Ignalina NPP is the only nuclear power plant in Lithuania consisting of two units, commissioned in 1983 and 1987. Unit 1 of Ignalina NPP was shut down for decommissioning at the end of 2004 and Unit 2 is to be operated until the end of 2009. Both units are equipped with channel-type graphite-moderated boiling water reactors RBMK-1500. The paper summarizing the results of deterministic and probabilistic analyses is developed within 1991–2007 by specialists from Lithuanian Energy Institute. The main operational safety aspects, including analyses performed according the Ignalina Safety Improvement Programs, development and installation of the Second Shutdown System and Guidelines on Severe Accidents Management are discussed. Also the phenomena related to the closure of the gap between fuel channel and graphite bricks, multiple fuel channel tube rupture, and containment issues as well as implication of the external events to the Ignalina NPP safety are discussed separately.
Preparatory works of construction of the Ignalina NPP have been started in 1974, and the first unit of Ignalina NPP was commissioned in December 31, 1983. At the same time the second unit was under construction and construction of the third unit began. The second unit was planned to start to operate in 1986, but because of accident in Chernobyl, works on preparation to operate this unit have been rescheduled. Second unit was commissioned in August 31, 1987. At that time 60% of the third unit have already been constructed, but later construction was suspended and terminated soon. Nowadays because of political reasons, the first unit of Ignalina NPP is shut down; the second unit is planned to shutdown at the end of 2009.
Ignalina NPP with RBMK-1500 reactors belongs to the second generation of RBMK-type reactors (it means that this is most advanced version of RBMK reactor design series in comparison with other RBMK-type nuclear power plants). In comparison with infamous Chernobyl NPP, Ignalina NPP reactors are by a third more powerfully and already from the beginning of operation substantially advanced emergency protection systems (e.g., emergency core cooling and accident localization systems) [
After 1990 Lithuania declared its independence; Ignalina NPP with two largest in the world RBMK-1500 reactors came under authority of the Lithuania Republic; however, nobody in the world did not know about the real safety level of these reactors. The first Safety Justification of Ignalina NPP has been prepared by Russian experts of Research and Design Institute for Power Engineering (RDIPE), organization—designer and developer of RBMK reactors, after Chernobyl NPP accident. In this document the analysis of all design basis accidents (except partial breaks of pipes) is presented in sufficient details. The analysis is performed using at that time existing tool—quasistationary derivative approximation method, being based on conservative assumptions and existing experimental data. From the present-day viewpoint such safety justification [
It was limited only to the systems description and the analysis of design basis accidents.
Computer codes, developed in Russia, have been used for simulations, but these codes have not been extensively verified and validated.
The independent expertise of safety analysis has not been performed.
Therefore, at the beginning of the 90s of the last century there were reasonably doubts how such safety justification of Ignalina NPP, presented in the first safety justification, corresponded to the real situation. In 1992 at G7 Munich Summit the decision of closing Soviet-design nuclear power plants, at first of all the nuclear power plants with RBMK and VVER-440/230 reactor types, was accepted. In 1994 Lithuania signed the agreement with the European Bank for Reconstruction and Development (EBRD) Account of Nuclear Safety by which it had undertaken to perform in-depth safety analysis of the Ignalina NPP and not to change fuel channels in the reactor.
Right from the start, when Lithuania assumed control of the Ignalina NPP, the plant, its design, and operational data have been completely open and accessible to Western experts. A large number of international and local studies have been conducted to verify the operational characteristics of the Ignalina NPP and analyze its level of risk. Ignalina NPP is unique nuclear power plant of RBMK type about which information was collected, checked, systematized, and made accessible. Collected and verified database has allowed
to assess present safety level of NPP,
to compare its level with other RBMK-type NPPs safety level,
to plan improvements of plant equipment and operating procedures increasing safety of the NPP.
Below, the results of the State of the Art deterministic and probabilistic safety analyses for Ignalina NPP, developed within 1991–2007 by specialists from Lithuanian Energy Institute, are discussed.
In this Section the main Ignalina NPP safety analyses, performed since 1991 till these days, are discussed:
Ignalina NPP Units 1 and 2 safety analysis reports and their review,
modifications of activation algorithms for reactor shutdown and emergency core cooling systems,
second diverse reactor shutdown system development, safety justification, and implementation,
studies of Ignalina NPP 1 and 2 levels of Probabilistic Safety Assessment (PSA),
external events at Ignalina NPP Analysis.
