KUDANKULAM REACTORS VIOLATES SAFETY ON SITING CRITERIA

 Kudankulam’s lurking dangers
While the prime minister (PM) accuses NGOs funded from abroad of trying to sabotage the ‘state-of-the-art’ Kudankulam nuclear power plant (KKNPP), various studies carried out by government agencies as well as experts suggest that the site is unsafe for a nuclear project.
The studies reveal potential threats to the nuclear reactor campus from near-shore tsunami, volcanic eruptions, and Karst (vulnerable landscape). DNA has a copy of the reports submitted by the agencies and experts.
A 15-member expert group set up by the Centre cleared the project. “The Kudankulam site is located far off (about 1,500km) from the tsunamigenic fault [where tsunamis originate]. Thus a tsunami would take time and lose some of its energy by the time it strikes Kudankulam,” according to the group’s official document.
However, a 1982 study reported in a noted journal documents the presence of two slumps — the East Comorin and Colombo — in the vicinity of the site. A ‘slump’ is a massive agglomeration of loosely-bound sediment on the sea bed that may suffer large submarine landslides, causing mega-tsunamis.
The expert group’s first report failed to identify the presence of a slump that is about 100km from the plant. After activists brought it to the group’s notice, its second report noted the presence of the slumps and the possibility of a near-field tsunami.
“This is against their earlier position and to that of the Atomic Energy Regulatory Board (AERB) which said near-field tsunamis are not possible at the KNPP site,” People’s Movement Against Nuclear Energy (PMANE) functionary M Pushparayan said.
“It is suggested that large submarine landslides can generate a tsunami and may cause coastal hazard. An attempt has been made to quantify the amount of possible water displacement from the above slump belts in the Gulf of Mannar that may occur during a worst case scenario,” the expert group’s second report said. However, it added that the amount of water displacement will be too small to produce a serious tsunami.
A tsunami hazard study for all reactors on the coast was conducted across the world after the Fukushima disaster in Japan in March 2011. One such study has been attempted for the Kalpakkam nuclear plant site in Tamil Nadu. “However, no such study has been undertaken for KNPP,” Pushparayan said.
The Nuclear Power Corporation of India Limited, too, in an official response to DNA, said it was aware of both slumps and had factored them in. “After ONGC discovered these slumps, scientists from AERB and NPCIL held discussions with ONGC for understanding their implications,” it said.
NPCIL officials said the KNPP site has hard rock at reasonable depth providing good foundation. However, PMANE’s experts say a ground magnetic survey conducted in the area in 2010 showed that the thickness of the rock beneath the reactor was about 4,000 metres, as against the usual 40,000 metres. The crust is the layer of earth between the surface and the mantle.
Another report by A Bhoominathan, professor at the Indian Institute of Technology, Madras, said studies done to verify the suitability of the site had failed to identify weak zones. “Confirmatory geological and geotechnical investigations carried out after excavation of strata to the founding level at various sites for nuclear facilities show the presence of weaker zones which have not (been) identified in the original investigation,” his report said.
“The establishment had to spend a lot of time and money when they found these weak spots in 2001,” said PMANE member VT Padmanabhan. “They excavated these spots and tried to strengthen them by cement grouting. Yet it is not safe to have a nuclear power plant on a rock mass that has been cement-grouted.”
With regard to the possibility of volcanic eruptions in the area, the government’s expert group said no active volcanism had been identified. Samples of rocks collected from Abhishekapati, 50km away, after a minor volcanic eruption in 1998, however, raise questions about the region’s stability.
“The seismic tremors and tectonics in this region also raise a question of stability for the area,” said a report submitted in 2002 by the Tamil University’s department of earth sciences. Lava rock samples were sent for analysis to the department. “Before going for any major structure in Kudankulam, one has to ensure the tectonics of this block,” the report said. “It is lying on a lineament plane. So, it is a must to take up micro-level studies for confirming the tectonic stability of this landmass before launching a major plant in Kudankulam.”
However, the Centre’s expert panel denied this, saying the lava rock was “related to an electrical phenomenon which is seen even today as visible burnt and melt marks on the two electrical poles in Pondicherry based on samples collected 14 years after the event”. Hence, the reported rock melts are no indicators of underground volcanic activity, it felt.
Lastly, the formation of a sill hole at Punnayurkulam after the rain on November 26, 2011, and the occurrence of a similar incident three years ago at Radhapuram, both barely 10km from the plant, suggest that this area might be a Karst region. Karst is a special landscape that is formed by the dissolution of soluble rocks. It is among landscape most vulnerable to natural hazards.
“Extensive studies to understand these events should have been undertaken by NPCIL, but it remains unaware of these events,” said Dr R Ramesh, who has been working to identify the geology of the KNPP site since 2000. According to AERB guidelines, “in case, the potential of such geological hazards exists and no practical engineering solutions are available to mitigate their effects, the site is deemed unsuitable”.
“The Preliminary Safety Analysis Report (PSAR) for the KNPP prepared by the Russians and submitted to the AERB had no idea about all this. This is because the PSAR was completed in the last months of 1998 and submitted to the AERB in early 1999. Since 1998, a series of geological events have occurred in places near the Kudankulam site, and a thorough study should have been done,” he said.

  http://www.dnaindia.com/india/report_dna-investigations-kudankulams-lurking-dangers_1655987-all

