|
EUROPEAN COMMISSION DIRECTORATE-GENERAL FOR ENERGY AND TRANSPORT
Euratom Safeguards OfficeThe Director
Dear Colleagues,
Please find herewith the final version of the Working paper describing the process and the outcome of the mission
with trilateral participation established under Chapter IV of the Melk Protocol.
The paper has now been sent to Vice-President Mrs de Palacio with an invitation to address it to Commissioner Verheugen.
I decided to finalise the work at the end of June, according to the provision found in the Melk Protocol.
Having circulated a previous final draft after the Brussels meeting, a delegation asked me to make a further attempt, at the very end of May, in order to try to reach full consensus.
The experience showed that in agreeing I made a huge mistake. Instead of bridging the gap, the one month further delay was on purpose and led to a widening of the gap.
Therefore I have decided to terminate the exchange of notes between the parties on 29 June 2001 and to finalise the text under my own responsibility.
This would not prevent any other party to associate itself with the text, even if reservations are made on the conclusions I have drawn on some of the issues remaining open.
For those issues, for which not even a procedural conclusion could be agreed, I have decided to use the conclusions drawn on the similar issue by the AQG / WPNS report adopted by COREPER, on 6 June.)
I did it because I never experienced, in international negotiations, a situation in which a party took a position in one forum and another one in another forum.
Therefore I though it legitimate to base my final draft, when needed, on such sound principle.
Concerning the additional contributions received between the 30 May meeting and the 29 June, I have taken on board as much as I could, but without putting at risk the general balance of the paper.
An additional document of 179 pages, received on 3 July looked like a final attempt to ensure the collapse of the Melk process. Fortunately, it arrived after my deadline.
Therefore only a reference is made to it in a footnote on page 2 of the executive summary. I do not intend to circulate it to anybody, as I consider it as a paper issued under the sole responsibility of Austrian experts.
Finally, I draw your attention to the fact that I merged together the previous "executive summary" and "final statement" to avoid the numerous redundancies existing between these two papers)
Concerning the additional contributions received between the 30 May meeting and the
29 June, I have taken on board as much as I could, but without putting at risk the general balance of the paper. An additional document of 179 pages, received on 3 July looked like a final attempt to ensure the collapse of the Melk process.
Fortunately, it arrived after my deadline. Therefore only a reference is made to it in a footnote on page 2 of the executive summary. I do not intend to circulate it to anybody,
as I consider it as a paper issued under the sole responsibility of Austrian experts.
Finally, I draw your attention to the fact that I merged together the previous "executive summary" and "final statement" to avoid the numerous redundancies existing between these two papers.
Thanking you again for the efforts made and contributions provided during the "mission with trilateral participation" I had the honour to chair, I also wish you all the best for the future and very nice holidays to start with.
Regards,
C. Waeterloos
WORKING PAPER SUMMARISING THE OUTCOME OF THE EXPERT MISSION WITH TRILATERAL PARTICIPATION
ESTABLISHED UNDER THE MELK PROTOCOL (CHAPTER IV)1
EXECUTIVE SUMMARY
The Protocol of the negotiations between the Czech and the Austrian Governments led by Prime Minister Zeman and Federal Chancellor Schüssel, with the participation of Commissioner Verheugen, was concluded in Melk, on 12 December 2000.
In its Chapter IV the parties « agreed to conduct a « trialogue » to find a better mutual understanding on the issue of the Temelin Nuclear Power Plant » related to nuclear safety.
To this end, the parties established « an expert mission with trilateral participation » which was dispatched
first to Vienna, on 2 February 2001, to identify the Austrian main issues of concern. During a subsequent mission
to Prague and the Temelin NPP, on 15 and 16 March 2001, the same expert mission heard the explanations given by
representatives of the Czech Republic on these issues of concern. A final joint meeting took place in Brussels,
on 14 and 15 May 2001, in order to find solutions to the identified problems, on the basis of the state of the
art relevant in the Member States of the European Union. A final discussion between heads of delegation took
place in Brussels on 30 May 2001, at the request of the Austrian side.
uring the process, twenty-nine issues of concern have been identified. All of them were documented and
addressed. Two additional workshops were organised in Rez on 26-27 February and in Prague on 4 April. An IAEA
Operational Safety Review Team mission lasting for three weeks in February 2001 reviewed the operational safety
of the plant. The conclusions were presented to the trilateral expert mission. Five issues of major concern to
Austria were selected and discussed in depth in the Prague and Temelin meeting.
The role of the Commission services was not to evaluate the technical safety of the power plant, but to
facilitate the dialogue and exchange of information between the Austrian and Czech sides in order to identify
the main issues of concern and to find solutions to the problems identified. Under this "trialogue" significant
progress has been made. The overall outcome of the process has been positive, for all of the 29 (twenty-nine)
issues of concern addressed during the trialogue procedure.
This technical working paper summarises the work of the tripartite mission. For each of the twenty-nine issues
of concerns identified, this paper provides a summary of the discussions which have taken place and of the final
outcome for each of them.
To limit the size of this paper recording the positions of the parties, these have been summarised.
The summaries therefore do not always present the full scope of the concerns expressed nor the details of the
information provided. The detailed positions of the parties to the process can nevertheless be found in the
papers they have circulated during the process 2.
At the final stage of the process, all issues found a common understanding. The expert mission under the
Melk protocol regarded nine issues (out of 29) as closed, meeting the purpose of the Melk
process 3. Due to the nature of the respective topics, the expert mission found another ten issues
more suitable to be followed-up after the end of the Melk process, in the framework of the pertinent bilateral
Austria-Czech agreement 4. Finally, the Melk process helped to narrow gaps in the understanding
of ten major issues to be further reviewed by the appropriate instances 5. Even if it was not
possible to reach an agreement on all the issues at stake, all participants agreed that the aim foreseen in Melk,
namely to facilitate the dialogue between the governments of Austria and of the Czech Republic, has been
achieved. Therefore, Chapter IV of the Melk Protocol may be considered as fully and satisfactorally
implemented.
At the request of the Council of the European Union, a Working Party on Nuclear Safety (WPNS) in the
context of enlargement was established on 26 July 2000. The report of the WPNS/AQG was examined and endorsed
by COREPER on 6 June 2001. Recommendations made concerning the Czech Republic in relation to Temelin are
presented in annex 1. These may serve as a way to better qualify remaining Austrian concerns recorded in this
paper and to propose an EU peer review procedure to monitor the implementation of the recommendations made.
The European Commission experts participating in the "expert mission with trilateral participation"
established in Melk do, therefore, consider that they have complied the task they were provided with under
Chapter IV of the Protocol.
I N T R O D U C T I O N
This paper is an attempt to summarise the discussions which have taken place during the implementation of
Chapter IV of the Melk Protocol which provided that an expert mission with trilateral participation would be
dispatched first to Vienna to identify the Austrian main issues of concern (called hereafter "issue of concern");
during a subsequent mission to Prague and Temelin NPP, the same expert mission would hear the explanations given
by the representatives of the Czech Republic on these issues of concern (called hereafter "explanation given").
A final joint meeting would take place in order to find solutions to the identified problems, making use of
the expertise of the Commission officials involved in the process. The outcome of the process established in Melk
is presented (titled hereafter "final outcome").
The grouping of issues is made according to the schedule of the different meetings, which have taken place
from 2 February to 30 May 2001.
1. The REZ meeting (26-27 February)
During the first trilateral meeting in Vienna on 2 February 2001 as part of the implementation of Section
IV ("Safety Issues") of the Melk Protocol on Temelin NPP, it was decided to hold on 26-27 February in Rez a
special meeting to discuss three specific technical issues.
· Issue 9. Reactor pressure vessel (RPV) embrittlement and pressurised thermal shock.
· Issue 10. Main steam line safety and relief valves qualification for two-phase and water flow.
· Issue 22. Non-destructive testing (NDT).
After the Rez meeting, further discussions to clarify pending issues took place on 16 March 2001 in a
parallel session to the visit at Temelin.
Issue 9. Reactor pressure vessel (RPV) embrittlement and pressurised thermal
shock (PTS)
Issues of concern :
Questions were raised concerning : quality assurance programme in place; qualification programme for RPV
materials; regulation applicable for defect evaluations during the manufacturing, pre and in-service inspection
(ISI); number, location, content and specific purpose of the containers used for the RPV surveillance specimens
programme; treatment of a supposed defect at the bottom of the RPV; present situation of the structural
integrity assessment for pressurised thermal shock (PTS) analysis; justification of the conservatism
of the limiting operational pressure - temperature (p-t) curves; and the use of these curves during operation
as a temporary substitute of a pre-service PTS analysis.
Explanations given :
A documented presentation on the issues was made by the manufacturer of the RPV and the turbine of Temelin.
The presentation covered the following aspects: codes and standards used in design, manufacturing and
service; RPV description and main parameters; upgrading RPV in manufacturing; RPV materials qualification
programme; acceptance and supplementary acceptance tests; project RPV and reactor internals lifetime assessment;
surveillance specimens programmes; neutron field in RPV; pressurised thermal shock. Pressure - Temperature
limiting (p-t) curves.
It was pointed out, among other things, that:
· The qualification programme for the RPV materials have been extensive, conducting a significant number
of qualification tests.
· The RPV in-service inspection is planned in four-year cycles.
