Ignalina Source Book

3.1 Design Loading

The structural components of the plant are designed in accordance with the specification set forth in "Design Safety Regulations of Nuclear Power Plants (OPB-88)" [16]. The generic requirement of this document is that safety-related systems and elements of nuclear power plants have to be able to fulfill their functions under all conditions. This implies that they have to accommodate stresses imposed by natural phenomena as well as mechanical, thermal, chemical and other impacts which may arise during design basis accidents.

3.1.1 External

The term "external events" (relative to a nuclear power plant) covers such natural phenomena as a earthquakes, flooding, strong winds, lightning, snow and ice, and such man-made events as aircraft crashes, industrial explosion, sabotage and terrorist action. On site fire and flooding are usually also considered as external events.

3.1.1.1 Air-Shock Wave

Buildings and other constructions unit 1 and unit 2 of the Ignalina NPP were designed and built without taking into account the influence of the air-shock wave, because corresponding requirements were put into operation only after the beginning of year 1987 [17].

Before construction started at the Ignalina NPP, the Research and Development Institute for Energy Technology, St. Petersburg (at that time Leningrad), Russia, performed a number of studies on the response of structures subjected to a step air shock wave of 10 kPa with the duration of up to 1 s, as required in the code [17]. The structural components under investigation were similar for all three units of the Ignalina NPP. The calculations show, that such a wave would destroy the following structures:

the pre-fabricated ferro-concrete structures, the metallic framework of external and internal walls in the central hall of the equipment room of the main building (Fig.1.2, building A),

the building structures of the turbine hall (Fig.1.2, building G) and the deaerator room (building D) of the main building,

the building structures of the ECCS pressurized tanks (accumulators) above the zero elevation (Fig. 1.2, building B),

the building structures of the service-water pump station (Fig. 1.1, buildings 1 and 2),

the building structures of the redundant diesel power station (Fig. 1.1, building 40).

The studies showed that in this event the loading on equipment due to oscillations of the structures was below the load due to, for example, an earthquake of magnitude 6 on the scale MSK-64 (see Subsection 3.1.1.4).

3.1.1.2 Water

According to reference [18] an analysis of the "Rupture of the dam (weir) of the cooling water pond" was not necessary, because the source of cooling of the Ignalina NPP is the water from lake Druksiai. In order to justify this, changes of the water level in lake Druksiai must be considered. According to available records a maximum water level was 142.26 m in 1953, and the minimum -140.76 m (above see level) in 1964 [10].

In normal operation of the Ignalina NPP and for supporting calculation of water level in lake Druksiai, there is the addition of spring floods and rain-water, as well as the effects of the hydro-engineering complex on the river Prorva. In case of destruction of this structure and the dam of the hydroelectric power plant, the water level in lake Druksiai would drop to the level of river Prorva, which is 140.20 m.

In case of destruction of the earthen dam on the river Drukse and return of the flow to the old river-bed, the influx of water into lake Druksiai would decrease by about 20 %. Temporary elimination of the dam on the river Drukse would not lead to a sharp lowering of the water level in lake Druksiai.

3.1.1.3 Missiles

Safety analysis of nuclear power plants, according to reference [18], requires the consideration of an "Aircraft crash on the reactor hall". The consideration of this event is proposed in a list of hypothetical accidents defined in 1990 by the Kurchatov Atomic Energy Institute, Moscow, Russia. This requirement was imposed after completion of the Ignalina NPP.

The requirements for considering an aircraft crash therefore were not imposed on any RBMK plant. This was due mainly to three major considerations:

There were no such regulatory requirements at the time when the plants were developed and no such requirements were introduced by the regulatory bodies,

Such events are sufficiently unlikely, besides, the RBMK sites are situated reasonably far from airports,

Until recently, there were no reliable statistics on flight incidents and fatal accidents involving both civil and military aircraft, which could be used when considering such events regarding nuclear power plants.

Note, that the nearest air route Svir-Rokisškis is ten km to the West of the Ignalina NPP. In 1990 a total number of flights along the Lithuanian air routes was 65000. During the last 30-year period there were no commercial aircraft crash accidents in Lithuania

3.1.1.4 Seismic

Seismic stability is the ability of equipment and structures to maintain integrity during seismic loading. This implies the maintenance of strength, tightness, maintainability, nuclear and radiological safety and the absence of residual deformation, which encumber normal operation [19].

