1. ROSATOM
STATE ATOMIC ENERGY CORPORATION “ROSATOM”
Safety of new Russian VVER designs with an account of the lessons, learned from Fukushima Daiichi accident and new IAEA requirements
Sergey Boyarkin
Bratislava, Slovakia
February 27, 2013 1

2. Main safety objective in NPP design
The main safety objective in the NPP design is elimination of possibility of an accident, which may cause significant radioactive release.
A necessary condition for meeting this safety objective is provision of three fundamental safety functions.
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

3. Fundamental safety functions
The three fundamental safety functions are:
Reactivity control
preventing uncontrolled increase of reactor power
ensuring fast safe shutdown of the reactor when needed
Removal of decay heat to the ultimate heat sink
cooling of the shutdown reactor
cooling of the used nuclear fuel
Confining radioactive materials
preventing significant radioactive releases
to the environment
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

4. Lessons, learned from Fukushima Daiichi accident (1)
Main lessons, learned from Fukushima Daiichi accident are:
The three fundamental safety functions have to be provided even in case
loss of AC power and/or
loss of possibility to use ultimate heat sink
The systems providing fundamental safety functions have to be protected against all conceivable environmental hazards – natural and manmade
Containment has to be protected so that it prevents large radioactive releases even after a core meltdown
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

5. Lessons, learned from Fukushima Daiichi accident (2)
In the international meetings after Fukushima accident the key word, emphasized in discussions of the NPP safety techniques was diversity.
It means that each of the fundamental safety functions must be provided by different safety systems that can be used independently and in a flexible manner, depending on the accident scenario.
Use of only active either only passive systems does not provide reliable protection.
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

6. Lessons, learned from Fukushima Daiichi accident (3)
Implementation of each of the three fundamental safety functions should be provided by various independent safety systems:
1. Active systems with electrical power sources
The power sources supplied from off-site and on-site should have multiple redundancy and diversity
Electrical power should be supplied by the system where the elements under redundancy are properly separated
2. Active systems with electrical power sources, supplied from a specific source, applied for this system
For instance, a diesel generator supplying power to certain systems and turned on only when the other power supplies have been lost;
(list continues on the next slide)
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

7. Lessons, learned from Fukushima Daiichi accident (4)
(list continues from the previous slide)
3. Active systems which do not require any electrical power
systems operated by diesel driven pumps, manually operated shut-off valves, manually operated.
4. Passive systems with proven operability in all conceivable situations.
5. Systems relying on transportable power sources and pumps:
power sources should cover an appropriate capacity and voltage range, and pumps should cover an appropriate operability and head-pressure range.
The design should provide connection points of transportable sources and pumps
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

8. Lessons, learned from Fukushima Daiichi accident (5)
The operability of passive safety systems, provided for rare accidents, should be proved by regular control and analysis:
The operability should be provided in any circumstances and in any environmental conditions
The natural system circulation should be provided even in cases of allocation and accumulation of soluble non-condensable gases
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

9. Lessons, learned from Fukushima Daiichi accident (6)
In order to facilitate operation of safety systems in a station black-out situation, it is necessary to provide power to
Lighting,
Life-support system in control rooms
I&C system
Redundant power in these systems should be provided with the long-term accumulators. The technical possibility if their recharge from the motor driven generators should be provided. There should be several recharging sockets and they should be placed along the NPP site.
Efficient suppression of oil and cable fires should be provided by advanced systems such as high density water fog systems.
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

10. Lessons, learned from Fukushima Daiichi accident (7)
At least some systems providing the fundamental safety functions should have robust physical protection against all conceivable external hazards
The robust physical protection of redundant power sources on- and off-site is also needed.
The combustible materials should be eliminated from the use
For instance, pumps and their motors should preferably use water (rather than oil) as lubricant and cooling media
An effective fight against fires should be provided with the help of advanced systems, which do not use toxic gases, such as high density water systems ”fog”.
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

11. VVER fleet today
Today there are 54 units with VVER technology under operation in 10 countries of the world. Among them 18 VVER units, operated in 5 countries of EU, have passed successfully European stress-tests and are in compliance with all modern safety requirements.
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