· The surveillance specimens programme monitors property materials of the RPV throughout the lifetime
of the vessel, including the potential annealing of the RPV.
· With regard to the defect found at the bottom of the RPV, and given its characteristics, there
is no problem with the integrity of the RPV taking into account the ISI (In-Service Inspection) in place.
· The (p-t) curves calculations, performed in accordance with a Westinghouse methodology, are very
conservative and sufficient for at least the first five years of plant operation.
· Additionally, the thermal-mechanical calculations and stress analyses of selected PTS scenarios using a
deterministic approach will be initiated this year.
Final outcome :
Most of the questions were answered during the meeting in Rez, and some additional explanations addressing
pending items were provided during the follow-up meeting at Temelin. An outstanding point of discrepancy was
related to whether or not there was a need to conduct very detailed calculations to produce a PTS analysis before
the operation of each of the Temelin NPP Units.
It was indicated that the plant is commissioned and operated respecting PT curves calculations developed
according to Westinghouse methodology. These calculations will be expanded to full PTS analysis for both Units
using a step by step approach with full respect of the IAEA Guidelines on the PTS analysis.
Austria's opinion is, that no pre-service structural integrity assessment for pressurised thermal shock
(PTS) conditions was performed for the reactor pressure vessel (RPV) of Unit°1 before nuclear operation.
The simplified calculations of operational limit curves provided as substitute were not considered by Austrian
experts as appropriate to prove structural integrity as required by all codes6.
It was understood by the parties concerned that such calculations are scheduled to be made in technically
justifiable timeframe (within the next five years), benefiting from the data available from the testing
surveillance specimens programme in order to achieve high accuracy of the analyses.
It should be noted that this issue is also covered by two general recommendations concerning the Safety of
Nuclear Power Plants and the regulatory framework in the context of enlargement7.
Concerning the state of implementation of these recommendations, in Temelin, the WPNS final evaluation
considered them as:
1. sufficiently addressed in national improvement programmes;
2. sufficiently covered by two general recommendations in the main report.
This issue is classified as "low to moderate safety significance". Such a classification indicates that
some parts of the ongoing improvement programme should be checked to be in line with good practices widely
applied within the E.U. The E.U. Council is in the process of establishing such a peer review procedure.
Issue 10. Main steam line safety and relief valves qualification for
two-phase and water flow
Issues of concern :
The lack of qualification of main steam line safety (MSSV) and relief valves (BRU-A) for (high velocity) two
phase and water flow is a generic safety issue, ranked in IAEA category III, for all WWER-1000/320 reactors, as
well as a specific issue applicable to Temelín.8
A complete qualification documentation for main steam line safety (MSSV) and relief valves (BRU-A) was
pending.
During discussions following the Rez meeting, experts asked which studies on design modifications of the
MSSV and BRU-A system had been performed for Temelin, and in particular on the option to install a qualified
steam isolation valve, as recommended in the IAEA VVER 1000 generic issue book (1996) and the IAEA Temelin
specific issue book (1996).
Explanation given :
A presentation was made on the issue covering the criteria used for the qualification for two-phase and water
flow of the "safety and relief valves" and the "main steam safety valves".
The "safety and relief valves" of Temelin NPP (type BRU-A 1115-300/350) had been qualified based on the
qualification programme conducted for similar type of valves existing at Mochovce NPP (Slovak Republic).
The qualification tests were conducted at an EdF test facility (CUMULUS). As for the criteria of similarity
between the two types of valves, the ASME (American Society of Mechanical Engineers) methodology (QME-1-1994)
had been followed.
The "main steam safety valves" (type 969-250/300) had been qualified based on the qualification programme
for a similar type of valves (type 108-250/400), implemented through a co-operative effort between Siemens
and Chekhov.
The selection of the bounding conditions for the qualification were based on the experience of all the
companies involved in the qualification process (Framatome, Siemens and Chekhov). Detailed information
about the test data and testing philosophy remain proprietary information of the companies involved.
Qualification documentation related to this issue is at present being revisited at the initiative
of the regulator based on a recommendation of WENRA.
Final outcome :
The positions of both parties have been clarified.
The functional qualification of main steam line safety and relief valves for two-phase and water flow have
been performed according to ASME QME-1-1994 Standard by extension of parent valves qualification program that
have been previously performed. The qualification documentation for BRU-A relief valve has been prepared for
comments and approval process by the Czech safety authority.
In a similar way, the audit of the main steam safety valve qualification documentation and review of design
similarity, in the manufacturer's factory (Chekhov in Russia) was fixed.
According to the Austrian assessment functional qualification for relief valves (BRU-A) and main steam line
safety valves (MSSV) is still pending. Non qualified valves could remain stuck open in case of accidental
operation under two phase flow conditions. This could trigger an event sequence resulting in a severe accident
with large release of radioactivity. In addition, isolation valves on the main steam lines upstream of the relief
valves, which could mitigate the adverse consequences of a stuck open valve, are not installed in Temelin.
To the contrary, the Czech authority considered that the BRU-A valves were qualified for two-phase and
water flows, and were designed as isolation and throttle valve. There was therefore no need to install
additional isolation valves in front of the BRU-A as requested by the Austrian side.
Despite the documentation available, this seems to remain a major concern to some Austrian experts.
The "Report on Nuclear Safety in the Context of Enlargement" (see footnote 7, p.5) contains a recommendation
of type II 9regarding qualification of Safety and Relief valves in Temelin 1-2,
which suggests "measures to complete the demonstration of reliable function of key steam safety and relief
valves under dynamic load with mixed steam-water flow. The situation with regard to this issue will be
followed up by the E.U. Council peer review procedure.
Issue 22. Non-destructive testing (NDT)
Issues of concern :
A number of questions were identified for discussion, such as: NDT qualification programme; reasons for not
using tandem inspections; use of results of the international project PISC (Project for the Inspection of
Steel Components); feedback of operating experience; scope of the inspections in the RPV and possible
restrictions for inspection due to the placement of containers for the surveillance specimens programme in
the RPV; sensitivity of inspections; report of pre-In-service inspection (ISI) results; applicable Code
regulations for evaluating non-allowable indications; qualification and number of personnel dealing with
NDT (Non Destructive Testing); programme of inspection and limitations for the inspections of the
whip-restrains in steam and feed water piping at the level 28.8 m; accessibility of inspection in
the primary loops; evaluation of non-allowable indications found in the RPV and the pressurizer that were
not repaired; defects found in the surge line; and evaluation of defects found in loop 2.
Explanation given :
The presentations made covered the following aspects: legal basis and legal framework; lifetime evaluation;
SUJB regulatory guides; safety analysis reports; personnel qualification; NPP Temelin ISI programme; nuclear
safety assessment and verification (SUJB practice); SUJB inspections of weld joints (examples);
framework for ISI qualification; principles for the derivation of basic qualification requirements; ISI
qualification requirements and priorities; establishment of ISI objectives, qualification body, as well
as pre-operational safety analysis report; overview on Examination Programme of Primary Loop Components
(RPV inspection programme and equipment, steam generator, pressuriser, main circulation piping, connecting
piping to pressuriser); review of documents (Non-conformance, manufacturing passport for selected cases);
NDT qualification.
It was pointed out, among other things, that:
· The NDT qualification programme is in accordance with the European Network for Inspection Qualification
(ENIQ), recommendations from the European regulators (document EUR 16802) and IAEA principles.
. The qualification programme of mechanised Ultrasonic Testing (UT) of RPV from outside and inside
includes except for two available test blocks (RPV nozzle inner radius and RPV nozzle to primary piping
of 850 mm diameter) the preparation of a test block for the qualification of VVER 1000 RPV
circumferential butt welds including cladding and a full qualification conducted in two phases.
The first phase as a part of the technical justification will be performed on the test block available
for VVER 440 type RPV this year. The second phase will be completed by the full qualification of
inspection procedures conducted on the VVER 1000 RPV test block not later than in 2004 including the first
expected application within the ISI Programme.
· The use of tandem was not considered strictly necessary because it was not required by the Czech
regulator (SUJB) and the fact that it is possible to conduct inspections of the RPV from outside.
Mechanised UT examinations of RPV cylindrical part performed from inner and outer surface are mandatory
and included in the RPV ISI Programme. The qualification of these RPV UT inspections from outside and inside,
required by SUJB, will be focused to prove a sufficient effectiveness and capability of the used NDT system
and to justify the replacement of the tandem technique by the TOFD techniques applied from both surfaces.
· There is no restriction for inspecting the RPV owing to the placement of the surveillance specimen holders
in the RPV.
· All the pipe whip restrains in steam and feed water piping at the level 28.8 m. will be inspected by
the UT qualified NDT system within the next four years. The qualified UT system will be applied and verified
within UT inspections of circumferential piping welds and the welds of fixing plates of pipe whip restrains
conducted on Unit 2 this year.
· Records corresponding to treatment of the defects found in loop 2 of the primary piping show that
all defects were repaired and properly inspected.
Final outcome :
Most of the questions were answered and the information provided regarding the definition of the system to
deal with non-destructive testing (procedures, regulation, qualification programmes, etc.) was according to
EU Member States practices, adequate and comprehensive.
Nevertheless, the Austrian position is that the non-destructive testing (NDT) program for primary loop
components involving a variety of methods has not yet been qualified (calibrated) although appropriate test
blocks are available. Material defects undetected by insufficient NDT could jeopardise the strength and thus
component integrity.
