Safety upgrades at Kozloduy

26 October 2004

The European Commission insists on closing Kozloduy 3&4 before 2007 because, in 1992, it classified these units as ‘non-upgradable’. This means that the units are: “Reactors which cannot be upgraded to internationally accepted levels of safety at a reasonable cost.” By Emil Vapirev and Sabin Sabinov


With a total installed capacity of 3760MWe from six reactors, Kozloduy is one of the largest nuclear power plants in the world. During almost 25 years of plant construction, three different generations of VVER reactors have been installed in three stages:

  • 1st stage (1970-1975): units 1 and 2, VVER-440 standard 230 design (two safety trains).
  • 2nd stage (1973-1982): units 3 and 4, VVER-440 improved design (three safety trains).
  • 3rd stage (1982-1991): units 5 and 6, VVER-1000 standard 320 design (three safety trains).

The first VVER-440 design, referred to as the B-230 type, was developed in the late ’60s. The principle of no instantaneous pipe rupture was considered in the design of the high-pressure fluid systems and equipment. Because of this, primary circuit pipelines were made from non-brittle austenitic stainless steel. During reviews by international experts over the last decade, these technical features were considered to be safety advantages:

  • Conservative margins of the reactor core thermal-mechanical reliability and negative reactivity coefficients for all operational modes.
  • Three-train safety system with 100% functional capability of each train for units 3 and 4.
  • High degree of core heat removal redundancy due to the existence of six main circulation loops and coolant stable natural circulation (with possibility for heat removal of up to 9% of the reactor thermal power).
  • Large amount of water above the core (the distance between the inlet nozzles axis and the top of the core is 1470mm) and absence of reactor vessel nozzles below the coolant inlet nozzles.
  • Horizontal steam generators (SGs) with a large amount of secondary side water, with the possibility for removal of the residual heat for more than four hours in case of station total blackout, when both normal and auxiliary feedwater to the SGs are lost.

Units 1 and 2 are constructed on the basis of the standard VVER-440 B-230 plant design. The safety system design is of two-train structure with several interconnections and common back-up components. Each train is capable of performing fully the required safety functions, which were limited to loss of coolant accidents (LOCAs) resulting from breaks of the small branch pipes connected to the primary circuit system.

Units 3 and 4 are of a new design solution that differs from the VVER-440/230 type reactors. Their safety systems design is based on three independent trains, each fully capable of performing 100% of safety functions. Low pressure emergency core cooling system (ECCS) is provided to cope with large break LOCAs. The design of the safety systems is based on the solution later applied in VVER-440/213 reactors.

The original containment system of these four units was of the standard B-230 design, which is low pressure containment with relief valves to the atmosphere. The negative pressure during the normal operation is ensured by a two train filtered venting system and during accident by the spray system.

Units 5 and 6 are modern reactors representing the latest generation of the Russian PWRs (VVERs). These units are 1000MWe each with a single turbine per reactor. The units have four loops (instead of three for the same power in western PWRs), horizontal steam generators, and three redundant safety trains of 100% each. As in the VVER-440 design, in-core monitoring is ensured by detectors installed through nozzles on the reactor head, which does away with the need for penetrations in the bottom of the reactor vessel.

Both units have containment buildings constructed in pre-stressed concrete to hold the effect of any radioactive release in accordance with latest international nuclear safety requirements.

For the last 10 years the share of the Kozloduy plant in the electricity production of Bulgaria has been 44-46% with a maximum of 47.36% achieved in 2002.

On 31 December 2002, following a decision of Bulgarian government, both units 1 and 2 were shut down before the end of their design lifetime in compliance with previously agreed commitments between Bulgaria and the European Commission (EC).

The EC also requires the shutdown of units 3 and 4 in 2006 – well before the end of their design lifetime and terms of the current operational licence.


The systematic analyses for compliance of the units with the current safety requirements and the internationally adopted codes and practices began in 1990 and was initiated by International Atomic Energy Agency (IAEA) safety review and World Association of Nuclear Operators (WANO) missions. Considering the results of these first evaluations in 1991 the short-term programme for implementation of the safety upgrade measures on these units was developed.

