Special report: Nuclear plant safety

Three decades of nuclear safetyNuclear plant safety has not been a static concept

by Pierre Tanguy

The safety of nuclear power plants has become thefocus of the international nuclear community since theChernobyl accident in 1986. Much has been accom-plished in the last 30 years with the IAEA playing acentral role in the evolution of safety practices.

Historically, The Technology of Nuclear ReactorSafety provides some decisive views in this field,particularly on accidents.* A quotation from the generalconclusions of an accident in January 1961 at the3-megawatt test reactor SL1, has been mentionedseveral times since Chernobyl:

' 'Most accidents involve design errors, instrumenta-tion errors, and operator or supervisors errors. The SL1

Mr Tanguy is Inspector General, Surete et Securite Nucleates,Electricite de France (EDF), Paris. His article is adapted from an oralpresentation at the IAEA in 1987.

* Published by the Massachusetts Institute of Technology Press(1964), edited by Thomson and Beckerly.

accident is an object lesson on all of these. There hasbeen much discussion of this accident, its causes, and itslessons, but little attention has been paid to the humanaspects of its causes. There is a tendency to look only atwhat happened, and to point out deficiencies in thesystem without understanding why they happen; whycertain decisions were made as they were. Post-accidentreviews should consider the situation and the pressureson personnel which existed before the accident "

That assertion is still relevant today and can help usaddress current safety issues.

The basic idea for this article is based on the firstpage of that book, where the evolution of nuclear poweris described as occurring over 10-year periods.

The concept is a good one, as each 10-year period canbe characterized by a major emphasis on specific safetyaspects. A limited number of safety-significant eventscould well mark the end of such a period and the begin-ning of a new era for safety development. It is clear that

Calder Hall, the world's first large-scale nuclear power station, was officially opened in 1956 at the Windscale Works in Cumbria, UK.(Credit: UKAEA)

IAEA BULLETIN, 2/1988 51

Special report

Safety features are key elements in the design of nuclear powerplants. (Credit: UKAEA)

1979, the year of the accident at Three Mile Island(TMI) and 1986, when the Chernobyl accident occurred,are such reference points. The establishment of theIAEA in 1957 is another landmark.

"Pre-history" of safety

In 1947, the first event of safety-significance wasselected by David Okrent in his book Nuclear ReactorSafety on the History of the Regulatory Process. It isused as the starting point of the chapter on historicalbackground in The Technology of Nuclear ReactorSafety:

"At its first meeting in 1947, The Reactor SafeguardsCommittee considered the first proposal for a containedreactor. From that time on containment for protection ofthe general public has played an important role in reac-tor safety in the United States.''

It is still today one of the central issues in reactorsafety assessment.

In fact, the history begins earlier, as the book notes:' 'Safety has been an important consideration from the

very beginning of the development of nuclear reactors.On 2 December 1942 shortly before the reactor was'expected to reach criticality, Fermi noted the mountingtension of the crew. To make sure that the operation wascarried out in a calm and considered manner, hedirected that the experiment be shut down and that alladjourn for lunch. With such leadership in safety at thevery beginning, it is no wonder that the operation ofreactors to date (in 1964) has been singularly free ofmishaps.''

Perhaps we lack the safety culture of such a super-visor in many plants, since such a large fraction ofso-called abnormal occurrences happen during startupafter a shutdown period for refueling or maintenance.This is the time when the desire to get the plant on lineas soon as possible prevents the people in charge from

52

stopping when"they experience minor difficulties, beforethey get into more serious trouble.

It is coincidence that in 1957 the Windscale accidentoccurred, with the first, and until Chernobyl, the onlyone of its time, large-scale radioactive release into theenvironment: 20 000 curies of iodine. This accident andits potential long-term consequences has been the subjectof renewed debates since Chernobyl.

