Reliability assessment of emergency auxiliaries of an NPP using an additional steam turbine under various modes of its utilization

Under complete blackout of a station, it is possible to cool-down the VVER-1000 type reactors using the energy of residual heat release of the reactors. The calculations from past works showed in the context of Balakovo nuclear power plant, that a single low-power steam-turbine unit by utilizing the energy of residual heat release from one reactor is capable to provide electricity for two VVER-1000 power units, including the cases when the first circuit in one of the units is depressurized. This work is a continuation of the investigation of the general-station reserve systems for nuclear power plants own needs. The effectiveness of the joint installation of an additional multifunctional steam turbine and a mobile general-station diesel generator was investigated taking into account the results of a large research of the causes for not starting diesel generators at nuclear power plants, conducted by scientists from the USA and Canada, according to which the interval of the percentage of their non-start ranges from 1 to 3%. It is shown that the reliability of such concurrent redundancy of the NPP’s own needs meets the IAEA requirements. Also in the work, the reliability of the developed emergency power supply system was investigated in the conditions of the additional steam turbine stop during the night off-peak hours of the electrical load. Research has shown that this is not acceptable for the accepted conditions from a safety point of view.


Introduction
A blackout at a nuclear power plants is considered an extreme event, which may be a consequence of both external and internal factors. External factors include: major system accidents with the current frequency drop below the permissible level, destruction of communication lines due to earthquakes, hurricanes, dust storms, icing, etc. The emergency condition is due to the need for prolonged heat removal from the shutdown reactors. Failure to comply with these requirements leads to serious accidents with the destruction of the reactor core and release of radiation into environment. Probability of such accidents will increase with the rise in the number of nuclear reactors. In this regard, the safety requirements for nuclear power plants will be reinforced as nuclear power develops. To ensure emergency cooling after reactor shutdown, independent safety channels are provided (from 2 to 4) at each power unit with their own diesel generators. In addition, a mobile station-wide diesel generator is provided in some cases.
Each backup element is in a standby mode of the initial event and should have high level of emergency preparedness in case of blackout conditions. Such system of power supply redundancy is considered passive. Researching reliability of such systems is a rather complex and multiway task. To a certain extent, this is determined by the poorly investigated properties of the elements, equipment and systems used in the standby mode. Also, the statistical material on the properties and failures of redundant equipment is not sufficiently researched.
Each diesel generator is equipped with autonomous service systems for supplying fuel, cooling oil, starting air, heating, ventilation, and power supply for auxiliaries. Reliability of such electricity generating system during start-up and operation is largely determined by the technical condition of diesel generators, operation modes, as well as service systems, including starting devices, fuel supply automation, auxiliaries, etc. Thus, reliability of the entire redundancy system depends on reliability of its constituent elements, and permissible loading rate. Performance of such a redundancy system and reliability of its operation can be affected by: the quality of the fuel and oil used, the quality of remedial maintenance, inspection intervals, and approximation level of tests and trials to the actual start-up conditions in the course of blackout. Let us consider some of the most significant factors.
According to official statistics, about half of diesel engine failures and malfunctions are related to fuel quality and storage conditions. Long-term storage of diesel fuel causes a decrease in its quality. This may be the result of contact of fuel with copper or zinc, separation into fractions with an increase in the temperature in summer season, the moisture content, which enables the growth of bacteria and fungi, and additives, which rapidly decompose and lower the quality of fuel. Thus, diesel fuel during long-term storage separates: the heavier dark fraction accumulates in the lower part of the tanks, it burns poorly and can lead to the clogging of filters and failure of diesel engines. For this reason, even in keeping with the storage rules, the diesel fuel retains its properties for only one year. It is possible to extend its storage period only when the fuel is cleaned in recirculation filters, and the storage tanks are cleaned from accumulated deposits. When the initial event occurs, the regulation requirements relating the starting and loading of diesel generators are stringent. Thus, the start-up with the rated voltage of the generator should be performed within 15-20 seconds, while the full load operation should be achieved within 20-40 seconds. It should be considered, that application of cage asynchronous motors is accompanied by a shock current load, which can be seven times the rated current of the electric motor, and the maximum current in the external circuit of the generator can be at 100-200% of the nominal current. Duration of such modes is measured in fractions of a second. However, the short start-up duration has a negative impact on reliability of the start-up procedure due to significant temperature and mechanical stresses [1]. In [2], there is a set of associated factors affecting the start-up reliability. These factors include: delays in the growth of oil consumption in relation to rotation frequency, inertia of the air pressurization system, that does not provide complete combustion of fuel, and condensation of chemically active components, that facilitate corrosion of pistons.
