The structural components of the plant are designed in accordance with the specification set forth in "Design Safety Regulations of Nuclear Power Plants (OPB-88)" . The generic requirement of this document is that safety-related systems and elements of nuclear power plants have to be able to fulfill their functions under all conditions. This implies that they have to accommodate stresses imposed by natural phenomena as well as mechanical, thermal, chemical and other impacts which may arise during design basis accidents.
The term "external events" (relative to a nuclear power plant) covers such natural phenomena as a earthquakes, flooding, strong winds, lightning, snow and ice, and such man-made events as aircraft crashes, industrial explosion, sabotage and terrorist action. On site fire and flooding are usually also considered as external events.
220.127.116.11 Air-Shock Wave
Buildings and other constructions unit 1 and unit 2 of the Ignalina NPP were designed and built without taking into account the influence of the air-shock wave, because corresponding requirements were put into operation only after the beginning of year 1987 .
Before construction started at the Ignalina NPP, the Research and Development Institute for Energy Technology, St. Petersburg (at that time Leningrad), Russia, performed a number of studies on the response of structures subjected to a step air shock wave of 10 kPa with the duration of up to 1 s, as required in the code . The structural components under investigation were similar for all three units of the Ignalina NPP. The calculations show, that such a wave would destroy the following structures:
The studies showed that in this event the loading on equipment due to oscillations of the structures was below the load due to, for example, an earthquake of magnitude 6 on the scale MSK-64 (see Subsection 18.104.22.168).
According to reference  an analysis of the "Rupture of the dam (weir) of the cooling water pond" was not necessary, because the source of cooling of the Ignalina NPP is the water from lake Druksiai. In order to justify this, changes of the water level in lake Druksiai must be considered. According to available records a maximum water level was 142.26 m in 1953, and the minimum -140.76 m (above see level) in 1964 .
In normal operation of the Ignalina NPP and for supporting calculation of water level in lake Druksiai, there is the addition of spring floods and rain-water, as well as the effects of the hydro-engineering complex on the river Prorva. In case of destruction of this structure and the dam of the hydroelectric power plant, the water level in lake Druksiai would drop to the level of river Prorva, which is 140.20 m.
In case of destruction of the earthen dam on the river Drukse and return of the flow to the old river-bed, the influx of water into lake Druksiai would decrease by about 20 %. Temporary elimination of the dam on the river Drukse would not lead to a sharp lowering of the water level in lake Druksiai.
Safety analysis of nuclear power plants, according to reference , requires the consideration of an "Aircraft crash on the reactor hall". The consideration of this event is proposed in a list of hypothetical accidents defined in 1990 by the Kurchatov Atomic Energy Institute, Moscow, Russia. This requirement was imposed after completion of the Ignalina NPP.
The requirements for considering an aircraft crash therefore were not imposed on any RBMK plant. This was due mainly to three major considerations:
Note, that the nearest air route Svir-Rokisškis is ten km to the West of the Ignalina NPP. In 1990 a total number of flights along the Lithuanian air routes was 65000. During the last 30-year period there were no commercial aircraft crash accidents in Lithuania
Seismic stability is the ability of equipment and structures to maintain integrity during seismic loading. This implies the maintenance of strength, tightness, maintainability, nuclear and radiological safety and the absence of residual deformation, which encumber normal operation .
The standard of seismic stability in the former USSR was the MSK-64 scale, which was established by the Earth Physic Institute, Moscow, Russia. Fig 3.1 provides a comparison between the MSK-64 scale and two other scales in common use. According to the MSK-64 scale, forces correspond to the following acceleration ranges of soil for periods from 0.1 to 0.5 s :
forces 5 - 0.12-0.25 m/s2,
forces 6 - 0.25-0.50 m/s2,
forces 7 - 0.50-1.0 m/s2 and so on.
For Soviet-designed NPPs two levels of seismic impact were taken into account: (a) the design earthquake, and (b) the maximum possible calculated earthquake. The first is a maximum earthquake, which may happen during the life-time operation of the NPP. The second is the maximum possible earthquake in the area in question. As a rule, for design purposes the maximum calculated earthquake employs an MSK-64 scale one force higher.
