ROSATOM STATE ATOMIC ENERGY CORPORATION “ROSATOM” Safety of new Russian VVER designs with an account of the lessons, learned from Fukushima Daiichi accident and new IAEA requirements Sergey Boyarkin Bratislava, Slovakia February 27, 2013 1

Main safety objective in NPP design The main safety objective in the NPP design is elimination of possibility of an accident, which may cause significant radioactive release. A necessary condition for meeting this safety objective is provision of three fundamental safety functions. The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Fundamental safety functions The three fundamental safety functions are: Reactivity control preventing uncontrolled increase of reactor power ensuring fast safe shutdown of the reactor when needed Removal of decay heat to the ultimate heat sink cooling of the shutdown reactor cooling of the used nuclear fuel Confining radioactive materials preventing significant radioactive releases to the environment The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Lessons, learned from Fukushima Daiichi accident (1) Main lessons, learned from Fukushima Daiichi accident are: The three fundamental safety functions have to be provided even in case loss of AC power and/or loss of possibility to use ultimate heat sink The systems providing fundamental safety functions have to be protected against all conceivable environmental hazards – natural and manmade Containment has to be protected so that it prevents large radioactive releases even after a core meltdown The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Lessons, learned from Fukushima Daiichi accident (2) In the international meetings after Fukushima accident the key word, emphasized in discussions of the NPP safety techniques was diversity. It means that each of the fundamental safety functions must be provided by different safety systems that can be used independently and in a flexible manner, depending on the accident scenario. Use of only active either only passive systems does not provide reliable protection. The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Lessons, learned from Fukushima Daiichi accident (3) Implementation of each of the three fundamental safety functions should be provided by various independent safety systems: 1. Active systems with electrical power sources The power sources supplied from off-site and on-site should have multiple redundancy and diversity Electrical power should be supplied by the system where the elements under redundancy are properly separated 2. Active systems with electrical power sources, supplied from a specific source, applied for this system For instance, a diesel generator supplying power to certain systems and turned on only when the other power supplies have been lost; (list continues on the next slide) The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Lessons, learned from Fukushima Daiichi accident (4) (list continues from the previous slide) 3. Active systems which do not require any electrical power systems operated by diesel driven pumps, manually operated shut-off valves, manually operated. 4. Passive systems with proven operability in all conceivable situations. 5. Systems relying on transportable power sources and pumps: power sources should cover an appropriate capacity and voltage range, and pumps should cover an appropriate operability and head-pressure range. The design should provide connection points of transportable sources and pumps The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Lessons, learned from Fukushima Daiichi accident (5) The operability of passive safety systems, provided for rare accidents, should be proved by regular control and analysis: The operability should be provided in any circumstances and in any environmental conditions The natural system circulation should be provided even in cases of allocation and accumulation of soluble non-condensable gases The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Lessons, learned from Fukushima Daiichi accident (6) In order to facilitate operation of safety systems in a station black-out situation, it is necessary to provide power to Lighting, Life-support system in control rooms I&C system Redundant power in these systems should be provided with the long-term accumulators. The technical possibility if their recharge from the motor driven generators should be provided. There should be several recharging sockets and they should be placed along the NPP site. Efficient suppression of oil and cable fires should be provided by advanced systems such as high density water fog systems. The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Lessons, learned from Fukushima Daiichi accident (7) At least some systems providing the fundamental safety functions should have robust physical protection against all conceivable external hazards The robust physical protection of redundant power sources on- and off-site is also needed. The combustible materials should be eliminated from the use For instance, pumps and their motors should preferably use water (rather than oil) as lubricant and cooling media An effective fight against fires should be provided with the help of advanced systems, which do not use toxic gases, such as high density water systems ”fog”. The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

