R1-R4 ENSREG Stress Test - Summary · Dokumentstatus Alt dokument ID 1 Alt dokument ID 2 Dokument ID / Version Frisläppt Externa händelser 2158963 / 2.0 Hemlig 8 (52) 1 INTRODUCTION

Ringhals AB

Dokumenttyp Dokumentstatus Statusdatum Dokument-ID/Version

Rapport-projekt Frisläppt 2011-10-27 2158963 / 2.0Intern dokumentägare Sekretessklass Gäller t o m Alt. dokument-ID 1

PRRT Hemlig Externa händelserPSG / FSG enl dok.nr Ersätter Alt. dokument-ID 2

Handläggare Granskat av Godkänt avEklöw Kajsa PRRTASFrisläppt av

Myhrberg Björn PRRTAS Jerregård Anders PRR1DEckegren Lennart PRRTFGranhäll Tord PRR2T Lövefors Daun Annette PRRQ

R1-R4 ENSREG Stress Test - Summary

Delgivning och distributionDelgivning för åtgärd: Delgivning för kännedom: Referensgrupp, Hans Länsisyrjä RQS, interngranskare, remissgranskare,

projektmedlemmar, cRTAS, cRQDistribution: 1 (52)

SUMMARY

An assessment of the site has been made at situations beyond the design bases of the units. The assessment has been performed in accordance with the ENSREG stress test specification. The stress test is focused on the areas:

- Earthquake, where the stressing is made by applying an earthquake with ground acceleration about four times beyond the design value (the 10-7

earthquake vs. 10-5 earthquake).

- Flooding, where the stressing is made by applying sea-rise levels beyond design. The design basis sea-rise level is 2,65 m. The plant robustness is evaluated by applying sea-rise levels of 3, 3,3 and 4 m.

- Loss of offsite power and station blackout. In this case the stressing is performed by applying a gradually increased of loss of power, ending up with only battery power as the available source.

- Loss of ultimate heat sink, where the stressing is made by applying gradually decreasing availability of seawater, ending up with no seawater at all available.

- Accident management, where the stressing is made by imposing potential obstacles for the accident management processes such as infrastructure destruction, unavailable facilities, loss of power, habitability issues etc.

In all cases, the very beneficial impact of the containment filtered vent feature is observed.

In the earthquake case, the engineering judgement is that the units will be able to withstand the design basis earthquake (DBE). Safe shutdown is judged to be feasible. The spent fuel cooling systems are not seismically qualified. At beyond design bases condition for the stress test, the applied case is an earthquake corresponding to an exceedance frequency of 10-7 per

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig

Dokumentstatus Alt dokument ID 1 Alt dokument ID 2 Dokument ID / Version

Frisläppt Externa händelser 2158963 / 2.0

Hemlig 2 (52)

site and year. At this condition, the containments, the containment filtered vents, the fuel buildings and the fuel pools and the severe accident mitigation systems are judged to be able to perform their release preventing functions. As mentioned above, the spent fuel cooling systems are not seismically qualified.

In the flooding case, the assessment concludes that for the design basis flooding, a sea level rise of 2,65 m, no fuel damage will occur. Beyond design basis, flooding of the units may occur with the potential of causing fuel damage by elimination of safety functions and spent fuel cooling equipment. Robustness exists up to the ground level, which is 3 m above sea level. At a sea-level rise of 4 m fuel damages are judged to be possible. Addressing the question of an appropriate sea-level rise is required before relevant measures can be taken.

In the “Loss of offsite power and station blackout” case, the assessment concludes that the limiting case is when only battery power is available. Robustness exists as long as anyone of the ordinary backup power sources (diesel generators or gas turbines) or the steam driven auxiliary feedwater systems are available. Postulating power system recovery times beyond design, exhaustion of batteries, depletion of the water sources for the steam driven systems and operation at low RCS inventory conditions will cause fuel damage. The containment filtered vent feature will contribute in keeping the releases within allowable limits. The loss of power will also cause a loss of the spent fuel cooling.Addressing the adequacy of the current battery capacities and the availability of the backup power sources is required before relevant measures can be taken.

In the case of loss of ultimate heat sink, the assessment concludes that robustness exists for several days in all cases, with the exception of operation at low RCS inventory conditions at the PWR’s. Addressing the operation at low RCS inventory conditions coincident with loss of UHS is required before relevant measures can be taken.

Regarding accident management, the assessment concludes robustness for events within design. The beneficial impact of the containment filtered vent is emphasised. When applying the Fukushima scenario as described in the stress test specification, a number of shortcomings are displayed. The emergency response organization can not handle four units simultaneously affected, the two existing mobile pump/generator units may not be enough, loss of cooling of the spent fuel pools can not be managed etc. Addressing the appropriate scenario to be applied is required before relevant measures can be taken.

The evaluation of the Ringhals site in the light of the Fukushima accident and in accordance with the ENSREG stress test specification has revealed a number of areas subject to improvement:

- The spent fuel pool cooling abilities needs to be further evaluated/reinforced

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 3 (52)

- The properties of the emergency response organization needs to be reconsidered

- The flooding scenario needs to be reconsidered

- The requirement for battery capacity is generally an area to analyze further.

- The adequacy of the present water supplies needs to be reconsidered.

The resulting potential plant improvements within each area are indicated in the referenced detailed evaluations, and summarized in this report. Before implementation of the indicated improvements is initiated, further in depth consideration is required to assure the correctness and suitability and that no jeopardizing of other plant properties will be caused.

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 4 (52)

R E V I D E R I N G S F Ö R T E C K N I N G

VersionNr.

Revideradesidor

Orsak Handläggare/Frisläppt av

2.0 Första utgåvan B Myhrberg/A Lövefors

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 5 (52)

INNEHÅLLSFÖRTECKNING

1 INTRODUCTION ........................................................................................81.1 Stress test background information........................................................81.2 Evaluation method of plant robustness ..................................................81.3 Previous reporting during the process ...................................................91.4 Other assessments of the incident..........................................................91.5 Scope of the stress test............................................................................92 SITE DESCRIPTION ................................................................................102.1 The site ....................................................................................................102.1.1 Hydrological characteristics ......................................................................102.1.2 Seismological characteristics ....................................................................112.1.3 Exposure to air transportation events........................................................11

2.2 Applicability of the ENREG accessibility limitations of 24 hours respectively 72 hours .............................................................................11

2.3 Basic design of the plants......................................................................132.3.1 Ringhals 1 characteristics .........................................................................142.3.2 Ringhals 2 characteristics .........................................................................142.3.3 Ringhals 3 characteristics .........................................................................142.3.4 Ringhals 4 characteristics .........................................................................14

2.4 Safety significant differences ................................................................142.5 Defence in depth principle .....................................................................162.6 The containment filtered vent feature ...................................................202.7 Performed safety enhancements...........................................................232.8 Routine safety enhancement work ........................................................242.9 Scope and results of PSA ......................................................................242.9.1 Scope .......................................................................................................242.9.2 Ringhals 1.................................................................................................242.9.3 Ringhals 2.................................................................................................262.9.4 Ringhals 3.................................................................................................272.9.5 Ringhals 4.................................................................................................29

3 STRESSTEST RESULTS.........................................................................303.1 Earthquake ..............................................................................................303.2 Flooding ..................................................................................................323.3 Loss of offsite power (LOOP) and station blackout (SBO) ..................343.4 Loss of ultimate heat sink without/with SBO........................................413.4.1 Loss of ultimate heat sink without SBO.....................................................413.4.2 Loss of ultimate heat sink with SBO..........................................................44

3.5 Accident management............................................................................444 SUMMARY ASSESSMENT......................................................................48

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 6 (52)

5 AREAS SUBJECT TO IMPROVEMENTS ................................................506 REFERENCES .........................................................................................51

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 7 (52)

LIST OF ABBREVIATIONS

DBE Design Bases Earthquake

CFV Containment Filtered Vent

RCS Reactor Coolant System

PWR Pressurized Water Reactor

BWR Boiling Water Reactor

ENSREG European Nuclear Safety Regulators

SAR Safety Analysis Report

TMI Three Mile Island

WANO World Association of Nuclear Operators

SOER Significant Operating Experience Report

LOOP Loss of Offsite Power

OPS Original Plant Section (Ringhals unit 1)

DPS Diversified Plant Section (Ringhals unit 1)

SBO Station Blackout

UHS Ultimate Heat Sink

ICS Independent Containment Spray

PGA Peak Ground Acceleration

CRDM Control Rod Drive Mechanism

DBF Design Bases Flooding

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 8 (52)

1 INTRODUCTION

1.1 Stress test background information

On the 25th of March 2011, the European Council of Ministers declared that the safety of all EU nuclear plants should be reviewed on the basis of comprehensive and transparent risk and safety assessments (“stress tests”) as a consequence of the Fukushima accident. The organization ENSREG (European Nuclear Safety Regulators Group), which is an expert body, composed of senior officials from national regulatory or nuclear safety authorities from all 27 member states in the EU, has thereafter agreed on the criteria for how the stress tests should be performed.The report at hand is a summary of Ringhals AB’s answer to the Swedish Radiation Safety Authority’s injunction ”Förnyade säkerhetsvärderingar av tålighet mot vissa händelser” [7], which states that Ringhals AB must perform the ENSREG stress test for all its units. The stress test specification is found in Appendix 2 in [7].

