After the final reports of post-Fukushima stress tests of nuclear reactors in Europe, Switzerland and Ukraine were published in April 2012, the European Nuclear Safety Regulators’ Group (ENSREG) agreed an action plan (in July), peer-review groups visited eight stations, and the European Commission published a communication on the tests in October. National action plans published in late 2012 are due to be peer-reviewed at a 22-26 April workshop.
The European Commission’s October 2012 communication compares countries’ performance in the stress tests with each other, unlike the final reports, which only covered a single country. One particular section of the supporting technical document gives a useful technical overview of what the stress tests found. It focuses mainly on generic and cross-cutting issues and is extracted below.
Initiating events
Stress test results clearly indicate that particular attention needs to be paid to periodic safety reviews (PSR) as a powerful tool to regularly reassess plant safety. The stress tests have confirmed that all the 17 participating countries perform periodic safety reviews at least every 10 years, including a reassessment of the external hazards (unless it can be demonstrated that there was no significant hazard evolution since the last reassessment). External hazards (for example, earthquake, flooding and extreme weather) and robustness of the plants against them should be reassessed as often as appropriate, but at least every ten years.
Generally the approach to demonstrate an appropriate design basis is sound. All plants need to be reviewed with respect to external hazard safety cases corresponding to an exceedance probability of 10-4/year (with a minimum peak ground acceleration of 0.1 g for the seismic hazard). Setting up an international benchmark exercise to evaluate the relative strengths and weaknesses of probabilistic and deterministic hazard assessment methods for external events is
Almost all countries consider an earthquake with an exceedance probability of 10-4/year as a minimum for Design Basis Earthquakes. Nevertheless, the stress test results point out specific cases:
– In France, no probabilistic seismic hazard assessment (PSHA) is used except for three plants (Saint Alban, Flamanville and Civaux). The peer review recommended to the regulator to introduce Probabilistic Seismic Hazard Analysis in France for the design basis of new reactors and for future revisions of the seismic design basis of existing reactors in order to provide information on event probability (annual frequency of occurrence) and to establish a more robust basis for DBE specifications.
Almost all countries consider a flood with an exceedance probability of 10-4/year as a minimum for Design Basis Flood. Nevertheless, the stress tests results point out specific cases:
– In France, the Design Basis Flood is defined considering statistical extrapolations limited to 10-3/year supplemented by a margin or a conventional combination. France stated that the current state-of-the-art in flood level calculations does not allow calculating, with a sufficient confidence, 10-4/year levels, except in some specific conditions such as small catchment areas up to about 1000 km2. The peer review therefore recommended performing a comparative evaluation with the methodologies used in other European countries.
Almost all countries consider 0.1 g as the minimum level of peak ground acceleration (PGA) to be considered for the Design Basis Earthquake, except Germany, Lithuania and the Netherlands. It should be mentioned however that the nuclear reactors have been shut down in Lithuania and that the existing and new spent fuel store facilities are designed to be capable of withstanding this recommended level of seismic event. Moreover, as for the Netherlands, the new seismic analysis to be conducted within the PSR of Borssele in 2012 will consider a PGA value of 0.1g at free field for the DBE, as per IAEA guidance.
The evaluation of beyond-design basis margins for earthquakes and flooding is not consistent in participating countries. A few countries have quantified the inherent robustness of the plants’ beyond-design basis up to cliff-edge effects, whereas the majority have made only a general claim that sufficient safety margins exist and therefore there is no verifiable information on the basis of which to consider effective potential improvements.
Seismic monitoring systems should be installed and associated procedures and training developed for those NPPs that currently do not have such systems. On-site seismic instrumentation should be in operation at each NPP. There is no on-site seismic instrumentation yet at Dukovany NPP (CZ), Brokdorf, Brunsbuettel, Emsland, Grohnde, Kruemmel and Unterweser NPPs (D), Borssele NPP (NL), Oskarshamn NPP (SE) and in all Ukrainian NPPs. The installation of on-site seismic monitoring is planned at each of these sites. A study to investigate the overall cost-benefit and usefulness of automatic reactor shutdown induced by seismic instrumentation is recommended.
Loss of safety functions
All countries have estimated the cliff-edge effects related to various combinations of losses of electrical power and/or cooling water, and the time available before safety functions need to be restored. In terms of safety margins, Station Black-Out (SBO, that is, total loss of AC power) is the limiting case for most reactors. For most reactor designs, SBO would typically lead to core heat-up after around one to ten hours if no countermeasures were implemented. For some boiling water reactor (BWR) designs, SBO leads to core heat-up within 30-40 minutes (using conservative assumptions) at Olkiluoto 1 & 2, (FI) and Forsmark 1 & 2 (SE), which have electrically-driven core cooling systems, if no countermeasures are adopted. Numerous improvements related to hardware and procedures have been identified; some have been implemented and others are still at the planning stage. For all plants, it is recommended to ensure that the available time is sufficient to allow safety function restoration, with adequate margin and without relying solely on organisational measures.
The loss of Ultimate Heat Sink (UHS) and alternate heat sink was not identified as a cliff-edge effect at any plant design in EU, Switzerland and Ukraine. NPPs typically have several redundant and diverse cooling options to ensure a minimum heat sink for 72 hours, provided that electrical power supply is available. The volume of cooling water available on site ensures heat removal from essential systems is not less than 6-8 days.