Mining near N-site didn’t cease till '05

The Kudankulam Nuclear Power Plant (KKNPP) is mired in controversy now, but even work on the project began by violating Atomic Energy Regulatory Board (AERB) guidelines prohibiting mining activity within 5km of a nuclear power plant. India Cements was mining limestone 3km from the KKNPP site when excavation work for the plant began in 2001.
Though AERB stipulated that mining must end by 1994, the activity continued till November 2005 in an area comprising 219.975 hectares in Kudankulam village, according to documents with DNA.
Clearance for excavation work for the power plant was given in October 2001 "subject to compliance of stipulations like restriction on surface mining of limestone within exclusion and sterilised zone". However, the Nuclear Power Corporation of India Limited (NPCIL) claims there was no violation of AERB guidelines as the board allowed surface scraping in March 2002 after construction work on the KKNPP began. "Since then, periodic inspection has been carried out to ensure the safety of the plant," the NPCIL said in its official response.
Though mining activities were going on in the region for over a decade before work on KKNPP began, they found no mention in the environment impact assessment carried out by the National Environmental Engineering and Research Institute for units 1 & 2 and in the expert committee's report later. The committee was formed last year to address safety issues related to KKNPP. "No mining activity is carried out by KKNPP," the panel’s report said.
"Since when did KKNPP become a mining company?" wondered activist Ravi Kumar, a resident of Kudankulam. "Despite AERB's inspections twice a year of the KKNPP site to verify compliance with regulatory requirements, none of the government reports mentions the mining activity."
It was only when the People's Movement Against Nuclear Energy (PMANE) raised the issue that the government admitted that mining by India Cements continued even after work on KKNPP began.
The latest report by the expert committee said India Cements was allowed to carry out mining activities considering the advanced technology adopted by it. However, when KKNPP was cleared in 1989, the AERB stipulated that mining must end by 1994. "Arrangements must be made to terminate the lease of the limestone quarry in 1994," said a clearance letter, which is in DNA's possession.
India Cements said the latest technology of surface scraping using a surface miner would be deployed to ensure that the topography remained intact and the atmosphere remained free of pollution. "With the use of these machines, limestone quarrying could be carried out without drilling and blasting," the expert committee's report said. The permission was granted in violation of AERB stipulations while sanctioning KKNPP.
Independent experts said mining should not have been allowed in the region as the KKNPP site is a possible Karst region - a vulnerable landscape. Geographical events that took place after 1998 and other reports prove that the place can turn into a Karst region. Karst is a special landscape formed by the dissolution of soluble rocks and is most vulnerable to natural hazards.
"Had the NPCIL known that the crust over which KKNPP is located has thinned out, it would not have allowed mining activity in the region at all," said Dr R Ramesh, who has written a book on the geology of Kudankulam. However, the NPCIL was adamant. "Since it is just a surface-scraping activity instead of mining involving blasting or drilling, it is not a matter of concern," it said.
Land for the Kudankulam project was acquired by the Tamil Nadu government. A government order (GO) issued to this effect in 1991 laid down conditions to be followed within 5km of the proposed plant. The GO granted permission to India Cements to continue with its mining operations till the lease expired in 1994 or when work on the project began, whichever was earlier.
When infrastructure work related to KKNPP began in 1993-94, India Cements sought permission to continue quarrying limestone. The department of atomic energy (DAE) issued a "no-objection certificate" to the state government in 1996, stipulating that only surface mining should be carried out in the areas identified within the plant boundary.
The mining lease was extended for five years by the state government in 1999 with conditions that collection of limestone must be done by surface scraping only and that India Cements must vacate the area when required by the DAE.
After the five-year period ended, India Cements made another request to continue its mining operations. It got an extension for a year following NPCIL's request to the AERB. The mining operations ceased in November 2005.

http://www.dnaindia.com/india/report_dna-investigations-mining-near-n-site-didnt-cease-till-05_1656442 

450 families live 1km from Kudankulam

If one were to believe the government, no one lives within 2km of the Kudankulam Nuclear Power Plant (KKNPP).
However, when DNA visited the site, it found that a thriving township with 450 housing units had come up 1km from the plant boundary, in violation of Atomic Energy Regulatory Board (AERB) guidelines.
A 15-member expert committee set up by the government last November said in its report that there is no habitation within 2km of the plant boundary. But CASA Nagar, a project to rehabilitate survivors of the 2004 tsunami, is a kilometre from the boundary.
The township was planned and built in 2006 and about 2,000 people are already living there. These people lived in Idinthakarai and other nearby villages earlier.
As per AERB guidelines, only natural growth of population is permitted in the sterilised zone (a 5km radius around the plant). Nuclear Power Corporation of India Limited (NPCIL) officials say no rules were violated for setting up CASA Nagar. “Natural growth of population in the sterilised zone is not a mandatory condition, but a desirable condition,” they said. The NPCIL also said the township was not a result of mass migration or industrial activity and that studies have proved that there is no effect of radiation from a nuclear plant on people living around it.
But Ravi Kumar, an activist from Kudankulam village, pointed out that the township could just as well have been built elsewhere outside the sterilisation zone. This would have prevented the needless exposure of women and children to stack emission. In case of a radiological emergency, they will have to be evacuated immediately.
“The expert committee ignored the 2,000 people of CASA Nagar and presented a wrong picture, based on the 2001 census, saying there is no population within 2km of the plant,” he said.
Land for the township was allotted by the Tamil Nadu government and “there was no objection or instruction from NPCIL regarding the location of the township”, said an official with CASA, a non-governmental organisation.
The central government, however, defends itself citing a 1991 Tamil Nadu government order (GO). The GO says only industrial growth in the sterilisation zone is prohibited and there is no restriction on the growth of population. Since CASA Nagar was only to resettle people from Idinthakarai village, the GO does not prevent it, the expert committee’s latest report argued.
The GO, however, appears to violate conditions laid down by the AERB while clearing KKNPP. “Suitable legislative and administrative control measures should be taken through state authorities to prevent increase in population within the sterilised zone beyond natural growth,” the AERB had said. DNA has a copy of the document.
“It is the responsibility of NPCIL to forbid any such unnatural settlement so close to the plant... AERB should have objected to the construction of the township, which was built five years after excavation for KKNPP began,” said Dr Pugazhendhi, a member of the People’s Movement Against Nuclear Energy.

http://www.dnaindia.com/india/report_dna-investigations-450-families-live-1km-from-kudankulam_1656880 

  
 Kudankulam plant fails to meet safety regulations 

(Water supply compromised)

The Atomic Energy Regulatory Board (AERB) had placed several conditions for fresh water requirements of the Kudankulam Power Nuclear Plant (KKNPP) but many of these conditions have not been met raising questions over the plant’s safety in case of a disaster.
As per AERB guidelines, there should be an alternative source of water all the time and storage of 60,000 cubic metres of water in the island should be built before KKNPP starts functioning. None of those conditions has been met. Fresh water is the primary coolant for nuclear reactors. Reactors cannot operate without it.
In Kudankulam there is no alternative source of water, which was one of the pre-requisites laid down by AERB in 1989 while sanctioning the project, as per documents in the possession of DNA. When the issue was raised by activists, government said that another source of water is not required as desalination plants are sufficient to meet requirements.
“Regarding other water sources desalination plants have been designed for sufficient capacity... Hence, the question of water utilisation from other sources, such as Pechiparai dam and Tamirabharani river, does not arise,” the expert committee report states.
“The dependence on a single source — desalination plant — would be fatal in case of any natural calamity like a tsunami. This was the exact case with Fukishima in Japan,” said EAS Sarma, former power secretary, Government of India. Moreover, desalination plants run on electricity which could be disrupted.
Further, dependence on a single source of water also raises concern on water requirement during seawater recession. During the 2004 tsunami, the maximum extent of ocean withdrawal was less than 5km, usually about 3km in the Indian Ocean, said Tad Murty, an Indian-Canadian oceanographer and expert on tsunamis.
He conducted a field survey on tsunami in Kanyakumari in 2008. “Every year, coastal Tamil Nadu has faced the issue of seawater withdrawal at least thrice a year,” said VT Padmanabhan, member of Peoples Movement Against Nuclear Energy expert panel. Though these events have been reported, no scientific study has been conducted by NPCIL so far, he said.
However, Arun Bapat, a Pune-based seismologist consultant, who accompanied Murty during the 2008 survey, said seawater recession is a precursor to a tsunami and not a permanent phenomenon.
Tsunami hazard manual released by United States Nuclear Regulatory Commission in March 2009 states that if seawater withdrawal is an issue at the site, then chances of the reactor going in for a dry intake should be studied thoroughly. But dry intake can cause damage to the turbines and reactors. Every minute a reactor needs thousands of cubic metres of seawater.“During such episodes, the seawater intake for the reactors will be disrupted as instead of drawing water, the intake pipes would be drawing just air, and thus causing damage to the reactor,” said Padmanabhan.
Besides, the Environment Impact Assessment by National Environmental Engineering Research Institute prepared in 2003 for KKNPP 1&2 states that there will be a reservoir with a capacity of 60,000 cubic metres of water. However, currently, only 11,000 cubic metres is available in different storage tanks inside the plant, which is enough to meet the water requirement, according to the expert committee. DNA has a copy of the report.
“The provision of water storage and inventory available in various tanks is adequate for cooling requirements of reactor plant for at least 10 days, in case of power failure from the grid (even though the regulatory requirement is only seven days),” says the report. NPCIL did not respond to an e-mail sent to its official id.