The scientists from the US and Canada conducted a large-scale research into the statistical analysis of failures of diesel generators at start-up based on the investigation of the experimental experience of diesel generators [3][4][5][6]. The results of this analysis showed that a no-start within the range of 1-3% is most probable. It should be noted that planned tests of diesel generators are conducted for more favorable conditions in terms of boosting the stringent conditions arising in the actual environment when the initial event occurs. It is practically impossible to make the conditions of scheduled examinations and the required emergency cooldown regulations compatible. Therefore, we can only expect deterioration in the start-up performance under real conditions of blackout. In addition, diesel generators have a relatively low mean time between failures, which increases the probability of their failure in the process of emergency cooling, which according to regulations should be at least 72 hours. Thus, based on the failure statistics of the most important components of marine diesel generators [7], it was found that their mean time between failures is in the range of 500-800 hours [8], which is lower than that of low-power steam turbine units. The issue of assessing the degree of preparedness to the loads on the reserve general-station diesel generator has not been investigated. Transportation of the general-station diesel generator to the related power unit, utility hook-up and start up will take a long time.
In connection with increasingly stringent safety requirements for the newly constructed power units, additional passive cooling systems are installed, which do not require external power supply in blackout situations. In the event of loss of backup energy sources at nuclear power plants, such passive heat removal systems should ensure the shut-down cooling within 72 hours, as well as in the case of loss of coolant of the primary circuit. Today, specific capital investments into such nuclear power plants amount $ 5,000 per kilowatt and over, which brings them to the ultimate level of competitiveness in the energy sector.
As an alternative option to improve the safety, the authors proposed to install an additional multifunctional small-capacity steam turbine unit [9][10]. The main advantage of such installation is a possibility of using the steam, generated by the residual heat, to drive the multifunctional turbine and generate the electric power necessary for cooling.
In normal operating modes, an additional turbogenerator provides power generation and totally cost-effective. The calculations to research the temporal characteristics of the residual heat of shutdown reactors are based on the experimental data of the Balakovo NPP [11] and show, that regardless of the moment of the fuel cycle for the existing initial enrichment of uranium in VVER-1000 reactors, the residual heat of one reactor is sufficient to generate electricity needed for the reactor shutdown cooling within 72 hours, even taking into account depressurization of the primary circuit in one of the reactors.
Another important characteristic of the low-power turbogenerator is the ability to provide uninterrupted power supply to the auxiliaries of the nuclear power plants in case of blackout conditions [12]. This is achieved by adjusting the protection system of the additional turbine in a way that it remains in operation and provides an auxiliary drive designed to cool the reactors. Thus, in an emergency situation, when the main power units will be affected by a blackout, the additional turbine will continue to operate due to residual heat supply. Such automation of the process does not require any assistance of the maintenance personnel. In this case, the intrinsic property of increased reliability of an operating unit (active reserve) is used to ensure the core cooldown.
The analysis of the failure statistics of domestic steam turbine units of various capacity levels [13] showed, that the mean time between failures for low-power turbines (up to 100 MW) is 20-22 thousand hours. For a one-and-a-half year fuel cycle at a nuclear power plant, the shutdown of a power unit for fuel reloading lasts up to one and a half months, and this period is usually combined with the major and preventive repairs of the equipment. The mean time between failures of an additional turbine unit with a large margin fits in this period.
An additional turbine during the operation in normal modes is considered as a refurbishment project. In case of a forced failure, it is repaired, restored, and returned to operation. In case of an emergency, for the entire blackout period when the power outage is unacceptable, it will be considered as an unrecoverable object. Based on the determined characteristics and advantages of the multifunctional additional turbine unit of a nuclear power plant, it can be considered that in combination with the developed and used diesel generators, it can make up for their deficiency and provide an increased reliability of supply of the in-house needs, and, consequently, their safety.

