UK Framework for Nuclear Safety: Safety Goals and Targets

Transcription

1 UK Framework for Nuclear Safety: Safety Goals and Targets Nigel Buttery EDF Energy Geoff Vaughan UCLAN 1

2 Outline UK legal framework Reasonable Practicability Use of TECDOC Safety Goal Framework Top-Level Goal Upper Level Goals Intermediate Level Goals Low Level Safety Goals Conclusions 2

3 Basis for UK Regulation Nuclear Safety Regulation follows same principles as other Health and Safety Law Originally specific controls were introduced industry by industry Unified in the Health and Safety at Work etc Act (HSW Act) No site can be used for installing or operating a nuclear installation unless a licence is issued by ONR: Nuclear Installations Act 1965 Single Licence covering entire lifecycle Not time limited but subject to periodic review Site Licence Conditions provide the means of regulatory control 3

4 HSW Act Requirements Employer is responsible for safety In particular it is their duty to: to ensure, so far as is reasonably practicable, the health, safety and welfare at work of all his employees. to conduct his undertaking in such a way as to ensure, so far as is reasonably practicable, that persons not in his employment who may be affected thereby are not thereby exposed to risks to their health or safety. HSW Act also puts responsibility on importers, manufacturers and designers to ensure safety of users of their equipment SFAIRP SFAIRP - so far as is reasonably practicable and ALARP as low as is reasonably practicable form the legal basis in UK ALARP and ALARA are based on the same concept but ALARP is used in the UK as a legal definition has been established. 4

5 Reasonable Practicability The term has a long history in the UK First reference to the term in Farm machinery prevention of accidents Threshing Machines Act Require so far as is reasonably practicable to keep the flywheel and blades sufficiently and securely fenced Current definition based on Judgement in UK Court of Appeal in 1949 The Judge said: it was necessary to compare the sacrifice in terms of money, time and trouble of implementing further safety measures to reduce risks with the risks that have been averted. If the comparison showed that it would be grossly disproportionate to implement the measures, then they did not need to be implemented. It was also stated that the higher the risk, the less important the cost should be. grossly disproportionate not legally defined but generally taken to be: Factor of between 2 and 10 for the public, depending on the risk Factor of 3 for workers risk defined in a later legal judgement as the possibility of danger 5

6 Implementation of framework Principle 1 of the Fundamental Safety Principles states: The prime responsibility for safety must rest with the person or organization responsible for facilities and activities that give rise to radiation risks. Regulator sets high level goals Safety Assessment Principles (and Technical Assessment Guides) provide guidance to assessors Controls via the Site Licence (36 standard conditions) Operator proposes means of achieving these goals Proposes arrangements to comply with site licence conditions Proposes design safety standards (not specified by regulations) Top Level requirements are common but the form of the lower level requirements reflects different responsibilities of the operator and regulator 6

7 Regulatory Pyramid Summary HSW ACT (Passed by parliament) NUCLEAR INSTALLATIONS ACT (Passed by parliament) SITE LICENCE AND LICENCE CONDITIONS (Prepared by ONR- compliance mandatory) ARRANGEMENTS MADE UNDER LICENCE CONDITIONS (Prepared by Licensee compliance mandatory) Integrated Inspection Plans. Safety Assessment Principles and Technical Assessment Guides (ONR and Licensee) 7

8 Top Level Goal To demonstrate that it is not reasonably practicable to do more to prevent harm to people (HSW Act and NIA65) What does this mean in terms of risk to people? what is a tolerable risk and what is an acceptable risk? HSE asked to set this down for Parliament and the Public: Tolerability of Risk from Nuclear Power Plants (ToR) Reducing Risk Protecting People (R2P2) Based on data on accidents and natural events to identify the tolerable and broadly acceptable levels of individual risk of death 10-4 /yr tolerable (most occupations or car driving) 10-6 /yr broadly acceptable (lightning strikes or influenza) Societal risk data less information but recommendations based on industrial hazards and case made for the Thames barrier R2P2 set tolerable level of <2x10-4 /yr for an accident causing >50 deaths Values are for guidance; they are not legal limits 8

9 Upper Level Safety Goals Relevant good practices should be used wherever possible Nuclear Site Licence Conditions require operator to put in place arrangements to ensure safety Operators have set down their own framework for meeting the top level goal Regulator sets down assessment framework Had common starting point: Fundamental safety principle set down by ICRP No person shall receive doses of radiation in excess of the statutory dose limits as a result of normal operation. The exposure of any person to radiation shall be kept as low as reasonably practicable (ALARP). The collective effective dose to operators and to the general public as a result of operation of the nuclear installation shall be kept as low as reasonably practicable. All reasonably practicable steps shall be taken to prevent accidents. All reasonably practicable steps shall be taken to minimise the radiological consequences of any accident. 9

10 Intermediate Level safety Goals ONR has produced Safety Assessment Principles to assist staff in applying consistent judgement on licensee s ALARP case Mainly qualitative but with semi-quantitative expectations Overall numerical targets provided (BSOs and BSLs) Cover normal operation and design basis doses and risk levels Some legal dose limits included as BSLs but mostly targets Basis for derivation of targets has been published 10

