• Regulatory Aspects of Nuclear Power Plant Safety;
  
• Status of Safety Improvements; and
• Status of Safety Analysis Reports^1/.

During the week of June 14, 1999 the International Atomic Energy Agency (IAEA) in co-operation with the European Commission and the OECD/Nuclear Energy Agency convened an International Conference on Strengthening Nuclear Safety in Eastern Europe. The Objective of the Conference was to assess the past decade of nuclear safety efforts in countries operating WWER and RBMK nuclear reactors and to address remaining safety issues which require further work. A particular focus of the Conference was on international co-operation and assistance and where such efforts should be focused in the future. The Conference was chaired by Carol Kessler, Senior Co-ordinator for Nuclear Safety of the U.S. Department of State.

All Eastern European countries that operate RBMK or WWER reactors participated in the Conference, namely: Armenia, Bulgaria, Czech Republic, Hungary, Lithuania, Russian Federation, Slovakia, and Ukraine. These countries submitted papers and made presentations at the Conference on three key areas of nuclear safety:

• Regulatory Aspects of Nuclear Power Plant Safety;
• Status of Safety Improvements; and
• Status of Safety Analysis Reports.

  Submitted papers are contained in IAEA document IAEA-CN-75.

In addition to the above list, representatives from 18 additional countries participated in the Conference, namely: Austria, Belgium, Canada, Egypt, Finland, France, Germany, India, Iran, Italy, Japan, Netherlands, Norway, Spain, Sweden, Switzerland, United Kingdom and United States of America. participants from countries that provide financial and/or technical assistance and co-operation in the area of WWER and RBMK safety offered the most extensive commentary on country presentations.

Key international organizations that provide nuclear safety assistance for WWER and RBMK reactors also made presentations at the Conference. This included the International Atomic Energy Agency, the World Association of Nuclear Operators, the Nuclear Energy Agency, the G-24 NUSAC, the European Commission, and the EBRD. Each organization described its unique role and perspective in the provision of assistance. All emphasised the importance of co-ordinating and tracking assistance, and the importance of the active participation of recipient countries. The EC in particular highlighted the importance of resolving nuclear safety issues in the context of the EU accession process.

The introductory papers by international organizations emphasised the importance of strong, independent, and adequately resourced Nuclear Regulatory Authorities. These organizations reported that it has been, and will continue to be, their policy to provide assistance to the regulatory authorities of Central and Eastern Europe and the former Soviet Union. Throughout the conference, speakers continued to emphasise the importance of effective nuclear regulation.

2.1. THE STATUS OF REGULATORY AUTHORITIES

In common with international practice, all reporting countries have nuclear regulatory authorities with powers and responsibilities defined by national statute. All authorities claim to be independent of the activities of the utilities and all have short reporting lines to government ministers. Bulgaria, however, noted that CUAEPP still had a small role in the promotion of nuclear power but legal changes to be enacted later this year will correct this. Other countries, on the other hand, have developed a regulatory structure which showed a high level of independence.

Senior regulatory staff are usually appointed by governments and this inevitably leads to suggestions of political influence on their decisions and methods of operation. Whether such suggestions are unfounded or real, it is incumbent on individual countries to ensure the independence of the regulator. However, because regulators' need the authority of the State, the political independence needs to be carefully managed. This can be helped by international peer reviews and by enhancing policies of openness and transparency (as exemplified by the current conference and the Convention on Nuclear Safety).

In all cases, the regulatory authorities are financed from central government budgets. Many countries note that this is not adequate to fund all their required duties and, in particular it is not sufficient to recruit adequate numbers of qualified staff. Some progress is being made; for example Armenia, Bulgaria, Hungary, the Czech Republic, Lithuania and Ukraine all hope to increase their staff numbers this year. However, this problem is not likely to be totally resolved until the national economies become stronger. In the meantime the international community should continue to make representations at a senior governmental level to stress the importance of independent and adequately resourced nuclear regulatory authorities.

