SSG-54 Accident Management Programmes for Nuclear Power Plants

To prevent escalation to a severe accident;

To mitigate the consequences of a severe accident;

To achieve a long term safe stable state².”

Preventive domain of accident management. Before the onset of fuel rod degradation, priority is given to preventing the escalation of the accident into a severe accident. In this domain, actions are implemented to stop the accident progressing to the onset of significant fuel rod degradation or to delay the time at which significant fuel rod degradation happens and preserve all the fundamental safety functions.

Mitigatory domain of accident management. When plant conditions indicate that significant fuel rod degradation is imminent or in progress, priority is given to mitigating the consequences of the severe accident through:

Maintaining the integrity of the remaining fission product barriers, particularly the containment, which depending on the design can also include maintaining the integrity of the reactor pressure vessel⁴;

Avoiding or limiting fission product releases to the environment;

Returning, to the extent possible, to a long term safe stable state.

To prevent escalation of an emergency;

To return the facility to a safe and stable state;

To reduce the potential for, and to mitigate the consequences of, radioactive releases or exposures.”

Preventing or delaying the occurrence of fuel rod degradation;

Terminating the progress of fuel rod degradation once it has started;

Maintaining the integrity of the reactor pressure vessel to prevent melt-through, especially at high pressure;

Maintaining the integrity of the containment and preventing containment bypass (strategies for maintaining containment integrity and preventing bypass are of the highest priority once the mitigatory domain is entered);

Minimizing releases of radioactive substances from the fuel or at other locations where releases of radioactive material could occur;

Returning the plant to a long term safe stable state in which the fundamental safety functions can be preserved.

Before significant fuel rod degradation has occurred: Preventing fuel damage is the first priority, and maintaining or restoring the integrity of the containment is the second priority.

After significant fuel rod degradation has occurred: Maintaining the integrity of the containment is the highest priority.

The time frames and severity of challenges to the barriers against releases of radioactive material.

The availability of support functions, as well as the possibility of their restoration.

The initial operating mode of the plant, as accidents can develop in operating modes in which one or more fission product barriers have already been lost at the beginning of the accident.

The adequacy of a strategy in the given domain; some strategies can be adequate in the preventive domain but not as relevant in the mitigatory domain owing to changing priorities. For example, cooling the fuel could be the first priority when the fuel is undamaged and the containment is intact, while restoring the containment integrity or limiting fission product releases could be the first priority when the containment is open (e.g. at shutdown) or has been damaged (e.g. cracks resulting from very severe mechanical loadings).

The difficulty of implementing several accident management strategies in parallel.

The long term implications of or concerns about implementing the accident management strategies.

It should promote consistent implementation by all staff during an accident.

It should emphasize the use of components and systems that are not likely to fail in their expected operating regimes, including during severe accidents.

It should implement all feasible measures that will either maintain or increase the margin to failure or that will gain time before the failure of safety functions or of barriers to a release of radioactive material.

It should address the possibility of adding components, including non-permanent equipment, in the event that existing plant systems are unable to preserve the fundamental safety functions or limit challenges to barriers to a release of radioactive material for conditions not considered in the design.

It should consider plant conditions in shutdown modes, particularly when the containment barrier is temporarily not available or when it is difficult to add water for decay heat removal.

The performance of personnel under the contextual and adverse boundary conditions given;

The command and control structure, including information sharing and cooperation among the staff involved.

The number of affected units (the reactor core and spent fuel pools);

The functionality and habitability of control facilities;

Damage to essential structures and buildings;

The availability of AC and DC power required for the operation of plant systems;

Access to essential buildings and equipment;

The availability of operating personnel and site staff for implementation of procedures and guidelines;

Whether actions can be taken by non-licensed personnel, typically an auxiliary operator;

The availability of other on-site control rooms and personnel in separate buildings;

The capability of communicating within the plant emergency command and control structure and with off-site organizations.

Answer questions that are beyond the capability of professional trainers;

Provide information about the operation of field and local equipment and the operation of other equipment, including non-permanent equipment, under adverse conditions.

Situations in which staff members involved in accident management have been incapacitated;

Situations in which some staff members involved in accident management need to be evacuated;

Situations in which outside support may be delayed so that main control room staff and technical support centre staff will need to continue the accident management measures.

