The International Atomic Energy Agency (IAEA), a member of the United Nations' family of organizations, has played two important roles in Western efforts to improve the safety of Soviet-designed nuclear power plants. By serving as a forum where nuclear experts from the former Soviet Union and Eastern Europe can meet their Western counterparts and freely exchange views on plant design and operation, it has done much to develop and sustain an East-West dialogue. Through its program for reviewing nuclear plant design, operating practices and accident prevention programs, the IAEA has--with the full cooperation of the former Soviet government and Eastern European governments--provided an independent assessment of many of the nuclear plants in operation and under construction in these countries.
In August 1986, the IAEA convened a special meeting on the Chernobyl international organizations. At that gathering, Valeriy Legasov, a member of the U.S.S.R. Academy of Sciences and a vice director of the Kurchatov Institute of Atomic Energy, gave a detailed description of the accident and what the Soviets had done to deal with its consequences and prevent a recurrence.
Legasov said the Soviet Union sought international cooperation aimed at improving the safety and operation of Soviet nuclear power plants.
The IAEA proved to be a valuable source of information as well as a forum for discussion. It earmarked funds for new data-processing systems containing information on nuclear power plant events worldwide. The agency also prepared an interactive software program that can be used to perform probabilistic safety assessments for nuclear plants.
The agency also created three sub-groups in its supplementary nuclear safety and radiation protection program to focus on:
Meanwhile, the IAEA's International Nuclear Safety Advisory Group was preparing a report on basic safety principles for nuclear power plants. The final version listed 12 fundamental and 31 specific safety principles that could be used to promote international cooperation among nuclear regulators.
IAEA began receiving requests for assistance in nuclear safety from countries operating Soviet-designed reactors. The IAEA responded in September 1990 with a program to evaluate the first generation of VVER-440 Model V230 reactors. The program's objective: to help countries operating Model 230s identify design and operational weaknesses, and to prioritize safety improvements. That program was expanded in 1992 to deal with VVER-440 Model V213, VVER-1000, and RBMK nuclear power plants in operation and under construction.
IAEA assistance focuses on three areas:
By late 1994, the program had identified design and operational shortcomings of VVER and RBMK nuclear power plants, and the related safety significance. The IAEA reached international consensus on the major safety issues for all Soviet reactor types, ranked according to urgency and significance with respect to the defense-in-depth concept. The IAEA is now assisting countries to review safety improvements that have been proposed and/or implemented.
In September 1990, the IAEA launched the first phase of its VVER-440 Model V230 program, identifying site-specific and generic design and operational safety concerns. By the end of 1991, phase one was completed, with the publication of a document evaluating the significance of the identified safety issues. The document also provided a basis for the short- and long-term activities needed to improve plant safety.
The IAEA began phase two early in 1992. Phase two activities include:
A priority of the safety reviews and modifications has been the establishment of preventive measures that enhance "defense in depth." An important part of preventing severe accidents is to ensure the integrity of the reactor pressure vessel. As such, all operating VVER-440 Model V230s--except Kozloduy 4 and Medzamor 2--have been annealed to restore the material properties of the reactor vessel degraded by radiation. Measures to further reduce damage from high neutron flux and to reduce loads from cooling transients also have been implemented in the plants.
The IAEA notes that further evaluation of the effects of annealing is needed. Similarly, regarding the structural response of the reactor pressure vessels, special attention has to be paid to the transients leading to pressurized thermal shock. Finally, concerning pressure vessel integrity, the agency says that completion of work to validate vessel assessment methods used to quantify safety margins and to demonstrate their conservatism is of utmost urgency.
The IAEA is preparing guidelines for use in evaluating pressurized thermal shock analysis.
The integrity of the primary circuit of plants also has been scrutinized. In VVER-440 Model V230s, a limited functional capability of the emergency core cooling and containment systems means that they cannot cope with large primary circuit breaks. Therefore, the IAEA is providing assistance in applying the leak-before-break concept.
To date, leak-before-break application studies have been conducted on a plant-specific basis at Bohunice and are close to completion at Kozloduy; a generic study is under way for Kola and Novovoronezh. Monitoring systems have been installed or are planned to ensure prompt detection of leaks. Related integrity assessments --using the leak-before-break concept--are planned for steam and feedwater lines, to prevent damage to primary circuit and safety systems resulting from breaks in those lines.