In 1995-1996 was prepared In-depth Ignalina NPP Unit 1 Safety Analysis Report, using USA and Western Europe methodology and computer codes for providing safety analysis [
In the safety analysis report of the Ignalina NPP Unit 1, the comprehensive accident analysis and equipment assessment have been provided; discussed questions concerning equipment ageing, investigated topics related to operators action, and power plant control provided conclusions about safety of Ignalina NPP (NPP safety level was assessed realistically); main lacks have been defined and measures for elimination of the deficiencies have been foreseen. It is the first western-type report on safety for nuclear power plants with RBMK reactors.
One of the basic conclusions in this safety analysis report was such that in this case there was no problem, which would demand immediate shutdown of the Ignalina NPP. Detailed accident analysis (accidents because of different pipelines ruptures, reactivity initiating accidents, equipment failures, transients with additional failure of reactor shutdown system, and fuel channel ruptures in the reactor cavity) has shown that accident occurring because of equipment failures does not cause such condition of the plant station which would cause violation of acceptance criteria; safety system ensures a safe condition of the plant even doing the assumption that operator does not take any action for 10 minutes from the beginning of accident to mitigate an emergency situation. Because of reactivity initiating accidents (exactly such type of initiating event became the reason of accident in the Chernobyl NPP), acceptance criteria of power plant also are not violated, even postulating single failures additionally. It has been shown that Ignalina NPP is reliably protected against loss of the coolant accidents if ruptures of pipelines do not cause local stagnation of flow. In case of one steam line rupture, the acceptance criteria will not be exceeded. But there are two steam lines located in the shaft at the Ignalina NPP; thus, rupture of one steam line can cause rupture of other steam lines, and in this case radiological dozes can be exceeded. Being based on these results of accident analysis, the recommendations for modifications of activation algorithms for reactor shutdown and emergency core cooling systems have been prepared.
It is necessary to note that in parallel with the Ignalina NPP Unit 1 safety analysis report in 1995–1997 it was performed independent Review of the Ignalina Nuclear Power Plant Safety Analysis Report [
In recommendations of Ignalina NPP Unit 1 safety analysis report, it has been shown that Ignalina NPP will be reliably protected from any ruptures of pipelines and steam lines after improving of activation algorithms for reactor shutdown and emergency core cooling systems. According to these algorithms the system will automatically activate on coolant flow rate decrease in single Group Distribution Header (GDH) and sharp pressure decrease in drum-separators. These modifications have been implemented in both Ignalina NPP units. Safety justification of these modifications has been performed in Lithuanian Energy Institute (LEI). Further discussed situation, when conditions for local flow stagnation because of GDH rupture in the fuel channels connected to this affected GDH, is developed [
Ignalina NPP reactor cooling circuit (one loop) and coolant flow diagram in case of partial GDH rupture: (1) drum-separators, (2) suction header, (3) main circulation pumps, (4) pressure header, (5) group distribution headers, (6) water supply from emergency core cooling system, and (7) affected fuel channels
Analysis of partial GDH rupture considering modification of ECCS algorithm: (a) coolant flow rate through fuel channels, (b) fuel rod cladding temperature in high-power channel connected to ruptured GDH, and (c) behavior of fuel channel wall temperature.
In the Ignalina NPP Unit 1 safety analysis report, they have been investigated not only basic design accidents (discussed above) but also Anticipated Transients Without reactor Shutdown (ATWS). Investigations of such accidents are carried out at the licensing process for USA and Western Europe nuclear power plants; however, for the NPPs with RBMK-type reactors such analysis has been performed for the first time. Consequences of accident for RBMK-1500 reactor during which loss of preferred electrical power supply and failure of automatic reactor shutdown occur [
Analysis of loss of preferred electrical power supply and simultaneous failure of design reactor shutdown system, when DAZ system was installed: (a) coolant flow rate through one main circulation pump, (b) the peak fuel channel wall temperature in the high-power channel, (c) pressure behavior in drum separators, (1) acceptance criterion, and (2) set points of DAZ system activation (reactor shutdown).