 http://www.dnaindia.com/india/report_dna-investigations-water-supply-compromised_1657336

NUCLEAR SAFETY MANAGEMENT ISSUES

 http://bhujangam.blogspot.in/2012/03/nuclear-safety-objectives.html

http://bhujangam.blogspot.in/2012/03/reactor-accidents-due-to-human-failures.html

 http://www-pub.iaea.org/MTCD/publications/PDF/P082_scr.pdf  (Page-9)

4.1. INTRODUCING A SAFETY MANAGEMENT SYSTEM

66. Many organizations will already have the components of an effective safety management system in place. However, in some cases these may not have been explicitly recognized and developed as part of a coherent safety management system with the general components identified in Figs 1 and 2.

67. In the safety management system or in the review or upgrading of systems, the   following guidance may provide a useful benchmark against which existing systems can be assessed:

—Existing processes and procedures affecting safety can be identified and assessed against the headings identified in this report (or some comparable alternative classification). This may permit deficiencies to be easily identified.

—In some cases, there may exist more than one process within the organization which seeks to achieve the same objective. This may present an opportunity to reduce duplication or overlap. It may also improve clarity with respect to organizational requirements and systems and encourage the adoption of unified best practices across the organization.

—The process of classifying and documenting existing systems may lead to the identification of areas for improvement in the system. For example, it may be that audit, review and feedback systems are predominantly reactive rather than proactive and the balance between these approaches might therefore be adjusted.

—Where analysis of the current safety management system identifies significant deficiencies in the existing system, it is important to introduce remedial measures on a planned and prioritized basis. A useful first step is to assess which deficiencies or shortfalls present the greatest potential threat to safety  and seek to introduce or improve systems in these areas as the top priority, moving to lower priority areas at a later stage.

—The checklist given in the Appendix of this report may be of further use as a prompt in order to assess whether the safety management system contains all the desired components and whether these are effective.

—In documenting the organization’s system for safety, it is often helpful to clarify:

—who is responsible for a particular part of the system;

—what is the purpose of the process;

—how the process operates and fits into the overall system.

—The clarity and transparency introduced by a systematic review of the safety management system provides a starting point against which the system can be reviewed and audited in future. The existence of a documented system, with a clear, logical basis that has been benchmarked against best practices elsewhere should provide additional confidence and assurance to the regulatory body that there exists a satisfactory system for managing safety.

68. It is often useful to ensure that there exists a hierarchy of documented requirements as part of an overall quality system. At the ‘highest’ level in the system there will generally be a statement of corporate safety policy. From this starting point, a      logical progression of requirements can be developed. For example, the policy and goals of the organization can lead to a statement of the processes and responsibilities that exist to achieve the goals. Below this, standards can define management expectations for the safety of particular processes. In turn, these can lead on to instructions or procedures used in day to day operations. It is important that these be seen as useful and relevant by those who use them. Staff involvement in producing and reviewing such a hierarchy of requirements should not only improve understanding of safety, but also improve ‘ownership’, because the relevance of those parts of the safety management system affecting the day to day work of the individual will be seen in its overall context as part of a planned system to ensure and improve safety throughout the organization.

69. In principle, it should be possible for all staff to recognize the existence of an unbroken chain of requirements and organizational processes and responsibilities from the boardroom to the workplace, through a logical and consistent auditable trail.  The production of an overview document explaining the overall system to all staff in the organization is often beneficial. This helps to ensure a clearer understanding in all parts of the organization of why various components of the safety management system exist and how they are interrelated.

4.2. MANAGEMENT OF SAFETY DURING ORGANIZATIONAL CHANGE

70. It is widely recognized that systems are required in all organizations which operate potentially hazardous plant to ensure that any engineered changes to the plant are properly considered in safety terms before being implemented. For those operational or engineered changes which have the highest potential for degrading safety if they do not meet intended standards or are not implemented satisfactorily, systems should be in place to ensure that proposed changes are closely and independently scrutinized before changes to the plant take place.

71. In recent years, the need to reduce costs and improve efficiency, combined with changes to the structure of electrical utilities and, in some cases, the change of ownership (e.g. privatization) of industries, has led many companies to consider how they might improve work processes and change organizational structures. This has often resulted in reductions in numbers of staff and changes in responsibilities, personnel and interfaces within the organization and greater use of contractors to carry out work. Such changes can lead to either improvements or reductions in safety, depending to a large degree on how they are planned and introduced.

72. For example, safety can potentially be improved by introducing shorter lines of communication, providing clearer accountabilities and simplifying and reducing organizational interfaces. As a specific example, improved planning and work control can increase the productivity of plant maintenance which, in turn, can lead to a reduced maintenance backlog. This is likely to decrease the number of equipment problems with a beneficial effect in reducing the number of plant events and challenges to safety systems. Better planning and work control also means that control room operations staff, maintenance technicians, system engineers, radiation protection personnel and planners are able better to co-ordinate their activities. This increased team working means that changes to the plant can be carried out more efficiently and effectively, with a potential safety benefit.

73. However, pressures arising from organizational change have the potential, if the changes are inadequately effected, to reduce safety. Three examples serve to exemplify the potential dangers. First, pressure for short refuelling outages can lead to inadequate investigation of equipment condition. This, in turn, can lead to short term repairs which can subsequently result in unscheduled forced outages. Second, unless control systems are in place and care is taken to ensure that standards are maintained, a substantial increase in use of contractors can potentially compromise safety.

