This article gives an impact analysis of utilization of nuclear power plant full scope simulator on operation parameters, training and education in nuclear power plant Krško (NEK). The Slovenian Nuclear Safety Administration issued their simulator decree to NEK in April 1995. The first training session on the simulator was performed in April 17, 2000 and since then the simulator has been used on daily bases to improve operator knowledges, skills, and performances. At the time, this was the first full scope simulator with the capability to simulate Beyond design basis accidents (severe accidents). The ability to simulate core meltdown and containment breach made it very suitable for emergency preparedness drills. After the 2017 simulator upgrade, fuel meltdown in the spent fuel pool can be simulated using the Modular Accident Analysis Program—MAAP5. This capability is still unique for full scope simulators even today. The simulator is also used for pretesting of plant modifications before their implementation on site or for just-in-time training for infrequent performed evolutions or for procedure development and testing. The Pressurized Water Reactor Owners Group used the NEK simulator in 2018 to develop the new set of the Severe Accident Management Guidelines, incorporated with a completely new usage approach. In all of these years, the simulator has been actively participating in the increased reliability and stability of the electricity production and in achieving NEK's vision to be a worldwide leader in nuclear safety and excellence.
In March 28, 1979, the mechanical failures at the Three Mile Island were compounded by the initial failure of plant operators to recognize the situation as a loss-of-coolant accident due to inadequate training. In the following years after the accident, one of the outcomes was a demand for every utility to have a plant specific simulator for operator training.
Simulators are widely used in very different areas as in aviation, in the space programs, in medicine, in nuclear, etc. Probably the most known or famous use of a simulator was the Apollo 13 accident in April 1970, with the third crew that was meant to land on the moon. “Houston, we have had a problem” statement lead to the lifesaving usage of the simulators at NASA. New procedures were refined, modified and evaluated in simulators to perfect the strategies required to bring the astronauts home .
In nuclear area, simulators are used to support the training for creation of qualified plant personnel ensuring safe and reliable operation of nuclear power plants (NPPs). Nuclear full scope simulators are exact replicas (physical copies) of main control rooms. A full scope simulator is a simulator incorporating detailed modeling of those systems of the referenced plant with which the operator interfaces in the actual control room environment. Replica control room operating consoles are included .
Many NPPs have a steady-state operation throughout the whole fuel cycle, because plant processes as conduct of operation, maintenance, training, , etc., have improved over the years. Nowadays, the availability factor of NPP's is very high , which is excellent in all ways, except for gaining experience. In the past, operators gained experience responding to plant transients or making mistakes by performing plant evolutions. None of these exists anymore. The lack of fewer operational experience opportunities can be compensated almost only by using a simulator.
The first training session on the Krško full scope simulator (Fig. 1) was delivered in April 17th 2000 after a long-lasting quest for a simulator. The whole simulator project from preparation to utilization took almost five years, from 1995 to 2000.
2 Simulator Utilization
The simulator has been and still is utilized in many different ways, but the vast majority of the time for training purposes. After the delivery, the simulator must evolve because of the modifications at the reference plant, preventing the faults in the simulations that can appear after years of operation . The simulator is therefore the best tool for pretesting main control room modifications, with the purpose of the reliability, compatibility, human factor engineering testing and defining deviations. Dynamic responses and transient analyses are performed, and so is the procedure development and testing of operating procedures and so on.
2.1 Simulator Capabilities.
The simulator complies with ANSI/ANS 3.5 requirements . It is capable of normal and abnormal operation from cold shutdown to hot full power, with a reduced reactor coolant inventory or open reactor coolant system operation. It is simulating design basis accident and beyond design basis accidents (severe accidents) using the Modular Accident Analysis Program—MAAP5, which incorporates the reactor core, the primary system, containment building, and the spent fuel pool. There are also varieties of generic and specific malfunctions.
2.2 Operations Training.
The primary purpose of having a simulator is to give the operators needed knowledge and skills to operate the plant. Because of the continuous steady-state operation, called also as excellence in operation, the training on simulator is one of the most important means of gaining experience.
2.2.1 Initial licensed Operator Training.
Training consists of four phases and the full scope simulator is utilized in three of them:
Fundamentals phase: lasts for about 21 weeks and in that time theoretical basis in nuclear technology as nuclear and reactor physics, thermodynamics, hydrodynamics, etc., are provided to the trainees. The full scope simulator in this stage is used to present the reactivity transients.
