Slovak Nuclear Society

European Nuclear Society

Czech Nuclear Society INIS-CZ--0028

^SVTS CZ0129400

PROCEEDINGS

International Topical Meeting on WER TECHNICAL INNOVATIONS FOR NEXT CENTURY

April 17-20, 2000

PYRAMIDA HOTEL Prague, Czech Republic 32/ 1 1 PLEASE BE AWARE THAT ALL OF THE MISSING PAGES IN THIS DOCUMENT WERE ORIGINALLY BLANK LIST OF CONTENTS

pg-

1. R. Kirmse (Gesellschaft fiir Anlagen- und Reactorsicherheit GRS mbH): Assessment of the Function of Major Passive Safety Systems of the New Russian WER-640 with Medium Power

15. 0. Matal, P. Sousek, T. Simo (ENERGOVYZKUM, Ltd.): Innovated Feed Water Distributing System of WER Steam Generators

23. O. Matal, P. Sousek, T. Simo (ENERGOVYZKUM, Ltd.): Blow-Down of WER 440 Steam Generators

29. V. Slugen, J. Lipka, I. Toth, A. Zeman, J. Hascik (Department of Nuclear Physics and Technology, Slovac Technical University Bratislava), M. Lehota (NPP Jaslovske Bohunice, SE-EBO, Slovakia): Corosion Products from WER-440 Nuclear Power Plant Bohunice Studied by Mossbauer Spectroscopy

37. R. Litchkov (NPP Kozloduy): Complementary System for Monitoring and Control of Neutron Flux During a Fuel Outage and During Reactor Start up Stage

45. G. Lunin, V. Voznesenskiy (Russian Research Centre "Kurchatov Institute", Moscow): Conception of WER Advanced Projects

53. A. Keskinen (Fortum Engineering Ltd, Finland): Modernisation and Power Upgrading of the LOVIISA NPP

59. J. Vita (CEZ,a.s. - NPP Temelin): Safety Improvements of TEMELIN NPP

75. M. Protze (SIEMENS / KWU): Modernization Program of NPP Kozloduy, Units 5 & 6

79. D. M. Popp (Westinghouse Electric Company, LLC Nuclear Projects Business Unit): The Use of U.S. NRC Licencing Practices for WERs

87. B. M. Cook (Westinghouse Electric Company, LLC Nuclear Projects Business Unit): Trends in Digital I&C for Nuclear Power Plants

95. M. Martin (Siemens): Experience in Modernization of Safety I&C in WER 440 Nuclear Power Plants Bohunice V1 and Paks 105. A.V. Arhipenko (Ministry of Energy of Ukraine), S.V. Barbashev, L.L. Litvinsky, A.N. Masko (The State Scientific Engenering Center of Control System and Emergency Response): Chemical Technologies and Life Management of Ukrainian NPPs

113. K. Porkholm, H. Kantee (Fortum Engineering Ltd), O. Tiihonen (Technical Research Centre of Finland): APROS Multifunctional Simulator Applications for WER-440

119. J. Tomek (Slovenske elektrarne, a.s.): Safety Improvement Programme of WWER 440/230 Units in Jaslovske Bohunice

127. V.V. Stovbun (National Nuclear Energy Generating Company 'ENERGOATOM'): Current Activities on Safety Improvement at Ukrainian NPPs

145. I. Kouklik (NPP Dukovany): Development of Dukovany Nuclear Power Plant

155. J. Baj'sz (NPP Paks): Strategy of Innovations at Paks NPP

163. J. Machek, V. Fiser (Nuclear Research Institute Rez, pic): Technical Innovations in the Field of Nuclear Safety for Next Century

171. V.A. Sidorenko, A.Yu. Gagarinski (Russian Research Centre "Kurchatov Institute"): Role of WER-Type Reactors in Large-Scale Nuclear Power of the XXI Century

181. A.V. Kapitanov (Rosenergoatom): The Legislative Basis and Safety Assessment for NPP Licencing During Commissioning in the Russian Federation

189. A. Billington, P. Blondiaux, J. Boucau, B. Cantineau (Westinghouse Elecrtic Europe), A. Mared (Ringhals Nuclear power Plant), C. Doumont (Westinghouse Elecrtic Europe): DART - For Design Basis Justification & Safety Related Information Management

201. A. Billington, P. Monette, C. Doumond (Westinghouse Elecrtic Europe): Increase Plant Safety and Reduce Cost by Implementing Risk-Informed In-Service Inspection Programs

211. P.V. Ancion, R. Bastien (Westinghouse Elecrtic Europe), K. Ringdahl (Vattenfail riir.y! .ais Nuclear Power Plant): EnergiTools - A Power Plant Performance Monitoring and Diagnosis Tool

221. V.I. Solonin, V.V. Perevezentsev, N.F. Rekshnya, V.G. Krapivtsev (Bauman Moscow State Technical University, Department of Nuclear Science and Technology): Experimental Study of Hydrodynamically Induced Vibrational Processes in VVER-440 Fuel Assemblies 231. K. Matocha, J. Wozniak (Institute of Material Engineering, Research and Development Division, Vftkovice, J.S.C., Ostrava, Czech Republic): Analysis of WWER 1000 SG Cold Collector Cracking

239. Z. Sk£la, J. Vft, P. Kepka, J. Forman, S. Zahorik (SKODA JS a.s. Pizen): Upgrades of USK 213 and SK 187

245. P. Balaz, J. Murani (VUEZ, a.s., Levice, Slovakia): Innovations of the WER 440 Accident Localisation System

253. M. Sabata (Dukovany NPP): WWER 440/213 NPP Containment from the point of view of IAEA Requirements and Current Euripean Practice

267. K. Pochman (CEZ - EDU NPP Dukovany), M. Ruscak, M. Brumovsky (Nuclear Research Institute Rez pic): Programs of Plant Life Management at NPP Dukovany

279. Z. Lastovicka, I. Kreisl, P. Taras (IPRON a.s.): Operational Fluid Radwaste Treatment Technology - Recent State and Outlooks for Optimization

297. M. Lukavec, J. Stepan, J. Maly, V. Lert (ENERGOPROJEKT Praha, Czech Republic): Nonlinear Analyses of the WER-1000 Reactor Building, Subjected to Extreme Loads

311. A. Hornaes, T. Bodal, S. Sunde (Institut for energiteknikk, OECD Halden Research Project), J. Belac, M. Lehmann, M. Pecka, K. Zalesky (Nuclear Research Institute Rez, pic), J. Svarny, V. Krysl, Z. Juzova (SKODA JS, a.s.), A. Sedlak, M. Semmler (Chemcomex Praha, a.s.): SCORPIO - WER Core Surveillance System

321. A. Miasnikov (State Office for Nuclear Safety, Czech Republic): Czech Regulatory Body Approach to the Design Changes Licencing

325. A. Afrov, V. Berkovich, V. Generalov, Yu. Dragunov, V. Krushelnitsky (Atomenergodesign): Design of NPP of New Generation Being Constructed at Novovoronezh NPP Site

349. P. Rebreyend, J.P. Burel (SCHNEIDER ELECTRIC, Safety Electronics and Systems Department): The Technology for Safety I&C Systems in Nuclear Power Plants: the Spinline 3 Solution

359. K. Khzek (Technical Support Centre, Nuclear Power Plant Temelfn): Nuclear Power Plant Temelfn Technical Support Centre

365. P. Kubecka (VSB-TU Ostrava), M. Tvrdy (VITKOVICE, a.s.), F. Wenger, P. Ponthiaoux (Ecole Centrale Paris): Tribocorrosion Behaviour of 08CH18N10T Steel 373. I. Cillik, L Vrtik (VUJE - Trnava Inc.): Mochovce NPP Safety Measures Evaluation from Point of View of Operational Safety Enhancement

383. H. Jeauneau, J.M. Favennec, E. Toumu, J.L Germain (Electricité De France - R&D Division / Generation Department): Innovative Instrumentation for WERs Based on non - Invasive Techniques

393. A. Shikov, V. Arjakova, S. Fedotov, L Ermakova (RF SSC VNIINM, Moscow), A. Lositski, V. Dubrovski, O. Bessonov, M. Shtutsa (JSC "ChMZ", Glasov, Russia): Investigation of Double Vacuum ARS Melted Zirconium Alloy E110 and E125 Structurel Condition Using Radioactive Trancers

397. M. Šabata (NPP Dukovany), I. Váša (Nuclear Research Institute Řež pic): Technological Innovations at NPP Dukovany - for Safe and Efficient Operation

405. A. Halbritter, N.J. Krutzik, W. Schütz (Siemens AG, Power Generation KWU, Offenbach), T. Katona, S. Ratkai (PAKS Nuclear Power Plant LTD): Dynamic Analysis and Upgrading of Reactor Cooling System of WER 440/213 (PAKS) due to Seismic and Normal Operational Loading

413. P. Rousset (Framatome): Design, Implementation and Licensing of Improvement measures

419. I. Martináková*, J. Galland**, M. Tvrdý*, V. Vodárek*, L Hyspf>cká*** ('Vítkovice R&D Division, Ostrava, "'Corrosion Laboratory, Ecole Centrale Paris, ***VŠB - Technical University Ostrava): Effect of Heat Treatments on Microstructure and Hydrogen Enhanced Fracture Behaviour of Alloys 600 and 690 CZO129401

"VVER Technical Innovations for the Next Century" Conference Prague, April 17 to 19,2000

Assessment of the Function of Major Passive Safety Systems of the New Russian WER-640 with Medium Power

R. Kirmse Gesellschaft fur Anlagen- und Reaktorsicherheit GRS (mbH) Schwertnergasse 1, D-50667 Koln, Germany Phone:+49221 2068 416 Fax:+49 221 2068 599 E-mail: [email protected]

ABSTRACT

As part of the activities initiated by the Bavarian-Russian Commission co-operating on peaceful use of nuclear and solar energy, GRS performed two phases of an assessment of the new Russian reactor concept VVER-640 of type V-407. The main topics of the first phase were: safety systems analyses, accident analysis, I & C and electrical systems. The second phase included the assessment of (a) function and reliability of the passive safety systems, (b) consideration of severe accident conditions in the design, and (c) digital instrumentation and control. Besides a general overview on the main results of the two phases, the paper concentrates on the function of passive safety systems and summarises the results of the assessment of the reliability of passive safety systems, and of the mitigation of severe accidents.

1 INTRODUCTION

As part of activities initiated by the Bavarian-Russian Commission co-operating on peaceful use of nuclear and solar energy, GRS received orders from the Bavarian State Ministry of State Development and Environment (BStMLU) for two phases of an assessment of selected safety issues of the new Russian reactor concept VVER-640 of type V-407.

This concept of a new-generation pressurised water reactor of medium capacity (640 MWei) and advanced safety is being developed in Russia under the leadership of the Russian project organisation Atomenergoprojekt St. Petersburg and the design organisation OKB Gidropress at Podolsk. This development is not completed yet but has already reached an advanced state. The license for the beginning of construction at two sites in Russia has been granted by the Russian safety authority Gosatomnadsor. Tenders were submitted also to foreign prospective customers. The two leading organisations are actively supported in the veri-

-1 - fication and validation of novel design solutions by several Russian scientific centres, e.g. by the Alexandrov Research Institute of Technology (NITI) Sosnovy Bor, the Kurchatov Re- search Institute (RRC KI) in Moscow, the Leypunsky Institute of Physics and Power Engi- neering (FEI) at Obninsk, and the Institute ZKTI in St. Petersburg. Siemens as the major foreign partner in planning and implementation of the VVER-640 is sharing its know-how in major areas associated with plant safety as well as in overall plant design and project execution. The VVER-640 will be equipped with systems for control of normal operation and with an I&C safety system, both based on Siemens technology. The electrical systems of the VVER-640 will likewise feature Siemens-made equipment and products. For selected functions, such as secondary-system overpressure protection, mechanical components built to Siemens standards will be employed. The development of the VVER-640 is a challenge of a co-operation between Russian and German companies (1).

Since it is co-ordinating this international co-operation, the Bavarian-Russian Commis- sion was interested in an independent safety assessment of the VVER-640. GRS received in 1993 a first order to perform an orientating safety related assessment of this reactor concept. This work included a limited number of selected topics with priority on the assessment of design basis accidents, of safety systems, of electrical engineering, and of instrumentation and control. To a lesser extent the topics core design and pressure boundary components were assessed in addition. The results of the assessment were discussed with the Russian designers before preparing the report on the first phase completed in 1994 (2).

The work was continued in performing a second phase of assessment beginning in late 1996. The working plan mutually agreed with the Russian Ministry of Atomic Energy, with Atomenergoprojekt St. Petersburg and with Gosatomnadsor, consisted of investigations and evaluations of three subjects. The first subject comprises the function and reliability of essential front line passive systems designed for the VVER-640, including the performed and planned separate effect's tests and integral tests for the demonstration of the function of those systems and for the verification of the computer codes applied in the process of safety demonstration. The second subject is dealing with the consideration of beyond design accidents in the design of the concept VVER-640, in particular the procedures and systems in the preventive and mitigative area including their analytical and experimental proofs. Furthermore the presented concept of digital instrumentation and control (I&C) had to be evaluated. Taking into account the stage of the design of I&C during the period of the present assessment project, the aim of this work was changed into an support for an improved understanding of the basic requirements of international and German rules for the implementation of digital systems in the safety system of nuclear power plants. The second phase was completed in 1998 (3).

2 MAIN RESULTS OF THE FIRST PHASE OF ASSESSMENT

The orientating safety-related assessment of the new Russian reactor concept VVER-640 was performed by GRS and its subsidiary ISTec on the basis of rules and guidelines which are in force in the Federal Republic of Germany considering also the requirements for future reactors as they were discussed in several countries. In particular, the general safety approach for new pressurised water reactors elaborated and recommended jointly by the French and Ger- man safety commissions and supported by the responsible French and German ministries were taken into account (4). An overall assessment of the VVER-640 concept on the basis of

-2- the performed safety assessment could only be made with reservations according to the limited scope and depth of the assessment. The VVER-640 belongs to the category of evolutionary-passive reactor concepts. The well-proved features, which were adopted from the VVER-1000, are for example the materials of the safety-relevant components and pipes. The construction of the primary system with the reactor pressure vessel (RPV), the cold and hot legs connected to it at different elevations, the horizontal steam generators, the combined hot- and cold-leg injecting emergency core cooling system with own injection nozzles at the upper plenum and the downcomer of the RPV were also adopted from the VVER-1000. Operational experience, especially in the field of materials used for the secondary system, were evaluated by the Russian side and detected deficiencies were largely eliminated.

Numerous safety-related improvements as compared to the VVER-1000 were noticed, e.g. the power density of the reactor core is reduced to about 60%, the neutron fiuence onto the RPV-wall is reduced by the lower power density and by the planned low-leakage loading of the core using burnable poisons, the shut-down reactivity is strongly increased by doubling the number of control assemblies, the water volumes of the primary and secondary system are enlarged, the volume of the pressuriser is enlarged, loop seals are avoided, copper-free material is exclusively applied for the secondary system, a double shell containment is foreseen, external events are considered in the design of all safety-relevant buildings, improved mitigative measures are foreseen against the consequences of primary to secondary (PRISE) LOCA by double isolation valves in the main steam lines and the arrangement of the main steam safety valves within the containment.

These improvements belonging to the evolutionary development are supplemented by an innovative approach, which entails partly replacing the active safety systems by passive safety features. The driving force behind this development is to enhance the safety by simplification and to allow for increased grace periods (not less than 24 h) after the onset of accident conditions before active intervention by operating personal is required. Hence the effect of human error on reactor safety is reduced considerably. In addition to the passive safety systems which usually are designed in 4x50% redundancy, active emergency-power supplied safety-relevant systems are provided in usually 2x100% redundancy. These active systems fulfil occasionally operational functions.

The second innovative approach concerns the implementation of precautionary measures to mitigate the consequences of severe core melt accidents, taken into consideration already in the design, e.g. the transition of core melt at high to low pressure, the retention of core melt inside the reactor pressure vessel (RPV) by ex-vessel cooling.

The results of the overall assessment performed during the first phase were: • By WER-640, a plant concept is presented for the first time on the basis of the new Rus- sian safety principles OPB-88 (5) and PBJa RU AS-89 (6), even exceeding clearly these requirements in some cases. • As far as the experimental testing programme with regard to the function of the new passive safety systems is concerned, the planned experiments at the large scale integral test facility KMS are required for a complete safety demonstration in addition to the separate effects tests and small scale system tests which partly had been already performed. • The assessment of the reliability of the passive systems needs to be performed.

-3- • The safety relevance of incidents which are initiated by inadvertent actuation of passive safety systems as well as by leaks and breaks in these systems needs to be investigated. • The more difficult diagnosis of the plant state when using passive systems instead of active systems must be considered in the concept of the reactor protection system.

Several further detailed conclusions were drawn for each of the selected safety issues at the end of phase 1. They are described in (2). These recommendations concerned essentially the completion of safety demonstration, the extension of safety analyses, e.g. into the area of low power states, included proposals for additional systems in order to obtain an improved balance of the safety system functions, e.g. an active emergency feed water system.

3 MAIN RESULTS OF THE SECOND PHASE OF ASSESSMENT

The results of three selected issues, the function of passive safety systems, the reliability of passive safety systems, and the mitigation of severe accidents are shortly described in the following.

3.1 Demonstration of the Function of Passive Safety Systems

The assessment of system functions is based on reports about the verification of computer codes PARNAS (7), SPAS (8), and SPOT (9), These codes are developed by different Russian institutes for the simulation of the system function of • depressurisation of the primary system and natural circulation modes in the connected system of pools (fuel pool and emergency pool) and reactor pressure vessel (system JNB), • containment heat removal under single- and two-phase natural circulation conditions to the external tanks BAOT located at high elevation (system JMA), and • heat removal from the secondary coolant system via the steam generators and heat exchanger/condensers into the tanks BAOT (system LBT).

Two main reasons were decisive for the development of new computer codes for the simulation of passive systems instead of adapting proven codes or modifying suitable ones for the purpose of simulating the involved processes. At first the new codes can be better equipped with appropriate interfaces which allow the formation of an integrated code package for the simulation of the interrelated physical processes during an accident. This concerns also further codes besides the three codes mentioned above, e.g. the code KUPOL which simulates the heat and mass transport processes in the containment. The conventional part of the simulation of the accident sequences are analysed by modified versions of existing codes which are provided also with the necessary interfaces for the integration into the code package. An example is the simulation of the thermal hydraulic behaviour inside the primary coolant circuit. Modified versions of the existing codes DINAMIKA and TETSCH are applied for this purpose. The second reason is the opportunity to individually tailor the code with specific models for the processes involved in different parts of the circuit. These processes are characterised by low flow parameters (pressure, mass flux, heat flux, steam quality) in natural circulation conditions and by mixing processes in large tanks. An additional advantage of developing new codes is the unlimited availability of the code by the designer including industrial application without restrictions, i.e. there is no dependence on foreign licenses. Nevertheless calculations with existing and extended foreign codes, e.g. RELAP5/Mod2 (SCDAP), were also performed for reasons of comparison.

-4- The simulation of the physics of the involved processes by means of the codes PARNAS, SPAS, and SPOT follows in general a realistic approach. A major part of the experimental work for the purpose of code validation and for the demonstration of the function of the passive safety systems has been conducted already. This work is continued at present and in the near future. At the end of this process a comprehensive and well validated code package will exist which will serve for the purpose of simulating the entire chain of heat removal from the core to the ultimate heat sink during different accident scenarios. Complex thermal hydraulic processes are involved in these chain. In case of a LOCA or after forced depressurisation: heat removal from core by natural circulation to the water pools surrounding the reactor, mixing and evaporation of water in these pools into the containment atmosphere, heat and mass transport within the containment, passive heat removal from the containment to the external water tanks, located outside the containment at high elevation, and mixing/evaporation of water in these tanks into the atmosphere as the ultimate heat sink. A parallel and partly diverse chain of heat removal from the core exists with heat transport at any primary system pressure by natural circulation to the steam generators, passive heat removal from the steam generators to the heat exchangers located in the same external water tanks and from there again to the ultimate heat sink. These complex and partly interacted processes are to be simulated and validated by means of suitable experiments. The validation concept corresponds with the state of the art. The progress obtained so far promises that the final goal will be achieved.

At first the codes were exposed to a systematic process of testing. An contrast to code validation by using experimental results for comparison, code testing comprises numerical tests, variation and optimisation of local resolution and time integration steps, comparison of the numerical solution with known analytical solutions, and comparison the results with calculations obtained with other codes. The testing of the codes PARNAS and SPAS has been completed successfully. For SPOT this process is still in progress. The codes PARNAS and SPAS obviously fulfil the requirements on robustness, stability and convergence. The simpli- fications which contributed to this features seem to be adequate, e.g. mainly a 1-D description, neglecting the dissipation compared to the transferred thermal energy and neglecting the diffusion, stationary values of phase slip, and an always saturated steam phase.

GRS proposed extensions of the scope of simulation for codes, e.g. for PARNAS to include the local variation of boric acid concentration, and to consider the influence of non- condensable gases on the process dynamics.

The validation process for the three codes is in progress. A higher progress has been already achieved for the codes PARNAS and SPAS.

3.2 Reliability of Major Passive Safety Systems

The assessment was concentrated on distinct system functions, namely the pressure driven coolant injection from accumulators into the reactor (system JNG), the gravity driven injection from ECCS pools (system JNK), the passive containment heat removal system (system JMA), the depressurisation of the primary circuit (system JNB), and the secondary passive heat removal system from steam generators (system LBT).

These passive safety systems as they are designed up to now for the NPP concept with. VVER-640 can be grouped into three types:

-5- • passive safety functions isolated by double check valves (in series) from the primary cooling circuit, namely the injection systems JNG and JNK, • passive safety functions aligned by opening /closing of hydraulic or pneumatic valves, namely the systems for depressurisation of the primary circuit JNB and the steam generator heat removal system LBT, • passive safety functions aligned permanently without the need to open any valves, namely the containment heat removal system JMA.

The reliability of these systems depends to a large extent on the type and performance of such valves, see also (10).

The designer has applied generic data for the estimation of the common cause failure (CCF) probability. GRS proposed a further plant-specific validation of these data. It is recommended that the Russian side creates and establishes an own empirical basis for CCF assessment.

The reliability assessment of the containment heat removal system (JMA) is proposed to be improved or expanded. Valuable steps towards demonstrating the order of magnitude of the failure probability at demand could be the check of the data base (11) and related references, as well as the assessment of hydraulic robustness and model uncertainties of SPAS. It is recommended to improve by minor design changes the fault tolerance of the redundant trains of system JMA. This would allow not to lose an entire train by one local leakage.

Up to now the reliability evaluation was related to the failure probability of separated passive system functions. It is proposed to continue the work by developing an integrated view on the systems for core melt prevention. This can be performed by the extension to event tree analysis. For selected postulated initiating events the active and passive system functions should be combined and the dominant event sequences regarding core melt frequency deduced and quantified with regard to their frequency. Finally, a sensitivity analysis should be performed with regard to uncertain parameters of the reliability estimates of the passive safety systems.

3.3 Mitigation of Severe Accidents

Essential improvements have been made to extend the ,,defence-in-depth" by design. They imply a significant reduction of the probability for those type of accidents, which could lead to core degradation up to core melting. Furthermore, provisions have been made to exclude or to drastically limit potential sources for the release of radioactive materials to the environment. In this context selected topics concerning accidental conditions which could lead to early containment failure and severe accident mitigation measures like • prevention of core melt at high pressure in PCS • coolability of molten core materials in the lower RPV head by ex-vessel cavity flooding • RPV failure mode • melt coolability in a core catcher device below the RPV • interaction of molten core materials with water (-> steam explosion) • formation of combustible gas mixtures in the containment atmosphere and • containment heat removal have been discussed and assessed. The technical solutions, chosen by the designers are supported by an extensive experimental research programme and related computer code de-

-6- velopment, validation and application. To assure the function of the technical solutions, still existing uncertainties should be reduced further by the ongoing research activities. For this some proposals and recommendations were made by GRS to further investigate solutions for the VVER-640 conception.

4 VALIDATION OF CODE PARNAS

The code PARNAS has been developed in order to analyse the natural circulation modes in the connected system of pools, in particular the non-stationary natural circulation and heat transfer in core, RPV, JNB pipes, the non-stationary heat transfer in the pools and mass transfer in the overflow pipe, and the heat exchange and natural circulation at external RPV cooling.

The processes of decay heat removal from core via pools, containment atmosphere and containment heat removal system (JMA) to the external JMA tanks are depicted schematically in Fig. 1 for a LOCA situations with rupture of the hot leg.

The validation of the code PARNAS is based on experiments from four test facilities (table 1). Experiments in three of these test facilities listed in the verification matrix have been performed up to now.

Name Type Scale State Task of verification experiments H V/P "A" SETF - - c thermal hydraulics of two-phase flow in vertical heated channel at low coolant parameters (0.1 MPa, up to 500 kg/nvVs) "BASIN" SETF-" 1:10 1:1000 c non stationary heat transfer, mixing and stratification in pools, coolant entrainment of non isothermal submerged jet at low coolant parameters (0.1 MPa, up to 0.2 kg/m'/s in emergency pool) "1ST" (EZ) ITF 1:1 1:1050 c non stationary processes of residual heat removal from reactor core by means of pool cooldown during the final stage of LOCAs "KMS" ITF 1:1 1:27 P comprehensive safety demonstration of the function of all safety systems including their interaction during accidents, reducing the impact of scaling

SETF = Separate Effects Test Facility V/P = Volume / Power ITF = integral Tests Facility c = conducted H = Height (Elevation) p = planned

Table 1 Test Facilities for the Validation of Code PARNAS

The test facility "A" is depicted in Fig. 2. The distinctive feature of this test facility is a specified constant pressure difference acting on the channel independent from the flow direction as it exists under the influence of the water column of pools during pool cooldown in the reactor. The experimental channel was not typical for the reactor core. The hydraulic diameter also differed somewhat from the reactor. Hence the tests are classified as basic tests. The analyses with code PARNAS of tests from facility "A" showed general good agreement between calculations and experiments.

-7- Fig. 1 Hydraulic Scheme of Pool Cooldown at Rupture of Hot Leg of PCS

Fig. 2 Layout of Facility "A"

-8- Several phenomena in the pool were investigated in the separate effects tests facility "BASIN": the non stationary heat transfer, mixing and stratification in the emergency pool as well as coolant entrainment of non isothermal submerged jet at low coolant parameters. The facility consists of two parts: the detailed facility for a more comprehensive simulation of the common behaviour of emergency pool and fuel pool with boundary conditions from the PCS (Fig. 3), and the simplified facility of the emergency pool for the verification of those sub- routines which are needed for the description of the non stationary heat transfer in the pool and for the determination of coolant entrainment due to a submerged vertical non isothermal single-phase jet (Fig. 4).

• CBblX

Fig. 3 Layout of the Integral Test facility "BASIN"

Since a precise physical modelling of such a complex process as investigated in this part is hardly practicable, an external forced coolant circulation circuit was installed in order to vary the conditions for the governing parameters, Re number and Fr number, in a wide range and by this to satisfy the scaling conditions to a better extent. A global power and volume scaling factor of approximately 1:1000 was selected. Results of experiments for a simulated large break in the hot leg were calculated by PARNAS with acceptable agreement against the measured results. The generally good agreement was obtained because the experiments in the simplified facility (Fig. 4) were used for the determination of closing conditions. An interesting result from this facility was the confirmation of density stratification with a moving horizontal temperature front when injecting hot water in vertical bottom-up direction. Model parameters were adjusted on the basis of a large number of these experiments. Considering the obtained experimental results it was decided to adopt the model of ideal mixing in horizontal planes of the pool for the code PARNAS for the calculation of non stationary heat transfer in the region of the emergency pool for larger cross sections of break sizes at two- phase outflow of coolant to the pool.

-9- Fig. 4 Layout of the Emergency Pool with simple geometry of facility "Basin"

GRS recommended to extend the experimental programme by investigating also pool mixing with inclined direction of injection and with two-phase flow entering the pool from the primary circulation circuit. This would cover also condensation processes in the pool. The processes investigated so far were calculated by PARNAS and acceptable agreement with the measured results was achieved.

The integral test facility "1ST" was designed to simulate the overall behaviour of PCS, emergency pool and fuel pool, and the connecting pipelines during residual heat removal by reactor pool cooldown in the ultimate phase after postulated LOCAs in VVER-640. The scaling factor is approximately 1:1000 for power and volume by preserving generally the elevations.

Fig. 5 Layout of Test Facility "1ST"

-10- The low flow parameters (pressure, mass flux) are of the same order as in the reactor plant. The scaling for horizontal tubes is based on the preservation of the Froude number. Limitations of the integral effects test facility "1ST" are the relative small size and the reduced length of the core, about half of the real core. The investigated sequences did not include the initial phase of the accident. The inclusion of smaller break/leak sizes than the double ended guillotine break into the experimental programme was recommended by GRS. The layout of this facility is depicted in Fig. 5.

A remarkably good agreement between the calculations by code PARNAS with the experiments was obtained. Also the rather complex oscillatory behaviour during the period of two phase flow in the core and sub-cooled fluid in the pool was calculated well. Since the majority of the physical phenomena occurring during reactor pool cooldown by natural circulation are reproduced in the facility "1ST (EZ)" the obtained test results contribute essentially to the verification of the code PARNAS, in particular with respect to the interaction of the subroutine packages for the simulation of the phenomena in the various sections of the circuit. Nevertheless the final code verification by means of the future experiments in the large KMS facility is inevitable.

The experiments at the KMS test facility (Fig.6), the fourth facility of the validation matrix, have not yet been conducted. The construction of this test facility is in progress. The scaling factor of 1:27 for power and volume and 1:1 for elevations of PCS and for the pools guaranty a thermal hydraulics behaviour during the processes of residual heat removal by pool cooling during the late phase of LOCAs being very close to the reality of the reactor plant. No cliff effects are expected in transferring the results to the reactor plant by a code like PARNAS if verified on the basis of experiments obtained from facility "KMS".

GRS considers the completion of the envisaged validation programme by including the tests at KMS as meaningful and necessary. The reasons for the necessity of such experiments are five-fold and equally applicable for the validation of the other codes. The experiments at KMS will serve • to reduce essentially the gap between the scaled down facilities with factors of 1:1000 (in case of PARNAS) respectively 1:110 (in case of SPAS and SPOT) and the real reactor, • to include the simulation of interactions between the reactor coolant circuits , the containment and the different passive systems, • to include the simulation of interactions between passive and active systems, • to provide data on the integral accident behaviour of the entire chain of heat removal from core to the ultimate heat sink, and • to model the complete time period of the accident from accident initiation up to safe shutdown state; these data are required for the validation of the integrated code package.

-11 - Fig. 6 Layout of "KMS" Facility

The validation of the codes SPAS and SPOT was performed in a similar way as the validation of the code PARNAS. Specific test facilities were built and operated to simulate the physical processes of containment heat removal and heat removal from the steam generators. These processes are interlaced because they use the same heat sink, the tanks BAOT at high elevation. Consequently, the validation of these two codes is based, besides separate effects tests, on the experimental simulation in a versatile system effects test facility which allows to study the interactions. The scaling factor of this facility is 1:110 in volume and power. To The gap towards the real reactor will be closed by means of the KMS test facility.

REFERENCES

1. Donath, R., Kirmse, R. and Kuchtevich, I., "WWER-640, Ein neuer Druckwasserreaktor mittlerer Leistung mit einem fortgeschrittenen Sicherheitskonzept (VVER-640, A new Pressurised Water Reactor of Medium Power with an Advanced Safety Concept)," Proc. of Jahrestagimg Kerntechnik '97, Berichtsheft der Fachsitzung "Verbesserung der Sicherheit von WWER-Reaktoren", pp 19-50, Bonn, July 1997

-12- 2. Kirmse, R., Langenbuch S., Mulka, B., Wenk, W. and Zabka, H., Orientierende sicher- heitstechnische Bewertung des Konzepts des neuen russischen Kernkraftwerkstyps W-407 (Orientating Safety-Related Assessment of the Concept of the New Russian Nuclear Power Plant Type V-407), Report GRS-A-2130, March 1994 3. Kirmse, R., Mulka, B., Ronde, J., Schäfer, H., Schnürer, G., Safety-Related Assessment of Selected Features of New Russian NPP with WER-640/V-407, Continuation of Previous Assessment, Report GRS-A-2642, December 1998 4. BMU (German Federal Ministry of Environment and Natural Protection), Gemeinsame Empfehlungen von RSK und GPRfür Sicherheitsanforderungen an zukünftige Kraftwerke mit Druckwasserreaktoren (Joint Recommendation of RSK and GPR for Safety Requirements for Future Nuclear Power Plants with Pressurised Water Reactors), Bundesanzeiger (Federal Gazette) 20.11.1993 5. Gosatomnadsor of USSR, General Directions to Ensure the Safety of Nuclear Power Plants, OPB-88, PNAE G-l—011-89, Moscow, 1989 6. Gospromatomnadsor of USSR, Rules of Nuclear Safety of Reactor Plants ofNPPs, PBJa RUAS-89, Moscow, 1990 7. Chabenski, V. et al., "Substantiation of Computational Techniques and Verification of Code PARN AS for Calculation of Non-stationary Processes During Residual Heat Re- moval from the Reactor through the Emergency Pool with Depressurisation of Primary Circuit of NPP of New Generation with VVER-640/V-407", NITI Report in Russian, Sos- novyBor, 1994 8. Beslepkin, V. et al., "Code for the Calculation of Non-stationary Processes in the System of Heat Removal from the Steel Shell of the Containment of NPP with VVER-640/V-407, Verification Report", SPbAEP Report in Russian, St. Petersburg, 1996 9. Atomenergoprojekt: "Information about Code and Analytical-Experimental Substantia- tion of the System of Passive Heat Removal from Steam Generators in NPP with VVER- 640/V-407", SPbAEP Report in Russian, St. Petersburg, 1997 10. Makihara, Y. et. al., "Passive safety systems for PWR using simplified PSA methodology", Proc. of ARS '94 (Int. Topical Meeting on Advanced Reactors Safety), Vol. 1, pp 95, Pittsburgh U.S.A., April 1994 11. Nyman, R. et. al., Reliability of Piping System Components, Voli: Piping Reliability - a resource document for PSA application, SKI Report 95:58, December 1995

-13- CZ0129402

INNOVATED FEED WATER DISTRIBUTING SYSTEM OF WER STEAM GENERATORS

Oldfich Matal, Pavel Sousek, Tomas Simo, ENERGOVYZKUM, Ltd., Bozetechova 17, 612 00 Brno, Czech Republic

Marian Lehota SE-NPP Jaslovske Bohunice, Slovak Republic

Jozef Lipka, Vladimir Slugen, Slovak Technical University, Faculty of Electronics and Informatics, Department of Nuclear Physics Ilkovicova 3, 812 19 Bratislava, Slovak Republic

Defects in feed water distributing system due to corrosion - erosion effects have been observed at many VVER 440 steam generators (SG). Therefore analysis of defects origin and consequently design development and testing of a new feed water distributing system were performed. System tests in-situ supported by calculations and comparison of measured and calculated data were focused on demonstration of long term reliable operation, definition of water flow and water chemical characteristics at the SG secondary side and their measurements and study of dynamic characteristics needed for the innovated feed water distributing system seismic features approval. The innovated feed water distributing system was installed in the SGs of two WER 440 units already.

1. Introduction

Defects in feed water distributing system of primary Russian design due to corrosion - erosion effects have been observed at many WER440 steam generators (SG) after approximately of ten years of operation. This defects have been observed in SGs of NPP Jaslovske Bohunice too. Therefore analysis of defects origin and consequently design development and testing of a new ( innovated) feed water distributing system ( co called SE- EBO design) were performed.

2. Brief description of the SE-EBO feed water distributing system design

The feed water pipeline inside the SG is subdivided into left- and right- hand chambers both located above the tube bundle. A number of feed water boxes with ejectors is inserted into the tube bundle using vertical gaps shaped by the tube bundle support system. The feed water is distributed from both chambers into feed water boxes by distributing pipelines.

-15- Outlets of ejectors are oriented horizontally and located approximately in the half of the tube bundle height. All elements of the system are manufactured from an austenitic stainless steel.

3. Verification of features

Features of the new feed water distributing system have been verified theoretically, experimentally and on prototype in-situ.

3.1 Theoretical analysis

Theoretical analysis were performed with following aims especially:

" To clarify hydrodynamics of feed water flows in pipelines and elements of the innovated distributing system. • To analyse field of medium flow velocities at the SG secondary side for different box with ejectors configurations. " To analyse field of impurities concentrations (sodium etc.) in the water at the SG secondary side for different box with ejectors configurations and selected blow down flow rates. • To study mode and frequency of feed water distributing system self vibration. • To provide understanding of requirements on and verification of technical and safety characteristic of the innovated feed water distributing system.

Examples of analysis results are in Fig. 1 and Fig.2.

Computed distribution of feed water flow rates in the SG length for the case of one of distributing system design variants is in Fig. 1. The mean water flow velocity in the left- or right- hand chamber decreases with the distance from the inlet as a result of the feed water flow into distributing pipelines. The water dynamics pressure decreases and the water static pressure increases with distance from the chamber inlet at the same time. Therefore the local water flow rate from the chamber into distributing pipelines is lower at the inlet of the chamber and higher to the end of the chamber. If an exchange of water among individual tube bundle sections is considered, in fact such sections are formed by the tube bundle support and tube distance systems, then a medium velocity field like shown in Fig.2 can be expected in the SG. The length of arrows is proportional to the medium mean velocity among sections. To this velocity field corresponds a field of impurity in water concentrations, Fig.3. More or less uniform distribution of impurities in water along the tube bundle is archived in this studied situation at the SG thermal power level of 100 %.

3.2 Experimental assessment

Features of selected parts of the innovated feed water distributing system were analysed experimentally . Experiments were focused mainly on:

-16- • Study of characteristics of ejectors and investigation of the feed water jet range in a water volume. • Study of tube wall temperatures if the outer target tube surface is submitted to a cold water jet ( expected situation for same probable reactor accidents).

One of the positive features of ejectors with feed water boxes is the colder feed water is mixed with more hot water from the SG secondary side and warmed up before injected into the water/steam volume at the secondary side consequently. This is also a positive SG safety improvement for many NPP operational and accidental transients. In SGs of WER 440 units of the type V230 is the feed water distributed by one feed water distributing system as during normal operation as in accidental situations. Therefore in some low probable but specific accidental situations a very cold (less than 50°C) feed water is pump into hot water /steam mixture or only steam (approx. 260°C ) at the secondary side via the feed water distributing system generating individual cold water jets. One of possible cold water jet targets is the hot outer surface of some tubes in the tube bundle. Local non steady cooling of the tube wall generates temperature shocks and transients and stress transients in the tube material and can initiate cracks at the tube surface. These phenomena were studied also experimentally. A tube of 16 mm O.D. and of 1,4 mm wall thickness manufactured from the OCH18N10T steel was connected to a test loop. The water flow rate as well as pressure inside the tube were the same as in the SG and water temperature at the inlet (T3 ) of the tested tube was kept at a level of 280°C , Fig.4. The hot tube outer surface was a local target for a water jet with the temperature of 20°C and flow velocity of 5 m/s. The response of a local surface temperature ( T4 ) of the tube to the jet is in Fig.4. In this diagram are also plotted calculated temperatures of tube inner surface (t vni) and tube outer surface (t vne) for very extreme conditions of cooling in the real SG: So in much more extreme temperature conditions than really expected. After some time period the cold water jet was stopped and so covered one load cycle. No crack initiation was observed at the tube surface after approximately 100 load cycles.

3.3 In — situ testing

A prototype feed water distributing system of the SE-EBO design was manufactured and installed into a one SG in Jaslovske Bohunice in 1994. In - situ long term tests were performed and focused on safety related verifications especially:

• Response in the rate and distribution of impurities ( Na, Cl', Fe) in the water at the SG secondary side on innovated feed water distribution system operation also in dependence on SG thermal power level. • Local temperatures of the system structure and surrounding medium • Spectra of vibrations'emitted by SG operation • Characteristics of waves emitted in high frequency ranges by SG operation

An example of obtained responses is in Fig.5. RMS vibration values for two accelerometer locations are plotted in time at the full thermal power of the SG.

-17- 4. Conclusions

Expected technical and safety features of the innovated feed water distributing system of the SE-EBO design have been verified by theoretical and experimental analysis as well as by long term in-situ testing. Based on this verification results the SR Nuclear Regulatory Authority made out a permition to install this system into steam generators in Jaslovske Bohunice. So now in all steam generators of two WER440 units are installed and operating innovated feed water distributing systems of the SE- EBO design.

References

Matal,O., Gratzl, K., etc.: Advanced feed water distributing system for VVER440 steam generators, Proceedings of the Third Int. Sem. on Horizontal Steam Generators, Lappenranta, Finland, October 18-20, 1994.

Mihalik, M., Matal, O.: Design of steam generators feed-water system modification to improve the chemical regime of VVER440 steam generator secondary circuit, Proceedings of the Int. Symp. on Safety and Reliability systems of PWRs and BVVRs, May 22-26, 1995, Brno

Matal, 0., Mihalik, M.: EBO feed water distributing system for VVER440steam generators, Proceedings on Spec. Meet, on Steam Generator Repair and Replacement Practies and Lesson Learned, IAEA Vienna, April 15-18, 1996

-18- 4 -

n i

t • < i 61'

1 -

-2

DISTANCE [m]

Fig 1: Computed distribution of feed water flow rates in the length of the steam generator

-19- CONCENTRATIONS 106 [kg /kg] t-o

—*—4—4 51 OUIOUIOUIOUI o 2. o -+> 3* X)c o

3 c' (a 3 01 o o o o

5 3 N5 O o 3 on O o 3

t-t- 0>

OQ a> 3 a> 3 o<—*• •-1 300

U o I.-: pi 1 H 2 200-J >

(•.r.: \ \ \ \ \ \ \ 50 0 _' \ \ \ \ \ \ J.

WATER JET TEMPER.ATURE

TIME [sj

Fig 4: Tube wall and water temperatures

T3 - measured temperature at the inlet in the tested tube T4 - measured local temperature at the tube outer surface tvne - calculate local inner tube surface temperature tvni - calculated local outer tube surface temperature ATV - computed temperature difference governing additional stresses in the tube wall AT2 - generated temperature difference by a cold water jet governing additional stresses in the tube wall

-21 - JO 1

• 0 RMS 1 70 I . ... !• i 1 ih ll I . /raV/ CO 1 1!. (Si J 1 III rf ;o | ini IJI + -> 1i k aiMi 1m

*" ^ • • •'

J ..A5.1 ;

: 12 CX):CO i;: CC:CO CO: CC:CC 12:co:co

TIME /hours/

Fig 5: RMS vibration values for two accelerometer locations at the full thermal power of the steam generator

-22 - CZO129403

BLOW-DOWN OF WER 440 STEAM GENERATORS

Oldfich Matal, Pavel SouSek, Tomis" Simo, ENERGOVYZKUM, Ltd., Bozet£chova 17, 612 00 Brno, Czech Republic

The paper provides comparison of design and operational characteristics of the old and an innovated blow-down system of steam generators (WER 440) and shows positive contributions of the innovated blow-down system to the operation and nuclear safety of WER 440 steam generators.

The innovated blow-down system of steam generators was installed at two WER 440 units already.

J. Requirements on blow-down system

The requirements on blow-down system of the SG secondary side the system has to meet are:

" To ensure and keep acceptable and defined characteristics of the environment at the SG secondary side to that the safety barrier between the primary and secondary circuits is exposed (tube bundle, primary collectors). • To monitor and quantify tightness of the safety barrier between the primary and secondary circuits.

2. Design and features of the former blow-down system

Design and typical features of the former (it is Russian) blow down system of VVER

440 steam ogenerator1- s can be characterized as follows: " Each SG has two blow down uncontroled extraction lines that joint to one blow down pipe located bellow the SG • All six individual blow down pipes are connected to one general blow down collector and one general expander subsequently • Individual blow down pipes possess different hydraulic characteristic each other • The pressure in the blow down expander is kept at a constant level in unit steady state power level conditions • Pressures at the secondary sides slightly differ in steam generators in unit steady state power level conditions • Inter circuit tightness in steam generators is monitored by chemical analysis of blow down water sampled from individual blow down pipes of each of six steam generators

The most important negative consequencies of this blow down system design are:

• Different and during operation unidentified blow down flow rates from the left and right halves of each steam generator, Fig. 1

-23- • Consequently together with feed water distribution form this produce different local as well as global environmental (mainly corrosive) conditions at the secondary side of each of six steam generators • No clear identification of the steam generator with a leak and no sufficient quantification of the leak rate if a inter circuit leak is monitored during unit operation • The blow down system cannot be washed effectively

3. Technical innovation of the blow down system

To avoid majority of negative features mentioned above research and analysis have been started that provided knowledge base for technical innovations of the former and still operating at many NPPs blow down system Innovations include namely: • In situ inspections of the status of the blow down system during unit shut-down period and evaluation of water and corrosion product chemical analysis results • Evaluation of operational experience with throttling elements located in blow down system • Elimination of differencies in blow down flow rates and implementation of distance controled and specific designed valves to provide possibility to control blow down rates from each steam generator individually • Clear identification as well as quantification of blow down flows in extraction lines by flowmeters • Identification improvement of the leaked steam generator it is improvement of the unit nuclear safety • Possibility to wash very effectively all pipes of the blow down system

4. Innovated system blow down systems - some results from operation

Innovated blow down systems were installed on two VVER440 units already. Results of performed analysis demonstrated different values of blow down rates from steam generators, Fig. 1, if the former system was considered. Flow rates from the same steam generators obtained after the implementation of the innovated blow down systems are in Fig.2. Comparing results illustrated on Fig. I and Fig.2 it is more than clear the innovated system can supply equal blow down rates from both sides of each steam generators in total, see for example Fig.2, as well as flow rates on demand for example in dependence on required local chemical quality of the environment at the secondary side of each of steam generators. Measured flow rates in blow down extraction lines - of an innovated blow down system - left side (M61) and right side (M62) as well as total blow down ratio from the steam generator (M6) are demonstrated in Fig.3 for the demand case equal flow rates (M6I=M62).

References

Simo,T., Matal, 0. : Blow down system hydraulic calculations, Report Number QR-EM- 009-99, ENERGOVYZKUM, Brno, January 1999 (in Czech)

-24- Matal,O., §imo,T., Manfiev^ M.D.: Innovation of blow down system in steam generators of a WER 440 unit, Proceedings of the 2nd Int. Symp. on Safety and Reliability systems of PWRs and VVERs , Brno, May 26-30, 1997.

-25- 0,8

C C

0.2 !•

4 5

SG NUMBER

IST EXTRACTION L[NE A 2nd EXTRACTION LINE

FLOW RATE LV SG BLOW DOVVT^ PIPE

Fig 1: Blow down flow rates in extraction lines and in the blow down pipes for individual SGs (connections of points should accentuate tendencies only)

-26- 0.2

SG NUMBER

o Is7 EXTRACTION* LINE A 2nd EXTRACTION LINE

E FLOVv RATE IN SG BLOW DOWN PIPE

Fig 2: Blow down flow rates in extraction lines and in the blow down pipes for individual SGs after system modernization

-27- U /t/hod

< 3 f 16 O >UJ (X w 2 r &&•

C3S o - C32:O0:CO :CO 10:00:03 14:CO:CO 13:CX):CO 22:CO:co

TIME [hours]

Fig 3: Blow down flow rates records after system modernization (M6 - flow rate in the blow down pipe, M61 and M62 - flow rates in extraction lines)

-28- CZO129404

CORROSION PRODUCTS FROM VVER-440 NUCLEAR POWER PLANT BOHUNICE STUDIED BY MOSSBAUER SPECTROSCOPY

V. Slugen1, J. Lipka1,1. Toth1, A. Zeman1, J. Hascik1, M. Lehota2

'Department of Nuclear Physics and Technology, Slovak Technical University Bratislava, Ilkovicova 3, 812 19 Bratislava, Slovakia, e-mail:[email protected] 2NPP Jaslovske Bohunice, SE-EBO, Slovakia

Abstract The transmission Mossbauer spectroscopy has been used in the investigation of magnetic phases of corrosion products from nuclear power plant V-l (Jaslovske Bohunice) steam generator and secondary circuit pipelines. The corrosion layers was separated by scraping of the rust from the surface and the powder samples were studied. It should be noted that the gamma spectroscopic measurements give no evidence of the presence of low-energy gamma radiation emitted from the samples. It was confirmed that cracks occur on the former feed water-distributing system. Defects were observed mainly in the area of feed water collector T-junction where DN250 nozzle is connected to the feed water distribution piping in the steam generator compartment. Design changes performed in the Bohunice steam generators in 1994 seem to be the proper answer for the corrosion limitation. According to the results obtained from the Mossbauer spectra analyse, it is possible to establish that main components of secondary circuit's corrosion products are magnetite (Fe-sO4) and hematite (a-Fe^O^). The results can be use for the optimal maintenance of VVER-440 nuclear reactors.

1. INTRODUCTION Mossbauer spectroscopy (MS) is a powerful analytical technique because of its specificity for one single element and because of its extremely high sensitivity to changes in the atomic configuration in the near vicinity of the probe isotopes (in this case 57Fe). MS measures hyperfine interactions and these provide valuable and often unique information about the magnetic and electronic state of the iron species, their chemical bonding to co-ordinating ligands, the local crystal symmetry at the iron sites, structural defects, lattice-dynamical properties, elastic stresses, etc. [1,2]. Hyperfine interactions include the electric monopole interaction, i.e., the isomer shift, the electric quadrupole interaction, i.e., the quadrupole splitting, and the magnetic dipole or nuclear Zeeman interaction, i.e., hyperfine magnetic splitting. These interactions often enable detailed insight into the structural and magnetic environment of the Mossbauer isotope. Indeed, more than four decades after its discovery (1958), Mossbauer spectroscopy still continues to develop as a sophistic scientific technique and it is often the most effective way of characterizing the range of structures, phases, and metastable states In general, a Mossbauer spectrum shows different components if the probe atoms are located at lattice positions, which are chemically or crystalographically unequivalent. From the parameters that characterise a particular Mossbauer sub-spectrum it can, for instance, be established whether the corresponding probe atoms reside in sites which are not affected by structural lattice defects, or whether they are located at defect-correlated positions. Each compound or phase, which contains iron, has typical parameters of its Mossabuer spectrum. It

-29- means, the method is suitable for quantitative as well as qualitative analysis. Mossbauer spectroscopy is non-destructive and requires relative small quantities of samples (-100 mg). In this respect, however, it is almost imperative to combine Mdssbauer measurements with other research methods, which preferably are sensitive to the nature of the defect properties [4-6].

2. FEEDWATER DISTRIBUTION IN THE WER-440 STEAM GENERATOR Schematic drawings of VVER steam generators (SG) are presented in Fig. 1 and Fig.2.

5 536 OHM, TR. 1 16 » Vt CROSS AXIS

S-iA OWH (I '^Jl* ^ M^-2—If : i. SECTOR g

750 750

Fig. 1 - Schematic drawing of SG35

Fig. 2 - Cross section of SG46 (Numbers indicate the places, where the specimens were scrapped)

Typical for Russian design of VVER440 NPPs are horizontal SGs. In the original Russian design the secondary side of the SG is underfeed by a pipeline passing the SG wall via a nozzle and connected to a feed water-distributing system located inside the SG. The feed water-distributing system consists of a T-junction and left and right part of a horizontal pipe-collector with a number of short cylindrical water outlet nozzles. The horizontal pipe-collector is inserted into SG tube bundle and manufactured from 20K Russian carbon steel. Serious damages were observed in the region of T-junction as well as of pipe-collector and outlet nozzles on many VVER440 SGs after approximately of ten years of operation [7,8]. Therefore, the former feed water-distributing

-30- system has been replaced by advanced feed water distributing-system of EBO design at SGs of NPP Jaslovske" Bohunice [9,10]. The advanced system consists of a V-shaped junction connected to the left — and the right part water distributing chambers both located above the tube bundle and few feed water boxes with water ejectors inserted into the tube bundle and connected to the distributing chamber by distributing pipelines. After five year operation in the SG Number 35 in the NPP outage one feed water box and corresponding distributing pipelines were replaced by new ones with the aim to analyse their overall stage and corrosion products on walls. For comparison, some parts of the former feed water-distributing system from the SG Number 46 were cut out and analysed.

3. EXPERIMENTAL For the experimental measurements, several specimens containing corrosion products were taken from different parts of all of 4 NPP Bohunice units. In the first step, corrosion process at the steam generators was studied. Later, the corrosion products were collected also from different parts of secondary circuit components and several filter deposits were analysed as well. The room temperature Mdssabuer study was performed at two different steam generator materials using conventional transmission Mossbauer spectrometer with the source 57Co in Rh matrix. Spectra were fitted using NORMOS program. The original STN 12022 material used in the 4th (SG46) unit till now, was changed in the some steam generators at the 3rd unit (SG35) with STN 17247 steel in 1994. The chemical compositions of both materials are shown in Table 1.

Table I - Chemical composition of investigated base material Steam- Type of the Chemical composition [weight %] generator steel C Mn Si Cr Ni Ti P Cu SG35 max. max. max. 17,0- 9,5- Min. max. - STN 17247 0,08 0,08 1,0 19,0 12,0 5x%C 0,045 SG46 STN 12022 0,16- 0,35- 0,15-0,30 max. max. - 0,04 max. (GOST20K) 0,24 0,65 0,25 0,25 0,3

Samples of corrosion products scrapped from different parts of the steam generators SG 35 and SG46 (see Fig. 1 and Fig.2) were analysed. The scrapped corrosion particles were homogenised by granulation and sieved in the wire of 50uin.

4. RESULTS AND DISCUSSION More than 50 specimens were collected from the NPP Bohunice secondary circuit. The investigation was focused mainly on the corrosion process going on in steam generators SG35 and SG46. Nevertheless, additional measurements performed on the corrosion products from SG31 and SG32 confirmed that corrosion process in all 6 steam generators of one reactor unit is the same and corrosion layers are on the some places altogether identical. All measured specimens comprise iron in magnetic and many times also in paramagnetic phases. Magnetic phases consist in form of nearly stoichiometric magnetite (y-Fe3O4), hematite (a-Fe2C>3), and in some case also iron carbides. The paramagnetic fractions are presented in Mossbauer spectra by doublet and singlet. Its parameters are closed to hydro-

-31 - oxide (FcOOH) parameters or to parameters of small so called superparamagnetic particles of iron oxides (hydrooxides) with the mean diameter of about 10 run (see Table 2 and Table 3).

Table 2 - MS parameters of corrosion products taken from the steam generator SG35 Magnetite Doublet Singlet H Sample HA Afd P Arel TAB IS QS Are| IS Arei (T) (%)

MS confirmed its excellent ability to identify steel specimens phase composition although its sawdust form and relative small amount (~ 100 mg). Our experiences with such measurements were published in [3,11,12]. MS confirmed an austenitic structure of STN 17247 steel and ferrite structure of STN 12022 steel. Difference between these two materials used in NPP Bohunice are well observable (see Fig.3 and Fig.4). According to the in-silu visual inspections performed at SG35 (1998) and SG46 (1999) as well as MS results, significant differences in corrosion layers and material quality were observed. The feed water tubes in SG46 were significantly perished after 14 years operation. Results confirmed that during operation time a very weak oxidation surroundings was in the observed steam generator SG35 after 5 years of operation time and the corrosion specimens were fully without base material particles. Magnetite was identified as dominant component in all studied specimens (see Table 2). Mossbauer spectrum of the steam generators (both SG35 and SG46) surface layer is the superposition of two sextets with hyperfine magnetic field HcfA = 49,4T and HcfB = 45.8T. J+ Sextet HcfA corresponds to the Fe ions in tetrahedral (A) sites and sextet HcrB corresponds to Fe2* and FeJ+ ions in octahedral (B) sites in magnetite spinel structure (FC^OA)- In contrast to magnetite, whose spectrum is characterised by two sextets, the hematite phase present in the powders produces one sextet. The relatively narrow line width (F) of the a-Fe2O"3 (mainly 0,24 -H 0,26 mm/s) indicates presence of a well-crystallised phase with few, if any, substitutions of other elements for Fe. However, in some spectra (mainly from filter deposits studied later) both the lower hyperfine field and the larger width (about 0.33 - 0.34 mm/s) could indicate a poorer crystallinity and/or a higher degree of substitution. These findings are in good agreement with those obtained by E. De Grave [13].

' Samples 1754-1757 were taken from the feed water pipelines in situ during the reactor shut down. Samples 1758-1790 were taken from the same steam generator from selected parts of feed water dispersion box (see photo 1)

-32- Table 3 - MS parameters of corrosion products taken from the steam generator SG46 SAMPLE HEMATITE MAGNETITE BASE MATERIAL DOUBLET 1 DOUBLET 2 FIG. IS2 HI HA A,., HB A», H4 A,cl H5 A* IS1 Ar<:| Arel (T) % CD % CD % CD % CD % (mm/s) % (mnVs) % mOO5 49.0 35.4 45.8 64.6 mOO6 49.1 36.5 45.9 63.5 m007 50.0 16.9 49.2 25.6 45.8 38.2 33.0 1.6 0.84 17.7 5 m008 49.0 35.6 45.9 64.1 m009 51.5 13.4 49.1 32.1 45.9 54.5 6 mOlO 49.1 36.5 45.8 63.5 tnO12 51.5 12.5 49.2 31.9 46.0 55.6 7 mO13 48.8 25.3 45.7 40.5 33.0 30.2 30.8 4.0 rnO!4 49.0 9.9 45.8 13.6 33.0 66.6 30.7 9.9 mO15 48.5 6.0 45.6 8.6 33.0 73.1 30.6 12.3 8 Accuracy ±0,1 ±0,5 ±0,1 ±0,5 ±0,1 ±0,5 ±0,1 ±0,5 ±0,1 ±0,5 ±0,04 ±0,5 ±0,04 ±0,5

Table 4 - MS parameters of the steam generators base material SEXTETS SINGLET

Sample HA Ard HB Arir! H3 Arei IS Ard Fig. (sawdust) (T) (%) (T) (%) (T) (%) (mm/s) (%) SG35 28.6 19.3 25.4 34.4 22 J 21.6 -0.20 24.7 3 SG46 28.6 19.3 25.4 34.4 22.1 21.6 -0.20 24.7 4 Accuracy ±0,1 ±0,5 ±0,1 ±0,5 ±0,1 ±0,5 ±0,04 ±0,04

r, J \ A ;' X.

V '; t;'. *r'

n ••< t - K i

!)•

Fig. 3 - Mossbauer spectrum of SG35 base Fig. 4 - Mossbauer spectrum of SG46 base material material

For the ideal stoichiometric Fe3C>4 the quantity rAe (ratio between A and B sub-component areas) is equal to 0.535. In the case that magnetite is the dominant (sole) phase in the specimen, the deviation from the ideal value of rAB is minimal (see Table 2). Significant deviations could be explained by a small degree of oxidation of the magnetite, resulting in the presence of vacancies or substitution by non/magnetic irons in the octahedral sublattice. Slight

2 Samples mO06, m008, mOlO were taken from outside surface, samples m007, m009, mOI2 from inside surface of the feed water pipeline according to the positions 1, 2 and 3, respectively (see Fig. 2 and Photo 2)

-33- substitution of other elements (Mg, Ni, Cu, ...) for Fe in the magnetite lattice is not unlikely, and this has a similar effect on the A- to B-site area ratio. Therefore, it is not feasible to conclude anything quantitatively about the degree of oxidation. Qualitatively, it can be inferred that this degree must be very low. During visual inspection of removed feed water dispersion box, 2 disturbing undefined metallic particles, fixed in one of outlet nozzle, were found. Both were homogenised and analysed by MS. It has been shown that these high-corroded parts ("loose parts" found in outlet nozzle of ejector) originate not from the 17247 steel but high probably from GOST 20K steel. In addition in this study, several samples taken from the sediment cooler of NPP secondary circuit were analysed. In this case, hematite was identified as the dominant component. Mtissbaucr measurements on the corrosion specimens scrapped from different position of the feed water distributing system (see Fig.2) shown that the outside layer consists exclusive from magnetite but the inside layer contains also hematite. Its amount decreases in successive steps towards into steam generator. The origin of this result is probably in fact that outside of the system is boiling water at the temperature of approximately 260 °C with higher salt concentrations and inside is the feed water on the temperature up to 225 °C. Changes in the inside temperature in region (158-225 °C) can occur in dependence on the operation regime of high-pressure pumps in NPP secondary circuit.

Fig. 5 - Mossbauer spectrum of corrosion Fig. 6 - Mossbauer spectrum of corrosion specimens taken from inside surface of the specimens taken from inside surface of the SG46 feed water tube (Fig. 2 - position 1, SG46 feed water tube (Fig. 2 - position 2, sample m007 in Table 3) sample m009 in Table 3)

The most corroded areas of the former feed water-distributing system are welds in the T-junction. High content of base material was identified in the Mossbauer spectra (see Fig.8). Due to dynamic effects of the feed water flow with local dynamic pressures of 20 to 30 kPa or local dynamic forces up to 1000 N on the inner pipe wall in the region of T-junction, the content of corrosion products was reduced. Particles of the feed water tube of SG46 base material were identified in sediments also in the bottom of the T-junction.

-34- Fig. 7 - Mossbauer spectrum of corrosion Fig. 8 - Mossbauer spectrum of the most specimens taken from inside surface of the damaged area of the former feed water- SG46 feed water tube (Fig. 2 - position 3, distributing system (see Fig. 2 -position 4, sample mO12 in Table 3) sample mO15 in Table 3).

Finally, in addition to mentioned results we have also decided to study deposits on filters placed after high-pressured heaters. It seems that hematite contents in filter deposits are much higher (up to 80%) than those in corrosion layer at the surface of steam generator parts. We still continue in these measurements.

5. CONCLUSION MS measurements performed at specimens from NPP Bohunice steam generators and other secondary circuits components confirmed that corrosion in combination with erosion can cause substantial damages in the integrity of the feed water distributing systems [6,7,12,13]. Therefore, the replacement of STN 12022 steel (in Russian NPP marked as GOST 20K) used in the steam generator feed water systems is important from the operational as well as nuclear safety point of view. Steel STN 17 247 proved 5 years in operation at SG35 seems to be optimal solution of this problem. Nevertheless, periodical inspection of the feed water tubes corrosion (after 10, 15 and 20 years) is recommended.

Acknowledgement Authors would like to thank to IAEA (RC-10994/RO, RCl 1120/RO) and to Slovenske elektrarne pic. for support.

-35- REFERENCES

[ 1 ] L. Cohen, Application of Mössbauer spectroscopy. Volume II. Academic Press, New York (1980) [2] G. Brauer, W. Matz, Cs. Fetzer, Hyperfine Interaction 56 ( 1990) 1563-1568 [3] J. Lipka, J. Blažek, D.Majerský, M. Miglierini, M. Seberíni, J. Cirák, I. Tóth, R. Gröne: Hyperfine Interactions 57, (1990), p. 1969-1974 [4] W.J. Phythian, C.A. English, J. Nucl. Mater. 205 (1993) 162 [5] G.N. Belozerski, Mössbauer studies of surface layers, ELSEVIER, North Holland (1993) [6] V. Slugeň, Mössbauer spectroscopy in material science, Kluwer Academic Publishers, Netherlands (1999) 119-130 [7] S. Savolainen et al., Proceeding from 2nd International Symposium on Safety and Reliability Systems of PWRs and VVERs. Brno, Czech Republic (1997) 190-212 [8] J. Čech, P. Baumeister, Proceeding from 2nd International Symposium on Safety and Reliability Systems of PWRs and VVERs. Brno, Czech Republic (1997) 248-272 [9] O. Matal, K. Gratzl, J. Klinga, J. Tischler, M. Mihálik: Advanced feed water distribution system for VVER440 steam generators, Proceedings of the Third International Symposium on Horizontal Steam Generators, Lappeenranta, Finland (1994) [10] O. Matal, T. Šímo, P. Soušek: Safety evaluation of an advanced feed water distribution system for WWER 440 Steam Generators, Proceeding from 3nd International Symposium on Safety and Reliability Systems of PWRs and VVERs. Brno, Czech Republic (1999) [II] V. Slugeň, V. Magula, Nuclear engineering and design 186/3, (1998), 323 [12] V. Slugeň, J. Lipka, I. Tóth, A. Zeman, P. Uváčik, J. Haščík, R. Hinca, M. Lehota, Proceedings of the 3rd International Symposium on Safety and Reliability Systems of PWRs and VVERs, Brno, Czech Republic (1999) 103-109 [13] E. De Grave: Report 96/REP/EDG/10, RUG Gent 1996 [14] J. Koutský, J. Kočík, Academia, Praque 1994 [15] J. A. Savicki, M. E. Brett: Nucl. Instrum. Meth. Phys. Res. B76 (1993), 254. [16] V. Slugeň, D. Segers, P. de Bakker, E. DeGrave, V. Magula, T. Van Hoecke, B. Van Vayenberge, Journal of nuclear materials, 274 (1999), 273-286

-36- CZ0129405

WER Technical Innovation for the Next Century

Complementary System for Monitoring and Control of Neutron Flux During a Fuel Outage and During Reactor Start up Stage.

R. Litchkov

Kozloduy Nuclear Power Plant / Units 1-4 VVER 440 / B-230

-37- Introduction.

The present work is an example for that, how with modern technical instruments is possible to compensate disadvantage and to increase technical resources of the old systems, without a change of given system totally with new one.

The system detail design and implementation was possible mostly, due to the international conferences and courses organised by IAEA and technical information provided by the agency.

The designed system plays a role of complementary system to the in situe operational systems for monitoring and control of the reactor core neutron flux, allowing its measurement and control during a fuel outage and during reactor start up stage.

Additionally, the system recalculates the reactivity in beta units and according to its value the reactor criticality fixed up reactivity is defined.

Theoretical base.

The input signals for the system are the outputs from the originally implemented count rate meter BIO-2-17 for each channel. These are pulses after amplitude discimitator of the reactor count rate meter and their track frequency is linear function of the reactor physical power.

The sensitivity of the in situe detectors SNM-11 versus thermal neutrons equals to 1 cps/nv (1 cps/flux unit). For the control of a neutron flux during the fuel outage, the flux must be measured at under reactivity level that equals to 1 E-12 Nnom or level 1 E-10% Nnom (detector measurement zone flux = 0.01 nv) with the appropriate accuracy.

At the mentioned above level of the in situe detector SNM-11 sensitivity is clear that for achieving an appropriate control as well the lowest possible level of a flux (0,01 nv) during operation of the complementary system acting as common frequency meter, the measurement interval must be about 45 sec. This means that if the neutron flux density changes its new value will be obtained after 45 sec. This is a very long period for data refreshing in spite of slow outage operations speed, and on the other hand the recalculation of the period and reactivity at the lowest under reactivity levels is impossible.

To avoid these long periods of averaging, the system uses digital count rate meter method with subinterval data gathering. In this method the needed interval e.g. 45 sec is subdivided into certain subinterval t'. The number of the pulses in each subinterval is written down separately, and the total number of the pulses is a sum of the pulses in the separate subintervals. The average counting rate is defined as a function of the total pulses number divided by time interval t. At the and of the counting period e.g. (t'+l) subinterval , the information gathered for the first one is clear up and its place is fill in by the value obtained during (t'+l) subinterval and so on.

-38- This procedure heavily decreases counting rate value - each average frequency change is registered with latency in worst case equal to one subinterval. This allows immediate registration of trends in neutron flux increase and decrease, at the lowest levels of the neutron flux as well, it allows period recalculating and reactivity at the same levels.

The subinterval is 0,1 sec, it means that the data refreshing time equals 0,1 sec. The program automatically switches into different numbers of the time subintervals decreasing in number due to increasing density of the neutron flux. The whole time interval is divided in to 512 subintervals. The following table shows the count rate meter parameters at different scanning intervals.

Neutron flux Count rate Number on Total interval Statistical error for in the meter and subintervals (number on min, max and middle detector area scanning subintervals frequency intervals x0,l) % n/cm2.s cps sec fmin, fcp, fkax 0,01 -5- 1 0,01 + 1 512 51,2 44,2 19,8 14 1-5- 10 1 + 10 256 25,6 19,8 8,8 6,2 10 -s- 100 10+ 100 128 12,8 8,8 3,9 2,8 100-1000 100-1000 64 6,4 3,9 1,8 1,2 103- 105 103-105 32 3,2 1,8 0,6 0,2

The maximal error at the lowest levels is calculated for the average counting rate 0,1 cps. After preliminary measurements with a help of the digital frequency meter during first fuel rods loading, the counting rate is about 0,3 cps. and at loaded up reactor zone in its deep under reactivity state equals to 2 cps. The error at these levels of neutron flux will be certainly lower. For example, an average counting rate of 0.5 cps produces error of 19,8%.

The in situe counter SNM-11 with its sensitivity (cps/nv) is very comfortable for counting rate registration - the values for neutron flux density and counting rate are the same (look at the table). The scales can be given in n/cm2 or cps. and vice versa.

System structure, hardware and software.

Structure

The system signals (pulses) are provided by in situe electronic block BIO-2-17 for each active zone channel physically separated. There are no modifications to the in situe hardware nor reactor trip systems.

The system is not tended to be a part of the reactor trip system so there is no need for the channels to be separated from the reactor core to the kits. The system consists of two twin independent channels for measurement and data processing - one of them placed at the Reactor Protection System, the other one at the Control Room. These two channels provide displays located in the refuelling machine(RM) with analogue signals of counting rate and period.

-39- The same channels provide the systems with digital signals for warnings and trip alarm, audio indicators and defects alarm of RM.

Hardware.

?C at Reactor Protection System. Industrial Rack mount with following characteristics: Processor : Intel Pentium III 450 MHz RAM :64MB PC 100 HDD :10.2 GB Display : 15"

PC at Control Room 1. Portable Lunchbox with following characteristics: Processor : Intel Pentium III 450 MHz RAM :64MBPC100 HDD : 3.2 GB Display : 15" TFT

The computer is installed before the unit shut down and it is placed at the movable rack at side of PI at the Control Room.

National Instruments hardware.

PCI Adapter PCI-6602 The adapter is installed in the computers at the Reactor Protection System and the Control Room - one for each ones. The adapter includes 8 32bit counters and up to 32 digital input/output channels. The adapter has got following characteristics: • Number of channels 8 • Resolution 32-bit • Compatibility 5V/TTL • Frequency accuracy f ±0,005% • Maximal input frequency f 80 MHz • Minimal source pulse duration 5 ns • Working temperature from 0 to 50 °C at humidity from 10 to 90%

AO-2DC analogue adapter The adapter is installed in the computers at the Reactor Protection System and the Control Room - one for each ones. The adapter includes 2 voltage outputs, 2 current outputs and 16 digital input/output channels. The adapter has got following characteristics: • voltage outputs voltage : 0 to 10V, ±5V, software fixing input impedance : 0,5 Q max max. current : 1 mA load capacity : 10 nF protection : short circuit earthing

-40- absolute accuracy : ±5 mV • current outputs output current : 0 to 20 mA external power supply : +7V to +40V output impedance : 1 GQ protection : short circuit grounding; absolute accuracy : ±30 |iA max • Stability : -60uV/C° • working temperature : 0 to 55 C° at humidity from 10 to 90%.

Terminal boxes and cables kits

Both terminal boxes (one at the Reactor Protection System and one at the Control Room) type SCIB-68 are to connect measuring channels and the adapters PCI-6602.

Both terminal boxes (one at the Reactor Protection System and one at the Control Room) type SC-2072 are to connect measuring channels of the adapters AO-2DC with the information panel of the refuelling machine.

Software.

MS Windows NT 4.0 Workstation with SP3 is an operating system.

The application language of the system is G language in the environment of the Bridge View of National Instruments firm. Besides the Bridge View package besides G language includes resources allowing as follows: • input/output points labels creation (tag); • trends and processes history generation; • control an decode optimisation.

Object orientated programming is based on the principle that all functions (for measuring, analysis, I/O file processing and so on) are included in the separate modules. Each of the modules has got data inputs and outputs for according processing. The basic advantages of the OOP are as follows: • the programmer is concentrated mainly on the creation of the application using in situe modules included in to application programming environment; • low level of possible error in the program caused by data incompatibility, format and inexistance. The Bridge View environment validates all these aspects and generates errors during compilation process of the application.

-41 - System operation.

Counting rate measurement.

Each of the six measuring channels has got its own counter on the PCI-6602 adapter. The seventh counter is used for information refreshing interval generation (0,1 sec) so called hardware gate. The eight counter is a redundant one. The value of the counting rate for each of the channels is displayed as an vertical bar on the digital indicator. The average value of the six channels is shown in the diagrams. The logarithmic scales are used from 0.01 up to 10E5 cps.

The status of each channel (being checked , switch off, failed) is displayed on the Boolean indicator where the number of the channel is shown. When the colour of the indicator is green it means that the channels is working properly, when is red it means that the channels in switch off and the programme cut off the channels data processing. The status of each channel is given by means of light diodes mounted on refuelling machine.

The data for the average counting rate are forwarded to the adapter AO-2DC, which converts them as on analogue signals from 0 to 10 V and from 0 to 20 mA used by displays at refuelling machine.

Reactor period calculation.

The reactor period is recalculated for each of six measuring channels and is displayed as an vertical bar and digital indicator for each of the channels. The minimal period of the sixth channels is shown in the diagram. The scales are exponential rated from 60 to 10 sec.

The data for a minimal period arc forwarded to the adapter AO-2DC; which converts them as analogue signal rated from 0 to 10V and from 0 to 20mA used by displays at refuelling machine.

The period is recalculated according to a formula: 1 1 dN T N dt where: T - reactor period N - current power (counting rate)

In the programme the previous formula is implemented as follows:

T ~ N At ~ N At where> N - the value of the average current counting rate N' - the value of the average previous counting rate At - the refreshing time at data

-42 - Reactivity calculation.

The reactivity is calculated using average counting rate of the six measurement channels. The value is displayed in the diagram of the display

The reactivity recalculating is performed according to the reverse point kinematics: 5]r* | a,.

As a practical implementation of the reactivity calculation, integrals recursive calculation is performed based on previous formula. The reactivity is calculated in the fixed time interval dt - 0,1 sec. The following integrals descriptions are implemented:

^dt' tj=J.At

Recursive formula for the integrals deriving is:

4% = No 4. A/ (2) where, Nj - counting rate at tj ?>.i,pi - latency constants of the neutrons for groups i (i=l,2..6) S - the value of the independent neutrons source in the reactor

The derived integrals according to formula 2 are substituted into formula 1 and the value of the reactivity is given in P units. The latency constants and the independent source are provided by the operator based on physical recalculation for the certain active zone.

Data back up.

Collected and recalculated data by Bridge View Engine are written down into hard disks of the PCs located at (the Reactor Protection System and the Control Room) in the compressed form 1 MB in size and THD extension (trend historical data).

The following type of data are written: • counting rate for the six channels; • period for the six channels; • average counting rate for the six channels; • minimal period for the six channels; • reactivity; • each channel status.

-43- Tester.

The function of the tester is to test the performance of the system including the whole hardware path e. g. preamplifier, BIO2-17, connection adapter, connection lines, terminal boxes, connection computers - measuring adapters, analogue outputs adapter, information panel of the refuelling machine.

The tester consists of portable PC with installed analogue output channels PCI-6704 adapter of the following characteristics: • voltage outputs : 16 channels, ± 10 V, accuracy ± 1 mV max. • current outputs : 16 channels, 0,1 to 20,2 mA, accuracy ± 2 mkA max. • stability : voltage - 5 mkV/°C, current - 10 nA/°C

The tester is connected with measurement channel by extending adapter, which is placed instead of BKC2-04 unit (in situe block for channel survey).

The tester application is designed by means of Lab View and it acts as two pulses mode generator: • test static frequency - the impulse string of static frequency is generated based on choice of the operator. • test static period - the impulse string of exponentially increasing frequency is generated.

System performance at failures.

• One PC failure - at the Reactor Protection System or one at the Control Room Because of the fact that both PCs perform the same functions, both forward the information throughout two separate cables to the refuelling machine, this kind of failure dose not have any impact on the system.

•PCI-6602 Counter failure. The accusation of the input signals by the channels is cut off. The implications on the systems are the same as above. The system functionality is not jeopardised.

• Analogue Outputs Adapter AO-2DC failure. The forwarding of the information from one of the PCs to the refuelling machine information panel is interrupted. The system functionality is not impacted by this kind of failure cause the other PC is providing data to the RM.

• RM information panel connection or apparatus failure. Because of apparatus and cabling duplexing the functionality of the system is not impacted by this kind of failure.

•Measurement channel (channels) failure. When the channel failure occurs the appropriate bar in the display is filled up and coloured in red, the system cuts off data processing on this channel so the rest of the channels are working properly. The system can work properly even with smaller number of working channels.

-44- CZO129406

Conception of WER Advanced Projects G.Luniaand V.Vqznesenskiy. Russian Research Centre "Kurchatov Institute", Moscow 1. Introduction Since 1964 58 power units with water-water power reactors (VVER) with electric power (gross) from 70 to 1000 MW had been built at 18 NPPs in the USSR, east European countries and Finland. At present some of these reactors are out operation either because of the end of lifetime or for other reasons. From 49 power units currently in operation 13 with the WER-440 and 1000 reactors of various modifications are in Russia. In spite of their high performance characteristics construction of VVER-440 reactors was stopped in the USSR in the 80s. They were replaced by VVER-1000 reactors as more efficient and lower in cost. During the 35 year operation of VVERs multiple measures on heightening their safety and efficiency, based on the VVER operation experience and experience with other type reactors, as well as due to changed safety standards and rules, were taken. Simultaneously, the activity on creation of new VVER designs, more reliable, safe and efficient was carried out. 2. Main requirements to NPPs with new generation VVERs The accidents at the "Three Mile Island" (USA, March 28, 1979) and Chernobyl (USSR, April 26, 1986) NPPs, caused by deficiencies in the designs of these reactors and faults of personnel, set the world public opinion against nuclear power as a whole. This resulted in essential reduction in programs of nuclear power development in a number of countries and even in the termination of NPP construction (Sweden, Finland) or prohibition of NPP operation (Italy, Austria). Although accidents with destructive consequences are practically impossible at the NPPs existing in the world due to their design and physical features, the need arose to make changes in the designs of the operating and of newly designed NPPs in order to ensure safety with more reliable means. For newly constructed NPPs the statements appearing in the IAEA recommendations (INSAG-3) [1] and USSR normative documents of (OPB-88) [2], insistently requiring to reduced the probability of severe accidents with core meltdown by 10 times comparing with the level established for operating NPPs (up to 10" 1/reactor-year), and the possible inadmissible release of radioactivity demanding the evacuation of population-by 10-100 times (up to 10"6 - 10"7 1/reactor-year). As an perspective direction for solving the problems arisen, the NPP designers of some countries, including Russia, began to create a number of water-water reactor designs using the following safety enhancing approaches: - extensive use of highly reliable passive safety systems operating without outside power supply and permitting, in the case of accidents, the reactor plant to be cooled down for a long time, about 24-72h, without operator's intervention; - lower heat generation rates of fuel rods in the core, allowing slow development of the accident and offering the possibility to take necessary measures even in the case of beyond- design development of events; - designing the systems of normal operation taking into account their possible use as active safety systems; - use of double containment: inner leak-tight shell and outer shell capable to withstand such external impacts as fall of aircraft and explosions; - provision of systems for managing beyond-design accidents.

-45- Simultaneously with safety enhancement the NPP designers took effective measures on reducing the expenditures for NPP construction and operation. The increased economic efficiency of new power units is reached due to the following measures: - reduction in consumption of concrete, metal, valves, pumps, cable due to the use of passive systems and decrease in the number of active ones, improvement of arrangement of rooms and equipment; - increase in the fuel burnup at a given enrichment due to reduction in the power distribution of the core and larger number of refuellings per core life; - longer NPP service life - 50-60 years. In the late 80s the designing of two such reactors, VVER-640 and VVER-1000 (V-392 design) was begun in Russia. Also, a conceptual design of NPP with 1500-1800 MW reactors are being considered. New NPPs are being created using the experience gained in designing and operation of VVERs which were connected to the network in the USSR, East European countries and Finland. 3. Main characteristics of new generation NPPs The main characteristics of new generation NPPs are listed in Table 1. As seen from the table, most parameters of new VVER-1000 (V-392 design) and those of VVER-1000 (V-320 design) now in operation are nearly the same. In the VVER-640 design the steam pressure in steam generators is increased, which improves essentially the thermodynamic efficiency of the unit. In spite of essential difference in the power of the VVER-1000 and VVER-640 designs, the dimensions of their vessels (rail transportable) and cores are the same. The number of control rods (CR) is increased in comparison with the operating NPPs with VVER-1000 reactors from 61 to 121. In this case their efficiency is sufficient, including the case with one CR stuck, to trip the reactors and cool them down to a temperature of 20-100°C without boric acid injection. In addition, the VVER-640 core will remain subcritical even after its complete depoisoning and in the case of unanticipated replacement of coolant's boric acid by pure condensate. The increased CR worth makes it possible to ensure a more reliable safety of NPP during the accident resulting in a deep cooldown of the reactor coolant system or those induced by unanticipated ingress of pure water into the reactor. The reactor plants of units considered have four circulation loops with the MCP and horizontal steam generator in each. In the design of steam generators the deficiencies revealed during the operation of NPP with VVER-1000 have been eliminated. In particular, the headers in the SG of new units will be made of stainless steel using an improved technology of tube closing. In the designs new main circulation pumps with reduced leaks from the seals are used. Even in the case of seal cooling loss leaks through the seals of one pump will not exceed 50 1/h for 24 h. No oil system is required for cooling the pump components. An unusual reverse locations of sucking and pressure nozzles of MCP for the VVER-640 permitted the reactor coolant system to be designed without U-shaped sections on the loops, worsening LOCA development. In the designs of new generation NPPs with VVERs the turbines of high heat economy, generators with fully water cooling, condensers with titanium tubes are used. As far the NPPs with 1500-1800 MW are concerned, at present there are proposals from two teams: these are the NPPs with VVER-1500U (OKB "Gidropress", St. Petersburg AEP) and UVR-1500 (AEP, Moscow; OKB Mashinostroenie, Nizhni Novgorod). In the first proposal the

-46- Table 1. Main characteristics of new VVERs comparing with those of western reactors of the same power

Cbtricterfftic WER- WER- AP600 WER- WER- N1300 WER- WER- EPR 440 640 (USA) 1000 1000 (France) 1800 1500U (V-320) (V-392) 1 Electric power (gross), MW 440 640 620 1000 1000 1330 1830 1500 1500 2 Thermal power, MW 1375 1800 1940 3000 3000 3817 5250 4250 4250 3 Pressure in reactor coolant system, MPa 12,3 15,7 15,7 15,7 15,7 15.5 15,7 15,7 15,5 4 Pressure in SG, MPa 4,6 7,1 5,5 6,3 6,3 7,1 7,1+7,8 7,1 7,3 5 Average/maximum linear 156/410 power generation rate in 127/325 100/265 135/- 166/448 L 66/44 8 170/- 185/478 120/310 155/450 fuel rods, W/cm 6 Outer diameter of fuel rod 9,1 9,1 9,5 9,1 9,1 9,5 9,1 9.1/7,6 9,5 7 Outer diameter of reactor vessel, m 3,84 4,54 4,4 4,54 4,54 4,83 5,67 5,30 5,4 M 8 Number of loops 6 4 4 4 4 4 4 4 4

Note: 1. For the VVER-1800 the characteristics of V-352 conceptual design, developed in 1985, is given. 2. EPR - European power reactor. basis for designing the safety systems is solutions developed for VVER-640, in the second-for VVER-1000 (design V-392). The short-term problem is to reduce these two proposals to one selecting the best solutions. 4. Safety concept of new generation NPPs.

The operation conditions of NPPs with VVERs include: - normal operation; emergency situations; design and beyond-design accidents. The NPP meets the safety requirements when its radiation impact on the personnel, population and environment under normal operation, in emergency situations and DBA does/not result in exceeding the adopted doses of personnel and population exposure and standards on the release and content of radioactive materials in the environment and limits this impact in the beyond-design accident. For each category of operation conditions the following factors are determined: signs of referring the operation condition to one of the categories; nomenclature of operation conditions for each category; criteria of successful course of given operation condition. It is understood by the normal operation the fulfillment of all operations necessary for reaching the main objective of NPP-the generation of electricity and heat, with the safety of personnel and population being ensured. The normal operation includes: flooding of the equipment with a working medium, heating/cooling of the systems, scheduled start-ups and shutdowns of the unit, operation at various power levels, scheduled equipment switchings ons and offs, revisions, refuelings, tests, ets. Under the normal operation condition the state of NPP equipment is maintained in the operation limits determined by the design. These conditions are maintained by corresponding systems of normal operation, including the control systems. When the controllers fail, the function of maintaining the parameters in the limits of safe operation is fulfilled by the systems of process interlocks and protections. In the normal operation the criteria given below for this category of operation conditions must not be exceeded.

-47- The violation of the normal operation (emergency situation) may be deviations of parameters beyond the permissible limits (symptom) or the event pertaining to the category of emergency situations or accidents (event sign). Unlike the accidents, the emergency situations are very probable events and, therefore, their arising should not lead to the violation of safety criteria specified for the normal operation or cause failure of the equipment, except for one whose failure is the initial event. Upon the repair of failed equipment the unit must be put into operation without any extra revisions and refuelings. In the Russian normative documentation there is no probability criterion for separating emergency situations from accidents. In accordance with the US standards, [4] all whose probability is <10"2 1/reactor year, i.e. once per 100 year and more often, should be understood as the emergency situations. These includes unscheduled (emergency) switching off some equipment (MCP, turbines, feed pumps, steam generators), false operation of scram system, ruptures of small pipelines, etc. In accordance with OPB-88 and OPB-88/97 the accident is understood as a violation of NPP operation with the release of radioactive products and/or ionizing radiation beyond the limits specified in the design for normal operation (symptom). The accidents are divided into design and beyond-design ones. The design accident is one for which the design determines the initial events and final states and stipulates are foreseen the safety systems ensuring, with allowance for the principle of single failure of safety systems or a single error of personnel, independent of the initial event, the restriction of its consequences within the limits specified for these accidents [2], [3]. When the design accident occurs, an essential repair and even core discharge may be required. Therefore the probability of accident should be lower than for the emergency situation. As a consequence from the OPB-88 requirements and IAEA recommendations the probability of initial events of design accidents must be within the range 10"2 - 10"5 1/reactor year, and the probability of serious fuel damage must not exceed 10"5 1/reactor year. The beyond-design accident is meant as "the accident induced due to the initial events unanticipated for the design accidents or accompanied by failures of safety systems beyond the single failure or faulty decisions of personnel, which can lead to serious damages or to. core meltdown. The mitigation of its consequences is attained the accident by management and/or by the realization of the emergency plan on protection of personnel and population" [2]. According to [5] "the sequences of events which can lead to significant damage of the core" are called severe accidents. Obviously, the NPP operation will be safe and economic only in the case when the NPP is designed so that the number of disturbances in its operation (emergency situations and accidents) would be small, and their impact on the personnel, population and environment would not go beyond the limits of a certain permissible risk, insignificant comparing with other technogenous impacts. Therefore the approach existing in the world establishes various safety criteria depending on the operation conditions (its probability), and for radiation impacts taking into account the difference in their hazard for various groups of personnel and population. To ensure the safety of NPPs with the VVERs the defense-in-depth concept is used, which is based on the use of: - a system of barriers preventing propagation of ionizing radiation and radioactive products to the environment; - a system of technical and organization measures on the protection of barriers and maintaining their efficiency; - measures of direct protection of population.

