CHAPTER 4: Introduction to Accident Management

Principles of accident management

Introduction

Each NPP has a set of operating procedures that apply comprehensively for normal operation, anticipated operational occurrences and accident conditions. These procedures are an important component of the defence-in-depth concept. See IAEA SSR 2/2, Rev. 1, Req. 19 Read more →

Procedures for anticipated operational occurrences (AOOs) include Alarm Response Procedures (ARPs) in case of simple AOOs (malfunctions), as well as Abnormal Operational Procedure (AOPs), for more complex AOOs (typically events impacting the operation of more than one system or component). Both ARPs and AOPs belong to the defence-in-depth level 2.

Procedures for accidents are often called Emergency Operating Procedures (EOPs). EOPs are limited to DBA but may extend to events beyond the design basis, such as Anticipated Transient without Scram (ATWS), also called ´Anticipated Transient Without Trip` (ATWT), and Station Black-Out (SBO). EOPs, hence, cover all events with no or limited fuel damage; severe fuel damage events are mitigated by SAMG. EOPs belong to the defence-in-depth level 3, with – often - an extension into level 4. Note: Limited fuel damage is often allowed for DBA, e.g. ECCS fuel clad criteria of 1200 ºC and 17% oxidation allow rupture of the cladding and, hence, some release of fission products.

For DECs with fuel damage, a specific set of procedures is developed, usually in the form of guidelines rather than procedures, as they contain flexibility to deviate from the indicated path, due to the large uncertainties involved in the possible evolution of a severe accident and the limited insights in its evolution, due to failure of instrumentation. The guidelines are often named 'Severe Accident Management Guidelines' (SAMG), but other names exist as well (mentioned in sec. 3.2). In the subsequent section, the main principles will be discussed. Further elaboration is in Module 3, after the phenomena of severe accidents have been described in Module 2. SAMG belong to the defence-in-depth level 4. See IAEA SSR 2/2, rev. 1, Req. 26 Read more → and SRS 48, Chapter 1, Introduction. Read more →

Some DECs with extensive core damage may be caused by extreme external events, which may have resulted in extensive site damage, e.g. caused by large explosions or tsunamis, which may include loss of control room, emergency shutdown room, and loss of the normal command and control organisation (staff wounded or killed). Some plants have procedures to also deal with such events. They include local manual actions, the use of portable equipment and support by off-site organisations. Such guidelines are often called 'Extensive Damage Mitigation Guidelines' (EDMG). They are initiated upon extensive site damage, irrespective of the core/ spent fuel status. EDMG are outside the scope of the SAMG-D Toolkit, but can be studied by interested readers in NEI 06-12, rev.2. Read more →

ARPs usually cover the events up to reactor scram and/or start of ECCS, at reactor scram or ECCS starts the EOPs are initiated, up to core/fuel damage. Then SAMG are initiated.

Definitions

Accident management is the taking of a set of actions during the evolution of an accident:

(a) To prevent the escalation of the event into a severe accident;
(b) To mitigate the consequences of a severe accident;
(c) To achieve a long term safe stable state.

The second aspect of accident management (to mitigate the consequences of a severe accident) is also termed severe accident management. It contains a subset of actions:

• Maintaining the integrity of the remaining fission product barriers, particularly the containment, which depending on the design can also include maintaining the integrity of the reactor pressure vessel;
• Avoiding or limiting fission product releases to the environment;
• Returning, to the extent possible, to a long term safe stable state.

For Candu reactors, the equivalent objective is to maintain the integrity of the pressure tubes and calandria tubes.

See SSG-54, para 1.7b Read more →

Note: to achieve a long stable state is also considered to be a long-term action and, hence, a post-SAMG action.

Concept of an A/M programme

An overview of the elements of a full SAM programme is presented in Figure 1-6.


Figure 1-6: Elements of a full SAM programme (example from Canada for CANDU).

For each plant, an accident management programme up to and including SAMG should be developed, irrespective of the calculated total core /spent fuel damage frequency and fission product release frequency. Special hardware provisions to mitigate severe accidents, which some plants have, may make SAMG development easier, but never replace it, as also dedicated severe accident mitigation features may fail – no structure, system or component is immune to failure.

Development of AOOs, ARPs and EOPs is outside the scope of the SAMG-D Toolkit. In order to well understand the transition from EOPs to SAMG, a short description of EOPs is given in sec. 3.3 of this Module. For EOPs, a useful IAEA Technical Report exists. See SRS-48 Read more →

SAMG should be developed as a structured top-down approach, beginning with the objectives of severe accident management. In order to meet these objectives strategies are searched for and defined, based on suitable methods and measures. These then are transformed into plant specific procedures and guidelines. The procedures/guidelines cover both the preventive (EOP) and mitigative (SAMG) domains. The process is further detailed in the next section.