During construction it is necessary to guarantee the seismic stability not only for the building being constructed, but also for equipment, reactor control and protection system, control and measuring devices and others.
Fig. 3.1 The relation between seismic scales
MSK - Modvedev, Spanheuer, Karnik
MMIS - Modified Mercalli Intensity Scale
JMA - Japan Metrological Agency
Seismic Stability Categorization for the NPPs with RBMK - type Reactors
Depending on the need for functionability during and after the earthquake, all systems, equipment and structures of NPPs with RBMK-type reactors, are designed according the "Code for Designing of seismic-resistant nuclear power plants" . The structures are divided into three seismic stability categories.
The first category is in turn divided into three groups. The first group encompasses systems or elements for which damage and loss of integrity could lead to releases of radioactive products in such amounts that they would result in radiation exposure to inhabitants above the established codes for a maximum design basis accident. The following systems of the NPP belong to this group:
The second group of the first seismic stability category includes the safety systems which protect the reactor core, the emergency heat removal systems from the reactor, and also the confinement system for radioactive products. The following safety systems belongs to this group:
Third group of the first seismic stability category includes those buildings, structures and equipment for which damage would lead to failure of reactor operations. This group consists of:
The second seismic stability category encompasses those systems, equipment and structures (not included in the first category), for which failure can lead to radiation levels above the permissible annual level for normal operations. This category is divided into two groups.
The first group of the second seismic stability category includes systems, equipment and constructions, which are located inside of the accident confinement zone:
The second group of the second seismic stability category includes:
Systems, equipment and structures, which are not included in the first and second categories, belong to the third seismic stability category.
Seismic Stability of Structures, Equipment and Pipelines
Calculations of seismic stability criteria for the Ignalina NPP structures, equipment and pipelines were conducted by the Research and Development Institute for Energy Technology, St. Petersburg (at that time Leningrad), Russia. These calculations were performed using a linear spectral theory of seismic stability. Calculation results of the main and auxiliary facilities are shown in Table 3.1. The seismic stability of buildings is given according to the above mentioned MSK-64 scale.
For the Ignalina NPP area the design earthquake magnitude is 6 forces and the maximum possible calculated earthquake magnitude is force 7 according to the MSK-64 scale. This requirement implies, that some structures of the Ignalina NPP need to be strengthened. According to the above listed estimates, the following structures are subject to alterations:
Table 3.1 Seismic stability of the Ignalina NPP structures
Seismic stability, force
Reactor building (A)
Deaerator building (D) and Turbine hall (G)
Building of the ECCS accumulators
Redundant diesel-generator building
Building of service-water pumps:
- part below ground
- building frame
Primary system grade water tank
Trenches and tunnels for cables
A large part of the equipment within the first and second units of the Ignalina NPP do not comply with the seismic requirements. Calculated results of pipeline seismic stability show, that they correspond to standards .
Thus systems, equipment and structures of the Ignalina NPP do not fully comply with seismic stability standards. Measures aimed at reinforcing the existing building and equipment components are expensive, and are considered by plant experts as unfeasible. However, aftereffects of an earthquake will be diminished if the reactors are promptly shut down prior to the seismic wave approaching the plant. The implementation of the seismic monitoring system is under progress in accordance with Safety Improvement Program of Ignalina NPP .
The "internal" events which can impose loads on structures and equipment are events anticipated or postulated to occur as a result of plant failures, i. e. malfunction of the reactor's normal operating and control system.
22.214.171.124 Postulated Piping Ruptures
The safety analysis of the NPP with RBMK - type reactors considers the following ruptures of pipes and system components:
This Subsection discusses the initiating event itself, symptoms of the accident, direct consequences and measures to eliminate or limit the anticipated consequences. A quantitative analysis of the most significant accidental transients are presented Section 11 of the Ignalina RBMK-1500 Source Book.