1.2 Evaluation method of plant robustness

Nuclear power plants are designed with large safety margins. The safety margins are related to a number of postulated events, such as pipe breaks in the primary system, steam line break, flooding, wind etc. The plants are designed to withstand these postulated conditions with satisfactory margins.

At the stress test according to ENSREG, the plant properties at conditions beyond the postulated design conditions are evaluated. This will result in an evaluation of to what extent the plant can withstand conditions beyond design without fuel damage occurring.

The stress test principle is that the plant safety functions gradually are assumed to fail, regardless of redundancy properties. This will finally display a level of degradation where fuel damage is unavoidable.

The stress test specification frequently addresses the point at which “fuel damage is unavoidable”. In the evaluations this point generally is when the core exit thermocouples indicate 650C (PWR) or the water level has decreased to the top of the core (BWR). In some cases, emptying of water sources is applied as criteria, however somewhat conservative. Concerning fuel pool discussions, the point is applied as the point when the water level has decreased to the top of the fuel assemblies.

The base for the evaluation is the current unit analyses in the SAR’s, supplemented by descriptive discussions and engineering judgements where we are beyond the scope of the SAR.

The stress test according to the ENSREG specification has an endpoint when fuel damage is unavoidable. However, the Swedish plants are designed to cope with a scenario even after severe fuel damage and vessel melt-through

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 9 (52)

has occurred. This scenario, the containment filtered vent scenario, was introduced at the Swedish plants in 1988 in accordance with government decision 11, 1986 [27]. The purpose of this government decision, derived from the TMI accident, was among others to prevent a ground deposition at severe accidents that in the long term will prevent the utilization of extensive land areas. The containment filtered vent feature is described in section 2.6.

1.3 Previous reporting during the process

The evaluation of the units according to the ENSREG stress test specification was initiated by the regulator SSM via the injunction 2011/2065, ”Förnyade säkerhetsvärderingar av tålighet mot vissa händelser ” [7].

The prerequisites for the stress test was reported by Ringhals AB in 2011-06-08 [8], additional prerequisites were reported 2011-07-12 [9]. The prerequisites were reviewed by SSM in a review report 2011-07-29 [10].

The progress of the work was reported to SSM in 2011-08-15 [11], contributing to the national progress report submitted to the EU in 2011-09-15.

1.4 Other assessments of the incident

Shortly after the accident, the regulator SSM emphasized the importance of initiating plant specific evaluations, aimed at identifying potential reinforcements [12]. A dedicated project was established within the Ringhals site organization [13]. This project was later adapted to the requirements of the regulatory injunction [7].

The WANO SOER’s 2011-2 and 2011-3 are addressed within the siteorganization.

WANO SOER 2011-2, Fukushima Daiichi Nuclear station fuel damage caused by earthquake and tsunami, was addressed and reported [30].

WANO SOER 2011-3, Fukushima Daiichi Nuclear station spent fuel pool/pond loss of cooling and makeup, is being addressed at the moment.

1.5 Scope of the stress test

The extent of the stress test according to the ENSREG specification results in an evaluation of the plant in the following perspectives:

- The earthquake perspective, meaning that an evaluation is performed by applying an earthquake more severe than the design earthquake. The plant possibilities to fulfil the release preventing functions at theses conditions are evaluated.

- The flooding perspective, meaning that an evaluation is performed of the magnitude of a flooding the plant can withstand before fuel damage is unavoidable.

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 10 (52)

- The loss of power perspective, meaning that an evaluation is performed of the plant long term properties during a gradual loss of power sources until only battery power remains. The available range of time until fuel damage is unavoidable is evaluated.

- The ultimate heat sink perspective, meaning that an evaluation is performed of the plant long term properties during a gradual loss of sea water for plant cooling. The available range of time until fuel damage is unavoidable is evaluated.

- The accident management perspective, meaning that an evaluation is performed of the adequacy of the accident management procedures, and of the emergency response organization.

A common feature of the evaluations is that potential cliff-edge effects are identified. Cliff-edge effects may be e.g. exhaustion of batteries, lack of diesel fuel, emptied water supplies etc. A cliff edge effect causes the sequence of events to change in a significant way, and based on this, areas subject to improvements, further evaluations or reinforcements can be identified.

The stress test specification frequently addresses the point at which “fuel damage is unavoidable”. In the evaluations this point is defined as when the core exit thermocouples indicate 650C (PWR) or the water level has decreased to the top of the core (BWR). Concerning fuel pool discussions, the point is defined as the point when the water level has decreased to the top of the fuel elements.

2 SITE DESCRIPTION

2.1 The site

The Ringhals plant is situated along the west coast of Sweden on the Värö peninsula within the Varberg municipality in the province of Halland. Contiguous cities are Varberg 25 km south of and Gothenburg 60 km north of Ringhals.

The site has four units, one BWR and three PWR’s. The site is operated by Ringhals AB, who is the license holder.

2.1.1 Hydrological characteristics

The site is situated by the sea, and is consequently exposed to events originating from the sea. In the vicinity of the site, there are no dams or rivers constituting potential sources of flooding. The single source of flooding with the potential to cause a sequence of events resulting in fuel damage is a sea-level rise.

The assumed highest flooding level is a sea level rise of 2,65 m [3].

Tsunami

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 11 (52)

A tsunami is created by seismic events or underwater landslides.

During an underwater earthquake a large amount of energy is added to the water. Since these events often occurs in the Pacific at large depths, the energy addition does not result in a significant level increase in the open sea. The result is a minor level increase of 0,5 – 1 m moving at large velocity away from the area. The energy is transmitted as a long wave, at the velocity

C = (g * h)1/2,

Where the depth h often is of the magnitude 4000m. This results in a wave velocity of » 200 m/s (700 km/h). When reaching the shore the wave will be retarded by the decreasing depth, resulting in an increasing height.

In the seas surrounding Sweden no tsunami has been registered. Even if tsunami initiating events should occur, the impact would be small since the depth of the surrounding sea is limited. The average depth in the Baltic is 60 m and is assumed to be similar in the Kattegatt, resulting in a wave velocity of 25 m/s. This concludes that the waves will not generate any larger waves with the potential to cause any major damage [18].

Tide

Water level variations due to tide are usually insignificant, but may add up to an extra 30 cm to the water level variations due to atmospheric pressure and wind load [18].

2.1.2 Seismological characteristics

In Scandinavia seismic activity is generally low. The region is generally considered as being seismically stable. Only a few incidents have been registered in historic time, which might have damaged an industrial plant of today. The risk of a nuclear accident in Sweden, caused by an Earthquake, may thus be considered to be low. The bedrock conditions at the site are further discussed in [20]

The design basis earthquake is an earthquake with the occurrence frequency of 10-5/year [21].

2.1.3 Exposure to air transportation events

The probability of an airplane incident in the vicinity of the Ringhals site is estimated to be very low, 2E-8 [22]. The air transportation is further discussed in [29].

2.2 Applicability of the ENREG accessibility limitations of 24 hours respectively 72 hours

In the ENSREG document a footnote states that:

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 12 (52)

“All offsite electric power supply to the site is lost. The offsite power should be assumed to be lost for several days. The site is isolated from delivery ofheavy material for 72 hours by road, rail or waterways. Portable light equipment can arrive to the site from other locations after the first 24 hours.”

Application of the stated timeframes of 24 respectively 72 hours requires is required to be further motivated.

Within the site, it has to be credible that the generated amount of debris in the plant yard can be handled in such a way that transportation activities are possible.

In order to credit portable light equipment after the first 24 hours, access to the site area has to be made credible, i.e snow obstacles and other obstacles should be made credible to be removed. Further, the assessed light equipment, has to be available within transportation range. Light equipment is assumed to be equipment transportable by off road vehicles or bandwagons.

In order to credit heavy material first 72 hours, access to the site area has to be made credible, i.e snow obstacles and other obstacles should be made credible to be removed. Further, the assessed heavy material, has to be available within transportation range. Heavy material is basically assumed to be equipment requiring truck transportation by road.

The site organisation capabilities regarding clearance of the site area in case of bad weather conditions or other events is managed by the on shift rescue team. At their disposal, the team has a fully equipped fire truck and an off road vehicle. At emergency situations, the site heavy vehicles such as front loaders and lifting trucks are also available. Based on the presence of the on shift rescue team and the available equipment, it is judged that the site area can be cleared for transportation purposes within 24 hours following bad weather conditions or other events.

The transportation possibilities by road at bad weather or other difficult situations are managed by Trafikverket (Department of Transportation) and its local subcontractors. The experiences from previous bad weather conditions is that the roads are cleared well within 24 hours. Should the situation reach a societal emergency level, the First Commander of Rescue Service disposes all of the resources of the society.

Based on the experience of historical bad weather situations, and the availability of the total society resources in emergency situations, it is reasonable to site specifically apply the timeframes of 24 hours respectively 72 hours as described in the footnote of the ENSREG document.

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 13 (52)

2.3 Basic design of the plants

The plants are designed to confine the radioactive material by physical barriers. There are dedicated systems intended to protect and maintain these barriers.

The barriers are the fuel pellet structure, the fuel cladding, the reactor coolant pressure boundary and the containment.

The protective functions included in the plant design in order to maintain the barrier integrity are characterized of design according to the single failure criterion, i.e. one single failure in the protective function does not jeopardize the purpose of the function.

The plants were originally designed with two main trains of safety functions. The supporting power system was divided into four sub trains, each one with a dedicated emergency diesel generator. Two sub trains are supporting each main train.

