This appendix describes emergency procedures and guidance used at U.S. nuclear plants and how they are being revised in response to the Fukushima Daiichi accident.
Emergency Operating Procedures (EOPs) are “plant procedures that direct operators’ actions necessary to mitigate the consequences of transients and accidents that have caused plant parameters to exceed reactor protection system set points or engineered safety feature set points, or other established limits” (USNRC, 1982, p. 3). For example, station blackout (i.e., loss of all AC power) situations or loss of ultimate heat sink can be handled within EOPs as long as reactor pressure and water level can be monitored and remain within acceptable ranges. An example of the successful use of EOPs in Japan is the response at the Fukushima Daini plant (see Sidebar 4.2 in Chapter 4). EOPs have always been a part of operational practice in the United States and are based around transient events or accidents that the plant was designed to handle, in some cases with operator actions, that is, the design-basis events—although a larger range of events was originally considered in the EOPs for boiling water reactors than for pressurized water reactors.
EOPs have long been part of the USNRC’s safety requirements. These requirements are provided in 10 CFR Part 50 and in the technical specifications for each plant. Numerous technical reports (e.g., USNRC, 1980a,c, 1982, 1983) also help guide the development of EOPs. Training and both
written and simulator exams for licensing reactor operators and senior reactor operators include EOPs. The shift supervisor, who is stationed in the control room, and the plant manager have command-and-control responsibilities for implementing EOPs. (Both individuals possess senior reactor operator licenses.)
Severe Accident Management Guidelines (SAMG) are intended to address “beyond-design-basis” situations in which the core has become or is becoming damaged. The goals of the SAMG are to stabilize a degraded core, maintain containment, and minimize the release of the core’s fission products. SAMG are much less specific than the EOPs because they cover a wide range of possibilities of the reactor damage state after significant fuel damage occurs. The phenomenology of severe accidents in light-water reactors is too complex and highly dependent upon the timing of mitigation actions to be fully predictable in advance. An extensive discussion of the SAMG can be found in Sehgal (2012, ch. 6).
Events involving the loss of core cooling are considered to be beyond the nuclear plant’s design basis and are covered by SAMG. The requirements in 10 CFR § 50.631 (Loss of all Alternating Current Power) address the conditions that can lead to the loss of core cooling. Licensees are required to provide an additional source of electrical power or otherwise demonstrate that the plant could cope with the loss of all AC power through other means for removing decay heat from the reactor for a specified period of time.
In events involving the loss of all AC power, operators would follow the procedures required under 10 CFR § 50.63(c)(ii)-(iii):
(ii) A description of the procedures that will be implemented for station blackout events for the duration determined in paragraph (c)(1)(i) of this section and for recovery therefrom; and
(iii) A list of modifications to equipment and associated procedures, if any, necessary to meet the requirements of paragraph (a) of this section, for the specified station blackout duration determined in paragraph (c)(1) (i) of this section, and a proposed schedule for implementing the stated modifications.
The procedures developed to address (ii), above, would address the maintenance of cooling functions using an alternative AC power source
or coping strategies. The procedures would also address the restoration of onsite and offsite AC power sources.
A key difference between EOPs and SAMG is that the former are subject to regulatory oversight (see USNRC, 1982) whereas SAMG are a voluntary industry program. Another important difference is that SAMG anticipate that the engineering staff in the technical support center will be available to guide reactor operators in applying the guidance and evaluating trade-offs that inevitably occur in severe accident management, whereas EOPs enable control room staff to engage in immediate symptom-based responses. Transition points between EOPs and SAMG are defined, but some element of judgment is required to determine whether the transition criteria have been met. Consequently, operator training and education play an important role in making timely decisions.
SAMG make use of both standard and nonstandard plant systems. They include approaches to evaluate plant conditions, select the appropriate guidance, and evaluate the effectiveness of the selected guidance during a severe event. It also includes training plans for staff expected to be involved in any of the following three activities: (1) evaluation of plant damage, (2) making decisions on which strategies to implement, or (3) implementing the selected strategies.
NEI 91-04 (NEI, 1994) recommends that plants self-evaluate their strategies through use of periodic minidrills that ensure that personnel who would be involved in the emergency response are familiar with the implementation of SAMG. However, since SAMG are considered an industry initiative, the USNRC has no specific regulatory control. Instead, the USNRC has accepted the industry’s commitment to assess its capabilities and implement appropriate improvements within the constraints of existing personnel and hardware (Taylor, 1996). In other words, the range of severe accident scenarios that could be managed with the training and steps outlined in the SAMG is limited to those situations that do not require additional resources in staffing or equipment.