WASH-740 was the first report which gave an evalu-ation of the maximum consequences of a severe uncon-tained accident. It became the basis for the liabilitylimits to be included in the Price Anderson Act, whichdefines the provisions for insurance of nuclear powerplants in the United States.

There was a revised version of this report many yearslater in 1966, but it was not as well known. WASH-740represented the main reference on what could be theconsequences of a very severe nuclear accident until theRasmussen report (in 1975), and until Chernobyl.

According to Okrent, in the first years, safety prioritywas on design features, and little attention was given tothe other stages — construction and operation. The USAtomic Energy Commission (AEC) issued a firstversion of the general design criteria in 1965. But thesecond version of 1967, after discussion with theAdvisory Committee for Reactor Safety (ACRS), incor-porates important aspects which are still relevant today.The issuance of these criteria represents a decisive stepin the deterministic approach of safety. It is a coinci-dence that, in that same year, the idea of probabilisticsafety assessment (PSA) was introduced for the firsttime in an international meeting in Vienna, Austria. Thedevelopment of that idea has been extensive.

Before 1957, safety had not reached full recognition,independent from nuclear developments. That wasobtained later. Therefore, "pre-history" is a suitableterm. Safety was already a primary concern for organi-zations involved in the development of the peaceful usesof nuclear energy but not fully autonomous. In his paper"Progress in Nuclear Safety", Francois Cognementions that, in the first two Geneva conferences in1955 and 1958, there was no specific session devoted tosafety.* Three important safety developments occurredduring the pre-history period in the USA. David Okrentconsiders that the first official statement on the AECsafety philosophy was made in 1953 by Edward Teller,former chairman of the Reactor Safeguards Committee:

"In the popular opinion, the main danger of anuclear pile is due to the possibility that it may explode.It should be pointed out, however, that such an explo-sion, although possible, is likely to be harmful only inthe immediate surroundings and will probably be limitedin its destructive effects to the operators. A much greaterpublic hazard is due to the fact that nuclear plantscontain radioactive poisons. In a nuclear accident, thepoisons may be liberated into the atmosphere or into the

* Paper in French, in Revue Generate Nucleaire, No. 1 (1984).

IAEA BULLETIN, 2/1988

Special report

water supply. In fact, they will retain a dangerous con-centration even after they have been carried downwindto a distance of ten miles. Some danger might possiblypersist to distances as great as one hundred miles. "

This was said 33 years before Chernobyl.

A second point relates to the rule of thumb to definethe radius R in miles around the plant for which evacua-tion should be possible:

R = O.OlVP, with P = power in thermal kilowatts.

A 1000 megawatt-electric (MWe) radius is 17.3 milesaccording to this formula, which is about 30 kilometres.That rule of thumb was established in 1950, 36 yearsbefore Chernobyl.

Finally, in 1953, the first civilian nuclear power plantwas announced in Shippingport: a containment buildingwas provided around the reactor. The three majoraspects that dominated safety for the next years werepresent: accident prevention, mitigation of consequencesby containment, and emergency planning.

1957-67: Safety of design

The dominant safety aspect of this period is theimportance given to safety of the design. Most of theconcepts which are still in use were established aboutthat time including the main safety functions: controllingthe chain reaction; cooling the core; and containing theradioactive materials. The concept of defence-in-depth,with the requirement of redundancy to fulfil the singlefailure criterion, and of postulated initiating events togive the design basis for the safety features, were

established. Even if some developments were to occurlater, most external events, such as earthquakes andfloods, were introduced at that time.

In the AEC approach, the concept of "maximumcredible accident" was used, presented for the first timein 1959. It was not universally accepted.

In France, the emphasis was put on the multi-barriersystem, between the radioactive materials and theenvironment, and on an assessment of the possiblechallenges of these barriers.

