MANAGEMENT OF BEYOND DESIGN BASIS EVENTS RISK ROLE OF PROBABILISTIC AND DETERMINISTIC ASSESSMENTS

Transcription

1 ANS PSA 2013 International Topical Meeting on Probabilistic Safety Assessment and Analysis Columbia, SC, September 22-26, 2013, on CD-ROM, American Nuclear Society, LaGrange Park, IL (2013) MANAGEMENT OF BEYOND DESIGN BASIS EVENTS RISK ROLE OF PROBABILISTIC AND DETERMINISTIC ASSESSMENTS Akira Yamaguchi Department of Energy and Environment Osaka University 2-1 Yamada-oka, Suita, Osaka, Japan ABSTRACT In the present paper, the role of the probabilistic and deterministic assessment of safety in the risk management of the beyond design basis events is discussed in relation to the concept of defense-in-depth. The defense-in-depth applications are described from the viewpoints of FP release and severe accident. It seems a probabilistic approach is useful to certify the achievement of the severe accident prevention and mitigation. On the other hand, the performance of the barriers for the FP release prevention and mitigation are assured with a deterministic approach. The completeness uncertainties are the major source of the risk uncertainties. Some accident sequences and plant responses may be excluded from the PRA model. Lack of knowledge and/or awareness of scenarios cause the completeness uncertainties. So called unknown unknown is an event that is not within the scope of the safety consideration. It is a low frequency high consequence or low likelihood high consequence events and the source of the completeness uncertainties. In light of the Fukushima Dai-ichi accident, the manageability of the completeness uncertainties of the scenario and phenomena that are excluded from the safety evaluation are the critical crossroad of the severe accident and benign termination. Therefore, the defense-in-depth should be implemented and applied to the risk management so that the completeness uncertainties are minimized. Independent effectiveness in the defense-in-depth will important to reduce the completeness uncertainties. Key Words: Defense-in-depth, Unknown, Completeness uncertainty, Fukushima Dai-ichi 1 INTRODUCTION The 2011 earthquake off the Pacific coast of Tohoku occurred at 14:46 Japan Standard Time on March, 11. In 40 minutes, tsunami rushed in one after another, causing station black out and the loss of ultimate heat sink in Fukushima Dai-ichi nuclear power plant (NPP). In addition, the direct current (DC) batteries were lost by the tsunami or depleted afterward and hydrogen explosions occurred in reactor buildings. Accordingly, loss of plant control and instrumentation, communications, and deterioration of accident management environment followed. Short-term as well as long-term accident management was required in the Fukushima Dai-ichi. However, most of the activities were not successful. As a result, three units suffered from severe accident. The Japanese government has elicited lessons-learned[1] in which it has decided to actively and swiftly utilize probabilistic risk assessment (PRA) to achieve unrelenting safety improvement including effective accident management measures. The PRA and risk information are the basis of the approach that takes uncertainties, up-to-date knowledge, and experiences into consideration.