Rupture of the Fuel Channel
The following potential break locations of the fuel channel were investigated:
The rupture of the fuel channel inside of the reactor block can be diagnosed by the following symptoms:
When symptoms flagging a fuel channel failure are detected, the reactor emergency shutdown and cool-down is initiated. Reactor shutdown is initiated by either:
Simultaneous with the cool-down of the reactor, the damaged fuel assembly is removed from the fuel channel using the refueling machine. The emergency plug is utilized and the leakage is stopped by closing of the isolating and control valve of the damaged channel.
Rupture of the Water-Communication Line
The symptoms of a full or partial rupture of the water-communication lines are:
An increase of excess pressure to 2 kPa in the water communication compartments, activates the emergency protection (FASS, AZ-1) signal and the reactor power is decreased to zero. Subsequently the reactor cool-down process is initiated. If emergency symptoms are flagged, the reactor can be shut down by the operator using the button AZ-1.
After cool-down of the reactor, the fuel assembly is removed from the damaged fuel channel and an emergency plug is installed. Leakage is stopped by closing off the isolating and control valve.
Rupture of the Steam-Water Communication Line
A rupture of the 75 mm exiting line which carries the two-phase coolant from the core to the DS results in increased coolant flow rates within the damaged channel. Coolant flow is increased roughly in proportion to the break flow, consequently ability of coolant to maintain adequate temperatures within the channel is thus not impaired. During the pressurized phase of the transient critical flow conditions prevail for the break flow.
In case of the mentioned rupture, a leakage of the coolant from the MCC is insufficient to cause a strong change of the circuit parameters. However, because of loosing a large amount of active coolant, it is necessary to shut down and cool-down the reactor.
If any of the above symptoms appear, the operator must shut-down the reactor. The reactor emergency protection AZ-1 is activated by a pressure increase signal when the excess pressure reaches 2 kPa.
Water, which is discharged due to the rupture of the steam-water pipeline flows to the drainage lines of the 135m3 tank. From this tank water could be taken to the ACS hot-condensate chamber, or after the elimination of accident consequences, to contaminated demineralized water tank, the capacity of which is 1500 m3.
Rupture of a Group Distribution Header
Rupture of the 300 mm diameter group distribution header belongs to those accidents, which can cause considerable changes of the MCC parameters. The supply of coolant to the fuel channels connected to the ruptured group distribution header, depends strongly on the rupture location. The most severe rupture of the group distribution header is one which occurs beyond the check valve (taken in the flow direction). In this case all 43 fuel channels are cooled by backward flow of coolant from the drum separators. In this case the leakage rate is maximized, because the coolant flow, which is discharged through the restriction inserted in the MCP pressure header, is added to the leakage of the coolant from the emergency group distribution header through the 43 fuel channels from the separator drum and the ECCS headers.
The FASS reactor emergency protection signal is activated by an increase of excess pressure to 2 kPa in the water communication compartment. In order to simulate most unfavorable accident conditions, a
complicating event is assumed. Simultaneous with the activation of FASS, a loss of off-site power is assumed to occur. In this case, the main circulation pumps and main feedwater pumps are not available. The ECCS is put into operation by the simultaneous excess pressure signals and the decrease of the pressure differential (up to 0.6 MPa) between the MCP pressure header and the separator drum. Water from the ECCS is taken to the affected damaged-half of the reactor. ECCS operation is discussed in more detail in Section 6.4.
Safeguards for confinement of this accident lead to the closure of gate valves in the head, suction and bypass lines of the MCP headers. All channels of the damaged-half of the reactor, which are not connected to the affected group distribution header, are cooled by direct ECCS flow under maximum possible flow conditions. After an increase of the water level in the separator drum of the damaged-half of the reactor the channels of the ruptured GDH are cooled by backward flow.
Water, which escapes through the rupture of the group distribution header to the water-communication compartment, flows by way of the drainage lines to the 350 m3 tank. From this tank water could be taken to the ACS hot condensate chamber.
