Periodic Safety Review NPP Borssele reduced TCDF by a factor of 4.

Introduction

Borssele is a two-loop PWR built by Siemens KWU, that became operational in 1973. It is operated by the Dutch utility EPZ, which over the years has invested regularly in safety and efficiency. After its first PSR a plant modernisation programme of around 250 million Euros has been implemented in 1997 during a five-month outage. Highlights included the back fitting of new primary safety valves, new steam and feed water lines, a new control room, an emergency control room, new emergency diesel generators with higher capacity and a reserve ultimate heat sink.

In 2004 EPZ has decided to improve the plant’s balance of plant to a gross capacity of 510 MWe (see e-news issue 15, winter January 2007). This was carried out by Siemens during the 2006 outage.

In the same outage also the majority of measures were implemented that followed from the second PSR. These improvements have resulted in another significant gain in nuclear safety (see figure 1).

Figure 1. Changes in total core damage frequency as a result of safety improvements.

This paper reports on the process of the latest periodic review, as well as on examples of implemented measures. The associated gains, in terms of nuclear safety, are seen as the first priority for EPZ. At the same time these gains contribute to our goal of staying in the top of the safest nuclear power plants in the western world.

Periodic safety review

The operating license of the Borssele power plant stipulates that EPZ should conduct and report a periodic safety review every 10 years. This PSR is extensive and analyses developments in technology and regulations with respect to the current licensing base. The periodic safety reviews cover both design and operation, with technological-, organisational-, personnel- and administrative aspects.

The most recent PSR covers the period 1993 – 2002 and consists of an evaluation-, a conceptual- and an implementation phase. An important result of the evaluation phase was that Borssele is operated safely, in compliance with (inter)national regulations and current state-of-the art technology. In addition, several areas for further improvement and optimisation have been identified. The improvements have been selected, amongst others, for their impact on the total core damage frequency contribution (TCDF, PSA Level 1) and on individual risk contribution (PSA Level 3). This was calculated with the full scope, plant-specific living probabilistic safety assessment model. In figure 1 the integrated effect of these improvements on the total CDF is given. It shows that the most recent periodic safety review has resulted in another significant gain, despite the 1985 and 1997 back fitting projects which already reduced the original total CDF number significantly. An important decision has been to increase the so-called mission time in the PSA from 24 hours to 72 hours. This has allowed us to identify areas of improvement beyond the original 24 hours after the occurrence of an event. It has turned out that for some rare external events a significant safety improvement could be achieved.

Evaluation phase (1999 – 2003)

The evaluation of subjects for improvement started in 1999 by gathering information from different sources, such as:

• Input from personnel (listening to own organisation)

• Assessing new and upcoming regulations (national, KTA and IAEA)

• Information from aging programmes (conceptual and physical)

• Probabilistic Safety Analyses (In house living PSA model, as well as know-how of commercial companies in the field of PSA)

Over more than 1200 issues were gathered and clustered in 26 basic reports. After a first evaluation 176 issues of potential improvement were selected, based on know-how and PSA data.

Conceptual phase (2003 – 2005)

The potential improvements were further analysed during the conceptual phase, and measures were formulated in order to obtain the improvement. An estimation of costs was made together with the expected benefits, which were selected on expected gains in nuclear safety and based on:

• Probabilistic information.
  Impact on the total core damage frequency (CDF) and the individual risk were calculated with a plant-specific living probabilistic safety assessment model.

• Deterministic information.
  Upcoming regulations and defence-in-depth approaches (failures, availability, reliability,..) was analysed.

• Radiation protection gain.
  Collective, individual and environmental doses were calculated.

The issues for improvement were split into Technical (design) measures and OPA measures (organisational, personnel and administrative measures). All measures were subject to a cost/benefit analysis, and the end result has been agreed upon by the regulator in June 2005.

Implementation phase (2005 – 2007)

The modifications resulting from the technical measures were conducted by a separate project organisation. It covered around 35 measures of which 20 measures were conducted by own personnel. The remaining 15 measures were carried out by the consortium Belgatom – GTI on a design & construct basis. Within this consortium Belgatom was responsible for the project management, the nuclear engineering and the final testing. Detail engineering, purchasing and construction was carried out by GTI.

The engineering process and (safety) evaluation by personnel took place in 2005 and first half of 2006. Some of the measures required a change in the operating license. This was honoured in the beginning of 2006. Therefore, construction could start in the second half of 2006, and was concentrated in the outage of 2006. In 2007 some smaller constructions are finalized and documentation is completed. In the following paragraphs some examples are given, showing the diversity of the implemented measures.

Figure 2. Remotely opened explosion hatches.

Defence in depth measures.

Several defence in depth measures were formulated that cover different lines of defence, i.e. from prevention of system failures to extending the design basis of the plant. Examples of these measures are the installation of new improved seals of the low pressure safety injection pumps, an additional feeding possibility of the back-up decay heat removal system with a fire pump, installation of an additional pump in the cooling circuit for the irradiated fuel storage pond, and an additional pump for the emergency residual heat removal system.

Furthermore, the installation of a connection between the two emergency grids (6kV – 400 V) and extending battery power have been carried out. The power supply of the reactor protection system is extra secured and the dependence of the external grid has been further diminished, resulting in a significant gain in CDF.

As a last example, remotely opened explosion hatches have been installed (see figure 2). Between the operating- and the innercontainment section of the reactor building there are explosion hatches, which are designed to burst open in case of accidental pressure build-up, so as to limit damage to the innercontainment. In case of a very small LOCA with hydrogen buildup, the explosion hatches at top and bottom of the steam generator sections can now be opened remotely from the control room. In this way an air flow is forced by means of a chimney effect. The hydrogen will mix and reach the passive recombinators at the different positions in the reactor building.

Figure 3. Air intake of bunkered diesels.

Assessing risks from external events.

In a periodic safety review also off-site events are assessed that could influence the plant’s safety. Increased traffic of LPG tankers on our river have led to installation of igniters for external flammable clouds. More severe storms and sea level increase, due to a possible climate change, has led to an even more conservative design level of external flooding. The air intakes of the bunkered diesels were placed higher up with an external structure attached to the bunkered building (see figure 3). Because of the safety function, the pipework is earthquake-proof, blast-proof and on different sides of the building to reduce common mode failure.

Also a crashtender (see figure 4) was acquired to be able to fight kerosene fires that would challenge vital buildings.

Figure 4. Crashtender for fighting kerosene fires.