-48- In accordance with the defense-in-depth concept the NPP is designed, constructed and operated in such a way that the radioactive materials are confined with a number of physical barriers. The system of barriers of NPP with the VVER consists of: fuel matrix; fuel claddings; reactor coolant pressure boundary; a leak-tight confinement (containment). For the protection of barriers several NPP protection "levels" characteristic of the given impact level (categories of regimes) are provided. For each "level" the appropriate technical and/or organization measure for preventing and/or mitigating the impact consequences or impact sources are used to prevent the NPP transition from the normal operation to the emergency situations or to the accident, if these measures are ineffective, with the aim of fastest return to normal operation. For each category of NPP operation conditions the safety concept envisages a set of criteria for attaining the main safety goal. The criteria are set up on the basis of normative requirements and experience of creation and operation of NPPs with the VVERs (see Table 2). 5. Technical means for ensuring safety concept requirement. Unlike the operating NPPs with the VVERs, an important feature of new designs, as mentioned in Section 3, is the use of double shell containment with a controlled space in between. To ensure the safety in the beyond design accident at the NPPs with VVER-1000 and with VVER-640 of new generation, sets of active and passive systems are provided. The passive systems can fulfill all safety functions without active systems and operator's intervention for at least 24 hours. The active systems, in turn, (a part of them also fulfill the functions of the systems of normal operation) can ensure the safety without the operation of passive systems for the most probable accident in the presence of alternating current at the NPP. The reactor is tripped, if necessary, both by the insertion of control rods into the core by gravity and by the injection of boric acid into the coolant. For the core cooldown and removal of residual heat in non LOCA cases, the passive heat removal systems (PHRS) from the steam generators are provided. The SG heat is removed in special heat exchangers, located outside the containment, to the air (VVER-1000) or to the water in a heat accumulating tank initiating its evaporation (VVER-640). In the LOCA cases, as the pressure decreases, the reactor coolant systems is reflooded from the ECCS hydroaccumulators. or/and tanks. In the VVER-1000 design four hydroaccumulators of first stage with the initial pressure 5.9 MPa and twelve hydroaccumulators of second stage with the initial pressure 1.5 MPa are provided, each of them containing 50m3 of water. The water stored in the hydroaccumulators (taking into account for the operation of SG PHRS) permits the core to be flooded for at least 24 hours without switching on the active safety systems. For the NPPs with VVER-640 ECCS tanks with atmospheric pressure (4X460) m3 and a different principle of heat removal at the final stage of accident are provided in place of hydroaccumulators of second stage. When the primary circuit pressure is decreased to 4-5 MPa the non-return valves of hydroaccumulators open, and the boric acid is injected to the reactor vessel. Further cooldown and pressure reduction for small and medium LOCAs are accomplished

-49- Table 2 Technological and radiation criteria ensuring safe operation of the new generation NPPs with WERs Technological criteria Radiation criteria ^^^ BARRIER REACTOR FUEL FUEL CLADDING COOLANT CONTAINMENT CRITERION MATRIX SYSTEM PRODECTION ^^\^ LEVEL ^^ 1 LEVEL - Normal No fuel melting. Operational limit of At normal operation The leak of medium operation Release of fuel rod damage is the rate of from the leak tight Limits of professional exposure level PURPOSE: Assurance of radiologicaly not exceeded: unanticipated leaks shell-not more than 1. The limit of individual dose of external and internal irradiation - NPP safety at the expense hazardous -defects of gas- from the reactor 0.1% of its volume 20 mSv/year. [6], [7] of operation reliability and fission products untightness type - coolant system not per day. The designed dose rates, corresponding to the given limit with anowance maintaining barrier from the fuel not more than 0.1% higher than 100 l/h for double designed safety factor depending on the character of works, efficiency, and ensuring the matrix does not of fuel rods: The pressure is lower are used in designing protection against the ionizing radiation's. personnel's vital activity by exceed 0.3% of - direct contact of or equal to the design 2. The limit on the collective dose of personnet carrying out schedule technical means and the total.(3) nuclear fuel with the pressure (2). works connected with dose expenditures (planned maintenance, organization measures coolant-not more In the emergency inspection, refueling) - 0.5 man Sv/year. envisaged for normal than 0.01% of fuel situation the pressure operation. rods. (1) increase up to 1.15 of The limits of exoosur doses for population The external the design pressure is The individual dose - 0.1 mSv/yr.[6], [7]. temperature of permitted. (9). The limit is referred to the effective equivalent dose for the critical group claddings - s355°C of population due to NPP operation with allowance for direct and indirect No heat transfer ways of radiation impact. crisis. The limit corresponds to10% of the main limit of dose, established for the population in NRB-99.

II LEVEL - emergency DNBR- 1,2+1.3. situations -1+2a, where a - PURPOSE: Assurance of mean square error NPP safety by limiting the of correlation used normal operation till its termination and assurance of barrier efficiency and personnel vital activity by technical means including safety systems.

(1) The given values are half as large as those indicated in [8], (2) The design pressure is maximum pressure in normal operation, exept for the hydraulic tests, used in the strenth calculation (3) Up to burnup 42 MWd/kgU

Oi O i Table 2 Technological criteria Radiation criteria ^\^^ BARRIER REACTOR LEAK-TIGHT FUEL FUEL CLADDING COOLANT ENCLOSURE CRITERION MATRIX SYSTEM SYSTEM s PRODECTION ^ """--^i^ LEVEL ^- 111 LEVEL-Design No fuel melting. The maximum Loss of reactor Medium leak from Planned increased exDosure of personnel accidents fipoeXTHbie Fuel enthalpy in design fuel rod coolant can result in the protection leak- Limit of individual external exposure dose - 40-80 mSv/year.[7] anapnH reactivity impacts damage-not short-term core tight shell 0.1% of its Limit of individual effective equivalent dose in the control room and PURPOSE: Assurance of as low as 607 exceeded: deflooding. Pressure volume per day. reserve control room -25 mSv/year. NPP safety by the reliable kj/kg. - fuel cladding <1.15 of design The limits correspond to the integral doses the personnel received during the termination of operation by temperature musl pressure. accident and in mitigation of accident consequences through external and the operation of safety be 800 °C; (4) internal exposure by inhalation. systems. - local depth of Limits of population exposure doses. fuel cladding The individual dose of external whole body exposure - 5 mSv/year.[7] oxidation must be The radiation impact on (he population from accidental release of radioactive 25 % of the (4) products to the environment during the design accidents and/or external effects starting wall taken into account in the design, does not require any protection measures for thickness; the population beyond the NPP site. - fraction of oxidized zirconium £1% of its mass in fuel claddings. IV LEVEL-The beyond- The probability of The probability of Loss of reactor The probability of Planned increased exposure of personnel deslgn accidents severe core severe core coolant result in long- limited emergency This is specified in the design in accordance with the above limits for the PURPOSE: Assurance of damage or melting damage or melting term core deflooding. release must be designed accidents. NPP safety by the reliable mustbesiO"5 must be £1O~5 By the time of failure <10"^ 1/reactor year. Limits of DODuiation exposure doses termination of operation, 1/reactor year. 1/reactor year. the pressure in the The restriction of radiation impact on the population in the design accidents by protection of barriers and system < 0,1+0.2 the above limits is attained by protection measures taken ahead of schedule by assurance of vital activity of MPa. forecast of formation of accidental exposure levels. the personnel using any The zone of planning the protection measures for the population, specie - possible means. in the design for the limiting accidental release with a probability 10"7 1/reactor year is S3 km taking into account the characteristics of NPP location. The radiation impact on the population due to accidental releases of radioactive products to the environment does not require any planned protection measures outside the NPP site, except for temporal limitation on consumption of local agriculture products.

(4) This values are lower, than given in [8] figures 1200°C and 18%, respectively.

i • through the SG PHRS and, if necessary, by steam discharge from the pressurizer via the relief valve. For large and long-term LOCAs, upon the decrease in the pressure difference in the primary circuit and in the containment up to 0.6 MPa special depressurization valves, connecting the hot and cold legs of the loops with the spent fuel pool open. These valves represent passive facilities which in normal operation are closed due to the pressure of the primary circuit. The coolant and boric acid from the ECCS tanks coming from the rupture are collected in the special leak-tight enclosure around the reactor and primary loops forming the so-called emergency pool (EP). After deflooding of two hydroaccumulators and two ECCS tanks the level in EP, is set above the level of reactor's outlet pipes, and then, after deflooding all hydroaccumulators and all ECCS tanks-at the level of MCP connector (not flooding the motor). When the EP level rises up to 2.95 m from the pool bottom (approximately between the hot and cold reactor pipes) the valves on the line connecting the emergency and spent fuel pools open. Thus, the whole volume (except for the failed ECCS tanks) of water in the leak tight encloses is involved into the process of cooling the core and spent fuel. The process is stabilized and may continue, in principle, for a rather long time depending on the availability of the cooling system of leak-tight enclosure, which is designed for 24 hours in the VVER-640. In the designs of NPP of new generation the systems for severe accidents management are first provided. In spite of all measures taken to prevent the core melting it is deterministically supposed than such an accident may take place. In this case are considered the technical means of retaining the corium in the reactor vessel and if it can not be for some reasons, in a special device under the reactor vessel. Also, the measures for prevention of explosive hydrogen concentrations and protection of the containment from high pressure in severe accidents are provided. 6. Techno-economic indices of new generation units. In designing the NPPs of new generation great attention was given to updating of their technoeconomic indices by improved arrangement solutions, use of advanced equipment, reduced number of active systems. Such indices as volumes of construction, consumption of concrete and metal, construction sites, consumption of cable are reduced by 15-25% for the NPP with new VVER-1000 comparing with NPP with VVER-1000/V-320. These indices for the NPPs with VVER-640 are practically the same as for the NPPs with VVER-1000/V-320. Conclusion The concept of NPP with the VVER of new generation is developed taking into account the requirements stated in Russian normative documentation, international requirements and 35- year experience with operation of these type reactors. The safety level and efficiency of the NPP being developed in accordance with this concept should completely satisfy the needs of Russian and potential Customers for several decades after the year 2000.

References

1. "Basic Safety Principles for Nuclear Power Plants", 75-INSAG-3. IAEA, Vienna, 1988. 2. "General statements on assurance the NPP safety" (OPB-88), Moscow, 1989. 3. "General statements on assurance the NPP safety" (OPB-97), Moscow, 1987. 4. "Code of federal regulations. Part 10".NRC U.S. Washington. 1987 r. 5. "Design for safety of nuclear power plantN 50-C-D, (Rev.I), IAEA, Vienna, 1990. 6. Federal law "On radiation safety of population. 7. "Standards of radiation safety (NRB-99), R.F. Minzdrav of Russia, Moscow, 1999. 8. "Nuclear safety regulations for NPP reactor plants" PBYa RU AS-89, PNAE G-1-024-90, Moscow, 1990. 9. "Rules for construction and safe operation of equipment and pipes of nuclear power units" PN AE G-7-008-89.

-52- CZO129407

MODERNISATION AND POWER UPGRADING OF THE LOVnSA NPP

Aarno Keskinen Fortum Engineering Ltd, FOB 10, 00048 Fortum - Finland Tel. +358 10 45 32535 Fax.+3581045 33403 E-mail: [email protected]

ABSTRACT

In 1995, Imatran Voima Oy (IVO), nowadays Fortum Power and Heat, started a project for the Modernisation and Power Upgrading of the Loviisa Nuclear Power Plant. The project was completed in April 1998 when the Council of State awarded a new operation licence for the Loviisa 1 and 2 units.

During the project, the plant safety has been ensured, electricity production has been increased and a good basis for the extension of the plant's life has been elaborated. In addition the targets have been reached for training a new generation of specialists to take advantage of the nuclear energy also in the future.

Thermal power of the reactors has been upgraded by about 9.1% to 1,500 MW compared with the original power level of 1,375 MW. Together with this and certain other measures to improve the turbine efficiency, an increase of about 50 MW in the electrical output in both units has been possible. The total cost of the project is around FIM 200 million.

1. Introduction

Fortum Power and Heat (Fortum), former Imatran Voima Ltd (IVO) operates two VVER 440 Nuclear Power Units at Loviisa site. Loviisa 1 and 2 started commercial operation in 1977 (LO1) and in 1981 (LO2). Performance indicators of Loviisa 1 and 2 have been favourable, and a number of measures have been carried out to improve plant safety and reliable operation.

The project for the modernisation and power upgrading of the Loviisa NPPs gave an excellent way to take advantage of the latest development in the nuclear power plant technology. The key aspects in the project were to verify the plant safety, to improve production capacity and to give a good basis for the extension of the plant's lifetime.

At present, competition with the other methods of producing electricity is becoming increasingly tough, and the economical aspects have become more important also to nuclear operators. In the long term it is important also from the point of view of safety to keep operation of the plants at an economically profitable level. This has been admitted extensively in the whole world, and a large number of NPP operators have corresponding projects under plan and implementation.

-53- 2. Goals and preconditions of the project

Company's policy has always been to maintain and further improve the nuclear safety of Loviisa NPP. A large number of safety upgrading measures have been implemented since the start of the commercial operation of the plant. Thus the starting point to the project were quite good.

The following elements give an idea of the project starting point:

• almost 20 years were gone from the starting of the plant operation • there was need to educate new generation of nuclear specialist • Loviisa 1 RPV was successfully annealed in 1996 • feasibility study gave very positive signals for power upgrading • the existing operating licence was valid until the end of 1998 and renewal of the licence was necessary

In the first phase, the feasibility study was carried out applying in particular to the uprating of reactor thermal power. The focus of the study were in the following tasks:

• The optimisation of the power level and definition of the new parameters of the main process • Reactor core and fuel studies, including the RPV irradiation embrittlement • Safety analyses and licensing • The main components and systems » Project planning and risk assessment ^

The results in the feasibility study were quite positive for power upgrading and the decision to start the project was made. The following concrete objectives for the project were set:

(1) Plant safety as a whole will be checked and, if needed, improvements will be made, (2) Plant units will be licensed for 1,500 MW reactor thermal output, (3) Gross electric output of the plant units will be raised to about 500 MW, (4) Measures supporting plant life management / extension will be undertaken, (5) The plant long-term availability will not be impaired (6) The level of expertise of the staff will be enhanced.

3. Time schedule and project organisation

A feasibility study for modernising the plant and upgrading the reactor power was carried out starting in spring 1994, while the project itself was launched in the summer of 1995. Critical works in the time schedule, such as the revision of the Final Safety Analysis Report and the preparation of certain plant modifications, were started immediately.

Implementation of the programme were carried out in several stages. The main activities related to the reactor power upgrading were completed in 1996, and testing at the gradually upgraded reactor thermal power was started January 1997. The last transient test by final reactor power was completed successfully in December 1997.

The Council of State awarded a new operation licence for the Loviisa NPP in April 1998. The licence is valid until the end of 2007 for 1,500 MW reactor thermal power, which is 9.1% more than the previous power level of 1375 MW. Measures to improve the efficiency of the steam turbines will continue within the annual maintenance outages until the year 2002.

-54- 1994 1995 1996 1997 1998 1999 2000

1.licence* A 1.1 Operating licence A| A 1.2 IJcencefortcMrurK • P R 1J (environmental impact assessment procedure -

2. Project stages 2.1 Feasibility study —mm 2.2 Project start-up and approval of the project plan •1 2 J Safety anal vw.-s revision ••• —•

IS Test runs wmmmm 2.6 Operation at upgraded reactor power (target)

V -ApplcalOT

Fig 1. Overall time schedule of the project.

The implementation of the project was .carried out in co-operation between the Loviisa NPP and Fortum Engineering Ltd. In.addition,. mWy other organisations such as the Technical Research Centre of Finland (VTT) participated in the work. Special attention has been paid to the QA routines in the' project as well as to.the coordination of the work in several organisations. One example of this are the panicular subject-specific specialist groups which have been established to ensure the control of the entirety in essential sections such as nuclear safety and commissioning.

The .work was divided into the following ten sub-projects which each had a responsible person from the organisations of both the Loviisa NPP and Fortum Engineering Ltd:

• Operating licences • Other licences • Safety analyses and basic data management « FSAR revision and comparison of the plant with regulatory body guidelines • PSA (including level 2 PSA) • Modification of the turbines • Electricity systems • Reactor and fuel • Process systems and automation • Commissioning and revision of instructions

4. Technical implementation

Increasing the electrical output by about 50 MW in total per one unit was part of the Loviisa modernisation programme. After completing the upgrading of the reactor thermal output in April 1998, more than 80% of the total increase in the electrical output was fulfilled. The total increase of the electrical output is available when the measures to improve the steam turbines are completed in the year 2002.

The reactor power upgrading from 1375 MW to 1500 MW (+9.1%) was planned on the basis of optimising the need for heavy plant modifications. In the primary side and the sea water cooling side,

-55- the mass flow rates arc not affected, but the temperature difference has been increased in proportion to the power upgrading. In the turbine side, the live steam and the feed water flow rate were increased by about 10%, but the live steam pressure is equal with the previous value. Changes in the main process parameters are presented in Figure 2.

The reactor fuel loading is considered on the basis of the present limits set for the maximum fuel linear power and fuel burn-up. The increase in the reactor thermal output has been carried out by optimising the power distribution in the core, so that the loading of one single fuel bundle will not be increased above the maximum level before power upgrading. In parallel with this work, more advanced options have been investigated relating to the real mixing rate of the cooling water in the fuel subchannels and the increasing of the fuel enrichment. The dummy elements installed on the side of the fuel core in Loviisa 1 and 2 are preserved to minimise irradiation embrittlement of the reactor pressure vessel.

,A I - ->- 1 -C (1375 MW => I50UMW)

Fig 2. Changes in the Loviisa NPP main process parameters after upgrading the reactor power by 9.1%

The WER 440 design margins in the primary side are rather large and the hardware modifications needed there were quite limited. Replacement of the pressurised safety valves was indicated already during the feasibility study as a necessary measure because of the power upgrading. Most of the other substantial measures in the primary side were carried out on the basis of the continuing effort to maintain and raise the safety level of the plant, and they are not directly included in the power upgrading.

More extensive measures were necessary to carry out in the turbine plant and the electrical components. Steam turbines are modified to a higher steam flow rate. Also the efficiency and operation reliability of steam turbines have improved. Certain modifications were carried out in the electrical generators and the main transformers to ensure long-term reliability in operation with the upgraded power output.

5. Trial operation and long term operation experience

The last step in the process to upgrade the reactor thermal power was the long-term trial run to verify the main process parameters as well as plant operation in both steady state and transient situations. The trial run was carried out in gradually upgraded reactor power with a power level of 103 %, 105 %, 107 % and finally 109 %. Transient tests defined in the test programme were performed with a reactor thermal power of 105 % and 109 %. The test programme included e.g. one feed water pump trip, PCP trip and turbine trip to house load operation. The test results correspond very well with all analyses and calculations. The accept criteria for the tests were also fulfilled.

-56- In the long term operation special attention has been paid to phenomena affected by increased mass flow in water-steam process:

• live steam moisture content • vibration in pipe lines and process components • erosion corrosion • fuel leakage

Live steam moisture content has increased slightly compared to the situation before reactor power upgrading. However, the steam generator moisture separators operate still in sufficient range with acceptable parameters. The live steam moisture content has remained under 0.2 %.

Vibrations in certain pipe lines increased quite clearly as an effect of the increased mass flow. The results from specific vibration measuring program were utilised in the vibration analyses carried out to the piping systems. As a result of the vibration analyses the specific vibration dampers were installed in the main steam lines and in the main feed water lines.

Erosion corrosion rate in process systems depends on combination of different factors like material characteristics, shape of the flow paths, and process and chemical conditions. Reactor power upgrading has effected increased mass flow rates and moisture content in certain parts of the process. That can cause increase in erosion corrosion rate, too. Inspection results in revision outage in summer 1999 indicate some local increase in erosion corrosion rates. However, the time span is still too short and operation experience inadequate to make general conclusions on erosion corrosion affected by power upgrading.

The risk for fuel leakage was analysed to be very small due to the reactor power increase. The operation results from two years period supports clearly the calculation results.

6. Licensing procedure and safety analyses

The modernisation programme as a whole was started from the basis of the positive safety progress. This was applied by taking advantage of the latest development in calculation codes and technology as well as feedback of the operating experience, expertise in the ageing processes and safety reassessment coupled with the evolution of safety standards.

STUK, the Radiation and Nuclear Safety Authority, was closely involved at every stage of the project, from the early planning of the concept to the evaluation of the results from the test runs. STUK examined all the modification plans that might be expected to have an impact on plant safety. Individual permits were granted on stage by stage, based on the successful implementation of previous work.

The renewal of the operation licence for the increased reactor power was carried out in the following steps:

• permission from the Ministry of Trade and Industry to make plant modifications and test runs with upgraded reactor power under the existing operation licence and under the control of STUK • assessment of the environmental impact (EIA-procedure) of the project • STUK's approval of the Final Safety Analyses Report (FSAR), the safety-related plant modifications, test programmes and results. • the Ministry of Trade and Industry, the responsible ministry of the NPP operation licences, received a statement from several local and national organisations

-57- • the operation licence was prepared by Ministry of Trade and Industry, and the Council of State awarded the licence in their session on 2 April 1998. The licence is awarded to 1,500 MW nominal reactor thermal power (9.1% increase to the previous licence, to 1,375 MW) until the end of the year 2007.

The environmental impact has been assessed in the EIA Report, which was completed in December 1996. This is the first time in Finland (parallel with TVO plant having a corresponding modernisation programme) the EIA Procedure has been applied to a nuclear power plant. The law and the decree set certain procedures, including the public hearing for screening, scoping and the EIA statement, which are the stages of this procedure.

The result was that the reactor thermal power upgrading has no other considerable environmental impact than a slight increase in the outlet temperature of the cooling water. This means that the maximum temperature increase of the cooling water in the main condenser, before releasing back to the sea, is about 1°C higher than the present temperature increase, which is typically close to 10°C.

An extensive safety review and comparison of the plant with the latest national regulatory body guidelines (YVL guides) have been carried out. This work was performed taking into account many international standards, such as the IAEA standard "A Common Basis for Judging the Safety of Nuclear Power Plants Built to the Earlier Standards INSAG-8". As a result of the work, a particular safety review report has been completed.

A part of the safety review and the licensing process of the reactor power upgrading were the renewal of the Final Safety Analyses Report. New accident analyses have been made concerning the containment pressure, LOCA and MSLB, for example. In addition to the accident analyses, there are a large number of transient situations that have also been analysed. The risk for radioactive release to the environment was considered from the probabilistic base (PSA level 2) also for the first time in respect of the Loviisa NPP.

7. Summary

In the project for the modernisation and power upgrading, the Loviisa NPP utilised the advancement of nuclear plant technology and analysing methods. Plant safety has been verified, production capacity improved, and a good basis for the extension of the plant's life has been achieved.

An extensive safety review and comparison of the plant with the latest national regulatory body guidelines have been carried out. This was also the first time in Finland the environmental impact of a NPP has been assessed in accordance with a systematic EIA procedure.

The results in the long-term trial operation with gradually upgraded reactor power correspond very well to the analyses and calculations. STUK, the Authority of Radiation and Nuclear Safety, considered the results. In April 1998, the Council of State awarded Loviisa NPP an operating licence for 1,500 MW reactor thermal power, which is 9.1% more than the previous nominal power. The total increase in electrical output of two plant units is about 100 MW.

The special program was carried out to follow-up the possible long-term changes in the plant after power upgrading. Particular attention have paid to the live steam moisture content, vibrations in pipe lines, erosion corrosion rate and fuel leakage. The results obtained during two years operation with 1,500 MW reactor power are very good and no surprise has occurred.

-58- CZO129408 SAFETY IMPROVEMENTS OF TEMELIN NPP

JosefVfta CEZ, a. s. - NPP Tcmelin Czech Republic

1. INTRODUCTION

Decision on the construction of a nuclear power plant at Temelin site was made in 1980 as a result of expert site selection for 4 units with WER-1000/320 reactors. Contract on the supply of so-called ,,TechnicaI design" from the former USSR was signed in 1982. This design included turbine hall, reactor and auxiliary buildings and diesel generator stations. Design of the balance of the plant was entirely in hands of Czech party according to the contract. The Basic Design of Temelin NPP Units 1 and 2 was completed by the Czech ,,Architect Designer" company Energoprojekt (EGP) Praha in 1985. The site license was issued in 1985 and construction license in November 1986. Actual erection of the buildings was launched in February 1987. Domestic specialists analyzed and subsequently modified the original design as early as before 1989. After 1989, under new political and especially economical conditions, the demand of the Czech Republic for 4000 MW power was re- evaluated and at the same time new analyses of the design safety level were performed. In March 1993 the government of the Czech Republic decided that NPP Temelin construction will be finished with two units.

SCHEDULE FOR COMMISSIONING AND COMMERCIAL OPERATION AT TEMELIN NPP

Containment Integrity Testing * 12/2000 (leakproof test and strength test) Control Room technology testing 01/2001

Primary Circuit integrated hydro-testing 07/2001 Fuel loading into the reactor (start of physical commissioning) 11/2001 Start of commercial operation after complex testing and successful 144 hour test 08/2002

• Strength and leakproof testing of the Temelin NPP Unit 1 containment took place during the period from December 14, 1998 through January, 1999. The containment met al! strength and leakproof criteria. The leak amount found during the leakproof testing is one digit place lower than the prescribed values. The achieved testing results can be compared to the best of results achieved abroad.

This paper briefly describes the effort spent to enhance safety level of the plant considering all recommendations made by different assessment missions.

2. NUCLEAR SAFETY LEGISLATION FRAMEWORK

The license application for the nuclear installation commissioning and operation must be accompanied, among others, with the Final Safety Analysis Report (FSAR), the content of which shall include:

1. description of changes to the original design assessed in the Preliminary Safety

-59- Analysis Report; 2. supplementary and more precise evidence of nuclear safety and radiation protection measures; 3. technical specifications for the nuclear installation safe operation; 4. neutron-physics characteristics of the nuclear reactor; 5. method of radioactive waste management; 6. quality evaluation of classified equipment.

3. INTERNATIONAL EXPERT APPRAISALS

International missions to the Temelin NPP are dated since the beginning of nineties. These missions were invited to provide an independent evaluation of the original Russian design and some other aspects of the plant construction from the stand-point of internationally adopted standards.

In 1990 upon invitation from (that time) the Czechoslovak government the IAEA organized three international expert missions:

• Mission aimed at the evaluation of the Temelin site safety (April 1990) • Pre-OSSART mission on the plant construction practice and on the preparation of safe operation (turn April/May 1990) • Mission focused on the safety systems, core design and safety analyses evaluation (turn June/July 1990).

These missions stated that the design of NPP Temelin, its siting and organization of construction did not show any significant deviations from the international practice. The final reports of those missions offered some partial recommendations which should have contributed to the plant safety level enhancement. The follow-up Pre-OSSART mission took place in February 1992, assessing to what degree the 1990 recommendations were considered and implemented in the construction and in the preparation for future operation.

In addition to the activities listed above, the CEZ contracted consulting company Halliburton NUS in 1991 to perform an independent audit focused on the power plant technical concept and to verify whether the plant will be licensable with respect to standards accepted for a plant built in Western Europe or the US in the mid-1990s. The audit team concluded that the overall technical concept of Temelin is in many respects consistent with modern reactor designs used in the West. Temelin includes, or can be practically modified to include, essentially all features necessary to reflect Western nuclear power plant standards designed for the mid- 1990s. Some of the initial Temelin design concepts and criteria fall short of modern practices, but these shortcomings can be removed by changes in the design. These include the addition of a new I&C system, improved fuel and core design, improvements resulting from VVER and PWR operating experience, and improvements resulting from the audit team recommendations.

Besides that, some analyses were performed by COLENCO (Switzerland) and TUV Bayern e. V. (Germany), which specifically assessed I&C design.

Among other IAEA significant activities with respect to NPP Temelin it should be especially mentioned:

• QARAT mission focused on quality assurance (turn March/April 1994)

-60- • Consultants Meeting on the Temelin design changes at the IAEA Headquarters in Vienna (turn November/December 1994) • Mission focused at the fire protection of the plant (February 1996).

A special mission of the IAEA in 1996 examined how Temelin plant has solved safety issues identified by the IAEA as generic for nuclear power plants with VVER-1000/320 type reactor. The mission evaluated the innovated design, implementation of previously suggested alterations and the preparation for operation. This included the compatibility issues, i.e. compatibility of modern western technology with the original Russian design. In general, the mission concluded and highly commended that the future plant operator had spent a significant effort in improving the plant design. The mission emphasized that the combination of western and eastern technology in the Temelin design was considered very carefully, indeed. In mission's opinion, in some cases such combination of western and eastern technology resulted in a pronounced improvement of the safety assurance level, compared with international practice.

Another IAEA mission focused on commissioning for Temelin NPP took place in February 2000 and Osart mission is planned for February 2001.

List of missions is shown in attachment No. 1.

4. MAIN DESIGN CHANGES AND SAFETY IMPROVEMENTS

Results of the independent international reviews organized by the IAEA, proposals of Czech specialists (including the SUJB recommendations) and results of the NUS Halliburton audit were used as a basis for technical improvements which, following implementation prior commissioning, will assure that both units of NPP Temelin will reach engineering standards usual for western power plants at the end of nineties. Among a number of improvements related to the replacement of components and systems, following should be mentioned:

• replacement of I&C • replacement of core and nuclear fuel • replacement of the original radiation monitoring system • replacement and supplementing of the diagnostic system • replacement of original cables with fire-retardant and fire-resistant ones • significant changes in the electrical design (electrical protections, addition of 2 non-safety grade dieselgenerators, increased discharge time of batteries), etc.

All significant design modifications are summarized in attachment No. 2.

5. TEMELIN NPP SAFETY ANALYSES

The Westinghouse provides the fuel, I&C, safety analyses, and emergency response guidelines for Temelin NPP. This scope permits to apply the systematic and integrated approach to nuclear safety (control, monitoring, protection) that is applied also to a Westinghouse designed plants. This approach integrates: core design, plant and core monitoring, plant and core control, protection system design, safety analyses, core and plant operating limits, and emergency response guidelines. This integrated approach enhances defense in depth, which is considered to be composed of the following echelons of defense:

• Control Systems (maintains plant parameters during normal operation)

-61 - • Alarms and Manual Control (allows the operator to observe and correct deviations from normal operation) • Limitation Systems and Backup Control (the Temelin NPP design provides for extensive "supervisory" control that can automatically take rapid action in the event of a malfunction, thus avoiding the need for protective action that would trip the plant) • Primary Reactor Protection System (PRPS) - 'the safety system of Class 1 E providing automatic protection to shutdown reactor and automatic actuation and control of emergency safeguards features (ESF) • Diverse Protection System (DPS) - the safety system of Class 1 E providing backup protection for a postulated CCF in the PRPS (provides reactor trip, some ESF actuation and control).

As stated above, a systematic approach to safety analysis is also a systematic approach to protection system design. That is, one must:

• Define unacceptable consequences (offsite dose, DNB, fuel failure, etc.) • Determine limits on plant operation which could lead to unacceptable consequences if exceeded • Define required protection system functions based upon events & consequences • Select acceptance criteria, assumptions, and methods • Analyze complete spectrum of plant conditions for the accident scenarios considered (specific analyses of particular events are of course unnecessary if an evaluation shows the event to be bounded by another event that is analyzed • Demonstrate by results of analyses that protection system keeps the plant safe and that consequences are consistent with accepted criteria • Develop limiting conditions for operation & monitoring requirements • Protection system setpoints derived from the safety analysis • Plant operations maintained within limits assessed in the safety analysis

The Temelin FSAR content is shown in attachment No. 3.

6. SAFETY IMPROVEMENT PROGRAM (Program)

In accordance with a CEZ, a. s. policy stated in ,,Safety Strategy", it is planned to perform continual safety assessments and to incorporate additional improvements above the framework of the legal requirements. This is one of measures for attaining a high safety level.

The Program is elaborated for the period that comes after launching trial operation of the Unit 1 Temelin NPP - however, fulfillment of some items of the Program will be or is initiated in advance. The Program is an open document that will be systematically updated on the basis of: • periodical NPP's units safety assessments • WANO indicators assessments • results of operational experience • supervisory bodies' assessments (Nuclear and Civil safety authority...) • independent assessment recommendation (WANO, IAEA, external audit...)

The aim of the Program is not only to improve HW and SW but also the analytical assessment of safety and impact on environment as well as improvements of the organization and human factors.

-62- The Program is updated every December (1st updating will be done in December 2000) based on preliminary discussed items/activities in NPP Temelin Safety Technical Commission Meeting or whenever depending on decision of the top management of NPP Temelin Construction Division.

First version of Program is shown in attachment No. 4

-63- Attachment No. 1 INTERNATIONAL MISSIONS OF THE IAEA AT TEMELIN NPP Mission objective / dates Focus / Participation Conclusions

Site safety review mission * The site selection assessment * The mission's conclusion was that (4/1990) including demographic conditions, the Temelin site meets all safety dispersion features and external events criteria in accordance with the IAEA * Italian, Austrian, British, Dutch and recommendations IAEA experts PRE - OSART mission * Evaluation of 10 safety aspects of the * The overall conclusion was that the (4-5/1990) standard agenda of PRE OSART work carried out at the site is of a mission high quality. The mission identified * Canadian, American, Italian, good practices which are of interest German, Finnish, British and IAEA for other plants and made several experts proposals for improvements including a positive statement about the intent to replace the existing I&C with a Western advanced Design review mission * The reactor core and safety systems * The Design is very similar to (6-7/1990) design assessment modern PWR plants which have been * American, French, German, put into operation in other countries. Bulgarian and IAEA experts The mission did not identify any major safety problems and recommended possible further improvements Pre - OSART mission follow - up * The Pre - OSART findings and * The conclusion was that despite the visit recommendations made in 1990 large number of recommendations (2 /1992) reviewed in order to determine the made, the plant has made satisfactory actions resulting from the previous progress in addressing the issues mission raised by the Pre-OSART mission * British, Italian and IAEA experts review Quality Assurance Review * QA system assessment, mainly * The expert group confirms the (QARAT) mission management and QA Department positive development of this field (3-4/1993) functions being managed by a competent team * French and IAEA experts and the senior management Leak Before Break Application A review of the modern Western * It was confirmed that the LBB review mission conception application during the application was successfully (5/1993,12/1993, 12/1994,12/1995) integrity assessment of the high energy performed at Temelin NPP in stressed pipelines accordance with world practice and * Austrian, Japanese, German and that breaks are extremely unlikely IAEA experts Fire safety mission * A fire analysis, licensing and The experts conclusion was that (2/ 1996) operation performance review from fire significant improvements have been safety point of view made in accordance with * Canadian and IAEA experts international trends in fire protection Probabilistic Safety Assessment * Transfer of technology, methodology * The general conclusion was that the review missions and results of the PSA study review Temelin team has adopted the PSA (5/1995 and 1 /1996) * Austrian, American, German, British, methodology very well and despite Spanish and IAEA experts conservative assumptions the results confirmed the high level of the plant safety Safety issues of WWER 1000 * A review of resolution of WWER 1000 GENERAL CONCLUSIONS... resolution review mission safety issues at Temelin NPP which (3/1996) have been identified by the IAEA as a result of its thorough analyses • French, Spanish, Russian, Swedish, German and IAEA experts

-64- GENERAL CONCLUSIONS of the March 1996 mission:

1) It is recognized that the Czech Electric Company (CEZ) has made a large effort to improve the design of Temelin independently of the identification of safety issues by the IAEA. The organization of their actions in terms of the IAEA issues was only a convenient way to demonstrate that all of the issues are being taken into consideration.

2) The scope of national participation in the Temelin design, manufacturing and construction has had a positive impact on solving several safety issues identified in WWER-1000/320 plants.

3) The adoption of Western technology and practices for a part of the scope of supply (e.g. fuel, I&C, radiological protection, accident analysis) has helped to solve a large number of safety issues identified for WWER-1000/320 NPPs.

4)Several safety issues which are addressed by ongoing activities have not been completely solved, but the related activities are properly managed and, in most cases, there seems to be sufficient time for their completion.

5) The mission recognizes the effort of Temelin NPP to ensure that all the safety issues identified by the IAEA have been addressed. In general this effort was successful, since no issue has been identified which has not been addressed to some degree. Most of the issues have been properly addressed.

6) The combination of Eastern and Western technology and practices and the potential compatibility problems seem to have been carefully considered at Temelin. In several cases, the combination of Western and Eastern technology has led to safety improvements in comparison with international practices.

Physical Protection Assurance * The review of the NPP Physical * The conclusion of the experts was mission-IPPAS Protection aspects defined by the IAEA very positive on the physical 9/1998) * American, French, Finnish, Canadian protection assurance and its and IAEA experts licensing. They concluded that system meets fully the international requirements .

-65- Attachment No. 2 MAIN DESIGN CHANGES AND SAFETY IMPROVEMENTS Item Item description Note No. ] nstrumentation and Control System &C of unit 1 and 2. replacement (hereinafter referred to as I&C) 2 leactor Core Design and Nuclear Fuel ^ew nuclear fuel brings substantial nuclear safety enhancement, radioactive waste amount decrease and operational cost reduction. 3 ladiation Monitoring System (RMS) Original system design did not comply either with echnical nor legislative requirements. 4 TMDS 'rimary Circle Diagnostic System was a "white spot" n the initial Project (listed in a book ADC) 5 Sipping system Original Russian system (KGO) did not meet requirements of new legislative and western standards. 6 3itumenation Line lequirement for radioactive waste reduction (RAO) specified by PRE-OSART. 7 Refueling machine - I&C Replacement of original control system of GANZ Co. By ANSALDO Co. system 8 Spent Nuclear Fuel Compact Storing Compact grate allows substantial increase of storage capacity in the spent fuel pool 9 Full Scope Simulator Operative personnel training assurance 10 Technical Support Centre Fulfilment of recommendations adopted after TMI PP (emergency preparedness) accident 11 Inverters/ Rectifiers (AEG) Replacement of original Russian AEP instrumentation (ANN) of safety systems power supply, 4th and 5th systems and protection systems was initiated by nuclear safety enhancement requirements 12 Penetrations (Skoda+ISTC Company) Assurance of safe and reliable hermetic penetrations

13 Circuit breakers J2UX replacement Continuous negative operational experience from NPP BO and NPP DU (fires etc.) 14 Unit Transformer Penetrations (Passoni Villa bushings) 15 Replenishment of reserve power supply Strict compliance with own consumption block source for 2.HVB energizing principles 16 Common reserve DGS (diesel generator Systems "nuclear safety related systems" added by station) emergency/ accident resource to maintain this sort of supply for important and expensive unit equipment 17 Accumulator batteries capacity increase AKU exchange was initiated by negative operation experience; capacity increase allows overcoming of defect states in total loss of supply regime 18 "Reserve Protections" Implementation and Overall selective scheme ensures elimination of failure Full Selectivity in Radial Networks 6 kV/ nn consequences in the unit electro section (short-circuit, Assurance dead earth, ... ) 19 Volume Compensation System - electrical Lower use of primary circle machinery components heaters continuous regulation (pressuriser) service life 20 Containment Hydrogen Elimination of post-accident hydrogen content in Recombinars containment 21 Hydrogen Post Accident Monitoring System Control of hydrogen post accident content development in containment 22 Valve replacement Replacement of defect and low reliable valves 23 Reconstruction of Stable Fire-Extinguishing Adding of existing manual SHZ starters by automatic Equipment (SHZ) of the outdoor power activation + modification of spray equipment baskets transformers and increasing the amount of nozzles, inter-walls installation 24 Secondary Voltage Regulation (SRKO) Technical requirements of CEZ a.s. specified in relation with preparation of operation with UCPTE Item Item description Note No.

-66- 25 Terminal NPP TE (TELETE) Technical requirements of CEZ a.s. specified in relation with preparation of operation with UCPTE 26 Modification of Important Technical Water Since the technical calculations were carried out it was (TVD) and Unimportant Technical Water important to implement modifications for system frVN) systems functionality assurance 27 Pump replacement Producers ceased to exist, inappropriate characteristics 28 Containment sump modifications Net construction modifications in compliance with tests carried out in Russia 29 Suction from containment (simple failure/ Installation of 1 closing valve and adjacent piping defect) under containment 30 Titan tubing in condensers Life service increase, transition to more advantageous chemical regime by pH increase 31 Control Rod Drive System (LPK) Life service and reliability increase by using of SKODA innovated drives 32 New Chemical Control Higher chemical control quality provides higher life serviceability of important components, especially steam generators 33 Safety analyses (US RG 1.70) Analyses elaboration mainly in relation with fuel replacement and I&C 34 ATWS analyses Analyses performance in accordance with the newest nuclear power knowledge 35 PSA - level 1 and 2 (Probabilistic Safety Level 1 - discusses probability of active zone damage Analyses) Level 2 - discusses probability of leakage due to containment damage 36 Beyond Design Analyses Selected Accident Analysis for new Accident management conception 37 IV&V (independent verification and Independent verification of correctness of SW reactor validation of SW) accident protections and safety / protection systems 38 LBB assessment Verification of the rate of assurance of primary section pipeline systems integrity (LOCA prevention) 39 EOP Emergency Operating Procedures (symptom based oriented accident emergency procedures) - accident prevention 40 SAMG Severe Accident Management Guidelines (logical continuity to EOP) - accident consequences mitigation 41 Fire Safety, cables, EPS Implementation of non-combustible and fire non- propagating cabling and electrical fire signaling systems (EPS) by CERBERUS Co. 42 Seismicity - analysis Elaboration of new seismic assessment (0.1 g) and floor response spectra for individual seismic buildings floors — seismic re-qualification 43 Documentation Control system Assurance of Evidence Documentation Elaboration for selected facilities/ equipment (solidity, serviceability, seismicity ...) 44 ISE (NPP Information Systems) Implementation of computer information system 45 Accommodation of Internal Steam Generators Accommodation in the supply point and PG separation In-fittings (PG) (serviceability increase ...) 46 Supplementing of new level measurements in Securing Safety Divisions Sections PG 47 Polar Bridge Crane Controlling System Original controlling system ROBOTRON (East Germany) replacement; it did not maintain fulfilment of required functions; 48 Filtration Station for Emergency Control HVAC Systems Filter Adding maintains ND Room (ND) habitability even in accidental conditions 49 Unit Control Room HVAC Systems Maintenance of required control room habitability Accommodation (BD) conditions for personnel (noise level, temperature, ...)

-67- Item Item description Note No. 50 GERB Dampers Seismic requirements fulfilment

51 Supplementary of Drencher Fire- Supervisory Body's requirements fulfilment Extinguishing Systems for Main Circulation Pumps 52 Supplementary of Post-Accidental Liquid Radioactive Waste Volume Reduction (RAO) RAO Processing (Liquidation) Systems 53 Supplementary of Boron Collection Waters Radioactive waste volume reduction (RAO) Systems and Post-Active-Water Exchange Separation Systems 54 Asbestos Sealing Replacement Replacement by Teflon maintains higher serviceability of the technological equipment 55 New Exchangers of Active Accident Systems Low quality of original exchangers design 56 Supplementary of Pressuriser Relief Valve Avoiding number of action of the pressuriser main safety valves 57 Supplementary of Fast-speed valves on steam Protection of important and expensive component generator steam piping 58 Main Circulation Pumps Modernization Maintenance of required flow through active zone, impeller reinforcement, rotor balancing ... 59 High-activity RAO Organized deposition Changing of original radioactive waste deposition conception (RAO) 60 Freon Replacement Chilling Station Reconstruction by using of absorption units

-68- Attachment No. 3 TEMELIN FSAR CONTENT CHAPTER 15 No Chapter iTCeiDEIS!?lS£N&^ • •; 15.0 Set of the complete input data used for accident analyses 15.1 Increase in heat removal by the secondary system 15.1.1 Feedwater system malfunctions causing a reduction in feedwater temperature I. Full opening of the bypass valve of a regenerative heat exchanger (RHE) II. TripofallRHEs III. Trip n/3 legs of heat exchangers (n = 1, 2, 3) 15.1.2 Feedwater system malfunctions causing an increase in feedwater flow a) Accidental opening of FCV at full power - automatic rod control - manual rod control b) Accidental opening of FCV at zero power 15.1.3 Steam pressure regulator malfunction or failure that results in increasing steam flow a) Minimum feedback + automatic rod control b) Minimum feedback + manual rod control c) Maximum feedback + automatic rod control d) Maximum feedback + manual rod control 15.1.4 Inadvertent opening of SG relief or safety valve causing a depressurization of the MSS a) Inadvertent opening of 1 ADV b) Inadvertent opening and stuck open SGSV c) Inadvertent opening of turbine bypass valve 15.1.5 Spectrum of main steam line breaks a) Rupture of steam line inside containment b) Rupture of steam line outside containment c) Rupture of main steam header 15.2 Decrease in heat removal by the secondary system 15.2.1 Steam pressure regulator malfunction or failure that results in decreasing steam flow 15.2.2 Loss of external electrical load 15.2.3 Turbine trip (TG stop valve closure) a) Minimum feedback with pressure control b) Minimum feedback without pressure control c) Maximum feedback with pressure control d) Maximum feedback without pressure control 15.2.4 Inadvertent closure of the MSIVs 15.2.5 Loss of condenser vacuum a) Trip 1/2 condenser cooling water pumps b) Trip 2/2 condenser cooling water pumps 15.2.6 Loss of onsite and offsite AC power a) Main TG breaker trip b) Loss of onsite AC power 15.2.7 Loss of normal feedwater flow a) LONF with offsite power, with No MCP Trip b) LONF with offsite power, with MCP Trip c) LONF without offsite power d) Loss of 1 MFW pump e) Loss of 2 MFW pumps and failure of AFW pump f) Closure of isolation valve on main feedwater line g) Loss of condensate pumps (different combinations) h) Loss of essential cooling water pumps 15.2.8 Feedwater line breaks a) Main feedwater line break, offsite power available b) Main feedwater line break, offsite power unavailable c) Break downstream and upstream check valves d) Main feedwater header rupture

-69- No Chapter 15.3 Decrease in reactor coolant system flow rate 15.3.1 Single and multiple MCP trips and complete loss of forced reactor coolant flow a) 4/4-CLOF b) 3/3-CLOF c) 2/2-CLOF d) 3/4-PLOF e) 2/4-PLOF f) 1/4-PLOF g) 2/3-PLOF h) 1/3-PLOF l) 1/2-PLOF ) 1/4 + 3/4 - SLOF k) 1/3+ 2/3-SLOF 1) 1/2+1/2-SLOF 15.3.2 Mot applicable forNPP Temelin 15.3.3 vlain coolant pump shaft seizure (locked rotor) a) 1/4 b) 1/3 c) 1/2 15.3.4 Main coolant pump shaft break a) 1/4 b) 1/3 c) 1/2 15.3.5 Deterioration of heat removal a) Cooling down by natural circulation b) Cooling down by coolant vaporization c) Partial coolant flow blockage through the fuel assembly 15.4 Reactivity and power distribution anomalies 15.4.1 Uncontrolled control rod bank withdrawal from a subcritical or low power startup condition a) Analyzed to evaluate minimum DNBR b) Analyzed to evaluate hot spot fuel temperature 15.4.2 Uncontrolled control rod bank withdrawal at power a) 4 Loop, 100% power, Maximum feedback b) 4 Loop, 100% power, Minimum feedback c) 4 Loop, 60% power, Maximum feedback d) 4 Loop, 60% power, Minimum feedback e) 4 Loop, 10% power, Maximum feedback f) 4 Loop, 10% power, Minimum feedback g) 3 Loop, 67% power, Maximum feedback h) 3 Loop, 67% power, Minimum feedback i) 3 Loop, 10% power, Maximum feedback j) 3 Loop, 10% power, Minimum feedback k) 2 Loop, 50% power, Maximum feedback 1) 2 Loop, 50% power, Minimum feedback m) 2 Loop, 10% power, Maximum feedback n) 2 Loop, 10% power, Minimum feedback 15.4.3 Control rod malfunction a) One or more RCCAs within the same group dropped b) A dropped RCCA bank c) Statically misaligned rod d) Single rod withdrawal at power 15.4.4 Startup of an inactive RCS loop at an incorrect temperature a) Transition from 3-loop to 4-Loop Operation b) Transition from 2-loop to 3-Loop Operation 15.4.5 Not applicable for NPP Temelin 15.4.6 Chemical and volume control system (TK) malfunction resulting to a RCS boron concentration decrease a) Uncontrolled boron dilution in coolant

-70- No Chapter - Boron dilution in coolant, mode 1 - Boron dilution in coolant, mode 2 - Boron dilution in coolant, mode 3 - Boron dilution in coolant, mode 4 b) Sudden transition to RCS charging by 60 - 70 deg C charging water 15.4.7 Inadvertent loading and operation of a fuel assembly in an improper position a) Misloading error b) Enrichment error 15.4.8 Spectrum of rod ejection accidents a) Hot full power, Beginning of life b) Hot full power, End of life c) Hot zero power, Beginning of life d) Hot zero power, End of life 15.4.9 Not applicable for NPP Temelin 15.5 Increase in reactor coolant inventory 15.5.1 Inadvertent actuation of the ECCS during power operation 15.5.2 Chemical and volume control system malfunction that increases reactor coolant system inventory a) CVCS malfunction analyzed to evaluate minimum DNBR b) Inadvertent injection from standard charging system into pressurizer with water temperature 60 - 70 deg C c) Pressurizer spray valve opening and stuck open 15.5.3 Not applicable for NPP Temelin 15.6 Decrease in reactor coolant inventory 15.6.1 Inadvertent opening of a pressurizer safety or relief valve a) Pressurizer safety valve inadvertent opening and stuck open 5) Insufficient closing of a pressurizer safety valve following right opening 15.6.2 3reaks at instruments line or other RCPB lines penetrating the containment 15.6.3 Steam generator rube rupture 15.6.4 Steam generator internal manifold failure 15.6.5 _oss of coolant accidents (LOCAs) a) Large Breaks )) Small Breaks 15.7 tadioactive release from a subsystem or component 15.7.1 Radioactive gas waste system leak or failure 15.7.2 ladioactive liquid waste system leak or failure 15.7.3 Postulated radioactive releases due to liquid tank failures 15.7.4 Design basis fuel handling accident in the containment a) Dropped assembly impacts another assembly still in the reactor core >) Dropped assembly drops into the spent fuel canal, striking the floor of the canal c) Dropped assembly drops into the spent fuel storage pool, striking either the floor of the pool or another fuel assembly in the spent fuel storage racks 15.7.5 Spent fuel cask drop accidents 15.8 Anticipated transients without scram (ATVVS) 15.8.1 nadvertent control rod withdrawal 15.8.2 -oss of feedwater 35.8.3 -oss of AC power 15.8.4 -oss of electrical load 15.8.5 -oss of condenser vacuum 15.8.6 "urbine trip 15.8.7 Closure of main steam line isolation valves 15.8.8 leactor shutdown to hot standby state by boron concentration increasing 15.9 ^oss of essential cooling water pumps

Attachment No. 4 SAFETY IMPROVEMENT PROGRAM Item No. Technical Description Start Notes Finish

-71 - 1 PSA level 1-upgrade 09/1999 Internal event "shut down" in 08/2000 and external 08/2000 (fire, floods etc.) in 12/2000 2 PSA level 2-upgradc 03/2001 09/2001 3 Safety Monitor (SM) 11/1999 SM trial network operation in 11/1999 with existing 12/2001 models, gradual upgrade of SM models - upon PSA level-1 models upgrade 4 SAMG (Severe Accident Management 01/2000 Guidelines) 02/2001 5 Installation of Restrictors in room A 1999 820 and in the hermetic zone 2000 6 Information System of the NPP 1999 Documentation Management Module has already modules: 2000 been in a trial operation, Technical Change -documentation Management Module will be set into operation in -management 2000 -technical change - management 7 Fuel Management It concerns implementation of selected items of Post Irradiation Inspection Program (PIIP) on the frame of - PUP extension to further campaigns; 07/2004 as the SUJB (State Office for Nuclear Safety - required hereinafter referred to as SONS) campaigns requirements

- PUP Methods Improvement Application of improved methods within PUP as required

- Transition to developed alloys in PS due to - ZIRLO, E635, and conditions for PE and PS load construction; operatio-nal bearing elements; results

- Fluency Decrease on TNR - TNR Residual Service Life Increase resulting in 07/2004 safety enhancement for the PP's entire service life period; 8 Core Control:

- Transition to DMM version of AZ Approx. - DMM version monitors DNBR directly. Transition BEACON condition monitoring 2004 is connected with safety analysis re-evaluation; program;

- Adaptation of developed calibration Approx. Accuracy enhancement and calibration method excore/ incore; 2003 simplification resulting in safety enhancement;

Implementation of Fuel State 1989 - Variant of NPP DU program; development started, Monitoring Program and 2005 consistence with high degree fuel bum-up program Methodology

-72- Item No Technical Description Start Notes Finish 9 Safety Analysis:

- Regular re-evaluation of accuracy 03/2000 -Explicit formulation of marfins; codes for accuracy prediction 2030 enhancement

- Application of improved methods 2001 -Projection of current reserves and operational during regular safety analyses re- 2030 experience into selected limits for NPP operation; evaluation;

-Technology transfer for selectee 1999 - Approved by Investment Commission within Fuel safety analyses; 2001 Contract

-Implementation of Fuel Rods 1989 -Development has started and continues; will be as Analysis Program and Improvec 2005 overall CEZ Thermomech. code Methods for high bum-up conditions 10 EIA (updating of elaborated 11/1999 Processing of Environmental Impact Assessment Environment Impact Assessment 11/2000 studies according to CR Law No. 244/1992 Coll. with studies); regard to changes applied in the building proceeding since July 1, 1992 11 Safety Indicators Evaluation Trial In accordance with agreement with SONS in "pre- Implementation as per SONS opreration trial" operation methodology contin. 12 Engineer (Display) Simulator 2000 Technical tool for management and optimizing of 2002 operating procedures and personnel activities on BD 13 Physical Protection - replacement of 2003 Replacement of existing identification system for identification system 2005 checking the vehicle authorization to enter the NPP TEMELFN guarded area on the main entrance 14 Fire Protection - Reconstruction of 1999 CEZ-NPP TEMELIN Fire Rescue 2000 Corp Controlling Center 15 "Ire Protection - vehicle fleet 2001 Gradual replacement of vehicle fleet in Company's 2005 Bremen Rescue Brigade will be implemented 16 Monitoring of temperature increase 2000 The task encompasses monitoring and assessment of mpact in Vltava River by NPP 003 water quality changes at Orlik dam and tributary TEMELIN discharge mouth on. water treams, their seasonal changes, monitoring of quality development in relation with adioactive elements content in fish and dam bottom ts further utilization; ediments bio-mass, monitoring of water macro-fyt as water environment bioindicators, changes in fish sort jopulation and fish bio-mass, chlorophyll concentration and other hydro-biological characteristics monitoring

17 vionitoring and evaluation of 2000 * Assessed period of implementation - full scope underground water quality, * minimum 10 years; limited scope (underground water monitoring of underground water uality) during the entire NPP life service evel and evaluation of underground water regime (underground water movement, level fluctuation, flow lirection changes) 18 Analysis of Agricultural Activity 1993 nitial State in NPP TEMELIN Site 2000 djacent area;

-73- Item No. Technical Description Start Notes Finish 19 Monitoring of NPP TEMELIN 2000 * Will be specified later operation impact on elements of * environment; 20 Monitoring of NPP TEMELIN 2000 * Will be specified later operation impact on health of * population 21 Upgrade of Nuclear Materials 01/2000 Registration Programme 12/2000 22 ALARA Centre Equipment 01/2000 Replacement 12/2000 23 SW means for defectoscopical Upgrading controls planning and management 12/2000 24 HARSHAW TLD system equipment 01/2000 Equipment for measuring and evaluation of equivalent 12/2000 dose - replacement 25 SAT* items implementation 1999 * SAT „ Systematic Approach to Training „ in CEZ 2002 and Subcontractor's Personnel preparedness 26 Simulator adaptation - replica for Unit 2002 Adaptation to Unit 1 commissioning results and to 1 2003 operation experiences after approx. 1 year 27 Cable Life Service Monitoring 1999 Finishing of NPP TEMELIN Cable System Regulated Program 2000 Aging Program 28 Design Basis Documentation 2001 The Project is in the preparation stage but conditions Reprocessing 2003 for its implementation were created in the second half of nineties within extensive Project changes. Contractual assurance - cooperation with project organizations is expected 29 Digitalization of NPP TEMELIN 1994 Gradual audit of project document contents and other selected documentation 2002 documents on equipment of all professions and their transition into graphical and database SW systems have gradually been carried out within this Project. The Project leads to substantial change in the information use and database assurance method for control of configuration. 30 Geographical Informational System 2002 [n compliance with the CEZ a.s. overall conception CEZ-NPP TEMELIN 2004 GIS will be built up in CEZ NPP TEMELIN as well. Data preparation for GIS in the field of detailed geodetic documents and data on land plots and Duildings has continuously been carried out.

-74- CZ0129409

Modernization Program of NPP Kozfoduy, Units 5 & 6

Marion Protze, SIEMENS / KWU Project Manager of European Consortium Kozloduy

A comprehensive Modernization Program for the Units 5&6 of NPP Kozloduy (Type WWER-1000/320) was established by the Bulgarian Power Utility and by national institutes, supported by the French utility EDF and by Russian design institutes (MOHT) in 1994/95. The tasks of the program were the safety enhancement of the units in agreement with current Russian and international requirements and practice for operating plants, as well as a set of improvements in order to increase the operational performance.

General and plant specific IAEA reports, proposals of the original plant designer, Bulgarian studies and operational feedback, as well as the assessment of German and French safety consultants (Riskaudit) were incorporated in the program.

Early in 1997 two framework contracts were concluded with two vendors.

The major part of the modernization project, about 120 work items, was awarded to the European Consortium Kozloduy (ECK), consisting of Siemens (leader), Framatome and Atomenergoexport. This consortium had been founded to provide a 100% financing scheme, and to ensure the combination of the original designers' knowledge together with broad experience on western safety upgrading practice. The ECK is the first east-west consortium of this kind for a big project in the nuclear energy field.

In fall 1998 the first steps of the Modernization Program were started by the European Consortium Kozloduy (ECK): • Implementation projects are under way for very urgent measures on - modernization of non-interruptible power supply (one safety train already in operation in Unit 5), - boron meter replacement, - replacement of separators.

-75- • The basic engineering phase ("BEP Contract") for about 50 measures is close to its finalization. The goal of this phase was the elaboration of "technical projects" in order to - justify the offered technical solutions of ECK for measure implementation, - issue the technical solutions to the Bulgarian Authority for approval, - define the fixed scope of supplies and services, - establish the prerequisites for the loan agreements.

The contract for the implementation phase ("Main Contract") was signed in mid 1999. At the moment the negotiations for the financing of the Main Contract scope are under way. The foreseen financing scheme includes 50% of the overall project to be financed by EURATOM, 30% by Roseximbank, and 20% by German and French export loans.

The overall scope of measures of the European Consortium Kozloduy (ECK) includes the following fields: • Substantiation of RPV integrity and cold overpressure protection

• Measures for long term core cooling improvement, including provisions against sump clogging, EFW improvement

• Improvement of emergency electrical power supply and other relevant electrical systems (renewal of DC systems, DG improvements, additional DG for unit consumers, replacement of power breakers, etc.)

• Containment integrity preserving measures under beyond-design and severe accident conditions, including hydrogen detection/recombination

• Diagnostic and computerized information systems, including loose parts detection and leakage detection of primary circuit and RPV head

• Mechanical analyses, including primary system fatigue reduction, auxiliary and secondary systems' equipment investigations

• Improvement of SG safety valves, study on implementation of isolation valves in front of main steam blowdown valves to atmosphere

• Seismic improvements, including structural, piping and components analyses and strengthening

-76- Internal hazard protection measures, including main steam and feedwater line break protection, fire detection and protection improvements, flooding analysis

Safety analyses, including updating of thermal-hydraulic analyses, equipment classification and qualification analyses, analyses for beyond-design basis accidents, ATWS, bleed and feed

Improvement of operational documents and maintenance means

Turbine plant and BOP improvements, including replacement of condenser tubes, water treatment system upgrading, main cooling water filters, heat exchanger improvements, etc.

Further measures of the Modernization Program, not carried out by the European Consortium Kozloduy (ECK), are dedicated to

• Information systems for improvement of the Units' operation

• Modernization of radiation monitoring systems

• Limited scope of analyses

-77- CZ0129410

The Use of U.S. NRC licensing practices for WERs.

Dennis. M. Popp, Manager, Licensing Westinghouse Electric Company, LLC Nuclear Project Business Unit

Introduction

The licensing process for the upgraded Temelin I&C and Fuel designs were enhanced with the introduction of U.S. Nuclear Regulatory Commission, NRC practices. Specifically, the use of the NRC Regulatory Guide 1.70, "Standard Format and Content Guide for Safety Analyses Reports" and NRC NUREG 0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants", were beneficial in the development and review of Temelin licensing documentation. These standards have been used for the preparation and review of Safety Analysis Reports in the United States and also in a large number of licensing applications around the world.

Both Regulatory Guide 1.70 and NUREG 0800 were developed to provided a predictable and structured approach to licensing. This paper discusses this approach and identifies the benefits to designers, writers of licensing documentation and reviewers of licensing documents.

Regulatory Guide 1.70

One of the goals of the U.S. NRC licensing regulatory practices is to further ensure safety by developing regulations and regulatory practices that are clearly understood by both the Nuclear Power Plant (NPP) representatives and by regulatory reviewers. A review of the regulations that are used for the development and review of the Safety Analyses Reports demonstrates this objective. Regulatory Guide 1.70," Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants" provides detailed guidance to the writers of Safety Analysis Reports. This Regulatory Guide was developed to allow for the standardization of information that is required by NRC for the granting of both Construction Permits and Operating Licenses. The Regulatory Guide provides direction in the format and content of required information. Table 1 provides a listing of the chapter titles required by the guide. The use of this Guidance allows for the efficient presentation of material, by clearly defining the location for the presentation of criteria, design information and analyses. This allows for standard referencing in chapters that are devoted

-79- to providing design information to chapters that are devoted to providing criteria. Use of the Regulatory Guide also provides for the author to understand the complete documentation needs of the regulatory authority. For example, the following is an example of information that is required to be provided in Chapter 4, "Reactor", Section 4.3.1 " Design Bases":

"The design bases for nuclear design of the fuel and reactivity control systems should be provided and discussed, including nuclear and reactivity control limits such as excess reactivity, fuel burnup, negative reactivity feedback, core design lifetime, fuel replacement program, reactivity coefficients, stability criteria, maximum controlled reactivity, insertion rates, control of power distribution, shutdown margins, stuck rod criteria, rod speeds, chemical and mechanical shim control, burnable poison requirements, and backup emergency shutdown provisions."

The Regulatory Guide provides over 300 pages of requested information similar to the above paragraph. This allows the Safety Analysis Report author to have a detailed understanding of the expectations of the regulatory authority with regards to format and content.

While the Regulatory Guide provides significant instructions in format and content of Safety Analysis Reports it provides little guidance in listing the regulations that need to be address for compliance. Regulatory compliance is the role of the Standard Review Plan, NUREG 0800.

Standard Review Plan

The Standard Review Plan (SRP) is prepared for the guidance of staff reviewers in the Office of Nuclear Reactor Regulation in performing safety reviews of applications to construct or operate nuclear power plants. The principal purpose of the SRP is to assure the quality and uniformity of staff reviews and to present a well-defined base from which to evaluate proposed changes in the scope and requirements of reviews. A purpose of the SRP is also to make information about regulatory matters widely available and to improve communication and understanding of the staff review process by interested members of the public and the nuclear power industry.

The specific information required by the NRC for an evaluation of an application is identified in Regulatory Guide 1.70, The SRP sections are keyed to the Standard Format, and the SRP sections are numbered according to the section numbers in the Standard Format.

Though the SPR is written for the use of the regulatory reviewers, it also

-80- provides key information for designers and for writers of Safety Analysis Reports. In particular, writers can use the reviewer requirements as a guide for information that needs to be included in a SAR. This can reduce the number of follow-up questions that are made by regulatory reviewers. As a comparison of the level of detail available, the I&C section of Regulatory Guide 1.70 is 7 pages in length while the I&C section in the SRP for Chapter 7 is over 85 pages. The SRP thus complements the Regulatory Guide as guidance for the appropriate level of detail necessary to make the regulatory review efficient.

The individual SRP sections address, in detail, which NRC organization performs the review, the matters that are reviewed, the basis for review, how the review is accomplished, and the conclusions that are sought. Each SRP section is organized into five subsections as follows:

I. Areas of Review

This subsection describes the scope of review, i.e., what is being reviewed by the reviewer. This subsection contains a description of the systems, components, analyses, data, or, other information that is reviewed as part of the particular Safety Analysis Report section. It also contains a discussion of the information needed or the review .

II. Acceptance Criteria

This subsection contains a statement of the purpose of the review, an identification of which NRC requirements are applicable, and the technical basis for determining the acceptability of the design or the programs within the scope of the area of review of the SRP section. The technical bases consist of specific criteria such as NRC Regulatory Guides, General Design Criteria, Codes and Standards, Branch Technical Positions, and other criteria.

III. Review Procedures

This subsection discusses how the review is accomplished. The section is generally a step-by-step procedure that the reviewer goes through to provide reasonable verification that the applicable safety criteria, as defined in the previous sub section have been met.

IV. Evaluation Findings

At the completion of an NRC review of a Safety Analysis Report, the NRC publishes the findings of there review. These findings are published in a document entitled " Safety Evaluation Report". For each section, a conclusion

-81 - that is to be provided in the NRC's Safety Evaluation Report is requested. This subsection provides guidance on the specific subjects reviewed and which aspects of the review were selected or emphasized; which matters were modified, require additional information, will be resolved in the future, or remain unresolved; where the plant's design or programs deviate from the criteria stated in the SRP; and the bases for any deviations from the SRP or exemptions from the regulations.

V. References

This subsection lists the references used in the review process. These references could be Regulations, Regulatory Guides, and Industry Standards or specific NPP reports or Topical Reports that were used in the evaluation.

Benefits

The use of these regulations was beneficial to both the writers and reviewers of Safety Analysis Reports. Some of the Key benefits are as follows;

Safety Analysis Report documentation is predictable. The guidance provided in these regulations define the content, in sufficient detail, that the regulatory criteria and the informational needs, necessary for the successful preparation of a SAR are understood in advance. Prior to the writing of a SAR the design information required for licensing is understood. Design activities can be scheduled in such a manner as to provide licensing ( SAR) input, to support the licensing process. Licensing scheduling and associated cost for producing licensing documentation can be estimated with greater accuracy.

The licensing standards provide guidance to designers. Design criteria is explicitly given for every aspect of design and analyses. The NUREG 0800 list and discusses the regulatory criteria each design must comply with. A review of this NUREG provides valuable input to the design process by identifying all required regulatory guides and industry practices.

NUREG 0800 is an excellent tool for regulatory authorities. As previously stated, the NUREG was written a guide for regulatory reviewers. This NUREG can be used as a tool for conducting regulatory reviews. It provides a detailed, methodical approach for conduct regulatory reviews of a SAR. A regulatory reviewer can use the process and perform a line-by-line review of a application with confidence that the important safety issues will be covered. In addition to providing guidance for a regulatory review, the NUREG also provides guidance for documenting the results of the review. As can be seen from Table 1 all aspects of NPP design, criteria and analyses are covered by the Regulatory

-82- Guide and associated NUREG.

The Regulatory Guide 1.70 and the NUREG 0800 have been used for the licensing of Nuclear Power Plants for over 20 years. All US Safety Analysis Reports and numerous international licensing submittals have followed this practice. The wealth of experience gained from these applications is beneficial to both the authors and reviewers of SARs.

For the author of a Safety Analysis Report, numerous applications exist as examples of successful applications. From these examples one can judge the level of detail required for a successful application. For applications using Westinghouse technology, numerous generic reports have been written to address subjects identified in NUEG 0800. The Westinghouse generic reports have been submitted to NRC and have received written NRC approval. These reports address such areas as programmatic plans i.e. Quality Assurance, Software Verification &Validation, Equipment Qualification and resolution of specific technical issues such as fuel rod bow or reactor vessel toughness.

The guidance provided in Regulatory Guide 1.70 and NUREG 0800 can be used for both the licensing of an entire Nuclear Plant or for the licensing of a major plant upgrade, such as an I&C replacement. For example if an NPP was to upgrade the I&C design, portions the Regulatory Guide and NUREG could be used as guidance for identifying regulatory design criteria, licensing documentation requirements for the licensing submittal. Selected Chapters , including criteria, from Chapter 3, regulatory and industrial design guidance and licensing submittal format and content informational requirements from the I&C Chapter 7, and the quality assurance program in Chapter 17 could be assembled as a licensing submittal. A regulatory reviewer could use NUREG 0800 to review the submitted information. Designers could also use the information in the NUREG 0800 as a base of regulatory requirements.

The information in Regulatory Guide 1.70 and NUREG 0800 allow for the flexibility to include specific design features and in country regulations with great ease. The content and format guides identify areas with regulations are listed. Additional in country regulations can be added to these list and addressed in the same manner as the listed NRC requirements. In addition that guidance provided in these standards also allow new sections to be added to address specific VVER design information. For example, the Temelin I&C design required the designers to address Czech Decrees. Section 7.1 of the Regulatory Guide and the NUREG provide a list of NRC Regulatory Guides and Industry Standards that were to be provided. These list were expanded to include both Czech and IAEA standards. The Temelin I&C design also included a Diverse Protection System, DPS that is not required or addressed in the Regulatory Guide or the NUREG. A

-83- new section was provided in Chapter 7 of the Temelin Safety Analyses Report. While this section was developed to describe the Temelin DPS, the section was written and reviewed to format and criteria from Primary Protection System Reactor Trip, Section 7.2 and Primary Protection , Engineered Safeguards System.

The use of these standards has been successfully applied on the Temelin project. The Temelin Safety Analysis Report was written using Regulatory Guide 1.70 and was reviewed using the guidance of NUREG 0800. The use of these standards provided additional confidence that the safety case of the Temelin project was thoroughly reviewed and. documented in a manner consistent with the practices of many of the worlds regulatory authorities. It also has demonstrated that these regulations can be successfully applied to WER plants.

Conclusion

In summary, the application of Regulatory Guide 1.70, "Standard Format and Content Guide" and NUREG 0800, "Standard Review Plan" provided many benefits. To plant designers these standards provided a detailed listing of regulatory criteria and industry standards with which plant designs, analysis and programs must comply. To the writers of licensing documentation, the standard provided a structured, well-defined plan for the format and content of a Safety Analyses Report. The standards also provide the same guidance for the licensing of large plant upgrades or modifications. The writing of a Safety Analyses Report also becomes more predictable. NUREG 0800 is an excellent tool for regulatory reviewers by providing review criteria and a review process. These standards have been adopted in many applications through the world and as demonstrated by the Temelin Safety Analysis Report (PBZ), can be beneficial in the licensing of WERs.

Biographical Sketch

Dennis Popp has been working in nuclear licensing for over 30 years. He has participated in the writing of over 20 Safety Analysis Reports in 6 countries. He is currently the Licensing Manager for all of the Westinghouse licensing actives on WERs. He has recently participated in IAEA training programs on licensing of WER Fuel. In addition Mr. Popp has participated in the review and development of numerous licensing standards and regulations.

-84- Table 1 Safety Analysis Report Content

Chapter Title, Content

1 Introduction - Discussion of plant layout, Research programs

2 Site Characteristics - Discussion of Site Meteorology, Hydrology, Seismology

3 Design Criteria - Discussion on Classification requirements, General Design Criteria,

4 Reactor Fuel - Discussion on Nuclear, Mechanical and T&H design

5 Reactor Coolant System - Discussion on Reactor Vessel, Steam Generators, Pressurize

6 Engineered Safety Features - Discussion on Containment Systems, Safety Injection Systems

7 Instrumentation and Control - Discussion on Safety System and , Post Accident Instrumentation

8 Electric Power - Discussion on Offsite and Onsite systems

9 Auxiliary Systems - Discussion on Fuel Handling, HVAC and Water Systems

10 Steam and Power Systems - Discussion of Turbine, Main Steam, Condensers

11 Radioactive Waste Management - Discussion on Solid, Liquid and Gaseous Systems

12 Radiation Protection - Discussion on Radiation sources and Health Physics

13 Conduct of Operation - Discussion on Organization,Training Emergency Planning

14 Start up Testing - Discussion on tart-up testing programs

15 Accident Analysis - Evaluation and Results of all Bounding Accidents Analysis

-85- Table 1 con't Safety Analysis Report Content

Chapter Title, Content

16 Technical Specifications ( Limits and Conditions) Specific Guidance for PWR provided in NUREG 1431

17 Quality Assurance Programs - Discussion to commitments of 10CRF 50, Appendix b and ISO9000

18 Human Factor Designs - Discussion of Control Room Designs and verification testing

-86- CZ0129411

Trends in Digital I&C for Nuclear Power Plants

Bruce M. Cook, Chief Engineer Westinghouse Electric Company, LLC Nuclear Projects Business Unit

ABSTRACT At the Sizewell B nuclear power station in the United Kingdom, modern digital I&C Over the past decade, large-scale digital systems have been providing the plant I&C systems have been installed on nuclear safety, control and monitoring functions power plants as the original systems for since it went into operation in 1994. plant operations. Examples of these include Sizewell B in the United Kingdom and Now, several operating nuclear plants are Temelin NPP in the Czech Republic. Now, either implementing or planning the upgrade this digital technology is being used for of a portion of or the entire I&C systems. replacement and upgrade systems such as Among these is the four unit, WER-440 those for Ringhals Unit 2 in Sweden and the nuclear power plant at Dukovany in the Kewaunee plant in the United States. Such Czech Republic. Other upgrading plants a digital upgrade is being planned for the include Mohovce in Slovakia, Paks in Dukovany NPP in the Czech Republic. As Hungary, Oskarsham and Ringhals in the experience base grows with this digital Sweden, and the Sequoyah, Zion and technology on nuclear power plants, certain Diablo Canyon plants in the United States. trends are developing in the application In addition, several plants are modernizing practices and licensing of these systems. their plant computer systems. This paper discusses these trends and suggests adaptations that may become With this wealth of experience being gained, necessary in the classical roles of vendors, not only by the vendors, regulators and regulators and plant operators. plant owners directly involved in the modernizing programs, but also by the INTRODUCTION observers in other countries, it is an appropriate time to assess the directions being taken by the industry for digital Unit 1 of the Temelin Nuclear Power Plant instrumentation and control systems. has just completed its hot functional testing in preparation for the loading of fuel. The instrumentation and control systems for this APPLICATION OF COMMERCIAL plant represent the largest integrated digital GRADE EQUIPMENT system in the nuclear industry worldwide. This I&C system provides the bridge Recent consolidations within the nuclear between the technological design of the industry vendors have had the side effect of plant based on Russian design principles of separating the nuclear I&C applications high degrees of redundancy and engineering organizations from the automation, and the Western practices of electronic manufacturing functions of the design optimization and thoughtful companies who have been the long term consideration of the role of the operator in suppliers of I&C for the nuclear industry. A the normal and abnormal operations of the prime example of this was the sale of the plant equipment. Westinghouse Process Control Division to Emerson Electric Corporation in 1998.

-87- Such separation of I&C manufacturing from level of assurance, etc.) that are in conflict the nuclear vendors wilt mean that in the with the concepts that form the foundation future, the I&C product offerings will of the nuclear industry standards, increasingly be the application of misunderstanding of the system "commercial products" rather than custom requirements could result. Another example solutions for the nuclear industry. This of overlapping standards is the relatively carries both positive and negative new ISO-9000 quality assurance standard. ramifications for the nuclear industry. On While it establishes quality practices very the positive side, broader application of the similar to those already in place in the technology means that a larger experience nuclear industry, the slight differences in base, hence proven design status, is terminology and roles of the various provided for the systems applied in the organizations is a source of confusion. nuclear industry. Also, an electronics manufacturer that serves a wider market is In this environment of applied commercial more able to keep up with the' latest I&C to nuclear applications, the roles of the technology developments. This is certainly owners, regulators and vendors must adapt. a significant factor considering the rapid With less chance to customize the pace of evolution in digital I&C, driven technology applied to their I&C upgrades, primarily by the office personal computer owners will increasingly need to weigh the market, and the comparatively long cycle benefits offered by one vendor's system time of a typical nuclear upgrade project, against the negative impacts of not having which can be several years. On the exacting requirements met in all areas. negative side, the nuclear vendors are Regulators will need to determine the losing their control over the specification of minimum necessarily design and design features once thought to be essential qualification review to accept existing for the requirements unique to the nuclear products, designed to non-nuclear specific industry. requirements, rather than follow the strict requirement to design feature trail as they This commercialization of the nuclear I&C have done in the past. Nuclear I&C vendors industry goes beyond the offerings of the will become system integrators. In this role, various vendors. It extends into the industry they will need an even broader knowledge standards writing organizations as well. At of the array of technologies available for one time, nuclear regulation was done to a application solutions. Modifying both the set of codes and standards that were requirement and the application to arrive at prepared by the industry itself. Now, the optimum licensable solution will be a however, increasing application of other skill that requires development. industry's standards is being made. As an example, the IEC standard 61508 on the CLASSIFICATION OF I&C SYSTEMS use of digital computers in safety critical applications has a significant overlap in The classification of I&C systems as to their scope and objective with the IEC 61513, role in plant safety is becoming a more 60987 and 60880 series produce by the definitive process. Previously, the black nuclear industry. While it may seem and white approach of safety or non-safety harmless to have overlapping standards, equipment was followed. However, this left the certain confusion that will exist when the a middle ground of equipment for normal I&C manufacturers become accustomed to operation that is nevertheless important to the more general industrial standards is the safety of the plant. Emerging standards, sure to cost the nuclear industry significant based on IAEA 50-SG-D8 and IEC 61226, resources. For instance, if the I&C are proposing requirements for this category manufacturers use the terminology from the of safety related equipment. Furthermore, general industry standards (safety critical, the application of probabilistic methods to unknown. It would not be unreasonable to the determination of equipment category is see that the actual safety of a combined being considered in many countries. In the system including diversity of hardware and United States, the Nuclear Regulatory software is actually less than that of a single Commission has proposed rule making that system due to the increased complexity would divide the systems into four involved. categories. In addition to the traditional designation of safety or non-safety, a When diversity is added to the plant through classification of safety significance would be the provision of a separate system, added based on the risk associated with the integration problems can exist. Establishing equipment's failure to function. Under this the correct priority of the non-failed system proposed classification scheme, major plant over that which is assumed to be failed is controls will receive an increased scrutiny difficult when both start and stop actions are while some equipment previously classified needed depending on plant state. Having as safety system may have its safety the diverse system being provided by a clasification reduced. This is similar to the separate manufacturer to maximize the classifications provided by IEC-61226. differences can aggravate this integration issues. Integration of the diverse functions When combined with the trend towards into a single system architecture will allow increased use of commercial grade conflicts over actuation priority to be better equipment and practices, this change in the addressed. classification process and the determination of the fundamental requirements for the I&C As regulators become more familiar with equipment will place an additional digital technology, the approach to the dimension on the design and licensing of application of diversity will likely become nuclear I&C applications. more rational. The role of functional diversity may become more prominent than APPLICATION OF DIVERSITY that of hardware or software diversity because of its potential to address a While the potential for common mode failure broader range of design and operational of safety system equipment predates the issues. This trend is evident in the bid application of digital I&C, the element of specification for the Dukovany I&C upgrade software design has intensified this concern program. However, the role of hardware in these modern systems. Various and software diversity should not be applications of principles of diversity have trivialized. While the probability of the been applied in different countries. These common mode failure of microcomputers of requirements for diversity have ranged from a given electronics manufacturer may be complete backup protection systems, such acceptably small, having the application as those at Sizewell B, Temelin and design team implement some of the Oskarsham to a minimal, non-safety grade protection functions on a different system to provide an alternate means of applications platform has merit. Just as actuating key safety functions such as functional diversity avoids CMF by relying reactor trip. In many cases, the requirement on different process measurement for diversity has arisen from non-specific principles, application diversity forces a fears over the potential for common mode different thought process to be followed failure of computer software simply for the which eliminates the chance for the same reason that this "new" technology is not well defects to be included in the design. understood. But if the likelihood of the Also, by taking a broader view of common common failure itself cannot be quantified, mode failure, along the lines of "defense-in- then too the benefit of the diversity is depth" principles, a more systematic assessment of the overall safety of the plant

-89- may be achieved. While common mode independent testing went to the' extent, in failure of a particular safety function may be both cases, of dynamic simulation of plant possible, the compensating effects of other accidents and presentation of the process systems, such as the plant control systems, variable trajectories to prototypical safety can contribute to the maintenance of plant system equipment to confirm its proper safety margins. Furthermore, the inherent response. Such validation of the system functional and application diversity of these design is unquestionably expensive and, other systems has definite merit against considering the lack of significant findings in common mode failure. Rather than either case, of questionable value. Placing excluding such systems from the safety undue emphasis on independence leads to analysis because they are not part of the necessarily shallow understanding of the safety system, the analysis should be software design, which could in turn cause expanded to include the entire plant. This design defects to be overlooked. has ramifications in the l&C classification topic already discussed. The trend towards application of commercial grade product to nuclear systems important A more rational treatment of software to safety places a new burden on design common mode failure will include analysis verification. As the nuclear vendors loose of the potential sources of failure so that the control of the l&C product designs, they will effectiveness of design features to deal with also loose the detailed knowledge of the these failure, whether those features be lowest working levels of the products. diverse or not, can be assessed. Just as Proprietary information rights will interfere EMI, seismic and temperature have been with the ability to examine the software at dealt with for safety system hardware, the source code level. Also, the operating software design issues that pose potential system level software will in general not sources of common cause failure will be have been developed to nuclear specific identified, designed against and proven to V&V standards. While the quality may be be non-existent through the digital superb, the customary documentation trail equivalent of "qualification" testing. The net may become difficult to establish. effect of this more rational treatment of Regulatory and quality assurance controls common mode failure will be simpler system that can be passed on to the equipment designs with a better chance to optimize the manufacturers need to be established. cost/safety benefit ratio. Within the organizations that produce the DESIGN VERIFICATION AND software, the verification processes are VALIDATION becoming better tuned to suit the actual need. Functional testing is receiving One requirement for digital l&C systems is increased attention while placing emphasis that a structured approach be taken for on execution of every line or branch of code design verification and validation. This was is becoming less important. Experience has recognized in the early standards, such as consistently shown that incomplete or IEC-60880, but is becoming refined through incorrect requirements specifications experience. In some cases, notably constitute a significant portion of design Sizewell B and Temelin, the respective defects in safety systems. Incorrect regulators have been so focused on the implementation of the requirements is a rare independence of the review that they event. Therefore, placing a greater focus required the licensees to contract separate on the "up-front" portions of the design organizations (from that of the l&C vendor) process can provide a higher payback in to conduct third party analysis and testing of quality and lesser rework costs. Finally, a the safety system software. This large fraction of verification findings have consistently been on the documentation

-90- rather than on the software code itself. By taken to not misapply or over-apply these following more "application oriented" standards. In many cases, the design processes and minimizing the design measures taken to make a cable fire documentation produced, the quality of the resistant are contrary to the necessary final product can be enhanced. electrical properties for system performance. Also, costly fire protection of PHYSICAL SEPARATION a cable in a room where there is no fire hazard, or worse where the I&C equipment Separation is a critical issue for upgrade depending on the cable is not itself I&C systems. From the highest-level design protected, is not the best utilization of the criteria down through the various industry plant operator's upgrade budget. standards, the need to maintain independence between the redundant On the positive side, some developments in portions of the safety system, and between digital I&C, such as the use of fiber optic the safety system and other plant systems, cables for equipment interconnections, may is clearly required. The practices applied by help to alleviate these separation problems. the industry in this area have evolved over By reducing the overall volume of cabling, the years, generally as a result of the and by allowing the encoding of information consideration of fire hazards. This can so that fire induced failures can be present a particular problem for the discriminated from false actuations, a operating plant that chooses to upgrade system design that complies with fire hazard their I&C systems. requirements can be achieved.

