. The actual
sets of needed values for the present investigation have been
supplied in different occasions, see Soloviev and Novoselsky,
2004, and are related to the Smolensk 3 RBMK NPP with core
configuration at the date of October 16, 1996. Additional data,
used for thermal-hydraulic analyses, are related to the nomi-
nal operating conditions of Ignalina 2 NPP, see Almenas et al.,
1998 and Uspuras and Kaliatka, 2006. For both Smolensk 3
and Ignalina 2, more details can be found in D’Auria et al.,
2005.
5. The results from the analyses
All the accident scenarios listed in Tables 3 and 4 and some
of the scenarios listed in Table 2 have been analyzed into detail,
implying the consideration of several hundred of variables per
each test case. Actually, tens of time trends and suitable tables,
e.g., sequence of imposed events, sequences of resulting events,
initial condition data, etc., are documented per each scenario in
D’Auria et al., 2005.
The performed analysis typology shall be classified as ‘Best-
Estimate’, even though licensing requirements have not been
addressed, as already mentioned. Therefore, the analyses should
be considered as generic safety support studies. In this con-
nection, the importance of associating the uncertainty to the
predictions of the best-estimate codes is recognized and the
results of sample application of the CIAU method, see D’Auria
986 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001
and Giannotti, 2000, are documented in D’Auria et al., 2005.
However, considering the main objective of the concerned set
of six RBMK-devoted papers and the current state-of-the-art in
the application of uncertainty to coupled codes or to chains of
codes, the expected uncertainty in the results does not constitute
a key element for the study.
The purpose here is to present a ‘spot-overview’ of the RBMK
system performance in case of accidents addressing the class of
scenarios A–E in Table 3, taking into consideration safety fea-
tures of these reactors. Key results and conclusions from the
analyses are presented hereafter and a deeper phenomenologi-
cal investigation and characterization of system or component
performances during the considered transients can be found in
the companion papers from D’Auria et al., 2008a–e. Therefore,
the description of calculated NPP performance is not systematic
and the quality of input data is not considered.
5.1. ECCS design (more details in D’Auria et al., 2008a)
The selection of transients to address the ECCS design,
Tables 3 and 4, reflects primarily the thermal-hydraulic phe-
nomena and to a limited extent the probability of occurrence of
the assigned sequence of events, making irrelevant (within the
present context) the distinction between DBA and BDBA.
5.1.1. LOCA-PH-FIGDH
The initiating event is the full size double-ended guillotine
break for the pressure header (i.e., LOCA-PH part of the transient
identification). Furthermore, considering the ECCS port located
downstream the GDH, the failure to close of one check valve is
assumed. The function of the check valve is to prevent ECCS
injected flow to the break as better shown by D’Auria et al.,
2008a (failure to isolate one GDH, i.e., FIGDH part of the tran-
Table 5
Key features of nodalizations developed for performing RBMK deterministic safety analyses
No. System or component Code
1 Relap5
Main coolant circuit
2 Korsar
3 Relap5
Confinement system
4 Cocosys
5 Nestle
Reactor core
6 Bars
7 Part of a FC Fluent
8 FC Inlet Zone Star-cd
9 Broken Single Channel and neighboring FC Relap5
10 Individual Pressure Tube and connected Graphite Stack Ansys
11 Helios
Fuel moderator and coolant
12 MCNP
13 Graphite stack as a whole U Stack
* Number of hydraulic nodes and number of mesh points for conduction heat transfer are distinguished.
Fig. 6. LOCA-PH-FIGDH, Smolensk-3, demonstration of effectiveness of engi-
neered safety features to protect the overall core: peak cladding temperatures in
FC of different initial power fed by the non-isolated GDH.
sient identification). The capability demonstration for the ECCS
system to keep cooled the FC in the short (hundreds of seconds)
and the long (thousands seconds) term period constitutes the
target of the analysis.
In these conditions, the steam drums pressures reach 1 MPa
in about 100 s (the same even occurs much earlier in the affected
pressure header) and scram is generated in about 0.2 s. Accumu-
lators and pumps provide cooling liquid at the ECCS ports for
short term core cooling, while long term cooling is ensured by
ECCS pumps feeding water into the GDH to maintain water
level in the steam drum.
Ignalina-2 and Smolensk-3 related analyses are documented
in D’Auria et al., 2005. The predicted peak cladding temper-
atures in FC belonging to the affected GDH of Smolensk-3
are reported in Fig. 6. Reverse flow from the steam drum pre-
vents temperature excursion above the allowed thresholds. Same
Total number Target for the nodalization
of nodes
6491/52735* Thermal-hydraulic performance of the RBMK primary
829/5256* loop in case of DBA and BDBA
621/2625* Thermal-hydraulic performance of the RBMK
37 confinement in case of DBA and BDBA
29856 Three-dimensional calculation of fission
17416 power in the core
∼106 Calculation of fluid-dynamic forces acting upon fuel rods
following FC break
3.7 105 Calculation of pressure and velocity fields to assess the
appearance of steam cavitation in control valve
167/2810* Calculation of break area and position and ‘local’ hydraulic
parameters for primary system and confinement
4700 Stresses in pressure tube and in graphite stack consequent to the
creep deformation of pressure tube
14 × 4 + 30 × 4 To derive macroscopic cross section sets suitable for the use of
(zones) three-dimensional neutron kinetics codes
Not applicable
– To address the MPTR issue by the deformation method
 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001 987

(a) A special, LOOP originated signal is generated in Ignalina;

therefore, the system evolves toward a safe shut-down con-
dition following 600 s calculated transient, Fig. 8a.
(b) In the case of Smolensk-3, the calculation (D’Auria et al.,
2005) shows over-passing safety limits for fuel clad tem-
peratures, pressure tube temperatures and primary system
pressure at about 40 s, 60 s and 200 s into the transient,
respectively, see Fig. 8b related to pressure.

The pressure and temperature excursions in the case of

Smolensk-3 are caused by the mismatch between core generated
fission power and core flow-rate, the last one quantity rapidly
achieving the natural circulation value after the transient start.
Fig. 7. LOCA-SL, Smolensk-3, demonstration of effectiveness of engineered The Ignalina-2 predicted data show the effectiveness of the DAZ
safety features to protect the overall core: flow-rate at the inlet of selected FC.
system to deal with this scenario (see also Kaliatka and Uspuras,
2002 for more details).
conclusion has been achieved for the FC wall temperatures. Def-
initely, the ‘as-designed’ engineered safety features are effective
5.1.4. GDH-BLOCKAGE
for the concerned transient.
A typical GDH in RBMK is connected, downstream, with
around 40 FC and, upstream with the Pressure Header (PH).
5.1.2. LOCA-SL The connection line PH and GDH includes components like fil-
The initiating event is the double-ended guillotine break of ter, accident flow limiter (De Laval nozzle) and check valve. The
the steam line. The resulting transient scenario is challenging GDH blockage event may be caused by the obstruction of the
owing to the (high) depressurization rate and the cooling condi- filter or the breaking off of the disk of check valve and block-
tions established in the core, including the consideration of the ing the pass with that disk. The event has the potential to cause
mismatch between Main Coolant Pump (MCP) trip and scram the simultaneous overheating of 40 FC resulting in a disruptive
occurrence and (stable) ECCS coolant supply. accident for the core. The ‘passive’ design countermeasure for
The steam drum pressure reaches 1 MPa in about 300 s and the event is constituted by the so called ECCS bypass line con-
scram and MCP trip signals are generated at 13 and 26 s, respec- necting the PH with the GDH upstream inlet thus ‘bypassing’ all
tively. The ECCS pumps are switched on by an operator action the components that are prone to initiate the current failure. The
at 600 s after the transient start to maintain water level in steam
drum.
Ignalina-2 and Smolensk-3 LOCA-SL related analyses are
documented in D’Auria et al., 2005. No rod surface temperature
excursion is predicted, confirming the large ‘inertia’ associated
with the primary loop of RBMK. Selected time trends of flow-
rate at FC inlet are reported in Fig. 7; oscillations can be observed
after the time of ECCS injection that do not threaten the cooling
conditions for the fuel.

