Loviisa compliance 395/1991

Compliance with the general regulations for the safety of nuclear power plants (Decision 395/1991)

The Loviisa plant


EXECUTIVE SUMMARY

This document is a safety review report on the Loviisa nuclear power plant. Decision 395/1991 of the Council of State on general regulations for the safety of nuclear power plants is the basis of the review. General principles, radiation exposure and releases of radioactive materials, nuclear safety as well as the operation of the Loviisa plant are considered in this report.

The Loviisa plant fulfils in essential parts the requirements for ensuring safety functions and for a provision against various accidents. However, deviations exist which relate to

  • a provision for a failure of some components needed in performing of a safety function in case a redundant component is out of operation
  • the estimated radiation dose of an individual of the critical group, caused by a major leak from the primary to the secondary circuit (considered as a postulated accident)
  • a provision for severe reactor accidents.

The requirements in question have been primarily provided for new nuclear power plants after the commissioning of the Loviisa plant, and they are not specifically related to the power level of a plant. So the planned 9% increase of the current reactor nominal thermal power 1375 MW does not change the situation related to these issues.

Imatran Voima Oy (IVO) has still many on-going projects at the Loviisa plant for enhancing safety. This is in line with the principle of the continuous improvement of safety provided in Section 27 of Decision 395/1991. Section 28 of Decision 395/1991 allows to consider expediency in evaluating technical solutions at nuclear power plants in operation. STUK considers that at both the current and also the uprated reactor nominal thermal power 1500 MW (109% compared with the current power level) the Loviisa plant is in compliance with the provisions of Decision 395/1991, taking into account the provisions of Section 28 of Decision 395/1991 and the plant modifications for enhancing safety planned to be implemented in the near future.


CONTENTS

EXECUTIVE SUMMARY

1 INTRODUCTION

2 GENERAL PRINCIPLES

2.1 General objective

2.2 Safety culture

2.3 Quality Assurance

2.4 Demonstration of compliance with the safety requirements

3 RADIATION SAFETY

3.1 Limitation of radiation exposure

3.2 Radiation safety of nuclear power plant workers

3.3 Limit for normal operation

3.4 Limit for an anticipated operational transient

3.5 Limit for a postulated accident

3.6 Limit for a severe accident

4 NUCLEAR SAFETY

4.1 Levels of protection

4.2 Technical barriers for preventing the dispersion of radioactive materials

4.3 Ensuring fuel integrity

4.4 Ensuring primary circuit integrity

4.5 Ensuring containment integrity

4.6 Ensuring safety functions

4.7 Avoiding human errors

4.8 Protection against external events and fires

4.9 Safety classification

4.10 Monitoring and control of a nuclear power plant

5 OPERATION OF A NUCLEAR POWER PLANT

5.1 Technical Specifications and plant procedures

5.2 Operation and maintenance

5.3 Personnel

5.4 Monitoring releases of radioactive materials

5.5 Operating experiences and safety research

5.6 Nuclear power plants in operation

REFERENCE


1 INTRODUCTION

The Council of State decided on 14.2.1991, by virtue of Section 81 of the Nuclear Energy Act, on the general regulations for the safety of nuclear power plants (395/1991). Decision 395/1991 has been valid since 1.3.1991.

This document is a safety review report on the Loviisa plant. The review is based on the safety level requirements of Decision 395/1991 395/1991. In addition, YVL Guides issued by STUK have been taken into account. Among the most essential of YVL Guides are Guides YVL 1.0, YVL 2.2, YVL 2.4, YVL 2.7 and YVL 2.8, which have been revised since the issue of Decision 395/1991. The reactor nominal thermal power 1500 MW, which includes the planned 9% reactor power increase, has been taken into account in this review.

The fulfilment of the general principles (Sections 3–6) of Decision 395/1991 are considered in Chapter 2 of the report. The conclusion is that these principles on general objectives, safety culture, quality assurance and demonstration of compliance with the safety regulations are fulfilled. Safety culture, quality assurance and safety analyses have to be maintained and developed throughout the lifetime of a nuclear power plant. According to the current structure of IVO Group, the Loviisa plant also bears the prime design responsibility related to the implementation of the nuclear safety principles, although the real expertise in this field lies in other parts of IVO Group. The activities of IVO have to be developed in the future so that those who are responsible have also necessary expertise, especially related to the implementation of safety principles, and that the expertise of the whole IVO Group is utilised more efficiently.

In Chapter 3 of this report, the fulfilment of the provisions (Sections 7–12) of Decision 395/1991 concerning radiation exposure and releases of radioactive materials are considered. The occupational radiation doses are internationally compared low and the dose limits have not been exceeded. The releases of radioactive materials caused by the normal operation of the plant and the resulted exposure of the surroundings population have remained essentially lower than the set limits. Any incident occurred at the plant has not caused a radioactive release that would have been seen as an increase of the annual release level related to the normal operation.

The Loviisa plant fulfils the provisions of Section 28 of Decision 395/1991 for nuclear power plants, which were in use before Decision 395/1991 became valid. The plant fulfils the provisions of Sections 11 and 12 of Decision 395/1991, set primarily for new nuclear power plants, with the following exceptions:

  • According to the analyses the radiation exposure limit 5 mSv set in Section 11 of Decision 395/1991 is not exceeded in the postulated accidents except a major leak from the primary to the secondary circuit. The analyses show that in this case the limit 100 mSv provided in Section 28 of Decision 395/1991 is not exceeded.
  • Planned safety improvements at the Loviisa 1 and 2 units for severe reactor accidents are still partly unfinished. This kind of accident may result in exceeding the requirements provided in Section 12 of Decision 395/1991 concerning the limitation of radioactive material releases. Plant modifications needed for the improvement of the situation have been, however, mainly designed. The principles of the modifications have been accepted by STUK.