The two train design has during the years been reinforced. Additional reactor trip systems have been installed on all units. On Ringhals 1 an entire diverse plant section (DPS) has been installed in addition to the original plant section (OPS). Measures to strengthen the physical and functional separation of the trains have been taken.

The parallel trains may in some cases perform the intended functions by different methods such as steam driven and motor driven pumps, diversification.

The plant is designed to protect the barriers with automatically taken measures or by permitting reasonable time for consideration of manual actions. The latter is often called "Grace time" or "Time for reflection".

All units are equipped with steam driven systems to provide core cooling capabilities, either directly to the reactor vessel (BWR) or via the steam generators (PWR).

The power supply to the unit during normal operation consists of two alternative sources; the national 400 kV grid and the national 130 kV grid. At accident conditions, the power is supplied by four dedicated diesel generators and gas turbine plant common for the site. Ringhals 1 has in addition to this another two air cooled diesel generators installed within the diversified plant section. The unit is also equipped with house load operation feature, according to the national grid requirements. Furthermore, an additional full capacity mobile diesel generator is available at the site. The power supply to the filtered vent systems has independent battery capacity and a dedicated mobile generator set.

The spent fuel is stored in the spent fuel pools at the unit for an average time of one year, prior to transportation to the national spent fuel storage facility.

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 14 (52)

2.3.1 Ringhals 1 characteristics

Ringhals 1 is an ASEA-Atom design BWR with a rated thermal power of 2540 MW. The first criticality was achieved by august 20, 1973.


Ringhals 2 is a Westinghouse design three loop PWR with a rated thermal power of 2660 MW. The first criticality was achieved by June 19, 1974.


Ringhals 3 is a Westinghouse design three loop PWR with a rated thermal power of 3151 MW. The first criticality was achieved by July 29, 1980.


Ringhals 4 is a Westinghouse design three loop PWR with a rated thermal power of 2783 MW. The first criticality was achieved by May 19, 1982.

2.4 Safety significant differences

The safety significant properties and differences regarding the areas of the stress test scope (earthquake, flooding, LOOP/SBO, UHS, severe accident management) are discussed below.

All units are finalising programs to improve the safety of the plants as requested in regulations that have been implemented for that purpose (SSMFS 2008:17). These requirements encompass the ability of the units to cope with external events.

Earthquake

With regard to the safety properties during earthquake conditions, there are no significant structural differences between the units.

The four units at the site are exposed to the same seismic conditions. Originally, the units were not designed with seismic considerations since Sweden is a zone with low seismic activity.

The modern national regulations require seismic upgrading of the units, which is an ongoing work.

The BWR unit is divided into two parts regarding the safety features, OPS (Original Plant Section) and DPS (Diverse Plant Section), where the DPS is seismically qualified.

The I&C-system on Ringhals 2 was recently replaced and seismically qualified.

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 15 (52)

The essential safety feature with regard to radioactive releases, the filtered vent of the containments, was originally designed with seismic considerations.

Flooding

With regard to the safety properties at flooding conditions, there are no significant differences between the units.

The four units are erected at the same ground level, 3 meters above sea level, and are consequently equally exposed to flooding. Other potential flooding sources such as dams or rivers do not exist in the vicinity of the site.

Loss of offsite power/Station blackout (LOOP/SBO)

With regard to the safety properties at LOOP/SBO conditions, there are differences between the units.

All units are equipped with four diesel generators, supplying redundant equipment. The durability of the diesel generators is further discussed in the LOOP section of the report.

Ringhals 1 is further equipped with two additional diesel generators, supplying the DPS. (At Ringhals 1, a physically and functionally separated and diversified reactor protection system called DPS (Diversified Plant Section) has been installed. The DPS works in parallel with the Original Plant Section, OPS.)

All units have steam driven systems supplying cooling capacity at loss of power situations.

All units are supplied with battery capacity for the SBO case. The durability of the batteries is further discussed in the SBO section of the report.

Ultimate Heat Sink (UHS)

With regard to the safety properties of the UHS, there are no significant differences between the units.

The UHS is the sea. The seawater canal system is similar for all units.

The properties of the seawater canal system are further discussed in the UHS section of the report.

Severe accident management

With regard to severe accident management, there is no significant difference between the units.

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 16 (52)

The severe accident management is based on the presence of the filtered vent feature of the units. The severe accident scenario resulting in a reactor vessel melt-through trained in similar ways for the BWR and the PWR’s.

The accident management organisation is common for the site.

2.5 Defence in depth principle

As described above the plants are designed with the safety objective of confining the radioactive material by physical barriers, maintained by dedicated protective systems and the management of the plant. This philosophy is described in the defence in depth principle.

In order to meet the principal safety objectives, the concept of defence in depth is one of the most fundamental principles guiding the design of the plant and the principles for administrative control of the operation, providing an overall strategy for safety measures and features of nuclear power plants. When properly applied, the defence in depth concept ensures that no single human or equipment failure would lead to harm to the public, and even combinations of failures that are improbable would lead to little or no harm.

Defence in depth helps to establish that the basic safety functions;

- Controlling the power,

- Cooling the fuel, and

- Confining radioactive material,

are preserved, and that radioactive material do not reach people or the environment.

The principle of defence in depth is implemented primarily by means of a series of barriers which would in principle never be jeopardized, and which must be violated in turn before harm can occur to people or the environment. These barriers are physical, providing for the confinement of radioactive materials at successive locations.

The concept of defence in depth, as applied to all safety activities, whether organizational, behavioural or design related, ensures that they are subject to overlapping provisions, so that if a failure were to occur, it would be detected and compensated for or corrected by appropriate measures. Application of the defence in depth concept throughout design and operation provides a graded protection against a wide variety of transients, anticipated operational occurrences and accidents, including those resulting from equipment failure of human action within the plant, and events that originate outside the plant.

With the publication of INSAG-3, 1988 five levels, as presented in the list below, were defined

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 17 (52)

Levels of defence in depth

Objective Essential means

Level 1 Prevention of abnormal operation and failures

Conservative design and high quality in construction and operation

Level 2 Control of abnormal operation and detection of failures

Control, limiting and protection systems and other surveillance features

Level 3 Control of accidents within the design basis

Engineered safety features and accident procedures

Level 4

Control of severe plant conditions, including prevention of accident progression and mitigation of the consequences of severe accidents

Complementary measures and accident management

Level 5Mitigation of radiological consequences of significant releases of radioactive materials

Off-site emergency response

Application of the concept of defence in depth in the design of the plant provides a series of levels of defence (inherent features, equipment and procedures) aimed at preventing accidents and ensuring appropriateprotection in the event that prevention fails.

The aim of the first level of defence is to prevent deviations from normal operation. This leads to the requirement that the plant should be soundly and conservatively designed, constructed, maintained and operated in accordance with appropriate quality levels and engineering practices, such as the application of redundancy, independence and diversity in order prevent equipment failures.

The aim of the second level of defence is to detect and intercept deviations from normal operational states in order to prevent anticipated operational occurrences from escalating to accident conditions. This is in recognition of the fact that some postulated initiating events are likely to occur over the service lifetime of a nuclear power plant, despite the care taken to prevent them. This level necessitates the provision of specific systems as determined in the safety analysis and the definition of operating procedures to prevent or minimize damage from such postulated initiating events.

For the third level of defence, it is assumed that, although very unlikely, the escalation of certain anticipated operational occurrences or postulated initiating events may not be arrested by a preceding level and a more serious event may develop. These unlikely events are anticipated in the design basis for the plant, and inherent safety features, fail-safe design, additional equipment and procedures are provided to control their consequences and to achieve stable and acceptable plant states following such events. This leads

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 18 (52)

to the requirement that engineered safety features be provided that are capable of leading the plant first to a controlled state, and subsequently to a safe shutdown state, and maintaining at least one barrier for the confinement of radioactive material.

The aim of the fourth level of defence is to address severe accidents in which the design basis may be exceeded and to ensure that radioactive releases are kept as low as practicable. The most important objective of this level is the protection of the confinement function. This may be achieved by complementary measures and procedures to prevent accident progression, and by mitigation of the consequences of selected severe accidents, in addition to accident management procedures. The protection provided by the confinement may be demonstrated using best estimate methods.

The fifth and final level of defence is aimed at mitigation of the radiological consequences of potential releases of radioactive materials that may result from accident conditions. This requires the provision of an adequately equipped emergency control center, and plans for the on-site and off-site emergency response.

A relevant aspect of the implementation of defence in depth is the provision in the design of a series of physical barriers to confine the radioactive material at specified locations. The number of necessary physical barriers depends on the potential internal and external hazards, and the potential consequences of failures. Interaction between the defence in depth concept and the barrier concept can be illustrated with the following figure.

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 19 (52)

Fig 2-1, Defence in depth vs barriers

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 20 (52)

2.6 The containment filtered vent feature

A common characteristic of the units is the containment filtered vent feature.

R1-R4 started commercial operation 1975-1983 and were designed a decade earlier, with a clear focus at prevention of core damage (i.e. level 1-3 of the defence in depth principle). Due to the TMI-2 accident 1979 the interest for mitigating actions increased (i.e. level 4-5 of the defence in depth principle) and as a result some mitigating systems were implemented in Ringhals in the late 1980:s:

- Containment Filtered Vent (CFV, system 362)

- Independent Containment Spray (ICS, system 367/365 injecting via system 322)

The filtered containment venting feature was installed in the Swedish power plants as a result of new requirements stipulated by the Swedish government. The Ringhals specific requirement is referred to as “Regeringsbeslut 11, 1986” [27].