5.1.3. LOOP-ATWS
The initiating event is the sudden unavailability of the high
and low voltage electrical networks available on the site (LOOP)
with the aggravating condition that un-effective scram signals
are generated (ATWS). The resulting transient scenario is chal-
lenging for the discharge capabilities of the steam relief valves
and for the capability of the core to survive such condition.
Furthermore, a global core reactivity change is expected not
influenced by the individual channel dynamics: this makes pos-
sible the application of point neutron kinetics with suitable
feedback coefficients. Considering the redundancy of the scram
systems in the RBMK NPP, the transient shall be classified as
BDBA.
Analyses have been performed in relation to Ignalina-2 and
Smolensk-3. Due to the presence in the Ignalina-2 NPP of the Fig. 8. LOOP-ATWS: (a) Ignalina-2 (with DAZ) and (b) Smolensk-3, demon-
special back-up scram system called DAZ, the predicted tran- stration of effectiveness of engineered safety features to protect the overall core:
sient evolution is different for the two NPP units: pressure in various zones of the primary loop.
988 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001
Fig. 9. GDH-BLOCKAGE: (a) Ignalina-2 (assuming scram generated by low
flow in five of six FC of the affected GDH) and (b) Smolensk-3 (scram generated
following FC rupture), demonstration of effectiveness of engineered safety fea-
tures to protect the overall core: rod surface temperatures in the highest thermally
loaded FC.
flow in the line occurs due to the increased pressure differential
that establishes between PH and GDH following the blockage
event. The purpose of the calculation is to prove that the ECCS
bypass line flow is enough to cool the affected FC.
Calculations have been carried out in two ‘key-conditions’:
(1) Ignalina-2: reactor scram is generated by flow decrease in
five of the six instrumented FC of the affected (any) GDH; (2)
Smolensk-3: reactor scram signal is not generated.
In the former case, scram signal is generated at about 3 s
after the event, dry-out occurs, but the ECCS bypass line flow is
enough for the quench occurrence and the overall system recov-
ery without further damages is possible. In the latter case, the
ECCS line bypass flow is not enough (due to the high fuel power)
to prevent disruptive rod surface temperature excursions and FC
failures; in this case scram is generated after FC rupture at about
170 s due to high pressure in reactor cavity. Results are given in
Fig. 9 for the two situations.
Different calculations have been performed for Ignalina-2
and Smolensk-3 cases assuming, respectively, different individ-
ual GDH affected by the event and a different grouping of FC
fed by the affected GDH based upon the initial power (D’Auria
et al., 2005). In the case of Ignalina-2 the documented result is
not affected by the GDH selection. In the case of Smolensk-3,
the number of failed FC is affected by the noding. However,
the evidence was found that the high power channel(s), i.e.,
typically 1–3 FC, fail before the others and the subsequent
‘reactor-cavity-generated’ scram comes early enough to pre-
vent the failure of the remaining FC connected with the affected
GDH, thus, avoiding or limiting the relevance of the MPTR
issue.
5.2. Confinement design (more details in D’Auria et al.,
2008b)
The confinement of RBMK is constituted by a multiple-
building, multi-compartment, multiple-functions complex sys-
tem, as already mentioned. Therefore, the deterministic accident
analysis should reflect the complexity by a wide range of
analyses. The scenarios B1–B3 in Tables 3 and 4 might
not cover the overall expected ranges of safety relevant
parameter within the DBA domain. However, design pressure
in the confinement regions Reactor Cavity (RC), ALS and
Turbine Hall is challenged during the three scenarios, respec-
tively.
5.2.1. GDH-BLOCKAGE-SA
The transient is originated by the same event as the GDH-
BLOCKAGE discussed in the previous section (A4 in Table 3).
The difference is the unavailability of the ECCS bypass line.
The event is classified as Severe Accident (SA in the acronym)
because the ECCS bypass lines constitute installed design fea-
tures for RBMK.
The pressurization of the RC is a consequence of the number
of broken FC and is affected by the combined incondensable
gas and two-phase mixture venting toward ALS and toward the
environment. The evaluation of pressure thresholds inside RC
for environment venting and for top RC plate lifting may be seen
as key target for the analysis. The number of calculated broken
FC following such initiating event is affected (at least) by:
• The power of individual FC fed by the affected GDH and
the GDH layout, i.e., ‘physical’ boundary conditions (several
GDH exist in one NPP with several individual FC powers and
power distributions during the core life).
• The (unavoidable) FC grouping when setting up the input
deck, i.e., ‘code-user’ related choice.
• The assumption about FC rupture, to be partly classified as
analyst assumption.
• The assumption about scram occurrence as discussed in Sec-
tion 5.1 for transient A4.
Following the break of one or more FC, the remaining (still
intact) FC is cooled by flow reversal that establishes from the
steam drum to the break(s) crossing the affected GDH. In other
words, more FC is broken and better cooling conditions occur
in the intact FC of the same GDH.
A synthesis result assuming typical best-estimate conditions
for the bullet items above is given in Fig. 10. Namely, 24
over more than 40 FC are predicted to fail. This brings the
results for maximum value of the RC pressure close to the
set point for venting to environment (∼314 kPa) and below
the set-point for plate lifting (∼400 kPa). The up-lift of the
upper reactor plate constitutes a ‘cliff-edge-event’ for the safety
analysis; the acceptability of the safety margin calculated for
 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001 989

Fig. 10. GDH-BLOCKAGE-SA, Smolensk-3, demonstration of effectiveness

of the confinement barrier: pressure in the RC and in the ALS, following a 24
FC break occurrence.

this event, typically, is not a target for the present analy-

sis.
In connection with the above result it shall be noted that the
number of broken FC that cause the top plate lift at an assigned
RC pressure set-point, is affected by the time when the tube
rupture breaking event occurs. If the FC break occurs at time
zero, i.e., during nominal NPP operation and is caused by a
material defect, much more energy is discharged through the
Fig. 11. LOCA-PH-FIGDH: (a) Ignalina-2 and (b) Smolensk-3, demonstration
break related to the condition when FC break occur after drying of effectiveness of the confinement barrier: pressure in the ALS following the
out of the channel. In the former case a lower number of broken maximum credible accident.
FC is sufficient to lift the top plate.

5.3. Three-dimensional core neutron kinetics performance

5.2.2. LOCA-PH-FIGDH
The challenge put by this event to the acceptable pressure
threshold in the ALS is evident from the scenario description in
Section 5.1.
Ignalina-2 and Smolensk-3 confinement related analyses are
documented in D’Auria et al., 2005. The predicted peak pres-
sures in various compartments of the ALS can be deduced from
Fig. 11. The maximum pressure values are below the acceptable
threshold that is different for the two NPP units, i.e., 300 kPa and
440 kPa for Ignalina-2 and Smolensk-3, respectively (Tables 9
and 10 of IAEA, 2005).
(more details in D’Auria et al., 2008c)
The dimensions of the core and the material used for cool-
ing and moderation impose the need of three-dimensional (3D)
analyses in RBMK, as already mentioned. The dimensions of
the core and the lack of symmetry definitely pose a challenge
to the power of available computers. The scenarios C1–C4 in
Tables 3 and 4 give an idea of the system response following
typical DBA initiated at the NPP nominal operating conditions
(i.e., no results provided for start-up or low power conditions
connected with the Chernobyl-4 event of 1986).