Further work is needed to assure the integrity of secondary piping and to evaluate areas subject to restricted inspection. Also, measures to ensure integrity of pressurizer surge lines are required.
Safety and support systems is another area of concern indicated by the IAEA. Improvements have been made or are being implemented in some plants to ensure sufficient steam generator water inventory during abnormal operation; to improve the capability and redundancy of the emergency feedwater system; and to improve redundancy and separation of the residual heat removal and related support systems. Bohunice has added an emergency feedwater system outside the turbine hall, and it has improved the pressurizer safety valves system. Novovoronezh, Kola and Kozloduy are planning to install additional redundant emergency feedwater systems protected against internal and external hazards.
Elsewhere, improvements have been completed or are planned to install remote shutdown panels, define the required post-accident monitoring instrumentation, assess the reliability of existing instrumentation and control equipment, improve physical separation, and review the control room layout. Bohunice, Kola and Novovoronezh plan to replace the reactor protection and engineered safety features actuation systems with new ones complying with current safety standards. They also plan to establish safety parameter display systems, and Bohunice intends to install a new redundant and seismically qualified water system able to provide sufficient heat sink to all safety systems.
Further work is needed, according to the IAEA, in the area of safety and support systems. The design basis of new emergency feedwater systems needs to be established. The design criteria to improve the emergency core cooling systems have to be detailed and clarified--and the plant response to all possible loss-of-coolant accidents further analyzed--to ensure short- and long-term cooling capability. Accident analysis covering all of the locations and break sizes is needed to establish the design bases for the emergency core cooling system improvement, and IAEA has developed guidelines for such analysis. The design criteria for the emergency remote shutdown panel have to be investigated further.
VVER-440 Model V230s suffer from very poor leak tightness due to their deficient containment capability. To address the problem, plants have launched a comprehensive program to detect and repair sources of confinement leaks. A first phase of improvements reduced the confinement leak rate by one order of magnitude. Further improvements are planned to reduce the leak rate by a factor of two. In addition, Bohunice is developing a design for confinement upgrading; Kola and Novovoronezh are considering similar modifications.
The IAEA recommended that further improvement of confinement leak tightness is urgent. The agency says that structural analyses are needed to determine the ultimate pressure capability of the confinement structure and to identify limiting points and expected failure modes. The spray systems should be modified to provide two redundant and separate trains to guarantee the performance of confinement. Additional studies on the prevention of hydrogen deflagration hazards are needed. And the adoption of a negative pressure approach should be considered to limit a post-accident release of high-level radiation.
As with most Soviet-designed plants, electricity production by the VVER-440 Model V230s came at the expense of safety. The lack of adequate operational and maintenance procedures and practices at the plants is being addressed through twinning programs and other technical exchange agreements with Western plants. Quality assurance programs are being implemented, radiation protection practices have been improved, and operating and administrative procedures have been or are being prepared and reviewed.
The housekeeping and material condition of the plants have improved. Most of the IAEA's recommendations on maintenance and surveillance testing practices have been addressed at Bohunice, Kola and Novovoronezh; a predictive maintenance program is planned for Kozloduy. A systematic approach for operator training has been adopted by Novovoronezh and computer-assisted training for Bohunice is under development. Kozloduy is about to begin operating its new training center. Emergency planning improvements have been carried out at Bohunice, Kola and Novovoronezh.
Although restoration of Kozloduy 1 and 2 has been carried out, improvements to the material condition of the other units are needed, and emergency planning at the plant needs to be reviewed. All of the VVER-440 Model V230s need control room design/human factors reviews. The lack of a full-scope site-specific simulator at Kola is impeding progress in the operator training program and the implementation of emergency operating procedures. Further improvements also are needed at all plants in the areas of maintenance procedures, maintenance personnel training, quality control procedures, and spare parts supply and control.
In 1990, an IAEA mission to Kozloduy concluded that the plant lacked a sufficient safety margin for the estimated design basis earthquake. Upgrading of units 1 and 2 has been completed, and work on units 3 and 4 is ongoing.
At Bohunice, engineering and construction work has been ongoing since 1991, reducing the seismic risk of the units.
