«Item 7b Severe Accidents Related Issues Preliminary Monitoring Report Report to the Federal Ministry of Agriculture, Forestry, Environment and Water ...»
The SAM programmes adopted for US NPPs are characterized by very detailed guidance for all phases for a severe accident, up to and including RPV failure, basemat attack, and a variety of other potential challenges to containment integrity. The US SAM guidance is mechanistically based - that is, guidance was developed for all situations and phenomena that can physically arise, irrespective of their frequency of occurrence. The approach is based on the Electric Power Research Institute (EPRI) "Technical Basis Report" (TBR, proprietary), which encompasses the physics and phenomenology of severe accidents. The TBR, which analysed plant vulnerabilities and described potential countermeasures, which are available, analysed their potential effects during a variety of plant damage states, and incorporated research findings from the USNRC and industry as well as IPE and PSA insights. The largest SAM programme in the US was that of the Westinghouse Owners Group (WOG). The WOG SAMG approach was later selected by many European utilities, for both Westinghouse and some non-Westinghouse plants.
Plant modifications and SAMG adoption in Europe
In Europe, the picture of SAM and SAMG is quite diverse compared with the US situation. In response to the severe accidents at Three Mile Island in 1979 and Chernobyl in 1986, various European regulators had required or requested measures against severe accidents, with the focus on hardware measures. NPPs in a number of countries were required to install filtered vents to their containments. (Some sort of filtered venting capability was ultimately installed in approximately four out of five PWRs in Western Europe. These systems range from sand filters installed on the top of the auxiliary building to a variety of different filtration systems housed in separate, dedicated structures. Belgian, Spanish, and UK regulatory authorities have not required implementation of filtered venting systems.) In addition, many NPPs in Western Europe installed passive autocatalytic recombiners (PARs), sized and designed for severe accident conditions, to prevent or mitigate hydrogen combustion/deflagration/detonation. Belgium was the first Western European country to require PARs, which were implemented in its PWR NPPs between 1995 and 1997. The current state-of-the-art in Western Europe for severe accident management includes severe accident-sized and designed PAR systems. Most PWRs in Western Europe have either implemented such systems, or have decided to do so in the past few years and are in the process of implementation [Bachellerie 03].
It should be noted that many plants in Europe have also built additional preventive features, such as additional redundant power supplies from adjacent stations, well-qualified PORVs for bleed and feed operation, bunkered systems for sustained heat removal under extreme external events (earthquake, air plane crash, extreme winds, acts of terrorism), feeding SGs from mobile source outside the plant, etc. This was done notably in Belgium, Germany, Netherlands and Switzerland. Some built also control room air filtering (Germany, Trillo in Spain).
Loviisa built a separate primary depressurisation system (apart from the existing PORVs).
A number of plants have provided for cross-connections between systems within a unit (allowing, for example, containment spray pumps to provide low pressure injection or vice versa) or between systems in adjacent units (allowing, for example, the high pressure injection system in one unit to supply high pressure injection in the adjacent unit if that unit's system failed). Such modifications were often regulatory-driven, but were also done at the initiative of the utility for a variety of reasons (including investment protection). (The USNRC investigated the European efforts for application in the US, notably the bunkered systems, but concluded that such systems were not cost-beneficial; cost-benefit considerations are part of US "back fitting" legal requirements.) ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues 151
European AM Procedures and Guidelines
The Procedures and Guidelines developed in Europe relate to the origin of the plants: Most plants of US-type in Europe were aware of the developments in the USA, and have implemented similar guidance, albeit it somewhat later than the US schedule. In many cases, this was promoted or even required by the regulatory body in these countries.
Non-US plants had initiated similar initiatives, but mostly on a different basis. This will be the subject of subsequent sections, where the situation in the different countries is further described.
European AM Implementations
Accident management procedures and guidelines were developed in parallel with plant operation in Western Europe, except for the Sizewell B PWR, which had already implemented accident management during plant construction. Many Western European utilities selected the WOG SAMG approach as their primary vehicle for accident management for PWRs. This was done at most PWRs in Belgium (Tihange), Netherlands (Borssele), Spain (Asco, Almaraz, Jose Cabrera), and Switzerland (Beznau). Some other plants extended the range of their EOPs into the SAMG domain. This was done in the Belgium (Doel) and the UK (Sizewell B).
The French PWRs followed their own SAMG approach, which is not as detailed as the WOG SAMG approach and also implemented some hardware features (such as a separate RCP seal cooling system to prevent seal LOCAs during an accident and mobile cooling systems to fill an empty steam generator). At the German PWRs, an Emergency Manual was created to deal with accidents but with limited guidance (compared with US approaches) for the case of core melt. German PWRs also implemented hardware measures to reduce the likelihood of severe accidents (additional power lines, bunkered decay heat removal systems, qualification of relief valves for bleed & feed operation, and mobile water sources to fill an empty steam generator).
Only the Finnish PWRs at Loviisa implemented a fully integrated SAM plan including both hardware and software measures supported by a plant-specific research programme. Loviisa did not develop ex-vessel severe accident management guidance, but instead implemented changes to make it very unlikely ("physically unreasonable") that RPV failure would occur in a severe accident (a probabilistic approach, called Risk Oriented Accident Analysis Methodology, ROAAM).