Some technical issues which were widely discussedduring the period, and which have some relevancetoday, should be mentioned. The question of pressurevessel integrity was raised in reference to the safetyapproach, based on prevention of accidents and on miti-gation of their consequences should they occur. Thisapproach was fine for pressure tube design wherepriority was given to prevention of tube rupture; but italso had to be demonstrated that propagation to othertubes would not lead to unacceptable consequences. Wasit necessary to provide a containment able to withstandthe consequences of rupture for pressure vessel designs?The question was easily answered for gas-cooled reac-tors, where containment was not considered necessary tokeep the consequences of an hypothetical accident at anacceptable level.

The discussion was more difficult for light-waterreactors (LWRs). When the AEC deemed such a failure"incredible", a report by British experts in 1964 con-cluded that rapid vessel failure was possible at tempera-tures above the nominal brittle-ductile transition range— in the operating temperature range where suddenfailure was not supposed to occur. A specific research

The Pickering nuclear generating station nearing completion In the late 1960s.

IAEA BULLETIN, 2/1988 53

Special report

The accident at TMI placed emphasis on operational safety.(Credit: GPU)

programme was launched in 1965 in the USA and lastednearly a decade. The Heavy Section Steel TestProgramme, conducted by the Oak Ridge NationalLaboratory, indicated that at operating temperaturesthick-walled steel for pressure vessels was very toughand not inclined to undergo rapid fracture.

In parallel, significant improvements were brought tocodes and standards, from stress analysis to in-serviceinspection. Finally, it was considered that the risk of amajor rupture from missiles which could breach thecontainment was very low. Several years later, theRasmussen report confirmed that conclusion.

Another technical issue is related to the risk of reac-tivity excursions. Reactor kinetics were subject to exten-sive studies and research, including the variousreactivity coefficients, xenon instabilities, and, forliquid moderators, void effects. Many important experi-ments were conducted during that period, among themthe well-known SPERT programme in Idaho Falls onLWRs.

In the following years, reactivity transients were stillthe subject of considerable investigations, in particularas regards fuel failure mechanisms, in many researchfacilities, for example in the USA, Japan, and France,and for several reactor types.

One can consider that it is at the end of this firstperiod that the possibility of urban siting was ruled out.It was first raised in 1963 in the USA with the applica-tion for the Ravenswood site: two pressurized-waterreactors (PWRs), around 600 MWe each, in theBorough of Queens in New York City, along the East

River, with three million people at night within a 5-mileradius, and 5.5 million during the day. The applicationwas withdrawn; the official reason was not related tosafety, but to the availability of cheaper power fromLabrador.

A similar debate took place several years later in theFederal Republic of Germany with the Ludwigshafenproject, for which specific provisions were foreseen tocope with vessel failure. Finally, although there wasstrong industry pressure for metropolitan siting (in theUSA, for example, the Edison Electric Institute wrote in1967 that "siting of NPPs in metropolitan areas must bea key factor in the design of our future electric powersystems"), there was a general consensus to move awayfrom metropolitan sites with the recognition of the rela-tionship between core melt and containment failure.

1967-79: Safety of construction

During the second period, from 1967 to TMI, theemphasis was on safety of construction. This may beexcessive, since most of the effort was still related todesign safety. However, one key safety aspect wasintroduced at this time: quality assurance.

The importance of safety during the constructionstage has always been recognized. As noted in TheTechnology of Nuclear Reactor Safety in 1964: •

"Since many reactor projects have experienceddifficulty due to inadequate workmanship, faultymaterials, and other construction problems, the impor-tance of this phase (the construction stage) cannot beoveremphasized. The execution of a reactor design, ifnot properly carried out, can nullify the safety features.Very little can be said in the way of guidance except thatit is essential to maintain the highest standards ofconstruction and installation. "

A lot of guidance was given later, and qualityassurance may have been the source of more paper workthan the entire regulatory process. It is now a well-accepted concept, even if its implementation raisesproblems.

