Overview of IAEA Safety Standards in terms of Accident Managementindico.ictp.it/event/7996/session/5/contribution/26/... · 2017. 10. 25. · Requirements what are associated with

Overview of IAEA Safety Standardsin terms of Accident Management

Presented by Naoki Hiranuma, Nuclear Safety OfficerSafety Assessment Section/Division of Nuclear Insta llation Safety/Department of Nuclear Safety and Security (S AS/NSNI/NSS)[email protected]

Joint IAEA-ICTP Essential Knowledge Workshop on Nuc lear Power Design Safety – Updated IAEA Safety Standards

9-20 October 2017Trieste, Italy

Objective

• To provide safety requirements and recommendations related to accident management, from IAEA applicable Safety Standards

• To introduce IAEA review activity

2

Fundamental Safety Objective

The fundamental safety objective aims at

protecting people, society and the environment from

the harmful effects of ionizing radiation.

3

Who We Are

4

External Events Safety Section

NSNI Mission

• To support Member States– in establishing the appropriate safety infrastructure

– to continuously improve the safety of nuclear installations

• site evaluation

• design

• construction

• operation

– through the development of up-to-date safety standards and providing for their effective application

5

History- IAEA Statute

“To establish or adopt, in consultation and, where

appropriate, in collaboration with the competent

organs of the United Nations and with the

specialized agencies concerned, standards of

safety for protection of health and minimization of

danger to life and property, and to provide for the

application of these standards to its own

operation as well as to the operations making use

of materials, services, equipment, facilities, and

information made available by the Agency…”

6

Under Article III.A.6 of its Statute, the IAEA is authorized:

Safety Standard Hierarchy

Global Reference Point for a High Level of

Nuclear Safety

Safety objectives andsafety principles

Functional conditions required for safety

Guidance on how to fulfil the requirements

7

Fundamental Safety Principles

8

Responsibility for

Safety

Role of Government

Leadership and Management

for Safety

Justification of Facilities and

Activities

Optimization of Protection

Limitation of Risks to

Individuals

Protection of Present and

Future Generations

Protective Actions to

Reduce ExistingOr UnregulatedRadiation Risks

Preventionof Accidents

Emergency Preparednessand Response

Safety ObjectiveTo protect people and the environment from harmful

effects of ionizing radiation

10 Safety Principles

Safety Standards Structure

9

Safety FundamentalsFundamental Safety Principles

General Safety Requirements

Part 1. Governmental, Legal and Regulatory Framework for Safety

Part 2. Leadership and Management for Safety

Part 4. Safety Assessment for Facilities and Activities

Part 3. Radiation Protection and Safety of Radiation Sources

Part 5. Predisposal Management of Radioactive Waste

Part 6. Decommissioning and Termination of Activities

Part 7. Emergency Preparedness and Response

1. Site Evaluation for Nuclear Installations

2. Safety of Nuclear Power Plants2.1 Design

2.2 Commissioning and Operation

4. Safety of Nuclear Fuel Cycle Facilities

3. Safety of Research Reactors

5. Safety of Radioactive Waste Disposal Facilities

6. Safe Transport of Nuclear Material

Collection of Safety Guides

Specific Safety Requirements

Commission and Committees

10

Commissionon Safety Standards

(CSS)

NuclearSafety

StandardsCommittee(NUSSC)

Radiation Safety

StandardsCommittee(RASSC)

Waste Safety

StandardsCommittee(WASSC)

Transport Safety

StandardsCommittee(TRANSSC)

Emergency Preparedness

Safety Standards Committee (EPReSC)

Process Flow for the Development

11

Outline and work planPrepared by the Secretariat

Review by the committees and Commission on Safety Standards

Drafting or revising of safety standard

by the Secretariat and consultants

Reviewby the safety

standards committee(s)

Endorsementby Commission on Safety Standards

MemberStates

Establishment by the IAEA’s Director General or BoG

Publication

• SF and SRs approved by Board of Governers

• SGs approved by DG

Involvement of Stakeholders

Participation by the different stakeholders (for example, regulators, users and co-sponsors) during the drafting and review phaseis a long established practice

12

Applicability

• Primarily: land based stationary NPPs with water cooled reactors

• With judgement: for application to other reactor types, to determine the requirements that have to be considered in developing the design

