Rivne NPP Unit 3 with WWER -1000/В‑320 reactor is under operation since 1986.

22 September 2009 was 118^th day of Unit 3 planned outage that started on 28.05.2009. Reactor installation was in hot shutdown state, primary circuit temperature - 280°С, pressure - 160 кg/сm². The core was in subcritical state, concentration of liquid neutron absorber (boric acid solution) was a “shut down” one - 16 g/kg, all control rods were inserted into the core.

Equipment of primary and secondary circuits and containment were sealed. All three safety channels were in stand-by mode of operation.

On 22.09.09 planned testing of pressurizer safety relief valves was started.

Note:                The pressurizer safety relief valves are designed to prevent overpressure of the primary circuit under transients with fast turbogenerator load reduction. Valves consist of 3 main valves and 6 pilot valves (two for every main valve).  In case of increasing of steam pressure in pressurizer up to 185..192 кg/сm², pilot valves are opened that results in opening of the main valves for 5¸10 seconds and decreasing of primary circuit pressure to set point of pilot valve closure (176..180 кg/сm²).

By design, steam is released to the relief tank for condensation and returning back to primary circuit.

Pressurizer safety relief valves, produced by German company «Sempel AG» were installed at Unit 3 in 1986 when unit was put into operation. Such valves are operated successfully at 9 of 15 Ukrainian units.

Overhaul maintenance of all pressurizer safety relief valves was conducted during planned outage in 2009. After completion of maintenance, in accordance with the unit technical specifications and design documentation, correctness of their work shall be tested by actual pressure increasing with short-term steam release to relief tank.

Event sequence:

The tests started according to standard “Testing program. Primary circuit excess pressure protection system. Safety protection system. Testing of pressurizer safety relief valves by pressure increasing up to actual actuation. Unit 3” 141-70/3-PR-CNIO on 20:45 22.09.09.

After primary circuit pressure increased up to 185 кg/сm², pilot valve is opened (21:14:49), pressurizer main valve is opened (21:14:50) and primary circuit pressure started to drop. However, main valve is not closed under pressure 175 кg/сm² (21:15:00) although interlock on its closure was actuated on-time.

Due to long-term steam release from pressurizer, pressure and temperature in relief tank started to increase and under pressure of 12 кg/сm² membrane that protects relief tank from destruction was ruptured. From this moment coolant from primary circuit started to leak to containment (as a steam and as parameters go down, as a steam-water mixture). In such a way, integrity of primary circuit – the third barrier on a way of radioactive substances and ionizing radioactive sources, was broken.

According to technical specifications, personnel stopped to fulfill testing program and switched on ECCS high pressure pumps in order to compensate loss of coolant due to leak to containment through pressurizer safety relief valve and relief tank.

On 21:49:13 containment pressure reached 0,3 кg/сm² (differential) that actuates spray channels of safety systems. In total, they work during 3 hours 40 minutes and as a result, equipment of primary circuit (reactor vessel, lid, main circulation pipelines, steam generators, pressurizer) were sprinkled by cold radioactive coolant (solution of potassium metaborate).

The last protective barrier – containment – functioned as designed, that is why radioactive coolant was localized within containment and there were no releases to the NPP site and the environment. After condensing and cooling, coolant run off to the containment sump and pumped to the primary circuit by ECCS high pressure pumps.

On 22:29, because of injection of cold boron water to primary circuit by ECCS high pressure pumps, its temperature decreased to 82°С, pressure - to 35 кg/сm². NPP personnel started to compensate loss of coolant by ECCS low pressure pumps. Primary circuit pressure was decreased to atmospheric one, level dropped below joint of pressurizer safety relief valve. Leakage was stopped.  

On 16:05 23.09.09, after pressure and temperature decreasing, conduct of radiological survey and getting SNRCU resident inspectorate permission, NPP personnel along with representative of SNRCU resident inspectorate walked down to containment and confirmed that incident had been caused by failure-to-closure of the pressurizer safety relief valve YP21S01.

On 23.09.09 NPP management, according to procedure, sent to SNRCU preliminary information about reporting event at NPP.