A third example arises when, in attempting to work more effectively under economic and time pressures, workers fail to comply with safety rules or procedures in a misguided attempt to assist the organization to reduce costs. It is vital that management neither encourage such behaviour nor condone it, but make it clear to staff that this is neither intended nor acceptable.

74. Many of the potential adverse effects of organizational change on safety can be avoided if consideration is given to the effects of such change on the maintenance of acceptable levels of safety before changes are allowed to take place. By analogy with the processes in place to categorize the safety significance of proposed engineering changes, organizations should establish a system to assess in advance the impact of organizational change, to the extent warranted by its assessed potential safety significance.

75. It is important that, for significant changes, an implementation plan be drawn up which recognizes the need to scrutinize the effects on safety of the proposed changes as they proceed and which recognizes circumstances under which countermeasures might need to be applied should adverse effects on safety become apparent. For such changes, independent internal review may also be required. The regulatory body or bodies will also need to be fully informed about changes with potentially significant effects on safety so that it or they can independently assess the proposed changes, and can inspect and if necessary intervene if they conclude that safety is being jeopardized.

76. For changes where it is judged that potentially significant effects on safety could arise, assessments should ensure the following:

—The final organizational structure needs to be fully acceptable in safety terms. In particular, it is important to ensure that adequate provision has been made to maintain a suitable level of trained and competent staff in all areas critical to safety and that any new systems introduced have been documented with clear and well understood roles, responsibilities and interfaces. All necessary retraining requirements should have been identified by, for example, carrying out a

training needs analysis of each of the new roles and planning for retraining of key staff where this has been identified as necessary. These issues are particularly important if personnel from outside the operating organization are to be used for work which has traditionally been carried out internally or if their role is to be otherwise substantially extended.

—The transitional arrangements need to be fully secure in terms of safety. For example, it is important that sufficient existing safety critical expertise be maintained until training programmes are complete and that organizational changes not be made in such a way as to lose clarity about roles, responsibilities and interfaces. Any significant departure from preplanned transitional arrangements should be subject to further review.

77. Organizational change can potentially have broader effects important to maintaining high levels of safety. For example, it is important that the overall strategy for introducing change should recognize the potential for adverse effects on morale and motivation. Changes that are not understood or accepted by the parts of the organization and individuals affected are likely to lead to reduced morale among staff. Good communication and involvement of staff in the change process can often reduce such undesirable consequences. Planning of change that involves staff and their representatives, together with briefing and joint review during the process, is therefore desirable. This may serve not only to improve commitment and ownership, but also to enable new issues to be identified as they arise.

4.3. MONITORING EFFECTIVENESS USING PERFORMANCE MEASURES

78. An important part of the process of audit, feedback and review shown in Fig. 2 is to allow the objective assessment of safety performance within the organization.

Therefore, wherever possible and meaningful, measurable indicators of safety performance should be introduced. Monitoring of the measures of safety performance is a management responsibility. While staff can compile the data and develop the reports or summaries, the task of monitoring the results and determining which actions are called for is a vital line management function.

79. The introduction of performance measures enables an organization to set safety targets and to trend performance for the organization as a whole, for individual nuclear power plants and, where feasible, for organizational units within a plant. The inclusion of quantitative performance indicators that are defined nationally or internationally (e.g. those defined by WANO) also allows the organization and individual plants to benchmark their performance against national and international standards.

To achieve this it is helpful to adopt indicators, current approaches to which are discussed in the following.

80. There is general agreement that no one indicator has been developed that provides a measure of nuclear safety. A range of indicators needs to be considered in order to provide a general sense of the overall performance of a nuclear plant and its trend over time.

81. These can be measures of recent performance, achievement of actions to improve safety and measures of the attitudes and behaviour of staff. Most conventional quantitative indicators measure historical performance (they are often referred to as ‘output’ or ‘lagging’ indicators) and thus their predictive capacity arises from extrapolation of trends or comparisons with past performance. Forward looking indicators (sometimes referred to as ‘input’ or ‘proactive’ indicators) which measure positive efforts to improve safety are particularly valuable, although they are recognized as being more difficult to develop and measure objectively. Measures of personnel behaviour and attitudes, although more qualitative in nature, can provide a significant input to judgements about overall safety performance. Although results are usually more difficult to interpret, they have the advantage of providing direct feedback from operational staff and provide opportunities for incipient safety issues to be detected and early signs of deteriorating performance to be identified.

82. In the development of quantitative measures, it is important to recognize potential pitfalls in their interpretation and use:

—Improvement measures usually take a substantial time to be reflected in performance data, particularly when data are analysed on a rolling basis (e.g. monthly data analysed on a 12 month rolling average).

—Care needs to be taken in setting targets and analysing data when dealing with small numbers. Statistical fluctuations can easily mask trends.

—Whenever possible, quantitative measures should not relate solely to failures (e.g. number of events, number of accidents, etc.). Ideally, measures should also be designed to ensure progress on those activities which will improve safety.

For example, the reporting of ‘near misses’, the number of safety inspections and the provision of safety training can all be used as input measures.

—In the development of reporting systems, account needs to be taken of local and cultural aspects that may inhibit reporting, e.g. the response of management to individuals associated with an event, local reward systems based on a reduction in accidents or the number of reported events and a culture which accepts injuries as a part of normal life.

—Numerical measures must always be subject to careful interpretation and be used as part of an overall judgement about safety performance. They should not be regarded as an end in themselves.

—Indicators should be periodically reviewed and their relative importance may change with time. The use of a fixed set of indicators that do not reflect the evolution of the organization and its requirements should be avoided.

83. Many operators of nuclear power plants have developed their own output performance indicators; however, the following ‘top level’ performance indicators have been used by WANO:

—unit capability factor,

—unplanned capability loss factor,

—unplanned automatic scrams per 7000 hours critical,

—safety system performance,

—thermal performance,

—chemistry index,

—collective dose,

—volume of low level solid radioactive waste produced,

—industrial accident rate,

—fuel reliability.

The extent to which individual indicators in this list are of a direct measure of safety varies considerably, although most of them, at least, provide an indirect measure. Furthermore, it should be recognized that some of these have greater significance for particular reactor types (e.g. the chemistry index) and thus when comparing performance, allowance must also be made for the characteristics of different designs.

84. Experience has shown that plants that have an overall poor record on a majority of these indicators typically have operational problems with a potential impact on safety. As a rule of thumb, when a few of these indicators show declining trends, this can be taken as a useful early warning signal to alert management and to prompt further analysis and investigation of the underlying issues.