In 1993, at the request of the Armenian government, the IAEA established a technical cooperation program to assist in that country's efforts to restart the two units shut down shortly after the 1988 earthquake. Although the plant was undamaged, its location in an earthquake-prone area leaves three main problems to be solved:
1. Geological stability of the site should be demonstrated.
2. Seismic design basis for the site should be re-evaluated.
3. Seismic requalification of the plant's buildings and components to the new seismic design basis should be performed.
Encouraging results have been obtained with respect to the first two problems.
The IAEA technical cooperation mission also is helping Armenia to strengthen its regulatory body and establish a plan of action consistent with IAEA recommendations for VVER-440 Model V230s.
The VVER-440 Model V213 reactor designs incorporate substantial safety improvements compared with their predecessor, the VVER-440 Model V230. Nonetheless, the 213s still lack many safety features found in Western nuclear power plants. So, in 1993, the IAEA launched a broad safety review of these plants. Much like the program to improve the 230s, this IAEA program looks at both generic and plant-specific issues. Some of the major safety issues in the VVER-440 Model V213s are presented in the following sections.
VVER-440 Model V213 reactors are equipped with bubbler condenser-type containments, in which peak pressure after large-break loss-of-coolant accidents is reduced by a steam suppression system. While this approach to containment has several positive elements, it also has raised concerns. Specifically, experimental support for this type of construction is needed, since the containment design involved several original developments.
The IAEA has prepared guidelines for bubbler condenser structural evaluation. The application of these guidelines has confirmed that the structure needs to be reinforced to withstand the effects of an instantaneous guillotine break of the 500 millimeter reactor cooling pipes.
To address the safety concerns related to the bubbler condenser structure, large-scale experiments in natural geometry are also needed to investigate: maximum pressure difference on internal structures, uniformity of flows in the bubbler condenser structure, and pressure oscillations.
To date, experimental structures have been built--but are not yet operating--at Zugres in Ukraine and Bechovice in the Czech Republic.
IAEA also recommends that mechanical strength analyses now be performed on a plant-specific basis, and that regulatory authorities should determine the rules for bubbler condenser containment evaluation.
Despite being redundant and independent, the emergency feedwater systems in the 213s are wholly located within the turbine hall. As a result, the components of the systems are exposed to common-cause failures due to fire, flooding, steam line break, or a seismic event.
The IAEA has proposed that the emergency feedwater systems be located outside the turbine hall, with the routing of lines so that no common-cause hazards can damage more than one line.
VVER steam generators have, as a unique feature, a cylindrical primary header with a bolted flange. A rupture of this component would allow radioactive water steam to bypass the containment, because the primary water would go to the steam relief valves and to the environment--a scenario not considered in the initial design of the plant.
A number of corrective actions have been planned and partly implemented at the plants. They include: improving primary to secondary system leakage detection, increasing emergency core cooling system water reserves, and improving the pressurizer spray system.
During a loss of coolant accident, the containment sumps should collect water escaping the reactor coolant system and make it possible for the emergency core cooling system to recirculate the water. However, strong jets of water or steam from broken pipes could tear thermal insulation from primary piping. This insulation could clog the containment sump filters, cutting off recirculation of water for core cooling.
One fix under consideration would be to replace the thermal insulation. However, that change would be costly, could introduce other problems, and would not guarantee an improvement of the situation. Other possible solutions are still being sought.
Control rooms of VVER-440 Model V213s are not equipped with separate ventilation systems capable of filtering the intake air in case of radioactivity releases outside the containment. This is a major concern, since the safety of control room operators is required for proper management of an accident.
Improvements at all plants with 213-design reactors are planned. Redesigned ventilation systems should, according to the IAEA, be able to: supply the main and emergency control room with filtered air, free of radioactive material; and prevent contaminated air from entering the control room by maintaining overpressure in the rooms.
The instrumentation and control (I&C) systems of the 213s represent the technical level of the early 1970s. In addition to being outdated, the reliability of the systems is questionable, and they require an inordinate amount of effort to keep them in operation. Even then, the I&C systems do not always fulfill single-failure criteria, and the physical separation of redundant trains of the reactor protection system is inadequate.
Given the importance of I&C systems to the safety of nuclear power plants, reconstruction of the systems is planned at various VVER-440 Model V213s. The list of necessary work includes:
Like most nuclear power plants developed during the early 1970s, the VVER-440 Model V213s lack sufficient attention to fire hazards. However, unlike most of those plants, the 213s have incorporated few of the improvements to fire protection, detection and suppression that swept through the rest of the world following the Browns Ferry fire in 1975.