Identification of challenge mechanisms: Mechanisms that could challenge the fundamental safety functions or the barriers to a release of radioactive material should be identified.

Identification of plant vulnerabilities: Plant vulnerabilities should be identified, with consideration given to the challenge mechanisms, including the concurrent loss of the fundamental safety functions.

Identification of plant capabilities:

Development of severe accident management guidance:

Establishment of a verification and validation process for the severe accident management programme.

Integration of the severe accident management programme into the management system and the emergency preparedness and response arrangements:

For challenges to the fundamental safety functions and fission product barriers, the plant capabilities, including capabilities to delay or mitigate such challenges, in terms of both available equipment and available personnel, should be considered.

The available or necessary hardware provisions for the execution of severe accident management strategies should be considered.

Suitable severe accident management guidance should be developed and should include the use of permanent and on-site and off-site non-permanent equipment and instrumentation to cope with the vulnerabilities identified.

Development of severe accident management guidance should be supported by appropriate analyses. Best estimate analyses are typically used for this purpose.

Dependencies between external hazards should be considered.

The possibility and consequences of using erroneous information should be considered.

The means of obtaining information on the plant status, and the role of instrumentation therein, should be considered, including cases in which the information provided by instrumentation is erroneous and all normal power for instrumentation and control systems is unavailable.

Possible restrictions on access to certain areas in order to perform local actions should be considered.

Interfaces with actions performed prior to any significant fuel rod degradation should be addressed.

Suitable procedures and guidelines for the execution of the strategies and measures should be developed.

Severe accident management strategies should consider relevant very low probability events.

The lines of decision making, responsibility and authority in the teams that will be in charge of the execution of the accident management guidance should be specified.

Human and organizational factors should be considered using a systemic approach to safety [22].

A systematic approach to the periodic evaluation and updating of the guidance and training should be considered; such an evalution should incorporate new information and research insights into severe accident phenomena.

Education, training, exercises and drills should be considered.

Integration of the severe accident management programme with the emergency arrangements for the plant should be ensured.

Operating experience, relevant safety analysis and results from safety research.

Accident sequences reviewed against a set of criteria aimed at determining which severe accident challenges should be addressed in the design of the severe accident management programme.

Potential design or procedural changes that could either reduce the likelihood of occurrence of these challenges or mitigate their consequences, and decisions on the implementation of such changes.

Plant design capabilities, including the possible use of:

For multiple unit sites, consideration of the use of available means and/ or support from other units on the site, provided that the safe operation of those units is not compromised.

Systems beyond their originally intended function and anticipated operational states when the use of such systems will not exacerbate the situation;

Additional non-permanent systems or components to return the plant to a long term safe stable state or to mitigate the consequences of a severe accident, provided that it can be shown with a good level of confidence that the systems will be able to function in the expected environmental conditions.

Working in high temperature, high pressure or high humidity areas;

Working in poorly lit or dark areas;

Working in areas ventilated by portable ventilation systems;

Working in high radiation areas;

Using non-permanent instrumentation or non-permanent power supplies.

Maintaining the integrity of the containment or any other remaining confinement barrier and preventing containment bypass;

Minimizing or delaying any off-site releases of radioactive material;

Returning the plant to a long term safe stable state.

Terminating the progress of fuel rod degradation;

Maintaining the integrity of the reactor pressure vessel and other fuel retaining structures (such as the spent fuel pool).

Filling the secondary side of the steam generators to prevent creep rupture of the steam generator tubes;

Depressurizing the reactor coolant system to prevent high pressure failure of the reactor pressure vessel and direct containment heating;

Flooding the reactor cavity to prevent or delay vessel failure (or facilitate corium spreading on a large area in the case of vessel rupture) and subsequent basemat failure;

Mitigating the impact of combustible gases;

Depressurizing the containment to prevent its failure by excess pressure or to prevent basemat failure under elevated containment pressure (see Ref. [17]).