• It might not be practicable to apply all the requirements to NPPs that are already in operation

• It is expected that a comparison will be made against the current standards, for example as part of the periodic safety review for the plant

13

Status IAEA Safety Standards

Safety Standards are• Non binding on Member States

(MSs) but may be adopted by them

• Binding for IAEA’s own activities

• Binding on MSs in relation to operations assisted by the IAEA or MSs wishing to enter into project agreements with IAEA

14

Safety Assessment

15

Revised after the Fukushima Daiichi accident

Main changes

• Margins to withstand external events and to avoid cliff-edge effects

• Multiple facilities / activities at one site

• Cases where resources are shared

• Human factors in accident conditions




Safety Assessment (cont’d)

16

Requirements what are associated with accident managementRequirement 4 “Purpose of the safety assessment”

The primary purpose of the safety assessment shall be to determine whether an adequate level of safety has been achieved for a facility or activity and whether the basic safety objectives and safety criteria established by the designer, the operating organization and the regulatory body , …

Requirement 14 “Scope of the safety analysis”The performance of a facility or activity in all operational states and, as necessary, in the post-operational phase shall be assessed in the safety analysis.

Safety Assessment (cont’d)

17

Requirement 23 “Use of the safety assessment”The results of the safety assessment shall be used to specify the programme for maintenance, surveillance and inspection; to specify the procedures to be put in place for all operational activities significant to safety, and for responding to anticipated operational occurrences and accidents; to specify the necessary competences for the staff involved in the facility or activity; and to make decisions in an integrated, risk informed approach.

Requirement 24 “Maintenance of the safety assessment”The safety assessment shall be periodically reviewed and updated.

Design

18

• To be implemented by the designer to fulfill the fundamental safety functions with the appropriate level of defense in depth

• To be used by the reviewer of the design (e.g. by the Regulatory Authority) to assess the safety of the design




Design (cont’d)

19

Requirements what are associated with accident managementApplying the safety principles and concepts – Safety in Design

2.10 … Measures are required to be taken to ensure that the radiological consequences of an accident would be mitigated. Such measures include the provision of safety features and safety systems, the establishment of accident management procedures by the operating organization…

Requirement 7 “Application of defence in depth”The design of a nuclear power plant shall incorporate defence in depth. The levels of defence in depth shall be independent as far as is practicable.

• The purpose of the fourth level of defence is to mitigate the consequence of accidents … Event sequences that would lead to an early radioactive release or a large radioactive release are required to be ‘practically eliminated’. (From the concept of defence in depth)

Design (cont’d)

20

Requirements what are associated with accident managementRequirement 20 “Design extension conditions” (DECs)

A set of design extension conditions shall be derived on the basis of engineering judgement, deterministic assessments and probabilistic assessments for the purpose of further improving the safety of the nuclear power plant by enhancing the plant’s capabilities to withstand, without unacceptable radiological consequences, accidents that are either more severe than design basis accidents or that involve additional failures. These design extension conditions shall be used to identify the additional accident scenarios to be addressed in the design and to plan practicable provisions for the prevention of such accidents or mitigation of their consequences.

Requirement 59 “Provision of instrumentation”Instrumentation shall be provided for: determining the values of all the main variables that can affect the fission process, the integrity of the reactor core, the reactor coolant systems and the containment at the nuclear power plant; … and for making decisions for the purposes of accident management.

Commissioning and Operation

Requirements what are associated with accident managementRequirement 19 “Accident Management Programme (AMP)”

The operating organization shall establish, and periodically review and as necessary revise, an accident management programme.

– Documentation and periodical review

– Concurrent accidents for multi-unit NPP site

– Instructions for the utilization of available equipment

– Contingency measures

– To mitigate the consequences of an accident

– Training for implementation of the AMP

– To take into account the possibilities, such as

degradation of regional infrastructure, etc.

