«Contents Executive Summary 1. General Data about the Barrow Site_ 1 1.1 Brief Description of the Site Characteristics 1 1.2 Use of PSA as part of the ...»
1. General Data about the Barrow Site___________________ 1
1.1 Brief Description of the Site Characteristics 1
1.2 Use of PSA as part of the safety assessment 3
2. Earthquakes ______________________________________ 4
2.1 Design Basis 4
2.2 Evaluation of Safety Margins 4
3. Flooding _________________________________________ 6
3.1 Design Basis 6
3.2 Evaluation of Safety Margins 6
4. Extreme Weather Conditions ________________________ 7
4.1 Design Basis 7
4.2 Evaluation of Safety Margins 7
5. Loss of Electrical Power and loss of ultimate heat sink _____________________________________________ 9
5.1 Loss of Electrical Power, Decay Heat Removal or Ultimate Heat Sink 9
6. Severe Accident Management ______________________ 10
6.1 Organisation and arrangements of the licensee to manage accidents. 10
6.2 Maintaining the containment integrity after occurrence of significant fuel damage (up to core meltdown) in the reactor core 11
6.3 Accident management measures to restrict the radioactive releases 12
7. General Conclusion _______________________________ 13 Executive Summary Introduction Following the accident at the Fukushima Nuclear Power Plant (NPP) the European Council declared in March 2011 that “the safety of all European Union nuclear plants should be reviewed on the basis of a comprehensive and transparent risk assessment (“stress tests”)”.
In June 2011 the UK Office of Nuclear Regulation (ONR) confirmed that the stress tests had been agreed by the European Nuclear Regulatory Group (ENSREG) and the European Commission.
ONR have confirmed that the scope of the NPP includes operational plant, plant under construction and shutdown plants where spent fuel is in operation. Nuclear activities at the Barrow site involve the construction, testing, commissioning and demonstration of Astute Class nuclear powered submarines and include the storage and transport of new nuclear fuel. The only radioactive material on site with the potential to cause a significant radiological hazard is the reactor fuel. On this basis, the scope of this document is limited to operations carried out on Astute Class submarines, and their fuel, by BAE Systems Marine Limited at the Barrow licensed site. Shutdown plant with spent fuel is not within the scope of operations at Barrow.
The Site Safety Justification (SSJ) has already demonstrated the ability of the Barrow site to safely accept environmental challenges within the current design basis envelope (i.e. events with nominal annual probabilities of 10-4 yr (1 in 10,000 per year)). The review revisited this demonstration but then focussed on more extreme (and less likely) levels of environmental challenges to the safety related structures, systems and components (SSC), including supporting services, that might give rise to a significant radiological hazard. The resulting potential scenarios, which are acknowledged as being highly unlikely (if not incredible), then formed the basis for an appraisal of the engineered provisions and management arrangements (including the Emergency Arrangements) for dealing with the consequences of such a challenge.
This report presents the Conclusions of the review by BAE Systems Marine Limited to satisfy the ENSREG requirements to the UK Office of Nuclear Regulation. The report has been specifically structured against the format defined by the ENSREG.
Some sections of this report necessarily contain information in an abbreviated form and with limited technical detail. This has been done in the interest of national defence and public security. The HSE have access to fuller, more detailed and classified information to enable them to satisfy themselves on the acceptability of this assessment.
Approach Although the events at Fukushima were initiated by a severe earthquake with a consequential tsunami, the review considered a wider set of potential challenges to nuclear safety at the Barrow site. To meet the overall objective, the review considered a number of
interrelated elements in the nuclear safety context:
Identification of key accident sequences potentially initiated by severe challenges.
Confirmation of the levels at which the design bases of the relevant challenges are set.
Extension of these challenges to beyond design basis levels, to consider their implications.
Identification from the above of a set of bounding accident scenarios, representative of the types of challenging situations that might conceivably arise on the Barrow site, for further review.
Review of these bounding scenarios, including:
Strategies and available timescales for recovery/repair.
o Review of the dependency on the off-site infrastructure and the means of o communicating with it.
Consideration of the need for enhancement of the independent on-site o essential services and supplies.
Consideration of the need for enhancement of the on-site infrastructure for o emergency control (including instrumentation and communications), taking account of the potential effect of the wider situation on site personnel.
The review recognised that the particular SSC and operations at the Barrow site differ from those at a civil nuclear power plant. Thus, a generic approach drawn up for the latter was not totally appropriate. The review was therefore specifically tailored to meet the above objective.
The review also recognised that a great deal of work has been carried out and reported on nuclear safety at the Barrow site. This work, embodied in the SSJ, and particularly in the Operational Safety Cases (OSCs), describes the operations carried out at the Barrow site, and describes and justifies the associated SSC and management arrangements to ensure that the nuclear risks from these activities are tolerable and as low as reasonably practicable (ALARP). This includes the substantiation/assessment of the relevant SSC against Design Basis hazards. In addition, a Hazard Identification and Risk Evaluation (HIRE) has been carried out as a basis for the emergency planning arrangements. The review did not aim to repeat any of this work but to build on it.
Conclusions The overall conclusion of the stress test is that the design basis for the Barrow site is robust and that the Barrow Operational Safety Cases remain valid. The site is not dependent on electrical supplies to maintain nuclear safety. For activities prior to initial criticality it is not credible that a seismic event and/or an extreme high water level, even at levels well above the site design basis, would lead to a radiation emergency. For activities following initial criticality the submarine is in its seagoing state and effectively isolated from extreme seismic events and water levels. The reactor plant is designed to be entirely independent of shore services with the Submarine crew onboard maintaining appropriate manning levels. Whilst naturally occurring hazards that could give rise to a radiation emergency have been considered as a requirement of the stress test specification, the associated accident sequences are not considered credible.