VVER fleet today Today there are 54 units with VVER technology under operation in 10 countries of the world. Among them 18 VVER units, operated in 5 countries of EU, have passed successfully European stress-tests and are in compliance with all modern safety requirements. The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

New VVER type plants Today there are two WWER design of generation III+: - VVER -1000 with power of 1000 MW - VVER -1200 with power of 1000 MW These two WWER designs have several configurations (for different conditions): VVER-1000: NP-91, NP-92, VVER-1200: NPP-2006/LNPP and NPP-2006/NVNPP. In VVER plants of generation III+ all the factors further called ”lessons learned from Fukushima Daiichi” were taken into account even before the accident happened. Following plants of WWER design of generation III+have been already constructed or are under construction: NPP-91: Tianwan 1-2 (China, in operation), units 3-4 (under construction) NPP-92: Kudankulam 1-2 (India, in start up), Belene (contract in Bulgaria) NPP-2006/LNPP: Leningrad II/1-2 (under construction), Baltic 1-2 (construction), Belarus 1-2 (contract in Belarus), Temelin 3-4 (bidding in Czech Republic) NPP-2006/NVNPP: Novovoronezh II/1-2 (under construction) The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Advanced systems in new VVER plants of generation III+ All new VVER plants that are under construction take into account ”Fukushima lessons”and provide: long term cooling of reactor core and SNF pools without AC power, long term decay heat removal which doesn’t rely on primary ultimate heat sink, protection of reactor containment integrity after potential core meltdown accident Passive safety systems would protect the reactor core from severe damage even in case of Large Break LOCA occurring in coincidence with a complete loss of AC power. The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Reactivity control (1) Nuclear reactor remains shutdown when control rods have been inserted. PWR reactors (USA, Europe) and VVER type reactors have control rods that drop to the reactor when power to electromagnets holding the rods in position above the reactor is cut. After that the fast reactor shutdown occurs even if some rods fail to drop as planned. In the PWR plants and in the older VVER plants the reactor remains shutdown only as long as the coolant temperature is kept high. The reactor re-starts to small power if the coolant temperature decreases (in the operating standard of VVER reactors the critical temperature is 190°C and in the most PWRs it starts earlier – with more than 200°C). The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Reactivity control (2) Due to their inherent design features, the reactors of the PWR plants and the older VVER plants would re-start in connection with certain disturbances. Furthermore they cannot be taken to safe shutdown condition without adding boron to the reactor (it is a second”diverse” shutdown system). In these reactors ensuring long term reactor shutdown in all circumstances requires adding boron to the coolant which subsequently requires electical power. The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Reactivity control (3) All WWER reactors of generation III+ have a unique safety feature which is missing in the older PWR or WWER type plants: IF THE CONTROL RODS ARE INSERTED TO THE CORE THE REACTOR WILL STAY IN SHUTDOWN STATE ALSO IN LOW TEMPERATURES This has been achieved by increasing of a number of control rods and by their effectiveness in neutron capturing. It is not necessary to add boron to the coolant for ensuring long term safe cold shutdown. However, for realizing a “diversity” principle while managing reactivity control there are boron injection systems in these designs. The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Reactivity control (4) In addition to the effective control rods, VVER reactors of generation III+ are equipped with PASSIVE and ACTIVE boron injection systems, that can pump boron liquid to the reactor in case the control rods would not drop to the reactor core for any reason. PASSIVE system injects boron liquid from two tanks, which are under the pressure and doesn’t need any electrical power. ACTIVE boron injection system has four identical parallel pumps. Operation of two pumps is enough for fast shutdown of the reactor so that the reactor fuel is not damaged in any accident scenario. If there is no reason for an emergency reactor shutdown, operation of one pump is enough! The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Decay heat removal systems In new VVER types, decay heat can be removed in three different ways: by active systems to the main ultimate heat sink, by active systems to the spray ponds, by active systems to the atmosphere (SG feed and bleed) by passive systems to the atmosphere. THE COMBINATION OF ACTIVE AND PASSIVE SYSTEMS IS A UNIQUE FEATURE OF OUR DESIGN. OUR DESIGN FITTS COMPLETELY THE SAFETY SYSTEM ”DIVERSITY” REQUIREMENTS, WHICH ENSURES THE FUNDAMENTAL SAFETY FUNCTION – DECAY HEAT REMOVAL IN ANY CIRCUMSTANCES, INCLUDING FULL POWER LOSS AND SIMULTANEOUS ULTIMATE HEAT SINK FAILURE. The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Passive decay heat removal from SGs (LNPP) Passive system for decay heat removal from reactor via steam generators to atmosphere (PSHR-SG) 1 – emergency heat removal tanks (EHRT) outside containment ; heat is removed by boiling of water in EHRTs in atmospheric pressure. There are 4 tanks. 