It is not uncommon in the course of any SURVEILLANCE TESTING upgrade program to attempt to apply the latest design standards, particularly in areas Digital I&C technology offers new features directly involved in plant safety. However, in the area of self diagnostics that could in operating plants, the level of separation change the view on surveillance testing in that can be achieved is limited by the the plant. These diagnostics improved the existing structures. This is particularly true reliability of the I&C system by reducing the in the area of cabling. The cost of mean time to detect failures to the absolute improving the separation to fully meet minimum. Furthermore, the mean time to modern standards in the course of an repair the failure can be reduced by provide upgrade program could be so great that it the I&C maintenance staff with advance would mean that the upgrade program information as to the nature of the fault and would be canceled. In such a case, the the module replacement necessary to clear opportunity to improve the safety of the it. As more of the equipment becomes plant in other areas not related to the covered by such diagnostics, the need for separation issue would be denied. For I&C period testing of that equipment diminishes upgrades, it may be necessary to accept to the point that I&C testing only during some design conditions as they are and plant shutdown may become achievable. only make improvements where they would Even that testing may become more be cost beneficial. focused on the hardware and its potential failures rather than on the safety function In the area of cabling, the application of IEC itself. Since the function is becoming more standards (or others) in the areas of flame a property of the software of the system, the retardance and fire resistance has become function itself is not prone to failure. a normal practice. While improving the fire Efficient testing will be targeted at the qualification pedigree of the cabling has specific failure modes of the hardware that some obvious benefits, care should be could disrupt needed features. To allow this

-91 - change in the philosophy of surveillance potential for an outside person to disrupt the testing, some changes in the design operation of the plant cannot be allowed. standards that govern surveillance testing, and the regulations based on them, may be CONCLUSIONS necessary. In the 1970's, the invention of the micro- INFORMATION INTEGRATION processor introduced the instrumentation and control industry to a new era. In the A key advantage of digital I&C systems is 1980's, the nuclear industry and regulators that they can make a considerable amount had to be convinced that this new of data available to the plant information technology could be applied in a safe system without requiring additional manner. Industry standards were written hardware to input this data to the computer. more from an academic point of view than In addition to the signal from a process from an application of experience. Through sensor, additional information on the the 1990's the experience in the application instantaneous calibration of that sensor of digital I&C technology to nuclear power channel, process noise indicating sensor plants has grown. Now, in the new response time and various other data millennium, digital technology is the only relating to the health of the overall system one available for new plants and plant providing the measurement, can be sent to upgrades. the operation staff over plant networks with increasingly higher bandwidths. If not The increasing reliance on the application of properly integrated into the information commercially available equipment will place display to the operator, this overload of data new burdens on the vendors, plant can be a disadvantage rather than an operators and regulators in establishing that advantage. Integration of this data into the an appropriate level of design quality has plant operations raises design concerns on been achieved. Furthermore, where the the human factors and the operator's ability nuclear design process has been to to process so much information to arrive at establish a requirement and then design a meaningful conclusions. Equipment custom I&C equipment to meet that diagnostic alarms need to be discriminated requirement, the new process will be to from those alarms that require more urgent adapt a commercial design to perform operator actions. adequately against a requirement, but in some cases that requirement must itself be Beyond the concerns of human factors, adapted. connection of the various operational I&C computers into a broader plant-wide Finally, thus far, nuclear I&C upgrades have communications network can also introduce to a large extent been function for function security issues. Providing access to system replacements of the analog system diagnostic data to the engineering staff predecessors. New capabilities will could be useful, but restricting access to undoubtedly result from the digital affect the state of plant equipment over the technology itself. The ability to encode same networks could be problematical. communications to do fault detection allows When connection to offsite wide area a higher degree of "fail-safe" design to be networks is considered, the problems are followed. Closer matching of the algorithm compounded. News broadcasts of to the plant process will allow higher computer hacker invasions of various accuracy and reduced design margins to be companies are frequent. Even if the plant realized. Integration of more information on systems ensured the ultimate safety, the the state of the plant will permit a higher degree of automation to be achieved.

-92- However, each new benefit will come at the cost of some long held design philosophy. What seemed to be the best practices and engineering judgements of the past will be questioned in the future. Industry standards and practices that were written from the viewpoint of analog systems, and which did not even consider the possibility of digital technology, will need to be revisited and interpreted in a new light.

Throughout this process the industry, plant owners, regulators and nuclear vendors alike, must keep their focus on the common shared objective of producing power in the most economical and safest way possible.

BIOGRAPHICAL SKETCH

Bruce M. Cook has been working in the nuclear I&C industry for thirty years, all of that time being employed by Westinghouse Electric. He is a graduate of the Control & Systems Engineering curriculum at Case Western Reserve University and holds a Masters of Nuclear Engineering degree from Carnegie-Mellon University. Mr. Cook is a registered Professional Engineer in the state of Pennsylvania, USA.

Mr. Cook has been active in international standards writing as a US delegate to IEC Technical Committee 45A on nuclear reactor instrumentation systems for the past ten years, and previously was a member of the IEEE Nuclear Power Engineering Committee, subcommittee on reactor safety.

-93- International Topical Meeting on WER Technical Innovations for Next Century 17. - 20- April 2000 Prague

Experience in Modernization of Safety I&C in WER 440 Siemens Nuclear Power Plants Bohunice V1 and Paks Michael Martin

Experience in Modernization of Safety I&C in WER 440 Nuclear Power Plants Bohunice V1 and Paks

Contents

1. Abstract

2. Necessity for I&C Modernization.

3. Modernization Projects in Bohunice V1 and Paks NPP

3.1 Bohunice V1 NPP.

3.1.1 Scope of Modernization

3.1.2 Timeframe of Modernization

3.2 Paks NPP

3.2.1 Scope of Modernization

3.2.2 Timeframe of Modernization.

4. Main Steps of Modernization Projects

4.1 Preparation of Modernization Projects

4.2 Basic Design

4.3 Detail Design.

4.4 On-Site Activities

4.5 After-Sales Service

5. Lessons Learnt

6. Summary

-95- International Topical Meeting on WER Technical Innovations for Next Century 17. - 20- April 2000 Prague

Experience in Modernization of Safety I&C in WER 440 Siemens Nuclear Power Plants Bohunice V1 and Paks Michael Martin

1. Abstract

For nuclear power plants which have been in operation for more than 15 years, backfitting or even complete replacement of the instrumentation and control (I&C) equipment becomes an increasingly attractive option, motivated not only by the objective to reduce the cost of I&C system maintenance and repair but also and to prolong or at least to safeguard the plant lifetime: • optimized spare-part management through use of standard equipment • reduction of number and variety of different items of equipment by implementing functions stepwise in application software • adding new functionality in the application software which was not possible in the old technology due to lack of space • safeguarding of long-term After-Sales-Service.

Some years ago Bohunice V1 NPP, Slovak Republic and Paks NPP, Hungary intended to replace parts of their Safety I&C, mainly the Reactor Trip System, the Reactor Limitation System and the Neutron Flux Excore Instrumentation and Monitoring Systems. After a Basic Engineering Phase in Bohunice V1 and a Feasibility Study in Paks both plants decided to use the Siemens' Digital Safety I&C System TELEPERM XS to modernize their plants.

Both Bohunice, Unit 2 and Paks, Unit 1 have been back on line for over six months with the new Digital Safety I&C. At the present time Bohunice, Unit 1 and within the next few months Paks, Unit 2 will be replaced.

Trouble-free startups and no major problems under operation in the first two plants were based on • thorough understanding of the WER 440 technology • comprehensive planning together with the plant operators and authorities • the possibility to adapt TELEPERM XS to every Plant type • the execution of extensive pre-operational tests

-96- International Topical Meeting on WER Technical Innovations for Next Century 17. - 20- April 2000 Prague

Experience in Modernization of Safety I&C in WER 440 Siemens Nuclear Power Plants Bohunice V1 and Paks Michael Martin

Regarding these modernization measures Siemens, as well as the above Operators, have gained considerable experience in the field of I&C Modernization in WER 440 NPPs.

Important aspects of this experience are: • How to transfer the WER technology to TELEPERM XS • How to implement the digital safety I&C system TELEPERM XS in the existing Plant conditions • How to modernize the field level in the meaning of transmitters and cabling • How to fulfill the national licensing requirements • How to replace the equipment within a short period • How to familiarize the staff with the new I&C system at an early stage

This know-how and experience acquired by Siemens forms a great advantage for further WER 440 Nuclear Power Plants which intend to modernize their I&C.

2. Necessity for I&C Modernization

I&C and especially Safety I&C is important for reliability and availability and therefore also for economical aspects of Nuclear Power Plants. Experience has shown that in plants which have been in operation for more than fifteen years, backfitting or replacement of I&C equipment becomes necessary based on the following reasons: • unavailability of spare parts • impossibility to add new functionality

Modernization of I&C will not only eliminate the above reasons, the modernization will also form an objective to reduce the costs of service and maintenance and to prolong and to safeguard the plants lifetime. The following requirements should be reached by a new system: • realization of all functions by one system • optimized spare-part management by use of standard equipment • reduction of number and variety of different items of equipment by implementing functions stepwise in application software

-97- International Topical Meeting on WER Technical Innovations for Next Century 17. - 20- April 2000 Prague

Experience in Modernization of Safety I&C in WER 440 Siemens Nuclear Power Plants Bohunice V1 and Paks Michael Martin

• adding new functionality in the application software which was not possible in the old technique due to of lack of space • safeguarding of long-term After-Sales-Service.

3. Modernization Projects in Bohunice V1 and Paks NPP

3.1 Bohunice V1 NPP

3.1.1 Scope of Modernization Since the early years of operation Bohunice V1 NPP - comprising two WER 440-230 units - made a number of changes and additions to the original design to eliminate or compensate for safety shortcomings of this reactor type. Following a small-scale reconstruction and based on the results of prior studies Siemens in close cooperation with Bohunice V1 NPP developed a comprehensive safety and retrofit concept to enable Bohunice V1 NPP in compliance with international acceptable safety standards.

This safety and retrofit concept was transformed into a modernization project which was then awarded to a consortium called REKON, consisting of the Slovak Research Institute VUJE Trnava and Siemens. The I&C part covers: • the reactor trip system, • the neutron flux monitoring system, • the reactor power control and limitation system, • the priority control and control interface system for safety-related loads, • the diesel generator control system, • the accident monitoring system, • the operating and control equipment in the main and back-up control rooms.

The reactor protection system plus the enhanced reactor power control and limitation system were implemented on the digital TELEPERM XS system platform. The new priority control and control interface system, and the interconnection of the new safety I&C system with the existing I&C system are based on the proven ISKAMATIC hardware technology. The I&C system upgrade was divided into two steps. The first step consisted of replacing the peripheral measurement equipment and setting up the new reactor protection system cabi-

-98- International Topical Meeting on WER Technical Innovations for Next Century 17. - 20- April 2000 Prague

Experience in Modernization of Safety I&C in WER 440 Siemens Nuclear Power Plants Bohunice V1 and Paks Michael Martin

nets. The second step involved replacement of the priority control and control interface system for the safety equipment actuated by the reactor protection system. The entire system was then put into operation. Prior to the second step, the new reactor protection system was tested in open-loop mode, and the data acquisition and signal processing functions were optimized and verified. During this phase lasting several months, the control room personnel familiarized themselves with the messages and operating procedures used by the new system. Following the upgrade, numerous individual tests of the newly installed equipment and user software were performed according to plan - most of them in parallel with the standard unit restart process. Within the scope of a startup program approved by the operator and the licensing authority, a number of complex tests were performed to verify the functionality of the new I&C equipment and smooth interaction of all the I&C components. Realization of the tight time schedule for installation and commissioning of the new I&C system was made possible by extensive prior testing, beginning with simulations in the test bay and ending with functional tests following installation, • checking and optimization of signal processing and of the newly developed computer cir- cuitry in open-loop mode, • verification and optimization of the functionality of the reactor power control and limitation system by interfacing the control system with a process-oriented plant simulator.

3.1.2 Timeframe of Modernization The contract for the Basic Engineering was signed in 1994, the order for realization was awarded in 1996. The reconstruction was / will still be performed in prolonged outage phases. Since October 1998 Unit 2 of the Bohunice Nuclear Power Plant is the first Russian- design reactor plant to be equipped with a state-of-the-art digital I&C system. Unit 1 will be completed in June this year.

3.2 Paks NPP

3.2.1 Scope of Modernization In the early 90s, the operator of Hungary's Paks Nuclear Power Plant - which comprises four WER 440-213 units - decided to replace the plant's Soviet-designed reactor protection sys-

-99- International Topical Meeting on WER Technical Innovations for Next Century 17. - 20- April 2000 Prague

Experience in Modernization of Safety I&C in WER 440 Siemens Nuclear Power Plants Bohunice V1 and Paks Michael Martin

tern (RPS) with state-of-the-art Western technology based on the following reasons: • uncertainty regarding spare parts procurement from the original equipment manufacturers (OEMs) in Russia and Ukraine, • the desire to simplify RPS maintenance and testing, and • the need to increase plant safety and reliability

A digital system based on the most recent state of the art in technology was to be installed, i.e. not a hardwired system. An invitation for bids for such a system was then issued in 1993.

After the bids had been reviewed and a shortlist had been made up of potential suppliers, Siemens was among the companies selected to perform a preliminary study. On the grounds of the results of this study as well as the low price quoted by Siemens, Siemens was awarded a contract in 1996 to replace the RPS in all four Paks units.

The work covers: • Reactor trip system • ESFAS (Engineered Safety Features Actuation System) • Neutron flux monitoring system • Desk and wall panels for the main control room and the emergency control room • Connection to the plant simulator of a representative configuration consisting of a full replica (both hardware and software) of one redundant RPS train including the associated control room panel.

According to the contract, Siemens is responsible for engineering, supply, installation and commissioning of the I&C equipment in the meaning of the digital safety I&C system TELEPERM XS. The plant operator is responsible for formulating the functional requirements and for integrating the new equipment into the plant.

By performing extensive analyses (reliability and safety analyses) as well as investigations at the simulator (which later also included the representative configuration mentioned above), the plant operator generated detailed functional requirements in the form of synoptically functional diagrams as well as a complete input/output (I/O) database for all drives and instrumentation. Siemens then used this information as a basis for designing the new

-100- International Topical Meeting on WER Technical Innovations for Next Century 17. - 20- April 2000 Prague

Experience in Modernization of Safety I&C in WER 440 Siemens Nuclear Power Plants Bohunice V1 and Paks Michael Martin

TELEPERM XS I&C equipment. The desk and wall panels in the control rooms are designed in a manner that all indications are still legible at a distance of six meters. An item of equipment specially designed for Paks are the sequencers that count incoming alarms according to the time sequence in which they arrive. Also, a special testing concept with testing computer was developed which enables I/Os as well as logics to be tested while the plant is in operation.

3.2.2 Timeframe of Modernization RPS of unit 1 was replaced, as planned, in May and June of 1999 during the annual refueling outage. Unit 2 follows in March and April 2000, with Units 3 and 4 being upgraded during outages in the following years. The activities carried out to replace the RPS at Unit 1 were completed right on schedule during the 62-day outage. Following a 30-day trial run, the system was officially taken over by the plant operator in September1999. The RPS replacement project at Paks proves that activities of this kind, performed in close collaboration with the nuclear plant operator, can be completed during scheduled plant outages - even without the OEMs being involved - without any technical problems or impacts on the outage time schedule. The flexibility offered by our TELEPERM XS equipment enables safety-related I&C systems to be optimally tailored to customer needs.

4. Main Steps of Modernization Projects In order to execute optimized modernization, the project is to be subdivided in the following main steps:

4.1 Preparation of Modernization Projects Feasibility Study Preparing of Tender Documents, Technical Specifications

4.2 Basic Design Execution of a Basic Design intended to provide a basis for Detail Design and Manufacturing. • What work shall be done? • Which conditions should be take into consideration? - Purpose of work

-101 - International Topical Meeting on WER Technical Innovations for Next Century 17. - 20- April 2000 Prague

Experience in Modernization of Safety I&C in WER 440 Siemens Nuclear Power Plants Bohunice V1 and Paks Michael Martin

- Codes and standards - Existing equipment, interfaces - Timeframe - Budget • How shall the work be done?

4.3 Detail Design • Engineering of project specific application software. • Procurement of required equipment. • Implementation of application software into the hardware. • Factory Acceptance Test.

4.4 On-Site Activities • Dismantling if required • Installation • Commissioning • Site Acceptance Test :

4.5 After-Sales Service After-Sales Service during operation and outages due to guarantee availability, reliability and safety.

5. Lessons Learnt

• How to transfer the WER technology to TELEPERM XS One of the main development aims of the digital safety I&C system TELEPERM XS was the opportunity to use it in every kind of reactor technology, thus also for WER plants. This was more or less a theoretical approach. Based on the experience of two orders in WER plants and with staff experienced in WER technology Siemens has gained the know-how required to execute further projects in an optimized and positive manner. Precondition: comprehensive cooperation with the operators and the authorities where

-102- International Topical Meeting on WER Technical Innovations for Next Century 17. - 20- April 2000 Prague

Experience in Modernization of Safety I&C in WER 440 Siemens Nuclear Power Plants Bohunice V1 and Paks Michael Martin

necessary to include all relevant plant specifics in the project.

• How to implement the digital safety I&C system TELEPERM XS in the existing Plant conditions Modernization of I&C covers more than the mechanical replacing of I&C cabinets. Among the physical requirements (dimensions, weight) also the power supply concept, the cli- matic, seismic and EMC conditions must be taken into consideration. A possible new redundancy concept could require modifications in the building structure. Parallel running of old and new I&C equipment needs additional power supply and additional heat removal. Precondition: definition of a clear description of the work comprising all aspects of modernization and operation, such as design of hard and software, testing conditions, inservice inspections during the outage, operating conditions during the outage.

• How to modernize the field level in the meaning of transmitters and cabling Feasibility studies as well as executed projects have shown, that the total number of transmitters in WER plants could be essential reduced. This reduction is an important approach in the meaning of decreasing maintenance work and costs. The new transmitters as well as the new digital I&C require new cables, but based on the reduced number of transmitters and by using suitable cable types the required amount of cables is within a range, which could be installed in addition to the existing ones. Precondition: definition of a clear concept of sensor and signal sharing.

• How to fulfill the national licensing requirements In the frame of the TELEPERM XS development two steps were important with regard to fulfilling international licensing requirements. Firstly the development in accordance with all relevant international codes and standards. And second the execution of type testing of both hardware and software and a plant-independent systems test. Therefore, based on the acceptance of all the plant-independent testing the relevant authorities, e.g. the NRC, ensure the plant operator and his authority to minimize the licensing procedure. Precondition: generic qualification accepted by the authorities, e.g. US NRC.

• How to replace the equipment within a short period With regard to economical aspects the replacement should be executed during more or

-103- International Topical Meeting on WER Technical Innovations for Next Century 17. - 20- April 2000 Prague

Experience in Modernization of Safety I&C in WER 440 Siemens Nuclear Power Plants Bohunice V1 and Paks Michael Martin

less prolonged outages. This kind of modernization requires an optimized preparation based on a detailed execution schedule carried out by an experienced staff. A comprehensive factory acceptance test must be successfully finished, cable connections should be prepared as far as possible, installation and commissioning are to be carried out by experienced supervisors. Precondition: long-term experience under such replacement conditions and comprehensive know-how of the plant specifics.

• How to familiarize the staff with the new I&C system at an early stage To assure reliable operation and maintenance the new digital I&C must be accepted by the relevant Customer's staff. This acceptance will be reached by training, involvement during the engineering phase and training on the job during installation and commissioning. Precondition: optimized training programs and early involvement of relevant Customer staff.

6. Summary Both a modern digital safety I&C system and experience gained in two WER plants and the employment of highly qualified staff form the basis for successful I&C modernization within the meaning of economic, safety, availability and reliability aspects.

Trouble-free startups and no major problems under operation in the first two plants has shown that Siemens • understands the technology of WER 440 plants • plans the work in a comprehensive manner together with the plant operators and authorities • has proved that TELEPERM XS is adaptable to every Plant type the execution of extensive pre-operational tests is necessary for successful modernization

-104- CZ0129413 Chemical technologies and life management of Ukrainian NPPs.

A.V. Arhipenko1, S.V. Barbashev2, L.L. Litvinsky2, A.N. Masko2 - Ministry of Energy of Ukraine -The State Scientific Engineering Center of Control Systems and Emergency Responce

Abstract Now 11 units with WWER-1000 reactors, 2 units with WWER-440 and 1 unit with RBMK-1000 are operated in Ukraine. State of chemical technologies of NPPs essentially influents on unit operating resource by the next ways: - decreasing of corrosion intensity of equipment metal; - decreasing of contamination on thermal exchanged surfaces of equipment; - decreasing of amounts of radioactive waste. Improvement of these parameters can be achieved by the next measures: - improvement of purification schemes for feed water of main systems; - introduction of more effective water-chemical regimes (WCR); - implementation of new methods and-instruments of chemical monitoring for WGR; - providing of without-scale regime of thermal-exchanged equipment operating by reactor division users through optimisation of the WCR of the NPP spray pool.

1. Introduction Preparation of desalted water for initial filling of the main NPP systems and loss compensation determines essentially the quality of the WCR fulfilment of these systems. Because of aggravation of initial water quality and elaboration of new methods of water chemical purification (WCP), the existed WCP systems need to be reconstructed and modernised. Now at Zaporizka and South- Ukrainian NPPs possibilities are analysed to decrease the ion and organic pollution in the produced water with acceptable level of financial expenditures. Most important tasks, which solution has to provide the WCR of first system, is decreasing of equipment corrosion intensity, and, as a result, decreasing of amounts of radioactive wastes and personnel doses. One of the most seriously problems, which arises at the Ukrainian NPPs and can be solved by the way of WCR improvement, is to provide reliable operating of steam generators (SG). So, at the Zaporizka and South-Ukrainian NPPs 25 SGs have been changed before design terms.

-105- 2. Desalted water preparation

The WCP systems of the Ukrainian NPPs were constructed according to designs of 70-th and quality of water produced by them is much worse then those produced at modern WCP systems. So, improvement of water preparation regimes allows to improve quality of water directed from the WCP systems to main NPP's systems and will provide reliable operation of equipment of these systems. To improve the operation of water preparation installations and to increasing operation life, it needs to pay essential attention and to strength the requirements to such parameter as specific electrical conductivity of feed water.

So, for the NPPs with RBMK reactors this parameter limit is determined as 0,1 jiS/cm, and for the NPPs with WWER reactors - as 0,3 uS/cm, whereas for existed technologies at these NPPs the measured values are about 0,15-0,2 (LiS/cm. The specific electrical conductivity (SEC) has to be decreased up to the world accepted level - 0,07 u.S/cm through implementation of modern water preparation technologies and providing of reliable work of turbine condensers. An important parameter of stable operating of the main system equipment is amount of used chemically desalted water for NPP needs. At the Zaporizka NPP (Fig.l) after introduction of strict monitoring of this parameter and implementation of measures to decrease of heat-carrier leakage, the value of this parameter decreases systematically that influents positively at the quality of WCR-2.

3. Water chemical regime of first system Stable fulfilment of WCR of first circle is provided at the Ukrainian NPP but it leads to production of a big amount of radioactive waste. (Table 1). Therefore, possible ways are investigated and analysed aimed to increasing of equipment life time and to minimising of radioactive waste. In particular the possibility and efficiency of introduction of gaseous hydrogen to 1-st circle instead of ammonia are investigated. According to normative requirements, concentration of dissolved hydrogen in the first system water has to be provided as 2,7-5,4 ppm. It needs to suppress radiolysis of heat-carrier in active core, to support the concentration of dissolved oxygen less then 5 ppb and to provide the needed conditions for as high as possible decreasing of corrosion intensity of the first system components. At the western NPPs with PWR-reactors the concentration of dissolved hydrogen is provided by introduction of gaseous hydrogen just to pressurizer.

-106- Fig.l

Consumption of chemically desalted water for needs of Zaporizka NPP (1986-1999 years)

103m3 mvMWt 3000

- 0,05

86 87 88 89 90 91 92 93 94 95 96 97 98 99

IV,m3 •m3/MWt

-107- Table 1 Dynamics of production of liquid radioactive waste at Zaporizka NPP Years Evaporation Collected salt solution residue, m3 V,m3 containers 1987 276 18,4 132 1988 549 36,6 217 1989 876 58,4 298 1990 1335 89,0 461 1991 1280 149,0 738 1992 800 130,0 643 1993 2000 239,4 1203 1994 2002 228,8 1144 1995 2551 245,4 1227 1996 2131 190 932 1997 1969 177 883 Total: 15769 13362 7878

At the NPPs with WWER reactors hydrogen is produced due to disintegration of ammonia introduced to 1-st system. Operating problems: - getting of hurtful contamination to 1st system heat-carrier together with ammonia; some elements been activated into reactor increase activity of heat- carrier; - difficulties of providing of needed hydrogen concentration during setting into operation or power transition regimes because hydrogen production is proportional to neutron flux; - necessity of long-time ventilation of the 1st system equipment before opening for restore works because of hydrogen production due to remaining neutron flux; - decreasing of efficiency of ion-exchanged filters of bypass purification system of 1-st system from corrosion ions due to saturation of the filters by ammonia. Necessity to regenerate often the filters to restore its ion-exchanging ability; - peaks of concentration of alkaline metals and activity of heat-carrier when ammonia is introduced.

Production of radioactive waste The main shortage of existed scheme of ammonia introduction is essential amounts of liquid radioactive waste LRW arisen due to regeneration of ion-

-108- exchange filters (water purification and liquid waste reprocessing systems). Reprocessing of mentioned waste connects with next negative aspects: big amounts of LRW to be concentrated and stored; big amounts of discharged water; unacceptable accumulation of radioactive waste.

4. Experience of improvement of WCR At the operated units with WWER -reactors the steam generators (SG) are breakable mostly, which exit collectors and thermal-exchange tubes are most critical. Its breaks arise due to design, technological and operational lacks. In particular it connects with high remained tension of metal, imperfection of WCR, lacks of design and operation of condensation-feed system and blowing system as well as with deficient diagnostics (operational control). For lifetime extension of SG the solution of following important tasks are needed: - providing of optimal WCR and its modernisation during operation; - implementation of high dense turbine condensers excluded cooler water entry to second circle heat-carrier; - increasing of reliability of equipment of condensation-feed system to provide needed quality of feed-water; increasing of efficiency of the SG blowing system; - implementation of automatic system of WCR operating and monitoring. At Zaporizka and South-Ukrainian NPPs, where the problem of SG reliability is most critical, active works on investigations and implementation of new methods for 2nd circle WCR were carried out during latest years. The problem of the 2nd circle WCR has to be discussed in more detail.

4.1 Lithium- metaborate WCR-2 During of Zaporizka NPP operation, there were replaced 12 SGs of PGV- 1000 type at units No 1,2 and 3. Metal breaks of ,,cold" collectors of the PGV- 1000 steam generators had corrosion-mechanical characters and were observed as trens-cristallit cracks, directed in depth of steel 10 FH 2MOA type of collector up to non-rusting layer at the 1st system side. According to opinion of specialists, the reasons of damages of ,,cold" collector metal are lacks of the PGV-1000 design as well as low quality of WCR-2, which together form the condition for corrosion process in chinks of rolling of thermal-exchanged tubes to collectors due to concentration of corrosion-active contamination of 2nd system water resulted from evaporation. Metal of ,,hot" collector is not distrusted by corrosion possibly due to filling its chinks by steam ,,pad" which under unit operation isolates metal from coming of corrosion-aggressed salts of 2nd system water to places of tube packing. -109- Accepted for 2nd system of.NPP with WWER-1000 reactor the hydrazine- ammonia WCR together with existed copper alloys in 2nd system equipment does not allow to provide reliable operation of SGs: - determined region for feed water pH values does not provide minimisation of the corrosion-erosion wearing out processes of equipment metal made from carbon steel; more high concentration of ammonia is impossible because of strengthening of copper alloy corrosion processes. For existed design solution the alternative water regimes had to be choices taken into account the national and world experience accumulated at ThPPs and NPPs, which cold allow to avoid the negative influence of the mentioned factors on choose constructive materials of the 2nd system equipment. Therefore in 1992 at the unit No3 of Zaporizka NPP the experimental tests of WCR-2 were started with feed water correction by lithium-metaborate. Based of the results of experimental operation of the unit No3, the WCR-2 with SG feed water correction by lithium-metaborate was extended upon all Zaporizka NPP units. The pH correction of feed water by lithium-metaborate is carried out under condition of pH decreasing of blowing water lower than 8.3. Under WCR operation the lithium concentration in blowing water is supported in the region 30-90 ppb. Averaged over 1998 years parameters of WCR-2 is shown in Table 2. Table 2 Parameters of lithium-metaborate WCR-2 Unit No Blowing water Feed water PH Na, Na, pH N2H4, Fe, ppb ppb ppb ppb

1 8,5 111 24 9,0 91 11,5 2 8,5 79 45 9,0 101 10,4 3 8,4 53 52 8,9 123 10,4 4 8,4 54 35 9,0 111 11,0 5 8,4 99 49 9,0 82 12,3 6 8,4 67 49 9,0 93 12,9 average 8,4 77 42 9,0 100 11,4

According to the data of Zaporizka NPP, it was not observed the positive influence of the lithium-metaborate WCR-2 on corrosion-erosion processes carried out at metal surfaces of equipment of condensation-feed system. Iron concentration in feed water remains at respectively high level. Copper concentration in feed water is not higher than 4 ppb. As positive factor of influence of the regime on metal state in can be mentioned the high level of integrity of SG thermal-exchanged tubes despite of its essential pollution by contamination.

-110- Number of riveted thermal-exchanged tubes of SGs are shown in Table 3. Table 3 Status of SG tubes Number of Units riveted tubes during SG operation 1 2 3 4 5 6 12 37 1 42 7 6 Operation 51136 48432 49000 77000 63000 17452 time (h)

In SG sediments the lithium compounds are observed as 0,07-0,09% (normalised to L^O), that testifies on including of lithium to film at the metal surface of thermal-exchanged tubes. As essential lacks of WCR-2 with correction of feed water by lithium - metaborate there can be mentioned the hard work regime of anionite and cationite of SVO-5 equipment, especially anionite which really work as boron- form. Therefore when WCR-2 is carried out with feed water correction by lithium-metaborate, increasing of exchange volume of SVO-5 anionite has to be provided. Introduction of WCR-2 with lithium-metaborate dosing at Zaporizka NPP allowed to improve SG WCR and can be considered as one of the ways of the 2nd system WCR improvement.

4.2 Morpholine WCR-2 Because the cooling water of condenser turbines at South-Ukrainian NPP is characterised be salt concentration as 2,5 times more then design value, the hydrazine-ammonia WCR-2 existed now does not provide the design operational terms of the 2nd system equipment. Based on the recommendations of the EC experts an the frame of the TACIS-95 Programs, to solve this problem the WCR-2 with correction of 2nd system feed water by morpholine was proposed. The world experience testify to efficiency of the morpholine WCR-2 as method of decreasing of corrosion-erosion process intensities for equipment with copper alloys due to pH increasing. The morpholine distribution coefficient for the ,,steam-water" system is near 1, whereas ammonia is characterised be the coefficient equal 8. This property of morphine provides its inhibiting and neutralising abilities for all elements of the 2nd system equipment. Analysis of world experience of morpholine regime use at NPPs with PWR-reactors, which content copper alloys in 2nd system equipment, testifies to essential decreasing of corrosion-erosion process intensities (to 7-10 times) in -111 - comparison with ammonia-hydrazine regime used earlier. Decreasing of corrosion intensity leads to decreasing of corrosion product transport to SG and, as result, to decreasing of its pollution levels. In turn, decreasing of pollution levels of the SG surfaces leads to decreasing of under-sediment corrosion intensities and to suppressing of the ,,hide-out" effect during transit regimes of unit operation. On the frame of the TACIS-95 Project No Ul.02/95 A at South-Ukrainian NPP unit No2 the tests of the morpholine regime were carried out to examine the possibility of its use in the specific conditions of WWER-1000 unit. The South-Ukrainian NPP unit No2 with the WWER-1000 reactor is the first unit of WWER-type, which 2nd system the morpholine regime was examined in. The unit No2 was operated at the nominal 100% power with WCR-2 morpholine regime during 97 days. After 3-monts experimental operation of the unit, the next conclusions can be made: uniform concentration of morpholine (4-5 ppm) and pH value were achieved in the 2n system. Introduction of morpholine allowed to increase the pH value of the SG blowing water from to 8,8-9,0 in comparison with 7,8-8,2 for the traditional ammonia regime; iron and copper concentrations in feed water were decreased essentially: 0,7-5ppb for iron (decreasing coefficient > 2) and 0,1-0,6 ppb for copper (decreasing coefficient 2-5); amounts of corrosion products at SG tubes were decreased essentially; the morpholine regime is more economical and competitive in comparison with those of hydrazine-ammonia.

Preliminary evaluation demonstrates that waited economical effect from introduction of morpholine regime is not less than US$ 270,000 only due to shortage of direct operational expenditures. Comparable analysis of the results of SG inspections carried out during 1997-1998 restores demonstrated that next decreasing of sediment amounts were obtained: 2 times at SG No3 3 times at SG No4 no sediments at SG No 1,2 during 1998. Experimental tests of morpholine WCR-2 at the SUNPP unit No2 give positive results and demonstrate possibility and efficiency of implementation of this regime at the units with WWER-reactors of soviet design. This results allow to hope that morpholine WCR-2 implementation will allow to solve the problem of reliability and operational resource of SGs. After preparation of corresponded documents further examination of morpholine WCR-2 at South-Ukrainian NPP will be continued.

-112- CZ0129414

APROS MULTIFUNCTIONAL SIMULATOR APPLICATIONS FOR WER-440

Kari Porkholm, Heikki Kantee Fortum Engineering Ltd POB 10, 00048 Fortum, Finland Tel.+358 10 45 32449 Fax+358 10 45 33403 E-mail: [email protected]

Olli Tiihonen Technical Research Centre of Finland POB 1604, 02044 VTT, Finland Tel. +358 9 456 5040 Fax +358 9 456 5000 E-mail: [email protected]

ABSTRACT

Fortum Engineering Ltd and the Technical Research Centre of Finland have developed APROS simulation software since 1986. APROS is a multifunctional simulator, which is used for process and automation design, safety analysis and training simulator applications. APROS has unique features and models developed especially for VVER-440 reactors.

At first the paper gives a short overview of APROS multifunctional simulator. The rest of the paper deals with different kind of applications of APROS in VVER-440 reactors' improvement and operation development.

INTRODUCTION

The trend in the development of the simulation software is to create one software, so-called multifunctional simulation software, which can be used in process and automation design, safety analysis and training simulator applications. By the use of the multifunctional simulation software significant benefits are achieved, e.g. the utilisation of the software during the plant lifetime becomes more effective and faster as well as the maintenance costs of the software and its applications decrease considerably.

APROS (Advanced PROcess Simulator) simulation software is one example of the real multifunctional simulation software. It has been used successfully in the simulation of VVER-440 reactors in all the multifunctional simulator applications.

APROS MULTIFUNCTIONAL SIMULATOR

APROS multifunctional simulator has been developed in co-operation between Fortum Engineering Ltd and Technical Research Centre of Finland since 1986. APROS Simulation Environment contains tools, calculation algorithms and extensive model libraries for the simulation of both nuclear

-113- and thermal power plants. Much attention has been paid for the development of the user-friendly graphical interface.

APROS nuclear power plant library consists of comprehensive simulation models. The thermal hydraulic library contains 3- , 5- and 6-equation models for the calculation of one-dimensional two- phase flow. For the computation of water and steam material properties the fast access material property tables are used. Component model library includes:

• one- and three-dimensional nuclear reactor • pressuriser • horizontal and vertical steam generator • turbine plant components • feed water and condenser plant components • auxiliary systems components • containment • control and interlocking systems • electrical system components.

In the nuclear power plant applications APROS has many useful and also unique features:

• accurate physical dynamic models • fast running simulation • extensive validation • graphical interactive interface for process modeling • suitable to model also I&C and electrical systems • possibility to extend the plant analyser or engineering simulator of the plant design phase to the training simulator.

PROCESS AND AUTOMATION DESIGN

OPERATING INSTRUCTIONS

TRAINING OF PLANT PERSONNEL

Figure 1. APROS Applications

The validity of APROS power plant models ranges from cold start-up to normal operation modes, normal and emergency shutdown, load rejections and other disturbances as well as to failures of any combination of process, automation or electrical components.

-114- The APROS simulation software can be run in any manufacturer's computer e.g. COMPAQ, HP, SUN and SGI workstations. Today also a version running in Windows NT personal computers is available.

APROS VVER-440 APPLICATIONS

In APROS development work a lot of efforts have been made to increase the capability of APROS to simulate VVER-440 reactors. Therefore APROS has been used extensively in the simulation of Loviisa reactor. Today APROS is also in use at Kola NPP and Paks NPP. In these applications APROS has been used as an engineering simulator, a plant analyser and a training simulator. Below different kind of applications are presented and achieved benefits are considered.

Process Design

The simulation software having physical models is an excellent tool in a process design. The tool gives to the user an opportunity to study the dynamical behaviour of the plant modifications already in the design phase, i.e. when the modifications are on the paper. The faults in the process systems can be observed at the stage, when the modifications are easy and economical to make.

APROS process design applications at Loviisa NPP are:

• design of the new high pressure preheater system • capability of the emergency core cooling systems at high sump temperatures • dimensioning of the throttle of the steam generator blowdown system • design of the new emergency make-up tank • behaviour of the HPSI and LPSI pumps in the minimum recirculation conditions • behaviour of the condenser in the sea water line break • behaviour of the PCP injection system temperatures in the sea water transient.

Automation Design

The increase of the computer computation power has enhanced remarkable the possibilities to simulate complex physical phenomena accurately. This is the precondition on the effective use of a simulator in the automation design.

APROS has many useful applications at Loviisa NPP in the automation design e.g. checking the functioning of the control systems and pretuning of the control systems. Based on the experience the use of the simulator decreases the start-up time and the costs of the testing phase.

Examples of the use of a simulator in the automation design at Loviisa NPP are:

• design of the control system of the new high pressure preheater system • design of the steam generator level control systems • design of the pressure control system of the feed water tanks.

In the configuration of a distributed control system (DCS) many bugs are made in spite of a careful work. The bugs can be found only by the extensive testing of DCS. The testing can be made more effective by the utilisation of the simulator.

-115- The automation systems are nowadays designed more open than earlier. This enables that the connection of the automation system and simulator is easier to make. The newly developed and widely accepted OPC standard offers one flexible way to connect simulators and DCS of different vendors.

Based on the OPC standard, a new framework of connecting automation domain applications has been developed in APROS. The system has been used in one thermal power plant application and the results are promising. It is expected that the same configuration could be used in the testing of a new automation system in a nuclear power plant.

Figure 2: Schematic figure of the testing system

Safety Analysis

In Finland APROS has been the main system analysis code since mid 1990's when it was used in safety analyses relating to the modernisation and power uprating program for Loviisa VVER-440 reactors. Among other things Loviisa Final Safety Analysis Report (FSAR) was extensively revised as part of the licensing process for higher reactor thermal power /I/. The major part of FSAR safety analyses was calculated using APROS.

The revision of the Loviisa FSAR in the modernisation and power uprating program with the new- uprated 1500 MW thermal power required a great number of safety analyses. 6-equation version of the APROS code was used in all the analyses and the calculated initiating events are listed below: o LBLOCA (Cold and hot leg, BOC and EOC) • SBLOCA (Cold and hot leg, several break sizes) • ATWS (CRW from full power, Loss of main FW, Loss of on and off-site AC power) • PRISE (Single tube, medium, large) • Reactor coolant pump trips (One, Three) • Reactor coolant pump seizure • Main feed water pumps trip

- 116- • Feed water line break (Three different break locations) • Inadvertent closure of main steam line isolation valve (One valve, Six valves) • Loss of on and off-site AC power • Uncontrolled withdrawal of a control rod group during power operation • Overpressure protection analysis (Six or one MSIV closure, Turbine trip) • Decrease of feed water temperature • Inadvertent opening of one steam generator safety valve

To study the sensitivity of the results, each initiating event analysis included several parameter variation analyses. Parameter variations included e.g. in pipe break cases variations of break size and break location, in ATWS and overpressure protection analysis variation of initiating events and in analyses dealing with pump trips variation of number of pumps to trip and power control system (ROM) operating or not. Also capacity of ECCS and emergency feed water pumps were considered important parameters as well as the availability of on and off-site AC power.

In the future application of APROS concerning accident analyses of Loviisa will be extended to low power and shutdown mode analyses.

Validation of Emergency Operating Procedures

APROS has sophisticated process component models for the description of the whole VVER-440 power plant process. In addition the control, interlocking and protection systems as well as the electrical systems can be simulated comprehensively. These APROS features added by the user friendly features, e.g. graphical and interactive modelling, make APROS an excellent tool for the development and validation of the emergency operating procedures (EOP).

The Kola Nuclear Power Plant has already used APROS in these applications and the experiences are good 111. At Loviisa NPP APROS will play an important role when EOPs will be rewritten. APROS is going to be main tool in verifying new procedures.

Training Simulator

The training simulators are used extensively in the operator training of the nuclear power plants. Normally the training simulators are full scope, where the control room corresponds accurately to the real one.

The utilisation of the compact training simulators in the operator training is increasing. The extent of the simulation model of the compact training simulator corresponds to the full scope training simulator. Instead the process, automation, protection and electric systems are presented in visual diagrams in computer displays and the operator actions are performed by the mouse. As a consequence the time for the development of the compact training simulator is shorter and the price lower than the full scope training simulator.

Fortum Engineering Ltd has developed in the co-operation with Kola NPP and Technical Research Centre of Finland an APROS-Based Kola 1 and 2 Compact Training Simulator. The development work started in 1995 and the simulator passed the final acceptance tests in August 1999. The full set of the acceptance tests covered different steady state, start up and shut down events as well as 40 transients 131.

-117- The Kola training simulator of the older units 1 and 2 includes the systems needed for normal operation and accident conditions. The simulator has the displays for the operators and the instructor, who is able to generate any kind of malfunctions. Additionally the simulator has versatile functions to analyse and repeat exercises. The trainees can see on the displays of the simulator the same plant parameters and control the same plant equipment as in the real control room of the plant.

QiniDIQiEIQlDiainiHIQID

Figure 3. Example of an operators display

CONCLUSIONS

APROS is a real multifunctional simulator, which has been used in process and automation design, safety analyses and in the development of the training simulator for VVER-440 reactors. APROS has proved to be an excellent tool in the enhancement the safety operation of nuclear power plants.

REFERENCES

/I/ H. Kantee, H. Kontio, H. Plit, H. Kallio, S. Savolainen, S. Norrman and E. Virtanen, Application of APROS Simulation Software in Safety Analyses of Loviisa NPP Power Uprating Project, 6th International Conference on Nuclear Engineering, ICONE-6, San Diego, California, USA, May 10- 15, 1998

111 M.Yu. Lankin, V. I. Schutov, V. V. Malshakov, C. A. Andrushechko and Yu. N. Pytkin, APROS Simulation Software for Operational Procedures at Kola Nuclear Power Plant (in Russian), Moscow, Russia, May, 1998

131 K. Porkholm, L. Kumkov and S. Netchaev, Kola's simulator passes its final tests, Nuclear Engi- neering International, January, 2000, page 34

-118- CZ0129412 CZ0129415

Safety Improvement Programme of WWER 440/230 Units in Jaslovske Bohunice.

JozefTomek Slovenske elektrarne, a.s. Hraniena 12 827 36 Bratislava Slovak Republic E-mail: [email protected] Phone: +421 805/555 2312, Fax: +421 805/5591 527

1. General overview

The Slovenske elektrarne, joint stock company (SE) is the dominant electricity generator in the Slovak Republic (SR) with a total installed generating capacity of 7,027 MW at the end of 1999, which represents approximately 85% of the total installed capacity of power plants in the SR [Fig. 1]. In the year 1999 SE generated in their own sources 23,426 GWh, from which 56 % at nuclear, 24 % at thermal and 20 % at hydro-electric power plants. Figure 2 shows the power sources of SR including two NPP sites: • four WWER 440 units in operation at Jaslovske Bohunice site. First two units of older soviet PWR design V-230 (also known as V-1) and other two units of newer V-213 type (also known as V-2). • two units in operation (unit 1 in commercial, unit 2 in trial operation) and two units under construction at Mochovce site (4 units WWER 440/V213),

Total Instated capacity In Slovakia In 1999 - 8 313 MW

• Tnamal POMT Plant O Hydro powar plant

O H*attog Plant O Dltpatcnlng Cantr»

* Nuctaar pwm plant • S£ Haadquartani

KPP undar commlssionnlng

*tnutmtntFaculty

Fig. 1 Share of power sources in Slovakia Fig.2 Power sources of SR

The Board of Slovenske elektrarne expressed its ultimate responsibility for nuclear and radiation safety matters in ,JVuclear and Radiation Safety Policy". Among the main principles declared in this document also belong these two ones:

-119- • nuclear safety is the first priority and above to all other interests of the Company, • upgrading of nuclear safety, based upon the most up-to-date knowledge, with the objective to maintain European standards and IAEA norms, is a continual and ongoing process nuclear sources and keep them on an internationally acceptable level of nuclear safety

Among the most important power sources of SE belong the WWER 440/230 units in Jaslovske Bohuriice. In Table 1 the information of their commissioning schedule and the total electricity produced till 1999 is given. Table 1 I Connection to the grid Commercial operation Electric power production i start-up (by the end of 1999) [GWhJj . . . . i Unit 1 17.12.1978 26.03.1980 57 102 Unit 2 01.04.1980 01.01.1981 54 821

The operation of these units has been safe and reliable since their commissioning. They provided by now a reliable contribution to the country's power supply without any accident or off-site impact (all reported operational events were reviewed by IAEA ASSET mission in 1990 and ranked according to the INES scale). This statement can be supported by the fact that since 1990, when the ASSET operational event investigating methodology was adopted by the plant staff, no event judged as INES level 2 and above happened. Last year even no event INES 1 occurred.

2. Bohunice V-1 Units Nuclear Safety Upgrading

Management and staff of the Bohunice NPP were always aware of their responsibility for the safe operation and understand the nuclear safety as a continuous process. Out of this reasons, safety improvements and equipment modifications have been performed just since the plant commissioning. More than 1300 minor or major modifications were implemented. Increased effort for safety upgrading of Unit 1 and 2 started in middle 80-ties, when the first backfitting programme, focused mainly on the RPV irradiation embrittlement decrease (installation of shielding assemblies around the core, using of so-called low-neutron-leakage fuel loading, measures to reduce thermal stress of the reactor pressure vessel during operational transients, etc.) and on improvements in fire protection area, was developed and executed. After the political changes in former Czechoslovakia in 1989 the country opened for the cooperation with foreign bodies. Since 1990 more than twenty specific safety missions reviewed the status of the NPP both in the design and operational area. In 1990 IAEA initiated a programme to assist the countries of central and eastern Europe in evaluating the safety of the first generation WWER-440/230 NPP's. Major design and operational safety issues were identified and gathered in the document TECDOC-640 ,,Ranking of safety issues for WWER-440/230 NPP's". As a result of findings, recommendations and suggestions for further safety upgrading programmes were adopted. According to decision No. 5/91 issued by the regulatory authority of former Czechoslovakia, so called ,,Small reconstruction programme" was performed at Unit 1 and 2 between 1991 and 1993 with total investment of USD 67 million eighty-one improvements were performed within this programme both in design and operational field and considerably improved the safety of both units. The programme included: • annealing of reactor pressure vessels of both units, • validity verification of the LBB (Leak Before Break) method including the seismic upgrading of the equipment,

-120- improvement of confinement leaktightness, installation of fast-closing isolation valves at the steam generator steamlines, installation of diagnostic systems at the primary and secondary circuit equipment, reconstruction of the containment spray system delivery lines, interconnection of emergency core cooling systems of both units, reconstruction of pressurizer safety valves and installation of pressurizer relief valve, installation of emergency control room panels, reconstruction of the self consumption electric system including the installation of an additional diesel generator and an accumulator battery, replacement of the fire signalization system, extension of the stable fire extinguisher system and fire resistance upgrade - replacement of cables with fire-proof ones, covering of the fire protective walls and cables with non-flammable material, emergency operating procedures and surveillance programmes development, development of level 1 probabilistic safety assessment study,

Slovak regulatory authority issued decisions No. 1/1994 and 110/1994 based on the Safety Analysis Report elaborated in the frame of the ,,Small reconstruction programme" and other technical sources listed below: • Preliminary Safety Analyses Report for Gradual Reconstruction, • "Ranking of Safety Issues for WWER 440 model V-230 NPP's" IAEA - TECDOC 640, • "Bohunice V-l Major Safety Upgrading" IAEA consultant's meeting report, • IAEA report - "A common basis on which the safety of all operating nuclear power plants built to earlier standards can be judged", • Report of IAEA consultant's meeting "On containment and confinement performance in NPP's with WWER 440/213 and 440/230", • Report of the IAEA consultant's meeting "Major improvements for WWER 440/230 NPPV, • PSA level 1. In decisions No. 1/1994 and 110/1994 requirements for further improving were expressed and the future operation of both units was conditioned by fulfillment of prescribed requirements. Only in case when they are met, the regulatory authority issues the license for operation which is valid one year. Basic Engineering for major reconstruction was prepared and so called ,,Gradual reconstruction programme" started in 1996 and will be finished in 2000. The REKON consortium formed by Siemens KWU Group and the Slovak research institute VUJE a.s. is the main supplier of this reconstruction programme with total estimated cost of approximately USD 180 million. By the realization of this programme the Bohunice NPP intends to meat the following targets: a) deterministic targets: • to cope with the newly defined maximum Design Bases Accident LOCA 2 x § 200 mm by a conservative approach and coping with Beyond Design Bases Accident LOCA 2xi| 500 mm by best estimate method, complying with the following conditions:

^ Peak temperature of fuel cladding < 1 200 °C, '-y' Fuel melting does not occur, ^ Total cladding oxidation < 1% from its total amount,

-121 - ^ Peak local cladding oxidation < 18% from the initial cladding thickness, • two redundant separate train of safety systems and support features, • the confinement leaktightness and accident localization systems must assure that the dose equivalent is less then 50 mSv for the whole body and 500 mSv for the thyroid in case of DBA and the dose equivalent is less then 250 mSv for the whole body and 1500 mSv for the thyroid in case of BDBA in the controlled area, b) probabilistic targets: • the failure probability of safety systems 10 "3 / per demand or less • the failure probability of automatic reactor trip system 10 '5 / per demand or less, • severe core damage probability (CDF) 10 AI reactor year or less, • LBB concept implemented - probability of sudden double ended guillotine break of primary pipe < 10-6 per year.

The V-l units safety upgrading process is carried out gradually during extended outages and general overhauls within 1996-2000 (this is why it is called ,,Gradual Reconstruction"), and includes, among others, the following safety improvements: • increasing of reactor coolant system integrity, • confinement leaktightness improvement and installation of isolation valves at the hermetic zone boundary pipes (the improvement brought about so far is evident from Fig. 3), • strength improvement of the hermetic zone Confinement leaktightness Improvement at V-1 structures to withstand maximum overpressure during LOCA 2 x

-122- • ventilation systems modifications and installation of new ones

Simplified layout of emergency systems including accident localization system is on the Figure 4.

Fig. 4 Emergency systems after gradual reconstruction

1. Reactor 8. HP emergency pump 2. Steam generator 9. LP emergency pump 3. Reactor coolant pump 10. Spray system pump 4. Main isolating valve at the hot branch of the loop 11. Tank of boric acid solution 5. Main isolating valve at the cold branch of the loop 12. Heat exchanger 6. Pressurizer 13. Sprays 7. Safety relief tank 14. Containment

-123- Fig. 5 shows results of PSA Level I studies for the individual safety improvements stages of the initial project of V-l units. After the gradual reconstruction including the implementation of symptom- oriented emergency procedures (SOEP), the CDF calculated value is 5,39 E-05 per reactor year.

Initial level After Small Basic Upgraded BE SOEP 12/1991 RECO Engineering Implemented 12,1993 12/1999

Fig. 5 Results of the PSA Level 1 studies of Bohunice V-1 units and reconstruction objectives

Certain projects have a general effect on the entire Bohunice site, as evident from the following implemented projects: • Quality Assurance Program and Personal Training Program - in co-operation with the Nuclear Electric Pic. and funded by the UK government, • Multifunctional simulator - development of a simulator with international co-operation with CORYS, BELGATOM and Siemens, funded by the European Commission, • Installation of a number of diagnostic systems (evaluated as a ,,Good Practice" by OSART 96) - Fig. 6, • AKOBOJE Site Security System - implemented by CEGELEC-TERMATOM, • Teledosimetric system - monitoring of the 15 km radius area around the Bohunice site (evaluated as a ,,Good Practice" by OSART 96) - Fig. 7.

tytiftn* ItoiiJttilngiyiteu

Continual monitoring o Bohunice site and surrounding area: Stations layout: • 5 - Bohunice site •15 - 6 km circle •= • 4 -15 km circle -' On-line data output to ;g Emergency Response Center of SR NRA

Fig. 6 Diagnostic systems at the NPP Bohunice Fig. 7 Teledosimetric system at the NPP Bohunice

-124- 3. International Safety Assessment of Bohunice V-1 Units

Several international safety assessment and safety missions (covered by IAEA) were carried out during last two years. Some of their important statements and conclusions concerning Bohunice V-1 are given bellow. Bohunice V-1 Safety Upgrading Review - June 1998 • considerable amount of safety improvement have been performed in all design areas, • when the gradual reconstruction is completed, all IAEA recommendations for WER-440/230 type reactors will be fulfilled at the Bohunice V-1 Units. Review meeting of National Reports - Convention on Nuclear Safety - April 1999, Vienna • outstanding performance in nuclear safety upgrading area, equally on regulatory and industrial aspects, enables Slovakia to transfer their knowledge and experience to other countries with similar nuclear installations, • considering the efficiency of the confinement system of Bohunice V-1 reactors, Slovakia presented arguments, they are developing to demonstrate that, taking into account implemented and proposed modifications, this is not a safety issue. Final Report of the Extrabudgetary Program on the Safety of WWER and RBMK NPPs (IAEA-EBP-WWER-15) - May 1999 It is stated that after completion of reconstruction all IAEA recommendations for WWER-440/V230 model type reactors will be fulfilled at Bohunice V-1 Units. International Conference on Strengthening Nuclear Safety in Eastern Europe, June 1999, Vienna - IAEA 26 countries, WANO, OECD-NAE, G-24 NUSAC, EC, EBRD • best results in confinement leaktightness improvements by factor of 100 has been achieved at Bohunice V-1 NPP, • at Bohunice V-1, major safety improvement, based on a pressure reduction system may give the confinement the capability to face all types of large break LOCAs, • taking into account all planned and already implemented safety measures, Bohunice V-1 can be considered as an example of the safety level which can be achieved in a WWER - 440/230.

4. Conclusions

I has to be stressed once again that the nuclear safety is the first priority of Slovenske elektrarne, a.s., which is expressed also in the ,,Nuclear and Radiation Safety Policy". We assume that an internationally acceptable level of safety will be reached by accomplishing of this ambitious safety upgrading programme. This fact and outstanding safety culture performance enables the operating organization to operate these units safely till the end of the lifetime.

-125- CZ0129416

Current Activities on Safety Improvement at Ukrainian NPPs.

Presentation by the National Nuclear Energy Generating Company 'ENERGOATOM'

at International Conference «WER Technical Innovations for Next Century» Prague, The Czech Republic, 17-20 April, 2000.

-127- International Conference: «WER Technical Innovations for Next Century» Prague, The Czech Republic, 17+20 April, 2000.

Content:

INTRODUCTION 1. SUMMARY OF THE CURRENT SITUATION IN THE NUCLEAR POWER INDUSTRY OF UKRAINE

2. APPROACHES APPROVED FOR DEVELOPMENT OF ACTIVITIES INTENDED FOR SAFETY IMPROVEMENT AT UKRAINIAN NPPS.

3. ENCLOSURE 1. SUMMARIZED INFORMATION ON IMPLEMENTATION STATUS OF THE ACTIVITIES RATED CATEGORY III AT UKRAINIAN NPPS WITH WWER-1000 TYPE REACTORS

-128- International Conference: «WER Technical Innovations for Next Century» Prague, The Czech Republic, 17-^20 April, 2000.

INTRODUCTION.

This report describes general development status of the national programs on safety improvement of the Ukrainian NPPs, basic approaches adopted for planning and implementation of safety improvement works, and state of implementation of principal technical activities aimed at safety improvement of Ukrainian NPPs. (Slide 1)

-129- International Conference: «WER Technical Innovations for Next Century» Prague, The Czech Republic, 17^-20 April, 2000.

1. Summary of the current situation in the nuclear power industry of Ukraine.

In Ukraine at five nuclear power plants 17 power units were constructed and commissioned At present there are 14 power units in operation. Three power units of Chornobyl NPP were stopped (Chornobyl Unit 4 was destroyed during the accident in April, 1986; Chornobyl Unit 1 and Unit2 had been stopped and are on the decommissioning stage). (Slide 2). As of 1st April, 2000 gross installed capacity of Ukrainian NPPs was 12.818 GW (Slide 3).

Under conditions of comprehensive economic recession in Ukraine electricity production reduces either (Slide 4), caused, mainly, by the shortage of both fossil fuels (oil and gas) and funds to purchase it and ending of the life time of the power generating capacities of the conventional power industry.

In 1999 share of electricity produced by NPPs which have 24,6%(S//cte 5) of total installed capacity was 42,1 %. (Slide 6).

Over the last 3 years appeared a trend on reduction of power generation by NPPs either, caused by prolongation of the maintenance duration due to additional works related to the equipment diagnostics, performance of rehabilitation and upgrading. It resulted in decrease of the load factor (Slide 7).

-130- International Conference: «WER Technical Innovations for Next Century» Prague, The Czech Republic, 17-4-20 April, 2000.

2. Approaches approved for development of activities intended for safety improvement at Ukrainian NPPs.

2.1. With regard to the design peculiarities Ukrainian nuclear power units can be divided into four reactor groups: (Slide 8) • WWER-1000(V-320)-large series • WWER-1000 (V-302, V-338) - small series • WWER-440(V-213) • RBMK-1000 (second generation).

2.2. Over the period from 1986 to 1990 a set of activities to improve technological solutions was defined on the basis of analysis of erection, start-up and operation of WWER-1000 and WWER-440. These activities include: (Slide 9) • individual specific measures; • calculation and validation of specific activities; • validation to assess long-term tasks of safety and reliability improvement.

These measures were described in a number of published nuclear power regulations applied in the industry (in the first turn in SM-88 and SM-90 'List of Combined Activities Aimed at Safety Improvement of Power Units with WWER and RBMK Reactors in Operation').

It shall be emphasized that these comprehensive activities integrated experience, expertise and approaches of the key organizations involved in creation of the power units. However, it was not a corollary of the comprehensive safety assessment.

2.3. In early nineties many technical regulations have been enacted, including those related to the safety provision. It required that analysis of the conformity with the regulatory requirements be made, and measures to eliminate inconsistencies and/or compensating measures be developed and implemented.

2.4. In 1994 GOSKOMATOM of Ukraine developed a 'Program on Safety Improvement of NPPs with WWER-1000 and WWER-440 reactor types' and a 'Program of the Priority Measures on Safety Improvement of NPPs with WWER-1000 and WWER-440 reactor types' (both were agreed upon with, GosAtomNadzor of Ukraine, the then Regulatory Authority).

The specified program was developed based on the following principles:

-131 - International Conference: «WER Technical Innovations for Next Century» Prague, The Czech Republic, 17*20 April, 2000.

(Slide 10) • ensuring of elimination of major inconsistencies with the safety regulations requirements and/or compensating measures on elimination of inconsistencies impact on safety; • deterministic assessment of safety deficiency and elaboration of measures based on available expertise and operational experience; • classification of safety deficiency similar to IAEA's classification; • integration in the 'Program..' of principal activities on safety improvement complemented with less significant measures relating to reliability (availability) included in the specific programs developed by NPPs.

2.5. The measures were implemented in compliance with plans developed for specific NPPs and power units.

2.6. Since safety is a priority it was considered reasonable to summarize available expertise and activities including those related to the international projects, to make 'Programs on Safety Improvement of WWER NPPs' more detailed in order:

• to define full set of long-term safety improvement activities which can be defined based on the present level of expertise (strategic plan); • to define package of priority measures intended for safety improvement.

2.7. By now NNEGC ENERGOATOM has developed the documents listed hereafter: (Slide 11) • industrial program on safety improvement 'List of Combined Activities Aimed at Safety Improvement of Power Units with WWER 1000 (320) Reactors in Operation; • Program on Priority Measures for Safety Improvement of Ukrainian NPPs. These activities are to be implemented within 3 years (was approved by NRA); • Comprehensive Program on Safety Improvement and Upgrading of Rivne Units 1 and 2 ( developed by the joint effort of the NNEGC, RNPP and JSC Siemens ; reviewed and approved by the NRA).

'List of Combined Activities Aimed at Safety Improvement of Power Units with WWER-1000 (320) Reactors in Operation' is a follow up of the 'Program on Safety Improvement of WWER-1000, WWER-440 NPPs' which was approved by the GOSKOMATOM of Ukraine and agreed on with the GOSATOMNADZOR of Ukraine in 1994.

Necessity to upgrade this 'Program on Safety Improvement of WWER-1000, WWER-440 NPPs' and make it more detailed was caused by the following factors: (Slide 12)

-132- International Conference: «WER Technical Innovations for Next Century» Prague, The Czech Republic, 17+20 April, 2000.

• some issues were revised in addition which allowed to clarify the substance of problems and ways of their solution; • in the framework of activity of international expert organizations a number of issues were reviewed, among them, those related to the categorization of priorities on safety effects; • detailed long-term upgrading programs for Khmelnitsky -2 and Rivne- 4 units under construction were developed, revised and agreed. The design of these power units under construction is similar to that of the operating units. • necessity to specify in more details possible areas of technical development and their relationship depending on the character of the activity (general development for all power units, individual development, etc.).

The following fundamental documents were used to compile this program: (Slide 13,14) • applicable Ukrainian technical codes and standards on safety ; • combined activities on safety and reliability improvement of operating nuclear power plants with WWER reactors which were developed in the USSR in 1987-1989; • technical safety analysis reports (so called TOBs) done for all operating power plants and units under construction in 1992-1993; • 'Program on Safety Improvement of WWER 1000 and WWER 440 NPPs' developed by the GOSKOMATOM of Ukraine and agreed on with the GOSATOMNADZOR of Ukraine in 1994; • Program on Upgrading of Reactor Units of WWER-1000/V-320 type at Ukrainian Nuclear Power Plants. • documents of the IAEA's missions to Ukraine (OSART, ASSET, SRM); • studies of the IAEA in the field of general safety of the WWER 1000 reactors, including those performed under extra budgetary program (document IAEA- EBP-WWER-05; WWER dealing with Safety Problems of the NPPs with reactors of WWER 1000/320 type and their categorization ),etc.

'List of Combined Activities...' provides the following definitions (Slide 15): • Part 1- priority measures aimed at ensuring of acceptable safety level. • Part 2- long-term activities aimed at upgrading of the available safety level; • Part 3 - activities of reliability and operation availability enhancement; • Part 4 includes additional materials comprising summarized information on the following issues:

• elimination of deviations from technical codes and standards in the course of implementation of the 'Program on Upgrading';

-133- International Conference: «WER Technical Innovations for Next Century» Prague, The Czech Republic, 174-20 April, 2000.

• implementation in the 'Program on Upgrading 'of recommendations provided in the IAEA's Report IAEA -WWER-05.

The industrial program comprises (Slide 16):

• specific technical measures defined on the basis of analyses of the fundamental documents. In parallel, for some problems concrete technical solutions were outlined, while for the rest, direction for the search of technical solutions was indicated ; • analyses and validation aimed at both verification of existing technical solutions and/or justification of the required modernization.

Activities which may appear in the course of these analyses and justification refer to the long-term measures. Their implementation is subject to separate review in the future revisions of the program.

Based on the 'List of activities ..." and 'Comprehensive program...' the long term plans for specific NPPs and power units are being clarified with the priority activities and current financial opportunities being identified.

2.8. Compiling of the long-term activities list was based on the summarized experience of the previous activities, including (Slide 17):

• activities implemented in Ukraine and Russia; • international projects on WWER NPPs safety analysis (including analyses made by IAEA such as : IAEA-EBP-WWER-03, IAEA-EBP-WWER-05; WWEER-SC-202).

Safety problems and their categorization for different reactor types of Ukrainian NPPs are shown respectively on (Slide 18, 19, 20):

2.9. Since compiling of the list of activities and their prioritization is based on the deterministic approach, they have to be specified for each power unit after Safety Analysis Report is implemented (SAR).

-134- International Conference: «WER Technical Innovations for Next Century» Prague, The Czech Republic, 17^20 April, 2000.

3. Enclosure 1. Summarized information on implementation status of the activities rated Category III at Ukrainian NPPs with WWER-1000 type reactors

Here is some information on current implementation status of the most significant safety improvement activities (in compliance with IAEA's documents, namely: IAEA-EBP-WWER-03, IAEA-EBP-WWER-05), many of them being top priorities (Slide 21):

No. Title of the Safety Problem Zaporizhzhya NPP Rivne Khm South-Ukraine NPP elnit NPP sky NPP 1 2 3 4 5 6 3 1 1 2 3 1. GENERAL ISSUES 1.1 Equipment certification Development of materials on the equipment certification 2005 2005 2005 2005 2005 2005 2005 2005 2002 2002 2005 Equipment classification + + + + + + + + + + +

2. REACTOR CORE 2.1. Reliability of the control rod insertion \fuel assembly deformation Ensuring design time of the CPS (control and protection system) + + + + + + + + + + + control rod drop. Calculation of the loads onto the support frame of the fuel assembly Introduction of the "weighted" CPS control rods. — — + — — + + — — — — Replacement of the 5th Group's half length control rods by the full + + + + + + + + + + + length control rods Installation of racks for the spent fuel assemblies compacted + + + + + + + + + + + storage Implementation of measures aimed at preventing ingress of pure + + + + + + + + + + + condensate into the primary circuit.

CO en International Conference: «WER Technical Innovations for Next Century» Prague, The Czech Republic, 17-20 April, 2000.

No. Title of the Safety Problem Zaporizhzhya NPP Rivne Khm South-Ukraine NPP elnit NPP sky NPP 1 2 3 4 5 6 3 1 1 2 3 Replacement of the Control Rod Bank/Individual Control Rod — — + — — — — + + — — System Replacement of sensors of the CPS control rod position. + + + + + + + + + + + 2.2 Monitoring of subcriticality under the reactor shutdown conditions Replacement of the neutron flux monitoring instrumentation-03 by + + — — — + + — + — — the neutron flux monitoring instrumentation-07 Modernization of the reactor refueling machine control system + + + + + + + + + + +

3. INTEGRITY OF COMPONENTS 3.1 Embrittlement of the reactor pressure vessel (RPV) and its monitoring Insufficiently accurate evaluation of the fluence accumulated by + + + + + + + + + + + the reactor critical zones. Upgrading of the radiation monitoring system under the existing — — — + — — — — — — — test samples program in order to improve the representation of results of the test sample trials. Development and implementation of a regular working method for 2001 2001 2001 2001 2001 2001 2001 2000 2001 2002 2001 specifying the current residual radiation lifetime of the reactor pressure vessel's safe operation with taking into account the actual reactor's status, its operational conditions as well as indications of the system for monitoring of radiation burden to the reactor pressure vessel; dosimetric experimental results covering WWER-1000 reactors and mock-ups and the results of the test specimen trials. Identification of the current residual radiation lifetime of the 2001 2001 2001 2001 2001 2002 2001 2001 2000 2000 2001 pressure vessels' safe operation with taking into the account the actual data

I International Conference: «WER Technical Innovations for Next Century» Prague, The Czech Republic, 17-5-20 April, 2000.

No. Title of the Safety Problem Zaporizhzhya NPP Rivne Khm South-Ukraine NPP einit NPP sky NPP 1 2 3 4 5 6 3 1 1 2 3 Heating up to 55° C of the water supplied to the reactor from the 2001 2001 2001 2001 + + + + 2000 2000 2002 ECCS passive parL(hydro tanks) Ensuring the water supply with a temperature not less than 20 °C, 2001 2001 2001 2001 2001 2001 2001 2002 + + 2002 to the reactor from the ECCS active part 2000 To perform the transition of reactor core to the uranium- — — — — — — — — — — gadolinium fuel with low-leakage rate layouts to ensure the reactor installation lifetime extension Upgrading of the monitoring system-187 (only for «small series») + 2000 Supply of a new mast manipulator with increased positioning + 2000 2001 2001 2002 + + 2001 2001 precision (only for A-320) To manufacture a testing sample with artificial flaws made of the^ 2000 2000 material compatible with the RPV material (only for «small series») 3.2. Non- destructive examination Development and implementation of the systems for the acoustic- + + + + + + + + + + + emissive diagnostics of the SG headers' condition Development and implementation of the system for detection of 2002 2002 2002 2002 2002 2002 2002 2002 2002 2002 2002 objects freely and poorly fixed Development and introduction of the system for the residual 2001 2002 2003 2004 2000 2005 2008 2004 2003 2004 2007 fatigue lifetime diagnostics. Development, purchase and implementation of a set of the 2001 2001 2001 2001 2001 2002 2000 2000 2000 2000 2001 system for periodical metal inspections conducted inside the reactor pressure vessel Compiling of a list of areas with increased risk of leak happened + + + + + + + + + + + during inspection. 3.3. Integrity of the SG header Improvement of the SG blow-down system.. + + + + + + + + + + +

CO J International Conference: «WER Technical Innovations for Next Century» Prague, The Czech Republic, 17+20 April, 2000.

No. Title of the Safety Problem Zaporizhzhya NPP Rivne Khm South-Ukraine NPP elnit NPP sky NPP 1 2 3 4 5 6 3 1 1 2 3 Development of the system for inspecting the SG heat- + + + + + + + + + + + exchanging tubes' integrity Development of organization and technical measures on the + + + + + + + + + + + accident management, e.i: coolant leak from the primary to the (2000) (2000) (2000) (2000) (2000 (2000) secondary circuit with equivalent cross-section of 100 (mode ) automation) Implementation of the system for continuos automatic monitoring + + + + + + 2000 2000 + + 2000 of the primary coolant's parameters (d'\, O, (2) (2001) (2002) (2003) (2004) (2005 (2006) ) Implementation of activities aimed at improving the reliability of + + + + + + + + + + + SG and its auxiliary systems (modernization of SG water supply) Performance of the SG chemical flushing + + + + + + + + + + + 3.4. Integrity of the steam and feed water lines { Performance of the rigid fixing of steam lines and feedwater lines 2002 2002 2002 2002 2002 2002 2002 2002 + + 2002 at the reactor hall outlet. Performance of a specific analysis to identify the impact level 2002 2002 2002 during pipeline breaks in «pipeline tunnels» and the probability of — — — • — — — the secondary impacts' consequences (only for A-320) Replacement of pipelines affected by intensive erosion, by the + + + + + + + + + + + stainless steel pipelines System to measure main steam humidity upstream the main + + + + + + + + + + + steam gate valve Reconstruction in the feed water system (in order to reduce the + + + + + + + + + + + probability of brittle fractures of SG nozzles). Implementation of activities aimed at improving the reliability of + + + + + + + + + + + main steam lines during transients Monitoring of temperature fluctuations of the main steam lines + + + + + + + + + + +

CO O0 International Conference: «WER Technical Innovations for Next Century» Prague, The Czech Republic, 17+20 April, 2000.

No. Title of the Safety Problem Zaporizhzhya NPP Rivne Khm South-Ukraine NPP elnit NPP sky NPP 1 2 3 4 5 6 3 1 1 2 3 To use metal inspection results to forecast early the probability of 2001 2002 2002 2003 2004 2004 2002 2002 2001 2001 2002 cracking (a.i. apply a «leak-before-break» concept)

4. SYSTEMS 4.1. Clogging of the ENNS sump filters Measure aimed at ensuring the residual heat removal during an accident with a primary circuit break: - implementation of compensatory measures - erection of — — — — — + + + — — — bridges «TQH-TG» - replacement of existing thermal insulation by disposable 2007 2006 2005 2004 2003 2002 2001 2002 2001 2002 2003 and in-destructible one. - realization of measures aimed at improving organization + + + + + + + + + + + of medium collection during LOCA type accident with penetration into the containment sump. 4.2. Implementation of compensatory measures at ECCS. Replacement of service water pipelines of the safety system + + + + + + + + + + + pump piping by the stainless steel pipelines. Implementation of system for hydro tests of the emergency and + + + + + + + + + + + normal cooling heat exchangers. Improvement of the system for process leakage collection in order + + + + + + + + + + + to reduce operating costs for their treatment and recovery. Upgrading of the reactor air valve elbow. + + + + + + + + + + + Mcaernization of the ECCS servicing sites + + + + + + + + + + + Physical and functional separation of ECCS + + + + + + + + + + + Modernization of the emergency pumps' sealing systems. + + + + + + + + + + + Replacement of impulse lines in the reactor hall by new ones + + + + + + + + + + + made of stainless steel

CO CD International Conference: «WER Technical Innovations for Next Century» Prague, The Czech Republic, 17^-20 April, 2000.

No. Title of the Safety Problem Zaporizhzhya NPP Rivne Khm South-Ukraine NPP elnit NPP sky NPP 1 2 3 4 5 6 3 1 1 2 3 4.3. Certification of the SG safety relief valves for water flow Development of organization and technical measures on the + + + + 2002 (2000) (2000) (2000) (2000) + + + + + + accident management: coolant leakage from the primary to the (2000 (2000) secondary circuit with equivalent cross-section of 100 (mode ) automation) Replacement of the SG safety valves by pilot operated relief 2001 2001 2001 2001 2001 2001 1999 2002 2001 2002 2002 valves that meet the codes and standards' requirements

Implementation of activities aimed at improving the reliability of + + + + + + + + + + + discharge devices of the secondary circuit protection. 4.4 Operational safety Replacement of control valves of the SG power center by the + + + + + + + + + 2000 + upgraded ones with improved design Replacement of booster pumps of the turbine driven feed water + + + + + + + + + + + pump by the upgraded ones Replacement of lens compensators by rubber-cord ones on the + + + + + + + + + + + turbine circulating water lines Replacement of tube bundles of low pressure re-heaters 3 and 4 + + + + + + + + + + + by the new ones made of stainless steel Modernization and rehabilitation works at the secondary circuit. + + + + + + + + + + +

5. I&C 5.1. System for the reactor pressure vessel head leak monitoring Development and introduction of the systems for the primary 2001 2002 + + + + + + + + + coolant leak monitoring To develop and implement a comprehensive diagnostics system, including :

o I International Conference: «WER Technical Innovations for Next Century» Prague, The Czech Republic, 17+20 April, 2000.

No. Title of the Safety Problem Zaporizhzhya NPP Rivne Khm South-Ukraine NPP elnit NPP sky NPP 1 2 3 4 5 6 3 1 1 2 3 - diagnostics and monitoring for the NPPs with WWER-1000 2004 2005 2006 2007 2008 2009 2008 2009 2007 reactor installations. - reactor vibration diagnostics 2001 2002 2003 2004 2005 2006 2002 2000 2003 2004 2004 - RCP vibration inspection and diagnostics 2002 2003 2004 2005 2001 2006 + + 2003 2004 2005 - mode diagnostics 2004 2005 2006 2007 2008 2009 2008 2009 2005 2006 2007 - in-core noise diagnostics system 2002 2000 2001 2004 2003 2005 2008 2004 2005 2006 2007 - check valves diagnostics 2002 2003 2004 2005 2001 2006 2007 2002 2004 2005 2006 - diagnostics for valves with air operated actuator 2002 2003 2004 2005 2001 2006 2007 2002 2003 2004 2005 - system of the industrial television for closed premises + + + + + + + + + + + Replacement of the level measurement transducers in the steam + + + + + + + + + + + and gas box by the «SAPFIR-22» transducers Implementation of the two-set systems AZ (emergency + + + + + + + + 2000 2001 + protection) and AZTP (emergency protection for process disturbance) (for small series). Implementation of measures to improve reliability of control components of the safety important systems that allows to decrease the possibility of failures and reduces the number of false failures and the possibility of power unit shutdowns, including: - improvement of reliability of the actuation of the fast-acting + + + + + + + + + + + steam dump valve with discharge into the atmosphere as well as the SG pilot safety device actuation.; - application of the upgraded sensors; + + + + + + + + + + + - application of modernized unified complex of engineering + + + + + + + + — — + means; - improvement of pressure control reliability in the primary circuit; + + + + + + + + + + + International Conference: «WER Technical Innovations for Next Century» Prague, The Czech Republic, 17+20 April, 2000.

No. Title of the Safety Problem Zaporizhzhya NPP Rivne Khm South-Ukraine NPP elnit NPP sky NPP 1 2 3 4 5 6 3 1 1 2 3 -improvement of reliability and operability of the turbine protection + + + + + + + + + + + systems; - automated control on the basis of ASUT (automated turbine + + + + + + + + + + + control system) -1000R. Implementation of measures to improve the reliability of the turbine protection systems: - introduction of systems for centralized testing of the ECCS and + + + + + + + + + + + turbinej>rotection systems.; - introduction of systems to protect the thermal output circuit from + + + + + + + + + + + ingress of the ECCS radioactivity; -improvement of reliability of protection against the axial + + + + + + + + + + + displacement of the rotors of the turbine driven feed water pump; Installation of electrical equipment of the individual radiation + + + + + + + + + + + monitoring system Rehabilitation of the information computer system (for the small + + series) Introduction of SPDS 2000 2000 2000 2001 + 2001 2000 + + 2000 2000

6. ELECTRIC POWER SUPPLY 6.1. Time of the battery discharge Increase in the battery discharge time (battery replacement) 1999 2000 2000 2000 2000 2000 + 2002 + + 2000 Implementation of measures to improve reliability of the stand-by + + + + + + + + + + + diesel power station start-up. Replacement of UPS control units + + + + + + + + + + + Rehabilitation of emergency generator complex breaker control + + + + + + + + + + + circuits (KAG-24) and of the relay protection at power units.

ro i International Conference: «WER Technical Innovations for Next Century» Prague, The Czech Republic, 17+20 April, 2000.

No. Title of the Safety Problem Zaporizhzhya NPP Rivne Khm South-Ukraine NPP elnit NPP sky NPP 1 2 3 4 5 6 3 1 1 2 3 Implementation of the measures to improve reliability of the + + + + + + + + + + + electric motor relay protection and to reduce the overvoltage level during short circuit.. Upgrading of the transformer protection systems + + + + + + + + + + + Replacement of the input switching devices at the assemblies of + + + + + + + + + + + the three-phase in-door switchgear with one-side access. Improvement of reliability of the power supply of the + + + + + + + + + + + ventilation system

7 CONTAINMENT Replacement of penetrations by the upgraded ones produced by + + + + + + + + + + + the «ELOKS» Company. Implementation of compensatory measures to prevent hydrogen + + + + + + + + + + + accumulation inside the containment

8. INTERNAL HAZARDS. 8.1. Fire prevention Replacement of existing fireproof doors installed in the protecting 2000 2000 + + 2001 2000 — + + + — structures of the SS (safety systems) trains premises Use of fire-retardant cable coating 2000 2001 2002 2002 2003 2003 + 2002 + + 2003 Replacement of the combustible oil by the noncombustible 2002 2002 2002 2002 2002 2002 2002 2002 2002 2002 2002 lubricating liquids in the MCP lubrication system 2000 Improvement of the fire-resistance of turbine hall metal + + + + + + — + + — structures by coating them with fire-proof material Development and introduction of the circuit for automatic — hydrogen discharge from the generator vessel outside the turbine hall in case of the «fire» signal.

CO I International Conference: «WER Technical Innovations for Next Century» Prague, The Czech Republic, 17-20 April, 2000.

No. Title of the Safety Problem Zaporizhzhya NPP Rivne Khm South-Ukraine NPP elnit NPP sky NPP 1 2 3 4 5 6 3 1 1 2 3 Implementation of fire prevention measures. - rehabilitation of fire prevention of AMNF system; + + + + + + + + + + + - rehabilitation of fire prevention of ICS; + + + + + + + + + + + 9. ACCIDENT ANALYSIS Development of the guidelines concerning the beyond the design + + + + + + + + + + + basis accident management for the NPP units. PSA development 2000 2000 2000 2000 2000 2000 2000 2000 + 1999 2000 Development of the design basis accident analysis 2000 2000 2000 2000 2000 2000 2000 2000 1999 2000 2000 Development of the beyond the design accident analysis. 2000 2000 2000 2000 2000 2000 2000 2000 1999 2000 2000 Development of consolidated SAR 2000 2000 2000 2000 2000 2000 2000 2000 2000 2000 2000 CZ0129417 I. Kouklik Development of Dukovany Nuclear Power Plant

Abstract: The presentation evaluates the present situation of the Dukovany nuclear power plant operation. It analyses the present at the plant, and also in both the near and distant localities. Based on these analyses the conclusions and targets that are necessary for keeping the plant's safe operation are made. From the current situation the report about the results of the year 1999 in the operation and financial field, stress on the safety index, is presented. Further, there is a list of finished and semi-finished activities that the taking place within the harmonization of the Dukovany NPP. At the same time the report presents the terms of licensing and the going of implementation of the ,,KAPA,, project - the complex application of the Atomic Energy Act. In the part, comparison to the environment, there is an example of a comparison with the results of a plant in the EU. Further the report compares the advantages and disadvantages of the WWER reactors with other light water reactors. In the last part of the presentation there is a brief opinion of the author on the steps that are awaiting us in the future. First, the ,,Harmonization Program,, of Dukovany NPP is explained, its philosophy and principles. The basic idea is to take the right steps and strategic decisions, with the vision for the operation till the year 2025 at least. There is also a list of the most important events that are planned to increase the safety. Further the report goes briefly over the current situation in the field of nuclear energy in the period of joining the European Union and also mentions the risks that result from this process. Is concludes with the prognosis for the future position of the Dukovany nuclear power plant.

The fulfilment of at least three conditions is necessary for the further operation of the Dukovany nuclear power plant:

Acceptance Best safety Competitiveness

1. The acceptance is supported by

• good public relations • considerate relation to the environment • programme of safety enhancement • international co-operation • insurance of the power plant • preparedness for abnormal occurrences • continuous attention to health and industrial safety • power plant security • comparability with the power plants throughout the world • independent inspection by the state supervisory bodies • results of international missions to the power plant

You will be able to form your own judgement about the results of our NPP in this area from the following examples. The first indicator illustrates the number of industrial accidents in comparison with the European Union countries. Note: The definition of the indicator is taken over from the WANO methodologies, same as several other indicators which make comparison with other countries possible.

- 145- Bar Chart No. 1

Industrial Safety Accident Rate 1998;

The quality of the management of this safety area has been also appreciated by the Czech Office for Industrial Safety, which has awarded the title of ,,Safe Enterprise" to NPP Dukovany.

The relations with the public in the power plant vicinity are on a high level, which is shown by the following chart.

Bar Chart No. 2

Public Acceptance of Dukovany NPP Presence

§9 quite positive 0 positive O no opinion D negative M quite negative

EDU region 1998 .N-499

Sorry to say, people in the Czech Republic and abroad have not such a good opinion of the nuclear power engineering. We all have to strive for a change in the public opinion of the nuclear industry, it is one of the fundamental tasks for survival in the future.

- 146- 2. Safety

First, several results concerning the operational safety.

The operational safety is supported by: qualified personnel documentation of good quality safe operating utilization of international experience and operational experience consistent inspections and tests of the equipment radiation protection on a high level fire safety

Influence of NPP Dukovany on the Environment

Influence on Personnel and Public

The basic indicator to determine the radiation exposure of the personnel by is the collective effective dose". This figure shows what dose was received by all those who have entered the restricted area of the power plant. Not only the permanent employees, suppliers' workers and inspectors but also the visitors are included in it. You can see the value of this indicator and its development during the last five years in the bar chart No. 3.

Bar Chart No. 3

Collective Effective Etose per- Unit

1995 1996 1997 1998 1999 • NPP Dukovany D World average

Last year we attained the average value of 0.28 man-Sv per unit. When we compare this value with the results of the world's power plants it is clearly visible that in minimization of the workers' radiation exposure we belong among the absolute world elite. We succeeded in attaining this result thanks to the precise organization of work in the restricted area, implementation of ALARA (,,As Low as Reasonably Achievable") principle, time schedule of the outages, and properties of materials which the relevant components of the primary circuit are made of.

And now for comparison with the EU countries:

-147- Bar Chart No. 4 Collective Radiatioji Exposure

Gaseous Effluents

The radioactive noble gases, iodine and aerosols are decisive for radiation monitoring of the gaseous effluents from the power plant.

Bar Chart No. 5 Drawing of Limits; of Effluents, from NFP Dukovany Aerosols,

Lirail: 1.8x10 "Bq

250 T 100i

80- mm , Hi 3 60- 1995 1996 1997 1998 1999 • VK 1 • VK 2 40-

20 0,075 0,047 0,136 0,044 0,046

1995 1996 1997 1998 1999

With all kinds of gaseous effluents, the values vary under 0.1% of the permitted limit. Aerosol effluents are chosen as an example. A team has been established at the power plant, which deals with all, however small it may be, increases of effluents consistently. The results of its work are reflected in the values reached.

Liquid Effluents

- 148- The most important components which can affect the environment from the radiological point of view are the corrosion and fission products and tritium.

Bar Chart No. 6 Activity of M

1995 1996 1997 1998 1999

Our results, which put together a number of these components, are in the bar chart No. 6. The effluents of corrosion and fission products reached the best values in the last five years which testifies to good technological discipline and fuel tightness, in tenths of the percentage of the permitted state limits again.

Operational Safety

A comparison of the number of automatic scrams of the reactor is shown in the following figure. This parameter testifies to the reliability of the equipment, organization of work, quality of the personnel and correctness of the documentation used.

Bar Chart No. 7

-149- Unplanned Autojnatie Serajms, per 70,0,0) Hours, Critical

There was no reactor scram at NPP Dukovany in the year 1999.

The operational safety of NPP Dukovany has been also appreciated by a number of international missions. They were especially the following ones:

Independent Evaluations - International Missions

OS ART 1989, follow up 1991 ASSET 1993, 1995 • IAEA ,,Safety Issues" 1995 • WANO Peer Review 1997 Safeguards 1998-IAEA PSA-IPERS 1998-IAEA

And we have invited IAEA's OSART Mission for the year 2001, ten years after the last inspection of this type at NPP Dukovany.

Design Safety

VVER type reactors have a number of design advantages which make reliable sources of electricity generation from them. They are a kind of ,,draught horse" among the reactors. For instance, horizontal steam generators, three independent safety systems for core cooling, soft core, VVER containment, whose functioning was tested in 1 : 1 scale as one of few in the world, and many other belong among these advantages.

3. Competitiveness

Effectiveness is based on:

• optimum utilization of output • consistent management of cost • effective management of the duration of unit outages • management of the equipment service life -150- • effective investment programme • optimum fuel cycle

The following indicators testify to the volume and reliability of the production:

Bar Chart No. 8

1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999

In the year 1999 a record electricity production was attained. Also in this area we can well compare with the European Union countries.

The following chart shows how many per cent of time the power plant generated 100% of power. The higher the value, the higher quality of the work organization and more reliable equipment. In this comparison, we are above the average of the European power plants in the year 1998.

