TABLE OF CONTENTS

1........... The EU nuclear stress tests: Approach and Methodology.. 4

1.1........ The peer review process. 4

2........... Key recommendations from the safety assessments. 5

2.1........ Specific recommendations on external hazards. 5

2.2........ Specific recommendations on loss of safety functions. 6

2.3........ Specific recommendations on severe accident management 6

2.4........ Aircraft crashes. 6

3........... Key recommendations from the security assessments. 7

4........... More detailed transversal and generic results of the safety assessments  7

4.1........ Initiating events. 7

4.2........ Loss of safety functions. 10

4.3........ Severe Accident Management 12

5........... Summaries of Member State Stress Test Peer Review results. 16

5.1........ BELGIUM... 16

5.2........ BULGARIA.. 18

5.3........ CZECH REPUBLIC.. 19

5.4........ FINLAND.. 21

5.5........ FRANCE.. 23

5.6........ GERMANY.. 25

5.7........ HUNGARY.. 26

5.8........ LITHUANIA.. 28

5.9........ THE NETHERLANDS. 29

5.10...... ROMANIA.. 31

5.11...... SLOVAKIA.. 33

5.12...... SLOVENIA.. 34

5.13...... SPAIN.. 36

5.14...... SWEDEN.. 38

5.15...... UNITED KINGDOM... 39

6........... Summaries of Neighbouring Countries' Peer Reviews. 42

6.1........ SWITZERLAND.. 42

6.2........ UKRAINE.. 44

GLOSSARY.. 47

Annex 1: Summary Table. 49

1. The EU nuclear stress tests: Approach and Methodology

The stress tests were conducted according to a common methodology[1] along two parallel tracks:

· A Safety Track to assess how individual nuclear power plants can withstand the consequences of various unexpected events, ranging from natural disasters to human error or technical failure and other accidental impacts.

· A Security Track to analyse security threats and a methodology for the prevention of, and response to, incidents due to malevolent or terrorist acts. For the assessments under this second track, the Council set up the Ad-hoc Group on Nuclear Security (AHGNS).

Specifications on the safety track of the stress tests defined three main areas to be assessed: extreme natural events (earthquake, flooding, extreme weather conditions), response of the plants to prolonged loss of electric power and/or loss of the ultimate heat sink (irrespective of the initiating cause) and severe accident management.

· The safety assessments were organised in three phases:

· Self assessments by nuclear operators. Nuclear licensees were asked to produce reports to national regulators by 31 October 2011;

· Review of the self assessments by national regulators. National regulators reviewed the information supplied by licensees and prepared national reports by 31 December 2011;

· Peer reviews of the national reports, conducted in the period January – April 2012.

All national reports were submitted to the Commission within the agreed deadline.

1.1. The peer review process

In order to provide an objective assessment of the work done at national level and to maximise coherence and comparability, the national reports were subjected to a peer review process, organised in three phases:

– A desktop review phase where the 17 national reports were analysed by all the peer reviewers[2], who posed more than 2 000 written questions on the reports. The EU Stress Test secretariat run by the Joint Research Centre of the Commission opened a dedicated website to gather questions from the public for the peer reviews.

– A peer review related to horizontal topics, comparing the consistency of the national approaches and findings in three key areas: extreme natural events, loss of safety functions and severe accident management. The topical review meetings were organised at the Commission premises in February 2012, and involved around 90 experts. National teams were called in and asked to answer the questions posed in the desktop review phase. The result is summarised in 3 topical reports and 17 country reports for each participating country, with a list of remaining open questions for the ensuing country peer reviews.

– A vertical, individual review of each of the 17 country reports. The country peer reviews took place in March 2012 and included one NPP site visit in each country. As a result, the country reports were finalised, providing the basis – together with the topical reports – for the overall peer review Board report to ENSREG, which endorsed it on 26 April 2012[3].

The peer review teams were composed of nuclear safety experts from EU Member States, Switzerland, Ukraine and from the Commission, with observers from third countries (Croatia, USA, Japan) and the IAEA[4].

– A considerable effort was made, in terms of human resources, to analyse the safety of all NPPs and spent fuel storage facilities of all 17 countries in a short time. In each of the 17 countries the review team has conducted a NPP visit. The total number of reactor units on the sites visited during the originally scheduled visits in March 2012 was 43 (approximately 30% of all the units in operation). The plant visits confirmed the prior analyses and in some cases have led to additional recommendations.

Additional visits were performed to eight reactor sites by the peer review teams in September 2012, in order to gain additional insight on different reactor types, to discuss implementation of the identified improvements and in order to alleviate concerns relating to installations in areas bordering other Member States. Thus, all operating reactor types in Europe have been visited by peer reviewers.

All reports, including the licensee reports have been made available on the ENSREG website.

2. Key recommendations from the safety assessments

The key considerations for each topic are summarised in the following sections.

2.1. Specific recommendations on external hazards

· The technical design and operation of plant must be able to deal with unforeseen external hazards (e.g. earthquake, flooding, extreme weather and accidents) and external events, unexpected events which were not planned for in the original design (beyond design margins).  

· On-site seismic instrumentation should be in operation at each NPP.

· As a good practice, the use of a ‘hardened core’ of safety-related systems, structures and components capable of withstanding earthquakes and flooding significantly beyond design basis should be considered.

2.2. Specific recommendations on loss of safety functions

This depends on the specific reactor design, but in terms of safety margins, Station Black-Out (SBO, i.e. total loss of AC power), which can lead to core heat-up within 30-40 minutes, depending on the reactor design, is the key risk. Therefore, the following should be readily available under even the most extreme conditions:

· a variety of mobile devices (such as mobile generators, mobile pumps, mobile battery chargers or mobile DC power sources, fire-fighting equipment, emergency lighting, etc.).

· the availability of alternative means of cooling;

· specialised equipment and fully trained staff to deal effectively with events affecting all the units on one site.

2.3. Specific recommendations on severe accident management

· Recognised measures to protect containment integrity should be urgently implemented.

· Comprehensive Severe Accident Management Guidelines (SAMG's) should be developed. Periodic validation of SAMG's is essential for ensuring their practicability, robustness and reliability.

· SAM arrangements need to be enhanced, including the methods and tools for SAM training, and exercises should include the suitability of equipment, instrumentation and communication means.

· On-site emergency centres should be available and designed against impacts from extreme natural.

· Radiation protection of all staff involved in severe accident management and emergency response must be ensured.

· Where emergency equipment is stored centrally, it must be stored in locations that are safe even in the event of general devastation, and where it can be quickly supplied to the relevant NPP site.

2.4. Aircraft crashes

Aircraft crashes have not been considered explicitly as an initiating event in the safety assessments. However, the stress tests have to a considerable extent covered the indirect effects of airplane crashes through the thorough work undertaken on station blackout and loss of plant cooling.

The national reports of Belgium, Germany, Slovenia and the Netherlands mention that the scope of the stress test has been extended to aircraft crashes. Further information on these countries is presented in the corresponding country sections.

3. Key recommendations from the security assessments[5]

The final report of the Ad Hoc Group on Nuclear Security[6] presents conclusions on the five themes discussed, namely physical protection, malevolent aircraft crashes, cyber-attacks, nuclear emergency planning, and exercises and training. It also contains several recommendations to the Member States in order to strengthen nuclear security in the EU. It highlights in particular:

· the importance for the Member States which have not yet done so to complete the ratification of the amended Convention on Physical Protection of Nuclear Materials;

· the added value of IAEA's guidance and services, including IPPAS[7] missions on a regular basis in all Member States having nuclear power plants;

· the importance of a regular and close cooperation between Member States and with neighbouring countries and

· the necessity to define modalities and fora for the continuation of EU work on nuclear security.

4. More detailed transversal and generic results of the safety assessments

The following transversal and generic issues can be highlighted. A comprehensive description of the situation can be found in the final peer review report, national reports and the peer review reports.

4.1. Initiating events

Stress test results clearly indicate that particular attention needs to be paid to periodic safety reviews as a powerful tool to regularly reassess plant safety. The stress tests have confirmed that all the 17 participating countries perform periodic safety reviews at least every 10 years, including a reassessment of the external hazards (currently unless it can be demonstrated that there was no significant hazard evolution since the last reassessment). External hazards (e.g. earthquake, flooding and extreme weather) and robustness of the plants against them should be reassessed as often as appropriate but at least every 10 years.

Generally the approach to demonstrate an appropriate design basis is sound. All plants need to be reviewed with respect to external hazard safety cases corresponding to an exceedance probability of 10-4 / year (with a minimum peak ground acceleration of 0.1 g for the seismic hazard).  Setting up an international benchmark exercise to evaluate the relative strengths and weaknesses of probabilistic and deterministic hazard assessment methods for external events is recommended.

Almost all countries consider for Design Basis Earthquakes an earthquake with an exceedance probability of 10-4 / year as a minimum. The Stress tests results point out nevertheless specific cases:

– In France, no probabilistic seismic hazard assessment (PSHA) is used except for 3 plants (Saint-Alban, Flamanville and Civaux). The peer-review recommended to the regulator to introduce Probabilistic Seismic Hazard Analysis in France for the design basis of new reactors and for future revisions of the seismic design basis of existing reactors in order to provide information on event probability (annual frequency of occurrence) and to establish a more robust basis for DBE specifications.

– In Romania, analyses showed that the exceedance probability associated to the DBE was 10-3 / year. The Design Basis is considered to be consistent with the minimum levels in international standards but not with current practices in Europe. Margins have however been demonstrated beyond the Design Basis, using a review level earthquake (RLE) with a PGA of 0,33 g and upgrading this by a screening level of 0.4 g (corresponding to an exceedance probability of 5.10-5/year) for safety relevant Structures, Systems and Components on the safe shut down path.

Almost all countries consider for Design Basis Flood a flood with an exceedance probability of 10-4 / year as a minimum. The Stress tests results point out nevertheless specific cases:

– In Belgium, the Tihange site is currently protected by its design against a reference flood with a statistical return period up to 400 years. However, the reference flood with a statistical return period up to 10,000 years will be implemented as a new DBF and associated protection measures are foreseen.

– In France, the design basis flood is defined considering statistical extrapolations limited to 10-3 / year supplemented by a margin or a conventional combination. France stated that the current state of the art in flood level calculations does not allow calculating, with a sufficient confidence, 10-4 / year levels, except in some specific conditions such as "small catchments areas - up to some 1000 km2". The Peer-review therefore recommended performing a comparative evaluation with the methodologies used in other European countries.

– In the Netherlands, the Borssele site is protected against flooding by the network of dykes in Zeeland. This network will be improved to comply with the legal requirements of 4000 year return period. The reinforcements will include margins in order to guarantee the legal safety standard also in the future. Therefore, the protection provided by the levee after the reinforcement should be higher (against events with a return period of 10,000 years).  However, the Peer-Review recommended examining thoroughly the consistency of this approach with the new IAEA guidance (SSG-18).

Almost all countries consider 0.1 g as the minimal level of PGA to be considered for the Design Basis Earthquake, except Germany, Lithuania and the Netherlands. It should be mentioned however that the nuclear reactors have been shut down in Lithuania and that the existing and new spent fuel store facilities are designed to be capable of withstanding this recommended level of seismic event. Moreover, as for the Netherlands, the new seismic analysis to be conducted within the PSR of Borssele in 2012 will consider a PGA value of 0.1g at free field for the DBE, as per IAEA guidance.

The evaluation of beyond design basis margins for earthquakes and flooding is not consistent in participating countries. A few countries have quantified the inherent robustness of the plants' beyond the design basis up to cliff edge effects, whereas the majority have made only a general claim that sufficient safety margins exist and therefore there is no verifiable information on the basis of which to consider effective potential improvements.

A number of possible means to increase the robustness of NPPs against external hazards has been identified during the stress tests. Among these, the following can be mentioned:

– the protected volume approach (flood protection of building containing safety significant systems and components), used at least to some extent in CH, FR and NL.

– the use of a bunkered or ‘hardened core’ of safety-related systems, structures and components capable of withstanding earthquakes and flooding significantly beyond design basis can be mentioned. This is currently used namely in BE, CH, Finland (only for Loviisa) and DE, planned to some extent in SI and requested to be implemented in FR.

Additional guidance on natural hazards assessments, including earthquake, flooding and extreme weather conditions should be developed, as well as corresponding guidance on the assessment of margins beyond the design basis and cliff-edge effects.

Regulators and operators should consider developing standards to address qualified plant walk-downs with regards to earthquake, flooding and extreme weather to provide a more systematic search for non-conformities and correct them (e.g. appropriate storage of equipment, particularly for temporary and mobile plant and tools used to mitigate BDB external events).

The design for storage of mobile equipment to perform necessary safety functions should take account of external events at the design and beyond design levels, to ensure appropriate availability in the event of being required following a significant external event.

The Peer-Review observed namely that mobile diesel generators should be adequately protected for beyond design basis earthquake in Kozloduy (BG). Similar observations were made in the Czech Republic and in Slovakia where the fire brigade buildings should be reinforced to withstand BDBE. Moreover, it was noted in the Netherlands that storage facilities for portable equipment, tools and materials needed by the alarm response organization that are accessible after all foreseeable hazards would enlarge the possibilities of the alarm response organization.

Seismic monitoring systems should be installed and associated procedures and training developed for those NPPs that currently do not have such systems. On-site seismic instrumentation should be in operation at each NPP. Currently, there is no on-site seismic instrumentation yet in Dukovany NPP (CZ), Brokdorf, Brunsbüttel (permanent shutdown) and Krümmel (permanent shutdown) NPPs (D), Borssele NPP (NL) and in all Ukrainian NPPs. The installation of on-site seismic monitoring is planned in each of these sites. A study to investigate the overall cost-benefit and usefulness of automatic reactor shutdown induced by seismic instrumentation is recommended.

Advance warning of deteriorating weather is often available in sufficient time to provide the operators with useful advice and national regulators should ensure that appropriate communications and procedures are developed by all operators. In Sweden in particular, the Peer Review recommended that early warning systems, as well as relevant operating procedures in case of extreme weather conditions, should be implemented at all sites.

4.2. Loss of safety functions

All the countries estimated the cliff-edge effects related to various combinations of losses of electrical power and/or cooling water, and the time available before safety functions need to be restored. In terms of safety margins, Station Black-Out (SBO, i.e. total loss of AC power) is the limiting case for most reactors. For most reactor designs, SBO would typically lead to core heat-up after around 1-10 hours if no countermeasures were implemented. For ASEA/ABB Boiling Water Reactor (BWR) designs without steam driven systems or emergency/isolation condenser, SBO leads to core heat-up within 30-40 minutes (using conservative assumptions). These reactors are Olkiluoto 1 & 2 (FI) and Forsmark 1 & 2 (SE), which have their core cooling systems electrical driven. According to the Swedish regulator, this weakness was, however, identified in the original design and redundant emergency power supply trains were consequently introduced via four emergency diesel generators or a combination of two emergency diesel generators and gas turbines. Numerous improvements related to hardware and procedures have been identified; some have been implemented and others are still at the planning stage. It is recommended to ensure in all plants that the time available is sufficient to allow safety function restoration, with adequate margin and not relying on organisational measures only.