2 Akira Yamaguchi A question is raised whether the PRA is appropriate and useful to prepare for a beyond design basis natural event; whether one ensure the event progression to a serious situation is prevented; and whether the risk management supported by the PRA is practically effective to mitigate the scenario and reduce the risk of the public and environment. In the present paper, the author discusses the role of the PRA in relation to the concept of defense-in-depth to ensure safety in light of lessons-learned and insight obtained from the Fukushima Dai-ichi accident. 2.1 Application of Defense-in-Depth 2 UNCERTAINTY AND DEFENSE-IN-DEPTH The purpose of reactor safety is the protection of public and environment from hazardous materials, i.e., fission products (FPs). For this purpose multiple barriers are placed to separate the hazard and the public and environment physically. Underlying concept to achieve the purpose is the defense-in-depth that is to be established and implemented to prevent the FP release and to mitigate the consequences if any. Characterization of the defense-in-depth is given in INSAG-10 of IAEA[2] as follows: (1) Prevention of abnormal operation and failures; (2) Control of abnormal operation and detection of failures; (3) Control of accidents within the design basis; (4) Control of severe plant conditions, including prevention of accident progression and mitigation of the consequences of severe accidents; and (5) Mitigation of radiological consequences of significant releases of radioactive materials. Since the FP is the hazard for public and environment, the essential elements of the defensein-depth are the prevention and mitigation of the FP release. Figure 1 shows the concept of the protection of public and environment from the FP. The risk criteria can be defined to assess the achievement of the safety purpose. Measures to quantify the achievement of FP release prevention and mitigation are useful to ensure that public risk is suppressed low enough. The risk criteria may have two features, probabilistic and deterministic. The resistance to the FP release is an appropriate measure if quantitatively evaluated. Total amount of FP release is another criterion for the mitigation of the consequence. They are deterministic criteria rather than probabilistic. The frequency of containment failure (CF) on condition that core damage (CD) occurred (CFF CD) is a probabilistic metric for the FP release prevention. Similarly the conditional frequency of large release (LRF) on the CD and CF, (LRF CD, CF) is a probabilistic metric for the FP release mitigation. Several probabilistic risk criteria are discussed in Ref. [3]. The criteria for the FP release resistance and amount seem to be not simple and are difficult to define because the failure mode and timing of the multiple barriers, the time history of the FP release for various nuclides, climate conditions and distance to the residential area are information necessary to measure the performance of the prevention and mitigation of the FP release consequences. Safety design, control and risk management are the process to implement and ensure the nuclear safety from the viewpoint of facilities. The safety design and operations are concerned with (1), (2) and (3) and the accident management is related to (4) and (5) of the IAEA definition of the defense-in-depth. It is noted as in Fig. 1 that the safety design and the risk management overlap in the prevention and mitigation of the FP release. The prevention of FP release and mitigation of its consequence are essential and the multiple barriers should be intact as total Page 2 of 12

3 Management of Beyond Design Basis Events Risk Role of Probabilistic and Deterministic Assessments performance. The multiple barriers should be effective as a whole system for both of the prevention and mitigation of FP release rather than the integrity of the individuals. Safety design (Prevention of SA) Risk management Mitigation of SA consequence) Hazard (Fission products) Prevention of FP release Mitigation of FP release Public and environment Risk Criteria (Probabilistic) (Deterministic) IAEA-(1)(2)(3) Multiple barriers (CFF CD) FP release resistance IAEA-(4)(5) (LRF CD, CF) Amount of FP release Figure 1. Purpose of nuclear safety: protection of public and environment from hazard. Let us consider another view of the defense-in-depth. In a nuclear power reactor, the major scenario of the FP release is a severe accident combined with a loss of containment function. In other words, the key elements of the defense-in-depth in nuclear reactor are the prevention of severe accident and containment failure. Needless to say, this is achieved by the safety design, control and operations. Once a severe accident (SA) occurs, the FP is released, it is already in a beyond design basis situation and accident and crisis management procedures are necessary. The risk management includes the accident management procedures on site and emergency planning and response off site. The risk management establishes the appropriate structure of the multiple barriers. Figure 2. Implementation of defense-in-depth: multiple barriers and safety standard from safety design viewpoint. Prevention of a severe accident (SA) is important to prevent the FP release. Maintenance of containment function is fundamental of the FP release consequence mitigation. The barriers for Page 3 of 12