The design requirements of the filtered vent are i.a (according to regeringsbeslut 11)

- In the case of core damage, prepared plant specific strategies shall exist in order to protect the reactor containment function and to reach a stable condition where the core is cooled and covered by water.

- It is vital that the reactor containment function remains intact during the first 10 to 15 hours after a core damage.

- In order to protect the reactor containment against damage from overpressure during severe accident events, a controlled depressurization of the reactor containment shall be feasible. The pressure relief devices shall be independent of operator actions and independent of other safety systems. The pressure relief devices shall also be possible to operate by the operators.

- The releases shall be limited to maximum 0.1 % of the reactor core content of cesium-134 and cesium-137 in a reactor core of 1800 MW thermal power, provided that other nuclides of significance, from the use of land viewpoint, are limited to the same extent as cesium.

The chosen design scenario is station blackout (SBO, loss of all AC) and loss of steam-driven pumps, with no manual actions credited during the first 8 hours. Without actions or mitigating systems such a scenario will typically give serious core degradation within 1-2 hours, vessel failure within 2-4 hours followed by containment overpressurization and somewhat later gross failure of containment with large releases of fission products, unless mitigating measures are taken.

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 21 (52)

The requirement is to mitigate the design scenario so that the release of 134Cs and 137Cs will be no more than corresponding to 0.1% of the core inventory of a 1800 MWth core.

After 8 hours the ICS is assumed to be available, which will reduce the con-tainment pressure and temporarily terminate the filtered release (or delay the initiation).

In the design scenario for BWR (R1) the pressure in the containment will not reach the design pressure within 8 hours, why the actuation of ICS at this time will significantly delay the overpressurization of the containment until more than 24 hours. Somewhat later at a certain pressure the CFV is assumed to be actuated manually, but in case of no manual actions the CFV will be automatically actuated through the bursting of a rupture disk.

In the design scenario for PWR (R2-R4), the pressure in the containment ty-pically will reach the design pressure after 4-6 hours. Since no manual actions are credited during the first 8 hours the CFV will be automatically actuated through the bursting of a rupture disk and will reduce the containment pressure through a filtered release. After 8 hours the ICS is available which will reduce containment pressure and terminate the current CFV-release.

However, (for both BWR and PWR) if no other means of cooling of the con-tainment becomes available the ICS injection cannot continue “forever” since it will fill up the containment and has to be terminated at a certain level after approximately 30 hours. The pressure will then rise and there will be re-peated activations of the CFV with an energy balance established with “feed-and-boil” with the ICS intermittently injecting water and the CFV dissipating energy through a filtered release of steam.

The possibility to passively (no operator decision required) prevent a containment over-pressurization is an important feature when answering the ENSREG questions about protecting containment integrity.

All plants have chosen the FILTRA/MVSS concept to fulfill the requirements.

FILTRA/MVSS stands for Filtered Containment Venting – Multi Venturi Scrubber System. The major component is a scrubber system comprising a large number of small venturi scrubbers submerged in a water pool. A venturi scrubber is a gas cleaning device that relies on the passage of the gas through a fine mist of water droplets. The design of the venturis is based upon the suppliers wide experience in this area gained in designing venturis for cleaning polluted gases from various industrial plants. Separation of aerosols and gaseous iodine takes place in the venturis and the radioactive matter is transferred to the pool water.Since the venturis are located on different levels and are sealed off by the internal water level, the number of engaged venturis is proportional to the pressure in the containment and thereby the total relief flow. Consequently, each venturi always operate close to the optimal flow and high

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 22 (52)

decontamination factors are therefore achieved over a wide flow range. The activation of venturis is inherently automatic and no external flow control is required.A moisture separator collects the entrained pool water droplets efficiently.

The basic design requirement in Sweden was that depressurization of the reactor containment shall be possible without relying on operator action. This required activation by means of a rupture disc and efficient separation over a very wide flow range. Further, a sturdy design operating at low pressure was preferred, in order not to have the filter function jeopardized by dynamic effects such as hydrogen explosions.

A principal figure of the filter is shown below.

Fig 2-1, Containment filtered vent principal design

A = Pressure relief line from the containment

D = Pool G = Pressure vessel

B = Venturi distribution E = Moisture H = Manhole

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 23 (52)

system separator

C = Venturis including riser pipe

F = Release to atmosphere

I = Liner

A principal sketch of the connection to the containment is shown below.

Figure 2-2, FILTRA/MVSS connection to the containment

2.7 Performed safety enhancements

At Ringhals, safety enhancing plant modifications have been performed during the lifetime of the units. The major modifications are:

- Modifications triggered by the TMI accident

- The severe accident mitigation systems and procedures (including i. a. the containment filtered vent feature)

- Steam generator replacements

- Recirculation strainer reinforcements

- Replacement of the I&C equipment on Ringhals 2, including a diverse protection system

- Installation of a diverse protection system on Ringhals 3 and 4

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 24 (52)

- Installation of a functionally and physically diverse protection section (DPS) on Ringhals 1

- Installation of passive hydrogen recombiners

- Localizing the plant specific simulators on site, achieving increased training opportunities and efficiency.

- Development and training of the emergency response organization, based on experiences from drills and events such as TMI and the Chernobyl accident.

2.8 Routine safety enhancement work

Safety evaluations are a part of the daily work tasks. The plant technical specification controls the safe operation of the units, and each deviation from this is subject to a safety evaluation in the resulting licensee event report.

The experience feedback system of site supplies potential safety enhancements based on information from suppliers and organizations.

The safety level of the units is also continuously developed driven by the development of the national regulations. Revised regulations requires backfitting of the units to fulfil the new requirements.

At present, such a backfit program is in progress . The program is extensive, with a time schedule of several years [14-17].

Periodic safety reviews are made each 10 year and in addition (safety) reviews are made by external expertise from IAEA and WANO.

2.9 Scope and results of PSA

2.9.1 Scope

The PSA models for Ringhals 1, 2, 3 and 4 are plant specific. The focus is on the frequency of core damage, PSA level 1, and the frequency of release of radioactive substances, PSA level 2. The PSA models constitute an important tool for many risk-informed applications and the results are described in the Safety Analysis Report (SAR) for each plant. However it is important to bear in mind that the results of a PSA are valid only given certain conditions and assumptions. This also implies that the numerical values for different plants (including the four units at Ringhals) are not directly comparable due to differences in the modelling.

2.9.2 Ringhals 1

The results for Ringhals 1 are taken from the Ringhals 1 SAR [23].

Results PSA level 1 for power operation

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 25 (52)

The mean value of the core damage frequency from all initiating events which are modelled for power operation is 2.2E-5 /year. The contributions tothis value from different initiating event types are shown in figure 2.9.2-1.

Figure 2.9.2-1. Contribution to the core damage frequency during power operation from different types of initiating events

Results PSA level 2 for power operation

Releases exceeding 0.1 % of the core inventory of radioactive materials for a reactor of 1800 MW are defined as releases which corresponds to 0.072% of the core inventory for Ringhals 1.

The result is a release frequency for Ringhals 1 of 2.8E-6 /year.

Results PSA level 1 for low power operating modes

The mean value of the core damage frequency from all initiating events, which are modelled for the low power operating modes, is 2.0E-6 / year.

The contributions to this value from the different initiating event types are shown in figure 2.9.2-2.

Figure 2.9.2-2. Contribution to the core damage frequency during low power operating modes from different types of initiating events

Results PSA level 2 for low power operating modes

The release frequency for the low power operating modes is estimated to be 1.8E-7/year.

Results PSA level 1 for refueling outage

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 26 (52)

The mean value of the core damage frequency from all initiating events, which are modelled for a refueling outage, is 5.9E-5 / year.

The contributions to this value from the different initiating event types are shown in figure 2.9.2-3. External events are analysed but the contribution is shown to be small enough to neglect.

Figure 2.9.2-3 Contribution to the core damage frequency during refuelling outage from different types of initiating events


The release frequency is defined in the same way as for power operation. This is estimated to be 1.2E-6 /year. 1.5.3

2.9.3 Ringhals 2

The results for Ringhals 2 are taken from the R2 SAR, Part 8.7 Probabilistic Safety Analyses [24].

Results PSA level 1 for power operation and the low power operating modes

The mean value of the core damage frequency from all initiating events, which are modelled for power operation and the low power operating modes, is 3.6E-5 /year.


Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 27 (52)

Area Events52%

External Events2%

Internal Events46%

Figure 2.9.2-4. Contribution to the core damage frequency during refuelling outage from different types of initiating events


The large early release frequency for Ringhals 2 is estimated to be 7.5E-7 /year.

Results PSA level 1 and 2 for refueling outage

A plant specific analysis of the shutdown states has been developed but is not yet included in the R2 SAR. However an indication of the risk distribution can be achieved by studying the results from the corresponding analyses for Ringhals 3 and Ringhals 4.

2.9.4 Ringhals 3

The results for Ringhals 3 are taken from the R3 SAR Chapter 15.9 –Probabilistic Safety Analysis [25].


The mean value of the core damage frequency from all initiating events which are modelled for power operation and the low power operating modes is 3.6E-5 /year.


Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 28 (52)

Area Events48%

External Events5%

Internal Events47%



The release frequency for Ringhals 3 is 9.3E-7 /year.


The mean value of the core damage frequency from all initiating events, which are modelled for a refueling outage, is 1.5E-5 /year.