The loss of Ultimate Heat Sink (UHS) and alternate heat sink was not identified as a cliff edge effect at any plant design in EU, CH and UA. NPPs typically have several redundant and diverse cooling options to ensure a minimum heat sink for 72 hours, provided that electrical power supply is available. The volume of cooling water available on site that ensures heat removal from essential consumers is not less than 6-8 days.

To increase the robustness of the ultimate heat sink function, it is strongly recommended to identify and implement also alternative means of cooling. The term “alternate UHS” was interpreted differently in several countries. Most countries considered a diverse source of cooling medium (water from ponds, wells, water table, etc.) as an alternate UHS, but some countries also considered secondary or primary feed-and-bleed into (ultimately) the atmosphere. To cope with losses of the main ultimate heat sink, all plants have a variety of design features that can be used to some extent; this includes multiple (and large) reserves of water on site e.g. dedicated tanks (seismic proof), large capacity pools (e.g. with spray-based heat removal from essential service water system), dedicated wells (with own, independently powered pumps) as well as arrangements to obtain water from rivers, nearby lakes or the sea (using tank trucks or fire hoses).

For multi-unit sites, robustness could be enhanced if additional equipment and trained staff are available to effectively deal with events affecting all the units on one site. At most multi-unit sites, an accident simultaneously occurring at several units was not considered in the original design. For multi-unit sites, robustness could be enhanced if additional (to the existing) equipment and trained staff are available to effectively deal with events affecting all the units on one site. This recommendation is currently analysed and measures will be implemented at all NPP sites in EU, CH and UA.

All plants confirmed that they already possess or are in advanced process of acquiring a variety of mobile devices including skid/trailer based diesel generators and diesel-driven pumps, dedicated fire trucks, etc. including the connection points and procedures on how to engage mobile units. Nevertheless, a systematic selection of and acquisition of the equipment that would provide a variety of power and pressure levels and that is safely stored on-site and/or offsite still needs to be done. The transport, simple and fast connection of the mobile equipment including its proper functioning (considering fuel supply, independence but also organization and procedures) shall be assured by appropriate, plant and site centric design and regular testing after installation. Mobile battery chargers or mobile DC power sources are already installed at Cernavoda NPP (RO) and Kozloduy NPP (BG) and ensure DC power for SBO consumers by recharging station batteries via small diesel generators, or even back-up station batteries have been installed at Paks NPP (HU) which allow extended use of instrumentation and controls. Fire-fighting equipment, including fire trucks, diesel pumps, generators, emergency lighting, etc. is normally readily available at the plants.

Operational or preparatory actions such as ensuring the supply of fuel and lubrication oil, battery load-shedding to extend battery life are examples of measures that are small (in many cases procedural) but that could make a considerable difference in response to initiators. All in all, most of the plants have already considered these measures and might be adding to them in the future.

Within the stress tests evaluation the bunkered system, qualified to anticipated external events, are equipped with independent diesel driven pumps and water storage to ensure heat sink, and electrical power supply to vital consumers via stand-by small emergency diesel generators, batteries, and diesel-driven pumps for at least 24 hours. Bunkered systems are already installed as a standard design feature at German pre-Konvoi and Konvoi NPP design (i.e. in all plants operating these reactor design in DE, NL, and ES), as well as in all NPPs in CH and with some degree also at NPPs in BE. Bunkered system proved its worth in ensuring an additional level of protection after the external events, able to cope with a variety of initiators, including those beyond the design basis. It provides back up to ordinary stand by systems (e.g. emergency diesel generators) to ensure fulfilment of safety functions even if all stand by safety related equipment is lost. The concept is taken even further in the form of the "hardened core" where in addition to equipment, trained staff and procedures designed to cope with a wide variety of extreme events will be available.

4.3. Severe Accident Management

PSR should continue to be maintained as a powerful regulatory instrument for the continuous enhancement of defence-in-depth in general, and the provisions of SAM in particular. The lessons learned from the Fukushima accident and from the stress tests should be reflected in the scope of future PSRs.

In response to their previous commitments, regulators should incorporate the WENRA reference levels related to SAM into their national legal frameworks, and ensure their implementation as soon as possible. Regarding Emergency Operating Procedures (EOPs) and Severe Accident Management Guidelines (SAMGs), utilities from only a few countries have developed these procedures/guidelines for all power conditions (Belgium, Slovenia, Sweden, the Netherlands, France for the 900 MWe reactor series, and Switzerland). In Hungary, EOPs and SAMGs are developed for all plant states but the associated hardware modifications are still needed in units 2 to 4 to complete implementation. In most of the other countries, utilities have developed EOPs for power and shutdown states but SAMGs cover only power state (e.g. in Bulgaria and Czech Republic). In a few countries like Germany or Spain the development of a more comprehensive and systematic set of SAMGs is still on-going for some Plants. Ukraine has only EOPs for power states available at the moment but is engaged in a program to complete EOPs for shutdown states and to develop SAMGs for all power states. In the UK, it appears that EOPs and SAMGs need further development to be in line with international Standards.

Effective implementation of SAM requires that adequate hardware provisions are in place to perform the selected strategies.

On top of RCS depressurisation systems, Passive Autocatalytic Recombiners (PARs) and containment Filtered Venting System discussed separately, several other hardware provisions are already installed or will be installed in the different NPPs concerned by this review. The main ones are listed below:

– Additional Diesel Generators (or Combustion Turbines) physically separated from the normal DGs and devoted to cope with SBO, external events or severe accident situations are already installed on the different NPPs in Germany, the Netherlands, Belgium, Finland, Hungary, Romania, Spain, UK, France, Sweden and Switzerland.

– Mobile equipment especially Diesels Generators are already available on the different NPPs in many countries, such as Belgium, Lithuania, The Netherlands, Romania, Bulgaria, Slovenia, Hungary, and Sweden or are under implementation in many others such as Slovakia, and Czech Republic.

– In some countries, centralised storage of emergency equipment has been set-up, shared among several NPP sites. This is for example the case in the UK, DE and CH. And this will be implemented in Spain and in France (as part of the Rapid Action Force which will be put in place). The regulatory Body from Czech Republic has also proposed to establish common (regional) emergency response arrangements for neighbour countries operating similar reactors.

– In most of the countries the instrumentation and communication means have been qualified for Design Basis Accidents but further investigations are needed to ensure the availability of these equipment during a Severe Accident especially concerning power supply and survivability under external events and harsh conditions.

The means for maintaining containment integrity should in particular include depressurization of the reactor coolant system, prevention of damaging hydrogen explosions, and means of addressing long-term containment over-pressurization, and minimze long-term off-site contamination, such as by means of filtered venting.

All plants foresee the depressurization of the primary circuit with existing design features. For example, Czech Republic, France, Finland and Sweden have implemented additional measures for depressurization of the primary system, such as installation of additional hardware (lines and specific valves). Slovakia is currently implementing, and Slovenia has scheduled implementing similar measures. France has planned the reinforcement of the operability of existing equipment by fixed or mobile supplies.

Most of the plants have measures to prevent hydrogen explosions in place. Older operating BWR plants in Switzerland (Mühleberg), Germany, Spain (Santa María de Garoña), Finland (Olkiluoto 1 and 2), and Sweden (Oskarshamn 1, 2 and 3, Forsmark 1, 2 and 3, and Ringhals 1), and Cernavoda 1 CANDU (Romania) have their containments inerted with nitrogen. Newer, larger BWR plants like Leibstadt (Switzerland) and Cofrentes (Spain), and Cernavoda 2 CANDU (Romania) have ignitors. Of these, only the Gundremmingen B and C have additionally Passive Autocatalytic Recombiners (PAR), although Santa María de Garoña, Cofrentes and Cernavoda (both units) have plans to install them, and Leibstadt is evaluating long term hydrogen management. Most of the non-inerted light water reactor containments have reinforced the measures to prevent hydrogen explosions during accidents by the installation of Passive Catalytic Recombiners (PAR). The PARs installed in Bulgaria, Czech Republic, United Kingdom (Sizewell B) and Ukraine (Rivne and Khmelnitsky) were designed for DBA, and have not been proven to mitigate hydrogen explosion risks in severe accidents. Slovenia has active hydrogen recombiners which will be replaced in 2013 by PARs designed for BDBA. Studies or plans to install additional PAR as needed to cope with hydrogen risks in severe accidents are under way in these countries. The countries that have not installed PAR in all their PWR plants: Spain, (PARs only in Trillo), and Ukraine, have also plans to install them. The rest of the PWR plants have PAR capable of coping with the risk of hydrogen generation during severe accidents. Although it has been recognized that the risk of hydrogen explosions in the UK gas cooled reactors is not a sensitive issue, further studies regarding generation of combustible gases are under way.

Hungary, Slovakia and Ukraine do not have any plan or schedule with regard to implementing filtered venting of the containment. Czech Republic, Spain and United Kingdom are in different stages of the process of considering the implementation of containment filtered venting, Belgium has included it in the long term operation project for its older plants (Doel 1 and 2, and Tihange 1), and studying its installation in the newer plants, while Romania has a schedule to implement it. The remaining countries have already filtered venting infrastructure installed to avoid pressure build-up in the containment and minimize long-term off-site contamination.

A systematic review of SAM provisions should be performed, focusing on the availability and appropriate operation of plant equipment in the relevant circumstances, taking account of accident initiating events, in particular extreme external hazards and the potential harsh working environment.

In the frame of this Stress Tests exercise, a systematic review of SAM provisions (organization, staffing, hardware, SAMGs, etc.) has been performed by the different participants, focusing on the availability and appropriate operation of plant equipment in the relevant circumstances, taking account of accident initiating events, in particular extreme external hazards, potential harsh working environment, need to work with a severely damaged infrastructure (i.e. in which the usual means of communication and access, etc. are disabled), at plant level, corporate-level and national-level aspects, and of long-duration accidents affecting multiple units at the same time (on individual and nearby sites as appropriate). These studies are still on-going in most of the countries to finalize the most adequate SAM provisions to be put in place.

The assessment of SAM provisions should take account of the need to work with a severely damaged infrastructure (i.e. in which the usual means of communication and access, etc. are disabled), of plant level, corporate-level and national-level aspects, and of long-duration accidents affecting multiple units at the same time (on individual and nearby sites as appropriate).

The SAMGs should be comprehensively validated taking due account of the potential long duration of the accident, the degraded plant and the surrounding conditions. All countries that have developed SAMG have validated them in terms of feasibility of the potential strategies, but it is not clear in all cases that the validation has considered explicitly the potential long duration of the accident and the existence of degraded conditions. In such cases, the countries have declared their intention of extending the validation of the SAMG with the inclusion of the potential long duration of the accident, and the presence of degraded conditions (for example due to extreme external hazards). Pre-planned SAM actions should be designed to function effectively and robustly for suitably lengthy periods following the initiating event. In most cases, durations of at least several days should be assumed for planning and assessment purposes.

Training and exercises aimed at checking the adequacy of SAM procedures and organisational measures should include testing of extended aspects such as the need for corporate and national level coordinated arrangements and long-duration events. All countries that have implemented the SAMG carry out periodic training and exercises to check the adequacy of SAM procedures and the adequate co-ordination among the involved organizations. The level of detail and scope of this training is diverse among the participating countries, and all plan to enhance it to take into consideration the improvements of the SAM strategies and of the Emergency Organisations. It is worth mentioning as good practice the very complex exercise organized by NL, which includes all involved emergency organizations, with more than 1000 participants, and the real time SAM drills with simulator carried out by Slovenia, which can take several days.

When developing SAM action plans, conceptual solutions for post-accident fixing of contamination and the treatment of potentially large volumes of contaminated water should be addressed.

Radiation protection of operators and all other staff involved in the SAM and emergency arrangements should be assessed and then ensured by adequate monitoring, guaranteed habitability of the facilities (hardened on-site emergency response facility with radiation protection) needed for accident control, and suitable availability of protective equipment and training.

On-site emergency centres should be available and designed against impacts from extreme natural and radiological hazards.

Main Control Rooms (MCR) of the plants have been designed against Design Basis Accidents. In case the Main Control Room becomes inhabitable as a consequence of the radiological releases of a severe accident, of fire in the MCR or due to extreme external hazards, all plants have a backup Emergency Control Room (ECR) except OL1&2 in Finland (where planning is underway to develop such a facility) and the AGRs and Magnox reactors in UK (except Heysham 2 and Torness). The countries have evaluated or are evaluating whether the MCR and ECR can withstand the consequences of a severe accident (especially in case of accident affecting several units at the same time) and extreme natural hazards. Most of the countries have already proposed additional measures to improve MCR and ECR habitability in case of severe accidents.

Additionally, some plants have on-site emergency control centres from which the emergency response activities can be co-ordinated in case of Severe Accident. As an example, the emergency control centres of all the plants in Finland, Germany, Hungary, Sweden, Lithuania, Bulgaria and Ukraine are well prepared against radiological and extreme natural hazards. The rest of the countries have found out that their on-site emergency centres of facilities from which the emergency activities are coordinated need to be improved to withstand extreme external hazards or radiological conditions. All of these countries plan to reinforce their existing on-site emergency centres, or to build new ones. As an example, the Krško NPP's emergency control center is well designed against external hazards and equipped for long-term habitability, but lacks the adequate radiological protection in case of BDBA. A new emergency control center that will be protected against BDBA and all external hazards will be built by the end of 2015.

Although PSA is an essential tool for screening and prioritizing improvements and for assessing the completeness of SAM implementation, low numerical risk estimates should not be used as the basis for excluding scenarios from consideration of SAM especially if the consequences are very high.

5. Summaries of Member State Stress Test Peer Review results

Note: a more comprehensive description of the situation can be found in the national reports and the peer review reports.

5.1. BELGIUM

Note: Stress tests in Belgium cover also nuclear facilities other than operating NPPs (fuel fabrication plant, waste treatment and storage facilities, radioisotope production facility, research centres), and include man-made events (terrorist attacks, aircraft crash, cyber-attack, toxic and explosive gases, blast waves) and security related aspects. The assessment of these man-made events was however developed in a separate national report which was not part of the peer review exercise.

Recommendations:

- It is recommended that the regulator monitors the completion of the updated probabilistic seismic hazard analysis (PSHA), the implementation of the consequential measures and the updated assessment of safety margins. These updates may benefit from a harmonization of the seismic hazard assessment on an international level with neighbouring countries, in order to avoid discrepancies for sites with comparable seismic activity.

- Taking into account the relatively low safety margins with regards to flooding over a period of 10 000 years and the reconsideration of design basis flood (DBF) values at the Tihange site, it is recommended to focus on the implementation of all safety improvements proposed by the licensee, as well as those prescribed by the regulator. For the Doel site, it is recommended to the regulator to monitor the implementation of the measures proposed in the licensee’s action plan.

