Canadian Nuclear Safety Commission Commission canadienne de sûreté nucléaire The Evolution of System Safety in the Canadian Nuclear Industry System Safety Society, Eastern Canada Chapter, June 18, 2009 Philip Webster; Director, Darlington Regulatory Program nuclearsafety.gc.ca
Nuclear safety means protecting Canadians Canadian Nuclear Safety Commission (CNSC) Canada s nuclear watchdog Quasi-judicial body Independent of, but not isolated from, government Regulates the use of nuclear energy and materials to protect the health, safety and security of persons and the environment; and to respect Canada s international commitments on the peaceful use of nuclear energy System Safety Society, Eastern Canada Chapter, June 18, 2009-2
Nuclear regulation CNSC regulates all nuclear facilities and activities in Canada, including: Nuclear power plants Uranium mines & mills Uranium fuel fabrication and processing Nuclear substance processing Industrial and medical applications of nuclear substances, such as nuclear medicine and cancer treatment centers Research and educational facilities Import/export of nuclear and dual-use substances, equipment and technology Waste management facilities is a federal responsibility System Safety Society, Eastern Canada Chapter, June 18, 2009-3
Darlington NGS-A System Safety Society, Eastern Canada Chapter, June 18, 2009-4
Summary Initially little recognition of need for safety systems Need for safety systems to be independent Increasing complexity of safety systems Multiplicity, availability, testability Contribution of support systems to safety Increasing analysis Probabilistic risk assessments Management systems approach Modern standards for design, analysis Licensees vs. Regulator System Safety Society, Eastern Canada Chapter, June 18, 2009-5
NRX Reactor - 1952 Reactor started operation at CRNL in 1947 Produced Pu, other isotopes, fuel testing, research Maintaining operation was important Combined control/shutdown rods Manual procedures to withdraw them Errors made during startup Major power excursion, fuel melting Lessons learned: Indicated need for fast shutdown capacity Independent of any control system System Safety Society, Eastern Canada Chapter, June 18, 2009-6
Reactor Safety Criteria - 1964 Process equipment Equipment and systems for normal operation Protective devices Prevent fuel damage from failure in process equipment Containment provisions Limit or restrict release of radioactivity Structurally and operationally independent Rate of cross-linked faults less than rate of coincident independent faults System Safety Society, Eastern Canada Chapter, June 18, 2009-7
Application of Reactor Safety Criteria Frequency of process failures < 1 in 3 years Unreliability of protective devices < 0.003 Unreliability of containment < 0.003 Safety systems to be physically and functionally independent from process systems and each other Safety systems must be testable to verify Exclusion zone System Safety Society, Eastern Canada Chapter, June 18, 2009-8
Two shutdown systems - 1977 Regulatory Document R-10 New reactors to have two shutdown systems Independent, diverse Physically and functionally separate All serious process failures can be handled by either one Failure to shutdown is beyond design basis Unavailability of each < 1E-3 per year Testable, fail-safe Two diverse trip parameters for each SPF System Safety Society, Eastern Canada Chapter, June 18, 2009-9