In Chapter 4 of this report the fulfilment of the nuclear safety design requirements (Sections 13–22) of Decision 395/1991 are evaluated, taking into account the planned 9% power increase of the plant. The Loviisa plant fulfils the design requirements provided in Sections 17 and 18 of Decision 395/1991 with the following exceptions:

  • In the original design of the Loviisa 1 and 2 units severe reactor accidents were disregarded, and therefore the containment was not designed according to Section 17 of Decision 395/1991. IVO has designed and STUK has approved the measures for improving safety. When these measures have been implemented the deficiency will no longer exist.
  • The safety functions of the Loviisa 1 and 2 units have not been in every detail ensured according to Section 18 of Decision 395/1991. The most significant deviations concern the function of the safety systems even though an individual component would fail to operate and additionally any component would be out of operation simultaneously due to repairs or maintenance. This deviation has reflected to the Technical Specifications in such a way that a short repair time is required for the components in question. Deviations exist also in the separation of the redundant parts of the safety systems in such a way that their failure due to same external cause would be unlikely. On the other hand, the safety systems of the Loviisa units are, however, in many ways functionally exceptionally flexible that improves the reliability of the safety functions.

The objective of the requirements in Section 16 of Decision 395/1991 is to ensure the integrity of the primary circuit of the plant. After the commissioning of the Loviisa 1 and 2 units it has been observed that the embrittlement of the reactor pressure vessels of the units due to neutron radiation is faster than presented in the design information. Due to the embrittlement several measures for increasing safety have been taken. In this way adverse effects of the embrittlement could be adequately mitigated. The embrittlement of the pressure vessel material is continuously followed. For the present, STUK has accepted the use of the pressure vessel of the Loviisa 1 unit until 2004 and of the Loviisa 2 unit until 2010.

According to Paragraph 2 of Section 28 of Decision 395/1991 the requirements of Sections 17 and 18 are applied to a nuclear power plant in operation to the extent justified based on the provisions of Paragraph 2 of Section 27, and taking into account the technical solutions of the nuclear power plant in question.

For enhancing safety IVO has introduced projects, the objective of which is to fulfil the provisions of Sections 17 and 18 of Decision 395/1991 as far as reasonable achievable. The projects are in compliance with the provision of Section 27 of Decision 395/1991 to take such actions for further safety enhancement which can be regarded as justified considering operating experience and the results of safety research as well as the advancement science and technology. The planned increase of the reactor power has no effect on possibilities to comply with the provisions of Decision 395/1991. Taking into account the safety improvements planned to be implemented in the near future STUK considers the situation regarding to Sections 17 and 18 as acceptable.

In Chapter 5 of this report the fulfilment of the provisions (Sections 23–27) of Decision 395/1991 concerning the operation of a nuclear power plant is evaluated. It is concluded that the provisions concerning the operation are fulfilled.

The operating experiences of the Loviisa plant have been good, and the number of incidents of safety significance has remained small. Operating events have been discussed in quarter and annual reports on the regulatory control of nuclear power plants issued by STUK. Operating experiences of the Loviisa plant during the passed licence term are also discussed in Chapter 5.5 of this report.

In the safety review, the following issues have been noted as essential subjects for development during the term of the new licence:

  • to arrange the responsibility for safety and design in such a way that required expertise is available for those, who are responsible for the state of the plant. This is especially important in issues related to the implementation of safety principles. This subject for development relates to safety culture, quality assurance, personnel and organisation
  • to mitigate consequences of accidents leading to bypass of the containment at the beginning or during an accident
  • to develop a qualification system for non-destructive inservice inspections
  • to make more effectively use of operating experiences for avoiding the recurrence of similar operating incidents.

In summary, STUK considers that at both the current and also the uprated reactor nominal thermal power 1500 MW (109% compared with the current power level) the Loviisa plant is in compliance with the provisions of Decision 395/1991, taking into account the provisions of Section 28 of Decision 395/1991 and the plant modifications for enhancing safety planned to be implemented in the near future.


2 GENERAL PRINCIPLES

2.1 General objective

The general objective is to ensure nuclear power plant safety so that nuclear power plant operation does not cause radiation hazards which could endanger safety of workers or population in the vicinity or could otherwise harm the environment or property. (Section 3 of Decision 395/1991)

The general provisions for ensuring the achievement of the general objective are presented in Decision 395/1991. In YVL Guides the safety objectives are further defined, as considered by STUK. The review of the fulfilment of the objectives comprises the issues discussed in the following.

2.2 Safety culture

When designing, constructing and operating a nuclear power plant, an advanced safety culture shall be maintained which is based on the safety oriented attitude of the topmost management of the organisations in question and on motivation of the personnel for responsible work. This presupposes well organised working conditions and an open working atmosphere as well as the encouragement of alertness and initiative in order to detect and eliminate factors which endanger safety. (Section 4 of Decision 395/1991)

The concept of safety culture was presented shortly after the Chernobyl accident by IAEA's International Nuclear Safety Advisory Group (INSAG). In 1991 the issue was defined more accurately in a report INSAG-4 “Safety Culture”, made by INSAG. For evaluating the state of safety culture IAEA has published a so-called ASCOT-guidance. In the ASCOT-guidance actual characteristics of an advanced safety culture are described.

According to the principles of safety culture it is important that in all organisations influencing safety a proper emphasis in all activities is given to factors important to safety. On one hand a good safety culture grows from the organisations' ways of action and, on the other hand, out of individual attitudes.

The significance of safety culture as a factor influencing safety has been widely recognised in the 1990's. The development of safety culture is a continuos learning process, which in every utility and nuclear power plant occurs in a slightly different way, because of their own starting points. Principles and practices expressing the advanced safety culture have been applied at the Finnish nuclear power plants already before the concept ever came up. The advanced safety culture has a lot of common goals with the development of a quality assurance programme, management procedures and a whole working environment.

IVO has a long tradition in power production. That has influenced on the development of the company's organisational culture and reflected positively to the design, construction and operation of the Loviisa plant. A factor that has influenced on the development of safety culture at the Loviisa plant has been the inadequacy of operation procedures received from the plant supplier. It caused a need to put effort in the design of the plant and to develop the functions of the operating organisation. This development process has given to the plant and the whole IVO Group a strong expertise in several issues.