According to explanations given by Czech experts, all tests during manufacturing and pre-service ISI
give full justification of the integrity of all components. Qualification programme will assure that all
service ISI will be carried out as fully qualified.
No specific ultrasonic test methods (i.e. Tandem technique or French focussing technique) were used that
guarantee a reliable detection of severe crack-like defects perpendicular to the surface in the reactor
pressure vessel. Thorough manufacturing testing programme excludes such defects however.
In the plant documentation three non-allowable defect indications (according to the accepted
standards) were discovered, that were left unrepaired without the appropriate defect evaluations.
However, technical justification provided is sufficient to meet present regulatory requirements.
Additional technical justification can be found in Annex 2.
There are therefore still Austrian concerns regarding the non-use of tandem inspections and some practical
applications of the NDT system in place, especially the inclusion of qualified UT methods for reliable
detection of crack-like defects perpendicular to surface in safety relevant components
(RPV, RPV head and components with wall thickness over 100 mm), as well as the application of mechanised
UT inspection to the main steam lines, and of special procedures for inspection of pipe whip restraint
fixations welds (underweld cracks initiated from the weld-base metal interface).
The discussions confirmed that qualified UT Non Destructive Examination (NDE) inspections following the
ENIQ (European) methodology will be applied for all critical components including steam line welds and areas
with pipe whip restraints. The application of TOFD technique has been already proposed for the RPV UT
examinations within the pre-service inspection of Unit 2 and inspection of Unit 1 starting in 2002.
In view of these assurances the issue should no longer remain a major concern, provided the necessary
qualified inspections are properly conducted in due time. Austrian experts do not fully share these views
despite the fact that upgrading of non-destructive testing for Temelin was classified as being of "low
to moderate safety significance" in the Report of the WPNS (see footnote 7 page 5).
-------------------------------------
NOTICES
1 This paper has been drafted under the sole responsibility of European Commission experts
involved in the process, even if for its largest part, the « final outcome »
statements were agreed jointly by the three parties concerned.
2 Austrian Report to the expert mission with trilateral participation (January 2001)
Czech Republic Report to the expert mission with trilateral participation (March 2001)
Another Technical Position Paper of Austria prepared after the expert mission with trilateral
participation (dated June 2001) was sent to the parties early July.
3 issues 2, 3, 12, 14, 15, 17, 20, 24, 25
4 issues 5, 7, 11, 13, 16, 18, 19, 21, 23, 29
5 issues 1, 4, 6, 8, 9, 10, 22, 26, 27, 28
6 Additional justification is provided in Annex 2
7Report on Nuclear Safety in the Context of Enlargement established by an ad'hoc Working
Party on Nuclear Safety (WPNS) at the request of the Atomic Questions Group (AQG) of the Council of the European
Union, and endorsed by COREPER on 6 June 2001.
8 WENRA Report (2000) stated for Temelin: Plant-specific safety demonstration for the
functioning of the main steam relief valves and the main steam safety valves under dynamic
loading with a steam-water mixture still has to be fully verified. This action is underway.
This function is needed to control specific primary to secondary leaks.
9 Type II means " recommendation of improvements and other necessary measures which
should be implemented, but in a more flexible time-frame than type I " . Type I being
"recommendations with the highest priority, to be implemented in a specific and limited time-frame".
2. Operational Safety, OSART report
The Operational Safety Review Team (OSART) of the IAEA is focused on operating practices in the areas of
management, training, operation, maintenance, technical support, radiation protection, quality assurance and
emergency preparedness. A previous pre-operational review (PROSART) was conducted
in February 2000 by a team of 6 people during one week, and the complete one was performed the last three weeks
of February 2001 and involved 13 people over a period of three weeks. The final report is now completed and
already released.
During the tripartite meeting in Prague on 15/3/01, the chairman of the OSART mission presented their
preliminary conclusions, which can be summarised as follows:
Areas identified as having room for improvement :
· Safety Culture was well witnessed but needs continuous efforts in order to be maintained and
reinforced.
· Self-assessment, quality assurance, and performance indicator implementation have to be extended.
· Surveillance program, maintenance and work process, temporary modifications, and supporting procedures
exist, according to the status of the plant; they have to be fully implemented. Very good improvement has
been seen in contractor work practices.
· Technical processes are well established, only the diesel trending needs surveillance.
· Industrial safety needs further improvement, clearance is well done.
· The fuel integrity program has some room for improvement.
Areas identified as good practices :
· Plant condition is quite good, material condition and housekeeping have had a very good
improvement compared with last years' IAEA mission.
· Emergency preparedness seems very good.
· The re-evaluation of training and feedback should provide good results.
· The operating experience is very well established, to mention specially the external operating experience
from vendors.
The Vienna meeting of 2 February agreed that due to time constraints not all issues of concern could be
discussed during the expert meetings associated to the implementation of Chapter IV of the Melk Protocol.
The Austrian and Czech sides therefore agreed not to fully treat the issues 6, 27 and 28, but to await the
results of the IAEA OSART Mission to Temelin.
Issue 6. Emergency Operating Procedures (EOPs) and Severe Accident Management
Guidelines (SAMGs)
Issues of concern :
It is understood that the EOPs have been implemented, but Austrian experts would have liked to
review them. They are also aware that the SAMGs were not implemented for start-up of Unit 1.
Important in this context is the related issue of post-accident monitoring and sampling in
terms of design, capability, qualification, and availability of information in the main and
emergency control rooms, as well as in the technical support centre.
Explanation given :
The answers to this topic were divided into three areas.
· Tool for Prevention of Severe Core Damage - Emergency Operating Procedures
The set of the symptom-oriented operating procedures for the Temelin NPP was developed according to the
Emergency Response Guidelines methodology elaborated by the Westinghouse Owners Group. The optimal
recovery procedures cover all the relevant scenarios identified by the PSA 1 Study, which may lead to a
core damage. For other remaining scenarios, function oriented approaches were used. All interventions
are conformed to ensure the following goals:
1) to prevent core damage, 2) to minimise possible consequences of radioactivity release to the
environment.
At present these EOPs are fully implemented at the Temelin NPP, being verified and validated on the full
scope simulator. Temelin personnel are regularly trained to use them.
· Tool for Mitigation of Severe Core Damage - Severe Accident Management Guidelines
The Temelin NPP has (within its emergency response organisation) several cognisant safety engineers who
are specially trained to support the Control Room personnel to mitigate consequences of severe accidents.
Their working place during the accident conditions is the Technical Support Centre. As a systematic tool for
this support, the Technical Support Centre staff will use Severe Accident Management Guidelines developed by
the Westinghouse Owners Group safety engineers. These guidelines are not fully implemented yet, however,
the main severe accident mitigate measures are established and technical means are available to access the
status and progress of the severe accident (see Issue 4 and 16).
Notwithstanding the SAMGs are not fully implemented yet, analytical support for SAMGs development was
finished before the fuel loading. During this phase the results of the PSA 2 study were used to categorise
scenarios which needed additional
efforts to confirm correctness of the accident management measures. These scenarios
have been analysed.
The analyses performed up to now provide a deep knowledge of the severe accident phenomena. Based
on this knowledge a systematic training of safety engineers was completed. The special computer tool
for presentation of the severe accident analyses results
is available to their use in the Technical Support Centre. This seems sufficient for the time being;
notwithstanding a contract for development of a new type of the SAMGs was already signed with Westinghouse.
· Post-accident monitoring capabilities
The Post-Accident Monitoring System (PAMS) has been installed at the Temelin NPP (in both the main control
room and the emergency control room) to provide the post accident monitoring. It is a part of the I&C systems
and it is classified as a safety system.
All the plant parameters and components necessary to bring the plant to safe conditions are monitored by the PAMS.
The Technical Support Centre (TSC) is equipped with a monitoring system that gives direct access to the on
line technological data from both plant units, as well as from other parts of the plant. Another computer
tool exists at the Technical Support Centre using a code for the assessment and prediction of the possible
adioactive release consequences in the surrounding areas of the Temelin NPP. The TSC staff can independently
evaluate the safety and radiological status of the plant,
and provide the best recommendations to the control room personnel and to the local operators.
Final outcome :
It was understood that SAMGs as well as the transition from EOPs are already prepared for implementation as
recommended by the IAEA INSAG in their report INSAG-8 for the Plants Built to Earlier Standards and in
INSAG-10.
Severe accident analyses, taking into consideration operator interaction to limit radioactive release were
asked for to support Austria's analyses of possible effects on its territory. In reply the Czech side noted
that in western countries it was not common practice for a country to review the common product of another
country or company (Westinghouse - ČEZ) in the area of plant operational documentation. The reason is that
without deep knowledge of the methodologies used such review could lead
to misunderstandings and misinterpretations. Nevertheless, all in all, the PAMS seems to be a good system
for post-accident monitoring, and the Technical Support Centre is well equipped for the prediction and
assessment of the consequences of radioactive releases.
In addition, as stated in the OSART presentation, the operator is in the
process of having all these tools completely implemented. Emergency preparedness was identified as a good
practice.
A final understanding between the two parties could therefore be achieved provided necessary information
are accessible to allow Austria to proceed with its EPZ planning to the extend needed.
Willingness of the Czech side to initiate such co-operation was indicated during the Melk process.