Plant systems and operation phase: lasts for about 28 weeks. The trainees are getting familiar with the plant systems by classroom training and walk downs. Simulator is used to perform some plant evolutions like synchronization to the electrical grid or job performance measurements like establishing letdown in the Chemical and Volume Control System. These are so called demonstration scenarios. What has also been shown as very useful in this phase, is the familiarization with the main control board. Because of this familiarization, time is gained when the trainees start with the simulator training in the simulator training phase. They are already acquainted with the main control board layout and with the positions of different equipment controls and indicators. The plant system interaction training on the simulator can start much earlier, because there is no or very little adaptation time.
Simulator training phase: lasts for about 23 weeks. Trainees are getting familiar with the different systems interaction in the control room environment on the simulator by manipulating the controls and interfering systems with different malfunctions causing transients. This phase also provides the trainees with the procedure handling and an understanding of the phenomenology during normal, abnormal or emergency operation. During the training, 3D interactive graphic visualization (Fig. 2) is used to support the understanding and retention of system behavior and transients in major events.
Reactor operator on-the-job training: lasts for about 14 weeks. This is practical training in the main control room on the Reactor operator position, which is conducted in parallel with the simulator training. Simulator is not utilized in this phase, because the intent is to gain experience in a real working environment.
2.2.2 Licensed operator Continued Training.
The licensed operator continue training is performed in two years cycles, based on a two-year program and on current training needs in accordance with the systematic approach to training. The yearly training for each crew is divided into four training segments, each lasting one week. In that week, 15 h of training is delivered in the classroom and 20 h are performed on the simulator. Annually each licensed operator is involved in 60 h of classroom training and in 80 h of simulator training. Altogether, 140 h of training per each operating crew in a year, or 1120 h total of training in a year for all groups, of those 640 h on the simulator. The training is performed for 6 operating crews and for two operations staff groups including trainees with an active operator license.
The simulator is mostly used for normal operation or for accident training to mitigate events. In the majority of time spent on the simulator, trainees respond to transients or abnormal conditions that are very unlikely to appear, but if they do, they are prepared to respond. In this training, knowledge and skills are improved and the analysis and synthesis abilities by performing the scenarios are enhanced.
Safety analysis and operational experience indicates that human error is a great contributor to the risk of a severe accident in a NPP. Therefore, the operators are trained on the simulator to successfully cope with any transient or accident without or with minimum errors in their response. This is achieved by soft skills training on communications, problem solving, decision making, teamwork, leadership, professionalism, etc. All of this is trained on the simulator and tracked with performance indicators.
In the last 20 years, more than 12.800 h of continuous training for licensed operators has been performed and more than 9.500 h for initial training, where 74 candidates have obtained their first reactor operator license.
2.2.3 Field Operator Training.
The field operators are part of the operating crew, except they do not have a license and they perform actions in the field on behalf of the licensed main control room personnel. The simulator used in the field operator training program is called classroom virtual local panel (Fig. 3). The classroom virtual local panel can be utilized as a standalone full scope simulator just for field operator training or it can be part of the main full scope simulator for performing joint scenarios with the simulator main control room crew. In this case, all actions performed by field operators have real-time effects on the simulator and an on-line response is obtained for the crew in the main control room. To achieve realism, the field operator response is delayed and performed in a timely manner, as in reality, where they need time to reach the equipment. From the moment receiving the request to perform a task from the operating crew, the field operator has to show their knowledge and skills on the requested evolution describing to the instructor actions they have to undertake and the expected consequences of those actions. At the end, they also have to find and point out the equipment to be manipulated on the NEK virtual plant walkthrough application. This is a separate application, which enables plant walk downs in high resolution and is not a part of the simulator.
Joint scenarios are conducted for licensed operators and field operators to cover specific topics common to the entire shift crew, to build teamwork and to improve training realism.
2.2.4 Just-in-Time Training.
Some planned evolutions on the plant are infrequently performed or may have never been performed in the past. Those activities demand an extra caution. When an action plan for an infrequent performed activity has been approved and it involves the operations crew participation, usually a just-in-time training is performed on the simulator. For the participating crews, this is the opportunity to get an in-depth overview of the activity, recognize overlooked deficiencies or possible traps and to reduce the stress before the real performance. Just-in-time training is always performed before the plant shutdowns, the reactor startups and for the synchronizations to the grid.
2.3 Emergency Preparedness Drills.
Emergency response is not an everyday employment for the members of the emergency response organization. They are engaged in different areas in the plant and they are meant to respond to a very unlikely emergency, with a really small probability, but not equal to zero, to happen. Therefore, it is really important that the emergency response members have adequate and effective training to respond appropriate to severe accidents. A severe accident can be defined as any transient leading to a loss of reactor cooling and fuel damage, including cladding oxidation and hydrogen generation, fuel melting, vessel failure, containment failure and fission product releases.