In the 1990's IVO internationalised in a strong way and with the acquisitions and incorporation IVO has become a Group organisation. In the Group it has been considered appropriate that each independent company or unit develops its organisational culture from its own starting points, taking into account the principles of the Group management on common visions and values. It has been evaluated in IVO that the attitude in the Group on the continuous development of activities gives a solid frame for maintaining an advanced safety culture in the operation of the Loviisa plant.

The concept of the advanced safety culture was added in the Administrative Rules of the Loviisa plant in 1991. The quality policy of the plant written in 1996 brings up the meaning of safety expressing good safety culture (Chapter 2.3).

Several measures have been implemented at the Loviisa plant for maintaining and developing safety culture. Related to this IVO carried out a self-evaluation in 1994 using an interview method based on the ASCOT-guidance. During the preparation of the application for the operating licence the state of safety culture was evaluated using mainly the ASCOT-guidance as a point of comparison. Based on the evaluation the procedures for maintaining safety and availability have been noted to be comprehensive and relatively well operative.

In the evaluation many good characteristics of safety culture were noted. Respectively, the most important areas have been identified, to which the development measures should be focused in the future for the continuous development of safety culture. By nature these issues are related to the activities of organisations and people.

STUK has reviewed safety culture and its development in IVO and at the Loviisa plant, firstly on the basis of how the safety culture has been promoted by various measures and how its development has been evaluated, and secondly on the basis of observations made in connection with inspection and control activities by STUK.

According to STUK's opinion the development of safety culture has been actively promoted in IVO and at the Loviisa plant, and areas where development measures are especially needed have been identified. Based on STUK's observations, one area which needs improvement measures is the building of a general view on many-sided safety issues. This results partially from the separation of the design duties related to the implementation of the safety principles and the responsibility for safety in the current organisation of IVO Group. This is against a good organisational safety culture. According to the opinion of STUK, in addition to the identified measures more attention shall paid to the co-operation between the Loviisa plant and IVO Power Engineering Oy and to co-operation procedures followed in connection with the design of the plant modifications, as well as to the utilisation of modification work experiences for the development of activities.

In conclusion, safety culture complying with the provisions of Section 4 of Decision 395/1991 is maintained in IVO. In the future, however, it is necessary to develop the activities of IVO so that those who are responsible have also necessary expertise, especially related to the implementation of safety principles, and that the expertise of the whole Group is utilised more efficiently.

2.3 Quality Assurance

Advanced quality assurance programmes shall be employed in all activities which affect safety and relate to the design, construction and operation of a nuclear power plant. (Section 5 of Decision 395/1991)

The Administrative Rules of the Loviisa plant define the Loviisa plant operating organisation and the duties, authorities and responsibilities of the staff of the plant. The Administrative Rules are limited in matters significant for operational safety, and it is the document mentioned in Section 122 of the Nuclear Energy Decree. The operating organisation of the Loviisa plant is directly under the supervision of the IVO Group's Vice Managing Director, who is responsible for technology.

STUK has approved the person proposed by IVO to work as a responsible director defined in Section 79 of the Nuclear Energy Act. Respectively, STUK has accepted the persons proposed by IVO as deputies for the responsible director.

A Nuclear Committee of the Loviisa plant (LYTT) has been appointed by the Board of Directors of IVO as an advisory body in nuclear safety issues. One of the duties of the Committee is to observe the quality assurance for operation and to give recommendations on quality assurance activities. LYTT reports to the Board of Directors of the company. LYTT has regularly held meetings. STUK has checked the records of the meetings and evaluated the activities of LYTT in connection with the inspection programme for the operation. In the inspections, there has been no remarks on the activities of LYTT.

For evaluation and feedback of operating experiences from other nuclear power plants an internal group of the Group has been established. This group (IVO-KKR) has a duty to serve the Loviisa plant and the nuclear design activities of the Group by evaluating operating experiences and making recommendations for actions at the Loviisa plant, and by transferring information on operating events. IVO-KKR presents its recommendations for the consideration of the management group of the Loviisa plant. IVO-KKR has regularly held meetings, and the records of the meetings have been submitted to STUK for information. STUK considers that the activities of IVO-KKR are appropriate.

IVO Group and the Loviisa plant have established a quality system. Ex-Managing Director of the company has defined IVO's quality policy. Based on the strategic planning of the company, it defines the principles on the quality objectives of the products and services of the company. The quality policy of the Group is partly obsolete, and needs to be updated.

IVO's requirements on quality assurance have been presented in the Quality Assurance Manual for Operation of the Loviisa plant and in the related instructions of the guidance system of the plant, as well as in the Manual concerning nuclear fuel procurement. The Loviisa plant has regularly updated its guidance. In 1996, IVO included the quality policy principles and requirements of the Loviisa plant in the Quality Assurance Manual. Vice Managing Director of IVO Group, responsible for the operating organisation of the Loviisa plant, has accepted with his signature the quality policy mentioned above and the related chapters of the Quality Assurance Manual for Operation of the Loviisa plant.

Detailed requirements on quality assurance related to Section 5 of Decision 395/1991 are provided in Guides YVL 1.4 and YVL 1.9, issued by STUK. Guide YVL 6.7 relates to the quality assurance of nuclear fuel. In addition, almost all YVL Guides include requirements which belong to the scope of quality assurance, or relate to it. However, there is no exact definition in YVL Guides on the meaning of “advanced quality assurance programmes”.

In addition to the quality policy, the Quality Assurance Manual includes requirements on the Manual itself, organisation, training and qualification of the personnel, control of documents, operation, maintenance, activities of the technical group, modifications of components, systems and structures, inspection and testing activities, procurement and storage, procedures for deviations, deficiencies and faults, fire protection and audits.