Bar Chart No. 9 Unit Capability 19,98;

-151 - The next indicator tells us how many per cent of time the power plant did not generate electricity because of technical faults. Here we belong among the best operators already, we are operating with markedly higher reliability than the standard in EU is.

Bar Chart No. 10

Unplanned! CapabjLliiiy Loss, Factor 19,98;

Future of NPP Dukovany

The current situation has been described above. But we cannot stop. ,,Continuous improvement" is our strategy. This and this only is a way to a long-term operation of our nuclear power plant.

How can we reach it? We have decided to develop and implement HARMONIZATION programme.

Harmonization Programme -= Enhancement of Pro,ductLyit^ ojf CEZ-NPF Bu

VISION: To supply electrical energy to our customers effectively up to the year 2025 at least!

Strategical progress target until the year 2003 is: ,,£EZ - NPP Dukovany belongs among the world best operated power plants from the viewpoint of safety, reliability, effectiveness, competitiveness, and acceptance."

-152- Our target is to operate NPP Dukovany up to the year 2025 at least. That is why we have established seven key areas - personnel, documentation, licence, equipment, external relations, effectiveness, and management.

We have established 195 projects, interconnected and balanced mutually, in the above- mentioned areas to attain our target. When developing the projects, we came to the conclusion that it is not possible to concentrate on one area only, on equipment for instance, but that we have to improve all the components harmoniously. The projects have their concrete targets, measurable criteria of success, deadlines, and responsible persons.

Our first gradual aim is to belong among the best operated nuclear power plant until the year 2003.

To be the best means fulfilment of these two conditions:

• to be one of the best actually - to reach measurable results which place us among the best really • to be considered as one of the best - in other words: to get this information to all places where it is desirable

Such is our way into the 21st century and we want to be successful in it. I do believe that our programme, in co-operation with all participants, will make it possible for us.

~ I OvJ "" CZ0129418

WER Technical Innovations NPP PAKS for the Next Century Prague, 2000.04.17-19

JozsefBajsz

STRATEGY OF INNOVATIONS AT PAKS NPP

-155- The paper gives an overview of the present situation atPaks NPP. Discusses the main safety upgrading works and plans, execution that will help to meet challenges in the next century.

1. The operation of Paks NPP has reached its half time. Until this time it fulfilled expectations raised before its construction: the four units have produced safely and reliably more than 200 TWh electricity. The production of the plant has been at the stable level since its construction and has provided 43-38 % of electricity consumed in Hungary (Fig. 1). The annual production is around 14 TWh (Fig. 2), which means a load factor higher than 85 % (Fig.3). The plant is the generator of the cheapest electricity in Hungary. Its cost advantage is 30 % compared to the second cheapest source (lignite fired power plant). The increase of the unit generating cost has felt behind the changes of the consumer price index (Fig. 4). The good economical results are accompanied with sound safety records.

To maintain the gained position the plant has to find its proper responses to new challenges. These challenges are: increasing safety requirements; economical pressure of market liberalization.

2. Safety improvement

Safety upgrading activities at Paks had started in the late eighties, when the commissioning work of units 3 and 4 were carried out. That time the main emphases were put to lessons learned of the TMI and Chernobyl accidents. The international reviews hosted by our plant widened our review's scope. To systematize our approach a complete safety review, the AGNES (Advanced General Safety and New Evaluation of Safety) project was started in 1991. The goal of the project was to evaluate to what extent Paks NPP satisfied the current international safety expectations and to help in determining the priorities for safety enhancement and upgrading measures. The project completed in 1994 ranked our safety upgrading measures by safety significance, which became a basis for technical design work and financial scheduling.

-156- The other important outcome of the AGNES project was the introduction the Periodical Safety Review regime by our nuclear authority. These periodical reviews held after 10 years of operation offer the possibility - and obligation for the licensee - to perform a comprehensive assessment of the safety of the plant, to evaluate the integral effects of changes of circumstances happened during the review period. The goal of these reviews is to deal with cumulative effects of NPP ageing, modifications, operating experience and technical developments aimed at ensuring a high level of safety throughout plant service life.

The execution of our safety-upgrading program is well advancing. The list and scheduling of the most important measures can be find in the Table 1. For the whole program from 1996 to 2002 250 million US dollars will be invested. Up to the end of 1999 60 % of the allocated resources was already spent. Thanks to these measures the core damage probability has decreased by a factor of 10 (Fig. 5).

As it can see from the Table 1, our main tasks in the near future are: To replace the pressurizer safety valves; To install modifications to handle primary to secondary leak events at steam generators; To improve the seismic resistance of the plant structures, components and systems; To reconstruct the reactor protection system at all units; To introduce of symptom oriented emergency procedures.

The last two measures beside the safety improvements represent a tendency directed to the future. The new reactor protection system utilize the software based technology assuring high integrity and reliability, requiring less operators actions on the changes of operation modes. The new system is flexible, it can easily adjusted to new requirements (introduction of new protection signals for example). Due to its technology the system require significantly less inservice inspection and maintenance activities.

The introduction of symptom oriented emergency procedures together with the installation of the Plant Safety Monitoring and Assessment System (PLASMA) will offer operators of the control room better working conditions in case accident situations. The PLASMA system will be implemented on networked workstations and will provide operators with the following information:

-157- the current safety status of the plant; on-line monitoring of the critical safety function status trees; displaying the EOPs in a computerized form and those signals which are referenced in them.

We have recently started the preparation of the 2 level PSA study, to determine our tasks concerning the preparation for severe accident events. Although many studies have already been completed concerning the preparation for severe accident management, the consistent strategy is to be elaborated. After finishing the PSA-II study major technical and administrative measures can be determined in the near future.

We are confident that with safety upgrading measures performed and planned the nuclear safety at our plant will not be an issue during the accession process of Hungary to the EU. On this topic I would like to quote the report of the Western European Nuclear Regulators' Association on nuclear safety in EU applicant countries: ,,It is expected that after the implementation of planned safety improvements, which are in the design and preparation phase the plant will be able to reach a level of safety which compares well with plants of the same vintage in Western European countries."

3. Cost reduction

Paks NPP can not avoid consequences of electricity market liberalization. Market forces require the cost-effective operation and maintenance. If the plant would like to keep its present cost advantage in Hungary and would like to stay competitive on the European market, the aggressive cost reduction is unavoidable.

Activities to improve the organization of maintenance and services, to decrease lengths of outages, to improve fuel efficiency have already started. There is a tendency of reducing the duration of outages in the last years (Fig. 6), however we have not exhausted our possibilities. We expect further reductions in the duration and in the workload as well from the introduction of reliability based maintenance and increasing the online maintenance.

-158- The utilization of the high burned-up fuel (four years fuel cycle) will start this year, which help us to decrease not just the front end but the back end fuel cost as well.

At the nuclear plant constant costs make significant part of the unit generation cost (around 40 %). To influence - in other words: to decrease - this part of cost it can be done only with the increase of production. The first thing is to improve the availability. However as it was mentioned earlier with load factor above 85 % we have limited possibility. The second option is to uprate the power level of units. The ongoing turbine retrofit works result in 12-14 MW increase per unit. After completion of these measures the rated power of our units will be 472 MWe (at 100 % reactor power and at nominal cooling water parameters). An assessment to increase the reactor power has started. Our first task is to determine that to what extent of the power increase is feasible at what cost.

Trespassing the half of the design life the proper lifetime management activities become more and more important. It is necessary that safety upgrading measures, refurbishments of worn out components to be carried out with the understanding of the requirements of the lifetime assurance and possibly the lifetime extension. The lifetime extension has its technical, safety, economical and political aspects. It is hard to predict the future circumstances for the correct economical assessment, but to forecast the political conditions simply impossible. That is why so important to maintain the technical and safety aspects of the extension. The clear knowledge of components and systems conditions, the proper predictions for their changes will give us the necessary tools to influence the decision makers when they have to face the question of the life time extension.

Elaboration and maintaining the possibility to operate the plant beyond its design limits (30 years) one is of high priority tasks at Paks. Extension of operation can result in cost reduction as well with decreasing the sum of yearly depreciation.

4. Strategic goals of NPP Paks

As an operation organization our responsibility is to manage the plant's assets in the most efficient way.

-159- That is why strategic goals of Paks NPP Company are: To maintain and improve the present safety level of the plant; To keep the unit generation cost competitive in the open electricity market; To elaborate the basis for the (minimum) 10 years of lifetime extension.

-160- Table 1. Safety upgrading measures of Paks NPP

Measures 1996 1997|1998 1999 (2000 2001 2002 1. Protection of containment sump Unitl. against clogging Unit 2. Unit 3. Unit 4. H 2. Hydrogen management in the contain- 1. 2 ment 2. 3. • 4. 3. Preventing the refilling of ECCS tanks i—r 4. 4. Installation of protection against loss of off-site power (disconnection relay) 5. Improvement of spent fuel pond 1. HH™ I cooling circuit's reliability 2. mm 1 3. 4. 8 6. Relocation of Emergency 1- 1 IHH Feedwater System H4. ™1 - 7. Emergency gas removal from the l- 1 HB1 primary circuit 2. WKt 3. 4. - •I 8. Reactor protection system refurbish- 1. ment 2. 3. F msm 4. 1 - 9. Replacement of pressurizer's safety 1. HI valves 2. 3. F 4. 1 F Bill 10. Elimination of the forced loss of off- 1. •HI 1 site power signal 2. 3. F- 4. 11. Management of SG primary to secon- 1. UK dary leak accidents (PRISE) 2. ••_ 3. 4. ^^"

-161 - Table 1. ( cont.) Measures 1996 1997 1998 1999 2000 2001 2002 12. Earthquake resistance improvement Site seismic hazard revaluation Design of structures reinforcements i mm Upgrading the seismic resistance of coolant loop's equipment 2. 3. 4. -19 I Upgrading the seismic resistance of 1. - rn of primary circuit's equipment 2. 1 3. 4. Upgrading the seismic resistance of structures and BOP's equipment mmm 13. Introduction to symptom oriented 1 I I emergency procedures •• 14. Containment function verification 15. High Energy Line Break analysis HHLJ 16. Provision of filtered air to the Control 1. Rooms 2. 3. LJ 4. 17. Introduction of high pH water 1. 1 chemistry into the secondary circuit 2. -• 3. 4. P 1 i i

-162- CZ0129419

TECHNICAL INNOVATIONS IN THE FIELD OF NUCLEAR SAFETY FOR NEXT CENTURY

Jindrich MACHEK, Vladimfr FISER NUCLEAR RESEARCH INSTITUTE ftE2, CZECH REPUBLIC

ABSTRACT

This contribution presents the author's vision of the future progress in the field of nuclear safety, especially that of Czech nuclear power plants and their Technical Support Centres.

INTRODUCTION During next century continued emphasis on improvements in the field of nuclear safety can be expected. Specifically, it can be assumed that both existing power plants and power plants under construction will have to prove their readiness to cope not only with design basis accidents (as it is now), but also to prove their ability to cope with so called beyond design and severe accidents. To fulfill these requirements it is necessary to prepare so called Severe Accident Management Guidelines (SAMG) as well as tools to identify key phenomena related to these types of accidents to support the decision-makers to avoid these types of accidents or (if no other solution exists) to minimise the accident consequences. Reliable and realistic recommendations for decision makers are provided by so called supporting groups, mainly Technical Support Centre, established for this purpose and composed of top experts. Nevertheless, even experts are only human beings and therefore it is of the first importance that they have as much of reliable information, methods and tools as possible to help them to evaluate what happened and to predict what can happen in future. Friendly user's interface of supporting tools is essential for correct interpretation of available data and for avoiding errors.

CURRENT STATUS OF TSC SOFTWARE TOOLS

During the nineties NRI 0ez developed in close co-operation with the NPP and IC- Energo a set of software tools for TSC of NPP Dukovany. This set of tools, called SW1-6, was described in detail e.g. in [1]. It performs following functions:

SW1 - IDENTIFICATION AND LOCALISATION OF PRIMARY COOLANT LEAKAGE MODULE Module is designed to establish whether during the accident course there was a loss of the primary coolant (identification) and to establish the basic parameters of such a leakage, i.e. when and where (localisation), as well as to establish whether the break can be isolated, where the coolant leaks in (into hermetic compartments or outside them, into component cooling system etc.). Results of the SW1 application (location and time of the break occurrence) is stored in HI part of the Protocol database. To make these results available for the following SW tools, the break location is internally coded, application itself distinguishes between the following break location:

-163- • break on the hot leg of one of reactor loops • break on the cold leg of one of reactor loops • break on pressuriser (PZR) • 1 or 2 safety valve blocked in open position • break on the reactor - in hot part (reactor head, main parting plane, break of accumulator (AT) connecting pipeline which leads to the upper mixing chamber) • break on the reactor - in cold part (cold loops nozzles, reactor shaft, break of AT connecting pipeline which leads to the reactor shaft) • break on TC10,50 system (continuous primary coolant purification system) • break into the main circulation pump (MCP) component cooling system • break into the reactor protection system (RPS) component cooling system • break into the secondary circuit through steam generator (SG) - Steam Generator Tube Rupture (SGTR)

The identification and localisation message will be accompanied by a verbal description of the reasons which led the SWl operator to the conclusions presented in the report. The position of the break is usually estimated as a result of change in the technological or radiation parameters. Therefore, the courses of parameters used to localise the break will be stored together with the report. It can be assumed that break localisation will be unambiguous in case when coolant leaks into the secondary circuit or into the component cooling systems (MCP or RPS). However, in other cases an unambiguous localisation will be not always possible. In such cases the SWl conclusions will be formulated as alternative hypotheses. For example - it is very difficult to distinguish between break on the hot and cold leg of a loop. If the monitored data do not show which of these cases took place, operator will create alternative hypotheses on the break position. Then, the following SW tool will take into account both alternatives of the preceding calculation. So, the results could have the tree structure.

SW2 - LEAKAGE RATE AND BREAK SIZE ASSESSMENT MODULE

In the case when SWl establishes the primary coolant leakage, such leakage will be quantified with SW2, i.e. the amount of leaking coolant will be calculated as a variable depending on time, and if the break position is known the break size can be calculated. The calculation is based on the mass balance in the primary circuit and it is contingent on two limiting assumptions: • Coolant in the whole of the primary circuit (except pressuriser) is in the liquid state (it is not boiling) • Coolant level in the pressuriser is within the gauges measuring range (so that the coolant inventory in the primary circuit can be determined).

-164- •G.SW2 - Vypocet mnozslvi unikaiicihochladiva - [Vjhodnoceni vypoctenych velicin]

Aktualnf zpr&va H2 03

]| Tabuka | TihCna] '• } E(tA) "283,1 S(tih) -5S39 E(mn)-31« "^ ,

f«

[nun]

[Hw&is: VCTH^Mr^^!^

Figure 1: SW2 leakage rate (upper) and break size equivalent diameter (lower) calculation

Results of the calculations are written in the separate part of the Protocol database (part H2). Numerical results are accompanied with a verbal explanation of the calculation's assumptions. It will be also clearly stated which results of the SW1 calculations were used (which SW1 alternative develops the SW2 report). Result of the break size calculation is not necessarily unambiguous and has always a non-negligible error arising from- the uncertainties in the flow rate measurements. Therefore the SW1 alternatives will be evaluated again as alternatives (for instance - the best and conservative estimate of the break size).

SW3 - TIME DELAY TO CORE UNCOVERING PREDICTION MODULE

In the case when a break on the primary circuit has been identified and SW2 succeeded in calculation of its equivalent diameter, the question, whether the core uncovering may occur and how much time there is till this happens, becomes relevant. This event has very serious consequences for both the plant technology and its environment. Core uncovering is feasible as a result of small LOCA accompanied by the station blackout or LOCA with the ECCS failure during transition to recirculation (for instance - as a result of recirculation sump clogging).

For this and the similar cases the TSC will use a very fast (however also very simplified) LOCA simulator dedicated to the time to core uncovering estimations. This simulator works with two control volumes only (primary and secondary circuits) and calculates mass and energy balances. It calculates the time dependence of a number of the primary and secondary circuit technological parameters, including mass of coolant in the primary circuit. The programme solves the mass and energy balance equations. Initial values of the parameters are obtained from the database (temperatures, pressures and water levels

-165- measured before the accident). Boundary conditions are assumptions of the programme operator (assumptions on the emergency systems operation) and define an alternative. In case when there is a mass decrease below the established limit the SW3 reports that the core uncovering took place. Time from the reactor trip by its protection systems (we assume that in the case of LOCA the systems are operational) to the calculated time of the coolant mass decrease below the pre-established limit represents the delay before the core uncovering for the chosen alternative.

»JSW3 - odhad.doby do obnazeni AZ - (Vvhodnoceni vvpoclenych velicinl £olokol Iechnologa Aktuafnf zpravo. H3 02

Legend* | H | H

16 u 3816 1£HK£!&PW &£ "2" -

Figure 2: SW3 time to core uncovering prediction - ECCS does not compensate leakage, core uncovering will occur at about 3 hours after high injection failure (upper = coolant mass, lower = pressure of Is' and 2nd circuit)

Results of the SW3 calculation are stored as the commented alternative predictions in the separate part of Protocol - H3, where they are available for the personnel in charge of the accident management as well as for the needs of the following calculations SW4&5.

SW4&5 - PREDICTION OF TIME DELAY TO CORE MELTING, FUEL DAMAGE RANGE ESTIMATION AND FISSION PRODUCT RELEASE ASSESSMENT MODULE Our initial intention was to develop two relatively independent tools: SW4 - to determine the range of fuel damage and to estimate the time margin to the fuel melting and SW5 - to assess the radioactivity release. However, it became obvious that these two issues are closely interconnected and therefore the same method should be used for the solution, namely the correlation one. This led us to the decision to combine the both predictive tools into one SW tool, tentatively labelled SW4&5. The tool SW4&5 is closely linked-up with the SW3 calculation results. Its task is to determine, for each SW3 alternative which leads to core uncovering, the range of the possible fuel damage and related amount of the radioactivity released. Solution includes the

-166- isotopic compositions and its time development taking into account the primary circuit's retention capability for different break positions.

SW6 - MANAGER

This tool is proposed manage the emergency evaluation process and to inform responsible managers of NPP about the current status on NPP and about expected further development of the accident. Moreover the tools performs also the database maintenance and on basis of the results of SW1-5 determines which of the sequences in the RTARC database suits best to the actual emergency.

The SW4&5 output, together with other output information of SW1 - 6, will serve as a part of the input data deck for the programmes which compute the radioactivity spread within and outside of the NPP site and which also estimate the radiological consequences of each particular radioactivity release. An older version of the RTARC1 programme is available at the NPP Dukovany, purchase of the updated version and its on-line interconnection with some input data (e.g. meteorological) is under consideration.

All the tools described here co-operates according to following scheme:

Process parameters database SW6 User Interface and Database management (instance CR) 1 SW1 SW2 SW3 SW4&5 Leakage Leakage Delay to core Delay to fuel detection and quantification uncovering cladding localisation and break size failure,

HO HI H2 H3 H4&5

SW6 User Interface management and Database

Figure 3: SW1-6 data & results flowchart

' RTARC - Real Time Accident Release Consequences - software tool from VUJE TRNAVA, determining the radiological consequences of an accident.

-167- CURRENT STATUS DISADVANTAGES

This set of tools has, however, following disadvantages:

1. Tool SW1 expects highly qualified users. The analysis of measured data is performed mainly from the program point of view, the user has to remember many partial analyses results and to perform the synthesis ,,in his mind". To make the tool more user friendly, data analysis should be reorganised in such a way, that the user will follow the decision-making tree.

2. Tool SW2 seems to be OK, but working with real NPP data have come to the conclusion, that we must first validate its input data. The tool works with some 100 measured parameters and current experience with measured data is, that it is almost sure, that at least one parameter contains an error (wrong values), what complicates significantly its future utilisation. Furthermore, the tool does not fully use all information, which SW1 tool can offer. Thus we plan improve also the algorithm of this tool in order to improve its accuracy.

3. We also plan to improve the predictive tool SW3. Currently it provides reliable results only for simple LOCA sequences (e.g. LOCA + blackout). It does not take into account the break position, which effects the delay to core uncovery significantly. We would like rebuild the SW3 tool into a simple, but fast simulator of the blow-down and boil-off phases of LOCA accidents.

4. The present version of the tool SW4&5 informs the user only about the amount of radioactivity, released from the fuel to the primary circuit and from primary circuit to the the hermetic zone. In fact, in case of the accident we need not only this values, but we also need the amount of activity released into- the environment. Thus, the tool should also be rebuild into a tool, estimating the so called ,,source term".

PLANS FOR THE FUTURE

As the first step we plan to couple the first two above mentioned tools into one diagnostic tool, which would not only localise the potential break of LOCA accident, but which would categorise the emergencies (not only LOCA, but also breaks on the secondary circuit, on the feedwater systems etc.) and if LOCA accident is recognised, it would determine the break size (former function of independent SW2 tool). We expect to solve the problem of errors in input data using some of the validation techniques, described e.g. in [2]. When an error in the input parameter is detected, it can be usually replaced by an estimate, based on other parameters, as we illustrate in following figure:

-168- UR0097 Validated mean temp, of primary circuit

r •—• h 1 1

'—k_

8:04:24 8:11:36 8:18:48 8:26:00 8:33:12 8:40:24 8:47:36 8:54:48 9:02:00 Time [hh:nn:ss] "tgure 4 Comparison of raw and validated values ofVR0097 parameter gives an example of replacement of an error in input parameter of SW2 - i of primary circuit (parameter UR0097). Original values of this parameter n 8:04:30 and 8:40:58 (what is obviously an error in the measuring chain), the correct values of the mean temperature were calculated using a : of other temperature measurements (which originally also contained errors, ad been eliminated).

'.d improvement of emergency preparedness, in which we should like to is the definition and prognosis of the source term in case of a radiological Under the source term we understand the amount, composition and kinetics •lease from the NPP as a result of the accident. for the source term prognosis we expect to use results of the PSA studies Institute. These studies provides us with set of the event trees for various f we recognise the initial and subsequent events using the above mentioned e can define, which branch or branches of the event tree are actual and thus : source term category, which is associated with each branch of the event diagnosis of the source term, we will be using as many NPP radiological available. The volumetric activity measurements of the Dukovany NPP Z) are measured is available for both normal and emergency ranges and thus tat even during LOCA accident we will have these data available. The )ressure of HZ atmosphere are also measured. If we know the untightness m, the source term can be calculated. The problem of course, is our HZ untightness and its distribution. The integral untightness of individual Dvany is well defined (measured), but its distribution can be estimated only

-169- SGTR accident there is a risk of release via the steam generator relief . But in principle, taking into an account the known volumetric activity istribution coefficients of the isotopes, radioactivity released into the iculated as well.

;k J.: Diagnostic and Predictive Tools for Dukovany NPP Technical JonNo. 3 (1997), pp. 15-20

; J.: Validation of Signals from NPP Information Systems, Nucleon No.

-170- CZ0129420

ROLE OF WER-TYPE REACTORS IN LARGE-SCALE NUCLEAR POWER OF THE XXI CENTURY

V.A.Sidorenko, A.Yu.Gagarinski Russian Research Centre "Kurchatov Institute"

Light water reactors (LWR) make over 85% of the world nuclear park and are presently constructed in 12 countries. One of the generally recognized LWR development directions is represented by WER reactor concept, created and developed in the former Sovie Union. For over 35 years of WER existence (with gross capacities ranging from 70 to 100 MWe), 58 power units have been built, and 49 are still in operation (13 in Russia and Ukraine each, 6 - in Bulgaria and Slovakia each, 4 - in Hungary and Czech Republic each, 2 - in Finland and 1 - in Armenia). The oldest of operating WERs - 3rd unit of Novovoronezh NPP in Russia - was connected to grid in 1971; the last - Mochovce-2 in Slovakia - was launched in 1999. Geography of WER reactors is developing quite dynamically. For the first time this reactor type is being built in the countries of Asia: China and Iran, as well as in Cuba (see Table 1). Construction of the first WER in India is also expected.

Peculiarities ofVVER construction and development

The detailed design of a 200 MWe WER reactor was completed in 1956. In the same year the intergovernmental agreement was signed by the USSR and GDR, and in 1957 the work on erection of the Rheinsberg NPP with a capacity of 70 MW began. Various sits for the first NPP with VVER were considered, including a MOSENERGO cogeneration plant (TEC-21) in Khovrino, near Moscow, and finally the Novovoronezh site was chosen. There the first VVERs of all generations were constructed.

• Unit 1 of NVNPP (VVER-1) was connected to the grid in 1964 and finished operation in 1984. • Unit 2 of 365 MWe worked from 1969 to 1990. • Rheinsberg NPP was commissioned in 1966.

Construction of the first NVNPP units confirmed the technical feasibility of reliable commercial nuclear power sources. The experience of their creation and operation was of exceptional importance for further development of NPPs with WER in our country and other countries where our designs were used.

Here it is important to emphasize, that the careful and dynamic work on the reactor design stage, pre-startup full-scale investigation of the core physical parameters, timely corrections of the construction errors, including those introduced after manufacturing of issued elements and representative tests and checks in the course of pre-start adjustments have ensured the good reactor and NPP startup and achievement of design capacity in the shortest possible period. The plant was launched on September 30, 1964, and the design power (210 MWe) was achieved on December 30, 1964. In the following operation the reactor and the plant itself have shown the possibility of operation with 280 MWe capacity.

-171 - Further operation experience, which had revealed some defects in the equipment construction and design, and which had manifested itself in a series of accidents leading to performance of large amount of repairs and maintenance work, has provided an invaluable material for creation of the next WER units.

It should be pointed out that a number of the basic engineering solutions worked out for the first VVER were original and became traditional for all subsequent WER generations.

Among these are:

• a triangle array for the fuel assemblies in the core and the fuel elements in the assembly, which gives a hexagonal form to the fuel assembly; • the use of Zr-Nb alloy as a cladding material; • the use of high-strength alloyed carbon steel suitable for performance at high neutron fluxes as the material for the reactor vessel; • the reactor vessel is made of solid-forged shells without longitudinal welds; • the lower part of the reactor vessel accommodating the core is designed as a cylindrical vessel with the elliptic bottom without pipe penetrations or any other holes; • the reactor vessel rests on a cylindrical clamp on the lower shell of the branch pipe zone; • control and protection systems drive mechanisms, core systems for temperature control and power generation control are installed on the removable closure (head) of the reactor vessel; • in the first units and VVER-440 the movable fuel assemblies are used as control rods; • the original design of the horizontal steam generator with a tube plate consisting of two cylindrical headers; • the SG heat-exchange tubes are made of OX18H10T austenitic chromium-nickel stainless steel; • an important factor was assurance of rail transportability of the large-sized equipment.

The first-generation commercial 440 MWe WERs were constructed based on the experience with the erection of the first two units of NVNPP. The premier unit of this series (NVNPP-3) was commissioned in 1971. From 1971 to 1975 six such units were put into operation in the Soviet Union (at Novovoronezh, Kola and Armenian NPPs) and ten more units were put into service from 1974 to 1982 in Bulgaria, Czechoslovakia and GDR under the intergovernmental agreements. This series of VVERs had demonstrated the economic competitiveness of the nuclear power plants.

This phase of VVER development was connected with the first period of development of NPP safety concept in the Soviet Union - when it was supposed, that any serious damage of pipelines, equipment or other reactor components could be avoided in case of

-172- ensuring their high quality, and thus would exclude the possibility of severe accidents. In this connection, the first NPP designs both with WERs and channel-type boiling reactors have considered a limited coolant leakage as a maximum design accident, thus limiting the requirements to accident localizing systems. Such systems have included leaktight premises (designed with account to excess pressure) containing the coolant loop (partially or completely) and sprinkler devices intended for condensing the steam released in course of accident. No special requirements were put on the premises' leaktightness at high pressure, because no serious damage of fuel elements was expected. In this period NPPs were designed, built and operated mainly in accordance with general industry standards and rules. Development of special standards and regulations was at first connected only with such new specific aspects of nuclear energy use, as radiation protection, nuclear physics, radiation material research, etc.

However, the very first experience of NPP construction and operation has shown, that even the most accurate selection of metal and the highest requirements to the quality of equipment and pipelines' manufacturing were unable to completely exclude the possibility of their damage in course of operation. That's why in this period the new complex approach to NPP as an object of higher risk requiring development and application of special safety measures, began to form in this period.

In the same time, beginning from the first VVER, its designers have paid great attention to excluding the events, which could, with high probability, become a cause for a major accident or aggravate its course, making it finally a severe one.

VVER designs have used materials and constructions not inclined for rapid destruction; potentially hazardous phenomena (fracturing of reactor vessel and fractures in steam generator headers, etc.) have been supervised in course of operation, what, as experience has shown, has made it possible to take timely measures to avoid incidents' development into major accidents.

Parameters of VVER equipment (reduced power density of core, large water margin in second circuit steam generators, capacity of pressurizers, etc.) were selected in a way to ensure the slow development of accident, which would let the operators to take active measures for its liquidation. Characteristic decisions adopted for VVERs - determining their safety enhancement - were recognized by international experts in after-Chernobyl period. Operation experience has given examples of useful manifestations of these properties.

A decisive role in formation of new approaches to NPP safety was played by the work on NPP design with VVER-440 reactor for Finland that started in 1969. Close contacts and detailed acquaintance with the practices of other countries engaged in nuclear power development has contributed to the formulation of new requirement to NPP safety at the level of international standards.

Characteristic features of VVER installations forming the base of their enhanced safety were added to by the all-plant systems for severe accidents' prevention.

-173- The development of the "General provisions for nuclear power plant safety" began in 1969; in 1971 their first version was approved and the development of a NPP design with second-generation VVER, that would satisfy the international safety approaches, began in the same year.

The first power units of these series were constructed at Loviisa NPP in Finland (the first unit was commissioned in 1977; the second - in 1980). In the plans of NPP construction realized in our country and CMEA countries, power units of the new generation have replaced the planned units of the first series. The total of 4 such power units were constructed in the USSR and 10 - in CMEA countries.

Taking into account the new safety requirements, the development of VVER-1000 reactor system (design B-187) began in 1969 for the pilot 5th unit of the Novovoronezh NPP. In 1971 the detailed design was recommended for implementation. For the first time in our country the design of a reactor system has provided for a containment maid of pre-stressed reinforced concrete designed for the maximum pressure in case of the maximum design-basis accident with the rupture of main circulation pipe of 850 mm in diameter. The 5th NVNPP unit with VVER-1000 was commissioned in 1980.

The design of VVER-1000 equipment and the technological part of the reactor system were mainly based on new technical solutions. Thus, for the first time, VVER used the reactor core with "soft" control rods in the form of bundles (clusters) of absorbers (12 rods in each bundle).

While preserving the main layout solutions of the B-187 reactor system, design of reactor systems for VVER-1000 was developed for the first unit (B-302) of the South- Ukrainian NPP, and 1st and 2nd units of the Kalinin NPP (B-338); unlike the 5th NVNPP unit their new fuel assemblies were shroud-free.

These units were put into operation in 1982, 1985 and in 1984 and 1986, respectively.

In 1978 the development of the reactor system WER-1000 (B-320) began for a large series of NPps. While preserving the main pressure and temperature parameters, all new solutions for the B-320 system were to be optimized on the base of accumulated experience with the development of B-187, B-302 and B-338.

During 1984-1993, 14 such power units were commissioned (including two in Bulgaria in 1987 and 1991).

Important practical step in the development and implementation of reactor systems with inherent safety and passive protection means was first made with the construction of nuclear district heating plants (NDHP) in the Soviet Union. In should be noted, that creation of these facilities was completed before the Chernobyl accident, and the requirements for them were developed and the works were begun even before the accident at Three-Mile-Island in USA. However, their commissioning was stopped contrary to the technical logic on the wave of anti-nuclear feelings after the Chernobyl and Perestroika.

-174- Active progress and propaganda of reactor systems with inherent safety and passive protection means in post-Chernobyl years was hampered by Western nuclear industry afraid of technical & economic competition and of negative public reaction. Forcing of the "new approach" could put under question the safety and acceptability of operating NPP park. Factors of the necessity of public acceptance of nuclear power and the forming technical conjuncture in USSR and Russia, which, after the nuclear power prestige downfall as a result of the Chernobyl accident, demanded demonstration of qualitatively new steps in the further development of the branch, have determined the other attitude towards these new solutions. For this reason, the very next NPPs, which should be classified as "evolutionary", should have the maximum possible set of new safety features, characterized by "inherent" and "passive" terms. The logic of the country's economic development in the past years, and, consequently, the logic of nuclear power development, has determined the commissioning of such new-generation plants (with VVER-1000 and VVER-640) before 2000. The real course of economic reforms has considerably slowed the progress of nuclear power.

Present-day phase of VVER concept

In this connection it would be useful to sum the results of the present-day phase of water-water reactors' (VVER) development concept, characterized by wide spreading of the second generation of these reactors and availability of feasible third-generation projects.

Nuclear power plants with second-generation VVER reactors are represented by power units with reactor installations VVER-440 (V-213 design) working at Loviisa NPP (Finland), Paks NPP (Hungary), Dukovany NPP (Czech Republic), Bogunice and Mohovce NPPs (Slovakia), Rovno NPP (Ukraine), Kola NPP (Russia), as well as by power units with VVER-1000 reactors in Russia, Ukraine and Bulgaria.

At present 38 second-generation VVER units are in operation. Another 11 power units with VVER-1000 and VVER-440 of this generation are under construction.

Second generation of VVERs has ensured the safe operation of nuclear power in the Soviet Union (and then in Russia and Ukraine), especially in post-Chernobyl period, and demonstrated the possibility of NPPs' solid presence on the international market. Now it provides the technological and scientific & technical base for strengthening o( nuclear power in Russia and for competing on the world market via evolutionary transition to the third generation of nuclear-fueled units.

The decisions on constructing NPPs with third-generation nuclear units - VVER-640 (Sosnovy Bor and Kola-5 in Russia) and VVER-1000 (Novovoronezh-6 in Russia and NPPs in China and India) - were adopted. These projects develop to large extent the internal safety features, including use of natural factors and processes and passive technical means.

-175- Nuclear reactors of the XXI century

Availability of approved nuclear technologies in power industry, confirmed economic competitive ability and technical safety will make nuclear energy a favorite in providing a considerable part of energy production by the time of the next energy carrier change in the XXI century.

Reactors of various types will be present in the large-scale nuclear power. One of possible ways to classify them is to choose their functional attribution criteria: energy production, extended fuel breeding, isotopes production and actinides burning; reactors of all the functional lines would be involved in the solution of the main task - energy production.

The contribution of light water reactors in the world nuclear park, both today's'and forecasted with account to East-European and Asian-pacific components, will inevitably (for economic reasons) leave them in the world nuclear energy of the next century.

In the same time, projected considerable increase of nuclear energy production rate requires the analysis of the place of various reactor types in the large-scale nuclear power of the XXI century. The peculiarities of this new phase of nuclear energy use, such as: increase of its volume up to dozens percent in electricity production, the need of fissile nuclear materials' breeding, extension of both its sphere of application and the number of countries using nuclear facilities, make it necessary to clearly define the conditions and requirements, which should be obligatory for the reactors pretending to play an important role in the future nuclear power.

Variability of features and conditions of large-scale nuclear power existence determines the need to conduct research and development of new-generation reactors in line with improvement of available reactor designs. The proposals introducing a new quality in solution of future nuclear power problems should have preference in the selection of new development directions. It is impossible to propose, for perspective, a single project, which would, in the best possible way, solve all the problems faced by nuclear power. In the perspective several reactor types will be functioning, and each of them will be the best to solve its own large-scale energy task - doubtless including VVER- type reactors.

The trend of power reactors' development will continue with a goal of their use for electricity generation. Construction of large- and medium-capacity reactors, which have proved their good operation on previous stages, will continue. In the same time, the directions of further capacity increase will be realized. In particular, the size of energy grids in the European part of Russia and the requirement of competitiveness if compared to fossil-fuelled DHPs lie in base of the trend of unit power growth; and the orientation on the world market makes it necessary to have (for home and foreign use) a Russian VVER design competitive with Western ones in terms of capacity and other parameters.

The process of extension of nuclear energy application sphere (co-generation of heat and electricity, district heating sources, industrial heat supply), which has already

-176- objectively begun, makes it possible to forecast the development of this trend in the century to come. In this connection it could be expected, that the new branch of WER family - highly safe heating plants (NDHP) - could be finally developed up to their practical realization and mastering, to become an alternative in an optimal solution of large regions' heat supply.

Large-scale nuclear power cannot be built just on use of uranium-235. Feeding with fissile component of natural uranium, constantly involved into the fuel cycle, would be insufficient for operation of all the variety of nuclear power reactors. Fissile materials' breeding is one of the main features of nuclear power of the future. This function will be realized by breeder reactors. Breeding of fuel, which is necessary for fuel supply of all the nuclear power structure, is these reactors' main purpose. So, nuclear fuel breeder reactors and reactors consuming fuel will coexist in the future power industry. Their quantitative rate in the world large-scale nuclear power will be determined by the neutron balance of all the nuclear power structure, and by the level of reactor breeding.

Positive neutron balance of nuclear power reactor system, if necessary, may provide not only the breeding of nuclear fuel, but also the burning of most hazardous radioactive waste. Special thermal burner reactor could be developed for this purpose.

The rate of numbers of various-purpose reactors depends on perfection of their parameters, areas of application, level of nuclear power development and the status of solution of radwaste management issue. For established large-scale nuclear power development the approximate estimation of the rate between thermal/fast/thermal-for- actinides-burning reactor capacities would make 0.6/0.3/0.1.

It should be specially noted, that the initial period of the XXI century, together with traditional fuel cycle operations, will be characterized by solution of the problem of excess nuclear weapon-grade materials' (highly enriched uranium and plutonium) use in reactors. Utilization of weapon-grade plutonium power potential will contribute to the fuel base of nuclear power. In course of weapon-grade plutonium use, the mixed uranium-plutonium fuel technology will be mastered, and the experience of solving environmental problems and control, accounting and protection procedures, necessary for future nuclear power, will be accumulated. Power burning of released weapon-grade plutonium could be carried out in the form of mixed uranium-plutonium oxide fuel in operating and constructed Russian reactors, including VVERs. Selection of concrete solutions would be determined by economic conditions of the program's realization, with account of the strategy of nuclear power development.

Natural resources of thorium (which exceed uranium resources) and their cheapness give additional possibilities of resource-unlimited development of nuclear power. Involvement of thorium into the fuel cycle would not only contribute to the fuel base, but would also facilitate the solution of radwaste disposal problem. In the last time, together with the above advantages of thorium, the possibility of its use in operating or developed VVER reactors in order to enhance the solution of non-proliferation issue is being studied.

-177- Thus, it seems, that the most reasonable way lies in the evolutionary development of approved existing nuclear projects and in creation of new-generation nuclear technologies based on the experience of previous phases.

Perspectives of VVER reactors

Achieved level of development of nuclear power technology based on VVER-type reactors (their ship analogues) makes it possible to consider them as an integral part of nuclear power of the future and analyze their possibilities in solving the arising tasks: • priority growth of nuclear energy rate in electricity production in basic and loading following modes; • extension of the sphere of nuclear energy use: heat and electricity cogeneration, domestic and industrial heat sources, water desalination, etc.; • extension of the number of countries and customer regions and creation of flexible capacity range of nuclear power installations for use in large and small power systems and for decentralized energy supply; • utilization of excess plutonium minimizing its amount in nuclear power system; energy-related application of weapon-grade nuclear materials; • involvement of thorium into the nuclear fuel cycle; • development of nuclear sea transport, including fossil fuels' transportation.

Supposed further development of water-water reactors' development concept should clearly demonstrate the important element of nuclear power strategy of the XXI century - technological succession, based on great scientific & technical potential and developed industrial base, which should give maximum outcome and solve the economic tasks both for immediate future and for long-term perspective.

- 178- Table 1. VVER reactors constructed in the world

Country NPP Reactor Gross Beginning Expected type capacity, of commissio- MW construc- ning tion (year) (year) Russia Rostov-1 V-320 1000 1981 2000 Rostov-2 V-320 1000 1982 Kalinin-3 V-320 1000 1985 2004 Novovoronezh-6 V-392 1000 1999 * Kola-5 V-407 640 1997 * Sosnovy Bor V-407 640 1997 *

India Kudamkulam-1 V-412 1000 Kudamkulam-2 V-412 1000 **

Iran Bushehr-1 V-446 1000 1975 2002

China Liangjungang-1 V-428 1000 1999 2005 Liangjungang-2 V-428 1000 1999 2006

Cuba Juragua-1 V-318 440 1982 * Juragua-2 V-318 440 1982 *

Czech Temelin-1 V-320 1000 1982 2001 Republic Temelin-2 V-320 1000 1985 *

Ukraine Khmel'nitski-2 V-320 1000 1985 * Khmel'nitski-3 V-320 1000 1986 * Rovno-4 V-320 1000 1986 *

* - the year was not officially determined. ** - the intergovernmental agreement was signed; construction wasn't begun.

-179- CZO129421

The legislative basis and safety assessment for NPP licensing during commissioning in the Russian Federation.

to a conference "VVER Technical Innovations for the Next Century", April 17-19 2000, Prague. Author: A.V.Kapitanov

1. Introduction. 1.1. General information about NPPs in the Russian Federation. There are 29 nuclear Units at a 9 Sites under operation today in the Russian Federation. The common capacity amounts to 21,24 GWt(e) or 10 % to all established electrical power in Russia. It includes 13 units of a PWR-type reactors, 11 units of a RBMK-type reactors, 4 units of a EGP-type reactors (channel uranium-graphite installations) and 1 unit with the fast Reactor BN-600. The minimum of nuclear electricity production was observed in 1994. Since 1995, electricity generation at Russian NPPs has been constantly growing. In 1999 nuclear electricity production in Russia constituted 123 % to the level of the 1994 (more than 120 bln.kW.h.).

1.2. Nuclear safety legislative basis and regulations in Russia. There are three main acts in the Russian Federation which determine legislative basis on nuclear power safety: (I) The federal Act "Radiological Safety of the Public" (approved in 1995). This act establishes: - Main terms in the field of radiological safety of the population; - System of legal regulation in the field of providing of radiological safety; - Principles of guarantee radiological safety; - Measures to provide radiological safety; - Powers of the Government of Russian Federation and the subjects of Russian Federation in the field of radiological safety; - State management in the field of providing of radiological safety; - State supervision and monitoring; - General requirements to provide radiological safety; - Providing of radiological safety during an emergency situation; - Rights both responsibilities of the citizens and public associations in the field of guarantee radiological safety; - Responsibility for failure to meet requirements to provide radiological safety.

-181 - (2) The federal Act "About nuclear energy usage" (approved in 1995). This act establishes: - Legislative, legal and other regulations in the Russian Federation in the field of nuclear energy usage; - Principles and objectives of legal regulation in the field of nuclear energy usage; - Objects of application of this Federal Act; - Kinds of activity in the field of nuclear energy usage; - Property items concerning of nuclear installations, radiation sources, storage, nuclear materials and radioactive substances; - Federal norms and rules (regulations) in the field of nuclear energy usage; - Powers of the President of Russian Federation, the Government of Russian Federation, public authorities of the Russian Federation, public authorities of the subjects of Russian Federation, municipality in the field of nuclear energy usage; - Rights of organisations, including public associations, and citizens in the field of nuclear energy usage; - State management in the field of nuclear energy usage; - State authority of safety in field of nuclear energy usage; - Siting and construction of nuclear installations, radiation sources and storage's; - Legal status of organisations executing activity in the field of nuclear energy usage; - Treatment of nuclear materials, radioactive substances and radioactive wastes; - Security of nuclear installations, radiation sources, storage's of nuclear materials and radioactive substances; - Responsibility for the losses and injury caused by radiation to organisations or persons; - Responsibility for violation of the legislation of Russian Federation in the field of nuclear energy usage; - Export and import of nuclear installations, equipment, technologies, nuclear materials, radioactive substances, special of non-nuclear materials and services in the field of nuclear energy usage; - International contracts of Russian Federation in the field of nuclear energy usage.

(3) The federal Act "Protection of the public and territories from extremely natural or technological situations" (approved in 1994). This act establishes: - Uniform state system of the prevention both liquidation of extremely situations and its main consequences; - Main principles of providing of protection for the population and territory from extremely situations; - State management in the field of protection of the population and territories from extremely situations;

-182- - Right and responsibility of the citizens of Russian Federation in the field of protection of the population and territories from extreme situations and social protection suffering; - Action under the international agreements of the Russian Federation in the field of protection of the population and territories from extremely situations. - and others;

1.3. Federal norms and rules in the field of use of nuclear energy. Federal norms and rules (regulations) in the field of nuclear energy usage establish requirements for safety, which fulfilment is necessary for implementation in any kind of activity within the field of nuclear energy usage. The list of this federal regulations in field of nuclear energy usage is affirmed by the Government of Russian Federation. Under the law, this regulations should take into account the recommendations of corresponding international organisations, in which activity the Russian Federation participates. The list of federal regulations includes of 46 normative documents of Gosatomnadzor, Health Ministry, and Ministry of Internal Affairs concerned on technical aspects, sanitary- hygienic aspects, and fire-prevention aspects. The next should be noted: - " Radiation safety standards " (NRB-96); - " The general safety rules to nuclear power plants " (OPB-88/97); Except for this types of legal documents, there is a plenty of the branch normative documents which determine the basic and common requirements to assurance the safe and reliable operation of NPP. As a rule, this documents are not the subject for approving by Regulator (Gosatomnadzor of Russia) as well as for registration by Russian Ministry of Justice. "The Basic rules for ensuring of nuclear plants operation", 1998, is one of this documents which contains the basic requirements for NPP commissioning.

2. Safety assessment and license issue to perform the Siting and Construction of NPP. There are a general procedures for licensing of nuclear units on new sites as well as on old ones. They are established by the current legislation of the Russian Federation, federal regulations in the field of nuclear energy usage, other current normative documents. The similar procedures should be used for commissioning nuclear units after big-scale reconstruction. In accordance with clause 32 "About nuclear energy usage" Act, the NPP commissioning can be carried out by the operating organization after receiving all stipulated licences and permissions for NPP operation. The whole sufficiency of organizational system and technical measures to provide safety commissioning is estimated on several main stages: 1 - ecological expertise (examination) of NPP project to determine that proposed plant can be constructed, commissioned and operated without undue radiological risk to the public and the environment impact (before permissions on nuclear unit siting); 2.1 - review and assessment before issue of the Gosatomnadzor licence for unit siting (as the first stage of the licence for construction);

-183- 2.2 - review and assessment before issue of the Gosatomnadzor licence for unit construction (as the second stage of the license for construction for new units as well as for continuation of construction after temporary closing-down); 3 - review and assessment before issue of the Gosatomnadzor licence for unit operation as well as for subsequent modifications in the licence in connection with transition from one stage of commissioning to another one.

2.1. License issue to perform the Siting (construction). The construction of main NPP buildings and constructions can be started with according to approved and affirmed design of NPP as well as after issue of the Gosatomnadzor licence for unit construction. The license is issued after performing a thorough review and assessment of applicant's technical submissions, including design justifications and conclusions of state ecological expertise. The NPP design has to describe the technical means and organizational measures for precaution of accidents and limitation of their consequences. The system of technical or organizational measures on safety assurance has to be presented in special design document (in the safety analysis report). It should be marked separately the necessity of presence of justification for analysis of possible consequences of several accidents and accident management. The design should contain a section about conditions and procedures of commissioning after construction, including the information about tests important for safety of systems and equipment, as well as acceptance criteria.

2.2. License issue to perform operation including commissioning. In accordance with current regulations, the commissioning is the process during which NPP components and systems, having been constructed, are made operational and verified to be in accordance with design assumptions and to have met the performance criteria. In accordance with clause 32 "About nuclear energy usage" act, the commissioning of NPPs should be performed taking under consideration a whole complex of all design installations for industrial and domestic assignment. The main stages of commissioning consist of non-nuclear tests of all systems and equipment, initial criticality tests, and start-up power tests resulting in commercial operation. The common management, monitoring and coordination of commissioning performs operating organization with participation of vendors. The NPP manager should ensure observance of safety requirements during unit commissioning. To perform the commissioning activity from the beginning of first nuclear fuel delivery on the site, the operating organization have to receive the license for operation on this site with corresponding license conditions. The first nuclear fuel delivery on the site, initial criticality tests starting, and start-up power tests are the hold-points for regulator review and assessment. Gosatomnadzor issue the authorization to perform this activity by permissions to go to the next stage of operation according to license conditions after inspections of preparedness of NPP and on approvals of others national authorities. For license issue as well as for modifications in operation license conditions during commissioning, operating organization have to submit statement with the indicating of a stage

-184- and periods of activity conducting, documents to confirm readiness of systems and equipment, complete set of the test programs at the specified stage, report with results of executed tests on the previous stage of commissioning, information on staff certification and qualification, the onsite and off-site emergency preparedness documents. For safety assessment during commissioning Gosatomnadzor performs regulatory inspections. Inspection program should take into consideration the operating instructions and procedures, readiness of systems and equipment, readiness of personnel workrooms, full strength with staff and their qualification. Inspection result in formal note with reflecting of the detected oversights, time for their elimination, assessment of NPP readiness to conducting a next stage of commissioning, decision on a possibility of conducting a next stage.

2.3. Items for assessment during NPP commissioning. The operating organization have to prepare "The NPP commissioning program" with the purposes of safe and qualitative executing of commissioning, as well as "The quality assurance program during commissioning". The last one should represent a complex of organizational and technical measures on executing operations during commissioning according to regulations, standards on safety, design and designer documentations, and also on providing of monitoring of all operations. The program should define the rights, duties both responsibility of vendors and designers and their relationships. All of vendors and others enterprises should have the admittances (licenses) of Gosatomnadzor for conducting their activities in nuclear engineering. "The NPP commissioning program" is subject for Gosatomnadzor assessments at all stages of licenses issues for Siting both building, and should be approved resulting in, as a rule, the special conditions to these licenses for making corrections and adds before finishing of construction. Within the framework of this program the NPP administration should provide engineering and agreeing by vendors the set of start-up and test work programs. The programs should be approved by operating organization and submitted to Gosatomnadzor. Besides, the appropriate design materials should be submitted to Gosatomnadzor defining demands on a sequence and volume of start-up operations and tests for all systems and equipment, initial criticality tests, and start-up power tests, as well as acceptance criteria for the equipment and systems being commissioned. The technical specifications, emergence operating procedures, accident management procedure and off-site emergence plan in a set with others procedures should be reviewed and assessed with the whole complex of documentation during safety assessment.

2.4. The general organization for NPP commissioning. In accordance with general procedure, the state committee is established for NPP commissioning. The commissioning is considering as two-stage process: test operation and commercial operation. The acceptance in the test operation is approved after a continuously operation during 72 hours at a level of thermal power not less than 50 % from nominal. The test operation continues up to the time necessary for finishing all tests on power start-up program and mastering for design power. The acceptance in commercial operation is approved by state committee after completion

-185- of the program of power start-up as well as after assessment this results by Gosatomnadzor that have to put corresponding modifications into license conditions.

3. Closing. The program of development of nuclear power in the Russian Federation. It should be noted in closing the main directions of the Program of development of nuclear power in the Russian Federation. This document was authorized by the Government of Russian Federation in July 1998r. In this program two versions of development of atomic power are provided: - Minimum version: Nuclear capacity amounts up to 24,24 GWt(e) in 2000, up to 26,88 GWt(e) in 2005, up to 27,5 GW(e) in 2010, including stop for decommissioning 2,76 GWt(e). - Maximum version: Nuclear capacity amounts up to 24,24 GWt(e) in 2000, up to 26,88 GWt(e) in 2005, up to 29,2 GWt(e) in 2010, including stop for decommissioning 2,76 GWt(e). In the field of a NPP safety the Program presumes: - Modernization and creation of modern equipment to provide the safe and reliable NPP operation; - Operation and development of research reactors to provide an experimental base for investigations in field of NPP safety; - Reprocessing and treatment of radioactive wastes on NPP and other nuclear installations sites; - Research and design activities on the field of future nuclear installations safety substantiation, including analysis of improbable accidents. In the field of technical modernization the Program presumes a realization of measures to increase a level of safety of NPP under operation today and the extension of their service life. In the field of completion of NPP construction the Program presumes the finishing of construction of the 3-rd unit of Kalininskaja NPP, 5-th unit of Kurskaja NPP, 1-st and 2-nd units of Rostovskaja NPP, Voronezhskaja NPHP, construction of South-Ural NPP with the BN-800 unit. In the field of new generation of high safety level NPP it is supposed: - Construction of pilot-unit with VVER-640 (Sosnovi Bor) and pilot-units with VVER-1000 (Kolskaja NPP-2 and Novovoronezhskaja NPP-2); - Construction of low power units for operating in Chukotski district and in a Primorski state on the basis of safety and compact navy nuclear installations.

-186- Time-table for NPP commissioning & decommissioning up to 2010 r. (According to the program of development of nuclear power in the RF)

Name of NPP, type of reactor Unit Capacity Time-table for commissioning number (MWt(e)) & decommissioning 1998- 2001- 2006- 2000 2005 2010 Completion of NPP under construction temporary closing-down KALININSKAJA NPP, 1 1000 WER-1000 2 1000 3 1000 comm. KURSKAJA NPP, 1 RBMK-1000 2 3 4 5 1000 comm. ROSTOVSKAJA NPP, 1 1000 comm. VVER-1000 2 1000 comm. BELOJARSKAJA NPP, BN-600 3 600 BELOJARSKAJA NPP, BN-800 4 800 SOUTH-URAL NPP, BN-800 1 800 comm. Construction high safety level pilot-units of NPP SOSNOVI BOR, WER-640 1 640 comm. HOVOVORONEZHSKAJA 6 1000 comm. NPP-2, VVER-1000 7 1000 comm. New NPPs construction KOLSKAJA NPP-2, VVER-640 5 640 comm. 6 640 comm. 7 640 KURSKAJA NPP-2 6 comm. (type is under consideration) SMOLENSKAJA NPP-2 4 (type is under consideration) LENINGRADSKAJA NPP-2 5 comm. (type is under consideration) 6 7 NPPs under operation now BALAKOVSKAJA NPP, 1 1000 WER-1000 2 1000 3 1000 4 1000 SMOLENSKAJA NPP, 1 1000 RBMK-1000 2 1000 3 1000

-187- Time-table for NPP commissioning & decommissioning up to 2010 r. (According to the program of development of nuclear power in the RF) (cont.)

Name of NPP, type of reactor Unit Capacity Time-table for commissioning number (MWt(e)) & decommissioning 1998- 2001- 2006- 2000 2005 2010 NOVOVORONEZHSKAJA NPP, 3 440 decomm. WER-440, VVER-1000 4 440 decomm. 5 1000 KOLSKAJA NPP, WER-440 1 440 decomm. 2 440 decomm. 3 440 4 440 LENINGRADSKAJA NPP, 1 1000 decomm. RBMK-1000 2 1000 3 1000 4 1000 Construction & decommissioning of NPHP VORONEZHSKAJA NPHP 1 500(th) comm. 2 500(th) comm. TOMSKAJANPHP 1 500(th) 2 500(th) PEVEK sity, CHUKOTSKI distr., 1 70 comm. KLT-40 PRIMORSKI state, 1 70 comm. "VOLNOLOM" or KLT-40 BILIBINSKAJANPHP, 1 12 decomm. EGP-6 2 12 decomm. 3 12 decomm. 4 12 decomm.

CONCLUSIONS

NUMBER OF NUCLEAR UNITS 3 3 4-7 TO BE COMMISSIONED (except of NPHP)

WHOLE CAPACITY TO THE 21.24 24.24 26.88 27.56 - END OF PERIOD, GWt. 29.20

-188- CZO129422

DART - For Design Basis Justification & Safety Related Information Management

A. Billington1, P. Blondiaux', J. Boucau1 , B. Cantineau', A. Mared2, C. Doumont1

ABSTRACT

DART is the acronym for Design Analysis Re-Engineering Tool. It embodies a systematic and integrated approach to NPP safety re-assessment and configuration management, that makes use of Reverse Failure Mode and Effect Analysis in conjunction with a state-of-the-art relational database and a standardized data format, to permit long-term management of plant safety related information. The plant design is reviewed in a step-by-step logical fashion by constructing fault trees that identify the link between undesired consequences and their causes. Each failure cause identified in a fault tree is addressed by defining functional requirements, which are in turn addressed by documenting the specific manner in which the plant complies with the requirement. The database can then be used to generate up-to-date plant safety related documents, including: SAR, Systems Descriptions, Technical Specifications and plant procedures. The approach is open-minded by nature and therefore is not regulatory driven, however the plant licensing basis will also be reviewed and documented within the same database such that a Regulatory Conformance Program may be integrated with the other safety documentation.

This methodology can thus reconstitute the plant design bases in a comprehensive and systematic way, while allowing to uncover weaknesses in design. The original feature of the DART methodology is that it links all the safety related documents together, facilitating the evaluation of the safety impact resulting from any plant modification. Due to its capability to retrieve the basic justifications of the plant design, it is also a useful tool for training the young generation of plant personnel. The DART methodology has been developed for application to units 2, 3 and 4 at Vattenfall's Ringhals site in Sweden. It may be applied to any nuclear power plant or industrial facility where public safety is a concern.

' VVestinghouse Electric Europe, Boulevard Paepsem 20, 1070 Brussels, Belgium 2 Vattenfall DART Project Manager, Ringhals Nuclear Power Plant, S-430 22 Varobacka, Sweden

-189- INTRODUCTION

During the forty or so years since their first commercial introduction, the requirements for the design and operation of nuclear power plants have undergone tremendous evolution, responding to experience gained from operational and accident situations, and reflecting advances in scientific knowledge and engineering techniques.

In recent years, more and more emphasis is placed on operating NPPs to demonstrate, via traceable and up-to-date documentation, that they continue to meet the currently accepted safety standards, in the way they are designed, operated and maintained.

Typically, the relevant plant data are contained in separate, cross-referenced paper documents, which may be owned and maintained by different functional departments within a utility's organization. Managing all these documents, ensuring their coherence and up-to-date status, can therefore become a cumbersome and resource-intensive task, further complicated by the ever changing world of text processing (software and hardware). Furthermore, efficient use of the information contained in these different documents may often be achieved by experienced and specialized personnel only.

The method and tool described here allow one to reconstitute the safety-related features of a plant in a systematic and logical manner, using Reverse Failure Mode and Effect Analysis (RFMEA). These features are documented in a time-resistant electronic format inside a relational database, which becomes the centralized source of all relevant plant information and thus allowed the generation of the plant safety documents (safety analysis report, technical specifications, system descriptions, procedures, etc.).

The RFMEA approach facilitates the evaluation of changes in plant design or operation, while the centralized relational database ensures that such changes be efficiently reflected throughout all impacted documents. Furthermore, the database may be accessible through the utility's computer network, via a user-friendly browser software, so it may be used as a training tool or as a day-to-day consultation tool by utility personnel.

The RFMEA approach has been developed to be applied to the Ringhals 2 PWR in Sweden, under the name "Design Analysis Ringhals Two" (DART), in the framework of a comprehensive safety re-assessment program undertaken by Vattenfall.

The methodology, and the associated tool, turned out to be applicable to the other Ringhals units, and in fact to any nuclear power plant or risk-concemed industrial facility. Therefore, the DART acronym has been redefined to mean "Design Analysis Re-engineering Tool' ".

Patent application filed

-190- BARRIERS AND RELEASE PATHS

As a basic criterion for a nuclear power plant, DART must prevent radioactive release to the environment.

As a first step, the methodology must identify all activity sources, as well as the successive barriers supposed to prevent such activity from reaching the public. In a nuclear power plant, the main activity source (the core) is shielded by four successive barriers (Figure 1): the fuel matrix, the fuel cladding, the Reactor Coolant System (RCS) boundary and the containment building boundary. This multiplication of barriers represents the well known defense-in-depth approach.

Isolation Device Containment Building

Fuel Cladding

Figure 1: As a first step, the methodology must identify all activity sources, as well as the successive barriers supposed to prevent such activity from reaching the public. In a nuclear power plant, the main activity source (the core) is shielded by four successive barriers.

Other systems than the defined barriers can become radioactive and thus become additional activity sources, due to their connections with a adjacent barrier (Figure 1). System B may become radioactive if its isolation devices are opened when the upstream barrier (the RCS in this case) contains radioactivity. The boundary of System B then becomes the barrier for that activity source and constitutes a second possible release path to the environment.

- 191 - REVERSE FAULT TREE APPLICATION

To retrieve and document the plant safety features that serve ultimately to limit the release of radioactivity, one uses the Reverse Failure Mode and Effect Analysis (RFMEA). Starting from the undesired consequences, one constructs logical fault trees that systematically identify successive causes of failure until the root causes have been identified. This approach originates from one used for the functional design of safeguard systems for protection against external events, for certain European NPPs [1]. Because it avoids the treatment of trivial effects, it offers the advantage of being more efficient than its counterpart, cause and effect analysis.

One identify the causes of the ultimate undesired consequence (radioactive release to environment) by logically connecting the different barriers according to each release path. For each barrier, fault trees are constructed by progressive identification of failure modes (called gates) which could cause the given barrier to fail. The logic is developed down to a very detailed level, with each gate in turn becoming the undesired consequence of its own causes, until the root causes have been identified.

As an example, consider a simplified fault tree identifying two possible paths leading to radioactive release to the environment (Figure 2), via the barriers shown in Figure 1. The release may come from the containment or from System B. Release from the containment requires both the presence of radioactivity in the containment and a containment failure. Radioactivity in the containment is due to releases from systems inside it or connected to it: the Reactor Coolant System (RCS) or System B. In turn, the reasons for the presence of radioactivity inside these systems is broken down by a systematic series of causes and subcauses that introduce links to other barriers and systems.

As shown in Figure 2, trees can be linked via the top gate or via intermediate level gates. A high-level operational issue can be split into very detailed causes, at the component level (for example, isolation device failure). By reading the tree from causes towards consequences, one can also determine all the significant effects of a component malfunction in the plant.

The fault trees associated with the barriers and with the systems supporting these barriers are stored in a relational database that maintains the logical links between gates and trees. One addresses each failure cause, identified by a unique gate, by defining functional requirements for measures that will prevent the failure from occurring, mitigate its effects or reduce the likelihood of failure probability. The requirements are introduced in the database in the form of structured text fragments, as described in the following section.

-192 - Gate types

AND STOP;

Connection to dependent fault tree or gate

Figure 2: The fault trees start from the undesired consequence (radioactive release) and identify successive causes of failure.

-193- STRUCTURED FUNCTIONAL REQUIREMENTS

A structured file (or text fragment) is associated to each gate within the database. The text describes the nature of the failure concern and the measures required (functional requirements) to prevent its occurrence or mitigate its effects. Such requirements, which may be as numerous as deemed necessary, are introduced as subfragments within the gate. The specific manner in which the plant complies with each functional requirement is documented within the gate file in the form of a compliance statement.

The measures required to show that the given failure has been accounted for in the plant design may be generic or specific, such as requirements for systems, analyses, procedures or technical specifications. They may also be regulatory requirements.

To distinguish clearly between the various sorts of requirement, and to allow retrieval and grouping of like information from different gates, each high-level functional requirement fragment may be divided into other types of subfragment. The rules for structuring the fragments within a gate and those for entering information within each fragment are defined by a template, which may be tailored to any project.

As an example, consider a simplified template that corresponds to the gate structure described above (Figure 3). The information in each gate may consist of entities created in the tool (such as text, equations, lists or tables) or of links to database files containing graphics or standard definitions. Links may also be made to other trees and gates in order to identify logical relationships that arc not necessarily evident at the tree level.

Optional fragment. Compulsory fragment May occur as many (if parent exists). Way limes as required occur once under a given parent.

Retirement Compliance

Requirement Compliance Requirement Compliance Requirement Compliance Requirement Compliance Requirement Compliance

Figure 3: Dividing the functional requirements into subfragments makes it easier to distinguish between various sorts of requirements.

-194- In practice, the specific requirement fields (system, analysis, procedure, technical specifications, regulation) may usefully be substructured, thus establishing a hierarchy between these requirements. For example, an analysis fragment may be added under system to specify the need for a system sizing analysis, or a regulation fragment may be added under analysis when rules exist for performing such analyses.

DATA FORMAT AND MANAGEMENT

A relational database management system, used as the central depository for the data, contains and controls the access to each piece of information produced during the project, including the tree structure, the gate information and all the text fragments.

The long-term accessibility and portability of the electronically stored information requires a neutral format to make the data independent from a particular software or hardware platform. The most suitable and universal format that meets these needs is the Standard Generalized Markup Language (SGML), defined in an ISO standard [2].

In an SGML file, the text is encoded as ASCII and tagged (or marked up) by SGML codes to indicate text style and formatting.

SGML allows links to other files (SGML or other, such as graphics) through "Hypermedia/Time-based Structuring Language" (HyTime) [3], another ISO standard that allows the end-user to jump (or browse) between connected pieces of information stored at different locations. An SGML file may also be reused from within another SGML file, such that the same information may appear at different locations, while being entered only once. When the reused SGML file is updated, the modifications are automatically implemented wherever this file has been reused, with no risk of inconsistencies.

Rules are necessary for structuring the information that is entered into each gate. In SGML, the rules for entering information are contained in a separate file, known as a Document Type Declaration (DTD). The DTD for a gate defines the relationship between the different text fragments (description, functional requirements, etc.), according to the structure shown in Figure 3. The DTD contains substructures that may need to be repeated. These substructures are defined as SGML elements, which in turn contain the rules for entering information at the next level down.

For example, the gate structure shown in Figure 3 requires five levels of SGML element definition of the following type ("*" designates optional elements - used zero, one or several times - while "|" represents an exclusive or): 1. gate (title , description, functional requirement*); 2. functional requirement (requirement description, compliance statement, system*, analysis*, procedure*, technical specifications*, regulation*); 3. system (requirement description, compliance statement); 4. requirement description (content*); 5. content (text | list | table | figure).

- 195- DTDs may be made as flexible or as rigid as required by the application. In the example shown on Figure 3, a gate must contain a title and a description field, whereas functional requirements are optional. However, once a functional requirement (general or specific) has been opened, it requires both description and compliance fragments. This approach ensures consistency between authors and reduces the risk of incomplete information.

The information contained within the database may be accessed and viewed with an SGML browser, such as the graphical interface used for creating the fault trees. The data can also be converted to HTML format so that it may be viewed on an intranet using a common Internet browser.

One can also create reports (as RTF files) of selected pieces, or combinations, of information extracted from the database. The report format is defined in a "style-sheet" encoded according to "Document Style Semantics and Specification Language" (DSSSL), yet another ISO standard [4], A document may thus be regenerated at any time. Its contents then reflects the state of the database at that instant.

The DART system (Figure 4) is by nature open and flexible in the sense that it focuses on defining the content of the information. Thus, it can connect to intelligent plant information systems, like Documentum®.

-196- DATA ENTRY CLIENT

GRAPHICAL INTERFACE: • tree editing • document SERVER builder • text browser DATABASE i • file check-out W SGML / OTHER A k. Report < •( NETWORK \ T DSSSL w V SERVERS SGML Editor ^^ ^

SGML

ADMINISTRATOR DSSSL • CLIENT

USER TOOL: • users SGML • groups DSSSL « permissions

INTRANET ADMIN TOOL: CLIENT • DB structure A • Statuses & WEB Page HTML revisions P" Browser . Locking rules

Figure 4: The DART data management system is open and flexible. It allows the user to browse connected pieces of information stored at different locations.

PLANT SAFETY RELATED DOCUMENT INTEGRATION

Once the trees and gates have been completed, the plant safety-related documents (safety analysis report, systems descriptions, technical specifications and regulatory conformance program) are regenerated from the DART database. Like for the fault trees, SGML provides a perfect means to share information between the different documents, without duplication. It ensures that all documents are updated as soon as the information itself is modified in the central database, which eliminates any risk of using obsolete information.

The flow of information between the fault tree gates and the plant safety documents avoids the duplication of information and allows the user to browse the different documents (Figure 5). The structure of every document is built-up according to its own DTD. One may

-197- insert SGML fragments that have been created within gates into the document structure by reusing them, at as many locations as required.

TECHNICAL GATE Fragments SYSTEM SPECIFICATIONS DESCRIPTIONS (SGML document) Requirements & Compliance (SGML documents) related to:

Systems •<— Analyses "*- Procedures Tech. Specs. Regulations

REGULATORY SAFETY CONFORMANCE ANALYSIS PROGRAM PROCEDURES REPORT (SGML document) (SGML documents) (SGML document)

Figure 5: The flow of information between the fault tree gates and the plant safety documents avoids the duplication of information and allows the user to browse the different documents

The documents are constructed in SGML, in parallel with the creation of the functional requirements within the gates. When they are separated according to their own DTDs, specialists in each area (regulations, technical specifications, safety analysis reports, etc.) can work in parallel with the gate text authors, to create the framework and context that is specific to each document. As fragments are created on either side, they are marked by flags which define keywords that relate document fragments to gate fragments. The keywords might define the name of the barrier, system or component to which the fragment applies, or they might specify a barrier protective safety function (such as heat removal or overpressure protection).

Database searches on files with specific combinations of keywords allow one to locate fragments where information is to be shared. The necessary links may then be easily established to create an integrated and coherent set of electronic documents that form intersecting sets with the information contained in the fault trees.

Connecting all safety-related documents allows one to determine the safety impact of a given plant change by examination of the relevant fault trees and gates. Consequently, the

-198- impacted text may be modified in a comprehensive way throughout those documents, without any duplication of information.

CONCLUSION

DART provides a systematic and methodical way of reviewing and documenting the design bases of a nuclear power plant in a format that ensures the long-term manageability and coherence of the plant safety-related documentation. It organizes the information into in a system that is readily accessible to utility personnel for day-to-day consultation or training purposes. As such, it is a powerful tool for maintaining the plant safety documentation up-to-date in a cost- efficient way.

ACKNOWLEDGEMENTS

The authors would like to acknowledge the significant contribution to this work of the DART project team members, and especially of D. Ballant and J.P. Chaboteaux at Westinghouse and of B. Elam, J. Gallsjo and O. Johansson at Vattenfall.

REFERENCES

1. Cantineau, B. and Cecchi,T. , "Systematic Assessment of Necessary Functions for Protection Against External Accidents" Transactions of the American Nuclear Society ENC'79 Conference, May 1979, Volume 31, pp.351-353. (ENC - European Nuclear Conference)

2. ISO 8879:1986 "Information processing — Text and office systems — Standard Generalized Markup Language (SGML)" International Organization for Standardization, Geneva. (ISO = International Standards Organization)

3. ISO/IEC 10744:1997 "Information technology -- Hypermedia/Time-based Structuring Language (HyTime)" International Organization for Standardization, Geneva. (IEC = International Eiectrotechnical Commission)

4. ISO/IEC 10179:1996 "Information technology — Processing languages - Document Style Semantics and Specification Language (DSSSL)" International Organization for Standardization, Geneva.

-199- CZO129423

Increase Plant Safety and Reduce Cost by Implementing Risk-Informed In-Service Inspection Programs

A. Billington, P. Monette, C. Doumont Westinghouse Electric Europe, Boulevard Paepsem 20, 1070 Brussels, Belgium

Abstract

The idea behind the program is that it is possible to "inspect less, but inspect better".

In other words, the risk-informed In-Service Inspection (ISI) process is used to improve the effectiveness of examination of piping components, i.e. concentrate inspection resources and enhance inspection strategies on high safety significant locations, and reduce inspection requirements on others.

The Westinghouse Owners Group (WOG) risk-informed ISI process has already been applied for full scope (Millstone 3, Surry 1) and limited scope (Beznau, Ringhals 4, Asco, Turkey Point 3). By examining the high safety significant piping segments for the different fluid piping systems, the total piping core damage frequency is reduced. In addition, more than 80% of the risk associated with potential pressure boundary failures is addressed with the WOG risk-informed ISI process, while typically less that 50% of this same risk is addressed by the current inspection programs.

The risk-informed ISI processes are used • to improve the effectiveness of inspecting safety-significant piping components, • to reduce inspection requirements on other piping components, • to evaluate improvements to plant availability and enhanced safety measures, including reduction of personnel radiation exposure, and • to reduce overall Operation and Maintenance (O&M) costs while maintaining regulatory compliance.

A description of the process as well as benefits from past projects is presented, since the methodology is applicable for VVER plant design.

-201 - 1. Background to Risk-Informed Inspection

The purpose of In-Service Inspection (ISI) of pressure retaining components is to identify conditions, such as material flaws, that may be precursors to failure of the pressure boundary. By the timely detection and mitigation of such conditions, failure may be prevented and knowledge gained about the degradation behaviour of plant components.

Traditionally, ISI is required in piping at locations where the analysis of record has shown a high fatigue stress or usage factor, as specified in the ASME Code for example [1], with the ISI technique and extent of inspection being a function of the traditional piping safety classification. Consequently, most of the ISI effort and cost has been concentrated on highly reliable piping, with the focus on areas where cracks could initiate but without consideration for the actual potential for failure.

Since the commissioning of the first generation of Nuclear Power Plants (NPPs), other, more potent piping failure, mechanisms have come to light, such as Flow Assisted Corrosion (FAC) and Stress-Corrosion Cracking (SCC). NPP owners have consequently augmented their traditional ISI programs to take them into account. However, attempts to integrate rules covering these mechanisms into the codes and standards governing ISI have so far proved unsuccessful.

In parallel with these developments, the way in which NPP safety is measured and analysed has also evolved with the application of Probabilistic Risk Assessment (PRA). Today, NPPs typically have their own plant specific PRA model, allowing to quantify the safety significance of individual systems and components, in terms of a global plant risk measure, such as Core Damage Frequency (CDF) or Large Early Release Frequency (LERJF). However, as well as being a safety analysis tool, PRA is increasingly being considered for use in the optimisation of the way in which NPPs are operated and maintained. High cost activities such as ISI and In-Service Testing (1ST) are obvious candidates for such attention.

Whereas reliability data for active components, such as pumps and valves, are readily available, there exists relatively little data on the failure probability of NPP piping, that may be readily transposed for use with PRA. Indeed, apart from treating pipe failures as initiating events, PRAs typically do not consider the effect of pipe failure. However, recent work in the area of probabilistic fracture mechanics has lead to the development of efficient techniques that allow to estimate the probability of failure of piping based on specific materials and service conditions. By combining this estimated likelihood of failure, with the simulated consequence of failure, determined by the PRA, this risk associated with the failure of a given segment of pipe may be quantified and thus used in the decision process for selecting ISI locations.

It must be recognised that probabilistic techniques have their limitations and may require to be complemented by other engineering insights or expert judgement. For this reason the terminology for this approach to decision making, which was previously known as "risk- based", is now referred to as "risk-informed". The following sections discuss the development of a risk-informed ISI program, using the approach that was developed by the VVestinghouse Owners Group (WOG) in conjunction with ASME Research [2], and compare the results of a number of applications. An overview of the complete process is given in Figure 1, below.

-202- Expert Panel Consequence Categorization f y Evaluation / X . \ Element/ Scope and Risk- NDE Implement Segment * Evaluation Program Definition Selection X Structural Element Failure Probability Feedback Assessment Loop

Figure 1: Westinghouse risk-informed In-Service Inspection (ISI) process includes an expert judgement.

Using the notion of risk to establish a ranking scheme for ISI locations, has been the practice in certain countries for some years. In Sweden, for example, the current state guidelines [3] provide a method for determining risk-significance by combining a "damage index" (which gives an indication of the risk of failure of a given pipe segment) with a "consequence index" (which gives an indication of the risk to safety, should that segment fail). The major drawbacks of such a method are that it is highly subjective, meaning it cannot be easily compared with other measures that affect plant safety, and it is essentially qualitative in nature, which means that it is difficult to determine the effect of changes in conditions or inspections.

In the US, initiatives have now been taken by the ASME [4][5] and the NRC [6][7] to provide a framework within which risk-informed programs may be developed and implemented.

2. Determining the Conditional Consequences of Failure

The systems considered in the risk-informed ISI program are, as a minimum, those that are included, as event initiators or mitigating systems, in the plant PRA model. Depending on the scope and extent of the PRA, other systems may have to be addressed on a more qualitative or traditional basis. For example, if shutdown modes are not included in the PRA then the residual heat removal system would fall into this category.

Each system is divided up into piping segments, such that a leak or break anywhere in the segment would have the same direct consequence on the plant, in terms of - initiating event, - loss of train, or - loss of system. The effect of operator action is also considered. For example a remotely operated normally open valve will be taken as a segment separator. Segments may also be sub-divided at locations where it is suspected that there may be a change in failure probability, for example at changes of pipe size or material.

Once the direct consequences of failure are determined, the indirect consequences of failure

-203- of each segment must also be established in order to have a complete evaluation of the impact of a pipe break or leak on the plant. Such information may be available in the plant documentation related to High Energy Line Break (HELB) protection. Otherwise it may be necessary to perform a plant walk-down to identify the position and nature of potential targets. The mechanical and electrical effects of following consequences of pipe failure must be considered: - jet impingement, - water spray, - flooding, - temperature, and - pipe-whip .

The direct and indirect consequences of failure of each segment are associated to the PRA model, and surrogate components are identified to represent piping, which is not explicitly modelled (the surrogate components modelling operator recovery action must be defined carefully).

The segment failure probability is set to unity and conditional consequence of failure (CDF or LERF) is calculated for each segment. This will be combined with the probability of failure of the segment, in order to determine the risk associated to the segment.

3. Determining the Probability of Piping Failure

The probability of piping failure is quantified by a computer code known as SRRA [8], that was developed from previous work in probabilistic fracture mechanics. The code uses the following engineering input data, that is usually gathered from design records and plant experience: - material and pipe properties, - operating conditions, - service loading, - design limiting loading, - inspection accuracy, - system disabling leak rate, - potential for FAC or SCC. A median value, a standard deviation and a distribution function are defined for each parameter.

Using a Monte-Carlo technique, with importance sampling, random selections are made for the input parameters. Having determined the most predominant degradation mechanism, either - low-cycle fatigue, -FAC, - SCC, or - high-cycle fatigue, the growth of a postulated material defect is simulated over the plant lifetime via a standard mechanistic model. At discreet intervals during the defect growth, the stability of the undamaged section is verified by comparing the design limiting stress to the material flow- stress. If the flow-stress is exceeded, a pipe break is registered and a new trial is initiated. If the flow-stress is not exceeded, the program checks whether the defect has penetrated the pipe

-204- wall. If this is the case, the leak rate is calculated and compared to the system disabling leak rate in order to determine whether the leak is classified as large or small.

By running a sufficiently large number of trials, probabilities of failure may be established for full break, large leak and small leak, for each segment. The effect of ISI may also be simulated by entering the ISI interval and the probability of non-detection for the inspection method being used. This gives a reduced probability of failure, which is used in order to determine the change in risk associated with changing ISI programs.

4. Determination of New Inspection Locations

The CDF (or LERF) associated with the failure of each segment is calculated by combining the conditional CDF, with the segment failed, with the probability of failure of the segment, assuming no ISI. Compound calculations are required when the segment may initiate different events, depending on whether the leak is large or small. If mitigating systems are impacted then test intervals and mission times of equipment must also be taken into consideration.

Having calculated the CDF for each segment, the total piping core damage frequency is calculated by summing all the segment CDFs. The Risk-Reduction Worth (RRW) for the segment is calculated as

total _ piping _CDF conditional _ segment _ CDF _ with _ 100% _ reliability

A segment with an RRW greater than 1.005 is considered to be of High Safety Significance (HSS), while those with a RJR.W between 1.001 and 1.005 are usually put to an expert panel, which makes the final risk ranking between HSS and Low Safety Significance (LSS).

To establish the new inspection plan, the segments in the HSS category are sub-divided into two groups: one gathering all those segments where active mechanisms are present, such as FAC, SCC, vibration, thermal stratification, striping, etc., and the other gathering together those segments which only experience benign mechanisms (e.g. low-cycle fatigue), whose failure probability is dominated by design limiting stresses. For the first group all susceptible locations are required to be inspected, while for the second group a sampling process is defined, specifying a minimum number of inspection locations in order to meet a specified level of reliability.

For the LSS segments which experience active degradation mechanisms, it is recommended that the NPP owner continues with ongoing inspection programs associated with the mechanism of concern, while LSS segments with benign mechanisms need only receive standard system pressure tests and visual examinations.

The above described categorisation of HSS and LSS segments is illustrated in the structural element selection matrix, shown in Figure 2 below.

-205- (a) Susceptible locations (100%) High-failure-importance Owner-defined segment program (b) Inspection location selection process 3 1

Low-failure-importance Only system Inspection location Segment pressure test selection process and visual exams 4 2

Low-safety-s ign ificant High-safety-significant segment segment

Figure 2: The structural element selection matrix defines the best suitable inspection program, depending on the segment failure-importance and safety-significance.

5. Establishing the Change in Risk

Once the new ISI program has been established, it may be compared with the current ISI program through the piping failure probabilities calculated by the SRRA code, taking the effect of ISI into consideration. In a similar fashion to that described above, the total piping CDF is calculated, considering ISI, for both the current program and the new one.

In the case of Surry 1 (Figure 3), one RI-ISI program addresses approximately 86% of the piping CDF risk, while the current ASME Section XI program addresses about 53%. Both programs are given credit for existing augmented inspection programs, such as flow accelerated corrosion programs. The percent of piping LERF risk addressed is even more dramatic: approximately 94% for the RI-ISI program versus 20% only in the current Section XI program. This positive result remains unchanged even when one considers the impact of potential operator actions to recover from piping failure events.

-206- 100%

•a 90% -* * A A * *- -* * A w 80% e> 70% I 60% u. 50% g 40%

a.20% 7

0% RC FW BD MS CH AFW HHI CW SW RH CC CS AS LHI ECC RS ACC CN EE FC VS System

-%CDFAUGONLY -%CDFSXI + XI-AUG -%CDFRMS!+RIAUG

Figure 3: The percentage of CDF addressed by the RI-ISI application at Surry 1 [2] is largely higher than the one addressed by traditional inspection plans.

6. Program Monitoring

Risk-informed ISI programs are living programs: they should be monitored continuously to account for changing conditions in the plant. Such monitoring encompasses many facets of feedback or corrective action, including periodic updates based on inputs and changes resulting from plant design features, plant procedures, equipment performance, examination results and individual plant and industry failure information. This feedback and updating is greatly facilitated by the systematic and quantifiable basis of this risk-informed approach, which uses efficient and easy-to-use computational methods.

7. Results

So far, two US plants have carried out full-scope applications of the approach described above for establishing risk-informed ISI programs. One of them has already received NRC approval for implementation. In Europe, several utilities have carried out limited scope pilot projects, concentrating mainly on the Reactor Coolant System (RCS), to assess the effectiveness of the approach [9].

All the studies performed show a clear reduction in the number of examination locations (Table 1). This redistribution of the ISI effort reduces operating costs and radiation exposure to personnel.

For example, for the Surry 1 application, the total savings are around 150 000 $ per year. They are subdivided as follows: 90 000 $ in examination costs, - 10 000 $ per REM, with a reduction of 9 REM per outage. In general, the savings are between 150 000 and 300 000 $ per year.

-207- The studies also show a significant safety increase. For example, the pilot program performed for the Swedish PWR shows a reduction in piping CDF (with operator actions and no'leak detection) from 8.0 to 2.2 10"7/year.

Plant Current Exams Risk-Informed Exams Surry 1 (full-scope) [2] 385 136 Millstone 3 (full-scope) [2] 753 107 Swedish PWR (RCS) [9] 44 34 Swiss PWR (RCS) [9] 69 34

Table 1. Both full-scope and limited RI-ISI applications lead to a potential reduction in the number of examination locations.

8. Conclusion

All the studied applications have shown that the risk-informed approach leads to an overall improvement in the level of plant safety, while at the same time redistributing the ISI effort and thus reducing operating costs and radiation exposure to personnel.

Cost-benefit studies, performed independently for both full-scope applications, show that risk-informed ISI programs can be implemented at a cost that can be returned in one to two years following implementation, depending on the size and age of the unit. Given that aging effects are directly evaluated in the process using a structural reliability/risk assessment tool, significant additional benefits could come from the use of this technology for defining aging management programs and the associated inspection of piping systems as part of plant life extension programs.

In other words, the RI-ISI program is a useful tool to "inspect less, but inspect better".

Acknowledgements

The methodology and results presented in this paper are based on extensive work performed by a team from Westinghouse Energy Systems and the Westinghouse Owners Group, dedicated to the development of risk-informed applications. In particular, the authors would like to recognise K. Balkey, N. Closky, B. Bishop and R. Haessler for their innovation and leadership in this area.

References

[1] American Society of Mechanical Engineers, ASME Boiler & Pressure Vessel Code, Section XI, "Rules for Inservice Inspection of Nuclear Power Plant Components" [2] Westinghouse Energy Systems, 1999, "Westinghouse Owners Group Application of Risk- Informed Methods to Piping Inservice Inspection Topical Report" WCAP-14572,

-208- Revision 1-NP-A. [3] Statens Karnkraftinspektion (SKI), 1996, "The Swedish Nuclear Inspectorate's regulations concerning structural components in nuclear installations, SKIFS 1994:1 including changes in accordance with 1995:1, 1996:1" (Translation) [4] American Society of Mechanical Engineers, 1997, ASME Boiler & Pressure Vessel Code, Code Case N-577, "Risk-Informed Requirements for Class 1, 2 and 3 Piping, Method A, Section XI, Division 1," [5] American Society of Mechanical Engineers, 1997, ASME Boiler & Pressure Vessel Code, Code Case N-578, "Risk-Informed Requirements for Class 1, 2 and 3 Piping, Method B, Section XI, Division 1,". [6] U.S. Nuclear Regulatory Commission, 1998, Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Current Licensing Basis," [7] U.S. Nuclear Regulatory Commission, 1998, Regulatory Guide 1.178, "An Approach for Plant-Specific Risk-Informed Decision Making: Inservice Inspection of Piping," [8] Westinghouse Energy Systems, 1999, "Westinghouse Structural Reliability and Risk Assessment (SRRA) Model for Piping Risk Informed Inservice Inspection" WCAP-14572 Revision 1-NP-A Supplement 1 [9] Wcstinghousc Energy Systems, 1998-1999, unpublished work

-209- CZO129424

EnergiTools®® - A Power Plant

Performance Monitoring and Diagnosis Tool

Pascal V. Ancion Rene Bastien Kjell Ringdahl Westinghouse Electric Europe, Westinghouse Electric Europe, Vattenfall Ringhals Nuclear Boulevard Paepsem 20 Boulevard Paepsem 20 Power Plant B-1070 Brussels, Belgium B-1070 Brussels, Belgium S-430 22 Varobacka, Sweden

relationships. The system also has the ability to use neural Keywords networks for processes that are difficult to model analytically. An application is the estimation of the reactor power in nuclear Causa! networks, diagnosis, bayesian networks, performance plant by interpreting several plant indicators. monitoring.