- The design parameters for extreme weather conditions are mainly based on historical data, and therefore, on a return period in the order of 100 years. The derivation of design basis parameters with 10,000 years return periods is recommended to be considered.  Attention should be also paid to extreme temperatures.

- In case of design basis earthquake (DBE), the autonomy of the emergency diesel generators (EDGs) of the 2nd level safety systems at the Tihange 1 is only 7.5 hours (the capacity of their seismically qualified fuel tanks is the limiting factor). It is recommended to take into consideration the benefits of increasing the autonomy of these EDGs at Tihange 1 for events determined by DBE.

- The preliminary study for the filtered venting system on each unit to be finished in 2012 should consider sub-atmospheric pressures in the containment.

- Regardless of the outcome of the assessment of the residual risk of hydrogen generation and accumulation in the spent fuel pool (SFP) buildings, the installation of Passive Autocatalytic Recombiners (PARs) in the SFP should be considered.

- The additional measures to increase the consistency of the emergency training and refresher training programs at the Tihange and Doel NPPs should be broadened to the total concept of severe accident management (SAM) (hardware provisions, procedures and guidelines) as much as possible.

Good practices:

- Multiple external power supply links (two independent power supplies).

- Underground cable 6.6 kV lines (after transformers) linking 150 kV on-site sub-stations with the units at both sites.

- Two-level redundant safety systems, including in particular: 1st and (bunkered) 2nd level emergency diesel generators and power supply systems, seismically qualified for all units at both sites (with the exception of the 1st level diesel generators (DGs) in Doel 1/2, which will be completed by mid-2012).

- Auxiliary feedwater turbo-pumps (in each unit).

- Emergency steam-driven turbo-alternator (Tihange 1).

- Primary and alternate ultimate heat sink (UHS) available at both sites.

- Diverse other water sources (including unconventional) and inter-connection possibilities available at the plant sites.

- Many non-conventional means (NCMs - mobile/portable equipment) are available, including mobile diesel-driven pumps and mobile diesel generators, and their connections are already implemented (for electrical power and water supply).

- Long autonomy of AC power sources and batteries.

- The integration of the non-conventional means into the accident management procedures and SAMG and benchmarking it with US NRC Extensive Damage Mitigation Guidelines.

Safety improvements implemented or planned (non-exhaustive list):

- Performing more detailed seismic hazard studies.

- Enhancing external power supply reliability in the Tihange NPP through a better separation of  the high-voltage  (380 and 150 kV) lines.

- Increasing the capacity of auxiliary feedwater tank and adding a motor-driven pump in Tihange 1.

- Solving the problem of refilling the primary circuit during mid-loop operation and with primary system open in case of the total SBO in Tihange 3.

- Modifying the spray system in order to achieve an alternative spraying flow with a mobile spraying pump at Doel 3 & 4 units.

- Performing seismic qualification of the refuelling water storage tanks at Doel 1/2.

- Enhancing protection against external hazards (earthquake, flooding, weather conditions) of the following areas:

· At the Doel NPP, the construction of a new seismically qualified building which is also protected against flooding, is planned; this building will be used as a location for storage of NCM (including fire trucks) that are expected to ensure the safety function in case of extreme external hazards.

· Performing seismic upgrade of the AFW-turbo pumps and their tanks at Doel 1/2.

· Assessment of strengthening the electrical building of Tihange 1 unit

· Improving volumetric protection of the Tihange site, and the reinforcement of the river embankment of the Doel site.

· Enhancement anti-flood protection measures at Tihange, in particular its emergency power supply systems, assuming the 10 000 year recurrence frequency type of flooding (to prevent the loss of safety functions).

- Improving the following power supplies:

· Alternative power supply (380V) for non-conventional means or safety equipment

· Alternative power supply (380V) for rectifiers; this measure ensures the possibility to recharge the batteries before their total depletion during an SBO event

· Introduction of a procedure for minimizing the diesel generators fuel consumption

· Purchase of a fuel tanker truck for the on-site transportation of diesel fuel (Doel)

- Constructing a new demineralized water production circuit at the Tihange site.

- Ensure procedures take into account events such as loss of the primary UHS affecting more than one unit, total SBO, and load shedding to increase the batteries autonomy. Enhancing the organization and logistics of the internal emergency plan to include “multi-unit” events.

- Implementing continuous measurement of water level in SFPs in the Tihange NPP units where this is not in place yet.

- Improving SAMG with decision support tools, long term monitoring and exit guidelines.

- Adapting strategies for flooding reactor pit before reactor vessel rupture.

- Installing additional instrumentation (e.g. pH sump, bottom reactor vessel) and identifying effective means to control pH inside containment.

- Applying specific provisions (maintenance, inspections, testing) to non-conventional means credited in analyses.

5.2. BULGARIA

Recommendations:

- Adequacy of paleoseismological studies should be further analysed throughout the periodic updates of the seismic PSA and in the PSR, on the basis of the information available and verified, to evaluate the need of re-assessment of the seismic hazard on site.

- Implementation of the complementary improvement measures for beyond design basis conditions identified in the Action Plan (such as improvement of the leak tightness of certain rooms below ground level) should be monitored. 

- A combination of extreme weather conditions still needs to be considered.

- Although the batteries have 10 hours discharge time, a possibility of their recharging from a mobile DG should be considered.

- Concerning SAM, there is still an open issue under which conditions is the implementation of different SAM measures feasible, e.g. due to possible lacking some hardware provisions for mitigation of severe accidents. It is recommended that additional improvements for SAM covered by the “Program for Implementation of Recommendations Following the Stress Tests Carried out on Nuclear Facilities at Kozloduy NPP plc.” is pursued.

Good practices:

- During the country visit it was noticed that periodic and frequent walk downs on SAMGs provisions are performed, this is considered as a good practice.

Safety improvements implemented or planned (non-exhaustive list):

Some examples of measures for improvement of plant robustness related to the two operating units 5 & 6 at Kozloduy NPP are, as follows:

- Studying the possibilities for alterative options for Units 5 and 6 decay heat removal using the existing SG emergency makeup system (EMS) of Units 3 and 4.

- Securing the availability of at least one tank of the SG Emergency Feedwater System in shutdown mode in order to provide for the use of the SG as an alternative for the residual heat removal.

- Two new mobile DGs will be delivered, and the existing one will be maintained in standby conditions for the remaining structures at the NPP area; Power supply from a mobile DG is provided for charging the accumulator batteries of the safety systems.

- Implementation of the symptom based EOPs for the shutdown states with open reactor, and implementation of SAMGs.

- Development of technical means for direct water supply to the steam generators, SFPs and the containment using mobile fire equipment.

- Installation of additional hydrogen recombiners in the containment.

- Installation of instrumentation for monitoring of steam and oxygen concentrations in the containment, and for monitoring the temperature in the reactor vessel

- Updating on-site and off-site emergency plans, taking into account (a) difficulties in accessing the emergency control rooms of Units 5+6; possible drying out of the SFS basin compartments, with subsequent increase of dose rates; and (c) providing alternative routes for evacuation, transport of fuels and materials and access of staff.

- Construction of a new Emergency Management Centre, outside the Kozloduy site.

5.3. CZECH REPUBLIC

Recommendations:

- The reviewers recommend the regulator to consider the implementation of diverse ultimate heat sink at Dukovany NPP due to inadequate capability of the cooling towers in regard to hard wind and seismic hazard.

- The reviewers recommend the regulator to consider the qualification of equipment and systems needed to manage SA, especially system ensuring power supply like hydro power plant connection, diesel generators.

- The reviewers recommend the regulator to consider modifications on emergency procedures, staffing of emergency response organization and analysis's regarding the usability of the shelter under flooding conditions.

- The reviewers recommend the regulator to consider increasing the protection of diesel fuel pumps against flooding effect at Temelin NPP.

- The battery autonomy is currently an issue that needs to be addressed at all operating NPP designs. The reviewers recommend the regulator to consider the benefits of recharging the batteries before their complete depletion in case of total SBO in addition to ensuring the depletion time / battery capacity increase.

- The reviewers recommend the regulator to consider studies of using a filtered venting system to protect the containment against loss of integrity and to reduce significantly the releases of radioactivity to the environment in case of severe accidents, as the current system is not designed for severe accident conditions.

- The reviewers recommend the regulator to consider studies on hydrogen management considering reactor and SFP building and the installation of additional re-combiners sufficient for severe accident conditions at Temelin and Dukovany NPPs.

- Mid-loop operation at Temelin NPP is a critical issue in case of SBO. The licensee announced that it eliminates the mid-loop mode of operation from the regular outage schedule. The reviewers recommend the regulator to follow up the announcement.

- The reviewers recommend the regulator to consider increasing of the plant robustness by implementation of alternative means for AC power supply for core cooling and heat removal.

Good practices:

- The proposal by the regulator to establish common emergency response arrangements for several neighbouring countries.

Safety improvements implemented or planned (non-exhaustive list):

- Finalization of safety upgrading to the currently approved design Basis Earthquake by the end of 2015 for Dukovany NPP.

- Upgrading of fire brigade building for seismic resistance.

- Discussions of further hardware implementation to cover severe accident (primary circuit depressurization, hydrogen management for severe accident, containment isolation).

- Installation of connection points for water supply from fire brigade pumps.

- Improvement and finalization of EOPs and SAMGs including shutdown states, open reactor, SFP and multi-unit accidents. Further analysis of the impact of damage of the infrastructure.

- In particular, the following measures indicated in the national report have to be implemented:

· alternative containment sump water make up (Temelin)

· selection and implementation of appropriate solution for protecting containment from the overpressure loads

· providing mobile (portable) equipment for ensuring feasibility of the SAM actions

· increase robustness of storage building structures for mobile devices including fire trucks, or relocation of equipment

· implementation of ex-vessel cooling at Dukovany NPP

· analysis of molten core cooling in Temelin NPP

· installation of additional re-combiners sufficient for severe accident conditions at Temelin and Dukovany NPPs.

5.4. FINLAND

Recommendations:

- Seismic justification of structures, systems and components (SSC) is based on the seismic PSA. The peer review recommends that STUK should consider additional assessment of critical SSC with respect of PGA = 0.1g (as recommended in the IAEA Safety Guide NS-G-3.3).

- The peer review recommends that the assessment of the drainage system capacity in case of high seawater level should be considered.    

- It was noted that Olkiluoto 1 & 2 are vulnerable to SBO (short coping time), particularly if it occurs at the time of reactor scram. It was also noted that a heat sink completely independent of seawater does not currently exist at Olkiluoto 1 & 2. The peer review recommends that corresponding planned corrective measures should be implemented.

- General suggestion is to perform special tests of several equipment, among them DC batteries up to depletion, endurance tests of diesel generators, under extreme conditions, training of some activities as for instance hoses installation etc.

- The reassessment of the emergency preparedness should address events that occur at all the units on site at same time. The peer review recommends that the scope of EOPs/SAMG should also include all shut down states and that the availability of dedicated systems and components to be used during severe accidents scenarios should be verified.

Good practices:

The detailed and strict legal basis regarding the emergency preparedness and severe accidents management is a strong point. Already implemented provisions enhancing robustness can be considered as advantages when assessing the safety of Finish NPPs against hazards that contributed the Fukushima accident. Several good practices were identified as follows:

- At Loviisa 1&2, independent air cooled SAM diesel generators (not depending on EDGs), dedicated SAM valves for Reactor Coolant System (RCS) depressurization measure providing external cooling of the vessel in case of a core meltdown accident, hydrogen management, containment external spray (dedicated SAM system), and operational by mobile equipment in case of loss of its own pumping capability.

- At Olkiluoto 1&2, means for flooding the lower drywell, depressurisation of the RCS and diversification for keeping the valves open, modifications to protect the drywell penetrations against pressure and thermal loads), filtered venting system of the containment (a dedicated SAM system), and possibility to fill the containment with fresh water.

Safety improvements implemented or planned (non-exhaustive list):

There is a long list of safety improvements that were either implemented or are planned. Here are some examples:

- Continues decreasing the seismic risk, which includes replacement of plant equipment with new, seismically qualified equipment, (i.e. relays especially for eliminating relay chatter, steel racks for batteries), and the study of seismic fragilities of pool structures in reactor containment and pools in spent fuel storages.

- At Loviisa, the licensee is studying modernization the bulkhead used to close the cooling water discharge openings, etc. A water tightness and water pressure tolerance of doors leading to the basement of the reactor building and consequences of the eventual leakages will be investigated and improved if needed.

- At Loviisa, evaluation of mobile devices to ensure boron injection into the RCS, coolant inventory in the secondary circuit, water supply for the diesel driven auxiliary emergency feed water pumps, electricity supply for instrumentation needed in accidents, electricity supply for the RCS depressurisation valves, containment heat removal during severe accidents, decay heat removal from the spent fuel storage pools, control room lighting, and plant communication systems.

- To increase robustness of the UHS, two cooling towers per unit are under consideration, one removing decay heat from the reactor and one the decay heat removal from the in-containment spent fuel pool and the spent fuel storage pools;

- At Olkiluoto 1 & 2 possible renewal of all eight emergency diesel generators; the new EDGs would have two diverse component cooling systems, allowing for air cooling, improved water tightness of the rooms, and improved local control room. Installation of a so called 9th EDG that could supply electric power to either Olkiluoto 1 or 2. This EDG would be located in a new, separate diesel building, qualified for flooding.

- Installation of diverse and independent way of pumping water to the reactor pressure vessel via fire fighting diesel driven pumps (Olkiluoto 1&2).

- STUK requested the licensee to provide a plan and schedule to secure decay heat removal from reactor core and containment in case of total loss of AC power (Olkiluoto 1&2);

- At Loviisa NPP, licensee has performed the following measures to enhance the accident management capabilities:

· number of staff in the technical support emergency organization was recently increased for better preparedness and support against accident situations;

· improvements to guidance for accident management (SAM Guidelines and SAM handbook) to ensure prevention of fuel uncovery are under development for spent fuel pools and storages;

· reduction of bypass sequences frequencies will continue in the future.

5.5. FRANCE

Recommendations:

- The DBE has been developed according to the French regulation, based on a deterministic approach for seismic hazard assessment. IAEA recommends conducting both deterministic and probabilistic approaches, as complementary strategies. It is recommended that ASN consider introducing PSHA in France for the design basis of new reactors and for future revisions of the seismic design basis of existing reactors, in order to provide information on event probability (annual frequency of occurrence) and to establish a more robust basis for DBE specifications.

- The seismic margins for seismic events above the DBE have been roughly estimated by the licensee. The reviewers recommend the regulator that a more systematic evaluation will be used either by performing PSA or SMA as well as introducing PSHA in France.

- The reviewers recommend the regulator to improve the seismic instrumentation at the plants.

