Roberto Adinolfi at CPExpo 2013, New Horizons for Nuclear Power Plants Safety

NEW FRONTIERS FOR NUCLEAR POWER PLANTS SAFETY

dr. Roberto AdinolfiChief Executive Officer, Ansaldo Nucleare SpA

Genova, 30 ottobre 2013

Genova, 30 0ttobre 2013

CPEXPO – COMMUNITY PROTECTION

NEW FRONTIERS FOR NUCLEAR POWER PLANTS SAFETY

H i it ibl t t t it i t i d d i kHow is it possible to protect community against man-induced risks……e.g. from Nuclear Power Plants?

• The key principles of nuclear safety

• Lessons learned from the Fukushima accidentesso s ea ed o t e u us a acc de t

• What is “acceptable” as man-induced risk?

• New plants: where are we going

• Is it possible to do better?Is it possible to do better?



THE KEY PRINCIPLES OF NUCLEAR SAFETY

• The development of a civil nuclear industry introduced a new• The development of a civil nuclear industry introduced a newdimension in industrial safety:– Not only protection of the investment

l f h– Not only protection of the operators

– …but also protection of the general public

• A nuclear power plant shall not release radioactivity to the generalpublic, even in accident condition, for more than a fraction of naturalsources

• Proper barriers against the release of radioactivity shall be deployed, eg:p g y p y , g– The fuel pin

– The pressure boundary of the primary cooling system

– The containment, which envelopes all the radioactive systems of theThe containment, which envelopes all the radioactive systems of the plant

• The “defence in depth” principle: the barriers shall be designed in such a way not to be impaired at the same time following an accident



THE KEY PRINCIPLES OF NUCLEAR SAFETY (cont’d)

• According to the above principles, emergency plans for evacuation are required by licensing authorities to limit the residual risk for the generalpublic.p

• After Three Miles Island, the deterministic analysis is integrated and supported by probabilistic risk assessmentpp y p

• Protection against external events:– Definition of “worst case” (“Design Basis”) event, on the basis of statistics( g ) ,

and /or probabilistic analysis, with frequency of occurence in the range10‐3 – 10‐4 ev/yr

– Design of structures and components to withstand, on deterministic bases, the worst case event

• Limited recourse to probabilistic analyses for external events



LESSONS LEARNED FROM FUKUSHIMA ACCIDENT

(A thorough description of the Fukushima sequence of events is presented in the memory of Mr. Alessandroni in a separate session)

• The actual Tsunami was largely over the DesignBasis event (the actual Eartquake* was only( q ymarginally higher that the Design Basis one)

• The deterministic defenses against Tsunami(e.g.a seaside wall of 6 m) were therefore totallyinadequate towards waves of 13-15 m(according to present understanding, seismicinput didn’t create problems toinput didn t create problems tostructures/systems integrity, but to the offsitepower supply)

Slipping area 500x200 km

• The flooding caused by the tsunami was acommon mode failure of (almost) all the electricpower onsite supply systems

(*) magnitude 9, the fourth largestever recordedever recordedworldwide



LESSONS LEARNED FROM FUKUSHIMA ACCIDENT (cont.’d)

• Recovery actions to reinstate core and spent fuel cooling were made very difficultfrom the extensive damages and the

On‐site testimony:“As tremendous aftershocks

psycologycal situation

• Containment systems in Units 1, 2, 3 and 4 b tl i i d b l i

occurred, with our full face masks still on, we frantically

headedff h d ”were subsequently impaired by explosions

caused by hydrogen generated from coremelting processes

off to the upper ground.”“While laying down cables at night, entailing the

h f t ti d

Defense in depth didn’t work properly

search of penetrations and terminal treatment

work, we were terrified that we might be electrocuted

• Evacuation of people (113.000 persons) from the 20 km radius area was effective in limiting the early exposure of the public

we might be electrocuted due to the outside water

puddles.”g y p p



A FEW CONSIDERATIONS

• Fukushima has been a very dramatic natural disaster, affecting a largey g gnumber of infrastructures (civil buildings, roads and bridges, distributionnetworks, industry plants, dams etc.). All this resulted in almost 20.000 immediate deaths:it is a fact that, out of them, none was related to the nuclear accidentsnuclear accidents

• This was largely due to the defense in depth approach, which offeredprotection at different levels, even if there were flaws on how it had beenimplementedimplemented

These flaws were mitigated by theevacuation of a significant numberevacuation of a significant numberof people, which after one year arestill living out of their home, even iflarge part of the restricted area islarge part of the restricted area isno longer “at risk” from a purelyscientific point of view.