Issue 27. Safety Culture
Issues of concern :
The broad issue of safety culture covers several aspects. Having primarily operational safety in mind,
two specific aspects : (a) operating experience feedback, and (b) root cause analysis procedure and how
these aspects of safety culture are integrated into the management and operation of the plant has important
implications that need to be investigated. In addition (c) elements have been raised by Austria during the
trilateral Melk process concerning licensing procedures 10
.
Explanation given :
There is an operational experience feedback (OEF) group established at the Temelin NPP within the nuclear
and operational safety department dealing with internal and external aspects.
As stated by the OSART team: "The OEF engineers are knowledgeable, with operational, design and
engineering experience. Numerous examples have been provided to indicate that the in-house events
reporting system and events investigation process is well established".
The events reporting system at the Temelin NPP has a sufficiently low threshold to cover also the near misses
and the precursors. The plant has at the moment 4 years experience in reporting the events. Up to 15 events
were classified in accordance with the International Nuclear Event Scale (INES) methodology as the INES 0
and none as the INES l or higher up to now.
All the initial events at the Temelin NPP are categorised into the three groups: 1) highly considerable
events -from the nuclear safety, operational reliability and possible harm for the plant point of view,
2) less considerable events -equipment malfunctions with no effect to plant operation and plant safety and
3) -not considerable events.
For the events in the first category the investigation of the direct cause and the root cause analysis is
always performed. For the Root Cause Analysis the Temelin NPP uses the HPES (Human Performance Enhancement
System) and the ASSET (Assessment of Safety Significant Events) methodologies. During the investigation the
corrective measures are always suggested by the OEF engineers. The results of the analyses and the suggestions
for the corrective measures are always reviewed by the Failure Commission that approve the root causes of the
reported events and the corrective measures. The implementation of the corrective measures is tracked for their
implementation by the OEF engineers. The sufficiency and the efficiency must be confirmed by the Failure
Commission as well. This commission includes mainly the plant senior managers and other invited specialists.
For the events in the second category the corrective measures are defined but detailed investigation of
direct cause is not performed. The implementation of the corrective measures ensured by the commissioning expert
group is also tracked by the EOF engineers.
The third category are those events which are accounted only by the OEF group in order to analyse whether
they might belong to the "repeated events" category.
External operational experience is also screened at the Temelin NPP. The events are sent to the
appropriate specialists to get their review and to propose corrective measures if the information
presented in the external event reports is applicable to the Temelin plant. Proposed corrective measures
are considered by and assigned to the Failure Commission meetings.
Final outcome :
As indicated in the OSART report, the safety culture showed a good rate of
improvement. The OEF was found as an example of good practice and the re-evaluation and feedback
to training as well. Both, OEF and RCA, meet western industry standards.
The feedback to training from internal and external operating experience need now to be properly
implemented.
Both sides agreed to continue exchange of information on these issues in the framework of the
pertinent bilateral agreement.
Despite this agreement some Austrian experts still consider the issue as a concern (see annex 2).
Issue 28. NPP Organisational Structure and Management
of Licensing Activities
Issues of concern :
Organisational structure with functional responsibilities and authorities associated to each identified
safety position and the associated administrative structure, are of significant importance for the management
of safety activities of the NPP.
These aspects together with the NPP organisation for management of licensing activity and interface with the
State Office for Nuclear Safety (SÚJB) are to be evaluated according to additional documentation and
information provided by CEZ a.s.
Explanation given :
Similarly to other Western countries, basic information on organisation and responsibilities is included
in the Quality Assurance (QA) plan, which is one of the power plant licensing documents approved by the State
Office for Nuclear Safety (SÚJB). This is why this information is not in detail repeated in the POSAR.
Organisation of Temelin Nuclear Power Plant (NPP) forms part of a nation-wide energetic company CEZ, a.s.
(CEZ, joint-stock company). The main representative of this organisational unit is an Executive Manager who
is in accordance with the Act No. 18/1997 Coll. primarily responsible for preparation and realisation of all
constructions within the Temelin NPP and for preparation of operation as well as for operation under the binding
legal regulations, permissions and decisions of the State Administration bodies involved and under legal
licensing, safety and other criteria. Direct subordinates of the Executive Manager are the Construction Manager,
Production and Technical Manager and Financial Manager.
The Construction Manager is responsible for preparation and realisation of the Temelin NPP construction.
Assurance of financial resources is under responsibility of the Manager for Finance and human resources.
The production and technical section ensures the main process : production of electricity. The main objective
of this section is to ensure operation while respecting all safety requirements. The Manager of Production
and Technical section is responsible to the Executive Manager of the Temelin NPP construction for safe, reliable
and economical operation. Direct subordinate of the Production and Technical Manager is a Safety and Technology
Manager with a right of direct reporting to the plant Executive Manager. His position is oriented especially to
functional devices in the following fields : nuclear, ecological, industrial safety, radiation protection and
emergency preparedness.
Final outcome :
The OSART results will serve as a basis for corrective actions where needed. Plant organisational structure
and management of safety practices are subject of regular SUJB surveillance.
In addition, international peer review exercises including by the IAEA, will serve as another independent
check.
This issue was therefore found more suitable to be followed, on the basis of the final report of the OSART
mission (and those of the following OSART missions), outside of the Melk process.
-------------------------------------
NOTICES
10 These are of course contrary to the general principle accepted in Western Countries
that licensing procedures are the sole responsibility of the national licensing authority concerned.
3. The Prague and Temelin meetings (15-16 March 2001)
At the Vienna meeting, on 2 February, it was agreed to select five core issues for an in-depth discussion
in Prague and Temelin. These discussions, supported by written documentation and detailed presentations,
addressed the following issues:
· "Natural Gas Pipeline Accidents and their potential impact on Temelin" (issue N°. 2)
· "Main Steam Line and Feed-water Line Possible Breaks" (issue N°. 8)
· "Sump Screen Blocking and Sunction Line Integrity" (issue N°. 14)
· "Reactor Coolant Pump Seal Integrity" (issue N°. 15)
· "Environmental and Seismic Qualification of Equipment" (issue N°. 19)
The first and last presentations aroused the most discussion between the experts.
Issue 2. Natural gas pipeline accident
Issues of concern :
There are three large natural gas pipelines close to the plant (900 meters). In addition there are
other smaller pipelines supplying the auxiliary gas-fired boilers at the nuclear power plant.
These pipelines represent a potential risk through rupture of pipes with or without ignition, penetration
of the gas cloud
inside the main containment building or other auxiliary buildings such as turbine hall, diesel generators etc.
There are no combustible gas detectors in the ventilation system that could isolate the ventilation system and
prevent ingestion of gas in the main buildings.
Explanation given :
Several scenarios for different types of pipe rupture, gas leakage and their consequences were analysed by
the Czech experts. They presented a detailed answer to questions from Austria. The questions addressed in
Prague dealt
with the possibility of a pipe rupture oriented horizontally and the drifting of gas towards the plant.
The Czech pointed out that their model calculations show that the gas cloud would not reach the site and that
the various buildings were capable
of withstanding the heat load and pressure wave impact from a hypothetical explosion and fire. The leak before
break was used during the design phase and material for the pipelines were chosen so as to minimise the risk
of rupture and all the welds were tested during construction of the pipeline. The pipeline is also regularly
inspected. Additional isolation valves have been installed to reduce the volume of escaping gas in case of
rupture. Special gas detection system
and special organisational measures for the case of a gas accident are operational in the Temelin NPP.
Final outcome :
The installation of additional gas detectors, although not necessary as pointed out by the Czech experts,
will be considered.
Issue 8: Main Steam Line and Feedwater Line Break
Issues of concern :
The main steam lines and main feedwater lines at the 28.8 m level run in parallel between the main isolation
valves and the penetration in the containment vessel with a distance of some 20 meters. As a consequence of pipe
whip, a ruptured pipe could damage or rupture other adjacent lines, unless it is adequately restrained and/or
separated. Possible causes of rupture could be erosion/corrosion effects. The issue involves the adequacy of
the design for the pipe restraint at the penetration of the containment building, the consequence of pipe rupture
and the locations of possible ruptures. Analysis of potential consequences of the current situation for assumed
initiators (including potential external impacts) should be made to have a basis for solutions to be taken.
Explanation given :
The Czech side presented the philosophy, the criteria and requirements that were used for the design and
analyses. In general, solutions used the US approach. A list of documents for guidance was presented (NRC, ASME
and Czech regulations).
The possible pipe break locations are determined from the state of the local stress in the pipe. The analyses
performed show that the stresses at various locations along the pipes are very low. Ruptures are then postulated
at the welds with the sealed penetration (through the containment building) and at welds on pipelines at
anchorage points with the wall of turbine hall. The restraints are then designed to withstand the associated
loads. Manufacturing of the pipes and restraints were carried out with full QA procedures. NDE tests carried
out in January 2001 confirm the quality of the equipment. For the corrosion /erosion issue, the time to reach
the critical thickness has been calculated. Intervals for in-service inspection were determined accordingly.
Final outcome :
Evidence of the resolution of the full scope of the safety case of multiple steam line and feedwater line
ruptures was obviously needed, including information on reactivity control, subcooling effects, danger of
pressurised thermal shocks,
water hammer and dynamic effects, limiting break conditions and direct consequences, demonstration
of robustness and adequacy of pipe whip restraints and erosion-corrosion prevention and mitigation.