According to the current international practice, the quality system concentrates on procedures for maintaining the operation of the plant and for practical implementation of modification works. The quality system of the Loviisa plant does not include proper requirements on the design related to the implementation of safety principles, although the plant bears the prime responsibility for this activity, too. Extension of the quality system to also cover this subarea is a subject for development in the future. This issue concerns both regulatory requirements as well as the operation of the plant. Experiences on the development of quality systems in other industrial areas are worth to make use of in this development work.

The effectiveness and coverage of the quality assurance programme are evaluated by two different ways:

  • An internal evaluation of the plant; the coverage and effectiveness of the quality assurance system are annually evaluated and reported by the group leaders as regards their own responsibility areas and by the quality assurance unit as regards the whole quality system.
  • An independent evaluation, which is carried out by a person appointed by Vice Managing Director of IVO Group responsible for the Loviisa plant. The subjects of the evaluation are the efficiency of the quality system and the activities of the quality assurance unit. These audits have been regularly carried out semi-annually, and the audit records have been submitted to STUK for information.

The quality assurance unit of the Loviisa plant carries out audits for ensuring that the various activities are carried out according to the Quality Assurance Manual and to the instructions of the guidance system of the Loviisa plant. From time to time STUK and IVO have discussed about the organisational position of the quality assurance unit at the Loviisa plant. The unit is not according to the normal international practice directly under the supervision of the responsible director of the plant. In practice, this has caused no problems, and the independent evaluation practice mentioned above contributes to ensuring the existence of adequate independence. Resources needed for the development of the quality assurance activities require re-evaluation.

IVO has regularly revised its Quality Assurance Manual for Operation. STUK has accepted the changes of the Manual. To the extent required, other instructions of the guidance system of the plant have been submitted to STUK for information. Work orders and operating orders used for guiding various work performances have been evaluated in connection with on-site inspections by STUK.

The inspection programme of STUK concerning the operation of nuclear power plants has been developed so that all inspections of the programme contribute to clearing up the state of quality assurance in various subareas. The activities of the quality assurance unit are subject to inspections. In the inspections the aim is to ensure that quality assurance has been implemented efficiently and according to the Manual.

By order of STUK, an independent quality assurance audit was carried out by a third party in 1997. The subjects of the audit were the modification work processes followed at the plant and the evaluation of operating events. Observations made were consistent with the observations of the inspections by STUK.

In conclusion, IVO's quality assurance is in compliance with the provisions of Section 5 of Decision 395/1991.

2.4 Demonstration of compliance with the safety requirements

If compliance with the safety regulations cannot be directly ascertained, fulfilment shall be demonstrated by the necessary experimental and calculational methods.

Nuclear power plant safety and the design of its safety systems shall be substantiated by accident analyses and probabilistic safety analyses. Analyses shall be maintained and revised if necessary, taking into account operating experience, the results of experimental research and the advancement of calculating methods.

The calculating methods employed for demonstrating the meeting of the safety regulations shall be reliable and well qualified for dealing with the events in question. They shall be applied so that the calculated results are, with a good confidence, less favourable than the results which are considered best estimates. Furthermore, analyses which picture the likely course of transients and accidents shall be conducted for the purpose of probabilistic safety analyses and for the development of emergency operating procedures. (Section 6 of Decision 395/1991)

Detailed requirements on transient and accident analyses for justification of safety and the technical solutions of the safety systems at nuclear power plants, related to Section 6 of Decision 395/1991, are presented in Guide YVL 2.2 as well as in Guide YVL 2.4 regarding to the over-pressure protection of the primary and secondary circuit. In addition, Guide YVL 1.0 includes requirements, the fulfilment of which is evaluated by means of accident analyses.

The trial use and tests of the Loviisa plant at the increased power level are also discussed in this Chapter.

STUK has presented requirements on Probabilistic Safety Analyses in Guide YVL 2.8.

Transient and accident analyses

By means of analyses it is aimed to demonstrate the capability of the plant to cope with various transient and accident situations safely enough. According to Guide YVL 2.2, the analyses shall be focused to events, which by nature and severity cover different kind of transient and accident situations as well as possible. The course of transients and accidents shall be evaluated from the initiating event and resulting in a safe and stable state.

IVO has revised in connection with the modernising of the Loviisa 1 and 2 units the transient and accident analyses included the Final Safety Analysis Report, taking into account the planned reactor power increase.

For the assesment of normal operating conditions, transients and postulated accidents IVO has used primarily calculation methods which have been developed in Finland. So-called topical reports have also been presented on used methods. Their aim is to demonstrate the reliability and usability of the methods. Methods have been validated to the extent, which is consistent with the level recognised internationally as good, mainly by making reference calculations with various methods and by using measurement results at experimental equipment as a reference. Due to uncertainties related to the accuracy of the calculation methods it is essential that adequate safety margins are applied when evaluating the fulfilment of the acceptance criteria of analyses.

Input data and assumptions influencing on the results of the analyses as well as made sensitivity calculations have also been presented and justified in the analyses described in the Safety Analysis Report and in related topical reports. STUK has reviewed the analyses and the methods applied. In addition, STUK has made independent reference analyses, or such analyses have been done by order of STUK. Sensitivity calculations and reference analyses are needed for evaluating and reducing uncertainties related normally to calculation methods and assumptions.

The analyses presented in the Safety Analysis Report cover anticipated operational transients, postulated accidents used as a design basis of safety systems and so called severe reactor accidents. Analyses related to severe reactor accidents, mainly radioactive release analyses, are still partly being done (provision for severe reactor accidents is also discussed in Chapter 4.5). Different transient and accident types have been classified. Each category contains several different accident sequences. Specific analyses have been presented on each accident sequence. Each analysis essential to safety includes sensitivity calculations which are often considerably extensive.

The anticipated operational transients are events which can be expected to occur at least once during the lifetime of a plant. The following events have been considered as anticipated operational transients:

  • stopping and jamming of reactor coolant pumps
  • uncontrollable withdrawal of control rods
  • stopping of a main feedwater pump
  • closure of isolation valves of steam generators
  • loss of off-site power supply.