- ASN explained that the design basis flood is defined considering statistical extrapolations limited to 10-3/y supplemented by a margin or a conventional combination. ASN and IRSN stated that the current state of the art in flood level calculations doesn't allow calculating, with a sufficient confidence, 10-4/y levels, except in some specific conditions such as "small catchments areas - up to some 1000 km2". It is recommended to perform a comparative evaluation with the methodologies used in other European countries.

- The regulator asked the licensee to conduct the analyses of climatic phenomena related to flooding. The reviewers recommend the regulator to consider including also tornadoes, heavy rainfall, extreme temperatures and the relevant combinations of extreme weather conditions in these complementary studies.

- The battery autonomy is currently an issue that needs to be addressed at all operating NPP designs. The reviewers recommend the regulator to consider the benefits of recharging the batteries before their complete depletion in case of total SBO in addition to the foreseen battery capacity increase.

- The main improvements to be made in order to cope with severe accidents, possibly affecting multiple units and caused by natural hazards have been pointed out by ASN. One basic recommendation of the peer review process is to guarantee their actual implementation. The reviewers consider the identified actions to be adequate for a further improvement of safety features. The consideration and implementation of these issues is important to be realized as soon as possible, apart from the PSRs, which are usually the reference for introducing new safety standards in France.

Good practices:

- Continuously safety upgrading of the plants by regularly implementation of new safety features in the framework of the period safety reviews

- The licensee announced the creation of specialized crews and equipment in order to cope with accidents in 24 hours. These crews will be made up of the licensee's employees at all plant sites and equipment will be stored in 4 regional centres.

Safety improvements implemented or planned (non-exhaustive list):

- The regulator requires the licensee to define a certain "Hardened safety core" of material and organizational measures. The hardened safety core will be based mainly on new equipment diversified form the existing one to prevent common cause failure. This hardened safety core should include:

· the emergency management rooms and equipment (they must display high resistance to hazards and allow the management of a long-duration emergency)

· the mobile devices vital for emergency management;

· the active dosimetry equipment, the measuring instruments for radiation protection and the personal and collective protection equipment, which must be permanently available in sufficient quantity on the sites

· the technical and environmental instrumentation for diagnosing the state of the facility and assessing and predicting the radiological impact on the workers and populations

· the communication means vital for emergency management

· strengthened equipment including, for operating NPPs:

- mobile electricity generating set

- diesel-driven emergency cool down water supply for each reactor primary and secondary circuits.

- ultimate backup diesel generator (DUS) for electrical backup of control room ventilation and instrumentation useful and necessary in SA

· qualification against external hazards of the hydrogen re-combiners and the venting filters system

· improvement and updating of SAMGs including all operation states, SFP and multi/unit events

- The licensee proposes several improvements or studies to reinforce the management of accident or severe accident situations on its sites including the provisions for multiple unit events. These improvements target more particularly:

· appropriateness of the human and material resources for the activities associated with deployment of the "hardened safety core" equipment and the additional equipment proposed;

· reinforcement of the material resources and communication means;

· conducting a study to improve the resistance and habitability of the safety building;

· design of Local Emergency Centres, integrating stringent habitability requirements and allowing more effective management of the emergency. The design requirements taken into account shall be consistent with those of the hardened safety core;

· reinforcement of the means of measurement and of technical and environmental information transmission, including meteorological information, necessary for emergency management;

· complementary measures to reduce the risk of loss of water inventory in the SFPs.

5.6. GERMANY

Note: German stress tests cover also several man-induced events, such as aircraft crash, blast wave, toxic gases, terrorist and cyber-attacks.

In the safety review by the German Reactor Safety Commission (RSK), the assessment criteria for a postulated aircraft crash differ in three Degrees of Protection. A difference is made between the mechanical impact (impact of the aircraft) and the thermal impact (kerosene fire). The Degree of Protection is considered according to the crash of an aircraft comparable to a Starfighter (Degree of Protection 1), the crash of a medium-size commercial aircraft (Degree of Protection 2) and additionally of a large commercial aircraft (Degree of Protection 3).

Recommendations:

- For German NPP sites the PGA values are in some cases lower than 0.1g. As it deviates from the approach recommended by the IAEA, and it is recommended that the regulator should consider the safety impact of values below 0.1 g.

- It is recommended to install seismic instrumentation at some NPPs in northern Germany where such instrumentation is not available yet, which is currently also required by an updated KTA rule.

Good practices:

- SAM measures including significant hardware modifications are in place for many years (for PWRs: Secondary side Bleed & Feed including mobile pumps to feed the SG; and primary side Bleed & Feed; for BWRs: diverse RPV depressurization and injection systems, mobile pumps for RPV injection; for both: PARs, Filtered Venting Systems…).

- Nuclear intervention force exists since 1977.

- Main control room habitability during accidents and the use of filtered venting is ensured.

- Emergency response organization could be housed in different buildings. Alternative support centre is part of concept.

Safety improvements implemented or planned (non-exhaustive list):

- Only 4 of the NPPs have performed a seismic PSA. The next round of PSRs might be used to review the seismic hazard and design for all plants on a probabilistic basis, which remain in operation.

- At Gundremmingen plant, feasibility studies to increase the AC power supply robustness. The reviews of the external hazards are already part of the deterministic part of the PSR.

- Unterweser NPP applied for license for measures aimed at using a fire water pump to sustain low-pressure feed to the emergency feed water system or to the emergency condition diesel system even under harsh ambient conditions.

- At Isar-1 plant plans for installing two new emergency diesel generator buildings and for replacing the water-cooled emergency diesel generator with new air-cooled, diverse units.

- The GRS information notice WLN 2012/02 contains 22 recommendations. It includes, e.g., the following topics: SBO coverage for at least 10 hours, additional emergency power generator available within 10 hours, diverse ultimate heat sink, two feeding points for connection of mobile equipment to supply the essential component cooling system.

- Systematic inclusion of internal/external hazards into the AM Program (including operability of mobile equipment).

- Development of AM measures to protect the building structure surrounding the spent fuel pool in a BWR, which is outside the containment, against hydrogen combustions or to prevent them.

- SAMGs for full power states exist for one NPP (GKN-1) and are being developed for all operating NPPs. No low power or shutdown SAMGs exist (but there is some guidance in operational manuals).

5.7. HUNGARY

Recommendations:

- Regarding earthquake, it is recommended to the Regulator to monitor implementation of the measures for further strengthening the level of protection of plant structures against liquefaction effects and soil settlement, as well as for the completion of seismic qualification of certain SSCs and a review of the database containing the seismic safety classification of components.

- Concerning flooding, it is suggested to the Regulator to monitor implementation of specific measures for strengthening the level of protection of the essential service water system.

- It is suggested to the Regulator to monitor implementation of specific measures for strengthening the level of protection of plant SSCs against extreme weather conditions. Special attention should be paid to assessing vulnerability of the rain drainage system in case of BDB of extreme precipitation and snowmelt.

- Concerning loss of safety functions, the possibilities of interconnection of existing equipment are beneficial. However this might also lead to loss of separation. Such improvements or modifications should only be carried out after careful investigation of separation issues.

- In the area of SAM, to reduce radioactive release to the environment in case of long term severe accident and to avoid over-pressurization a filtered containment venting system or a specific containment cooling system should be installed at all units, as the actual measures for long term internal containment cooling are considered to be adequate only in the case of a successful in vessel retention of the molten core.

- Water supply to the SFP from an external source has to be made possible by pipeline having adequate design against external hazards, with additional connection from outside. Water with boron concentration has to be supplied through this line to the SFP. The operating instructions have to be developed.

- Liquid radioactive waste management procedures have to be developed for severe accident situations

- The management of on-site consequences, especially of multi-unit accidents, has to be improved.

Good practices:

- Regarding earthquake, the reviewers acknowledge the measures undertaken to upgrade the plant, which was originally not designed to withstand earthquakes, to its current standard.

- Concerning flooding, a strong safety feature of the plant is its site ground elevation above maximum possible water level in case of flooding caused by high flow pattern of the Danube River or dam break.

- The requirement of SAMG in the national regulatory framework and the decision of the regulatory authority to require implementation of SAM measures as pre-conditions for the life extension for all units are commendable.

- EOPs and SAMGs have been developed for all operating modes (normal operating and shutdown), for SFP accidents in all units.

- The arrangements in place in the Protected Command Center (PCC) regarding power supply, worker protection against external hazards (dose, contamination, etc.), display of plant critical parameters during a severe accident are commendable.

Safety improvements implemented or planned (non exhaustive list):

- The programme on development and implementation of hardware measures for severe accident mitigation measures and of SAMGs was started before the Fukushima accident and is still on-going. As part of this programme, the installation process of hydrogen recombiners was accelerated after Fukushima accident and is now completed in all units.

- Several measures have been envisaged to increase the robustness of the plants in case of loss of electrical power, among others:

· The protection of 400 kV and 120 kV substations and of the automatic switch to island mode will be evaluated against earthquakes, and improved as appropriate.

· In addition to the existing severe accident diesel generators supplying electrical power to I&C systems described in accident management procedures, diverse diesel generator, which can supply electrical power to safety consumers having role in severe accident prevention and long term accident management is being considered.

· The black start ability of the gas turbine located in Litér will be assured by installing a diesel generator.

- To enhance the resistance of the plant in the case of loss of UHS several modifications are planned such as maximizing the inventory of the stored demineralised water.

- Finally, further studies on SAM are planned in the following topics:

· Hydrogen generation and distribution in the reactor hall

· Long-progression with containment pressurization during severe accidents

· Updating the Level 2 PSA studies

· Development of a software based severe accident simulator.

5.8. LITHUANIA

Recommendations:

- To perform a BDBE analysis for the new and operating spent fuel interim storages by postulating cracks/collapse of walls of cask storage hall and hot cell (for new spent fuel interim storage), cracks or collapse of the guarding concrete fence (for operating spent fuel interim storage), turnover of casks during transportation, loss of cask sealing as well as cask blockage by debris (for the new and operating spent fuel interim storages).

- To perform a BDBE analysis of the accident management centre structure to confirm their seismic capability.

- To examine the possibility to use signals of seismic alarm and monitoring systems to formulate emergency preparedness criteria (and include them in the relevant procedures or guidelines).

- To consider the need for a further PSR for reactor unit 2 and the SFPs if the decommissioning phase is delayed.

- To consider the benefits of qualifying the level and temperature instrumentation in the SFPs for accident conditions and having these signals available in all relevant locations.

Good practices:

- A strong feature is the 2 hydro plants that can provide electrical power when the off-site power is lost.

- Accessibility of the SFPs under SA conditions has been considered and Ignalina NPP has radiation protection provisions in case manual actions are required.

Safety improvements implemented or planned (non-exhaustive list):

- Development of BDBA guidelines.

- To install mobile DG connections to important to safety I&C, radiation monitoring system, communication system, recharging point for the batteries of flashlights, and temperature and level indicators of the SFP (and to install DG connections to these last indicators), and to other consumers.

- To use domestic potable water pumping system with own backup DG as diverse heat sink cooling for the reactor and SFPs.

- Modifications to supply Unit 1 systems by Unit 2 DGs.

5.9. THE NETHERLANDS

Note: The assessment by the Netherlands included also airplane crashes in its scope, and the national regulator confirmed that a more extensive study of the impact on the safety functions of different airplane crashes has to be performed as proposed by licensee EPZ.

Recommendations:

- The seismic hazard assessment should be updated for Borssele NPP. It is understood that a comprehensive and state-of-the-art seismic analysis will be performed as part of the PSR of the Borssele NPP starting in 2012.

- This analysis will then consider a PGA value of 0.1g at free field for the DBE, as per IAEA guidance. The reviewers recommend to follow-up the mentioned analysis for verifying its global scope and adequate performance, in particular concerning the revision of the DBE level.

- The combination of young unconsolidated sediments; grain size effects; and high water tables are expected to make the site susceptible for liquefaction. It is therefore recommended that the national regulator should consider assessing the liquefaction problem in connection with the on-going seismic analyses.

- Considering the very specific approach of the Netherlands for the flooding protection of the site, which relies on the national dyke system, the reviewers recommend to examine thoroughly the consistency of this approach with the new IAEA guidance (SSG-18).

- Further recommended topics that should be considered for additional studies are: minimum depth of underground piping required for proper protection against freezing, possibility to operate diesel generators at extremely low temperatures and the potential effect of accumulation of wind transported snow on roofs.

- The capabilities to cope with SBO situations during mid-loop operation should be developed and corresponding procedures should be prepared and validated. Due to the short times available for manual intervention and the worsening accessibility of the containment after the start of water boiling in the open primary circuit, the possibility to use remotely controlled valves allowing for primary system water make-up in case of SBO during mid-loop operation should also be investigated.

- Possibilities to increase the robustness of back-up power supply from mobile means, as well as from small portable equipment, should be further investigated considering external support.

- The Dutch regulator’s suggestion for further analysis to establish the validity of the assumptions made regarding the SSCs needed for SAM is supported and should be pursued as a matter of priority.

- The maintenance schedule for equipment related to accident management should be reviewed by licensee.

- Unambiguous tagging of keys of rooms (e.g. emergency control room) in the bunkered building should be implemented.

- The licensee should consider placing the SAM execution procedures at the location where they are to be used.

Good practices:

- Use of risk monitor for planning maintenance during operation and outages.

- Explicit incorporation of international standards (e.g. those of IAEA, WENRA) into the license via the Nuclear Safety Rules (NVRs) approach.

- Borssele has SAMGs for all operational states (including shutdown). The licensee has been very proactive in this regard, implementing them far faster than in many nations reviewed. Its SAMGs were considered state of the art in 2003.

- Borssele has used a full scope Level 3 PSA for deriving its severe accident management strategies and has been subject to IAEA IPSART missions.

- The scale of emergency exercises at Borssele is unusually large by international standards – one recent national exercise involved 1000 people.

- PARs are already installed and are designed for severe accident conditions.

Safety improvements implemented or planned (non-exhaustive list):

- Storage facilities for portable equipment, tools and materials that are accessible after all foreseeable hazards would enlarge the possibilities of the alarm response organization.

- Ensuring the availability of fire annunciation and fixed fire suppression systems in vital areas after seismic events would improve fire fighting capabilities and accident management measures that require transport of water for cooling/suppression.

- Ensuring the availability of the containment venting system after seismic events would increase the margin in case of seismic events.

- During the next PSR, either a seismic PSA will be developed and/or a SMA will be conducted and the measures will be investigated to further increase the safety margins in case of earthquake.

- Modification in process to install a seismic monitoring instrumentation in the plant.

- Improving flood resistance of buildings containing emergency supply.

- Regulator considers the impact of floods with long return period must be further assessed. Additional study on extreme flooding with long term period including dyke failure mechanisms is envisaged.

- Development of an operating procedure for flooding has been initiated.

- The sea dyke A of 9,4 m + NAP will be improved in 2012.

- Develop check-lists for plant walk-downs and needed actions after various levels of the foreseeable hazards.