2.2. THE LEGAL BASIS OF NUCLEAR REGULATION

All reporting countries inherited nuclear legislation from previous regimes. Some aspects of this remained in force for a number of years but all countries recognised its limitations and have replaced it, or supplemented it, with new primary laws based on the current national constitutions and legal processes. Generally, the primary legislation sets out main principles and responsibilities and, in all cases, it claims to place responsibility for safety on the NPP operator. Primary laws also set out the basis of the licensing systems. To be effective, the primary laws need to be supported by regulations and guides and more detailed codes and standards. The development of these has been a major task for the regulatory authorities. Whilst this process is not yet complete, most countries have made significant progress. In Armenia, the main nuclear law was enacted earlier this year and the process of developing its national regulations has only started recently.

All countries' legislation set out the fundamentals of a licensing system which defines responsibilities and interactions between government departments. The Western practice of using a safety analysis report (SAR) as a licensing basis is not widely followed yet. This is addressed in Section 4.

For many years the development of legislation has been the subject of support by the international community. The main responsibility for the continuation of this work should rest with the national authorities - only they are fully familiar with the details of their own legal systems. International assistance, in the form of reviewing regulations, would help to achieve an overall consistency and ensure that all aspects of nuclear safety are addressed. Armenia, Russia and Ukraine may request help in this area.

2.3. THE RESPONSIBILITIES OF THE REGULATORY AUTHORITIES

All the regulatory Authorities are required to carry out a range of functions which can include the preparation of regulations, licensing, plant security, radiation protection, and radioactive waste management, fuel cycle facilities, materials control and accounting, emergency arrangements, technical assessment (sometimes with TSOs), site inspection, and public information. These diverse activities are very demanding. Several countries noted the difficulties in providing a full range of technical expertise to carry out safety evaluations. Some countries have entered into bilateral agreements to provide technical support (e.g. Swiss/Slovak project). Even where regulators had authority to recruit additional staff they found it difficult to do so. This may be due to the salaries or it may be due to the non-availability of qualified personnel in the smaller countries. Some small countries noted the difficulties in appointing suitably qualified and sufficiently independent senior staff to the advisory committees which they have established. During the licensing process for Ignalina, the Lithuanian regulator, has used many national and international resources to carry out technical assessment. It has also been taking steps to develop its own national TSO. The larger Regulatory Authorities such as Russia have a full range of technical support.

The licensing of safety improvements at reactors has presented a high workload on regulators and their TSOs for several years. This is not likely to change in the short-term. Future technical review work on safety analysis reports will be at least as resource intensive. The regulators in the Czech Republic, Lithuania, Hungary, and Slovakia have recent experience of this during their work on the SAR and on the Periodic Safety Reviews. The regulators of those countries operating first generation reactors will have progressively more difficult decisions to make regarding the continued operation of such plant. Currently it is doubtful whether all of the regulatory authorities have the resources or authority to make such decisions. Whilst the regulatory authorities, particularly the small ones, may not have the full range of technical experts, they should have sufficient expertise and knowledge to be able to discuss issues and, if necessary, challenge their experts.

It is anticipated that regulators will continue to need the support of outside experts. The international community should respond positively to any requests for such assistance but should also recognise that the ultimate responsibility must rest with the national regulatory authority.

Regulators could also increase their own effectiveness by not carrying out work which should be done by the utilities. Regulators should ensure that licensees fully carry out their responsibilities for safety. The Hungarian and Slovakian Regulators have done this with some effect and GAN Russia recognises the need to transfer more responsibilities to the nuclear operators. Whilst other countries did not specifically mention this issue it is recommended that all consider the implications with respect to their own regulatory authorities. Transfer of responsibilities will, of course, need to be done in a planned and systematic way. The international community should assist with this by arranging joint regulator/licensee workshops.

The reports of the regulatory bodies indicate that the main work in recent years has been associated with the development of regulations and guidance, and in activities associated with NPP licensing - particularly the licensing of backfitting proposals. In addition, all countries mentioned that they have a site inspection role and some also state the types of plant inspections which are carried out. Little information was provided on how regulators and license requirements were enforced on site. Hungary identified this as a key area for future development. The Lithuanian regulator VATESI has successfully used international assistance to support team site inspection activities which were part of the NPP licensing process. The Ukrainian regulator reported that the inspection authority in Ukraine has become an integral part of the Regulatory Authority. This recognises the importance of inspection. An IRRT in Slovakia noted that inspection and enforcement programmes complied with western standards. It is proposed that for some countries, future assistance should focus on the site inspection process.

