«Item 7b Severe Accidents Related Issues Preliminary Monitoring Report Report to the Federal Ministry of Agriculture, Forestry, Environment and Water ...»
Systematic analysis regarding the performance of instrumentation beyond the operational range should be performed based on the severe accident analysis. The evaluation should include both the adverse environmental conditions and availability of AC and DC electrical power. This process may lead to the identification of potential strengths and/or weaknesses of the plant. Requirements for extending the range of measurements or instrumentation survivability may be identified and some enhancements implemented.
Current plant status Systematic evaluation of instrumentation needs for of the implementation of SAM strategies has been performed. Example results of such investigation for the selected strategy (SAG-4 – Inject into the containment) were presented during the Prague workshop [Sỷkora 03 b].
No needs for additional instrumentation or upgrade of the existing instrumentation have been identified in relation to SAMG implementation [Sỷkora 03 a]. The existing ‘as built’ instrumentation has been found to be sufficient to support AM decision-making process (in relation to diagnostics, availability of equipment, verification of the strategy and controlled plant state).
No problems have been reported with survivability of instrumentation during SA conditions.
The situation is expected to be comparable to other plants in which there is a considerable diversity of instrumentation and the majority of measurements sensors are located beyond the areas affected by the severe accidents.
Several computational aids (in the form of graphs or tables) have been developed to provide additional means to monitor those plant parameters that cannot be directly measured [Dessars 03].
Evaluation Based on the available information, the aspects discussed above appear to have been addressed properly and in accordance with the current state-of-the-art. However, detailed evaluation of this aspect was not possible. This issue should be addressed within a specialized independent review (e.g. IAEA RAMP mission).
3.3.5 Means to Enhance Reliable Initiation of Equipment Operation
VLI No. VLI title / description 4.5.1 Have automatic systems available for limitation of core damage and radioactivity release been implemented?
4.5.2 Are the procedures for initiation of these systems available and adequate?
4.5.3 What provisions are made for improving reliability of instrumentation?
Is the concept of automatic self-testing implemented where possible?
4.5.4 Have the time margins for startup of equipment been properly determined?
ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues 63 State-of-the-art requirements and practices Reliable initiation of equipment needed for the implementation of AM during an accident is an important aspect that should be addressed in the development of SAMGs. Some automatic features (e.g. automatic self-testing), which may be incorporated in the systems used to limit the core damage and radioactivity release, are of interest. Provisions should also be made for improving the reliability of instrumentation that is used in putting the equipment into operation and in monitoring its performance.
The availability and adequacy of the procedures for initiation of relevant systems credited in AMP is of high importance. Strategies credited in AMP should be based on the realistic estimation of the required time margin for startup of the equipment. This margin should be properly determined and correctly considered in the implementation of AMP strategies.
Current plant status No additional automatic features have been considered at Temelín in relation to SAMG implementation. Reliability of the existing instrumentation is considered sufficient. No information was provided during the Prague workshop in relation to procedures for initiation of relevant systems.
Evaluation Based on the available information, detailed evaluation of this aspect was not possible. This issue should be addressed within a specialized independent review (e.g. IAEA RAMP mission).
3.3.6 Plant Control Capabilities in Severe Accident Conditions VLI No. VLI title / description 4.6.1 Are there the provisions for initial warning of the MCR inhabitability?
What personnel protective devices are available for MCR operators?
4.6.2 Has a reliable communication among remote locations been established?
4.6.3 Is there an adequately protected place with monitoring and control capabilities (reserve control room/panel) to be used in severe accident conditions? Are there any SA challenges identified that can affect the habitability of the reserve control room?
4.6.4 Is there a reliable power supply to important instrumentation for station blackout conditions?
State-of-the-art requirements and practices The availability of plant control capabilities under severe accident conditions is an important aspect of SAM [IAEA 03]. Some provisions should be in place to maintain these capabilities during a severe accident. This includes the provisions for initial warning in case of the MCR inhabitability as well as the availability of personal protective devices for MCR operators. An adequately protected place with monitoring and control capabilities (emergency control room) to be used in severe accident conditions should also be available. Any SA challenges that can affect the habitability of the reserve control room should be identified and resolved.
A reliable communication among remote plant locations should be established (including the MCR or ECR, TSC, OSC, plant locations where relevant equipment needs to be restored / maintained during an accident). Diverse communication means should be available also for station blackout conditions.
64 ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues Current plant status An emergency control room (ECR) to be used in the case of MCR inhabitability is available at the plant [Sỷkora 03 a]. The plant’s experts reported no problems with habitability of ECR under severe accident condition. However, it is opinion of the PN 7 project team that the environmental conditions in the reactor building after basemat failure will preclude human occupation of the building, including the MCR and ECR. Monitoring of conditions will still be possible from the on-site underground emergency centre.
Technical means to communicate between TSC and MCR/ECR are available (verbal and visual communication lines) [Sỷkora 03 a].
Evaluation Based on the available information plant control capabilities in SA conditions have been addressed in relation to SAM and are in accordance with the current state-of-the-art and worldwide practice, consistent with the plant configuration. However, detailed evaluation of this aspect was not possible. This issue should be addressed within a specialized independent review (e.g. IAEA RAMP mission).
3.4 Administrative Arrangements for Personnel Response
Enhancement of the response of personnel involved in AM is one of the relevant aspects that should be considered in the development of SAM programme and SAMGs. The following subsections provide background information and discussion on the related administrative arrangements that should be in place at the plant.