Special aspects of using additional turbogenerators under normal modes
Compared to the main turbine, the turbine of a multifunctional installation has a lower coefficient of efficiency of the flow range ηoi. Dependence of the changes in the relative internal efficiency coefficient of the flowing rate of the designed steam turbine on the volumetric passage of steam through the turbine [14] is shown in figure 1.
A decrease in the efficiency of the turbine ηoi with a decrease in the bilk steam (design turbine) is primarily associated with a decrease in the height of the working blades. This determines effectiveness of unloading an additional turbine at the decline in maximum power consumption, i.e. in the off-peak night hours.
As a rule, a low-power turbine is performed with a throttle control of the flow in the main steam. Unloading an additional turbine unit at night time can be performed in three ways: 1. by reducing its capacity to the level that ensures the load pickup in case of emergency; 2. no-load operation;

shutdown followed by a start-up.
In case of a night shutdown, an additional turbine for this period will not be able to fulfill the functions of emergency reserves. This may affect a reduction in reliability of emergency backup of the auxiliaries, which requires a more detailed research into the issue. Figure. 1. Basic coefficient of efficiency, excluding the output losses, for calculating parts of steam turbines at n=25 s -1 , for a part of high pressure or medium and low pressure compartment under performance with superheated steam depending on G0υ0 -the bulk steam at the entrance to the compartment and pressure ratios p0 / p2 before and outside the compartment, respectively.

Theoretical analysis
Previously, in [15] a reliability assessment of the backup of auxiliary needs of NPPs was made on the basis of a three-channel emergency power supply system with diesel generators in conjunction with a mobile additional general-station diesel generator and, as an alternative, with an additional steam turbine. The research was conducted with account for the results of the above investigation of the causes of no-start of diesel generators at nuclear power plants, conducted by the researchers from the USA and Canada [3][4][5][6].
The results of preliminary assessment of reliability of general-station backup systems have shown, that reliability of a three-channel emergency power supply system with installation of an additional general-station diesel generator does not satisfy the present-day safety requirements for nuclear power plants [15], since the failure rate of the system exceeds the maximum rate of the damage to the reactor core, established by the IAEA -1.0•10 -6 1/rector•year [16]. The failure rate of a three-channel emergency power supply system with diesel generators provided with additional steam turbines satisfies the above mentioned requirements only at 1% failure of the start of the diesel-generator while backing up the auxiliaries of only one power unit [15].
The obtained results indicate the need to improve the proposed solutions. In this regard, it was decided to investigate the traditional three-channel emergency power supply system with diesel generators during the joint installation of an additional steam turbine and a general-station diesel generator, and to compare it with the systems investigated in the previous work [15]. To assess the reliability of the backup system used for auxiliary needs based on a three-channel emergency power supply system (EPS) with diesel generators (DG) when installing an additional steam turbine (ST) together with a mobile additional general-station diesel generator (GS DG), a corresponding state graph has been compiled In case of a complete blackout, an additional steam turbine continues to operate based on the power supply for the NPP auxiliary needs, and a three-channel emergency power supply system with diesel generators is tripped in case of its failure. An additional general-station diesel generator triggers if all the diesel generators do not start or fail in the course of operations. In case of its failure, then there is a loss of all the sources of power supply with a subsequent damage in the reactor core at the indicated power unit. Moreover, if the general-station diesel generator is in operation at one of the power units, and simultaneously, there is a failure of the safety channels with the diesel generators at the other power unit, then the latter loses all the power supply sources with a subsequent damage in the reactor core.
To determine the probability of each of the states, a system of differential equations and a normalization equation, describing the state graph, are compiled and solved ( figure 2). The values of stationary state probabilities are determined as a solution of a system of algebraic equations, obtained from the Kolmogorov system of differential equations by equating derivatives for time of state probabilities to zero. More detailed calculations of similar state graphs are presented in [10,15].
The results of the previous investigation [15] will be the basis for calculating reliability indicators of a three-channel emergency power supply system with diesel generators, an additional generalstation steam turbine, and general-station diesel generator. The main results of [15] [17,18], for calculation of bl, DG, 3.5•10 -5 and 3.0•10 -3 1/react.•h were taken as equal, respectively.