Based on the results of the analyses concerning operational transients it can be noted that the planned power increase does not essentially make the transient behaviour of the plant worse.

As postulated accidents all such situations have been re-evaluated which according to Guide YVL 2.2 are postulated accidents and which begin at full reactor power. These kind of accidents are:

  • loss of coolant accidents
  • breaks of a steam line
  • leaks from the primary to secondary circuit
  • ejection of a control rod
  • anticipated transients without scram (ATWS)
  • a large spectrum of disturbances in reactivity control, including false dilution of boron concentration in the primary circuit (boron is used in reactivity control)

As regards transients beginning at low or zero-power, the power increase can only be at most seen as small changes in the process quantities of the initial state, when compared with the present figures. IVO has evaluated the course of these kind of accidents based on the analyses for the current power.

Furthermore, transients and accident situations beginning in outage situations have been analysed.

The influence of the planned 9% power increase on the results of accident analyses is mainly quite small. The influence can be seen more clearly in connection with a so-called major loss of coolant accident. Due to the power increase, the maximum cladding temperature of the fuel rods exceeds during this kind of postulated accident the maximum temperature calculated using comparable assumptions and the current nominal power 1375MW. The mentioned exceeding is, however, only a small part of the present safety margin to the approval criterion of the maximum fuel rod cladding temperature. On the other hand, because the power increase is implemented by balancing the power distribution without changing the load of the most loaded fuel rods, the number of the most loaded fuel rods slightly increases.

In connection with the updating of the safety analyses it was noted that the original dimensioning of the intermediate cooling circuit for decay heat removal from the containment has been done on faulty basis. In accident conditions, the intermediate cooling system has two essential duties: to remove decay heat into the final heat sink, and to cool a large number of equipment and systems for various safety functions and their room spaces. Accordingly, the reliable function of the intermediate cooling system is an essential safety factor in accident situations. IVO has implemented extensive measures for increasing the design temperature of the intermediate cooling circuit, in order to ensure the adequate reliability of the functions of the intermediate circuit on the basis of new information. Such measures are i.a. process modifications for decreasing heat load and component modifications for improving heat endurance of motors and cables.

Accident analyses for evaluating functioning capabilities of the safety systems are also discussed in Chapter 4.3 as regards the reactor core and nuclear fuel, and in Chapters 3.4 and 3.5 as regards radiation safety.

IVO has separately made accident analyses for the storages of spent fuel and reactor wastes. The descriptions and results of the analyses have been presented in the appropriate Chapters of the Safety Analysis Report.

Transient and accident analyses and used analytical methods have to be maintained and developed throughout the whole lifetime of a nuclear power plant. Based on the results of the analyses measures are taken for enhancing safety, when necessary. The accident analyses indicate that the process parameters of some essential safety systems can be defined more appropriately than currently done.

In conclusion, the transient and accident analyses for the Loviisa plant have been made according to the provisions of Section 6 of Decision 395/1991. There are deficiencies in ensuring the containment integrity and safety functions. These are discussed in Chapters 3.5, 3.6, 4.5 and 4.6.

Trial tests

IVO has planned and carried out a trial test programme, by which it has been made sure of the effects of the nominal power increase on the functioning of the systems and components of the plant. Normal operation and in a limited way also transient behaviour of the plant have been studied in the trial tests. Studies made by means of the plant simulator and the results of transient analyses have been used in the planning of the trial test programme. Due to the small number of plant modifications required for the power increase of the Loviisa plant, a simple trial test programme supported by the simulator studies has been considered as appropriate and acceptable. Trial tests and disturbance tests can not be considered only as type tests, but their purpose is to make sure of the appropriate functioning of the components of both units.

The trial operation of both units has been carried out at the various reactor powers, increasing stepwise the current power level (103%, 105%, 107% and 109%). The trial operation at the power levels 103–107% continued at both units for several months. At the final target power level 109% the operation of the Loviisa 1 unit continued for 14 days and the operation of the Loviisa 2 unit 8 days. According to the trial test programme, transient tests and extensive measurements concerning the state of the plant have been carried out at various power levels.

Transient tests have been carried out at the power levels 105% and 109% at both units. They have been selected so that by means of tests the acceptability of the functioning of the most important process and control systems of the primary and secondary circuit could be verified, the number of the tests being as small as possible. Stopping of a reactor coolant pump and stopping of a main feedwater pump (without starting up an emergency pump as well as a turbine load trip (only at the Loviisa 1 unit) have been carried out as transient tests.

Based on the trial tests it can be considered that the units operate as planned also at the increased power level. However, e.g. following observations have been done during the trial tests:

  • in the determination of the reactor heat power a fault was noticed at the Loviisa 1 unit
  • steam flow rate has from time to time exceeded the original target value 40 m/s of the steam pipings at both units
  • a hidden fault was detected in the protection system limiting reactor power at the Loviisa 1 unit; the system was unnecessarily launched due to the fault.

As a result of the observations mentioned the necessary corrective measures have been planned and implemented.

In conclusion it is noted that the trial tests of the Loviisa plant, performed in connection with the modernisation, have been carried out with acceptable results and to the extent necessary for the planned power increase. As regards nuclear safety, STUK considers appropriate to permit the extended trial operation of the Loviisa plant at the power level higher than the nominal power, however, without exceeding the target power level 109%.

Probabilistic safety analysis

By means of Probabilistic Safety Analyses (PSA) effects of various initiating events of an accident on the safety of a plant are evaluated. Such events are disturbances of the plant, fires, internal floods, heavy weather conditions and earthquakes. In PSA, event sequences describing the progress of an accident and leading to reactor core damage are analysed. Their probabilities are also evaluated. The accident sequence is determined by an initiating event and failures of the safety systems as well as by failures of operator actions. Probabilities of the initiating events of an accident are evaluated based both on plant-specific and world-wide operating experiences.