Sections 3.4.1 and 3.4.2 address aspects related to the procedural framework. The current status of plant specific Emergency Operating Procedures (EOPs), which are used in response to design basis accidents, is discussed in Section 3.4.1. Guidelines, which are used in response to severe accidents (SAMGs), are addressed in Section 3.4.2. Arrangements, which are not directly related to the preparation of procedures, but which would be required to enhance the usability of the guidance on site, are addressed in Section 3.4.3.
3.4.1 Status and Features of Symptom Based Emergency Operating Procedures (EOPs) VLI No. VLI title / description 5.1.1 Have the scenarios contributing significantly to risk been identified?
5.1.2 What plant states are covered by the existing emergency operating procedures?
5.1.3 Have all the EOP-related symptoms properly identified? What parameters are used?
5.1.4 Have recovery actions for DBA been specified and verified?
5.1.5 Is information needed to detect level and trend of severity available to the operators?
5.1.6 Has the performance of equipment under accident conditions been verified?
5.1.7 Have the conditions for operator involvement been clearly defined?
5.1.8 Have the exit conditions and further steps been defined?
5.1.9 What was the extent of the EOPs validation?
ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues 65 State-of-the-art requirements and practices The emergency operating procedures (EOPs) provide guidance to the MCR operators in response to accidents covered within the design basis (DBA). The implementation of EOPs at the plant is a prerequisite for the development of SAMGs. EOP exit conditions provide entry point to SAMGs.
The plant specific EOPs should address all potential accident scenarios that contribute significantly to the risk. They should be fully symptom-based using the symptoms that are easily verified by the existing measurements. Information should also be available to the operators to draw conclusions on the progression of accident, effectiveness of the recovery actions/ measures, as well as the severity of the current plant status. Conditions of operator involvement should be clearly defined in the procedures including the exit conditions.
The plant specific EOPs should be properly verified and validated. Effectiveness of the recovery actions specified in the procedures should be demonstrated by analysis and engineering evaluation. The performance of the equipment under accident conditions should be assessed based on best-estimate approach. Validation should be performed by practical exercises using full scope plant simulator. Training of the operators on the use of EOPs and feedback from the training process are also important aspects.
Current plant status The process for implementation of symptom-based plant-specific EOPs was clearly presented during the Prague workshop [Hončarenko 03]. Such procedures were successfully implemented at Temelín in 1998 based on the well-known Westinghouse concept (Emergency Response Guidelines [WEC 83]).
As reported during the Prague workshop [Hončarenko 03], due consideration was given at the plant to all the above-mentioned aspects of EOP development and implementation.
The EOPs were subject to comprehensive verification (detailed walk-through method and analytical insights) and validation using CR mockup and full scope simulator. The final validation of EOPs was completed in 1999 after the full scope simulator was made available at the plant [Sỷkora 01 a]. Over 20 accident scenarios were covered within the validation exercises.
All findings from the V&V process were carefully evaluated, documented and resolved.
Comprehensive training was implemented at the plant for the use of EOPs. This training covered both the MCR personnel and other plant staff involved in the emergency response including plant management staff.
Feedback from operational events and from simulator training is systematically made into procedures and training programmes. All findings are documented (in the dedicated EOPs database), evaluated and resolved.
EOPs are periodically updated based on the operational experience feedback. New EOPs revision will be issued in connection to SAMG implementation [Hončarenko 03]. These procedures will define the transitions from EOPs to SAMGs. They will be finalized following the approval of the recent version of E-plant, which is currently under review by SUJB.
Evaluation The plant specific EOPs have been implemented at Temelín. The development and implementation process was conducted in accordance to the current international practice. These procedures reflect the current state-of-the-art in this area. They provide appropriate framework for the transition to and the implementation of SAMGs.
66 ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues 3.4.2 Status of Severe Accident Management Guidelines (SAMGs) VLI No. VLI title / description 5.2.1 Have the high level AM strategies been converted into easily usable procedures/guidelines (SAMG)? See Sections 6 and 7 for SAMGs-related quality attributes.
5.2.2 What is the actual status of SAMG implementation at Temelín NPP?
State-of-the-art requirements and practices Under most circumstances, the preventive accident management measures included in the EOPs and implemented by the operating staff will result in plant recovery without core damage. The SAMGs are applied in the case these measures are unsuccessful and core damage occurs. Subsequent recovery actions that are covered in SAMGs (mitigative measures) place priority on containing and minimising fission product releases. The SAMGs together with EOPs provide a comprehensive procedural framework for response to accidents.
Current plant status The work on development and implementation of plant specific SAMGs is underway [Sỷkora 03 a]. The plant specific SAMG package has already been developed (English version) and is being translated into Czech language. Verification and independent review of SAMGs is underway. The new revision of EOPs will be finalized following the approval of the new version of E-plan by SUJB. Design documentation of the related plant hardware changes (which are minor) is being prepared. Preparation of the SAMG validation process is ongoing. Plans are prepared for SAMG related training as well as for the implementation of plant hardware changes.
More detailed background information and discussion of SAMGs-related quality attributes is provided in Sections 3.5 and 3.6. This section addresses only the current status of plant arrangements relating to the development and implementation of SAMGs at Temelín plant.
Evaluation The process of SAMG development is close to completion. Work on the implementation of SAMGs is well advanced. The SAMG development process includes all relevant elements defined in the current state-of-the-art.