– Arrangements for accident management

21

Relevant Safety Guides

22




Relevant Safety Guide (cont’d)Severe Accident Management Programmes for Nuclear Power Plants, No. NS-G-2.15

�Objectives:� To provide recommendations on meeting the requirements for accident

management, including managing severe accidents

� To present recommendations for the development and implementation of an Accident Management Programme (AMP)

�Scope:� The development of AMP to prevent and to mitigate the consequences of

beyond design basis accidents, including Severe Accidents

� Accident management during at-power states, also other modes of operation including shutdown states

� Note: NS-G-2.15 is under revision in light of Fukushima Daiichi accident, and modification of related Safety Requirements (GSR Part 4, SSR-2/1 and SSR-2/2)

23

Severe Accident Management ProgrammeRecommendations

– General remarks: Preventive and Mitigatory regime– Identification of plant vulnerabilities and capabilities– Development of accident management strategies,

procedures and guidelines– Hardware provisions for accident management– Role of instrumentation and control– Responsibilities and lines of authorization– Verification and validation– Education and training– Processing new information– Supporting analysis– Management system

24

General remarks: Preventive and Mitigatory regime

• Preventive regime:– The preventive accident management guidance should address the full

spectrum of credible beyond design basis accident events;

– For determination of the full spectrum of events, useful guidance can be obtained from the probabilistic safety assessment (PSA) Level 1(if available), or similar studies from other plants, etc.

• Mitigatory regime:– The accident management guidance should address the full spectrum of

credible challenges to fission product boundaries due to severe accidents

– For determination of the full spectrum of challenge mechanisms, useful guidance can be obtained from the PSA Level 2(if available), or similar studies from other plants, etc.

Severe Accident Management Programmes for Nuclear Power Plants, No. NS-G-2.15

25

Identification of plant vulnerabilities and capabilities

• Plant vulnerabilities:

– How specific accidents will challenge critical safety functions should be investigated, and also if these safety functions are lost and not restored in due time, how the core will be damaged and how the integrity of other fission product barriers will be challenged.

– The insights should be obtained using appropriate analysis tools. Other inputs should also be used, such as the results of research on severe accidents, insights from other plants and engineering judgement.

• Plant capabilities:

– All plant capabilities available to fulfil the safety functions should be investigated, including the use of non-dedicated systems, … and use of systems beyond their design basis, up to and including the possibility of equipment damage.


26

Development of accident management strategies, procedures and guidelines

• Accident management strategies should be developed for each individual challenge or plant vulnerability, in both the preventive and mitigatory domains based on plant vulnerability and capability, etc.

– Preventive domain; to prevent core damage, such as achieving and maintaining core cooling, containment integrity, etc.

– Mitigatory domain ;• Terminating the progress of core damage once it has started;

• Maintaining the integrity of the containment as long as possible;

• Minimizing releases of radioactive material;

• Achieving a long term stable state.


27

Development of accident management strategies, procedures and guidelines

• Procedures and guidelines:– Should be converted to Emergency Operating Procedures

(EOPs) as preventive domain and Severe Accident Management Guidelines (SAMGs) as mitigatory domain.

– Contain the necessary information and instructions for the responsible personnel, including the use of equipment, equipment limitations, and cautions and benefits.


28

(cont’d)

– EOPs; • a set of actions to prevent the escalation of an event into a severe

accident.

– SAMGs;• a set of actions to mitigate the consequences of a severe accident

according to the chosen strategies.

• Address the various positive and negative consequences of proposed actions and offer options.

– The transition point from the preventive domain to the mitigatory domain should be set at some time prior to ‘imminent core damage’ or at the ‘beginning of core damage’, or at some other well defined point.

• e.g. the execution of preventive measures has become ineffective or impossible


29

Development of accident management strategies, procedures and guidelines(cont’d)

Hardware provisions for accident management

• The plant should be equipped with hardware provisions in order to fulfil the fundamental safety functions– e.g. control of reactivity, removal of heat from the fuel, confinement of

radioactive material

• In new plants there are usually design features present that practically eliminate some severe accident phenomena, and/or dedicated equipment is available for managing beyond design basis accidents and severe accidents.


30

Hardware provisions for accident management (cont’d)

• For the mitigatory domain, in upgrading equipment the focus should be placed on preservation of the containment function:– Containment isolation in a severe accident;

– Monitoring parameters in the containment;

– Ensuring the leaktightness of the containment;

– Management of pressure and temperature in the containment;

– Control of the concentration of combustible gases, fission products and other materials ;

– Containment overpressure and underpressure protection;

– Prevention of high pressure core-melt scenarios;

– Prevention of vessel melt through;

– Prevention and mitigation of containment basemat melt through;

– Monitoring and control of containment leakages.