In order to support this safety case the following additional actions to be carried out have been announced:
extended assessment of all relevant damage mechanisms, qualified UT NDE of all initial locations by mechanised
testing and application of justified concept of the Break Exclusion at A 820 and A 826/1 and 2 compartments.
This should justify extremely low probability of failure of all relevant piping systems.
Austrian experts, nevertheless, keep a different view on this (see justification in annex 2).
Under all circumstances, it is essential that the operator implements the inspection programme that
it has developed and implement any correction measure deemed to be needed/justified.
The safety authority will ensure that such a programme is properly followed, reviewed and monitored.
The issue will also be followed by the peer review procedure to be established by the Council of the EU,
in accordance with the recommendations made by the WPNS (see footnote 7 on page 5).
Issue 14. Sump screen blocking and suction line integrity
Issues of concern :
All three trains of high pressure injection, low pressure injection, and containment spray are fed during
a LOCA (Loss Of Coolant Accident) out of the containment sump. Blocking of the sump screens can therefore affect
all these systems simultaneously. The assumption is that debris and loose insulation resulting from a pipe rupture
or leak could block the sump inlet screens.
Explanation given :
The WWER-1000 plants are equipped with ECCS (Emergency Core Cooling System) and containment spray systems
that have a similar design basis and basic configuration as in western PWRs. These systems have 3 ´
100% redundancy with the exception of the ECCS water storage tank, which is common to all subsystems.
The same tank serves as a containment sump. The tank is located under the containment and has open connections to
the containment through the bottom plate.
An evaluation of the conditions during a LOCA supported by representative tests was performed. The
experiments showed that under worst LOCA conditions, if the amount of thermal insulation loosened during
the LOCA is as postulated in the US NRC Regulatory Guide 1.82, sufficient flow-rate will be provided through
the partly blocked sump screens for one train of the safety system (spray, low-pressure and high-pressure pumps)
which seems sufficient to cover any design postulated accident.
To reduce the possibility of screen clogging and to assure re-circulation in emergency safety systems,
the following modifications were carried out:
- modification of the way the insulation is fixed to the steam generator in order to increase the
capability of insulation mattresses to preserve their integrity during an accident,
- lowering of holding volumes in the containment (drilling of platforms with "dead" volumes, lowering of
piping penetration collars).
- modifications of screens at the sump inlet.
Additional level measurement systems have been installed in the containment sump tank on both the non-clean
and clean side of the sump screens. If these measurements detect screen clogging and water level drop in the
tank, the operator will be able to shut off one (or possibly two trains) of the TQ systems, which does not mean
any limitation or danger taking into account the 3x100% redundancy.
Final outcome :
It was agreed that the plant operator will consider measures to reduce the necessity for manual interventions
of operations personnel and increase the available time required under LOCA scenarios
to assure the long-term ECCS availability in the framework of sump screen clogging.
Possible measures might be one of the following :
- automatic controls to support the operators in switching off ECCS trains,
- automatic throughput reduction of ECCS pumps or
- installation of systems that allow flushing back of clogged sump screens or other measures based on a
PSA assessment.
The Czech side reconsidered the possibility of parallel sump internal screens blocking in a demanding time
for the operator (and this information was presented to EC representatives based on their request
for additional information). It was concluded that an additional measure would complicate plant design,
and would not bring expected benefit from perspective to help the operators with their duties during
emergencies.
Issue 15. Reactor Coolant Pump Seal Integrity
Issues of concern :
The issue is based on the assumption that a loss of seal cooling or injection and a subsequent failure to switch off the Main Reactor Coolant Pumps (MCP) could lead to a LOCA.
Explanation given :
The seal cooling and injection is ensured during normal operation by the redundant systems.
The seal temperatures and stage pressures including cooling water conditions are controlled by the plants I&C (Instrument & Control) system and will trip the pumps in case of malfunction.
Additional trip criteria for the MCPs are actuated by the reactor protection system.
In case the automatic trip of a MCP fails, 3-30 min, dependent on the fault type, remain for the operators to switch of the pumps manually to avoid seal damages.
Experiments have shown that the seals remain tight under primary conditions and pumps shut down without operation of auxiliary systems and with the valve on the controlled leakage from the seal closed for 24 hours.
Final outcome :
The additional information and clarification regarding this issue provided by the Czech side has shown that this issue should probably no longer be one of primary concern.
The expert mission under the Melk protocol regards therefore this issue as closed, meeting the purpose of the Melk process.
Issue 19. Environmental and Seismic qualification of equipment
Issues of concern :
In NPP Temelin there is no fully established qualification of safety and safety related equipment. Safety and safety related structures, systems or components need to be seismically and/or environmentally qualified.
The concern was that this process was not sufficiently documented and in some cases incomplete and that a status report is required. The practice of qualifying equipment was also questioned.
The content of the in-progress complex program to reassess and finalise the qualification of safety and safety related equipment by year 2002 and its current status of implementation needs to be reviewed.
Explanation given :
The Czech experts presented a paper. The concepts 'Systems and components important to safety', 'Safety systems and components', and 'Safety related Systems and components' were defined. The safety systems were listed.
· The seismic qualification is completed. The methods used were stated. The documents are filed.
· EMC (Electro Magnetic Compatibility) qualification is completed. The documents are completed and filed.
In case of environmental qualification, all processes (tests and/or analyses) required by licensing procedure have been performed. Because of long construction time, in a small number of cases
(where the equipment was procured in the beginning of the nineties), regulatory authority asked for transfer of qualification documentation to standard format till the end of 2001.
Qualification of I&C and electrical supplies (mainly from western countries), which represent the majority of the equipment relevant for qualification, is documented in a standard format.
A summary of the current situation was given.
In all cases, in general US standards were used for western designed or supplied parts, Eastern European standard for those of Russian or Czech origin.
Final outcome :
The Austrian opinion is, that qualification of safety related equipment was not fully established even though the plant is already in the nuclear commissioning phase,
and therefore the status do not comply with internationally accepted safety requirements, by which the qualification of equipment important for safety has to be ensured
and demonstrated before the installation of equipment.
Details were given to satisfy experts that seismic, EMC, and environmental qualification was being treated professionally. All qualifications are effectively completed.
The documents are archived. Nevertheless, in some cases the documentation is being reorganised and amended in order to comply with the latest requirements.
To gain better understanding and evidence of the way this important issue has been managed and is managed is essential. The Czech safety authority declared its readiness to
further explain the qualification methodologies it has accepted to follow. Accordingly, discussions will continue bilaterally outside of the Melk process, in the framework of the pertinent bilateral agreement.
4. Post Prague meeting (4 April 2001)
During the first trilateral meeting in Vienna on the 2nd February 2001, as part of the implementation of Section IV of the 'Melk Protocol', the Czech team offered to hold a specific workshop
on the "Technical basis for Temelin Emergency Planning Zones".
This workshop took place in Prague on April 4th, 2001 and the following technical issues were addressed:
· Issue 1, Containment bypass and primary-to-secondary (PRISE) leakage accidents.
· Issue 4, Containment Design and Arrangement.
· Issue 5, Probabilistic Safety Assessment and Severe Accidents
· Issue 26, Beyond Design Basis Accident Analysis.
· Issue 29, Technical Basis for Temelin Emergency Planning Zones (EPZ).
The presentations led participants through the PSA (Probabilistic Safety Analysis), and the selection of beyond design accidents. Mitigation possibilities were always ignored,
to be on the conservative side. Several of these beyond design accidents were analysed using the MELCOR 1.8.3 code (modified to represent VVER-1000 reactors) to estimate the corresponding source terms.
These were said to be representative of any possible extreme source terms. Czech legal requirements concerning EPZ determination cover accidents with a frequency of 10-7 per year or greater in frequency.
The legal requirements defining the emergency zones in terms of dose over 7 days were described. These together with the above mentioned accident analysis lead to the determining of the size of the zoning.
The emergency actions, which are to be taken in each zone, were specified. Some of these actions are to take place automatically, before taking into account the actual dose rates measured.
Issue of concern :
Based on the documents made available prior to the Melk process, i.e. mainly the POSAR and the PSA, there was serious concern that the containment integrity could not be maintained under severe
accident conditions, and that the contribution of containment bypass sequences to severe accidents was exceptionally high.
Explanation given :
The Czech regulator (SUJB), the Nuclear Power Plant Research Institute (VUJE), the Nuclear Research Institute, Rez (NRI), and the NPP presented the different issues in a scientific/technical way.
Issue 1. Containment bypass and primary-to-secondary (PRISE) leakage accidents
Several such accidents scenarios were investigated in the PSA described below (issue 5). Three such extreme cases, the V, 1a and 1b sequences, were reported.
Issue 4. Containment Design and Arrangement
This issue was not treated separately, although the plan of the containment was often shown. On several occasions questions were asked on specific details in conjunction with some other points,
so that the relevant characteristics of the containment were described. Specific Temelin containment design features during severe accidents were explained.
Issue 26. Beyond Design Basis Accident Analysis
NRI, VUJE and CEZ gave a presentation of the selected sequences of severe accident analysis and the calculation codes used. Original STCP code was used and then, the code MELCOR 1.8.5.
This code developed by Sandia Nat Lab of the US Nuclear Regulatory Commission, was used, but qualified against several other codes from the US, Japan, and Europe.