Provisionally NPP rated the event as «P07» category (failures of group “B” safety related equipment) and with level “0” under INES scale (deviation, no safety significance). However, on 24.09.09, preliminary analysis of event sequence conducted by SNRCU resident inspectorate proves that the following deviations from normal operating conditions and design modes took place:

-                            Violation of safety limit on minimal pressure departure from primary coolant boiling;

-                            Violation of safety condition (pouring boric acid solution on dividing bellows and studs of main reactor joint);

-                            Violation of operating limits of safe operation (surpassing permitted cooling down rate and pressure decreasing rate in the primary circuit);

-                            Thermal shock of reactor vessel metal due to injection of cold boric acid solution to primary circuit.

On 25.09.09, taking into account the above, the Chief state inspector of Ukraine on nuclear and radiation safety required from the Ministry of Fuel and Energy of Ukraine, SE NAEK “Energoatom” and Rivne NPP the following:

-                             Re-rate the event with category «P02» (violation of limits and/or conditions of safe operation, not developed into accident);

-                            Correct the event INES rating (violation of barriers integrity);

-                            Perform comprehensive analysis of transient at reactor installation and reveal all violations of system and components operation;

-                            Develop and agree with SNRCU programs and methodologies on examination,  inspection, monitoring and confirmation of capabilities of reactor installation equipment;

-                            Substantiate possibility of further safe operation of Unit’s safety related systems and components and agree the substantiation with physicometallurgical and design organizations including OKB “Gidropress” (main designer of reactor installation) and TVEL Corporation (fuel supplier).

Further, SNRCU department of nuclear installation safety assessment, performing assessment of transients in the course of liquidation of the event consequences, set the following:

1) The mode had serious potential danger because during periods of time  21:21 ¸ 21:47 and 22:33 ¸23:24 (when NPP personnel made attempts to manually fill in pressurizer and control primary circuit pressure by three ECCS high pressure pumps) pressure difference in secondary and primary circuits was 15¸30 кg/сm². In case of leakage of steam generators heat-exchange surface (that is very probable under such hard cool down conditions) it may lead to entry of “plug” of distilled water (instead of boron water) to the core and generation of local criticality zones. 

To fix this known safety deficiency of reactor installation WWER‑1000/B-320, a branch measure “Modernization of ECCS HP to control outlet pressure of pumps suppling water to primary circuit” was developed and agreed by SNRCU. This measure was developed in the framework of the “Concept for safety improvement of operating NPPs”. However, its timely implementation on “pilot” Unit 5 of Zaporizhya NPP in 2009 was frustrated and its   implementation at the rest units WWER‑1000/B-320 in 2010 is very doubtful. SNRCU repeatedly informed the operating organization and the Ministry of Fuel and Energy of Ukraine about this situation.

2) Fortunately, in accordance with the “Concept for safety improvement of operating NPPs” and pursuant to SNRCU requirement, replacement of thermal insulation of all primary circuit elements in containment was completed in 2009. It was mitigating circumstance because old insulation could be disintegrated under impact of increased temperature and humidity and could enter into primary circuit and ECCS channels. This circumstance simplified liquidation of incident consequences, further repair and recovery works, allows to save all three safety channels and prevent chokage of equipment and fuel. Exactly this circumstance became a decisive one in the course of examination and cleaning of equipment (only 57 days of off-schedule outage was requested; duration of unplanned outage  in case of similar event at Zaporizhya Unit 1 in 1995 was 78 days).

 

Liquidation of incident consequences:

According to SNRCU requirement, considerable amount of work has been conducted at Rivne NPP Unit 3: full unloading of the core, examination of fuel, metal of reactor vessel, lid and internals, main circulation pipeline, steam generators, pressurizer, main circulation pumps, control and protection system, inspection and cleaning of three ECCS channels. 

On 06.11.09 SNRCU received a reply from representative of «Sempel AG» and the first version of report on reported event at Rivne NPP Unit 3. The operating organization, on SNRCU insistence, rated the event with INES level «1» (anomaly) and with «P02» (violation of limits and/or conditions of safe operation, not developed into accident).