4 Akira Yamaguchi FP release prevention and mitigation are FP barrier (nuclear fuel pins), reactor coolant barrier, and containment barrier. Figure 2 shows the overall picture of the defense-in-depth concept from the viewpoint of the multiple barriers. To achieve the purpose of nuclear safety, the reactor core integrity and containment integrity should be maintained. Recently the Japanese Nuclear Regulatory Authority published the draft standards for safety design and the severe accident countermeasures and emergency preparedness.[4] The safety design standards describe the requirement for the prevention of core damage by postulating the design basis events to prevent the occurrence of a severe accident with sufficient margins. Furthermore, the standard for severe accident countermeasure defines the requirement for the mitigation of the core damage and the prevention and mitigation of containment failure. Corresponding to each objective, core damage frequency (CDF) and containment failure frequency (CFF) are used as performance goals. Furthermore, large release frequency (LRF) is prescribed to mitigate the effect of the consequence of the hazard exposure to the public and environment. They are consistent with the IAEA definition of the defense-in-depth, that is, the IAEA (1)-(3) is to maintain the core integrity and (4)-(5) for the containment integrity and emergency activities. Figure 1 and Figure 2 depict the defense-in-depth on the basis of public and environment protection from the hazard. Figure 1 is based on the prevention and mitigation of the FP release while Figure 2 is depicted on the basis of the multiple barriers against the severe accident progression. The safety design and the risk management overlap to establish the multiple barriers as in Figure 1. The prevention and mitigation of the FP release, on the other hand, overlap as in Figure 2. It suggests the defense-in-depth concept looks like different depending on the FP release concern or the multiple barriers viewpoints. Figure 1 suggests the performance goal can be defined in terms of the resistance to the FP release and the resilience after FP release. Figure 2 clarifies the performance to the SA prevention and the SA consequence mitigation. In both cases, the adequate performance goals that measure the effectiveness of the individual barrier are necessary. Any events that may affect the safety and initiate the accident sequences are taken into consideration. The features of the internal initiating events and external initiating events are different in terms of the extent of the influence on the nuclear plant system and uncertainties in the PRA. Generally, the internal events affect randomly the reactor systems, e.g. the control of reactor power, core cooling and related support systems. On the other hand, the external events influence multiple systems including the systems for FP release mitigation as well as off-site lifeline systems. In summary, the defense-in-depth application is flexible. We can draw different pictures according to the different viewpoints, i.e. FP release or multiple barriers. However, the concept and what it means are the same. It seems a deterministic approach is suitable to certify the risk criteria for the FP release prevention and mitigation. The FP release resistance and total amount of FP release are evaluated by appropriate envelop of the result of the deterministic accident progression analyses. On the other hand, a probabilistic approach is more suitable for the risk criteria for frequencies, CDF, CFF and LRF which are evaluated by the PRA. 2.2 Uncertainty in Risk Assessment Probabilistic risk metrics are the CDF for the core integrity and the CFF for the containment integrity. Further, the performance of the mitigation of the FP release consequence is measured by the LRF. Here we consider an external initiating event such as a seismic event, fire, volcanic Page 4 of 12