The reduction of fire hazards is one of the most important tasks needed for improving the safety of these Soviet-designed plants. Systematic fire hazard analyses for each area of every 213 are needed. The analyses should identify the weak points of the fire barriers, show the need to separate redundant trains of safety important systems, and justify the acceptability of redundant train separation by distance. Additional analysis should be performed to identify the measures needed to improve fire prevention and fire suppression capability.
At the request of its members, the IAEA initiated the Coordinated Research Program on the Benchmark Study for Seismic Testing of VVER Type Nuclear Power Plants in 1992. Two types of reactors--the VVER-440 Model V213 and the VVER-1000--were selected for a benchmarking study, which will be used to coordinate methods and criteria related to seismic safety. The Paks plant was selected as the study's 213 reference plant. The study includes a state-of-the-art seismic analysis and dynamic, full-scale testing, using explosions and/or vibration generators.
After an initial meeting at the Paks plant in 1993, on-site testing of the plant's equipment was performed; preparations for the full-scale dynamic testing are under way. Also in 1993, the IAEA reviewed seismic input at Paks and conducted two seismic safety missions to review the work already done on seismic input and seismic capacity.
The Mochovce nuclear plant, another VVER-440 Model V213, underwent a preliminary review of the re-evaluation of its seismic design basis in 1993.
In February 1992, the IAEA was asked to expand its safety program on the VVER-440 Model 230 reactors to other Soviet designs. Bulgaria, Czechoslovakia and Ukraine separately requested that the agency initiate a more comprehensive safety evaluation of VVER-1000 nuclear power plants.
The VVER-1000 is a design that shares similarities with Western plants, in terms of design philosophy, design features and constructability. However, concerns remain about engineering design solutions, quality of manufacture, and reliability of equipment.
The strategy for improving the safety of VVER-1000s is similar to the IAEA's plan to upgrade the VVER-440 Model V213s. The main elements of the VVER-1000 program follow.
Between 1986 and 1991, 24 VVER-1000 steam generators developed cracks in primary cold collectors; cracking occurred after 7,000-60,000 hours of operation, and was determined to be caused by environmentally assisted cracking at temperatures of about 280 degrees C. Although cracked collectors were generally replaced, and the cause identified, concern remains: As of November 1993, 19 operating VVER-1000s had been outfitted with 76 of the steam generators in question.
The rupture of steam generator collectors could initiate accidents of high safety significance in two ways: The radioactive primary coolant could be discharged to the environment through the main steam atmospheric dump; and the long-term cooling of the core cannot be assured in the event of loss of primary coolant water through the main steam atmospheric dump.
In addition to the existing corrective measures, the IAEA has suggested improvements related to detection, inspection, repair, material, manufacturing processes, stress relieving, accident mitigation, and operating conditions. A new, improved steam generator design is under consideration at Gidropress, a Russian nuclear components manufacturer. The following are other important future activities:
Deformed fuel assemblies were discovered at Balakovo and Zaporozhye 1. The problem was observed after an irradiation of two years in the core. In addition, the distance between spacer grids was no longer uniform. Preliminary results of a post-irradiation examinations by Russia's Scientific Research Institute of Nuclear Plant Operations confirmed the deformation of whole fuel assemblies; the institute continued its study in 1994, and is looking into whether the cause is a design problem. The spacer grid movement may be the result of inadequate loading.
While a root cause analysis is under way, design modifications to make the fuel assembly structure more rigid and to provide dimensional stability are being considered by the Russian designer.
During the refueling of Zaporozhye 1 in late 1992, it was discovered that eight control rod assemblies were not at the bottom position. Subsequently, the same problem was seen at Balakovo, Kalinin, Khmelnitskiy, Rovno and South Ukraine. In addition, an increased drop time exceeding the maximum design value was observed. Most of the problems have occurred during the third year of operating an assembly in the reactor.
Root cause investigations are being conducted. A preliminary conclusion links the problem to an increase in the friction between the control rods and their guide tubes in the fuel assemblies due to shape changes of the guide tubes or possible rubbed surface roughness. There appears to be a close correlation between the control rod insertion problem and the structural instability of fuel assemblies.
While the IAEA stresses the importance of determining the root cause and implementing measures to eliminate the problem, the agency notes that the final solution may rest on the new improved design of fuel and control assemblies.