5.2.3. LOCA-SL
The location of the break is relevant for the consequences
in terms of pressure load upon the building that is crossed by
the concerned broken line. A sample analysis result is given
in Fig. 12, related to Ignalina-2 NPP with break located in the
Turbine Hall. The licensing needed demonstration that the worst
location is chosen for the break, typically, is not a target for the
present analysis.
An excess pressure of 1 kPa is sufficient to cause the rupture
of windows located in the upper zone of the region. The anal-
ysis, conducted over a period of 104 s with only 30 s reported
Fig. 12. LOCA-SL, Ignalina-2, demonstration of effectiveness of the confine-
in Fig. 12, shows that venting though the windows prevents any ment barrier: pressure in the Turbine Hall following a guillotine break of the
harm for the structural integrity of the building. steam line in the region.
990 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001

Fig. 13. FC-BLOCKAGE, Smolensk-3, demonstration of predictability of local

performance and of ‘neutron kinetics inertia’ embedded into the core design:
power in the affected FC and in neighbouring channels after blockage. Fig. 14. GDH-BLOCKAGE, Smolensk-3, demonstration of predictability of
local performance and of ‘neutron kinetics inertia’ embedded into the core
design: overall core power after blockage.
5.3.1. FC-BLOCKAGE
The key issue for the FC-BLOCKAGE scenario from the
poses for the calculation are the check of the possibility to detect
point of view of neutron kinetics is the prediction of the affected
the initiating failure by the available neutron detectors and the
FC power (see also the end of Chapter 3 and Section 5.4).
demonstration of the thermal-hydraulic stability performance of
Channel voiding caused by evaporation introduces positive local
the FC belonging to the blocked GDH.
reactivity affected by burn-up and fuel composition, operating
A selected key result, addressing one of the added purposes
conditions (e.g., flow-to-power ratio) and FC location in the core.
for the analysis, item (d) above, is given in Fig. 14. It is shown
The same voiding unavoidably causes dry-out and average fuel
that the overall core power change, reduction in this case, is
temperature increase with consequent local negative reactivity
detectable a few seconds after the event by the current instru-
source by the Doppler effect.
mentation.
The timing of events like the start of significant metal water
reaction, the deformation of the fuel rods and the rod bundle, the
UO2 overheating and the rupture of the pressure tube, including 5.3.3. CR-G-WITHDRAWAL
the rupture area and location, as well as the possibility ‘to con- A spurious signal is assumed at the origin of the event denom-
trol’ the event by the ICM (see also Section 5.6), are affected by inated withdrawal of a group of control rods. Four rods are
the prediction of the transient fission power after the blockage. typically part of the group. Locations of the rods in the core
Furthermore, the blockage of one FC causes a flow perturbation and withdrawal speed (0.4 m/s) are key input parameters for the
in the remaining FC fed by the same GDH and a neutron kinet- analysis. The core power change rate and the time for the possi-
ics perturbation in the neighbouring FC. This requires a detailed ble achievement of set-point for scram, fixed at 110% of nominal
noding scheme around the affected FC. power, are the main output parameters.
The key results of a calculation where the blockage time is The key results are given in Fig. 15; it takes more than 5 s for
assumed at 0 s are given in Fig. 13: the fission power in the a 10% power increase when four CR are extracted. This can be
blocked channel is reported together with the power in selected
neighbouring FC (whose identification can be found in D’Auria
et al., 2008c). It can be seen that the power in the blocked FC
decreases for an amount of 10–15% following the event, due
to the fact that Doppler effect (negative reactivity insertion)
is larger than the positive reactivity insertion caused by void-
ing. The fission power generated in neighbouring FC remains
practically constant in a few tens of seconds after the event.

5.3.2. GDH-BLOCKAGE
The GDH-BLOCKAGE event, from the point of view of the
3D neutron kinetics, involves the consideration of aspects sim-
ilar to the FC-BLOCKAGE event, plus the following ones: (a)
the concerned FC are typically disposed along a chord of the
core, thus inducing a power perturbation to the overall core; (b)
the ECCS bypass line ensures a ‘partial’ cooling to the affected Fig. 15. CR-G-WITHDRAWAL, Smolensk-3, demonstration of predictability
FC (see also Section 5.1); (c) the number of ‘neighbouring’ of local performance and of ‘neutron kinetics inertia’ embedded into the core
channels is much larger than in the previous case; (d) added pur- design: overall core power following the withdrawal event.
 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001
Fig. 16. CPS-LOCA, Smolensk-3, demonstration of predictability of local per-
formance and of ‘neutron kinetics inertia’ embedded into the core design: overall
core power following the liquid draining event.
seen as a proof of the ‘neutron kinetic inertia’ for RBMK core
when a comparison is made with similar event in other reactor
types (see also Chapter 6 below).
5.3.4. CPS-LOCA
Three types of CR are part of the design, i.e., manual,
shortened and safety CR and can be inserted from the bottom
(shortened CR) or from the top (manual and safety CR). Their
overall number is around 200. Each rod is located in one chan-
nel that is embedded, like the FC, into the graphite bricks. The
cooling of CR channels is needed to prevent CR overheating
due to neutron captures and gamma heating and is achieved by a
nearly atmospheric pressure sub-cooled water circulation across
the channels of the so-called CPS cooling system. The draining
of the CPS cooling system introduces a positive reactivity whose
evaluation constitutes the target for the present analysis. The
asymmetric layout of CPS channels requires a detailed radial
(cross-section) noding of the core.
The results of the analysis, Fig. 16, show that around 25 s
are needed to achieve the set-point for scram (core power equal
110% of initial power) following the complete CPS draining
event that is achieved in about 45 s.
5.4. Pressure tube rupture and the MPTR (more details in
D’Auria et al., 2008d)
The presence of more than 1600 pressure tubes and related
connecting pipelines in the core of the RBMK, makes the
system prone to events like tube rupture (FC-LOCA in
Table 3) or channel blockage (FC-BLOCKAGE in Table 3).
Both the events, as analyzed within the present context,
imply breaking of the pressure barrier inside the reactor
cavity with consequent fuel release and constitute potential
precursors for MPTR. The FC-BLOCKAGE and the FC-
LOCA scenarios shall be distinguished for the following
reasons:
991
• FC-LOCA: The accident is typically originated by a micro
defect that may suddenly deteriorate the mechanical strength
of the pressure tube causing the failure. Following the break
occurrence, the fuel bundle is cooled by liquid coming from
the top (steam drum) and the bottom (GDH) and suitable cool-
ing conditions are kept. The scram signal is generated few
seconds after the event. Fuel rod damages may occur due to
ballooning (not from the predicted scenario, see below), but
hydraulic forces generated by the high fluid velocity at the
break may cause damage of the insofar intact fuel and con-
sequent radioactivity transport in the reactor cavity. Energy
release from the break is larger than in the FC-BLOCKAGE
case and (slightly) higher hydraulic loads acting upon neigh-
bouring channels can be expected. The event is classified as
DBA in Table 2 (row 5.5). However, due to the low probabil-
ity of pressure tube failure caused by a material defect, the
event could be classified as BDBA, see also Chapter 6.
• FC-BLOCKAGE (see also Chapter 3 and Section 5.3): The
accident originates by a loss of flow at the channel inlet (GDH
side). The initiating may be detected by the ‘zero-signal’ of the
channel flow meter; however, there is no automatic response.
Thus, because of the continued generation of fission power,
the event causes fuel overheating, clad failure due to col-
lapse and pressure tube failure due to creep. In this case, as
a difference from the previous case, scram is generated at
around 1 min after the initiating event and hydraulic loads
push damaged fuel in contact with graphite.
5.4.1. FC-LOCA
The thermal-hydraulic system performance, with main refer-
ence to the reactor cavity and the fuel bundle, can be deduced
from Fig. 17. The accident is easily detectable from the RC
pressure increase (Fig. 17a) and the scram predicted in about
2 s, connected with the bottom-up and top-down simultaneous
cooling, prevents rod surface temperature excursions (Fig. 17b).
The analysis carried out by Fluent (CFD code) and Ansys
(structural mechanics code) using boundary and initial con-
ditions obtained from the above depicted thermal-hydraulic
scenario brings to the results summarized in Fig. 18; about one
third of fuel bundle rods are predicted to fail owing to fluid-
discharging loads.
A conservative study (assuming delayed scram signal) per-
formed by Korsar–Rapta, brings to the results in Fig. 19. Pin
damage is predicted also due to thermal loads and balloon-
ing is the mechanism for clad failure. Hydraulic loads must
also be considered in this case to evaluate the overall bundle
damage.
5.4.2. FC-BLOCKAGE
The prediction of FC inlet mass flow-rate (assumed to achieve
the zero value in about 1 s), of coolant mass inventory in the
channel (only superheated steam is expected in less than 10 s),
of fission power in the voided channel (e.g., Fig. 13) and of
rod surface temperatures, must be combined with the predic-
tion of thermal power exchange between the pressure tube and
the graphite blocks. This is needed to calculate the pressure tube
temperature and the ultimate strength before creep phenomenon,
992 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001