11 Intermediate Level safety Goals (2) Licence condition requires licensee to produce arrangements for the production and assessment of safety cases As part of this defines standards against which it judges the acceptability of plant being designed/procured Based on common approach for all reactor types in terms of: Fundamental Criteria Engineering Criteria Fault and Hazard Assessment Targets Embodies principles of: Prevention and Mitigation Targets mainly based on doses to workers and public Underpinned by an assumption that an incremental risk of death of 10-6 /yr was acceptable Targets intended to be challenging 11

12 12

13 Low Level Safety Goals Intermediate level safety goals dose targets harmonised following the Sizewell B Public Inquiry (Technology Neutral) Licensee defines lower level technology specific targets e.g. Core damage frequency for reactors Accidental criticality limits for fuel processing plants Within EDF Energy assessment criteria have been defined for: Existing AGRs and PWR New nuclear plant (based on EUR) The same top level goals apply Paper gives examples of how the lower level targets for PWRs were derived 13

14 Derivation of design targets High level targets need to be turned into practical engineering criteria Design is carried out against engineering criteria but overall results can be assessed against risk criteria Need targets for safety function reliabilities systems reliabilities/diversity requirements Objective is to achieve a balanced design in terms of risk No sore thumbs No cliff edges immediately beyond the design basis Minimise off-site consequences Avoid need for countermeasures for design basis faults Note: UK definition of design basis faults based on sequences not just PIEs 14

15 System and function reliabilities Total Probability of exceeding Design Basis (DB) should be < 10-6 For an individual fault group Probability of exceeding DB < 10-7 Redundancy increases reliability Minimum redundancy set by use of deterministic rules e.g. Single failure Hazard assumptions Maintenance at power But must allow for common cause failure Limit reliability claim on redundant systems ( ) For frequent faults to achieve 10-7 requires diversity Design basis covers sequences with frequencies ~>10-7 Includes some design extension conditions (multiple failures) 15

16 Core Damage Frequency targets Not a fundamental risk target but a useful design/analysis target Core damage usually associated with exceeding the secondary fuel limits 1204C One of a number of design basis limits If CDF limit same as not exceeding design basis results shown to be very conservative CDF target for new plants 10-5 /yr ( BSO ) CDF target for older plants 10-4 /yr ( BSL ) 16

17 Societal Risk Targets Societal risk control crucial Achieved by: designing plant so offsite counter measures are either unnecessary or limited for design basis faults Setting targets for limiting societal impacts Level 3 PSA used to look at range of impacts as well as health effects e.g. Evacuation Relocation Agricultural restrictions Economic impact Based on this a criterion was defined expressed in terms of the frequency of exceeding 100 fatal cancers Not broken down into more detailed design goals but is used as part of the overall assessment of the design to ensure all reasonably practicable measures have been taken to reduce the risk 17

18 Conclusions UK Safety Goals can be fitted within the suggested hierarchical frame work Many are inter-related (derived from same upper level goal) but Others will be related to different upper level goals Provides a means of reviewing consistency and completeness of more detailed requirements Emphasising the fundamental safety objective being pursued 18

19 TOP LEVEL - PRIMARY SAFETY GOAL: To protect people and the environment from harmful effects of ionizing radiation UPPER LEVEL SAFETY GOALS: Ensuring adequate protection in all operational modes of all facilities and installations at the site Operational states Accident conditions O1 To protect workers, the public and the environment O2 To provide design feature s for security O3 To minimize radioactiv e waste O4 To provide design feature s to facilitat e decom missioning A1 Risk to life and health of people from the facilities and installations located at the site should be low comparing with risk from other sources to which an individual is generally exposed A2 Large off-site releases leading to land interdiction should be practically eliminated A3 Safetysecurity interface should be addressed A4 Emergency response should be provided INTERMEDIATE LEVEL SAFETY GOALS: Providing necessary safety provisions including technical and organizational measures based on proven approaches and good practices to ensure adequate protection Qualit ative O1-Q1 Manag ement, leader ship and safety culture Deterministic quantitative O1-D1 To meet ICRP criteria for workers by providing adequate radiation protection measures Qualitative A1-Q1 Maintaining effective defensein-depth Deterministic quantitative A1-D1 Maintaining allowed doses for workers in DBAs Probabilistic quantitative A1-P1 Overall L(E)RF for the site for all events and hazards Qualitative A2-Q1 Providing effective SAM design features and SAMG at the site level Probabilistic quantitative A2-P1 Probabilistic interpretatio n of practically eliminated A3-Q1 Vital area identification at the site level A4-Q1 Detailed emergency plan O1-D2 To meet ICRP criteria for discharges to the environment by providing adequate measures for controlling the discharges A1-Q2 Maintaining sufficient safety margins A1-D2 Maintaining allowed discharges to the environment in DBAs A1-P2 Frequencies of external hazards/ magnitudes for design of site protective features A2-P2 Food ban radioactivity levels and accepted frequency A4-D1 Food ban levels A1-Q3 Providing sufficient redundancy and diversity to comply with single failure criterion A1-D3 Containment withstanding the crash of a specified size aircraft A2-P3 Habitation radioactivity levels and accepted frequency A4-D2 Habitation radioactivity levels LOW LEVEL SAFETY GOALS: Providing necessary specific safety provisions for all facilities and installations at the site 19