Rupture of the Downcomer from the Separator Drum
An accident rupturing one of the 325 mm, 16 mm wall thickness downcomers from the separator drum will have a more severe impact on cooling conditions of the reactor core. This is due to a lower discharge rate of saturated water from both sections of the ruptured piping. In this event, before the ECCS pumps are initiated, the reactor core is cooled by coast-down inertia of the MCPs.
To ensure most unfavorable accident conditions, simultaneous with the activation of FASS, a loss of off-site power is assumed. This leads to a shut-down of the turbine generators, the main circulation pumps and the main feedwater pumps. The reactor is cooled down by the ECCS pumps and the auxiliary feedwater pumps. Cladding failure does not occur, because coolant is provided to the reactor block without interruption.
Water, which escapes from the separator drum compartment, flows by way of the drainage lines to the 135 m3 tank, which are designed for maximum pressure possible in case of emergency in the separator drum compartment. From this tank water could be taken to the ACS hot-condensate chamber.
An accident rupturing one of the water cofferdam of the separator drum which have an outside diameter of 325 mm and a wall thickness of 16 mm will have a more severe impact on cooling conditions of the reactor core. This is due to a lower discharge of saturated water from both sections of the ruptured piping. Before putting into operation the ECCS pumps, the reactor core is cooled while the MCP is costing down.
Rupture of the Main Steam Line Before the Main Steam Gate Valve
Rupture of the 600 mm diameter main steam pipeline is characterized by a significant pressure decrease in the main circulation circuit, as well as by the release of a large amount of steam through the break. System operating parameters, such as pressure in the MCC, pressure differential between the MCP pressure header and the separator drum, liquid levels in the separator drum, etc., in both halves of the reactor change in a similar fashion, because of the 400 mm diameter steam connection between the two MCC halves through 4 cofferdams and the 8 steam discharge valves of type SDV-C. Simultaneously a loss of off-site power is assumed.
The reactor emergency protection FASS or AZ-1 are activated by one of the following signals:
In addition it is anticipated that the emergency protection AZ-1 is activated by neutronic signals from the reactor: either by exceeding the power limit or by an increase of the reactor power excursion period.
Before the ECCS pumps are turned on, the reactor core is cooled by the inertial coast-down of the MCP’s. Subsequently the ECCS provides cooling water to both halves of the reactor.
Rupture of the Feedwater Pipeline
The largest impact of a break in this component occurs for a full rupture of the 500 mm diameter feedwater pipeline extending between the separator drum and the feed control device. This regime is characterized by a significant dynamical variation of the main parameters of the MCC.
In the analysis a simultaneous loss of off-site power is assumed. In this case, turbine generators, main circulation pumps and main feedwater pumps are switched off.
The FASS and AZ-1 reactor emergency protections are activated by an increase of the gauge pressure 2 kPa in the separator drum compartment. The reactor is automatically shut down.
Water, from the ruptured of feedwater pipeline flows along drainage lines to the 135 m3 tank. From this tank water could be taken to the ACS hot-condensate chamber or to the contaminated de-mineralized water tank.
Rupture of the MCP Header or Pipes Leading to the Header
The largest diameter component of the primary system is the 900 mm MCP pressure header. Loss of integrity of this component cuts of the regular coolant supply to one half of the reactor. Therefore, the rupture of this component is defined as the DB-LOCA for an RBMK plant.
Rupture of the MCP suction header starts a coast-down of the MCP pumps in the affected half .The pumps have a cavitation margin more than 1.5 MPa. Moreover, after stalling of the MCP’s, their inertia provides a brief operating margin. This means, that the coolant supply to the affected half of the reactor is not terminated immediately.
The rupture of pressure or suction pipes to the MCP, which have an internal diameter of 750 mm, leads to a smaller loss rate of coolant and the initial failure of only one MCP pump.
Therefore, the instantaneous full cross-section rupture of the MCP pressure header, which has an internal diameter of 900 mm, with unimpeded discharge of coolant from both ends of the pipe while the unit is in full power operation is taken to be the maximum design basis accident.
The reactor emergency protection FASS is activated by a pressure increase signal in the reinforced leaktight compartments. A simultaneous loss of off-site power is assumed. The main circulation pumps and main feedwater pumps are deactivated. Diesel-generators are placed into operation.
