Use of all systems
A NPP has many safety systems, which have been designed to mitigate DBAs. An example is the ECCS, designed to mitigate Large Break LOCA. To mitigate accidents beyond the design basis, called Design Extension Conditions BDBA, now called Design Extension Conditions (DEC), usually no dedicated systems have been designed for presently operating plants unless specific severe accident mitigation systems have been designed and back-fitted. To mitigate these accidents, full use should be made of all systems a NPP has, irrespective of their qualification and/or classification. Systems may even be used beyond their design limitations, and resulting damage to these systems is not considered to be not acceptable. For example, restarting an idle RCP in order to sweep loop seal water through the core may damage the pump.
Note: as many components have protective circuitry, such use of equipment outside its design limitations may need a de-activation of this circuitry. Such de-activation should be described in procedures and trained for actual application.
This is part of the search for plant capabilities in SSG-54 (paras. 3.13 to 3.19 ) Read more →
''All plant capabilities available to fulfil and support the plant's fundamental safety functions should be identified and characterized. This should include a review of the on-site consumable resources for the plant that would be required to support safety systems, as well as the use of non-dedicated systems and unconventional or alternative line-ups or hook-up connections for non-permanent equipment located on the site or brought in from off the site.''
Such temporary connections include the use of portable equipment. Use of such equipment includes the presence of contact points where it can be hooked on plant systems, transport means and consideration of the time needed to transport it to the plant and, in case of off-site equipment, also to transport it to the site. Regular training is needed to verify all elements of the use of portable equipment, in addition to regular maintenance of all equipment involved.
It should also be considered whether failed systems can be restored to service and, hence, can again contribute to the mitigation of the event.
Survivability of equipment
While developing the guidelines, the developers should check the survivability of the needed equipment, including instrumentation, as it may be damaged by elevated temperature, pressure, humidity and/or radiation. Where equipment failures can be or must be expected, alternate ways to execute the strategy concerned should be sought. As discussed, this could include the use of on-site and/or off-site portable equipment.
For all local actions on equipment (such as operating valves, pumps), it should be checked whether the equipment is accessible in view of environmental conditions.
Hardware changes
Most operating plants have not been designed against severe accidents. Hence, it may be useful to add dedicated equipment for mitigation of such accidents. For example, in order to mitigate hydrogen risk, one could install igniters or passive autocatalytic recombiners. To vent the containment, an appropriate filter could be installed, to reduce releases. Or dedicated systems may be added to flood the cavity (PWR) or drywell (BWR) to prevent, delay or mitigate core-concrete interaction.
A number of plants have built bunkered decay heat removal systems, to provide additional power and cooling water. Although not designed to mitigate severe accidents, such systems can also be helpful under severe accident circumstances.
Hardware changes can be costly modifications. The decision to include those will depend on both the costs and the expected benefit of the modifications. They should notably be considered if otherwise no meaningful SAMG can be developed. But they are no prerequisite: SAMG should always be developed, irrespective of the plant's selected hardware configuration (modified or not modified).
A note may be added here: keeping in mind in the risk curve (probability or frequency versus consequences) presented in the Figure 3.2, usually much effort is placed on the probability side, i.e. one tries to lower the frequency of damaging events for a threated event with a given probability and consequence:
• purely preventive measures aim at reducing the probability of that event, without reducing the consequences;
• purely mitigative measures aim at reducing the consequences, without reducing the probability of occurrence.
Hence, a balanced reduction of risk requires at the same time measures to reduce the consequences (mitigation) and measures to reduce the probability (prevention).

Figure 3-2: Risk curve and preventive against mitigative measures.
A PSA level 2 analysis provides a useful way to address and evaluate both these aspects of release risk reduction.
SAMG irrespective of plant configuration
Developing SAMG should include failure of mitigative systems, even dedicated ones and/or added hardware, as long as such SAMG can be developed.
For example, if hydrogen is mitigated by igniters or by passive autocatalytic recombiners, still guidance should be developed for the case that the igniters / passive autocatalytic recombiners fail (e.g. a seismic after-shock may have ripped the igniters / passive autocatalytic recombiners from the walls). Now a distinction can be made: the default severe accident guidelines assume the hydrogen mitigation measures are functional, whereas an 'emergency' guideline is available for the case the dedicated hydrogen mitigation does not function.
|