Federal Environmental, Industrial and Nuclear Supervision Service Scientific and Engineering Centre for Nuclear and Radiation Safety Member of Russian regulatory approach to evaluation of passive systems used for specific BDBA’S (SBO, loss of UHS) during safety review of NPP Good day! Let me introduce myself. My name is Rogatov Denis. I'm lead engineer, NPP Safety Division, Scientific and Engineering Centre for Nuclear and Radiation Safety (Technical support organisation of Russian Regulatory body). The topic of my presentation is russian regulatory approach to evaluation of passive systems used for specific BDBA’S (SBO, loss of UHS) during safety review of NPP Denis Rogatov SEC NRS Vienna, June 6-9, 2017 www.secnrs.ru

CONTENT Introduction VVER-1200/AES-2006-M and VVER-1200/AES-2006-P design solutions 2.1. Evolution of VVER in 1990-2000 years 2.2. AES-2006 safety systems 2.3. Configuration of passive safety systems. Novovoronezh NPP-2 2.4. Configuration of passive safety systems. Leningrad NPP-2 Key regulatory requirements to evaluation of passive systems Key findings of safety review in regard to passive systems (by the example of Novovoronezh NPP-2) 4.1. Novovoronezh NPP-2. Key findings of safety review (Air-cooled PHRS & HA-2) 4.2. Complex of additional calculated and experimental substantiations. Example 4.3. Novovoronezh NPP-2. Results of safety review 5. Conclusion In this slide you can see content of my presentation. The presentation consists of three parts: design solution, regulatory approach to evaluate passive systems and some examples of key findings of safety review of Novovvoronezh NPP-2 Vienna, June 6-9, 2017 2

VVER-1200/AES-2006-M and VVER-1200/AES-2006-P design solutions First, I will begin with an overview of design solutions of passive systems included in new VVER NPP designs Vienna, June 6-9, 2017 3

Evolution of VVER in 1990-2000 years NPP-91 NPP-92 Serial VVER Tianwan NPP, China (CPR) Kudankulam NPP, India The result of the evolution of the NPP-2006 design delivered two different options of modern NPP VVER-1200 designs: AES-2006-M design - Designer Moscow Atomenergoproekt. The example of the design is Novovoronezh NPP-2; AES-2006-P design - Designer Saint-Petersburg Atomenergoproekt. The example of the design is Leningrad NPP-2. Novovoronezh NPP-2 Leningrad NPP-2 Vienna, June 6-9, 2017 4

Molten core catcher (in case of severe accidents) AES-2006 safety systems in new VVER design Leningrad NPP-2 Novovoronezh NPP-2 Active systems 4х100% (Typical” structure of safety systems) 2-trays (some - with redundancy of separate elements inside train) Passive systems Double-walled containment Passive part of the ECCS (hydro accumulator tanks of the 1st stages) Water-cooled SG Passive heat removal system (PHRS) Containment PHRS Emergency hydrogen removal system Double-walled containment Passive part of the ECCS (hydro accumulator tanks of the 1st stages) Hydroaccumulator tanks of the 2nd stages Air-cooled PHRS Emergency hydrogen removal system The main distinctive features of these designs are that safety functions can be provided both by active systems and passive systems independently from each other. Main difference between two approaches for configuration of safety systems is that in Moscow design the active safety systems are of 2-train configuration with passive safety systems as air-cooled PHRS SG and hydroaccumulators of 1-st and 2-nd stages whereas in St.Petersburg design the active safety systems are of 4-train configuration (“typical” structure of safety systems) with passive safety systems as water-cooled PHRS SG, Containment PHRS and only hydroaccumulators of the 1st stages. Molten core catcher (in case of severe accidents) Mobile equipment Vienna, June 6-9, 2017 5

Configuration of passive safety systems Novovoronezh NPP-2 Air-cooled PHRS 1st stage HA 2nd stage HA PCHR Steamgenerator PHRS heat exchanger PHRS is intended for removal of heat residuals from the reactor core at the accidents with the SBO both at the tight primary circuit and at the occurrence of leaks either in the Primary or in the Secondary Circuit. In case of leaky primary circuit, the heat removal is provided by joint operation of PHRS and hydroaccumulators of 1-st and 2-nd stages. The system consists of four independent circuits of natural circulation. The heat is transferred through steam generators to steam-external air heat exchangers of the PHRS where the steam is condensed and returned to the steam generators. Cold air intake is in the lower part of the reactor building. Heated air conveys through air ducts on the dome of the containment to discharge deflector. The Hydroaccumulators of 2-nd stage is intended for the performance of the passive supply of boric solution into reactor core with the purpose of maintaining the level of coolant in the core in case of accidents with loss of coolant, when pressure in the primary circuit drops. RCP Reactor Molten core catcher Spent fuel pool Vienna, June 6-9, 2017 6