Apart from quality assurance, safety design under-went a considerable evolution during these years. It isimportant to note that independant regulatory bodiestook their full extension during that period. In the USA,the Nuclear Regulatory Commission (NRC) was estab-lished in 1974 by the Energy Reorganization Act. Beforethat, in 1970, a programme of safety guides (laterrenamed regulatory guides) was initiated by the AEC toimplement the design safety criteria.

In France, the safety responsibility shifted from theCommissariat a l'energie atomique (CEA) to the ServiceCentral de Surete des Installations Nucleaires (SCSIN)in 1973. In Great Britain, the Nuclear InstallationsInspectorate (Nil) was formed in 1975 in the Health andSafety Executive.

Many design safety issues were raised during theperiod. One issue deals with the specific case of liquid-metal fast breeder reactors (LMFBRs). After the Bethe

54 IAEA BULLETIN, 2/1988

Special report

and Tait accident, the period was dominated by theHypothetical Core Disruptive Accident (HCDA). Thehypothetical accident involved a core meltdown due tothe loss-of-cooling'power and-failure to scram (shutdown the chain reaction), followed by various energeticphenomena. Although core meltdown events for otherreactor types were not explicitly considered in thelicensing process, HCDA was considered for breeders,for which the negative reactivity coefficient and largethermal inertia were generally considered favourable.There was some apparent lack of coherence here. But,before TMI, there were many discussions on core meltin LWRs (the China syndrome) and important research,for example in the Federal Republic of Germany.

For LWRs, LOCA (loss-of-coolant accident) becamethe main issue. Results from a research facility (semi-scale) indicated in 1971 that much of the water couldleave the reactor vessel under certain conditionsinvolving a pipe break rather than reflood the coreimmediately. The so-called emergency core coolingsystem (ECCS) issue was the most controversial one forsome time, used by anti-nuclear movements in theiractions. It kept the safety emphasis on the large pipebreaks, the so-called guillotine rupture, and unfor-tunately diverted attention from the more probable smalland medium breaks — although the Rasmussen reportindicated clearly that they were the risk-dominantsequences. TMI was an unfortunate reminder of the truesafety issues.

Among the many other safety issues discussed duringthis period, fire was recognized as a potential safety con-cern of considerable importance for at least a decadebefore the Browns Ferry incident in 1975 in the USA.That event led to a major effort from regulatory bodies,and new requirements were introduced. Other issues ofsignificance to operational safety were resolved as well.

Finally, this period is also characterized by the publi-cation of the Rasmussen report, WASH-1400, in 1975.Forgetting the controversy about its executive summary,and its use in the public debate, what was essential wasthe general consensus on the benefits for safety whichcould be gained from a probabilistic approach, as asupplement to the deterministic one used in design. Thisconsensus was worldwide. An excerpt from an ACRSletter, from Okrent's book, articulates this consensus:

"Reactor Safety Study represents a valuable contri-bution to the understanding of Light Water ReactorSafety in its categorization of hypothetical accidents,indentificadon of potential weak links, and its efforts todevelop comparative and quantitative risk assess-ments....The methodology should be applied to othertypes and designs of reactors, other site conditions, andother accident initiation and sequences.''

On 28 March 1979, the safety scene looked satisfac-tory on the whole. The safety approach was coherent,and there were no pending serious issues. Contrary towhat was said later, severe accidents were not ignored.The probabilistic assessment did confirm that their prob-

Emergency preparedness evaluation at a US nuclear plant.(Credit: INPO)

ability was low, and that one could expect a significantmitigating effect from the containment which wouldmake the probability of severe radiological conse-quences to the public and the environment much lower.In fact, some members of the nuclear community wereeven convinced that nuclear power plants might well benot only safe enough, but too safe.

Maybe at that time it was overlooked that nuclearpower plants had evolved over years, and had increasedin power capacity. The decay heat levels were muchhigher. Engineered safety features were added to reducethe likelihood of accidents, but the designs had becomemore complicated. There were now important relation-ships between the possible failures of various safetyfeatures. And more important, most discussions dealtwith design, while not enough attention was given tosafety in operation and its human component.

