Chapter 7 Safety Evaluation of

Bwr Plants

1. Basic Policy for Safety Evaluation

1. Objectives of Safety Evaluation

The objectives of the safety evaluation of a NPP are roughly divided into two:

1. Confirmation of adequacy of the safety design

and

2. Confirmation of adequacy for distance of the surrounding public from the NPP when a significant accident occurs (suitability of siting).

The safety design with diverse protections has been done to provide multiple and complex barriers in order to prevent an excessive radiation hazard to the surrounding public of the NPP, in accordance with the basic policy of the defense in depth addressed in Section 1.4. Namely, at the NPP, multiplex barriers for preventing a release of fission product outside the plant are provided, such as fuel pellets, fuel claddings, the reactor coolant pressure boundary, the reactor containment, and the reactor building. To keep these barriers, diverse protection measures are considered in the safety design.

1. First level safety measures [occurrence prevention of an abnormal situation] Thoroughgoing measures at the stages of design, construction, and operation and maintenance of reactor facilities should be taken, so that an abnormal situation does not occur.

2. Second level safety measures [propagation prevention of an abnormal situation] Assuming a case where an abnormal condition arises in spite of the first level safety measures, detections and corrective measures (control rods insertion by reactor trip signal, etc.) should be provided so that a safety problem is not made.

3. Third level safety measures [mitigation of an

accident effect]

Furthermore, assuming a case resulting in an accident condition, mitigation measures (core cooling by ECCS, etc.) should be provided.

The safety analysis studies how the power plant, which is designed in accordance with the basic policy, responds to actual considerable external disturbances, malfunctions, or accidents, and reviews concretely the situations that develop. Based on the analysis results, the safety evaluation investigates the degree of integrity of barriers of radioactive materials including the nuclear fuel, reactor coolant pressure boundary, reactor containment, etc.. Furthermore, if damage to a barrier is judged possible, the safety evaluation is done to study aspects of a release of radioactive material and the degree of the impact on the general public. In other words, the adequacy of the concrete safety design of a NPP will be confirmed by the safety evaluation.

On the other hand, for the purpose of judging the suitability of NPP siting and the adequacy of its separation from the surrounding public, the impact on the surrounding public is evaluated by comparisons with reference levels of radiation exposure, assuming an accident resulting in a significant release of radioactive material independent of actual accident development. This assumption of an accident is based on the "Review Guide for Nuclear Reactor Siting and Reference Criteria Concerning Its Application". An accident is classified as a "major accident" which happens in the worst case from a technical viewpoint and a "hypothetical accident" which exceeds the "major accident" and cannot be considered to happen from a technical viewpoint.

2. Method of Safety Evaluation (1) Guides and their basic philosophy

There are two guides in Japan for the safety evaluation. They are the “Review Guide for Safety

Chapter 7

7- 1

NSRA, Japan

to the nuclear fuel and the reactor coolant pressure boundary and can be ignored from the viewpoint of radiation impact. On the other hand, although its occurrence frequency is low, an "accident" is an event which carries a risk that some of these multiple barriers may break and has a potential for radioactive material release. Making these classifications is reasonable; for an event of high frequency occurrence a design to ensure that the radioactive materials may not be discharged outside the plant is necessary and for the more severe event of low frequency occurrence a design such that radioactive materials may not be discharged is unnecessary.

Therefore, for "anticipated operational occurrences," as provided in the criteria shown in Table 7.1.1, an integrity impairment of barriers to a release of radioactive materials is severely restricted. On the other hand, for "accidents", the concept of a risk is introduced in order to take into consideration a balance between the exposure and the occurrence frequency, and criteria for adequacy of the barriers are set as "there is no significant risk of radiation exposure to the surrounding public."

As an example, the ICRP 1990 Recommendations provide that, if the average dose of five years does not exceed 1 mSv per year, the dosage which exceeds a single year limit may be permitted under a special condition. Then, 5 mSv per accident, five times the effective dose limit 1 mSv per year, is set as the target*¹.

3. For the siting of a reactor facility, the evaluation is performed assuming "major accidents" and "hypothetical accidents" in order to determine the appropriateness of separation from the surrounding public in relation with the engineered safety features system. The criteria are set according to the "reference levels of radiation doses".

For the siting evaluation, the release quantity of radioactive materials is decided regardless of some safety features of a nuclear reactor. However, if no safety features are assumed to

⁽*¹⁵ For accidents with very low frequency of occurrence, applying this value is not necessarily required.

NSRA, Japan

7-2

function, the siting is irrationally determined only by the reactor power. The minimum required separation distance should change with the fundamental structure, the reactor power, safety features, etc. of the nuclear reactor. Therefore, some safety features such as the containment vessel, the standby gas treatment system, etc. are allowed to be considered in the evaluation.

(2) Safety analysis

In order to perform the safety evaluation in accordance with the viewpoint of the guides described above, the events leading to "anticipated operational occurrences" and "accidents" (initiating events) should be defined and the detailed behaviors of a nuclear power plant should be analyzed. The safety analysis is performed following the procedures and assumptions described below.

1. Selection of initiating events

Although there are many initiating events that lead to abnormal situations of a plant and many plant conditions during these situations, they are distinguished according to the nature of their impacts to the nuclear reactor, (for example, a reactivity insertion event, an over-pressurization event, a loss of coolant event, etc.) and the most typical event is selected to include other events of the same nature.

As the initiating events for "anticipated operational occurrences", a single malfunction or inadvertent actuation of components and a single erroneous action are considered. Specifically, a total of 12 example events from three different categories of the nature of the impact of the "anticipated operational occurrences" are analyzed for BWRs as described in Section 7.2. The initiating events for "accidents" are considered very rare technical occurrences, and a total of 12 example events from four different categories of the nature of their impact are analyzed for BWRs as shown in Section 7.3.

As events used for the siting evaluation, the possible accidents that could escalate to release of radioactive materials are selected from the "accidents". The events are selected in such a way that the radioactive materials are discharged inside and also outside the containment

2. Setup of analytical conditions

After initiating events are selected for evaluation, analytical conditions are set up so that the external disturbance from each initiating event can become large. For example, in evaluating an "abnormal withdrawal of control rods during reactor startup" for a BWR, by assuming that in a critical reactor core one control rod of the maximum worth permitted by the control rod worth minimizer is continuously withdrawn at the maximum mechanically possible velocity, similar events can be covered.

Moreover, concerning parameters that change with the fuel burnup like void coefficients, the safety-side values are used to cover the values which change during a cycle or among cycles.

Also those operation parameters are used that gives the severest evaluation results. For example, when the integrity of reactor coolant pressure boundaries is focused on, larger values of reactor pressure are used with consideration of inaccuracies etc..

A similar approach is used in safety analysis. Actually, it is usual to set up safety-side assumptions disregarding certain measures that could mitigate the consequences of an accident.

Thus, since safety analyses are always based on the safety-side conditions or assumptions, the analyses give severer results than the actual consequences that could be given by the same initiating event naturally. Although this approach is required as a matter of course in evaluation of reactor safety, there are some differences with the actual behaviors of nuclear reactors. It is necessary to recognize this point fully in the descriptions of event analyses provided after Section 7.2.

3. Assumption of a single failure

The safety analyses are performed assuming a single failure in the systems and components required to cope with an "accident." The component with the single failure is selected based on which malfunction of the component gives the severest result. This single failure assumption is required for each fundamental safety function such as reactor shutdown, core cooling and confinement of radioactive materials.

For example, in the analysis of a large break accident of the "loss of reactor coolant", a single

7-3

NSRA, Japan