The functions of the safety systems and the plant personnel, needed as a result of initiating events for preventing reactor core damage, are assessed i.a. by means of thermohydraulic analyses, system analyses and procedures for operating and accident conditions. The probability of a failure of these functions is evaluated based on accumulated operating experiences. The plant systems and their operation are so exactly modelled that the effect of transient and accident conditions, component failures and operating and maintenance failures on the operation of the plant is found out. In the analyses, special attention is paid to common-cause failures, which can concurrently result in the inoperability of several safety systems. The probability of core damage of the plant can be evaluated by combining the probability of the initiating event of an accident and the probabilities of failures in accident management. It is commonly used as a risk indicator, reflecting the safety level of a plant.

A special benefit of a Probabilistic Safety Analysis is that it requires to clear up systematically the systems and functions of the plant. In this way such functional interdependencies between systems or interdependencies caused by the physical characteristics of the plant can be identified, which otherwise could remain without attention. Risk evaluations as a result of the probabilistic approach can be a motivation to make modifications in the plant, or to support the prioritisation of the planned modifications. However, clearly identified safety improvements shall also be implemented regardless of probabilistic evaluations, especially when the improvement can be done without unreasonable costs. In this case, the principle of the continuous improvement of safety (Section 27 of Decision 395/1991) is primarily followed.

STUK required in 1984 that IVO makes an extensive probabilistic safety analysis concerning the Loviisa units. It was required that the objective of the study is to determine the plant-specific risk topographies of the most essential accident sequences. Another important objective was to train the plant personnel to understand more deeply than before the plant and its behaviour as a whole in different situations.

In the first part of PSA, probabilities of accident sequences resulting in reactor core damage had to be analysed (level 1). In the second part of PSA, mechanisms of reactor core damage and progress of accident had to be evaluated, accident sequences had to be classified in release categories based on the amount of radioactive materials released to the environment, the way of the release and the time of the release, as well as the probabilities of these release categories had to be evaluated (level 2).

IVO provided STUK with level 1 PSA in summer 1989. Since 1990 IVO has extended PSA by analysing risks related to fires, floods, earthquakes, heavy weather conditions and outages, as well as by making level 2 PSA (integrity of the containment and releases). Since 1991 many modifications of the Loviisa units have been implemented. By means of these modifications risks have been decreased and the risk topography of the plant has been balanced. A part of the modifications has been implemented in connection with the modernisation of the plant. Technical solutions of the modifications have also been often justified with PSA, although the determination of the safety benefit of many plant modifications does not as such require probabilistic evaluations. Examples of the most essential plant modifications have been presented in the following. They are classified according to initiating events.

Level 1 PSA—Internal initiating events

The 1989 analysis contained an evaluation of the risks caused by various plant transients, ruptures of the cooling pipes and disturbances in the electrical network (internal initiating events). The result of the analysis concerning the probability of reactor core damage was 2 × 10–3 a year. Reasons for this big estimate were simplified assumptions related to event sequences which are difficult to be modelled: some events, such as e.g. exceeding the design temperature in the rooms of electrical systems, were assumed to result in reactor core damage. For decreasing the importance of these event sequences straightforward plant modifications were implemented, after which their probability became so small that they had no significant effect on the total risk. In the same connection other improvements of the plant were implemented, by which other clear risk factors indicated by PSA were eliminated. After the improvements of the plant in 1990 the probability of reactor core damage was estimated to be about 1.4 × 10–4 a year.

In addition, since 1991 several modifications of the plant have been made, reducing essentially the risk:

  • The reliability of reducing the pressure of the primary circuit was improved by making possible the emergency spray of the pressurizer by means of the pumps of the high-pressure safety injection system. The modification makes more effective the reducing of the primary circuit pressure to the level of the secondary circuit e.g. in connection with a leak from the primary to secondary circuit. In this way the primary-secondary leak in a steam generator can be finished as soon as possible.
  • A new safety injection water tank was installed in order to cool the reactor although coolant is lost from the primary circuit due to the primary-secondary leak through an open-stuck relief valve of the steam generator.
  • Radiation monitoring equipment was installed in the secondary circuit for making a more effective detection of leaks from the primary circuit to the secondary circuit in a steam generator.
  • A new protection signal was installed for isolating the feedwater line and the steam line and for stopping the reactor coolant pump in the case of a high water level in a steam generator.
  • The reliability of the emergency core cooling was improved. The old minimum circulation lines leading to the emergency injection water tank have been replaced with the new minimum circulation lines which lead directly from the delivery side of the safety injection pumps to the suction side of the pumps. They have also been equipped with a separate cooling system. After the modification the possibility has been eliminated for the alternate turnover of the suction source of the pumps between the tank and the containment emergency sumps. In connection of a turnover a valve failure might occur resulting in loss of emergency cooling.

Level 1 PSA—Fires

Plant fire risks were evaluated in the analysis completed in 1992. The probability of reactor core damage caused by fires was at that time estimated to be 1 × 10–3. This figure also became high, because simplified pessimistic assumptions had to be done in the modelling fire progress and consequences. For reducing fire risks several modifications of the plant were made:

  • additional sprinklers were provided for protection of cables important to safety
  • fire protection of control and power supply cables was improved
  • fire protection of important pressurised air pipings was improved
  • structural protection of the hydraulic oil stations of the turbine bypass valves as well as sprinkler protection of the stations were improved for preventing high pressure oil sprays.

Level 1 PSA—Flood

The probability of reactor core damage caused by floods was estimated to be about 1 × 10–5 a year in the analysis completed in 1994. The analysis resulted in many modifications of the plant for reducing the risks related to internal floods:

  • A wall against floods was constructed, for preventing the spreading of a flood from the turbine hall to the lower rooms of the reactor building through cable spaces. In the lower rooms a flood could cause failures in the cooling system of the reactor coolant pumps and in the emergency core cooling system.
  • Drainage of the cable spaces in the control room building was improved so that the flooding water accumulating on the floor would not cause the exceeding of the design load of the floor.
  • For reducing the flood risks of the control room building the cooling water pipes related to the standard ventilation units were removed from the cable spaces below the control room to more secure routes.
  • Drainage on the level of the feedwater tanks was improved so that the flooding water accumulating on the floor would not cause the exceeding of the design load of the floor.
  • To protect the floor of the feedwater tanks against possible high pressure jet forces, jet shelters were installed on the welded joints of the feedwater pipings to control the reaction forces in leak situations. Furthermore, the pipes crossing the feedwater tank level were replaced by pipes made out of better material at the Loviisa 1. A similar replacement will be carried out at the Loviisa 2 unit in 1998.

