The strategies and measures discussed in the previous section should be converted into guidelines for the mitigatory domain, i.e. to the severe accident management guidelines (SAMG).
Each of the guidelines should have most or all of the following elements:
- Objectives and strategies;
- Initiation criteria;
- The time window within which the actions are to be applied (if relevant);
- The possible duration of actions (if relevant);
- The equipment and resources required (e.g. AC and DC power, water, pumps, valves);
- Actions to be carried out;
- Cautions; potential negative consequences of actions;
- Throttling and termination criteria;
- Monitoring of plant response.
Note that the guidelines should not require an understanding of the underlying scenario. Insights in the plant damage condition (see Module 2) may be helpful in selecting proper strategies.
Further guidance on developing the guidelines can be found in SSG-54, paragraphs 3.30 to 3.60.
Instrumentation
The SAMGs should contain a list of the instruments, whose reading is needed to start the related SAMG action. The range of validity of the measurements should be indicated, their deviation under harsh environmental conditions and their failure mode (e.g. off-scale high, low). The guidance should indicate how to obtain key plant parameters under the absence of AC and/or DC as well as to provide alternative or indirect means to determine such parameters, or their reasonable estimates (e.g. determination of the RCS pressure based on the discharge pressure of the ECCS pumps).
Negative consequences
Each guideline should contain a list of potential negative consequences of proposed actions, where possible, in a quantitative sense, together with any special measures or limitations that may be taken when implementing the strategy to minimize the likelihood or impact of potential negative consequences.
Transition from EOP to SAMG
If an accident progresses to the situation where fuel damage is imminent or ongoing (in the core or in the SFP), clear and concise criteria should be provided for transiting from the EOPs to the SAMGs. These can be parameter values or other criteria if they relate to these; for example, the simultaneous loss of a number of critical safety functions. In other words, criteria must be defined, which, upon exceeding a certain threshold level, will unambiguously lead the operator to enter the SAMGs. However, there are no unique indicators for imminent or ongoing core/SFP fuel damage, they should be defined on the plant-specific basis.
Note that, depending on the SAM approach adopted, this may or may not be a decision based on a single observation by a control room operators only, as the consequences from fuel damage and the transitioning to the SAMGs may be extremely large, including the fact that the plant may no longer, in the worst case, be considered viable to operate. Such consequences could include:
- Exposure to potentially significant radioactive releases resulting in the need to put in place measures to protect the plant workers and the public;
- Contamination of the environment with potentially long-term restrictions for living, transport and agriculture, which will result in the need for large-scale decontamination efforts, possibly including the treatment of large masses of contaminated cooling water.
As the consequences are on a large scale, decision making during severe accident management is often placed at a higher level of authority, for example with the head of the Emergency Response Organisation (ERO), the Site Emergency Director (SED), or the plant manager (assuming he/she is not already the SED). Note: organisational issues associated with the transition EOP-SAMG are treated in Module 4. Where the organisation is adapted to mitigate the accident, proper guidance should be in place for the transition time.
Consequently, the transition criteria must be defined very well and must be clearly visible in the EOPs.
On the other side, precision of the criteria should not be "overdone": progressing core damage will rapidly lead to alarms and warnings of various sorts (e.g., high temperatures, hydrogen appearing, containment radiation, Safety Relief Valve (SRV) tail pipe temperatures, etc.), which may even outpace a balanced and appropriate human response, as shown in Ref. [1].
Examples of the transition criteria are:
• Exceeding of a predefined core exit thermocouple indication and failure of the associated mitigation actions in the most ultimate EOPs1; range is often 550 - 650 °C;
• High-level radiation in the containment (e.g. 10 Sv/h) or the appearance of a high hydrogen concentration in the containment (e.g. > 0.1 vol%)2;
• Sustained existence of superheat in the core, core conditions outside pre-calculated p – T graphs of adequate core cooling (p is RCS pressure, T is measured at in-core thermocouple; at full RCS pressure this is e.g. 980 °C) and TSC staffed3;
• The need to flood the RPV together with loss of the ability to do so4;
• RPV level below lowest acceptable level, and/or indications that core damage is occurring (H2, radiation, steam temperature, containment pressure, secondary containment radiation)5;
• High core exit temperature (e.g. 1100 °C) and containment radiation level above a pre-defined values (e.g. 5.0E+5 rad/hr)6, which indicates loss of at least two fission product boundaries, notably the fuel cladding and the RCS; note that such level may also appear outside the containment if the containment is not closed or sufficiently leak-tight;
• Containment hydrogen concentration above a pre-defined value (which indicates overheating of the core);
• For CANDU PHWRs: no subcooling margin in inlet headers – loss of core cooling, see also TECDOC-1594;
• For CANDU PHWRs: moderator level below highest channels.
Note that these examples stem from various operating plants, but for each practical application it must be noted that transition criteria are strictly plant unique and must be specified and motivated by a plant specific analysis.
See also paper 6.1 of the ISAMM 2009 conference.
Note that the definition of the transition point between EOPs and SAMG is made more complex in the CANDU PHWR SAMG, because progression to a severe accident involves fuel channel failures and core disassembly potentially occurring before temperatures in the channel reach the values required to create the conditions of concern. Single fuel channel failures are not by itself sufficient grounds to transit to SAMG. Hence, the transition requires a combination of conditions.
