Chapter 8 Safety Evaluation of

Pwr Plants

1. Basic Principles for Safety Evaluation

1. Purposes of Safety Evaluation

The two main purposes of safety evaluation of nuclear power plants are to confirm:

(D the pertinence of the safety design; and

(D the implementation of the necessary distance features of the plant from the general public (i.e. the suitability of site conditions) at the occurrence of an extremely rare serious accident

Safety design of NPPs is carried out on the basic principle set forth previously in section 1.4 of Chapter 1. NPPs are provided with multiple barriers of fuel pellets, fuel cladding tubes, the reactor coolant pressure boundary, the reactor containment vessel, etc. to preclude release of radioactive materials outside the plant. Safety design uses the defense-in-depth philosophy to maintain the integrity of the barriers (the containment vessel is provided as part of defense in-depth).

CD First-level safety measures [prevention of occurrence of abnormal conditions]

This involves devising measures as far as possible to ensure that no abnormal conditions occur at any stage of design, construction, operation and maintenance of nuclear reactor facilities.

2. Second-level safety measures [prevention of expanding abnormal conditions]

This involves detecting and correcting abnormal conditions (e.g. insertion of control rods by a reactor trip signal, etc.) before any safety problem is incurred, assuming occurrences of abnormal conditions in spite of the first-level safety measures.

2. Third-level safety measures [mitigation of the consequences of an accident]

This involves providing mitigating measures (e.g. cooling of reactor core by ECCS) assuming

that the situation develops into an accident condition.

Safety analysis is carried out to analyze in detail how the reactor plant responds to disturbances or failures that are anticipated to actually occur or that are very rare accidents, and what situations can be incurred. On the basis of such analysis, safety is evaluated to analyze the degree of integrity of the barriers against radioactive materials (fuel, reactor coolant pressure boundary, reactor containment vessel, etc.). If it is decided that the barriers may fail causing radioactive material release, degree of impact on the general public is evaluated. In other words, safety evaluation is a means to ascertain specifically the pertinence of safety design of NPPs.

For the purpose of judging the pertinence of the NPP site, assuming a large scale release of radioactive materials without postulating any specific accident progression, evaluations are made in comparison with the reference dose of the sufficiency of site isolation from the general public and the impact on general public in the vicinity of the plant. Accidents are postulated based on the “Review Guide for Nuclear Reactor Siting and Reference Criteria Concerning its Application” (hereafter called the “Guide for Siting of Nuclear Reactors”.)” and are classified into two categories: “major accidents,” i.e. accidents that from a technical viewpoint might occur in the worst case, and "hypothetical accidents,” i.e. accidents that are even worse than “major accidents” and unlikely to occur from a technical viewpoint

2. Methodology for Safety Evaluation

(1) Guidelines and basic principles

There are two guides for safety evaluation of NPPs in Japan: “Guide for Safety Evaluation of Light Water Nuclear Power Reactor Facilities” (hereafter called “Guide for Safety Evaluation)” and the “Guide for Siting of Nuclear Reactors”. According to these

Chapter 8

8- 1

NSRA, Japan

frequency, but have the potential for causing damage to some of the multiple barriers and for releasing radioactive materials. These categorizations are based on two premises: that the design should be such that radioactive materials are never released outside the plant for an event with high frequency of occurrence; and that it is irrational for the design to prohibit release of radioactive materials outside the plant for a serious event with a very low frequency of occurrence.

As indicated in Table 7.1.1, the acceptance criteria set forth stringently restrict any damage to the integrity of the barriers against release of radioactive materials at “abnormal transients during operation.” For the “accident,” on the other hand, the concept of risk is introduced, and “risks of significant radiation exposure should not be incurred to general public in the vicinity of the power plant” has been adopted as the criterion for judging the pertinence of proposed barriers.

