IAEA SSR-2/1 SPECIFIC REQUIREMENT: REINFORCEMENT OF DEFENCE IN DEPTH CONCEPT

REINFORCEMENT OF DEFENCE-IN-DEPTH: MODIFICATION PRACTICE AFTER THE FUKUSHIMA NUCLEAR ACCIDENT

3. IAEA SSR-2/1 SPECIFIC REQUIREMENT: REINFORCEMENT OF DEFENCE IN DEPTH CONCEPT

With the publication of SSR-2/1 document addressing the specific safety requirements for the design of a nuclear power plant, the philosophy of the Defence in depth was not modified but the concept was reinforced to match the new objectives given by SSR-2/1 Requirements in terms of radioactive releases:

• Any sequence which could lead to high radiation doses or large radioactive releases shall be practically eliminated, and that there are no, or only minor potential

radiological consequences for plant states with a significant likelihood of occurrence (SSR-2/1 Requirement 5, item 4.3).

• A primary objective shall be to manage all design basis accidents so that they have no, or only minor, radiological impacts, on or off the site, and do not necessitate any off-site intervention measures (SSR-2/1 Requirement 19, item 5.25),

• For design extension conditions, only protective measures that are of limited scope in terms of area and time shall be necessary for protection of the public, and sufficient time shall be made available to implement these measures (SSR-2/1 Requirement 20, item 5.31).

Level 4 has also been reinforced by enhancing the design requirements applicable to the means necessary to prevent severe accidents and to mitigate the consequences to make prevention and mitigation of such accidents more reliable taking into account that the consequences of their failures in case of demand would lead to large releases and

37 consequently to a long term off-site contamination. The relevant requirements are given in (SSR-2/1 Requirement 20 and associated items):

• First, initiating events or sequences of events which might exceed conditions caused by the design basis accidents shall be considered for the design of the plant unless their practical elimination by design be provided,

• SSCs implemented for prevention and migration of such conditions shall be independent, to the extent practicable, of those used in more frequent accidents,

• Conditions caused by these events or sequences of events shall be assessed and used to define the design basis of the SSCs necessary for mitigating their consequences. The assessment may be made using less conservative rules and less penalizing conditions than those required for the assessment of the conditions caused by the design basis accidents, but appropriate margins to avoid cliff edge effects are nevertheless requested. Demonstration that the mitigation of the consequences would be possible by crediting those SSCs only is requested.

The requirements established in SSR-2/1 primarily apply to new builds and might not be fully met at some existing nuclear power plants that were built to earlier standards. The extent to which the SSR-2/1 requirements are to be applied to existing plants is a decision for individual States. In particular, for existing plants the accident management of situations not explicitly considered in the original design might take use of non-permanent equipment, available at the site or not, provided the grace period before unacceptable consequences is sufficient for the installation of this non-permanent equipment. Nevertheless, accident management measures should not be used as an excuse not to install to the extent practicable permanent complementary equipment for both preventing progression of the accident and mitigating their consequences by limiting the radioactive release.

However, and although the Defence in depth concept with five consecutive levels was clearly defined in INSAG 10 document (1996) and its application required by the IAEA Requirements NS-R-1 (2000), the Fukushima Daii-chi accident and the “stress tests”

conducted in different countries have revealed some deficiencies in its implementation.

Consequently, the IAEA Secretariat was requested by the General Conference, held in September 2011, to review and to revise as necessary the IAEA Safety Standards in the light of the analysis of the Fukushima Daiichi accident.

For SSR 2/1 requirements, even if all the causes of the Fukushima Dai-ichi accident may not have not been identified yet, the following issues have already been identified as relevant and essential for the safety of nuclear plants and should be considered when designing new builds or re-assessing the design of existing plant:

• As external hazards can impair all the levels of defence, a correct site hazard

characterization is of first importance for the design of a plant which should be such that any external hazard defined for design could not lead to the total loss of a system intended to accomplish one of the fundamental safety functions, (INSAG 10, 2.4

“levels of defence”, item 36 : Level 1 provides the initial basis for protection against external and internal hazards (earthquakes, aircraft crashes, blast waves, fire,

flooding) even though some additional protection may be required at higher levels of defence),

• Design of SSCs important to safety should provide adequate margins to cope with hazards and internal events causing loads exceeding those strictly considered for the design (derived from INSAG 10 “Basic prerequisites”. An effective implementation of defence in depth has some prerequisites which apply to all measures at all the levels.

Appropriate conservatism is one of these prerequisites).

Margins are needed to avoid a cliff edge effect in case of a small deviation in a plant parameters (SSR-2/1 Req. 17, item 4.11), and their magnitudes should generally be commensurate with the safety significance of the SSC. The magnitude of margins is determined by applying design rules and methodologies of different grades of

conservatism (e.g. rules for design extension conditions may be less conservative than those used for the design basis accidents) and by considering number of uncertainties.

Nevertheless, the Secretariat recognizes that there is a need for harmonizing the approach to defining and assessing margins. The Secretariat has undertaken activities to prepare a report on the technical basis for an expanded definition of margins.

• Any design should include provisions (complementary equipment, procedures, connections for non-permanent equipment) to facilitate the accident management of situations exceeding those originally considered.

The relevant provisions should be identified and installed by assessing the timely response of the plant in the event of such situations.

Recently nature has shown us at various sites how much devastating natural phenomena could be, and taking into account the difficulty to predict the intensity of future natural hazards, some Contracting Parties have expressed during the 2^nd extraordinary Convention on Nuclear Safety the idea to enhance in some areas the resistance of nuclear plants with regard to such extreme and unexpected natural hazards with the objective to avoid unacceptable consequences for the public, the environment and the society should such hazards occur.

In this perspective, the set of structures and systems necessary to avoid unacceptable consequences which may be different from site to site and from one type of reactor to another should be identified first.

In conclusion in the frame of the review and revision of the SSR-2/1 requirement document, the IAEA Secretariat is proposing to the Member States to make more explicit some existing requirements and to add a few new requirements to strengthen the overall effectiveness of the defence in depth concept with the objective to make the likelihood of an accident having harmful consequences extremely low.

• Any sequence which could lead to high radiation doses or significant radioactive releases shall be practically eliminated. With the objective to practically eliminate high doses and releases, for reactors having a water pool system for spent fuel storage, the design shall include the necessary capabilities to prevent the uncovering of the fuel assemblies.

• Independence among the consecutive levels of defense shall be implemented as far as reasonably practicable with a particular attention for levels three and four because of the enhanced severity of overall consequences if failures of these two levels occur simultaneously.

• Design of systems and structures ultimately necessary to prevent early and large radioactive releases shall provide for significant margins to accommodate with external hazards of a severity or duration exceeding those considered in their definitions.

• To facilitate the accident management of situations not considered in the original design of the plant, appropriate and necessary features enabling the use of

non-permanent equipment or power sources should be installed with the objective to avoid large releases and long term off-site contamination.

4. DEFENCE IN DEPTH CONCEPT: EFFECTIVE INDEPENDENCE OF THE

문서에서 @ IAEA TECDOC SERIES (페이지 49-52)