Fig. 17. FC-LOCA: (a) Ignalina-2 (consequences in the reactor cavity) and (b)
Smolensk-3 (consequences for the fuel); thermal-hydraulic system performance:
(a) pressure in the various RC zones; (b) rod surface temperatures at different Fig. 19. FC-LOCA, Smolensk-3: evaluation of fuel pin performance in conser-
elevations in the broken FC. vative assumptions (time of FC rupture is 500 s for the reported analysis): (a)
rod surface temperature; (b) radius of fuel pin.
the interaction with graphite blocks with subsequent fragile fail-
ure of one or two graphite blocks and the break opening along
- An independent finite element analysis by Ansys code is used
the pressure tube axis. Selected steps and related results from the
to support the results documented in the item above; significant
process leading to the calculation of the rupture in the pressure
results are provided in Fig. 22.
tube are:
The FC-BLOCKAGE is the key-precursor for the MPTR
- The pressure tube temperatures at different elevations are
considered within the present framework. The connection
given in Fig. 20 related to a 92% inlet FC blockage.
between the scenario outlined above and the MPTR issue
- The calculation of the conditions for the occurrence of the
is constituted by the pressure differential generated between
rupture is based upon an experimentally generated crite-
two opposite faces of the neighbouring graphite stack
rion implemented in the thermal-hydraulic code calculation,
Fig. 21, when the ‘trajectory’ calculated by the thermal-
hydraulic code in the plane temperature versus pressure
differential across the tube intersects the rupture criterion, the
rupture occurs. The computer program allows the evaluation
of the area and of the location of the break along the axis.

Fig. 18. FC-LOCA, Smolensk-3: evaluation by a CFD code of hydraulic loads Fig. 20. FC-BLOCKAGE, Smolensk-3: characterization of the sequence of
acting upon the fuel rods following pressure tube rupture: about one third of fuel events for the scenario: pressure tube surface temperature at different elevations
bundle rods are predicted to fail owing to hydraulic loads. following a 92% FC inlet blockage.
 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001 993

Fig. 21. FC-BLOCKAGE, Smolensk-3: characterization of the sequence of events for the scenario; trajectory in the wall temperature vs. pressure differential across
the wall to determine the timing and the location of the break following a 92% FC inlet blockage.

and by deformation of the associated FC, as shown in
Fig. 23.
A more detailed discussion about the MPTR issue can be
found in the companion paper by D’Auria et al., 2008d. One
reference result is illustrated in Fig. 24 and significant associated
conclusions are:
- A limited number of FC is prone to cause MPTR after the
break (i.e., comes to plasticity).

Fig. 22. FC-BLOCKAGE, Smolensk-3: characterization of the sequence of Fig. 23. FC-BLOCKAGE, Smolensk-3, addressing the MPTR issue: (a) pres-
events for the scenario: (a) spatial distribution of principal stress before the break sure acting at an assigned elevation in different gaps between graphite stacks
occurrence; (b) maximum principal stress as a function of time with thresholds after the FC break occurrence; (b) axial distribution of pressure tube deformation
related to different values of fluence. for a neighbouring FC.
994 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001
Fig. 24. FC-BLOCKAGE, Smolensk-3, addressing the MPTR issue: identification of FC that in case of rupture is prone to cause MPTR.
- The lack of symmetry of the RBMK core imposes the one-by-
one consideration of FC to evaluate the related MPTR risk.
- The steel tank surrounding the graphite stack has an important
role for taking the load coming from the deformed columns;
this is accomplished also by introducing a constraint to the
maximum deformation.
- The effect of pressure wave is added to a static calculation
and plasticity analysis for neighbouring FC has not been per-
formed.
5.5. Hydrogen and fission products transport (more details
in D’Auria et al., 2005)
The production and the transport of hydrogen and fission
products following accident in RBMK do not differ from simi-
lar processes expected in different types of water cooled reactors.
Hydrogen is generated by metal-water reaction at high temper-
ature where metal also includes the pressure tube walls in the
case of RBMK. Radioactive products are generated by the fis-
sion inside UO2 pellets with well established accumulation and
release mechanisms in nominal and accidental conditions.
The complex geometry of the third generation of RBMK sys-
tem is relevant and has been modelled for the prediction of the
deposition of fission products and for the hydrogen accumula-
tion, as well as the various flow paths connecting the core sources
to the environment. Releases for both the FC-BLOCKAGE and
the GDH-BLOCKAGE-SA (Tables 3 and 4) have been calcu-
lated according to the sketch in Fig. 25.
5.5.1. FC-BLOCKAGE and GDH-BLOCKAGE-SA
Hydrogen and fission product generation and transport cal-
culations have been performed for both accident scenarios.
Thermal-hydraulic input data for the analysis, as well as con-
finement model derive from the calculations already discussed in
Sections 5.2–5.4. However, special input decks have been devel-
oped for Cocosys and Melcor to perform the analyses, making
reference to the sketch in Fig. 25.
Considering the number of broken FC in the case of the GDH-
BLOCKAGE-SA, i.e., 24 broken FC after the event, and the fact
that no cliff-edge phenomenon is triggered, only the results for
the FC-BLOCKAGE are shown here. The results obtained for
the GDH-BLOCKAGE are proportional to those shown here
(i.e., releases and masses multiplied by 24) with minor time
shift due to the non-simultaneous occurrence of the FC breaking
event.
Sample results are given in Figs. 26 and 27 and are related to
the transport and to the release to atmosphere of xenon and to the
accumulation of hydrogen in various zones of the confinement.
Key conclusions in the case of the FC-BLOCKAGE scenario
(the GDH-BLOCKAGE should be intended as a BDBA) are:
• The releases to the environment are much less than the licens-
ing threshold (Section 2.3).
• The hydrogen concentration in any part of the confinement is
much less than the acceptability limit (Section 2.3).
 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001 995

Fig. 25. FC-BLOCKAGE and GDH-BLOCKAGE-SA, Smolensk-3, evaluation of fission product and hydrogen release to the environment: sketch of the system and
flow paths for the releases.

