Functional and structural diversity of WWER-1000/V-392 safety systems provide deep protection against common-course failures, and application of passive systems and active systems actuation without personnel interference yield deep protection against human errors. These engineering solutions used in NVAES-2 design enable the attainment of increased safety level, compared to the existing WWER-1000 plants.

For existing plants where the most of safety functions are ensured by active systems, the electric power supply is an important precondition for the successful operation of the safety systems. In spite of the very reliable emergency power supply from diesel-generators, loss of offsite power remains to be very essential contributor to the estimated core melt frequency from the internal initiating events (for example, more than 80% for unit 4 of Balakovo NPP [6]). For NVAES-2 with V-392 reactor plant, this figure is reduced to about 30% at absolute value 7.91 x 10-9 As a whole, total core melt frequency for NVAES-2 is about three orders of magnitude less than for Balakovo-4 which is the latest WWER-1000/V-320 unit commissioned in Russia.

Passive residual heat removal system from the core via steam generators to the atmosphere as the ultimate heat sink (so called SPOT) plays an important role in the core melt frequency reduction mentioned above. The design basis for this system is that in case of station blackout during the most unfavorable atmosphere conditions the heat removal capacity with account for the failure of one channel shall amount to not less than 2% of the reactor rated power. The heat removal at the initial stage of the accident is performed due to partial water evaporation from the secondary side via steam generator relief valves to the atmosphere.

The SPOT system consists of four groups (corresponding to the number of reactor coolant system loops) of closed natural circulation circuits. In the ribbed tubular air-cooled heat exchanger (four heat exchangers for each of these circuits), steam extracted from the steam generator condenses, and the condensate flows by gravity to the steam generator boiler water volume. Under normal reactor plant operation, the SPOT system is under standby when all the SPOT circuits are in the warmed-up state. In case of plant blackout, the SPOT state changes from the standby to the operating condition. In addition to its main purpose (core decay heat removal in case of complete loss of a. c. power), the SPOT system can maintain the hot standby parameters of the reactor plant; for this purpose the SPOT has a special controller. The system is thermally insulated, so the heat losses in standby conditions are less than 0.1% of reactor rated power. Natural circulation in the SPOT system is provided by the corresponding layout of the steam generator, heat exchanger and draught air duct.

The steam circuit pipeline runs from fresh steam line to collector which distributes the steam by smaller tubes to four heat exchanger. The condensate from each heat exchanger is supplied by tubes to the collecting receiver and then by pipeline to the steam generator. Two isolation valves are installed at heat exchanging module inlet and outlet to isolate it in case of damage or maintenance. Small diameter pipelines with valves installed on them are provided for removal of air from heat exchanger when filling them with water during hydrotest and for periodical removal of non-condensables under standby conditions. Cooling air is taken from the atmosphere outside the reactor building. Air goes through the protective net and enters the annular corridor located around the reactor building and then to the heat exchanging modules. The air takes the heat from the steam and goes to the draught air ducts, which have the common outlet collector-deflector. Inlet and outlet gates and controller are installed on the airside of each heat-exchanging module. The gates open to switch on the heat exchanging

module to operation. The controller can be used to change the airflow rate to ensure additional SPOT system functions (for example, to maintain the reactor plant in the hot standby conditions).

Under standby conditions, the I&C system ensures for each heat exchanging module the measurements of the air inlet and outlet temperature, outlet air humidity, water level and temperature in the condensate lines. Information on the air humidity is especially important to detect a leak in due time. For this aim, humidity measurement is installed close to the upper part of the air space of the heat exchanger. Under accident conditions, power supply to the instrumentation is ensured by the sources of category 1. Under these conditions the number of measured parameters is reduced to condensate and air temperature and air humidity at the heat exchanger outlet.