Using the methodology of US NUREG-0771, two scenarios are reckoned to be extreme and representative of many beyond design basis accidents. One is a worse case, large LOCA (loss of cooling accident)
with parallel SBO (station black out); the other worse case is a leakage from the primary to the secondary circuit, again with parallel SBO. These were presented in details, but without
enough precise information on the source term functions, according to some Austrian expert (see justification in annex 2). Both involve (partial) core meltdown and corium - concrete interaction.
These were used to calculate the radioactive source terms for defining the zones. The calculations were based on the RTARC (Real Time Accident Release Consequence) code, developed by VUJE,
and the results were presented.
Final outcome :
The whole workshop, which was presented in a scientific spirit, gave a comprehensive insight as to how the safety case for the Temelin zones was constructed. The viewgraphs were very informative
and included a great deal of numerical data. In the discussion, the way safety engineers acquire their experience on the plant was also touched upon.
The Czech delegation made a substantial effort to inform the Austrian delegation in great detail. It seems that the safety case and in particular the Planning
Zones have been dealt with according to the usual practice.
The severe accident phenomena and possible mitigative actions of its consequences are topics with a broad common international interest. They are often discussed in multilateral meetings.
Austrian and Czech experts should meet on international forums where these issues are discussed in order to keep each other informed about the latest developments in this area including at the Temelin plant.
The issue will be followed in the framework of the pertinent bilateral Austria-Czech agreement.
Issue 5. Probabilistic Safety Assessment and Severe Accidents
Although the Czech legislation does not require a Probabilistic Safety Assessment (PSA), such an assessment was done by Temelin NPP and the results presented.
The purpose of the PSA application to the severe management was to group similar accidents, i.e. accidents with different initiating occurrences, but similar outcome,
estimate their relative risk, and, hence, to highlight accidents which could serve to define the Emergency Planing Zone.
Issue 29. Technical Basis for Temelin Emergency Planning Zones (EPZ)
This point was dealt with, in great details, by the regulators. The general objectives of accident management and emergency planning are to reduce the risk or mitigate the consequences of the accident
at its source; prevent the accident occurrence and serious deterministic health effects (DHE); reduce the likely stochastic health effects (SHE) as much as reasonably achievable.
Consequences of beyond design basis accidents were calculated as a basis for EPZ determination. Using internationally accepted dose limits and a dispersion/dose model system developed
in cooperation with Slovakia and Hungary, this lead to the identification of the zones, where immediate automatic, pre-planned, responses is necessary, or where the same responses would
be ordered based on environmental monitoring. These would be sheltering, evacuation, and distribution of thyroid blocking iodine. Only for the 'longer term protective action planning zone' (LPZ),
where a diagnostic and predictions are first drawn, would it be necessary to inform Austria and other neighbouring countries. This would be done by the Emergency Response Organisation.
Apart from the above-mentioned measures, the regulation of distribution and ingestion of foodstuffs and water, based on radiation measurements and food sampling, would also be considered.
Final outcome :
Within the framework of the pertinent bilateral agreement between the Czech Republic and Austria,
*information will be provided on any updates of the EP/EPZ resulting from implemented safety upgrading etc.;
*co-ordination will be organised concerning emergency planning and enhanced co-operation will be developed in radiological protection
(as agreed during the "Post Prague Meeting".
It should be noted that a final understanding between the two parties could have been achieved provided necessary information would be accessible to allow Austria to proceed with its EPZ
planning to the extend needed. This might need the inclusion of more precise information on source term functions in absolute and relative terms, as well as source height and released energy,
for all severe accidents to be considered.
5. The Environment Impact Assessment
Parallel to the trilateral discussions on safety issues (Melk protocol section IV) the EIA commission with observers from the EC, Austria and Germany was discussing the scope
of the EIA-documentation to be released to the public and the organisation of public hearings in the Czech Republic and Austria.
Recognising the interest of the general public in the Czech Republic, Austria, Germany and other neighbours, the Czech side announced that it will make available a public
presentation of beyond design and severe accidents consequences (see also issue 26 in section 4 "Post Prague Meeting") on the web site of the Czech Ministry of Foreign Affairs,
together with the Report of the EIA commission according to Chapter V of the Melk Protocol.
Issue 3. Tornadoes
Issues of concern :
Both the POSAR (Pre-OSART) and PSA indicate that tornadoes, except for very mild and very rare ones, do not occur on the territory of the Czech Republic.
This does not seem to be correct according to data available to the National Hydrometeorological Institute. Therefore it needs to be verified if the Temelin structures,
systems and components would be able to cope with such exceptional weather conditions which have recently struck NPP's in other countries, causing considerable damage and loss of offsite power.
Explanation given :
In the case of the Temelin power plant, all safety-related engineering structures have been designed to withstand the effects of external extreme impacts
(seismic action, wind, snow, temperature loading, storm rainfalls, pressure wave due to explosion, aircraft impact). The design basis for these loads in fact cover both static
and dynamic actions similar to tornadoes that might occur in conditions which are usual in Central Europe, including effects of flying fragments (missiles) generated by tornadoes.
The impacts of climatic phenomena are determined for two design basis levels : the design (standard) loads with mean re-occurrence rate of 100 years and extreme loads with
re-occurrence rate of 10 000 years. All structures of the so-called 1st category of seismic resistance were assessed with regard to the actions of extreme loads, i.e.
civil structures housing systems related to nuclear safety. Design basis for wind loading was established on the basis of data taken from records of instantaneous wind
velocities recorded in several localities over a period of 36 years.
A potential for adverse interactions between engineering structures, i.e. influence of damage of the structures that are not safety-related upon the structures
that are important for safety-related functions has been addressed by the design and are described in the POSAR.
In order to facilitate for the event of a damage of the external power network the electricity company ČEZ a.s. and the operator
of the grid ČEPS a.s. have prepared mutually co-ordinated plans of defence and reconstruction and regulations for the event of a breakdown.
These plans and regulations observe rules of networks of the UCTE and requirements regarding assurance of the safety.
Possible impacts on different buildings in the NPP were evaluated and, when relevant, existing safety measures were presented and discussed.
Final outcome :
The additional information and clarification provided regarding this issue has shown that it is probably no longer one of primary concern.
The expert mission established under the Melk protocol is therefore regarding this specific issue as closed, meeting the purpose of the Melk process.
6. Bilaterals
The Vienna meeting of 2 February agreed that not all 29 issues of concern listed by Austrian experts could be discussed during the expert meetings
associated to the implementation of the Melk Protocol. The Austrian and Czech sides therefore agreed to keep some issues for the usual bilateral level,
but to also evaluate these issues in the concluding document of the trilateral expert mission on the basis of written evidence which was provided.
For all these issues the information and clarifications provided by the Czech side have shown that either they are no longer of primary concern to
the Austrian side (issues 12, 17, 20, 24 and 25) or are more suitable to be treated outside of the Melk process (issues 7, 11, 13, 16, 18, 21, 23).
Issue 7. Seismic Design and Seismic Hazard Assessment
Issues of concern :
There are several indications that the currently assumed safety margins concerning the Seismic Hazard Assessment for Temelin NPP might underestimate the true risk.
Explanation given :
During the Vienna Meeting the Czech side announced it would make available further documents on seismic hazard assessment.
Final outcome :
The Austrian and Czech sides agreed to continue the exchange of information and to organise a workshop on seismic issues during the second half of the year 2001.
The workshop is intended to concentrate on site seismicity. The Austrian side would also like to address bilaterally the seismic design issues (for further details, see annex 2).
Issue 11. Status of IAEA Safety Issues resolution
Issues of concern :
There is a need to obtain final information on the status of implementation of plant/procedure modifications to address the generic safety issues concerning WWER-1000,
identified by the IAEA. Although the Nuclear Research Institute Rez report from March provides expanded information in this regard, some issues are left open
or their resolution is unclear due to equivocal statements in the report.
Explanation given :
Based on request from the Government of the Czech Republic, the IAEA conducted,
in the period of 11-15 March 1996, a mission to review the resolution of WWER -1000 safety issues at Temelin NPP.
General conclusions of this mission show that the issue resolution level was very advanced, i.e.:
· The Czech Electric Company (CEZ) has made a large effort to improve the design of Temelin independently of the identification of safety issues by the IAEA;
· The adoption of Western technology and practices for a part of the scope of supply (e.g. fuel, I&C, radiological protection, accident analysis)
has helped to solve a large number of safety issues identified for WWER-1000/320 NPPs;
· Several safety issues that are addressed by ongoing activities have not been completely solved, but there seems to be sufficient time for their completion;
· All the safety issues identified by the IAEA have been addressed;
· The combination of Western and Eastern technology has led to safety improvements in comparison with internal practices.
The Czech side declared in December 1998 in Vienna during Czech and Austrian bilateral meeting that the responses are going to be updated just before fuel loading.
This commitment was fulfilled and during May 2000 the new set of responses were submitted to the IAEA.
In October 2000 WENRA stated in its second report that:
"The safety improvement programme for Temelin units 1-2 is the most comprehensive one ever applied to a VVER-1000 reactor. Standard Western practices were
used to integrate Eastern and Western technologies and to deliver the corresponding authorisations. The ongoing commissioning process has to confirm
the integration of the different technologies. A few safety issues still need to be resolved. If these are resolved, Temelin units 1-2 should reach
a safety level comparable to that of currently operating Western European reactors."