The standard of seismic stability in the former USSR was the MSK-64 scale, which was established by the Earth Physic Institute, Moscow, Russia. Fig 3.1 provides a comparison between the MSK-64 scale and two other scales in common use. According to the MSK-64 scale, forces correspond to the following acceleration ranges of soil for periods from 0.1 to 0.5 s [19]:

forces 5 - 0.12-0.25 m/s²,

forces 6 - 0.25-0.50 m/s²,

forces 7 - 0.50-1.0 m/s² and so on.

For Soviet-designed NPPs two levels of seismic impact were taken into account: (a) the design earthquake, and (b) the maximum possible calculated earthquake. The first is a maximum earthquake, which may happen during the life-time operation of the NPP. The second is the maximum possible earthquake in the area in question. As a rule, for design purposes the maximum calculated earthquake employs an MSK-64 scale one force higher.

During construction it is necessary to guarantee the seismic stability not only for the building being constructed, but also for equipment, reactor control and protection system, control and measuring devices and others.

Fig. 3.1 The relation between seismic scales

MSK - Modvedev, Spanheuer, Karnik

MMIS - Modified Mercalli Intensity Scale

JMA - Japan Metrological Agency

Seismic Stability Categorization for the NPPs with RBMK - type Reactors

Depending on the need for functionability during and after the earthquake, all systems, equipment and structures of NPPs with RBMK-type reactors, are designed according the "Code for Designing of seismic-resistant nuclear power plants" [20]. The structures are divided into three seismic stability categories.

The first category is in turn divided into three groups. The first group encompasses systems or elements for which damage and loss of integrity could lead to releases of radioactive products in such amounts that they would result in radiation exposure to inhabitants above the established codes for a maximum design basis accident. The following systems of the NPP belong to this group:

reactor,

main circulation circuit,

steam pipelines from the separator drums to the relief valves, and the valves themselves,

feedwater supply system,

MCP hydrostatic sealing feeding system,

CPS cooling circuit,

refueling system equipment, refueling machine, cranes of the central hall,

equipment of spent fuel system, cranes in the service hall of the fuel cooling pond,

radioactive safety control system,

CPS equipment for combustion of explosive mixture.

The second group of the first seismic stability category includes the safety systems which protect the reactor core, the emergency heat removal systems from the reactor, and also the confinement system for radioactive products. The following safety systems belongs to this group:

control and protection system,

emergency core cooling system,

MCC overpressure protection system, except steam discharge valves to condensers (SDV-C),

reactor-space overpressure protection system (part of the ACS, which removes the steam from the reactor space to the fifth condensing pool),

reinforced leaktight compartment system, including headings, hatches and doors,

ACS towers,

ACS heat exchanger and pumps,

cutoff and sealing devices,

system for reception of waste water from reinforced compartments,

emergency power supply system,

service water system,

intermediate circuit system,

ECCS makeup system,

venting system of the safety system compartments and cable service,

tanks of the CPS venting system,

control safety systems, including redundant control systems.

Third group of the first seismic stability category includes those buildings, structures and equipment for which damage would lead to failure of reactor operations. This group consists of:

control room structures (building A) and deaerators (building D),

ECCS pressurized tanks (accumulator) building,

redundant diesel-generators building,

service water pump building,

purified deminiralized water tank (V=1500 m³),

communication tunnels and support structures of the first seismic stability category.

The second seismic stability category encompasses those systems, equipment and structures (not included in the first category), for which failure can lead to radiation levels above the permissible annual level for normal operations. This category is divided into two groups.

The first group of the second seismic stability category includes systems, equipment and constructions, which are located inside of the accident confinement zone:

heat exchanger and pumps of the purification and cooling system,

bypass cleaning system,

maintenance cool-down system of reactor,

pipelines located inside of the ACS.

The second group of the second seismic stability category includes:

ACS elements not mentioned above,

control systems of devices, which separate structures of the second seismic stability category from structures of third category,

turbine hall (building G),

supporting structures of the second seismic stability category.

Systems, equipment and structures, which are not included in the first and second categories, belong to the third seismic stability category.

Seismic Stability of Structures, Equipment and Pipelines

Calculations of seismic stability criteria for the Ignalina NPP structures, equipment and pipelines were conducted by the Research and Development Institute for Energy Technology, St. Petersburg (at that time Leningrad), Russia. These calculations were performed using a linear spectral theory of seismic stability. Calculation results of the main and auxiliary facilities are shown in Table 3.1. The seismic stability of buildings is given according to the above mentioned MSK-64 scale.