Configuration of passive safety systems. Leningrad NPP-2 Heat is removed with evaporating water from the tanks to the atmosphere Water-cooled PHRS Water-cooled PHRS SG and PHRS from containment are intended to provide long-term heat removal from reactor and containment into the atmosphere in case of BDBA (for at least 24 hours). Both systems have four independent trains and share water stored in the same emergency heat removal tanks on the top part of the containment. For PHRS SG, in case of SBO or impossibility to remove heat from secondary circuit by other systems, the cut-off valve will be open to initiate secondary coolant circulation through emergency cooling heat exchanger. PHRS from containment has cut-off valves that always in open state except for the occurrence of leak in emergency heat exchanger so there are no need to any action to start the system. After start of the systems the water in emergency heat removal tanks heats up to boiling, and begin to evaporate, giving heat to atmosphere. 1 – tank; 2 – steamlines; 3 – condensate lines; 4 – SG PHRS valve; 5 – Containment PHRS heat exchangers; 6 – Steam generator; 7 – Cut-off valve (large and small for SG PHRS) Vienna, June 6-9, 2017 7

Key regulatory requirements to evaluation of passive systems In this section I describe the general Russian regulatory approach to evaluation of passive systems Vienna, June 6-9, 2017 8

Key regulatory requirements to evaluation of passive systems When designing the systems (elements) of NPP and Reactor Installation, it is necessary to give preference to the systems (elements) with design based on the passive principle of action and inherent safety features (self-control, heat retention, natural circulation and other natural processes) as well as on the fail-safe principle (Para 3.1.10 NP-001-15) Reliability of safety functions implementation → reduce the number of active components and (or) support systems → reduce maintenance and testing efforts → sources for failures may be reduced New VVER NPP designs: Passive heat removal systems -design solutions to cover specific BDBA (SBO, loss of UHS) Сurrent regulations adopted in the nuclear power industry contain almost no specifications to principles of design of passive safety systems used for removal heat from reactor so the same regulatory requirements used for evaluation of the passive safety systems that are used for the active safety systems. However, There are some differences exists that you can see in the next slides First of all! In accordance with the requirements of the Russian safety regulation “General provisions for ensuring safety of nuclear power plants” in the design of NPP systems priority shall be given to systems the design of which is based on the passive principle of action. Based on this the set of passive systems was introduced into Russian NPP designs. Such systems is providing reliable implementation of one of the major safety functions - removal of heat from the reactor in accident scenarios with total station blackout along with emergency scenarios with loss of ultimate heat sink. But these systems generate new questions during the safety review of NPP, for instance the proof of their effectiveness for implementation of safety function. Vienna, June 6-9, 2017 9

Key regulatory requirements to evaluation of passive systems “The established limits for design basis accidents shall not be exceeded at any initiating event considered by the NPP design with a coincidental independent failure of one of the following safety system elements according to the single failure principle: an active element or a passive element with mechanical movable parts, or a passive element without movable parts whose probability of safety function performance failure is equal to 10-3 or higher or one human error independent of the initiating event. … Failures of elements (systems which they make part of) may not be considered if high level of their reliability is demonstrated or when the element (system) is in outage for a determined period of time for maintenance and repair. The reliability level is considered to be high if indicators of reliability of elements (systems) are not lower than appropriate indicators of the most reliable passive elements of safety systems without movable parts. …” (Para 1.2.12 NP-001-15) Let's consider the requirements one by one According to General safety provisions requirement failure criteria is applied simultaneously to active and passive systems. Part of the text of this requirement is shown on the slide. The above-mentioned requirement reflects some differences in approaches to the consideration of failures of passive and active systems. Vienna, June 6-9, 2017 10 10

