3. Emergency Protection (АЗ)

The AZ system is the reactor's last line of defense. It triggers a scram — rapid rod insertion — when an emergency signal is received from other protection logics such as AZM or AZS, or when the operator activates it manually. One important behavior to understand: the AZ logic runs only as long as the trigger signal is present. If the signal disappears before the scram is complete, rod insertion stops. This means that when manually scramming the reactor, you must hold the AZ button down continuously until all rods are fully inserted.

Setbacks vs. Full Scram

The AZ signals are not all the same severity. The system responds in proportion to the danger:

• AZ-1, AZ-2, AZ-3 are setbacks. They cut power down to a fixed safe level and hold it there — the reactor keeps running. They fire when a piece of supporting equipment (a pump, a turbine, the grid connection) fails and the reactor simply can't make full power safely anymore.
• AZ-T1 and AZ-T2 are scram triggers. Together with the manual AZ button, they command a full shutdown (AZ-5): every rod drives into the core and the chain reaction is killed.

Full power for this reactor is 3200 MW(th) (megawatts thermal), which the manuals call Nnom ("nominal"). Every percentage below is a share of that: 5% Nnom = 160 MW, 20% = 640 MW, and so on.

There are five AZ sub-signals:

• AZ-1 — reduces reactor power to 60%. Fires on cooling or feedwater trouble: one of the three running main coolant pumps in a pump station trips; feedwater flow drops to 0.75 of its current value; the drum-separator water level falls 200 mm below the axis; or coolant flow through any of the three pumps falls to 5000 m³/h.
• AZ-2 — reduces reactor power to 50%. Fires when one of the two running turbogenerators trips or throws off its electrical load.
• AZ-3 — reduces reactor power to 20%. Fires when both turbogenerators (or the only one running) reject their electrical load — the unit is separated from the power system, so there is nowhere to send the power. The turbines are still able to take steam, so this is only a setback. (Not to be confused with the turbine stop valves slamming shut, which is far worse — that's a full scram, see AZ-T1 below.) Can also be triggered manually by the operator's AZ-3 button.
• AZ-T1 — full scram for a technological reason. Fires the moment any monitored plant parameter crosses its emergency limit (see the list below).
• AZ-T2 — full scram because protection can't be carried out. Fires when an AZ-1/AZ-2 setback is called for while PK mode is active but all automatic regulation systems (1AR, 2AR, LAR) have tripped simultaneously — leaving no logic able to perform the setback, so the reactor is shut down instead.

AZ-T1 Trigger Conditions

AZ-T1 is the big one: any single item below is enough to scram the reactor.

Reactor running away (neutron / power):

• the reactor period shortens to 10 ± 2 s below 5% power, or to 20 s across the rest of the range — the reactor is accelerating faster than allowed;
• power overshoots its setpoint by 0.5% below 5% power, or by 10% between 5% and 100%;
• a working-range power-protection channel faults in each of the two protection groups at once.

Cooling lost:

• 2 of the 3 running main coolant pumps trip in any pump station;
• control-rod (SUZ) channel cooling fails — header flow falls to 800 m³/h, or the channels drain (emergency supply tank below 3.7 m);
• feedwater flow drops by 50% of its current value.

Steam circuit out of limits:

• drum-separator water level falls to −1100 mm, or rises to +250 mm, on any side;
• drum-separator pressure rises to 75 kgf/cm².

Containment breach (a fuel channel or pipe has ruptured):

• pressure in the reactor space rises to 0.15 kgf/cm²;
• pressure in the pump/pipe rooms rises to 500 kgf/m².

Power supply lost:

• voltage is lost on 4 sections of the 6 kV in-plant electrical supply.

Steam sink lost (turbines):

• the stop valves of both turbines close (the trip signal is applied for 30 seconds). This physically shuts the steam path, so the reactor has nowhere to dump its heat — unlike an AZ-3 load rejection, a setback is not enough and the reactor must be shut down. (This is the two-turbine-trip protection that was disabled at Chernobyl.)

Fallback:

• a condition calling for AZ-1, 2, 3 or 4 appears but can't be carried out because of a control-system fault — the reactor is shut down instead of left half-protected.

Clearing an AZ Signal

Because the AZ logic follows its trigger signal, an emergency stops driving rods as soon as its cause disappears. On the alarm board, AZ signals stop blinking on their own once their cause clears, and can then be acknowledged with the Z key. See Alarms and Acknowledgement for the full acknowledgement procedure.

Why This Matters

Emergency protection is your backstop, not an operating tool. Every threshold above is a line you should never actually reach in normal play — by the time AZ-T1 fires, something has already gone wrong upstream. And on the RBMK, the scram itself carries a hidden risk if the reactor is in a bad state when it fires (see The Scram Trap). The goal is to run so cleanly that the AZ system never has to save you.