Abstract EnergiTools® is used for the on-line performance monitoring and diagnostics at Vattenfall Ringhals nuclear power plants in Sweden. It has led to the diagnosis of various performance Throughout the world, power generation organizations are issues with plant components. Two case studies are presented. moving into a more competitive environment. Power plant In this first case, an overestimate of the thermal power due to a operation economics are therefore becoming very important. The industry is now required to optimize the power generation faulty instrument was found, which led to a plant operation of existing plants by increasing the efficiency of equipment and below its optimal power. The paper shows how the problem by chasing "lost megawatts". was discovered, using the analytical thermodynamic calculations. The second case shows an application of EnergiTools® for the diagnostic of a condenser failure using The diagnostic of performance problems has at the same time causal probabilistic graphs. become a more complex and intricate task. Although the behavior of power plant components has not changed, because the physics has remained the same, modern power plants are Introduction complex conglomerates of interactive components, systems, and instruments. Even though modern plant information With the increasing competition in power generation, the systems provide plenty of data, performance engineers have to electrical industry is required to optimize the production at turn it into relevant information using appropriate existing power plants. Investing in new equipment is one methodologies. response to this challenge. Optimizing production by chasing "lost megawatts" in existing installations is, however, a more cost-effective approach. For this reason, performance Westinghouse EnergiTools® is a performance diagnostic tool monitoring and diagnostics are increasingly important. that combines the power of on-line process data acquisition with advanced diagnostics methodologies. The system uses The diagnostics of plant performance are critical to minimize analytical models based on thermodynamic principles plant operational costs. Early detection and diagnosis of combined with knowledge of component diagnostic experts. equipment problems allow the plant staff to quickly implement An issue in modeling expert knowledge is to have a framework corrective actions. This allows the plant to improve megawatt that can represent and process uncertainty in complex systems. production. In addition, maintenance actions can be determined In such environments, it is nearly impossible to build while the plant is still in operation, allowing the plant to have deterministic models for the effects of faults on symptoms. A the necessary replacement parts available prior to an outage. methodology based on causal probabilistic graphs, more Such preventive actions potentially avoid extended specifically on Bayesian belief networks, has been 81 maintenance shutdowns or operation in a degraded condition implemented in EnergiTools to capture the fault-symptom for an extended period of time. relationships. The methodology estimates the likelihood of the various component failures using the fault-symptom

Copyright © 2000 by ASME -211 - Performance monitoring and diagnosis has traditionally relied • For processes that are difficult to model analytically, heavily on the experience and intuition of experts. Recent EnergiTools® has the ability to use neural networks. An advances in diagnostic methodologies and in information example is the estimation for the nuclear reactor power. technologies have enabled the development of innovative Here, a neural network is used to correlate reactor power diagnostic support software tools, like the Westinghouse with key plant measurements. This estimate, along with EnergiTools®, to augment the efforts of these plant experts. other inputs, can be fused to provide the best estimate for reactor power EnergiTools® includes traditional analytical models, which are based on thermodynamic principles. Its use in the context of • A component level diagnostic provides a detailed the traditional performance monitoring and diagnosis will be component level root-cause analysis. This portion of the illustrated in the next section. EnergiTools® also offers several tool uses recent advances in diagnostic methodologies and advanced diagnostic support paradigms: in decision theory. It is actually the main purpose of this paper. The rationale behind this methodology will be • A unit level diagnostic provides a system level view of the described, and the benefits will be illustrated in case plant, where plant-level problems are identified. If there is studies representing realistic operating conditions. a problem, EnergiTools provides an estimate of where the plant's heat rate is being increased. It quantifies each Traditional performance monitoring and intuitive component's performance, the effect of its degradation on diagnosis the heat rate, and the corresponding loss in megawatts. Complex plant configurations are monitored by observing data records from sensors placed at various plant locations. Typically, data is continuously collected, and experts monitor the readings. From these readings, they assess the health of the plant. If there are unusual readings, the experts use their diagnostics skills to determine the cause of the problems. While experts can be good at this detective work, there are problems associated with using human expertise to monitor complex

g| Peifoimance Analysis & Monitoring with Diagnosis - [admin - Ringhals 31 Advanced Model] Unit £)ataset Component Diagnosis Se.tup Calculations Setvices View Options Help B & BASELINE SETS. ]3 Ringhals 31 Advance 3 Or PERFORMANCE SET E ]3 Perl-CondenserPn E S; Component Dii 3 Condenser: ]2 Feedwaler J3 Tuibines IS Q Unit Diagnosis a HEATSALANCE SETS CJ PARAMETER SETS O QUALIFIED SETS

Figure 1: Vattenfall Ringhals 3 model - partial view

-212- temperature over time (figure 4). Since this reflects the pressure systems. A typical application may involve up to several before the turbine first stage, a drop in feedwater temperature hundred sensors, so that the task of real-time monitoring can be would indicate a falling turbine load. overwhelming and could produce unacceptable rates of false alarms or misdiagnosis. Modeling software tools have been developed to help engineers in their diagnosis. Many early Pinnhale A- Praccunn hainra raarttnn hlnrllun 07/Qfl performance evaluation software used only analytical Ringhals 4: Pressure before reaction blading 97/98 methodologies. Those systems were run regularly by 105 T performance engineers with off-line plant data. Besides supporting the performance engineers in the calculations, these 104.5

tools did little to guide their diagnostics activities. As the 104 --.•••; example below illustrates, the diagnostic activities place great reliance on the experience and intuition of plant personnel. 103.5 •'.• ...... '. • C;£;.; 103 In spring 1998, the unit 3 of Vattenfall Ringhals Nuclear Power .1J.O3 190641-04 Plant was already using EnergiTools® for its automatic Figure 3: Turbine first stage inlet pressure performance monitoring. Figure 1 shows the user interface with a small portion of the Ringhals 3 model. The operational Ringhals 4: feedwater temp *C, 97/98 department of Ringhals unit 4 had a feeling they were loosing 222.20 output power. Since units 3 and 4 are twin units, they decided to use unit 3 performance monitoring tool in off-line mode to 222.00 -I analyze the situation of unit 4. '- 221.80 f 221.60 Unfortunately, unit 4 is not very well equipped in terms of E 221.40 •

t- •*•'*••• i instrumentation. The available data was the turbine first stage 221.20 inlet pressure, the feedvvater temperature, the condensate flow, and the feedwater flow. The performance engineer thought that 221.00 the problem could be related to fouled feedwater flow Venturis, which had previously been experienced on unit 3. This was the Figure 4: Feedwater temperature first problem to be analyzed. The approach was to analyze which indications supported the idea of fouled feedwater The final proof that unit 4 was actually loosing output power Venturis. A comparison between the condensate flow and due to a fouled feedvvater venturi came from a calculated heat feedwater flow over time is shown in figure 2. balance. EnergiTools® was used to perform this "what-if" analysis. Issues that can be studied include, for example, how a changed cooling water temperature affects the output power, or Ringhals 4: Feedwater flow/Condensate flow 97/98 how a reduced thermal power affects the output power, as well as pressures and temperatures in the turbine train.

In this particular case study, the idea was to evaluate how well calculated data, with thermal power reduced to 99.5 %, would fit to actual measured data. Of special interest were the following parameters: • turbine first stage inlet pressure, • feedwater temperature, and Figure 2: Feedwater & condensate flow • condensate flow.

1 The comparison indicated that there was actually a mismatch. It turned out that the calculated values from EnergiTools However, more evidence was needed to be able to identify that matched the measured data very well. This made Ringhals the mismatch was related to the Venturis and not to a drift in performance engineer feel confident that there was really a instrumentation for the condensate flow. Hence, the trend of problem with a too low thermal power and that the problem the turbine first stage inlet pressure over time (figure 3) was was related to fouled feedwatcr flow Venturis. The output analyzed. power was about seven megawatts below nominal power.

Since the pressure before the turbine first stage is a very good Since Ringhals unit 4 was approaching outage, arrangements indication of turbine load, it corresponded very well to the were done to clean the Venturis. If the problem had not been condensate flow. Another indication to study was the feedvvater noticed, the plant would have gone back into operation below

-213- nominal power. During one production year, a seven megawatts loss equals to a substantial amount of money!

Automating performance diagnosis

Analytical diagnostic algorithms can be integrated in performance monitoring tools. With the computing power available today, one could think to emulate human experience and intuition by intensive automatic execution of performance calculations with varying plant data.

Unfortunately, such strategies are not good at figuring out multiple failures. Using these methods in conjunction with c regular on-line monitoring, i.e. every few hours, can provide useful information, since multiple failures and degradation rarely occur within a short time frame. Using automatic Figure 5: Condenser faults-symptoms graph analytical methodologies off-line and running them every few weeks or months might provide unreliable results. Over the years, there have been considerable efforts to develop expert systems to diagnose power generation equipment. With Another issue with analytical strategies, such as data a few exceptions, the majority of the systems have relied on qualification methodologies, is that they do not deal well with rule based reasoning. non-linear behaviors, which exist in thermohydraulic processes. Rule based diagnosis Replacing the traditional automatic diagnosis methods with In a rule-based expert system, reasoning is carried out through expert systems can provide information about the underlying the logical chaining of "if-then" rules, which are acquired from causes of problems and give clear indication on the rationale an expert. In the condenser model (figure 5), we would have behind the diagnosis. rules like the following: if "pressure increase" and "cooling water pump amps" Expert system for the performance diagnosis are too high An expert system relies on a knowledge base, which maintains then "condenser fouling" is true a set of rules and relationships between faults and symptoms. Though the language is very simple, it is quite powerful when Usually, symptoms can easily be observed, whereas their modeling experts' reasoning, and several impressive rule based causes, the faults, can not be easily observed. expert systems were constructed. But rule based systems have limitations in the expressiveness of rules. In the condenser The graph below (figure 5) models some of the faults- example, if all the symptoms related to the bad "pump symptoms relationships for a condenser. A possible problem performance" are true, then the inference rule above indicates with a condenser is that the cooling water intake system may that there must also be "condenser fouling"! have accumulated dirt that will affect the flow rate, in turn reducing performance of this component. This failure is called Missing, noisy, or faulty plant data add another degree of condenser fouling and can only be observed directly by visual complexity to the problem. They incorporate uncertainty in the examination of the inside of the component, which would rule-based system, extending the rules to the format: obviously affect the plant operation. The simplified faults- symptoms graph shows two observable symptoms: the higher if "symptom" with certainty x than normal electrical amps consumption for the cooling water then "fault" with certainty y pump and the increase in condenser pressure. Unfortunately, the decision theory proves that it is not possible to capture reasoning under uncertainty with inference rules. Once the faults-symptoms relationship has been~ identified, an The reason is that the inference rules are context free while inference strategy has to be defined. In other words, how does coherent reasoning under uncertainty is sensitive to the context the expert system figure out what set of faults caused an in which facts have been established. In other words, having a observed set of symptoms? symptom with certainty x does not imply that the fault certainty is y, because the fault certainty is impacted by the status of all the other symptoms related to that fault. In addition, what is

-214- known about one fault will also impact the knowledge about other faults have a low (35% for pump performance) or very other faults that share common symptoms. low chance to exist (0.5% for the instrumentation failure).

Bayesian belief network

At first look, the reasoning under uncertainty looks very difficult. However, classical probability theory has been extended to a very precise mathematical framework for decision making. Bayesian Belief Network is such a framework. It uses the concept of a priori and context-sensitive knowledge, as well as conditional probabilities and related inference rules.

Within this framework, our condenser fouling problem (figure 5) would be rewritten as follows. Let's assume that from experience, we have the following a priori knowledge: • a condenser fouling has a probability of 1% [P(f)=0.01] • a pressure increase has a probability of 4% [P(pi)=0.04] Figure 6: Condenser fouling In addition, some context sensitive knowledge relates the faults in the next test case (figure 7), the expert system is presented to the symptoms: with the set of symptoms relevant to the pump performance • the conditional probability to have a pressure problem. Although two of the symptoms are shared by the increase in case of fouling is 99% [p(pi|f)=0.99] condenser fouling fault, the system correctly identifies the pump performance as being the most probable fault (98% Keeping in mind that the observable fact is the symptom certainty). "pressure increase", the Bayesian inference rule provides the probability of the fault, given the symptom:

P(flpi) = P(pi|f) P(f) / P(pi) = 0.99 * 0.01 / 0.04 = 0.25

In other words, when the only observed symptom is that pressure increase is too high, the probability that it is caused by a condenser fouling is only 25%! One might be surprised to have such a low fault certainty. It is actually because having a 4% a priori probability for the pressure increase clearly indicates that this symptom is not caused by only the condenser fouling, which has a much lower a priori probability (1%).

Condenser diagnosis using Bayesian belief network EB8G5S5JBHHE lMRffl?B7*DF Nn I- • Normal The small example above only has one fault and its single |l 2.94 Yes symptom. This is appropriate to present the theory, but it does not really demonstrate the power of the concept. Let's apply Bayesian belief network to the condenser diagnosis, using the Figure 7: Poor pump performance faults-symptoms graph presented in figure 5 together with appropriate probabilities. In real operating condition, faulty or noisy instruments may produce erroneous symptoms. In some cases, for example Bayesian belief network produces appropriate fault diagnosis when some sensors are not available, symptoms might be when presented with sets of complete and coherent symptoms. missing. In such conditions, many diagnosis systems might In Figure 6, the expert system is presented with symptoms of produce wrong conclusions. As will be illustrated below, our condenser fouling. The conclusion is that there is a high Bayesian belief network framework also provides realistic likelihood (64%) that condenser fouling exists, whereas the diagnosis in this type of situation.

Copyright © 2000 by ASME -215 - The condenser pressure increase is normal (i.e. no pressure increase), whereas the other symptoms are clearly present. As demonstrated in figure 8, the expert system maintains a diagnostic similar to the previous case (figure 7). The pump performance is still considered to be the most probable fault, with however a lower probability (78% versus 98%).

Figure 8: Poor pump performance with one wrong symptom

In the first case, an erroneous symptom has been introduced.

Fig. 9: Condenser fouling symptoms with one observed fault

Component Causes [ Peif-CondenseiPiobtem ] • | Condense* ]

Unit Configuration Name|Rir*jnak 31 Advanced Model Parameter Dataset Name Ringhals 31 Advanced ModelParamset

Component Name Condensej Baseline Name Ringhals 31 Advanced Model-Baseline

Component Descriptionlcondenser

Performance Dataset Name|Per[-CondemeiProblem

Performance Dataset Description|Condemet Problem

|- Rool Causes • • Root Cause Probability Micro Fouling 0,285 Macro Fouling 0,285 Poor Pump Performance ! 0,243 Vacuum Pump Problem 0.004 Air in Leakage 0.004 High Hot Well Level 0.003 Id - Related Symptoms - Component Name Symptom Magnitude Condenser CooSng Water Pump Showing High TDH Condenser Cooling Water Pump Showing High AMPS Condense; % increase in Condenser Pressure 60,407 Condenser A Priori ProbabSJy of Poor Pump

View Root Cause Graph.. View Distribution Giaph... View Relation Graph... Close Piint

Fig. 10: Condenser fault diagnosis

-216- Cause Symptom Relationship

Un« Configuration Name [Ringhals 31 Advanced Mode) Parameter Set Name: |Rnghab31 Advanced Model-Para

Component Name: |Conderuer Baseline Name: [Ringhats 31 Advanced Model-Basel

Component Description: Condenser

Performance Set Name:, jPerf-CondenserProWem

Performance Set Description Condenser Problem

Root Cause: Poor Pump Performance

Stales

Component N ame: jCondenser 1.2S00- i Symptom! Cooling Water Pump Showing High-H | 0.6100- 020 020 020 020 020 ' -0.0300 Weight [1-000 States

Component Name: I Condense! 12500-

Symptom:[ Cooling Water Pump Showing High-^j | .0.6100- 020 020 020 020 020 Weight J0.390 C -oxaoo Stales

Component Name: Condense! 12500- i >

Symptom: X Increase in Condenser Pressure • I 0.6100- 0.00 0.00 0.00 0.00 Weight J0.878 -0.0300 States I

Close Print

Fig. 11: Poor pump performance with too high condenser pressure and other symptoms unobserved symptoms are defined than in the previous section example. A second test case shows a situation where some a priori Nevertheless, in this particular case, the three potential faults knowledge is existing about faults. It is known for a fact that identified by EnergiTools® relate to the pump performance the instrumentation is out of order. Figure 9 shows how the and fouling. The faults-symptoms relationships are similar to expert system reacts when presented with the set of symptoms those previously identified (figure 5). associated with the condenser fouling. The conclusions are similar to the case of figure 6, but with reduced certainty. The 9 condenser fouling fault is now credited with 39% probability The next step is to verify why EnergiTools believes that the versus 64% in figure 6. faults are relevant. This is accomplished by looking at the associated symptoms. Figure 11 shows the symptoms associated with the pump performance fault. Note that five Bayesian Belief Network in EnergiTools® states (normal, low, medium, high, and very high fault) are used for each fault or symptom. This allows for a finer tuning The Bayesian Belief Network framework has been than when an item is either true or false. It appears that the 31 implemented into EnergiTools to support the component possibility of a pump performance problem was mainly diagnosis functionality. A diagnosis scenario using derived from the very high increase in condenser pressure. EnergiTools3 will be described. The graceful behavior in case The two other symptoms for the pump performance are of missing or erroneous symptoms will be illustrated as well actually unknown (20% chance for any of the five states), as the process of refining the diagnosis. because they are not instrumented or their measured values were rejected due to an instrumentation failure. Figure 10 illustrates a condenser fault diagnosis, as produced for a practical case by EnergiTools®. More faults and

-217- The diagnosis engineer has then to figure out possible values amps" is somewhat high, he could manually enter a for the missing symptoms. If he finds out that the "pump distribution for this symptom, as illustrated in figure 12.

Distribution Symptom: Coding Waiet Pump Showing High AMPS

Likelihood 0-800 States

Fig. 12: Setting an observed symptom - CW pump Amps too high

-Root Causes- Root Cause k Probability Macro Fouling 0.5S3 Poor Pump Performance 0,475 Micro Fouling 0,047 Vacuum Pump Problem 0,001 Air in Leakage 0,001 High Hot Well Level 0,001 zl

Fig. 13: Condenser fault probabilities with high CW pump amps symptom

Running the diagnosis with this additional fact yields a new If the diagnosis engineer finds out that the "pump amps" is fault distribution (figure 13) with two highly probable faults: normal, EnergiTools® would provide another fault macro fouling and pump performance. distribution (figure 14). This time, the only fault to be considered is the condenser micro fouling.

-Root Causes- Root Cause ^\ Probability Micro Fouling "* 0,515 Vacuum Pump Problem 0,006 Air in Leakage 0,006 High Hot Well Level 0,005 Macro Fouling 0.004 Poor Pump Performance 0,003 zl Fig. 14: Condenser fault probabilities with CVV pump amps symptom set to normal

-218- Conclusion

With the increasing competition in power generation, the issue REFERENCES of performance monitoring and diagnosis is becoming 1. F. V. Jensen (Aalborg University, Denmark), 1998, increasingly important. Performance monitoring and diagnosis "An Introduction to Bayesian Networks", UCL Press, has traditionally relied heavily on experience and intuition of ISBN 1-85728-332-5. experts. Recent advances in diagnostic methodologies and in 2. M. Morjaria, F. Santosa, 1996, "Monitoring Complex information technologies have enabled the development of Systems with Causal Networks", IEEE innovative diagnostic support software tools, such as the Computational Science and Engineering, Winter Westinghouse EnergiTools®. 1996, pp. 9-10. 3. C. Rojas-Guzman, M. A. Kramer, 1993. EnergiTools® includes traditional analytical models, based on "Comparison of Belief Networks and Rule-based thermodynamic principles, for the performance calculation Expert Systems for Fault Diagnosis of Chemical and identification of possible component performance Processes", Engineering Application Artificial degradation. Several artificial intelligence paradigms have Intelligence, vol. 6, no. 3, pp. 191-202. been integrated to support the root-cause diagnostic activities. 4. S. Alag, M. Hunt, A. Mehta, K. Jeyarasasingam and One of the techniques used for the component diagnostic is P. Jain, 1998, "A Diagnostic System for Health based on the Bayesian Belief Network. Monitoring of Power Generation Equipment", Proceedings of ASCE, Engineering Mechanics: A Case studies based on data from the Vattenfall Ringhals Force for the 21st Century, La Jolla, CA, May 17 -20 nuclear power plants in Sweden are presented in this paper. 1998. Those practical examples demonstrate how well the EnergiTools3 component diagnostic handles multiple faults and uncertainty, and how it provides realistic diagnosis even when only a subset of the possible observations is available. The Bayesian belief network framework brings a very useful contribution to the chase for "lost megawatts".

Acknowledgement

This paper was originally written for the ICONE8 conference in Baltimore in April 2000. We thank ASME to have given us the right to present the paper at the Prague conference. The copyright, however, remains to ASME.

-219- CZO129425

EXPERIMENTAL STUDY OF HYDRODYNAMICALLY INDUCED VIBRATIONAL PROCESSES IN WER-440 FUEL ASSEMBLIES

Vladimir I. Solonin, D.Sc, professor, Vladimir V. Perevezentsev, Ph.D., assistant professor, Nickolai F. Rekshnya, assistant professor, Veniamin G. Krapivtsev, Ph.D., assistant professor

Bauman Moscow State Technical University Department of Nuclear Science and Technology 5, 2nd Baumanskaya St., 107005, Moscow, Russia Phone: 7 (095) 263 6579; 7 (095) 263 6207; fax: 7 (095) 267 48 44; E-mail: [email protected]

One of critical issues associated with increasing safety and reliability of nuclear power reactors consists in restraining the hydrodynamic influence of the coolant flow onto enclosed structural elements and originating at that vibrational loads applied to the above structural elements. These issues are of great importance especially for fuel assemblies and fuel rods. High amplitudes of vibrations of fuel rods in the bundle that undergoes the parallel coolant flow result in considerable dynamic loads and mechanical wear of fuel rod claddings in areas, where the spacing grids are installed. Regarding the above described, one of directions to perfect the fuel assembly design deals with the problem of lowering the hydrodynamic and vibrational loads on elements of fuel assembly. In order to resolve the issue, one should need a data on hydrodynamic processes at turbulent flow of coolant in the fuel assembly and parameters of vibrations arising at that. Nowadays the most reliable data can be obtained only in experimental studies of these processes that are performed at the full-scale dummies of fuel assemblies. In the present investigation, the hydrodynamically induced vibrations in a single fuel assembly of VVER-440 reactor were studied using a geometrically full-scale dummy installed in the closed circuit test facility. The hydrodynamic test facility represents a closed water loop with following performances: static pressure - up to 0,5 MPa; temperature of distilled water - 1O...5O°C; volume flow rate - up to 200 mVh. The flow velocity inside the fuel assembly at maximum flow rate has reached the value of about 6 m/s. Distilled water inside the loop is circulated by an impeller pump. The dummy fuel assembly is installed inside the vertical cylinder - "test section" of the loop. The test section is designed to provide the fastening conditions for the fuel assembly head and tail (top and bottom nozzles), which are similar to those in real reactor. In order to reduce the excitation factor from the working electric impeller pump, there are flexible sections

-221 - embedded into the test facility circuit. The hydrodynamic test facility and its performances are described in details in paper [1]. .- Geometrically full-scale dummies of operational fuel assembly of WER-440 reactor have been tested. The parameters of above models are as follows: outer diameter of fuel rod tubes (claddings) - 9,15 mm; supporting honeycomb grid and spacing grids have height of ~ 11 mm (11 grids); the fuel assembly case represents a hexagon tube with thickness of wall equal to 1,5 mm. The dummy fuel assembly was fastened inside the test section as illustrated in Fig. 1. The experiments covered the measurements of vibro-accelerations of three dummy fuel elements located in central zone and peripheral zones of the fuel assembly (Fig. 2), vibro-accelerations of fuel assembly case and test section of the experimental loop. The diagnosed dummy fuel elements were filled with simulators of fuel pellets. Those simulators have mass and outer geometrical dimensions same as real pellets. The rest of fuel rod tubes did not contain simulators of fuel pellets.

Fig. 1. Conceptual scheme of dummy assembly Fig. 2. Cross section of VVER-440 dummy fastening in "test section" of hydrodynamic test assembly. Scheme of arrangement of vibro- facility accelerometers in fuel tubes and on the case

The experimental study involved usage of piezoelectric and tensoresistive accelerometers and tensoresistive pressure pulsation sensors. Two-component piezoelectric or tensoresistive accelerometers were installed inside the fuel rod tubes and fixed at the inner cladding surface by split terminals or fluorocarbon-polymer bushes. The internal volume of the fuel rod tube containing the accelerometer was filled with simulators of fuel pellets, i.e. the accelerometer was placed into the structure of column of simulators "splitting" it into two parts - bottom and top. The cable from the accelerometer was laid through the central holes of simulators of fuel pellets and led out through the removable end-plug of the fuel rod tube. Tensometric accelerometers were also attached to the outer surface of case by means of special clamps. The pressure

-222- pulsations were measured by tensoresistive sensors on the inner surface of the bottom nozzle of the fuel assembly in front of the supporting grid and on the inner surface of one of case facets. The so-called "pulse holes" by diameter of 1 mm were connected to the sensors through metal pipes by inner diameter of 4 mm and length of 50 mm. The conducted analysis has demonstrated that such connecting line does not introduce any distortions into the measured signal in the frequency range of up to 2000 Hz. The mentioned frequency range corresponds to the conditions of performed investigation. The informational and measuring system has allowed registering and processing the signals from the primary transducers that were received at inputs of analog-digital converters. The sampling frequency was equal up to 2 kHz when using 16 channels simultaneously or up to 40 kHz when working with one channel only. The software that was used for statistical processing of experimental data allowed to obtain the time-base realizations of vibro- accelerations and pressure oscillations, estimate their root-mean-square values, conduct the spectrum analysis and determine the autocorrelation and cross-correlation functions. The data on hydrodynamic loads applied to the bundle of fuel rods and fuel assembly case was obtained by measuring pressure oscillations in front of the supporting grid and on the inner surface of the fuel assembly case. Pressure oscillations were measured in different cross- sections along the height. Amplitude-velocity and spectral parameters of pressure pulsations were measured in the experimental runs. Fig. 3 demonstrates the distribution of root-mean- square values of pressure pulsations versus fuel rod bundle length in the dummy assembly. The levels of pressure pulsations p in general frequency band in front of the supporting grid at maximum coolant flow velocity in the fuel rod bundle of- 6 m/s reached the values of- 4 kPa.

pv'2 Based on ratio p' ~——, the latter value corresponds to the value of pulsation velocity approximately equal to 2,8 m/s.

4.5 o oV=4.25m/ 1 o—3 V=5.95m/ 1 A 77" \ 3.J i 3

2.£ -^ i ^ Fig. 3. Distribution of root-mean-square 1 \ 2 pressure pulsations along the fuel rod bundl 500 1000 1500 2000 2500 Z, mm

-223- Thus the relative root-mean-square values of pressure pulsations (with respect to the dynamic head) in front of the supporting grid, i.e. beyond the bottom nozzle, were equivalent to more than 20 %. As the coolant flows inside the fuel rod bundle, the pressure pulsations are decreasing. They are lowering monotonically right up to the cross section z = 1460 mm in the area between sixth and seventh spacing grids. Then the tendency of some increase in pressure pulsations is observed, i.e. the generation of pulsation energy predominates over the dissipation processes. At the exit from the bundle, the levels of pressure pulsations diminish again. That might be associated with decrease of averaged velocity of the jet flow, which is formed behind the bundle. The regularity of dissipation of pulsation energy is defined by the internal structure of the flow that evolves behind the supporting grid and presence of spacing grids installed along the bundle height. The spacing grids appear to be the local sources of pulsation energy, and their contribution is proportional to the pressure losses in them. Taking into account that the spacing grids have relatively low hydraulic resistances, their contribution into generation of the pulsation energy is insignificant. That contribution does not define the regularity of distribution of root- mean-square pressure pulsations along the fuel rod bundle. The spectral distribution of pressure pulsations in front of the supporting grid (Fig. 4) shows that the most part of their energy is concentrated in the low-frequency area (/"< 40 Hz). The narrow-band resonances at the rotational frequency of the pump (25 Hz) and frequency of 13 Hz stand out against the background. The 13 Hz-peak is caused by propagation of hydrodynamic disturbances through all the loop circuit. Those disturbances arc induced by the entire dummy assembly, which oscillates in the "test section" filled with water.

kPa-IHz

Fig. 4. Absolute spectral densities of pressure pulsations in front of the support grid of dummy fuel assembly a _ V = 4.25 m/s; b - V = 5.95 m/s

-224- As coolant flows inside the fuel rod bundle, the above resonances in spectra of pressure pulsations persist. In comparison with pressure pulsations in front of the supporting grid, the higher frequencies start to bring in more contribution into the energy of pulsation (Fig. 5).

0.8 13 kfe/Hz 0.7

0.6 25

0.5

0.4 / •

0.3 0.2 \ J 36 a 0.1 V n 1 frequencyk..., Hz 10 10' frequency. Hz

Fig. 5. Absolute spectral densities of pressure pulsations in the region of the third span of the fuel rod bundle a - V = 4.25 m/s; b - V = 5.95 ni/s

Fig. 6 illustrates the distribution of vibro-accelerations along the case of dummy assembly. The results of measurements demonstrate that the vibro-accelerations along the axis, which is perpendicular to the case facet, are essentially higher than vibro-accelerations along the axis, which is parallel to the case facet. The bending stiffness of a thin-walled hexagon tube is almost the same along any direction, since moments of inertia along x and y -axes disagree

negligibly: Ix ~ I .

3.4 i a 32

2.8 2.6 r~ i i \ 1000 1500 1000 1500 z, mm z. mm Fig. 6. Distribution of root-mean-square vibro-accelerations along the dummy fuel assembly case a - perpendicular to the case facet (x-axis); b — in parallel to the case facet (y-axis)

Therefore, the registered differences in vibro-accelerations might be caused by shell oscillations for which the deformation of case facet along x-axis is much greater than that along y-axis. The above assumption was confirmed by measuring the vibrations of the case facets. The

-225- measuring axes of installed at the case facet vibro-accelerometer were respectively oriented towards x and y directions (Fig. 2). The accelerometer shows higher values of vibro- accelerations along x-axis, i.e. along the direction, which is perpendicular to the case facet. The observed diminution of intensity of fuel assembly case vibrations along the flow is caused by the registered dissipation of pulsation energy of the coolant and decrease in pressure pulsations. That is why the pressure pulsations define the hydrodynamic loads on the case and fuel assembly as a whole. Vibro displacements were determined by double integrating the vibro-accelerations that were obtained in the runs of experimental study. In order to exclude the errors associated with high level of background noises of the measurement lines with vibro-accelerometers in the low- frequency area, the lower boundary of the frequency range of vibro-displacements was equivalent to 10 Hz. The data presented in Fig. 7 demonstrates the levels and behavior of vibro- displacements along the fuel assembly case. Despite of vibro-accelerations, vibro-displacements demonstrate a non-monotonic behavior versus fuel assembly length. The highest root-mean- square values of vibro-displacements are observed in the bottom part of the fuel assembly (near bottom nozzle) and near top nozzle. For example, when the flow velocity in the fuel assembly equals to 5,95 m/s, the root-mean-square values of vibro-displacements of the case along x-axis at the level of midpoint of the first span of the fuel rod bundle are equal approximately to 20 //m, and near the top nozzle they exceed the value of 17//m. At the same time the minimum values of vibro-displacements along the same axis were registered in the area of the third span of the bundle. Those values are equal approximately to 13//m .

1000 1500 1000 1500 2, mm z, mm Fig. 7. Distribution of root-mean-square vibro-displacements along the dummy fuel assembly case a - perpendicular to the case facet (x-axis); b - in parallel to the case facet (y-axis)

-226- The spectra of vibro-displacements of the fuel assembly case testify to the fact that the essential contribution is brought in by the relatively low-frequency range (lower than 40 Hz). At the same time, the clearly outstanding against the background resonances are registered at frequencies of 11... 12 Hz and 15... 17 Hz. Besides, the spectral levels are getting higher at frequencies that are closer to the rotational frequency of the circulating pump (25 Hz). Analysis of data on behavior of vibro-displacements along the fuel assembly allows making a conclusion that oscillations of supporting elements of the fuel assembly structure also appear to be a source of vibro-displacements. The vibro-displacements of individual fuel rod tubes differ essentially. That is associated both with unequal conditions of their streamlining by the coolant flow and with influence of bending oscillations of the entire bundle resulting in different displacements of peripheral and central tubes. Fig. 8 illustrates the root-mean-square values of vibro-displacements of fuel rod tubes in different cross-sections along the bundle at flow velocity of 4,25 m/s. The maximum root-mean-square vibro-displacements, equivalent approximately to 140//m, were observed in the line of x-axis for the peripheral fuel rod in the corner in the cross-section located at the midpoint of the last span of the bundle. The minimum root-mean-square vibro-displacements (~ 15//m) - were observed for the fuel rod located in the first row from the central tube in the line of 7-axis. For all fuel rod tubes, the highest vibro-displacements are observed for the last span of the bundle. It can be seen clearly that the vibro-displacements diminish contiguously to the spacing grids. As a rule, the smallest values of vibro-displacements in the line of both directions are observed for the fuel rod tube located in the first row {x, and y,) near the central tube of the fuel assembly. The vibro-displacements in the line of x-axis, i.e. perpendicular to the case facet, exceed the respective values in the line of^-axis, i.e. in parallel to the case facet.

0 0 xl <3 0 y1 & £. x2 Q • >2

Fig. 8. Distribution of root-mean- square vibro-displacements along the • i i i i fuel rod bundle of dummy assembly f 1000 1500 z. mm (coolant flow velocity V = 4.25 m/s)

-227- Resonance at frequencies of 11 and 13... 15 Hz are predominant in spectra of vibro- displacements of the fuel rod tubes. Those resonances are stipulated respectively by oscillations of the "test section" at natural frequency and bending oscillations of the fuel assembly as a whole (Fig. 9). The vibrations of the fuel rod tubes are also excited at higher frequencies (up to 40.. .45 Hz) but with significantly lower spectrum levels.

x10

G6, m2/Hz

frequency. Hz

mVHz

frequency. Hz

x 10

nr/Hz

10 frequency, Hz frequency, Hz

Fig. 9. Absolute spectral densities of vibro-displacements of fuel rods of dummy assembly

-228- in the region of the third span (coolant flow velocity V = 4.25 m/s)

All the spectra contain a resonance at 25 Hz caused by the rotational frequency of the circulating impeller pump. The increase of spectrum levels at frequencies of 32... 36 and 45 Hz happens due to excitation of higher-frequency (in comparison with fundamental mode) oscillations of the fuel rod bundle either together with the case or just the bundle itself. We should mention that for the free oscillations of some individual fuel rods the natural frequencies turn out to be essentially higher (~ 200 Hz), but this frequency range does not bring any significant contribution into the vibro-displacements. Therefore the induced by the coolant flow vibrations of the fuel rods can be identified as predominantly bending oscillations of the entire fuel rod bundle.

References

1. Experimental study of hydrodynamic influence of the coolant flow on the structural elements of VVER-440 fuel assemblies. /A. K. Panyushkin, G. G. Potoskaev, V. I. Solonin et al.- Hydrodynamics and Safety of Nuclear Power Plants: Thesis of industrial-branch conference "Thermal Physics-99", Obninsk, Russia, 1999. - pp. 306-308.

-229- CZ0129426 Analysis of WWER 1000 SG Cold Collector Cracking

K. Matocha, J. Wozniak Institute of Material Engineering Research and Development Division Vitkovice, J.S.C., Ostrava, Czech Rep.

Introduction

In 1986 steam generator cold collector cracking was first detected at WWER 1000 units made and operated in the former Soviet Union. The causes of collector cracking have been identified as environmentally assisted cracking of low alloy bainitic steel of type 10NiMo8.5 (10GN2MFA) in secondary side water environment at about 290 °C. A lot of steam generators under operation have not shown this type of cracking, hence the plant specific operational practices and or manufacturing procedures to be related to its occurrence. Investigations over the last 15 years have indicated that in bainitic low alloy steel/high temperature water environment systems subcritical crack growth is significantly affected by sulphur content, MnS inclusion type, shape and orientation, dissolved oxygen content, stress/time pattern and temperature [1]. Very long term operation at about 300°C could result in thermal ageing of 10NiMo8.5 (10GN2MFA) steel because of its higher content of Ni. Due to the plastic deformation of ligaments between holes in perforated area of collector strain ageing could occur in these regions during operation of steam generator. As a result of recommendations summarized in the final report of consultants' meetings on ,,Steam Generator Collector Integrity of WWER 1000 Reactors" held in Vienna in 1993 [2] large experimental program was started in VITKOVICE focused on: 1. A detailed study of strain and thermal ageing and dissolved oxygen content on subcritical crack growth in 10NiMo8.5 (10GN2MFA) steel. 2. A detailed study of the effect of high temperature water and tube expansion technology on fracture behaviour of ligaments between holes for heat exchange tubes. 3. A detailed study of the effect of drilling, tube expansion technology and heat treatment on residual stresses on the surface of holes for heat exchange tubes. The aim of all these investigations was to find a dominant damage mechanism responsible for collector cracking to be able to judge the efficiency of implemented modifications and suggested countermeasures and to answer a very important question whether proper operation conditions (mainly water chemistry) make the operation of steam generators made in VITKOVICE safe throughout the planned lifetime.

Test material and experimental techniques

To study the effect of thermal and strain ageing and dissolved oxygen content on subcritical crack growth, the 53x12x290 mm bars were cut from a collector forging. Its chemical composition is shown in Tab. I.

Table I. Chemical composition of studied heat of 10NiMo8.5 steel (wt.%)

c Mn Si Ni Cr Mo V P S Cu Ti 1 0,97 0,24 1,97 0,21 0,46 0,03 0,009 0,007 0,072 0,005

One third of the bars was deformed in tension at a deformation rate of sat = 1.10"V. When 5% plastic deformation was reached, the load was removed. Then the samples were aged for two hours at 250°C. The test specimens manufactured from the bars were oriented such that the crack

-231 - propagation plane was perpendicular to the direction of plastic deformation. The second part of the bars was taken through a step cooling from 595 °C used to simulate long term service at operating temperature. Tensile properties of the studied structure states are summarized in Tab. II.'

Table II. Summary of tensile properties at laboratory temperature.

Re RpO,2 R. A5 Z [MPa] [MPa] [MPa] r%i r%i as received 532 631 25,0 69 condition state after ageing 742 742 12,4 66 5% + 250°C/2h after step cooling 547 647 25,2 74

It is evident from tab. II that step cooling had no detrimental effect on tensile properties at laboratory temperature. However severe loss of impact toughness and shift of transition temperature was observed after this heat treatment, see Fig. 1. This is due to significant occurrence of intergranular fracture mode, attributed to segregation of impurity elements, in our case mainly P, to prior austenite grain boundaries [3]. To determine the effect of a tube expansion technology on a fracture behaviour of ligaments and to compare the effect of drilling and tube expansion technology on residual stresses on the holes surface the tubes were expanded into experimental blocks shown in Fig. 2a using both explosive and hydraulic expansion technology. Thickness of ligaments between adjacent holes has corresponded to that observed in a half of a collector wall thickness. Then the experimental blocks were cut, like schematically shown in Fig. 2a, and special C(T) specimens were manufactured (see Fig. 2b), and fatigue precracked in air. X-ray diffraction analysis was used to measure both axial and tangential residual stresses on holes surface. Fracture mechanics tests in air were carried out at 290°C on MTS 500kN servohydraulic testing machine in stroke control at a displacement rate of 0,5 mm/min. Slow strain rate tests of C(T) specimens at 290°C were performed at a displacement rate of 0,001 mm/min, to determine the effect of water environment on fracture behaviour. Both fatigue and fracture mechanics tests in high temperature water were performed on an INOVA servohydraulic testing machine fitted with an 111 litre static autoclave at two significantly different dissolved oxygen contents:

1. oxygen content corresponding at the beginning of the test to aerated or oxygenated water,

2. oxygen content corresponding to deaerated water.

Results and Discussion

Fracture behaviour of ligaments between holes for heat exchange tubes To be able to judge the possibility of a catastrophic break of a collector in a quantitative manner the fracture behaviour of ligaments at operating temperature has to be known. For this reason fracture behaviour of ligaments was investigated in air at 290 °C. The aim of these experiments was to verify the effect of tube expansion technology on the fracture behaviour characteristics. As the characteristic feature of fracture behaviour of 10NiMo8.5 steel at temperatures from 20 °C to 320 °C was found to be a ductile stable crack growth the variation in J

-232- and 6 with crack growth Aa (J-R, 8-R curves) was investigated using multiple specimen method [8]. Tests in air were carried out in a stroke control at the speed of 0,5 rnm/min corresponding to the strain rate for dynamic strain ageing phenomenon [9]. Fig. 3 shows the J-R and 5-R curves obtained in air at 290 °C. No effect of tube expansion technology was found. The values of Jo ] and 50, were expressed like stress intensity factors KQ,

K5C- The calculated values of KCJ and K5C are approximately the same like those obtained at laboratory temperature and at 250°C [10]. Therefore operating temperature of cold collector corresponds to the upper shelf region of fracture behaviour of 10NiMo8.5 steel.

The effect of dissolved oxygen on subcritical crack growth in water environment at 290 °C

The results of fatigue crack growth rate measurements in air at room temperature are plotted against AK in Fig. 4 [4]. It could be reasoned that neither the threshold value for the fatigue crack propagation AK,h, nor the dependence of da/dN vers. AK are affected by strain ageing in spite of the significant differences in mechanical properties of studied steel in as received condition and after strain ageing. Fractographic analyses of the fracture surfaces of failed specimens provide evidence that micromechanism of failure is not affected by strain ageing as well. Changing AK produced no significant change in micromorphology. Fields of strations and occurrence of transverse microcracks are considered to be typical microfractographic features. Results of fatigue crack growth rate measurements in air and oxygenated water environment at 290 °C as a function are AK of given Fig. 5 which shows a significant enhancement of fatigue crack growth rates compared with those in an air environment. Increasing the frequency of cyclic loading significantly lowered the kinetics of crack growth in water. Experimental data fit very well with modified anodic dissolution/film rupture model [5]. Provided that the dissolved oxygen content was lowered significantly (see Fig. 6), no effect of the water environment was observed. Fig. 7 shows 5-R curves obtained in water environment at 250 °C and 290 °C in aerated (O2 > 5ppm) and de-aerated water (O2 < 10 ppb) using increasing displacement tests of precracked C(T) specimens, at displacement rate of 0,001 mm/min. As the experimental data obtained in deaerated water fit well with 8 - R curves gained in air, SCC is not induced in the environment. However in the case of testing in aerated water environment, remarkably lower 5-R curves, compared with those of air, were obtained, confirming the susceptibility of the studied steel to SCC in the presence of oxidant at water temperatures higher than or equal to 250°C. From the quantitative point of view, the following differences were revealed by fractographic analysis of fracture surfaces produced by stable crack growth in aerated and deaerated water: 1. Vertical roughness of fracture surfaces produced in deaerated water is lower compared with that produced in aerated water. 2. Fracture morphology was characterized by the occurrence of areas with crack arrest markings separated by steps or secondary cracks. Distances between crack arrest markings produced on fracture surfaces in de-aerated water are shorter.

The effect of tube expansion technology on the residual stresses on the surfaces of holes

X-ray diffraction analysis was used for measuring residual stresses on the surfaces of holes for heat exchange tubes. The test pieces were cutted from central parts of experimental blocks (see Fig. 2c). The results of axial and tangential residual stresses measurements are summarized in tab. Ill and tab. IV. The obtained results show that an appropriate drilling technology results in compressive stresses on the hole surface lowering the probability of crack initiation. While explosive expansion technology produces tensile residual stresses, protective compressive stresses

-233- are lowered significantly by low temperature heat treatment (450°C/24h). On the other hand this heat treatment have little effect on the level of tangential tensile stresses produced by explosive expansion technology. But the level of tangential stresses is the driving force for environmentally assisted cracking of ligaments.

Tab. HI: The effect of drilling and expansion technology on the level of tangential residual stresses as received condition after 290 °C/24h after 450 °C/24h after drilling -204 MPa -100 MPa -37 MPa after hydraulic -308 MPa -262 MPa -60 MPa expansion after explosive 131 MPa 89 MPa 205 MPa expansion

Tab. IV: The effect of drilling and expansion technology on the level of axial residual stresses as received condition after 290 °C/24h after 450 °C/24h after drilling -204 MPa -264 MPa 27 MPa after hydraulic -658 MPa -249 MPa -54 MPa expansion after explosive 164 MPa 152 MPa -21 MPa expansion

Conclusions

From the results obtained in this study it follows that: 1) Strain ageing of 10NiMo8.5 steel affected neither the threshold value K,h nor the dependence of the fatigue crack growth rate on AK. 2) A reasonable agreement between anodic dissolution/film rupture model proposed by Ford and Andresen and experimental data obtained at 295 ° C was noted. 3) Oxygen dissolved in water affects significantly the kinetics of fatigue crack growth behaviour. 4) Tube expansion technology doesn't affect fracture behaviour of ligaments both at 290°C and 320°C. 5) Operating temperature of cold collectors correspond to the upper shelf region of fracture behaviour of 10NiMo8.5 steel. 6) High temperature oxygenated water lower significantly 5-R curve compared with that in air. 7) Provided that the dissolved oxygen content was kept below 10 ppb no effect of water environment on fracture behaviour was found. 8) Appropriate drilling technology results in comprcssive stresses on the hole surface lowering the probability of crack initiation. 9) While explosive expansion technology produces tensile residual stresses, protective compressive stresses are produced by hydraulic expansion technology.

References

[1] FORD, F. P.: 3 Mechanisms of Environmentally Assisted Cracking. Int. J. Pres. Ves. and Piping 40 (1989), p.343. [2] IAEA extrabudgetary programme on the safety of WWER NPPs. Final report of the consultans'meetings on steam generator collector integrity of WWER-1000 reactors. Vienna, May 1993, WWER-RD-0057. [3] OHTANI, H.-McMAHON, C. J.: Modes of Fracture in Temper Embrittled Steels. Acta Meallurgica, Vol. 23, 1975, p.377.

-234- [4] MATOCHA, K.-WOZNIAK, J.- SIEGL, J.: The Effect of Strain Ageing on the Propagation of Fatigue Crack in NiMoV Alloy Steel. In: Proc. of the IAEA Specialists Meeting on Thermal and Mechanical Degradation in Reactor Materials. Abington 19-21 November (1991), p. 167. [5] JAHNS, J.: The Corrosion Mechanical Damage of Low Alloy Steel of Type 10GN2MFA (10NiMo8.5) in Secondary Side Water Environment at 290°C, (in Czech.). Research and Development Division Report, CZ-10/96, Vitkovice, J.S.C., March, (1996). [6] HIRT, J. P.: Metallurgical Transactions A, Vol. 11A, (1980), p.86. [7] MATOCHA, K.- WOZNIAK, J.- JAHNS, J.- SIEGL. J - NEDBAL, I.: Subcritical Crack Growth Behaviour of 10NiMo8.5 Steel Type a 508 Cl. 3a Steel in Air and High Temperature Water. In: Proc. of seventh Int. Symp. on Environmental Degradation of Materials in Nuclear Power Systems - Water Reactors. Breckenridge, Colorado, Vol. 2, p. 1169. [8] ESIS Procedure for determining the fracture behaviour of materials. ESIS P2-92, January 1992. [9] KIM, I. S.: Dynamic Strain Ageing Effect on Fracture Toughness of Vessel Steels. Presented at IAEA Technical Committee Meeting on Materials for advanced Water-cooled Reactors, Plzen, 14-17 May 1991, Czech Rep. [10] MATOCHA, K. - WOZNIAK, J.: The Effect of Strain Ageing on Fracture Behaviour in Air and High Temperature Water at Operating Temperatures of Collectors, (in Czech), Report of Research and Development Div., VITKOVICE, J.S.C., CZ-50/95, June, 1995.

10NiMo8.5 0.7 10NiMo6.5 AlR.290°C crosshead speed 0.5mm/min.

d~o] =0.207 mm o.i. 1/2 Krf-c=201HPam

0.2 -

O hydraulic • explosive O after drilling

0.1 0.05 0.1 0.2 0.3 0.5 1.0 A almmi

650 Q

500 - o

J = 193 N/mm 0.1 = 202 MPam'2

300 O • o

200 - o AS RECEIVED CONO, o hydraulic • AFTER STEPCOOLING explosive • alter drilling

f i -80 -60 -i0 -20 0 20 A0 60 nn 0.C5 01 0.2 0.3 0.5

Fig. 1 Fig. 3

-235- 10NiMo8.5 10NiMo8,5 2 10 R = 0.7; SINUS U290°C

AIR I =25°C. R =0.5 O

« non strained

0 Epi- 5%«250°C/2h

/ \. ANODIC DISSOl-/FILMRUPTURE / / M00FI, 2 10 = y £ o /___ —• m • f 10* > y' •o / • V

^\R = jO ' T.V D AIR 20°C 1.0 Hz • AIR 290° C W Hz T o WATER 290'C 0.017 Hz • WATER 290° C 1.0 Hz

3 t 5 i i 1 i i i .1- 10 15 20 25 30 35 AK[MPam'2] Fig. 4 Fig. 5

-236- a)

•Q

T 1 "I t:

/- /

Fig. 2

-237- 10NiMo8.5

Rising displacement tests 02<15ppb 0, =8ppm environment: demineralized water 10NiMo8.5 0 • displacement rate: 0.001 mm/min

A508cl 3 Q 0.7 ASME. Sec.XI. App.A O Reference fine 0.3

BNiyo8.5 (AIR. 295°CI

0.1 Oj<10ppb O2>53om 250 a 290 o I • 0.05

= 0.5. f = 0.03 Hz Environment: Water 0.02 - Temperature: 295°C

I i L. 0,01 15 20 25 30 35 0,1 0.2 0.5 1 2 AK iMPam" ] &a [mm]

Fig. 6 Fig. 7

-238- CZO129427

Upgrades of USK 213 and SK 187 Z. Skala, J. Vit, P. Kepka, J. Forman, S. Zahoik (SKODA JS a.s. Plze)

Outside inspection systems The systems for the inspection of reactor pressure vessels from the vessel outer surface were delivered as a part of the reactor vessel supply. USK 213 is used for WER 440 type 213 reactor pressure vessel inspection and SK 187 is used for the inspection of WER 1000 vessel. Each of the systems comprises four different manipulators, the position control system, the ultrasonic instrument and the industrial close circuit TV with b/w camera. Parameters of those systems did not correspond to current demands on automatic ultrasonic testing and the ultrasonic instrument and original ultrasonic probes did not even fulfil the demands of PK 1514-72 code on inspection sensitivity. These system had also other weak points: - the position control system worked only in manual or semi-automatic mode - the ultrasonic instrument had only an analogue output connected to a simple recorder which created on-line only the C- scan of the inspected area - the system did not produce any permanent data storage on magnetic media or other media allowing further data processing - the TV circuit produced a low quality picture and the visual inspection could not be performed simultaneously with the ultrasonic testing - the scanners used for the nozzle inspection did not allow inspecting the whole area, which had to be tested.

Upgrading of USK 213 SKODA JS was chosen by the NPP Dukovany to improve the USK 213 system, so that it will fulfil the demands on inspection sensitivity and accuracy. This upgrading was finished in 1997. Most of the mechanical parts of manipulators were found satisfactory, but all motors and position encoders have been changed. New motors have higher power and efficiency than the old ones and new position transducers give five times higher position resolution and their output is suitable for the new position control system. Only the manipulators for the testing of nozzles and vessel circumferential welds in nozzle area had to be changed also mechanically. Original linear movement units have been replaced by a new ones, that are longer and powered by stepping motors so that the full scope of inspection demanded by the inspection programmes can be covered now. The position control system was rebuilt completely. It now consists of a PC, a frequency converter, a controller of AC motors, a controller of stepping motors, an array of relays and necessary power supplies. Both controllers and the frequency converter are connected with personal computer, which is used for the manual, semi-automatic and automatic position control of all four manipulators. All position control system is placed in one cabinet. The original ultrasonic instrument was replaced by a modular ultrasonic instrument Microplus, produced by Sonomatic AEA, UK, with 16 UT channels, the Multichannel pulse echo and TOFD software packages.

-239- Each Microplus UT channel has a linear amplifier with bandwidth 0.1 kHz to 20 MHz and gain of 80 dB, selectable in 1 dB steps. The 16 point DAC has an amplitude range of 80 dB. The sampling frequency may be 8, 32 or 64 MHz, software selectable. The ultrasonic testing is performed with angle probes oriented in four directions, two parallel and two perpendicular to the weld axis and the contact technique is used. Compression wave and shear wave probes of several different angles are used for the testing so that the whole tested volume is covered and flaws of all possible orientations can be detected with the highest probability. Selection of probes is made taking into account the material, size and shape of the tested part, the manufacturing technology and the previously detected flaws. Multichannel pulse echo software gives us the possibility to digitise and store up to 16 peak amplitudes and corresponding times or the whole A-scan for one sequence. Up to 64 sequences can be programmed in one test cycle. The DAC curves can be defined in 16 points. All instrument controls are software adjustable and the setting is stored in a block of parameters as a part of the disk file containing the inspection data. The data obtained during the testing are stored in the data file and displayed on-line in graphical form on the computer screen at the same time. Position data are fed into Microplus from the position control computer using a program procedure simulating incremental encoders. The inspection data are transferred on a magneto optical disk to another PC, on which the results are evaluated off-line. The position of the point from which the received signal was reflected is calculated from this data. This point is always situated on the beam axis. The amplitude of received signal is compared with the amplitude obtained from the 4 mm FBH and converted to dB value. Un i t: EDU_4/'97 Part: Merka-suary Scan:7050/1 Date: 2. 9.97 Present.: 3 2540 ys: -52 zs: O Tine:15:58 Scale: 1:3 xe: 2969 ye: 147 ze: 150 mm Data fron 1 sequence • 3: 45° +x -8 -6 -4 -2 4 6 dB 2550 26OO 265O 27OO 2750 28OO 2850 2900

50-

1OO-

50 100 1

O-

50-

: 1O0-

t+-*+-= shi ft TAB=course/fine SHIFT+TflB=C/B ENTER=apply ESC=back

Fig. 1 The graphical presentation of UT data

-240- The interactive graphical presentation on the screen of PC is the main tool used for the evaluation of inspection results. The top, side, front view and combination of all tree views on one screen can be drawn (see Fig. 1). The reflecting point is represented by a square, colour of which corresponds to the signal amplitude. Data from up to six sequences can be presented simultaneously, sequence number, scale, view and colour coding can be changed from the keyboard. The coordinates of indications in all views can be measured and displayed on the screen and also stored in a data file for further processing (see Fig. 2) TOFD method is a tool for very accurate measurement of the real vertical dimensions of discontinuities. We do not use it as a standard method for the inspection yet, but the need to use it may result from the in-service inspection qualification demanded in Czech republic. Overview of changes is given in Tab. 2 and Tab. 3 and resulting improvement of the UT registration level is summarised in Tab. 4. Original system Improved system UT instrument UDAR-16 Microplus Producer NIIKIMT, USSR AEA Sonomatic, UK Number of channels 16(12) 16 Amplifier Linear Linear Gain 0-60 dB, 2 dB step 0-80 dB, I dB step Digitised peaks in a gate None 16 Frequency filter None Software selectable range Storage of data None Disk file

Tab. 2 Comparison of UT instruments Inspected part UT probes Original Improved Type Freq. Dimensions Type Freq. Dimensions [MHz] of crystal f of crystal [mm] [MHz] [mm] RPV circumf. 39°T 1,2 14x12 45°T 2.0 16x25 welds 59°T 1.2 14x12 60°T 2.0 16x25 90°R 1.2 14x12 0°L 2.0 0 20 0°SEL 1.2 2x18x10 0°SEL 2.0 2xl/ 2O 20°L 2.0 20 16x25 Nozzles DN500 50°T 1.2 14x12 45°SEL 2.0 2x15x8 59°T 1.2 14x12 60°SEL 2.0 70°SEL 2.0 2x15x8 Nozzles DN250 55°T 1,2 14x12 45°SEL 2.0 60°SEL 2.0 2x15x8 70°SEL 2.0 2x15x8

Tab. 3 UT probes for USK 213

-241 - i Unit: EDU_4/"97 _Part: Herka-suarn Scan:7O5OXl Date: 2. 9.97 Present.: 3 xs~: 2692 us: S zs: 6 Tine:15:58 Scale: 1:1 xe: 2835 vie: 71 ze: 56 Oata fron 1 sequence 3: 45° +x -8 -5 -2 7 10 13 dB

27OO 275O 28OO xn 2765 an 34 zn 39 an 7 xl 2755 x2 2769 yi 11 U2 63 zl 43 z2 36 50

Fig. 2 Dimensions of indication measured on a PC screen

Tested part of the Reporting level Registration level reactor pressure given in code ofUSK213 system vessel PK 1514-72 PNAEG-7-010-89 original upgraded circumf. weld Dn 3.8 mm Dn 3.1 mm Dn 7.0 mm Dn 2.8 mm t=120 to 199 mm Circumf. welds Dn 5.1 mm Dn 4.4 mm Dn 7.0 mm Dn 2.8 mm t=200 to 299 mm Base metal Dn 3.8 mm Dn 3.8 mm Dn 7.0 mm Dn 2.8 mm Cladding - Dn 4.4 mm Dn 4.4 mm Dn 7.0 mm Dn 2.8 mm lack of bond (t=90 to 400 mm) (t=l00to300mm) Austcnitic welds of n/a n/a n/a 0 3.2 mm nozzles -6dB Note: t... wall thickness n/a ... not available

Tab. 4 Improvement of UT registration level

-242- The eddy current testing instrument ECULAB D was added to the system for the outside inspection to complement the ultrasonic testing. It is a two frequency analogue eddy current instrument with the frequency range from 1 kHz to 10 MHz. The analogue signal from the eddy current instrument is fed via A/D converter to a PC. The full analogue signal is digitised and stored in digital form on the disk. The A/D conversion complies with ASME section XI, 1992 edition requirements. Four independent channels can be processed by the software for data presentation and evaluation. The evaluation is performed on a PC by means of the interactive graphical presentation software (see Fig. 3). Two probes are used for the testing from the outer surface, one detecting flaws parallel to the weld axis, the other detecting the flaws perpendicular to the weld axis. The surface breaking flaws are detected and sized by the eddy current testing. The remotely controlled colour miniature TV cameras replaced the original b/w TV system. Smaller dimensions of cameras allow to perform the visual inspection of the outer surface simultaneously with the UT and ET, which was not possible with the former TV system. The visual inspection is recorded on a video tape and can be replayed to the customer to document the results. The upgrading of USK 213 system on NPP Mochovce in Slovakia followed the successful completion of USK 213 improvements in Dukovany.

Field use of improved systems The first inspection from the outer surface by the upgraded USK 213 was performed in May 1996 on NPP Dukovany, unit 2. For the first time, the outside inspection by this device was done with the same sensitivity as the inside inspection and the results were stored on a media allowing future processing. Units 3 and 4 of NPP Dukovany were inspected by this system in 1997, inspection of NPP Dukovany unit 1- was done in 1999. The pre-service inspections of units 1 and 2 of NPP Mochovce were performed in 1998 and 1999. The new position control system, ultrasonic and eddy current instruments, ultrasonic probes and the colour TV system worked more reliably than the original ones and were handled and operated more easily. The pre-operational checks of the positioning system proved good position measurement accuracy. It is not worse than 1 mm for both movements of manipulators for nozzle inspection and of the manipulator for vessel circumferential welds in nozzle area. Also the repeatability of positioning was better than 1 mm. The position measurement accuracy of manipulator for the inspection of vessel lower part is a little bit worse. The position of the fully extended telescopic mast was measured with difference better than 5 mm, while the rotating table position difference after one complete rotation was less than 10 mm. The repeatability of positioning was better then 3 mm for both movements of this manipulator.

-243- I "I ' Iu ' I VI am HI tir..T)l ml mm

pnmwrrav

XI >*"! L can f- V "

i S-T_-

Fig. 3 Graphical presentation of ET data

Upgrading of SK 187 The difference between the outside inspection system for VVER 1000 reactor pressure vessels and USK 213 is not great, so the changes of hardware and software needed to upgrade SK 187 system on the NPP Temelin were very similar to those of USK 213. The upgrading of SK 187 have been finished in February this year and the system will be used in April for the pre-service inspection of the unit 1 of NPP Temelin. The preliminary tests in laboratory confirmed the improvements of all characteristics similar to those of USK 213.

Conclusions SKODA JS succeeded in improving systems for the reactor pressure vessel inspection from the outer surface. All weak points of original inspection systems were removed. The upgraded systems fulfil the demands of codes used presently for the inspections of VVER reactor pressure vessels and the automatic inspection performed by them covers all parts indicated in the pre-service and in-service inspection programmes. All parameters of improved USK 213 and SK 187 systems are comparable to similar devices used in other countries and this fact guarantees that the systems will be successfully qualified for future in-service inspections of VVER pressure vessels.

References /. Skdki Z, Vit J, Improvements of In-Service Inspection Systems in SKODA, 7th European Conference on Non-Destructive Testing. Copenhagen, 7th ECNDT, 1998 2.Skdla Z, Pepechal J., Sladky J., Vit J., Remote and Automated NDE in SKODA JS, First International Conference on NDE in Relation to Structural Integrity for Nuclear and Pressurised Components, Amsterdam, EUR 18674 EN, 1999

-244- CZ0129428

Innovations of the WER 440 Accident Localisation System

Pavel Baldz, Jan Murdni VUEZ, a.s., Lavlce, Slovakia

1.0 Introduction In the 1990s VUEZ, a.s. Levice (known before as Power Equipment Research Institute Tlma e) was centrally involved in the field of innovation activities related to NPPs with both VVER 440 V230 and V213 reactors. In the early 1990s it was the so-called Small Reconstruction of the Jaslovske Bohunice VI NPP with the main VUEZ activities concentrating on the leak-tightness enhancement at both VI NPP units where remarkable results were attained pertaining to containment leakage rates. In addition, the innovation activities also involved the spray system (replacement of nozzles), creation of the changing room and contamination checkpoint, installation of an independent system for primary circuit leakage monitoring, reconstruction of inlets to the boric acid emergency storage tank, reconstruction of vent systems etc. Even broader were VUEZ activities within the scope of the so-called Gradual Reconstruction of the Jaslovske Bohunice VI NPP where, based on UJD SR (Slovak NRA) Decision 1/94, extensive innovations were performed related, to a larger or lesser extent, to 16 functional technological units. Under the contracts with RECON Consortium (VUJE Trnava + Siemens), VUEZ solved directly three functional technological units and participated as a subcontractor in the solution of many others. Among those most decisive, I would like to mention particularly the Containment Integrity, Accident Localisation System, and Containment Strength. In respect of the newly built and at present already operating Mochovce NPP, VUEZ innovation activities were oriented first of all to the so-called safety measures. In this field for EUCOM Consortium (Siemens + Framatome), a complex of issues related to the Vacuum Bubbler Condenser were solved (CONT 01 to 06) and for Skoda, the General Supplier of the electromechanical part, the issue of Emergency System Reliability through re-qualification of sumps on the SG compartment floor. Both of these safety measures (ranked to class III) were solved in parallel within the scope of the PHARE Programme: the first one (the main contractor being Siemens+EdF+Agrupados Consortium) was completed in December 1999 and the other (the main contractor being FORTUM Engineering) in August 1998. In both of these projects, VUEZ participated as a subcontractor. To complete the account and to give further information, I would like to add that, based on the past involvement in this field (Mochovce NPP and PHARE), further VUEZ innovation activities are expected within the scope of the Jaslovske Bohunice V2 upgrading project. The V2 NPP upgrading is under way, though one of the safety measures - requalification of sumps on the SG compartment floor -

-245 is already being implemented (and this safety measure is also being executed in the Dukovany NPP). In this presentation, I wish to concentrate on two of the aforementioned issues where VTJEZ has extensive experience and may provide the most complete information on works performed so far, namely: a) elimination of leakages through the hermetic boundary, and b) requalification of sumps on the SG compartment floor.

2.0 Containment hermetic boundary To VVER 440 containment leak-tightness, certain criteria and requirements are applied, though it is true that they differ from country to country and even from plant to plant. Still it holds that in fact the leak-tightness is technically defined and limited everywhere. Thus, it forms the technical basis for the implementation of methods for leak-tightness measurement and verification, and for the implementation of potential repairs and improvements.

2.1 Integrated leakage rate tests The current methodology of integrated leakage rate tests uses well-known measurement methods commonly applied to full-pressure containments: containment pressurisation to a test pressure using an external air source, parameter stabilisation, measurements of pressure drop with time, mean temperature changes in the containment and humidity in the containment, automatic calculations and the monitoring of parameters throughout the whole duration of the test, i.e. 24 h (higher leakage rates may be measured within a substantially shorter period). In addition to measurements in VVER 440 containments in the Bohunice, Mochovce (Slovak Republic) and Dukovany (Czech Republic) NPPs, this methodology was successfully applied to the VVER 1000 containment in the Temelin NPP (Czech Republic).

2.2 Local leak tests To verify the leak-tightness of individual components and locations on the hermetic boundary, known procedures are used to identify the leak and define the technologies and procedures used for subsequent repairs. In addition to integral ways of pressure difference creation (pressurisation and vacuuming), also local pressurisation and/or blowing or suction may be applied (to a temporarily formed hermetic mini-volume). For leak identification, in principle local methods are used such as visual inspection (formation of bubbles), acoustic analyses, imprints, ultrasonic methods, thermal analyses (thermovision camera) and the like.

2.3 Technologies for leak repair Technologies, their applications and obtained results differ depending on the character of leaks, which can be divided into: a) leaks located on the accessible part of the hermetic boundary (welded liner plates, components such as doors, valves, penetrations, hatches and their sealings), and

-246- b) "hidden" leaks located on the inaccessible part of the hermetic boundary and identifiable only through the processes they induce in the adjacent materials (predominantly concrete). To repair the leaks the following technological procedures are used: ad a) welding, application of sealing compounds and adhesives, replacement of sealings - only during outages; ad b) application of foams, injection of epoxide resins and polyurethane materials or alternative design solutions (water jet application to remove concrete) - possible also during operation (from outside of the containment).

2.4 Obtained results In standard conditions, the leakage rate reduction in NPPs is the task of NPP maintenance departments. However, the capacity of these departments, usually is insufficient to substantially reduce the leakage rate. That was why, beginning in 1990, individual NPPs began to implement leak-tightness enhancement programmes under contracts with specialised organisations, such as VUEZ, a.s. Levice. Results obtained in this field are apparent from the enclosed figures.

- Jaslovske Bohunice VI NPP, Units 1 and 2, type V 230 The reference leakage rate measurement before initiation of the leak-tightness enhancement programme in 1990 showed the leakage rate at the level of 5-7000%/24 h. During the next 7 years, the leakage rate was reduced by 2 orders of magnitude, i.e. to the level of 50-70%/24 h. Between 1998 and 2000 an extensive reconstruction was performed with severe interventions to the containment hermetic boundary which caused a certain slowdown in the leakage rate reduction.

- Jaslovske Bohunice V2 NPP, Units 3 and 4, type V 213 The reference leakage rate measurement before initiation of the leak-tightness enhancement programme in 1996 showed the leakage rate at the level of 15-16%/24 h. After three years of resealing works this value was reduced by about 1/3, i.e. to the level of about ll%/24h.

- Dukovany NPP, Unit 1, type V 213 The reference measurement before initiation of the leak-tightness enhancement programme in 1996 showed a leakage rate of about 12.5%/24 h. After three years of resealing works this value was reduced by about %, i.e. to the level of 9.5%/24 h.

3.0 Requalification of sumps on the SG compartment floor Since the known incident in the Barseback NPP (8 years ago) when starting up unit 2, much attention has been devoted to the issue of the reliability and safety of sumps in the systems that shall be operated in accident conditions. This issue was also discussed between UJD SR and nuclear specialists. The necessity to solve this issue was established and also to implement the obtained results in Slovak NPPs either operating or under construction, i.e. both V 230 and V 213. VUEZ decided to technically solve the issue of the protection of sump

-247 - strainers from clogging, to verify individual solutions both by calculation and experimentally, and to get the final proposal approved and implemented. Taking into account that at that time in the Slovak Republic three types of NPPs existed with regard to sump protection (one operated with V 230, one operated with V 213 and another with V 213 under construction), also technical incentives and proposals were oriented on these three groups. Furthermore, it was necessary (experimentally, too) to define boundary conditions and sump loading parameters (as a result of debris consisting primarily of dislodged thermal insulation) in the event of accidents. In parallel to the described activities, in August 1997 the PHARE Project was initiated (with nearly a two-year delay) aimed at the solution of this issue for the Jaslovske Bohunice V2 and Dukovany NPPs. VUEZ participated in the project as a subcontractor to the main contractor - IVO POWER (FORTUM) Engineering. After one year of solution, the project results were included into the final design. Based on the theoretical and experimental verification of several technical options of emergency systems intake protection, it may be concluded that three basic solutions are possible (for the three NPP types mentioned) which in the meantime have been largely implemented. They will be briefly described below.

3.1 Protection for V 230 sump operated (Bohunice V1 NPP) In addition to the replacement of the original separation strainer structures located inside the emergency water storage tank according to Siemens design, for the intake a technical solution proposed by VUEZ was adopted. The solution consisted in a combination of building modifications performed on the SG compartment floor and the application of the so-called jet condensers connecting the emergency water storage tank with the SG compartment, thus forming inlet openings. After having been supported by large-scale experiments, this proposal was approved by REKON Consortium and afterwards (autumn 1998) implemented at Unit 2 and now it is being implemented at Unit 1.

3.2 Protection for V 213 sump under construction (Mochovce NPP) The Mochovce NPP was the first plant where the solution of the sump issue was initiated. After an extensive analytical and experimental programme (1995-96), a design was prepared taking into account the state of the art at that time. The design combined passive and active components where the passive part was represented by a wholly new concept of protective strainers and the active part by back-flushing of clogged strainers to remove the sediments and to clean the strainers. Additional experiments, however, proved a good capability of coolant to penetrate through a thick layer of sediments formed on the strainers if glass wool insulation is used and in the so-called underpressure regime, i.e. submerged sumps in DBA conditions. This was fully proved by experiments performed by IVO (FORTUM) Engineering within the scope of the PHARE programme based on even stricter boundary conditions. This meant that the installation of an expensive active back-flushing system was no longer necessary and this modified solution was implemented at both units of the Mochovce NPP.

-248- 3.3 Protection for V213 sumps operated (Bohunice V2 and Dukovany NPPs) The solution of sumps in the Bohunice V2 and Dukovany NPPs fully respects the conclusions of the PHARE Project, though the detailed design prepared in VUEZ and approved by both the Czech and Slovak Regulatory Authorities slightly differs from the basic design prepared within the scope of the PHARE Project. The final solution for the most adverse central sump is able to retain 100% of dislodged insulation (evaluated by calculation), i.e. about 1100 kg with a pressure loss across the strainer of 13 kPa (proved experimentally) which is less than the calculated maximum value of 17 kPa. I would like to point out that additional experimental verification with boundary conditions defined by the PHARE Project (the quantity of insulation debris fine fraction transported to the strainer is 1100 kg, max Ap across the strainer is 17 kPa) was performed also for solutions implemented in the Mochovce NPP and positive results were obtained.

4.0 Further activities related to ALS In the field of safety enhancement by means of the modified or repaired accident localisation system, VUEZ perform activities described in brief in the following paragraphs.

4.1 Containment strength The containment is a reinforced concrete structure of large volume, which in the case of accident is loaded with an internal overpressure. In this field VUEZ performed measurements and interventions into reinforced concrete walls (e.g. during reconstruction) of the following character: a) reconstruction actions (e.g. cutting of openings in walls), b) long-term actions (problems related to ageing).

4.2 Underpressure in the containment It is the liner that is most susceptible to destructions induced by higher underpressures. To solve the problem, the liner may be reinforced or (which is more often) vacuum breakers installed.

4.3 The strength of the Bubbler condenser system (V213) As to this issue, VUEZ participated in the PHARE Programme and performed a number of experiments resulting in reinforcement of metallic internals of the system.

4.4 Isolation valves These are large-size leak-tight fast-acting isolation valves. VUEZ has experience in their testing and installation, for instance in the vent systems within the scope of modifications (repairs) performed in NPPs.

-249- 5.0 Conclusion In this presentation, VUEZ activities in the field of emergency systems innovations in WER 440 NPPs were briefly described. It was mentioned that there is experience with preparation, design, implementation, testing and commissioning in the following fields: containment leakage rate tests and repair of detected leaks, containment structural integrity tests and investigation of issues of reinforced concrete stressing, - modification of emergency (ECCS, spray) system sumps in relation to theoretical and experimental analyses, - design and installation of some specific technological components in NPP safety systems (vacuum breakers, special valves, filters,...), - installation of measuring and verification systems (both in NPPs and experimental facilities). All this proves that in VUEZ adequate attention is devoted to innovations, repairs and modifications of safety systems in VVER NPPs. Furthermore, we believe that in the future VUEZ experience and capabilities will be used in an even broader scope.

-250- A-A

Strainer structures of new sumps for the V1 Bohunice NPP

-251 - Strainer structures of new sumps for the Mochovce NPP

ffi—1

Strainer structures of new sumps for the Dukovany and V2 BohuniceNPP^

-252- £ 2- - O O£ £ CZ0129429

9S Jadernd elektrdrna Dukovany

WWER 440/213 NPP Containment from the point of view of IAEA Requirements and Current European Practice

Prepared on the basis of data from Dukovany, Bohunice and Mochovce NPPs and Phare Project PH 2.13/95

prepared by M. Sabata Dukovany NPP 03/2000

32/ 11 -253- 1. Introduction A significant factor in design of complex technology of nuclear power plant (NPP) is minimisation of its impact on surrounding environment even in cases of extraordinary operational events. In addition to several levels of protection which prevent from equipment damage there are three barriers introduced in the NPP system preventing from release of radioactive substances into surrounding environment. They are fuel cladding, primary circuit boundary and containment. In summary these three barriers form an important item of the nuclear safety assurance system. The term "nuclear safety" means the state and capability of nuclear installation to prevent from an uncontrolled propagation of fission reaction as well as from an unallowable release of radioactive substances and ionising irradiation into environment both under normal operation and during accident conditions. Presented document is focused on the 3r barrier - containment and is aimed to explain the basic philosophy of management of maximum design accident in containment of WWER440/213 nuclear power plants. In addition it shall present that the WWER 440/213 containment provides protection of environment in way corresponding to IAEA requirements and to current European practice.

2. Brief description of the WWER 440/213-conrainment design The NPP design shall take into account a set of requirements both for proper manufacturing equipment and for protection system as well as for protective barriers. The concept of WWER 440/213 has already certain attributes of enhanced reactor safety of new generation, in particular great reserve of water for active core cooling. This was accomplished by use of six horizontal steam generators connected by six detachable loops to reactor. Such configuration required, in particular based on spatial reasons, a specific structural solution of the 3rd. barrier - containment. In particular the following basic functions has to be met by the containment: 1. Prevention from release of radioactive substances outside a hermetic area exceeding pre-set level, i.e. assurance of required tightness of biological protection under normal operation and during maximum design accident. 2. Management of impact of increased pressure and temperature inside hermetically sealed areas caused by failure of reactor cooling system. 3. Protection of reactor cooling system and plant equipment from external effects inside as well as outside the containment. Containment shall withstand effects of natural forces (earthquakes, winds) and human induced activities. The system of vacuum bubbler condenser for restriction of maximum design accident consequences with break of main circulating pipeline was developed in late of seventies. This system is used not only in Russia (Kola NPP) but also in Ukraine (Rovno NPP), in the Czech Republic (Dukovany NPP), in the Slovak Republic (Bohunice, Mochovce NPPs) and in Hungary (Paks NPP). Maximum design accident is an accident considered in design of nuclear power facility, which has the greatest radiation impact on environment. Probability of its occurrence is very low. Although its occurrence is hypothetical, the pre-set value of doses must not be exceeded for the most endangered individuals of public from surrounding of NPP. The Loss of Coolant Accident belongs among the most dangerous accidents. The failure of the first two barriers will occur during the LOCA - the fuel cladding and primary circuit integrity. The WWER 440/213 containment presents the 3r barrier against release of radioactive fission products into environment. It consists of the following main parts: • Steam Generator Compartment • Corridor • Bubbler Condenser building with accident confinement shaft • System of BC with air traps

-254- • Spray system The containment is sub-atmospheric with pressure suppression by bubbler condenser and spray system. It is designed for 150 kPa overpressure and for 20 kPa underpressure what together with safety coefficient cca 1,15 covers sufficiently assumed loading during maximum design accident - the rupture of the primary pipeline DN 500 with flow of coolant from both sides according to current IAEA requirements for the 3r barrier. The total free volume of containment is approximately 52 500 m3. Reinforced concrete walls form boundary of containment with lining from steel sheets separating all hermetically sealed areas from surroundings as well as by other construction, technological and electrical items providing its tightness. They are in particular hermetically sealed doors, hatches, penetrations, and protective cover of reactor shaft and air-conditioning items. The steel lining with thickness of 6 mm connects all these items thus the tightness of reinforced concrete walls is provided. There are quick acting isolating valves on the boundary of containment provided for quick isolation of systems inside containment in case of accident. The quick acting isolating valves are doubled and they are located on both sides of containment in its close vicinity, thus during any accident event at least one barrier shall remain retained which will protect before spreading of radioactive substances towards to the NPP environment. Under operation of unit the minimum underpressure of 50 Pa is kept inside the containment. Operation of containment under permanent underpresure allows for continued monitoring of its tightness, which is a significant safety aspect of this type of containment. The tightness of containment is verified also by periodical tests using an internal overpressure. The scheme of containment is shown in the Fig. No. 1 The containment consists of hermetically sealed compartments (2) housing reactor equipment (1) and equipment of air-conditioning systems, spray system (5) a bubbler condenser building which is connected to hermetically sealed compartments by corridor (7). The bubbler condenser building contains 12 staggered floors of passive condenser with bubbling of steam (8) and air traps (9) equipped by check valves (10). The gas volumes above the water level (beyond the water sealing) are through dual check valves connected to the air traps. There are four air traps to which uncondensed gases from containment are forced each connected to three floors of bubbler condenser trays. Between volume beyond water sealing and shaft of bubbler condenser are two self-closing check valves on each floor whose function is to prevent a reverse flow of water from trays in case of small accident.

3. Course of maximum design accident confinement in WWER 440/213 containment

The BC system is operated only in accident conditions in conjunction with loss of coolant of either primary or secondary circuit resulting in pressure and temperature increase in hermetically sealed area, it is put under operation automatically by arising pressure difference between hermetically sealed (2,3 - Fig. I) and retaining areas. Operation of bubbler condenser is clearly passive. General scheme of hermetically sealed volumes with confinement system is shown on the Fig. I; the detail of bubbler condenser building with several floors of trays is in Fig. 2. Principle of passive pressure reduction Passive reduction of quick pressure increase in hermetically sealed areas in maximum design accident is enabled by two basic function of bubbler condenser: a) steam condensation through bubbling of steam in 12 floors of trays with water (2 - Fig. 2) b) capture and retention of air and uncoudensed gases in four air traps (5 - Fig. 5)

-255 - The bubbler condenser is arranged in such way that air-steam mixture is passed through corridor to the bubbler condenser where the flow is distributed in bubbler condenser shaft (I - Fig.2) to individual floor and through volumes between ceilings and bottoms of floors the mixture enters in 1806 gas-cap water seals (2 - Fig. 2). After expulsion of water column in inlet cap of seals (3- Fig. 2) the mixture shall bubble through water layer where steam condenses with transfer of part of its thermal energy and concurrently reduces its volume in significant way. Air and uncondensed gases are then cumulated above water level and due to arising overpressure this mixture flows through dual check valve DN 500 (4 - Fig. 2) to the air traps (5 - Fig. 2). The time history of presented process is governed by pressure difference arising between bubbler condenser shaft (1 - Fig.2) and air traps (5 - Fig. 2). In case of maximum design accident it means very quick process (see graph in Fig. 3) attended by significant dynamic impacts of jetting flow on all technological devices as well as on structure of bubble condenser and hermetically sealed area. Dynamic effects of flow of steam-air mixture are at the inlet to bubbler condenser captured by special reflexive wall anchored to bearing structure of bubbler condenser trays and this way to the reinforced concrete building.

Fig. 1: WWER 440/213-containment scheme

********** rrrrrr gg

'////////////S///Y77,

s////////

1 Reactor Pressure Vessel 6 Reactor hall 2 Steam Generator Compartment (SG) 7 Corridor 3 MCPs room 8 BC unit 4 Removable hatch in the reactor hall 9 Air trap 5 Emergency core cooling system and spray system 10 Check valve

-256- In the course of accident localisation the pressures above water level (3 - Fig. 2) and in air traps (5- Fig.2) are equalised while check valves DN 500 (4- Fig. 2) are automatically closed retaining compressed air in chambers. Flow of hot water and steam from primary circuit continuously decreases and pressure in hermetically sealed area begins to fall due to steam condensation and heat transfer to the walls possibly also due to operation of an active spray system. Reverse pressure difference, when the pressure above water seal (2 - Fig. 2) is greater than the pressure in bubbler condenser shaft (1 - Fig. 2), causes a reverse water flow from trays to bubbler condenser shaft. Water flows through the same path where the steam - air mixture flowed up, along the ceiling of the lower floor flows to perforated collectors on the face wall of bubbler condenser and sprays the volume of shaft. This passive spraying causes further reduction of pressure in hermetically sealed volumes. Spilled water from trays is collected on the bottom of bubbler condenser shaft and spontaneously flows through corridor to the SG and MCP compartments. From this room the water is together with used sprinkling water transferred by flow net to suction of emergency system pumps. Accidents with small release of coolant have similar but slower course with lower achieved pressure also. In order to prevent an undesired outflow of water in case of small accident (small accident could become step by step large accident) there are two special check valves DN 250 equipped on each floor (6- Fig. 2) which allow pressure equalisation before and behind the water seal. These check valves are fitted with special blocking system which depending on pressure value in volume before a hydraulic seal automatically locks or unlocks the valve. The blocking system is set to value of 165 ± 5 kPa of absolute pressure. Reaching this value the valve is automatically locked and does not allow pressure to be equalised. In case of lower pressure before water seal the reverse flow occurs. If during an accident localisation the pressure in the shaft does not exceed a limit value of 165 kPa the valves remain unlocked and in case of pressure drop before water seal the pressure will be equalised before and behind seal thus water remains in trays. Presented passive function of bubbler condenser system causes spontaneous decrease of pressure in hermetically sealed areas with continuous cumulating of significant amount of released thermal energy. Full localisation of accident is accomplished by active spraying of SG and MCPs compartments which gradually reduces pressure in sealed compartments down to the minimum value of 80 kPa (underpressure) when the spraying system is automatically switched off. Achievement of moderate vacuum in sealed area will prevent release of radioactive substances; underpressure is maintained by controlled actuation of active spray systems. Violation of minimum values of vacuum with possible consequent violation of system tightness is prevented by deactivation of active spray systems.

-257- Fig. 2: Detail of part of containment- bubbler condenser system

3UHHH1 fflUMU A / t m A J^L ffHWff

1 Bubbler condenser shaft 4 Dual check valve DN 500 2 BC units with water siphon seals 5 Air trap 3 Level of water solution (H3BO3) 6 Lockable check valve DN 250

-258- Fig. 3: Pressure history in WWER 440/213 containment in maximum design accident

Tlak [kPa] Prasknuti hlavniho potrubi 10 250 Bezpeenostni tlakova rezerva kontejnmentu -1,15 218 Sprchovy system (SS) v provozu a vyliti barbota nich labu

165 vypnutf SS zapnuti SS

15 min Tlak = Pressure; Prasknuti hlavniho potrubi 10 = Rupture of main pipeline of primary circuit; Bezpecnostni tlakova rezerva kontejnmentu —1,15 = Safety pressure margin of containment-1,15; Sprchovy system v provozu a vyliti barbotaznich zlabu = Spraying system under operation and bubbler condenser trays emptied; vypnuti SS = deactivalion of spraying system; zapnuti SS = actuation of spraying system

4. Comparison of course of localisation of maximum design accident for WWER 440/213 and for selected types of BWR containment

Similar type of containment is used for western boiling reactors BWR. In full-pressure protective shell - containment the large deep pool was located to which steam released during accident from primary circuit was brought. This type of containment developed by general Electric in the seventies and known as MARK was subjected to certain technical development in several modifications (from type 1 to type III)

Comparison of main parameters of individual systems is given in the Table 1.

Table No. I: Characteristics of different type of containment

Type of GE-MARK 1 GE-MARK II GE-MARK KWU-BL69 KWU-BL72 VVER- Containment III 440/V213 NIT PEACH LIMERICK GRAND KRUMMEI. GUND- MOCfiOVCH BOTTOM GULF REMMINGEN Overpressure kPa 390 385 105 350 330 150 Thermal Power MWt 3293 3293 3833 3800 3800 1375 I'ree Containment nV 8100 1 1400 44300 7600 14500 48210 Volume Free Volume/ m7M 2,46 3,46 11,3 2 3.82 35 Thermal Power Wl Water Volume m' 3480 3530 3850 3700 3100 1360 Water m'/M 1,06 1,07 1,01 0,97 0,818 0,99 volume/Thermal Wt Power Number of pipes 74 106 78(horiz.) 72 64 1800 (siphon)

-259- From this comparison it follows that the free volume of containment is the greatest for WWER type what in conjunction with lower output leads to lower maximum pressure achievable in design accident. The share of water used for steam condensation in relation to power is similar for all compared power plants.