85. These indicators are broad based and it is often helpful to monitor other specific or more detailed indicators. For example, analysis of plant events of various types can provide a useful further input to the assessment of safety performance. The following are among those which might be considered:

—significant events, measured by both number and consequence;

—repeat events that have taken place on the plant; these provide a measure of thefailure to implement effective corrective actions;

—events that are similar to those identified at other nuclear plants; in this case, the organization may not have learned sufficiently from the experience of others;

—events arising from particular types of deficiency (e.g. failure to comply with technical specifications or near misses related to human factors or from deficiencies, in particular in nuclear related systems (e.g. the amount of time a system is declared as not being available — even if within technical specification limits).

86. Where similar root causes recur, a plant probably has weaknesses in its overall performance or cultural deficiencies that are in need of attention. Event analysis has expanded at many plants to include analysis of events without significant consequence (sometimes called ‘near misses’). As it is generally agreed that both consequential and non-consequential events have similar causes, it follows that correcting the causes of non-consequential events should contribute to improvements in safety by helping to prevent future events.

87. It is also sometimes useful to develop detailed indicators for specific organizational units in a plant. For example, in the maintenance area, the following have proved useful for monitoring performance in some organizations:

—number of outstanding backlogs;

—a measure of non-proceduralized practices or ‘workarounds’ employed;

—number of control room instruments out of service;

—amount of maintenance rework;

—percentage of spare parts available, as expected, on demand;

—average life of corrective maintenance actions;

—a measure of the prevalence of human errors;

—the completion of training to agreed time-scales;

—numbers of minor injuries and near misses (an increasing trend in the reporting of these is to be encouraged, since they frequently represent precursors to more serious accidents);

—standards of housekeeping.

This approach allows, in principle, deteriorating performance in a specific functional area to be recognized at an early stage. Although some of the measures are difficult to define and monitor on a fully consistent basis, they can nonetheless provide an important input to the overall picture and can serve as an added impetus to improvement.

88. There are other more general measures of safety performance that, whilst providing more qualitative information, are an important adjunct to numerical indicators.

For example, observations of the behaviour of plant personnel can give an indication of how safely they actually carry out work and comply with procedures and good practices. Observing plant personnel performing work in the field and their interactions with supervisors and managers can provide insight into the safety culture at a plant. Such measures can be supplemented by surveys and interviews into the attitudes of staff. Although these tend to reveal what people think rather than how they act, properly conducted surveys and interviews can provide an accurate impression of the level of safety culture at a plant.

4.4. IDENTIFYING DECLINING SAFETY PERFORMANCE

89. In order to avoid any decline in safety performance, nuclear power plant and utility management must remain vigilant and objectively self-critical. Early signs of declining performance are not readily visible and tend to be ambiguous or hard to interpret. In fact, when the signals are clear, it means that it is often too late and that serious performance problems exist. A key to this is the establishment of an objective internal self-evaluation programme supported by periodic external reviews conducted by experienced industry peers using well established and proven processes. Such a combined programme reduces the dangers of complacency and acts as a counter to any tendency towards self-denial (e.g. ascribing any deteriorating performance to such factors as ‘a run of bad luck’). In addition to the early detection of any deterioration, such an approach can also be used to identify any enhancements of operational performance and safety and to learn from success.

90. Declining performance typically exhibits the following pattern:

Stage 1: Over-confidence. This is brought about as a result of good past performance, praise from independent evaluations, and unjustified self-satisfaction.

Stage 2: Complacency. In this phase, minor events begin to occur at the plant and insufficient self-assessments are performed to understand their significance singly or in totality. Oversight organizations begin to be weakened and self-satisfaction leads to delay or cancellation of some improvement programmes.

24 Stage 3: Denial. Denial is often visible when the number of minor events increases further and more significant events begin to occur. However, there is a prevailing belief that they are still isolated cases. Negative findings by internal audit organizations or self-assessments tend to be rejected as invalid and the programmes to evaluate root causes are not applied or are weakened. Corrective actions are not systematically carried out and improvement programmes are incomplete or are terminated early.

Stage 4: Danger. Danger sets in when a few potential severe events occur but  when management and staff tend consistently to reject criticisms coming from internal audits, regulators or other external organizations. The belief develops that the results are biased and that there is unjust criticism of the plant. As a consequence, oversight organizations are often silent and afraid to be the bearers of bad news and/or to confront the management.

Stage 5: Collapse. Collapse can be recognized most easily. This is the phase where problems have become clear for all to see and the regulator and other external organizations need to make special diagnostic and augmented evaluations. Management is overwhelmed and usually needs to be replaced. A major and very costly improvement programme usually needs to be implemented. It is important that declining performance be recognized after the first two stages and at the latest early in Stage 3.

91. The key to a successful internal self-evaluation programme is the establishment of a learning culture throughout the organization with staff at all levels seeking to review their work critically on a routine basis and to identify areas for improvement and means of achieving this. In its turn, management must be supportive, for example by seeking opportunities for both themselves and staff to visit other nuclear power plants to identify good practices that they might adopt. This can occur both on an individual plant to plant exchange basis and also as members of international teams undertaking external reviews at nuclear power plants in other Member States.

92. Specific studies and general experience have shown that frequently occurring underlying conditions at those plants which have had significant problems include:

—acceptance of low standards of plant condition/housekeeping;

—failure to recognize that performance is declining and to restore higher levels of performance in specific areas at an early enough stage;

—a lack of accountability among line management and workers;

—ineffective management monitoring and trending of performance;

—deficient performance in the control room;

—an increasing human error rate;

—inadequate and/or poorly used procedures;

—insufficient and/or ineffective training;

—insufficient use of operational experience feedback and root cause analysis programmes in the analysis of events and ‘near misses’;

—an inadequate control of design configuration;

—failure to benchmark against those with better safety performance;

—a lack of awareness among the top managers about the principal deficiencies and associated corrective actions often reinforced by a ‘good news’ culture;

—inadequate or insufficient self-assessments being carried out on issues relating to safety culture;

—inadequate capability for supervising and monitoring contractors.

93. While weakness in a few areas can exist at even top performing plants, experience has indicated as a rough ‘rule of thumb’ that when weaknesses are apparent in more than a few of these conditions, there is a danger that a significant decline in plant performance is occurring.

94. The routine and objective review of the trends in a set of performance indicators such as those discussed in Section 4.3 is undertaken at most nuclear power plants. An early indication of concern might require the development and monitoring of additional lower level measures of performance to confirm (or otherwise) the  existence of a deteriorating trend and to support the identification of the associated root causes. In seeking critically to assess performance, the management at a plant may wish to give particular attention to analysing performance in areas such as those identified in para. 92.