5 Management of Beyond Design Basis Events Risk Role of Probabilistic and Deterministic Assessments event, and so on. Letting express the frequency of large FP release on condition that an initiating event occurred, is evaluated by the product of the frequency of the initiating event, and the conditional frequencies of core damage, containment failure, and large release of FP :. (1) We assume the frequencies follow the lognormal distribution and corresponding logarithmic standard deviations are,,, and, respectively. Thus overall uncertainty is expressed by the square root of sum of square of each uncertainty as follows:. (2) The uncertainty is generally divided into two types: aleatory and epistemic. Aleatory uncertainty is associated with the random nature of events such as initiating event occurrence frequencies and component failure rate. The epistemic uncertainty is much more complicated and important in the nuclear safety. Major concern is focused on the lack of our knowledge and experience. The epistemic uncertainty is categorized into three types and they are explained in Ref. [3] as: Parameter uncertainty relates to the uncertainty in the computation of the input parameter values used to quantify the probabilities of the events in the PRA logic model; Model uncertainty arises because different approaches may exist to represent certain aspects of plant response and none is clearly more correct than another; Completeness uncertainty relates to risk contributors that are not in the PRA model. Table I. Characterization of epistemic uncertainties with regard to the knowledge level of phenomena, model and parameter. Uncertainty Scenario/ Phenomenon Mathematical Model Parameter uncertainty Known Known Model uncertainty Completeness uncertainty Known Unknown/ Excluded Unknown/ Uncertain NA Model Parameter Uncertain/ No data NA NA The PRA model is an explicit model of initiating events and accident sequences as well as related phenomena in a mathematical form. Therefore, the phenomena relevant to the accident scenario should be understood and agreed to be appropriate. The aleatory uncertainty is well reflected in the PRA model because it is a random variability of known model and known parameter. The variance can be measured or estimated because the phenomenon is known. On the other hand, the epistemic uncertainty is not so simple because it originates from lack of knowledge or unawareness of the phenomenon. The knowledge level for the uncertainties is shown in Table I. If the phenomena and scenario are not known or intentionally excluded from the PRA model, the situations account for the completeness uncertainty. Even though a scenario and related phenomena are known, widely accepted mathematical models may not exist or the Page 5 of 12

6 Akira Yamaguchi mechanical model may be uncertain. We may have several alternative models or we may not have enough data to describe the model (model uncertainty). In most cases, we understand the accident scenarios and dominant phenomena. The mathematical model has been developed to evaluate the phenomena and quantify the risk metrics. The parameters appearing in the model need to be quantified but they may be uncertain or no data exists to determine the values in a statistical method. In extreme conditions of the SA, it sometimes happens that the applicability of the model is not validated and little experimental data is obtained in the actual conditions. These are examples of parameter uncertainties. The range of uncertainty of the CDF caused by the parameter uncertainty is comparatively small in general. If scenario, phenomena and model are known, resultant variability of the system response is expected to be limited within small range. If the scenario and phenomena are known, the variability of CDF caused by the model uncertainty would not be significant because all the possible models are developed to predict the same phenomena of concern. We investigate the uncertainties of the probabilistic risk measures for initiating event, core damage, containment failure and FP release as:. (3) in Eq. (2) is rewritten as:. (4) where, and are parameter, model and completeness uncertainties, respectively. Sources of the completeness uncertainties are unknown or intentionally excluded natural event for the external initiating event and scenarios of core degradation, containment failure, FP release. A common mode failure and cliff edge effect caused by an external event is such an example in which accident management procedures cannot be properly performed properly and resultantly lead to FP release. As discussed in the previous section the defense-in-depth concept is established to prepare for the uncertainties in the preceding barriers. Since the prevention of the FP release is not perfect, then mitigation of FP release consequence is required to protect the public and environment as in Fig. 1. Because of the uncertainties in the SA prevention, the mitigation of SA consequence is necessary. Further, the emergency response is important because the SA prevention and mitigation involve uncertainties. According to the INSAG-10, the prevention of SA is further multiplied into three parts: prevention of abnormal operation and failures; control of abnormal operation and detection of failures; control of accidents within the design basis. If the defense is designed on the basis of independent effectiveness, each barrier is effective regardless to the specific accident sequences. The independent effectiveness is to avoid carefully the common mode and mutual dependencies between the layers as possible as we can. The important scenario and phenomena are different for each defense layer. Therefore, the common mode and mutual dependencies can be avoided. If some representative plant conditions hat envelops the consequences of the accident progression for the preceding defense layer are Page 6 of 12