Key regulatory requirements to evaluation of passive systems Passive safety systems (as the active systems) and elements shall be capable of performing their functions within the NPP designs cope and with due consideration of the natural effects, external human induced events typical for the NPP site and (or) under possible hydraulic, mechanical, thermal, chemical and other impacts occurred as a result of accidents at which work of the considered systems and elements is required (Para 3.1.8 NP-001-15) Passive systems mainly designed to fulfill their function in case of SBO or/and loss of UHS: Passive systems mainly designed to fulfill their function in case of SBO or/and loss of UHS (when the operation of active systems is failed) consequently the special attention should be directed to the hazards which can lead to SBO and loss of UHS. The protection from these hazards shall be performed by SAR. special attention should be directed to the hazards which can lead to SBO and loss of UHS Vienna, June 6-9, 2017 11 11

Principles applied to combination of active and passive systems Key regulatory requirements to evaluation of passive systems All safety systems shall be designed and protected to tolerate common cause failures by applying the principles of diversity, redundancy and independence (Para 3.1.9 NP-001-15) Principles applied to combination of active and passive systems Safety function 33% 33% The existing of active systems that fulfill the same safety function shall be taken into account when assessing the fulfilment of protection from common cause failure for passive systems 100% Passive system Active system 33% 33% 100% Vienna, June 6-9, 2017 12 12

Key regulatory requirements to evaluation of passive systems Passive safety systems should be tested, including their active components, during commissioning and in operating plants to the extent feasible to assure their compliance with the design parameters Direct and full checks are preferable but if performance of direct and/or full checks not be possible indirect and/or partial checks shall be carried out Adequacy of indirect and/or partial checks shall be validated in the NPP design (para 3.1.14 NP-001-15) Passive safety systems, as any safety systems, should be tested, including their active components, during commissioning and in operating NPP to the extent feasible to assure their compliance with the design parameters. Vienna, June 6-9, 2017 13 13

Key regulatory requirements to evaluation of passive systems Reliability analyses of fulfillment of functions by the passive safety systems shall be presented in SAR (para 3.1.17 NP-001-15) General approaches of fulfillment qualitative and quantitative reliability analysis of safety important systems, including features of the analysis of the reliability of systems with passive elements: Reliability analyses of passive systems shall be included in SAR. General approaches of fulfillment qualitative and quantitative reliability analysis of safety important systems described in new Regulatory guide in which one of the last chapters is devoted the features of the analysis of the reliability of systems with passive elements. RB-100-15 Regulatory guide. Recommendations in order of execution reliability analysis of systems and components of nuclear power plants important to safety and their functions Vienna, June 6-9, 2017 14 14

Key regulatory requirements to evaluation of passive systems Confirmation of the actual characteristics of passive systems is performed during the commissioning of the NPP unit, while the characteristics of equipment and systems, design limits and conditions will be specified (para 4.2.4 NP-001-15) Based on the results of commissioning, a final version of the FSAR should be developed, that contains information on the results of the carried out tests, including the refined information of the systems. The Licensee should justify in the FSAR that the passive systems, according to the results of commissioning, correspond to the initially presented data, and the characteristics of the systems obtained from the results of calculations and experiments are confirmed (para 4.2.6 NP-001-15) Confirmation of the actual characteristics of passive systems is performed during the commissioning of the NPP unit. Results of commissioning shall be included in final version of FSAR. They should confirmed the data obtained from calculations and experiments. Vienna, June 6-9, 2017 15 15

Key regulatory requirements to evaluation of passive systems Passive safety systems should be described in Safety Analysis Reports (SAR) at the same level of detail as the other safety systems; When safety function can be fulfilled by either active or passive safety system the SAR (Chapter 15) should contain substantiation for both cases: a) when only active systems are in operation and b) when only passive systems are in operation; False actuation (starting) of passive system should be evaluated as one of initiating event (as a rule the false actuation of PHRS SG is considered) According to the requirement to content of SAR Passive safety systems should be described in Safety Analysis Reports at the same level of detail as the other safety systems If safety function can be fulfilled by either active or passive safety system the SAR should contains substantiation for both cases: a) when only active systems are in operation and b) when only passive systems are in operation NP-006-16. Requirements for the content of safety analysis report for nuclear power plants with VVER type reactors (new version) Vienna, June 6-9, 2017 16 16