To support the emergency preparedness training, the simulator is an excellent tool. Almost all current full-scope simulators that are used for training are capable of simulating design basis accidents, almost all current simulators are also capable of simulating beyond design basis accidents without including core melting. However, there are only few full scope simulators in the world, which can simulate beyond design basis accidents with core melt and containment breach and also only few full scope simulators with the spent fuel pool model integrated and the ability of fuel melting in the pool. The tool, that is used to simulate beyond design accidents, is the Modular Accident Analysis Program (MAAP) developed by Fauske and Associates Inc. (FAI) for the Electric Power Research Institute (EPRI). MAAP is a computer code used by nuclear utilities and research organizations to predict the progression of light water reactor accidents. MAAP5 predicts both the thermohydraulic and fission product response of the entire plant as the accident progresses. For these reasons, MAAP is often referred to as an integral severe accident analysis code . Currently, MAAP version 5 is integrated into the NEK's full scope simulator.
After the Fukushima accident the nuclear power industry proposed a safety strategy to address an extended loss of alternating current power and loss of normal access to the ultimate heat sink, called Diverse and Flexible Mitigation Capability, or simple FLEX. FLEX strategy maintains long-term core and spent fuel cooling and containment integrity with installed plant equipment that is protected from natural hazards, as well as with the backup portable onsite equipment. A lot of portable equipment was provided to NEK as diesel generators, fire protection pumps, compressors, submersible pumps, and transformers, to mitigate an accident. All of that equipment has been modeled on the simulator since 2011 and regularly used during training sessions or drills.
During a severe accident, all decision making is taken from the operating crew in the main control room and given to the Technical Support Center. The licensed operators have 160 h of training per year, half of it is on the simulator, and in case of a severe accidents, they give all the decision making to people, that have had not been trained as much. Therefore, it is crucial to give good training to the decision makers. The arising question is, how will they know, if their decisions were appropriate. With the integrated MAAP code, we can evaluate, if the decisions and suggested actions of the Technical Support Center were appropriate to mitigate the accident, just by observing the response. Usually we have more than 200 people involved in the drills, all of them have their specific tasks to perform and many of the tasks influence the simulator. The simulator shows an integrated response of all actions taken to mitigate the accident that is going on. In that way, the mitigating (un)success is shown online.
The emergency preparedness drills cover a range of different events, as:
Normal, abnormal and emergency operating events
Loss of all alternating current power
Severe accident events
Onsite/offsite radiological events or releases
Plant physical security events
External events (flooding, earthquakes, ….)
Plant fire events
Through the Simulated Plant Information System, the simulated plant parameters are available at on-site and off-site Emergency response organization located 100 km away. The emergency preparedness drills are performed twice a year, usually with a duration from 4 to 8 h, in 2008 it lasted for more than 24 h.
2.4 Procedure Validation.
When new procedures are developed or revised, they can be tested on the simulator so the procedure writer is given an actual feedback, before they are approved and used on site. This is also a very useful validation for startup procedures of newly implemented systems or components.
Following the Fukushima accident in 2011, a number of important updates were performed by the Pressurized Water Reactor Owners Group in order to incorporate lessons learned from the accident, including development of new generic severe accident management guidelines (SAMGs) package for international plants. It is a good practice to validate the generic guidelines, before the conversion into plant specific severe accident management guidelines is offered to the industry. This new revision with a completely new usage approach in the severe accident management guidelines, was validated for four days in March 2018 on our simulator, which was chosen because of its severe accident simulation capability.
2.5 Modification Implementation.
Maintaining fidelity with the reference plant is critical to ensure that the simulator remains a quality training tool. Failure to include the simulator in the design, procurement, and installation of plant modifications may adversely impact both fidelity and the ability of the Training Department to conduct necessary operator training .
All plant modifications in the preparation phase are also screened by the training department to determine the impact on training and the feasibility for implementation on the simulator. Since the year 2000, there have been more than 2.000 changes, like hardware enhancements and software updates, including modeling of more than 200 plant modifications. In cooperation with the vendor, 6 major updates have been implemented on the simulator before the simulator major upgrade.
In preparation for the replacement of the Turbine Control and Turbine Protection System with the Programable Digital Electro-Hydraulic control, the system was first implemented on the simulator, so the operating crews could have hands on training and get familiar with the new system, before it was put into service. During this phase of testing several deficiencies were discovered that have improved the system and prevented plant transients and even a reactor trip.