Area Events31%

Internal Events69%



Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 29 (52)

The release frequency is defined in the same way as for power operation. This is estimated to be 1.6E-6 /year.

2.9.5 Ringhals 4

The results for Ringhals 4 are taken from the R4 Förnyad SAR Systemdel Kapitel 15.9 – Probabilistic Safety Analysis [26].


The mean value for the core damage frequency from all initiating events which are modelled for power operation and the low power operating modes is 4.2E-5 /year.


Area Events61%

External Events4%

Internal Events35%



The release frequency for Ringhals 4 as 1.1E-6 /year.


The mean value of the core damage frequency from all initiating events, which are modelled for a refueling outage, is 4.4E-5 /year.


Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 30 (52)

Area Events51%

Internal Events49%



The release frequency is defined in the same way as for power operation and estimated to be 1.8E-6 /year.

3 STRESSTEST RESULTS

3.1 Earthquake

This summary of the earthquake evaluation is a summary of [28]. The summary is at an overall level, presenting the main areas for improvement.

An assessment has been performed of the properties of the plant at elevated earthquake conditions. The severity of the earthquake assumed has been increased from the design basis level of a 10-5 earthquake to a 10-7

earthquake. This results in an increase of the accelerations of about four times. The engineering judgement is that the containments, fuel buildings, spent fuel pools and containment filtered vents will be able to fulfill their functions. Further analysis are required regarding the spent fuel pool cooling equipment, the Control Rod Drive Mechanisms of Ringhals 2/3/4, the Ringhals 1 scram system and the Ringhals 1 reactor building roof.

In the original design, seismic loads were not included as design basis since the loads from earthquakes were considered small. The robustness of the structures called on for other reasons was considered enough to withstand the possible earthquakes.

Thereafter, seismic requirements have been applied.

Seismic loads have originally been applied for the Containment Filtered Vents (CFVs) and mobile units for water and power supply. The CFVs were installed during the late 80’s in accordance with the Swedish government decision 11 [27]. The ground response spectra for the CFVs were chosen in

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 31 (52)

accordance with US NRC Regulatory Guide 1.60 scaled to a PGA of 0.15 g horizontally and 0.10 g vertically.

Further, seismic events with a probability of 10-5 per year have been considered at plant modifications performed since the beginning of the 90’s, concerning equipment important for reactor safety. The ground response spectra used are valid for a typical Swedish hard rock site and are based on [21].

The assessment is that the units can reach safe shutdown at a 10-5

earthquake. The spent fuel cooling systems are not seismically qualified.

The stress test is performed by applying a more severe earthquake than the Swedish 10-5 earthquake. The applied case is an earthquake corresponding to an exceedance frequency of 10-7 per site and year, based on [21]. The resulting peak ground acceleration is 0,41g, i.e. about four times higher than the DBE acceleration of 0,11g.

Based on this earthquake level, the release preventing features of the plant and the spent fuel pools are evaluated. The release preventing features in this context are the containment with isolation provisions and the mitigation systems below:

- Redundant water supply to the containment. Water supply is available from the mobile unit for water and power supply.

- Controlled pressure relief of the reactor containment is performed via the MVSS (Multi Venture Scrubber System) connected to the reactor containment with a pipe.

- Non-filtered pressure relief of the reactor containment at LOCA in combination with degraded pressure suppression function. (Only for BWR.)

- Also other systems credited at severe accidents are evaluated, such as trip systems, pressure relief systems

It has further been evaluated if an earthquake could cause a flooding of the plant. The evaluation shows that this is not a realistic combination at the Ringhals site.

The engineering judgement is that the containment integrities will be maintained, the containment filtered vents will be able to fulfill their functions, and the mitigation systems will be able to fulfill their functions in case of an earthquake with frequency level 10-7 annual at site.

The fuel storage pools and the fuel racks of Ringhals 1 are judged to be able to fulfill their functions in case of an earthquake with frequency level 10-7

annual at site.

The fuel storage pools of Ringhals 2-4 are judged to be able to fulfill their functions in case of an earthquake with frequency level 10-7 annual at site, while the fuel racks needs further consideration.

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 32 (52)

The spent fuel cooling equipment on all units are not seismically qualified and needs further analysis regarding their possibility to maintain the cooling function after an earthquake. The roof of the reactor building of Ringhals 1 needs further analysis.

The CRDM’s of Ringhals 2-4 and the scram system of Ringhals 1 also needs further analysis.

3.2 Flooding

This summary of the flooding evaluation is a summary of [6]. The summary is at an overall level, presenting the main areas for improvement.

The Ringhals site is situated on the Swedish west coast, utilizing the sea as ultimate heat sink. In the vicinity of the site, there are no dams or rivers constituting sources of flooding. The single source of flooding with the potential to cause a sequence of events resulting in fuel damage is a sea-level rise.

The phenomena tsunami is not assumed to occur in Sweden. This assumptions is motivated by the requirement of large seismic activities combined by large depths of the sea in order to create a tsunami. The seismic activity in the Scandinavian area is low and the waters are relatively shallow. Historically, no tsunamis have ever been registered in Swedish waters [1].

A sea-level rise is the considered source of a flooding event. The design bases flooding, DBF, is a sea-level of 102,65 m. The normal sea-level is specified as 100 m and the ground level at site is 103 m.

The design bases flooding is based on statistics during the period 1887 to 2006 [2]. The original DBF was 101,43 m, a so-called 100-year value that, as the name indicates, was the highest water level measured during a 100-year period. In accordance with the regulations stated in § 14 of SSMFS 2008:17, this was reconsidered in order to reflect a flooding with a frequency of 10-4 to 10-6/year. The flooding level of 102,65 m has been determined to have the frequency 10-5/year [3].

The design basis is judged to be adequate, based on the large number of measurements of the sea level available.

In accordance with the ENSREG stresstest specification an evaluation of the margins have been performed. In the flooding case, the robustness of the plant when exceeding the DBF has been evaluated. The evaluated scenarios and results are:

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 33 (52)

Scenario Sea water level Comment Fuel damage

1 Below +102,65 m DBF which the plant is designed to handle

No

2 +102,65 m - +103 m Flooding above DBF but not above ground level

No

3 +103 m - +103,3 m Flooding above ground level, manageable amounts of water entering the buildings

Unlikely

4 +103,3 m - +104 m Flooding significantly above ground level, large amount of water entering the buildings

Possible

5 Above +104 m The main doors break and all buildings are internally flooded up to this level.

Yes

In scenario 1, the sea-level is within the DBF which is discussed above.

In scenario 2, the sea-level is above the DBF but below ground level. In this situation the cooling water tunnels will be the affected part of the plant as discussed above.

In scenario 3 manageable amounts of water will enter the plant and severe damage to the fuel is therefore deemed to be unlikely. Water will enter the plant through leakages in doors and pipe/cable penetrations, e.g. in the intake buildings. The leakage will be limited and no catastrophic failure will occur. The probability of a sea-level above +103 m has not been calculated but, as a comparison, a flood of +103,1 m is according to report [2] assumed to have a frequency of 10-6/year.

In scenario 4 large amounts of water will enter the plant through various openings. It is difficult to predict whether or not this level of water will lead to severe damage to the fuel since that depends on a number of factors such as which rooms are flooded and the duration of the flooding. The probability of a sea-level above +103 m has not been calculated but, as a comparison, a flood of +103,1 m is according to report [2] assumed to have a frequency of 10-6/year.

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 34 (52)

In scenario 5 the water reaches a level where the doors break. When the doors break the water will flood the entire plant instantly up to the level the flood was before the doors broke. Components of safety significance will be flooded and core damage (as well as spent fuel storage damage) will occur.

The cliff edge effects identified at the evaluation of the flooding event are summarized:

- As the DBF will not lead to internal flooding no cliff edge effects are identified within the DBF scenario.

Beyond the DBF, i.e. with a postulated sea level rise of 4 m, cliff edge effects have been identified:

- The significant cliff edge effect is the water level at which the outer doors will break and the buildings instantaneously will be flooded.

Based on the identified cliff edge effects, the following area will be subject to reinforcements or in depth evaluations:

- The ultimate cliff edge effect is when the doors break and the plant becomes flooded with core and spent fuel damage as a result.

3.3 Loss of offsite power (LOOP) and station blackout (SBO)

This summary of the cases loss of offsite power and station blackout is a summary of [4]. The summary is at an overall level, presenting the main areas for improvement.

The onsite power system is designed with several alternate AC-power sources and emergency diesel generators that can be used if offsite power is lost. From a functional perspective, the power supply can be illustrated as shown in the figure below.

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 35 (52)

Fig 3.3-1, Functional design of power supply system

AC-sources

The AC system consists of a number of subsystems that ensures that the onsite power system under all operating conditions has power supply so that the safety systems can perform their safety function.

In principal there are three different AC power sources for supply to the safety power systems, and these are:

1. Normal supply path via the 400 kV transmission system and/or the main generator via unit auxiliary transformer and the 6 kV busbar in the preferred power supply.

2. Alternative supply path from 130 kV transmission system via the start-up transformer, start-up switchgear and the 6 kV busbar in the preferred power supply. Via this supply path a connection can be established to the gas turbines when required.

3. Diesel generators (1 per electrical train), which during loss of offsite power automatically takes over the supply of the safety power systems. There is also a mobile diesel generator (DG910) available at Ringhals, which can replace any of the ordinary emergency diesel generators.