Preliminary assessment of materials revealed that spare parts for pressurizer safety relief valves were ordered and manufactured at factory of corporation “Kyiv valves” in 2005 without approval of technical specifications by producer of pressurizer safety relief valves (violation of par. 1.2.6 «Rules on arrangement and safe operation of equipment and pipelines of  nuclear power installations» PNAE G-7-008-89). According to report of «Sempel AG» representative, geometrical dimensions and chemical composition of slide valve do not meet «Sempel AG» requirements. In the course of testing it resulted in decreasing of a gap between slide valve and guide bush and, finally, it led to pilot valve jam in opened position.

In addition, it was established that installation of the valve parts during outage in 2009 was conducted with violation of maintenance procedure (relevant technical decision on replacement was not documented properly). 

On 11.11.09, taking into account the above, the Chief state inspector on nuclear and radiation safety returned back the event report №3ROV-P02-002-09-09 for additional investigation, pointing out to absence in the report correct root and direct causes as well as absence of corrective measures for all units of Ukrainian NPPs.

On 08.11.09 SNRCU received additional materials from the operating organization and on 19.11.09, based on analysis performed by the State scientific and technical center on nuclear and radiation safety, set forth additional requirements regarding substantiation of steam generators integrity (in particular, welded seams №111), pointed out to low level of safety culture (violation of par. 5.3.4 «General provisions of nuclear power plants safety» (ОPBU-2008)) and requested the following:

-                            Develop and submit to SNRCU relevant branch-level measures to prevent usage of inappropriate parts for maintenance and repair safety related systems;

-                            Bring to administrative and/or disciplinary responsibility managers of NAEK “Energoatom” and Rivne NPP, whose actions or inactivity led to failure of the pressurizer safety relief valve at Rivne NPP on 22.09.2009 and to violation of regulations (ОPBU-2008 and PNAE G-7-008-89);

-                            Perform during next unit outages  onetime inspection of  primary circuit excess pressure protection system and secondary circuit excess pressure protection systems (steam generator safety relief valves, fast-active steam discharge valves to atmosphere);

-                            Perform onetime direct and full functional test of abovementioned equipment according to par. 6.2.27 PNAE G-7-008-89, par..10.4.3 NP 306.2.141-2008.

Currently Unit 3 of Rivne NPP is in cold shutdown state.

Temperature of primary circuit coolant is 50°С, pressure – 10 кg/сm². The core is in subcritical state, concentration of neutron liquid absorber is 16 g/kg.

To demonstrate design characteristics of safety related equipment, tests of systems and components were started according to methodologies and programs and under approval of SNRCU resident inspectorate.

The first package of documents submitted to SNRCU by operating organization to substantiate Unit 3 safe operation is under expertise at the State scientific and technical center on nuclear and radiation safety.

The inspectorate will issue a particular permit to Unit 3 start up (including reactor installation heating up and bringing to minimum controlled power level) on special “start-up” meeting provided all abovementioned SNRCU requirements are fulfilled.

 