- Improvement of plant autonomy during and after an external flooding, for example by establishing the ability to transfer diesel fuel from storage tanks of inactive diesels towards active diesel generators would increase the margin in case of LOOP. Envisage potential actions to prevent running out of on-site diesel supply for fire extinguishing system and the fire brigade. Increase the amount of lubrication oil in stock. By increasing the autarky-time beyond 10 h the robustness of the plant in a general sense would be increased.

- Reducing connection time of the mobile Emergency Diesel Generator(s).

- Better arrangements for emergency diesel generators, including improved means for recharging batteries and strategies to conserve battery power.

- An Emergency Response Centre facility that could give shelter to the alarm response organization after flooding (and all foreseeable hazards) would increase the options of the alarm response organisation. Establishing independent voice and data communication under adverse conditions, both onsite and off-site, would strengthen the emergency response organisation.

- Assessment of the cooling possibilities in case of loss of the main Grid, Emergency Grids 1 and 2 and no secondary bleed and feed available.

- Updated and extended analysis of hydrogen management within containment, including for the SFP.

- Potential improvements to SFP cooling arrangements so that this does not require a containment entry.

- Strategies for corium stabilisation within containment.

- Revisiting previous analyses of ex-vessel Reactor Pressure Vessel cooling.

- Analysing the possibility of detonation / deflagrations in the containment filtered venting stack.

- Analysis of potential doses to workers during severe accident management activities, including assessments of how dose levels increase with reducing Spent Fuel Pool level and habitability of the Main Control Room and ECR.

5.10. ROMANIA

Recommendations:

- The absence of a seismic level comparable to the SL-1 of IAEA leading to plant shutdown and inspection is regarded a critical issue at the background that the probability of large earthquakes occurring during the lifetime of the plant is extremely high (recurrence intervals for the Vrancea seismic zone: 50y for Mw>7.4). It is suggested to the regulator to consider implementing adequate regulations.

- There is only little information about margins to cliff edges, weak points and no evidences that further improvements in the seismic upgrading have been considered. Further work is proposed in this area and it is recommended that the CNCAN obtains good quality programmes from the licensees and ensures that the work is appropriately followed up.

- It is suggested to consider improving the volumetric protection of the buildings containing safety related equipment located in rooms below plant platform level. It is also suggested to the regulator to consider routine inspections of the flood protection design features.

- The habitability of the MCR and SCA was assessed for various types of accidents but not in the case of a total core melt accident associated to a containment failure (or voluntary venting). MCR habitability analysis to be continued (e.g. implementation of a close ventilation circuit with oxygen supply).

- Further SAM study is required for shutdown states.

Good practices:

- The plant units have a high level of defence against the loss of power and its consequences. The robustness of the electrical power supply is provided by four levels of defence in depth.

- The dousing tank of the CANDU design allows gravity feed into the Steam Generators.

- The primary and alternative heat sinks provide a good level of redundancy and diversity.

- Possibility to use diverse methods to open the Main Steam Safety Valves if the normal power supplies are lost.

- The robustness of the CANDU design to SA progression (slow accident progression due to the quantity of water available in the vessel and calandria vault, which increases the chances to stabilize a degraded situation and limit the possibility of large early release (except for hydrogen combustion),

- The large spreading area in case of MCCI which contributes to the possibility of corium cooling in the late phase of an accident.

Safety improvements implemented or planned (non-exhaustive list):

- Two new mobile diesel generators for electrical power supply and two pumps that can provide water in the domestic water system from the deep wells. In order to further decrease the time to connect the mobile DGs, the plant has initiated a modification to install special connection panels to the loads which may be supplied from these DGs. 

- Design modification for water make-up to the calandria vessel and the calandria vault (completed for unit 2).

- Improving the seismic robustness of the existing Class I and II batteries. The option of charging the batteries or the installation of a supplementary uninterruptible power supply for the SCA is being considered.

- Implementation of a hydrogen monitoring system (proposed by the utility and considered by the Romania safety authority to be reliable). PARs on unit 1 and 2 for hydrogen management.

- Additional instrumentation for SAM (e.g. hydrogen concentration monitoring in different areas of the reactor building).

- Dedicated emergency containment Filtered Venting System (FVS) for each unit will be installed.

- Improving the reliability of existing instrumentation by qualification to SA conditions and extension of the measurement domain (e.g. 30 days resistance for cables and connectors).

- Spent Fuel pool: Use of a new, seismically qualified, fire water pipe to allow water make-up without entering in the SFP area. Connections are provided outside the SFP building,

- Reinforced water height level instrumentation in the SFP and the reception bay.

- Cernavoda NPP will establish a new seismically qualified building to host the on-site Emergency Control Centre fire fighter’s facility and main intervention equipment.

- Cernavoda NPP will increase the reliability of the communication systems and the robustness of the on-site emergency control centre. The set-up of an Alternative Off-site Emergency Control Centre is in progress.

5.11. SLOVAKIA

Recommendations:

- It is recommended to consider monitoring the implementation of measures for quantification of seismic margins, and measures for strengthening of the level of protection of the plants against flooding and extreme weather conditions.

- In order to assure a timely completion of the measures for seismic resistance of the relevant SSCs of Mochovce NPP 1&2 for the newly defined Review Level Earthquake (PGA of 0.15g), it is recommended to consider prioritization of the seismic upgrading measures, e.g. in respect to the fire brigade building, and to re-evaluate cases where components of no primary safety feature potentially may have indirect influence on safety functions.

- It is important that the SAM modification will be implemented according to the proposed schedule. It is suggested to consider locating the special equipment for SAM in dedicated locations qualified against external hazards. The verification of tightness of all containment penetrations in SA conditions should be further examined (resistance of seals in particular).

- The strategy of long term management of containment pressure without any containment venting system should lead to further verification to check the real feasibility of long term containment heat removal in severe accident conditions.

Good practices:

- The robustness of the plants against earthquakes has been significantly increased.

- Measures to improve the safety of the plants regarding LOOP, SBO and loss of UHS have been planned and prioritised. Good practices include: large capacity of batteries and availability of several batteries trays; battery status monitoring system; equipment configuration management system dedicated for assessment of situation during extreme events and combinations of events; availability of EOP for usage of water from bubble condenser tower for SFP cooling, filling up reactor vessel, cavity and pit; availability of EOP to remove the decay heat by steam generator when reactor is opened.

- Specific tests were performed to validate emergency measures (e.g. test of feeding steam generators using the fire truck high pressure pump, test of water supply to SFP from bubble condenser trays).

- Most of SAM measures are not yet implemented, but regarding the future situation the following points can be highlighted as good practices: the SAM measures to avoid large early releases and with long term management of the damaged plant; the application of EUR safety objectives for the new units; the continuous improvement of containment tightness of all plants; the new concept for the emergency control centres with remote control of SA equipment.

Safety improvements implemented or planned (non-exhaustive list):

- Some additional safety upgrading measures are envisaged to increase seismic resistance.

- Some protective measures against flooding were promptly implemented during the period of stress tests (e.g. temporary passive protection of the reactor building and DG station). An action plan for implementation of short term and long term corrective measures to increase plant robustness against flooding with defined deadlines for implementation has been developed and agreed by the regulator.

- Further work is defined to better document the resistance to beyond design weather conditions.

- The measures to increase robustness against LOOP, SBO and loss of UHS include the following: a 6kV air cooled diesel generator for SAM; a 0.4 kV mobile diesel generator for each unit for charging batteries and supplying selected consumers during SBO; modifications of the power supply of the high-pressure boron system pumps enabling their use during SBO; provision of a mobile high-pressure feedwater pump for each unit for injection into steam generators (available during SBO).

- An extensive project for the implementation of the plant modifications and the development of the SAM was confirmed for 2013 for Bohunice (including new improvements) and was accelerated from 2018 to 2015 for Mochovce NPPs. It includes reactor cavity flooding, an additional line for RCS depressurization, containment hydrogen management, and containment vacuum breaker.

5.12. SLOVENIA

Note: The Krško NPP has also prepared an analysis of the impacts of aircraft crashes on the plant. While this report is confidential and was not part of the peer review process, the national regulator states that the plant is well prepared even for such events.

Recommendations:

- The new updated seismic hazard assessment resulted in a decrease in seismic margins. It is recommended that the regulator consider requesting the update of the seismic design basis for future design modifications and consequently the associated PSA model.

- Additional systems and equipment that can ensure the main safety functions during LOOP and loss of UHS are planned to be deployed. It is recommended to complete these changes in a timely manner.

- Several provisions are already in place to support SAM with the use of mobile equipment, and additional upgrading measures (e.g., installation of PARs, filtered venting, new emergency control room, third engineered safety features train) are being implemented. It is recommended to complete these improvements as soon as possible.

Good practices:

- During the winter, warm water can be diverted from the essential service water to the inlet of the intake structure for de-icing purposes.

- At extremely low temperatures, daily plant surveillance is performed for all open air isolated lines. The plant has in place several heaters which can be used to heat safety related SSCs even during a SBO.

- Sufficient mobile and portable power generation sources are available on-site.

- Turbine-driven auxiliary feedwater pump is available for reactor cooling (provided the SGs are available).

- Possibility of independent water injection into the reactor vessel.

- SAMGs are validated by exercises on the full scope simulator and have been reviewed by IAEA RAMP mission in 2001.

- Full scope simulator used during drills provides real time response. Simulation goes up to containment failure and beyond. Longest exercise lasted 2.5 days.

- SAMGs are in place for the reactor as well as for SFP and are independent of the reactor operating state.

- Consideration of extensive damage due to aircraft crash and implementation of mitigation measures.

Safety improvements implemented or planned (non-exhaustive list):

- Several alternative cooling means are available or planned, in case of loss of primary UHS.

- Alternative means to provide suction to Auxiliary Feedwater System (AFW) pumps or to provide water to Steam Generators (SGs) directly.

- Alternative means for power supply to Chemical and Volume Control System in order to preserve reactor coolant system inventory and the integrity of reactor coolant pumps seals in induced SBO or Loss of essential service water system / component cooling system conditions.

- Alternative means for power supply to selected Motor Operated Valves.

- Alternative means for providing water from the external sources to the containment.

- Procedures for local operation of AFW turbine driven pump and for local steam generators power depressurization without need of DC or instrument power.

- Third independent diesel generator 6.3 kV (in a separate building with the third safety bus which could be connected to either one of the existing two safety buses).

- Provision to connect mobile diesel generator of capacity 2000 kVA to switch gear of the third diesel generator.

- Two engine driven 125 V aggregates will be available to provide the power to DC system panels in case of loss of DC main distribution panels.

- Acquiring onsite additional pumping station to assure additional high capacity “portable water ring” around the plant.

- Acquiring two additional high pressure mobile fire protection pumps (to remove decay heat in early stage after reactor shutdown and depressurizing SGs).

- Installation of additional quick connection points for mobile equipment.

- Alternative means for makeup of Spent Fuel Pool water inventory.

- An alternative system with skid mounted pump and heat exchanger to cool the SFP.

- Installation of a special emergency control room in the already constructed building protected against external events.

- Filtered containment venting.

- PAR for hydrogen control in the containment.

- A new Technical Support Centre with enhanced habitability requirements.

- Improving existing flood protection by increasing the heights of dikes upstream the plant, in order to keep the left Sava river bank dry even for flows beyond the PMF flood flow.

5.13. SPAIN

Recommendations:

- Within the framework of the on-going analyses on the effects of pipe rupture (non-seismic and seismic), it is suggested to consider in particular verifying that there are no common cause failure issues.

- Within the framework the seismic hazard update, it is suggested that the updated Seismic Hazard Assessment should use the available geological and paleoseismological data characterizing the active faults of the Iberian Peninsula.

- Adopting a consistent approach for the return periods associated to heavy rain and extreme temperatures scenarios at the different sites.

- Improving the external flood volumetric protection of buildings containing safety related SSCs.

- Completing the establishment of a comprehensive set of requirements for accident management integrated within the Spanish legal framework.

- It is suggested to consider containment filtered venting system in the NPPs.

- To explicitly include accident management as a topic in CSN’s safety guide on "the content of periodic safety reviews” and to include External events in the scope of PSA.

- Reviewing the approach linked in calculating the time margins for the control or mitigation of severe accidents.

- Trillo: development of symptom-based SAMG for mitigation of the consequences of severe accidents and maintenance of containment integrity.

- Considering passive autocatalytic hydrogen re-combiners (NPP Cofrentes and Westinghouse NPPs) and a clear commitment for SAMGs for hydrogen mitigation in SFP accidents.

- Developing severe accident management guidance for accidents initiated during shutdown operation and accelerating plans to include SAMGs addressing mitigating aspects for SFP.

Good practices:

- A comprehensive analysis of indirect effects induced by earthquake (explosions and fires, internal flooding caused by pipe breaks, damage on nearby infrastructure, sloshing in the SFPs, effects of earthquakes on industries in the vicinity of their sites).

- Organisational and technical measures to restore power supply directly from hydropower stations.

- Possibility to use turbine-driven pumps and atmospheric discharge valves to cool reactor core and possibility to operate such equipment manually (without any AC/DC power).

- The setting-up of a working group to analyse important factors like accessibility, human resources and times available.

- Verification and validation of SAMGs by supporting calculation, analysis and exercises.

- Permanent connection allowing alternate SFP makeup without entering the SFP area (Trillo).

- Provision for containment cooling from the outside by the annulus building ventilation (Trillo).

Safety improvements implemented or planned (non-exhaustive list):

- Update site seismic hazard characterization following the most recent IAEA standards.

- Analyses on-going for different improvements: increasing capacity of downstream dams spillways, reinforcing of water leak-tightness of building gates, increasing the evacuation capacity in the drainage networks, improvements to galleries with potentiality to induce in-leaks, improving the hydrostatic resistance of seals in galleries connecting to buildings containing safety-related equipment.

- A specific study on occurrence of tornados in the areas surrounding nuclear facilities

- Availability on site of autonomous electricity generating groups.

- Additional portable instrumentation in the event of complete loss of the batteries.

- Improvements to the communications systems (on- and off-site) in situations with loss of the electrical feed systems; improvements to the lighting for prolonged scenarios.

- Design modifications required to make available connection points for autonomous electrical and mechanical equipment.

-  Preparation of relevant procedures and training of personnel according to these procedures.

- The setting-up of new on-site Alternative Emergency Management Centres (AEMC), seismically and flood-resistant at each plant.

- the setting-up of an Emergency Support Centre (ESC), common to all the plants, with back-up equipment located at a central storage and available to be deployed and operated by an Intervention Unit ready to act at the sites in 24 hours.

- Installing passive autocatalytic re-combiners (PARs) at those plants that do not have them yet.

- Installing a filtered venting system.

- Applying measures to prevent core damage sequences with high pressure in the reactor and improving the ability to implement containment flooding strategies.

- Reinforcement of the electrical power supply to the Main Control Room ventilation system.