Level 1 PSA—Weather

In the analysis concerning weather risks, completed in 1994, a bad snow storm and algae were evaluated as significant risks. The probability of reactor core damage was estimated to be about 5 × 10–4 a year. The following modifications of the plant were implemented to reduce the risks:

  • To reduce the breaking risk of the travelling basket screen in the sea water intake channel, a system was installed which stops sea water pumps one by one based on the increase of the pressure difference in the screen. As a result of this change the access of the alga population into the sea water cooling pipings and heat exchangers is prevented.
  • To protect the intake air channels of the diesel generators against clogging caused by a snow storm, the type of the intake air filters has been changed. In addition, the intake air of the diesel generators can now be taken from the interiors through the automatically opening air inlet plates, if the intake air channel clogged.

After the improvements of the plant, the biggest part of the weather risk is caused by frazil ice. In this case the sea water intake channel may be clogged by ice crystallising out of subcooled water.

Level 1 PSA—Outages

The probability of reactor core damage caused by outages was estimated to be about 2,8 × 10–5 a year in the analysis completed in 1997. Heavy hoistings were considered to be a very important risk factor. By means of the outage risk analysis IVO has justified following improvements:

  • Changes were made in the operating and testing instructions based on the observations done in PSA.
  • To reduce the risk related to the hoistings of heavy loads procedures were changed.
  • To ensure the cooling of the instrument spaces important to safety, a modification will be made in the change-over automation of the ventilation units. This will ensure the proper functioning also in the case of a fuse failure.

All the improvements of the plant mentioned above have been taken into account in the updated risk analyses related to the internal floods, fires and internal initiating events (level 1). IVO provided STUK with these analyses in 1994–97.

At the end of 1997 the results of the risk analyses were the following:

  • internal initiating events, 1.6 × 10–5 a year
  • fires, 4.0 × 10–5 a year
  • floods, 1.0 × 10–5 a year
  • heavy weather conditions, 7.5 × 10–5 a year
  • earthquakes, 3.6 × 10–6 a year
  • outages, 2.8 × 10–5 a year.

The calculated estimate for the total probability of reactor core damage is about 2.0 × 10–4 a year. This estimate takes into account all the factors presented above.

IVO has also provided STUK with the level 2 PSA in which the integrity of the containment and the release of radioactive materials from the plant to the environment are evaluated. It is estimated that the probability of a big release to the environment is about 5 × 10–6 a year, caused by the internal initiating events of the plant. The biggest part of the calculated risk (about 70%) is caused by leaks between the primary and secondary circuit as well as by other bypasses of the containment. The rest of the risk is caused by high-energy phenomena resulting in the damage of the containment, such as a steam explosion in the reactor vessel, the discharge of the melted core out of the pressure vessel to the reactor cavity, or a hydrogen explosion in the containment.

The calculated risk estimate mentioned above takes already into account the future modifications of the Loviisa plant designed for severe accidents. These are: the external cooling of the reactor pressure vessel, the measures aimed for preventing such loading situations which break the reactor cavity, the improved control of hydrogen and the new procedures for severe accident management. These modifications have been planned to be implemented by 2002.

For evaluating the current situation STUK has made a rough risk assessment related to the Loviisa plant as it was at the end of 1997. This upper limit estimate for the probability of a big release is about 9 × 10–6 a year, caused by the internal initiating events. Until now, the risk estimate of the level 2 PSA does not include the risk caused by the external initiating events (fires, floods, heavy weather conditions). Should the external initiating events be taken into account, the upper limit estimate at the end of 1997 for the probability of a big release would be about 4 × 10–5 a year.

STUK has reviewed the analyses provided by IVO. In this review a PSA programme developed by STUK has been used. The results of the review show that IVO has applied in its analyses commonly accepted methods in modelling transient and accident situations of the plant and in collecting and handling reliability data. In the level 2 PSA, the further development of the models describing the progress of an accident is required for defining the results.

The Loviisa plant does not fulfil the numerical design objectives for new nuclear power plants, set in Guide YVL 2.8, concerning the probability of reactor core damage and the probability of a big release as a result of a severe reactor accident. The objective is, however, that the level of safety is as high as reasonable achievable, also in the sense of probabilities.

The risk estimates include inevitably considerable uncertainties, because risk models can't be fully comprehensive and simplified assumptions have to be made. The most important meaning of the analyses is that with them risk factors have systematically been identified and eliminated.

STUK considers that IVO has justified the safety and technical solutions of the plant by the probabilistic safety analyses using appropriate methods according to Section 6 of Decision 395/1991.


3 RADIATION SAFETY

3.1 Limitation of radiation exposure

Radiation exposure arising from the operation of a nuclear power plant shall be kept as low as reasonable achievable. A nuclear power plant and its operation shall also be designed so that the limits presented in this decision are not exceeded. (Section 7 of Decision 395/1991)

Section 7 of Decision 395/1991 includes the ALARA-principle of radiation protection as well as the provisions for taking into account the limits related to the releases of radioactive materials.

Detailed requirements related to Section 7 of Decision 395/1991 are provided in Guides YVL 7.1 and YVL 7.9. Detailed requirements on radiation exposure, concerning the workers of a nuclear power plant and the surroundings population, are additionally presented in Guides YVL 7.2, YVL 7.3, YVL 7.8, YVL 7.10, YVL 7.11 and YVL 7.18.

According to the ALARA-principle the total radiation exposure (collective radiation dose) of the plant workers and the surroundings population have to be separately considered. The quantity of the collective dose is manSv. The calculated health harm possibly resulting from the operation of a nuclear power plant shall be very small. In addition, the radiation exposure of an individual shall remain below the set limits.

