«Item 7b Severe Accidents Related Issues Preliminary Monitoring Report Report to the Federal Ministry of Agriculture, Forestry, Environment and Water ...»
It can be concluded that a due attention is given by the plant to this task albeit belatedly (IAEA Safety Series No. 110 [IAEA 93], which was issued in July 1993, called for implementation of severe accident management before commencement of Temelín operation). INSAG-10 clarified three years later that the existence of several of the elements of defence in depth does not justify operation in the absence of one element - all elements are required when an NPP is at power [INSAG-10].
Thus, strictly speaking, SAMGs should have been in place before Unit 1 was started up.
Some severe accident guidance was available at the time of startup for use by the accident engineer in the TSC, but clearly this was not full accident management along the lines of the SAMGs.
ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues 67 3.4.3 Availability and Completeness of Training Programmes for Personnel Involved in SAM VLI No. VLI title / description 5.3.1 Have the training needs for different personnel involved in SAM been systematically evaluated and documented? What personnel are covered by this training?
5.3.2 Have the training programmes and schedules for training, re-training and testing of staff involved in AM been developed / documented?
5.3.3 Is the training in relation to the plant specific SAMGs addressed in the plant training programme?
State-of-the-art requirements and practices The overall development of a plant specific severe accident management program should include tasks which are not directly related to the preparation of procedures, but which would be required to enhance the usability of the guidance on site. These include the development of a program for training the utility emergency response staff and management in the usage of the SAMG. Validation of the plant specific SAMGs against the existing E-Plan should be part of this training.
Exercise programmes should be conducted to ensure that all SAMG specified functions required to be performed for emergency response and all organizational interfaces for NPP are tested at suitable intervals. These programmes should include the participation in some exercises of as many as possible of the organizations concerned. The plan should evaluate systematically the exercises and also the regulatory body should evaluate some of them. The programme should be subject to review and updating in the light of experience gained. The attributes taken into account in the evaluation of validation exercises are further discussed in Section 3.6.
3. Training of SAMG evaluation team is further discussed in Section 3.6.6.
Current plant status Preparation of training programmes in relation to Temelín SAMG is in the planning stage [Sỷkora 03 b]. No information was provided during the Prague workshop on the related training programmes.
Evaluation Based on the limited available information, evaluation of this aspect was not possible. This aspects should be addressed in due time by a specialized independent review team (e.g.
IAEA RAMP mission).
68 ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues
3.5 SAMGs Content and Structure 3.5.1 Overall Concept of SAMGs VLI No. VLI title / description 6.1.1 Is the symptom based concept followed in the SAMG package?
6.1.2 Are the SAMG based on a well-established generic approach? Was the applicability of this approach to Temelín evaluated based on systematic process?
6.1.3 Have a severe management closure process been established (e.g. based on NUMARC 91-04) incorporating the following elements:
Utilization of the plant IPE/PSA to identify insights and enhancement that are potentially addressable by the plant specific AMP;
Evaluation of the current AM capabilities and selection of safety enhancements, as appropriate;
Schedule of the safety enhancements to the AMP;
Establishing an evaluation process flexible for addressing new information for assessment and identification of possible plant enhancements.
State-of-the-art requirements and practices SAMGs should convert the high level SAM strategies into easily usable procedures or guidelines. SAMGs should be fully symptom based. In general, SAMG do not attempt to diagnose the specific sequence underway but rather provide a symptom-based, structured way to determine which actions are needed in order to restore critical safety functions to prevent challenging the barriers to FP release, and finally allow the achievement of a controlled stable plant state. There should be a clear definition of the division between preventive actions covered by EOPs and mitigative actions addressed in SAMGs. Consistency with the emergency response plan should be ensured.
The procedures and guidelines must be usable and workable (the main purpose of validation being to check these aspects), and they must be presented in a user-friendly and consistent format which emergency staff can become fully familiar with and comfortable in using.
In the current practice, the SAMGs are implemented based on a well-established systematic
process (e.g. [NEI 94]). This process should incorporate the following elements:
- Utilization of the plant IPE (PSA) to develop and identify a set of insights and enhancements that are potentially addressable by the plant specific AMP;
- Evaluation of the current accident management capabilities and selection of a set of safety enhancements, as appropriate;
- Schedule of the selected safety enhancements to the AMP;
- Establishing an evaluation process that is flexible for addressing new information for assessment and identification of possible plant enhancements.
Current plant status The SAMG have been developed based on a well-established generic approach (WOG approach). The applicability of this approach to Temelín has been evaluated based on systematic process, which is consistent with the current state-of-the-art. This process includes all the elements mentioned above.
Evaluation The overall concept of SAMGs at Temelín plant is consistent with the current state-of-the-art in the area.
ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues 69 3.5.2 Contents of SAMG Package and Availability of Supporting Information VLI No. VLI title / description 6.2.1 Has guidance been provided to all involved parts of the emergency organization (MCR, TSC, operation support, etc.)?
6.2.2 Have all the relevant phases of SAM (including the diagnosis of plant status and transfer of responsibilities) been addressed?
6.2.3 Is guidance provided for identification and optimization of strategies, actions and plant features that are to be used in SA conditions?
6.2.4 Does the provided guidance include the assessment of availability of equipment and instrumentation?
6.2.5 Are the criteria for initiating and exit SAMGs and means for checking the success of each action clearly defined?
6.2.6 What are the provisions for obtaining background, plant-specific information to support selection and implementation of SAM strategies? To what extent this information can be provided from computerized data information systems (internal network, etc.)?