Within the last decade, new requirements going beyond this limited approach have been created to respond to potential terrorist attacks. The events at the Fukushima Daiichi plant have further emphasized the need for a more comprehensive approach to severe accident management. Indeed, industry is in the process of developing and implementing new SAMG and associated physical resources.
Following the terrorist attacks of Sept 11, 2001, there was significant concern in the United States about attacks on nuclear power plants using hijacked airplanes or other means (e.g., NRC, 2004b). The USNRC and
national laboratories analyzed terrorist attack scenarios on nuclear plants and their spent fuel pools and concluded that additional security and mitigation measures were needed (USNRC, 2010). The USNRC issued an Interim Compensatory Measure (ICM) Order in 2002 modifying the operating licenses of all plants. Section B.5.b of that order directed plant licensees to take certain actions:
Section B.5.b of the ICM Order requires licensees to adopt mitigation strategies using readily available resources to maintain or restore core cooling, containment, and spent fuel pool cooling capabilities to cope with the loss of large areas of the facility due to large fires and explosions from any cause, including beyond-design-basis aircraft impacts.
The utilities, working through the Nuclear Energy Institute, developed detailed guidance for B.5.b response procedures, termed Extensive Damage Mitigation Guidelines (EDMGs), and additional equipment to be located at each site. The guidance assumed conditions far beyond design-basis accidents, including loss of all AC and DC power, denial of access to structures including the control room, and loss of plant control and monitoring capability.
EDMGs play a different role than EOPs. EDMGs are intended to provide operators with a “toolbox” of capabilities that can be used to respond to unpredictable damage from large fires and explosions. EDMGs also serve as a bridge between the plant operational command and control and the command and control that is provided by the plant’s emergency response organization.
Little was publicly known about these B.5.b activities because they were initially protected as Safeguards Information. Additional details about the program became public knowledge after the March 2009 rulemaking that codified the B.5.b requirements contained in the order into regulations (10 CFR § 50.54(hh)(2)2) and the post-Fukushima acknowledgment (USNRC Bulletin 2011-01, “Mitigating Strategies”3) of the potential importance of B.5.b capabilities for responding to beyond-design-basis events.
Because the B.5.b order was determined to be Safeguards Information, the nuclear utilities in Japan were unaware of some of its content, although the Nuclear Safety Commission of Japan apparently was notified of its requirements. Even after the B.5.b. requirements became public knowledge, however, Japanese authorities did not recognize the change of policy and
2 10 CFR § 50.54. Conditions of Licenses. Available at http://www.nrc.gov/reading-rm/doccollections/cfr/part050/part050-0054.html.
3 Issued May 11, 2011. Available at http://pbadupws.nrc.gov/docs/ML1112/ML111250360.pdf.
therefore did not initiate any consultations on the requirements with Japanese nuclear utilities.
Many of the B.5.b capabilities and accident mitigation measures were needed or used at the Fukushima Daiichi and Daini plants following the March 11, 2011, earthquake and tsunami. The prepositioned equipment resources for B.5.b include portable generators, fire trucks or other portable water pumps, batteries, cables, tools, fuel, and firefighting equipment, all of which were part of these plant’s responses. The mitigation strategies that the EDMGs are intended to cover are listed in Table H.1.
At least four of these boiling water reactor strategies were utilized at the Fukushima Daiichi plant, supporting the claim by the USNRC (2013a, p. 21) that
the mitigating strategies implemented at U.S. nuclear plants following the terrorist attacks of September 11, 2001, to cope with large fires and explosions may have helped in responding to an extended loss of electrical power and core cooling capability that occurred at Fukushima if the equipment was stored in an area of the plant that was not inundated by the tsunami.
TABLE H.1 EDMGs Mitigation Strategies
|BWR Mitigation Strategies
|PWR Mitigation Strategies
|Manual operation of RCIC or isolation condenser
|Makeup to RWST
|DC power supplies to allow depressurization of RPV & injection with portable pump
|Manually depressurize SGs to reduce inventory loss
|Utilize feedwater and condensate
|Manual operation of turbine- (or diesel-) driven AFW pump
|Makeup to condenser hotwell
|Manually depressurize SGs and use portable pump
|Makeup to CST
|Makeup to CST
|Containment flooding with portable pump
|Procedure to isolate RWCU
|Manually open containment vent lines
|Inject water into drywell
NOTE: AFW = auxiliary feed water, BWR = boiling water reactor, CRD = control-rod drive, CST = condensate storage tank, PWR = pressurized water reactor, RCIC = reactor core isolation cooling system, RPV = reactor pressure vessel, RWCU = reactor water cleanup, RWST = reactor water storage tank, SG = steam generator.
SOURCE: NEI (2012).