Normally the supply path from the 400 kV transmission system is used, but there is also fast-bus-transfer equipment to change the supply to the 130 kV transmission system. There is one fast-bus-transfer equipment for each electrical train (A, C, B, D) and these equipments are independent of each other and supplied by batteries (110 V DC).

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 36 (52)

Should the power supply according to both 1 and 2 fail, there are four diesel generators ready to automatically start up and take over the supply of the safety power systems, one diesel generator per electrical train.

Further, all four units at the Ringhals NPP are designed to be able to transfer to house load operation if offsite power should be lost. During house load operation the main generators are only supplying the units onsite power system with electrical power. The main generators are no longer connected to the 400kV grid, so the electrical power that is generated only cover the need for the unit itself. It is an advantage (positive for the defense in depth strategy) to have an additional source of electrical power for safety power system equipment in a situation when offsite power is lost, especially if both possibilities (400kV and 130 kV) to feed the electrical distribution system from offsite power is lost at the same time.

DC supplies

In principal there are two different DC power sources and supplies for supplying the DC distribution systems.

1. Rectifiers supplied by the safety power systems.The rectifiers supply connected DC loads with uninterrupted power and at the same time charge or maintain batteries in a fully charged state.

2. Batteries.During loss of voltage on the preferred power supply an interruption in voltage will occur before the diesel-generators have started and energized the 6 kV safety power systems. During this time the batteries will take over and supply connected DC loads with uninterruptible power.

The robustness of the unit power supply is evaluated in accordance with the ENSREG stress test specification and divided into three cases:

1. Loss of offsite power, LOOP, meaning that the power from the 400 kV and 130 kV grids is lost while emergency diesel generators, gas turbines and batteries are still available.

2. LOOP and loss of on-site backup power sources meaning that the power from the 400 kV and 130 kV grids is lost together with loss of emergency diesel generators, while gas turbines, batteries and diversified emergency diesel generators are still available. The diversified diesel generators intended here are two dedicated diesel generators supplying the DPS part of Ringhals 1 (Ringhals 1 safety systems are divided into two separate sections, Original Plant Section OPS and the Diverse Plant Section DPS. The sections are functionally and physically separated).

3. LOOP and loss of the ordinary back-up sources and loss of any other diverse back-up sources meaning that only battery secured power systems are available.

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 37 (52)

Case 1, Loss of offsite power, LOOP, meaning that the power from the 400 kV and 130 kV grids is lost while emergency diesel generators and gas turbines are still available

This case constitutes a design case for the units. The grid is assumed to be lost and if house load operation fails the remaining power source for the vital equipment is the four emergency power diesel generators (Ringhals 1 equipped with two additional diesels). The gas turbines also remains intact.

The case is functionally described in the figure below.

Fig 3.3-2, Functional design of power supply system, LOOP condition

The robustness of the plant is in this situation controlled by the endurance of the emergency power diesel generators, i.e. from a practical point of view the supplies of fuel- and lube oil. A calculation of these consumables has been performed.

The calculations of the consumables are based on the assumption that the initial condition is power operation, because the consumption of consumables (diesel, etc.) is highest in an emergency scenario that starts during power operation. The calculations are based primarily on the minimum allowable stored volume, according to the technical specifications.

The result will be valid when all units are affected at the same time. However, if for instance only one unit is affected the consumption of fuel and lubrication oil for this unit will be the same but the endurance will be significantly longer. This because the supplies that are common for all four units can be used for the affected plant only.

The result is summarized in the following figure.

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 38 (52)

1 day 3 days 7 days

Unit 1

Unit 2

Unit 3/4

Fuel

Lube oil

Fuel

Lube oil

Fuel

Lube oil

Time

On-site supplies – no refilling required on-site supplies – refilling required

Light equipment on-site Heavy equipment on-site

OPS

DPS

Fuel

Lube oil

off-site supplies / refilling from other units tanks

Fig 3.3-3, Usage of consumables

The calculations shows that if all four units are affected simultaneously, delivery of diesel fuel is required after five days. After five days transportation to the site and within the site area is assumed to be feasible.

The power supply from the gasturbines has a fuel supply enabling power delivery for a period of several weeks.

The result of the evaluation is that the power supply in this case can be maintained for a long time. Hence, no fuel damage will occur in this case.

Case 2, LOOP and loss of on-site backup power sources meaning that the power from the 400 kV and 130 kV grids is lost together with loss of emergency diesel generators, while gas turbines and diversified emergency diesel generators are still available.

In this case the grid is assumed to be lost, the four emergency power diesel generators do not start and house load operation is not credited, resulting in that the remaining power source for the vital equipment is the gas turbines.

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 39 (52)


Fig 3.3-4, Functional design of power supply system, LOOP and loss of on-site backup power sources

The robustness of the plant is in this situation controlled by the endurance of the gas turbines, i.e. from a practical point of view the fuel- and lube oil supplies.

The evaluation shows that at a simultaneous occurence of this event at all four units, the power supply from the gas turbines will have an endurance of several weeks. Rated power for one gas turbine is greater than the rated power of all emergency diesel generators in Ringhals together (the gas turbine power station consists of four gas turbines).

In addition to the gas turbines Ringhals 1 is equipped with two diversified diesel generators within the DPS-section of the plant (Diversified Plant Section). These diesel generators are assumed to be operable and the evaluation shows an endurance of seven days until refueling is required.

The result of the evaluation is that the power supply in this case can be maintained for a long time. Hence, no fuel damage will occur in this case.

Case 3, LOOP and loss of the ordinary back-up sources and loss of any other diverse back-up sources meaning that only battery secured power systems are available

In this case the grid is assumed to be lost, the emergency power diesel generators does not start, the gas turbines does not start and house load operation is not credited, resulting in that battery power remains for monitoring and control of the plant.

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 40 (52)


Fig 3.3-5, Functional design of power supply system, LOOP and loss of the ordinary back-up sources and loss of any other diverse back-up sources

In this situation, the plants are dependent on their steam driven auxiliary feedwater systems.

Ringhals 1 is equipped with a steam driven auxiliary feedwater pump capable of delivering a flow corresponding to the steam released to the condensation pool. The pump is dependent of control valves, whose functional time is limited by the battery capacity.

The PWR-units, Ringhals 2-4, are equipped with steam driven auxiliary feedwater pumps, cooling the units via the steam generators. The pumps may be locally operated manually. However, monitoring of the steam generators is required in this situation, which is dependent on battery power. It is possible to supply power to the monitoring function by the mobile unit for water and power supply. The survival time for the mobile unit without refueling is 1 day [4]. After 1 day it is assumed that refueling is feasible, in accordance with the ENSREG assumptions.

For Ringhals 1, the evaluation shows that the time for depletion of batteries and loss of auxiliary feedwater results in an estimated time of 16 h until fuel damage occurs.

For Ringhals 2-4, the evaluation shows that the time for depletion of batteries and loss of auxiliary feedwater results in an estimated time of 9 h until fuel damage occurs. Connecting the mobile unit for water and power supply enables the utilization of the steam driven auxiliary feedwater pump until the loss of RCS inventory by the RCP seal leakage causes fuel damage, which is estimated to occur after 3 days.

In the scenario where the SBO occurs at low RCS inventory operation conditions in a PWR, fuel damage will be unavoidable in a shorter time

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 41 (52)

range. The evaluation shows that fuel damage will be unavoidable after 10 hours.

In the case of SBO at low RCS inventory conditions, or when the steam driven systems are exhausted, we enter the containment filtered vent scenario. This scenario and associated equipment was installed at Swedish units in 1988, in accordance with the government decision 11, 1986 [27]. The scenario is described in chapter 2.6.

The spent fuel stored in the spent fuel pools will also loose the cooling at a loss of power scenario. The spent fuel pools are evaluated in [5]. The evaluation shows that without corrective actions in order to reestablish cooling and/or feeding, fuel damage will occur after 3-5 days (PWR –BWR) in a refueling situation, i.e. maximum heat load assumed.

During operation, i.e. with a heat load representative of an operating season, the evaluation shows that without corrective actions, fuel damage will occur after 13-26 days (PWR resp. BWR).

The cliff edge effects identified at the evaluation of the three loss-of-power cases are summarized:

- The battery depletion times decides the time period for which control and monitoring of the steam driven systems is feasible.

- The feeding and cooling options for the spent fuel pools affects the time until fuel damage occurs

Based on the identified cliff edge effects, the following areas will be subject to reinforcements or in depth evaluations:

- The adequacy of the present mobile pump/generator resources need to be assessed.

- The battery capacity is generally an area to analyze further.

- Some operating procedures for SBO recovery needs to be updated.

- Cooling and feeding options and strategies for the spent fuel pools.

3.4 Loss of ultimate heat sink without/with SBO

This summary of the cases loss of ultimate heat sink without/with SBO is a summary of [4]. The summary is at an overall level, presenting the main areas for improvement.

3.4.1 Loss of ultimate heat sink without SBO

The ultimate heat sink of the units is the sea. The intake of the cooling water for the units has two intake canals; one for units 1 and 2 and one for units 3 and 4. The intake canals are equipped with an outer intake barrier at the

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 42 (52)

entrance of the canal, to prevent floating objects, such as timber, oil and ice, to enter the canal.

The cooling water systems are common to Ringhals units 1 and 2 and Ringhals units 3 and 4. Each reactor pair is equipped with two intake buildings, one for main cooling water and one for auxiliary cooling water, with screening equipment for removal of debris from the seawater. The cooling water is lead back into the sea through two tunnels, one for each reactor pair.