WHAT IS “ACCEPTABLE” AS MAN-INDUCED RISK?

• Preventing accidents is the first requirement for any risky industry or• Preventing accidents is the first requirement for any risky industry or infrastructure

• Protecting against the consequences of any credible accident eitherProtecting against the consequences of any credible accident, eitherinternally generated or due to an external event, has been generallyconsidered an adequate measure for plant safety

• Nuclear industry , with its defence-in-depth approach, went already further: at least for internal events, the goal becomes to mitigate the consequences(i.e. the releases to the environment) even in the case of beyond design b t (N t th t thi i t i th i k i d t i )bases events. (Note that this is not so common in other risky industries…)

• Fukushima shows the need to consistently extend this approach also tosevere natural events with very low probability of occurencesevere natural events with very low probability of occurence

This was the goal of the stress tests conducted in Europe



WHAT IS “ACCEPTABLE” AS MAN-INDUCED RISK? (cont’d)

I it h t li it th di t f lik l t ?Is it enough to limit the direct consequences even of very unlikely events?

• Fukushima persisting evacuation (as it is also at Chernobyl) creates a p g ( y )strong sentiment of “inadequate protection”

• The new demand seems to be to limit, or to avoid, socio-economicconsequences which add on the direct consequences of the initiatingevent

• This is true also for other risks than nuclear. In Emilia, the structural failureof industrial buildings was perceived as “unacceptable” not only in terms ofhuman losses but even in terms of loss of jobs.

• Since the recovery time to eliminate those consequences becomes a crucialfactor for acceptability, nuclear is particularly “weak” (“no threeshold”approach to long term effects)approach to long term effects)



NEW PLANTS: WHERE ARE WE GOING?

G ti III tGeneration III reactors

• The design of these advanced plants was based on the lessons learnedfrom Three Miles Island and Chernobyl accidents and is largely based on ay g yprobabilistic approach to safety

• They are a consistent step forward in the technology, extensively tested andreviewed by safety authorities through a ten years long process

• Two main types of plant design approach:– Evolutionary approach: improvement of redundancy and independence

of «standard» safety features (EPR from AREVA)– Alternate approach: extensive use of passive safety features to

t d f il d/ t (AP1000 fprevent common mode failures and/or operator errors (AP1000 fromWestinghouse)

Both types are currently under construction (4 EPR and 8 AP1000)– Both types are currently under construction (4 EPR and 8 AP1000)



NEW PLANTS: WHERE ARE WE GOING?

G ti III t i ifi t t f dGeneration III reactors: some significant steps forward

Improved Defense in Depththe containment system is designed to withstand core melt scenarios through:y g g

• retention & cooling of corium (in vessel or through core catcher)

• Hydrogen control (igniters and/or recombiners)

• Independent cooling systems (totally passive in the case of AP1000)p g y ( y p )

so ensuring independence towards other barriers

Lower risk of Total station BlackoutLower risk of Total station BlackoutThe Ap1000 has no need of diesels to withstand an accident: only batteries arerequired, with a capability of at least…….

Lower dependance on operator actionThe Ap1000 doesn’t require any operator action for 72 hours after an accident.



IS IT POSSIBLE TO DO BETTER?

G ti III t dd i f th f t i I d bGeneration III reactors are addressing many of the safety issues raIsed bythe Fukushima accident.

Acceptability requires reduced socio-economic consequences

There are at least two areas of improvement for the future:1. Better protection against natural hazards

• Probalistic approach to be extended to external events• «cliff edge» effects to be avoided, i.e. no sharp increase in

consequences for limited variations in the intensity of the phenomenon

2. Limited impact outside the fence• Improved containment performances in terms of radiological releases• Improved post accident monitoring/emergency management• Recovery strategies for extreme situations• Clear criteria for evacuation/sheltering measures

Thank you for your attention!

Technology

Roberto Adinolfi at CPExpo 2013, New Horizons for Nuclear Power Plants Safety