7 Management of Beyond Design Basis Events Risk Role of Probabilistic and Deterministic Assessments determined regardless to specific accident scenario, the model and parameter uncertainties will be practically eliminated. Thus, the completeness uncertainties are dominant comparing to the parameter and model uncertainties. It is the reason that appropriate defense-in-depth is effective to prepare for uncertainties. The uncertainties in the SA progression are compensated if the SA management is appropriately designed and does not depend on specific accident sequences. If it is true, the CDF uncertainty is not safety concern because the containment function will mitigate the severe accident consequence. Thus the FP release will be successfully prevented by the containment function as far as the SA scenario and important phenomena are known. However, the completeness uncertainty suggests there exists unknown scenario and phenomena. Therefore, the CFF is uncertain and appropriate measures to mitigate the large release consequence and emergency responses need to be effective to protect the public and environment. Here Eq. (4) can be rewritten emphasizing the completeness uncertainty as:. (5) It is seen that the uncertainty of the public and environment risk can be reduced by comparing Eq. (4) and Eq. (5). The independent effectiveness of multiple barriers of the defense-in-depth is essential. Further investigation and reduction of the completeness uncertainties are needed. To assure the independent effectiveness of the defense-in-depth, each barrier should be developed based on different principles from others. However the completeness uncertainties are caused by lack of knowledge and/or awareness. For example, with regard to the external initiating events, one of the uncertainties is the possibility that an initiating event is excluded from the PRA model but the frequency is not negligible actually. Some accident sequences may be out of the scope in the safety assessment because a severe accident management (SAM) is believed to be effective. However, it may not be practical and effective if a common mode failure exists. These are classified as the completeness uncertainties and that cannot be resolved by only enhancing the multiplicity of the safety system. The independent effectiveness of the defense-in-depth is an essential feature to deal with the completeness uncertainty. It is why the SAM and the off-site support should be prepared regardless to the performance of the SA prevention. Provisions for the beyond design basis accident control should be established based on different concept from the design basis approach. The SAM provisions can reduce the risk only if they are independently effective. 3 PREPARAREDNESS FOR SOTEI-GAI, FUKUSHIMA DAI-ICHI ACCIDENT 3.1 What is Sotei-gai? Out-of-Our-Scope Sotei-gai is a Japanese word that means an event we do not prescribed in advance. Sotei means to imagine or to think deeply and to suppose or to assume something. Gai means being beyond our scope or to be intentionally or accidently excluded. Figure 3 shows the categorization of design basis events and the sotei-gai events with respect to our postulation and experience. Known-known is a category in which we have sufficient knowledge and have experience of those events in the past history of engineering. Thus we recognize the significance of the events to ensure safety and select the design basis Page 7 of 12

8 Akira Yamaguchi events. With regard to external events, we determine a design basis earthquake and tsunami for example according to the historical records and source investigation. The probability of multiple random failures is very small and we do not take it into consideration in the safety design framework. Also, the extreme external event is not postulated because the occurrence frequency is small enough. We recognize the event as an extrapolation of the design basis. However we have not experienced those and not explicitly considered in the safety evaluation of the nuclear power plant. Thus the possible accident initiator is known but the accident scenario and consequence are not well investigated. Those events are categorized as unknown known. The known unknowns are events which we have experienced a similar incident but not postulated in the safety analysis. Examples are the station black out in Ma anshan nuclear power plant in Taiwan in 2001, flooding at Le Blayais in France in 1999 and beyond design basis earthquake in Kashiwazaki-Kariwa of Japan in These are excluded originally in the safety consideration. However, once we experienced those events, the cause and consequences are fully investigated and appropriate provisions are made to ensure safety. Sometimes additional regulatory requirement is developed. At this stage they are already known knowns. The last category