As an illustration, the effective dose of 5mSv⁺¹ a year is adopted as one of the acceptance criteria for “accidents” in the “Guide for Safety Evaluation,” referring to the 1990 recommendation by the International Committee of Radiation Protection (ICRP). The ICRP recommendation states that in special circumstances, a higher value of effective dose could be allowed in a single year, provided the average over 5 years does not exceed ImSv per year. *¹

3. At the time of siting of nuclear reactor facilities, “major accidents” and “hypothetical accidents” are assumed and evaluated as a yardstick for judgment of whether or not isolation from the general public is adequate in connection with the engineered safety features of the facilities. That judgment criterion is "reference dose.”

For the purpose of the site evaluation, the amount of radioactivity released from the core is stipulated regardless of the engineered safety features. However, if it were assumed that none of the engineered safety features functioned properly, siting would be determined merely from the power

⁽*¹⁵ It is not necessarily required to apply this value to accidents whose frequency of occurrence is extremely low.

NSRA, Japan

8-2

output of the nuclear reactor which is irrational. The minimal distance required for isolation ought to vary according to the basic structure, output, engineered safety features, etc. of the reactor plant, and hence the containment vessel and annulus clean-up system, etc. in the engineered safety features are included in the evaluation.

(2) Safety analysis

In order to carry out the safety evaluation in accordance with the concept of the above safety guides, it is necessary to analyze the specific operational behaviors of the plant by postulating the initiating events of "abnormal transients during operation" and “accidents." Such safety analysis is carried out on the basis of the following procedures and assumptions.

1. Selection of the initiating events

There are innumerable possible initiating events that could bring about abnormal conditions in the plant and innumerable possible states of the plant at that time, but if the events are classified into different categories according to their effects on the nuclear reactor (e.g. heat-up and cool-down events) and if the most representative event is selected in each category, it is possible to covers all events of the same nature.

The initiating events of "abnormal transients during operation" are a failure or a malfunction of a single components or a single operation error. Specifically, as discussed in Section 8.2 later, a total of 14 events in three different categories are analyzed as "abnormal transients during operation” for PWR plants. Initiating events of "accidents" are regarded as being extremely rare from a technical viewpoint as described in Section 8.3. For PWR plants, a total of 13 initiating events in four different categories are analyzed as “accidents".

For siting evaluation, accidents that could result in large release of radioactive materials either inside or outside the containment vessel are selected as "accidents.”

2. Analytical conditions

Once initiating events to be evaluated are selected, the analytical conditions are set so that the disturbance due to the initiating event becomes large. For example, in the analysis

of “inadvertent depressurization in secondary cooling system" for a PWR plant, a valve with the largest depressurization effect in the secondary cooling system is assumed to fail so that all other similar events are included. Furthermore, the values of parameters such as moderator temperature coefficient which changes with fuel burnup are assumed conservatively so as to cover all possible conditions during core cycle operations.

The values of operating parameters are also assumed similarly so as to make the evaluation results more severe. However, even for the same event different assumptions may be employed for some of the initial values according to the criteria applied. For example, when the integrity of reactor coolant pressure boundary is evaluated, a higher initial value of the primary cooling system pressure is assumed considering the errors, etc., and when fuel center temperature and enthalpy are evaluated, a lower value is selected.

The same holds in the analysis process. It is usual to make assumptions on the conservative side by ignoring some measures that are employed in reality to mitigate the consequences of an accident. Since safety analysis is thus consistently based on conservative assumptions, the results of the analysis are, of course, more severe than in any situation that can be expected to actually occur from the same initiating event. That is, of course, necessary in examination of the safety of nuclear reactors, but differences exist somewhat from its actual behavior. That should be correctly understood in the explanation of events in safety analysis in Section 8.2 and subsequent sections.

3. Assumption of single failure

Safety analysis is done assuming a single failure in the systems and components*³ necessary for coping with an "accident." The single failure is selected by examining which failure may result in the most severe consequences. The assumption of single failure is required for each of the basic safety functions: nuclear reactor

⁽*²⁾ Specifically, these are the emergency core cooling system, the reactor shutdown system, the containment vessel spray system, and the annulus clean-up system.

8-3

NSRA, Japan