5.6. The ICM proposal (more details in D’Auria et al.,
2008e)
The possibility of propagation of one individual FC rupture
to the MPTR has been shown as almost non-existent from the
present study, so that the overall contribution of the MPTR to
the probability of overall core destruction should result as low as
10−6 reactor/year, even though no PSA study has been formally
completed. On the other hand, the rupture of one individual
FC implies the disruption of fuel and the occurrence of fission

Fig. 26. FC-BLOCKAGE, Smolensk-3, evaluation of fission product and hydrogen release to the environment: xenon mass release.
996 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001

product pollution at least in some parts of the RBMK confine-

ment with needs for repair and decontamination, including stop
of electricity production and doses to personnel. Furthermore,
owing to the relatively large probability (∼10−2 reactor/year,
basically due to the flow blockage occurrence), the single FC
rupture shall be classified as a DBA for the RBMK.
Thus, damaged fuel in case of DBA, even though in small
quantities, is predicted to bypass the pressure barrier constituted
by the primary circulation loop (see also Chapter 6), creating
a difference in safety performance between RBMK and other
water cooled reactors.
Therefore, the proposal has been made to develop the ICM
system capable to prevent the pressure tube rupture following
the FC-BLOCKAGE type of event. The system has the potential
to stop the accident progressions in case of initiating events like
local power increase (e.g., withdrawal of control rod), lack of
cooling even during reactor shutdown, erroneous fuel bundle
placement inside the FC, or mismatch between produced power
and flow-rate in any individual FC.
The proposed ICM system triggers a devoted scram signal
following the simultaneous occurrences of low flow and high
coolant temperature at FC inlet and outlet, respectively. The
implementation of the system requires the introduction of ther-
mocouples (tentatively three for redundancy purposes) at each
FC outlet and the combined use of signals from thermocou-
ples and flow-rate instruments at the FC inlet minimizing the Fig. 28. ICM proposal: (a) early detectability of the FC-BLOCKAGE event by
measuring coolant temperature at the top of the FC; (b) predicted rod surface
probability of spurious scram signals. temperatures with and without ICM originated scram and without any ECCS
Results obtained from a thermal-hydraulic study show the action.
validity of the ICM proposal. The capability of preventing the
pressure tube rupture following the FC-BLOCKAGE event has on safety aspects, between a cottage and a skyscraper, or
been demonstrated for different FC initial conditions, as sum- between an airplane, a helicopter and a space-shuttle. Further-
marized in Fig. 28. The profitable results convince to make more, an assigned safety deficiency may be (legally) acceptable
feasibility study of ICM taking into account scale of the system if proper quality is established for its characterization includ-
and structure performances of operating RBMK. ing the qualified evaluation of related safety margins, or may
not be accepted if suitable quality background is not ensured,
6. Accident analysis topics relevant for water cooled including construction, maintenance and qualification level of
reactors and RBMK safety technologies personnel.
Notwithstanding the above, an attempt is made hereafter to
The safety comparison between two or more different nuclear select significant topics relevant for safety technologies of exist-
reactors may be seen as equivalent to the comparison, based ing reactors, mostly connected with the deterministic analysis.
The scope and the consideration of the topics are to establish a
bridge between safety technologies that were developed without
(or with limited) connections. An added objective for the anal-
ysis can be identified as ‘narrowing-the-gap’ between existing
safety technologies.
The performed analysis is necessarily qualitative, even
though some numerical data are taken into account. The
outcomes from the analysis should be seen as an integra-
tion and a support to the discussion provided in Section
2.2. A list of 13 topics is given in Table 6, establishing a
(qualitative) parallel between RBMK and other water cooled
reactors. Additional comments for each topic are provided
below.
The list is necessarily incomplete and is biased by the exper-
tise of the authors and by the RBMK deterministic safety
Fig. 27. FC-BLOCKAGE, Smolensk-3, evaluation of fission product and hydro- analyses performed within the present context. Furthermore,
gen release to the environment: hydrogen mass release. there is no logical order for the topics that should be seen
Table 6
Selected topics for establishing a bridge between safety technology of RBMK and other water cooled nuclear reactors
No. Safety relevant topic
1 Containment vs. confinement
2 Positive reactivity insertion after
LOCA
3 Probability of pressure tube break
4 Ejection of a fuel bundle
5 MPTR
6 Breaking by fuel of the pressure
barrier in DBA conditions
7 Molten fuel retention
8 Mixing in large components
9 Length of pressurized pipelines
10 Control rod design and operation
11 The PTS issue in PWR and VVER
12 The steam line valve closure in BWR
13 Inherent long term core cooling
RBMK
Complex ‘Confinement’
Positive void coefficient
>1500 pressure tubes
Theoretically possible,
creating a ‘confinement’
bypass
Negligible probability of the
event should be shown
This is foreseen/allowed in
current safety technology,
e.g., FC-BLOCKAGE
Possible following individual
FC damage
No safety relevance
∼100 km, comparable with
CANDU
Redundant and independent
systems at low pressure
Not applicable
Limited effect
Possible via ‘atmospheric’
pressure CPS cooling system
Water cooled reactors
Reference ‘Containment’ in the latest generation of
PWR
Negative void coefficient for the majority of core
life. Positive void accepted in CANDU reactors
RBMK equivalent situation in CANDU
The ejection of a control rod out of the vessel is
possible in some old units.
Non existing issue except for CANDU, where
negligible probability of occurrence is shown
Not acceptable in current safety technology
Difficult to calculate. Mass of molten material
comparable with the core mass
Mixing in lower plenum affects RIA evolutions
caused by boron and low temperature fluid
∼100 m in BWR. ∼300 km in PWR including SG
tubes
The common-cause failure difficult to exclude.
Sophisticate analyses needed with controversial
results
High power peak expected. Potential rod failure
occurrence
Availability of ‘atmospheric’ pressure water useful
for external vessel cooling
Notes
A proper application of the ‘defence-in-depth’
concept is at the basis of the design of the RBMK
confinement system, including a high level of core
(radioactivity) segregation.
F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001
Void coefficient unavoidably counter-balanced by
the negative Doppler effect. Furthermore, low
depressurization rate and void increase rate in
RBMK
Recent evidence by Lee et al. (2006), shows
negligible probability of occurrence
Not investigated within the present framework.
The present study provides the basis to demonstrate
low probability of the event
Fuel release into reactor cavity does not lead to
exceeding of radiation criteria for staff and
population
A preliminary analysis shows that the molten mass
of one FC can be cooled at the bottom connection of
the same FC with the massive core support plate
Example of critical issue for accident analysis in
water cooled reactors not applicable for RBMK
The topic cannot be seen as ‘distinctive’ for RBMK
Potential advantage in RBMK safety technology
Example of critical issue for accident analysis in
water cooled reactors not applicable for RBMK
The presence of steam drum largely mitigates the
consequence of this event in RBMK
Feature envisaged for ‘Generation IV’
997
998 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001