is unknown unknown. It is an event that is not within the scope of the regulation and we believe it is adequate. Since they are not postulated, the accident scenario is unknown and the uncertainty is large. Some natural events and man-made events are the candidate of this category. Severe accident management may not be effective for this type. As in Eq. (5), the completeness uncertainty is dominant. Excluded initiating events, unexpected core damage mode FP release mode, unlikely loss of containment function, and deterioration of the severe accident management environment including off-site activities are the examples. All of these are low frequency high consequence or low likelihood (no experience) high consequence events. No Experienced Yes Known unknowns Unlikely and experienced Near accident e.g. Station black out (Ma'anshan) Flooding (Le Blayais) Unknown unknowns Unknown scenario Complete uncertainty is large Examples e.g. Natural event Man-made event Unknown knowns Event is known Scenario is uncertain e.g. Extreme earthquake Extreme tsunami Multiple failure No Postulated Yes Known knowns Expected and postulated e.g. Design basis accident Design basis earthquake Design basis tsunami Figure 3. Classification of postulated events in terms of awareness and experience. Page 8 of 12

9 Management of Beyond Design Basis Events Risk Role of Probabilistic and Deterministic Assessments 3.2 Major Uncertainties in Fukushima Dai-ichi Accident In chapter 2, the completeness uncertainties of the external initiating event, core damage and containment failure and FP release are discussed. In light of the Fukushima Dai-ichi accident, we investigate how the completeness uncertainties are related to the accident progression. Tsunami in the Fukushima Dai-ichi was almost five times as large as the design basis. It resulted in severe accidents in three units in full power operation. Furthermore, one unit under refueling was seriously damaged by the hydrogen flow reversal from the adjacent unit. Because of this, the spent fuel pool of the unit was jeopardized. The tsunami height exceeded the design basis level in other NPPs such as Onagawa, Fukushima Dai-ni and Tokai as well. It is said the tsunami itself is not a cliff edge and does not induce a serious common mode failure if the antitsunami design is appropriate Initiating Event The design basis tsunami at Fukushima Dai-ichi and Dai-ni are 3.1m and 3.7 m, respectively based on the Chile tsunami in In 2002, The Japan Societies of Civil Engineers (JSCE) published the tsunami assessment method for Japanese nuclear power plants.[6] According to the methodology in the report, the maximum tsunami heights were evaluated for the Fukushima Dai-ichi and Dai-ni NPPs to be m and m, respectively. The tsunami heights were reevaluated in 2008 assuming that the same magnitude as the Meiji-Sanriku earthquake occurred off the coast of Fukushima prefecture. The Meiji-Sanriku earthquake occurred in 1896 approximately 166km off the coast of Iwate Prefecture, which is one of the most destructive earthquakes in Japanese history. The tsunami run-up reached 38.2m at the highest and 22,000 people was killed. The result was m at the Fukushima Dai-ichi site. Furthermore, the Jogan earthquake in 896 was also investigated. The epicentral area of the Jogan earthquake is not definite but believed to be off the coast of somewhere between Miyagi and Fukushima prefectures. Supposing a postulated Jogan earthquake in Fukushima region, the tsunami heights were evaluated to range from m and m at Fukushima Dai-ichi and Dai-ni, respectively. TO follow-up the studies, the Tokyo Electronic Power Company consulted to the JSCE for further investigation and started the tsunami sediment survey. The tsunami earthquake sources were uncertain. Approach is that the same tsunami earthquake sources as the Meiji-Sanriku and Jogan earthquakes were assumed to exist at offcoast Fukushima. The reevaluation was not considered as urgent as immediate provisions are required. It is a completeness uncertainty in the consideration of tsunami earthquakes source. It seems the model and parameter uncertainties range is smaller than the completeness uncertainty. If we consider the tsunami earthquake source locates uniformly in the off coast Pacific Ocean side of East Japan, the tsunami height consideration may be updated to be larger e.g. 15m. If we refer to the flooding at the Le Blyais NPP and the tsunami at Madras NPP, the situation would be very different with respect to the prevention and mitigation of the tsunami affect. The inundation height during the Fukushima Dai-ichi accident on March 11, 2011 was m. It is noted that the ground level of the site is 10m. Japan has experienced several earthquakes that are beyond design basis. The performance of the plant system to the earthquakes was excellent except some non-safety grade SSC failures. Learning from the experience, seismic enforcement has been fulfilled in the Japanese NPPs. It ensures the good seismic design quality is achieved. On the other hand, Japanese nuclear plants have not experienced the flooding and tsunami. Although the Japanese seismic design code Page 9 of 12