Thus the analysis of anticipated transients without shutdown has shown that in some cases the consequences can be dramatic enough. Therefore the priority recommendation has been formulated: to implement the second, based on other principles of operation, diverse shutdown system. However development, designing, and implementation of such system needed few years (in the Ignalina NPP Unit 2, this system was installed in 2004), so the compensating means, which were used in transition period while second diverse shutdown system was developed, has been implemented. This temporary system was called according Russian abbreviation “DAZ”, “Dopolnitelnaja avarijnaja začita”—“Additional emergency protection”. This system used the same control rods as well as design reactor shutdown system; however, signals for this system control were generated independently in respect of design reactor shutdown system. In Lithuanian Energy Institute for DAZ system, they have been selected not only set points of activation but also the safety justification was performed. Performed analysis has shown that after implementation of DAZ system the reactor is shut down in time and cooled reliably as well; acceptance criteria are not violated even in case of transients when design reactor shutdown system is not functioning. In Figure
The Second Diverse Shutdown System (DSS) has been designed and installed in Ignalina NPP Unit 2 in 2004. In the first unit of Ignalina NPP this system has not been installed because reactor has been shut down in 2004. Therefore, nowadays Ignalina NPP reactor emergency protection (emergency shutdown) system consists of two independent shutdown systems: first, BSM controls manual control rods and shortened absorber rods, which are inserted into the core from bottom. This system performs the normal reactor shutdown function and can maintain a reactor in subcritical state. Second system AZ controls 24 fast acting reactor shutdown rods as well as additionally 49 rods, which belong to both—BSM and AZ systems. AZ system performs emergency protection function. Also the Additional Hold-down System of the reactor is installed. This system allows to prepare and inject water and neutron absorber gadolinium mixture into control rods cooling circuit. Thus, the reactor remains in subcritical state even in the case of failure of BSM system.
DSS justification was one of the main projects increasing a level of NPP safety. Specialists from LEI together with experts from the countries of Western Europe checked and have assessed the design documentation, carrying out independent calculations, thus helping Lithuanian regulatory body (VATESI) to make the appropriate decisions concerning implementation of mentioned system at Ignalina NPP [
In 2002 the safety analysis report for Ignalina NPP Unit 2 has been developed. This report contains the description of systems, list of postulated accidents, engineering assessment of reactor cooling system, accident analysis, assessment of fuel channels structural integrity, assessment of reactor safety acceptability, and other chapters. The accident analysis in this report was performed using best estimate approach with uncertainty and sensitivity analysis. According to the international practice, the best estimate approach is used mainly for analysis of loss of coolant accidents in reactor cooling system. In Lithuania the best estimate approach was successfully applied not only for loss of coolant accidents but also for reactor transients and accident confinement system response analyses. The uncertainty and sensitivity analysis allows to avoid the unnecessary conservatisms as well as to assess and address the existing safety margins. The safety analysis report and its review were the main documents required for license for Ignalina NPP Unit 2. Both documents demonstrated the increased safety level after implementation of above mentioned modifications and satisfaction to requirements of regulating documents.
The Ignalina NPP first-level PSA “BARSELINA” project (1991–1996) was initiated in 1991 [
According to the international requirements, probability of the large reactivity release outside nuclear power plant should not exceed
Carrying out the complex analysis about influence on Ignalina NPP units safety [
aircraft crash,
extreme wind and tornado,
flooding and extreme showers,
external fire.
Besides lake, another external flooding source is
Discussing safety of RBMK-type nuclear power plants, three vulnerabilities more often are mentioned generally:
containment issue,
problem of gas gap closing between fuel channels and graphite blocks,
problem of multiple fuel channel ruptures.
Below, specificity of RBMK-1500 in respect of these problems is discussed.
In case of accident in nuclear power plant (rupture of reactor cooling circuit pipelines), the coolant with radioactive materials will spread into reactor and compartment-enclosed reactor cooling circuit. In many (but not in all) reactors of the USA and the Western Europe, function of containment carries out visible from afar, photogenic, semicircle form protection enclosure. Usually nonexistence of containment is treated as deficiency of RBMK reactors. However such containment as for vessel-type reactors is technically impossible to implement for RBMK reactors. In the Ignalina NPP the function of containing accidentally released radioactive material is accomplished by an extensive system of interconnected steel lined, reenforced concrete compartments called the Accident Localization System (ALS). The ALS uses the “pressure suppression” principle employed by G.E. designed boiling-water reactors. The ALS encloses the large Ignalina NPP reactor core, the coolant pumps, and all of the piping providing coolant to the core. It is not necessary to enclose the pipes above the reactor core, which carry the exiting two-phase (steam-water) mixture to the drum separators, because if one of them is breached, coolant flow to the fuel channels (which is provided by pipes entering the core from below) will not be interrupted. Significant amounts of radioactive material can escape only if fuel rods are over-heated. Breaches in the exiting pipes will not reduce coolant flow; therefore, the fuel rods will not overheat.
The effectiveness of the ALS has been verified by extensive international analysis and experimental programs. They all show that even if events leading to release of radioactive materials are postulated, these materials will be contained by the ALS; thus, the ALS performs the function of containment [
The fuel channels of RBMK-type reactor are separated from the graphite bricks by gaps maintained by graphite rings. These rings are arranged next to one another in such a manner that one is in contact with the channel, and the other with the graphite stack block (see Figure
Fuel channel and graphite column interaction. All measurements are in millimeters.