General Safety Requirements - 1982 Dose limits: normal operation & accidents Five dose classes defined Individual dose/sum of probabilities Safety requirements for siting, design, safety analysis, construction, commissioning, operation, effluent and waste management, decommissioning. ALARA System Safety Society, Eastern Canada Chapter, June 18, 2009-10
Grouping and Separation Group I SDS 1 ECCS Group II SDS 2 Containment Important process and SSS are triplicated Permits testing without making unavailable, or inadvertently triggering 2oo3 logic Two control rooms System Safety Society, Eastern Canada Chapter, June 18, 2009-11
Probabilistic Safety Assesments Validate for completeness the list of design basis accidents i.e. those identified for analysis Assist confirmation of accident sequence classification Identify dominant failure sequences Demonstrate cumulative frequencies of accidents are less than targets System Safety Society, Eastern Canada Chapter, June 18, 2009-12
P - Event Tree Example Multiple Tube Rupture in Any RCW-HX Reactor Shutdown by RRS SDS1/SDS2 Pressure and Inventory Control System Available Trip of PHT Pumps on Low PHT Pressure PHT Loops Isolate at 5.52 MPa(g) PHT Crash Cooldown Manually Operated ECC Initiated by Operator. HP and MP Only are Available. Main or Aux. Feedwater System Moderator Acts as Heat Sink LOCA2-4 RT15 PIC1S HTT LI CCD-M ECCHMD-M FW2L MHS6 # END-STATE-NAMES SEQUENCE-NAMES 1 OK LOCA2-4-001 2 PDS9 LOCA2-4-002 3 NDF LOCA2-4-003 4 NDF LOCA2-4-004 5 NDF LOCA2-4-005 6 PDS3 LOCA2-4-006 7 PDS2 LOCA2-4-007 8 PDS3 LOCA2-4-008 9 PDS2 LOCA2-4-009 10 PDS0 LOCA2-4-010 System Safety Society, Eastern Canada Chapter, June 18, 2009-13 LOCA2-4 - 2008/02/25 Page 46
P Fault Tree Example REACTOR FAILS TO TRIP AFTER MULTIPLE TUBE RUPTURE IN RCW HX RT15 3 OF 28 SORs NOT DROPPED FROM FULLY OUT POSITION WHEN SIGNALED (RT15) SDS2 FAILURE INSUFFICIENT POISON INJECTION (RT15) SDS1_RT15 SDS2_RT15 1 KNOWN AND 2 RANDOM SOR FAILURES (RT15) 2 KNOWN AND 1 RANDOM SOR FAILURES (RT15) 3 RANDOM SOR FAILURES (RT15) 2 OR MORE OF 6 LIQUID INJECTION UNITS FAIL TO INJECT WHEN He HEADER PRESSURIZED POISON TANKS NOT PRESSURIZED WHEN REQUIRED (RT15) 2475 6989 1KNOWN_2RND_RT15 2KNOWN_1RND_RT15 3RAND_RT15 GAD_INJ_COMP POISON_TK_P_RT15 1 KNOWN SOR FAILURE 2 RANDOM SOR FAILURES (RT15) 1 RANDOM SOR FAILURE (RT15) 2 KNOWN SOR FAILURES 1 TEST RELATED AND 2 RANDOM SOR FAILURES (RT15) 3 RANDOM SOR FAILURES (RT15) 6.210E-2 M>1ASSEMBLYM 2RAND_RT15 1RAND_RT15 2KNOWN 1TEST_2RAND_RT15 3RND_SORS_F_RT15 1 TEST RELATED SOR FAILURE AND 1 RANDOM SOR FAILURE (RT15) 2 RANDOM SOR FAILURES (RT15) 1 RANDOM SOR MECHANISM OR SIGNAL FAILURE IN BANK 1 (RT15) 1 RANDOM SOR MECHANISM OR SIGNAL FAILURE IN BANK 2 (RT15) 1 KNOWN SOR FAILURE ADDITIONAL SOR FAILURE REQUIRING SHUTDOWN 2 RANDOM SOR FAILURES (RT15) 1 SOR IN-CORE FOR TEST OR FAILS TO WITHDRAW FOLLOWING TEST 1 RANDOM SOR MECHANISM OR SIG FAILURE IN BANK 1 AND 2 IN BANK 2 (RT15) 2 SOR MECHANISMS OR SIGNAL FAILURES IN BANK 1 & 1 IN BANK 2 (RT15) 3 RANDOM SOR MECHANISM OR SIGNAL FAILURES IN BANK 1 (RT15) 3 RANDOM SOR MECHANISM OR SIGNAL FAILURES IN BANK 2 (RT15) 6982 6983 6980 6981 6.210E-2 1.050E-3 6984 6793 6985 6986 6987 6988 1TEST_1RAND_RT15 2RND_SORS_F_RT15 1RAND_B1_RT15 1RAND_B2_RT15 M>1ASSEMBLYM M>ASSEMBLY_8M 2_RND_NTEST_RT15 TEST_OR_FW B1_1&B2_2_RND_15 B1_2&B2_1_RND_15 B1_3_FL_RND_RT15 B2_3_FL_RND_RT15 System Safety Society, Eastern Canada Chapter, June 18, 2009-14
Defence-in-Depth NS-R-1-2000 1. Prevent deviations from normal operation & system failures 2. Intercept deviations to prevent AOOs escalating to accidents 3. Provide engineered safety features to control, cool and contain accidents 4. Mitigate consequences of severe accidents to prevent off-site release 5. Mitigate off-site radiological consequences System Safety Society, Eastern Canada Chapter, June 18, 2009-15