The papers submitted reveal a significant variation in the scope and the degree of implementation of safety improvement measures undertaken at countries operating WWER and RBMK. The following provides an overview of major design and operational measures implemented and/or planned for the NPPs in operation.

3.1. WWER-440/230 NPPs

On the main safety issues, the situation is the following:

Reactor pressure vessel (RPV) integrity is a major issue (ranked IV according to IAEA categorization) for this type of reactors. For most of them, the measures which have been implemented and the analysis performed so far show that the RPV can operate until the end of the design life (30 years) of the plant, provided that a programme of periodic RPV integrity and residual lifetime assessment has been established and does not indicate a need for additional measures. Such a programme should be a prerequisite for any decision concerning further operation.

Linked to the RPV integrity, cold overpressure protection and overcooling protection measures (fast closing main steam valves, new pressurizer safety valves) have been implemented at Bohunice, Kozloduy, Novovoronezh 4 and Kola 1 and 2 and will be implemented this year at Novovoronezh 3 and Armenia NPP.

Primary circuit integrity is also a very significant issue (ranked IV). In the design basis of these units, only small size LOCAs (32 mm in diameter) was considered. Therefore, leak before break (LBB) concept applicability had to be checked on all units. Armenia has not implemented it yet, due to the lack of funding. The associated measures - modifications on the primary circuit, installation of leak detection systems and specific surveillance systems, improvement of in-service inspection (ISI), were reported to have been implemented, following the LBB studies.

Confinement integrity is a high category issue (ranked III). Confinement leaktightness, which is insufficient in the original design has been and continues to be improved on all units. The best results have been achieved at Bohunice where confinement leaktightness has been improved by a factor of 100. Significant confinement leak tightness improvements have been made at other plants and further improvements can be obtained.

Also at Bohunice V-1, a major safety improvement, based on a pressure reduction system (jet condensers) is being implemented. This, in addition to the increased capacity of ECCS and containment spray system MAY give the confinement the capability to face all types of large break LOCAs. Confinement improvements are being studied for Kozloduy.

Most of the remaining safety significant issues (ranked III and IV) are related to the reliability of the heat removal function on the secondary side (emergency feedwater, steam generator safety valves, etc.) and their support systems (cooling water, electric power supply, I&C, etc.). This includes problems of redundancy, of protection against common-mode failures, of qualification.

In this area improvements are generally performed in two steps:

a first step with short-term measures, which reduce the impact of the issues without solving them completely,

a second step with extensive, long-term measures which will eliminate the problems.

It can be considered that most short-term measures have been implemented on all the sites.

Some long-term measures have been implemented at Novovoronezh and Kola and are being implemented at Armenia NPP. The rest of these measures are planned on these sites for future dates which depend on the availability of the extensive resources in manpower and money which are necessary.

Second step measures for Kozloduy 1-4 are being implemented in the framework of the complex programme to be completed in 2001. In the case of Bohunice V-1, all second step measures will have been implemented on both units by the end of 2000. Then, taking into account all the safety measures already implemented, Bohunice V-1 can be considered as an example of the safety level which can be achieved in a WWER-440/230.

3.2. WWER-440/213 NPPs

The initial design of this type of reactor, represents a significant safety improvement by comparison with the initial design of the WWER-440/230 reactors. There were no Category IV issues identified in the IAEA Extrabudgetary Programme for the WWER-440/213 NPPs.

On the main issues, the situation is the following:

Issues concerning safety-related system reliability: emergency feedwater system vulnerability to common-mode failures and risk of ECCS sump screen plugging. Improvements addressing the issues have been performed at Mochovce and Paks and have begun to be implemented at Bohunice V-2 and Dukovany. This work is planned for Kola 3-4 and Rovno 1-2.

Protection against internal hazards (fire, flooding, high energy pipe whip): the systematic analysis of each of these hazards has been performed and the resulting measures implemented at Mochovce and Dukovany. The same type of analysis is underway at Paks, Bohunice V-2, and Rovno 1-2.