The objectives and goals of the SAMGs;

The interface with the EOPs;

The criteria for entry into the mitigatory domain;

Potential negative consequences of the actions;

Guidance on the monitoring of strategies;

Cautions and limitations;

The equipment and resources necessary (e.g. AC and DC power, water);

Consideration of the necessary human resources;

Consideration of the habitability of workplaces at which local measures for accident management may be necessary;

Guidance on the use of diagnostic tools and computational aids;

The time window within which the actions are to be applied;

Local actions sheets (if applicable);

Conditions for exit from or termination of the SAMGs;

Guidance on the assessment and monitoring of the plant response, including consideration of the effectiveness of implemented actions.

Possibilities to restore the equipment;

Possibilities for unconventional system line-ups;

Possibilities to connect portable equipment;

Successful recovery times when several pieces of equipment are out of service;

Dependence on a number of failed support systems;

Doses to personnel involved in the restoration of the equipment or the connection of portable equipment.

Situations in which all AC and DC power is lost and compressed air is not available;

Situations involving high radiation areas and high temperatures in areas where vent valves are located (if local access is required);

The notification of relevant off-site response organizations about actions with off-site consequences;

The limitation of radioactive releases in the event of containment venting through such means as aerosol deposition, filtration or early venting.

If while executing EOPs an entry point for an SAMG is reached, should actions in the EOP then be stopped or continued, if not in conflict with the applicable SAMG?

If an SAMG is in execution, but the point of entry for another SAMG is also reached, should that other SAMG be executed in parallel?

Should the consideration to initiate another SAMG be delayed while parameters that called for the first SAMG are changing value?

It should be a self-contained source of reference containing:

It should provide basic material for training courses for staff involved in accident management.

The technical basis for strategies and deviations from generic strategies, if any;

A detailed description of instrumentation needs;

Results of supporting analysis;

A detailed description of and the basis for steps in procedures and guidelines;

The basis for the specification of set points used in the SAMGs.

Evaluation or recommendation (assessment of plant conditions; identification of potential actions; evaluation of the potential impacts of these actions; recommendation of actions to be taken; and, after implementation, assessment of the outcome of the actions): Personnel in charge of such duties are often called ‘evaluators’.

Authorization (decision making — approving the recommended action or deciding on other appropriate actions for implementation): Personnel in charge of such duties are often called ‘decision makers’.

Implementation and support of the actions (operation of equipment as necessary, including verification of operation; dose assessment in support of accident management actions; and emergency response functions): Personnel in charge of such duties are often called ‘implementers’ or ‘responders’. This function includes remote operations from the main control room and local actions by appropriate personnel to recover or connect equipment.

Monitoring essential containment parameters, such as temperature, pressure, radiation level and water level;

Ensuring the leak-tightness of the containment, including preservation of the functionality of isolation devices, penetrations and airlocks, for a reasonable time after an accident;

Establishing or restoring the ultimate heat sink to manage pressure and temperature in the containment;

Control of combustible gases, fission products and other materials released during a severe accident, including any necessary instrumentation;

Monitoring and control of containment leakages and of fission product releases;

Removing the produced heat from the molten core debris to an ultimate heat sink.

Instrumentation that is designed for the expected environmental conditions after a severe accident should be the preferred method of obtaining the necessary information.

Alternate instrumentation should be identified if the preferred instrumentation becomes unavailable or is not reliable.

Specification of the criteria that would indicate the onset of severe core damage;

Identification of the symptoms (i.e. parameters and their values) by which staff may determine the condition of the fuel and the state of protective barriers;

Identification of the challenges to fission product barriers in different reactor states, including shutdown states;

Evaluation of the timing of such challenges to improve the potential for successful human intervention;

Identification of the reactor systems and other material resources that may be used for severe accident management purposes;

Verification that accident management measures would be effective to counter challenges to protective barriers;

Evaluation of the performance of equipment and instrumentation under accident conditions;

Development and validation of computational aids for accident management.

Hydrogen production in the vessel and its release, as input information for the design of the hydrogen treatment system;

Retention of the molten core within the vessel both by internal and external vessel cooling;

The composition and configuration of the molten core and failure of the reactor pressure vessel as inputs to the design of the core catcher;

Reliable depressurization to allow low pressure water injection and avoid high pressure vessel failure;

Long term release of fission products from the reactor core.