1979-86: Safety in operation

The third period is a familiar one and includes the les-sons learned from TMI. They were, in most countries,re-emphasized after Chernobyl. Only after TMI, opera-tional safety was given the attention it deserved. Manyessential safety aspects played a role in the TMI accidentincluding the importance of adequate operating proce-dures; the need for appropriate training of operatingpersonnel; the necessary improvement of the man-machine interface; the usefulness of operatingexperience feedback; the requirement for efficient emer-gency plans; and the danger of improper "mind-sets" atall levels of the operating organization. These safety

IAEA BULLETIN, 2/1988 55

Special report

aspects now receive, in most countries, the attentionthey require. The establishment of the Institute ofNuclear Power Operations (INPO) in the USA is asignificant indicator.

Also in this period, probabilistic methodologies wereat last used in practice to improve safety. One typicalexample is the single failure criterion which is useful forsafe design, but is not sufficient. There are cases wherethe complete loss of redundant safety systems has to betaken into account if the corresponding consequenceswere too large — the "cliff edge" effect. The onlydecision tool is probabilistic safety assessment (PSA).Complicated safety issues such as total blackout (loss ofall electrical sources, external and internal to the plant)and anticipated transient without scram (ATWS) havebeen solved with the assistance of PSA.

"Safety goals" have to be used, even if implicitly, inthe decision-making process. In retrospect, it appearsthat there was from the beginning a conscious policy oftrying to make nuclear power reactors safer than otherindustrial or technological enterprises. Many countrieshave attempted to translate this.general objective interms of limited probabilities for harmful accidental con-sequences. This is not an easy concept, and even if manywould agree on the order of magnitude of some safetygoals, the discussion would be more difficult on theiruse, or practical implementation.

Finally, there is no doubt that this period has seensignificant improvements in the safety of nuclear powerplants. The Chernobyl disaster does not necessarilycontradict this statement, but it compels us to proceed toa new and complete review of our safety philosophy andpractices.

1986 and beyond: International safety

No one can know what will be the main safety trendsin the next decade in the technical field. Fashionableconcepts such as inherent safety should not have a verybright future; but, international aspects will beprominent.

We did not wait for 1986 before entering into inten-sive international safety co-operation. In addition toIAEA's role, there are many examples of fruitful inter-national safety co-operation, through internationalorganizations, such as the Nuclear Energy Agency of theOrganisation for Economic Co-operation and Develop-ment (NEA/OECD), as well as through bilateral ormultilateral agreements.

They cover all aspects of nuclear safety, from regula-tory matters to exchange of operating experience,including safety research. Much of the safety progressmade in the past has been the result of common researchprogrammes, too numerous to mention here.

IAEA's nuclear safety programme. The drafters ofthe Statute of the IAEA conferred on the Agency themandate to "seek to accelerate the contribution ofatomic energy to peace, health and prosperity through-

out the world". The phraseology was widely seen in theearly days as giving the Agency a promotional role withrespect to the use of nuclear power for electricitygeneration. At the same time, however, they gave theAgency a specific mission in the field of safety.

The Agency has no actual regulatory powers; it ismandated only to provide advisory services. The onlyexception is in the case of technical assistance projects,when it is obliged to observe its own safety standards inaddition to those of the national regulatory or safetyauthority, where they do not conflict.

The Agency was established at a time when therewere very few nuclear power stations; and the resourcesdevoted to its nuclear safety programme were limited.National authorities took the lead in the development ofstandards, reflecting their own degree of involvement innuclear power. The Agency paid close attention to workin areas where international agreement was clearlyrequired.