Estimation of reliability indicators for the systems of general-station reservation is made based on the method of preliminary reliability analysis of reservation systems of the NPP auxiliary needs, which is described in detail in [10]. The developed method also takes into account a possibility of reconnection with the energy system during the operation of emergency power sources. The previous calculations, based on the developed method, of a three-channel emergency power supply system with diesel generators, taking one percent of no-start-up of diesel generators, according to the requirements for these generators [1], showed that 3DG bl  is 7.37·10 -5 1/react.·year. This result corresponds with an error of 11% to the declared risk of the reactor core damage, according to the official probabilistic safety analysis -8.29·10 -5 1/react.·year [19].
The total intensity of the transition process to the failure of all emergency power supply systems with a subsequent reactor core damage is the sum of the products of all state probabilities and intensity of the transition of each state to the final state of the reactor core damage.
Then, for the investigation system The results of the research are presented in table 1. Table 1. The total intensity of the damage in the reactor core, 1/react.·year Table 1 shows that upon installation of a traditional three-channel emergency power supply system with diesel generators together with a general station additional steam turbine and a general station diesel generator for two nuclear power units, at the range of a no-start percentage of diesel generators at 1-3%, and for three power units at the no-start percentage of diesel generators at 1%, the IAEA requirement to not exceed the maximum core damage (1.0•10 -6 1/react.·year) rate is fulfilled. Operation of an additional turbine unit under normal operating conditions should be investigated: it is necessary to determine the rational modes of its loading under uneven daily electricity consumption schedules.
In addition to economic efficiency factors, the safety factor must be considered for choosing the operation mode of an additional steam turbine: when the steam turbine stops, the nuclear power plant loses the additional reserve source of electricity due to the long start duration of the steam turbines. To assess the influence of this factor, an investigation was made into the operating mode of a multifunctional steam turbine for 16 hours work (τbas) / 8 hours turbine outage at off-peak night hours of electric load (τt.o.) for reserve systems: a three-channel emergency power supply system with diesel generators and an additional steam turbine with / without an additional general station diesel generator.
From the set condition it is clear that the emergency power supply system will have the following structure: -when the steam turbine is in operation: three-channel emergency power supply system with diesel generators + additional steam turbine + / 0 an additional general station diesel generator; -under turbine outage: three-channel emergency power supply system with diesel generators + / 0 an additional general station diesel generator.
Based on this, the total failure intensity, when the steam turbine is stopped at night, can be found by the formula: where: bas  -the failure intensity of the investigated power supply system without turbine outage; .
. to  -the failure intensity of the investigated power supply system in period of turbine outage.
The results of calculating the total failure intensity of the investigated power supply system with an 8-hour night turbine outage are presented in table 2. 3.22·10 -5 5.28·10 -5 8.05·10 -5 As the calculations showed, in case of the outage of the additional steam turbine, the above mentioned IAEA requirements do not satisfy by the investigated emergency power supply systems at any number of power units and percentage of no-start of the diesel generator. Thus, comparing the data in the tables 1 and 2, we can conclude that the permanent reserve on the basis of an additional steam turbine is much more effective in terms of the NPP safety than the steam turbine outage during the hours of decrease in the load in the power system.
Based on the results of a comprehensive research into reliability indicators of the backup systems (tables 1 and 2), it must be emphasized that reliability of diesel generators requires particular attention,  [3][4][5][6], the reliability indicators of diesel generators are far behind (up to four times) from the existing requirements, which has a significant negative impact on the overall reliability of the redundancy systems.

Conclusions
The given work proceeds with the investigation of general station reserve systems for the NPP auxiliary needs. It is shown that, when a traditional three-channel emergency power supply system with diesel generators is installed at nuclear power plants together with a general station additional steam turbine and diesel generator for two nuclear power units with a range of no-start of diesel generators at 1-3%, and for three power units with the no-start of diesel generators at 1%, the IAEA condition related to not exceeding the permissible reactor core damage intensity is fulfilled at 1.0•10 -6 1/rector·year.
Additionally, reliability of the investigated emergency power supply system was investigated during the steam turbine outage during off-peak night hours of an electric load of 8 hours. The investigation showed that in terms of the safety for the accepted conditions, it is not permissible, due to the fact, that the failure intensity of the emergency power supply system with a subsequent damage is higher than the maximum, according to the IAEA requirements.