Seismic safety: seismic loads were not considered or under evaluated in the original design of WWER-440/213 type reactors. Following seismic input re-evaluation, upgrading measures are being implemented at Bohunice V-2, Mochovce and Paks.

In addition to previous calculations and experiments on the strength behaviour of the bubble condenser structure and in response to EBP studies which showed a lack of demonstrated safety margins, further tests will be conducted on the Russian large scale test facility under construction in the frame of PHARE programme.

More generally, the WWER-440/213 NPPs have developed safety improvement programmes which will address all IAEA Category III, most of the Category II issues and in some cases Category I issues.

3.3. WWER-1000 NPPs

No Category IV issues were found on this type of reactor which has a general design similar to the western PWRs. The following safety issues have been selected:

Reactor pressure vessel integrity - results from TACIS programme indicated the need to perform integrity analyses for RPVs of WWER-1000. This work is currently underway.

Vulnerability of safety related systems and their support systems for "small series" WWER-1000 NPPs (5 units): insufficient physical separation and, as a result, vulnerability to common-mode failures has been found on ECCS (issue ranked III). Improvements to address this issue are planned in Russia and the Ukraine.

Primary circuit integrity assessment (issue ranked III) with focus on RPV and including PTS analysis should be performed on each unit, in accordance with the current methodology available. Applicability of LBB concept needs also to be demonstrated.

Primary circuit integrity monitoring implies the use of non-destructive testing according to international practice.

Finally, all operating plants with WWER-1000 units have developed specific modernization programmes. But there is a wide variety of scopes and implementation programmes were provided only by Ukraine which plans to implement high priority measures within the next three years, depending on the availability of financial resources, and by Bulgaria, where the safety improvement programme of Kozloduy 5,6 will be implemented from 2000 to 2005, and where the engineering phase will be completed this year.

3.4. RBMK NPPs

Over the past decade, a considerable amount of work has been carried out by designers, operators and regulators to improve the safety of RBMK reactors and to eliminate the causes that led to the Chernobyl accident. As a result, major design and operational modifications have been implemented. However, safety concerns remain, particularly regarding the units of the first generation.

The presentations concerning the main design issues highlighted that:

• newly improved control rods and fuel rods with burnable absorber are being introduced at operating RBMKs. These developments should further enhance plant safety.

• a diverse second shutdown system is under development. The schedule for its implementation for Ignalina 2 is 2002 and Leningrad 4 is 2002.

• concerning the welded joint cracks in austenitic steel pipelines (IGSCC) which affect all RBMKs, a new inspection methodology was developed along with repair techniques. The IAEA has developed with RBMK operators and regulators a two-year collaborative programme to address the mitigation of this issue.

• work is still needed to complete the adaptation and validation of modern computer codes being used to analyse RBMK postulated accident.

• safety improvements are being implemented at Chernobyl 3 during 1999.

3.5. OPERATIONAL SAFETY

Safety culture is generally considered the most important operational issue and an area where additional co-operation will be useful and assistance will be needed. Several countries reported some progress in this area. In the Czech Republic and Slovakia, in order to promote safety culture, the Utility Board of Directors has adopted a set of principles starting with: "Nuclear Safety is the first priority and is above all other interests of the Company". In Hungary, a programme to improve safety culture was conducted from 1994 to 1999 with support from the IAEA. For Bulgaria, the recently completed OSART mission gave positive assessment of the general improvements in this area. In accordance with the IAEA recommendations, the Russian operators have published statements which spell out their safety policy. Within the framework of those statements, work has been organised with regard to safety culture.

Quality assurance programmes have been developed in most of the countries. In Bulgaria, Czech Republic, Hungary, and Slovakia implementation of such programmes was reviewed during OSART missions. Russia and WANO are co-operating on quality assurance programmes.

Emergency operating procedures in use are generally "event-based" procedures. However, symptom based EOPs are in use at Novovoronezh 3, Dukovany Bohunice V 2, and Mochovce NPPs the actual use of symptom-oriented EOPs will start in autumn 1999 at all units at the same time after 5 years of work. A similar project is going on at the Ignalina and Paks NPP where symptom-oriented EOPs will be in use by the end of 2001. Symptom-oriented EOPs are also at various stages of development or implementation at Kozloduy and Russian NPPs.