31

Role of instrumentation and control

• Since the SAMGs depend on the ability to estimate the magnitude of several key plant parameters, the plant parameters needed for both preventive and mitigatory accident management measures should be identified.

• Alternative instrumentation should be identified where the primary instrumentation is not available or not reliable.

• The expected failure mode and resultant instrument indication for instrumentation failures in severe accident conditions beyond the design basisshould be identified.– e.g. off-scale high, off-scale low, floating


32

Role of instrumentation and control

• The ability to infer important plant parameters from local instrumentation or from unconventional means should also be considered.– For example, the steam generator level can be inferred from local pressure

measurements on the steam line and steam generator blowdown lines.

• The need for development of computational aids to obtain information where parameters are missing or their measurements are unreliable should be identified and appropriate computational aids should be developed accordingly.


33

(cont’d)

Responsibilities and lines of authorization

• Functions and responsibilities in accident management, in both the preventive and mitigatory domains, should be clearly defined within the documentation of the accident management programmeand of the overall emergency response organization.


34Fig. Typical layout of the technical elements of the on-site emergency response organization.

Responsibilities and lines of authorization (cont’d)

• The roles of personnel involved in severe accident management should be considered:– Evaluation/recommendation

• e.g. assessment of plant conditions, identification of potential actions, evaluation of the potential impacts of these actions, and recommendation of actions

– Authorization (decision making)

– Implementation of the actions

• In an event that degrades into a severe accident, transfer of responsibilities and decision making authority from the control room staff to a higher level of authority should be made at some specified point in time


35

Verification and validation

• All procedures and guidelines should be verified. Verificationshould be carried out to confirm the correctness of a written procedure or guideline and to ensure that technical and human factors have been properly incorporated.

• All procedures and guidelines should be validated. Validationshould be carried out to confirm that the actions specified in the procedures and guidelines can be followed by trained staff to manage emergency events.


36

Education and training

• For each group involved in accident management, including the management of the operating organization and other decision making levels, and also, where applicable, regulatory personnel, specific objectives and training needs should be defined.

• Regulators, where they participate in utility decisions, should be trained so that they fully understand the basis of proposed utility decisions.

• Exercises and drills should be based on appropriate scenarios that will require the application of a substantial number of procedures and guidelines.


37

Processing new information

• For any change in plant configuration, the effect on EOPs and SAMGs as well as on organizational aspects of accident management should be checked. A revision of the documents should be made if it is found that there is an effect on these procedures and guidelines.

• International research on severe accident phenomena should be followed actively and new insights should be processed accordingly in the accident management programme.

• Exchange of information with peers should be used to improve the SAMGs for future revision.


38

Supporting analysis

• Later stages of the analysis aim to provide only analytical support for accident management.1) Formulation of the technical basis for development of strategies,

procedures or guidance;

2) Demonstration of the acceptability of design solutions to support the selected strategies, procedures and guidelines in accordance with the established criteria;

3) Determination of the reference source terms for emergency plans.

• Appropriate consideration should be given to uncertainties in the determination of the timing and severity of the phenomena. This consideration should include the uncertainties in the understanding of phenomena that may occur in both the progression of the accident and the recovery phase.


39

Supporting analysis (cont’d)

• Computer codes used for analysis should be validated to the extent possible.

• The operating organization of the plant should specify the proper codes and models for the various applications, and should justify their use.

• Computer code results should be interpreted with consideration given to model limitations and uncertainties.


40

Management system

• Development of an accident management programme should follow the applicable IAEA safety requirements and guidance on this subject.

– Leadership and Management for Safety, IAEA Safety Standards Series No. GSR Part 2 (2016), that superseded No. GS-R-3 titled ‘The Management System for Facilities and Activities’.

– Application of the Management System for Facilities and Activities, IAEA Safety Standards Series No. GS-G-3.1 (2006)

• Where these cannot be followed due to the uncertainties in the severe accident domain, the intent of the safety requirements should be followed to the extent practicable.