The cooling water system is designed with several sluice gates to allow different alignments in order to provide cooling water to the reactor buildings during all operation conditions (normal operation, maintenance, testing and postulated accidents). For example, if clogging of both intake buildings occurs, it is possible to provide auxiliary cooling water from the discharge water tunnel to the salt water system. If also the discharge water tunnel is clogged it is possible to re-circulate the cooling water in order to obtain cooling water to the salt water system. Also, one of the trains in the intake buildings for main cooling water is used as a backup for auxiliary cooling water.

At normal operation, the cooling water flow is approximately 80 m3/s (to each reactor pair). In case of loss of off-site power for all units the auxiliary cooling water flow is approximately 7 m3/s.

As mentioned above, the sea is the ultimate heat sink and the only source of water for the cooling water system. However, the probability of losing this source is low. There are also several ways to line up the cooling water depending on the situation. Events that could possibly result in a loss of UHS as a consequence are listed below.

- Low water level- Clogging of intake water- Blocked discharge tunnel- Tunnel collapse

The stress test is performed by, with a deterministic approach, postulating a long term loss of the UHS. Off-site power is assumed to be available. The cause of the loss of the UHS is not considered. Three different cases with different severity have been postulated:

Case 1. Blockage of the intake buildings (possibility to use the discharge as intake)

Case 2. Blockage of the intake buildings and discharge tunnel (possibility to re-circulate the cooling water)

Case 3. Total loss of the UHS (no water available to the salt water system, 715)

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 43 (52)

Case 1, Blockage of the intake buildings (possibility to use the discharge as intake)

In this case the intake of the seawater is blocked. Line-up is made to use the discharge tunnel as intake.

The evaluation shows that this is a feasible way of maintaining the cooling chain working. No fuel damage will occur in this case.

Case 2, Blockage of the intake buildings and discharge tunnel (possibility to re-circulate the cooling water)

In this case both the intake and the discharge tunnel are blocked. Line-up is made to recirculate the contained amounts of water. This amount of water will accumulate the residual heat, and after some time the cooling chain will not be usable. The cooling of the units will then rely on the auxiliary feedwater systems together with associated sources of water.

The evaluation neglects the time interval for heating the contained amount of sea-water, and focuses on the consumption time for the available sources of auxiliary feedwater. With this assumption the the available water sources will be emptied after 25 days (Ringhals 1), 17 days (Ringhals 2) and 11 days (Ringhals 3/4). Fuel damage will consequently occur at the earliest after these times.

Case 3, Total loss of the UHS (no water available to the salt water system, 715)

In this case the sea-water is not available, causing the cooling chain to be inoperable. The cooling of the units will rely on the auxiliary feedwater systems together with associated sources of water.

The evaluation focuses on the consumption time for the available sources of auxiliary feedwater. The available water sources will be emptied after 25 days (Ringhals 1), 17 days (Ringhals 2) and 11 days (Ringhals 3/4). Fuel damage will consequently occur at the earliest after these times.

In this evaluation, the case with loss of UHS when the RCS is at reduced inventory conditions in midloop conditions is not discussed. The SG’s are not available in this condition, and consequently the loss of UHS causes a loss of the cooling chain. This case is bounded by SBO at midloop or low RCS inventory conditions, resulting in a time range to unavoidable fuel damage of at least 10 hours, since safety injection is available in this case.

During a loss of the ultimate heat sink the spent fuel pool cooling will also ultimately fail. Without corrective actions boiling will occur and the water level in the pool will decrease. Fuel damage will be unavoidable after 3-5 days (PWR –BWR) The evaluation shows further that with feeding from available water sources fuel damage will occur after 3 weeks (Ringhals 1) and 2 weeks (Ringhals 2-4) respectively.

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 44 (52)

The cliff edge effects identified at the evaluation of the three loss-of-UHS cases are summarized:

- The water supplies will be emptied after certain periods of time.

Based on the identified cliff edge effects, the following areas will be subject to reinforcements or in depth evaluations:

- The adequacy of the present water supplies need to be assessed.

3.4.2 Loss of ultimate heat sink with SBO

This case is bounded by the SBO-case as discussed in section 3.3 above. At an SBO event, one of the effects is that the operation of the pumps circulating the UHS coolant is interrupted. The plant response to the SBO events is consequently the same whether the UHS is lost or not. Hence, the method and the results for SBO described in section 3.3 are valid also for this case.

3.5 Accident management

This summary of the accident management is a summary of [31]. The summary is at an overall level, presenting the main areas for improvement.

The accident management of the site consists of:

- Emergency operating procedures, controlling the operators managing of the units

- The emergency response organization, managing measures within the site and the coordination with external authorities and external resources. The emergency response organization includes a technical support function for the operators

The emergency operating procedures are based on the generic procedure packages from the respective vendor, with plant specific adaptations. Specific adaptations have been performed with regard to the containment filtered vent feature, unique for the Swedish plant design.

The emergency response organization is initiated by the engineer on duty, being on site around the clock (24/7). The organization includes management of the entire site, and the affected unit. The organization further includes technical support function for the operators, radiation protection function, coordination function and recovery staff. The organization has a response time of 2 h.

The accident management is initially focused on preventing fuel damage. The strategy is to assure subcriticality, water supply to the core and removal of the residual heat.

If core damage becomes unavoidable, the severe accident management strategies are applied. Actions are then shifted from prevention of fuel

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 45 (52)

damage towards mitigation of the consequences to the public. Primary system pressure is reduced, in order to allow larger amounts of water to be injected into the system. Pressure reduction is also performed to avoid a high pressure melt-through of the reactor pressure vessel. Other strategies are also applied in preparation for a possible vessel melt-through.

The severe accident strategies were developed as a part of the installation of the containment filtered vent. The containment filtered vent was installed in 1988 as a result of a government decision (government decision 11, 1986), triggered by the TMI accident. The filtered vent is further described in section 2.6.

If all measures to recover the core cooling fails, vessel melt-through will occur and the strategy is focused on maintaining the integrity of the containment.

The containment integrity is challenged by:

- An overpressure situation that may occur as a consequence of a hydrogen detonation, or as a consequence of steam formation due to vessel melt-through.

- Basemat melt-through as a consequence of ex-vessel core after a vessel melt-through.

- Containment bypass by severe accident induced steam generator tube rupture in PWR

These phenomena are taken into account within the safety systems and accident management of the units.

The hydrogen detonation in BWR-containment is prevented by keeping an inerted atmosphere in the containment (nitrogen filling of the containment). The hydrogen detonation in PWR containments is prevented by the installed passive autocatalytic hydrogen recombiners, PAR.

Overpressure of the containments is normally prevented by containment spraying. In the case of a station black-out it is still possible to spray the containment by use of mobile independent pump units. If spraying is not successful the pressure relief will be performed by the filtered vent feature described in section 2.6. The evaluation shows that the site has two mobile independent pump units, which may be inadequate if four units are affected simultaneously.

For the PWR’s, preventing a base-mat melt-through is made by filling the containments with water to a certain level. The BWR always have the condensation pool filled with water underneath the reactor pressure vessel.

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 46 (52)

These measures can be taken independently of power supply from emergency power diesel generators and batteries. Two dedicated mobile pump/generator units are available for the purpose.

The evaluation further includes the management of the spent fuel pools at a loss of cooling event. At the loss of cooling, the radiation shielding achieved by the water level will decrease. The radiation shielding has decreased to an unacceptable level when the water level has decreased to 2 m above the fuel. This will with maximum heat load occur after 2-3 days (PWR – BWR) if no countermeasures are taken.

As long as the radiation shielding is maintained, it is possible to restore the fuel pool cooling provided power is available. If power is not available, feeding of the pools by the use of firewater is possible.

The adequacy of the existing accident management measures have been assessed:

- Containment filtered vent system

In the context of the Fukushima disaster the CFV system appears to be an important last line of defense capable of significantly mitigate accident scenarios with loss of several safety functions and core damage.

The system is designed for earthquake, is unlikely to be affected by flooding and will retain most of its capability even without supporting actions.

The system will be activated passively by a rupture-disc at excessive containment pressures, and hence no decision-making is required.

- Hydrogen risk in PWR

The PAR-system (Passive Autocatalytic hydrogen Recombiners) in the Ringhals PWR:s appears to be a robust and reliable way of limiting the risk associated with hydrogen from severe core damage.

The system is designed for earthquake and independent of supporting systems.

Hydrogen risk in BWR

In the context of the Fukushima disaster the ability to vent the containment through the CFV-system appears to be an important possibility to reduce the hydrogen risk. The system is designed for earthquake, high radiation and high hydrogen concentrations, and have only minor dependencies on supporting systems. Purging containment with nitrogen might be difficult to do due to high radiation.

The ability to handle hydrogen/oxygen without venting is less reliable for

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 47 (52)

severe accident conditions, and may require further actions within a week.

- Independent pump/generator

The system 367 consists of 2 fire-trucks equipped with independent diesel-driven pump and generator.

The pump can take suction at various sources including the sea, and can feed the containment spray system as well as feed-and-boil of the spent-fuel pool.

The generator charges the batteries in the 362-system. At PWR it can charge parts of the DC-batteries.

The system is designed for earthquake and is fairly independent of supporting systems.

Since there are 2 fire-trucks for 4 units the availability might be limited if considering more than one accident simultaneously, and/or considering several needs (e.g. fuel pool feeding and independent containment spray) simultaneously.

Destroyed infrastructure might hinder the activation of the system.