- Spent Fuel pools: develop specific procedures to allow taking preventive measures to assure cooling or water replenishment.

- Defining reference dose levels for the personnel intervening in an emergency for all onsite intervening personnel during an emergency.

5.14. SWEDEN

Recommendations:

- To consider carrying out more detailed flooding risk analysis including cliff edge analysis. To assess plant vulnerability against flooding, implementation of a refined external flooding PSA could be suggested.

- For the Forsmark and the Ringhals sites, to consider studying the combination of high sea water level and other external phenomena such as swell, strong wind and organic materials.

- To implement early warning systems and relevant operating procedures in case of extreme weather conditions (which are not in place for all sites).

- Reducing risks of common cause failures in Emergency Diesels Generators.

- Enhancing the reliability of electric power supply (analysis of robustness of gas turbines as alternate AC power, improving possibilities to refill the diesel tanks at diesel units, availability of lube oil, use of diesel generators used for physical protection, increasing the number of mobile diesel generators at site, load shedding, etc.

- The alternate cooling system for EDGs that is in place in Ringhals might be an alternative at other units.

- Maintaining the level in available water storage tanks close to maximal.

- Installation of pipelines to provide fire water to spent fuel pools.

- Qualification of mobile equipment (and its storage) against DBE and other external hazards.

- Consideration of multiple unit events including long term effects, particularly during extreme situations.

- Ensuring long term performance of the filtered venting system (> 24 hours).

- Consideration of natural disasters leading to loss of infrastructure in the SAM.

- Concepts to manage large volumes of contaminated water.

- Accumulation of hydrogen in rooms or buildings outside the containment.

- Qualification of instrumentation (water level, temperature in the Spent Fuel Pool) for severe accident as well as qualification of the equipment against harsh conditions.

- Enhancement of the accident management programmes (SAMGs, EOPs) for all plant states (including spent fuel pools and multi-units events).

- EOP training and drills for extended scope of the accident management (multiunit accidents under conditions of infrastructure degradation).

Good practices:

- After the Three Mile Island accident, the Swedish government decided that all Swedish NPPs should be capable of withstanding a core melt accident without any casualties or ground contamination of importance to the population. This resulted in an extensive backfitting for all Swedish NPPs, including:

· Filtered containment venting through an inerted MVSS with a decontamination factor of at least 500.

· Independent containment spray water supply (mobile units and/or firefighting system).

· Passive Autocatalytic hydrogen recombiners (PWR).

· Flooded lower drywell in BWR aiming to stabilize ex vessel molten corium.

- All Swedish BWR containments are inerted with nitrogen since their original design to avoid hydrogen risks.

- For the most part, the SAM systems and procedures currently in place were developed during the 1980s and are part of the design bases of the plants.

- The communication solution RAKEL.

- Capability to withstand loss of UHS scenario for long time periods if water volumes in various tanks are close to maximal.

Safety improvements implemented or planned (non-exhaustive list):

- More detailed studies for potential improvements regarding mitigation strategies for long term severe accident conditions, capability to handle more than one affected unit, analysis of destruction of infrastructure, and damage to safety systems and barriers.

- Additional assessment of the containment integrity in the event of a severe accident, including measures if necessary (all reactors: 2012).

- Strategy for long term cooling of a severely damaged core, including physical measures if necessary (all reactors: 2012, some measures before 2012).

- Independent emergency core cooling system. (All reactors, studies ongoing).

- Change to two phase flow relief valves (Ringhals 1: 2011, Oskarshamn 2: 2013).

- Measures to vent incondensable gases from the reactor vessel (Ringhals 1: 2012).

- Analysis of the adequacy of emergency control, including upgrade measures, if necessary (Oskarshamn 3: 2012, Ringhals 3 & 4: 2012).

- Installation of a new emergency control (Forsmark 1: 2011, Forsmark 2: 2012, Oskarshamn 2: 2013).

5.15. UNITED KINGDOM

Recommendations:

- Several uncertainties exist with regard to the Design Basis Earthquake, which were established by different methodologies for different sites during the 1980s and 1990s. This leads to ONR’s “Stress Test Finding” that: “The nuclear industry should establish a programme to review the Seismic Hazard Working Party methodology against the latest approaches”.

- The currently available Design Basis Flooding (DBF) assessments have not accounted for some recent tsunami research work, although ONR are content that such work is unlikely to significantly affect previous work on maximum credible tsunami heights.

- For flooding, there is no satisfactory evidence of capability of the plants beyond the design basis. It is recommended that the UK regulator considers providing a specific programme for additional review regarding the design basis approach and an adequate response regarding margin assessment and identifies specific potential plant improvements is recommended. ONR has raised this as findings in the UK report.

- For earthquake and some specific external hazards, beyond design basis capability are inferred but not quantified and no specific evidence is provided that margins to cliff edge effects and potential specific improvements have been considered systematically for all NPP. Additional review regarding the design basis approach and an adequate response regarding margins assessment beyond the design basis and identification of specific potential plant improvements. The review team encourages the ONR to establish a strong regulatory oversight programme on this matter.

- Although the reviewers note that the UK Chief Inspector’s final report makes a recommendation to review/revise site-specific flood analyses, ONR is urged to ensure that common cause failure modes from flood hazard are comprehensively taken into account for all the reactors of a site, in particular regarding the need to share mitigation or mobile equipment.

- ONR should clarify its technical requirement in the implementation of the defence in depth principle regarding flooding, and consider requirements for warning and prevention of flooding of the site, protection against flooding of rooms and mitigation, for the whole site.

- For AGRs/Magnox, the longer grace times should not be used as an argument for not considering implementation of fixed hardware provisions. The following further improvements are suggested:

· Inject water into the reactor core as an ultimate means to provide residual heat removal from the core without use of the boilers and identify the means/equipment that would be used, including filtering for AGR/Magnox.

· Stocks of fuel and other consumables. for at least 72h.

· Battery capacity is low compared with other countries and therefore should be increased or recharged by additional generators for most of the plants.

- In accordance with the existing plans, the on-site emergency facilities should be strengthened in order to be resistant against external hazards and provide for working conditions in case of severe accident. A more comprehensive assessment is also needed regarding the occurrence of severe accident at multiple units and conditions of severely damaged infrastructures.

- The need for a backup control room providing for shutdown and cooldown to safe condition of the plants should be considered.

- Symptom Based Emergency Response Guidelines (SBERGs) and SAGs should be further developed to cover fully all spectrums of accident scenarios, including plant shutdown conditions. Training and exercises for implementation of the procedures should be improved.

- Radiation conditions which may potentially develop on site in case of severe accident, possibly at several units, should be more comprehensively analysed and appropriate measures to address them implemented.

- The existing plans to strengthen hardware provisions for SAM in all reactors, but in particular in Sizewell B, are supported by the review team. It is advisable to take into account the need for operability of newly installed equipment under conditions of extreme external hazards and prolonged SBO. Provisions for ensuring sufficient coolant inventory in the SFP should be further strengthened by providing e.g. additional delivery of coolant from external sources.

Good practices:

- Accident management for gas cooled reactors represent a special case due to their unique design features, in particular absence of a separate containment building and very large thermal inertia. This large inertia provides comfortable time margins for performing recovery actions. Many severe accident challenges to confinement integrity such as hydrogen explosion, high pressure melt ejection; steam explosion and direct containment heating are not present.

- The PSA that has been produced for Sizewell B is a full scope Level 3 PSA. The PSA addresses all modes of operation of the plant (full power, low power and shutdown modes), internal initiating events, and internal and external hazards.

- Strong safety features for NPPs in the UK are the different independent and autonomous systems and the diverse back-up AC power Diesel or Petrol Driven Generators and pumps or steam driven pumps present on any site, the Gasturbines at Magnox operating reactors and the four independent EDG’s at Sizewell B. At Sizewell B the Reserve Ultimate Heat Sink system and the two steam-driven emergency feed deserve also to be mentioned.

- Approximately ten years ago the licensees established a number of beyond design basis containers that contain a range of equipment and materials that could be beneficial when responding to a beyond design basis accident. These containers are located remotely offsite at a central UK location, available to be transported to an affected site within a ten hour timeframe following declaration of an off-site nuclear emergency. All containers and their contents are maintained regularly, and their deployment has been exercised.

Safety improvements implemented or planned (non-exhaustive list):

- For Sizewell B, it was confirmed during the country visit that the licensee will install a filtered containment venting system and passive autocatalytic hydrogen recombiners as part of SAM improvement measures. In addition, it will consider a flexible means of injecting water into the containment using portable external equipment. Some other specific enhancements are already being considered, for example the provision of a hardened Emergency Control Centre at Sizewell B.

- Finally, further studies on SAM are planned in the following areas:

· How the pilot PSA studies (Level 2 PSA; Fire PSA; Shutdown PSA) and the insights from them are taken forward across the AGRs fleet.

· Further resilience enhancements to communications equipment and associated critical supplies.

· Potential explosive hazard arising from the production of Carbon monoxide (CO) for AGRs during a severe accident.

· AGR pressure vessel basemat melt through in severe accident conditions.

6. Summaries of Neighbouring Countries' Peer Reviews

6.1. SWITZERLAND

Recommendations:

- It is recommended that the regulator assesses the opportunity of requiring more reliance on passive systems for hydrogen management for severe accident conditions.

- It is recommended that the regulator considers further studies on the hydrogen management for the venting systems.

Good practices:

- The review team has recognized the significant efforts carried out to update in depth the seismic hazard assessment in Switzerland, which would lead to identification of possible safety improvements.  It is based on a probabilistic seismic hazard analysis and is considered to be ’state of the art’ by the Regulator. It includes a recently updated paleoseismological data-base and uses a solid scientific basis.

- The peer review team recognises as good practice the recent creation of a flooding-proof and earthquake-resistant external storage facility at Reitnau. The storage facility houses various operational resources for emergencies, which are readily available and can be supplied to the required location within reasonably short time frames.

- The safety train concept and a strong defence in depth contribute to the robustness of the plant. There are 3 independent paths to bring and maintain the plant in a safe shutdown state, one being fully autonomous for at least 10 hours. The number of safety layers for power supply is significant and diverse options are available. An external storage was set up in 2011 and can provide in a timely manner additional diesel generators.

- Three sites have an alternate cooling source consisting of specially protected deep-water wells that would provide water in the event of the loss of the primary ultimate heat sink.

- During the peer review process, the following strong points have been identified:

· The ENSI issued a comprehensive report on lessons learned after Fukushima.

· SAM has been addressed in national regulations and the main components of SAM were in place before the Fukushima accident,

· SAMGs are available for both power and shutdown states,

· Effective AM strategies are available in case of prolonged SBO.

· Long-term scenarios are covered in procedural guidance’s.

· SFPs outside the containments are addressed by SAMGs.

· Multi-unit events (for Beznau NPP, the only site with more than one unit) and arrangements have been tested repeatedly even before the Fukushima accident.

· Filtered containment venting, with active and passive activation.

· Emergency Control Rooms are protected against external events, including filtered air supplies. Manual actions can be performed from radiologically protected areas.

· Re-criticality in the SFP is unlikely. Possibility for injection of non-borated water, e.g. with fire pumps through prepared connections. 6 tons of boron is available for SAM.

Safety improvements implemented or planned (non-exhaustive list):

- Targeted back-fitting measures to improve the seismic resistance of: the supporting structures for cables and the control stations in the main control room (Gösgen NPP), the SFP cooling at Beznau NPP and Mühleberg NPP, and the installation of a new set of EDGs that are robust against earthquake at Beznau NPP.

- Back-fitting of two physically separated connections for the external spent fuel pool supply at all the NPPs (without the need to enter the SFP area).

- At Beznau NPP, additional independent flood protected spent fuel pool cooling system with coolant supply from the protected special emergency well and additional injection means into the SFPs via an existing alternative pool cooling system, and via a new flood protected pool cooling system.

- At Gösgen NPP, building of a flood protection wall to prevent water ingress through a breach in an embankment, and preparation of a shut-off bulkhead for access via the power plant road. Mühleberg NPP plans to install a diverse flood protected SFP cooling water system.

- For Gösgen NPP the following improvements have been implemented:

· Introduction of an automatic advance flooding alarm.

· Additional sealing of building shells, air inlets and doors, etc., of buildings with equipment used for the safe shutdown of the plant.

· Preparation for the erection of dam bulkheads.

· Installation of ‘flood valves’ to seal ventilation intakes.

- For Mühleberg NPP the following improvements have been implemented:

· Provision of mountable flood protection walls for protection against flooding of the auxiliary cooling water pumps in the pump building, and enhancement of the relevant operating instructions.

· Provision of mobile pumps to inject water into the diversified heat sink intake structure.

· Implementation of an additional injection option (intake shaft) into the diversified heat sink intake structure.

· Back-fitting of three special vertical pipes on top of the diversified heat sink intake structure to ensure the cooling water supply for the diversified heat sink.

- To increase the number of options available for SFP cooling, all sites will also have to back-fit a physically separated additional feed for the pools (used by mobile means from outside the building).

- In three plants, at least one medium-sized mobile AM emergency power unit (at least 120 kW / 150 kVA) is available locally. Since the end of October 2011, two large mobile units (approx. 890 kW) have been available at Beznau NPP.

6.2. UKRAINE

Recommendations:

- The seismic evaluations for some parts of the equipment, piping, buildings and structures important to safety are not yet completed. Some additional seismic safety upgrading measures are envisaged, but not implemented yet. The peer review recommends monitoring in a systematic way the implementation of the upgrading measures in order to assure timely completion as part of the Comprehensive safety improvement programme.

- A special attention should be paid for defining vulnerability of the plant in case of beyond design basis tornado (in terms of potential loss of essential service water). Safety margins with respect to extreme wind and extreme snow should be evaluated too. The peer review recommends considering monitoring the fulfilment of additional analyses of the threat to the essential service water system due to the tornado impact as well as the evaluation of emergency arrangements with respect to the personnel access to sites in severe weather conditions.

- The improvement of makeup possibilities to primary circuit, to the SGs, and to the spent fuel ponds in case of SBO and LUH events is being considered. The deployment of mobile diesel and pumping (MDGPU) unit has to be further analysed in detail. The peer review recommends that the regulator considers monitoring resolution of these proposals.

- Concerning SAM the peer review recommends the following topics for consideration by the Ukrainian regulator:

· Demonstration, with a high degree of confidence, that the key functions needed for SAM can be achieved. In particular, provisions against cliff-edge effects on accident progression should be addressed in priority (hydrogen management, control, reliability of RCS depressurization function in severe accident condition).

· A strategy and program for the qualification of equipment needed in severe accident conditions should be implemented.

· The risk induced simultaneously by reactor and SFP in case of a severe accident should be assessed.

· The analysis of SFP accident in various configurations in order to underwrite EOP and SAMGs, the robustness of the means to cool the SFP even after core melt should be improved. If SFP is inside the containment, a means to cool the SFP should be ensured even if some internal structures (pipes) in the containment have been damaged by hydrogen combustion.