Concerning training, extensive programmes have been developed for the training of each category of employees at all NPPs. In Slovakia, special attention has been given to improving human reliability. In Hungary, a maintenance training centre was created and systematic approach to training introduced in the frame of an IAEA "model project". Systematic approach to training was also implemented at Kozloduy and Armenia NPPs. Multifunctional simulators or full-scope simulators are either available or being developed on all the sites of WWERs and RBMKs.

Ageing management is also a very important issue, since many WWERs and RBMKs have already operated for more than half of their design life.

Some countries have addressed it through various programmes, but it will remain an important topic to deal with in the frame of future international co-operation.

Safety Analysis Reports (SARs) are detailed reports of all aspects of a nuclear power plant related to safety, ranging from the safety concepts and principles employed in the design and construction of the unit to the safety limits to be employed in plant operations. As the most complete compilation of plant-specific information relevant to safety, SARs are useful for day-to-day decisions concerning plant operations, and serve as the basis for assessments of the overall safety status of the plant, as well as for modifications and improvements of plant hardware, procedures, and operation. They serve as a basis for the derivation of technical specifications limiting conditions for operation.

For the regulatory authority, a comprehensive SAR provides the technical basis for its judgements concerning plant safety and licensing. A thorough, independent review of the information contained in the SAR allows the regulator to reach a judgement concerning the adequacy of plant safety independent from the designers, constructors, and operators of the plant. For these reasons the Agency selected the completion of a SAR as a criterion for assessing the completeness, adequacy and maturity of assistance programs for operators and regulators of WWER and RBMK reactors.

In the former Soviet Union (FSU), as in other countries, the norms for older plants did not contain the full set of safety analyses expected today. Although requirements for SARs for operating plants vary somewhat from country to country, they usually include descriptions and engineering analyses of all plant systems important to safety, accident analyses, description and analysis of plant operations, including management, quality assurance, and the identification, documentation, and correction, of root causes of previous operating experience. For older plants, where a significant fraction of the design life has expired, an analysis of the effects of ageing of the plant's systems, components, and structures is appropriate. SAR analyses usually include deterministic and probabilistic accident analyses for the full range of design basis accidents, beyond design basis analysis, and analysis of the containment/confinement system's capability to prevent or mitigate accidental releases. The full range of initiating events includes not only internally generated, but external and area events, such as fire, flooding, and seismic hazards. In some cases the basic design information is either not available, or outdated, so that a basic element of a SAR is the thorough documentation of the actual plant configuration.

If the SAR is to assess the actual plant configuration at the current point in time it must include the "as found" configuration and, at a minimum, reflect the "as-built" drawings. In addition, this information should be updated by the plant modification. Upon further modifications of the plant to correct deficiencies identified by this process an update of the SAR is necessary.

4.1. SAR IMPLEMENTATION STATUS

All conference participants operating RBMK and WWER reactors stated their commitment to the performance of modern SARs and to the review of SARs by their Regulatory Authorities. The status of the implementation varied from completion to merely a declaration of intent..

For the first generation of RBMK and WWER reactors, Safety Analysis Reports of the type described above are either completed, underway, or are being revised.

A greater diversity of approaches for implementation the of SAR concept is apparent for second and later generation reactors. According to the 1997 regulations and guidance for SARs, work is under development.

In some countries, a SAR has been produced, received regulatory review, and has been used as a basis for long-term licensing. In some cases, periodic updates to the completed SAR have been scheduled or planned.

4.2. VARIATIONS IN RESULTS

The contents of SARs presented at the meeting showed wide variations with respect to comprehensiveness, quality, and depth. Deterministic accident analysis included varied assumptions concerning accident severity, initial conditions, and methodology. A co-ordination of assumptions and methodologies appears to be appropriate.