Key regulatory requirements to evaluation of passive systems Requirements for safety valves, hydraulic test, materials used to manufacture of passive system components without any difference from active systems, are applied for (elements under pressure of the working medium) of passive systems NP-089-15. Rules for design and safe operation of equipment and pipelines of nuclear power installations (new version) In case of passive systems (their pipelines) penetrating the containment and communicating with the reactor coolant or containment atmosphere (isolation valves and etc.) NP-010-16. Rules for arrangement and operation of nuclear power plant confining safety system (new version) Requirements to elements under pressure of the working medium and elements penetrating the containment and approaches to their fulfillment the same for passive and active systems Vienna, June 6-9, 2017 17 17

Main regulatory requirement for passive systems evaluation Key regulatory requirements to evaluation of passive systems “Technical and administrative decisions made for NPP safety ensuring shall be well proven by the previous experience or tests, investigations, operating experience of prototypes. …” (Para 1.2.7 NP-001-15) Main regulatory requirement for passive systems evaluation The new passive safety systems that considering in this presentation are innovative technical means so they can be allowed in plant design if there is sufficient substantiation from necessary calculations, experimental studies and operational experience So one of the important issues assessed in the course of review is the fulfillment of requirement that “Technical decisions made for NPP safety ensuring shall be well proven by the appropriate substantiations” Vienna, June 6-9, 2017 18 18

Key regulatory requirements to evaluation of passive systems SAR (or some topical reports referenced in the SAR) shall present: Sufficient substantiation of systems operability by calculations, experimental studies and (or) operational experience) Applicability of thermo-hydraulic computer programs (codes) used for safety justification: codes shall be verified and certified Analysis of the compliance of experimental conditions with the actual conditions of the system Next information should be submitted by the Licensee and shall be carefully checked by Regulator - Existence of sufficient approbation of systems - Applicability of thermo-hydraulic codes for calculation - Analysis of the compliance of experimental conditions with the actual conditions of the system, if the experiments were conducted. (Experimental base, metrological support of experiments, main results of the experiments) Vienna, June 6-9, 2017 19 19

Key regulatory requirements to evaluation of passive systems When the calculations and experimental studies of passive safety systems are implemented, the following issues should be taken into account: sufficiency of heat removal from reactor: with no time limitation or the providing explanation for time limitation 24, 72 or more hours (for water-cooled PHRS: the measures on inventory make-up are to be envisaged) in any weather condition (for air-cooled PHRS: temperatures or wind speed) potential interactions of active and passive systems or/and different passive systems foreseen to operate simultaneously: potential negative interactions i.e. interactions worsening their reliability During the review of submitted documentation the reviewer also have to pay attention to next issues: - sufficiency of providing for the function of heat removal from reactor with no time limitation or the providing some explanation for time limitation; - potential negative interactions of systems: - possible delays in systems operation and etc. Vienna, June 6-9, 2017 20 20

Key regulatory requirements to evaluation of passive systems possible delays in systems activation caused by various reasons: such time interval shall not exceed time period when the accidents’ evolving into the severe condition is being prevented because of natural processes related to coolant heating and boiling-off (in SGs, in primary circuit) possible negative effects of non-condensable gases: measures to prevent collection of them into the heat exchangers # During the review of submitted documentation the reviewer also have to pay attention to next issues: - sufficiency of providing for the function of heat removal from reactor with no time limitation or the providing some explanation for time limitation; - potential negative interactions of systems: - possible delays in systems operation and etc. Vienna, June 6-9, 2017 21 21

Key findings of safety review in regard to passive systems (by the example of Novovoronezh NPP-2) Today the safety review of Novovoronezh NPP-2 and Leningrad NPP-2 are in different stage of implementation. For Novovoronezh NPP-2 review of preliminary version of Final SAR is finished – the unit got a license for operation. For Leningrad NPP-2 review of preliminary safety analysis report is finished and review of preliminary version of final SAR is ongoing. This section presents the example of key findings regarding passive systems, found during the fulfilment of safety review of Novovoronezh NPP-2 based on regulatory approach described previously. Vienna, June 6-9, 2017 22