Fig. No. 4: The scheme of bubbler condenser MARK III

Reactor pressure vessel 5 Containment Auxiliary buildings 6 Bubble condenser pool Reactor hall 7 Horizontal channels Reactor shielding 8 Separating walls

-260- Large difference is in structural arrangement of bubbler condenser system. The scheme of the MARK type of containment is shown on the Fig. No. 4. Large protective shell (5) contain primary circuit with reactor pressure vessel (1) and deep ample pool for steam bubbler condenser (6) in its bottom part. In case of rupture of primary circuit pipeline the released steam is forced through siphon seal and horizontal channels (7) to bubbler condenser pool for condensation. Air and uncondensed gases then remain in protective shell (3). Pressure history for the case of maximum design accident is shown in figure 5.

Fig. No. 5: Pressure history in MARK HI containment during accident localisation

Tlak [KPa]

250

Projektovy tlak kontejnmentu 200

• Prasknuti hlavniho pamiho potrubi Patm [100 kPa] 100

10 10 10' 10 10 10 Cas

Tlak = Pressure; Projektovy tlak kontejnmentu = Design pressure in containment; Prasknuti hlavniho parniho potrubi = Rupture of main steam pipeline; Cas = Time

Pressure suppression by bubbler condenser leads also in this case to the lower pressure peak, however containment remains under long-term pressure loading. Generally, utilisation of bubbler condenser leads to effective reduction of pressure peak in both cases (MARK III and WWER 440/213). The MARK system is more compact as for its structure, it uses smaller number of active items but it must withstand to long-term internal overpressure, while the WWER system is more complex, it contains larger number of active items but reduction of pressure is more effective and containment may not withstand to long-term pressure loading.

-261 - 5. IAEA and EU standpoints for structural solution of WWER 440/213 containment

The chapter 3.2.1 of the IAEA- EBP-WWER-03 publication presents for the WWER 440/213 type "Utilisation of the bubbler condenser for steam condensation and for restriction of maximum overpressure inside containment are conceptually equivalent to design of PWR with condensers or to BWR containment with pressure suppression pools in particular type MARK III". Requirements for analytical and experimental support of bubbler condenser design are therefore the same as in the case of other containment where the items of unit protection systems (ESFAS) are used which ensure restriction of maximum overpressure and serve for suppression of time of this overpressure inside containment" The positive features of containment with bubbler condenser rely on fast reduction of internal pressure down to the sub-atmospheric value. In compliance with design calculations in case of accident with large release of coolant (LOCA) the time of overpressure does not exceed 15 minutes that means that small releases occur even for permitted design leakage of containment. However, sufficiently amount of evidence was not available for the IAEA whether design of the bubbler condenser is mechanically adequate enough in order to withstand the pressure differences which occur in an early stage after immediate rupture of primary circuit with medium release from both sides. In order to solve this problem the OECD Support Group on "WWER 440/213 Bubbler Condenser Containment Research Work" was established in 1992. Based on initiation of the EU the "WWER 440/213 Bubbler Condenser Containment Feasibility Study" was carried out. The Study confirmed the need for additional research in this field and the necessity for an experimental verification of Bubbler Condenser function within framework of TACIS /PHARE assistance by Programme named "Bubbler Condenser Experimental Qualification". One part of this Programme deals with course of thermal - hydraulic processes, resistance and integrity of bubbler condenser steel structure under the conditions of design accidents was verified by the other part.

The first IAEA Experts mission was held in the Dukovany NPP with following objectives: • To review technical design of structure in the Dukovany NPP documentation • To check "as built" status of the bubbler condenser steel structure • To evaluate feasibility of proposed enhancement

Following recommendations were drawn from this IAEA mission: • To continue in detailed calculations of structural nodes using more accurate methods • To support an experimental verification of function on models in full scale.

These recommendations are included in above-mentioned Project PHARE/TAC1S (see chapter 7). In case that the publication will be used also by the Bohunice and Mochovce NPPs it could be better to rewrite paragraph concerning the Dukovany NPP in such way that it will generally reflect also results from similar IAEA missions held on other NPPs.

-262- 6. Impact of maximum design accident localisation in WWER 440/213 containment on environment.

The release of radioactive substances to environment and its radiological effects for public in case of NPP accident presents the most serious problem. Influence of released radioactive substances on radiological burdening of public is reviewed according to the WHO and ICRP recommendations, Decrees of regulatory bodies and national legislature. The third barrier - containment is formed by a sophisticated system of technical means serving at first for reliable protection of public against consequences of reactor accident. Under normal operation the containment is underpressurised in regard to ambient atmosphere what prevents an uncontrolled release of radioactive substances to environment. After rupture of primary circuit (violation of the 2nd barrier) the release of coolant occurs. All radioactive substances contained in coolant are released to volume of containment but regarding to the total activity contained in coolant such release is not significant for influence on radiation burden of public in NPP surroundings. Due to insufficient cooling of core the temperature of fuel increases what leads to untightness of the 1st barrier- fuel cladding. This phenomena causes more significant release of radioactive substances which is confined by the containment. Part of released radioactive substances is captured by structures of the primary circuit; part of them is captured in air traps of bubbler condenser system. Passive as well as active spray systems provide flushing of radioactive substances from containment atmosphere thus they contribute to reduction of released amount to environment. Quick achievement of underpressure in the containment will minimise NPP impacts on surrounding also in cases of extraordinary events.

7. Conclusions resulting from common PHARE/TACIS Project In 1995 the common PHARE / TACIS Project on "WWER 440/213 Bubbler Condenser Experimental Qualification" was approved. This Project followed after previous Project (PH 4.2.8/92) by which current status of knowledge and feasibility of experiments on full-scale equipment directed towards to functionality of confinement systems was evaluated. This serve to refute of fears arising in the community of western experts on the late of eighties. Responsible solver of this Project became Consortium BCEQ grounded by Siemens, EdF and Empresarios Agrupados. Work within framework of this Project was commenced in the October 1997 and it was subdivided to four tasks: Task 1: Project leadership; Inception, planning, administrative Task 2: Performance of thermal-hydraulic tests and fluid-structure interaction tests on the experimental facility presenting the bubbler condenser of Paks NPP in scale 1:100 Task 3: Performance of static structural test for internal structure of bubbler condenser of Bohunice NPP a Dukovany NPP subjected to stresses in an early stage of accident.

-263- Task 4: Analytical support and tests on equipment in small scale for development of task 2 experiments The Consortium awarded contracts with local Subcontractors: EREC (Eiectrogorsk, Russia) for task 2, VUEZ (Levice, The Slovak Republic) for task 3 and SVUSS (Prague, the Czech Republic) for task 4. Within framework of the Project two large and one small experimental facilities were constructed. The first experimental facility (EREC - in scale 1:100 for volumes and flow sections) modelled all essential parts of actual accident localisation system including simulation of outflow from damaged part of primary circuit which was reproduced by the system of five tanks in order to enable modelling of different kinds of accidents. Individual parts of hermetically sealed area were modelled by three interconnected chambers and by own model of bubbler condenser (structure according to the Paks NPP). Its main part was a section of one floor of condenser with two sections in full scale each containing nine "gap-cap" units and an additional volume for air trap modelling. Also dual check valve DN 500 between bubbler condenser and air traps and lockable check valve DN 250 connecting volumes before and behind water seal were modelled. In the course of analytical phase the parameters of experimental facility were more specified and its anticipated behaviour during different types of accidents were compared with calculated courses for Paks NPP. In order to increase reliability the analysis of bubbler condenser was carried out by two computation programmes - DRASYS and CONTAIN; for calculation of outlet from the source part the programme ATHLET was used. Results of analyses showed that: • The most loading of system occurs in case of design basis accident (LOCA) • For modelling of an early phase of accident localisation it is necessary to perform two different tests with different margin conditions, directed towards to accident initiation (pressure loading of internal structure of bubbler condenser) and towards the middle term phase (maximum pressure in system) • Conditions can be established and modelled which cover expected loads of system and its parts (different floors of bubbler condenser) in case of maximum load in an initial phase of accident • Deviations in course of accident localisation for individual NPPs are small (up to 10%) Test equipment were fitted with measuring system allowing to determine course of main parameters in its main parts. Courses of pressure and pressure differences, temperatures of air-steam mixtures, temperature of water and walls, flows and roughly also mixture concentration, stresses and displacements and water level were measured. Process and check valves behaviour was also visually monitored. Selected methods including visualisation were verified before test on equipment for small- scale test (SVUSS). Three experiments presenting design accident LOCA were carried out in September and October 1999. The first one was focused on integrity of system in middle term phase of accident, remaining two experiments were focused on an initial phase and effect of break location (far from and close to bubbler condenser) Concurrently with these tests the strength analyses and test of internal structures of bubbler condenser reproducing the Dukovany and Bohunice NPPs were carried out in order to verify integrity of steel structure in assumed pressure loads (pressure difference up to 30 kPa). The tests were prepared and carried out both with dynamic load for different rate of pressure increase (small model with three sizes of gap-cap units) and for step by step increased static loading up to expected maximum (model with two sections each containing nine "gap-cap" units in full scale).

-264- Test results

Bubbler condenser had worked during all thermal - hydraulic tests in expected manner and after tests neither damage nor mechanical failure were detected. Test evaluation and their analysis showed that: • Results of measurement of main quantities (pressures, temperatures and pressure differences on bubble condenser) are representative • There is relatively significant non-uniformity in water warm up in bubbler condenser pool • No significant tear off of water to air traps occurs. • During flow through corridor to the bubbler condenser complex thermal-hydraulic conditions occur • Conservative results were predicted by computation programme (little conservative for maximum pressure, more conservative for initial pressure difference) • Measured initial pressure difference did not exceed the value of 20 kPa for conditions reproducing the Paks NPP, for other NPPs it will be smaller than 22 kPa. • According to measurements the maximum pressure should not exceed the value of 210 kPa for any NPP • The test results should be further analysed and should serve for validation and further development of computation programmes.

The strength and integrity of internal structure of bubbler condenser was successfully proven by strength tests with following conclusions: • Even in maximum pressure the structural integrity and tightness of bubbler condenser remained intact. • Partial strains of some parts of internal structure were identified at 24 kPa overpressure however they did not affect proper function of facility • Methods used for strength analysis showed that they are sufficiently representative and calculated results were in well compliance with measured values • Several provisions and small reinforcing were recommended for structure of the 1M and the last floor of bubbler condenser.

&_ Conclusion

The containment in WWER 440/213 NPPs is an original and fully functional technical solution. Due to utilisation of large reserve of H3BO3 solution and due to activity of active spray systems an underpressure can be quickly created and this way any impact of accident on environment is minimised. The capability of the bubbler condenser system for maximum design accident has been proven by analyses and tests carried out within framework of PHARE PH 2.13/95. It was proven that bubbler condenser system could reduce pressure in containment in an effective way. The majority of up to now arising questions and comment was answered and sonic so far existing concern resulting from insufficient verification of this system according to western standards were refuted. The WVVER 440/213 containment is fully valuable choice of worldwide used design solutions of NPP containment and it fulfils appropriate requirements.

-265 - CZO129430

Programs of plant life management at NPP Dukovany *Karel Pochman, **Martin Ruscak, **Milan Brumovsky *CEZ - EDU NPP Dukovany, Czech Republic **Nuclear Research Institute Rez pic, Czech Republic

Abstract

The program of lifetime management at NPP Dukovany is oriented towards an effective usage of facilities while keeping their safety parameters, mainly concerning nuclear safety. The goal is to achieve maximum usage of the design lifetime under the condition of fulfilling above mentioned requirements. Evaluation procedures have been prepared for selected components. These are subsequently discussed and approved by the State Office of Nuclear Safety. The databases of original data are built up regarding the evaluated components. The input data are completed as well according the approved procedures. Generally valid approached based on the evaluation of all possible degradation mechanisms is modified regarding the original status of particular component. The procedures are oriented towards a quantification of residual lifetime. They employ knowledge of initiation and kinetics of degradation mechanisms. They also define parameters, which should be quantified. For irreplaceable components or components which replacement is difficult, the program is focused to the control of operation conditions and inspections of facilities. However, they are again based on the knowledge of degradation kinetics. If at least some parts of the facility could be replaced, better material selection regarding the operation conditions is an option. Systems included into the ageing management system will be specified in the paper. Also, the measures will be identified which serve as a check of implementation of all possible stressors and degradation mechanisms into the first screening. The examples of lifetime evaluation of some systems and components will be given in the paper: reactor pressure vessel, reactor internals, steam generator tubes and feedwater piping. Specific approaches will be shown for different original status of components and different operation conditions.

Introduction

Procedures for Lifetime Evaluation

Periodical lifetime evaluation of NPP main components is required by the Czech ,,Atomic Law" No. 18/1997, as well as by a SONS Decree No. 214/1997. General requirements for

-267 - lifetime evaluation of nuclear pressure vessels and internals is given in the SONS procedures and requirements of lifetime evaluation of WER reactor pressure vessels and their internals during NPP operation" (1998).

Lifetime evaluation is based on potential damaging mechanisms for individual components as well as on their mode of possible failure - e.g. brittle/non-ductile failure for thick ferritic materials, ductile failure for austenitic materials, leakage or full failure for tubing and piping etc. Thus, individual procedures must be prepared for individual components - recommended procedures and necessary requirements as well as material design properties etc. Are given in the ASI CODE, Section IV ,,Lifetime determination of components and piping in WER type NPPs".

Plant life management programme (PLEM) or Ageing management programme (AMP) should be prepared in full accordance with the chosen procedure of lifetime evaluation. This is the only way how to assure necessary effectiveness of activities in decreasing material ageing to assure required components lifetime which is the main aim of the whole process.

Principles of the Lifetime Evaluation Program at Dukovany NPP

The basic concept of the LE program at Dukovany NPP has been based on the assumptions: • only operation conditions could be changed in order to control lifetime of the component or system which is irreplaceable or which replacement is technically or financially difficult • for replaceable facilities, the ageing can be suppressed by replacements of components of such facility, or even by the replacement of all facility. Moreover, a new component or facility may possess better technical or material design To assure an effective usage of the property of EEZ - EDU NPP with minimum costs and minimum increases of input costs is the very basic principle of the plant lifetime management program at EDU. Moreover, it should support also an effort for competitiveness of the company. Together with the LE program, the Program of qualification of safety related facilities is run. Such a principle will be fulfilled if the particular goals are met: • utilisation, operation, diagnostics and maintenance of the facility from the perspective of full usage of the design lifetime, together with the evaluation and keeping qualification of safety related facilities to reach a goal of safe and economical operation till 2025.

-268- • to optimise an usage of irreplaceable facilities or facilities with limited replaceability until the planned lifetime while fulfil all safety and reliability criteria should be kept • re-qualification of facilities in the safety approved cases, especially while fulfilling SONS requirements in the field of equipment qualification, in accordance with decree No. 214/97. In 1999, EDU issued the Rules for the lifetime management of tangible assets under rule of EEZ-EDU. The position of Lifetime program manager has been created. His principle duty is defined as activities that lead to a restriction of facility degradation. It includes also a coordination of persons responsible for the particular facility. The principal scheme of organisation of LE program is given in Fig. 1. The most focused systems are as follows: • Reactor pressure vessel and reactor • Piping of safety class 1 internals • Pressurizer • Steam generator including heat • Feedwater and steam piping exchange tubes • Cables • Main circulation piping • Main circulation pump • Main gate valve

Example 1 of Lifetime Management Programme: Reactor Pressure Vessel

Key elements of a VVER reactor pressure vessel ageing management programme are shown in Fig.2. In general, five steps of the programme are usually defined: /. Understanding RP V ageing This step is fully understood on the basis of many analysis of operating conditions and materials behaviour. 2. Co-ordination ofRPV ageing management programme This programme has been prepared on the basis of Step 1 as well as on regulatory requirements and potential procedures/activities to affect components integrity.

-269- Fig. 1: Scheme relationstrips and principle programs of NPP related to Lifetime management Program (LMP)

PLAN 2. Definition of LMP:

Improve the LM program Integration of activities Minimize expeted degradation • Co-ordination of lifetime control activities • Documentation of LMP • Optimatization of LMP based on current understanding, evaluation and revisions ACT I t DO I 1. Understanding SSC ageing ro 5. SSC maintenance 3. Operation of SCC o The key to effective ageing management: Managing ageing effects: Influencing the ageing mechanisms: • Materials and material properties Preventive maintenance • Stressors and operating conditions Operation according procedures Corrective maintenance • Ageing mechanisms Check of chemical parameters Spare parts management • Degradation sites Operation history Replacement • Condition indicators Maintenance history • Consequences of ageing degradation and failures CHECK

CHECK 4. SSC inspection, monitoring Correct unacceptable degradation and assessments 'nfirm degradation r Correct unacceptable degradation Defecting and assessing ageing effects: Confirm degradation Tesls and calibrations In-service inspections Surveillance Leak detection Evaluation of functionality Record keeping Fig. 2: Flow chart reactor pressure vessels lifetime evaluation

dB dB dB initial operational regimes initial material properties and parameter courses defects in materials

material degradation In-service inspection and neutron fluence

COMPONENT LIFETIME ASSESSMENT EVALUATION OF EVALUATION OF EVALUATION OF EVALUATION OF INTEGRITY vs. NON- FATIGUE DAMAGE DEFECTS CORROSION- MECH. DUCTILE FAILURE ALLOWANCE DAMAGE ro

LIFETIME ASSURED / DETERMINED 3. RPVoperation/use This step is very important as it is fully connected with RPV operation - operation regimes and their conditions have been modified in spite of the basis of known damaging mechanisms and potential mitigation methods. 4. RPV inspection, monitoring and assessments This step represents a continuous activity, which serves as a feedback for the component lifetime evaluation and assurance. Continuous monitoring of operating conditions is supplemented by periodic in-service inspections - non-destructive inspections in four/eight years period and destructive testing of standard and supplementary surveillance programme specimens including ex-vessel fluence measurements. 5. RPV maintenance This step represents mostly potential mitigation activities which are connected with a local damage (flanges, threads etc.) or the substantial part (radiation damage in beltline region. Such mitigation can extend components lifetime by a substantial way. All these steps are connected together by their feedback properties and functions. For reactor pressure vessels in their ,,young" life, the most important part can be seen in a proper inspection and monitoring, and finally on periodical lifetime assessment (based on qualified damaging trends construction) to be able to catch in time any anomalous behaviour of materials. On such basis, a plan of necessary modifications of operating conditions in the case of small imperfections, or a plan for some major mitigation activities (vessel annealing) could be prepared in time to be cost and functionally effective.

Example 2 of Lifetime Evaluation Program: Reactor Internals

The main objective of the Program is coming from the decision of State Office of Nuclear Safety No. 197/95. It has asked utilities to include into the reactor internals strength calculations also evaluation of both strength and lifetime from the viewpoint of influence of irradiation on the changes of material properties. That means also to determine principal damage mechanisms and to prove an ability to control them for all time of planned operation. The principle tasks have been identified: • To secure an ageing management of materials and structures of RPV internals influenced by radiation embrittlement and IASCC. To define the limit values of critical parameters suitable to be monitored on the four year period basis. • To determine sensitivity to radiation embrittlement and IASCC degradations for 40 years of planned operation. To determine current status of mechanical and corrosion mechanical

: -272- properties of reactor internals material. • To propose measures to monitor changes of material properties of reactor internals. To define procedure how to built these results into the current models of damage kinetics. • To calculate stress and deformation status of structures, to compare them with the material properties after 10-40 years of operation. • To determine threshold level of stress and fluence and to estimate kinetics of cracks growth. Based on these values, prepare a model of degradation and subsequent calculation of residual lifetime. As a result of the work, a prediction of degradation of reactor internals will be prepared together with the methodology of in situ measurements and stress and deformation calculations. The principle structure of the Program is shown in Figure 3. There are four main tasks present there. First of them they are inputs. Material selection for the tests comes from the detailed material technology knowledge. Detailed neutron flux calculation was planned in order to determine real fiuences during the planned period of operation. The third input is stress and deformation status of the structure. The second main task contains material irradiation and testing in order to prepare a quantified model of materials degradation. In situ measurements of material properties changes will be designed. Eventually, a procedure for lifetime determination will be proposed.

Example 3 of Lifetime Evaluation Program: Steam Generator Tubes

Within more than twenty years of operation of the WWER 440 steam generators three most frequent types of damage have occurred: stress corrosion cracking of collectors, stress corrosion cracking of heat exchange tubes, erosion-corrosion damage of the feeding pipes. Whereas the latter problem, in principle, has been removed, remedial measures have been introduced to reduce the primary collector damage. The trend of damage in some of the steam generators can play a significant role in ensuring their planned life, even damage rate is rather low.

-273- Preparation of Calculation materials and ofneutron specimens fluxes

Pre-irradiation, transportation

Kinetics of radiation Sensitivity to SCC: SSRT damage: tensile tests SCC YS,TS YS.TS Pheno- menological TE,AR model

Permissible deformations, initiation of SCC defects

Status of the component In-situ measurements Kinematic hardness

(Time to next inspection)

Figure 3: Scheme of WWER reactor internals lifetime evaluation program

WWER 440 steam generators are horizontal bodies with two cylindrical collectors for primary water inlet and outlet. The heat exchange tubing, tube support plates and primary collectors are made of a 08Khl8N10T type titanium-stabilised stainless steel similar to AISI 321. The most significant difference lies in the geometry, given by the vertical design of PWR steam generators in comparison with the horizontal arrangement of WWER steam generators. They lead to differences in the amount of solid particles deposited from the water volume of a steam generator, proportions of the water and steam volumes, extent of the water free surface,

-274- differences in formation of locally concentrated regions in the water phase, possibly also processes of deposition of compounds in crevices and others.

Another difference is the surface temperature of heat exchange tubes, whose level in PWR steam generators is higher by up to 40 K. While the PWR steam generator primary side suffers from stress corrosion cracking, on the WWER steam generator primary side such damage has not been observed. On the WWER 440 steam generator secondary side the damage manifests itself primarily by stress corrosion cracking resulting in tube plugging. In different nuclear power plants the extent of steam generator tube plugging varies, nevertheless in Czech and Slovak plants it attains values of the order of only one tenth of percent of the total number of tubes.

Up to now any simple relationship between operating modes and the defect initiation and propagation has not been established. Stress corrosion cracking results in formation of non- through as well as through-wall cracks oriented primarily in the axial direction, exceptionally also in circumferential direction. The defects are predominantly intergranular. The cracks are initiated either on smooth surface or at the bottom of pits.

At present tube damage is detected primarily by the eddy current method which, however, is burdened with a considerable measuring error. The resulting large scatter can lead to two sorts of misleading: a steam generator tube, which is not significantly damaged, may be plugged or a seriously damaged tube can be omitted. The risk of the latter mistake is reduced by conservatism of limits and by application of results of studies concerned with assessment of critical stresses in a tube with a crack and with measurement of leaks through a damaged tube. It is evident that a considerable over-estimation of damage may occur with unnecessary tube plugging. hi order to evaluate the trend of damage, it is necessary to know the kinetics of the defect initiation and growth. On the basis of this knowledge it is then possible to evaluate the relative increment of damage, as indicated by measurement, especially if larger data files are available, enabling the use of statistical methods. By correlation of measured and predicted values it is possible to assess the extent of conservatism in determination of tubes for plugging, and, if necessary, also to check the efficiency of remedial measures, including changes in water chemistry.

Deviations of the feedwater chemistry from the long-term standard levels bring about changes in the chemistry of crevice environment and in conditions of crack initiation and growth,

-275- presumably also in exhausting the steam generator service life. The changes may apply to more sophisticated water chemistry used to slow down the ageing of components, as well as to unforeseen deterioration of water chemistry, e.g. during the operation of a condensate polishing plant. Knowledge of these parameters enables to predict the extent of service life exhaustion within a time period, e.g. a campaign, providing a model of damage is available.

For assessment of the steam generator ageing an evaluation system has been prepared, enabling to perform the above-mentioned analyses for concrete conditions of WWER steam generators.

Principal features of the system are:

1. Relations for critical crack size and permissible and measurable leak through the defect.

2. Introduction of a hideout return evaluation procedure. At NPP Dukovany analyses have been carried out to identify chemical conditions in crevices.

3. Knowledge of the local crevice environment, based on a HOR analysis by the MULTEQ code, a temperature analysis and a model of dynamics of concentration. In case of occurrence of short-term deviations in water chemistry, these changes can be considered.

4. A model of damage initiation and kinetics of SCC crack growth. It will be experimentally determined on a structurally identical material

5. under conditions simulating the local environment including concentration factor and mechanical stressing of tubes.

6. Time to defect initiation is to be measured by the method of constant loading of C-rings.

7. By slow loading of CT-specimens (RDT test) a threshold value of the stress intensity factor for crack growth should be determined, together with the dependence of the growth rate on the J-integral.

The evaluation procedure is shown schematically in Fig. 4 . On-line and off-line gathering of data on the feedwater and blowdown chemistry, together with the HOR evaluation, should enable to model the local crevice environment. Based on the developed damage model, evaluations should be carried out after each service cycle and they are planned also in case of occurrence of over-limit values in the water chemistry. From the NDE measurements and the predictions the extent of lifetime exhaustion in the given operating cycle is determined.

-276- Fig. 4: Scheme of the lifetime evaluation program for the steam generator tubes

Slowdown Feedwater Hideout return chemistry cliernistry

MULTEQ on-line Database CHEMJS Determination of local crevice composition

Long-term status of Evaluation of water Spectrum of local the circuit/SG water chemistry in chemistries for the chemistry operation cycle model preparation

Calculation of temperatures in crevices

time to stress intensity crack crack factor growth Calculation of kinetics of initiation J-integrai rate densification in crevice threshold value Stress analysis of SG tube in the crevice location

. ' Semi-empirical model: influence of pH, local composition

Time to damage residual lifetime

- Correlation of 'measurementand '.. ... NDE V;;: ^ prediction: status of SG ,-ECf: extension of.: •after trie operation defects populatibh ' i period '

-277- CZO129431

VVER Technical Innovations for Next Century April 19,2000 PYRAMIDA HOTEL Prague, Czech Republic

OPERATIONAL FLUID RAD WASTE TREATMENT TECHNOLOGY - RECENT STATE AND OUTLOOKS FOR OPTIMIZATION

IPR«Na.s.

Zdenek Lastovicka, Ivo Kreisl, PetrTaras IPRON a.s., Zlatnicka 6, 110 00 Praha 1 Czech Republic

Based on the Dukovany NPP (EDU) order, IPRON a.s. performed in the year 1999 the "Concept Study of Neutralization of Semi-liquid RAW Originating in the EDU Processes". This paper summarizes the conclusions of the Study while emphasizing the sludge and sorbent treatment under the conditions of Czech NPPs operating the WER blocks.

-279- Issues relevant to semi-liquid radwastes

As a consequence of purification of wastewater and other fluids most PWR plants (WER as well) produce • liquid concentrates (satisfactory standard technologies for their further treatment are available) radioactive sludges saturated sorbents the latter two items will be referred to as semi-liquid RAWs (SLRAW)

SLRAW treatment concepts for WER440 and WER1000 greatly difer

Radioactive sludge arises as a secondary unwanted product of various hyrdrodynamic and physical-chemical processes even in those where no technological precipitation / coagulation is applied. Sludge can be found in various operating devices, especially in retention volumes for wastewater take-up and cleaning. It is fairly variable and unstable during storage. Sludge particles bind substantial proportion of wastewater activity. Saturated sorbents are produced by particular sewage treatment plants. Filtration cartridges of these plants are flushed according to the operation procedure in dependence on the saturation or silting degree and regenerated. After several regeneration cycles they are washed out into particular tanks in the storage as liquid radioactive wastes.

-280- Differences between VVER440 and VVER1000 installed in CR

WER 440 Dukovany WER 1000 Temelin (no operational experience up to now) Certain processes placed in the main All treatment processes localized in production block BAP Large store volumes in two places: BAP1 & BAP2 Mobilization and final adjustment All technologies up to final adjustment technologies missing available SLRAW storage volumes set Low storage volumes demand steady behindhand vulnerability to operability of the technologies administrative decisions

IPR«Na.s

The basic difference between WER 440 and WER 1000 consists in original designs, where a satisfactory retention volume for the RAW storage was assumed in the former case, while the latter one contrives smaller storage volumes with adjacent final RAW treatment technology. WER 440 design assumed a possibility to expand the storage volumes as well as an implementation of supplementary technologies (objects) for the final RAW processing. In accordance to it, various WER 440-type NPPs manage their wastes in different ways. WER 1000 design concept is already rather complex solution of the SLRAW processing.

-281 - Sludges Sorbents VVER 1000 - NPP Temel n Waste water

SNOV Filtration •*£? Sedimentation

WER1000 power plants process semi-liquid radwastes localized in the buildings of auxiliary processes (BAP). In addition to the original "Russian" solution, a centrifugation separation technology is implemented as an alternative to the insoluble particles separation by mechanical filtration.

Abbreviations: SVO1 - primary coolant purifying plant SVO2 - primary circuit drainage purifying plant SVO3 - radioactive waste water purifying plant SVO4 - pool water purifying plant SVO6 - boric acid concentrate purifying plant SNOV - wastewater collecting tank

-282- IPR9N; SLUDGES SORBENTS VVER 440 - NPP Dukovany WASTEWATER CONCENTRATE

Power plants operating WER 440 treat RAWs both in main production blocks (HVB1 and HVB2) and in BAP. The original "Russian" design was supplemented by the RAW processing unit (ZRAO) and by the flyover bridge (overpass) leading the tubing between BAP1 and BAP2. Somewhat specific to VVER 440 is also pumping RAWs between concurring technologies of SVO3 over long distances, thus increasing the risk of particle sedimentation in the manifold. Abbreviations used are those described in the previous page (for WER 1000) plus one additional: SVO5 - steam generator blow-down purifying plant

-283- NPP Dukovany - SLRAW containing tanks

number total volume SLRAW load Identification 3 [pcs] [m ] [%] Wastewater collection tanks 4 120 16 Sedimentation tanks 2 920 28 Decantation liquor tanks 2 50 4 Wastewater storage tanks 6 1 500 1.2 Sorbent storage tanks 2 920 42 Emergency tanks 2 920 —

From the point of SLRAW treatment there are several representative tanks: Wastewater collection tank lying square stainless steel tank 5.8 * 3 m, height 2 m, working volume 29 m3. It is equipped with a manhole of DN 800. Its bottom has no downslope, it is equipped with a drain pit, however, connected to a drain tube of DN150. There are two such tanks (one for each HVB), at least one operational tank is a necessary condition for the NPP run. Special drainage inflow can be encountered after reactor shutdown as well. Implementation of alternative technologies is awkward because of complicated transportation passageways, inconvenient installation of provisional tubing, limited interspace, high doserate in the room with the tanks.

Sedimentation tank, sorbent tank, emergency tank are the identical reservoirs with an overflow. They are 7.8 m high, with a diameter 9.1 m, total volume 460 m3 each. Their evacuation is questionable because of insufficient suction height of the pumping systems.

-284- NPP Dukovany - legislative requirements

Basic standards: - Atomic Law - S JB directive 184/97 Coll. on the exigencies of radiation protection - Limits and conditions of RAW repository Dukovany (L&C)

Mandatory decisions of S JB related to the SLRAW issues impose on NPP Dukovany: volume limit of admissible stored amount of unadjusted saturated sorbents - 460 m3,

deadline date of accomplishing and commissioning of relevant missing technologies - 03/2001

In fulfilling the S JB directives, the sorbent storage tanks seem the most questionable. As a matter of fact, wastewafer collection and sedimentation tanks represent even more complicated case, since the sludge mobilization is difficult and it may hinder further NPP operation.

IPR«Na.s

The current state of the SLRAW treatment is substantially influenced by malfunction of several installed systems. Above all, the fluidization, mobilization and circulation systems are undervalued. Induced dysfunction of some of other systems operated up to now is threatening to the following objects: wastewater collection tank: sedimentation of coarse-grained SLRAW (sand) may cause obstruction of the drain tubing and hinder the suction pumps operation, sedimentation tanks: too large volume of stored sediments reduce the settling efficiency.

-285- NPP Dukovany - current operation state sedimentation of sludge The sedimentation tank capacity was designed for the NPP lifetime; excessive sludge production takes place, however; disintegration of sludge sediments, fluidization the installed manifolds are insufficient for this task, ejectors are malfunctioning, the built-in piping hinder application of new technologies, disintegration of sorbent sediments, fluidization the tanks are of the same construction as previous - hence identical problems, final RAW adjustment new final LRA W processing site - up to now, only the concentrate fixation by means of bitumenation on the film rotor evaporator was commissioned; SLRAW processing concept encompassing drying and bitumenation in a cauldron evaporator has not been materialized yet.

IPR«N.

Particular sludge layers do not form typical strata (tables) - they have varying thickness. Their specific activity fluctuates up to ten times. The lowest portions are rather stiff, both in sedimentation tanks and in the wastewater collection tank (coarse-grain sediment). Oily products on the water surface present a specific limitation in the sedimentation tank: since any oily leak into the overflow filtration system is undesirable, water level drop under the edge of the built-in partition has to be avoided as well as stirring up the water surface unless removing the organic layer in advance. The concentrate reservoirs contain also sludge of several centimeter thickness. This does not represent any problem, however, since it is fine and light mobile, easy to treat in the RAW processing unit.

-286- NPP Dukovany - sludge characteristics Coarse-grain sludge wastewater collection and sedimentation tanks Fine-grain sludge decantation iquor tank Super-fine sludge wastewater storage tanks and concentrate reservoirs Inorganic components - oxides of Si, Al, Fe, Mn and others, borates Organic components - textile fibers, hydrocarbon derivatives etc. + decay (putrid) products (particularly methane, ammonia, carbon dioxide, hydrogen). More detailed specification concerning particular layers in the sedimentation tank:

Layer Layer volume Contents [m] 3 [m ] 0 0,2 13 sorbenls, coarse-grained admixtures 0,2 1.2 65 dense sludge containing sorbent particles, petrified inorganic lumps sized up to 10 mm, painting and isolation junk up to 12 mm, fibers (textile, hairs) up to 50 mm, soft dumps up to 20 mm 1.2-2 50 watery sludge layer ending by a marked activity leap 2 7.2 335 processing sedimentation layer, pH approx. 9.4 (dissolved NH<) surface 0,025 film of oily matter dense sludge activity beta : 6.9x10* Bq/kg dry weight | alpha : 6.4x103 Bq/kg dry weight

IPR«IM as

Unlike sludge, the saturated sorbents are more homogeneous and better movable. The lowest portions may get stiff since they contain sludge admixtures. A specific issue bound to sorbents is the maximum allowed storage volume, which was set to 460 m3 for the whole NPP. Current volume increase is approx. 10 to 15 m3 p.a. for each pair of blocks.

-287- NPP Dukovany - sorbent characteristics

lon-oxchange resins strong acid kation-exchangers (sulphonic) and strong basic anion- exchangers (ammonia) are being used. Particle size 0.3 1 mm. Active charcoal represents approx. 10% of sorbents by volume. Particle size is 0.4 4.5 mm (75% vol. in the range 1.2 3 mm).

Approx. 10% of saturated sorbents are mechanically degraded. Ion exchangers hold up to 50% fixed water. Sorbent tanks contain also some 20 m3 of sludges. Saturated sorbents wash out into the L-RAW storage is performed after a schedule and recorded. Hence relatively precise data:

tank in BAP1 by the end 1993 -186 m3, tank in BAP2 by the end 1998 -179 m3, Total - 365 m3.

upper sorbent layer in total activity the tanks P 3.0 x 107Bq/kg a 2.3 x 10"Bq/kg

State Office for Nuclear Safety (S JB) continuously lean on NPP to deal with concept solutions of SLRAW treatment; surpassing the limits and terms would lead to penalties. The Code No. 214/97 Coll., issued by S JB, places a duty to assure appropriate quality of every process concerning radioactive substances and ionizing radiation.

Performed analyses show the great discrepancy between the outdated concept of RAW treatment of the WER 440 - based NPPs and the current state of the legislative. Operational experience fosters the modifications to the current state, which are, however limited by the technologies already implemented as well as by the inventory attributes. Necessary optimization procedures will involve extensive resources and capacity.

-288- NPP Dukovany - border conditions

o HVB1 0 HVB2 Accessibility and availability of free rooms in BAP and RAWPU I • BAP1 • BAP2 Sludge mobilization problems I • OVI-RI'ASS Limiting properties of the flyover • RAWPU bridge and tubing

Solutions available on the market

General constrictions: there is a free room in a box intended for a concentrate tank one in each BAP building. There is a free space in the RWA PU too. Accessibility of the rooms limits the implementation of technologies for sludge mobilization in wastewater collection tank. Use of the flyover is also questionable since it is neither thermally insulated nor heated. Moreover, it was neither designed nor tested for the sorbent transportation. Some of the analyzed solutions do not conform to the NPP qualifications, some of them are limited to a partial problem only. The comparative analysis was carried out on the base of available solutions designed by the companies: AEA Technology England Bouygues BTP France Fortum Engineering LTD (formerly IVO Ltd.) Finland Nukem Germany Sage Brno s.r.o. (DUKE) CR SGN France STMI France 3E a.s. (Dukovany) CR VUSAM a.s. (Zvolen) SR Vyzkont s.r.o. (Trnava) SR Westinghouse Savannah River Corp. USA

-289 - NPP Dukovany - SLRAW treatment - process design

SLRAW modification This stage means slight amendments to the current under current storage state only. conditions Mobilization and RAW First tangible step towards a more advantageous storage modification state of the matters. This may be carried out in modifications SLRAW transformation determined by technology requirements on price, into a new form compatibility, volume reduction etc. The solution fits the repository acceptance criteria Final RAW depositing and is compatible with its equipment.

IPR«N as.

Process solution is composed of specific stages of SLRAW mobilization, storage modification, and of its appropriate final adjustment into a new desired form. Selection of reasonable variants and their feasibility assessment stand for a substantial part of the Study. Variants included in the multi-criteria analysis were chosen so as to cover the whole range of technologies - from simple modification up to demanding complex solutions bringing the process on the up-to-date technology level, while keeping their number in reasonable limits. Basic criteria were the safety ones, legislation requirements, environmental impact, technical parameters, financial requirements, conformity with the RAW repository regulations, and references. General constrictions specific to the NPP Dukovany, as well as qualification defined by NPP, were taken into account.

-290- NPP Dukovany - SLRAW mobilization in the wastewater collection tanks (SNOV)

Principal outlines of the SLRAW mobilization in HVBs

to BAP 1 ' to BAP 2

IPR«N;

Variants considered in connection with wastewater collection tanks include always pumping over the sediments out of all SNOVs into the sedimentation tanks and: 1. Implementation of changes to related operation regimes (may be repeated if necessary). 2. Modifications of concurrent technology (pumps, tubing). 3. Reconstruction of the interior of one SNOV so that uncontrolled sludge sedimentation is avoided (the second one remains unchanged as a technology reserve). 4. Complete reconstruction of all SNOVs.

Multi criteria analysis showed the variant No. 1 as optimum.

-291 - NPP Dukovany - SLRAW mobilization in BAP

SEDI- sedimentation tank

SORB - sorbent tank

Principal outlines of the SLRAW mobilization in BPP

i to final RAW treatment IPRGN a.s.

Variants considered in connection with sedimentation tanks are: 1. Pumping over of all sediments to a mobile cementation plant. 2. Pumping over of all sediments to a new stable processing unit (includes sludge transportation via the flyover bridge). 3. Variant 1 + construction of new sedimentation units in both BAPs. 4. Variant 2 + construction of a new sedimentation tank in BAP2 (includes new wastewater transportation via the flyover bridge). 5. Variant 2 + construction of new sedimentation units in both BAPs .

Variants considered in connection with sorbent tanks are: 6. Pumping over of the sorbents from the storage tanks to a mobile processing unit (cementation) by means of a single-purpose device. 7. Implementation of a new stable technology for a reliable transportation of sorbents from storage tanks to a stable processing unit. 8. Variant 2 + construction of new sorbent tanks in both BAPs, involving the transportation technology to a stable processing unit.

The multi criteria analysis found No. 4 as the optimum variant for the sedimentation tanks and No.2 for the sorbent tanks.

-292- NPP Dukovany - SLRAW final adjustment

General sketch of the RAW treatment modification I I

LS."_=.«.i;.»i!!.?JL"."i?..«- 1: I: cement j: •i additives ii

repository •]

O O O i! O O O O RAW processing VllVi—i'i—m

IPR«N as.

Variants considered in the case of final adjustment of sludge and sorbents were: 1. Cementation of semi-liquid RAW, using: a) a mobile unit operating either at BAP1 or at RAWPU, applying a mixer, b) a stable unit inside BAP1, applying mixing in a drum, c) a stable unit inside RAWPU, applying mixing in a drum. 2. Bitumenation of SLRAW in the RAW processing unit with a partial use of the existing equipment. 3. Vitrification of sludge in the RAWPU and filling the sorbents into epoxy-resin in a mobile unit. 4. Dewatering of SLRAW in RAWPU followed by an encapsulation in special containers (HIC) either by filter pressing (a) or by complete drying (b).

Multi criteria analysis found the optimum variant 1c.

-293- NPP Dukovany - optimum process

MOBILIZATION TREATMENT HVB BAP RAW processing unit

RAWinSNOV SLUDGES CEMENTATION pumping out, pumping out, stationary solution operational mode operational mode modifications (ZRAO) modifications new equipment wastewater transfer via flyover

SORBENTS pumping out, operational mode modifications accessory modifications transfer via flyover

IPR«Na.s.

The resulting optimum combination stands for feasible solution that is in compliance with up-to-date legislation requirements.

Since the complex implementation imposes great financial burden, an alternative solution was laid out. This alternative will keep the stored SLRAW within the allowable limits in conjunction with the existing RAW treatment technologies operating. The proposed solution encompasses the following activities: - finding a suitable and reasonably priced container usable for final drying and depositing dry RAWs without a matrix, that would comply with the limits and conditions of the RAW repository in Dukovany, starting the licensing procedure of the container, gradual processing of the sludge from the sedimentation tank and storing it in the containers in the sorage area of the NPP; after obtaining the license depositing the containers in the repository; - preparation of the technology for the sludge mobilization in the wastewater collection tank, so that it can be transferred into the sedimentation tank in appropriate time. The described basic principles of the sludge volume reduction are applicable for the sorbent tanks as well.

-294- Activity schedule proposal: 1. Choice of a suitable container. 2. Design preparation. 3. Negotiation of the design solution with responsible authorities. 4. Setout of the container licensing procedure. 5. Supply of the containers and of the technology for SLRAW mobilization in the sedimentation tanks. 6. Setout of the sludge pumping from the sedimentation tanks. 7. Supply of the technology for SLRAW mobilization in the wastewater collection tanks. 8. Setout of the sludge pumping from the wastewater collection tanks.

After fulfilling necessary formalities the SLRAW processing can start off, being controlled by the technology needs and financial potency of the NPP. The sludge pumping from the wastewater collection tanks can launch as soon as the sludge level in the sedimentation tank is sufficiently low.

-295- CZ0129432

Nonlinear Analyses of the VVER-1000 Reactor Building, subjected to Extreme Loads

M. Lukavec, J. Stepan, J. Maly, V. Lerl

ENERGOPROJEKT Praha, Czech Republic

ABSTRACT: In this paper, analyses of two most severe internal and external extreme loads, such as increasing pressure inside containment vessel and aircraft impact to the peripheral building's external wall, carried out for the WER-1000 reactor building at Temelin NPP in Czech Republic, are presented. Both analyses have been elaborated with the aid of the analysis program ABAQUS under the assumptions of concrete cracking and yielding of steel reinforcement. Calculations have been performed on three-dimensional finite element models composed of shell or spatial continuum elements, used for modeling of concrete, and tension-compression rod elements, that have been used to represent steel reinforcement.

Introduction

The outer reinforced concrete structures of the WER-1000 reactor buildings are required to withstand various extreme accidental and external loads, such as internal pressure and thermal loading, seismic events, external explosions and aircraft impacts. Structural integrity of the pre- stressed concrete containment structure must be satisfied with regard to its strength as well as its hermetic function. Reinforced concrete structures of the peripheral building, that are interconnected with the rest of the reactor building, are required to preserve their load-bearing function, when subjected to the most severe external loads. In both cases, concrete cracking needed to be considered in calculations, since deformation or dynamic response depend on stiffness, that changes rapidly with development of cracks in concrete.

In the first study, the performance of the containment structure under increasing internal pressure have been analyzed on a spatial FE model of a portion of the containment structure and ultimate capacity of the containment vessel in terms of maximum pressure loading has been estimated. Initial state of stress due to pre-stressing of the structure and gravity loading was calculated before application of pressure. Deformation and cracking pattern have been studied at several pressure levels and pressure-versus-displacement characteristics have been plotted for several locations.

The objective of the second study was to assess safety of the external wall of the peripheral building, subject to horizontal aircraft impact. Dynamic response of a portion of the wall, in which the most severe effects were assumed, has been calculated by means of explicit dynamic analysis in time domain. The problem of kinematic interaction of structure with impacting aircraft has not been analyzed, since impact loading has been replaced by an equivalent time-history function of external force, acting at the location of impact and uniformly distributed over the contact area of approx. 3 m2. In the analysis, total mass of the aircraft 7 t and instant speed 100 m/s have been considered.

Containment's performance under increasing internal pressure

The objectives of the static analysis, in which performance of the pre-stressed concrete containment vessel (PCCV) of the Temelin NPP under the conditions of increasing internal pressure was simulated, were the to address the following aspects:

• (i) propagation of cracking in cylindrical wall and spherical dome,

-297- • (ii) load versus deflection characteristics at selected locations,

• (iii) plastic strain development in the steel liner on the inner surface of the containment,

• (iv) estimation of the state of ultimate rupture.

The analysis has been carried out using ABAQUS/Standard by means of Newton-Raphson solution technique, in which external loads are applied to the structural model gradually in small increments and equilibrium iterations are employed at each load increment, since nonlinearities due to material behavior and membrane stiffening were taken into account in the calculation.

Geometry of the Finite Element model is shown in Fig. 1. The inner radius of the cylindrical wall is 22.5 m, height of cylindrical wall (up to peripheral gallery) is 42.4 m, thickness of the cylindrical wall is 1.2 m. Height of the peripheral gallery, into which anchors of pre-stressing tendons are mounted, is 5.4 m. The inner radius of the spherical dome is 35 m, thickness of the shell of the dome is 1.1 m. The dome in the vicinity of peripheral gallery has varying thickness, that grows with decreasing distance from the gallery. Composite shell elements use reduced integration (one material point per element) and numerical integration of the stresses across the section of the shell according to Simpson's rule using 10 material points (9 for concrete and one for steel liner on the interior surface) across shell thickness. Due to the symmetry in plan, apparent from Fig. 2, only a portion of the containment vessel has been modeled. Geometric boundary conditions, at nodes at model's boundaries, were introduced as shown in Fig. 1 (left) in local coordinate systems, orientations of which depend on the direction of the model's boundary. Geometry of rod elements, used in the FE model to represent pre-stressing tendons, is displayed in Fig. 1 (right). Lower bound values of the initial tensile stresses for pre- stressing tendons were adopted, which correspond to the minimum acceptable values.

Young's modulus of 30 000 MPa and Poisson's ratio of 0.2 for concrete was assumed. Behavior of concrete accounts for cracking in tension and plasticity in compression. The standard material model for concrete, implemented into ABAQUS/Standard was used. Formation of the first crack in the material point is governed by the value of principal tensile stress, which exceeds the value of strength of concrete in uniaxial tension. Crack orientation is fixed throughout the calculation. Only two orthogonal cracks can be formed in the material point under plane stress conditions (that is the case of shell elements). Tensile behavior incorporates tension stiffening mechanism, that can be defined either in terms of tensile strain or direct displacement across crack. The latter approach, adopted in the analysis, restrains to some extend the problem of undesired mesh sensitivity of the solution on element size. Behavior of concrete in pure tension with strain softening is plotted Fig. 4, in which irreversible part of deformation ucr (direct displacement across crack) is independent of element size and can be derived on the basis of fracture energy and tensile strength. In compression, associated flow and yield surface, defined by a linear relationship between equivalent pressure (1-st stress invariant) and von Mises equivalent stress (2-nd stress invariant), which is mapped into principal stress space as a compression failure surface, shown in Fig. 3. Hardening function has been derived from the stress-strain relationship of concrete under the conditions of uniaxial compression.

Analysis has indicated linear behavior up to the overpressure of approx. 500 kPa, which was confirmed by pressure integrity test, carried out at the Unit 1 of the Temelin NPP (pressure reached 460 kPa). At the pressure range 500 - 600 kPa extensive cracking occurs in the dome, as shown in Fig. 8 (left), in which the focus of cracking is located in a skew strip, centerline of which in projection onto XY plane contains angle approx. 45 degrees relative to global X and Y axes. Damage index of cracking (used in Fig. 8) is defined as a number of material points throughout the cross-section of the shell with at least one crack. Since the total number of concrete material points across the thickness of the shell was 9, damage index of 9 indicates the portions of the model with complete tensile failure across the cross-section. At the pressure levels 480 - 550 kPa progressive cracking due to membrane action in vertical (axial) as well as horizontal (tangential) direction develops in the cylindrical wall, as plotted in terms of cracking damage index in Fig. 8 (right). Degradation of the stiffness of the structure due to extensive cracking can be observed in Fig. 5 and Fig. 6, in which displacement histories in terms of pressure inside containment vessel are plotted for two selected locations. It is also apparent, that the stiffness does not change remarkably for pressure exceeding approx. 750 kPa. Softening due

-298- to cracking in certain regions of the model can be also be studied by comparing shapes of total deformation in Fig. 7 at two pressure levels.

The pressure has been applied at 430 load increments and calculation had to be restarted several times with altered time incrementation scheme and convergence parameters. Nonlinear solution ceased to function completely at the pressure of 805 kPa due to the loss of convergence of plasticity algorithm of the material model for concrete. Therefore, estimation of structure's behavior for pressures exceeding 805 kPa could only be achieved by means of linear perturbation step, in which pressure increment of 100 kPa was applied. The pressure, corresponding to the onset of overall collapse of the containment vessel can be estimated under the assumption of constant stiffness as the state of stress, in which yielding point of the material of pre-stressing tendons is reached. The complete failure will follow the yielding of tendons almost immediately, since hardening modulus of the material of tendons and its ductility are small (guaranteed ductility is about 4%). The pressure inside containment vessel, corresponding to the onset of total collapse, can therefore be estimated by linear extrapolation of stresses in pre-stressing tendons to the yield stress according to the formula

g(l00)f aS05 pmax = minimum (805 + 100), A

in which Aa1Oo is tendon's tensile stress change in the perturbation, fy is the yielding stress (1620 MPa), a8o5 is tendon's tensile stress at the pressure 805 kPa and minimum is taken for all rod elements, that represent tendons in the FE model. The pressure p^x. that corresponds to the onset of yielding of pre-stressing tendons has been estimated as approx. 1400 MPa. Failure of hermetic liner at smaller pressure levels is unlikely, since strains at the containment's interior surface are small in comparison with ductility of liner's material (about 30 %). The above approach quite obviously neglects redistribution of internal forces due to concentration of plastic stresses in compression in some regions of the structure, esp. at the bottom of the cylindrical wall.

The analysis has confirmed, that the estimated ultimate capacity in terms of pressure inside containment vessel exceeds the pressure at large LOCA accident approx. three times. Safety of the containment structure with respect to internal pressure loading is therefore sufficient.

-299- Fig. 1: Finite element model of a portion of the containment structure with constrained nodes (left) and overlying mesh of rod elements, that model pre-stressing tendons (right)

Fig. 2: Portion of the containment vessel (dashed area), simulated in the calculation, in relation to the geometry of prestressing tendons in spherical dome (plan view)

-300- Fig. 3: Compression failure surface and crack detection surface in principal stress space (plain stress conditions)

Povrch indikace trtilin/Crack Detection Surface

Plocha plasticity v tlaku/Compression Yield: Surface/

Fig. 4: Stress - strain relationship for concrete under uniaxial tension (ucr - irreversible displacement across crack, uet - elastic deformation)

o,= 650000

1600000 \^ i

/ ^\ i \

/ I | / / / I 800000 • / / I / I / •

/ I \ / / I 400000 • Ucr i L i f / i / ' 7 ' 0 • -9 / i 0.00E+0O 5.00E-O5 1.00E-04 1.50E-04 2.00E-04 2.50E-04 3.00E-04 3.50E-04 4.00E-O4 u|m]

-301 - Fig. 5: Pressure versus vertical deflection at the top of spherical dome [kPa, m]

900.00 \ ^ - - " " 800.00

700.00 perturbation 600.00- ] p^K^

500.00- /

!•/•;:; 400.00 • 7 ! 300.00 •

200.00 -

100.00 - / \ \

0.02 0.04 0.08 u[m]

Fig. 6: Pressure versus transverse deflection in the middle height of cylindrical wall [kPa, m]

1000.00

900.00

600.00 •

500.00 •

400.00 -

300.00 4

200.00 -

100.00

0.005 0.01 0.015 0.02 0.025 0.03 0.035 0.04 0.045 0.05 u(mj

-302- Fig. 7: Comparison of deformation at the pressure of 517 kPa and 805 kPa - contours of total displacement [m]

tn ° 3

-303- Fig. 8: Cracking cross-section damage index (1-9) at the pressures 556 and 652 kPa

I I O ^

5. j;

Analysis of the External Wall, subject to Aircraft Impact

The finite element model (see Fig. 10) represents a portion of the north-east peripheral wall (thickness 0.6 m) between elevations +29.40 and +36.60 m, as marked in Fig. 9. Since three- dimensional state of stress in the wall's part in the immediate vicinity of impact is of importance, this section of the model has been made-up of spatial continuum element. The vertical plane of symmetry, which is perpendicular to the wall and contains axis of impact (boundary on the right in Fig. 10), has been introduced by nodal constraints on the boundary of the solid section, as shown in Fig. 10. Two layers of reinforcement have been formed near both surfaces using orthogonal meshes of tension- compression rod elements. The surrounding structure including walls and ceiling slab of the adjacent interior room was modeled by shell elements, that are connected to the central portion by means of kinematic constraints. Reduced integration has been used for all elements, for shell elements 7 material points through element thickness were defined. Average values of material characteristics were adopted in calculations.

Concrete has been introduced by standard material constitutive model, that is implemented into program ABAQUS/Explicit. The model assumes simple Rankin cracking criterion (crack initialization is governed by reaching tensile strength in principal tension), fixed crack orientation and strain softening model, that depends on fracture energy. Behavior of concrete for the most typical spatial element is plotted in Fig. 12. The length of the softening branch ucr in the diagram is independent of element length and can be estimated on the basis of tensile strength a, and fracture energy G, as a value 2.G, la,. Compression plasticity effects could not be considered due to limitations of the material

-304- constitutive model, but these effects are localized into a small region near the exterior surface and are assumed as insignificant. Nonlinear stress-strain relationship for reinforcement is plotted in Fig. 13.

Fig. 9: Longitudinal vertical section through the Peripheral building with the view of the N-E wall, in which portion of the structure modeled by FE analysis and location of the impact center are marked (dashed area)

o o o o o O o CO CO •<*• CO CM CM o iri CO ai 1"") co + rsi CM + CO

Time history analysis of the model subject to time-dependent equivalent external force (see Fig. 11) has been carried out by means of explicit integration in time domain, that simulates stress wave propagation, important in short-term dynamic events. Time stepping is managed fully by analysis program in order to satisfy criteria for numerical stability of the solution. Total duration of the dynamic event was 0.1 s and minimum stable time increment 1.48 . 10'5 s. Rayleigh damping, giving equivalent modal damping 5 % for the first natural frequency (-50 Hz) has been specified for the dynamic

-305- analysis. Initialization of stresses has been performed by initial quasi-static analysis, in which vertical loads under normal service conditions were applied (mass scaling was used to reduce number of analysis steps).

Fig. 10: Finite element model of a portion of the peripheral wall with nodal constraints, specified in global coordinate system (1, 2, 3 - translations, 4, 5, 6 - rotations)

Axis o f im pa ct

Analysis results in terms of deformation and stresses are shown in Fig. 14 through Fig. 16. "Departure" of approx. two nodes immediately opposite the impact center (see Fig. 14) is caused by scabbing of concrete near the interior surface. Scabbing has been introduced by specification of failure criterion for continuum elements, that the element is inactivated when two orthogonal crack are formed in the only element's material (and simultaneously integration) point. Depth of the scabbing zone can be estimated on the basis of this as approx. 100 mm.

The remainder of the structure is weakened by tensile cracking, that spreads over a region near the interior surface, surrounding the scabbed area. As seen from the history of transverse displacement of the node in the impact center (see Fig. 15), the maximum deflection is approx. 10 mm. The contours of principal compressive and tensile stresses in the solid portion of the model show a decrease in principal tension in the scabbed region (see Fig. 16, left) due to strain softening of concrete in tension and maximum compression near the exterior surface (see Fig. 16, right).

The analysis have proven, that the exterior wall preserve its bearing function, even when serious local damage is inflicted in the impact region.

Conclusion

The calculations have indicated that degree of safety of both structures with respect to analyzed effects of extreme loads is sufficient. The obtained analysis results have indicated, that program ABAQUS is a suitable tool, that can be used effectively for analyses of concrete structures subject to extreme static or dynamic loading.

-306 - Fig. 11: Time history function of the equivalent impact loading force [MN, s]

Pmax=j5.1MN

.J.

0 0.01 0.02 0.03 0.04 0.05 0.06 0.07 0.08 t[s]

Fig. 12: Behavior of concrete in uniaxial tension

0.0E+00 1.0E-04 2.0E-04 3.0E-04 4.0E-04 5.0E-04 6.0E-04 7.0E-04 8.0E-04 9.0E-04

-307- Fig. 13: Nonlinear stress-strain relationship for reinforcement in uniaxial tension

fu=569

500

400

200 -

0.02 0.16

Fig. 14:Deformation at time of maximum transverse displacement (t=0.027 s) [m]

| 0.00282

0.002 I I

O.:-O\ *•

Ourput S et: S tep 2-1824. 0.02743, Oe for me cKO.Oll 4): Total Trans la lion. C oniour. Y Translation

-308- Fig. 15: Time history of transverse displacement of the node in the impact center (exterior surface)

10 20 40 50 60 70 80 90 100 Time [ms]

Fig. 16: Contour surfaces of principal compressive and tensile stresses in the solid portion of the model in the vicinity of impact [kN/m2] at time of maximum transverse deformation (t=0.027 s)

utSili'S tep 2-1S24. 0.02 743 DefOfmed(O.OII4]:ToIalTranilali Contour: 5 olid Min p rin S Irtss

-309- CZ0129433

SCORPIO - WER Core Surveillance System

Arne Hornses, Terje Bodal, Svein Sunde Institutt for energiteknikk OECD Halden Research Project P.O.Box 173, N-1751 Halden, Norway

Josef Běláč, Miroslav Lehmann, Marek Pecka, Karel Záleský Nuclear Research Institute NRI Řež plc 250 68 Řež, Czech Republic

Jiří Švarný, Václav Krýsl, Zdenka Jůzová ŠKODA JS, a.s. Orlík 266 316 06 Plzeň, Czech Republic

Anton Sedlák, Milan Semmler Chemcomex Praha, a.s. Pražská 16 102 21 Praha 10, Czech Republic

ABSTRACT

The Institutt for energiteknikk has developed the core surveillance system SCORPIO. The SCORPIO system represents a practical tool for reactor operators, which can increase the quality and quantity of information presented on core status and dynamic behaviour. This leads to an improved plant safety, as undesired core conditions are detected in an early stage and can be more easily prevented. More flexible and efficient plant operation is made possible. The system has been originally implemented on western PWRs, but since the basic concept is applicable to a wide range of reactors including VVERs a VVER version of SCORPIO has been developed and implemented in co-operation with the Nuclear Research Institutee, ŠKODA JS, a.s. , CHEMCOMEX Praha a.s. and Dukovany NPP. The main differences between VVERs and typical western PWRs with respect to core surveillance requirements are outlined. The development of. The first system SCORPIO-VVER has been implemented at Dukovany NPP, where after the installation, the Site Acceptance Tests and trial operation received a license issued by Czech nuclear regulatory SONS on September 2, 1999 for use as a Technical Specification Surveillance tool replacing the original Russian VK3 system. New approach and set of Technical Specifications is also in use at the Dukovany Plant. SCORPIO- VVER system is under operation on three Dukovany NPP Units and to be implemented on the last unit in April/May 2000.

-311 - 1. INTRODUCTION The SCORPIO system [1] has been in operation at the Ringhals PWR unit 2 in Sweden since the end of 1987. In addition, the system has been installed at Nuclear Electric's Sizewell B PWR in UK and all the 7 NPPs of Duke Power Co. in USA [2]. The development of the VVER version of SCORPIO has been carried out in co-operation with the Czech partners Nuclear Research Institute e (NRI), Skoda and Chemcomex, with the NPP Dukovany as the target plant. The goal has been to adapt the functionality of SCORPIO to address the particular needs in VVERs. The project has been initiated and partly funded by the Science and Technology Agency (STA), Japan through the OECD NEA assistance program. The system specification is general covering all VVER type reactors, and the target system has been prepared such that adaptation to other VVERs, including VVER-1000, can be easily achieved. At present, SCORPIO-VVER implementation project on Bohunice NPP Unit 3&4 in Slovakia funded by European Commission PHARE Program and Covernment of Norway was started on March 15, 2000.

Special characteristics, which have been emphasised for WERs, are: • Control of radial power distribution to minimise fluence at the vessel wall may be important in VVERs due to the small diameter of the pressure vessel. In certain operating regimes, it might be desirable, to reduce the load on certain identified leaking fuel rods. • In VVERs there are a number of fixed in-core neutron detectors and core exit thermocouples, which are used for core surveillance. One problem is to validate the correctness of these measurements. In Western plants one has reported problems with effective validation of the exit thermocouples. With a detailed simulator one can use the simulator to calculate the measurements thus providing analytical redundancy. This increases the possibility of detecting sensor failures at an early stage. This has been demonstrated in PWRs and BWRs where the simulator is used to check the status of fixed in-core sensors and other measurements. • Thermocouple measurements are more credible in a VVER-440 reactor than in standard western plants due to the shrouds surroundings of the fuel assemblies. The major new features of the SCORPIO-VVER core surveillance system compared to existing VVER core monitor systems can be summarised as follows • Improved limit checking and thermal margin calculation • On-line 3D power distribution calculation based on the same physics model as used for core design and safety analysis • Improved validation of plant measurements and identification of sensor failures by util- ising the core simulator as an independent means for calculation of 3D power distribution • Optimum combination of measurements and calculations to obtain more precise values of critical parameters • Predictive capabilities and strategy planning, offering the possibility to check the consequences of operational manoeuvres in advance, prediction of critical parameters, etc. • Provide interfaces to off-line analysis codes for core loading pattern design, neutron fluence calculations at the reactor vessel wall, etc. • Integration of modules for monitoring fuel performance and coolant activity as a means for detection and identification of fuel failures As a consequence of these requirements it was decided that the SCORPIO-VVER version should use the core simulator MOBY-DICK. It was also decided to continue using the PICASSO system as the MMI part of SCORPIO-VVER. The old Picasso-2 system was re-

-312- placed by Picasso-3 [3] which includes much more functionalities than Picasso-2. In addition two new modules, a new PCI model PES [6] and a primary coolant monitoring system PEPA [7] were to be integrated with the basic SCORPIO system.

2. IMPLEMENTATION The SCORPIO-VVER system consists of autonomous modules, which communicate through the communication package Software Bus [4]. The main modules in SCORPIO are identified in the block diagram shown in Fig. 1. A short description of each module follows. Core Follow Mode In the core follow mode, the present core state is calculated based on a combination of instrument signals and a theoretical calculation of the core power distribution. An automatic limit check against the core state is performed on these data. The operator obtains relevant information on core status through the Man-Machine Interface (MMI) in the form of trend curves, core map pictures and diagrams displaying margins to operational limits.

Core Follow System Core Predictive System

Plant Mesurements Input Data

3D Power 3D Power Distribution (Predictive) Distribution Determination Determination

Limit Checking and Limit Checking and Thermal Margin Thermal Margin Calc. Calculation (Predictive)

PCI-Margin Calculation PCI-Margin Calculation PES PES (Predictive)

Primary Coolant Primary Coolant Monitoring, PEPA Meas.Cool Monitoring, PEPA - i (Predictive) Aclivity

Logging

MMI Operator/Reactor Physicist/System Supervisor

Fig. 1. Main Modules of the SCORPIO-VVER system

.1 Plant Measurements Input Data Two modules take care of this task: The Data Acquisition Module (DAM) is implemented with communication facilities to handle two types of data acquisition units (Hindukus and Temperature Measurements Backup System) connected by LAN as TCP/IP clients and provides input data for other modules. Basic functions • Accepting of multiple client connections

-313- • Preparation of data structures with Hindukus and TMBS signals • Confirmation of data transfer by special messages • Periodic updates of communication status information • Software Bus interface to other modules for transfer of data and status information Technical features • Non-blocking communication with clients, safe in the case of client or LAN malfunction • Immediate processing of the client message not blocked by other processing (e.g. output) • A complete message with the Hindukus data processed in less than 100 milliseconds Following characteristics are checked in a data set received from any client: • Size of data structure corresponds with predefined data format for this type of client. • Signal identifiers are in appropriate positions according to predefined data format. • Data are readable; numbers and arrays are in an appropriate format.

The Input Data Processing Module (IDATP) processes all signals from measurements collected by the DAM. Basic functions • Identification of Operational Regime (number of loops in operation etc.) • Signal conditioning, stabilization, quality checking and validation • Signal transformation to physical units • Calculation of primary and secondary circuit parameters including the reactor power • Calibration of temperature sensors in isothermal reactor states Both discrete and analogue signals from Hindukus and TMBS are processed. Most important outputs are temperature and pressure values in all measured locations, linear powers, state of primary circuit loops, control assemblies positions, boron acid concentration, mean reactor inlet and outlet temperatures, temperature rises, coolant flow rate and reactor thermal power. Input data validation is performed in two steps. Primary signal checking is based on comparison of values from signal interpretation and maximum reasonable limits. Faulty sensors are excluded in this step. Advanced method of signal validation is applied to thermocouple and Self Powered Neutron Detector (SPND) measurements. Credibility factor is assigned to each measurement using statistical evaluation of measured and calculated values. For thermocouples and resistance thermometers calibration before the reactor start-up, a special procedure monitors the temperature stabilization process and calculates individual correction coefficients for sensors.

.2 3D Power Distribution Determination The main task of this functionality is to supervise calculations of 3D power distribution and critical boron concentration performed by the core simulator MOBY-DICK on the nodal level. The 3D Power Reconstruction module (3DREC). activated each basic system cycle (15 sec), provides representative 3D nodal power distribution using validated FA outlet temperature and SPND linear power measurements obtained from IDATP and the Simulator results. Basic functions • Calculation of the reconstructed 3D power distribution by two different methods • Triggering of Simulator calculation according to changes in the reactor state. • Triggering of Simulator adaptation according to reactor state and user requests. Two alternative methods of power reconstruction are implemented in 3DRJEC. "Traditional" method is similar to that applied in the VK3 monitoring system, using "local" interpretation of validated in-core measurements, with limited support from Simulator calculation. "Ad-

-314- vanced" method, oriented more on "global" interpretation of both measurement types, uses the Simulator results with higher priority. This method is able to reach acceptable results with significantly less number of valid in-core sensors.

The Simulator module (SIM), activated on request from the 3DREC module (usually each 15 min), has been designed in accordance with the following principal requirements: • The module is based on universal finite-difference few-group program MOBY-DICK [5]. A simple adaptation procedure has been added to "fit" radial and axial power shapes calculated by SIM to the actual "reconstructed" power distribution. A standard 2-group diffusion data library of off-line MOBY-DICK is utilised. • SIM performs coarse mesh (nodal) 3D analysis of actual core states. It solves either a 60° core symmetry segment (standard mode) or the full core (360°) if an explicit perturbation of core symmetry exists, i.e. if there is a significant asymmetry of core loading or individual CFAs are dropped or misaligned. Switching between symmetries is automatic, and return to the 60° calculation is carried out when symmetrical power distribution is re- stored and stabilised. Full core solution is performed with a little simplified core model (with 6 mesh points per FA cross section, instead of 24 points used at SIM symmetrical solution). • SIM uses standard off-line MOBY-DICK archive files as its initialisation files. • SIM provides calculated power, neutron flux and burn-up distributions for: 1) "reconstruction" of the representative 3D nodal power distribution (performed in 3DREC); 2) power distribution "de-homogenisation" (i.e. determination of pin power peaking factors Fq and FAH, carried out in RECON); 3) signal validation (carried out in IDATP); 4) evaluation of probability of fuel defects caused by PCI (performed in PES module). In addition, critical boron concentration calculated by SIM is used to determine the boron concentration in primary circuit, and special input data are prepared for Strategy Gen- erator (SG).

.3 Limit checking and thermal margin calculation The present NPP Dukovany Specification for operation, such as nodal power peaking limits and fuel assembly (FA) temperature rise are checked on the basis of the 3D coarse mesh core follow power distribution [8]. Detailed 3D pin-wise power distribution is produced for determination of Fq and FAH power peaking factors and assessment of all margins to the safety limits (DNBR, LOCA and saturation temperature) on the basis of subchannel analysis. Detailed pin-wise power distribution is processed to provide information for PCI-margin calculation (PES). Two modules are taking care of this functionality: The Reconstruction Module (RECON) has the following functions: • Determination of 3D pin-wise power distribution and pin-wise Fq and FAH • Transformation from 20 mesh to 7 points for FAs including SPND detectors. The Check Module (CHECK) has the following functions:

• Traditional checking of nodal power peaking factors ( kq and kv) • Traditional checking of coolant temperature rise in the fuel assemblies • New function for assessment of the margins to the safety limits (DNBR, LOCA and saturation temperature) • Automatic selection of limit values depending on operational mode • Calculation of transform coefficients for SPND detectors

-315- .4 PCI -margin calculation, PES

The PES module is evaluating local fuel damage probabilities due to pellet cladding interaction. This module has the following functions: • Calculation of the conditioned power distribution • Determination of limits for permitted reactor local and global power change

.5 Primary Coolant Monitoring

The PEPA Module determines the number and type of fuel defects based on the coolant activity analyses (i.e. identification of noble gases and fission products in the coolant).

.6 Logging of data

The LOG Module collects output data from other modules, maintains an archive of outputs and provides output to the LAN for other systems and printed text output of selected arrays. Basic functions • Asynchronous data capturing from DAM, IDATPD, 3DREC, SIM, CHECK and PES modules. • Data sorting (synchronization) in accordance with time stamps in data sets. • Temporary storage of multiple data sets in memory. • Short-term (up to 3 days) disk archivation of selected data from sets stored in memory. • TCP/IP interface for other computers of Unit LAN performing output of selected data. • Automatic calculations of main reactor state parameters mean values per hour and per day. • Automatic recovery after the shutdown - reuse of backups and archive after new start-up. • Configurable print service for printing of selected arrays in specified time intervals. Technical features • Non-blocking communication with clients, safe in the case of client or connection malfunction. • Input calls are processed with a higher priority than output tasks to eliminate data loss. • Memory and disk space requirements are controlled by configurable parameters. When output structures from other modules are received, LOG checks time stamps included in structures and assembles the archive data sets. Selected data are stored in memory approx. 30 minutes to enable a fast output and then a subset of data is transferred to a disk archive. Print service of the Logging Unit is able to print or save on the disk selected arrays in periodical intervals or after user request from MMI. Arrays may be printed in various formats and organized in predefined forms according to a specification in the configuration file. Predictive Mode In the predictive mode of operation, the operator can forecast the reactor behaviour during the coming hours. As no detector signals are available in this case, the accuracy of the predicted core state depends heavily on the quality of the physics model in the predictive core simulator. The state is checked against limits, and the predicted behaviour of the core may be analysed by the operator through a number of dedicated pictures. .7 Strategy Generator The main task of the Strategy Generator (SG) is to assist the operators and reactor physi- cists to derive various operational strategies that can be verified by the predictive simulator.

-316- The strategy generator employs an extremely simplified core model to suggest control strategies for achieving a given power manoeuvre [9]. Power and xenon-iodine densities are calculated for the upper and lower core halves without solving the neutronics and hydraulic equations. The calculations are based on precalculated coefficients for the reactor's response to changes in the inlet temperatures, control-rod movements, and boron and xenon concentrations. These coefficients are found by running the off-line MOBY-DICK for various reactor conditions, and correspond to multidimensional numerical expansion of reactor reactivity.

.8 Predictive simulator The Predictive Simulator Module flPREDSIMt is based on the MOBY-DICK [5]. It is used for calculation of 3D power distribution and critical parameters up to 72 hours ahead of current time. The initial conditions are provided by the 3DREC module. The Strategy Generator module and/or the user himself prepare the necessary input data. The predictive simulator can be used to solve 5 different sorts of tasks. These are: • Solution of load-follow transient without recalculation of critical parameters. • Solution of a load-follow transient with recalculation of critical parameters • Calculation of start-up critical boron concentration and concentrations providing selected subcriticality margins for specified three coolant temperatures and one Bank 6 insertion. • Calculation of start-up critical Bank 6 positions and positions of Banks 4 to 6 selected subcriticality margins for specified 3 coolant temperatures and one boron concentration. • Calculation of shutdown boron concentration at one specified coolant temperature with all rods out of core. Tasks 3 and 4 can only be performed at zero power. The predictive tasks can be started in 60° core symmetry only. To accelerate calculation, 6 mesh points per FA cross section are used.

.9 Limit checking and thermal margin calculation in predictive mode The Predictive Limit Checking Module is triggered by the PREDSIM. It produces detailed

3D pin-wise power distribution for determination of Fq and FAH power peaking factors and assessment of all margins to the safety limits (DNBR, LOCA and saturation temperature) on the basis of subchannel analysis.

.10 PCI margin prediction The Predictive PES module is used to find the minimum difference between limit and linear power on the detailed pin-wise level. The result is based on initial condition from the PES Core Follow Module and inputs coming from PREDSIM, the Predictive Limit Checking Module.

.11 Primary Coolant Activity Prediction The Predictive PEPA module allows, based on results of the on-line module, calculation of radioactive nuclide activities in the primary coolant in transient states of the reactor. The transient is defined by using the Strategy Generator. Man Machine Interface The man machine interface has been designed to be used by three different user groups: O Reactor Operator © Reactor Physicist © System Supervisor and to be used in the two operation modes: O Core Follow © Predictive

-317- The system was designed such that is easy to use and presentation of information is easy to understand and read. An example of a SCORPIO-VVER screen is shown in Fig. 2. This picture shows the reconstructed outlet temperatures. The colour of assembly cells has in this case been selected to indicate the difference between measured and reconstructed temperature rise.

3. CONCLUSIONS The development of the SCORPIO-VYER system has been going on since the middle of January 1996. The development process has followed a well-defined Quality Assurance Plane. Dukovany NPP staff has taken part in the requirement specification, reviews, testing and in coupling of the system to the plant instrumentation. Factory Acceptance Test (FAT) was taking place in the first part of November 1997 and Site Acceptance Test (SAT) was successfully performed during the first week of March 1998. The parallel trial operation of the system and its performance was compared to the original VK3 system used at Dukovany NPP as a part of the licensing process that lead to the license issued by Czech Regulatory SONS on September 2, 1999. The system is now implemented and used as a Technical Specification Surveillance tool on three of the four units at the Dukovany NPP with the installation on the last fourth unit scheduled during April and May 2000.

Vystupm teploty a ohrev .99.6W2&58

Fig. 2. The "RPD, Outlet Temperatures" picture

-318- 4. REFERENCES [1] O. Berg, T. Bodal, J. Porsmyr, K. A. Adlandsvik (OECD) Halden Reactor Project: "SCORPIO-Core Monitoring System for PWRs. Operational Experience and New Devel- opments", ANS Topical Meeting on Advances in Nuclear Fuel Management II, Myrtle Beach, South Carolina, March 23-26, 1997 [2] S. C. Balzard, S. K. Gibby (Duke Power Co.): "Implementation of the Core Surveillance System SCORPIO at Duke Power Company", ANS Topical Meeting on Advances in Nu- clear Fuel Management II, Myrtle Beach, South Carolina, March 23-26, 1997 [3] K. A. Barmsnes, T. Johnsen, C. V. Sundling (OECD) Halden Reactor Project: "Imple- mentation of Graphical User Interface in Nuclear Applications", ENS Topical Meeting on WER Instrumentation and Control, Prague, April 21-24, 1997 [4] T. Akerbask, M. Louka: "The software Bus, an Object-oriented Data exchange System", HWR-446 (April 1996) [5] "MOBY-DICK, Theoretical Foundations of the Macrocode System", Skoda report No. ZJS-1/91 [6] R. Svoboda, M. Valach: "The PCI Safety Margins Assessment for WER-440 core", UJV Rez, November 1993 [7] F. Pazdera, M. Valach, O. Barta, L. Novak, S. Stech: "The Application of the PES-PEPA Expert System at the Dukovany NPP", Technical committee on fuel failure in normal operation of water reactors, 26.5. - 29.5.1992, Dimitrovgrad, Russia [8] "SCORPIO-WER, Navrh algoritmu a ukolu realizace ve SKODA JS", Ae 8771/Dok, (in Czech) [9] S. Hval, "A description of the two-point model used as strategy generator in the core surveillance system Scorpio", HWR-79 (1982)

-319- CZO129434

Czech Regulatory Body Approach to the Design Changes Licensing

A.Miasnikov State Office for Nuclear Safety

All activities of the Czech Regulatory Body (State Office for Nuclear Safety - SUJB) including these dealing with design changes are based on legal framework. Parliament of the Czech Republic passed new act in January 1997 under No. 18/1997 Coll., on Peaceful Utilization of Nuclear Energy and Ionizing Radiation (the Atomic Act) and on Amendments and Additions to Related Acts. The Act entrusted execution of the state administration and state supervision in peaceful utilization of nuclear energy and ionizing radiation, to the SUJB, and newly established the province of its authority. The Act was developed with the objective to re-codify utilization of nuclear energy and ionizing radiation, and, especially to modify so far insufficiently regulated issues such as radioactive waste management, liability for nuclear damage, emergency preparedness. The Atomic Act now regulates > methods of both nuclear energy and ionizing radiation utilization together with conditions for performance of activities related to nuclear energy utilization and practices resulting in radiation exposure, > methods of both nuclear energy and ionizing radiation utilization together with conditions system of protection of human beings and the environment from undesirable effects of ionizing radiation, > obligations within the process of preparation and implementation of measures leading to reduction of both natural and radiation incident exposure > special requirements ensuring civil liability in case of a nuclear damage > conditions for ensuring safe disposal of radioactive wastes ^ performance of the state administration and supervision within the process of nuclear energy utilization, during practices resulting in radiation exposure and over nuclear items. In such a way the Atomic Act defines conditions for peaceful utilization of nuclear energy and ionizing radiation, including activities which shall require the SUJB license or authorization. An extensive list of licensee obligations sets forth. Obligations related to the reconstruction or other changes affecting nuclear safety, radiation protection, physical protection and emergency preparedness of nuclear installation or workplace with important or very important ionizing radiation sources are given in § 9. Licenses for Individual Activities, letter f) where a license granted by the SUJB is required for these activities. The determining safety relevance is based on ranking of Selected Equipment into Safety Classes. Codification of the criteria for ranking and distribution of selected equipment into the safety classes is covered in Part Five (§ 33) of Regulation 214/1997 Sb. of the State Office for Nuclear Safety of August 15, 1997 on Quality Assurance in Activities Related to the Utilization of Nuclear Energy and in Radiation Practices , and Laying Down Criteria for the Assignment and Categorization of Classified Equipment into Safety Classes. The criteria for ranking and separating the selected equipment into the safety classes for the nuclear installations, part of

-321 - which is a nuclear reactor, which is uses the chain fission on thermal neutrons and is light water moderated and cooled, as for the nuclear installations for the radioactive waste storage, for the spent fuel storage, for the disposals of radioactive waste and spent nuclear fuel, and for equipment, fabricating, preparation, storing and depositing the nuclear materials are given in the Annex of this Regulation. The selected equipment is ranked into three safety classes. The selected equipment can be also the component or its part that is important from the viewpoint of fulfillment of safety function of other selected equipment.

For the better understanding all the changes are divided into three categories: A. Changes affecting nuclear safety according to Atomic Act § 9 letter f): a) Modification of selected equipment which changes its safety function or such a change or action into a component (part) which performs or supports a safety function that the property of the component will change with relation to its safety function. b) Change of medium or its parameters. c) Change of manufacturer or of a design of selected equipment. These changes are judged individually. Ranking of the changes is primarily responsibility of licensee holder but it is subject to the inspection and supervision of SUJB. Approval process (partial license - License for Individual Activity) is required. B. Changes important to the nuclear safety Under these changes are understood all changes which are not listed under letter A. but in case of applying incorrect or improper procedures the nuclear safety could be affected. If the changes or activities concern selected equipment of Class 1, the proposed changes or activities are to be reported to SUJB without delay before action starts. Other changes important to the nuclear safety are to be reported at the latest the next day. C. Changes not related to the nuclear safety These changes cover all changes, which are not related to selected equipment. No reporting is required if the changes are not related to the documentation, which is subject to approval (e.g. Techspecs) Czech Regulatory Body (SUJB) is aware that a different approach could be used. E.g. US legislation require a regulation approval of the change before it is made if Safety Evaluation shows that there is unreviewed safety question. An unreviewed safety question is defined in 10CFR50.59 in terms of changes: "A proposed change, test, or experiment shall be deemed to involve an unreviewed safety questions, i. if the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the Safety analysis Report may_be increased; ii. if a possibility for an accident or malfunction of a different type than any evaluated previously in the Safety analysis may be created; iii. if the margin of safety as defined in the basis for any Technical Specification is reduced."

-322- These criteria can be broken down into seven separate questions. They are: • May the proposed activity increase the probability of occurrence of an accident previously evaluated in the SAR? • May the activity increase the consequences of an accident previously evaluated in the SAR • May the proposed activity increase the probability of occurrence of a malfunction of equipment important to safety previously evaluated in the SAR? • May the proposed activity increase the consequences of a malfunction of equipment important to safety previously evaluated in the SAR? • May the proposed activity create the possibility of an accident of a different type than any previously evaluated in the SAR? • May the proposed activity create the possibility of a malfunction of equipment important to safety of different type than any previously evaluated in the SAR? • Does the proposed activity reduce the margin of safety as defined in the basis for any Technical Specification? Both approaches have the same basic objective - to assure that the nuclear safety is not impaired. At present the Czech Regulatory Body (SUJB) examines the advantages and possibilities of alternative approach especially completeness with regards to the safety. Basic requirements for the changes affecting nuclear safety (according to Atomic Act § 9, letter f) is demonstration of safety assurance, which has to done during licensing process. It is obvious that Czech legal requirements, codes and standards must be unconditionally met. For imported equipment (system, component, parts) State Regulatory Body requests the deliverables to be licensable in the country of origin i.e. to meet the national codes and standards which are scrutinised and compared with the Czech requirements, codes and standards. Another obligatory condition is not to disturb other parts of the design (design's compatibility and design's reliability). Safety assurance for safety-related items has to be demonstrated by submitting complete documentation as a Supplement to the Safety Report and Topical Reports. The design change is reviewed not only as separates components but also as integral unit from the point of view of the design's compatibility with other components and parts taking into account existing (original) materials, moderator (water chemistry), especially from the standpoint of (if applicable, following example is written with respect to the new fuel design but similar requirements apply to other components as well): thermal hydraulic properties - vibration, hydraulic resistance, CHF correlation, fuel rod bowing, effect of spacing grids, pressure losses, mechanic properties - rigidity, cyclic fatigue, wear, cladding abrasion, deformation by external forces (load during LOCA and seismic events), kinetics of control assemblies drop, chemical properties - corrosion, hydriding, - Neutronic-physical properties - peaking factors, influence of different enrichment, water-uranium ratio, etc.; shutdown reactivity margin; stability; maximum speed of the reactivity insertion, both calculated and experimental (especially for non-active tests area).

-323- Design's reliability and safety related influence has to be demonstrated by proving that: fuel design parameters will not be exceeded, fuel cooling will be ensured, coolability is always maintained core design neutronic parameters will be met for normal and abnormal operation and accident conditions (as defined in the Decree No 195/1999 Coll. and/or in 10CF50 App.A, or in equally binding Guidelines of the manufacturer's country).

Only qualified codes, accepted for these purposes by the SUJB, can be applied for the calculational analyses. The appraisal (evaluation) of computer codes is based on required specific documentation, namely the computer code abstract, computer code authors quality assurance evidence, certificate of computer code legal purchase, certificate issued by regulatory body in the country of computer code origin (attesting regulatory body approval for the code to be used for safety assessment if such exists), computer code related technical reports. Computer codes (databases, libraries, correlations) used for the nuclear safety assessment belongs to professionally different areas. Categorization of the computer codes is made and seven Technical Appraisal Committee of experts are set up in order to perform the corresponding evaluation according to the computer code orientation. Result of experimental verification and operational experience is required as a part of submitted safety documentation. For fuel system the out-of-core experimental verification should comprise thermal hydraulic and mechanical tests of a fuel rod and fuel assembly, autoclave tests. This part of the experiments must be performed in full scope, prior to the application, and the documentation must include these tests evaluation. In the case of in-core verification, performed as the new fuel experimental loading into the appropriate part of the core, the attention is focused on the inspection program and on the fuel and core conditions monitoring, including inspections of non- irradiated fuel, extended program of the physical start-up before each core with new fuel is put into operation, in-core fuel behaviour monitoring, and post-irradiation tests, which shall begin after first year of new fuel in the core. Concise program including all these phases must be submitted as a part of the application documentation. Operational experience can be linked to the same or similar design. The SUJB requires the progress reports on the work progress and the tests results. A more detailed set of technical reports, which should be transmitted to the SUJB before the official application, must be specified, as well. The aim of this paper was to give concise overview of Czech Regulatory Body Approach to the design changes licensing.

-324- CZO129435

Design of NPP of new generation being constructed at Novovoronezh NPP site

A. Afrov, V. Berkovich, V. Generalov, Yu. Dragunov, V. Krushelnitsky

1. General Layout

NPP general layout is developed for 2 Units, taking into consideration the following requirements: - maximum independence of each Unit; - modular principle of construction using monoblock principle; - optimum arrangement of buildings and structures of the main production process as well as support production and auxiliary buildings and structures; - mitigation of extreme external effects upon NPP operability; - site zoning versus main production and auxiliary buildings.

In the center of the General Layout is the zone of main buildings consisting of the reactor and turbine departments, including outdoor main working and standby transformers, standby diesel power stations, spray ponds of the reactor department vital loads cooling system and NPP-common sheltered centre for emergency actions management at NPP (sheltered centre).