Date, time	Event chronology
22.09.2009 20:45	According to the pressurizer testing program, the main circulation pumps (MCP) 3YD10,20,30,40D01 are switched off. Setting «DTs < 10°С» of the emergency core cooling system (ECCS) protection is deactivated.
20:46	Pressurizer heaters are switched on in order to increase pressure in primary circuit.
21:14:49	Primary circuit pressure reaches 186,5 kg/сm2. By signal of the control scheme electromagnets of pilot valves (PV) 3YP21S03, S04 are switched off and main valve (MV) 3YP21S01 is opened.
21:15	Primary circuit pressure is 175,7 kg/сm2. Electromagnets of PV 3YP21S03, S04 are switched on and indication of MV 3YP21S01 closed position is appeared but pressure in the primary circuit keeps decreasing. Taking into account decreasing of primary circuit parameters and raising parameters in the relief tank, the MV 3YP21S01 failure to close is identified. Attempts to close 3YP21S01 are not successful.
21:15:47	By interlock signal all pressurizer heaters are switched on.
21:16	By interlock signal “containment pressure > 0,003 kg/сm2” isolation valves of ventilation systems TL 22,42 are closed.
21:17	Pressurizer heaters are switched off by interlock signal “pressurizer level < 4200 mm”.
21:18	Shift personnel switch on pumps TB10D02,03 to supply boric acid from ТВ-10 tanks to  inlet of primary circuit charging (makeup) pumps.
21:19	Primary circuit pressure is 66 kg/сm2. A protection signal «DTs < 10°С» is generated without impact on ECCS actuators.
21:20	Primary circuit pressure is 58 kg/сm2. Opening of check valves on pipelines from ECCS hydroaccumulators 1-4 to primary circuit is noted.
21:21	Primary circuit pressure is 50 kg/сm2. Control room operators switch on pumps TQ14-34D01, TQ13D01 connected to primary circuit.
21:26:22÷ 21:29:25	In order to close 3YP21S01, valve 3YP21S08 was opened and electrical power was supplied to electromagnet for opening of valve 3YP21S09 for short period of time. The valve 3YP21S01 was not closed.
21:30	To cool down reactor installation, filling up of steam generators 1-4 is started.
21:34	Primary circuit pressure is 48 kg/сm2. The control room operators switched on the pump TQ23D01 connected to primary circuit.
21:37	Shift personnel closed 3YR60S01,02 and by opening 3YR01÷03S01, 3YR11÷41,12÷42S01 and 3YR51÷53S01 connected together emergency gas-off lines from reactor, steam generators 1-4 and the pressurizer (with discharge to the relief tank).
21:44	Primary circuit pressure is 44 kg/сm2. Control room operators switch on pump TQ33D01 connected to primary circuit.
21:49:13	Containment pressure >0,3 кg/сm2. It is noted that ECCS protection is actuated, containment is localized by closure of isolation valves, ECCS mechanisms 3TQ12÷32D01 are switched on, sprinkling solution is injected to containment by 3TQ11÷31D01 pumps.
21:50÷21:55	Primary circuit pressure is 70 kg/сm2. Pumps 3TQ14÷34D01, 3TQ33D01 are disconnected from primary circuit.
21:55	Primary circuit pressure is 60 kg/сm2. Pump 3TQ23D01 is disconnected from primary circuit.
22:13	Primary circuit pressure is 31 kg/сm2. Pump 3TQ13D01 is disconnected from primary circuit.
22:30	Primary circuit pressure is 23 kg/сm2. Boric acid supplying to primary circuit by pumps 3TQ12÷32D01 is noted.
22:37	Primary circuit pressure is 22 kg/сm2. Pump 3TQ22D013 is disconnected from primary circuit.
22:39	Containment pressure 0,1 kg/сm2. Pump 3TQ31D01 is switched to recirculation mode.
22:50	Containment pressure 0,1 kg/сm2. Pump 3TQ21D01 is switched to recirculation mode.
23:10	Decreasing of hot legs temperature below 70ºС is noted.
23:19:38	Fast-acting valves 3YT11÷14S01, 02 on pipelines connecting ECCS and primary circuit are closed.
23.09.09 00:39	Primary circuit pressure is 23 kg/сm2. Pump 3TQ32D01 is disconnected from primary circuit.
01:30	Containment pressure is 0,03 kg/сm2. Pump 3TQ11D01 is switched to recirculation mode.
01:40	Reactor installation parameters: primary circuit pressure - 20 kg/сm2, temperature - 50ºС, containment pressure - 0,07 кгс/см2, concentration of boric acid solution - 20,9 g/кg.
02:50	Ventilators 3TL01D01, D03, 3TL04D02 are switched on to remove heat from containment
03:30	Isolation valves of containment radiation monitoring system are opened.
05:05	Isolation valves of containment hydrogen concentration monitoring system are opened.
05:20	Emergency and planned cool down header TQ40 is connected to primary circuit; pump 3TQ22D01 is switched on to cool down primary circuit, pump 3TQ12D01 is switched off.   After pressurizer level decreasing, coolant release to the relieve tank through opened valve 3YP21S01 is stopped.