Final outcome :
As seen from the May-2000 responses to the IAEA safety issues and the October-2000 WENRA report resolution,
only a few of these safety issues still need to be and will be completed.
The IAEA will perform a follow-up mission on safety issues resolution by the end of this year and the results of this exercise may be discussed bilaterally.
Issue 12. Safety classification of components
Issues of concern :
Concern was expressed that the POSAR provides lists of safety systems and safety-related systems,
but neither explains the assignment criteria nor the requirements for the several categories.
Explanation given :
The POSAR is not the documentation that would describe how the systems were assigned to 'the safety systems category' and 'the safety related systems category'.
This is included in the Czech Decree 214/97, which is available for review to the Austrian side. This classification follows the IAEA recommended classification.
Systems (structures, systems, and equipment) were evaluated and categorised according to 214/97 in the document 'Initial Concept of Operational Safety for the Temelin NPP'.
The method used is stated. All systems of safety relevance are included in the Temelin Technical Specification as are also the definitions allowing the indexing
of the systems into the relevant categories. This document, used by the Temelin staff, is available to the Czech regulatory body. It contains, however, proprietary information.
Final outcome :
This answer does clarify the categories and subcategories used. The issue seems to have been addressed in an appropriate way and is therefore considered to be closed.
Issue 13. Control Rod Insertion
Issues of concern :
Operational experience on VVER 1000 showed problems with the original control rod design.
Austria would like more information on the new design by Westinghouse, which should have solved the problem.
Explanation given :
A different design solution is used in Temelin compared with the original VVER design. The problems experienced with the Russian design should not occur with
the new Westinghouse design. In addition a system for continuously monitoring the performance of the rod drive mechanism is in place. This programme will compare
the evolution of performances during previous operations. At the beginning of each new fuel cycle, verifications will be carried out to assess if the functional criteria are met.
At the end of the campaign the drive mechanism will be inspected thus ensuring proper subsequent operation or repairs.
Final outcome :
The safety authority should ensure that the operators' programme of monitoring the proper operation of the rods is implemented.
If necessary, the issue may be further discussed within the framework of the pertinent Austria-Czech bilateral agreement.
Issue 16. Hydrogen Control
Issues of concern :
The assumption that hydrogen detonations do not pose a hazard of containment failure is based on conclusions derived from an US-NRC document that analyses
a different containment building configuration. A deflagration to detonation transition could occur in the Temelin containment configuration. This might result
in shock loading on the containment, which is not included in the PSA. The catalytic hydrogen recombiner system, which is supposed to maintain the hydrogen concentration
below the safety limit of 4% in the case of a design basis accident, is not designed for severe accident. It is therefore necessary to assess the adequacy of the containment
in the case of severe accident.
Explanation given :
In the framework of the effort to enhance the safety of the plant, a study was carried out to determine the number and best locations of appropriate equipment
to cope with hydrogen produced during a LOCA. A system of 22 passive autocatalytic hydrogen recombiners was installed in the containment. They are designed to cope
with hydrogen release up to the maximum DBA (Design Basis Accident). Work was latter undertaken to analyse the performance of the system during severe accidents.
The results of the analyses show that the recombiners could not prevent hydrogen burns in the containment during a severe accident but could nevertheless reduce
the amount of hydrogen in the containment. The study showed that only local deflagration and not detonation could occur inside the containment. In order to definitely
exclude cases were deflagration could convert into detonation, solutions to mitigate the consequences of a severe accident were envisaged. Among those also a possibility
of safe deliberate hydrogen ignition was studied.
Final outcome :
Analyses were performed to address the problem and presented in a frank and transparent manner. Measures to prevent hydrogen detonation have been defined.
The way in which this issue is handled may be further discussed in the framework of the pertinent bilateral Austria-Czech agreement, alongside other related
concerns (namely about containment integrity).
Issue 17. Limited ECCS/Containment Spray Sump Volume
Issues of concern :
In Temelin, the volume of water for the ECCS systems and containment spray is low (500 m3) compare to other VVER 1000
(800 m3 for Kozloduy 5 and 6) and to westerns PWRs (950 to 1900 m3). This give less margin and less reaction time in case of leaks from primary to secondary circuit.
Explanation given :
While the minimum sump volume is indeed 500 m3 to satisfy the accident analysis success criteria, it is kept at 630 m3 during normal operation.
Taking into account other volumes available for emergency situations, the volume of available coolant is 936 m3. The « closed water cycle » has been tested in 2000.
The test confirms that sufficient water is available during a LOCA. Analyses were performed to show that it is possible to achieve plant cold shutdown with the existing
emergency operation procedures before the containment is emptied below the minimum limit. In addition there are two other important systems that can postpone depletion
of the containment sump during a leak from primary to secondary system.
Final outcome :
The issue has been analysed and tested. When taking into account additional sources available for coolant, the containment sump
for Temelin is comparable with other VVER or « average » western PWRs.
Therefore, the issue is considered to be closed, meeting the purpose of the Melk protocol.
Issue 18. Boron Dilution
Issues of concern :
Boron dilution could result in a return to power and eventually core damage in situation where RHR (Residual Heat Removal System) and pressure relief
system are not available. Such a situation could occur during shutdown when operator relies on administrative controls and not on automated systems
to prevent a boron dilution accident.
Explanation given :
The various situations when a possible boron dilution could occur have been analysed.
After a reactor trip, design features prevent the supply of pure condensate in the primary circuit.
Once the control rods are inserted into the core (therefore also during outage and refuelling)
several measures consisting of checking at regular intervals the situation of valves, pumps and tanks are undertaken to ensure there cannot be
inadvertent release of condensate in the primary circuit.
Abnormal and emergency situations that could cause boron dilution in the RCS (Reactor Coolant System) have been identified and analysed.
The measures proposed will prevent an uncontrolled reactivity increase due to boron dilution.
Final outcome :
Situations where boron dilution could result in an uncontrolled reactivity increase have been identified and presented in details by the Czech team in bilateral meetings.
The issue seems more suitable to be revisited in the framework of the pertinent bilateral Austria-Czech agreement.
Issue 20. Ventilation System and Habitability Aspects of Control Rooms
Issues of concern :
There is a need to improve the ventilation of the main control room (MCR) and the emergency control room (ECR) in such a way that radioactive or toxic substances
in the inlet air to those rooms under emergency conditions can be prevented. The ventilation systems of the two control rooms should be separate from each other.
The habitability of the control rooms must be ensured also in case of severe accidents in the adjacent unit.
There is no automatic isolation of these ventilation systems in order to avoid ingestion of combustible or toxic gases.
Explanation given :
Both, the main and the emergency control rooms have been equipped with separate, filtered air supplies.
An additional filtration unit has been installed into the existing air conditioning system for the emergency control room to retain radioactive aerosols and iodine isotopes.
This ventilation system is ranked as safety system and has a 1+2 redundancy. If there is radioactivity around the plant and after operating personnel
moves to the emergency control room, the system ensures emergency control room air conditioning and filtered air supply.
The control rooms are situated on the clean side of the reactor building, have no windows and are kept under air overpressure. Therefore the insinuation of radioactive
or toxic substances through other flow paths than the ventilation systems is unlikely. Activity measurements in both control rooms warn the operations personnel
in non-standard situations. Fire alarm systems switch off the MCR air condition systems automatically and actuate fire flaps to close up.
Anti detonation flaps avoid pressure waves to enter the reactor building via the ventilation inlet systems.
No system provisions are made for toxic or non-toxic gases as there is no source on site or in the vicinity of the plants in a quantity that could be hazardous
for the control rooms habitability. However, the MCR are equipped with oxygen breathing apparatuses and whole face respirators to enable operations personnel
to work and move to the emergency control room.
Final outcome :
The general design features of these systems seem comparable with western plants. Following the common understanding reached on issue 2,
this issue is considered to be closed, meeting the purpose of the Melk protocol.
Issue 21. Instrumentation and Control (I&C) Reliability
Issues of concern :
Additional information on the following topics was requested:
· data source for the I&C reliability values used in the PSA
· logic used by the Primary Reactor Protection System (PRPS) and the Diverse Protection System (DPS) if one train of components is in test or maintenance
It was noted that the PSA version which was provided for the Austrian review did not accomplish fully the goal of evaluating the reliability of the I&C systems.
The I&C systems, protection systems, and the corresponding man-machine interfaces were represented in a relatively coarse manner in the PSA.
Explanation given :
The main safety relevant instrumentation and control (I&C) systems have been replaced with Westinghouse design.
Systematic testing is carried out using tools like automatic testers, self-diagnostics, data quality and validity tests, communication diagnostics and manual tests.
All subsystems perform online hardware failure analysis. Tools are implemented for manual testing of components, which are not automatically tested.
The PRPS (Primary Reactor Protection System) is designed in such a way that during testing the single failure criterion is still maintained.
Maintenance may require temporary l-out-of-2 logic, depending on the cabinet and circuit needing maintenance. This aspect of the design was
thoroughly reviewed by Czech regulatory body with the conclusion that the single failure criterion is not violated. The DPS (Diverse Protection System)
as back up system is placed in 2-of-2 logic during its testing or maintenance.
As far as the PSA analysis is concerned, the PSA analysis has never been intended to fully assess the reliability of entire I&C system in detail.