· Further investigation of the habitability of MCRs and ECRs in case of a severe accident as well as enhanced seismic capabilities for the building hosting the crisis centre should be assessed. The schedule for hardware and procedures implementations should stay under strict control of the regulator.

· For site with several units it should be verified in details the feasibility of immediate actions required to avoid core melt, prevent large release, and avoid site evacuation for a disaster affecting more than one unit at a particular site.

Good practices:

- High level of redundancy of SSCs and power supply (DGs) which offers many possibilities and flexibility for accident management; some extensive additional safety upgrades to the original design are implemented to prevent severe accidents.

- The risk of common mode failure is being addressed through additional mobile equipment that should allow for quick connection and should be stored in a safe area.

- Some prompt actions already implemented: mobile DG for Chernobyl NPP (ChNPP), set of targeted emergency exercises conducted at all NPPs, including ChNPP.

- In addition, emergency exercises on long term SBO type of scenarios were conducted at all Ukrainian NPPs. Upon their results, measures were identified to improve on-site emergency response taking into account Fukushima-related phenomena.

Safety improvements implemented or planned (non-exhaustive list):

The following measures are envisaged in the “Comprehensive (Integrated) Safety Improvement Program for Ukrainian NPPs”:

- Complete equipment seismic qualification for 0.1g and additional seismic investigations of NPP sites and assurance of robustness of equipment, piping, buildings and structures important to safety to seismic impact >0.1g.

- Assurance of operability of essential service water consumers under loss of water in spray ponds of operating plants as a result of tornado.

- Increase the discharge time of batteries and restoration of power supply to stationary makeup pumps from a Mobile Diesel Generator (MDG).

- Improve the emergency makeup to SG, water injection into SG from fire trucks and MDGPU (Mobile Diesel Generator and Pumping Units), as well as injection of borated water into the primary circuit from MDGPU, restoration of power supply to stationary makeup pumps from a MDG, and water injection into the SFP from independent MDGPU or from the fire extinguishing system.

- Development and Implementation of SAMG at WWER 440 and 1000 Units.

- Preservation of the containment integrity if there is interaction with corium (active core melt) at the ex-vessel phase of severe accident including implementation of H2 concentration reduction measures for BDBA situations.

- Implementation of the filtered containment venting system for all WWER-1000 and WWER-440 units.

GLOSSARY

AC                       Alternating Current

AEFS                   Additional Emergency Feedwater System

AEMC                 Alternative Emergency Management Centres

AGR                    Advanced Gas Cooled Reactor

AFW                    Auxiliary Feedwater

AM(P)                 Accident Management (Programme)

APOP                  Abnormal plant operating procedures

BDB(A)               Beyond Design Basis (Accident)

BDBE                  Beyond Design Basis Earthquake

BWR                    Boiling Water Reactor

CANDU              Canada Deuterium Uranium (Pressurised Heavy Water) Reactor

CDF                     Core Damage Frequency

CNCAN              Romanian National Commission for Nuclear Activities Control

CSN                    Nuclear Safety Council (Consejo de Seguridad Nuclear), Spain

CVA                    Auxiliary steam system

DBE                     Design Basis Earthquake

DBF                     Design Basis Flood

DC                       Direct Current

DG                       Diesel Generator

EC                       European Commission

ECC                     Emergency Control Centre

ECR                     Emergency Control Room

EDF NGL            EDF Energy Nuclear Generation Ltd

EDG                     Emergency Diesel Generator

EDMG                 Extensive Damage Mitigation Guidelines

EMC                    Emergency Management Center

EMS                    Emergency Makeup System

ENSI                    Swiss Federal Nuclear Safety Inspectorate

ENSREG             European Nuclear Safety Regulators Group

EOP                     Emergency Operating Procedure

EPR                     Evolutionary Power Reactor

EPS                      Emergency Power Supply

FANC                  Federaal Agentschap voor Nucleaire Controle, BE

FARN                  Nuclear Rapid Response Force

GRS                     The Gesellschaft für Anlagen- und Reaktorsicherheit, DE

HCLPF                High Confidence of Low Probability of Failure

FANC                  Federal Agency for Nuclear Control (in Belgium)

IAEA                   International Atomic Energy Agency

I&C                     Instrumentation and Control

LOOP                  Loss Of Offsite Power

LUHS                  Loss of Ultimate Heat Sink

MCCI                  Molten Core-Concrete Interaction

MCE                    Maximum Calculated Earthquake

MCR                    Main Control Room

MSSV                  Main Steam Safety Valves

MDGPU              Mobile Diesel and Pumping Unit

NCM                   Non-conventional Means

NRC                    (United States) Nuclear Regulatory Commission

NPP                     Nuclear Power Plant

NVR                    Nuclear Safety Rule

ONR                    Office for Nuclear Regulation, UK

PAR                     Passive Autocatalytic Recombiner

PCC                     Protected Command Center

PGA                     Peak Ground Acceleration

PMF                    Probable Maximum Flood

PSHA                  Probabilistic Seismic Hazard Analysis

PSA                     Probabilistic Safety Analysis

PSR                     Periodic Safety Review

PWR                    Pressurised Water Reactor

RCIC                   Reactor Core Isolation Cooling

RCP                     Reactor Coolant Pump

RCS                     Reactor Coolant System

RLE                     Review Level Earthquake

RPV                     Reactor Pressure Vessel

RWST                  Refuelling Water Storage Tank

SAM                    Severe Accident Management

SAMG                 Severe Accident Management Guidelines

SBERG                Symptom Based Emergency Response Guidelines

SBO                     Station Blackout

SCA                     Secondary Control area

SDG                     Stand-by Diesel Generator

SG                       Steam Generator

SGTR                   Steam Generator Tube Rupture

SFP                      Spent Fuel Pool / Pit

SFSF                   Spent Fuel Storage Facility

SPSA                   Seismic Probabilistic Safety Assessment

SSC                     Structures, Systems and Components

STUK                  Radiation and Nuclear Safety Authority (Finland)

SWHP                 Seismic Hazard Working Party

UHS                     Ultimate Heat Sink

VVER                  (Russian) Water Water Energetic Reactor

WANO                World Association of Nuclear Operators

WENRA              Western European Nuclear Regulators’ Association

Annex 1: Summary table

 

Issue no. || Description (“X” in the table where these issues or good practices are applicable)

I1 || External hazard safety cases corresponding to an exceedance probability of less than once in 10 000 years should be used (I1a: for earthquakes; I1b: for flooding).

I2 || A DBE corresponding to a minimum peak ground acceleration of 0.1 g should be used.

I3 || Means needed to fight accidents should be stored in places adequately protected against external events.

I4 || On-site seismic instrumentation should be installed.

I5 || Time for restoration of the safety functions in case of loss of all electrical power and/or ultimate heat sink is less than 1 hour.

I6 || Emergency Operating Procedures not covering all plant states (full power to shutdown states)

I7 || Severe Accident Management Guidelines not covering all plant states (full power to shutdown states)

I8 || Passive measures to prevent hydrogen (or other combustible gasses) explosions in case of Severe Accident not in place (such as Passive Autocatalytic Recombiners or other relevant alternative)

I9 || Filtered Venting Systems not in place

I10 || A backup Emergency Control Room not available, in case the Main Control Room becomes inhabitable as a consequence of the radiological releases of a severe accident, of fire in the Main Control Room or due to extreme external hazards.

GP1 || Existence of alternative and fully independent ultimate heat sink (good practice).

GP2 || Additional layer of safety systems fully independent from the normal safety systems, located in areas well protected against external events (for instance bunkered systems or hardened core of safety systems) (good practice).

GP3 || Additional Diesel Generators (or Combustion Turbines) physically separated from the normal diesel generators and devoted to cope with Station Black-Out, external events or severe Accident situations already installed (good practice)

GP4 || Mobile equipment especially Diesels Generators devoted to cope with Station Black-Out, external events or severe accident situations are already available (good practice)

GP5 || Additional on-site emergency control centre, from which the emergency response activities can be coordinated, should available and adequately protected against radiological and extreme natural hazards (good practice).

Other issues || Site / unit specific issue referred in the text of the Staff Working Document.

The legend above summarises the recommendations made by the peer reviews to the national regulators for consideration to improve the safety of nuclear power plants as well as good practises identified. The table below connects those recommendations as well as the good practices directly to each reactor of each NPP in the EU. In order to assess the full applicability of each recommendation a backward reference should be made to the relevant chapter of this working document, as well as the national reports and the individual facility reports available on www.ensreg.eu.

country || Site || Type || Unit || Start of commercial operation || Current years of operation || Current net capacity [Mwe] || Site visited? || I1a || I1b || I2 || I3 || I4 || I5 || I6 || I7 || I8 || I9 || I10 || GP1 || GP2 || GP3 || GP4 || GP5 || Other issues?

BE || Doel || PWR || 1 || 15/02/1975 || 36 || 433 || X || || || || || || || || || || X || || X || X || X || X || ||

|| || PWR || 2 || 01/12/1975 || 36 || 433 || X || || || || || || || || || || X || || X || X || X || X || ||

|| || PWR || 3 || 01/10/1982 || 29 || 1006 || X || || || || || || || || || || X || || X || X || X || X || ||

|| || PWR || 4 || 01/07/1985 || 26 || 1039 || X || || || || || || || || || || X || || X || X || X || X || ||

|| Tihange || PWR || 1 || 01/10/1975 || 36 || 962 || || || X[8] || || || || || || || || X || || X || X || X || X || ||

|| || PWR || 2 || 01/06/1983 || 28 || 1008 || || || X1 || || || || || || || || X || || X || X || X || X || ||

|| || PWR || 3 || 01/09/1985 || 26 || 1046 || || || X1 || || || || || || || || X || || X || X || X || X || ||

BG || Kozloduy || PWR (VVER-1000/320) || 5 || 23/12/1988 || 23 || 953 || X || || || || X || || || || X || X || || || || || || X || X ||

|| || PWR (VVER-1000/320) || 6 || 30/12/1993 || 18 || 953 || X || || || || X || || || || X || X || || || || || || X || X ||

CZ || Dukovany || PWR (VVER-440/213) || 1 || 03/05/1985 || 26 || 427 || X || || || || X1 || X1 || || || X1 || X || X || || || || X || 1 || X ||

|| || PWR (VVER-440/213) || 2 || 21/03/1986 || 25 || 427 || X || || || || X1 || X1 || || || X1 || X || X || || || || X || 1 || X ||

|| || PWR (VVER-440/213) || 3 || 20/12/1986 || 25 || 471 || X || || || || X1 || X1 || || || X1 || X || X || || || || X || 1 || X ||

|| || PWR (VVER-440/213) || 4 || 19/07/1987 || 24 || 427 || X || || || || X1 || X1 || || || X1 || X || X || || || || X || 1 || X ||

|| Temelin || PWR (VVER-1000/V320) || 1 || 10/06/2002 || 9 || 963 || X || || || || X1 || || || || X1 || X || X || || || || X || 1 || X ||

|| || PWR (VVER-1000/V320) || 2 || 18/04/2003 || 8 || 963 || X || || || || X1 || || || || X1 || X || X || || || || X || 1 || X ||

FI || Loviisa || PWR || 1 || 09/05/1977 || 34 || 488 || X || || || X || || || || X || || || X || || 1 || || X || || X ||

|| || PWR || 2 || 05/01/1981 || 30 || 488 || X || || || X || || || || X || || || X || || 1 || || X || || X ||

|| Olkiluoto || BWR || 1 || 10/10/1979 || 32 || 885 || || || || X || || || X || || || X || || X1 || 1 || || || || X ||

|| || BWR || 2 || 10/07/1982 || 29 || 860 || || || || X || || || X || || || X || || X1 || 1 || || || || X ||

FR || Belleville || PWR-1300 || 1 || 01/06/1988 || 24 || 1310 || || X || X || || X1 || || || || X1 || || || || || 1 || X || 1 || 1 ||

|| || PWR-1300 || 2 || 01/01/1989 || 23 || 1310 || || X || X || || X1 || || || || X1 || || || || || 1 || X || 1 || 1 ||

|| Blayais || PWR-900-CPY-CP1 || 1 || 01/12/1981 || 30 || 910 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPY-CP1 || 2 || 01/02/1983 || 29 || 910 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPY-CP1 || 3 || 14/11/1983 || 28 || 910 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPY-CP1 || 4 || 01/10/1983 || 28 || 910 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| Bugey || PWR-900-CPO || 2 || 01/03/1979 || 33 || 910 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPO || 3 || 01/03/1979 || 33 || 910 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPO || 4 || 01/07/1979 || 33 || 880 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPO || 5 || 03/01/1980 || 32 || 880 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| Cattenom || PWR-1300 || 1 || 01/04/1987 || 25 || 1300 || X || X || X || || X1 || || || || X1 || || || || || 1 || X || 1 || 1 ||

|| || PWR-1300 || 2 || 01/02/1988 || 24 || 1300 || X || X || X || || X1 || || || || X1 || || || || || 1 || X || 1 || 1 ||

|| || PWR-1300 || 3 || 01/02/1991 || 21 || 1300 || X || X || X || || X1 || || || || X1 || || || || || 1 || X || 1 || 1 ||

|| || PWR-1300 || 4 || 01/01/1992 || 20 || 1300 || X || X || X || || X1 || || || || X1 || || || || || 1 || X || 1 || 1 ||

|| Chinon || PWR-900-CPY-CP2 || B-1 || 01/02/1984 || 28 || 905 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPY-CP2 || B-2 || 01/08/1984 || 28 || 905 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPY-CP2 || B-3 || 04/03/1987 || 25 || 905 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPY-CP2 || B-4 || 01/04/1988 || 24 || 905 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| Chooz || PWR-1500 N4 || B-1 || 15/05/2000 || 12 || 1500 || X || X || X || || X1 || || || || X1 || || || || || 1 || X || 1 || 1 ||

|| || PWR-1500 N4 || B-2 || 29/09/2000 || 12 || 1500 || X || X || X || || X1 || || || || X1 || || || || || 1 || X || 1 || 1 ||

|| Civaux || PWR-1500 N4 || 1 || 29/01/2002 || 10 || 1495 || || || X || || X1 || || || || X1 || || || || || 1 || X || 1 || 1 ||

|| || PWR-1500 N4 || 2 || 23/04/2002 || 10 || 1495 || || || X || || X1 || || || || X1 || || || || || 1 || X || 1 || 1 ||

|| Cruas || PWR-900-CPY-CP2 || 1 || 02/04/1984 || 28 || 915 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPY-CP2 || 2 || 01/04/1985 || 27 || 915 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPY-CP2 || 3 || 10/09/1984 || 28 || 915 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPY-CP2 || 4 || 11/02/1985 || 27 || 915 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| Dampierre || PWR-900-CPY-CP1 || 1 || 10/09/1980 || 32 || 890 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPY-CP1 || 2 || 16/02/1981 || 31 || 890 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPY-CP1 || 3 || 27/05/1981 || 31 || 890 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPY-CP1 || 4 || 20/11/1981 || 30 || 890 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| Fessenheim || PWR-900-CPO || 1 || 01/01/1978 || 34 || 880 || X || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPO || 2 || 01/04/1978 || 34 || 880 || X || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| Flamanville || PWR-1300 || 1 || 01/12/1986 || 25 || 1330 || || || X || || X1 || || || || X1 || || || || || 1 || X || 1 || 1 ||