12. New VVER type plants
Today there are two WWER design of generation III+:
- VVER with power of 1000 MW
- VVER with power of 1000 MW
These two WWER designs have several configurations (for different conditions):
VVER-1000: NP-91, NP-92,
VVER-1200: NPP-2006/LNPP and NPP-2006/NVNPP.
In VVER plants of generation III+ all the factors further called ”lessons learned from Fukushima Daiichi” were taken into account even before the accident happened.
Following plants of WWER design of generation III+have been already constructed or are under construction:
NPP-91: Tianwan 1-2 (China, in operation), units 3-4 (under construction)
NPP-92: Kudankulam 1-2 (India, in start up), Belene (contract in Bulgaria)
NPP-2006/LNPP: Leningrad II/1-2 (under construction), Baltic 1-2 (construction), Belarus 1-2 (contract in Belarus), Temelin 3-4 (bidding in Czech Republic)
NPP-2006/NVNPP: Novovoronezh II/1-2 (under construction)
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

13. Advanced systems in new VVER plants of generation III+
All new VVER plants that are under construction take into account ”Fukushima lessons”and provide:
long term cooling of reactor core and SNF pools without AC power,
long term decay heat removal which doesn’t rely on primary ultimate heat sink,
protection of reactor containment integrity after potential core meltdown accident
Passive safety systems would protect the reactor core from severe damage even in case of Large Break LOCA occurring in coincidence with a complete loss of AC power.
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

14. Reactivity control (1)
Nuclear reactor remains shutdown when control rods have been inserted.
PWR reactors (USA, Europe) and VVER type reactors have control rods that drop to the reactor when power to electromagnets holding the rods in position above the reactor is cut. After that the fast reactor shutdown occurs even if some rods fail to drop as planned.
In the PWR plants and in the older VVER plants the reactor remains shutdown only as long as the coolant temperature is kept high. The reactor re-starts to small power if the coolant temperature decreases (in the operating standard of VVER reactors the critical temperature is 190°C and in the most PWRs it starts earlier – with more than 200°C).
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

15. Reactivity control (2)
Due to their inherent design features, the reactors of the PWR plants and the older VVER plants would re-start in connection with certain disturbances. Furthermore they cannot be taken to safe shutdown condition without adding boron to the reactor (it is a second”diverse” shutdown system).
In these reactors ensuring long term reactor shutdown in all circumstances requires adding boron to the coolant which subsequently requires electical power.
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

16. Reactivity control (3)
All WWER reactors of generation III+ have a unique safety feature which is missing in the older PWR or WWER type plants:
IF THE CONTROL RODS ARE INSERTED TO THE CORE THE REACTOR WILL STAY IN SHUTDOWN STATE ALSO IN LOW TEMPERATURES
This has been achieved by increasing of a number of control rods and by their effectiveness in neutron capturing.
It is not necessary to add boron to the coolant for ensuring long term safe cold shutdown. However, for realizing a “diversity” principle while managing reactivity control there are boron injection systems in these designs.
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

17. Reactivity control (4)
In addition to the effective control rods, VVER reactors of generation III+ are equipped with PASSIVE and ACTIVE boron injection systems, that can pump boron liquid to the reactor in case the control rods would not drop to the reactor core for any reason.
PASSIVE system injects boron liquid from two tanks, which are under the pressure and doesn’t need any electrical power.
ACTIVE boron injection system has four identical parallel pumps. Operation of two pumps is enough for fast shutdown of the reactor so that the reactor fuel is not damaged in any accident scenario.
If there is no reason for an emergency reactor shutdown, operation of one pump is enough!
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

18. Decay heat removal systems
In new VVER types, decay heat can be removed in three different ways:
by active systems to the main ultimate heat sink,
by active systems to the spray ponds,
by active systems to the atmosphere (SG feed and bleed)
by passive systems to the atmosphere.
THE COMBINATION OF ACTIVE AND PASSIVE SYSTEMS IS A UNIQUE FEATURE OF OUR DESIGN. OUR DESIGN FITTS COMPLETELY THE SAFETY SYSTEM ”DIVERSITY” REQUIREMENTS, WHICH ENSURES THE FUNDAMENTAL SAFETY FUNCTION – DECAY HEAT REMOVAL IN ANY CIRCUMSTANCES, INCLUDING FULL POWER LOSS AND SIMULTANEOUS ULTIMATE HEAT SINK FAILURE.
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