The review has however, recognised that there are a number of opportunities to enhance the resilience of the site, particularly in the area of emergency response arrangements. These have been identified as considerations for taking forward and will be subject to structured assessment and further review prior to commitment to implementation.
Over and above the information provided in this report, further details on the design of the Naval Reactor Plant and the adequacy of the associated safety justification can be obtained from the Ministry of Defence (MOD) who are the Approving Authority for the design of the Naval Reactor Plant.
1. General Data about the Barrow Site
1.1 Brief Description of the Site Characteristics BAE Systems Marine Limited Licensed Nuclear Site is located at Barrow-in-Furness – on the north-west coast of England.
Figure 1 – Location of Barrow-In-Furness The Company is contracted by the Ministry of Defence to build and commission nuclear submarines. The submarines are powered by a Pressurised Water Reactor (PWR), which is also assembled and commissioned at Barrow. The Reactor units are therefore at various stages of build over time and the review considered the full scope of activities from receipt of new fuel, assembly of fuel into a core, installation of the core into the submarine and test and commissioning of the finished reactor together with all other associated commissioning activities.
Commissioning of the Reactor for each boat occurs a few years apart and the full extent of reactor plant operation at the Barrow site is normally completed within a few weeks.
1.1.1 Description of the systems for conduction of main safety functions The Site Safety Case allows nuclear fuel for a number of cores to be on site at any one time. Only one reactor core is permitted in any one facility on the site at any one time.
Fuel modules are transported to the site and then stored and assembled into a reactor core before final installation onto the submarine. Following initial criticality the fuel becomes irradiated and fission products are created.
Operational requirements ensure that a submarine in its seagoing state can be entirely independent of shore services. The submarine contains a Pressurised Water Reactor to provide propulsion and electrical power supplies. A schematic of the main components of the Naval Reactor Plant is provided in Figure 2.
Figure 2: Simplified diagram of the primary and secondary circuits of the Astute Class Naval Reactor Plant This is a common design for all Astute Class submarines and there is never more than one operational reactor plant on site at any time. A brief description of the Naval Reactor Plant is given below.
The core is contained in the Reactor Pressure Vessel (RPV). Heat is generated by fission in the core. The heat generated in the core heats cooling water (primary coolant) passing through it. The Main Coolant Pumps (MCPs) circulate the primary coolant around the Primary Circuit to the Steam Generators. In the Steam Generators, heat is transferred from the primary coolant to generate steam in the secondary circuit. This steam is used to drive turbines and produce electricity and propulsion for the submarine. The heat sink to the main condenser is provided by the Main Circulating Water (MCW) system, drawing seawater from outside the submarine.
Basic control of the reactor is achieved by the movement of control rods. Complete insertion of the control rods is known as a SCRAM and shuts the reactor down. A SCRAM will be initiated automatically if the reactor protection system detects a transient taking the reactor control parameters outside of their set safe operating limits.
The Primary Circuit is pressurised by the pressuriser to prevent the primary coolant from boiling.
The whole of the Primary Circuit is housed in one compartment of the submarine, the Reactor Compartment.
To provide redundancy, the Primary Circuit consists of two loops, independently isolable via the Main Isolating Valves.
Additional cooling systems provide back-up for decay heat removal through a passive cooling regime. Radiation shielding is provided within the Reactor compartment for normal operation and accident conditions.
Containment Structures and Systems are designed to operate at various levels to restrict radioactive releases in progressive accident scenarios.
The key elements of the containment are:
The fuel cladding The integrity of the sealed primary circuit, its pipe work and components;
Containment boundaries built in to the submarine structure and pressure hull Automatic protection systems to isolate systems which penetrate containment boundaries
1.2 Use of PSA as part of the safety assessment All activities, from receipt of fuel on site up to its departure with the submarine, have been subject to the production and assessment of safety cases to modern standards. This includes a combination of quantitative and qualitative techniques to determine the safe operating envelope. Figure 3 provides an overview of the Safety Assessment process including the use of both Deterministic and Probabilistic Assessment.
Figure 3 – Safety Case Assessment Process
2.1 Design Basis 2.1.1 Earthquake against which the plants are designed A study carried out by Principia Mechanica Ltd has enabled the response spectra and synthetic time histories for horizontal and vertical motion to be developed from available world-wide earthquake data for regions with similar geological conditions and which are those used in the current UK seismic design approach. These spectra have been developed for hard, medium or soft ground conditions.
A seismic hazard assessment has been carried out for the Barrow site that shows that the response spectrum for medium ground conditions is conservative for the Barrow Site. Hence, the design response spectrum appropriate for medium ground conditions has, therefore, been adopted by BAE SYSTEMS Marine Ltd.
For the Barrow site, the Design Basis Earthquake (DBE) is therefore taken as an event with a return frequency of 10-4yr characterised by a Peak Ground Acceleration of 0.25g.
To demonstrate that there is no disproportionate increase in risk due to additional failures just beyond the DBE, potential ‘cliff edge’ effects are investigated for seismic loadings that are 40% above the Design Basis. For the Barrow site, the Beyond Design Basis Event (BDBE) is therefore taken as an event characterised by a Peak Ground Acceleration of 0.35g.
Once the submarine is afloat in Devonshire Dock the reactor plant is not directly affected by an earthquake. Therefore for commissioning activities, consideration focuses on SSC that could present a hazard external to the submarine.
2.1.2 Provisions to protect the plants against the design basis earthquake Definition of the provisions to protect the fuel and assembled reactor against a DBE is founded on a comprehensive identification of all potential external hazards. This has linked into the modern standards approach to the safety case assessment – see Figure 3. Any seismic hazards that can result in worker or public dose are included in the fault schedule to derive Safety Functional Requirements for safety assessment and consideration of ALARP.