The availability of the gap between graphite bricks and fuel channels is the main condition limiting the operation of RBMK-type reactors. These graphite fuel channel tubes gaps allow
unimpeded (axial and radial) thermal expansion and contraction of the fuel channels,
predictable noncontacting heat transfer from graphite bricks (temperature higher than 500°C) to fuel channels (temperature 300–320°C) across the gaps,
leakage of helium-nitrogen mixture, which provides heat transfer from graphite to coolant and protects graphite against oxidation. Furthermore helium-nitrogen mixture is part of fuel channel integrity monitoring system.
The control of gap between fuel channels and graphite blocks at Ignalina NPP Unit 1 and 2 is carried out from the beginning of its operation and now the largest database and experience of assessment of gap among all RBMK type reactors is saved. After gap closure some functions of the control not only are lost but also worsen characteristics of the reactor. Increasing probabilities of damage of the channel and deformations of graphite, withdrawing of the channel from a reactor if necessary becomes complicated and the temperature of graphite and the fuel channel changes. In Ignalina NPP Unit 1 reactor the average gap between fuel channels and graphite up to final shutdown of the reactor from an initial level (3–2.7 mm) has decreased three to four times. This decreasing in Unit 2 is insignificant. Estimation of such small gap is very sensitive to errors of measurements, uncertainties of used models, and strategy of selection of fuel channels for measurements.
As it is known, after signing the agreement with the EBRD Account of Nuclear Safety in 1994, Lithuania has undertaken not to change fuel channels and not to operate Ignalina NPP reactor after closing even one gas gap between graphite stack and fuel channels. In Ignalina NPP in-depth safety report [
In Lithuanian Energy Institute complex investigations on the problem of gap closure between fuel channels and graphite blocks at Ignalina NPP have been carried out. Assessment of the gap between graphite stack and fuel channels has very big importance because results of this problem are very important in making of the decision on duration of Ignalina nuclear power plant operation. At development of a technique on assessment of gap and strategy of measurements, the thermal-hydraulic, structural and probabilistic calculations have been performed. The detailed analysis [
The specialists from LEI developed the integrated technique on assessment and control of risk of gas gap reduction. This allowed to develop strategy of measurement of holes diameters in graphite columns and replacement of fuel channels. This strategy has ensured existing of gap in Unit 1 reactor up to its final shutdown and by that has allowed considerably to prolong time of Ignalina NPP Unit 1 operation (until the end of 2004).
Change of a gas gap in the second unit of a reactor very much differs from that of the first unit because in a reactor of Unit 2 they are used zirconium tubes of fuel channels having different hardened surfaces and the rate of their ballooning is two times slower in comparison with tubes in reactor of Unit 1. Tendencies of change of graphite stack diameters in the second Unit are very similar to those of the first unit.
In case of fuel channel rupture a two-phase flow is discharged to gaps between graphite stack. Part of graphite blocks can be and damaged cracked by coolant jet impingement; graphite columns can be displaced and coolant passes into the reactor cavity. Because graphite stack is hotter than the coolant, the pressure in tight reactor cavity increases. The leak tight Reactor Cavity (RC) performs the function of containment in the region immediately surrounding the nuclear fuel and graphite. The RC is formed by a cylindrical metal structure together with bottom and top metal plates. The reactor cavity confines the steam release in case of rupture of fuel channels. The steam-water-gas mixture from the reactor cavity is directed via Reactor Cavity Venting System (RCVS) pipelines to two steam-distribution devices of the 5th (upper) condensing tray in the Accident Localization System (Figure
Simplified schematic of the reactor cavity venting system: (1) reactor, (2) the fifth ALS suppression pool, (3) suppression pools 1–4, (4) steam distribution devices, and (5) membrane safety devices (350 mm diameter)
In the case of multiple fuel channel tube ruptures, if the RCVS does not assure relief of steam-water-gas mixture from RC, the pressure increase in the RC will lift top plate of the RC. Those structural integrity of the RC and the rest fuel channels would be lost as well. Such event would cause very severe consequences similar to Chernobyl accident. Therefore it is important to maintain RC integrity, which is assured if pressure in the RC is below permissible pressure (314 kPa, abs), that is, the pressure of upper plate of biological reactor shielding weight [
Rupture of one fuel channel is design basis accidents for RBMK-1500 reactors. Probability of such rupture is
Moscow Research and Design Institute for Power Engineering (RDIPE), designer and developer of RBMK reactors, specialists in 1996 have analyzed pressure behavior in the Reactor Cavity in case of multiple fuel channel rupture [
Such analysis is conservative with impact of uncertainties. The best estimate analysis of Ignalina NPP response to multiple fuel channels tubes rupture was performed at the Lithuanian Energy Institute. Sensitivity and uncertainty analysis was performed as well [
Pressure in the reactor cavity as a function of a number of ruptured fuel channels.