10 Akira Yamaguchi mentioned tsunami should be protected as a seismically induced event, tsunami PRA has not been done before the March 11 event. We can conclude that near accidents and accident sequence precursors are very important to find out the plant vulnerability that we have not recognized. PRA society should investigate those events systematically and share the insights with worldwide nuclear safety community Core Degradation Sequences The uncertainties in the core degradation sequences originated from the uncertainties in the capacities and the responses of structures, systems and components (SSCs). The SBO scenario, loss of seawater system and loss of ultimate heat sink have been predicted by the PRA with the model and parameter uncertainties. As discussed above, the containment function is supposed to cover this type of uncertainties. What happened in Fukushima Dai-ichi was SBO combined with battery failure. Most of the electrical panels and switchgears were lost by seawater intrusion into the electrical rooms in the basement of the turbine building. Therefore, alternative power source such as power vehicles cannot be connected as the accident management procedures. Because of the loss of all the power, instrumentation and control, communication and lighting systems were not available. This is another completeness uncertainty. The earthquakes intensity exceeded design basis level in several NPPs such as Fukushima Dai-ichi and Dai-ni, Onagawa, and Tokai. The defense-in-depth protection safety functions, however, were not lost in other plants than Fukushima Dai-ichi. Let us discuss the Onagawa NPP case. The IAEA sent a mission to Onagawa nuclear power plant and concluded[7] that: Despite prolonged ground shaking and a significant level of seismic energy input to NPS facilities the structures, systems and components of the Onagawa NPS performed its intended functions without any significant damage. The lack of any serious damage to all classes of seismically designed facilities attests to the robustness of these facilities under severe seismic ground shaking. It was concluded that the facilities of the Onagawa NPS remain remarkably undamaged given the magnitude, distance and duration of ground shaking. Kashiwazaki- Kariwa NPP experienced more than three times of the design basis earthquake in Tyuetsu-Oki earthquake in In this case, the safety functions are not deteriorated and are intact and the IAEA investigation team concluded that the safe performance of the Kashiwazaki-Kariwa nuclear power plant during and after the earthquake that hit Japan s Niigata and Nagano prefectures on 16 July 2007 has been confirmed. The fact suggests the seismic safety margins of the Japanese NPPs are large enough. It is attributed to the knowledge on the seismically induced sequences and good seismic qualification of the SSCs. Accordingly the completeness uncertainties are not significant as far as the earthquake of this type is concerned. However, it is noted is that the vulnerability of off-site power has been found in the 2011 earthquake off the Pacific Coast of Tohoku. In five nuclear power plant site, that is Higashidori, Onagawa, Fukushima Dai-ichi and Dai-ni, Tokai, there are 19 off-site power grid lines. After the earthquake, only three lines were available. In Tokai, it took a few days to recover the off-site power Severe Accident Management and Containment Integrity Short-term as well as long-term accident management was required at on-site as well as offsite in the Fukushima Dai-ichi accident. However, most of the activities were not successful. The reasons that the accident management was in fail are investigated to identify a proper approach to effective accident management even in extreme conditions. Page 10 of 12

11 Management of Beyond Design Basis Events Risk Role of Probabilistic and Deterministic Assessments The failures of DC batteries and common mode failures of multiple switchgears and electrical panels were not considered in the severe accident management in advance. Rubble and debris by the tsunami damage obstructed the recovery activities of personnel. Also, the FP release and the deterioration of accident management environment obstructed the severe accident management. It is believed that the FP release is caused by the thermal failure of the seal of the vessel closure head. To maintain the containment integrity alternative containment depressurization and cooling were prepared. Although the structural integrity of the pressure containment vessel was maintained, hydrogen explosion in the reactor building escalated the radiation level. Thus the SA mitigation was not practical in the actual situations during the accident. However, those operations were not successful. It is because the AC power was not recovered. The problem is that the accident management provisions for containment integrity