|| || PWR-1300 || 2 || 09/03/1987 || 25 || 1330 || || || X || || X1 || || || || X1 || || || || || 1 || X || 1 || 1 ||

|| Golfech || PWR-1300 || 1 || 01/02/1991 || 21 || 1310 || || X || X || || X1 || || || || X1 || || || || || 1 || X || 1 || 1 ||

|| || PWR-1300 || 2 || 04/03/1994 || 18 || 1310 || || X || X || || X1 || || || || X1 || || || || || 1 || X || 1 || 1 ||

|| Gravelines || PWR-900-CPY-CP1 || 1 || 25/11/1980 || 31 || 910 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPY-CP1 || 2 || 01/12/1980 || 31 || 910 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPY-CP1 || 3 || 01/06/1981 || 31 || 910 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPY-CP1 || 4 || 01/10/1981 || 30 || 910 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPY-CP1 || 5 || 15/01/1985 || 27 || 910 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPY-CP1 || 6 || 25/10/1985 || 26 || 910 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| Nogent || PWR-1300 || 1 || 24/02/1988 || 24 || 1310 || || X || X || || X1 || || || || X1 || || || || || 1 || X || 1 || 1 ||

|| || PWR-1300 || 2 || 01/05/1989 || 23 || 1310 || || X || X || || X1 || || || || X1 || || || || || 1 || X || 1 || 1 ||

|| Paluel || PWR-1300 || 1 || 01/12/1985 || 26 || 1330 || || X || X || || X1 || || || || X1 || || || || || 1 || X || 1 || 1 ||

|| || PWR-1300 || 2 || 01/12/1985 || 26 || 1330 || || X || X || || X1 || || || || X1 || || || || || 1 || X || 1 || 1 ||

|| || PWR-1300 || 3 || 01/02/1986 || 26 || 1330 || || X || X || || X1 || || || || X1 || || || || || 1 || X || 1 || 1 ||

|| || PWR-1300 || 4 || 01/06/1986 || 26 || 1330 || || X || X || || X1 || || || || X1 || || || || || 1 || X || 1 || 1 ||

|| Penly || PWR-1300 || 1 || 01/12/1990 || 21 || 1330 || || X || X || || X1 || || || || X1 || || || || || 1 || X || 1 || 1 ||

|| || PWR-1300 || 2 || 01/11/1992 || 19 || 1330 || || X || X || || X1 || || || || X1 || || || || || 1 || X || 1 || 1 ||

|| St. Alban || PWR-1300 || 1 || 01/05/1986 || 26 || 1335 || || || X || || X1 || || || || X1 || || || || || 1 || X || 1 || 1 ||

|| || PWR-1300 || 2 || 01/03/1987 || 25 || 1335 || || || X || || X1 || || || || X1 || || || || || 1 || X || 1 || 1 ||

|| St. Laurent || PWR-900-CPY-CP2 || B-1 || 01/08/1983 || 29 || 915 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPY-CP2 || B-2 || 01/08/1983 || 29 || 915 || || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| Tricastin || PWR-900-CPY-CP1 || 1 || 01/12/1980 || 31 || 915 || X || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPY-CP1 || 2 || 01/12/1980 || 31 || 915 || X || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPY-CP1 || 3 || 11/05/1981 || 31 || 915 || X || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

|| || PWR-900-CPY-CP1 || 4 || 01/11/1981 || 30 || 915 || X || X || X || || X1 || || || || || || || || || 1 || X || 1 || 1 ||

DE || Biblis || PWR || A || 26/02/1975 || 37 || 1167 || || || || || || || || || X || || || || X || X || || X || X ||

|| || PWR || B || 31/01/1977 || 35 || 1240 || || || || || || || || || X || || || || X || X || || X || X ||

|| Brokdorf || PWR || || 22/12/1986 || 25 || 1410 || || || || X || || X || || || X1 || || || || || X || X || X || X ||

|| Brunsbüttel || BWR || || 09/02/1977 || 35 || 771 || || || || X || || X || || || X || || || || X || X || X || X || X ||

|| Emsland || PWR || || 20/06/1988 || 24 || 1329 || || || || || || || || || X1 || || || || X || X || X || X || X ||

|| Grafenrheinfeld || PWR || || 17/06/1982 || 30 || 1275 || X || || || X || || || || || X1 || || || || || X || X || X || X ||

|| Grohnde || PWR || || 01/02/1985 || 27 || 1360 || || || || X || || || || || X1 || || || || || X || X || X || X ||

|| Gundremmingen || BWR || B || 19/07/1984 || 28 || 1284 || X || || || || || || || || X1 || || || || X || X || X || X || X ||

|| || BWR || C || 18/01/1985 || 27 || 1288 || X || || || || || || || || X1 || || || || X || X || X || X || X ||

|| Isar || BWR || 1 || 21/03/1979 || 33 || 878 || || || || X || || || || || X || || || || || || || X || X ||

|| || PWR || 2 || 09/04/1988 || 24 || 1410 || || || || X || || || || || X1 || || || || || X || X || X || X ||

|| Krümmel || BWR || || 28/03/1984 || 28 || 1346 || || || || X || || X || || || X || || || || || X || || X || X ||

|| Neckarwestheim || PWR || 1 || 01/12/1976 || 35 || 785 || || || || || || || || || X || || || || X || || X || X || X ||

|| || PWR || 2 || 15/04/1989 || 23 || 1310 || || || || || || || || || X1 || || || || X || X || X || X || X ||

|| Philippsburg || BWR || 1 || 26/03/1980 || 32 || 890 || || || || || || || || || X || || || || X || X || X || X || X ||

|| || PWR || 2 || 18/04/1985 || 27 || 1402 || || || || || || || || || X1 || || || || X || X || X || X || X ||

|| Unterweser || PWR || || 06/09/1979 || 33 || 1345 || || || || X || || || || || X || || || || || X || X || X || X ||

HU || Paks || PWR (VVER-440/213) || 1 || 10/08/1983 || 28 || 470 || X || || || || || || || || || || X || || || || X || X || X ||

|| || PWR (VVER-440/213) || 2 || 14/11/1984 || 27 || 473 || X || || || || || || || || 1 || || X || || || || X || X || X ||

|| || PWR (VVER-440/213) || 3 || 01/12/1986 || 25 || 473 || X || || || || || || || || 1 || || X || || || || X || X || X ||

|| || PWR (VVER-440/213) || 4 || 01/11/1987 || 24 || 473 || X || || || || || || || || 1 || || X || || || || X || X || X ||

LT || Ignalina || LWGR (RBMK 1500) Permanent shutdown || 1 || 31/12/1983 || - || - || X || || || X || || || || || || || || || 1 || || || X || X ||

|| || LWGR (RBMK 1500) Permanent shutdown || 2 || 01/08/1987 || - || - || X || || || || || || || || || || || || 1 || || || X || X ||

NL || Borssele || PWR || || 26/10/1973 || 38 || 487 || X || || X1 || X1 || X1 || X1 || || || || || || || X || X || X || X || 1 || X

RO || Cernavoda || PHWR (CANDU-6) || 1 || 02/12/1996 || 15 || 650 || X || X || || ||  X1 || || || || X || X1 || X1 || || X || || X || X || X ||

|| || PHWR (CANDU-6) || 2 || 31/10/2007 || 4 || 650 || X || X || || || || || || X || X || X1 || X1 || || || || X || X || X ||

SK || Bohunice || PWR (VVER-440/213) || 3 || 14/02/1985 || 27 || 505 || || || || || || || || || X1 || X1 || X || || || || 1 || 1 || X ||

|| || PWR (VVER-440/213) || 4 || 18/12/1985 || 26 || 505 || || || || || || || || || X1 || X1 || X || || || || 1 || 1 || X ||

|| Mochovce || PWR (VVER-440/213) || 1 || 29/10/1998 || 13 || 470 || X || || || || X || || || || X1 || X1 || X || || || || 1 || 1 || X ||

|| || PWR (VVER-440/213) || 2 || 11/04/2000 || 12 || 470 || X || || || || X || || || || X1 || X1 || X || || || || 1 || 1 || X ||

SI || Krsko || PWR || || 01/01/1983 || 28 || 666 || X || || || || || || || || || X1 || X1 || || || || || X || ||

ES || Almaraz || PWR || 1 || 01/09/1983 || 28 || 1008 || X || || || || || || || || X1 || X1 || X1 || || || || X || || 1 ||

|| || PWR || 2 || 01/07/1984 || 27 || 956 || X || || || || || || || || X1 || X1 || X1 || || || || X || || 1 ||

|| Asco || PWR || 1 || 10/12/1984 || 27 || 996 || || || || || || || || || X1 || X1 || X1 || || X || || X || || 1 ||

|| || PWR || 2 || 31/03/1986 || 25 || 992 || || || || || || || || || X1 || X1 || X1 || || X || || X || || 1 ||

|| Cofrentes || BWR/6 MK-3 || || 11/03/1985 || 26 || 1064 || || || || || || || || || X1 || X1 || X || || X || || || || 1 ||

|| S.Maria de Garona || BWR/4 MK-1 || || 11/05/1971 || 40 || 446 || || || || || || || || || X1 || X1 || X1 || || X || || || || 1 ||

|| Trillo || PWR || 1 || 06/08/1988 || 23 || 1000 || X || || || || || || || X || X1 || || X1 || || X || X || X || || 1 ||

|| Vandellos || PWR || 2 || 08/03/1988 || 23 || 1045 || || || || || || || || || X1 || X || X1 || || X || || X || || 1 ||

SE || Forsmark || BWR || 1 || 10/12/1980 || 31 || 978 || X || || || || X || || X || || || X || || || || || || 1 || X ||

|| || BWR || 2 || 07/07/1981 || 30 || 990 || X || || || || X || || X || || || X || || || || || || 1 || X ||

|| || BWR || 3 || 18/08/1985 || 26 || 1170 || X || || || || X || || || || || X || || || || || || 1 || X ||

|| Oskarshamn || BWR || 1 || 06/02/1972 || 39 || 473 || || || || || X || X || || || || X || || || || || || 1 || X ||

|| || BWR || 2 || 01/01/1975 || 36 || 638 || || || || || X || X || || || || X || || || || || || 1 || X ||

|| || BWR || 3 || 15/08/1985 || 26 || 1400 || || || || || X || X || || || || X || || || || || || 1 || X ||

|| Ringhals || BWR || 1 || 01/01/1976 || 35 || 855 || X || || || || X || || || || || X || || || || || || 1 || X ||

|| || PWR || 2 || 01/05/1975 || 36 || 813 || X || || || || X || || || || || || || || || || || 1 || X ||

|| || PWR || 3 || 09/09/1981 || 30 || 1051 || X || || || || X || || || || || || || || || || || 1 || X ||

|| || PWR || 4 || 21/11/1983 || 28 || 935 || X || || || || X || || || || || || || || || || || 1 || X ||

UK || Dungeness B || AGR || 1 || 01/04/1985 || 26 || 520 || || || || || || || || X[9] || X2 || X || || X || || || X || X || ||

|| || AGR || 2 || 01/04/1989 || 22 || 520 || || || || || || || || X2 || X2 || X || || X || || || X || X || ||

|| Hartlepool || AGR || 1 || 01/04/1989 || 22 || 595 || || || || || || || || X2 || X2 || X || || X || || || X || X || ||

|| || AGR || 2 || 01/04/1989 || 22 || 595 || || || || || || || || X2 || X2 || X || || X || || || X || X || ||

|| Heysham 1 || AGR || 1 || 01/04/1989 || 22 || 585 || || || || || || || || X2 || X2 || X || || X || || || X || X || ||

|| || AGR || 2 || 01/04/1989 || 22 || 575 || || || || || || || || X2 || X2 || X || || X || || || X || X || ||

|| Heysham 2 || AGR || 1 || 01/04/1989 || 22 || 620 || X || || || || || || || X2 || X2 || X || || || || || X || X || ||

|| || AGR || 2 || 01/04/1989 || 22 || 620 || X || || || || || || || X2 || X2 || X || || || || || X || X || ||

|| Hinkley Point B || AGR || 1 || 02/10/1978 || 33 || 410 || || || || || || || || X2 || X2 || X || || X || || || X || X || ||

|| || AGR || 2 || 27/09/1976 || 35 || 430 || || || || || || || || X2 || X2 || X || || X || || || X || X || ||

|| Hunterston B || AGR || 1 || 06/02/1976 || 35 || 430 || || || || || || || || X2 || X2 || X || || X || || || X || X || ||

|| || AGR || 2 || 31/03/1977 || 34 || 430 || || || || || || || || X2 || X2 || X || || X || || || X || X || ||

|| Oldbury || GCR || 1 || 31/12/1967 || 44 || 217 || || || || || || || || X2 || X2 || X || || X || || || X || X || ||

|| || GCR || 2 || 30/09/1968 || 43 || 217 || || || || || || || || X2 || X2 || X || || X || || || X || X || ||

|| Sizewell B || PWR || 1 || 22/09/1995 || 16 || 1188 || X || || || || || || || || X2 || X1 || X1 || || || || X || || ||

|| Torness || AGR || 1 || 25/05/1988 || 23 || 600 || || || || || || || || X2 || X2 || X || || || || || X || X || ||

|| || AGR || 2 || 03/02/1989 || 22 || 605 || || || || || || || || X2 || X2 || X || || || || || X || X || ||

|| Wylfa || GCR || 1 || 01/11/1971 || 40 || 490 || || || || || || || || X2 || X2 || X || || X || || || X || X || ||

|| || GCR || 2 || 03/01/1972 || 39 || 490 || || || || || || || || X2 || X2 || X || || X || || || X || X || ||

 

[1]               ENSREG specifications agreed in May 2011, see www.ensreg.eu

[2]               January 2012

[3]               http://www.ensreg.eu/sites/default/files/ENSREG%20Action%20plan.pdf

[4]               http://www.ensreg.eu/sites/default/files/Peer%20Review%20Topical%20Teams.pdf

http://ensreg.com/sites/default/files/Country%20Review%20Teams.pdf

[5]               This section is based on the Final Report of the Council Ad-hoc Group on Nuclear Security (AHGNS).

[6]               http://register.consilium.europa.eu/pdf/en/12/st10/st10616.en12.pdf, 31.5.2012.

[7]               International Physical Protection Advisory Service.

[8] Improvement planned.

[9] EOPs and SAMGs needs further development to be in line with international standards – Improvement planned.