19. Passive decay heat removal from SGs (LNPP)
Passive system for decay heat removal from reactor via steam generators to atmosphere (PSHR-SG)
1 – emergency heat removal tanks (EHRT)
outside containment ; heat is removed by
boiling of water in EHRTs in atmospheric
pressure. There are 4 tanks.
2 – steam lines
3 – condense pipes
4 – PSHR-SG valves
5 – heat exchangers of containment heat
removal system PSHR-C (see slide 26); it is a
separate system but it uses the same EHRTs]
6 – steam generators
7 – cutoff valves
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

20. Passive decay heat removal from SGs (LNPP)
Operation of 3 out of 4 EHRT tanks provides cooling for 24 hours, all 4 tanks for 72 hours
After Fukushima, a fixed battery driven pump was added to design that can refill the EHRT tanks and spent fuel pools from a separate storage tank, batteries have a capacity for 72 hours.
Also, jacks for connecting external diesel generators for battary recharging were added. It provides cooling without time limit.
Furthermore, preserved jacks for transportable diesel driven pump that can also refill EHRT tanks and spent fuel pools were added. They use water, supplied from fire trucks or other on-site sources.
All transportale devices have well protected shelters in separate locations near site.
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

21. Passive decay heat removal from SGs (NVNPP)
Atmospheric air
Hot air
Reactor
Steam generator
Filters
PHRS
Hydrogen recombiners
Annulus
Passive filtration
draft pipes
The passive heat removal system provides removal of the reactor decay heat to the atmosphere.
No need to add any water and thus no time limit for function
The system consists of four independent (4x33%) loops
Each loop has devices controlling air flow for graduate cooling of primary circuit at proper rate.
Hydrogen recombiner
Atmospheric air
Separate passive system maintains vacuum in annulus. Filters preserve from possible radioactive leakages

22. Systems to cope with LOCA (NVNPP)
Reactor
Pressurizer
RCP
Steam generator
Passive heat removal system from the steam generator
Annulus
System of 1st-stage hydro accumulators
System of 2nd-stage hydro accumulators
Passive annulus filtration system
Inner
containment
Outer containment
Primary circuit
Corium catcher
Active emergency core cooling system (ECCS)
Main steam
RCP
Condenser
HPH
Diaerator

23. Containment of radioactive material (1)
A common view emerged after Fukushima Daiichi accident that special safety systems, independent from the “normal operation” systems have to be installed at all new plants for protecting the reactor containment after possible core meltdown accident.
The ”severe accident management” based only on existing hardware designed for other purposes, as applied in most of the currently operating NPPs is not any more acceptable at new plants.
IN VVER DESIGN OF GENERATION III+ ALL THESE NEW SAFETY REQUIREMENTS HAVE BEEN ALREADY REALISED.
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

24. Containment of radioactive material (2)
The protection of the containment after possible reactor core meltdown requires that all physical phenomena that could threaten the containment integity are taken into account in design. These include:
reactor core meltdown in high primary circuit pressure,
containment overpressure due to the steam generated inside the containment
accumulation of hydrogen inside the containment
penetration of the molten reactor core through the containment bottom
recriticality of the molten reactor core
A special equipment, which functions in case of emergency, is necessary for controlling a severe accidents.
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

25. Containment of radioactive material (3)
AT ALL NPP-2006 TYPE PLANTS, PROTECTION OF THE CONTAINMENT INTEGRITY IS BASED ON PASSIVE SYSTEMS THAT DO NOT NEED ELECTRICAL POWER, WHICH IS OPPOSITE TO THEOTHER NPPs WHERE ACTIVE SYSTEMS ARE GENERALLY DESIGNED FOR SEVERE ACCIDENT MANAGEMENT.
Some new plants still offered in the market do not have dedicated systems for protection of containment integrity after core meltdown accident.
The following slides present systems that are designed for
containment overpressure limitation by condensing the steam generated inside the containment
hydrogen removing by recombining to avoid an explosion possibility
localization of the molten reactor core
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