is dependent on the power supply. Further, a worker could not stay at the reactor location for long time for recovery. Even if the core integrity is lost, alternative procedures are possible to maintain the containment vessel and to prevent the FP release. However, the alternative procedures were not possible which is attributed to the completeness uncertainty. Physical separation, variability and flexibility works. The SBO scenario that has been postulated is one in which DC batteries are available and recovery of AC power is possible. The accident management procedures are based on the assumption that no obstacle such as debris exists and the radiation level is low so that the accessibility for the management is maintained. The accident management procedures should not excessively rely on the plant status condition analyzed by the plant system response in a severe accident analysis. Most of probable SBO scenarios evaluated by the level 1 PRA can be recovered because we know the sequences and prepared for them in advance. The analogy is applicable to the offsite emergency response as well. In case that the emergency response is needed, it is beyond our prediction and postulation. Then the emergency preparedness established based on only the dominant accident scenarios is not effective enough. Accident management against the beyond design basis conditions to prevent the progression to the core damage and to mitigate the core damage consequence must be independently effective. There may be wide range of variety in the beyond design basis extreme conditions. Accident management is required to be adaptive and flexible so that it can deal with the various situations. Diversity in the countermeasures is also one of the important features. For the independently effective severe accident management, it is useful to define the management-basis core degradation conditions. The representative conditions are used to assess the appropriateness of the subsequent barrier in the defense-in-depth concept based on the PRA. If a management-basis FP release condition is appropriately assumed, the emergency preparedness will be more effective and social risk may be reasonably reduced. Each layer of the defense-in-depth is independently effective if it does not depend on the specific accident sequences. It is necessary to mitigate completeness uncertainties by the risk management. A beyond design basis event is not always results in a severe accident. There are considerable margins to recover the situation. The crossroads of the recovery and the progression to the severe accident are the appropriateness of the defense-in-depth and knowledge and experience. The barriers for the severe accident mitigation and emergency response should be established based on these concepts. Page 11 of 12

12 Akira Yamaguchi 4 CONCLUSIONS The defense-in-depth applications are described from the viewpoints of FP release prevention and mitigation and severe accident prevention and mitigation. The PRA is used to certify the achievement of the severe accident prevention and mitigation. On the other hand, the risk criteria for the FP release prevention and mitigation are assured with a deterministic approach. The defense-in-depth that is independently effective will make up for the uncertainties of the PRA. The completeness uncertainties are the major source of the risk uncertainties. The completeness uncertainties are caused by lack of knowledge and/or awareness of scenarios and phenomena. Because of them, some accident sequences and plant responses may be excluded from the PRA model. So called unknown unknown is an event that is not within the scope of the safety consideration. In light of the Fukushima Dai-ichi accident, we learn the completeness uncertainties or scenario and phenomena that are excluded from the safety evaluation are the critical crossroad. Therefore, the defense-in-depth should be implemented and applied to the risk management so that the completeness uncertainties are minimized. The key words are operability, manageability and accessibility. The flexibility and knowledge-base are useful. It is the independent effectiveness in the defense-in-depth. 5 REFERENCES 1. Report of Japanese Government to the IAEA Ministerial Conference on Nuclear Safety, The Accident at TEPCO's Fukushima Nuclear Power Stations (June 2011) 2. IAEA, INSAG-10, (1996) 3. Probabilistic Risk Criteria and Safety Goals", OECD/NEA, NEA/CSNI/R(2009) 4. Safety Standards, (2013) 5. USNRC, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk- Informed Decision Making, NUREG-1855, Japan Society of Civil Engineers, Tsunami Assessment Method for Nuclear Power Plants in Japan, February IAEA Mission to Onagawa Nuclear Power Station to Examine the Performance of Systems, Structures and Components Following the Great East Japanese Earthquake and Tsunami, Onagawa and Tokyo, Japan, 30 July - 11 August 2012, IAEA MISSION REPORT 8. Third IAEA Report on Kashiwazaki-Kariwa Nuclear Power Plant Published, (2008) Page 12 of 12