For the Ignalina NPP area the design earthquake magnitude is 6 forces and the maximum possible calculated earthquake magnitude is force 7 according to the MSK-64 scale. This requirement implies, that some structures of the Ignalina NPP need to be strengthened. According to the above listed estimates, the following structures are subject to alterations:

Main building. The extent of reconstruction amounts to about 35-40 % of the entire volume of the unit. The deaerator building and reactor hall need to be replaced completely.

The ECCS pressurized tank (accumulator) building. Degree of reconstruction amounts to about 50 %.

Building of service-water pumps should be replaced completely.

Table 3.1 Seismic stability of the Ignalina NPP structures

Building		Seismic stability, force
Reactor building (A)		6
Deaerator building (D) and Turbine hall (G)		< 5
Building of the ECCS accumulators		5
Redundant diesel-generator building		7
Building of service-water pumps:
- part below ground		7
- building frame		6
Primary system grade water tank		7
Trenches and tunnels for cables		7

A large part of the equipment within the first and second units of the Ignalina NPP do not comply with the seismic requirements. Calculated results of pipeline seismic stability show, that they correspond to standards [21].

Thus systems, equipment and structures of the Ignalina NPP do not fully comply with seismic stability standards. Measures aimed at reinforcing the existing building and equipment components are expensive, and are considered by plant experts as unfeasible. However, aftereffects of an earthquake will be diminished if the reactors are promptly shut down prior to the seismic wave approaching the plant. The implementation of the seismic monitoring system is under progress in accordance with Safety Improvement Program of Ignalina NPP [22].

3.1.2 Internal

The "internal" events which can impose loads on structures and equipment are events anticipated or postulated to occur as a result of plant failures, i. e. malfunction of the reactor's normal operating and control system.

3.1.2.1 Postulated Piping Ruptures

The safety analysis of the NPP with RBMK - type reactors considers the following ruptures of pipes and system components:

fuel channel,

water communication line,

steam-water communication line,

group distribution header,

downcomer or the cofferdam of the separator drum,

main steam line before the main steam gate valve,

feedwater pipe,

pipe or header of the MCP,

service water pipeline,

purification and cooling system pipeline,

intermediate circuit pipeline.

This Subsection discusses the initiating event itself, symptoms of the accident, direct consequences and measures to eliminate or limit the anticipated consequences. A quantitative analysis of the most significant accidental transients are presented Section 11 of the Ignalina RBMK-1500 Source Book.

Rupture of the Fuel Channel

The following potential break locations of the fuel channel were investigated:

rupture of the steam and water communications lines of the fuel channel

full rupture of the fuel channel inside of the reactor block,

partial rupture of a fuel channel.

The rupture of the fuel channel inside of the reactor block can be diagnosed by the following symptoms:

pressure change in the reactor block,

activation of "gas moisture increase" and "gas temperature increase" signals in the system for monitoring fuel channel integrity,

activation of the "water flow increase" signal in the emergency channel cell,

appearance of water in the drainage pipes from the reactor block,

appearance of water in the drainage lines from the CPS channel siphon compensator,

a considerable local decrease of graphite temperature.

When symptoms flagging a fuel channel failure are detected, the reactor emergency shutdown and cool-down is initiated. Reactor shutdown is initiated by either:

a FASS signal generated automatically if the excess pressure in the reactor block increases to 7.5 kPa,

or by the operator, using the AZ-1 button if emergency symptoms are indicated by control room instrumentation.

Simultaneous with the cool-down of the reactor, the damaged fuel assembly is removed from the fuel channel using the refueling machine. The emergency plug is utilized and the leakage is stopped by closing of the isolating and control valve of the damaged channel.

Rupture of the Water-Communication Line

The symptoms of a full or partial rupture of the water-communication lines are:

activation of the "water flow increase" signal in the channel with the ruptured water-communication line,

increase of moisture and air activity in the water communication compartment,

increase of pressure in the water communication compartment,

noise in the water communication compartment,

level increase in the waste water tanks.

An increase of excess pressure to 2 kPa in the water communication compartments, activates the emergency protection (FASS, AZ-1) signal and the reactor power is decreased to zero. Subsequently the reactor cool-down process is initiated. If emergency symptoms are flagged, the reactor can be shut down by the operator using the button AZ-1.