The reactor emergency cooling system is switched on by simultaneous signals generated by the pressure increase in the reinforced leaktight compartments and the pressure differential between the MCP pressure header and the separator drum. The ECCS pumps and the auxiliary feedwater pumps are activated and provide cooling water at a flow rate of at least 275 kg/s in each half of the MCC. Water expelled through the break flows along drainage lines to a 150 m3 capacity tank. From this tank water can be taken to the ACS hot-condensate chamber.
Steam produced by flashing of the hot pressurized water flows from the reinforced leaktight compartments through the steam supply corridors and passes to the ACS steam reception chamber. The response of the of the ACS is described in more detail in Section 6.2.
Rupture of the Service-Water Pipeline
At least three different emergency situations are possible:
A) Rupture of the pressure pipeline of the service-water pump before the check valve.
When the pressure decrease signal is received, the reserve pump is automatically switched on and the devices are switched into reverse. If during the 24 hours it is impossible to repair the malfunction, the unit must be shut down.
B) Rupture of the service-water pipeline in the segment extending from the check valve of the service-water pumps to the gate of the device-consumer pipeline.
For the case of a partial rupture of pipelines, which does not lead to a pressure decrease in the water line, the loss of coolant is eliminated without unit shutdown.
A large loss of water can lead to a cessation of the service-water supply required for normal operation. Interruption of cooling of engines and oil coolers of an MCP requires their shut-down, subsequent to this the reactor would be shutdown by the AZ-1 button. In this case a loss of off-site power is possible. It is the most serious sequence of the rupture of a service water pipeline. In this case to ensure a reliable supply of service-, this pressure water line is closed off, and their pumps switched to the non-emergency water line.
C) Rupture of the service-water pipeline at segment which connects this pipe to the system.
Isolation of the damaged section is performed automatically by a preventive signal from flow meters. It leads to the isolation of only one device-consumer from the group.
Rupture of the Purification and Cooling System Pipeline
The character of the accident resulting from the rupture of the purification and cooling system pipeline depends on the location of the rupture. For the Ignalina NPP design the following situations were examined:
The maximum rate of coolant loss occurs in the first case.
Depending on the rupture location, the reactor emergency protection FASS is activated by a pressure increase signal in the corresponding locations:
Fuel channels of the damaged-half of the reactor are normally cooled by coolant flow from the MCP. During the loss of off-site power or by a signal of water level decrease in the separator drum, water is taken to the damaged-half of the reactor by the ECCS pump.
Rupture of the Intermediate Circuit Pipeline
Rupture of the intermediate circuit pipeline is a very-low- probability event, because in this system pipelines are used, which are designed for pressures of 1.6 MPa. This is about three times higher than the maximum possible pressure in the system.
Rupture of this pipe would lead to the shutting off of the water supply to the MCP coolers and the heat exchanger. The reactor would be shut down by the operator and cooled down. Water level in the separator drums is supplied by the auxiliary feedwater pumps.
126.96.36.199 Assumed Missile Effects
According to the list of initial events , the following events, related to internal missile effects, are examined. Accidental dropping of:
A fuel assembly being transported by means of the refueling machine is lifted and lowered with the grabber. This ensures a reliable grip of the fuel assembly and eliminates a possible release of the fuel assembly. To increase the reliability and safety, the refueling machine is inspected before each transporting cycle.
The fall of the casket with spent fuel, fall of spent fuel assembly, irradiated fuel channel and transport container during transporting from cranes are prevented by the following measures:
The possibility of fall of a transport casket from the second tier to the bottom of the spent-fuel pool is prevented, because the dimensions of the openings are smaller than the dimensions for the casket.
The consideration of the "Dropping of the refueling machine, the central hall crane or crane construction components on the top of the reactor" is proposed in a list of hypothetical accidents defined in 1990 by the Kurchatov Atomic Energy Institute, Moscow, Russia. This requirement was imposed after completion of the Ignalina NPP.