41

Appendices and annexes

• Appendix: Practical Use of the SAMGs– Overview of how actions in SAMG domain are

implemented

• Annex: An Example of A Categorization Scheme for Accident Sequences– Examples of how to categorize accident sequences in

terms of status of equipment to cope with the accident, containment damage states and so on.

42

Relevant technical documents

• Safety Report Series on Implementation of Accident Management Programmes in NPPs (SRS-32 (2004))� Objective

43

� To provide a description of the elements to be addressed by the team responsible for developing and implementing a plant specific Accident Management Programme (AMP)

� For use by NPP operators, utilities and their technical support organizations, also regulators

� Scope� Focus on SAMGs for operation plants and under

construction plants

� Both internal and external events are covered

� To discuss full power operational states, not including low power and shutdown states

Relevant technical documents (cont’d)

• Guidelines for the review of accident management programmes in NPPs (SVS-9 (2003))� Objective

44

� to give guidance on the preparation, execution and reporting of IAEA missions devoted to review of the AMP or its components

� to assist operators and regulators in preparing, developing and implementing AMP and in performing their internal review or regulatory review

Technical Safety Review (TSR)

The TSR incorporates IAEA safety assessment

and design safety technical review services to address the needs of Member States at all

stages of development and implementation of

the nuclear power programme.

45

TSR

Objectives Scope

Tailored, independent evaluation of the plant safety assessment and design safety documentation– Recommendations for enhancements

to safety

Assistance in following topics− Safety of operating and new nuclear

plant designs− Safety Analysis Report− Safety Requirements developed by

regulatory authorities − Safety assessments, also related to

plant modifications− Action taken to address emerging

safety issues− Periodic Safety Reviews

46

Subject areas

• Design Safety (DS)

• Generic Reactor Safety (GRS)

• Safety Requirements (SR)

• Probabilistic Safety Assessment (PSA)

• Accident Management (AM)

• Periodic Safety Review (PSR)

Audience: Regulatory Bodies, TSOs, Owners/Operators

Duration : 3 – 9 months

Team composition: Lead by IAEA staff

# experts: dependent on scope

North America 1

Africa 0

Europe 77

Latin America and the Caribbean 2

Asia and the Pacific 28

108 TSRServices*

* total number of services to date

TSR Services Conducted (1/2)

TSR Services Conducted (2/2)

Subject AreasNumber of Services

Number of receiving

MSsTime Range

Design Safety (DS) 7 5 2003 - 2009Generic Reactor Safety (GRS) 11 6 2008 - 2016Safety Requirements (SR) 2 2 2013 - 2014Probabilistic Safety Assessment (PSA)

77 21 1988 - 2016

Accident Management (AM) 9 6 2001 - 2014Periodic Safety Review (PSR) 2 2 2001 - 2008

General Process

49

3. MEETING:Staff conducts meeting

at the site to discuss observations and

performs evaluations

2. PREPARATION:IAEA staff plans review; prepares and conducts

evaluation with support of international experts

1. REQUEST:Member State sends a formal request to the

IAEA staff

5. FOLLOW-UP:Requesting party considers inviting a follow-up ser vice

4. REPORT:Staff finalizes the review report at headquarters and provides

to requesting party

Outline of TSR- Design Safety (DS)

• Objective and Scope

• Limitations

• Review Process

• Deliverables

• Schedule

• References

50

Objective and Scope (1/3)

• Objective

– Perform and provide independent international review based on selected IAEA Safety Standards to assist the requesting party (RP) in their technical evaluations of the design safety documentation

– Selected IAEA Safety Requirements in force on the date of submission of the design safety documentation to the IAEA: utilized as review criteria

51


• Objective (cont’d)

– Selected IAEA Safety Guides: considered as supporting information for purposes of clarification of the requirements used as the basis for the review

– Outcome: summarizing observations (without ranking) made by experts regarding the presented design documentation in the Preliminary Safety Analysis Report (PSAR) that might need further evaluations, analysis, explanations, clarifications, considerations, supplements, etc. in the context of the identified IAEA Safety Standards

52


• Objective (cont’d)

– Specific details of each observation: provided via Review Sheets in the Report

• Scope

– Part of, or the entire PSAR, depending on agreement with the RP in the Terms of Reference (ToRs)

53

Limitations

• Observations identified: based on a high level review, as comprehensive as possible based on the schedule, as well as exemplary