Implementation of D-i-D 1. Conservative design, documented procedures, well-trained operators 2. Inherently safe response and reliable control systems 3. Safety systems to give high confidence that credible accidents are controlled 4. Mitigation of core damage and containment of radioactivity to minimise releases 5. Emergency measures to protect public in the event of a significant release System Safety Society, Eastern Canada Chapter, June 18, 2009-16
Management Systems - 2005 C-N286-05 Management System Requirements for Nuclear Power Plants Replaces N286.0 to.7 (1986-2000) Quality Assurance for Nuclear Power Plants Same management requirements apply to each phase of plant life (siting to abandon) Activities for one phase may occur during another phase System Safety Society, Eastern Canada Chapter, June 18, 2009-17
Refurbishments Late-2000s Pickering A, Bruce A, Point Lepreau Integrated Safety Review performed Comparison of plant, programs, etc against modern safety goals, meets current standards and regulatory requirements for safe and secure long-term operation. Pickering B decision imminent Darlington, Bruce B, Gentilly-2 likely soon System Safety Society, Eastern Canada Chapter, June 18, 2009-18
New NPP Build - 2009 Environmental Assessment needed Before any licensing Covers full life cycle of station Site Evaluation: RD-310 Modern Design: RD-337 Applies to new reactors Will apply in phased manner to existing Safety Analysis: RD-310 System Safety Society, Eastern Canada Chapter, June 18, 2009-19
Safety Areas and Program Areas Comprehensive assessment of performance of all processes, programs, systems, etc relevant to safety Developed from IAEA Darlington overall Fully Satisfactory Annual NPP Performance Report http://www.nuclearsafety.gc.ca/eng/readingro om/reports/powerindustry/2008/index.cfm System Safety Society, Eastern Canada Chapter, June 18, 2009-20
Darlington Compliance and Safety Performance in 2008 Safety Area Operating Performance Performance Assurance Design and Analysis Equipment Fitness for Service Emergency Preparedness Environmental Protection Radiation Protection Safeguards Rating System Safety Society, Eastern Canada Chapter, June 18, 2009-21
Darlington Performance Program Rating Compliance and Safety Performance in 2008 Safety Area Operating Performance Organization and Plant Management Operations Occupational Health and Safety (non-radiological) Performance Assurance Quality Management Human Factors Training, Examination and Certification Design and Analysis Safety Analysis Safety Issues Design Equipment Fitness for Service Maintenance Structural Integrity Reliability Equipment Qualification Emergency Preparedness Environmental Protection Radiation Protection Security Safeguards BE Prescribed System Safety Society, Eastern Canada Chapter, June 18, 2009-22
Summary Moved from equipment to humans to management systems Full life-cycle considered for new NPPs Five levels of Defence-in-Depth Safety principles of separation, independence, redundancy, diversity Prevention of process system failures is fundamental System Safety Society, Eastern Canada Chapter, June 18, 2009-23
Canadian Nuclear Safety Commission Commission canadienne de sûreté nucléaire Canadian Nuclear Safety Commission nuclearsafety.gc.ca Canada
Barriers to Fission Produce Release Fuel matrix Welded sheath cladding Primary circuit pressure boundary Containment Exclusion zone, evacuation System Safety Society, Eastern Canada Chapter, June 18, 2009-25