2. Information on the main process solutions

2.1. Process solutions pertaining to the Main Building

General provisions and schematic solutions

NPP equipped with V-392 belonging to ALWR class is a monoblock with four- loop reactor plant, turbine plant with two turbine-driven feed-water pumps. Monoblock layout combines reactor plant double containment, turbine hall, safety and auxiliary systems building and ensures minimum length of engineering infrastructure lines and high reliability of normal operation as well as safety functions.

-325 - The main engineering solutions of the design are aimed at:: - achieving a new qualitative level of safety as compared to V-320; compliance with recommendations of INSAG, IAEA etc.; - application of mature processes and design solutions only (evolutionary approach); - improvement of design economical performances as compared to V-320 and fossil fuel sources; - application of operating NPPs feedback and results of its analysis by domestic and foreign companies; - creation of prerequisites and actual scope of preparatory works to implement by the year of 2020 a large power Unit with mature inherent safety features intended for large-scale application in Russia and featuring obvious efficiency advantages as compared to fossil fuel plants irrespective of region it is located in. The essence of process solutions is based upon use of - advanced WER-1000 with improved efficiency of reactor trip system, maintaining reactor subcritical during cooling down to the temperature of 100 - 120 °C without boron injection, reactivity feedback is improved by means of negative coolant temperature coefficients of reactivity throughout the fuel cycle; - advanced steam generator with primary header structure modified using austenitic steel in the heat exchange tubes region in order to extend its service life; blowdown is arranged from the section with the highest salt concentration in the steam generator boiler water; - advanced reactor coolant pump where the shaft seal is used which prevents the coolant leak in case of loss of power for 24 hours and loss of sealing water and other cooling media; - auxiliary systems of reactor and turbine departments. The operating experience of many Units is used in the course of design development, new engineering solutions tested at operating Units are used as well as the approach aimed at continuous diagnostics of disturbances. - radioactive waste processing and storage systems. In the systems in question new advanced process solutions alongside with the traditional ones with their efficiency proved by many years of experience at domestic and foreign NPPs are used. Selection of new processes and new equipment is justified by relevant R&D and orders are placed with Manufacturers to develop new equipment.

-326- Schematic solutions The reactor plant is four-loop one, primary coolant temperature at the reactor outlet is 322 °C, design primary pressure is 17.6 MPa; 1 RCP with external motor with necessary inertial performances and one horizontal steam generator with submerged heat exchanging surface are installed in each loop; live steam pressure is 6.37 MPa (design pressure is 80 bar); steam capacity of the plant as a whole is»(4 x 1470 t/h). Reactor plant is equipped with four 1st stage accumulators, Nitrogen cushion pressure being 60 bar, 1st stage accumulators are connected in pairs to reactor pressure vessel emergency nozzles in the upper and lower plenums through check valves. Bypass line of each RCP is equipped with systems of coolant high temperature mechanical cleaning as well as with high concentration boric acid tanks and quick-acting valves of quick boron supply system backing up the operation of reactor scam system solid absorbers. One mln kW power turbine plant with optimized system or feedwater regenerative heating. Feedwater plant consists of 2 non-redundant turbine-driven feedwater pumps, it is capable to provide 70% of Unit steam capacity with one pump in operation. Unit safety system in its process part is train-type structure subject to the criteria of high reliability of crucial safety functions fulfilment and minimization of common-cause failures probability. This approach has led to safety systems design with mutually redundant active and passive trains; this diversity covers practically all the main safety functions. Hereinafter the safety systems solutions are described in greater detail. Nuclear Fuel Management Nuclear fuel management system facilitates all the fuel handling operations at NPP and comprises the following systems: • new fuel storage and management system, including its transfer to the reactor department; • refuelling system • spent fuel handling system consisting of: => spent fuel storage near the reactor; => spent fuel storage in a special building located outside the reactor building;

-327- • system of nuclear fuel transportation at the NPP site covering operations from reception of special carriage with new fuel up to sending away a special carriage with spent fuel as well as site internal transportation of nuclear fuel.

Fuel Handling in the New Fuel Storage Facility (NFSF) NFSF is common for the whole NPP and is arranged in a separate building at NPP site. In terms of nuclear safety the NFSF belongs to seismic category 1 structures. So NFSF structures and new fuel handling equipment belongs to seismic category 1 and are designed for extreme external effects. NFSF is designed to house: - 170 fuel assemblies necessary for refuelling of 2 reactors plus 20% extra; - 180 fuel assemblies in casks for complete core loading plus 10% extra. NFSF is equipped with the rack for storing the fuel assemblies and absorbing rods prepared for refuelling. The rack is a metalwork consisting of three slabs rigidly connected by pillars. The cells housing fuel assemblies are spaced 400 mm away, their array being triangular. Before refuelling the prepared fuel assemblies are installed by the NFSF into site-internal transportation container, which in its turn is mounted onto site internal platform and is transported to the reactor department. Fuel Handling in the Reactor Department Among the main fuel handling operations carried out within NPP reactor department belong: - new fuel delivery into the reactor department and its loading into the reactor; - spent fuel removal from the reactor; - spent fuel storage in the spent fuel pool for not less than 3 years; - cooled fuel removal from the reactor department. Cooled fuel from the spent fuel pool is removed simultaneously with the operations on reactor preparation for refuelling. Core refuelling operations cover replacement of spent fuel assemblies, spent burnable absorber rods by new ones and fuel assemblies and absorber rods shifting in the core. Fuel assemblies and absorber rods are handled by means of refuelling machine under protective water layer. During these operations the refuelling machine can handle only one fuel assembly or one burnable absorber rods bundle at a time, fuel assemblies may be shifted together with absorber rods bundles. After operations of cooled fuel removal from the reactor department, spent fuel withdrawal out of the reactor and fuel assemblies rearrangement within the

-328- core the new fuel prepared in the NFSF and delivered into the reactor department is loaded into the core. The spent fuel unloaded from the reactor is stored in spent fuel pool compact storage racks consisting of borated steel cells. Fuel assemblies in the racks are spaced 300 mm away in triangular array. Fuel in the spent fuel pool is protected by level of water with boric acid concentration of 16 g/kg. Radioactive Waste Management Radioactive concentrated liquid media processing Radioactive effluents utilization process includes: - collection and temporal storing; - processing by means of cementation. Liquid radioactive waste is stored separately depending upon its composition and activity IQVQL Temporal storing is envisaged for waste accumulation prior to its processing at the solidification plant and to provide short-lived nuclides decay. Duration of medium-active sorbents temporal storing is 3 months. Dry residues and. low-active sorbents are processed when accumulated. Liquid waste solidifcation system is designed to solidify the liquid waste and its drumming for transportation and safe long-term storage in the processing and storage building. The following technologies are used for liquid waste processing depending upon its composition and activity. - cementation of medium-active ion exchange resins, sludge, salt concentrates; - concentration of low-active dry residues to obtain dry salts; Proper arrangement method of waste storage is used, enabling waste extraction from storage cells to check package or removal to regional disposal. System of Solid Radioactive Waste Processing and Storage Solid and solidified radwaste utilization and storage is designed proceeding from and taking into consideration NPP safety concept during Unit normal operation and during design basis accidents. NPP safety in respect to solid radwaste processing and storage is ensured by application of system of barriers in the way of radioactive substances propagation into the environment. System of Solid Radwaste Collection. Sorting out and Transportation

-329- Solid radwaste is collected and sorted out with regard to its level of activity and processing methods in the places of its generation by loading into appropriate containers or disposable tare Containers and disposable tare is delivered to the non-attended rooms during repair works when waste generation is expected; in the periodically attended rooms and rooms with permanent presence of personnel the containers are installed in allocated places. Number and types of containers are determined in advance by prediction of waste quantity, its composition and activity. Containers filled with waste are combined into lots to be removed to the processing and storing building. For this purpose special sites are provided in the main building. Waste is removed from the reactor department by special vehicles through the transportation corridors. Before leaving the transportation corridor the motor vehicles are subject to dose metering and are washed and decontaminated, if necessary. The solid radwaste from the containment is removed through the equipment lock. Solid Radioactive Waste Processing System To reduce the volume of solid radwaste to be stored it is processed by the following methods: - grinding; - incineration; - compaction. The final product this processing yields is packed into standard drums. Metal waste (pipes, rolled stock), ventilation filters, small items of equipment are ground. Solid radwaste of the 1st and 2nd activity group is compacted. Combustible waste of 1st and 2nd activity groups are incinerated. Solid radwaste processing and storage facilities are located in a separate building System of Solidified Liquid and Solid Radwaste Storing Solid and solidified liquid radioactive waste storage facility is provided at the site. Solid radwaste is stored in specially equipped above-ground reinforced concrete storage building with walls and ceilings sufficiently thick to ensure mechanical strength and biological shielding. Proper method of waste storing is used enabling waste withdrawal out of storing facility cells to carry out package inspection or to remove it. Solid radwaste and solidified product is to be stored in the storage facility in baskets containing 6 standard drums each with subsequent waste withdrawal and

-330- transportation to the regional disposal. Coefficient of cells filling in case of such storage is 0.34. Special drums with highly active waste are stored along guiding lines in the storage cells for 50 years (the whole service life of NPP), with feasibility of their subsequent removal to the regional disposal. Filling factor is 0.59. Nowadays the concept of solid radwaste storage at NPP site for the whole NPP service life of 50 years is adopted. Nevertheless, storing technology and storage structure enables the withdrawal of drummed waste and send it for further processing and storage to the regional disposal as soon as it is designed and constructed. Solid radwaste storage facility is built at NPP site stage by stage with subsequent extension. Initial storing volume is designed for 10 years and is commissioned together with NPP pilot Unit, subsequent extension is carried out if required. The storage facility is equipped with railroad and motor vehicles access points, systems of transporation means inspection and decontamination, radiation monitoring system, system of explosive and fire hazard detection, heat and humidity detection system. 2.2. Main Engineering Solutions Pertaining to Electrical Part HV switchgears 500 and 220 kV are provided in the design for NPP power output into the grid. Outdoor switchgear 500 kV is constructed in 500 kV line.

Metal-clad SF6 gas isolated switchgear (MCS) is constructed in 220 kV line. Application of MCS-220 kV instead of outdoor switchgear is caused by its vicinity to the cooling tower because of terrain relief. According to the design each Unit shall be equipped with one completely water- cooled turbine generator of 1100 MW. Generator and main transformer are connected by shielded busducts with generator breaker between them which is capable to disconnect the short circuit current. Two working transformers of 63 MVA each are installed in the tap between the generator breaker and main transformer. Availability of generator breaker enables schedule Unit startup and shutdown from the Grid through main transformer and to provide auxiliary power supply from working auxiliary transformers in case of generator or process part of the Unit failure without change-over to standby transformer and so enhances the Unit reliability considerably. NPP auxiliary power supply system contains the sources of working, standby and emergency power supply.

-331 - Auxiliary power supplies are divided into off-site and internal ones. The power Grid with its power plants is the off-site power supply. Off-site power may be supplied to NPP auxiliaries through working auxiliary transformers or through standby transformers 220/6.3-6.3 kV. Internal normal operation auxiliary power sources are the turbine generators and emergency auxiliary power sources - diesel-generators and storage batteries. NPP auxiliary power system is designed to supply loads supporting: - NPP normal operation; - Unit brining into safe condition and maintaining it so under normal and emergency operation conditions; - reactor plant state monitoring for 24 hours in case of loss of power and failure to start all the diesel generators. Normal operation and emergency auxiliary power supply systems are envisaged at the Unit. Each Unit is equipped with two working transformers of 63 MVA each feeding normal operation and emergency power supply system loads under Unit normal operation. The design envisages four normal operation sections of 6 kV - in accordance with number of RCPs. Power to each RCP is supplied from individual section so more stable operation of the Unit is provided in case of loss of 6 kV sections as loss of RCP requires Unit power reduction or its shutdown. Emergency power supply system consists of two independent subsystems. Each independent subsystem consists of two trains with mutual redundancy allowed. Installation of dies el-generator of 6300 kW and startup time of 1.5 s and three storage batteries is envisaged in each train as power supplies. Emergency power supply system switchgears are connected to normal operation loads ensuring serviceability of the main process equipment which requires power in case of loss of normal power supply. Here belong turbine oil pumps, shaft turning gear, rotor hydrojack. Normal operation loads are connected to switchgear of only one independent subsystem. Emergency power supply system storage batteries are intended to: - one storage battery is to provide power to control and automation and relay protection devices of emergency power supply system elements, as well as for emergency lighting of loads of this channel of emergency power supply system. Time of the battery discharge is 2 hours.

-332- - the second battery is to provide power to I&C hardware. Duration of battery discharge is also 2 hours; - the third battery is to provide power to reactor control and monitoring devices in case of total loss of a.c. power. Time of battery discharge is 24 hours. Emergency power supply system electric equipment is located in standby diesel power station (SDPS) SDPS for each subsystem are arranged in two separate buildings. Each building consists of two physically separated cells. Each cell houses equipment of one train. The trains are separated by structures of not less than 1.5 hour fire resistance limit. 2.3 Computer-aided Process Control System (I&C) Each NPP Unit envisages independent I&C systems. From the point of view of Unit the I&C is intended to maintain design basis limits pre-set by process parameters values and characteristics of state of process elements and systems designed for normal operation conditions, operational occurrences, emergency situations and accidents. While developing the design the IAEA comments on automation of Units equipped with RU-320 and their operational experience. Simultaneously with the design the I&C hardware was being developed. I&C concept is based on the following fundamentals: • I&C is mainly implemented using modern digital hardware proved by positive operating experience at fossil fuel or nuclear power plants • the design adopts centralized system of Unit equipment control which envisages Unit automatic control from the main control room • standby control room is provided at the Unit to ensure Unit shutdown, cooling down and reactor plant subcriticality monitoring • a protection system train is envisaged for each of four safety system trains • two independent sets of emergency protection are envisaged for Unit emergency shutdown • Unit top level system is envisaged to combine all the automation subsystems into unified system, which implements Unit common tasks as well.

Unit I&C structural diagram represents the main components of the system/protection systems, low level automation and Unit top level control and monitoring systems as well as digital trains of data exchange and remote control.

-333- 2.5 Civil Solutions, Main Building General Layout Main building layout is of monoblock type, main and ancillary equipment of the reactor plant and turbine of each Unit is located in separate compartments. The main building which is a standardized module combines reactor and turbine departments and sanitary-social building. Reactor department Reactor department is a number of adjacent compartments containing reactor plant and systems supporting its normal operation and ensuring emergency shutdown of the Units. Reactor department consists of containment building and process safety systems, buildings of protection safety systems, monitoring and control systems building, normal operation process and special water treatment systems building. All the buildings are constructed on separate foundation slabs. Proceeding from condition of independent response under static and special dynamic effects the gaps between buildings are assumed to be 400 mm. Containment and process safety systems building Containment building consists of cylindrical containment (leaktight part) and two adjacent buildings from opposite sides (non-leaktight part) located on the same foundation slab. Containment houses safety-related systems so it is designed to withstand external effects and belongs to Safety class 1. The building plan dimensions are 73.2 x 43.2 m Building height is 89.4 m. Containment is an accident localization system and consists of two shells: inner leaktight containment and external one, protecting it from external effects. Reactor plant, spent fuel pool, ancillary process systems working at primary parameters, venitlation systems and equipment providing for fuel handling and repair operations are located under the containment. The central part under containment is occupied by the reactor. To both sides of the reactor pit located are the spent fuel pool and internals inspection wells, two Main Circulation Circuit (MCC) compartments housing steam generators, RCPs, Main Circulation Pipelines, pressurizer, bubbler and quick boron supply system tanks. Reactor Pressure Vessel inspection machine and core catcher for beyond design basis accident are located on the slab of leaktight containment under the reactor. Pulse valves actuators maintenance rooms, purification systems rooms (SWT-1, SWT-2), contaminated pipelines valve control chambers, ventilation plants are located around reactor pit. ECCS tanks of the 1st and 2nd stages are located at maintenance elevation. Contaminated equipment washing unit is located next to spent fuel pool from the side of equipment lock.

-334- For execution of transportation operations through the localization boundary the containment is equipped with locks designed to ensure tightness under design basis accidents and design external effects. Personnel access into the containment is through the main lock to the maintenance elevation from control access area of auxiliary process systems building. Emergency lock is provided at the lower elevation to ensure emergency exit of personnel from containment. All the fuel and equipment handling operations are carried out through equipment lock at the maintenance elevation and trestle located outside the containment. Containment building basement part is the space between the leaktight containment slab and building foundation slab. The height of the basement is defined by structural features of cooling down pumps. Containment basement houses primary circuit and spent fuel pool cooling systems, primary circuit I&C and radiation monitoring assemblies (immediately under the core), intermediate circuit system, steam generators emergency cooling down and blowdown systems, I&C and radiation monitoring and I&C rooms of the systems located in the basement. In the building adjacent to the containment from the side opposite to the turbine building there are filters of containment overpressure release filters, service water emergency inventory tanks and exhaust ventilation centre. The building in question together with basement part belong to control access area. The adjacent building from the side of turbine hall except for the floor of the rooms of steam generators emergency cooling down and blowdown systems belong to free access area. It houses the safety-related part of main steamlines and feedwater pipelines, plenum ventilation centre, cable corridors , I&C and radiation monitoring hardware premises. Systems located in the non-leaktight part of containment building (except for the system of containment overpressure release) are divided into two independent channels with 100% redundancy in each channel. Rooms of different channels are separated by walls. Area of one channel (including rooms, corridors, staircases) is completely isolated from the area of another channel and no communications lines (pipelines, cable and ventilation ducts) of other channel pass through it. Corridors of the area of one channel are separated by a vestiblule from the common corridor in order to provide the fire protection measures. Common corridor and emergency exits into the outdoor area are used to provide for the evacuation of personnel from those areas. Main Solutions Pertaining to Containment Civil Structures

-335- Outer Containment Outer containment is made as a cylinder with spherical dome made of monolithic reinforced concrete with cylindrical and dome walls thickness of 600 mm and inner diameter of 50.8 m. Outer containment absorb loads of external effects: hurricanes, tornadoes, external shock wave, aircraft crash. Inter-containment gap is 2.2 m due to conditions of maintenance of inner containment prestressing system and accessibility of surfaces for visual inspection. Intercontainment gap enables gas-air media leaks controlled collection. Inner surface of the outer containment shall be provided with polymeric coating ensuring required tightness of outer containment. Passive heat removal system heat exchangers are located on the outer containment. Heat exchangers layout on the outer containment is designed in such a way, that heat exchangers of only one steam generator could be damaged in case of aircraft crash. Inner Containment Inner containment is made of prestressed monolithic reinforced concrete in the form of cylinder covered with semispherical dome. Containment basic dimensions are defined by equipment layout in the leaktight space and are: - cylinder and dome inner diameter, m; - cylindrical part height, m; - walls and dome thickness proceeding from structural requirements and biological shielding requirements is 1.2 m; Leaktightness of the inner containment is ensured by steel lining. Basic ambient parameters the inner containment is designed for are: During design basis accident: - emergency design overpressure 0.4 MPa - emergency design temperature +150 °C. During beyond design basis accident: - emergency overpressure is 0.6 MPa - emergency temperature is + 200 °C NVNPP-2 reactor department comprises as well the following: Protection Safety Systems Building and Monitoring and Control Systems Building

-336- Electrical building is located between the reactor and turbine departments. Two protection safety system buildings, standard from the viewpoint of their layout belong to safety class 1 and are located from opposite sides of monitoring and control systems building to prevent their simultaneous destruction due to aircraft crash. Each of the buildings houses electrical equipment of two independent channels of active safety systems including independent systems of plenum and exhaust ventilation. Safety class 1 building of monitoring and control systems electrical equipment is located between the protection safety system buildings. It houses the premises of main control room, control and protection system (SUZ) and information computer system panel. The above buildings are made of monolithic and prefabricated-monolithic reinforced concrete. The reactor department includes also: Building of Normal Operation Process Systems (PB) of Special Water Treatment System (SWT) Process systems (PB) and SWT building plan dimensions are 45.0 x 66.0 m (Safety class II) is a process lean-to to the containment building and adjoins the latter by the long wall from the side of transportation trestle. The building houses auxiliary primary systems (PB) including Unit special water treatment. The building is made of monolithic reinforced concrete. Special sewerage, borated and service water drainages collection systems are located at lower elevations. Laboratories are designed at elevation 7.200. I&C, control and protection system premises, plenum ventilation centre, exhaust ventilation centre and stack are located at higher elevations. Access lock into the containment leaktight space is at elevation 31.800; entrance into the building and exit out of the building is through sanitary-social service building.

Turbine Hall and Deaerator Rack Including Oil Handling Building Turbine hall, deaerator rack and oil handling building depends mainly upon the type of turbine plant with condensers located in the basement, three low pressure cylinders and water-cooled generator as well as upon the layout of auxiliary systems and equipment. Turbine building and deaerator rack, including oil handling building belong to Safety category II. Turbine hall plan dimensions are 36.0 x 102.0 m, its height is 40.8 m Turbine hall carcass is designed to be made of steel structures.

-337- Arrangement of turbine hall with its end face towards reactor department enables to use the layout volume to the best for arrangement of equipment and locate turbine steam exhausts as close to the reactor building as possible. Turbine plant foundation is provided with vibration dampers so the transfer of dynamic and vibrational effects upon civil structures of platforms and ceilings resting on turbine plant foundation pillars and by lower support plate are practically avoided. Standby Diesel Power Station (SDPS) SDPS (Safety class 1) is intended to supply power to safety system loads under NPP blackout. Equipment of each safety system train is located in respective isolated SDPS cell. 4 cells with plan dimensions of 30.0 x 33.0 m and 16.0 m high are provided for each Unit. SDPS cells are arranged in pairs, with their short sides contacting and are located in two buildings preventing their simultaneous destruction in case of aircraft crash. Each cell houses: - the standby diesel power plant itself; - intermediate circuit and vital consumers service water supply pumphouse. The building is to be made of monolithic reinforced concrete structures. Sheltered Centre of Emergency Actions Management at NPP fSEAMQ SEAMC is designed in a sheltered two-storey underground structure with plan dimensions 24.0 x 54.0 m belonging to seismic category 1 and safety class 1. The building houses: - standby control rooms of Units 1 and 2 (SCR1 and SCR2); - NPP central control room (CCR) - shelter for 900 persons. SCR is intended to shutdown the Unit in case of MCR failure. From SCR it is possible to monitor and initiate the safety systems and remove heat from reactor plant. Reactor plant and spent fuel pool state can be monitored from SCR under all operating conditions including blackout. SCR availability for 24 hours using storage batteries shall be ensured in case of loss of power. System of crucial parameters recording ("black box"), ensuring information preservation in case of accident at the Unit, is located at SCR. NPP CCR is intended for power generation process control and NPP-common facilities control, radiation monitoring at the site and at buffer area. (ARSMS).

-338- 3. Safety Concept, Safety Evaluation Results, Research Performed

3.1 General Philosophy and Safety Concept NVNPP-2 Unit 1 is designed as NPP equipped with enhanced safety WER- 1000 reactor of new generation. When elaborating the safety concept the evolutionary approach based on thorough analysis of operating NPP Units with V-320 operating experience and design solutions. The analysis incorporated evaluation of advantages and weak points of operating NPPs with V-320 carried out within the framework of development of the concept of safety enhancement of the Units in question, which was implemented in line with domestic and international programmes with participation of leading Russian (AEP, OKB Gidropress, RSC "Kurchatov Institute" etc.) and foreign (EdF, GRS, Siemens) companies as well as IAEA. NPP with V-320 safety enhancement concept was developed using deterministic and probabilistic safety analyses. Proceeding from the analyses performed the conclusions were drawn that the safety level of operating NP Units with V-320 reactors in major part complies with safety level of operating NPP Units equipped with VWR reactors and implementation of measures suggested in the NPP with V-320 safety enhancement concept will ensure compliance of these Units with most of the requirements of valid regulatory documents. However, the qualitatively new level of safety can be achieved by means of elaboration of new design solutions ensuring resolving or reduction of effect of the weak points revealed at NPP with V-320. First of all it is necessary to point out that actually the recommendations produced for NPP with V-320 were thoroughly considered for NPP with V-392 and were subject to special analysis focused upon two main points.

Safety concept used on NVNPP-2 design is based upon application to maximum possible extent the engineering principles of defense-in-depth concept disclosed in valid IAEA regulations and upon usage of results of operating NPPs with V- 320 safety analysis results. NVNPP-2 safety concept covers the following basic principles: 1 Application of functional and/or structural diversity in the systems performing each individual safety function. Mutually redundant active and passive systems are used in the design. Diversity ensures sufficient depth of protection against common cause failures and enables reduction of safety systems unavailability indices by several decades. 2 Usage of active safety system trains (emergency cooling down and ECCS) for normal operation functions execution. At the same time the most of

-339- those components are in the states similar to the state they are during execution of assigned safety functions in the course of accidents. Such mode of functioning of those systems makes it possible to enhance availability and ensure additional protection against common cause failures. For continuously functioning components the latent failures which are the main course of unavailability of the systems in "waiting" mode of operation are avoided. 3 The following design solutions provide protection against human errors: • increase of systems automatic control scope (prevention of personnel interference) in case of a number of design basis accidents and, in particular, in case of primary to secondary leaks; • introduction of passive systems which do not require relevant personnel actions for their actuation. 4 Application of full pressure double containment equipped with hydrogen removal system, containment air discharge and purfication (filter) system and core melt catcher ensuring non-exceeding of the established limiting release under beyond design basis accidents with severe core damage.

Table 1 presents detail list of safety functions together with the lists of systems capable of fulfilling each of them. One should note that most of the design solutions mentioned above were developed basing upon results of PSA performed for operating NPPs with V- 320 reactors and as a part of design of NVNPP-2 Unit 1.

3.2. Safety Systems Technological Bases The greatest modifications as compared to V-320 concern the safety systems. Probabilistic analysis revealed the dominant safety functions and "weak" points of existing design and enabled conclusion that the following solutions are necessary: - the main critical safety functions shall be fulfilled by diverse systems - active and passive ones; - in terms of functional reliability and taking into consideration the maintenance procedures peculiarities the best active safety system part structure is 4 x 100%, at the same time the structure of 2 x 200% yields the best results for support and protection safety systems. The best reliability of main safety functions execution by the active systems is achieved in case the so called "combination" principle is implemented, when

-340- active safety systems mechanisms perform normal operation functions and as soon as accident indications appear they start to perform safety functions either without any change-overs or with minimum number of such change-overs. As compared to traditional "waiting" safety systems this solution improves reliability considerably (5-6 times) owing to low sensitivity to latent failures (failures not revealed in the "waiting" state of mechanism, which is out of operation) and reduces significantly the number of apparatus, valves, cables, instruments, automatic devices etc.). For example, in NPP-92 design there are four pumps in the active system of emergency cooling through the primary circuit and the same functions in the traditional design are carried out by 12 pump assemblies (compared are identical structures of 4 x 100%). Safety systems active part includes: - scheduled and emergency primary circuit and spent fuel pool cooling down ; - steam generators emergency cooling down and blowdown; - intermediate circuit system; - service water supply system; - ventilation and air conditioning support systems. Safety systems passive part incorporates: - passive heat removal system (PHRS); - 1st and 2nd stage accumulator system - quick boron injection system; - inter-containment gap underpressure maintaining system. Active system of emergency cooling through the primary circuit is made of 4 groups of cooldown circuits with a combination of centrifugal and jet pumps in each of them; under normal operation these circuits are used for spent fuel pool cooling; under accident conditions the system executes circuit emergency makeup in the pressure range of 80 - 1 bar as well as spray function. Active system of emergency cooling through the secondary circuit is made of 4 close circuits of secondary coolant cooling - one per each steam generator; under normal operation conditions the said circuits are used for steam generators boiler water blowdown cooling. Passive system of quick boron supply facilitates reactor shutdown in case of control rod system failure (conditions without scram). The system consists of 4 subsystems. Each subsystem has a tank with concentrated boron solution connected to RCP intake and discharge by pipelines, that is it represents RCP bypass. In case of an event requiring reactor trip and solid absorbers system fails to fulfil the function the tank is connected to the loop. In this case boron solution goes to the primary circuit to RCP intake. Inventory and concentration of boron

-341 - solution is selected so that to ensure compliance with safety criteria in case of design initiating events and reactor trip system failure to actuate. The system carries out its function in case of loss of RCP power also as boron solution from the tanks is forced out into the reactor due to RCP coastdown. Passive system of heat removal from the primary circuit (PHRS) is made of four (in accordance with number of SG) groups of close natural circulation circuits. In the ribbed tubular heat exchangers of these circuits the steam extracted from steam generator is condensed; the condensate driven by gravity goes down the letdown pipelines into the steam generator boiler water volume. The PHRS heat exchangers are cooled by atmospheric air coming to the heat exchanging surface near draft airduct outlet through special direct action control gate maintaining steam generator pressure higher than nominal one. This solution under normal operation conditions also makes it possible to prevent heat losses and keep all the PHRS circuits warmed at the same time. In case of blackout this solution prevents adverse primary circuit dynamics (coolant cooling, pressurizer level walk-away etc.). With the circuit being integral the PHRS operation duration is practically unlimited. Passive system of reactor flooding during primary leaks is two groups of accumulators: - 1st stage accumulators - 4 tanks 50 m3 each with gaseous Nitrogen cushion pressurized to 60 bar and connected in pairs to upper and lower reactor plenums through special nozzles in reactor pressure vessel by pipelines equipped with check valves; - 2nd stage accumulators are 8 tanks 120 m3 each connected to the primary cold leg through check valves and to primary hot leg through special spring-type valves, which are kept closed by primary circuit media pressure and when the pressure drops below 15 bar the spring opens the valves. Such connection diagram and valve design ensures continuity of hydrostatic pressure irrespective of primary pressure variation. Installation of throttling devices ensures stepwide limitation of water drainage flowrate with 2nd stage accumulator level decrease. Stepwise limitation of drainage flowrate follows the law of decay power decrease with necessary margin. The water inventory in 2nd stage accumulators enables reactor cooling for 24 hours in case of leaks even under blackout conditions with all the active mechanisms inoperable. If a.c. power is not recovered after 24 hours further core cooling is possible by means of PHRS which maintains low temperature of steam generator boiler water and so ensures condensation of primary coolant steam inside the steam generator heat exchanging tubes under conditions with coolant level in the reactor pressure vessel below hot nozzles. Coolant steam condensate, gravity- driven, returns along the loop pipe lower generatrix back into the reactor pressure vessel to cool fuel assemblies.

-342- 3.4 Accident Product Localization System Design basis sequence of loss of primary coolant accidents is overcome by process systems actuation (accumulators, emergency core cooling systems, containment spay system, containment isolation etc.). Containment ambient parameters design values under design basis accidents are: P = 5atm;T=150°C. Under the beyond design basis accidents, considered in the design when fuel cooling is impaired the limit accident performances values are established as follows: P = 7 atm; T = 200 °C. The same way as it is done for other critical safety functions the containment protection is provided by independent systems: - spray system (conventional one); - passive heat removal system; safety dumping device equipped with high efficiency filtering plant. In any case the filtered discharge system will actuate not earlier than 12 hours after accident initiation. To limit considerably the fission products release beyond containment the permanent rarefaction is maintained in the inter-containment gap. This safety function which belongs to most important functions, is fulfilled by two systems: - exhaust ventilation system equipped with a filtering plant with its suction from inter-containment gap and outlet into the stack; - passive system of suction from the inter-containment gap. This system is communication lines connecting inter-containment gap to PHRS exhaust ducts which are in hot state. Such solution enables permanent removal and purification of inner containment leaks irrespective of NPP power availability and operator actions. According to estimations the rarefaction in any point of inter- containment gap is maintained with inner containment leaks up to 2.8% of volume per day (design leak value is 0.3% of volume per day). Hydrogen suppression system is designed to prevent hydrogen burning or explosion under the containment. The system comprises passive catalytic hydrogen igniters made of efficient high porosity cellular materials. An element of 1.5 x 0.3 x 1.4 m dimensions oxidises 30 1/h of hydrogen, its volumetric concentration is 4%. 50 igniters provided in the design prevent hydrogen explosive concentrations under beyond design basis accidents when 100% of Zr react with steam and hydrogen is generated from other soruces.

-343- For the case of beyond design basis accident leading to core damage and melting through the reactor pressure vessel, there is a core catcher designed which makes it possible to retain the corium within the compartments provided with refractory coating and to cool it by passive means (with the help of accumulated water at the initial stage and by means of return of condensate generated in PHRS heat exchangers. 4.5 Probabilistic Safety Assessment (PSA) NVNPP-2 Unit 1 design includes probabilistic safety analyses performed comprising: PSA-1 for internal initiating events; PSA-2 for internal initiating events; PSA for fires within the NPP premises; PSA for seismic effects. The main goals of PSA are to develop probabilistic models, assessment of probabilistic safety indices using those models and evaluation of achieved safety level proceeding from the results obtained. For such indices the limit environmental radioactive release frequency and core damage frequency were used. Qualitative and quantitative evaluation of safety was performed. For safety level quantification the values of 1.0 E-7 per reactor year for limit release frequency and 1.0 E-5 per reactor year for core damaged frequency established in OPB-88 (items 1.2.17 and 4.2.2) were used for goal probabilistic values. Qualitative evaluation on the basis of PSA results was fulfilled by comparison of NVNPP-2 design compliance with the main engineering or deterministic safety principles established in valid domestic regulatory documents (OPB-88 etc.) and IAEA materials (INSAG-3), which, being met, ensure the required level of defense-in-depth. The brief description of PSA results is presented below. Total limit environmental release frequency over all the internal initiating events is about 4.77 x 10'8 I/year. Functional and structural diversity of safety systems enables deep protection against common-cause failures, and application of passive systems and active systems actuating without personnel interference enable deep protection against human errors. The Table presents the results of estimation of contribution of different initiating events, including internal initiating events, which are probable during reactor power operation and during shutdown, internal fires and seismic effects into the core damage frequency.

Initiating event category Contribution into core damage frequency (CDF)

-344- absolute, I/year relative, % 1. Internal IE during 2.6 E-8 48 reactor power operation 2. Internal IE under 2.2 E-8 40 shutdown conditions 3. Seismic effects 5.9 E-9 11 4. Fires in the NPP 4.0E-10 1 premises All the categories of IE 5.4 E-8 100

The internal initiating events are the main contributors into CDF (~ 88%). The next contributor (~ 11%) is seismic effects. Contribution of fires within the NPP rooms is relatively small (~ 1%). So the engineering solutions used in NVNPP-2 Unit 1 design enable reaching of a qualitatively new safety level as compared to operating NPPs. This safety level meets all the requirements of defense in depth concept and target probabilistic safety indices established in valid regulatory documents.

4 Experimental and Analytical Validation of Passive Heat Removal System Experiments and analyses have been carried out to define PHRS operating parameters over the whole range of specified conditions with the aim to justify the design solutions pertaining to passive heat removal system.

4.1 PHRS Experimental Validation PHRS Experimental Study at Full-Scale Test Rig Full-scale sections of PHRS air heat exchanger-condenser with design power of 5 MW were subject to experimental tests at OKB Gidropress test rig. The experiments were carried out at the test rig with natural circulation steam condensate and air paths modelled, the environment air temperature being from - 19 °C up to + 30 °C and steam condensing duct pressure being from 0.5 MPa up to 6.4 MPa. In the course of experiments the heat exchanger section thermal power is defined within the range of parameters specified during both operation with open gates and "waiting" conditions.

-345- PHRS Experimental Investigation at TDU-1 at IPE of Academy of Science of Belorussia The experiments were performed using double-loop and three-circuit installation 1.0 MW. The installation had two identical loops with simulators of steam generators and air heat exchangers-condensers 400 kW each. Availability of two loops makes it possible to simulate operation of two PHRS-SG circuits in parallel under the conditions of heat exchangers non-equilibrium loading. The experiments were performed with air temperature variation from + 5 °C up to + 31 °C and steam pressure variation in the range from 0.6 MPa up to 5,4 MPa The experiments demonstrated stable operation of heat exchangers within the range of parameters specified. No heat exchanging tube walls and condensate temperature variation is detected.

Experiments at "SPOT-2" Facility at IPE of Academy of Science of Belorussia The facility simulates the main circulation circuit with WER-1000 reactor and PHRS circuit in power scale 1:5500, maintaining hydraulic similarity of full- scale and model circuits and actual difference in equipment location elevations. The main results of the experiments: - possibility of long-term cooling down by passive heat removal system is confirmed for the case of accident with main circulation pipeline rupture and loss of power. Under the conditions of experiments the PHRS heat removal capacity was 97% of the decay power. Experiments for determination of wind effect upon RHRS capacity When wind flow around the NPP main building, depending upon wind direction and velocity, the non-uniform pressure field is created along the containment circumference. It may cause air flow reversal in one or in a group of PHRS exhaust shafts. Atomenergoproject has suggested to use common circular collector at the inlet into the exhaust shafts and one common collector with deflector at the outlet in order to protect PHRS operation against effects of wind. NPP main building simulator in scale of 1:80 was developed and made to investigate the wind effect upon PHRS operation. This simulator was used to carry out experiments at Ts-22 NITs TsIAM in TsAGI to investigate wind direction and velocity upon air flow in PHRS exhaust shafts.

-346- Aerodynamics tests at the main building simulator were carried out for the wind velocity range of 0 up to 90 m/s (from calm to hurricane) and depending upon wind direction from 0 up to 360 degrees in respect to the main building axis. The experiments performed at NPP 1:80 simulator proved the correctness of design decisions on joining the PHRS channels by common inlet collector and common outlet collector equipped with deflector. No circulation reversal in the PHRS exhaust shafts was observed. 4.2 PHRS Parameters Analyses Atomenergoproject has carried out calculations to justify PHRS design parameters over the whole range of preset conditions and under all the PHRS modes of operation including those under extreme temperature and wind effects. A number of computer codes were developed at Atomenergoproject, which facilitate necessary calculations of PHRS steady-state and dynamic parameters, in particular, "RADUGA", "SPOT-KT", "GAMBIT", "STVORKA" codes. Using the above mentioned codes the calculations substantiating PHRS-related design solutions were performed, the effect of PHRS upon reactor plant operation was calculated for different accident conditions. Analyses of dynamic processes during PHRS operation with passive governor of air heat exchangers heat removing capacity were carried out. Analysis proving optimum control device diagram was performed. 4.3 Passive Filtering System Purpose of passive filtering system Passive filtering system (PFS) is intended for controlled removal of steam-gas mixture out of the inter-containment gap under beyond the design basis accidents with total loss of power. Prior to release of the steam-gas mixture into the atmosphere it must be purified at the filters from the radioactive substances entrained through containment systems and elements untightness into the inter-containment gap. Passive filtering system shall be operable under the beyond the design basis accidents with loss of all a.c. power both with tight primary circuit and with primary or secondary leaks. System design Passive filtering system can be divided into the following functional sections: - inter-containment gap; - stack; - filtering device; - air heater; - valves. -347- In case of loss of coolant accident the steam-gas mixture with high pressure and temperature would appear in the containment. Through containment untightness (steel lining microcracks, penetrations untightness, cracks in concrete) the steam-gas mixture enters the inter-containment gap. Air heating in the stack at the expense of the pipe contact with hot air coming into the outlet collector from the PHRS heat exchangers, results in levelling pressure differential in the passive filtering system. Due to this pressure differential the steam-gas mixture passes through the stack and is discharged into the atmosphere. When passing through the stack the mixture is heated up, dehumidified and purified before its release. Mode of Operation There are two modes of operation of the passive filtering system: - waiting mode; - working mode. Under Unit normal operation and under design basis accidents the system is in waiting mode. In working mode the passive filtering system shall ensure rarefaction over the whole height of inter-containment gap as compared to atmospheric pressure. System Operating Parameters The greatest capacity of passive filtering system in terms of clean air provided rarefaction is maintained over the whole height of inter-containment gap is 0.066 kg/s for the worst external conditions. This values is equivalent to total untightness of containment, which is 1.5% of the localization area volume per day, the containment pressure being 0.5 MPa(abs.) that is it exceeds the design leak value by 5 times.

Experimental Study of Steam-Gas Media Flow through Concrete Wall Cracks The experimental installation is designed and built with the purpose of research of the steam-gas propagation through cracks in the concrete wall. The results demonstrate that within the concrete block temperature range of 20.0 - 100 °C there are no moisture drops at the concrete crack outlet. Absence of drops reveals that filtering plant will not be subject to moistening. There were no drops detected at the crack outlet in case of increase in flowrate of pure steam as well as steam-air mixture at concrete block temperature of 20 °C. Block heating over 100 °C resulted in drops appearing from the concrete crack.

-348- CZO129436

THE TECHNOLOGY FOR SAFETY I&C SYSTEMS IN NUCLEAR POWER PLANTS : THE SPINLINE 3 SOLUTION

Philippe REBREYEND , Jean-Pierre BUREL , SCHNEIDER ELECTRIC , Safety Electronics and Systems Department

1. GENERALS

The potential consequences of an accident in a Nuclear Power Plant are deemed non- acceptable. Then searching the best level of safety is a permanent objective. In the case of I&C systems, a particular attention is paid to the role of each system on safety.

Different methods are suggested to address the classification of the I&C systems regarding their importance to safety. International standards like IAEA or IEC or National standards give recommendations on the classification of systems. In any case, the safety systems require a special care to guarantee the correct operation in all situations, even when a failure occurs in the system.

The functional guarantee in any case or any conditions is a fundamental difference between the safety systems and the industrial products. That implies a lot of consequences in term of quality and qualification.

On the technological point of view, safety systems are made of the same types of components as the industrial I&C products. The market of the electronic components has a high changing rate that's why the technology of safety system changes periodically. The experience shows that every ten years a new technological generation is offered for safety systems.

Following the evolution of the technology, the Safety Electronics and Systems Department of Schneider have developed several generations of technologies for nuclear safety systems. The first Digital Integrated Protection System, known as SPIN, has been in operation since 1984 on the French 1300 MW reactors. Now, the digital technology is widely accepted, and Schneider has maintained its effort to propose the best solution for safety system and especially for modernisation of WER type reactors.

-349- 2. MOTIVATION FOR MODERNISATION THE WER I&C SAFETY SYSTEMS

The first WER type reactors have been designed and operated at the beginning of the seventies. Since that time, many reasons can be taken into account for retrofitting the I&C safety systems. • Spare part availability: Some components of the existing equipment have been designed to be operated for a given life time before being definitively replaced. But, the spare parts have become hardly available due to the economic situation and organization of the former Soviet Union, which made some manufacturers unable to supply the missing components. In some extreme cases the manufacturers even purely disappeared.

• Extension of power plant life time : It is becoming important to extend the power plants operation life time over more than one or two decades in order to solve the economical difficulties of the Eastern Countries. Accordingly, the availability of the technological component of the new systems must be ensured over this life time extension.

• Reducing probabilities of blocked or spurious actuation: Regarding safety and operational objectives, the original system is perfectible. Since the different functions have to be wired respectively, the system, as a whole, requests a large amount of components and implies the use of many sensors. Completed by the necessary redundancy to achieve the fault-tolerance, the size of the existing system leads to frequent failures. Furthermore, in normal degraded situations like periodic tests, the existing system is considered as critical.

• Compliance with international standards: The new system must comply with the international safety standards. Thus, the original existing design, compliant with Russian standard has to be up-dated. Nowadays, it is matter-of-fact acceptance that nuclear safety is a universal and international objective, even if the responsibility stays locally.

3. INTRODUCING THE SPINLINE-3 TECHNOLOGY

SPINLINE 3 is the brand name of the latest digital technology developed by Schneider in co-operation with Framatome for all the next projects: new reactors and modernisation of old reactors. This technology is the fruit of more than twenty years of experience in the field of digital safety systems.

-350- This long history is characterised by three generations of digital safety systems shown on the next figure:

2000 '- ." Kozloduy . \ \ 1990 : t Fessenheim.i | 1450 MW \ >( 4 Bugey • 7 I 1980 | | 1300 MW |\ -16 bit Qinshan , ' 1970 | microprocessors I Tihange. -. .* 900 MW I - 8 bit |; - C language i microprocessor j j - SAGA | - analog \ - Nervia network i - assembler ; 32 : \:s - relaying language i sc; DE AY / \

Technological development: the three generations of digital solution

Note: The given dates are approximate. The exact date for the design of a generation should be slightly earlier than indicated.

• The first generation ( 1980) This technological system was the first to be developed, using microprocessors to ensure the protection of a nuclear reactor. This system is considered as the reference model for principles and methods for the development of safety software Microprocessor: 8bits Programming language: assembler Communication: fibre Optic / point to point connection / Serial Asynchronous links This system is installed on 20 NPP in France and has been in operation since 1984. No project is planned to modernise this system.

• Second generation (1990) This generation is a complete new design. The technology has been changed mainly due to the new components available on the market. The main characteristics are the following : Microprocessor: 16bits Programming language: SAGA (synchronous language) and C language

-351 - Communication: fibre Optic / safety Local Area Network: Nervia1 Dual Actuator Control by network

• Third generation (2000) This generation known as SPINLINE 3 technology is an improvement of the second generation. The main evolutions are justified by the technology: a new generation of microprocessors and a new software CAD tool: CLARISSE and a prequalified standard. The main characteristics of SPINLINE 3 are the following : Microprocessor: 32 bits Programming language: SCADE2 software environment and C language, Communication: fibre Optic / safety Local Area Network: Nervia Dual Actuator Control

3.1 OBJECTIVES OF SPINLINE 3

The SPINLINE 3 technology has been developed in order to achieve four major objectives: • To reduce the costs for developing a new project, but keeping the same level of safety as the previous technology. • To reduce the time for development • To guarantee the safety • To guarantee the long term operation

These objectives are the main characteristics of the SPINLINE 3 technology as described in the following paragraphs.

3.1.1 REDUCTION OF COSTS

The costs reduction involves: • A shorter time to develop a new software application: This is achieved with the CLARISSE CAD tool. • A shorter time to manufacture the equipment thanks to a standardized cabling. • A greater capacity to integrate several system in a compact and limited structure.

3.1.2 GUARANTEE OF LONG TERM OPERATION

One of the most important requirements is the long-term maintenance of safety equipment. The necessary huge effort to validate and qualify a new safety system implies the long- term operation in order to pay back the investment. The SPINLINE 3 technology has been designed to offer maintenance services for more than twenty years. A 25 years maintenance agreement has been signed with Electricite de France. An ad-hoc organisation has been settled to guarantee spare parts and relevant competencies

4. MAIN FEATURES OF SPINLINE 3 TECHNOLOGY

SPINLINE 3 is a general modular offer adapted to address the needs of Nuclear Reactors in term of safety I&C systems. This technology should be used on Power Plants and Research Reactors. SPINLINE 3 is a qualified and proven solution based on a complete set of qualified and proven safety modules.

1 Nervia : Name of the Safety local area network developed by Schneider 2 SCADE : Acronym for Safety Critical Application Development Environment

-352- 4.1 HARDWARE MODULAR STRUCTURE

The modular structure of the technology is fundamental to reduce the costs of development of a new project. This concept is applied to the hardware and is combined with the software development methodology. A system designed with the SPINLINE 3 technology is made of qualified Printed Circuit Boards; each of them dedicated to a function. The assembling of boards into racks and racks into cabinets gives the structure of the system. The main PCB are described here after:

4.1.1 CENTRAL PROCESSING UNIT

The Central Processing Unit (CPU) is the core of the system. For safety reasons, the SPINLINE 3 systems are built with single processor units. Each CPU is dedicated to a unique functional Unit. A system may have several functional units communicating with each other via networks. The CPU is the same for all the units. The only difference is the content of the memory with the software and the values of parameters.

The main features of the CPU are: • Microprocessor: 32 bit Motorola 68040 (clock frequency 25 MHz) with a mathematical coprocessor included. • parallel acquisition bus (BAP) control function, • 4 NERVIA network interfaces • 2 asynchronous serial links (insulated from each other and from the logic part), • Memory capacity : - FLASH EPROM 2 Mbytes - RAM 4 Mbytes - EEPROM 64 Kbytes

4.1.2 I/O INTERFACE PRINTED CIRCUIT BOARD

A large panel of interface PCB is offered: • Analogue input -0/10 Volts or 4/20 mA - 16 inputs • Binary Input - 32 inputs • Relay Output (8 relays) • Analogue output-0/10 Volts or -107+10 Volts (6) • Temperature acquisition • Neutron measurement interface • Actuator Control interface using a specific network to reduce the cabling • Nervia extension interface Any safety unit can be built from this limited variety of electronic boards.

4.1.3 NERVIA NETWORK

The Nervia Safety Network has been developed by Schneider to address the highest-level safety requirements for I&C systems. This network fully 1 E qualified in compliance with IEC 60880 . Nervia is already used in the previous generation of SPINLINE. Nervia can be used with fibre Optic or coaxial (75 Ohms) links.

-353- The main characteristics of Nervia are: • Determinism, self-tested, failure tolerance, predefined and constant response time. • 2 Mbits/s - Manchester code • HDLC standard - length 60 bytes including 50 bytes of data • 30 stations , maximum length = 300 m • Token ring , broadcasting protocol • Galvanic isolation = 500 V • Error detection processing • Token regeneration procedure After isolation, the Nervia network can be connected to a PC type computer for supervision or non safety purpose.

4.1.4 CABLING

To simplify and to reduce the time necessary to implement the racks inside cabinets, Schneider has developed a specific cabling method based on standard connections and predefined customised wires and terminal blocks.

4.1.5 ACTUATORS CONTROL

The requirements for safety are linked with requirements for availability of the plant. The SPINLINE technology is specifically designed to offer the best compromise between the safety requirement and the availability requirements to avoid the spurious actuation control. This approach is performed over the whole system from the design of electronic boards up to the achitecture of the system. In addition, the control of actuators is based on a dual control concept using a specific actuation network.

4.2 SAFETY SOFTWARE GENERAL FEATURES

The SPINLINE 3 development methodology, as shown on the following figure, is separated into categories of software: • The system software • The application software

BOARDS APPLICATION BOARDS SOFTWARE INPUTS OUTPUTS

SYSTEM SOFTWARE

Block diagram of software separation

-354- The main features of SPINLINE 3 software development are the following: • Quality : the components of the software are developed and validated to meet the Nuclear Safety requirements • Determinism and simplicity : > Zero-interruption based software > No dynamic memory allocation > Cyclical processing > No parameterised application processing

• Operating safety: > Defensive programming > Write protected software > Physical access to the CPU board necessary for software modifications

• Transparency : > No black boxes > The software is fully auditable by an external organisation

The upper level developing CAD tool is called CLARISSE. Its functions are the following: • Description of the architecture • Development of application software • Generation of programmed unit software • Automatic production of documentation • Configuration management

The CLARISSE CAD tool covers the system dimensions including the different units working in parallel and communicating by the Nervia safety network.

4.2.1 SYSTEM SOFTWARE

The system software includes: • I/O boards management • Interface between the application software and the equipment • selftests • management of cyclical execution of application software The system software is automatically generated from the description of the architecture.

4.2.2 THE APPLICATION SOFTWARE DEVELOPMENT ENVIRONMENT

The application software performs the specific processing of the functional unit.

The application software is developed and validated in accordance with the I EC 60880 by using the SCADE software development environment. SCADE

• SCADE has evolved from the SAGA tool, itself a major innovation of the previous generation of SPINLINE. • SCADE permits development of application software widely used in the field of real time embedded systems for critical applications where safety is concerned (civil aviation (Airbus Industries) , nuclear industry, transport...

-355- SCADE is the most advanced environment for safety software development. It includes: • Specification and design of application software > Formal approach > Represented in block diagrams • Automatic generation of application software code > Block diagrams translated into efficient and safe codes > Code complies with applicable standards (IEC 60880 , DO/178B) 5. QUALIFICATION

The qualification of SPINLINE 3 is based on tests performed according to international standards, especially I EC 60780. These standards are generally adopted as national standards. Three major points are addressed:

5.1 ENVIRONMENTAL CONDITION QUALIFICATION

It concerns the environmental tests and the robustness tests.

Typical environmental tests

Tests Severity Combined variation of Min T° : 5°C temperature and Max T" boards : 60°C voltage Max T° cabinet: 40°C Humidity 70 % RH at 60° C

Robustness tests:

These tests are performed to make sure the behavior in the time of the tested hardware. These test are applied in the following order

Tests Standard Severity

Fast temperature CEI 68-2-14 test Na -25°C +70°C variation 5 cycles Vibrations CEI 68-2-6 test Fc 10 to 500 Hz 2g 10 cycles Dry heat CEI 68-2-2 test Bd 96 hours 70 °C Wet heat CEi 68-2-30 test Db 6 cycles of 24 hours temperature max 55°C Cold CEI 68-2-1 testAb 96 hours -25°C

Acceptance criteria: At the end of the sequence, the hardware still operates.

-356- 5.2 SEISMIC QUALIFICATION

The seismic qualification is performed in accordance to the IEC 60980 (1989). This qualification includes tests and analysis. For the test, a cabinet with racks and printed circuit boards undergoes the seismic constraints on a biaxial moving table. The level and the spectrum of applied accelerations are oversized to cover the required spectrum at the site location. The analysis permits to validate and to apply the results of previous tests performed on a similar hardware configuration.

5.3 EMC COMPATIBILITY

The EMC compatibility has a particular importance in the case of modernisation of WER. The new systems are implemented in the electromagnetic environment of a WER which is particularly difficult for fast electronics and microprocessors. The large amount of relays and the conditions of cabling and grounding give a high level of perturbations. The SPINLINE 3 technology is designed to withstand such level of perturbation. The tests and the level are defined in the I EC 61000 standards as described in the following tables :

Table 1 : Immunity

Environmental Standard CE requirements Units phenomenon (CEI 61000-6-2) Radio-frequency ENV 50140 80 a 1000 MHz amplitude modulated EN 61000-4-3 10 V/m (effective non modulated) electromagnetic field 80 % MA (1 kHz) Radio-frequency common ENV50141 0.15 a 80 MHz mode EN 61000-4-6 10 V(c) 80 % MA (1 kHz) Eiectrostatic discharge EN 61000-4-2 contact discharge: 4 kV, (charge voltage) air discharge: 8 kV, (charge voltage) Fast Transients EN 61000-4-4 +/-2 kV on power supplies ±1 kV on anal, and binary I/O 5/50 Tr/Thns 5 KHz, repetition frequency Surges EN 61000-4-5 Line-to-earth: ±2 kV on AC power supplies Line-to-line: ±1 kV on AC power supplies Line-to-earth: ±1 kV on analogic and binary I/O Power frequency EN 61000-4-8 50,60 Hz magnetic field 30 A/m (effective)

-357- Table 2: Emission According to the EN 55011 standard , the following table gives the limits regarding the emission of radio-frequency

Access Frequency range Limits Envelop 30 MHz to 230 MHz 30 dBfj.V/m near peak value measured at 30 m 230 MHz to 1000 MHz 37 dB^V/m near peak value measured at 30 m AC Power 0,15 MHz to 0,50 MHz 79 dBjiV/m near peak value 66 dBjiV/m (mean value) supply 0,5 MHz to 5 MHz 73 dB^V/m near peak value 60 dB^iV/m (mean value) 5 MHz to 30 MHz 73 dB|_iV/m near peak value 60 dB|iV/m (mean value)

6. CONCLUSION

The SPINLINE 3 technology is the latest digital technology produced by Schneider to offer the most adequate solution to safety I&C systems , particularly for modernisation of WER reactors. This technology developed in co-operation with Framatome has the great advantage, of more than 200 reactors x years of cumulated experience in the field of digital safety systems. The design criteria mainly devoted to achieve the most stringent safety requirement are also combined with the economic objectives in term of investment, maintenance and long term operation. The SPINLINE 3 technology is fully supported by the activity on the French Nuclear Program with 59 NPP in operation.

7. BIBLIOGRAPHY

Jean-Michel Palaric, Alain Boue - Schneider Electric; "The latest spin on digital safety systems" Nuclear Engineering International p38 - 40 february 2000

-358- CZO129437 Technical Support Centre Nuclear Power Plant Temelfn

Nuclear Power Plant Temelin Technical Support Centre

Ing. Karel Kfizek, March 2000

-359- The area of emergency preparedness has not been addressed in the original design of the Temelfn NPP. The emergency preparedness encompasses a variety of engineering and organizational measures including in particular establishing of necessary working places for the Emergency Response Team, the Technical Support Centre, Operational Control Group and development of necessary controlling documentation. The amendment of the Initial Design has been ordered in 1994 from the General Designer of the Temelin NPP, Energoprojekt Praha, a.s., and designers from CEZ-ETE and Skoda Praha, a.s. have been as well involved in the design works. The design works have been complicated by the fact that there was no corresponding legislation in the Czech Republic. Due to this reason, information from similar projects from abroad has been gathered and partial design solutions have been continually discussed with SUJB (State Office for Nuclear Safety). The project has been completed and defended in June 1995. In order to provide for implementation including development of working design, a suppliers' system has been proposed including ca. 15 supplying companies. The most important suppliers have been the companies DELTAX Systems, a.s., WESTINGHOUSE and VUJE Trnava. The implementation of the system is currently completed and pre-complex testing is underway. In the following section, the paper is aimed at the architecture and concept of the Technical Support Centre hardware that is an integrated part of the Emergency Control Centre and is located in the same building as the Emergency Response Team. The task of the Technical Support Centre is to provide for effective engineering support to the operating crew of the main control room under abnormal and accident conditions. In the same time, it provides for development of technical data for the activities of the NPP Temelin Emergency Response Team that co-ordinates and controls all other emergency activities at the Temelin NPP. If it is activated, the Technical Support Centre provides for: • Analyses and assessment of the current process and radiation situation in the power plant and forecast of the next development. • Development of recommendations for working procedures of the operating personnel at the control rooms in case of emergency situations that are beyond the emergency operating procedures. • Determination of both short and long term strategy of the mitigation of the consequences of beyond design basis accidents. • Development of recommendations for providing for the radiation protection of the interfering personnel. • Assessment of the radiological situation at the nuclear power plant and in its environments. • Making forecasts of radiological impacts of potential leakages of radioactive materials. • Assessing the amount of radioactive matters released into the containment space.

-360- • Development of proposals of technical measures to mitigate, suppress or liquidate the accident consequences. In order to enable the Technical Support Centre staff to fulfil the required tasks, it has to have at disposal necessary current information on the conditions of the process equipment, design documentation, SW tools for calculation, making predictions, etc. The current information and data for the work of the Technical Support Centre are provided in particular by the following systems: 1. Process (Unit) Information System (UIS) of the production units 1 and 2. There are located workstations at the workplace of the Technical Support Centre where there are available all data from the process, radiation control, diagnostics, etc. The information format and structure is identical wit that available at workplaces of the operators and of the shift supervisor. This fact is important at providing support to the operating personnel at the control rooms since it considerably reduces the probability of recommendation misinterpretation or other misunderstandings. 2. The process Non-Unit Information system (NUIS). NUIS is intended for data collection from auxiliary process systems (Water Supply Control Room , Auxiliary Building, etc.) and their transfer to the main control rooms and, in addition to that, provides for transfer of selected process data from units 1 and 2 to the Power Plant Information System (ISE). There are located workstations at the Technical Support Centre at which selected data from auxiliary process systems are available. Their format and structure is identical to those at the working places of operators and of the shift supervisor. 3. Historical server (HSR) - an archive of process parameters and process conditions of production units. HSR in the Technical Support Centre is backed up by an identical HSR that is a part of the unit I&C. Necessary process data scanned before and during an accident may be retrieved from the HSR. The HSR data may be as well used for calculations, trends and statistical analyses. 4. The Power Plant Information System (ISE) is designed for administration control of important power plant activities (maintenance, documentation control, spare parts, operations economy, etc.). Among the major application SW used for carrying out standard tasks is in particular the systems PASSPORT®, Lotus Notes® and standard SW of MICROSOFT®. In addition to information that are transferred to ISE from NUIS, there are available in the system additional data from related subsystems, e.g. from the meteorological station , laboratory of chemistry, etc. A local ISE net is built In the Technical Support Centre that is able of autonomous operation in case of the supreme ISE part failure. In addition to standard SW, the local net is provided with additional SW tools making in particular possible: • Preparation and development of sets of process, meteorological, hydrological, geographical and demographic input data. • Modelling of processes, in particular of: • SW tools for the coolant leak detection, prediction of time of core melting, prediction of the leakages of the radioactive substances, etc.

-361 - • SW tools for the monitoring and forecasting of the proliferation of radioactive substances in and off the nuclear power plant. • Comparison of probabilities of occurrence of subsequent events and chains of events including quantitative parameters and comparison of compliance between the calculated probabilistic values and values measured in reality for: • Probable time of event occurrence • Probable leakage amount of the radioactive substances from the containment • Probable time and scope of the core melt • Probable radiological consequences of the radioactive substances leakage on the power plant surroundings 5. SAMPDERP (System of Autonomous Devices Measuring the Dose Equivalent Rate with a wireless transfer) data are transferred by wireless signal directly to the local ISE net in the Technical Support Centre. 6. Meteorological Station - as already mentioned in paragraph 4, the data from the Meteorological Station are transferred to the local ISE net. 7. The design addresses the data transfer from additional related systems, as e.g.: • Power Plant Security Automatic Means System (STPO) • Radio nets • System of Person Retrieval (Paging) • Telecommunications

In compliance with the world-wide practice, none of the systems of the Technical Support Centre is a Class 1E system. However, it is an important feature of all hardware of the Technical Support Centre that they are able of autonomous performance even in case of the supreme systems failure. The Technical Support Centre is able to perform its tasks even at the failure of the supreme system for data and information transfer to the Technical Support Centre since:

The power supply is backed for important pieces of equipment (UPS and DG). The performance of the electric systems is guaranteed for at least 48 hours without fuel makeup. Archiving of selected process data (backup process archive). In the Technical Support Centre there are located backup data archives of both units. The archived data may be used for the needs of the Technical Support Centre staff. An autonomous ISE subsystem provides for the option of carrying out necessary calculations and analyses at a ISE supreme part failure (only loss of on-line information on the in the stores inventory from the maintenance memory occurs, etc.).

-362- • Audio, video communications with the operating personnel in the control rooms. The Technical Support Centre staff can communicate with the operating personnel in the control rooms by means of phones, lod phones, intercom, radio stations, etc. In addition to that, the option of using video communication between the Technical Support Centre and the control rooms exist (working with technical drawings, diagrams, etc.). • The communication paths are mostly diverse - a transfer by a optic cable, radio signal, phone/fax transfer, etc. • The Technical Support Centre is located in spaces that meet the most strict requirements for the environment for the personnel stay under any operations and emergency conditions. The HVAC systems are provided with filtering equipment that is able to filter radioactive substances and most of the war gases. In the same time, the inevitable sanitary equipment and hardware enabling decontamination are provided there.

Conclusion: The erection of the Technical Support Centre for the Nuclear Power Plant Temelin has been a relatively sophisticated and costly issue. It was by proper use of the existing systems, as e.g. I&C, ISE and other systems, that a robust system has been created that is able to meet any requirements laid on the performance of the Technical Support Centre. The decision of the utility CEZ, a. s. that made is possible to establish the Technical Support Centre at the Nuclear Power Plant Temelin has been a right step which shows the level of safety culture within the utility.

-363- CZO129438

TRIBOCORROSION BEHAVIOUR OF 08CH18N10T STEEL Petr KUBECKA1), Miroslav TVRDY2), Francois WENGER3), Pierre PONTHIAUX3' 1) VSB-TU Ostrava;2) VITKOVICE, a.s.; 3)Ecole Centrale Paris (France)

Keywords: tribocorrosion, wear, corrosion, austenitic steel, 08CH18N10T

I. ABSTRACT Tribocorrosion of the 08CH18N10T austenitic stainless steel in a potassium sulphate solution was investigated with the help of pin-on-disk tribometer and polarisation curves method. The results indicate the occurrence of synergetic interactions between electrochemical and mechanical conditions: the damaging of the passive film by friction was pointed out, leading to an increase in the dissolution rate of the metal and simultaneously, the occurrence of electrochemical reactions (gas evolution, dissolution, passivation) was found to modify the tribological conditions (friction coefficient).

II. INTRODUCTION Tribocorrosion is the process leading to degradation of metallic surfaces by simultaneous action of friction and corrosion. It can be observed in many industrial sectors, for example in mining, extraction, paper and nuclear industries. Tribocorrosion is a complicated process involving interactions between mechanical and electrochemical phenomena and a possible synergetic effect between them.

One of these processes, which affect stainless steels and other metals protected against corrosion by a passive film, is the partial destruction of the passive film by friction. If friction speed is sufficiently high, repassivation of damaged surface cannot occur, so an active-passive corrosion cell is formed which further increases in material degradation [1, 2]. The 08CH18N10T stainless steel has been used in the nuclear power plant WER 440 EDU Dukovany for 10 years in the primary circuit. In this circuit, a critical tribocorrosion effect is to be feared, owing to the occurrence of vibrations, and therefore friction, between steam generator (SG) tubes and both

-365- the hole walls of SG collector and the support plates. There is practically no available information on the behaviour of this steel in tribocorrosion conditions.

In the present study, the sensitivity of the stainless steel to tribocorrosion was tested. A pin-on-disk type apparatus modified to carry out experiments in corrosive environment was used for tribocorrosion tests, and the electrochemical method of polarisation curves, was implemented [3, 4] to study the part played by corrosion and passivation in tribocorrosion of the steel. By this method, the influence of friction on the electrochemical reactivity of the surface of the metals can be investigated, and a possible increase in the corrosive dissolution of the metal can be quantified [5, 6].

III. EXPERIMENTAL EQUIPMENT A pin-on-disk type tribometer, designed to work in corrosive environments, was used for tribocorrosion tests. This tribometer is a modified hydraulic-mechanic testing machine. A special rotating head carrying an insulated friction pin holder replaced the upper conventional jaw, and the lower jaw was replaced by the sample (disk) holder and the electrochemical cell.

The tribometer enables to apply a normal force (Fn) up to 20 kN, and a rotation speed of the friction head (co) varying from 1 to 500 rpm. The friction track is circular with a diameter of 16 mm. In this work, the friction pin (ball with a diameter d = 10 mm) is made of sintered alumina. This material has several advantages: it is electrochemically inert in many corrosive environments; so as it is not corroded and moreover it does not form a galvanic cell with the tested sample. In addition, its hardness is high enough, so as deformation and wear of the pin can be neglected during the tests.

Applied normal and generated tangential (Ft) forces were measured continually with help of sensors and are converted by signal amplifiers. The signal is then further processed by computer, which calculates the friction coefficient (u). Applied electrochemical potential (E) and current (I) are recorded continuously and processed simultaneously with aid of data processing card [7].

-366- i

Figure 1: a) Scheme of tribocorrosimeter. b) Detail of tribocorrosimeter: I- Pin holder, 2- Pin, 3- Solution, 4- Counter-electrode, 5- Specimen: Working electrode, 6- Tangential force sensor, 7- Specimen holder, 8- Testing cell, 9- Reference electrode, 10- Insulated rotating head, II- Normal force sensor.

IV. EXPERIMENTAL MATERIAL AND CONDITIONS Cylindrical samples (d = 25 mm) were prepared from 08CH18N10T steel supplied by Vitkovice a.s. The chemical composition of the steel is given in Table 1:

Table 1: Chemical composition of 08CH18N10T steel. c Mn Si Ni Cr P s Ti 0,073 1,42 0,48 10,90 19,10 0,010 0,0125 0,66

-367- The main mechanical properties of this steel are the following:

Re = 258 MPa; Rm = 546 MPa; A5 = 65 % and Z = 77 %.

Electrochemical measurements are not possible in pure water because of low conductivity. A solution of potassium sulphate (0.4M) was used as a testing

environment. It was prepared from distilled H2O and pure K2SO4. All tests were carried out at room temperature (25°C). In this medium, corrosion and passivation of

the steel can occur, depending on potential and friction conditions. The K2SO4 solution should not be considered as a much more corrosive medium than water in the SG, especially because of the difference in the temperature between the test and SG conditions.

Potentiokinetic polarisation curves were recorded at a constant potential scan rate of 1,67 mV s'1. The initial potential was -1800 mV/SSE (SSE: mercury/mercurous sulphate saturated reference electrode), and the potential was increased up to the value of +2100 mV/SSE (direct scan). Then the scan was reversed, and the potential was decreased down to -1800 mV/SSE (reverse scan).

V. RESULTS AND DISCUSSION

To separate the influence of corrosion and friction, the electrochemical tests with and without application of friction were carried out under similar electrochemical conditions. In addition, electrochemical tests with only rotation of friction pin end were carried out to study the effect of electrolyte convection. The results of the tests with and without friction are shown on Fig. 2. The solid line represents the part of the polarisation curve I(E) in the passivity region. Due to the friction, an increase in electrochemical activity of the material occurred which is indicated by the increase in the current. For instance, by applying an electrochemical potential of E= -50 mV/SSE the current (I) increased from its initial value of 0,05 mA to 0,75 mA, which is about 15 times more. The increase of activity means the increases of corrosion wear. This phenomenon is generally valid in the whole region of applied electrochemical potentials and can be explained by the surface layers damage. Between -500 and +500 mV/SSE, the passive film is locally destroyed on the friction track, and the increase in the current is the result of this local damage.

-368- Fig. 3 shows the dependence of the friction coefficient (u) and the current (I) on the polarisation potential (E). The dependence can be divided into following parts:

- from -1800 to-1200 mV/SSE, an increase in the friction coefficient is connected with the decrease in the rate of hydrogen evolution (hydrogen adsorption stops above -1100 mV/SSE).

- from -1200 to -600 mV/SSE, after a maximum is reached, the value of the friction coefficient decreases. This decrease appears as a passive film starts to form on the surface, protecting the steel from corrosion.

- from -600 to 900 mV/SSE, the slow increase in the friction coefficient can be related to an increase in the repassivation rate and passive fil thickness.

- from 900 to 2100 mV/SSE, the falling tendency of the friction coefficient could be the result of either steel trans-passive dissolution and forming of corrosion products, which serve as lubricant between the pin and the steel, or oxygen evolution, which would have the same effect as hydrogen evolution at the lowest potentials.

As a conclusion, these tribocorrosion tests clearly show synergy between the effects of corrosion and friction. Friction increases the rate of metal dissolution by damaging the passive film, and the electrochemical reactions (gas evolution, dissolution, passivation) have an influence on the friction conditions, characterised by the friction coefficient u.

In order to draw conclusions concerning the evolution of a component of a metallic structure, subjected to tribocorrosion, it is also interesting to identify the nature and structure of the different damages brought by tribocorrosion to the surface. A particular kind of damage is visible on figures 4 and 5, which show friction traces. On Fig. 5, a part of the trace is shown at higher magnification. On its upper part, several spots are perceptible (one of them is marked by an arrow), which are probably due to damage under cyclic loading and are nuclei of future cracks. In corrosive environment, this kind of damaging could be accelerated.

-369- 1,5 T

0,5 - — I:40N40rpm —I: ON Orpm

—1 1 1 1 1 -500 -400 -300 -200 -100 100 200 300 400 500

E [mV/SSE] -0,5 -

Figure 2: Influence of the friction on the electrochemical activity. Curves I(E) with (Fn = 40 N; co = 40 rpm) and without applied friction (Fn = 0 N; co = 0 rpm).

-• 0,3

-0,2

-1500 -1200 -900 -600 -300 ( 300 600 900 1200 1500 1800 21 DO -•0,1 -20 - E [mVJSSE]

40 - 1 0

Figure 3: Dependence of the current and the coefficient of friction on the potential of polarisation. Condition: Fn = 40 N; u) = 40 rpm.

-370- •I- £

y -

* i " . , * ' V*' •

*- * **"

'^;,

t J V'-'

Figure 4: Part of the friction trace under conditions of Fn= 20 N; 00 = 20 rpm. After the potentiokinetic polarisation.

Figure 5: Internal side of the friction trace under conditions of Fn = 40 N; co = 40 rpm. After the potentiokinetic polarisation.

-371 - VI. CONCLUSION The present work pointed out the relationships between different electrochemical and mechanical parameters (I, E, p.), characteristic of the tribocorrosion process. A synergetic effect of electrochemical and tribological conditions was found: the influence of the electrochemical reactions, and reaction products on the friction coefficient was clearly shown, as well as a strong effect of the damaging of the passive film by friction, with the result of an increased electrochemical activity. It was shown above that the friction coefficient can be influenced by appropriate polarisation with the consequence of a lower mechanical wear of the material.

VII. BIBLIOGRAPHY [1] MADSEN B. W., Corrosive Wear, Wear, pp.271-279, 1993. [2] S.W. WATSON, F. J. FRIEDERSDORF, B. W. MADSEN, S.D.CRAMER, Methods of measuring wear corrosion synergism, Wear, v. 181-183, p. 476-484, 1995. [3] KUBECKA P., WENGER F., HYSPECKA L, PONTHIAUX P., GALLAND J., "Tribocorrosion tests of duplex stainless steels 22-05", Acta Metallurgica Slovaca, vol. 5, no. 2, pp. 103-111, 1999, ISSN-1335-1532. [4] PONTHIAUX P., WENGER F., KUBECKA P., GALLAND J., HYSPECKA L, "Application of electrochemical techniques to the study of tribocorrosion phenomena", 14th ICC (14th International Corrosion Congress), 26 September- 1 October 1999, Cape Town, South Africa, CD-ROM, produced by Documents Transformation Technologie - PO BOX 560. Irene. QQ63. South Africa, Presentation Number (118,0), ISBN: 0-620-23943-3. [5] JIANG X. X., LI S. Z., TAO D.D., and YANG J.X., Accelerative Effect of Wear on Corrosion of High-Alloy Stainless Steel, Corrosion Science, v. 49, v. 10, p. 836- 841, October 1993. [6] ZHANG T. C, JIANG X. X., LU S. Z. and LU X. C, A Quantitative Estimation of the Synergy between Corrosion and Abrasion, Corrosion Science, v. 36, n. 12, p. 1953-1962, 1994. [7] KUBECKA P., "Etude du comportement d'alliages passivables, acier duplex et alliage fer-nickel, soumis a Faction combinee du frottement et de la corrosion", PhD work, 230 p., Ecole Centrale Paris (France), ECP-1998-31.

-372- CZO129439

International Topical Meeting

WER Technical Innovations for Next Century

Prague, Czech Republic, April 17-20, 2000

Mochovce NPP Safety Measures Evaluation from Point of View of Operational Safety Enhancement

Prepared by:

Ivan Cillik, Lubos Vrtik VUJE - Trnava Inc., Okruzna 5, 918 64 Trnava, Slovak Republic

Abstract of paper

Mochovce NPP consists of four reactor units of WWER 440/V213 type and it is located in the south-middle part of Slovakia. At present first unit operated and the second one under the construction finishing. As these units represent second generation of WWER reactor design, the additional safety measures (SM) were implemented to enhance operational and nuclear safety according to the recommendations of performed international audits and operational experience based on exploitation of other similar units (as Dukovany and J. Bohunice NPPs). These requirements result into a number of SMs grouped according to their purpose to reach recent international requirements on nuclear and operational safety. The paper presents the bases used for safety measures establishing including their grouping into the comprehensive tasks covering different areas of safety goals as well as structural organization of a project management of including participating companies and work performance. More, results are given regarding contribution of selected SMs to the total core damage frequency decreasing.

I. INTRODUCTION

It is known that to finish Mochovce NPP construction a list of SMs was created to improve plant operational safety and reliability. The SMs list was based on WWER 440/V213 (J. Bohunice and Dukovany) operational experience and different international audits performed directly on the site. Below are given the most important documents as the result of audits and recommendations to satisfy the international requirements on nuclear safety and operational reliability:

1. Mission for safety improvements checking on Mochovce NPP, IAEA WWER-SC-102, September 1994

2. Safety improvements evaluation for Mochovce NPP rev. 16, Risk audit report, IPSN/GRS, December 1994 II. SAFETY MEASURE LIST

The list of Safety Measure Technical Specifications was originally prepared by VUJE Trnava Inc. together with Mochovce utility to give comprehensive overview of the work to be done.

-373- The final result represents a product covering all areas of the plant design including different types of analyses, operational procedures, data collection and information flows as well as monitoring of plant influence on environment and post accident management. To close contracts with different suppliers technical specifications of SMs were converted into SM contracts. Different items were grouped into the areas of technical interest with the precise definition of SM interfaces and information flows. SMs represent one part of the all work to be done on the site covering analytical and design work and supporting designers, suppliers and constructors activities. The major part of the work was performed before plant construction finishing and start-up to power operation. Final list of subcontractors consists of the main Slovak companies SE Inc., VUJE-Trnava Inc., VUEZ-Tlmace, Germany company Siemens, France company FRAMATOME, Czech companies SKODA-Prague, SKODA- Plzen, Energoprojekt-Prague and selected Russia companies. Siemens and FRAMATOME created consortium EUCOM working mainly under Germany budget. The list of SMs is presented below according to areas of common technical background:

A. GENERAL

G01: Classification of components G03: Reliability analysis of safety class 1 and 2 system G02: Qualification of equipment

B. REACTOR CORE

RCO1: Prevention of uncontrolled boron dilution

C. SYSTEM INTEGRITY

CI01: RPV embrittlement and its CI02: Non-destructive testing monitoring CI03: Primary pipe whip restrains CI04: Steam collector integrity CI05: SG tubes integrity CI06: SG feedwater distribution integrity

D. SYSTEMS

SOI: Primary circuit cold overpressure S02: Mitigation of a SG primary collector protection break S03: Reactor coolant pump seal cooling S04: PORV and PSRVs qualification for system water flow S05: ECCS sump screen blocking risk S06: ECCS suction line integrity S07: ECCS heat exchanger integrity S08: Power operated valves on the ESSC injection lines S09: Feedwater supply vulnerability S10: SG relief valves qualification for valves SI 1: SG relief valves performance at low SI2: Emergency feedwater make-up pressure procedure S13: SG level control valves qualification SI4: Primary circuit venting under accident on water flow conditions S15: Essential service water system SI6: Main control room ventilating system SI7: Hydrogen removal system

-374- E. I&C

I&CO 1: I&C reliability I&C02: Safety system actuation design I&C03: Review of reactor scram initiating I&C04: Physical and functional separation signals of main and emergency control room I&C05: Mechanical equipment condition I&C06: Primary circuit diagnostic systems monitoring I&C07: Reactor vessel head leak monitoring I&C08: Accident monitoring system instrumentation I&C09: Technical support centre I&C 10: Water chemistry control and monitoring I&C11: Changing of HINDUKUS and VK3

F. ELECTRIC SYSTEMS

E101: Start-up logic for the emergency E102: Diesel generators reliability diesels E103: Protection signals of emergency diesel E104: On-site power supply accident generators management E105: Emergency battery discharge time E106: Reliability of outside top transformer E107: Reliability of common top transformer system

G. CONTAINMENT

CONT01: Bubbler condenser strength response (max. pressure difference) under LOCA CONT02: Bubbler condenser thermodynamic response CONT03: Containment leak rates CONT04: Maximum pressure differences on walls between compartments of hermetic boxes CONT05: Containment peak pressure & activation of sub-atmospheric pressure after blow- down CONT06: Experimental verification of thermodynamic phenomena and of BC under LOCA

H. INTERNAL HAZARDS

IH01: Systematic fire hazards analysis IH02: Fire prevention IH03: Fire detection IH04: Extinguishing 1H05: Mitigation of fire effects IH06: Systematic flooding analysis IH07: Turbine missiles IH08: Internal hazards due to high energy pipe breaks IH09: Heavy load drop

I. EXTERNAL HAZARDS

EH01: Seismic design EH02: Analysis of plant specific natural external

-375- EH03: Man induced external events

J. ACCIDENT ANALYSIS

AA01: Scope and methodology of accident analysis AA02: QA of plant data used in accident analysis AA03: Computer code and plant model validation AA04: Availability of accident analysis results for supporting plant operations AA05: Main steam line break AA06: Overcooling transients related to pressurized thermal shock AA07: Steam generator collector rupture AA08: Accidents under low power and shutdown (LPS) conditions AA09: Severe accidents AA10: Probabilistic safety assessments (PSA) AA11: Boron dilution accidents AA12: Spent fuel cask drop accidents AA13:ATWS

K. OPERATION

OP01: Procedures for normal operation OP02: Emergency operating procedures OP03: Limits and conditions OP04: Safety culture OP05: Experience feedback OP06: Quality assurance program OP07: Data and document management OP08: Philosophy on use of procedures OP08: Philosophy on use of procedures OP09: Communication system OP10: Radiation protection and monitoring OP11: Emergency centre

III. ASSESSMENT OF SAFETY MEASURES ON THE BASES OF PSA MODELS

Detail Level 1 FPSA for Mochovce unit 1 was performed to present contribution of implemented SMs from the above list to the core damage frequency (CDF) decreasing. Three statutes of Mochovce plant up-grades were considered for power level 1 PSA model performance as follows:

1. The first PSA model was prepared for Mochovce unit 1 status before SMs implementation (original plant design) considering old event oriented emergency operating procedures without "feed & bleed" procedure. "Feed & bleed" procedure was finally considered as well to show positive contribution of this reactor core cooling and residual heat removal procedure to the total core damage frequency. 2. The second PSA model was prepared for Mochovce unit 1 status after the unit start-up including implemented SMs and new EO EOPs considering "feed & bleed" procedure (EO EOP - HP201). This model represent unit 1 status during the first year of its' operation. 3. The third PSA model was realised for Mochovce unit 1 status after the unit first refuelling including all implemented SMs and considering its' operation under SB EOPs which were trained by operators one year before their implementation.

-376- ANALYSIS OF BENEFIT OF SAFETY MEASURES FROM THE RISK DECREASE POINT OF VIEW

SMs analysed by the Mochovce FPSA model are presented below. The list of the considered initiating events is given below in the table below. This list of initiating events is the same for all analyse PSA models as it was presented above. TABLE: Initiating event categories for the Mochovce PSA study '/' \ V; fl>HP» •••**•*>• ""*•" RVR l.OOE-6 Reactor vessel rupture L6 6.70E-5 Large LOCA (300 - 500 mm) L5 8.00E-5 Large LOCA (200 - 300 mm) L4 1.50E-4 Medium LOCA (100 - 200 mm) L3 1.50E-4 Medium LOCA (60 -100 mm) L2 5.50E-4 Medium LOCA (20 - 60 mm) LI 1.15E-3 Small LOCA (0 - 20 mm) PSL 3.10E-4 Pressuriser steam LOCA IFSL 5.00E-4 Interfacing system LOCA PLOCA l.OOE-4 Interfacing pool LOCA SGTR 8.90E-4 Steam generator tube rupture 2TG 3.80E-1 Both TG trip IRT 1.80E-1 Inadvertent reactor trip LMF 9.20E-2 Loss of main feedwater LMF(FWHB) 1.40E-3 Main feedwater header break LMF(FWTB) 1.60E-3 Feedwater tank break LOF6 1.40E-1 Loss of four or more MCPs LOCW 1.20E-1 Loss of circulating cooling water RAT 2.00E-2 Reactivity addition transient SHB 1.40E-3 Steam header break SLBI 1.30E-3 Steam line break inside confinement SLBO 9.00E-4 Steam line break outside confinement LOP 3.10E-2* Loss of offsite power FIRE-490 6.20E-2 Fire in the TG hall

RESULTS OF PRE-MODIFICATION STATUS

The results of the first pre-modification phase of PSA modelling are presented for two basic cases: without and with the consideration the primary "feed & bleed" operation. In the second case non-qualified pressurizer safety valves would be used for "feed & bleed" given total loss of primary to secondary side heat removal.

Results without the Consideration of the Primary "feed & bleed" Operation

Using the PSA model, the following mean core damage frequency was calculated without consideration the primary "feed & bleed" operation:

-377- 1.03E-3 y1 Selected contribution of initiating events, categories of basic events and systems to the core damage frequency is presented below:

Contribution of Initiating Events Main feedwater header break LMF(FWHB) 30.19% Fire in the TG hall (FIRE-490) 25.15% Steam header break (SHB) 21.75% Steam line break outside confinement (SLBO) 13.98% Loss of circulating cooling water (LOCW) 3.60% Loss of offsite power (LPO) 1.38% Loss of main feedwater (LMF) 0.93% Other events • 3.02%

Contribution of Basic Event Categories Post trip operator actions are represented in cut sets that account for 33.9% of the total CDF. The partial contributions are the following: an operator fails to initiate the EFW system 32.1 % no manual fire suppression in the TG hall 26.2% an operator fails to initiate demi-water 1 MPa system 2.6%

Another important categories of primary events are the following: turbine hall effect 65.8% hardware failure 2.8% common cause failures 1.4%

Contribution of Systems The importance of system contribution to the core damage frequency is following: Emergency feedwater system 32.3% Demi-water system 1 MPa 2.8% Auxiliary feedwater system 1.9% Low pressure injection system 1.2%

Results with the Consideration of the Primary "feed & bleed" Operation

The mean core damage frequency is: 6.54E-5V1. The next part of the section presents the contribution of initiating events, categories of primary events and systems to the core damage frequency.