As part of the IAEA's benchmarking study on seismic safety, Kozloduy (units 5 and 6) was selected as the VVER-1000 reference plant. Extensive analysis and dynamic tests are planned. At Temelin, site safety has been documented, and progress review meetings were held on the topics of tectonics, microearthquake monitoring and hydrogeology.
Fifteen RBMK (Chernobyl-type) reactors are in operation in the former Soviet Union--11 units in Russia, two in Ukraine, and two in Lithuania. The design of the reactors evolved over the 17 years between construction of the first and last units, so it generally is recognized that there are three generations of RBMKs.
Major safety concerns exist with respect to the RBMK reactors--particularly the first-generation designs, which lack a dedicated emergency core cooling system and a pressure suppression system.
Since the 1986 Chernobyl accident, a number of safety-related improvements have been made to the RBMKs. Measures have been take to reduce the void reactivity coefficient. The problem of reactor instability has been addressed with new operating procedures. The control rod design was improved. And some fire corrective measures have been implemented in the area of fire protection, detection and suppression.
Despite these safety enhancements, concerns about the RBMKs persist. The IAEA program has identified the design and operational shortcomings of third-generation RBMK nuclear power plants based on a review of Smolensk 3 and the Ignalina plant. The IAEA results include insights from other national, bilateral and multilateral projects. The following are the principal areas being addressed in the IAEA's RBMK program.
After the Chernobyl accident, the shutdown system of all RBMK reactors was improved by: modifying the control rod design to eliminate the positive scram effect; reducing the rods' insertion time; incorporating the short bottom rods to the shutdown system; and implementing 24 fast-acting scram rods.
The RBMK shutdown system consists of the fast-acting emergency protection system (which uses all fast-acting scram rods) and the emergency protection system (which uses all control rods). However, these subsystems do not fully meet the basic principles of shutdown system requirements as defined by the IAEA, nor do they comply with the licensing practices observed in Western countries.
To correct the problem, Russian designers intend to develop and modernize the RBMK control and protection system. The shutdown system would adhere to recommended IAEA safety standards.
The possibility of the rupture of multiple pressure tubes is one of the highest-priority safety issues related to channel-type reactors, including RBMKs. Scenarios have been developed that show the potential for such an accident.
Analysis of the outcome of such an accident is needed. In addition, further experimental information is needed to better understand the physical phenomena involved. The IAEA recommends collaboration among RBMK designers and experts in Western countries familiar with modern safety analysis techniques for channel reactors.
Issues to be addressed include the nature of low-flow transients in multiple parallel channels, thermal mechanical response of graphite to channel failures, and high-temperature pressure tube failure mechanisms.
In 1995, the IAEA issued a report on multiple pressure tube failure, and the agency has initiated an international exercise to validate computer codes used to analyze multiple pressure tube ruptures. The validation work is based on experimental results made available through the IAEA by the Japanese government.
The IAEA carries out various types of nuclear plant services, including:
Pre-OSART (Operational Safety Review Team) missions for plants under construction. The team examines construction quality, commissioning arrangements and preparations for operations that will have a bearing on eventual operational safety.
OSART (Operational Safety Review Team) missions, which focus on operational safety practices. Within 12-18 months of a Pre-OSART or OSART mission, IAEA conducts an on-site follow-up review to assess progress in implementing the initial proposal for improvement.
ASSET (Assessment of Safety Significant Events Team) missions, which examine operating history and incident prevention programs. The team looks first for the direct cause and then the root cause of each safety-significant event--procedure, personnel or equipment--and then determines appropriate corrective actions. IAEA also sends an ASSET mission to help plant management implement the recommendations of the initial mission, then sends a follow-up ASSET mission to determine the effect of the implementation of recommendations.
Since 1987, the agency has received a growing number of requests for these safety-related audits of nuclear power plants in Eastern Europe and the former Soviet Union.
More than two dozen missions have been completed, including:
This list does not include missions conducted under the VVER-440 Model V230 project. Those missions, consisting of ASSET missions and Safety Review Missions (which covered both design and operational aspects), were conducted at Bohunice in the Slovak Republic, Kozloduy in Bulgaria, and Kola and Novovoronezh in the former U.S.S.R.
Several missions are scheduled for 1996 and 1997:
December 1995