The implementation of the programme commenced in 1991 and was completed in 1996. Over 900 modifications of systems and equipment have been implemented, and many important new safety systems were installed. The total amount of the funding allocated to the programme was $145 million.

Continuation of the safety upgrading process initiated by the short-term programme has been assured by the parallel development of a new, ‘complex programme’ based on the periodic safety review methodology of IAEA. The review itself was completed within a two-year period with the support of the original designers of the units from Russian engineering organisations. The goal of this assessment was to develop an effective set of measures that would bring the units in conformity with current safety standards. More than 450 man-months of highly qualified expert efforts were dedicated to this assessment. A system of 25 classification categories, developed on the basis of safety functions and conditions, was used for the analysis (see Figure 1).

As a result of the assessment, the so-called complex modernisation programme was developed. Altogether $100 million was allocated for implementation of the proposed technical measures and during 1997-1999 more than 460 design changes were implemented.

In parallel, so that this programme could be as effective as possible, it was subjected to broad international assessment. Several missions from the IAEA and the Western European Nuclear Regulators’ Association (WENRA), as well as expert assessments by EdF and Siemens have been carried out for this purpose in 1998 and 1999. In February 2000 a new revision of the programme, named PR-209M, was issued in order to reflect the results of these reviews.

The extended programme scope was mainly applied to the modernisation of units 3 and 4, while the implementation of some measures on units 1 and 2 were delayed due to the decision for early closure. A total of $66 million was allocated for the implementation of this revision of the programme.

The implementation schedule has been accordingly updated, while keeping the objective of continuous safety upgrading of the units. The major activities were implemented for units 3 and 4 up to 2002 (a total of 375 design changes), finishing with a total update of the units’ SAR (safety analysis report). Some long-term activities, mainly oriented to severe accident management, continued.

The design changes implemented by the different programmes represent an integrated process that led to extremely extensive changes to the design bases of the units.

The implementation of the different modernisation programmes up to 2002 brought the safety of units 1-4 to a different level. This is illustrated in Figure 2, where the current achievements on the units are marked. Especially for units 3 and 4, the current extended design basis compares favourably with the safety level of the VVER-440/213 reactors, which is internationally recognised as adequate following an IAEA in-depth review.

The updated SAR of units 3 and 4 issued in 2002 reflected the new design status after the finalisation of the modernisation programme and taking into account the operational experience of the units. It was developed in accordance with the scope and content approved by the regulatory body in compliance with current worldwide practice. This SAR is the basic safety document of the units, and is a condition for issuing plant operating licences (after the expiry of current operating licences) under the requirements of the new Safe Use of Nuclear Energy Act (SUNEA). Having presented this document and the other necessary documentation as well as a review under SUNEA, at the end of May 2003, the Bulgarian Nuclear Regulatory Agency issued long-term licences for operation of units 3 and 4 for 8- and 10-year terms of operation, respectively.

The main modernisation activities are listed below:

Number of events

The number of postulated events that the units’ safety systems can cope with has increased, in line with the commonly accepted design approach.

  • The capacity of the ECCS has been proven to be sufficient to cope with LOCAs that exceed more than 80 times the break cross section of the original design (up to Dn 500), thus resolving one of the main criticisms on these units level of safety.
  • The containment leakage was reduced more than 35 times. Together with the rest of technical measures implemented to improve the localisation system performance, it could be demonstrated that the radiological consequences would be managed well below the prescribed limits for all postulated events.

Radiation release

A significant improvement in the capability and reliability of the last protective barrier against the spread of radioactive products into environment in case of an accident.

The necessary technical solutions for the modernisation of the confinement system have been developed and justified. A pressure suppression device (jet vortex condenser, pictured left) was successfully licensed and implemented in 2001-2002 for units 3 and 4. The condenser reduces passively the containment pressure in case of an accident by both preventing its over pressurisation and by limiting the uncontrolled releases to the environment below prescribed limits.