as randomly selected from a ‘virtual basket’ including many
more.
6.1. Confinement versus containment
In significant portions of the nuclear reactor safety literature
the word ‘containment’ is used to indicate a leak-tight region
(full pressure, or pressure suppression) with ultimate design
pressure around 0.6 MPa and daily leakage around 1% of the vol-
ume; a number of other requirements is at the basis of the design
of containment in the areas of seismology, plane crash, steam
explosions, direct heating, internal missiles, etc. However, there
is the tendency to classify as ‘confinement’ or, ‘no-containment
at all’ whatever does not satisfy the above two criteria. This is
the situation for RBMK. The consideration of the level of seg-
regation of the core and of the related radioactive materials in
case of normal operation and of accident (Section 2.2) and the
results documented above (Figs. 10–12 and Figs. 26–27, see
also D’Auria et al., 2008b) suggest to re-evaluate the current
(negative) judgement for containment in RBMK nuclear power
plants.
6.2. Positive reactivity insertion after LOCA
The use of boron for reactivity control makes the PWR prone
to positive reactivity coefficients for a few days at the beginning
of the fuel cycle (largely affected by the individual NPP fuel
management). In the case of CANDU a positive void coefficient
is accepted within the licensing process, even though the power
reactivity coefficient is negative in all expected conditions.
FC voiding in RBMK caused by positive un-balance between
fission power and inlet flow-rate or by pressure decrease is asso-
ciated with fuel temperature increase that, typically brings to
the system more negative reactivity (in absolute terms) than the
positive voiding reactivity with a comparable time response. Fur-
thermore, the presence of large steam drums in RBMK makes
slower the depressurization rate (MPa/s) in the reference LOCA-
DBA than in the same scenario for other water cooled reactors.
Thus, the important issue (i.e., positive void coefficient) for
RBMK safety could be declassified for high (nominal) power
operation based upon systematic analyses including the consid-
eration of results by D’Auria et al., 2008c.
6.3. Probability of pressure tube break
The large number of pressurized channels (>1500) in the core
of the RBMK is at the origin of the request for the study of the
FC-LOCA, e.g., Section 5.4. Experiments see Lee et al., 2006,
performed with tubes having a similar geometry as FC (even
though different material) and comparable quality technology
for construction ends up with diagrams where probability of
failure is reported versus the ratio actual stress/ultimate stress.
Assuming these data valid for the operational conditions of
RBMK FC, including the consideration of radiation damage,
brings to the conclusion that the probability of failure per year
originated by a defect in the material, even for 1500 tubes with
total RBMK length, is below detectable limits (i.e., <10−6 ).
Based on this result, the requirement to consider FC-LOCA as
a DBA could be relaxed in RBMK.
6.4. Ejection of a fuel bundle
The ejection of a fuel bundle constitutes a possible event caus-
ing the bypass of the confinement for the radioactivity (although
associated to one fuel bundle) and is classified as BDBA in
IAEA, 2005. The ejection is caused by the pressure. The vessel
equipped water cooled reactors are immune from such event,
even though in some old units the ejection of the control rod
may cause a similar damage to the confinement as the fuel
bundle ejection in RBMK, but the radioactivity release to the
environment is negligible.
This constitutes an example of one (relevant BDBA) event
not investigated within the framework of the current set of six
papers.
6.5. The MPTR
The break of one FC is currently part of the DBA of the
RBMK. The problem, so far, has been the demonstration that
this event does not ‘migrate’ into the catastrophic rupture of a
considerable number of FC owing to a domino effect and to
the consequent failure of the confinement barrier. The present
study, more detail by D’Auria et al., 2008d, provides the basis
to exclude (or, more rigorously, to decrease) the value estimated
of the probability of occurrence of the MPTR within the RBMK
safety technology.
6.6. Breaking by fuel of the pressure barrier in DBA
conditions
Any event occurring in DBA conditions shall be part of the
ECCS design. It is common practice for Western type NPP that
ECCS prevents severe core damage even though limited clad oxi-
dation and local fuel damage (clad ruptures) cannot be avoided.
In no DBA situation molten or damaged fuel is allowed to escape
the safety barrier constituted by the primary pressure boundary.
In the case of RBMK, the FC-BLOCKAGE (and/or the FC-
LOCA) brings to spreading of (limited amount of) damaged fuel
into the reactor cavity, thus, introducing a conceptual difference
between acceptable safety thresholds in RBMK and other types
of water cooled reactors. This difference should be seen consid-
ering (in the case of RBMK) the ‘higher level of segregation’
of the core as discussed above. Nevertheless, it constitutes a
remarkable difference in safety evaluations.
6.7. Molten fuel retention
A key problem when investigating severe accident (BDBA)
conditions in Western type reactors is constituted by the demon-
stration that molten fuel is kept within the vessel or can be kept
coolable inside the containment; in the considered conditions
the amount of damaged fuel mass to be taken into account is not
different from the total core mass. In the case of RBMK, a pre-
liminary study, D’Auria et al., 2005, shows that the molten mass
 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001
of individually damaged channels might be cooled by conduc-
tion heat transfer in the bottom area of the reactor cavity, above
the core support plate, thus constituting a design passive feature
and a potential advantage of RBMK not available in other reactor
types (with the possible noticeable exception of CANDU).
It shall be emphasized that the molten fuel retention issue
has nothing to do with the domain of investigation consid-
ered within the present study, rather it constitutes a by-product
from the application of the Melcor code (above mentioned
report).
6.8. Mixing in large components
The evaluation of mixing and of the interactions between
the steam and the liquid phases in large components with
main reference to lower plenum and upper plenum of pres-
sure vessel, primarily in BWR and PWR, remains a problematic
issue in current safety analyses. Relevant situations are: (a)
arrival in lower plenum of a cold or of a deborated liquid
plug with the potential to trigger local power excursions in
selected core regions; (b) mixing and condensation in upper
plenum following ECCS injection that may create zones in the
core with inadequate cooling; (c) interaction of liquid streams
in lower plenum during nominal operation with creation of
vortices threatening the integrity of fuel rods due to vibra-
tions.
The topic shall be seen as an example of accepted critical
and non-resolved (at least not fully resolved) issue in water
cooled reactor safety technology not existing in RBMK safety
technology
6.9. Length of pressurized pipelines
The overall length of pressurized pipelines in RBMK (pas-
sage of primary coolant) is estimated as close to 100 km. This
value is comparable with the value applicable to CANDU reac-
tors. In case of PWR and BWR the value is of the order of 100 m.
However, in the case of PWR if the tubes of the steam generators
are considered, the length of pressurized pipelines results to be
close to 300 km.
Definitely, the length of pressurized pipelines cannot be taken
as a ‘distinctive’ topic in RBMK safety technology.
6.10. Control rod design and operation
The concepts of common-mode failure and
design/installation independence are difficult to demon-
strate for the majority of PWR and BWR type NPP with a few
noticeable exceptions. The rod operation into a high pressure