Reliable depressurization of the containment to avoid high pressure containment failure;

Sources, distribution and the potential leak paths of combustible gases, as input information for the design of the combustible gas treatment system;

Issues relating to ex-vessel steam explosion, high pressure melt ejection and direct containment heating;

Composition and configuration of the molten core as inputs to the design of ex-vessel melt retention devices;

Fission product sources and the distribution of fission products within the containment, with special attention given to the long term behaviour of such sources.

The choice of symptoms for diagnosing and monitoring the course of accidents;

The identification of key challenges and vulnerable plant systems and barriers;

The specification of set points to initiate and exit individual strategies;

The positive and negative impacts of severe accident management actions;

The time windows available for performing the actions;

The prioritization and optimization of strategies;

The evaluation of the capability of systems to perform their intended functions;

The expected trends in the accident progression;

The exit conditions for leaving the severe accident management domain;

The development of computational aids.

INTERNATIONAL ATOMIC ENERGY AGENCY, IAEA Safety Glossary: Terminology Used in Nuclear Safety and Radiation Protection, 2018 Edition, IAEA, Vienna (in preparation).

EUROPEAN ATOMIC ENERGY COMMUNITY, FOOD AND AGRICULTURE ORGANIZATION OF THE UNITED NATIONS, INTERNATIONAL ATOMIC ENERGY AGENCY, INTERNATIONAL LABOUR ORGANIZATION, INTERNATIONAL MARITIME ORGANIZATION, OECD NUCLEAR ENERGY AGENCY, PAN AMERICAN HEALTH ORGANIZATION, UNITED NATIONS ENVIRONMENT PROGRAMME, WORLD HEALTH ORGANIZATION, Fundamental Safety Principles, IAEA Safety Standards Series No. SF-1, IAEA, Vienna (2006).

INTERNATIONAL ATOMIC ENERGY AGENCY, Safety of Nuclear Power Plants: Design, IAEA Safety Standards Series No. SSR-2/1 (Rev. 1), IAEA, Vienna (2016).

INTERNATIONAL NUCLEAR SAFETY ADVISORY GROUP, Defence in Depth in Nuclear Safety, INSAG-10, IAEA, Vienna (1996).

INTERNATIONAL NUCLEAR SAFETY ADVISORY GROUP, Basic Safety Principles for Nuclear Power Plants, 75-INSAG-3 (Rev. 1), INSAG-12, IAEA, Vienna (1999).

INTERNATIONAL ATOMIC ENERGY AGENCY, Safety of Nuclear Power Plants: Commissioning and Operation, IAEA Safety Standards Series No. SSR-2/2 (Rev. 1), IAEA, Vienna (2016).

FOOD AND AGRICULTURE ORGANIZATION OF THE UNITED NATIONS, INTERNATIONAL ATOMIC ENERGY AGENCY, INTERNATIONAL CIVIL AVIATION ORGANIZATION, INTERNATIONAL LABOUR ORGANIZATION, INTERNATIONAL MARITIME ORGANIZATION, INTERPOL, OECD NUCLEAR ENERGY AGENCY, PAN AMERICAN HEALTH ORGANIZATION, PREPARATORY COMMISSION FOR THE COMPREHENSIVE NUCLEAR-TEST-BAN TREATY ORGANIZATION, UNITED NATIONS ENVIRONMENT PROGRAMME, UNITED NATIONS OFFICE FOR THE COORDINATION OF HUMANITARIAN AFFAIRS, WORLD HEALTH ORGANIZATION, WORLD METEOROLOGICAL ORGANIZATION, Preparedness and Response for a Nuclear or Radiological Emergency, IAEA Safety Standards Series No. GSR Part 7, IAEA, Vienna (2015).

FOOD AND AGRICULTURE ORGANIZATION OF THE UNITED NATIONS, INTERNATIONAL ATOMIC ENERGY AGENCY, INTERNATIONAL LABOUR OFFICE, PAN AMERICAN HEALTH ORGANIZATION, WORLD HEALTH ORGANIZATION, Criteria for Use in Preparedness and Response for a Nuclear or Radiological Emergency, IAEA Safety Standards Series No. GSG-2, IAEA, Vienna (2011).