After cool-down of the reactor, the fuel assembly is removed from the damaged fuel channel and an emergency plug is installed. Leakage is stopped by closing off the isolating and control valve.

Rupture of the Steam-Water Communication Line

A rupture of the 75 mm exiting line which carries the two-phase coolant from the core to the DS results in increased coolant flow rates within the damaged channel. Coolant flow is increased roughly in proportion to the break flow, consequently ability of coolant to maintain adequate temperatures within the channel is thus not impaired. During the pressurized phase of the transient critical flow conditions prevail for the break flow.

In case of the mentioned rupture, a leakage of the coolant from the MCC is insufficient to cause a strong change of the circuit parameters. However, because of loosing a large amount of active coolant, it is necessary to shut down and cool-down the reactor.

Accident symptoms:

activation of the "water flow increase" signal in the channel with the ruptured steam-water line,

increase of air moisture and activity,

noise in the drum separator compartments,

pressure increase in the steam-water compartments.

If any of the above symptoms appear, the operator must shut-down the reactor. The reactor emergency protection AZ-1 is activated by a pressure increase signal when the excess pressure reaches 2 kPa.

Water, which is discharged due to the rupture of the steam-water pipeline flows to the drainage lines of the 135m³ tank. From this tank water could be taken to the ACS hot-condensate chamber, or after the elimination of accident consequences, to contaminated demineralized water tank, the capacity of which is 1500 m³.

Rupture of a Group Distribution Header

Rupture of the 300 mm diameter group distribution header belongs to those accidents, which can cause considerable changes of the MCC parameters. The supply of coolant to the fuel channels connected to the ruptured group distribution header, depends strongly on the rupture location. The most severe rupture of the group distribution header is one which occurs beyond the check valve (taken in the flow direction). In this case all 43 fuel channels are cooled by backward flow of coolant from the drum separators. In this case the leakage rate is maximized, because the coolant flow, which is discharged through the restriction inserted in the MCP pressure header, is added to the leakage of the coolant from the emergency group distribution header through the 43 fuel channels from the separator drum and the ECCS headers.

The FASS reactor emergency protection signal is activated by an increase of excess pressure to 2 kPa in the water communication compartment. In order to simulate most unfavorable accident conditions, a

complicating event is assumed. Simultaneous with the activation of FASS, a loss of off-site power is assumed to occur. In this case, the main circulation pumps and main feedwater pumps are not available. The ECCS is put into operation by the simultaneous excess pressure signals and the decrease of the pressure differential (up to 0.6 MPa) between the MCP pressure header and the separator drum. Water from the ECCS is taken to the affected damaged-half of the reactor. ECCS operation is discussed in more detail in Section 6.4.

Safeguards for confinement of this accident lead to the closure of gate valves in the head, suction and bypass lines of the MCP headers. All channels of the damaged-half of the reactor, which are not connected to the affected group distribution header, are cooled by direct ECCS flow under maximum possible flow conditions. After an increase of the water level in the separator drum of the damaged-half of the reactor the channels of the ruptured GDH are cooled by backward flow.

Water, which escapes through the rupture of the group distribution header to the water-communication compartment, flows by way of the drainage lines to the 350 m³ tank. From this tank water could be taken to the ACS hot condensate chamber.

Rupture of the Downcomer from the Separator Drum

An accident rupturing one of the 325 mm, 16 mm wall thickness downcomers from the separator drum will have a more severe impact on cooling conditions of the reactor core. This is due to a lower discharge rate of saturated water from both sections of the ruptured piping. In this event, before the ECCS pumps are initiated, the reactor core is cooled by coast-down inertia of the MCPs.

To ensure most unfavorable accident conditions, simultaneous with the activation of FASS, a loss of off-site power is assumed. This leads to a shut-down of the turbine generators, the main circulation pumps and the main feedwater pumps. The reactor is cooled down by the ECCS pumps and the auxiliary feedwater pumps. Cladding failure does not occur, because coolant is provided to the reactor block without interruption.

Water, which escapes from the separator drum compartment, flows by way of the drainage lines to the 135 m³ tank, which are designed for maximum pressure possible in case of emergency in the separator drum compartment. From this tank water could be taken to the ACS hot-condensate chamber.