To increase the robustness of the ultimate heat sink function, it is strongly recommended to identify and implement also alternative means of cooling. The term ‘alternate UHS’ was interpreted differently in several countries. Most countries considered a diverse source of cooling medium (water from ponds, wells, water table, and so on) as an alternate UHS, but some countries also considered secondary or primary feed-and-bleed into (ultimately) the atmosphere. To cope with losses of the main ultimate heat sink, all plants have a variety of design features that can be used to some extent; this includes multiple (and large) reserves of water on site, for example dedicated (seismic proof) tanks, large-capacity pools (for example with spray-based heat removal from essential service water system), dedicated wells (with own, independently-powered pumps) as well as arrangements to obtain water from rivers, nearby lakes or the sea (using tanker trucks or fire hoses).
For multi-unit sites, robustness could be enhanced if additional equipment and trained staff are available to effectively deal with events affecting all the units on one site. At most multi-unit sites, an accident simultaneously occurring at several units was not considered in the original design. For multi-unit sites, robustness could be enhanced if additional (to the existing) equipment and trained staff are available to effectively deal with events affecting all the units on one site. This recommendation is currently being analysed and measures will be implemented at all NPP sites in EU, Switzerland and Ukraine.
All plants confirmed that they already possess or are in advanced stages of acquiring a variety of mobile devices including skid/trailer based diesel generators and diesel-driven pumps, dedicated fire trucks, and so on, including the connection points and actuation procedures.
Severe accident management (SAM)
PSR should continue to be maintained as a powerful regulatory instrument for the continuous enhancement of defence-in-depth in general, and the provisions of SAM in particular. The lessons learned from the Fukushima accident and from the stress tests should be reflected in the scope of future PSRs.
With regard to their previous commitments, regulators should incorporate the WENRA reference levels related to SAM into their national legal frameworks, and ensure their implementation as soon as possible. Regarding Emergency Operating Procedures (EOPs) and Severe Accident Management Guidelines (SAMGs), utilities from only a few countries have developed these procedures/guidelines for all power conditions (Belgium, Slovenia, Sweden, the Netherlands, France for the 900 MWe reactor series, and Switzerland). In Hungary, EOPs and SAMGs are developed for all plant states but the associated hardware modifications are still needed in units 2 to 4 to complete implementation. In most other countries, utilities have developed EOPs for power and shutdown states but SAMGs cover only powered state (for example in Bulgaria and the Czech Republic). In a few countries like Germany or Spain the development of a more comprehensive and systematic set of SAMGs is still on-going for some plants. Ukraine has only EOPs for powered states available at the moment but is engaged in a programme to complete EOPs for shutdown states and to develop SAMGs for all powered states. In the UK, it appears that EOPs and SAMGs need further development to be in line with international standards.
The means for maintaining containment integrity should in particular include depressurization of the reactor coolant system, prevention of damaging hydrogen explosions, and means of addressing long-term containment over-pressurization, such as filtered venting.
All plants foresee the depressurization of the primary circuit with existing design features. For example, the Czech Republic, France and Finland have implemented additional measures for depressurization of the primary system, such as installation of additional hardware (lines and specific valves). Slovakia is currently implementing, and Slovenia has scheduled implementing similar measures. France has planned the reinforcement of the operability of existing equipment by fixed or mobile supplies.
Hungary, Slovakia and Ukraine do not have any plan or schedule with regard to implementing filtered venting of the containment. The Czech Republic, Spain and United Kingdom are in different stages of the process of considering the implementation of containment filtered venting; Belgium has included it in the long term operation project for its older plants (Doel 1 and 2, and Tihange 1), and is studying its installation in the newer plants; while Romania has a schedule to implement it. The remaining countries already have filtered venting infrastructure installed to avoid pressure build-up in the containment.
A systematic review of SAM provisions should be performed, focusing on the availability and appropriate operation of plant equipment in the relevant circumstances, taking account of accident-initiating events, in particular extreme external hazards and the potential harsh working environment.
In the frame of this stress test exercise, a systematic review of SAM provisions (organization, staffing, hardware, SAMGs, and so on) has been performed by the different participants, focusing on the availability and appropriate operation of plant equipment in the relevant circumstances, taking account of accident-initiating events, in particular extreme external hazards, potential harsh working environments, the need to work with a severely damaged infrastructure (that is, in which the usual means of communication and access and so on are disabled) at the plant level, corporate level and national level, and of long-duration accidents affecting multiple units at the same time (on individual and nearby sites as appropriate). These studies are still ongoing in most of the countries.
Radiation protection of operators and all other staff involved in the SAM and emergency arrangements should be assessed and then ensured by adequate monitoring, guaranteed habitability of the facilities needed for accident control (hardened on-site emergency response facility with radiation protection), and availability of protective equipment and training.
On-site emergency centres should be available and designed against impacts from extreme natural and radiological hazards.
Main control rooms (MCR) of the plants have been designed against Design Basis Accidents. In case the main control room becomes inhabitable as a consequence of the radiological releases of a severe accident, of fire in the MCR or due to extreme external hazards, all plants have a backup Emergency Control Room (ECR) except Olkiluoto 1&2 in Finland (where planning is underway to develop such a facility) and the AGRs and Magnox reactors in UK (except Heysham 2 and Torness). Countries have evaluated or are evaluating whether the MCR and ECR can withstand the consequences of a severe accident (especially in case of an accident affecting several units at the same time) and extreme natural hazards.
Although PSA is an essential tool for screening and prioritizing improvements and for assessing the completeness of SAM implementation, low numerical-risk estimates should not be used as the basis for excluding scenarios from consideration of severe accident management especially if the consequences are very high.
[This text is comprised of edited extracts from the European Commission staff working document ‘20121004 Staff Working Document-Final’, pp7-15, table pp49-62, available on www.ensreg.eu/documents, or for immediate download via http://tinyurl.com/8d5vt8n]