Note also that for shutdown conditions other criteria may apply, as the RPV may be open, as also the containment may be open.
And note also that Emergency Action Levels (EALs) are to be monitored at the same time and may give rise to response (including transition EOP-SAMG).
Usually, the transition includes termination of the EOPs, as these have been developed for an intact core with no or limited fuel damage (note that fuel cladding which is heated and oxidised to the usual ECCS criteria of maximum 1204 °C cladding temperature and maximum 17% cladding oxidation shows ballooning and rupture, i.e. limited fuel damage). That is, upon entrance into SAMG the EOPs are exited. Some approaches, however, allow concurrent execution of EOPs and SAMG, with a clearly defined priority for SAMG, if planned actions could lead to competing use of resources. In addition, some actions started in EOP-domain, can produce negative consequences in SAMG-domain. For example, a containment spray system may de-inert an initially inert containment atmosphere (where steam has inhibited a hydrogen combustion) and so initiate a hydrogen burn. ´Rules of Usage` (or similar other name) determine such concurrent actions (more detail in Module 3, sec. 8).
After the EOP-domain has been left, automatic starts of EOP-related equipment should be prevented, as no equipment should start unless it is compatible with SAMG actions and in agreement with the revised decision making. In principle, in SAMG-domain no equipment should operate without TSC approval; this, hence, includes equipment that may have started automatically in EOP-domain. This does of course not mean that operating equipment should be stopped at the transition, but that an evaluation should be made which equipment can be left running and which equipment can not. Preferably, this is done beforehand, e.g. in ´Rules of Usage` (or similar other wording) but, if such guidance is not available or not applicable, by the TSC at a proper time.
Shaping the guidelines
Guidelines should be shaped such that their execution is within the capabilities of the staff to handle them. They should neither be too general, not too detailed. Drills/exercises can help determine the optimum shape. It is recommended to formulate the actual guidelines with the help of operating personnel, so that there is no misunderstanding on what actually is needed to properly execute the guidelines. Proper wording and other information on how to format a procedure/guideline can be obtained from "Writer's Guide", so that all text is consistent and does not depend on the individual writer or writers. Useful information on such Writers Guides is contained in IAEA TECDOC 1058 Read more,
INPO 82-017, INPO 09-004, GNP 3.2.1 of Wisconsin Public Services.
Examples are available for:
- PWR: via www.inpo.info; see also GNP 3.2.1 of Wisconsin Public Services for a PWR;
- PHWR, CANDU design:
• CSA N286-12, Management system requirements for Nuclear Power Plants, Clauses 1.4, 4.7.3, 4.7.4, 4.8.3, 4.10, 7.9.1, 7.9.3, 7.9.4 (a, b), 7.9.5 (a, b, c), and 7.9.6, 7.9.7, 7.9.8;
• American Institute of Chemical Engineers: Guidelines for Writing Effective Operating and Maintenance Procedures, New York, Centre for Chemical Process Safety, 1996;
• Nuclear Energy Institute’s NEI AP 907 005, Procedure Writer’s Manual, Rev.2.
Endnotes
1 Westinghouse plants, many VVERs, Chinese and Korean plants [2];
2 Siemens/Areva/Framatome plant in Switzerland [2];
3 Approach by Babcock & Wilcox NPPs, which has been kept after their transition to the PWROG SAMG [3];
4 BWROG approach [4];
5 BWROG approach [4], see also application in Mexico, post-Fukushima, [5];
6 For EdF [6].
References
[1] Operational Aspects on Decision Making on Transit Criteria to SAMG, Summary by Ken Stenman, Oskarshamn NPP, at the IAEA Technical Meeting on Current Practices in the Transition from Emergency Operating Procedures to Severe Accident Management Guidelines, IAEA, Vienna, Austria, 27-30 August 2019.
[2] Review of Current Severe Accident Management (SAM) Approaches for Nuclear Power Plants in Europe, S. Hermsmeyer (JRC), R. Iglesias, L.E. Herranz (CIEMAT), B. Reer (ENSI), M. Sonnenkalb (GRS), et al., EU Joint Research Centre, Petten, Netherlands, 2014-2020.
[3] Severe Accident Management: Babcock & Wilcox Owners Group, Howard Crawford, Three Mile Island Nuclear Station, ANS International Topical Meeting on Safety of Operating Reactors, October 13, 1998.
[4] Severe Accident Management Strategies used in US BWRs, Roy Harter, RLH Global Services, lecture in IAEA SAMG-D Toolkit course, IAEA, Vienna, 2018.
[5] Laguna Verde BWR/5, Organizational and Procedural Approach for EOP to SAMG Transition, Manuel González-Cuesta, Laguna Verde NPP, México, IAEA Technical Meeting on Current Practices in the Transition from Emergency Operating Procedures to Severe Accident Management Guidelines, IAEA, Vienna, Austria, 27-30 August 2019.
[6] EdF´s Experience in the Implementation of Severe Accident Management Provisions, G. Servière, EdF, OECD Specialist Meeting on Severe Accident Management Implementation, (p. 201ff / 584 of Proceedings), Niantic, CT, USA, June 1995.
|