2 – steam lines 3 – condense pipes 4 – PSHR-SG valves 5 – heat exchangers of containment heat removal system PSHR-C (see slide 26); it is a separate system but it uses the same EHRTs] 6 – steam generators 7 – cutoff valves The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Passive decay heat removal from SGs (LNPP) Operation of 3 out of 4 EHRT tanks provides cooling for 24 hours, all 4 tanks for 72 hours After Fukushima, a fixed battery driven pump was added to design that can refill the EHRT tanks and spent fuel pools from a separate storage tank, batteries have a capacity for 72 hours. Also, jacks for connecting external diesel generators for battary recharging were added. It provides cooling without time limit. Furthermore, preserved jacks for transportable diesel driven pump that can also refill EHRT tanks and spent fuel pools were added. They use water, supplied from fire trucks or other on-site sources. All transportale devices have well protected shelters in separate locations near site. The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Passive decay heat removal from SGs (NVNPP) Atmospheric air Hot air Reactor Steam generator Filters PHRS Hydrogen recombiners Annulus Passive filtration draft pipes The passive heat removal system provides removal of the reactor decay heat to the atmosphere. No need to add any water and thus no time limit for function The system consists of four independent (4x33%) loops Each loop has devices controlling air flow for graduate cooling of primary circuit at proper rate. Hydrogen recombiner Atmospheric air Separate passive system maintains vacuum in annulus. Filters preserve from possible radioactive leakages

Systems to cope with LOCA (NVNPP) Reactor Pressurizer RCP Steam generator Passive heat removal system from the steam generator Annulus System of 1st-stage hydro accumulators System of 2nd-stage hydro accumulators Passive annulus filtration system Inner containment Outer containment Primary circuit Corium catcher Active emergency core cooling system (ECCS) Main steam RCP Condenser HPH Diaerator

Containment of radioactive material (1) A common view emerged after Fukushima Daiichi accident that special safety systems, independent from the “normal operation” systems have to be installed at all new plants for protecting the reactor containment after possible core meltdown accident. The ”severe accident management” based only on existing hardware designed for other purposes, as applied in most of the currently operating NPPs is not any more acceptable at new plants. IN VVER DESIGN OF GENERATION III+ ALL THESE NEW SAFETY REQUIREMENTS HAVE BEEN ALREADY REALISED. The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Containment of radioactive material (2) The protection of the containment after possible reactor core meltdown requires that all physical phenomena that could threaten the containment integity are taken into account in design. These include: reactor core meltdown in high primary circuit pressure, containment overpressure due to the steam generated inside the containment accumulation of hydrogen inside the containment penetration of the molten reactor core through the containment bottom recriticality of the molten reactor core A special equipment, which functions in case of emergency, is necessary for controlling a severe accidents. The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Containment of radioactive material (3) AT ALL NPP-2006 TYPE PLANTS, PROTECTION OF THE CONTAINMENT INTEGRITY IS BASED ON PASSIVE SYSTEMS THAT DO NOT NEED ELECTRICAL POWER, WHICH IS OPPOSITE TO THEOTHER NPPs WHERE ACTIVE SYSTEMS ARE GENERALLY DESIGNED FOR SEVERE ACCIDENT MANAGEMENT. Some new plants still offered in the market do not have dedicated systems for protection of containment integrity after core meltdown accident. The following slides present systems that are designed for containment overpressure limitation by condensing the steam generated inside the containment hydrogen removing by recombining to avoid an explosion possibility localization of the molten reactor core The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Containment overpressure limitation (LNPP) Passive system for heat removal from the containment (PSHR C) PSHR-C condenses all steam generated in boiling of water inside the containment and is a back-up system to protect containment from overpressure in connection with accidents where active