Compliance with standards

Another important result is that safety standards now comply with current design principles such as:

  • Application of single failure criteria.
  • Separation between control and protection functions.
  • Ability to accurately test and monitor.
  • Redundancy, separation and other measures to cope with, for example, common cause mode failures.


Important assessments on fire risk, environmental impact, equipment classification and reliability amongst others have been carried out in parallel to supplement other technical measures. The development of a remaining lifetime management programme together with the optimisation of the in service inspection (ISI) programme creates the necessary basis for steady, safe and efficient operation of the plant.

Core damage frequency

As a result of the complex plant approach, significant reduction of the overall core damage frequency (CDF) was achieved, below the target value established for the reactors in operation worldwide.


The plant successfully implemented a set of measures to address operational safety issues identified by the IAEA in 1991. Two operation safety review team (OSART) reviews were conducted in 1999-2001 with a third follow-up review conducted in 2002. The IAEA experts concluded that all operational safety problems had been resolved and the plant operational practice corresponds to the international safety standards.

As a result of continuous safety improvements, the plant also successfully resolved the design safety issues identified by IAEA in the document Ranking of Safety Issues for WWER 440 Model 230 NPPs – TECDOC 640. A special IAEA mission conducted in 2002 concluded that all safety problems, defined by international experts, have been resolved and in some cases the plant efforts went well beyond them, covering other areas with possible impact on the overall safety of the units.

A general conclusion on all the efforts was given in the IAEA Annual Report for 2002: “A safety review mission to Kozloduy, in Bulgaria, reviewed the results of more than a decade of safety upgrades and assessments at units 3 and 4, including a series of actions recommended by various IAEA review teams. The team concluded that the operational, seismic and design safety at Kozloduy now corresponds to the level of improvements seen at plants of similar vintage elsewhere. Many of the safety measures adopted for these plants in the design, operation and seismic areas exceeded those that were foreseen.”

In accordance with the above conclusions was the outcome of the Atomic Questions Group (AQG) peer review, which was conducted following a specific Bulgarian request in 2003. In 2001, the AQG – created as a European Union (EU) advisory body on nuclear safety issues – published a report identifying a set of recommendations to each of the EU accession countries with the aim of attaining an acceptable level of nuclear safety. These recommendations were not only in the area of the safety of particular installations but also in the legislative and institutional framework existing in the country to maintain the level of nuclear safety.

The first assessment of the achievements of each country was conducted in 2002. In November 2003, a team of 12 experts from Austria, Belgium, Denmark, Finland, France, Germany, Greece, Ireland, Italy, Spain, United Kingdom and the EC performed new thorough evaluation of the country progress under the leadership of the Italian representative.

During this mission items related to recommendations of AQG reports were discussed with Kozloduy nuclear plant, the NRA and the Bulgarian Ministry of Energy and Energy Resources (MEER). Although the review was based on recommendations in the last AQG report (in accordance with the mandate of the review), the discussion in many areas went outside of these issues, covering all the important areas of the plant programme, especially for units 3&4. At the same time, issues outside of the 2001 AQG report were discussed like the long-term improvement programme (up to 2009) and adequacy of their financial provisions, plant and regulatory body commitments in long-term modernisation plans, and other conditions within the new operational licences (effective until 2011 and 2013 for units 3 and 4, respectively).

Following the technical evaluation of the information made available before and during the mission, several conclusions on the status of the recommendations contained in the 2001 Report on Nuclear Safety in the Context of Enlargement were presented in the AQG/ Working Party on Nuclear Safety (WPNS) final official report:

  • There was evidence that all the AQG/WPNS recommendations have been adequately addressed.
  • It was recognised that the personnel from Kozloduy have up-to-date knowledge of international practices and upgrading measures, and related applications in other similar nuclear units in eastern European countries. There was evidence of effective and comprehensive upgrading of the units 3 and 4 when compared to the status of a few years ago.

In its report, the AQG also commented that most of the recommendations, including all those requested for units 3 and 4, were already implemented. Those remaining were in progress according to established schedules. The actions, which are being carried out, concern units 5 and 6 for which the large-scale modernisation programme is underway, or long-term projects on units 3&4 which go well beyond AQG recommendations. All these were assessed as adequate and feasible in terms of human and financial resources.