The original data for the calculations were provided in an early design stage of the I&C system and represented available information from
the design process at the time of the analysis.
In support of the licensing process for digital safety systems, quantitative evaluations of the system reliability
have been performed using industry standard methodologies.
As a result, conservative estimates of component failure rates and the effectiveness of diagnostics are used. Despite the conservatism,
these analyses have consistently shown that the digital based systems are reliable. The results of the I&C design reliability assessment demonstrate
that this design is consistent with the objective to provide a high reliability for actuating required functions while minimising potential
for the spurious actuation of functions. Operational experience has now confirmed that the assumptions made were indeed conservative, often by orders of magnitude.
Recently initiated PSA model updates will consider the latest I&C design status.
Final outcome :
The described layout and design features of the I&C systems are comparable with modern international standards.
It is assumed that a periodic testing regime is carried out including the raw signal testing and re-calibration.
If necessary, a review of the issue is more suitable in the framework of the pertinent bilateral Austria-Czech agreement.
Issue 23. Leak Before Break (LBB)
Issues of concern :
This issue is to clarify on which basis the Czech regulators approved leak before break application for the plant. The POSAR did not fully address the issue.
Explanation given :
The entire section 3.6.3 of the POSAR is devoted to the LBB (Leak Before Break). Besides the LBB evaluation and results also large
amounts of supporting information have been made available.
The LBB Handbook summarising the results has been described. It is a detailed output of the LBB evaluation. List of the evaluated sections contain fundamental
input data like geometry, essential material characteristics, loads, detectable crack characteristics and evaluations using several internationally recognised methods.
Evaluated sections are defined on each half-meter of each piping evaluated. For these sections also postulated flaw growth is evaluated according to regulations.
Primary circuit systems were evaluated; other systems were also evaluated using the determination of rupture locations based on well-identified methods and criteria.
The evaluation is based on the fact that the safety system separation principle is implemented into the plant design. This principle means that the safety
related systems are separated into three divisions. Only one division is necessary for the reactor safe shutdown and keeping it in this state. Each room or sub
room contains only piping and equipment of one division and effects of pipe ruptures are transferred to other sub rooms. The assessment was based on the evaluation
of the impact of destruction of all piping and components in a sub room. Such evaluations were performed for all sub rooms through which evaluated piping runs.
It was proved that any break of evaluated piping would not disable the reactor safe shutdown.
Final outcome :
The LBB evaluations carried out covered possible causes and possible effects. The process was followed and evaluated by the IAEA.
Periodic non-destructive testing will be carried out to maintain knowledge of the plant status and to detect a start of possible
crack growth. The issue needs to be followed-up in the framework of the pertinent bilateral Austria-Czech agreement.
Issue 24. Conception of Safety Features
Issues of concern :
Some of the safety features concepts of the Temelin design appear to have shortcomings. These include: the feed and bleed mode of operation for small LOCAs,
loss of feedwater, and other events; reactor coolant pump emergency seal injection; steam generator tube rupture features, behaviour, and capability;
lack of intermediate cooling system for cooling the RHR (Residual Heat Removal) heat exchangers; and defence of safety support systems from external man-made hazards.
Explanation given :
· Feed and bleed mode
The feed and bleed mode is not used at Temelin for a small LOCAs recovery. It is used after an occurrence of the total loss of heat sink event
(i.e. the loss of all feedwater sources) when the SG (steam generator) levels are decreasing and after a short time the SG could not be able to ensure the heat
removal from the primary circuit. The operators' recovery actions for the loss of heat sink are determined in the emergency symptom-based procedures.
In the case of the total loss of heat sink, and if feedwater flow is not restored to any SG after previous attempts, the alternative method how to
remove the decay heat from the RCS is "feed and bleed". To ensure that the "feed and bleed" method will be successful, it must be initiated before
the core outlet temperature increases above the saturation temperature at the HP (High Pressure) ECCS pump shut off head pressure. (See also Issue 26).
An analysis was also performed to determine that the emergency venting system could be used as sufficient bleed paths for "feed and bleed".
The emergency venting system line from the pressuriser to the pressuriser relief tank can provide sufficient bleed paths to remove decay heat from the RCS by the
"feed and bleed" method.
· Steam generator tube rupture
The risk of steam generator collector and tubes failure was essentially reduced at the Temelin NPP comparing to other power plants by implementation
of several measures which are described in the report "Response to the IAEA document SAFETY ISSUES AND THEIR RANKING WWER-1000 MODEL
320 NPPs for TEMELIN NPP" from May 2000.
Despite of this a leakage from the primary to secondary circuit via ruptured SG tube, including a single SG tube rupture is covered in the Temelin EOPs.
The separation of the leaking SG from the remaining SGs is performed via the fast operating isolating valves as the first step of the recovery.
The partial cooldown of the primary circuit is then performed via the atmospheric steam dump valves of the remaining SGs. This cool down is stopped on such
a primary circuit temperature that enables to depressurise the primary circuit pressure to the equilibrium pressure with the leaking SG and so to stop the leak.
In a case of smaller leaks, up to one SG tube ruptured, the coolant inventory can be maintained by the charging system.
· Lack of intermediate cooling system for cooling the RHR heat exchangers.
The residual heat removal (ensured by the RHR system) is performed via the heat exchanger that is cooled directly by the essential service water of a pressure 0,6 MPa.
The RHR system is usually connected during the normal unit cooldown at a pressure of 1,5 MPa which is maintained by nitrogen in order to ensure the operation of the reactor
coolant pumps and then cools down the primary circuit from 80 -90°C (when the bypass steam dump to condenser is not efficient enough to further decrease the temperature) to 60°C.
When the unit is cooled down into the cold conditions (below 60°C), the reactor coolant pumps are shut down and the primary circuit depressurised to the atmospheric pressure.
The potential leak of the RHR heat exchanger would be detected during a normal operation by the radiation monitoring sensors located on the side of the essential service water.
· Defence of safety support systems from external man-made hazards
The systems important to the nuclear safety are designed at the Temelin NPP always as 3 independent physically separated subsystems.
The most important safety systems are located below the containment. Some of their supporting systems are located outside the containment,
but their separation and the distance between two subsystems ensures that these cannot be affected by the external effects.
Final outcome :
This issue being no longer a concern, it may be considered as closed, meeting the purpose of the Melk protocol.
Issue 25. Design Basis Accident Analysis
Issue of concern :
Design basis accident analysis and radiological consequences of such accidents could not be reviewed before the Melk process started since
the relevant portions of the POSAR (including the bulk of Chapter 15) were not provided by ČEZ a.s. until January 2001.
Explanation given :
A wide spectrum of events was investigated in order to ensure that the plant stays within the specified design parameters in case of the specified events.
The cases called "Design Basis Accidents" are assumed to originate from equipment malfunction or failures, from breaks of pressure retaining components
or from operator errors. For completeness a larger spectrum of events was systematically investigated based on the extended list of the US NRC RG 1.70
(Rev. 3 - Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants) and the Safety Report for the Temelín NPP.
The safety analysis philosophy applied for the Temelín NPP includes a conservative bounding analysis approach for each of the initiating
events category with the most adverse consequences, therefore a detailed analysis including code calculation is not required for each particular event.
An analysis is not required for a particular event if it can be demonstrated that it is conservatively covered by another event.
The bounding analysis approach postulates an event with the worst consequences while using conservatively adverse input data.
This approach is fully in compliance with the standard western practice.
In the Chapter 15 of the POSAR for the Temelín plant, the results of conservative safety analyses are presented with the objective
to demonstrate that sufficient margin to the plant design safety limits is ensured and the radiological consequences meet the limits imposed by the new Czech legislation.
It is noticeable that the Czech standards for radiological consequences, which are more restrictive than in some other countries including the USA, were fulfilled.
In addition to the safety evaluation, many additional analyses have been performed to support better understanding of the Temelín plant behaviour during various transients.
These additional analyses are mostly based on realistic assumptions and can be therefore used for various plant operational purposes.
The results of such best estimate analyses were used to confirm the correctness of the proposed recovery operator actions and to obtain a good idea
of the unit response to these recovery actions. Conclusions and findings from these analyses were used as a basis for the Emergency Operating Procedures (EOP) preparation.
The Temelin NPP selected a complex approach to the plant safety enhancement. This complex approach led to changes, both during the manufacturing and the NPP operation,
which considerably decreased the possibility of a SG collector damage. All changes have been performed using experience of the VVER-1000 designer and operators.
The improvement of the manufacture technology of steel and the steam generator including the primary collector means that operational response will meet the design expectations
and will not copy behaviour of the SG collectors at Russian, Ukrainian or Bulgarian NPPs. Even though the original design and manufacturing technology deficiencies are removed,
conservative safety analyses relevant to the Temelín NPP steam generator design have been performed. In addition to the modifications and safety analyses performed,
the symptom oriented EOP has been developed.
The PSA Study results show that blackout contribution to the risk of the core damage is smaller than that of other initiating events. The Temelin NPP is less vulnerable
to the total loss of electrical power than any other similar design. The IAEA mission stated already in 1996 that the measures implemented at the Temelín NPP fulfil
requirements for solving the total loss of electrical power safety issue.
Final outcome :
In view of the information and explanation received this issue is no longer a concern, meeting the purpose of the Melk process.
|