FOOD AND AGRICULTURE ORGANIZATION OF THE UNITED NATIONS, INTERNATIONAL ATOMIC ENERGY AGENCY, INTERNATIONAL LABOUR OFFICE, PAN AMERICAN HEALTH ORGANIZATION, UNITED NATIONS OFFICE FOR THE COORDINATION OF HUMANITARIAN AFFAIRS, WORLD HEALTH ORGANIZATION, Arrangements for Preparedness for a Nuclear or Radiological Emergency, IAEA Safety Standards Series No. GS-G-2.1, IAEA, Vienna (2007).

INTERNATIONAL ATOMIC ENERGY AGENCY, Safety Assessment for Facilities and Activities, IAEA Safety Standards Series No. GSR Part 4 (Rev. 1), IAEA, Vienna (2016).

INTERNATIONAL ATOMIC ENERGY AGENCY, Periodic Safety Review for Nuclear Power Plants, IAEA Safety Standards Series No. SSG-25, IAEA, Vienna (2013).

INTERNATIONAL ATOMIC ENERGY AGENCY, Deterministic Safety Analysis for Nuclear Power Plants, IAEA Safety Standards Series No. SSG-2 (Rev. 1), IAEA, Vienna (in preparation).

INTERNATIONAL ATOMIC ENERGY AGENCY, Predisposal Management of Radioactive Waste, IAEA Safety Standards Series No. GSR Part 5, IAEA, Vienna (2009).

INTERNATIONAL ATOMIC ENERGY AGENCY, Nuclear Security Recommendations on Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/Revision 5), IAEA Nuclear Security Series No. 13, IAEA, Vienna (2011).

INTERNATIONAL ATOMIC ENERGY AGENCY, Operational Limits and Conditions and Operating Procedures for Nuclear Power Plants, IAEA Safety Standards Series No. NS-G-2.2, IAEA, Vienna (2000).

INTERNATIONAL ATOMIC ENERGY AGENCY, Development and Review of Plant Specific Emergency Operating Procedures, Safety Reports Series No. 48, IAEA, Vienna (2006).

INTERNATIONAL ATOMIC ENERGY AGENCY, Implementation of Accident Management Programmes in Nuclear Power Plants, Safety Reports Series No. 32, IAEA, Vienna (2004).

INTERNATIONAL ATOMIC ENERGY AGENCY, Guidelines for the Review of Accident Management Programmes in Nuclear Power Plants, IAEA Services Series No. 9, IAEA, Vienna (2003).

INTERNATIONAL ATOMIC ENERGY AGENCY, Site Evaluation for Nuclear Installations, IAEA Safety Standards Series No. SSR-1, IAEA, Vienna (in preparation).

INTERNATIONAL ATOMIC ENERGY AGENCY, Experience in the Use of Systematic Approach to Training (SAT) for Nuclear Power Plant Personnel, IAEA-TECDOC-1057, IAEA, Vienna (1998).

INTERNATIONAL ATOMIC ENERGY AGENCY, Recruitment, Qualification and Training of Personnel for Nuclear Power Plants, IAEA Safety Standards Series No. NS-G-2.8, IAEA, Vienna (2002).

INTERNATIONAL ATOMIC ENERGY AGENCY, Leadership and Management for Safety, IAEA Safety Standards Series No. GSR Part 2, IAEA, Vienna (2016).

INTERNATIONAL ATOMIC ENERGY AGENCY, Development and Application of Level 1 Probabilistic Safety Assessment for Nuclear Power Plants, IAEA Safety Standards Series No. SSG-3, IAEA, Vienna (2010).

INTERNATIONAL ATOMIC ENERGY AGENCY, Development and Application of Level 2 Probabilistic Safety Assessment for Nuclear Power Plants, IAEA Safety Standards Series No. SSG-4, IAEA, Vienna (2010).

EUROPEAN COMMISSION, FOOD AND AGRICULTURE ORGANIZATION OF THE UNITED NATIONS, INTERNATIONAL ATOMIC ENERGY AGENCY, INTERNATIONAL LABOUR ORGANIZATION, OECD NUCLEAR ENERGY AGENCY, PAN AMERICAN HEALTH ORGANIZATION, UNITED NATIONS ENVIRONMENT PROGRAMME, WORLD HEALTH ORGANIZATION, Radiation Protection and Safety of Radiation Sources: International Basic Safety Standards, IAEA Safety Standards Series No. GSR Part 3, IAEA, Vienna (2014).