An accident rupturing one of the water cofferdam of the separator drum which have an outside diameter of 325 mm and a wall thickness of 16 mm will have a more severe impact on cooling conditions of the reactor core. This is due to a lower discharge of saturated water from both sections of the ruptured piping. Before putting into operation the ECCS pumps, the reactor core is cooled while the MCP is costing down.

Rupture of the Main Steam Line Before the Main Steam Gate Valve

Rupture of the 600 mm diameter main steam pipeline is characterized by a significant pressure decrease in the main circulation circuit, as well as by the release of a large amount of steam through the break. System operating parameters, such as pressure in the MCC, pressure differential between the MCP pressure header and the separator drum, liquid levels in the separator drum, etc., in both halves of the reactor change in a similar fashion, because of the 400 mm diameter steam connection between the two MCC halves through 4 cofferdams and the 8 steam discharge valves of type SDV-C. Simultaneously a loss of off-site power is assumed.

The reactor emergency protection FASS or AZ-1 are activated by one of the following signals:

pressure increase in the steam-water pipeline compartment,

loss of off-site power supply,

closure of the turbine emergency regulating valve,

decrease of feedwater flow.

In addition it is anticipated that the emergency protection AZ-1 is activated by neutronic signals from the reactor: either by exceeding the power limit or by an increase of the reactor power excursion period.

Before the ECCS pumps are turned on, the reactor core is cooled by the inertial coast-down of the MCP’s. Subsequently the ECCS provides cooling water to both halves of the reactor.

Rupture of the Feedwater Pipeline

The largest impact of a break in this component occurs for a full rupture of the 500 mm diameter feedwater pipeline extending between the separator drum and the feed control device. This regime is characterized by a significant dynamical variation of the main parameters of the MCC.

In the analysis a simultaneous loss of off-site power is assumed. In this case, turbine generators, main circulation pumps and main feedwater pumps are switched off.

The FASS and AZ-1 reactor emergency protections are activated by an increase of the gauge pressure 2 kPa in the separator drum compartment. The reactor is automatically shut down.

Water, from the ruptured of feedwater pipeline flows along drainage lines to the 135 m³ tank. From this tank water could be taken to the ACS hot-condensate chamber or to the contaminated de-mineralized water tank.

Rupture of the MCP Header or Pipes Leading to the Header

The largest diameter component of the primary system is the 900 mm MCP pressure header. Loss of integrity of this component cuts of the regular coolant supply to one half of the reactor. Therefore, the rupture of this component is defined as the DB-LOCA for an RBMK plant.

Rupture of the MCP suction header starts a coast-down of the MCP pumps in the affected half .The pumps have a cavitation margin more than 1.5 MPa. Moreover, after stalling of the MCP’s, their inertia provides a brief operating margin. This means, that the coolant supply to the affected half of the reactor is not terminated immediately.

The rupture of pressure or suction pipes to the MCP, which have an internal diameter of 750 mm, leads to a smaller loss rate of coolant and the initial failure of only one MCP pump.

Therefore, the instantaneous full cross-section rupture of the MCP pressure header, which has an internal diameter of 900 mm, with unimpeded discharge of coolant from both ends of the pipe while the unit is in full power operation is taken to be the maximum design basis accident.

The reactor emergency protection FASS is activated by a pressure increase signal in the reinforced leaktight compartments. A simultaneous loss of off-site power is assumed. The main circulation pumps and main feedwater pumps are deactivated. Diesel-generators are placed into operation.

The reactor emergency cooling system is switched on by simultaneous signals generated by the pressure increase in the reinforced leaktight compartments and the pressure differential between the MCP pressure header and the separator drum. The ECCS pumps and the auxiliary feedwater pumps are activated and provide cooling water at a flow rate of at least 275 kg/s in each half of the MCC. Water expelled through the break flows along drainage lines to a 150 m³ capacity tank. From this tank water can be taken to the ACS hot-condensate chamber.

Steam produced by flashing of the hot pressurized water flows from the reinforced leaktight compartments through the steam supply corridors and passes to the ACS steam reception chamber. The response of the of the ACS is described in more detail in Section 6.2.

Rupture of the Service-Water Pipeline

At least three different emergency situations are possible:

A) Rupture of the pressure pipeline of the service-water pump before the check valve.

When the pressure decrease signal is received, the reserve pump is automatically switched on and the devices are switched into reverse. If during the 24 hours it is impossible to repair the malfunction, the unit must be shut down.

B) Rupture of the service-water pipeline in the segment extending from the check valve of the service-water pumps to the gate of the device-consumer pipeline.

