Safety features desired in future plants have been summarized by INSAG-5 in “The Safety of Nuclear Power” [2]. It notes that the Basic Safety Principles of INSAG-3 [3] remain valid and should become mandatory, and the extension of INSAG-3 principles gives further opportunities for improvement of safety on which new plant designs should begin to draw. These opportunities include several design approaches such as avoiding complexity, reducing dependence on early operator actions, among others, and include specifically giving considerations in the design process to passive safety features. Such functions as the containment heat removal, hydrogen management, core debris cool down and prevention of the containment floor melt-through are probably among the most appropriate areas for passive systems usage. Both novel and more or less proven passive means are proposed in many new water-cooled reactor designs [4] to fulfill these and other functions.

Some future reactor designs have only added a few passive components to the traditional systems, some others make wide use of the passive systems and components. New WWER concepts V-392 and V-407 are of this last category since a number of relatively innovative passive safety means are implemented in these designs to ensure or to back up the fundamental safety functions: reactivity control, fuel cooling and confinement of radioactivity.

2.1. Reactivity control

Traditional gravity-driven control rods are the main system to ensure reactor scram both in currently operating and new WWERs. For existing pressurized water reactors, this system is not sufficient to bring the reactor to a cold shutdown state; therefore the control rod system of existing WWERs is supported by pumped emergency supply of the borated water to the primary circuit. New WWER designs V-407 and V-392 have an increased number of gravity — driven scram rods to maintain shutdown margin even in the absence of boron supply during the reactor cooling down.

Although very good reliability records exist for scram excitation, some failures of the gravity — driven control rod insertion have been recognized. The failures occurred for the different reasons; in particular, the cases of insertion speed reduction and incomplete insertion due to fuel assembly deformation have been reported during last ten years (see for example [5]). Besides, some failure modes may be considered which could prevent all the control rods to insert, and it was the basis for designers to analyze Anticipated Transient Without Scram events.

Keeping that in mind, for WWER-1000/V-392 a special quick boron supply system has been designed as a diverse system to the gravity-driven scram system. A concentrated boron solution tank is connected to the suction and discharge pipes of each main coolant pump. The valves in the connecting pipes will automatically open if there is a demand for reactor trip but the reactor power after some time is higher than its value after scram should be. The concentrated boron solution is supplied to the reactor due to pressure difference between discharge and suction of the main coolant pump (pump head). Inventory and concentration of the boron solution is selected to ensure compliance with safety criteria in the design events accompanied by control rod system failure to trip the reactor. Even in case of loss of power, the pump head during coastdown is sufficient to push all the boron solution from the tank (i. e. for this case the boron supply function is ensured passively). The operability of the quick boron supply system has been confirmed by extensive experimental investigation using a scaled model.