95 Self-assessment has significant advantages as a means to identify such precursors. If it is left to external reviews and audits, or worse still, for actual events to expose these weaknesses, the required corrective actions are often far more extensive and expensive to implement. Early identification and correction at the plant is thus the optimum solution. To achieve this, management must develop within the organization the ability to conduct thorough, critical self-assessments. Also, when areas for improvement have been identified, management needs to establish clearly prioritized action plans that address the root causes, gain ownership for these from staff and pursue them vigorously.

96. Even where self-evaluation programmes have been established, weaknesses can arise for a number of reasons. These include:

—failure to identify the real root causes;

—lack of actual or perceived management commitment in the resolution of the identified problems;

—insufficient attention to the content of remedial action plans and, in particular, a failure to prioritize actions;

—failure to gain the commitment of staff to the changes proposed;

—failure to commit adequate resources to complete the improvement programme satisfactorily;

—insufficient commitment to see the programme through to a stage where actions are complete and have achieved real and measurable improvement.

Reactor accidents due to human failures

SOME EXAMPLES OF THE EFFECTS OF DEFICIENCIES IN SAFETY MANAGEMENT

http://www-pub.iaea.org/MTCD/publications/PDF/P083_scr.pdf
http://carnegieendowment.org/files/fukushima.pdf  [Avoidable Fukushima accident,an excellent report]

GENERAL CONSIDERATIONS

A–1. From time to time reports on incidents or reviews of a plant or utility serve as a reminder of the continuing need for vigilance and the contribution that all managerial levels play in achieving safe operation. In the first of the two sections below, two examples which illustrate this have been drawn from published major plant/utility reviews. The final section provides specific examples linked to elements of the model presented in Fig. 2 which have been obtained from two IAEA sources — the IRS database and the OSART review findings. They all serve to demonstrate the continuing need to learn from the experience of others in relation to human and organizational issues as well as in technical and engineering areas.

A–2. In focusing on problems, there is a danger of forgetting the many positive successes achieved over 9000 reactor-years of experience accumulated worldwide. The international nuclear community must continue to seek replication of the many excellent practices that have led to these successful achievements as well as learning from well publicized shortfalls. Both can serve as an impetus and as a motivation for change. For those Member States with established nuclear power programmes and systems to support their safe operation, it is frequently factors associated with organization and human behaviour for which significant further improvements can be gained.

RESULTS ARISING FROM THE REVIEW OF NUCLEAR POWER PLANTS

A–3. The 1997 report of a review of a utility and its nuclear power plants identified management, process and equipment problems that had adversely impacted the performance of the organization and its operating stations. Although incidents and poor performance tend to focus attention at the plant operational level, they often arise as a result of weaknesses stemming from the higher organizational level, i.e. those responsible for defining the organization and specifying safety requirements. In this respect the review team found problems with organizational structures, practices, policies and systems.

A–4. These shortcomings inevitably had an adverse impact at the working level of the plants. Specific shortcomings in the planning, control and support activities were found and it was noted that ‘personnel have not incorporated an adequate safety culture into their normal activities’. One vital ingredient in an effective safety management system, namely an effective audit, review and feedback process, was also found not to be working satisfactorily. The utility has made a very positive response to the findings.

A–5. An evaluation (also in 1997) of a nuclear power plant in another Member State by a team from the national regulatory body followed a decline in performance that the regulator had noted and drawn to the attention of the plant a year earlier. Although the robust nature of the plant design, its relative newness and the limited period over which performance had declined were considered to be major factors in preventing significant degradation of plant equipment or an event of more serious consequence, a number of important deficiencies in the safety management system were identified.

A–6. The review concluded that management and leadership were generally ineffective in establishing expectations, communications, independent oversight, performance measurement and monitoring, decision making and human resource management. Programmes, processes and procedures were generally ineffective in self-assessments, corrective actions, root cause analyses, planning prioritization and scheduling. Human performance was found to be weak in procedural adherence, resource allocation and time management and prioritization.

A–7. The root causes of the problems were determined by the team to be:

—management generally did not establish and implement effective performance standards;

—the plant’s programmes, processes and procedures did not consistently provide defence in depth to assure plant activities were conducted in a safe manner;

—problem identification was inconsistent and evaluation and corrective actions were generally ineffective;

—management did not ensure that the infrastructure was suitable to support the major changes which the management were seeking to implement. The plant and utility have embarked on a plan to address the issues and their root causes.

A–8. The experiences of both utilities in implementing their recovery programmes provide valuable lessons to the international nuclear community.

WEAKNESSES FOUND FROM REVIEW OF THE IRS DATABASE  AND OSART REVIEW REPORTS

A–9. Examples of incidents (as reported to the IRS) and weaknesses in systems that might become the direct or root cause of a future incident (OSART review findings) are provided as a reminder of the need to remain vigilant and to avoid complacency. The latter, in particular, also serves to demonstrate the benefits of periodic external review.

Definition of safety requirements and organization

Statements of safety policy (including standards, resources and targets)

A–10. In an OSART review it was found that many of the rules for the technical specifications of safety equipment surveillance which were in force had been submitted to the safety authorities but had not yet been authorized by them. For example, a programme of diesel generator tests had been submitted to the regulatory authorities by the utility in 1992 but, by the time of the review in 1998, had not yet been approved. A batch of plant modifications had been approved for implementation by the regulator, but not the corresponding changes in specifications for surveillance tests. In those cases where the changes had not been approved, the plant implemented the surveillance proposed to the regulator so that there would be no ambiguity for operators. Some defence in depth was lost because the external review had not taken place. In addition, the use of surveillance tests that had not been approved by the regulator comprised a further loss of defence in depth as a result of a failure to comply with procedural requirements.

Planning, control and support

Control of safety related activities

A–11. During commissioning work on a hot cell in a nuclear power plant, a real spent fuel assembly was disassembled by mistake instead of a dummy fuel assembly. Three members of the maintenance staff received external radiation doses in excess of the dose limit. This event occurred as a result of work being poorly organized. The permit for work did not mention the need for a comprehensive programme of testing and the acceptance testing of the equipment in the disassembly section. Nor was a copy of these programmes attached to the permit, and the members of the team were not informed about it. Nobody in authority had checked that the permit had been correctly drawn up. The permit also made no mention of measures to prepare the workplace (i.e. preparation of the dummy fuel assembly in the hot cell). Therefore the senior mechanical engineer allowed his team to start the work covered by the permit without performing the official procedure for handover of the workplace, including reporting to the works manager. The relevant team began to work under the impression that the hot cell transport apparatus contained a dummy fuel assembly.

A–12. In another example of failures of control, an Assessment of Safety Significant Events Team (ASSET) mission reviewed an incident where during a cold  scram test after the refuelling outage, one scram group failed to work. The line-up checks of the valves belonging to that scram group were missed after maintenance had been performed. In addition, a second independent position check of all valves before plant startup also did not detect the wrong system line-up. This event occurred directly as a result of the lack of a rigorous and questioning approach in respect of the maintenance of safety related systems. The root cause was a lack of emphasis by plant management on ensuring adequate control when dealing with safety related systems. There was no planned management or supervisory intervention to verify the stringency of the valve line-up checks. It was noted that management were seldom seen to be visibly endorsing the importance of a rigorous approach when dealing with safety related systems.