environment require special care in the design.
The RBMK Control Rods (CR) can be distinguished in
different category having independent design, also entering
the core from top and from the bottom. Therefore, the
topic can be taken as an example of potential (i.e., requir-
ing an investigation with proper indicators) advantage of the
RBMK safety technology. The consequences of two equiva-
lent accident scenarios can be compared; in the RBMK the
999
withdrawal of a CR group causes an increase of 10% nomi-
nal core power in about 10 s; in typical PWR conditions the
same values in case of a single CR ejection are 30% and
1 s.
6.11. The pressurized thermal shock (PTS) issue in PWR
and VVER
Following the introduction of relatively cold water in the
pressure vessel, e.g., consequence of ECCS injection or of
anomalous quick cooling in steam generator, a thermal shock
may occur in the walls of the pressure vessel that may cause
propagation of pre-existent non detectable defects primarily in
situation when the vessel is irradiated (welding at the elevation of
the core are specially vulnerable). The topic needs complex com-
putational resources and brings to controversial results owing
to the uncertainty of important boundary and initial conditions
(form and position of the initial flaw, local fluid temperature and
neutron fluence, role of the vessel clad, etc.).
The PTS constitutes an example of critical issue for acci-
dent analysis in water cooled reactors (PWR and VVER) not
applicable for RBMK.
6.12. The steam line valve closure event in BWR
The closure of the steam line in BWR causes pressurization
and void collapse in the core with consequent reactivity inser-
tion and rapid power increase (timing of the order of 0.1 s) as
discussed by Bousbia-Salah et al., 2004, though this does not
imply that the occurrence is the precursor for a safety relevant
event.
The presence of steam drum largely mitigates the con-
sequence of this event in RBMK, thus constituting another
example of critical issue for accident analysis in water cooled
reactors (BWR) not applicable for RBMK.
6.13. The inherent long term core cooling
The unavailability of electric power source on the site of
any nuclear power plant including emergency diesel generators
implies melting of the core in 2–5 h. The special feature of the
RBMK allows the use of the CPS cooling circuit (that crosses
the active core region); atmospheric pressure water, basically
not requiring a ‘strong’ power source can circulate across this
circuit.
In other terms, following the ‘complete’ (on-site and off-site)
station blackout event, ambient water can be used in PWR and
BWR to keep cool the vessel from the exterior, not preventing
core melt. In the case of RBMK, the water can be used for circu-
lation inside the CPS cooling system and might prevent melting
of the fuel. Analyses have been done in Russia, e.g., Kramerov
and Michailov, 2000, see also Michailov and Moskalev, 2006,
and a rough estimation has been made by Galassi, 2006.
Therefore, the inherent long term core cooling capability
that is requested for the ‘Generation IV’ reactors is in principle
available in existing RBMK plants.
1000 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001
7. Conclusions
The results of an investigation in the area of deterministic
accident analysis for RBMK are summarized in the present
paper and are supported by additional details provided in the
companion papers by D’Auria et al., 2008a–e.
The investigation does not cover the entire range of expected
conditions and scenarios important for the NPP safety, and, as
an example, relevant areas like transients occurring at low power
or during shutdown are not considered. Furthermore, reference
is made primarily to the Smolensk-3 NPP put into operation in
1990 and no emphasis is given to the safety aspects that have
been or are the object of modernisation plans for existing RBMK
units. The provided results are derived from as-far-as possible
qualified calculations that might not have the rigor requested for
licensing analyses.
Following an effort to identify bounding scenarios that cover
‘all’ the expected phenomena relevant to the deterministic safety
analysis in RBMK, the accident evolutions have been predicted
making use of suitable codes and code chains. The results indi-
cated that acceptance criteria for the involved safety margins
are fulfilled and no major potential flaw or drawback in RBMK
safety could be identified.
A rough-parallel safety evaluation of RBMK and other water
cooled reactors has been completed based on 13 selected topics
relevant to the accident analysis. The evaluation showed that:
(a) A safety difference between RBMK and other water cooled
reactors in the area of DBA was identified consisting in
the allowed possibility for RBMK to transport even small
fraction of damaged fuel outside the pressure boundary.
(b) Some topics still constitute safety issues and are ‘tolerated’
in the related licensing processes, e.g., the PTS in PWR
and VVER and the occurrence of the fission power pulse
following steam line closure in BWR; these topics are not
applicable to RBMK.
(c) In relation to other topics an advantage of RBMK safety
features can be envisaged; these include the control rods
that are actuated in an atmospheric pressure environment,
the possibility of molten fuel retention and cooling of one
failed element and the smooth reactivity increase following
events like closure of main steam line valve.
(d) The inherent long term cooling capability, this is a require-
ment for ‘Generation IV’ reactors, perhaps might be attained
in RBMK having available water at atmospheric pressure
that cools the CPS system.
The Individual Channel Monitoring (ICM) system has been
proposed to generate safety control rod actuation from the
measurement of high fluid temperature at the channel outlet fol-
lowing an event of the type of the channel blockage. It seems to
be useful to asses the feasibility and the working capacity of the
system in operating RBMK.
The overall documented activity was possible owing to the
availability of powerful computers and computational tech-
niques, including numerical bases for the codes and qualified
input decks of the reference RBMK NPP unit that have been
made available in the last few years.
All of this suggests that the negative judgement for RBMK
in the area of nuclear safety technology is primarily a conse-
quence of the impact that the Chernobyl-4 event of 1986 had
upon accident analyses performed afterwards and in the early
90s. This judgement should be reconsidered in the light of the
recent availability of substantially improved plant features and
computational capabilities and should be used to support the
development of a new class of channel type reactors in line with
the ideas and the proposal of the prominent scientist and designer
Yu.M. Cherkashov, Gabaraev et al., 2004.
Acknowledgements
The present paper is devoted to the memory of the eminent
Russian researcher and technologist Dr. Yuri Cherkashov who
passed away in May 2006. He contributed to the crucial effort of
designing the fuel channel of the RBMK and was decorated and
granted a State award for his services. Around fifty researchers
at NIKIET and University of Pisa took part in the EC (Euro-
pean Commission) Project activities that were at the origin of
the present one plus five companion papers in this journal issue.
Most of their names appear as co-authors of the papers or of
the references. Their contribution is gratefully acknowledged. A
number of persons provided a managerial support to the activi-
ties; among them, we wish to recall V. Shandra and C. Sollima.
The work would not have been possible without the contribu-
tion and the willingness of the Russian Beneficiary Institution
Rosenergoatom to cooperate and to supervise the activities. Spe-
cial thanks are due to Dr. E. Hicken and Dr. R.B. Duffey who
took the charge of evaluating all this material and to Profs. M.
Mazzini and G. Petrangeli for their continuous supervision of