Based on this, the AQG/WPNS made the fundamental conclusion that for Bulgaria further monitoring activities by the AQG/WPNS are not considered to be necessary, fully confirming the already recognised capability of the Bulgarian nuclear programme in resolution of generic safety issues.

The conclusions of the team on the specific issues and in general were in full agreement with the other previously available international assessments such as the assessment of the IAEA 2002 safety review mission on the results of the units 3 and 4 modernisation programme, the IAEA IRRT (International Regulatory Review Team) mission 2002 on the resolution of the regulatory issues and others.

The importance of this fact is that the IAEA conclusions were confirmed using methodology and criteria not originating from the IAEA standards only. In addition, it showed that when properly developed and implemented, safety measures are assessed equally by different international organisations or bodies, confirming the universal effect of the peer reviews.

At the same time the confirmation of particular results from other missions also reaffirms validity of their generic conclusions, namely that units 3 and 4 are installations of the same level of safety as the units of the same vintage worldwide. Together with the positive assessment given to the process of issuance of the long-term operational licences, the AQG peer review results essentially confirmed that country policy toward maintaining the high level of nuclear safety resulted in very important achievements.

Today it is obvious that the decade-old classification of these units within the group of ‘non-upgradable’ does not have any clear technical basis in any of the technical assessments conducted on these units during the last two years. We have to remember that the exact phrase is: “Reactors which cannot be upgraded to internationally accepted levels of safety at a reasonable cost.” Units 3 and 4 are upgraded and the international missions have confirmed that there are no design deficiencies. The NRA in 2003 granted 8- and 10-year licences for units 3 and 4.

A normal sequence of events for maintaining safety is: review the safety of a plant; present recommendations as a result of the review; address the recommendations; and carry out follow-up reviews of the modifications/modernisations until all the pending safety issues are resolved.

Early closure of nuclear units not for technical reasons and unpredictable operational terms can lead to: a decrease of interest and safety concern of utilities; termination of safety improvement programmes; degradation of staff motivation; loss of corporate knowledge (enforced retirement, work abroad, reduction of young people in nuclear industry, and so on); unavailability of sufficient decommissioning funds and funds for safe management of radioactive waste and spent nuclear fuel; and unavailability of facilities for safe storage and final disposal of radioactive waste and spent nuclear fuel.

Emil Vapirev

(6 July 1948 – 10 September 2004)

By Sabin Sabinov, Kozloduy nuclear power plant

While this article was with the publishers, the nuclear community was shocked by the sudden death of the chairman of the Bulgarian Nuclear Regulatory Agency, Professor Vapirev. From the very first fuel assembly loading at Kozloduy until his death, he was an inseparable part of Bulgaria’s nuclear energy development. His remarkable contributions both to the safe operation of the units in Kozloduy, and to the raising of Bulgaria’s regulatory body to a new, high standard of competency and power, are highly regarded and will never be forgotten. Professor Vapirev was a great scientist and statesman, and an indisputable international authority. But first and foremost, he was always an honest man and a dear friend, whose loss leaves us deep in pain.

FilesDesign safety level
VVER-440 safety levels

Kozloduy Kozloduy
Kozloduy 3&4 main steam and feedwater lines Kozloduy 3&4 main steam and feedwater lines
Jet vortex condenser Jet vortex condenser
Kozloduy 3&4 information systems in main control room Kozloduy 3&4 information systems in main control room
Turbine hall Turbine hall
Emil Vapirev Emil Vapirev
Design safety level Design safety level
VVER-440 safety levels VVER-440 safety levels

Privacy Policy
We have updated our privacy policy. In the latest update it explains what cookies are and how we use them on our site. To learn more about cookies and their benefits, please view our privacy policy. Please be aware that parts of this site will not function correctly if you disable cookies. By continuing to use this site, you consent to our use of cookies in accordance with our privacy policy unless you have disabled them.