European Regulators AM positions
Unlike the US situation, many Western European countries saw action by regulators to require accident management. Regulatory requirements were put forward in Belgium (directly to Tihange NPP, indirectly to Doel NPP), Finland, France, Germany (as a binding RSK recommendation), Netherlands, Sweden, Switzerland, and the United Kingdom (implicitly in the regulations on tolerable risk). No such requirements were issued in Spain as the Spanish regulatory authority follows the regulation of the country of origin of the plants (USA, Germany). Hence, in Spain SAMG was a voluntary action by the utilities. The presence of regulatory requirements does not automatically mean that severe accidents are in the licence basis - in most countries the regulator does not formally approve the SAMGs.
152 ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues
Coverage of accident scenarios
Most Western European SAMGs cover all phases of a severe accident, from in-vessel core degradation, RPV failure, basemat attack, hydrogen combustion, containment bypass, and so on. Finland, as noted above, does not consider the ex-vessel phase because it has been excluded as physically unreasonable by plant modifications to ensure in-vessel retention of core debris. The German approach, while it does not have full SAMGs in place (in the WOG SAMG sense), does consider various severe accident phenomena such as hydrogen generation and basemat attack. Only a very few NPPs in Western Europe are working on shutdown SAMGs (Borssele in Netherlands and Goesgen in Switzerland). Long term SAM provisions are considered within the scope of SAMGs only in Sweden.
European SAMGs Organisation
Western European SAMGs are split between those for which SAMGs are guidance and those for which the SAMGs are prescriptive procedures. The plants with WOG SAMGs clearly are among those, which employ guidance; the French PWRs also employ guidance.
More prescriptive procedures are used in the German PWRs, at Trillo in Spain (which employs the same technology as the German PWRs), in Doel in Belgium, and at Sizewell B in the UK. Where accident management response remains with the control room operators, the SAM approach is prescriptive. Where accident management response shifts to the TSC, the SAM approach is in the form of guidance.
European Harmonisation Status
In view of the above, it is apparent that there is not formally a Western European practice or standard for accident management. The partners in the Severe Accident Management Implementation and Expertise project of the EU (SAMIME) [Vayssier 02] developed a consensus position on some basic aspects of SAM. All of the Western European countries with active nuclear power programmes were represented, along with organisations from Slovenia and Slovakia. The consensus position does not reflect the position of every partner in all particulars, but it provides the next best thing in terms of the Western European state-of-the-art
in severe accident management. The consensus opinion consists of the following aspects:
- The Need for SAM Written Guidance or Procedures: There was a full and definite consensus that well developed and institutionalised, written guidance is a valuable tool for handling a severe accident and clearly should be available to support staff during the highly stressful conditions associated with this kind of event.
- The Type of Guidance (Detailed Written Directives, Ranking of Potential Counter-measures, or Add-On to EOPs Directed at Restoration of Lost Safety Functions): There was no clear consensus opinion on which of these options is best.
- Coverage of SAM: There was broad consensus that events beyond the design basis but before core damage is expected (e.g., where bleed & feed is employed), core damage but not vessel failure, and core damage with vessel failure and basemat attack should be covered by defined and written SAM guidance.
- Mechanistic or Probabilistic SAM Basis: The SAM guidance should be based on a mechanistic approach since it is hard to exclude scenarios based on probabilistic considerations unless it can be shown that phenomena are physically unreasonable or extremely unlikely.
(French organisations considered this issue as not meaningful for accident management.) ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues 153 Technical Basis for SAM: There was a general consensus that there should be an appropriate technical basis for both the preventive and mitigative part of SAM guidance, the technical basis being the knowledge base from which the SAM guidance is developed, including the effect of planned operator actions on the degraded plant condition.
Flexible Guidance or Prescriptive Procedures: Severe accident management could consist of flexible guidance or prescriptive procedures. There was a broad consensus that in the domain of the MCR, SAM mitigation measures responding to initiating events before establishment of the TSC should be prescriptive. Once the TSC is established, mitigation measures should be more of the guidance type, but once a strategy is selected the instructions to the operators should be clear and unambiguous.
Need for Plant Diagnosis: There was general consensus that insights into the state of the core, vessel, and containment would be valuable (especially the core and containment), and that approaches not using such insights explicitly (such as WOG SAMGs) could be enhanced by such insights. There was also consensus that SAM guidance should be available where such insights are missing, in the form of default guidance.
Need to Address Potential Negative Consequences: There was broad consensus that SAM guidance must address potential negative consequences of actions, and that this should be done before hand, as it is not possible during the stressful situation of an accident.
SAM Priorities: There was a large consensus that the priorities for SAM should be defined.
In the beginning of an accident, the priority is with core cooling. If the core is damaged, priority generally shifts to fission product boundaries. If fission product boundaries are intact and not challenged, operators again should try to terminate core damage progression.