Substantiation of the PHRS & HA-2 characteristics: Novovoronezh NPP-2. Key findings of safety review (Air-cooled PHRS & HA-2) Substantiation of the PHRS & HA-2 characteristics: start-up characteristic, start-up time under the minimum and maximum external temperatures; reliability of the PHRS lock valve and air controller some others PHRS efficiency in case of LOCA, active ECCS failure, and non-condensable gases entering heat exchange area of the steam generator Efficiency of PHRS heat exchangers in case of the impact of non-condensable gases inside PHRS’s steam condensate tract For aerial PHRS the next issues war revealed in course of safety review: Lack of sufficient substantiation for: - characteristics of PHRS and HA-2 - PHRS efficiency in case of LOCA, active ECCS failure, and non-condensable gases entering heat exchange area of the steam generator - evaluation of the impact of non-condensable gases inside PHRS’s steam condensate tract on the efficiency of system heat exchangers; Vienna, June 6-9, 2017 23

Novovoronezh NPP-2. Key findings of safety review (Air-cooled PHRS & HA-2) PHRS efficiency in case of multifactor impact of on-site fire (high temperature and air humidity decrease on the entrance of the PHRS air intake): possible downflow air movement streaming around the containment, reverse flow in the PHRS air ducts on the outer side of the compartment opposite the fire can deteriorate performance of a PHRS heat exchangers Efficiency of the HA-2 system, taking into account joint operation of PHRS and HA-2 (calculated and experimental substantiations of the efficiency of passive safety systems operation in case of LOCA, taking into account the interaction of primary circuit, passive systems (HA-2 and PHRS), containment and the impact of non-condensable gases); PHRS efficiency in case of extreme wind impact PHRS efficiency in case of on-site fire and external impacts wasn’t shown by Applicant Also one of the most significant issues risen in course of safety review was lack of substantiation of the efficiency of the this system, taking into account joint operation of HA-2 and PHRS (common question for both system efficiency) Vienna, June 6-9, 2017 24 24

Complex of additional calculated and experimental substantiations Complex of additional calculated and experimental substantiations. Example General view of one of the experimental units Aerodynamic stand that provide substantiation of the PHRS protection from the wind impact. The base of the stand - air tunnel (tube) CIAM* (outlet nozzle 25 m2). The stand ventilation system creates a high-speed air flow up to 300 km/h. In the wind tunnel placed model of the main building (scale 1:90), including reactor compartment, turbine building, vent pipe, etc. Here the example of one of the experimental units that provide substantiation of the PHRS protection from the wind impact * CIAM - Central Institute of Aviation Motor Development Vienna, June 6-9, 2017 www.secnrs.ru 25

Positive conclusions of the final review Novovoronezh NPP-2. Results of safety review Applicant: fulfilment of full-scale complex of the calculated and experimental substantiations of the HA-2 and PHRS performance efficiency Additional information: SAR, including Chapter 15 “Accident analysis” Topical reports referenced in SAR Regulatory Body (with technical support organisation): Assessment of results of background calculations, tests and experimental justification based on specially constructed experimental stands But finally as a result of the full-scale complex of the calculated and experimental substantiations of the HA-2 and PHRS performance efficiency fulfilled by the Applicant the Regulator provide a positive conclusion about NPP. Positive conclusions of the final review were based on assessment of the topical reports which contained results of background calculations, tests and experimental justification that were submitted by the Licensee to the Regulatory Body, along with additional information as provided in SAR. Positive conclusions of the final review Vienna, June 6-9, 2017 26 26

Conclusion Passive safety systems in new VVER design are one of the important elements (along with active systems) of DiD and provide significant contribution to the safety, especially in case of the BDBA (DEC) involving SBO and loss of UHS Experience of safety review has shown that: available regulatory requirements valid are sufficient to assess passive systems safety and the effectiveness of their performance of safety functions main attention was paid to the verification of sufficiency and completeness of the justifications of passive systems (experimental and calculated) and their potential interactions with other systems Conclusion Passive safety systems are one of the important elements (along with active systems) of defence-in-depth. Available regulatory requirements are sufficient to assess their safety and the effectiveness of their performance of safety functions. Important issue that should remain in the sphere of the regulator's attention is the evaluation of the experience of operating passive systems. In Future important issue that should remain in the sphere of the regulator's attention is the evaluation of the experience of operating passive systems Vienna, June 6-9, 2017 27

Thank you for your attention ! Federal Environmental, Industrial and Nuclear Supervision Service Scientific and Engineering Centre for Nuclear and Radiation Safety Thank you for your attention ! Vienna, June 6-9, 2017 www.secnrs.ru