State-of-the-art requirements and practices Guidance should be provided for all involved parties (MCR operators, Technical Support Centre staff, and safety engineers). All the relevant phases of SAM (including the diagnosis of plant status and transfer of responsibilities) should be addressed.
Criteria for activation of the SAM team (TSC) as well as entry/exit conditions for each part of the guidelines should be clearly defined. Relevant decision points and the facilities to aid decision need to be identified. Plant specific set-points used in SAMGs should be plant specific and reflect the current plant status.
The actions required and equipment available to initiate actions should be defined accompanied with clear, comprehensive and plant-specific background information. Guidance should be provided on the selection of optimal SAM strategy as well as guidance on the assessment of availability and capability of plant systems to follow the different strategies. Requirements and means to override or block automatic protection signals or interlocks are in most cases not applicable to SAMGs since these actions are performed in earlier phase of the accident and covered by EOPs.
Means by which the success of each action can be judged should be described clearly. Consideration should be given to the increased possibility of erroneous readings from the instrumentation. Typically, the user is asked to confirm indication from the preferred instrumentation by double-checking against indications from other sources and by using information of different type (e.g. information on trends).
It should be noted that in addition to computational aids (CA), which can be used either manually or by means of computer, capabilities should be provided to obtain relevant support information by plant computer network. The access to relevant pre-calculated data and all related documents/reports that may be useful in selecting the optimal SAM strategy by TSC staff through computer plant network, is considered a good practice.
Current plant status The contents of Temelín SAMG package had been well described during the Prague workshop [Sỷkora 03 b]. The contents had been found consistent with the practice presented above.
70 ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues Guidance is provided in SAMGs to MCR and TSC as well as other involved parts of the emergency organization. All the relevant phases of SAM are addressed. The criteria for transition from EOPs to SAMGs are clearly defined.
Guidance is provided for diagnosis of plant status, identification and optimization of strategies, selection of potential recovery actions and plant features that are to be used in SA conditions. This guidance includes the assessment of availability of equipment and instrumentation, determination whether the strategy could be implemented using available plant features, and identification of negative impacts of the selected strategy including long-term concerns.
Criteria for exit SAMGs and means for checking the success of each action are defined.
Provisions for obtaining background, plant-specific information to support selection and implementation of SAM strategies are in place. TSC personnel have access to computerized data information systems (plant data and Emergency Facility information system). Various video cameras installed in MCR, ECR and at the plant provide additional information. There is also access to an accident analyses viewer. Large variety of design documentation and all relevant procedures (both hard copies and electronic files) are available in TSC. Diversive means of communication between TSC and MCR/ECR (verbal and visual) are in place.
Evaluation All aspects relating to the contents of SAMG package and availability of SAM supporting information during an accident were assessed based on Czech presentations during the Prague Workshop. The situation at Temelín is considered satisfactory and reflects the current state-of-the-art in this area.
3.5.3 Structure, Clarity, and Format of the SAMG Package
VLI No. VLI title / description 6.3.1 What are the structure and the basic elements of SAMG package?
6.3.2 Are all the relevant plant areas and/or release paths (e.g. hermetic zone, non-hermetic rooms, steam generators) addressed in the strategies, where applicable?
6.3.3 What is the basis for setpoints used in SAMGs? Have the setpoints been established based on ‘as built’ plant specific features and justified by plant-specific calculations?
6.3.4 What computational aids are provided to enhance the plant status monitoring capabilities?
6.3.5 Is the clarity of presentation and user friendliness satisfactory?
Are good practice and human factor principles followed?
State-of-the-art requirements and practices Plant specific structure and format of SAMGs depend on many factors such as the definition of decision-making process and responsibilities (e.g. TSC organisation), prioritisation of SA strategies, applicability of generic strategies and studies, etc. The most known state-of-art SAMG structure is the WOG Generic structure [WOG 01]. SAMG based on this concept have already been successfully implemented in many NPPs. Brief information on the structure and contents of SAMG package prepared in accordance with this concept is provided below.
Severe Accident Control Room Guidelines (SACRG) include two parts: SACRG-1 covering initial response of MCR staff to severe accidents and SACRG-2 dealing with accident management after the TSC has been made functional.
Guidelines intended for the use in the TSC is composed of Diagnostic Flow Chart (DFC), Severe Challenge Status Tree (SCST), Severe Accident Guidelines (SAG), Severe Challenge Guidelines (SCG), Severe Accident Exit Guidelines (SAEG), and Computational Aids (CA).
ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues 71 Basic rules for using the SACRG are similar to those applied in EOPs. An important exception is that verbatim compliance is not required. Once SACRG-1 has been entered the actions conducted within the EOPs are discontinued. However, equipment in service at the time of transition from EOPs to SAMGs should remain in service unless the SAMG applicable instructs to the contrary.
While executing SACRG-2, the MCR staffs are also responsible for implementing strategies recommended by TSC. Typically, these actions must be approved prior to implementation by the TSC head. Exceptions are some non-critical actions necessary to control equipment conditions or to protect operating equipment.
Once the TCS enters the SAMGs (authority for this decision is specified in the ER plan), the first guidelines used are the DFC. It instructs to start monitoring of several key plant parameters (in the order specified in the DFC) based on setpoint values. Also the monitoring of severe challenges is initiated using SCTS. If a setpoint is exceeded in the DFC, the TSC implements the corresponding SAG. If a setpoint is exceeded in the SCTS, the corresponding SCG is entered. In this case, the monitoring of DFC and evaluation of SAGs is terminated.