• TSR-DS does not constitute any kind of design certification or licensing activity as this is the responsibility of the Member States

• The quality of the English version of the PSAR could impact the results of the TSR-DS

• The review will be based on the PSAR as delivered by the RP, no request for additional information will be made by the IAEA

54

Review Process (1/4)

• TSR-DS: tailored based on an official request from a RP of a MS

• The Terms of Reference (ToRs) agreed with the RP, including the schedule and budget, are the bases for the review

• TSR-DS review: managed by an IAEA senior staff member responsible for the implementation

• IAEA Technical Officers (TOs): assigned for each PSAR Chapter

55


• IAEA utilizes external experts with expert understanding of the IAEA Safety Standards, as well as the knowledge, methods and approaches required to perform the TSR-DS

• External experts: selected according to the IAEA procedures

Particular attention

• To avoid a conflict of interest and not to recruit experts that have been involved in the development of the documentation to be independently reviewed.

56


• Project implementation

– Kick-off meeting of TOs with external experts

– External Experts: review assigned PSAR Chapters and develop the Draft Review Sheets

– IAEA Discussion Meeting of TOs and external experts on Draft Review Sheets

– Draft Report produced by IAEA and sent to the RP of the MS

57


• Project implementation (cont’d)

– Comments back from the RP

– Expert Meeting in the MS of the RP

– Final Report produced by IAEA delivered to the RP

58

Deliverables

• Draft Review Sheets - for information

• Draft Reports including Review Sheets – for the RP in the MS to provide comments (if any) under “Counterpart Response”*

• PSAR TSR-DS Final Report including final Review Sheets

59

*see section 3 of the Review Sheet, slide 62

Schedule

• Project Implementation Schedule: included in the ToRs and to be agreed with the RP of the MS prior to the beginning of the review

• Any delay in the submission of PSAR to the IAEA or in providing the comments to the review sheets: require a complete review and modification of the schedule to ensure the availability of the Technical Team members

60

References

• The TSR-DS is based on the IAEA Safety Requirements supported by the associated Safety Guides

• The full list of Safety Requirements and Guides is included in the ToRs

61

Review Sheet

62

1. IDENTIFICATION

PSAR Chapter Reviewed:

Review Area:

Observation Title:

2. OBSERVATION

2.1 DESCRIPTION

2.1.1 Statement in PSAR

2.1.2 Assessment by Reviewer

2.2 REFERENCE TO IAEA SAFETY STANDARDS

2.3 RECOMMENDATION

3. COUNTERPART RESPONSE

3.1

3.2

3.3

4. RESOLUTION BY THE IAEA TECHNICAL TEAM

4.1

4.2

4.3

TSR - Accident Management (AM)• DESCRIPTION

– Review service conducted by the IAEA staff and international experts of accident management programme (AMP) in Member States on the basis of Safety Standards GSR Part 4* and NS-G-2.15** and guideline SVS-9***

• OBJECTIVE – To advise and assist the regulatory body, utility or technical support organization

in the development and implementation of an accident management programme

• PROCESS – The process includes preparatory work and the review of the AMP and

associated documentation. The review usually lasts two weeks. Funded by the requesting party or through technical cooperation projects

• OUTPUT – A report describing the review performed, the review findings and, if needed,

recommendations in improving the plant specific AMP

63*Safety Assessment for Facilities and Activities**Safety Guides Severe Accident Management Programmes for Nuclear Power Plants***Guidelines for the review of accident management programmes in nuclear power plants

Results of AM reviews

64

Slovenia AM review of the quality and completeness of the accident management programme(AMP) for Krsko NPP

Completed 2001

Lithuania AM review of the quality and completeness of the accident management programme(AMP) for Ignalina NPP

Completed 2007

Pakistan Pre-AM review of emergency control centreand post accident monitoring instrumentation to improve the AMP for KANUPP

Completed 2007

Mexico Pre-AMreviewworkshop on severe accident analysis and accident management programme for Laguna Verde NPP

Completed 2014

Thank you for your attention!

Documents

Overview of IAEA Safety Standards in terms of Accident Managementindico.ictp.it/event/7996/session/5/contribution/26/... · 2017. 10. 25. · Requirements what are associated with