INTERNATIONAL ATOMIC ENERGY AGENCY, Application of the Management System for Facilities and Activities, IAEA Safety Standards Series No. GS-G-3.1, IAEA, Vienna (2006).

INTERNATIONAL ATOMIC ENERGY AGENCY, The Management System for Nuclear Installations, IAEA Safety Standards Series No. GS-G-3.5, IAEA, Vienna (2009).

INTERNATIONAL ATOMIC ENERGY AGENCY, Method for Developing Arrangements for Response to a Nuclear or Radiological Emergency, EPR-METHOD-2003, IAEA, Vienna (2003).

INTERNATIONAL ATOMIC ENERGY AGENCY, Approaches and Tools for Severe Accident Analysis for Nuclear Power Plants, Safety Reports Series No. 56, IAEA, Vienna (2008).

Immediate actions: The balance between the pros and cons of these actions has been made during the development of the programme, and it has been determined that they can be implemented without undue risk.

Delayed actions: These actions are evaluated by the crisis team while the accident is developing, and decisions have to be made after balancing the pros and cons of such actions. For each action that might be considered, the pros and cons are provided in the GIAG to enable the response teams to make an informed decision.

Using computational aids to support the diagnosis of the plant status and inform the decision making process and the prognosis for evolution of the accident.

Immediately opening all safety relief valves (if not already open)² to prevent failure of the reactor pressure vessel at high pressure and limit the risk of dispersal of debris in the upper parts of the containment (and potential subsequent direct containment heating in the case of failure of the reactor pressure vessel).

Limiting the risk of repressurization of the reactor coolant system above 20 bars, before vessel failure, through specific limitations on water injection into the reactor coolant system.

Limiting the risk of consequential steam generator tube rupture that would lead to containment bypass through immediate actions implemented when use of the GIAG commences, as follows:

Detecting failure of the reactor pressure vessel using temperature measurement in the reactor pit, with the potential for confirming the information by cross-checking other sources of information.

Injecting water into the core with the objective of limiting core degradation or cooling the molten core.

Activating the containment spray system to prevent overpressurization of the containment and to remove thermal energy from the containment atmosphere.³

Using passive autocatalytic recombiners to eliminate hydrogen from the containment atmosphere.

Heating the pipe situated between the intake of the sand bed filter inside the containment and the containment filter to prevent steam condensation in the tube and in the filter.⁴

Isolating radioactive steam generators;

Filling non-radioactive steam generators with water;

Depressurizing the reactor coolant system.

Installation of filtered containment venting;

Installation of passive autocatalytic recombiners on PWR units;

Implementation of containment inertization on boiling water reactor (BWR) units.

Diagnosis of the plant damage state;

Related strategies for mitigating the consequences of a severe accident;

Detailed sheets of instructions for all measures within the strategies;

Links to EOPs that are relevant to mitigatory strategies.

Core state A characterizes a low degradation level (the core still has a rod-like geometry).

Core state B characterizes ongoing core degradation up to failure of the reactor pressure vessel.

Core state C means the reactor pressure vessel has failed.

The containment is intact, and there is no obvious risk of losing containment integrity.

The integrity of the containment is challenged.

The containment is bypassed to the secondary side of the steam generators.

The containment is bypassed to the reactor building annulus.

The containment is bypassed to the nuclear auxiliary building, or the isolation of the containment has failed.

The containment has been impaired (leak or rupture).

Using computational aids to support the diagnosis of the plant damage state, the decision making process and the prognosis on the evolution of the accident, including the determination of the required flow for removing decay heat from the core.

Rapid depressurization (i.e. opening of all pressurizer valves) of the reactor coolant system to prevent high pressure core melt that could lead to failure of the reactor pressure vessel and subsequent transfer of core debris to the upper parts of the containment with a potential risk of direct containment heating. This action, however, would not prevent temporary repressurization of the reactor coolant system under some specific plant conditions.