By definition, severe accidents are considered to result in plant conditions that are beyond design basis and outside of the traditional regulatory scope. Nevertheless, the USNRC does have the ability to inspect individual plants to verify that licensees have implemented SAMG. The USNRC used this authority following the Fukushima Daiichi accident to collect information on the implementation, training, and maintenance of SAMG. The USNRC Near-Term Task Force noted that, while some plants have maintained this important safety program, others have treated the volunteer initiative in a
significantly less rigorous and formal manner, so much so that the SAMG inspection would have resulted in multiple violations had it been associated with a required program. (USNRC NTTF, 2011, p. 64)
The Task Force recommended that the USNRC initiate a rulemaking that would place SAMG under its oversight authority.
The industry has also taken a series of actions following the Fukushima Daiichi accident (see Appendix F). The 2012 report “The Way Forward” (NEI et al., 2012) outlines a set of goals and actions that the industry has committed to undertake to improve nuclear safety and apply lessons learned from the Fukushima Daiichi accident. These efforts are voluntary, remaining subject to inspection but outside of regulatory requirements. The industry is currently actively engaged with the USNRC in discussing how the industry response will fit in with the proposed changes in the regulatory framework mentioned above.
H.4.1 Diverse and Flexible Coping Strategies (FLEX)
An important component of the industry’s response is the FLEX program, a set of prepositioned capabilities designed to extend the coping period in the event of an extended AC power loss and other adverse situations such as occurred at the Fukushima Daiichi plant. These capabilities are intended to be used in conjunction with revised SAMG. The USNRC reviewed FLEX and ordered that each U.S. nuclear plant develop a site-specific plan to mitigate severe accidents of the type experienced at Fukushima Daiichi using FLEX-type capabilities (USNRC, 2012d). The order requires a phased approach with the following elements (USNRC, 2012d, Attachment 2, p. 4):
• The initial phase requires the use of installed equipment and resources to maintain or restore cooling, containment and spent fuel pool (SFP) cooling capabilities.
• The transition phase requires providing sufficient, portable, onsite equipment and consumables to maintain or restore these functions until they can be accomplished with resources brought from off site.
• The final phase requires obtaining sufficient offsite resources to sustain those functions indefinitely.
The FLEX implementation guide (NEI, 2012) contains these elements and was endorsed in USNRC Interim Staff Guidance (USNRC, 2012c) as being an acceptable means of complying with the Mitigation Strategies Order. The only caveat was that for the initial phase of the response, a determination of appropriate response time had to be made and used in the selection of storage location and readiness of equipment. The USNRC will review each plant’s FLEX installation and guidance as they are being completed (which will be no later than the end of 2016) and will issue a safety evaluation report.
H.4.2 Revision of SAMG
The Electric Power Research Institute commissioned a revision to the Severe Accident Management Guidance Technical Basis Report (EPRI, 2012b). This report is the first update of the original 1991 version, adding additional Candidate High Level Actions in Volume 1 and providing supporting technical information in Volume 2. New material addresses using seawater injection for reactor core cooling, common-cause failures due to external events, cooling spent fuel pools, setting priorities in multiunit events, containment isolation failure, and hydrogen combustion within plant buildings. The intent, as with the original report, is to guide owners’ groups in developing new SAMG.
Efforts are currently under way to develop revised versions of the SAMG for both generic and plant-specific guidance. The Emergency Procedures Group of the BWR Owners’ Group has been meeting quarterly since the Fukushima Daiichi accident and completed Revision 3 of the generic guidelines in 2013. These are integrated guidance for emergency procedures and severe accidents, referred to as Emergency Procedure Guidelines/Severe Accident Guidelines. According to the Nuclear Energy Institute (Williamson et al., 2013), this revision utilizes both FLEX and EDMGs capabilities and guidance to provide core and spent fuel pool cooling and maintain containment functions. Individual plants are developing EOPs and SAMG based on this generic guidance but tailored to their specific situations. The generic guidance is in the process of being implemented for each plant, and industry workshops are being held in the United States, Europe, Mexico, Japan, and Taiwan to assist with this process. The USNRC has formally requested that
H.4.3 Response in Japan
TEPCO has proposed a program of countermeasures similar to FLEX. The strategies are to
consider capabilities for accident control assuming situations where almost all station facilities used to control the accident lose their functions. This is in addition to the basic approach of assuming a certain scale of an external event, including tsunamis which caused the Fukushima accident, and taking complete countermeasures against it to prevent accidents from occurring. (TEPCO, 2012b, p. 471)
Examples of the type of equipment and guidance documents are provided by Kawano (2012). The descriptions of the equipment and capabilities are plant specific and designed to address the situations encountered at the Fukushima Daichi plant following the March 11, 2011, earthquake and tsunami.