Contribution of Initiating Events Main feedwater header break LMF(FWHB) 22.17% Fire in the TG hall (FIRE-490) 19.11% Steam header break (SHB) 15.90% Steam line break outside confinement (SLBO) 10.26% Small LOCA (L2) 8.53% Interfacing LOCA (IFSL) 7.31 % Small LOCA (LI) 3.90% Loss of offsite power (LOP) 3.55% Loss of circulating cooling water (LOCW) 2.74%

-378- Medium LOCA (L3) 2.34% Interfacing LOCA into the refuelling pool (PLOCA) 1.56% Other events 2.63%

Contribution of Basic Event Categories Post trip operator actions are represented in cut sets that account for 95.8% of the total CDF. The partial contributions are the following: an operator fails to initiate "feed & bleed" 55.4% an operator fails to prevent overflow of LPSI tanks 35.4% an operator fails to initiate the EFWS 23.4%

Another important categories of primary events are the following: turbine hall effect 48.6% common cause failures 4.4% hardware failure 3.6%

Contribution of Systems The importance of system contributions to the core melt frequency is following: Primary circuit ("feed & bleed") 55.5% Low pressure injection system 35.6% Emergency feedwater system 23.6%

RESULTS OF POST-MODIFICATION STATUS WITH EO EOPs

The results of the first post-modification phase of PSA modelling are presented in this section. The mean core damage frequency is: 1.91E-5 y1. The next part of the section presents the contribution of the initiating events, categories of basic events and systems to the core damage frequency. TABLE: Contribution of initiating events to the total core damage frequency

Initiating Description f [I/year] % of total : event ^ CD '/ ~ -„' ';•, •,"?- ' frequency FIRE-490 Fire in the turbine hall 9.66E-06 50.58% SGTR Steam generator tube rupture 2.14E-06 ;il.20% LOP Loss of offsite power 2.11E-06 " 11.05% LOCW Loss of circulating cooling water 1.39E-06 7.28% LMF(FWHB) Main feedwater header break 7.05E-07 •I 3.69% LMF(FWTB) Main feedwater tank rupture 6.30E-07 ; .3.30%^ SHB Steam header break 4.72E-07 - ,;2.47% LMF Loss of feedwater - all main feedwater 3.90E-07 ' '^2104%: pumps trip IFSL Interfacing LOCA 3.72E-07 t#£95%^ . PSL Pressurizer steam LOCA 3.58E-07 ;-%i,87%? ' Others 9.35E-07 1 4.64%

-379- Contribution of Basic Event Categories Post trip operator actions are represented in cut sets that account for 83.9% of the total CDF. The main contributions are the following: an operator fails to initiate the EFW system 71.7% an operator fails to initiate primary bleed and feed 69.9% no manual fire suppression in the TG hall 50.8% an operator fails to isolate the SGTR 7.6%

Another important categories of primary events are the following: hardware fai lure 33.3% common cause failures 14.4% turbine hall effect 5.6%

Contribution of Systems

The importance of system contribution to the total core damage frequency is the following: Emergency feedwater system 72.3% Primary circuit 70.1% Emergency power supply of category II 23.6% High pressure injection system 6.7% Demi-water 1 MPa system 6.0% Intermediate cooling system of ECCS 5.4% Auxiliary feedwater system 5.1%

RESULTS OF POST-MODIFICATION STATUS WITH SB EOPs

The mean core damage frequency is: 9.73E-7 y"1. The next part of the section presents the contribution of the initiating events, categories of primary events and systems to the core damage frequency. TABLE: Contribution of initiating events to the total core damage frequency Initiating - Description f [I/year] % of total CD event frequency L5 Large LOCA (200-300 mm) 1.86E-07 | 19.12% LI Small LOCA (0-20 mm) 1.73E-07 17.78% IFSL Interfacing LOCA 1.03E-07 10.59% SGTR Steam generator tube rupture 1.02E-07 10.48% L6 Large LOCA (300-500 mm) 9.40E-08 9.66% L2 Medium LOCA (20-60 mm) 8.27E-08 "8.50% LOP Loss of offsite power 5.78E-08 5.94% PSL Pressuriser steam LOCA 4.66E-08 4.79% RAT Reactivity addition transient 2.88E-08 2.96% SHB Steam header break 2.42E-08 2.49% Others 7.49E-08 7.69%

-380- Contribution of Basic Event Categories The hardware failures are represented in cut sets that account for 95.4% of the total CDF. The main contributions are from: common cause failures of ECCS intermediate cooling system 35.5% single failures of intermediate cooling system of ECCS 18.2% single failures of low pressure injection system 10.9% single failures of engineering safety fast actuating system 9.3% common cause failures low pressure injection system 6.6% single failures of emergency feedwater system 5.4% common cause failures of confinement spray system 5.0% common cause failures of essential el. power supply of category 2 4.9% single failures of core flooding system 4.8%

Another important categories of primary events are the following: human errors 25.6% common cause failures 55.6% turbine hall effect 3.3%

Contribution of Systems The importance of system contribution to the core melt frequency is the following: Intermediate cooling system of ECCS 54.3% Low pressure injection system 19.5% Engineering safety fast actuating system 9.5% Emergency feedwater system 9.3% Confinement spray system 7.8% Essential el. power supply of category 2 6.6% Core flooding system 5.5% Bubble condenser 4.8% High pressure injection system 4.7% Reactor protection system 4.5% Steam removal system 4.3% Primary circuit (pressurizer, MIVs, MCPs) 3.9%

CONCLUSIONS

The results presented above shows very transparently that the preparation, evaluation, selection and implementation of presented safety measures list to enhance Mochovce safety level based on the different international audits and missions and considering operational experience of VEER reactors substantially contribute to the VVER reactor safety. In the combination with SB EOPs implementation into the plant operation they shift plants with VVER reactors into comparable position with western designed NPPs regarding operational and nuclear safety.

-381 - ill n CZO129440

Innovative Instrumentation for VVERs bosod on non-Invasive techniques

H. Jeanneau, JM. Fav«nn«e, E. Tournu, JL. Germain Electricity De France - B&D Division / Generation Department 6 quai Watler - 78401 - Chatou France Phone: 33 1 30 87 85 36 Fax : 33 1 30 87 71 50 6-mail: lean-melalne. favBnnec &6dfadf. fr

Abstract: Nuclear power plants, such us VVERs, can greatly benefit Prom innovative instrumentation to improve plant safety and efficiency, In recent years innovative instrumentation has been developed for PWRs with the aim of providing additional measurements of physical parameters on the primary and secondary circuits: the addition of new instrumentation is made possible by using non-invasive techniques, such us ultrasonics and radiation detection. These innovations can be adapted for upgrading VVERs presently in operation and also in future VVERs, The following innovative instrumentations for control, monitoring or testing purposes in WEHs arc presented :

7- instrumentation for morn accurate primary side direct measurements, for belter monitoring of the primary circuit: *DECOR : a primary feed water flowmeter based on cross-correlation of Nitrogen-16 time fluctuations (a much more accurate method than the method based on N-16 decay measurement), using detectors placed outside of the pipe thermal insulation ; high accuracy is independent of reactor power (measurement available from 10% u> 100% of max power output) and of feed water flow ; *TEMPUS : a primary temperature measurement cool using ultrasonics, allowing for better temperature averaging than classical temperature sensors, and providing a fast response time ; ""WALLACE: a primary water level monitoring channel, fully non intrusive, based on ultrasonics, and providing a fast response time and very accurate measurement of level during an outage or for periodic lest purposes ;

2- Instrumentation to monitor radioactive leaks, for a safer plant: *VAMCIS : non-intrusive, fast response time monitoring channel of eventual primary to secondary leaks in the steam generator, by continuous monitoring of gamma ray emission of Nitrogen-16 in in the secondary side steam ; •LEAK DETECTION ON VARIOUS COMPONENTS ; a wide range of leak detection methods (used (bi- valves, condenser, reheater, boiler, nuclear reactor, steam generator, pit, containment, piping.) was developed, based on various techniques (acoustics, acoustic emission, temperature and flow measurement, decrease in pressure, chemical and radioactive tracers,...).

3-litstruinentation-reIated systems to improve plant productivity, for a cheaper kWh: *CLIP : on-line permanent ihennodynamic performance monitoring on the secondary side to provide plant operators with help in detecting faulty instrumentation and wrong settings in plant components (position of valves,,..). CLIP helps to recover MWe, * IMPROVING FLOWMETERING : improving I'lowmetering instrumentation is a key factor to significantly improve power output accuracy, on exchanger performance, etc. An innovative app-ouch combining modelling, technological mastery of industrial measurement systems, and experimental methods for validation. * Reliability Centered Maintenance (RCM) : RCM is a method for optimizing maintenance costs, focusing on maintenance programs of most critical components for plant safety and availability,

-383- 1' Instrumentation for more accurate primary side direct measurements, for better monitoring of the primary circuit:

1.1 DECOR : NITROGEN 16 MEASUREMENT OF PRIMARY FLOW RATE a) Coal awl measurement principle

Vallum do fluids prkrairo toi ruyonnoinenci 4nis

Imminent

Figure I j measurement principle The principle is to use nitrogen 16 which is conveyed by the primary coolant, at the same velocity. The nitrogen 16 fluctuations in time tire measured to determine a transit time between two measurement sections, by means of cross- cnrrelation (Figure 1). b) Innovative uspects The detectors used are circular radiation detectors mounted on a frame (collimator) around the reactor coolant pipe (Figure 2). The advantage is that the circular detector has minimum sensitivity to the velocity profile and ra any deformation of this profile in time or in space : a theoretical study has shown that the discrepancy between the velocity measurement using circular detectors and the real velocity is on the order of 0.1% for profiles with a linear unbalance, whereas it can reach 4% for one quasi-point detector and \% for a pair of diametrically opposite quasi-poinl detectors. Furthermore, the number of interactions in a circular detector is around 10 times higher than in a point detector. This greater number of events per second proportionally reduces the detection noi.se and enables improved measurement precision for a given response time. The correlation method which was chosen following un optimization study is another innovative aspect (Figure 3).

* 1,0 Figure 2 i crosa-correlatlon Figure 31 circular radiation detectors itnd dtitn unit c) Specific benefits • gains In both its principle and its application, the method is nbsolute in nature, since flow rate is calculated from a volume and i) transit time, In addition, it is a totally non-Invasive method, given that the detectors are placed outside the primary coolant pipe

-384- Accuracy is ± 1.5% for the flow raie in each loop at nominal reactor power, and does not deteriorate markedly up to 10% of nominal power. Laboratory acceptance tests, busqed on actual plant data have shown significant gains in accuracy (statistical uncertainty, resulting from the number of cross-correlations processed). Finally, specifications and final development of the measurement system are based on the "smart sensor" concept, which makes it possible to integrate validation and quality indicators in renl time, facilitating configuration of the measurement system and communication with its computer environment. d) Feedback This method was implemented with success at the Qruvelines, Dampierre and Chinon plants in the Eighties. The successive tests enabled validating the technological choices (detectors, instrumentation), the signal processing (cross- correlation, filtering) and the representativeness of the measurements (effect of the velocity profiles). The flow rate measurement method is now being applied at Chooz (N4), Significant developments in the technology, instrumentation, and signal processing techniques have made it possible to implement a far more efficient measurement system which, in addition, is largely based on standard off-the-shelf products.

1.2 TEMPUS : ULTRASOUND MEASUREMENT OF PRIMAKY COOLANT TEMPERATURE n) Measurement principle

1 Measurement principle A beam of ultrasonic waves at 1 to 2 MHz is emitted by transducer A, through the metal of a pipe and the fluid it contains, then received by a similar transducer B, diametrically opposite (Figure 4) Measurement of the propagation time ta[j of the wave in the liquid enables calculation of the velocity of sound, or c = d/ta|,. The existence and calibration of the relation c=f.(T,P) enables determination of the temperature, given measurements of P and c. b) Innovative aspects • Determination of the relation between c, T and P : measurement surveys (500 triplets) have been conducted with various boron concentrations (0, 600, 2000 ppm) and in the following thermndymimic range: 100 °C < T < 330 3C and 80 bars < P < 160 bars. Following an optimization study, the relation c = I'CT.P) was represented in the form uf a 15-term 4th-order polynomial for variables T and P (Figure 5). This optimization provides accuracy of ± 0,1 3C in representation of the polynomial under the thermohydraulic conditions of a PWR primary cooling system (250 °C-33OcCund 140-160 burs). • Waveguides: the measurement technique requires the implantation, on each collimation line, of a pair ol' waveguides welded on the outer side of the pipe, using a procedure developed by FRAMATOME which was followed in building the Blayuis 4 and Chooz Bl units. The design for a waveguide w;ts fine-tuned by EDF and its industrial partners , It provides a guarantee of the integrity of the transducer and of its acoustic coupling by maintaining the sei»up at a;e_mi)ejmure_below 80 aC under adverse operating conditions (temperature, radiation).

's • 's a1 a

Figure 5 i relation c=f(T,P) Figure 6 s temperature deviations at

-385- c) Specific benefits - gains The principal benefits of the method are the following : - non-invasive method, - n principle by which a mean measurement is acquired over at least one diameter and not in one point, • low response time.

d) Feedback A feasibility study was undertaken in 1992 at the Blayais 4 PWR plant, The measurement principle was validated with the prototype equipment. Good results were obtained during the power increase from 0 to 100% : figure 6 gives a comparison of the temperature measured by ultrasound in the hot leg with the operating temperature measured in the by-pass. The results with respect to the metrological and technological aspects over a period of five years of operation indicate that the process can be used for test measurements. Based on the results at Blayuis, one of the primacy coolant loops at Chaa-i 131 was equipped two acoustic eollimation lines on each hot and cold leg. The results are very satisfactory und meet the expected performances,

1.3 WALLACE : WATER LEVEL BY ACOUSTIC COMPUTERIZED EQUIPEMENT a) Mt'ttsuromcnt principle An ultrasonic wave pulse is emitted and then received by a transducer which ii in contact with the primary circuit pipe. The travel time of the ultrasonic pulse allows the height of the water in the pipe to be accurately determined, The detection and processing uf the composite signal resulting from multiple echoes within the pipe wall and from the surface of the water ensure a very reliable and accurate measurement of the water level in the pipe.

• • •'''!•(•'. Finn re 7 i WALLACE b) Innovative aspects Because ul' Ihs specific electronic treatment, the measurements lire insensitive to the following elements : • perturbations of the surface of the water, • boron-in-water concentration, • turbulence clue to the pump. The transducers allows measurements form 5° to 80°C (41°F to 176UF) and they are suitable for all steel pipes (stainless steel ; forged or cast), c) Specific benefits • gains • Ease of installation : the fast installation of the device reduces sei-up costs and radiation dose. • No modification of the primary pipe : the installation of the belt and the transducer support requires non preparation or intrusion into the pipe. • Automatic calibration : after a user request, the device ntW calibrates automatically in seconds • Alarm level monitoring ; 3 alarm levels, user programmable by keypad. • Precision : better than 1% at constant temperature and better than 3% for temperature changes from 10° to 70°C (50 to 158"F). including variation* of the apeed of sound in water, (1) feedback The First tests were completed in 1993 in the CATTENOM 3 nuclear power station. The WALLACE device, us requested by EOF, is Installed on every EDF900, 1.300 and 1450 M\V 1JWR unit (56 systems).

-386- 2- instrumentation to monitor radioactive leaks, for a safer plant

2.1 VAMCIS : A MEASURING CHANNEL TO MONITOR PRIMARY TO SECONDARY LEAK RATES INSIDE STEAM GENERATOR

a) Measurement principle To monitor leaks od primary fluid to the secondary side, VAMCIS is a non-intrusive measuement system installed on the secondary side (steam pipes). VAMCIS allows accurate and timely watch of leak development by providing : • the transient values created by changing phenomena (every 100 seconds) • the actual average value of the leak over time • the average trend of the leak.

The detector is a scintillator including a built-in radioactive source and a temperature sensor. The detector set up requires no modification of the existing installation. It is directly mounted facing the steam pipe heat insulation, outside the reactor containment. The electronic box provides the spectral analysis ; and at least two adjustable energy windows are available. Self stabilisation of the energy spectrum is improved by taking into account the temperature drift of the reference peak. the leak rates are continuously monitored. Two channel digital ratemeter readings can be displayed locally and in the reactor control room

VAMCtS GENERAL LAY-OUT

OcTFCHON SUB ASSEMBLY IOC/MNO' oujircnn .0-^.Cir.1 SJIV \Mfcl Ml COM! II Chi

Figure 8 : VAMCIS b) Specific benefits - gains • Continuous monitoring of leak rate : VAMCIS allows continuous measurement of leaks from primary to secondary circuits in steam generators under all operational circumstances, whether the primary coolant contains fission products or not. • High sensitivity : leak rates as low as 0.1 1/h can be easily and continuously monitored • Fast response : an alarm level leak in a full powered reactor is measured within seconds • Wide measuring range : leaks from 0.1 to 5,000 I/h can be measured • Reliability : results are not affected by temperature variations at sensor location • Detection of steam generator tube rupture : while the reactor is in operation, a sudden increase of the N16 activity triggers an alarm which indicates a tube rupture. Even though there are other methods to detect a catastrophic steam generator tube rupture, VAMCIS will provide automatically the information within seconds. • VAMCIS operation is totally automatic and needs no attention or particular maintenance procedures

-387- • VAMCIS can give information about the existence of leaks through plugged tubes by correlating NI6 and gamma channel signals

c) Feedback VAMCIS system has been successfully qualified for environment All French PWR plants are equipped. In Belgium : Tihange I and 2, Almaraz and Asco in Spain and several US plants use the VAMCIS system for leak monitoring.

2.2 LEAK DECTECTION ON VARIOUS COMPONENTS

a) Goal and principles Leaks are among the most common faults in industrial installations. They can affect a wide range of components: heat exchangers, valves, piping, boilers, tanks, pits, pneumatic and hydraulic circuits, containments, etc. The existence of a leak may directly affect safety (e.g. leaks of dangerous products), efficiency (e.g. steam loss) or availability, or may generate unnecessary maintenance costs due to damage. The leak may also be an indication of the appearance of a degradation (e.g. cracking in a pipe) which must be repaired as quickly as possible, before it can deteriorate. EDF has developed a wide range of leak detection methods, essentially used for: valves, condenser, reheater, boiler, nuclear reactor, steam generator, pit, containment, piping. The main techniques used are: acoustics, acoustic emission, temperature and flow measurement, decrease in pressure, chemical and radioactive tracers.

EDF masters a wide range of measurement instrumentation well suited to the different detection techniques (traditional: flow, pressure, temperature, etc.; and specific: hygrometers, mass spectrometers, acoustic emission, etc.). It also has: • a test environment, • extensive technical documentation, • high-performance calculation resources.

Figure 9 : Heat exchanger tubes destroyed by an undetected leak b) Innovative aspects The different detection techniques are based on innovative instrumentation : • In-service leak detection in conventional boilers by means of acoustic monitoring, • Detection of micro-leaks in steam generator tubes by means of helium tests during nuclear plant shutdown, • Helium test on superheater moisture separators in the plants, • Leak-tightness tests on EDF PWR containments, during shutdown and continuous monitoring (SEXTEN), • Hygrometric monitoring of vessel head penetration tubes in PWR units, • Internal valve leaktightness testing by means of acoustic emission techniques.

c) Specific benefits - gains In industrial production installations, leak detection and repair provides gains in safety, availability and maintenance costs. The use of leak detection techniques thus leads to gains in safety, availability and maintenance costs in industrial installations. d) Feedback EDF has developped leak detection techniques for more than twenty years to meet the needs of its nuclear and fossil-fired plants, particularly at the time of the launch of its pressurized water reactor program in the Seventies. The leak detection techniques adopted in these plants contribute greatly to EDF's good performance in terms of safely, availability and well-controlled maintenance costs.

-388- 3 instrumentation-related systems to improve plant productivity, for a cheaper kWh:

3.1 CLIP a system to monitor plant performance ratio and help recover MWs

a) Goal and Principle CLIP is an on-line efficiency monitoring system able to determine drifts or shifts of an nuclear power plant. This system has been developed to help producing a most economical kWh from primary fuel for PWR plant. The approach is based on the comparison of measured performance indexes and expected performance indexes according to associated uncertainties. This comparison is local for each measurement point and global with efficiency ratio for each significant component of the secondary system. The expected values are computed by a heat-balance model based on acceptance tests of the plant.

The actual plant efficiency is computed by the mean of measure plant data. The expected efficiency is computed given the outside constraints and status of secondary side. It finally compares these two estimations of the efficiency ratio. Any discrepancy between the two estimations - outside the uncertainty - is diagnosed and probable causes are then proposed (figure 10). The plant operators will carry out a verification to check the validity of the diagnosis and reconfigure the faulty plant component or its setting.

Figure 10: CLIP overview b) Innovative aspects CLIP includes a specific test instrumentation (around 100 sensors), a data acquisition system and a processing unit, which computes the current heat-rate efficiency ratio of the plant. It then computes an expected heat-rate efficiency ratio by use of a thermodynamical model of the plant : this model is fed with highly accurate data and performance parameters computed from earlier plant acceptance tests. It finally compares these two estimations of the efficiency ratio. Any discrepancy between the two estimations - outside the uncertainty - is diagnosed and probable causes are then proposed. The plant operators will carry out a verification to check the validity of the diagnosis and reconfigure the faulty plant component or its setting.

c) Specific benefits - gains CLIP diagnoses two types of fault: *LocaI faults are checked for each measurement point according to uncertainties on measured value and expected value in the same conditions. *Globai faults are checked for a list of performance parameters according to uncertainties on actual value (which can be directly measured or elaborated by the mean of measurements) and reference value (decided on feedback experience and independent references for a type of power plant unit). CLIP system is also used after an outage to save time in helping operators to reconfigure the plant faster in its optimal settings. During normal operation plant engineers periodically use it to gain better knowledge of their plant or some specific components.

d) Feedback A demonstration system has been implemented at Flamanville plant (1300 MW) and tested by plant operators in industrial operating conditions. Then the monitoring system has been optimized with feedback experience and developed for 900 MW and 1300 MW plants. Since 1998, all EDF's PWR plants are using CLIP. Thanks to CLIP, plants recover from 0.2% to 1% of electrical power output. CLIP provides a diagnosis on plant components which are not instrumented (localisation of possible leak, ...) and propagate uncertainties to provide diagnosis with accuracy.

-389- It also helps to optimize maintenance plant planning. CLIP also helps utility management to compare plants over a same independent basis. In other domains, such as production lines, CLIP system can also be used in order to optimize performances: preliminary studies in co-operation with the final users are required to optimize the system.

3.2 IMPROVING POWER PLANT EFFICIENCY AND SAFETY THROUGH BETTER KNOWLEDGE OF FLOW-RATES: THE EDF APPROACH a) Goal and principle In industrial conditions, flow-rate is often incorrectly determined due to various phenomena such as wrong calibrations and drifts, erosion or fouling of the flowmeters, incorrect installation conditions such as a lack of straight lengths required by the standards upstream from the meter... These phenomena may lead to systematic errors which can amount to several percents of the measured value. Regarding the importance of the flow-rate and the related economic gains, Electricite de France has always been very concerned by the means to improve the actual accuracy of flowmeters. This part presents EDF's approach and means in liquid flowmetering and the related activities of its Research and Development Division.

The experimental approach is an efficient way to investigate and make a diagnosis of real situations. Within the Research and Development Division of EDF, the experimental studies of liquid flowmetering problems are supported by the EVEREST loop. A reference section is dedicated to reference flow-rate measurements. They are carried out with two different types of standards (differential pressure devices and electromagnetic or Coriolis flowmeters) that perform a measurement with an accuracy of ±0.3% of the reading. This value is very low; in comparison, the best accuracy found in a power plant is about 0.8% (that of the feedwater flowmeter) and the flowmeter usual accuracy in the industry is of several percents. The testing section is variable, the pipe configuration can be modified to meet specific user needs in terms of singularities placed upstream from the meter (pipe fittings such as bends, valves, tees or reducers) that are frequently found in industrial sites. This section is of prime interest when in-situ calibrations are not feasible and piping duplication is necessary. b) Innovative aspects The rig is operated with a distributed control system which warranties high accuracy thanks to the digital communication, quality assurance thanks to historical and auto-diagnosis capabilities of smart devices and interoperability with most of the industrial flowmeters.

EDF's approach to improve flowmetering in plants is innovative in the sense that it combines: • an experimental capability • a modeling capability, • development of high-performance innovations allowing use of non-invasive flowmeters in various environments • practice of on-site measurement, experience feedback. c) Specific benefits - gains Here after an example is described of a study based on the EVEREST loop, concerning EDF 1300 MW unit feedwater flow. In some EDF 1300 MW units (those of the P'4 series), it has been calculated that an increase of 0.5% on the accuracy of the 4 feedwater flows corresponds to an increase of 0.25% on the thermal power accuracy. This increase represents a difference of 9 MWth, as the thermal power goes from 3817±15 MW to 3817±24 MW. In terms of electrical power, it may lead roughly to an annual loss of 3 MWe. In a year, this is evaluated as a loss of 300,000 US S per unit. For the total number of 1300 MW P'4 units (12), this 0.5% uncertainty increase amounts to a total of 3.6 million US dollars a year. This 0.5% increase is what is required by the ISO standards on the 1300 MW units since the feedwater flow orifice plate installation conditions do not fully respect ISO requirements. The orifice plate is positioned 26 pipe diameters downstream from a combination of a venturi tube and a 90° elbow, whereas the ISO standards require 28 pipe diameters for a guaranteed accuracy of ±0.7%. Although the difference may appear to be small, it forbids strict application of ISO accuracy values. An experimental study was thus carried out on the EVEREST loop: the feedwater pipework was simulated and the influence of the orifice plate installation conditions was evaluated. Figure 11 depicts the pipework that was mounted in the EVEREST testing section.

-390- flow "VS */ flow

| ventiri 1 1300 MW P"4 unit feedwater pipe configuration evaluated on the EVEREST loop a i P

V 90-elbow pipe (+340) orifice plate A/ <^ w , y/ ^ w ! r^ ' 260 ' 100 i Figure II Evaluation of orifice plate installation conditions on the EVEREST loop: pipework configuration Figure 12 represents the bias between the reference and the measured flow-rate for two series of tests done with the orifice plate positioned at 28 and 26 pipe diameters from the elbow.

• test with the orifice plate positioned 28D downstream from 1,0% j the elbow (ISO standard requirement) 0,8% - • — -* — test with the orifice plate positioned 26D downstream from 0,6% - -' the elbow (plant configuration) 0,4% - • 0,2% 0,0% • • accuracy limits - A" -0,2% - - of ISO standards S. -0,4% - • .2 -0,6% - • 2 -0,8% •+• -1,0% « 200 400 600 800 1000 1200 bias between the measured flow-rate (m3/h) flow-rate and the reference

Figure 14 Evaluation of orifice plate installation conditions on the EVEREST loop: bias versus flow-rate Figure 12 would seem to show a difference of about 0.4%, but since the curves of the bias versus the flow-rate are inside the accuracy limits of ISO standards, the accuracy of the orifice plate is considered not to be affected by the installation conditions. Finally, it has been experimentally demonstrated that the uncertainty over-estimation of 0.5% was unjustified and this permitted to save the amount of money above-estimated (3.6 million US $ a year).

3.3: Reliability Centered Maintenance (RCM) for optimizing maintenance costs a) Goal and principle Every industrial installation needs efficient maintenance. Maintenance procedures on industrial installations have certain general objectives: • limiting production outage and guaranteeing product quality, • controlling global operating costs, • protecting staff, the environment and equipment from any risks inherent to the process.

These procedures must nonetheless be carefully programmed, as maintenance is necessarily costly; it can lead to outage, have an impact on safety or expose humans to risk situations. Technical and economic efficiency therefore requires certain compromises. Security, safety of staff and equipment, profitability and product quality must all be taken into account in a well-balanced maintenance strategy, optimized to the limit. The solution is the RCM method : the fruit of developments in the USA in the field of aircraft maintenance, the Reliability Centered Maintenance (RCM) method takes a global approach to the problem. RCM enables making optimum decisions with respect to the preventive maintenance measures the plant operator must take to control maintenance costs, achieve target levels of availability and, more generally, guarantee dependability in the installation. RCM is a rational approach aimed at limiting the impact on an installation of failures stemming from equipment. It enables determining: • where preventive measures are needed (on what equipment), *what tasks must be performed, *when (how often) they must be performed.

-391 - Unit filure Unit states modes

cP, , Unit

cffbc System

2) ANALYSISO I) -'DYSFUNCTIONS IN THE FUNCTIONAL ^BlITAND SYSTEMS J ANALYSIS Of THE UNIT AND SYSTEMS . "4) SELECTION OF MAINTEJIANtE * TASKS l^!^;^*%

Rinciple of an RCM sludy

Figure 13 : Principle of a RCM study

b) Innovative aspect The innovation lies in applying RCM method and techniques from the aircraft industry to another process industry with similar high reliability requirements.

c) Specific benefits - gains Unlike TPM (Total Productive Maintenance) which primarily deals with organizational aspects, RCM is above all concerned with technical data. It is thus complementary to management methods, to which it adds the technical information useful in decision-making. The benefits of the RCM approach are felt in many areas: maintenance costs, availability, safety, organization, involvement of personnel. The many studies conducted at EDF have highlighted the benefits of the RCM method : *economic gains, due to the reduced volume of preventive maintenance; the costs of the RCM study are paid off in very little time, *an improved level of availability and greater consideration of safety imperatives, *reorientation of traditional preventive maintenance toward condition-based tasks of inservice monitoring, *greater synergy between operation and maintenance teams, *a ranking of failures and of the corresponding preventive maintenance tasks, simplifying decision-making and maintenance management, *awareness on the part of maintenance teams of the real effects of their work and the functional consequences of failures, *direct exploitation of feedback and improved collection of feedback. d) Feedback EDF's development of a Reliability Centered Maintenance method dates from 1990. Several pilot studies have been conducted on power plant systems (including a complete analysis of a plant using a gas turbine). Since 1994, the approach has been generalized throughout the nuclear power generation capacity and, since 1997, the fossil-fired park. As concerns the nuclear park, expected economic gains have been estimated at some 100 millions USD per year.

REFERENCES CLIP : A system to increase the efficiency of production lines (presentation made for the SMI '99 conference, third international conference on plant maintenance, in Bologna, Italy, from February 17th to February 2O'h, 1999) - E. TOURNU ; F. CHABOT

Improving Power Plant Efficiency and Safety through better Knowledge of Flow-Rates: the EDF Approach - M. PIGUET (POWER-GEN EUROPE '98)

Primary Flow and Temperature Measurements in PWRS using Non-invasive Techniques - J.M. FAVENNEC, P. THOMAS, H. JEANNEAU

-392- CZ0129441

INVESTIGATION OF DUBLE VACUUM ARC MELTED ZIRCONIUM ALLOY El 10 AND E125 STRUCTUREL CONDITION USING RADIOACTIVE TRANCERS

Shikov A., Arjakova V., Fedotov S., Ermakova L.,RF SSC VNIINM, Moscow, Russia. Lositsky A., Dubrovsky V., Bessonov O., Shtutsa M., JSC «ChMZ», Glasov, Russia.

Structure of vacuum-arc /VAR/ melted ingots was investigated with the use of radioactive tracers: very small proportions of W-185 and C-14 were added to charge materials before melting. They decorated ingots structure and made it possible to study the behaviour of impurities in the process of melt crystallization changes in structure with the degree of refining and method of melting. Radiographic investigations revealed that quality of ingots considerably improved after electron-beam melting: ingots structure was more uniform, carbide were considerably in their sires. Radioisotope tracer method was used for investigation of vacuum-arc melting process /VAR/ and crystallization of zirconium alloy with 2,5 wt. % of niobium. The following isotopes were used as radiotracers: W-185 - beta-radiator, half-life period - 73,2 days; C-14 - beta-radiator, half-life period - 5000 years. The isotope W-185 was used to investigate forming of zirconium alloys cast structure as it is zirconium soluble that is to say, it is a substitutional element. It is the element from amongst the natural impurities of this alloy, it has low beta-radiant energy, long half-life period and allows to reveal dendrite structure of the alloy , which is not revealed by standard etching with the aim of macrostructure revealing. The isotope W-1S5 was added to the alloy in the form of multicomponent quadruple alloying composition. Carbon isotope C-14 was to investigate the behaviour of interstitial impurities (carbon and others) forming different inclusions in zirconium alloys. Carbon isotope was added to the alloy in the form of zirconium-carbon compound. Isotopes mixed with electrolytic zirconium powder were packed into (packets of aluminum foil), which then were inserted into charge in the process of briquettes compacting. Additions of the isotopes constitute 0,0001 wt. %, that practically does not affect these elements content in the alloy. Tungsten content of the produced ingots was 0,01 wt. % and carbon content - 0,004...0,0068 wt. %. Longitudinal and transversal templates were cut from the finished ingots. Radiograms were obtained by the contact method at the scale 1:1. Dark places of the radiogram correspond to the maximum isotope content in a give place of the template, light - to metal, low in the isotope. The isotope were chosen in such a way as to decorate both ingot structure, depth and shape of the molten metal pool (W-185), and different microinlomogeneities, grain boundary precipitates (C-14). General view of the first melted ingots radiograms is demonstrated in fig. 3. It is seen from this figure how tungsten isotope decorates shape and depth of the molten metal pool as it enters this pool. It occurs so because of portionally adding of tungsten isotope to the consumable electrode. At the beginning of melting we obserwe areas low in the isotope, the small depth of molten metal pool in this period. As the molten metal pool increases, isotope distribution becomes more homogenious. Fig. 1,2 demonstrates shape factor of the molten metal pool as a function of the high of solidified part of the first melted ingot, were shape factor of the molten metal pool (m.m.p.) is the relation of m.m.p. depth with ingot high.

-393- As it is seen from this figure, stationary m.m.p. is located at the distance of 300 mm from the ingot bottom part and has composite shape in its section, including parabolic bottom part and trapeziform top part with the high about a half of molten metal pool depth. Experimental investigations show that the shape of m.m.p. (in its bottom part) in its axial section rather accurately corresponds to the following equation: Y = kx2, where Y - depth of m.m.p. section, x - diameter of the section at a given depth, k - 0,0017 - obtained experimentally.

From the preceding it may be seen that m.m.p. weight is 115... 120 kg.

Table - Volume and weight of the stationary molten metal pool Name Volume, sm Weight, kg M.m.p. conical part 12400 77 M.m.p. parabolic part 6100 38 M.m.p. 18500 115 Briquette 5740 31

So, the volume of one charge portion (one briquette) by the factor 3,2...3,4. Second melted ingots were melted into crucible with diameter 450 mm, ingot weight 1,2 t. Fig. 4 demonstrates the arrangement of zones with different structure zones of the ingot: fine cellular a); cellular b); cellular-dendritic c); transforming into dendritic d). Autoradiographs, fig. 5 , shows the ingot, melted using alternating stirring (stirring with alternating polarity) of the melt. Molten metal shape and depth are clearly seen as well as the length of two-phase zone and its variation with ingot high and diameter. The structure of ingot and cast rods produced by EB (electron beam) and EBCM (electron beam crucible melting) melting techniques was also studied using. Radioactive tracers (W- 185 or C-14) decorated the structure of ingots and cast rods and made it possible to evaluate the behaviour of interstitial and substitutional impurities on melt crystallization of EB- melting, the change of a structure depending on the extent of refining and the way of melting. It follows from the autoradiographs and the comparison between the structures that after EBCM the metal quality is significantly impoved: the structure is more homogeneous, the intercrystalline carbide precipitates are considerably less size. Fig. 6 shows the investigation of the EB-melting of surface of ingot. Zone of an ingot C- 14 also revealed a significance change of the structure: essentially no carbide precipitates are observed in the EB-melting of surface zone.

CONCLUSION

Research of ingots with using radioactive tracers: W-185 and C-14, give possibility get new result investigation the structure and to evaluate the behaviour of interstitial and substitutional impurities on melt crystallization.

-394- REFERENS l.Zaimovsky A.S. et al. « Zirconium alloys in Atomic Power», Moscow, Ehnergoizdat, 1981. 2. Arjakova V.M. et al. «Melting and Casting zirconium alloys», Paper submitted to conference in Reno, USA, 1989. 3. Arjakova V.M. Review of papers of 3-d International Oral Examination on Electron Beam Melting, Lyons, France, 1983. Zhurnal «Atomnaya Ehnergiya», vol. 57,1984.

-395- Fig. 1. Dependence coefficient form molten metal pool from high ingot.

Fig. 2. Dependence Depth molten metal pool from high melted ingot.

Fig. 3. Autoradiogram with W-185, 1:1.

Fig. 4. Fragments of autoradiograms of ingots structure zones, obtained using the isotope W-185.

Fig. 5. General view of the first melted ingots radiograms.

Fig. 6. Autoradiograms with C-14, 1:1.

Coefficient form molten metal pool

High ingot, m

Depth molten metal pool, m

High melted ingot,m

-396- CZO129442

Technical Innovations at NPP Dukovany - for Safe and Efficient Operation

M. Sabata, NPP Dukovany I. Vasa, Nuclear Research Institute Rez pic

Abstract

Inherent features of the NPP Dukovany design provide a significant confidence in its nuclear safety assurance, among these feature should be emphasised the reactor core stability and its control and protection system capability to hold the reactor in safe state following scram or accident conditions. Nevertheless, NPP Dukovany was designed in the early seventies, and current requirements for nuclear safety assurance are more strict and/or specific as a result of the technical development and lessons learned from nuclear accidents.

The paper compares the safety design base established at the time of NPP Dukovany project implementation and the current reference design base. Paper also presents procedure applied to implement technical and operational measures which are introduced to fulfil the current basic safety criteria. The scope of such measures applied at NPP Dukovany is compared with that of EU countries introduced from the same reason - to meet the updated safety related requirements.

Examples of some innovations already implemented or under implementation give an idea how NPP Dukovany proceeds in reaching the goal of harmonising its safety with the requirements to be met before the Czech Republic becomes a member-country of the European Union.

1. Introduction

NPP Dukovany (4 x VVER/213) was put into operation within 2.5 years period: its first unit was phased in to the national grid in the beginning of 1985 and the last fourth unit - in the middle of 1987. Since then, all four plant units have operated reliably, with excellent economic parameters and without any significant safety concerns.

Nevertheless, in accordance with the generally accepted trend of nuclear safety enhancement, conform to the ALARA principle, and bearing in mind the necessity to increase further reliability and efficiency of electricity production, the Czech Power Utility and Operator of NPP Dukovany (CEZ, a.s.) has begun its complex modernisation. Nuclear Research Institute Rez participated in this process since its has been launched in 1993.

-397- 2. Starting Point for Technical Innovations

A complex assessment of the NPP Dukovany operational safety, reliability and efficiency was performed during 1993 - 1994 by the plant staff in collaboration with NRI (and some other Czech organisations) specialists. This key step was practically directly followed by so called External Audit performed within PHARE 4.2.9/92 project - VVER 440-213 Engineering Safety Evaluation (1994 - 1995) by ENAC consortium. At the end of 1995 the plant hosted the IAEA Safety Improved Review Mission which confirmed that the NPP Dukovany modification programme aimed at the plant safety enhancement is oriented, prepared and controlled adequately.

It is worth mentioning that performed analyses of plant safety identified a number of technical and operational measures; some of the measures were also derived from the existing operational experience of this and other VVER-440 plants. Basically, all the measures already implemented or being currently implemented can be divided into several groups:

a) Group of the measures required by the State Office for Nuclear Safety, so called the IAEA ,,Safety Issues", for instance:

• Upgrading of I&C system equipment • Protection of steam generator box sumps • Modification of equipment at the longitudinal intermediate building, elevation + 14.7 m • Relocation of the emergency make-up section header • Equipment qualification

• Continuous level and pressure monitoring in steam generator boxes

b) Group of the measures required to ensure plant operation, for instance:

• Capacity extension at the intermediate spent fuel storage facility • Reconstruction and extension of the diagnostic system • Full-scope unit control room simulator • Replacement of the main condenser tubes (advanced material) • Assured power supply to safety systems • Replacement of electric equipment and diesel generators I&C system • Reconstruction of the ventilation system c) Other measures, for instance:

• Radioactivity monitoring in water treatment tanks

• Distribution of fire extinguishing and drinking water d) Group of the analytical and justification measures:

• Probabilistic Safety Assessment - PSA Level-2,^ • Assessment of pressure equipment integrity • Analyses required to extend the equipment service life

-398- • Thermal-hydraulic analyses and analyses of the operational modes • Justification of equipment functionality and safety • Assessment of the equipment residual service life

3. Procedures and Tools Applied for Safety Evaluation

One of the most efficient tools applied for plant safety evaluation was the PSA Level-1. Plant specific PSA study actually comprises a systematic procedure for the identification of credible accidents sequences and consequently - helps to the plant operational vulnerabilities (design, operating procedures, human factor, etc.). PSA level-1 for 1st unit of NPP Dukovany was completed in 1995. This PSA has not only shown that the core melt probability can be reduced but also indicated which steps should be taken to reach this goal. This basic study was performed for internal initiators and full power operation and its logical continuation so called Living PSA programme continued. Living PSA uses a specific PSA model which could be more dynamic and is based on the NPP real ,,situation" resulting from modifications and changes made since the unit was put into service. The first stage of the Living PSA programme was represented by development of Living PSA model. To modify the basic model two different approaches were used:

• model modifications - updating

• model modifications - scope extension

The first approach actually follows modifications in the NPP design, changes in operational and emergency procedures, input data and takes into account results of the newly performed analyses. The second approach to the model modifications has included (or will include) such activities as a model extension for other operating states, a more detailed human reliability analysis and the dependency analysis (interconnection of all safety related ,,factors" of the plant), other previously not considered source of radioactive releases (spent fuel storage pool) and likely - an level extension. All these steps should result in a PSA which can be used to an advantage for ,,real" NPP operation.

Making use of the OECD countries experience we have taken into consideration three kinds of the PSA applications:

• risk monitoring

Based on Living PSA model input, we are preparing Safety Monitor System which should be used for coping with short term operational risk related problems (events) and the corresponding decision-making, such as testing and maintenance schedule risk based optimisation, etc. NPP Dukovany has already had a certain kind of risk monitor system based on the preliminary PSA study used for off-line risk monitoring within the frame of the US DOE and Czech State office for Nuclear Safety sponsored pilot programme (1995 - 1996).

-399- • risk assessment of operational experience

This PSA application category includes evaluation of the nuclear power plant operational experience with the objective to analyse severity of accidents considered from the safety standpoint. Some analyses of this kind performed at NPP Dukovany earlier, however without the necessary systematic approach taking into account the accident sequence precursors, are already available.

• risk assessment application by Living PSA model

This application is based on evaluation of the core damage frequency (average value) and identification of the dominant risk contributors by the Living PSA model. Outputs are used to estimate the plant unit current average risk, to plan plant modifications and to establish priorities. At present, when many technical and operating modifications (measures listed above) have been already implemented, it is shown that the CDF (Core Damage Frequency) value for the operation at nominal power is significantly less than 10"4'.

Despite the fact that that the Dukovany unit core melting probability is sufficiently low" and corresponds to generally accepted values in the range of 10"5, it is necessary to prepare, in compliance with the world-wide trend, such measures which will minimise environmental impacts of a severe accident with core melting. This approach is based on the defence-in depth concept which was formulated (INSAG 10 ,,Defence-in-depth in Nuclear Safety") as a consequence of severe accidents that had occurred during eighties (see attached Fig.).

There is a general agreement on the practical steps which should be taken to implement such measures, however there is also a difference in the envisaged time schedules. In the EU countries the compliance was declared in so called Consensus Document. This document issued in 1995 confirms:

• compliance with the requirement of implementing preventive and limiting measures • necessity to develop an ,,Action Plan" for Severe Accident Management (SAM) • necessity to implement adequate measures for each of the NPP types, taking into account results of the cost-effectivity analysis • usefulness of including SAM into the periodic safety evaluation • necessity of taking such accidents into consideration in designs of future nuclear power plants

An analogical programme leading to the development of the severe accident management guidelines and to identification of the appropriate operating and technical measures, is being prepared for NPP Dukovany.

Nevertheless, at present there is still a problem of insufficient knowledge of all processes which take part in the course of a severe accident, as for instance:

• dynamics of melt behaviour in the reactor pressure vessel (stratification, circulation, chemical and nuclear reactions)

-400- • cycle of the fission products retention and release in the containment in the course of a severe accident • prediction and actual behaviour of hydrogen during individual stages of a severe accident.

The significance of full understanding of these phenomena for formulation of an optimal SAM strategy was underscored the fact that the relevant research was included into the EU 5th Framework Programme. We would like to mention that the Czech Republic participates in this effort and that the Nuclear Research Institute Rez is a member of research teams engaged in the projects listed in the attached Table.

Other significant international projects established with the similar purpose to obtain information necessary to ,,cover" the severe accidents problem were launched by the OECD/NEA, among the currently running projects we should mention RASPLAV (MASCA) and CABRI in which the Czech Republic (NRI Rez) participates as well as a number of PHARE projects related to some partial innovations for VVER-440/213.

Applying that information and actually within the international co-operation, we solve step- by-step all safety related issues using the state-of-the art tools and technology. Approximately an year ago NPP Dukovany has defined a complex programme of ,,Continuous Improvement" - so called Harmonisation Programme.

4. Conclusions

,,Harmonisation" programme and its gradual implementation ensures that nuclear safety of Czech NPP Dukovany either already is or very soon will be at the same level as nuclear safety of the EU countries, fulfilling criteria established for western nuclear power plants. We can therefore take it for granted that in the European Union region nuclear power plant Dukovany will remain a safe, reliable and economically competitive energy source.

-401 - Figure

Development of the Defence-in-Depth Concept

Basic Concept

Sixties Level 1 Level 2 Level 3 Conservative design DBA prevention DBA management

Defence-in depth Improvement

Seventies - Taking into account local and extreme effects - Strengthening QA - Implementation of PSA methodology

Defence-in-depth Extension

Eighties - Human factor, multiple failures - Accident management, and/or mitigation of consequences - Symptom-oriented Procedures - Procedures, guidelines and measures for Severe Accidents - Off-site Emergency Plans

-402- NRI Participation in the relevant projects

EVITA European Validation of the Integral Code ASTEC (GRS Koln, Germany) ARVI Core Melt Pressure Vessel Interaction during LWR Severe Accident (RIT- Stockholm, Sweden) SCTR Steam Generator Tube Rupture Scenarios (VTT- Espoo, Finland) ICHEMM Iodine Chemistry: High Effects and Mitigation Mechanism (AEAT - London, UK) LPP Late Phase Source Term Phenomena (AEAT - London, UK) TYPYCA Thermohydraulics and Physical Chemistry of Corium (CEA Cadarache, France) JSRI Joint Safety Research Index Programme (GRS, Koln, Germany) 4 Eurofastnet European project for Future Advances in Sciences and Technology for Nuclear Engineering O 00 thermalhydraulics, CEA-CEN Grenoble Promoting Co-operation between NRA EU and their Counterparts in the Central and Eastern Europe (GRS, Germany) CZO129443

Dynamic Analysis and Upgrading of Reactor Cooling Systems of WER 440/213 (PAKS) due to Seismic and Normal Operational Loading

A. Halbritter, NJ. Krutzik, W. Schutz Siemens AG, Power Generation (KWU), Offenbach, FRG

T. Katona, S. Ratkai PAKS Nuclear Power Plant LTD, Paks, Hungary

ABSTRACT

In order to requalify the seismic capacity of the reactor coolant system (RCS) as well as the nuclear safety systems (NSS) and components (NSSC), detailed analysis were performed for each of the four WER-440/213 units. The dynamic behavior of the reactor coolant system (RCS) was analyzed and evaluated in detail on the basis of the results of a dynamic calculation (eigenmodes, relative displacements, acceleration response spectra). The findings of the evaluation of the results obtained for the as-built status provided the first upgrading option and indication for arrangement of dampers introduced for stabilizing the steam generators and loops of the RCS. In order to evaluate the efficiency of the adopted dampers and their location, comparisons were performed on the basis of the results of different upgrading concepts considering the available gap (horizontal and vertical) of the dampers as well as the thermal expansion effects of the RCS loops. By evaluating the results obtained for a number of subsequent upgrading alternatives, it was possible to define the final stabilization concept for the reactor coolant systems. The final retrofit alternative of the structures on the reactor coolant systems represents the basis for the upgrading measures as well as the calculation of the final response spectra.

2 INTRODUCTION

In order to investigate the reactor coolant system in detail and select an optimal upgrading concept, a number of investigations were performed for a range of stabilization options. The starting point of this investigation were the data of the real dynamic behavior of the reactor coolant system obtained for the as-built status by means of a complex mathematical model composed of the RCS and the supporting reactor building concrete-block structure (RBCB). This led to the conclusion that, due to the relatively large displacements (particularly those of the steam generators, see Table 1), additional stabilizing elements (viscous dampers) would have to be installed in order to reduce the dynamic response of the RCS loops and components. This is mainly attributable to the very flexible structure of the RCS which is designed to accommodate the thermal expansion and contraction during operation. The dynamic behavior of the reactor coolant systems has therefore been calculated for a number of upgrading options considering a different arrangement of stabilizing elements (dampers) supporting the steam generators and the main cooling pumps of every loop. The selection of the most effective upgrading concept was based mainly on the detailed evaluation of the following dynamic response results:

-405- - Maximum displacements and accelerations - Values of total forces and stresses - Fundamental frequencies (transfer functions).

3 IDEALIZATION OF STRUCTURES AND LOADING CONDITIONS

The general arrangement of the RCS in the RBCB as well as its mathematical idealization is shown in Figures 1 to 3. The RCS loops as well as the associated components were idealized by means of equivalent piping, beams and spring elements. Figure 5 shows the three-dimensional mathematical model of one loop, while Figure 4 illustrates the global model of all six loops. The reactor building concrete block (RBCB) supporting the primary system was idealized by means of a three-dimensional mathematical model [4] composed of quadrilateral and triangular plate elements (Figure 2). In order to consider the coupling effects between the RCS and the supporting structure as well as to introduce correctly the excitation on the rather large number of supporting and connection points of the RCS, the two models (RCS + RBCB) were coupled as specified in [1] to form a single complex mathematical model [5]. The real interaction between the reactor building concrete block and the soil on the site is represented by frequency-dependent impedance functions (obtained as part of the analysis of the main building complex) distributed over all nodal points of the foundation of the RBCB. It is thus assumed that the capability of the soil foundation to absorb translational, rocking and torsional motion as well as its radiation and hysteretic damping is considered realistically [2]. Three artificial acceleration time histories derived from the site-specific free-field spectra were applied simultaneously in order to simulate an earthquake [3].

The horizontal time histories defined in [1] were scaled to 0.25 g and the vertical time histories to 0.2 g. In order to take into account the embedment level of the building, the time histories were deconvoluted to the foundation level.

4 ANALYSES FOR AS-BUILT CONDITIONS

Frequency-domain analyses using the SASSI computer code [6] were performed for every option of the reactor coolant system in order to derive the dynamic response results for the as-built conditions during an earthquake excitation of the reactor concrete block. By analyzing the eigenfrequencies and mode shapes (Figures 7 and 8) obtained for the as- built condition it was possible to determine the region and direction in which the RCS damping forces should be effectively implemented. After preselecting the stabilization elements and the locations of the dampers, calculations were performed in order to derive the relative displacements (Tables 1 and 2) and forces/stresses (Tables 3 and 4) acting in characteristic regions. The tables for forces and displacements show the maximum values of all six loops.

The following were identified as the most representative regions: - The edges of the steam generators (displacements and stresses) - Cold loop near MCP (displacements and stresses) - Hot loops near valves (displacements and stresses) - Hot and cold loop close to the RPV nozzle (forces, stresses) For every upgrading option, the status of stresses in the loops due to earthquake loading as well as stresses caused by normal operation were combined and evaluated.

-406- 5 UPGRADING ALTERNATIVES

With regard of the pronounced thermal expansion of the RCS loops, the only reasonable approach with regard to stabilizing the components and loops would appear to be the implementation of viscous dampers. Considering the required capacity of viscous dampers and considering the available space for implementing the damping devices, Gerb-type /8/ viscous dampers (VES 100) characterized by frequency dependent damping forces Figure 9) were selected. On the basis of the eigenmodes obtained for the as-built conditions as well as the relative displacements in the above characteristic regions of the as-built conditions (Option 0), the following upgrading versions were determined and analyzed independently in subsequent steps: a) Alternative 1 (4+0, Figure 10) - Stabilization of the steam generators by means of 4 VES 100 dampers located accordingly between the steam generator (SG) traverses and the repository supports. b) Alternative 2 (4+1) - Stabilization of the steam generators by means of 4 VES 100 dampers. - Stabilization of the MCP by one VES 100 on the loop downstream of the pump. c) Alternative 3 (6+1, Figure 11) - Stabilization of the steam generator by means of 6 VES 100 dampers. - Stabilization of the MCP as above. d) Alternative 4 (8+1) - Stabilization of the steam generators by means of 8 dampers. - Stabilization of the MCP as above.

The forces and stresses due to seismic and normal operational loads were evaluated accordingly for characteristic regions of the reactor coolant system. Subsequently the stresses in the characteristic regions of the pipe cross-section were derived from the axial forces and moments, and for the axial forces combined with bending moments. In order to select the most appropriate alternative, the seismically induced forces in the characteristic regions of the reactor coolant system (the connection to the loops to the RPV the SG and the MCP) are summarized (maximum values over all 6 loops) in Table 3. The values given for the stresses are only intended for selecting the upgrading concept and have been calculated without code considerations. In order to demonstrate the total status of stresses due to seismic and normal operational loads (deadweight, pressure, temperature) the stresses for the above characteristic regions are summarized in Table 4. Figure 12 shows the comparison of transfer functions from the "as-built" condition and Alternative 3. The peaks of the transfer functions indicate a change in the natural frequencies of the primary system as well as a reduction in the amplification values.

6 CONCLUSION

By comparing the relative displacements derived for different alternatives of arrangement and (numbers of dampers) it was possible to clarify the possibilities reducing the relative displacements of the steam generators. It could be observed that by means of only 6 dampers (3 dampers on every support) installed between the SG and the supports, the relative displacements could be reduced by a factor of more than three. The relative displacements were calculated for different upgrading alternatives as well for the thermal expansion.

-407- Although the reduction in the response noted in the case of implementation of viscous dampers is not significant, the main objective of the introduction of viscous dampers i.e. the limitation of the expected displacements and stresses in the RCS loops to the allowable values has been successfully achieved. Figures 13 and 14 show the arrangement schemes of the dampers on the steam generator as well as main pump location of the selected final solution.

6 REFERENCES

[1] Criteria and Methodology Specification for Seismic Reanalysis and Upgrading of WER 440/213 PAKS - Siemens Work-Report KWU NDA2/96/ E0516 [2] Soil Profiles and Time Histories at Foundation Level for Final Seismological and Soil Dynamic Input Data PAKS Units 1-4 - Siemens Work-Report KWU NDA2/96/E0528a [3] Artificial Time Histories Siemens Work-Report KWU NDA2/96/E0527a [4] Mathematical Model of the Main Building Complex WER 440/213 Paks, Siemens Work-Report KWU NDA2/96/E0530 [5] PAKS Unit 4, RCS / RBCB, Mathematical (3D) Model for Dynamic Characteristics of the RCS for As-built Conditions, Siemens Work-Report KWU NDA2/96/E0534 [6] SASSI, A Computer Program System for Dynamic Soil-Structure Interaction Analysis, Siemens KWU Version 1/1991 (Original source M. Tabatabaie-Raissi, J. Lysmer, University of California, Berkeley) [7] PAKS Unit 4, RCS / RBCB, Structural Dynamic Analysis for Seismic Loading of the Primary System PAKS (As-built Conditions), Siemens Work-Report KWU NDA2/97/E0555 [8] GERB Rohrleitungs-Typenreihe VES, Technischer Bericht July 1997

SlrucUire Nodal Poinl Displacement [mm]

X Y Z

FIPV 5002 0.0 0.0 0.0 5010

Valve / CL -62 76.2 80.8 2.3 Valve / HL •20 80.0 76.5 14.9

Sleam •90 186.5 172.8 4.9 Generator -91 130.9 128.0 2.8 -92 192.0 203.5 5.2 -93 137.4 145.2 3.1 Tab. 1 Maximum Relative Displacements AS-Built Conditions (Alternative 0)

Alternative Displacements [mm]

X Y Z

0 182.9 192.8 6.5 (0+0)

1 66.2 63.0 6.7 4+0

2 69.2 62.3 6.7 4+1

3 66.5 60.2 6.5 6 + 1

4 52.0 53.9 6.4 0+1 Tab. 2 Maximum Relative Displacement of the Steam Generator Girder in Relation to tne Supporting Rack

-408- Forces |kN| MomencspcNml NOL a iinane SeismctOead Load Region Alternative Region Alternative P j P2 ! P3 Ml M2 M3 P" T" A B C A g C 0 900 180 220 200 1700 960 0 1 101 1 34 103 256 34 103 306 HPV RPV 0.0 0*0 900 170 260 170 1800 810 2 101 7 34 103 280 34 103 304 0 23 560 240 1900 360 730 0 3 101 15 0.4 104 52 0.4 104 87 SG SG 0*0 700 150 270 190 1100 160 0*0 1 101 s 31 10 212 31 10 40 000 170 180 49 600 600 0 0 1 101 3 17 79 95 17 79 165 MCP MCP 0*0 1200 230 53 120 100 490 0*0 101 10 56 60 70 5S 80 140 4 1400 170 170 48 410 690 4 1 74 S4 74 HPV qpv 101 26 25 134 8*1 1*00 160 110 64 500 S90 8*1 2 101 7 25 73 107 25 78 167 4 14 210 100 620 170 330 4 3 101 5 0.2 47 25 02 47 60 SG SG 1200 100 100 81 620 120 8*1 1 101 15 22 6 94 22 31 4 870 400 420 32 260 210 4 1 101 3 15 26 52 15 28 122 MCP MCP 8*1 360 270 25 . 55 57 260 8*1 3 101 10 i 32 15 6 32 85

Tab. 3 Maximum Forces [kN] in Characteristic Tab.4 Maximum Stresses [Mpa] in Characteristic Regions of the RCS Nozzles of RPV Response of the RCS Nozzles of RPV Cold/Hot Leg) (Cold/Hot Leg)

Fig. 1 Arrangement of the Reactor Cooling System Fig. 2 Complex Mathematical Model in the Concrete Block of RCS and RBCB

Fig. 3 Interfaces of the Reactor Cooling System Fig. 4 Mathematical Model of the Complex RCS and Reactor Building Concrete Block

-409. Fig. S Mode Shapes and Upgrading Measures on Steam Generators

Fig. 5 Mathematical Model of a Single Loop

I- ^ L '1 1 • -» 1—1—1 r ^ ."•"^ •—~-_ •—1 =—.

i '•' ' : 1 1 «J

•—. —— —-—.

—r—z ~* i

Fig. 6 Frequency Dependent Damper Fig. 9 Mode Shapes and Upgrading Measures on MCP Resistance of GERB Dampers

Fig. 7 Upgrading Measures on Hot Legs Fig. 10 Retrofit Alternative 1 (4 + 0)

-410- 3I § '"

f REQUENCY IHZ1

Fig. 12 Comparison of Transfer Functions (Alternative No. 3) without and with Dampers, Steam Generator

Fig. 11 Retrofit Alternative 3 (6 + 1)

Viscose Oamp«r» (GERBVES-1001

Fig. 13 Implementation of Dampers on Fig. 14 Implementation of Dampers on Steam Generator Supports (Scheme) Main Cooling Pumps (Scheme)

-411 - CZ0129444

WER — Technical innovations for the next century

Design, implementation and licensing of improvement measures

Pascal Rousset - Framatome

Abstract

Modifications are designed to contribute to improve the level of safety, and the level of performance of the plants. The successful implementation of a modification depends on the quality of the design and particularly the good fitting of the modification in the existing design, on the perfect consistency of the licensing approach and on the good management of the project constraints and interfaces. Over the last ten years, Framatome has accumulated a large and varied experience in these activities, as shown in the few examples briefly described in the presentation. Within the Mochovce completion project, Framatome has been in charge of the basic design or implementation of about twenty safety measures. This involved establishing efficient partnerships with design organizations and suppliers in Slovak Republic, Czech Republic, and Russia. A similar approach is used in the frame of the Kozloduy 5-6 modernization program, where the basic engineering contract is conducted since 1998 and the main contract under discussion. From the very beginning of the TACIS program Framatome has been involved in projects dealing with the design of the reactor safety systems. For example, an extensive work aiming at developing a methodology for accident analysis in VVER reactor was initiated in 1993, in collaboration with Siemens, Kurchatov Institute and OKB Gidropress. This methodology was recently used successfully in a new project with the objective to evaluate the possible modification of reactor protection signals of some Russian reactors. Within the PHARE program, a complete analysis of the primary to secondary leakage risk was conducted for Paks nuclear power plant. This involved the writing and validation of the relevant emergency procedure, specification of the leak detection system, study of an improved design of the collector cover, and recommendation of some systems modifications. A last example is the study of the modifications of main steam lines performed in the frame of the Mochovce project as well as in a PHARE project for the Dukovany nuclear power plant. This involved the safety analyses of the consequences of a pipe rupture, determination of postulated ruptures, design of pipe restraints, analysis of the ability of isolation and safety valves to operate in accidental condition, proposal of modification of valve internals.

-413- Design, implementation and licensing of improvement measures

Modifications have been designed on VVER plants to contribute to improve the level of both safety and performance of the plants. The successful implementation of a modification depends on the quality of the design and particularly the good fitting of the modification in the existing design, on the perfect consistency of the licensing approach and on the respect of the project constraints and interfaces.

Though the safety concepts remain basically the same from one case to the other, the conditions in which each modification must be designed and licensed vary significantly, requiring a high flexibility in the approach. One obvious reason for this variability is the technical particularities of each plant, which require specific attention. But many other reasons contribute to make each project a unique one: the organization of the project itself, the various actors involved with their own methods, tools and culture, the way the consistency with other modifications implemented or planned on the same unit is ensured, the general approach of the involved safety institutions... The challenge is then to combine the high flexibility required to adapt one's approach to each unique situation with the high level of rigor required to carry out the project according to schedule, budget and requirements.

Over the last ten years, Framatome has accumulated a large and varied experience in these activities, as shown in the few examples briefly described in the presentation. This covers large projects including whole packages of modifications, as well as smaller projects focussed on one specific safety concern, or even on methodological concerns.

Modernization and completion projects

A first, and important example is the contribution of Framatome to the completion of Mochovce units 1 and 2. This case is characterized by the simultaneous treatment of a large number of safety measures within a vast organization involving many interfaces.

On the basis of the IAEA and Riskaudit reviews, Slovenske Elektrame elaborated a comprehensive catalogue of the safety measures to be implemented on the units during their completion. The industrial scheme adopted was similar to the one used for the initial construction of the plant, the General Designer and the General Supplier keeping their roles in the completion of the plant and taking charge of part of the decided measures. The balance of the safety measures has been analyzed or implemented by the EUCOM consortium, including Framatome and Siemens, by Atomenergoexport of Russia, VUJE of the Slovak Republic and the power plant operational teams. EDF assisted the utility in project management.

The 87 safety measures involved a large scope of safety concerns, such as accident prevention, protection against common mode failures, reliability of engineered safeguard functions, integrity of confinement barriers and radiation protection, accident analyses, probabilistic safety analyses, and man-machine interface. EUCOM has been involved in 43 of these measures.

-414- Specific tasks with major involvement of Framatome were, among others: the definition of the scope and methodology of the accident analysis, the best-estimate studies to support emergency operating procedures, the study of the reactor pressure vessel thermal schock, the analysis of the behavior of the steam generators in accident conditions, the review and improvement of the reactor protection system, the review of the primary pipe whip restraints studies, the treatment of the internal hazards due to high energy piping ruptures, the mitigation of steam generator primary collector break...

Framatome set up specific partnerships with several local companies for the purpose of this project: in the Slovak Republic, the Vuje institute in Trnava, the Relko institute in Bratislava and Vuez institute in Levice have been deeply involved in the design work as well as the Rez institute and Modranska Potrubny company in the Czesh Republic. In Russia, Framatome worked closely with the original designers Gidropress and Kurchatov Institute, as well as with equipment manufacturers such as SNIIP Systematom and Chekkov Power Engineering company, whose equipment have been qualified.

The challenge for all the parties involved was to demonstrate that they could complete their tasks in collaboration with the other parties, from basic design to implementation and licensing of the modifications, on time and within budget. The start-up on schedule of the units shows that this challenge has been met.

The bulk of Framatome work on this project is now over but another similar configuration is now encountered in the frame of new modernization and completion projects. For the Kozloduy units 5 and 6 modernization program, in Bulgaria, a consortium including Framatome, Siemens and Atomenergoexport signed a first contract in 1998, called "Basic Engineering Phase" which is aimed at defining in detail the needed hardware modifications. For Rovno 4 and Kkmelnitsky 2 completion project, in Ukraine, Framatome is the leader of a consortium including Siemens and Atomstrojexport, to act as general contractor.

A methodology for accident analyses

In a totally different context, TACIS 91 project "accident analysis" gave us the opportunity to develop a methodology for accident analysis of Russian VVER 440/230 reactors. This project was performed jointly by Framatome, Siemens and Electricite de France. The beneficiary was Rosenergoatom and the local institutes involved were Kurchatov Institute and Gidropress.

The project lasted two years and a half and allowed an in-depth review of western and Russian practices, methods and tools.

The French and German methodologies for accident analysis were analyzed in detail during the first year in order to determine their correct applicability to VVER 440/230. The principles to be adopted, the list of accidents and transients to be analyzed, and the precise assumptions to be made for each calculation were discussed at length. Eventually, a common methodology was proposed to Rosenergoatom and approved.

The French and German codes for thermal hydraulic and confinement analysis were transferred to the local institutes, with corresponding training. The necessary input data were

-415- elaborated and verified. A comparison of the western and Russian codes was performed to identify which code could be used for each purpose, and to eliminate the code-specific results.

Once the methodology had been defined, a total of 60 initiating events, leading to over 100 scenarios, were analyzed. The results corroborated the conservatism of the earlier approaches for the original design basis of these reactors and allowed to propose potential improvements.

More recently, in 1999, a new project called "emergency protection signals evaluation for VVER 230" was launched, aiming at proposing and evaluating a new set of protection signals for VVER 440/230. Despite changes in the western team, with the arrival of new participants, the large preparatory worked performed in the first project allowed this evaluation to be carried out in 8 months.

Primary to Secondary leakage

The possibility of a large Primary to Secondary leakage is considered with a particular attention for VVER reactors, especially because of the design of the steam generators primary collector. This accident can lead to significant radioactive release in the environment and the primary coolant inventory can be jeopardized.

The issue encompasses accident analyses, measures aiming at improving the prevention of the accident, improvement of the means for detection of the accident, and for the mitigation of its consequences.

Accident analyses involve the determination of the overall response of the plant, the calculation of activity released, the determination of the structures mechanical loads, the analysis of the influence of the various systems involved in the accident management. Analyses are performed with penalizing assumptions for licensing purpose and with best estimate assumptions for accident management purposes.

Accident prevention includes the study of improvements of the collector cover design and of the secondary water chemical control. The systems for early detection of small leaks are generally based on Nitrogen 16 activity measurement when the plant operates at full power. For low power or shutdown states the detection can be based on the detection of noble gases gamma activity.

Framatome studied this issue successively in the frame of a PHARE project with Paks Nuclear Power Plant as main beneficiary, and in the frame of the Mochovce project. The PHARE project involded a western consortium lead by Framatome and including Siemens, Electricite de France, IVO engineering and NNC, and the Hungarian companies KFKI-AEKI Eroterv, and also Budapest University. The sharing of the responsibilities, and the limits and sharing of the technical scope were widely different from one project to the other but the safety approach was successfully adapted in both cases.

High energy piping ruptures

-416- Another important safety concern is the consequences of high energy piping ruptures in the intermediate building of VVER 440/213 reactors. Framatome had to deal with this topic in the frame of the Mochovce completion program and, in the frame of a PHARE project, for the Dukovany nuclear power plant.

During the PHARE project, the following approach was followed, in collaboration with the plant and with REZ Nuclear Research Institute, acting as main local sub-contractor.

The most significant existing accident analyses were reviewed in order to validate their applicability to the safety demonstration undertaken in the project.

Detailed stress analysis of the steam and feed water lines were performed to determine the postulated break locations. Dynamic calculations were performed to identify where restraints were necessary. Additional calculation were performed to allow the accurate design of these restraints.

A new routing of the Emergency Feed Water System, presented by the plant, was reviewed to verify the consistency of its design with the safety criteria used in the project.

The closure in accidental conditions of the main steam isolation valves was investigated. Recommended modifications have been documented. Calculations have been performed to justify that these modifications were efficient enough. In addition, the behavior of the steam safety and relief valves has been assessed, and larger modifications of the discharge system have been investigated.

The proposed modifications have been documented in form of a safety analysis, a description of the modified or added equipment, and a price assessment for the procurement and installation of this equipment.

Conclusion

During the last ten years, Framatome has been involved in many contracts involving most of the significant partners in VVER industry, thus accumulating a large experience both in the technical and the industrial fields. An important lesson learnt from these activities is that it is of the utmost importance to remain open to the particularities of each plant and each country in order to fit into the proper technical and organizational scheme the most adapted to each case. We have always met this challenge with success and we are confident that we will continue in the future to bring an efficient support to the continuation and improvement of the VVER industry.

-417- CZO129445

Effect of Heat Treatments on Microstructure and Hydrogen Enhanced Fracture Behaviour of Alloys 600 and 690

Iva MARTINAKOVA*, Jacques GALLAND", Miroslav TVRDY*, Vlastimil VODAREK* and Ludmila HYSPECKA"*

* Vitkovice R & D Division, Ostrava, Czech Republic ** Corrosion laboratory, Ecole Centrale Paris, France *** VSB-Technical University Ostrava, Czech Republic

Keywords: hydrogen embrittlement, M23C6 carbides, microsegregation of impurities, tensile tests, INCONEL 600, INCONEL 690.

ABSTRACT In this paper the results of investigations on the hydrogen embrittlement of nickel base INCONEL 600 and 690 alloys are reported. The hydrogen charging of alloys was performed by the electrolysis of water injected into a molten salt bath at the temperature of 300°C. The effect of hydrogen on mechanical properties of alloys investigated was evaluated by tensile tests at room temperature. Microstructural and fractographic investigations were performed using optical, scanning and transmission electron microscopy. Auger electron spectroscopy was applied for studies on sulphur and phosphorus microsegregation on the free surface of specimens. It has been demonstrated that the hydrogen charging of alloys 600 and 690 in the sensitised condition results in an increase in the yield strength and a decrease in both the ultimate tensile strength and elongation. An intensive precipitation of M23C6 carbides along grain boundaries contributes significantly to the hydrogen embrittlement. However, the absence of intergranular carbides is not sufficient to suppress the hydrogen embrittlement of alloy 600. The results indicate that sulphur microsegregation to grain boundaries may increase the number of hydrogen traps in this alloy.

-419- 1 INTRODUCTION Nickel base alloys INCONEL 600 and 690 have been used extensively for the tubing of vertical steam generators in nuclear reactors. Alloy 600, with a typical composition Ni-16Cr-9Fe, has been used for the steam generator tubing of the pressurised water reactors since 1967. It has provided a good general performance [1]. Nevertheless, a number of corrosion problems have occurred, e.g. intergranular stress corrosion cracking on the primary side and a combination of intergranular attack and intergranular stress corrosion cracking on the secondary side of the tube wall [2]. As these problems had put the safety and reliability of power plants at risk, an attempt to substitute alloy 600 with alloy 690 was made in the late 1970s. This alloy, with a typical composition Ni-30Cr-9Fe, has provided a considerably better performance in both the primary water and caustic soda environments [3]. However, alloy 690 is prone to a large reduction in fracture toughness in a hydrogenated water environment at temperatures below 150°C. The environmentally assisted cracking mechanism was proposed as the hydrogen embrittlement [4]. It has been proved that the hydrogen charging of alloy 690 results in a drop of ductility and predominantly intergranular fracture mode [5]. The studies on Ni-Cr-Fe alloys indicate that hydrogen atoms can be trapped at carbide/matrix interfaces [6]. So far the effect of microstructure, especially of intergranular carbides, on the embrittlement of nickel base alloys has not been well delineated. In this paper the results of investigations on grain boundary precipitation and microsegregation processes in alloys 600 and 690 are related to the hydrogen embrittlement.

2 MATERIAL AND EXPERIMENTAL TECHNIQUE The chemical compositions of alloys 600 and 690 are shown in Table 1. Both alloys were delivered in the form of 1.09 mm thick plates. Details about heat treatment regimes of the alloys investigated are shown in Table 2.

Table 1 Chemical compositions of alloys 600 and 690 (wt. %)

/Alloy C Mn Si P S Ni Cr Fe Ti Al Cu Co N

-420- 600 0.029 0.22 0.22 0.002 0.001 75.1 14.98 9.11 0.29 0.22 0.01 0.01 0.008 690 0.026 0.24 0.39 0.014 0.001 59.8 28.98 10.1 0.23 0.17 0.01 0.006 0.034

Table 2 Heat treatments of the alloys investigated Alloy Heat Treatments Identity 600-S 1000°C/AC + 700°C/16hrs/AC 600-A 1050°C/10mins./AC 690-S 1050°C/AC + 700°C/16hrs/AC 690-A 1100°C/20mins./AC

Analytical electron microscopy studies were carried out on carbon extraction replicas and thin foils using a JEOL 200CX microscope fitted with a Kevex 7000 energy dispersive analyser. Thin foils were prepared by twin jet electropolishing method in a

Tenupol equipment using a 95% CH3COOH + 5% HCIO4 solution at the room temperature and a voltage of 80 V. The size and distribution of minor phase particles along austenite grain boundaries were assessed using thin foil micrographs at magnification 20K. The results were statistically evaluated by Weibull distribution ( standard ST SEV 877-78): f(x)=ap-axa-1exp[-(x/p)a] (1) where f(x) is the probability density, cc.p are the particle distance and particle size parameters of distribution. The tensile tests at room temperature were used to study the effects of microstructure and hydrogen on mechanical properties of the alloys investigated. The

yield strength Rp0.2, ultimate tensile strength Rm and elongation A5 were evaluated. Furthermore, the index of embrittlement was calculated as:

[F%] = [(smax0-WH)/Wo]-100 (2) The hydrogen charging was performed using potentiostatic cathodic polarisation (- 1.7 V/Ag) of tensile specimens by the electrolysis of water injected into a salt bath at the temperature of 300°C [7,8]. According to J. Crank [9] a uniform hydrogen concentration in material is achieved when Dt/I2 = 0.049, where D is the diffusion

-421 - coefficient of hydrogen, t is the charging time and I is the half thickness of the specimen. It has been suppossed that the diffusivity of hydrogen in both alloys investigated is very similar. The diffusivity of hydrogen in alloys 600 and 690 has been expressed, using the results of isothermal hydrogen desorption in vacuum of 10"2 Pa at temperatures of 275, 320, 350 and 400°C and the Fick's law [9], in the form: 7 1 1 DH = 2.26x10" exp (-41.4 (kJmol" )/RT) [ mV ] (3)

These results are in accordance with data of Kishimoto et al.[10] who reported Do= 4.9x10"7 m2s"1 and Q=42.4 kJmol"1. Using the equation (3) it has been calculated that the minimum time required for diffusion of hydrogen through 1.09 mm thick plates during the electrolysis at 300°C is 5 hrs. As a result, the hydrogen charging in this

study was carried out for durations in the range from 5 to 48 hours. During the hydrogen charging at 300°C hydrogen atoms diffused easily into the alloys investigated. The hydrogen concentration after 5hrs of the hydrogen charging, as determined by desorption at 600°C for 30mins., was about 80 ppm. The hydrogen charging at 300°C for 48hrs. resulted in hydrogen concentrations about 100 ppm. On the contrary, the desorption of hydrogen at room temperature was negligible. For example, the 2 ppm loss of hydrogen was found after exposure at room temperature for 3 months. Microsegregation behaviour of impurities in the alloys investigated was studied using Auger electron spectroscopy. The free surface segregation of phosphorus and sulphur was investigated in the temperature interval 300-1000°C. This technique can be used for an indirect estimation of grain boundary microsegregation processes [11]. The final polishing of 08x2 mm specimens was done using an 1 jim diamond paste and the contaminated surface layer was removed by ion etching. Subsequently, the specimens were held at the required temperature for 5 mins. This period of time was proved to be sufficient to provide the correct information about the free surface segregation [11]. After heating the samples were cooled down to a temperature lower than 300°C and an Auger spectrum was recorded. The segregated layer was removed by ion etching and the temperature of subsequent heating was increased by 50°C.

-422- 3 RESULTS 3.1 Microstructure Microstructural investigations on alloy 600 in the as-received condition revealed intensive precipitation along the austenite grain boundaries, Fig. 1. Precipitates were identified as M23C6 carbides. Diffraction studies proved the existence of the cube to cube orientation relatioship between M23C6 and one of the neighbouring grains of austenite.

A small amount of accicular M23C6 particles was also observed inside austenitic grains. In this case the cube to cube orientation relationship between carbides and the matrix was not found. This indicates that accicular M23C6 precipitates were present in the austenitic matrix before the final heat treatment. Furthermore, a very small amount of TiX, where X is carbon and/or nitrogen, was observed in the matrix. The average austenite grain size, as determined by a lineal intercept method, was

31jj.m. Solution annealing of alloy 600 ( condition 600-A ) resulted in a complete dissolution of M23C6 particles, Fig.2. The average austenite grain size after solution annealing was 88 [am.

Fig. 1 Microstructure of alloy 600 Fig. 2 Microstructure of alloy 600 in the sensitised condition, Mag. 30K after solution annealing, Mag. 45K Microstructural studies on alloy 690 in the as-received condition showed that the grain boundaries were decorated by M23C6 carbides, Fig. 3. The cube to cube orientation relationship was found between M23C6 particles and one of the

-423- neighbouring austenite grains. In addition, a very small amount of randomly distributed TiX particles was found in the matrix.

Fig. 3 Microstructure of alloy 690 Fig. 4 Microstructure of alloy 690 in the sensitised condition, Mag. 45K after solution annealing, Mag. 15K

Solution annealing of alloy 690 provoked complete dissolution of M23C6 carbides. The average austenite grain size after solution annealing was 88fim.

The results of statistical evaluation of the intergranular M23C6 particle size and the distance between individual particles are shown in Table 3.

Table 3 The results of quantitative metallography

Alloy a. P2 a2 Zd 1/ P Identity [nm] [nm] [nm] [nm] [%] 600-A 171.2 1.66 89.8 1.42 16755 20642 81 690-B 165 1.68 95.1 1.14 18195 21833 83 where a-,, p7 are statistical parameters for the size of precipitates

a2, p2 are statistical parameters for the distance between precipitates Ed is the sum of particle sizes Y.I is the total measured length of grain boundaries p is the fraction of grain boundaries covered with precipitates (p =

As evident M23C6 particles in both alloys in the as-received condition formed almost continuous network along the austenite grain boundaries.

-424- 3.2 Microsegregation processes It is very well known that impurities segregated on the grain boundaries cause embrittlement of metallic materials [11]. The results of the free surface segregation studies are summarised in Figs. 5 and 6. In both alloys the segregation of phosphorus increased up to approximately 1000°C and then dropped. At the temperature of solution annealing the surface segregation of phosphorus was found to be very small in alloy 600 but reached about 23 at.% in alloy 690.

INCONEL 600 INCONEL 690

TEMPERATURE [°C]

Fig. 5 Segregation of phosphorus on the free surface

X 25 1 • INCONEL 600 a, - INCONEL 690 20 O Z O 15

10 I- | U 5 ! o I u 0 I- o o

TEMPERATURE fC]

Fig. 6 Segregation of sulphur on the free surface

-425- The sulphur segregation in alloy 600 showed a continuous increase in the temperature interval 650-1050°C. The maximum value of the sulphur surface segregation was 16at.%. On the contrary, in the case of alloy 690 the free surface segregation of sulphur was independent of the testing temperature and was negligible.

3.3 Mechanical properties The results of tensile tests at room temperature are summarised in Table 4. The hydrogen charging of both alloys in the as-received condition exhibited a significant effect on the shape of the a - s curves. The yield strength level was increased by about 9%. On the other hand, the ultimate tensile strength and elongation values decreased. The embrittlement index for hydrogen charged specimens of both alloys in the as-received condition was about 70%. Table 4 The effect of the hydrogen charging on mechanical properties of alloys 600 and 690

Alloy Duration of RpO,2 A5 F Identity Charging [MPa] [MPa] [%] [%] [hrs.] 600-S 0 302 718 38 0 600-S 5 318 550 13 65 600-S 20 322 549 12 68 600-A 0 168 524 41 0 600-A 5 178 483 31 23 600-A 20 180 491 30 25 690-S 0 317 759 37 0 690-S 5 330 525 11 67 690-S 20 340 520 10 71 690-A 0 215 612 38 0 690-A 5 233 617 38 0 699-A 20 230 618 38 0

-426- The fractographic analysis of uncharged tensile specimens of alloys 600 and 690 in the as-received condition revealed a ductile dimple fracture, Figs.7a,b. On the contrary, the tensile specimens, which had been hydrogen charged, were broken by a brittle intergranular mode of fracture, Figs. 8a,b.

a. b. Fig. 7 Fracture surface appearance of the uncharged tensile specimens, a. material 600-S , b. material 690-S.

a. b. Fig. 8 Intergranular fracture of the hydrogen charged tensile specimens, a. material 600-S, b. material 690-S. The hydrogen charging of tensile specimens of alloys 600 and 690 in the solution annealed condition also resulted in an increase in the yield strength but this effect was less pronounced. A lower level of the yield strength after solution annealing can

-427 - be related to the greater average size of austenitic grains. The ultimate tensile strength and elongation of alloy 690 did not change due to the hydrogen charging, Table 4. On the contrary, alloy 600 was prone to embrittlement even after solution annealing, Table 4. The tensile specimens, which had been hydrogen charged, showed a decrease of both the ultimate tensile strength and elongation. The embrittlement index achieved about 25%. The uncharged tensile specimens of alloys 600 and 690 after solution annealing were broken by a ductile dimple mode of fracture, Figs. 9a,b. The hydrogen charged tensile specimens of alloy 690 were also broken by a ductile dimple micromechanism, Fig. 10a. However, fractographic analysis of broken tensile tests of alloy 600 revealed a mixture of ductile fracture with intergranular cracks and slip line zones, Fig. 10b.

a. b. Fig. 9 Fracture surface appearance of the uncharged tensile specimens, a. material 600-A , b. material 690-A.

-428- Fig. 10 Intergranular fracture of the hydrogen charged tensile specimens, a. material 600-A, b. material 690-A. 4 DISCUSSION In both alloys investigated the hydrogen charging resulted in an increase in the yield strength. This phenomenon can be explained by the generation of dislocations due to lattice distortion caused by hydrogen supersaturation. Generally, the hydrogen solubility in alloys with the face centered cubic lattice is very high at temperature 300°C and this can lead to a solid solution strengthening contribution after cooling to room temperature [12,13]. The high embrittlement index of the hydrogen charged alloys 600 and 690 in the as-received condition can be explained by the intense

M23C6 precipitation along the austenite grain boundaries. It has been reported that precipitate/matrix interfaces represent effective hydrogen traps [6]. This phenomenon may be responsible for intergranular micromechanism of fracture of the hydrogen charged specimens. A similar behaviour of alloy 690 after solution annealing and sensitisation as well as in the solution annealed condition was observed by Symons [3]. The effect of the hydrogen charging on mechanical properties of a sensitised alloy 690 was attributed to both the segregation of hydrogen atoms to carbide/matrix interfaces and internal stresses in the close proximity of grain boundaries. Kampe et al. [14] reported the same effect of the hydrogen charging in nickel and Symons [5] obtained well- matched results on a nickel rich alloy. It is worth noting that hydrogen can cause embrittlement of nickel due to segregation of hydrogen atoms to the grain boundaries in the absence of intergranular precipitates and impurities [16].

In the case of alloy 600 the dissolution of M23C6 particles during solution annealing did not eliminate the hydrogen embrittlement. This proves that apart from intergranular precipitates also grain boundary chemistry and probably the high nickel content have a pronounced effect on the hydrogen embrittlement. The results of microsegregation studies on alloy 600 indicate that at the solution annealing temperature segregation of sulphur is increased at the expense of phosphorus segregation. These results indicate that sulphur segregation in alloy 600 may increase the number of hydrogen

-429- traps on the grain boundaries. Furthermore, it is necessary to take into account the high nickel content in this alloy.

5 CONCLUSIONS It has been demonstrated that the hydrogen charging results in an increase in the yield strength and a decrease in the ultimate tensile strength and elongation of alloys

600 and 690 in the sensitised condition. The intergranular M23C6 particles contribute significantly to the hydrogen embrittlement which is accompanied by intergranular mode of fracture. It is believed that hydrogen atoms are trapped at precipitate/matrix interfaces. In alloy 600 the hydrogen embrittlement was observed even after solution annealing which had provoked dissolution of all M23C6 carbides. It means that the absence of intergranular carbides is not sufficient to suppress hydrogen embrittlement in this alloy. The results of microsegregation studies indicate that sulphur segregation to grain boundaries in alloy 600 may increase the number of hydrogen traps. Furthermore, it is necessary to take into account the high nickel content in this alloy. It has been reported that hydrogen can cause embrittlement of nickel even in the absence of intergranular precipitates and impurities [16].

REFERENCES [1] P. Berge, J.R. Donati: Nucl. Technol., 1981, p. 88. [2] O.S. Tatona: Nucl. Eng. Int., 1986, p. 81. [3] D.M. Symons: Metall. Mater. Trans. A, vol 29A, 1988, p. 1265. [4] CM. Brown, W.J. Mills: Corrosion 96, NACE, Houston, TX, paper No. 90 [5] M. Symons: Metall. Mater. Trans. A, vol. 36, 1997, p. 655.

-430- [6] G.A. Young, J.R. Scully: Scripta Mater., Vol. 36, 1997, p. 713. [7] H. Anddriamiharisoa: PhD Thesis, Ecole Centrale Paris, 1981, p. 18. [8] A. El Kholy, J. Galland, P. Azou, P. Bastien: C.R. Ac. Sc, 1977, p. 363. [9] J. Crank: The Mathematics of Diffusion, Clarendon Press, Oxford, 1975, p. 238. [10] N. Kishimoto, T. Tanabe T. Suzuki, H. Yoshida: J. Nucl. Mater., Vol. 127,1985, p. 1. [11] M. Tvrdy, R. Seidl, L. Hyspecka, K. Mazanec: Scripta Metal!., 19, 1985, p. 51. [12] P. Menut, Y. Shehu, J. Chene, M. Aucouturier: Hydrogene et Materiaux, 3eme cong. int. Paris, Ed. par P. Azou, 1982, p. 857. [13] B.C. Odegard, J.A. Brooks, A.J. West: Effect of hydrogen on behavior of materials AIMMP Eng., New York, 1976, p. 116. [14] S.L Kampe, D.A. Koss: Acta Metall., Vol. 34, No. 1, 1986, p. 55. [15] CM. Younes, F.H. Morrisey, G.C. Allen, P.Mclntyre: British Corrosion Journal, Vol. 32, No. 3, 1997, p. 185. [16] P. Marcus: Corrosion Mechanisms in Theory and Practice, Ed. M. Dekker, New York, 1995, p. 239.

-431 - CONFERENCE ORGANIZER TERIS

TERIS 2002, a.s. Stetkova 18 140 68 Praha 4, Czech Republic Phone: +420 2 42 20 68, 43 36 40 Fax:+420 2 61 21 89 92 E-Mail: [email protected] http://www.teris.cz

TERIS 2002, a.s. Your reliable partner in organizing conferences, congresses, company presentations, incentives, business trips and vacations at home and abroad