If the integrity of fission product boundaries is lots, priority should shift to minimizing releases. Where challenges are mixed (bypass), priorities should not be set before analyzing the situation.
Need for EOP Exit Criteria to SAMGs: There was a consensus that exit criteria from the EOPs to SAMGs should be established because overall responsibility may shift from the MCR to the TSC or Emergency Manager, and because some of the actions in the SAM domain may conflict with actions in the EOP domain. Where EOPs are not exited, the priority of SAM actions and their consistency with the EOPs should be checked.
Need for Throttling and Termination Criteria: There was broad consensus that it is useful to have throttling and/or termination criteria for SAM actions.
Responsibility for SAM Guidance Implementation in MCR or TSC: There was a large consensus that responsibilities should be clearly defined, but apart from this the situation is quite open and decisions could be made by either the MCR or TSC, or there could be a shift from the MCR to the TSC. The method chosen should be consistent with the plant's existing philosophy on emergency response and with the applicable legal framework. Partners implementing US owners groups' SAM guidance felt that the responsibility remains with the TSC and the responsible Emergency Manager.
Separation Between Evaluation and Decision-Making: There was a broad consensus that the chain of command should be clear, and that it should be clear who is performing assessment and who will finally decide what actions should be taken. There was no a priori preference whether there should be a clear distinction between these two groups of people. This is dependent on the structure of the emergency response organisation and the organisation for normal operation.
Availability and Use of Outside Guidance: Outside technical support was generally welcomed, but the guidance should be so comprehensive that the available plant staff and management should be able to handle the events without such support at least for the first several (ten) hours of an accident. Some partners felt that if possible, external guidance should be provided and experts should be available as soon as possible.
154 ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues Guidance for Equipment/System Restoration: There was general consensus that guidance should be available to determine which systems could be best brought back into service.
One should know the time to take critical actions (reach compartments, spend time in a hostile environment, repair components, build shielding, etc.), but there should also be room for ad hoc decisions.
Limitation of SAM Guidance to Existing Plant Capabilities: The consensus was that plant modifications are primarily a tool to achieve a predefined safety level, including modifications for obtaining a meaningful severe accident management capability. Plant staff should therefore investigate their plant capabilities and eventually consider such modifications.
Once having reached this safety level, plants should focus on how to handle a severe accident with their existing or improved capabilities. Limited further modifications (primarily for I&C) should still be considered for implementation if they can provide great benefit at reasonable cost. (Many plants have made modifications to cope with severe accidents, and their existing plant capabilities already include such provisions.) Regulatory Involvement: There was consensus that there should be regulatory involvement but at a lower level than in the design basis area. The role should be to define minimum acceptance criteria and assess the SAM guidance, together with the assessment of plant vulnerabilities. It is important that there is a consistent regulatory position with respect to the EOP domain and the SAM domain throughout the regulatory process (regulations, licenses, and regulatory oversight).
Training Interval: There was broad consensus that after preliminary training, an interval of one to two years for refresher training is reasonable.
Decision Making Ultimately Onsite or Offsite: There was broad consensus that the ultimate responsibility for decision-making should be with the plant management. Regulatory authorities should be informed (and in some countries must be included in the decision making process prior to actions which would severely impact the public, like venting the containment). The responsibility should be consistent with the emergency plan.
Processing of New Information: There was consensus that new insights, as well as feedback from training, should be factored into the SAM guidance. Periodic revisions are therefore appropriate and should be done at such intervals that the SAM guidance remains a "living" tool.
Finally, the EU-project identified also issues, which were considered resolved, and candidate
areas for further severe accident research:
The issues considered to be resolved include direct containment heating (DCH); steam explosion-induced containment failure, and global hydrogen combustion in PWR large dry containments that are not highly compartmentalized.
Candidates for further research were found to be ex-vessel fuel-coolant interactions, molten core-concrete interaction (MCCI), local hydrogen burns, retention of fission products in a water pool and in the steam generator secondary side, performance/development of I&C in severe accidents, and the effects of SAM strategies on Level 2 PSA.
ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues 155
SEVERE ACCIDENT SCENARIOS CALCULATED
FOR OR CONSIDERED IN THE PN7 PROJECTTable B.1. SA scenarios calculated for Temelín NPP – Czech simulations with the MELCOR code [Sykora 01a]
LOCA, and mixed model both for serpentine and silicate concrete 23 days for LB LOCA and 12,7 days for SB LOCA. The authors conclude that the time of basemat full melt-through (without corium spreading) is from 10 to 23 days for LB LOCA and from 6 to 13 days for SB LOCA [Schoels 02a].
ETE Road Map - Preliminary Monitoring Report – Item 7b: Severe Accidents Related Issues 165
PN 3 Qualification of Valves (AQG/WPNS country specific recommendation) [Item No.2] * PN 4 Qualification of Safety Classified Components [Item No. 5] *
PN 9 Reactor Pressure Vessel Integrity and Pressurised Thermal Shock [Item No. 3] * PN 10 Integrity of Primary Loop Components – Non Destructive Testing (NDT) [Item No. 4] *
* The Items are related to Annex I of the “Conclusions of the Melk Process and Follow-up”