A common element for all SARs described by the conference participants is a probabilistic safety analysis (PSA). PSA results, in terms of the calculated core damage frequencies (CDF), showed large differences for similar plant types. Plant-specific differences may account for some of these discrepancies, illustrating the observation that PSA results cannot be transferred from one plant to another. Other factors accounting for large differences in CDF estimates among similar plants can be attributed to unsubstantiated variations in assumptions and the quality of the input data. In this context, the importance the availability of accurate and complete information about the current plant configuration was noted. This is generally a difficult problem for all older reactors, and it is aggravated by the break-up of the Soviet Union, which, in some cases, has had the effect that the plant and its documentation now reside in different countries. It was suggested that the IAEA has played, and should continue to play a significant role in the harmonisation of PSA practice, as well as in the facilitation of sharing of relevant data.

4.3. APPLICATION OF RESULTS

Once completed, the SAR provides a sound technical basis for the assessment of the acceptability of the plant safety level and the adequacy and completeness of the plant's upgrade programme. All participants who completed SARs, partial SARs or even the initial step of completion of one component of a SAR, i.e. the PSA reported that the process resulted in the improvement of plant safety. In some cases, large numbers of specific minor and major deficiencies were identified in the process. Many of these deficiencies could be corrected, and thereby affect safety improvement, with minor expenditures of resources. The PSA can also be used to set priorities for major plant improvements.

Many conference participants expressed their concern, however, over the potential misuse of PSA results, particularly in light of the high uncertainty of the quantitative results. Propagation of uncertainties in the PSA event trees or fault trees is an essential element for interpreting the results. Uncertainties can be quite large especially in the internal and external events analysis such as flooding, fires, earthquakes and could cause misinterpretation of the results. It was noted that that the use of PSA is more appropriate for comparative purposes for the same unit, as opposed to the use of the absolute values for CDF. It was recognized that PSA is only one element of an SAR. It must be balanced by the other elements of a SAR in order to achieve a balanced assessment of plant safety.

There is no question that considerable progress on nuclear safety has been made in Eastern Europe. Special mention should be made of successful efforts to strengthen the independence and technical competence of the nuclear regulatory authorities. The countries have come a long way in producing the legislative and regulatory framework for national nuclear regulation. Assistance in this area in some countries is still needed. Efforts should now concentrate on improving the depth and scope of the technical abilities of the regulatory authorities. More attention by governments is needed to ensure that the regulatory authorities have the financial resources and enforcement authority to fully execute their missions. As, the primary responsibility for safety rests with the operator of the plant, efforts should be made by regulatory authorities to transfer appropriate responsibilities for safety to the operators.

With respect to the operators of the nuclear power plants, they have demonstrated clear progress in operational safety improvements. In particular, efforts to address analysis of operating experience feedback have been made, but more remains to be done. Significant additional efforts are required to maintain and enhance an effective safety culture. Future assistance efforts will need to focus on this area.

Design safety improvement programmes are in place in all countries. Implementation of these programmes has varied and is particularly affected by economic conditions. Valuable time and effort in implementing these programmes could be saved by increasing the exchange of information on the engineering solutions and implementation of the safety modifications among the countries in Eastern Europe. Mechanisms for the exchange of information should be strengthened.

The fundamental basis for selecting design safety improvements should lie in unit-specific safety analysis reports undertaken in accordance with best international practices. Safety analysis reports should form the basis for licensing of the reactors as they provide the conditions for safe operation. Although a lot of effort has been dedicated to the conduct of the PSA portion of the SARs, there is some concern that large variations are indicated in the PSAs from the same plant types. In addition while these PSAs provide a useful initial step to assess plant risk profiles and safety priorities, it is only a part of an effective SAR. Complementary deterministic analyses based on a full spectrum of accidents are needed. Consistency in both the probabilistic and deterministic approaches is desired and could be reached through systematic information exchanges among the Eastern Europe countries. The IAEA could provide one useful forum for these exchanges. Continued international assistance is also appropriate in this area. Implementation of the results of the SARs as well as follow-up Periodic Safety Reviews are important.

A high level of interest in nuclear safety in Eastern Europe was evidenced by the countries dedicated efforts to complete effective keynote papers to guide discussions in the conference. Discussions over the week of these papers among the participants provided new insights into solutions for safety issues that remain in these countries. These papers and the presentations will be placed on the internet by each of the Eastern European countries and the IAEA will link these to the web site of the IAEA nuclear safety department for easy reference.