- Spent Fuel Pool (SFP)

Generally the SFP:s have several possibilities for cooling, but most of them require that the SFP-building is habitable.

According to [5] the time from loss of SFP cooling to onset of boiling is in some cases around 9-14 hours, and to loss of shielding around 2-3 days.

Once water-levels in the SFP has decreased through boiling, or because of structural failure, and caused loss of shielding, there are few severe accident management measures available.

The site emergency response organization has been evaluated based on the Fukushima event:

- The management of a Fukushima-size acccident requires an organization being independent of surrounding society for a relatively long period of time. This is not the design basis for Ringhals emergency response organization.

- The present emergency response organization is basically designed to manage one affected unit. Training exercises have been performed on two affected units.

- The emergency response organization has a response time of 2 h. However, if the infrastructure is damaged the assumed response time is

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 48 (52)

in accordance with the ENSREG assumption, i.e. 24 h. This will affect the performance of the staff being on site.

- The emergency response organization is not designed with flooding and earthquake as design basis. It is judged that an earthquake does not impact the emergency response organization. At a flooding event beyond DBF, to the stressed levels above ground level, the emergency response organization premises will be flooded. (A backup emergency response location is available)

- The emergency response organization has no guidance for long time management of accidents of the Fukushima extent.

4 SUMMARY ASSESSMENT

An assessment has been made the site at situations beyond the design bases of the units. The assessment has been performed in accordance with the ENSREG stress test specification. The stress test is focused on the areas:

- Earthquake, where the stressing is made by applying an earthquake with a ground acceleration about four times beyond the design value (the 10-7

earthquake vs. 10-5 earthquake).

- Flooding, where the stressing is made by applying sea-rise levels beyond design. The design basis sea-rise level is 2,65 m. The plant robustness is evaluated by applying sea-rise levels of 3, 3,3 and 4 m.

- Loss of offsite power and station blackout. In this case the stressing is performed by applying a gradually increased of loss of power, ending up with only battery power as the available source.

- Loss of ultimate heat sink, where applying a gradually decreasing availability of seawater makes the stressing, ending up with no seawater at all available.

- Accident management, where the stressing is made by imposing potential obstacles for the accident management processes such as infrastructure destruction, unavailable facilities, loss of power, habitability issues etc.

In all cases, the very beneficial impact of the containment filtered vent feature is observed.

In the earthquake case, the engineering judgement is that the units will be able to withstand the design basis earthquake (DBE). Safe shutdown is judged to be feasible. The spent fuel cooling systems are not seismically qualified. At beyond design bases condition for the stress test, the applied case is an earthquake corresponding to an exceedance frequency of 10-7 per site and year. At this condition, the containments, the CFV’s, the fuel buildings and the fuel pools and the severe accident mitigation systems are judged to be able to perform their release preventing functions. As

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 49 (52)

mentioned above, the spent fuel cooling systems are not seismically qualified.

In the flooding case, the assessment concludes that for the design basis flooding, a sea level rise of 2,65 m, no fuel damage will occur. Beyond design basis, flooding of the units may occur with the potential of causing fuel damage by elimination of safety functions and spent fuel cooling equipment. Robustness exists up to the ground level, which is 3 m above sea level. At a sea-level rise of 4 m fuel damages are judged to be possible. Addressing the question of an appropriate sea-level rise is required before relevant measures can be taken.

In the “Loss of offsite power and station blackout” case, the assessment concludes that the limiting case is when only battery power is available. Robustness exists as long as anyone of the ordinary backup power sources (diesel generators or gas turbines) or the steam driven auxiliary feedwater systems are available. Postulating power system recovery times beyond design, exhaustion of batteries, depletion of the water sources for the steam driven systems and operation at low RCS inventory conditions will cause fuel damage. The containment filtered vent feature will contribute in keeping the releases within allowable limits. The loss of power will also cause a loss of the spent fuel cooling.Addressing the adequacy of the current battery capacities and the availability of the backup power sources is required before relevant measures can be taken.

In the case of loss of ultimate heat sink, the assessment concludes that robustness exists for several days in all cases, with the exception of operation at low RCS inventory conditions at the PWR’s. Addressing the operation at low RCS inventory conditions coincident with loss of UHS is required before relevant measures can be taken.

Regarding accident management, the assessment concludes robustness for events within design. The beneficial impact of the containment filtered vent is emphasised. When applying the Fukushima scenario as described in the stress test specification, a number of shortcomings are displayed. The emergency response organization can not handle four units simultaneously affected, the two existing mobile pump/generator units may not be enough,long time management guidance is not developed. Addressing the appropriate scenario to be applied is required before relevant measures can be taken.

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 50 (52)

5 AREAS SUBJECT TO IMPROVEMENTS

The following main areas are found to be suitable subjects to improvement:

- The spent fuel pool cooling abilities needs to be further evaluated/reinforced

- The properties of the emergency response organization needs to be reconsidered

- The flooding scenario needs to be reconsidered

- The requirement for battery capacity is generally an area to analyze further.

- The adequacy of the present water supplies needs to be reconsidered.

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 51 (52)

6 REFERENCES

A: Validated in the licensing process.

B: Not validated in the licensing process but gone through licensee’s quality assurance program.

C: Not one of the above.

1. Rapport över extrema väder och vattenhändelser i Sverige, SMHI, Darwin-id 981109065 (A)

2. NOG Säk och Miljö – Metodik för analys av vissa yttre händelser, Darwin-id 1944610/2.0 (B)

3. R1-R4 Sammanställning samt händelseklassning av yttre händelser, Darwin-id 1978823/2.0 (A)

4. R1-R4 ENSREG Stress Test – LOOP, SBO, Loss of UHS, Loss of UHS+SBO, Darwin-id 2141878/2.0 (B)

5. R1-R4 ENSREG stress test - Loss of spent fuel cooling, Darwin-id: 2151759/2.0. (B)

6. R1-R4 ENSREG Stress Test – Flooding, Darwin-id: 2146711/2.0 (B)

7. R1-R4 Förnyade säkerhetsvärderingar av tålighet mot vissa händelser, Darwin-id 2142379/2.0 (C)

8. Svar på SSM beslut: Förnyade säkerhetsvärderingar av tålighet mot vissa händelser, Redovisning av utgångspunkter och antaganden för analyser och säkerhetsvärderingar, Darwin-id 2143627 (C)

9. Antaganden för analyser och säkerhetsvärderingar vid förnyade säkerhetsvärderingar av tålighet mot vissa händelser.Kompletterande information, Darwin-id 2148889 (C)

10. Stresstester – Granskning av tillståndshavarnas redovisning av utgångspunkter och antaganden, Darwin-id 2151064 (C)

11. Förnyade säkerhetsvärderingar av tåligheten mot vissa händelser –Lägesrapport 15 augusti, Darwin-id 2152578 (C)

12. Åtgärder med anledning av händelserna vid Fukushima kärnkraftverk i Japan, Darwin-id 2132120. (C)

13. Beskrivning av uppdrag – Projekt Externa händelser, Darwin-id 2140747 (B)

14. Ringhals 1 – Övergångsplan för uppfyllande av SKIFS 2004:2, Darwin-id 1890250 (B)

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig



Hemlig 52 (52)




18. Rapport över extrema väder och vattenhändelser i Sverige, SMHI, Darwin-id 981109065 (A)

19. SKI Technical Report 92:3 "Project Seismic Safety" Report NO.4 and 5, April 1992, Darwin-id 1705297 (C)

20. R2 SAR part 2, Plant site, ch. 6 (A)

21. SKI Technical Report 92:3 "Project Seismic Safety" Summary report, April 1992, Darwin-id 960909047 (C)

22. R1-R4 PSA Level 1, Detailed External Events Analysis, Darwin-id 1826084/5.0 (A)

23. R1 Avsnitt 8.17 Probabilistisk säkerhetsanalys (PSA). FSAR/Allmän del, Darwin-id 980408029/6.7 (B)

24. R2 SAR, Part 8.7 Probabilistic Safety Analyses, SplitVision-id 1217042 (A)

25. R3 SAR Chapter 15.9 – Probabilistic Safety Analysis, Darwin-id 1911712 / 5.0 (A)

26. R2-R4 PSA. Förenklad modellering och utvärdering av PAR, Darwin-id 2028648 / 2.0 (B)

27. Regeringsbeslut 11, R1-R4 Villkor för fortsatt tillstånd enl. 5§ lagen (1984:3) om kärnteknisk verksamhet att driva kärnkraftsreaktorer, 1986, Darwin-id 980227022/1.0 (C)

28. R1-R4 ENSREG Stress Test – Earthquake, Darwin-id 2146557/2.0 (B)

29. R2 SAR, ch. 2.3, Split Vision id 637394 (A)

30. Ringhals- Station response to WANO SOER 2011-2 Fukushima Daiichi Nuclear Station Fuel Damage Caused by Earthquake and Tsunami, Darwin-id 2140020 (B)

31. R1-R4 ENSREG Stress test – Severe accident management, Darwin-id 2142360/2.0 (B)

Det

ta a

r en

PD

F-t

olkn

ing

fran

Dar

win

av

doku

men

t 215

8963

/ 2.

0S

ekre

tess

klas

s: H

emlig

Documents

R1-R4 ENSREG Stress Test - Summary · Dokumentstatus Alt dokument ID 1 Alt dokument ID 2 Dokument ID / Version Frisläppt Externa händelser 2158963 / 2.0 Hemlig 8 (52) 1 INTRODUCTION