Containment Spray System (4 x 50 %) is not able to operate. PSHR-C uses the same EHRT tanks as PSHR-SG for discharging the heat by boiling of water to the atmosphere. PSHR C has 4х33% capacity soon after reactor shutdown and more than 4 x 50 % after one day. Steam condensing heat exchangers EHRT tank The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Hydrogen removal system (today installed at all NPPs in Russia) Hydrogen can appear in the accident if there is a large leak from the primary coolant. It is generated in chemical stem- zirconium reaction. The hydrogen removal system consists of a large number of passive autocatalytic hydrogen recombiners where hydrogen is recombined with oxygen. The reaction generates water. It prevents formation of explosive mixtures inside the containment. The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Molten core catcher Placed below the reactor vessel to protect the containment structures against impact of molten core (melting temperature may overcome 2000°C). Core catcher retains and cools core melt and solid fragments of the core. It transfers passively heat to the cooling water surrounding the “core melt pot” and thus ensures long term cooling and solidification of the molten core Molten core is mixed with material absorbing neutrons, that excludes chain reaction inside the core catcher. Core catcher decreases significantly the hydrogen generation and radionuclides transfer into the containment. The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Other advanced safety features of new VVERs (1) An important issue connected directly with complete loss of electrical power is potential leak from the seals of the primary circuit circulation pumps. Most PWR plants have pump seals that start leaking in about one hour if cold water is not injected to the seals; water injection to the seals requires electrical power; pump seal leak causes loss of water from the primary cooling circuit and may lead to severe reactor accident (LOCA), if electrical power is lost for several hours All VVER type plants are equipped with pumps with a seal structure that ensures minimum leak in all conceivable circumstances: according to the tests it is less than 200 liters per day. The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Other advanced safety features of new VVERs (2) Inspite of passive safety systems, new VVERs have strong electrical power supply systems, both from offsite grid and from onsite independent power sources. Thus also the function of active safety systems is ensured equally well as at most of the operating NPPs in the world. Offsite power connections are ensured by at least two separate high voltage transmission lines from different directions bringing power to the plant via three separate transformers Onsite power sources are: one or two onsite diesel generators plus four backup diesel generators. In total each unit has five or six diesel generators. The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Other advanced safety features of new VVERs (3) Certain advanced design solutions have been developed to improve safety at VVERs Advanced primary circuit main circulation pumps and their motors have water cooling and water lubricated bearings (other designs have oil cooling that entails risk of fire) For fire protection there are”high fog” systems. They are water based, thefore not toxic and not hazardous for operating staff. The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Other advanced safety features of new VVERs (4) In the first days after an accident, the release of radioactive iodine would cause the largest radiological risk to the people living in the neighborhood. New VVER containments are equipped with a system spraying reagent that chemically binds the iodine released to the containment air space. This reduces the iodine releases from the containment. The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information. 

Conclusions The new VVER plants, generation III+ have safety design features that take into account the latest safety requirements, including ”post-Fukusima experiences”. The ”diversity” principle has been realised: all fundamental safety functions are ensured by multiple different safety systems, both active and passive. The VVER safety principles have been developed already before the Fukushima Daiichi accident. Similar design principles were approved at the European discussions in spring 2012, including IAEA Extraordinary meeting on Fukushima Daiichi accident. These safety features include: possibility for long term decay heat removal from the reactor core without AC power possibility for long term decay heat removal that is not relying on primary ultimate heat sink protection of the reactor containment integrity after potential core meltdown accident. The content of this presentation is for discussion purposes only, shall not be considered as an offer and doesn’t lead to any obligations to Rosatom and its affiliated companies. Rosatom disclaims all responsibility for any and all mistakes, quality and completeness of the information.