It is necessary to note that the analysis was performed for the case with reactor cooling system filled by coolant (the water levels in drum separators are nominal). Thus, after the fuel channels rupture, the steam-water mixture is discharged into the gaps of graphite stack. If the “dropout” model is used in CONTAIN 1.1 code, it is assumed that all the water released from the ruptured fuel channels in liquid fraction leaves from RC to the water drain. If the “dropout” model is not used in CONTAIN 1.1 code, it is assumed that not all evaporated water remains in a dispersed condition, and it may be transferred into RC and through the pipelines into ALS. The last assumption leads to higher calculated pressure in the RC (see Figure
It is necessary to note that during operation of RBMK reactors there were only three cases of ruptures of separate fuel channels:
at Leningrad NPP Unit 1 in 1975,
at Chernobyl NPP Unit 1 in 1982,
at Leningrad NPP Unit 3 in 1992.
In any of these cases adjacent channels have not been damaged. Thus, in reality there was no so-called “cascade rupture of fuel channels” when rupture of one channel causes ruptures of other channels. Experiments made on the large-scale TKR-Test facility at Electrogorsk Research and Engineering center for NPP safety [
Requirements of nuclear power plants safety depend on the accumulated experience, a level of a technical society evolution, which always raises, and from position of the state. About safety level of Ignalina NPP it was worried after Chernobyl accident in 1986. The first modernizations of reactors have been implemented at that time. RDIPE, designer and developer of RBMK reactors, experts have prepared the first safety justification for operating power plant in 1989. When Lithuania assumed control of the Ignalina NPP in 1991, a large number of studies on safety level have been conducted. It is necessary to note Safety Analysis Reports for Ignalina NPP Units 1 and 2, Safety Justifications of Reactor Cooling System, and Accident Localization System. The Ignalina nuclear power plant is distinguished from all RBMK-type reactors for the matter is that many international studies to investigate design parameters as well as level of their risk have been performed. Ignalina NPP, its design, and operational data have been completely open and accessible to Western experts. At first the effective initial help in questions of nuclear safety has been provided by Sweden and after by other countries (Germany, United Kingdom, USA, etc.), capable to perform expertises of the safety analysis. A public list of EC Phare projects, supporting the modernization of Ignalina NPP, is available under
The detailed analysis of accidents has shown that design basis accidents do not cause such condition of the plant, which postulates violation of acceptance. As well safety systems of the plant ensure a safe condition of the plant even doing the assumption that operator does not take any action for 30 minutes from the beginning of accident to mitigate an emergency situation.
The performed Probabilistic Safety Analysis of levels 1 and 2 has allowed to compare safety level of Ignalina NPP with the reached level on other nuclear power plants and to plan how to improve NPP safety systems and operational procedures. Investigations have shown that Ignalina NPP according to the probability of large radioactivity release outside nuclear power plant is not the worst in comparison with the plants of the USA and the Western Europe, constructed in the same years.
On the basis of the performed investigations the recommendations on safety improvement were developed by efforts of local and foreign experts. These recommendations were brought into Ignalina NPP Safety Improvement Programs (SIP-1, SIP-2, or SIP-3) which implementation strictly was checked by Lithuanian regulatory body VATESI. These means have allowed to improve safety level of the Ignalina NPP constantly. These works do not stop even on forthcoming final shutdown of the plant. In outcome of last significant project the Severe Accident Management Guide is developed. Now this guide is under implementation at Ignalina NPP. Severe Accident Management Guide will supplement Symptom-Oriented Emergency Operating Procedures and will provide safe elimination of accident consequences in all range of accidents.
Accident localization system
Anticipated transients without reactor shutdown
Russian acronym for “emergency protection system”
Russian acronym for “normal reactor shutdown system”
Russian acronym for “additional emergency protection”
Diverse shutdown system
European Bank for Reconstruction and Development
European Community
Emergency core cooling system
Group distribution header
Lithuanian Energy Institute
Membrane safety device
Nuclear Power Plant
Probabilistic Safety Assessment
Reactor Cavity
Reactor Cavity Venting System
Russian Acronym for “Water-Graphite Boiling Reactor”
Research and design institute for power engineering
Lithuanian acronym for “lithuanian state nuclear power safety inspectorate”.