Ensuring competence

A–13. In an OSART review in 1997, it was found that material used for training people in the plant was not being systematically reviewed and revised. Most of the existing lecture materials had been developed between 1978 and 1984 and had not been revised to include necessary changes such as plant modifications, operating experience information or procedure changes. The OSART team commented that the use of training notes that are not up to date could result in trainees receiving incorrect information and could lead to mistakes.

Communication and team support

A–14. A reactor startup was terminated and a reactor shutdown was commenced to repair a leaking safety relief valve. The reactor began to depressurize because decay heat was insufficient to supply all auxiliary loads. As the reactor depressurized, the reactor coolant temperature decreased, adding positive reactivity. As long as the operator continued to insert control rods, the reactor was maintained subcritical. The operator stopped inserting control rods to review plant conditions and the reactor scrammed about a minute later. The licensee attributed the event to the control room team failing to recognize the actual plant conditions.

Implementation

A–15. The examples in this category relate to human errors and are thus sometimes simply ascribed to individual failures. However, such issues frequently have their roots in organizational shortcomings which, if addressed, can minimize the extent of such human errors.

Questioning attitude

A–16. During a refuelling outage, one loop was isolated and drained to allow automatic in-service inspection of the steam generator tubes. In parallel, maintenance of the hot and cold leg main isolating valves (MIVs), gearboxes and electrical systems was in progress. One of the maintenance personnel noticed that the position indicator of the MIV wedge did not indicate the fully closed position. As the MIV was not fully secured against movement, he tried to close it. As he could not move the valve in the closed position he turned the wedge by mistake in the open direction. Water was then able to flow from the refuelling/spent fuel pool through the MIV and onto the floor through the open steam generator manhole. The refuelling pool level dropped by approximately 27 cm. Refuelling was stopped immediately and the MIV closed.

About 16.6 m3 of water was lost from the refuelling pool. This incident illustrates a failure to question the safety significance of a course of action when faced with difficult or ambiguous circumstances.

Rigorous and prudent approach

A–17. An OSART review found that the alarm response by reactor operators and radioactive waste control room operators at a plant was deficient. It was noted that several alarms were silenced, then allowed to flash for extended periods of time, including the power range monitor upscales and rod blocks, and alarms on a fire system panel. It was judged that this practice might have arisen because of the large number of alarms. For example, it was noted that over 50 alarms were lit in the radioactive waste control room.

A–18. Alarms are one of the first indications of a problem. Without an adequate response, degradation of plant systems may go undetected. The OSART team recommended that operations management should continuously reinforce expectations to improve operator alarm response. These expectations should include referring to alarm response procedures when an alarm is received, at least for the first time an individual alarm is received on a shift. They recommended that efforts to achieve a ‘black board’ concept should continue in order to reduce the number of distracting alarms.

Communication

A–19. Poor communication is very frequently an important contributor to incidents. In one example, preparation for refuelling was being performed and the reactor cavity was being filled with water. An examination of the sump area was planned by looking through the access door only. A worker was provided with a key to the sump area and was cautioned not to enter the sump area. The task was delayed until the next shift. The key was passed on but the caution was not. Two workers entered the sump area in spite of the warning on the door. One worker received a dose of 13 mSv (whole body) and the other received a dose of more than 2 mSv.

Audit, review and feedback

Measuring performance

A–20. An ASSET review found that on several occasions the unexpected activation of reactor protection system occurred when the reactor coolant pump was put into operation at 50% reactor power. The reactor power controller repeatedly failed to compensate for the reactivity increase induced by startup of the reactor coolant pump, allowing the neutron flux rate increase to exceed trip settings. This situation occurred on several occasions over a period of time but ineffective performance measuring caused plant management not to take appropriate and timely measures to avoid recurrence. In particular, no thorough analysis verifying the exact cause of the event was performed and no changes to reactor coolant pump procedures or reactor power controller designs response were considered.

A–21. Another ASSET mission found that the inoperability of a diesel generator due to oil cooler leakage was unnecessarily repeated. When the first oil cooler leakage occurred, the plant management decided to replace the tube bundle with one of similar material. A neighbouring power station had, however, previously suffered from an exactly similar problem and had demonstrated that the only solution was to replace the cooler with one of stainless steel. This information had been relayed to the original station but they still replaced the tube bundle with the original material and this again failed after a short time in operation.

Corrective actions and improvements

A–22. Several ASSET review have found corrective actions not being implemented in a timely manner, leading to numerous repeat events. The plants often have excellent computerized systems to store event databases and to analyse events systematically. However, the analysis of failures is often focused mainly on the direct cause and often only a specific area of the root cause is identified for correction. The specific corrective actions to eliminate the individual problem are implemented, but the broader generic lessons remained uncorrected.

REFERENCES

[1] INTERNATIONAL NUCLEAR SAFETY ADVISORY GROUP, Basic Safety  Principles for Nuclear Power Plants, Safety Series No. 75-INSAG-3, IAEA, Vienna (1988); and the update, Basic Safety Principles for Nuclear Power Plants 75-INSAG-3 Rev. 1, INSAG-12, IAEA, Vienna (1999).

[2] INTERNATIONAL NUCLEAR SAFETY ADVISORY GROUP, Safety Culture, Safety Series No. 75-INSAG-4, IAEA, Vienna (1991).

[3] INTERNATIONAL ATOMIC ENERGY AGENCY, Quality Assurance for Safety in Nuclear Power Plants and other Nuclear Installations: Code and Safety Guides Q1–Q14, Safety Series No. 50-C/SG-Q, IAEA, Vienna (1996).

NUCLEAR SAFETY - OBJECTIVES

NUCLEAR SAFETY -  OBJECTIVES (INSAG)

http://www-pub.iaea.org/MTCD/publications/PDF/P082_scr.pdf   (PAGE-9)

12. Three safety objectives are defined for nuclear power plants. The first is very general in nature. The other two are complementary objectives that interpret the general objective, dealing with radiation protection and technical aspects of safety respectively. The safety objectives are not independent; their overlap ensures completeness and adds emphasis.

2.1. GENERAL NUCLEAR SAFETY OBJECTIVE

13. Objective: To protect individuals, society and the environment by establishing and maintaining in nuclear power plants an effective defence against radiological hazard.