the activities. Neither the EC nor any person acting on behalf of
the Commission is responsible for the use which might be made
of the information in the paper and the views expressed are the
sole responsibility of the authors and not necessarily reflect the
views of EC.
References
Adamov E.O., Cherkashov Yu.M., Mironov Y.V., Nikitin Y.M., Bourlakov
E.V., Kukharkin N.E., 1995. RBMK Reactors During Severe Accidents and
Related Assessment Techniques. Proceedings of ICHMT Seminars, Thermal
Science Online, Issue 1, ISSN 961-91393-0-5.
Adamov, E.O., Cherkashov, Y.M., Ponomarev-Stepnoy, N.N., Bourlakov,
E.V., 1996. Upgrading of RBMK Reactors: Safety Enhancement
Measures—IAEA International Conference One Decade After Cher-
nobyl: Nuclear Safety Aspects, Vienna, Austria, April 1–3, pp. 84–
102.
Alexandrov V.P., Novoselsky O.Y., 2007. On the Problem of RBMK Stack
Graphite Inflammation (in Russian)—NIKIET document ET07/74, Moscow
(Russia).
Almenas K., Kaliatka A., Uspuras E., 1998. Ignalina RBMK-1500. A Source
Book, extended and updated version. Lithuanian Energy Institute, Kaunas
(LT), ISBN 9986-492-35-1, pp. 1–198.
Ansys Inc., 2002. Ansys User’s Manual (version 6.0). Canonsburg (US).
Avvakumov, A., Malofeev, V., 1991. Three-dimensional simulation of delayed
neutron transients in a Heterogeneous Reactor. J. At. Energ., 70.
 F. D’Auria et al. / Nuclear Engineering and Design 238 (2008) 975–1001
Bousbia-Salah, A., Vedovi, J., D’Auria, F., Ivanov, K., Galassi, G.M., 2004.
Analysis of the Peach Bottom Turbine Trip 2 Experiment by coupled Relap5-
Parcs three dimensional codes. J. Nucl. Sci. Eng. 148, 337–353.
D’Auria, F., Debrecin, N., Galassi, G.M., 1995. Outline of the uncertainty
methodology based on accuracy extrapolation (UMAE). J. Nucl. Technol.
109 (1), 21–38.
D’Auria, F., Giannotti, W., 2000. Development of Code with capability of Inter-
nal Assessment of Uncertainty. J. Nucl. Technol. 131 (1), 159–196.
D’Auria, F., Galassi, G.M., Giannotti, W., Petruzzi, A., Moussavian, K., Pierro,
F., Lo Nigro, A., Muellner, N., 2003. Qualification and application of coupled
reactor cooling systems and containment nodalizations. In: IAEA techni-
cal meeting on ‘Progress in Development and Use of Coupled Codes for
Accident Analysis’, Vienna (A), Nov. 26–28.
D’Auria F. (Editor), Soloviev S., Novoselsky O., Moskalev A., Radkevitch V.,
Malofeev V., Parisi C., Cherubini M., Pierro F., Moretti F., 2005. Determin-
istic safety technology in RBMK, EC TACIS Project R2.03/97 (Software
Development for Accident Analysis of VVER and RBMK Reactors in Rus-
sia) Final Technical Report, Part B, University of Pisa, ISBN 88-902189-0-8,
pp 1–838.
D’Auria, F., Gabaraev, B., Radkevich, V., Moskalev, A., Uspuras, E., Kaliatka,
A., Parisi, C., Cherubini, M., Pierro, F., 2008a. Thermal-hydraulic perfor-
mance of primary system of RBMK in case of Accidents. J. Nucl. Eng. Des.
238 (4), 904–924.
D’Auria, F., Novoselsky, O., Safonov, V., Uspuras, E., Galassi, G.M., Cherubini,
M., Giannotti, W., 2008b. Thermal-hydraulic performance of confinement
system of RBMK in case of accidents. J. Nucl. Eng. Des. 238 (4), 925–939.
D’Auria, F., Soloviev, S., Malofeev, V., Ivanov, K., Parisi, C., 2008c. The three-
dimensional neutron kinetics coupled with thermal-hydraulics in RBMK
accident analysis. J. Nucl. Eng. Des. 238 (4), 1002–1025.
D’Auria, F., Gabaraev, B., Novoselsky, O., Radkevich, V., Filinov, V.N., Mazzini,
D., Moretti, F., Pierro, F., Vigni, A., Parafilo, L., Kryuchkov, D., 2008d. The
multiple pressure tube rupture (MPTR) issue in RBMK safety technology.
J. Nucl. Eng. Des. 238 (4), 1026–1061.
D’Auria, F., Cherubini, M., Pierro, F., Giannotti, W., 2008e. The individual chan-
nel monitoring (ICM) proposal to improve safety performance of RBMK. J.
Nucl. Eng. Des. 238 (4), 1062–1079.
Fluent Inc., 2003. Fluent 6.1.22, User’s Guide. Lebanon (US).
Gabaraev, B., Grozdov, I.I., Petrov, A.A., Romenkov, A.A., Cherkashov, Yu.M.,
Burlakov, E.V., Eperin, A.P., 2004. The pressure-tube line in Russian nuclear
engineering. In: International Conference on Pressure Tube Reactors: Prob-
lems and Solutions, Moscow (Russia) October 19–20.
Galassi G.M., 2006. Rough estimation of the inherent long term cooling capa-
bility for RBMK. Un-classified document, University of Pisa DIMNP.
IAEA, 1993. Safety assessment of design solutions and proposed improvements
to Smolensk Unit 3 RBMK Nuclear Power Plant. TECDOC-722, Vienna
(A), Draft.
IAEA, 2000. Irradiation damage in graphite due to fast neutrons in fission and
fusion systems. TECDOC-1154, Vienna (A), ISSN 1011-4289 pp. 1–176.
IAEA, 2005. Accident analysis for nuclear power plants with graphite moderated
boiling water RBMK reactors. Safety Report Series No. 43, Vienna (A),
ISBN 92-0-112804-5.
INSAG, 1999. Basic safety principles for nuclear power plants. IAEA, INSAG
Series No. 12, 75-INSAG-3 rev. 1, Vienna (A).
1001
Kaliatka, A., Uspuras, E., 2002. Development and evaluation of additional shut-
down systems at the Ignalina NPP by employing Relap5 code. J. Nucl. Eng.
Des. 217, 119–139.
Kramerov, A.J., Michailov, D.A., 2000. About the approach to severe acci-
dent studying in channel boiling reactors, basically at overheating by decay
heat (in Russian). In: 5th International Information Exchange Forum (Safety
Analysis for NNP of VVER and RBMK types), Obninsk (Russia), October
16–20.
Landeyro, P.A., Buccafurni, A., 1991. Time-independent neutronic analysis of
the Chernobyl accident. J. Nucl. Eng. Des. 108, 126–149.
Lee, S.M., Chang, Y.S., Choi, J.B., Kim, Y.J., 2006. Failure probability assess-
ment of wall thinned nuclear pipes using probabilistic fracture mechanics.
J. Nucl. Eng. Des. 236, 350–358.
Mankamo T., Marttila J., Reponen H., 2000. Experiences from the LNPP-
P&DSA review. Lessons learned from RBMK safety studies. Report
STUK-YTO-TR 168. Helsinki (SF), ISBN 951-712-412-0, pp. 1–43.
Medvedeva, N.Yu., Peshkov, I.A., Andreev, A.V., Zhilko, V.N., 2004. Exper-
imental modelling of RBMK pressure tube failure due to accidental
overheating. In: International Conference on Pressure Tube Reactors: Prob-
lems and Solutions, Moscow (Russia) October 19–20.
Meyer, D., Micaelli, J.C., Domoradov, A.E., Mironov, Y.V., Nikitin, Y.M., 1994.
RBMK LOCA analyses with Cathare and Relap5. In: Internatioanl Con-
feernce on New Trends in Nuclear System Thermo-hydraulics, Pisa (Italy),
May 30–June 2.
Michailov, F D.A., Moskalev, F A., 2006. Personal communication with F.
D’Auria, Pisa (Italy), September.
Platonov, P.A., et al., 2003. Calculation and experimental investigations
on Wigner energy and graphite physical properties of CPS displace-
ments of RBMK reactor (in Russian). Atomnaya Energia 94 (4), 270–
283.
Simonov, S.L., et al., 1994. Analysis of pressure dynamics in reactor core cav-
ity experienced under incident at Leningrad NPP in March 1992. In: Top.
Meetings on MPTR Analysis in Channel Type Reactors, Moscow (Russia).
Soloviev S., Novoselsky O., 2004. Various personal communications to transmit
Smolensk 3 NPP related database. NIKIET classified documents, Moscow
(Russia).
Sorokin, N.M., Gabaraev, B.A., Cherkashov, Yu.M., 2006. Safe operation and
life extension of RBMK plants. J. Nucl. Eng. Des. 236, 1648–1656.
Sureau H., Novoselsky O., Hall S.F. (Lead Authors), 1996. Multiple pressure
tube rupture/cavity overpressure. EC TACIS RBMK2/TG2.8, pp. 1–140.
TACIS, 1996. RBMK safety review. Graphite-Pressure tube interaction (Stored
energy in GRAPHITE Displacers). EC RBMK2/TG2.7, Bruxelles (B), pp.
1–85.
TACIS, 1997. Severe transient analysis for RBMK reactors. Anticipated acci-
dents without scram. TACIS Project R2.30/94, EC RBMK3/TG4, Bruxelles
(B), pp. 1–320.
Uspuras, E., Kaliatka, A., 2006. Accident and Transient Processes at NPPs with
Channel Type Reactors. Monograph, Lithuanian Energy Institute, Kaunas
(LT), ISBN 9986-492-87-4, pp. 1–299.
Weber J.P., Bava G., Bestion D., Maccabee A., Reichenbach D., 1994. RBMK
safety review. final report of topic group 1; system engineering and accident
progression. EC Project RBMK/CMC/FR Issue 1, pp. 1–413.