Prevention of bypass sequences resulting from steam generator tube rupture that has occurred as a consequence of isolating, in advance, dry steam generators that would likely be impossible to feed during the accident.

Mitigating the effects of steam generator tube rupture through isolation of all failed steam generators or through the injection of water into failed non-isolated steam generators.

Monitoring parameters that enable confirmation that the reactor pressure vessel has not failed, determining a minimum grace period by deterministic analyses before failure of the reactor pressure vessel and identifying trending parameters that could enable characterization of the failure of the reactor pressure vessel. For cases in which the differentiation between different core states cannot be done using existing instrumentation only, alternate means (e.g. computational aids) can be used.

Injecting water into the reactor cavity (via the reactor coolant system) to prevent or limit basemat attack, and scrubbing fission products in case of failure of the reactor pressure vessel.

Using a flammability diagram to evaluate the risk of losing containment integrity in a situation involving flammable mixtures, and recommending tripping the containment heat removal systems when measurements indicate that the concentration of hydrogen inside the containment is nearing the flammability limit.

Inerting the filtered venting system to prevent its degradation.

All PWRs use computational aids, while BWR plants use technical support guidelines.

Graded depressurization is not considered, except in the most recent version of the BWR SAMGs, which mention slow depressurization as a means of allowing an injection system that uses a steam turbine (the reactor core isolation cooling system) to run as long as possible by using reactor steam.

Injection of water into the steam generators (the first priority for Westinghouse plants) or into the core (other PWR plants and BWR plants).

Injection of water into the reactor cavity (common to PWR and BWR plants).

Monitoring parameters that allow confirmation that the reactor pressure vessel has not failed (for Combustion Engineering and Babcock and Wilcox plants), and the use of logic diagrams to characterize vessel failure (Westinghouse plants have no such diagrams).

Use of a flammability diagram to evaluate the risk of losing containment integrity in situations involving flammable mixtures (used at all PWR plants, with various degrees of sophistication). For BWR plants, this issue is addressed in technical support guidelines. Hydrogen risk in venting system filters is not addressed, as filtering is not considered in these systems.

Common basic requirements for equipment to be used in severe accident management:

Preparation of procedures, implementation of drills and development of organizational systems: Appropriate organizational systems shall be established in advance by the formulation of procedures and the implementation of drills in order to manage beyond design basis accidents rapidly and flexibly.

Preparation of equipment and procedures for the following measures:

Capacity:

Environmental and load conditions: Equipment for use in severe accident management shall be designed to function as required, with sufficient reliability under environmental and load conditions, during postulated beyond design basis accidents.

Operability: Equipment for use in severe accident management shall be designed such that its operation is ensured under the conditions of postulated beyond design basis accidents.

Diversity:

Prevention of detrimental impacts: Equipment for use in severe accident management shall be installed so as not to cause any detrimental impact to other equipment.

Ease of changeover: Equipment and procedures shall be prepared so as to allow easy and reliable changeover from normal line configurations in the event that other equipment is to be used for severe accident management, different from its original use.

Reliable connections: Measures shall be taken to standardize connecting methods to ensure that mobile equipment and permanent equipment for severe accident management can be easily and reliably connected and that such equipment can be used interchangeably between systems and units. Furthermore, multiple connections shall be prepared with appropriate spatial dispersion to avoid disconnection due to common mode failure.

Seismic and tsunami resistance:

Storage locations: Stored mobile equipment for use in severe accident management shall be dispersed in different locations that are not easily impacted by external events (e.g. earthquakes, tsunamis). Mobile equipment for use in severe accident management shall be stored in different locations from permanent equipment for use in severe accident management.

On-site working conditions: The locations of equipment for use in severe accident management shall be selected in such a way that the installation, connection, operation and recovery of mobile equipment for use in severe accident management can be done even in the event of a postulated beyond design basis accident, for example by selecting a suitable place that would not be affected severely by the accident or by reinforcing the shielding performance.

Securing access routes: Access routes shall be designed and managed effectively so as to ensure the availability of access routes needed to transport mobile equipment for use in severe accident management or to inspect the damage of equipment under the postulated environmental conditions.