For the case of a partial rupture of pipelines, which does not lead to a pressure decrease in the water line, the loss of coolant is eliminated without unit shutdown.

A large loss of water can lead to a cessation of the service-water supply required for normal operation. Interruption of cooling of engines and oil coolers of an MCP requires their shut-down, subsequent to this the reactor would be shutdown by the AZ-1 button. In this case a loss of off-site power is possible. It is the most serious sequence of the rupture of a service water pipeline. In this case to ensure a reliable supply of service-, this pressure water line is closed off, and their pumps switched to the non-emergency water line.

C) Rupture of the service-water pipeline at segment which connects this pipe to the system.

Isolation of the damaged section is performed automatically by a preventive signal from flow meters. It leads to the isolation of only one device-consumer from the group.

Rupture of the Purification and Cooling System Pipeline

The character of the accident resulting from the rupture of the purification and cooling system pipeline depends on the location of the rupture. For the Ignalina NPP design the following situations were examined:

Rupture of the PCS 150 mm diameter pipeline near the pressure header.

Rupture of the PCS 200 mm diameter pipelines at the section right after joining the 150 mm diameter pipelines before the limiting insertion.

Rupture of the PCS 300 mm diameter pipeline, which is used for water return to the mixers of the feed system between check valve and mixer.

Rupture of the 300 mm diameter water receipt pipeline to the PCS from the water cofferdam of the separator drum.

Rupture of a pipeline in the PCS compartments.

The maximum rate of coolant loss occurs in the first case.

Depending on the rupture location, the reactor emergency protection FASS is activated by a pressure increase signal in the corresponding locations:

reinforced leaktight compartments in case A,

reinforced leaktight compartments in case B,

feed system compartment in case C,

separator drum or reinforced leaktight compartments in case D,

purification and cooling system compartment in case E.

Fuel channels of the damaged-half of the reactor are normally cooled by coolant flow from the MCP. During the loss of off-site power or by a signal of water level decrease in the separator drum, water is taken to the damaged-half of the reactor by the ECCS pump.

Rupture of the Intermediate Circuit Pipeline

Rupture of the intermediate circuit pipeline is a very-low- probability event, because in this system pipelines are used, which are designed for pressures of 1.6 MPa. This is about three times higher than the maximum possible pressure in the system.

Rupture of this pipe would lead to the shutting off of the water supply to the MCP coolers and the heat exchanger. The reactor would be shut down by the operator and cooled down. Water level in the separator drums is supplied by the auxiliary feedwater pumps.

3.1.2.2 Assumed Missile Effects

According to the list of initial events [18], the following events, related to internal missile effects, are examined. Accidental dropping of:

a fuel assembly during transportation to the spent-fuel pool by the refueling machine,

a casket with spent fuel during its unloading from the hot cell to the spent-fuel pool or during transportation from the spent-fuel pool to the container,

an irradiated fuel channel in transportation by crane during replacement,

a transport container during transportation from the spent-fuel pool by car to the flushing chamber,

a refueling machine, central hall crane or constructions onto the top of the reactor.

A fuel assembly being transported by means of the refueling machine is lifted and lowered with the grabber. This ensures a reliable grip of the fuel assembly and eliminates a possible release of the fuel assembly. To increase the reliability and safety, the refueling machine is inspected before each transporting cycle.

The fall of the casket with spent fuel, fall of spent fuel assembly, irradiated fuel channel and transport container during transporting from cranes are prevented by the following measures:

using the grabber, which eliminates the spontaneous disconnection with transporting loads,

precautionary lock is placed on the hook, which prevents the dropping of the grabber loop from the hook,

cranes have a brake which is normally closed. This ensures reliable locking of loads during loss of power and from automatically disconnecting by a switch on the drive of the lifting mechanism, and the end switch, which ensures automatically stops of the hook-lifting mechanism, when it reaches a set limit,

regular inspection of the load lifting mechanisms.

The possibility of fall of a transport casket from the second tier to the bottom of the spent-fuel pool is prevented, because the dimensions of the openings are smaller than the dimensions for the casket.

The consideration of the "Dropping of the refueling machine, the central hall crane or crane construction components on the top of the reactor" is proposed in a list of hypothetical accidents defined in 1990 by the Kurchatov Atomic Energy Institute, Moscow, Russia. This requirement was imposed after completion of the Ignalina NPP.