14. Each viable method of production of electricity has unique advantages and possible detrimental effects. In the statement of the general nuclear safety objective, radiological hazard means adverse health effects of radiation on both plant workers and the public, and radioactive contamination of land, air, water or food products. It does not include any of the more conventional types of hazard that attend any industrial endeavour. The protection system is effective as stated in the objective if it prevents significant addition either to the risk to health or to the risk of other damage to which individuals, society and the environment are exposed as a consequence of industrial activity already accepted. In this application, the risk associated with an accident or an event is defined as the arithmetic product of the probability of that accident or event and the adverse effect it would produce. The overall risk would then be obtained by considering the entire set of potential events and summing the products of their respective probabilities and consequences. In practice, owing to the large uncertainties that can be associated with the different probabilities and consequences, it is generally more convenient and useful to disaggregate the probabilities and the consequences of potential events, as discussed in INSAG-9. These health risks are to be estimated without taking into account the countervailing and substantial benefits  which the nuclear and industrial activities bestow, both in better health and in other ways important to modern civilization. When the objective is fulfilled, the level of

risk due to nuclear power plants does not exceed that due to competing energy sources, and is generally lower. If another means of electricity generation is replaced by a nuclear plant, the total risk will generally be reduced. The comparison of risks due to nuclear plants with other industrial risks to which people and the environment are exposed makes it necessary to use calculational models in risk analysis. To make full use of these techniques and to support implementation of this general nuclear safety objective, it is important that quantitative targets, ‘safety goals’, be formulated.

It is recognized that although the interests of society require protection against the harmful effects of radiation, they are not solely concerned with the radiological safety of people and the avoidance of contamination of the environment. The protection of the resources invested in the plant is of high societal importance and demands attention to all the safety issues with which this report is concerned. However, the main focus of this report is the safety of people. What follows is therefore expressed in these terms solely, but this is not to imply that INSAG has no regard for other factors.

2.2. RADIATION PROTECTION OBJECTIVE

16. Objective: To ensure in normal operation that radiation exposure within the plant and due to any release of radioactive material from the plant is as low as reasonably achievable, economic and social factors being taken into account, and below prescribed limits, and to ensure mitigation of the extent of radiation exposure due to accidents.

17. Radiation protection is provided in nuclear power plants under normal conditions and separate measures would be available under accident circumstances. For planned plant operating conditions and anticipated operational occurrences, compliance with radiation protection standards3 based on recommendations by the International Commission on Radiological Protection (ICRP) ensures appropriate radiation protection.

18. The aforementioned radiation protection standards have been developed to prevent harmful effects of ionizing radiation by keeping doses sufficiently low that deterministic effects are precluded and the probability of stochastic effects is limited to levels deemed tolerable. This applies to controlled circumstances. In the event of any accident that could cause the source of exposure to be not entirely under control, safety provisions in the plant are planned and countermeasures outside the plant are prepared to mitigate harm to individuals, populations and the environment.

2.3. TECHNICAL SAFETY OBJECTIVE

19. Objective: To prevent with high confidence accidents in nuclear plants; to ensure that, for all accidents taken into account in the design of the plant, even those of very low probability, radiological consequences, if any, would be minor; and to ensure that the likelihood of severe accidents with serious radiological consequences is extremely small.

20. Accident prevention is the first safety priority of both designers and operators. It is achieved through the use of reliable structures, components, systems and procedures in a plant operated by personnel who are committed to a strong safety culture (see Sections 3.2.1 and 3.2.2, and subsequent sections).

21. However, in no human endeavour can one ever guarantee that the prevention of accidents will be totally successful. Designers of nuclear power plants therefore assume that component, system and human failures are possible, and can lead to abnormal occurrences, ranging from minor disturbances to highly unlikely accident sequences. The necessary additional protection is achieved by the incorporation of many engineered safety features into the plant. These are provided to halt the progress of an accident in the specific range of accidents considered during design and, when necessary, to mitigate its consequences. The design parameters of each engineered safety feature are defined by a deterministic analysis of its effectiveness against the

accidents it is intended to control. The accidents in the spectrum requiring the most extreme design parameters for the safety feature are termed the design basis accidents for that feature. For existing plants, design basis accidents are generally associated with single initiating events; they are evaluated with conservative assumptions including aggravating failures and do not usually imply severe core damage.

22. Attention is also directed to accidents of very low likelihood which might be caused by multiple failures or which might lead to conditions more severe in existing plants than those considered explicitly in the design (accidents ‘beyond the design basis’). Some of these severe accidents could cause such deterioration in plant conditions that proper core cooling cannot be maintained, or that fuel damage occurs for other reasons. These accidents would have a potential for major radiological consequences if radioactive materials released from the fuel were not adequately confined. As a result of the accident prevention policy, they are of low probability of

occurrence.

23. Since these accidents could nonetheless occur, other procedural measures (accident management) are provided for managing their course and mitigating their consequences. These additional measures are defined on the basis of operating experience, safety analysis and the results of safety research. Attention is given in design, siting, procedures and training to controlling the progression and consequences of accidents. Limitation of accident consequences requires measures to ensure safe shutdown, continued core cooling, adequate confinement integrity and off-site emergency preparedness. High consequence severe accidents are therefore

extremely unlikely because they are effectively prevented or mitigated by defence in depth.

24. Notwithstanding the high level of safety so achieved, increased understanding  of severe accidents beyond design basis events has led to complementary design features being implemented in some operating nuclear power plants as well as expanded guidelines and/or procedures to cope with severe accidents of very low likelihood beyond design basis.

25. For future nuclear power plants, consideration of multiple failures and severe accidents will be achieved in a more systematic and complete way from the design stage. This w ill include improving accident prevention (for example, reduced common mode failures, reduced complexity, increased inspectability and maintainability, extended use of passive features, optimized human–machine interface, extended use of information technology) and further reducing the possibilities and consequences of off-site radioactive releases.

26. In the safety technology of nuclear power, overall risk is obtained (as discussed in Section 2.1) by considering the entire set of potential events and their respective probabilities and consequences. The technical safety objective for accidents is to apply accident prevention, management and mitigation measures in such a way that overall risk is very low and no accident sequence, whether it is of low probability or high probability, contributes to risk in a way that is excessive in comparison with other sequences.

27. The target for existing nuclear power plants consistent with the technical safety objective is a frequency of occurrence of severe core damage that is below about 10–4 events per plant operating year. Severe accident management and mitigation measures could reduce by a factor of at least ten the probability of large off-site releases requiring short term off-site response. Application of all safety principles and the objectives of para. 25 to future plants could lead to the achievement of an improved goal of not more than 10–5 severe core damage events per plant operating year. Another objective for these future plants is the practical elimination of accident sequences that could lead to large early radioactive releases, whereas severe accidents that could imply late containment failure would be considered in the design process with realistic assumptions and best estimate analyses so that their consequences would necessitate only protective measures limited in area and in time.