The 1960s, for example, saw the development of thewell-known "regulations" on the transport of radio-active materials across international boundaries. Thesehave been widely adopted as the basis for national legis-lation, and by bodies which do have regulatory powers.The Agency worked in close collaboration with organi-zations such as the Central Commission for the Naviga-tion of the Rhine, Central Office of InternationalRailways, Euratom, International Maritime Organiza-tion, International Air Transport Assocation, UniversalPostal Union, and World Health Organization.

In the 1970s, the number of nuclear power plantprojects increased, and it was recognized that harmoni-zation of differing national standards and regulatoryrequirements — not only in transport but in other areasof nuclear safety — could be valuable in the develop-ment of international trade in nuclear power plantservices and equipment. The Agency therefore begandevelopment of a comprehensive body of safety stan-dards for nuclear plants. Eventually, this programmeresulted in the publication of 60 documents in theAgency's Nuclear Safety Standards (NUSS)programme, dealing with siting, design, construction,operation, and quality assurance considerations.

The accident at TMI, and the changing world energysituation, resulted in a fall in the number of orders fornew nuclear plants. The Agency reoriented itsprogrammes to place increased emphasis on operationalsafety. In 1982, it revised its Basic Safety Standards totake account of recommendations of the InternationalCommission on Radiological Protection (ICRP) on doseoptimization. During the same period, it published awide range of technical guidance documents dealingwith occupational and public needs in the field of radia-tion protection, and emergency planning andpreparedness.

From the beginning, the Agency carried out ad hocmissions to Member States, especially in connectionwith services and assistance provided through its techni-

56 IAEA BULLETIN, 2/1988

Special report

cal assistance programme. Through these missions,developing countries in particular could receive thebenefit of expert advice. In 1972, to meet the increasingneeds of Member States, the Agency announced theavailability of missions for the Integrated SafetyAssessment of Research Reactors (INSARR) — many ofwhich are in developing countries.

In 1983, the Agency formally offered the firstOperational Safety Review Teams (OS ART). OS ARTmissions provide nuclear power plant operators withuseful advice, and an exchange of ideas on safetyimprovement, at the working level. Since Chernobyl,the OSART programme has been expanded greatly; theAgency now fields at least one mission each month.

Also in 1983, the Agency established an internationalIncident Reporting System (IRS), to enable operators inall participating countries to benefit from "lessonslearned." This system complements that operated by theNEA/OECD. In particular, it includes plants in coun-tries outside the OECD area. It is now being expandedto include more "significant events", and to enable amore effective and timely analysis of events. Teams forthe assessment of safety-significant events (ASSET) arenow offered, to perform on-the-spot, in-depth analysisof the operational experience of nuclear power plantswith respect to their safety, focusing particularly on theman-machine interface and human factors.

In 1985, the Agency established the InternationalNuclear Safety Advisory Group (INSAG) to review theAgency's activities in the field of nuclear safety and to

advise on its future work programme. INSAG wasactive in reviewing data and analyses presented at thePost-Accident Review Meeting convened in Vienna in1986 in response to the Chernobyl accident.

The Agency also offers Radiation ProtectionAdvisory Team (RAPAT) missions, to help non-nuclearpower States develop their radiation protection capabili-ties; training is expanding in this field.

Where is the emphasis today?

The emphasis today in nuclear safety efforts isswitching from establishment of standards and qualityassurance to accident prevention through improvedoperational safety and accident mitigation. Accidentmitigation has three aspects: accident management,containment integrity, and emergency preparedness.

Moreover, the establishment of monitoring networks,the setting of intervention levels, (which demonstrate atthe national level that the public can be efficiently pro-tected against the consequences of severe accidents) willhave to be included in multinational and multi-agency endeavours.

Finally, from the beginning, the safety priority hasalways been the prevention of accidents, particularlysevere accidents. It is proper to be prepared to faceaccidents, should they happen, and we should remainconvinced that these accidents can be avoided if we takeinto account the lessons learned from more than 30 yearsof nuclear safety development.

IAEA BULLETIN, 2/1988 57