3 Simulator Upgrade in 2017
NEK has prepared and is still carrying out a Safety Upgrade Program for the modernization and upgrading the safety measures to prevent severe accidents, and to improve the means to successfully mitigate their consequences. Consequently, the upgrade of the full scope simulator was needed due to the Safety Upgrade Program, especially by introducing the new Emergency Control Room, which simulation added an extra load to the execution of simulation modules and demanded an extensive expansion of interface channels toward the simulator host computers. And the simulator's two host computers, Origin 2000 manufactured by Silicon Graphics, were a state-of-art in 2000, but in 2017 they were more or less obsolete with no available spare parts and with no options to be gradually upgraded. On top of everything, maintenance of the rest of the simulator equipment was very hard to perform.
The main acquisitions from the upgrade were:
simulations of the new Emergency Control Room
simulations of the new plant equipment incorporated because of the Safety Upgrade Program
upgrade of the severe accident simulation from MAAP4 to MAAP5, which includes the spent fuel pool upgrade
hardware virtualization of the simulator computer systems
new instructor stations with upgraded software to interact with the simulator
new Classroom Virtual Local Panels
4 Hardware Virtualization of the Simulator Computer Systems
To prevent obsoletion of the simulator computers, virtualization is used, meaning that the simulator can run on any computer that has enough Central Processing Unit (CPU), memory and disk capacity. Virtual machines can be installed on newer platforms with minimal effort and cost. Both simulator computers, main simulator and development simulator, are virtualized on two host servers, each host server is capable of simultaneously running both simulator computers. This configuration enables fast switchover with no loss of data, if one server fails. This virtualization was the first of a kind approach delivered by the simulator vendor. The idea and concept were fine-tuned in collaboration with NEK.
5 Analysis and Conclusion
In this part of the article, we try to evaluate the impact of simulator utilization on the plant operation and safety records. Altogether, the simulator is used for about 1.700 h per year; 880 h for initial training, 640 h for continuing training, 160 h for scenario validations, 32 h for initial training demonstrations on the simulator. A working year has about 2.000 h, so the simulator is, on average, used for 6 h and 48 min per each working day in a year or 85% of the available time. Moreover, this is just for training, the scenario development, modifications implementation and configuration developments aren't accounted for in this time.
The benefits of the simulator are indisputable. It enables the operators to grow in their knowledge and gives them experience. It is the same with the emergency preparedness organization. Modifications are validated before they are implemented in the plant and consequently reducing transient possibilities. It is identical with the operating procedures.
Even nuclear energy usage is promoted by the simulator. Usually it is the most interesting part for the plant visitors, experiencing plant shutdown or safety injection with all the sounds and lights coming on.
How to analyze the effect of all those simulator utilization modes on different NPP performance indicators? Despite all known benefits, is there a way to really measure the simulator contribution to the safe and reliable operation? Probably there is no direct method to measure such an impact. However, we try to estimate the impact with observation of general integral plant parameters. One such is the usage of the Unplanned automatic scrams performance indicator as shown in Fig. 4.
The indicator shows the number of unplanned automatic scrams (reactor shutdowns) and in the table, there is a distinction in the numbers before and after year 2000 (red line), when the simulator usage started. Before year 2000, there were 60 scrams in 17 years in total or 3,5 scrams per year in average, and after year 2000, 8 scrams in 19 years or 0,4 scrams per year in average. After year 2003, the fuel cycle was first prolonged from 12 months to 15 months and in the next fuel cycle from 15 to 18 months. From the perspective of operating a NPP, the longer the fuel cycle is, the more complex it is to maintain the plant on-line. Many processes have to be optimized and synchronized and all of the personnel has to be very knowledgeable and highly skilled to achieve stable operation through the whole fuel cycle.
The number of automatic scrams shows, among other things, also the awareness of the operators to operation. This result is an integration of all actions taken to improve the reliability of the electricity production, from the areas in maintenance, operations, modifications … and also in the training. Year 2000 was the time, when a lot of emphases were put on the usage of soft skill tools. And, in a lot of those areas, if not in all, the simulator was, is and will be a meaningful tool.
In the future, we will try to assess the return of investment of our simulator or at least the return of investment of the licensed operator training program as the main simulator user, to evaluate the costs and benefits of the simulator.
This work presented here, was enabled by many of those who worked in the past and are still working on the NPP Krško full scope simulator and broader field or using it for training or any other purposes to increase the safety and reliability of the plant.