26. Containment overpressure limitation (LNPP)
Passive system for heat removal from the containment (PSHR C)
PSHR-C condenses all steam generated in boiling of water inside the containment and is a back-up system to protect containment from overpressure in connection with accidents where active Containment Spray System (4 x 50 %) is not able to operate.
PSHR-C uses the same EHRT tanks as PSHR-SG for discharging the heat by boiling of water to the atmosphere.
PSHR C has 4х33% capacity soon after reactor shutdown and more than 4 x 50 % after one day.
Steam condensing heat exchangers
EHRT tank
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

27. Hydrogen removal system (today installed at all NPPs in Russia)
Hydrogen can appear in the accident if there is a large leak from the primary coolant. It is generated in chemical stem- zirconium reaction.
The hydrogen removal system consists of a large number of passive autocatalytic hydrogen recombiners where hydrogen is recombined with oxygen. The reaction generates water. It prevents formation of explosive mixtures inside the containment.
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

28. Molten core catcher
Placed below the reactor vessel to protect the containment structures against impact of molten core (melting temperature may overcome 2000°C). Core catcher retains and cools core melt and solid fragments of the core. It transfers passively heat to the cooling water surrounding the “core melt pot” and thus ensures long term cooling and solidification of the molten core Molten core is mixed with material absorbing neutrons, that excludes chain reaction inside the core catcher. Core catcher decreases significantly the hydrogen generation and radionuclides transfer into the containment.
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

29. Other advanced safety features of new VVERs (1)
An important issue connected directly with complete loss of electrical power is potential leak from the seals of the primary circuit circulation pumps.
Most PWR plants have pump seals that start leaking in about one hour if cold water is not injected to the seals; water injection to the seals requires electrical power; pump seal leak causes loss of water from the primary cooling circuit and may lead to severe reactor accident (LOCA), if electrical power is lost for several hours
All VVER type plants are equipped with pumps with a seal structure that ensures minimum leak in all conceivable circumstances: according to the tests it is less than 200 liters per day.
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

30. Other advanced safety features of new VVERs (2)
Inspite of passive safety systems, new VVERs have strong electrical power supply systems, both from offsite grid and from onsite independent power sources. Thus also the function of active safety systems is ensured equally well as at most of the operating NPPs in the world.
Offsite power connections are ensured by at least two separate high voltage transmission lines from different directions bringing power to the plant via three separate transformers
Onsite power sources are: one or two onsite diesel generators plus four backup diesel generators. In total each unit has five or six diesel generators.
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

31. Other advanced safety features of new VVERs (3)
Certain advanced design solutions have been developed to improve safety at VVERs
Advanced primary circuit main circulation pumps and their motors have water cooling and water lubricated bearings (other designs have oil cooling that entails risk of fire)
For fire protection there are”high fog” systems. They are water based, thefore not toxic and not hazardous for operating staff.
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

32. Other advanced safety features of new VVERs (4)
In the first days after an accident, the release of radioactive iodine would cause the largest radiological risk to the people living in the neighborhood.
New VVER containments are equipped with a system spraying reagent that chemically binds the iodine released to the containment air space. This reduces the iodine releases from the containment.
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

33. Conclusions
The new VVER plants, generation III+ have safety design features that take into account the latest safety requirements, including ”post-Fukusima experiences”.
The ”diversity” principle has been realised: all fundamental safety functions are ensured by multiple different safety systems, both active and passive.
The VVER safety principles have been developed already before the Fukushima Daiichi accident. Similar design principles were approved at the European discussions in spring 2012, including IAEA Extraordinary meeting on Fukushima Daiichi accident.
These safety features include:
possibility for long term decay heat removal from the reactor core without AC power
possibility for long term decay heat removal that is not relying on primary ultimate heat sink
protection of the reactor containment integrity after potential core meltdown accident.
The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information.