Prohibition of shared use: In principle, permanent equipment for use in severe accident management shall not be shared by more than two units. However, this rule shall not apply if risks can be reduced and no other detrimental impact is caused by sharing the equipment.

Equipment for use in severe accident management shall⁵ be designed to have sufficient capacity to cope with postulated beyond design basis accidents.

Mobile equipment for use in severe accident management shall be designed to have sufficient capacity with suitable margins, in accordance with the necessary equipment reliability, to cope with postulated beyond design basis accidents.

Permanent equipment for use in the preventive domain in severe accident management shall be designed such that diversity is considered as much as possible with respect to equipment for management of design basis accidents.

Mobile equipment for use in the preventive domain in severe accident management shall be as diverse as possible with respect to equipment for the management of design basis accidents and permanent equipment for use in the preventive domain of severe accident management.

Appropriate measures for equipment for use in the mitigatory domain in severe accident management (including piping, valves and electrical cables within the building, in addition to connections to mobile equipment for use in the mitigatory domain in severe accident management) shall be taken so as not to damage the necessary functions for withstanding standard ground motion and a standard tsunami.

Equipment for use in the preventive domain in severe accident management (including piping, valves and electrical cables within the building, in addition to connections to mobile equipment for use in the preventive domain in severe accident management) shall have equivalent seismic and tsunami resistance to the corresponding equipment for the management of design basis accidents.

Measures for reactor shutdown.

Measures for cooling the reactor at high pressure.

Measures for depressurizing reactor coolant pressure boundaries.

Measures for cooling the reactor at low pressure.

Measures for securing the ultimate heat sink for severe accident management.

Measures for cooling, depressurization and reduction of radioactive material in the atmosphere of the containment vessel.

Measures for preventing failure of the containment vessel due to overpressure.

Measures for cooling molten core fallen to the bottom of the reactor pressure vessel.

Measures for preventing hydrogen explosions inside the containment vessel.

Measures for preventing hydrogen explosions inside the reactor building and other locations.

Measures for cooling, shielding and maintaining the subcriticality of spent fuel storage pools.

Measures for securing make-up water and water sources.

Measures for securing power sources for the following:

Measures for suppressing off-site releases of radioactive material.

Control room;

Emergency response centre;

Instrumentation devices;

Radiation monitoring facilities;

Communications devices.

Accident management with mobile equipment:

Establishment of a specialized safety facility:

Procedures shall be prepared for the following activities and measures for situations in which the plant has suffered large scale damage due to a large scale natural or human induced external event.

Furthermore, organizational systems and the necessary equipment enabling these activities in accordance with the procedures shall be prepared.

Activities for extinguishing a large scale fire;

Measures for mitigating fuel damage;

Measures for mitigating failure of the containment vessel;

Measures for minimizing the release of radioactive material;

Measures for maintaining necessary water levels and measures to mitigate fuel damage in spent fuel storage pools.

The term ‘specialized safety facility’ refers to a facility with the function of suppressing a large release of radioactive material caused by failure of the containment vessel in the event of severe core damage or an almost damaged core as a result of a natural or human induced external event.

The specialized safety facility shall be installed in accordance with the following:

The specialized safety facility shall be equipped with adequate measures for preventing the loss of necessary functions due to the intentional crashing of a large airplane into the reactor building.

The specialized safety facility shall be equipped with adequate measures for preventing the loss of necessary functions due to design basis seismic motion and tsunamis.

The specialized safety facility shall be installed with the equipment required to prevent failure of the containment vessel.

Equipment shall be designed so as to allow use over a certain period of time.

An organization to maintain the functionality of the specialized safety facility shall be established.

Evaluation of the effectiveness of preventive measures against core damage and failure of the containment vessel:

Evaluation of the effectiveness of preventive measures against fuel damage in spent fuel storage pools.

Evaluation of the effectiveness of preventive measures against fuel damage in a reactor during shutdown.

The licensee has to postulate beyond design basis accidents that could cause severe core damage and prepare appropriate measures to prevent severe core damage.

The licensee has to postulate the failure modes of the containment vessel that could occur in conjunction with severe core damage and prepare appropriate measures to prevent failure of the containment vessel.