Collective radiation dose of the population in the surroundings

In the operation of a nuclear power plant radioactive materials are produced in the reactor. They mainly remain in the nuclear fuel. A small part of radioactive materials is produced in the reactor coolant circuit, and is further transferred in water, gas and waste treatment systems. A very small part of radioactive materials is released in the air and water of the surroundings. All possible releases are monitored with exact measurements (Chapter 5.4).

During the operation of nuclear power plants releases are limited with many structural and operational ways. Among the most important are the integrity of the nuclear fuel as well as the effectiveness of the inner water and gas purification systems of the plant. The number of fuel rod failures at the Loviisa plant has normally been very small, and so the leaks of radioactive materials in the coolant have also remained small. The purification systems have functioned in the designed way, and the releases have had in practice no effect on the radiation exposure of the environment. In 1994, the Loviisa plant took in use a Cs-separation system, by means of which the settled water of the liquid waste storing tanks can be treated. So the activity and the total amount of releases from the tanks to the environment can be essentially reduced.

The radiation exposure of the surroundings population caused by the releases of radioactive materials from the Loviisa plant is very small. In 1996, the calculated radiation exposure was 0,001 manSv for the population living within a 100 km distance from the plant. It is below one millionth of the whole radiation exposure of this population during the same time period, taking into account the natural background radiation and the medical use of radiation.

Very long-life C-14 isotopes are also released from nuclear power plants. The annual C-14 release from the Loviisa plant is estimated to cause a radiation dose of about 4 manSv to the population of the world for a 500 year period, assuming that the amount of the population remains below 10 milliards, and that the living conditions and life styles remain.

STUK has accepted the instruction for monitoring releases, included in the operating instructions of the Loviisa plant, and the method to calculate the radiation doses of the population. IVO provides quarterly STUK with data concerning the releases of radioactive materials from the Loviisa plant to the environment. In addition, IVO submits annually a summary report on releases and calculated doses, and the results of the environmental radiation monitoring programme.

The operation of the Loviisa plant and the measures to limit the releases of radioactive materials are appropriate. The increase of the reactor power is evaluated to have no effect, caused by the loads of the nuclear fuel or other technical characteristics, on the releases of radioactive materials during the normal operation. The ageing as a result of the operation of the plant is also considered to have, during the term of the new licence, no effects on the releases related to the normal operation. It is concluded that the Loviisa plant fulfils the provisions of Section 7 of Decision 395/1991 as regards radiation safety of the environment.

Collective radiation exposure to workers

According to Guide YVL 7.9 the objective for the limitation of the collective radiation exposure of nuclear power plant workers is 2.5 manSv per 1 GW of net electric power, calculated for one reactor unit and averaged over two successive years. Before the power increase of the Loviisa plant, this corresponded with the average of 1.11 manSv a year for one reactor unit. If this value is exceeded as a result of the operation for two successive years, radiation protection shall be improved at the unit in question.

The radiation safety of workers depends on the structure and maintenance of a plant as well as on radiation protection measures in connection with works. The factors affecting safety at the plant are partly same as the factors for the safety of the surroundings population (the integrity of nuclear fuel, the functioning of purification systems). In addition, e.g. the realisation of the spaces, activities, radiation protection as well as of radiation measurements contribute to radiation safety. Among the most important procedures of radiation protection are the areal zone classification based on the radiation levels at the plant, the limitations related to the zones, the work permit practice, training concerning radiation protection and radiation protection instructions.

The collective radiation exposure of the Loviisa plant workers was 2.64 manSv in 1996, and 1.14 in 1997. This figure changes depending on the extent and nature of works in annual outages, but it has on average been lower than the collective exposures at nuclear power plants of equal age and type. In spite of extensive works at the plant made systematically in connection with annual outages, the radiation exposure of the workers has not essentially increased in recent years.

In limiting the radiation exposure of the workers, a special topic has been Co-60 isotope activity accumulated from coolant flow to the inner surface of the Loviisa 2 primary circuit pipings. The activity was during the annual outages clearly higher than at the Loviisa 1, and it would have essentially complicated extensive maintenance works close to these pipes. During the annual outage in 1994, the primary circuit was decontaminated by means of a special chemical method, after which its radiation levels have remained lower and are equal with the levels of the Loviisa 1 unit.

Working methods related to the radiation protection of the workers have been continuously developed at the Loviisa plant. In addition to the dosimeters which are monthly checked, individual indicating dose meters are used by the workers in the most demanding outage duties. Their measurement data is followed daily in a centralised way.

The structural radiation safety of the Loviisa plant and the radiation protection of the workers are appropriate. For fulfilling the objective of Guide YVL 7.9, IVO has when necessary implemented measures to decrease the radiation exposure according to the ALARA-principle. It is concluded that the radiation protection of the workers at the Loviisa plant complies with the provisions of Section 7 of Decision 395/1991. It is however expected that while the plant gets older radiation protection has to be implemented more effectively than in passed years, because the radiation levels and the extent of maintenance works tend to increase with ageing. The replacement of the radiation measurement system firmly installed is necessary in next few years because the ageing of the equipment.

3.2 Radiation safety of nuclear power plant workers

A nuclear power plant's design and operation shall be implemented so that radiation exposure to workers can be limited as separately enacted. (Section 8 of Decision 395/1991)

The valid dose limits for workers are included in the Radiation Decree (1512/1991). The dose limit for the exposure of a worker is 50 mSv a year. In addition it is provided, as a new requirement compared with the former legislation, that the radiation exposure of a person engaged in radiation work is limited so that the added dose does not exceed 100 mSv for the period of 5 years.

IVO has developed the monitoring of occupational radiation doses and the reporting of measurement data in the dose register of STUK according to Guide YVL 7.9 and YVL 7.10 during the operation of the plant. The Finnish and Swedish competent authorities for radiation safety agreed already in 1983 on the practice that the radiation doses of the nuclear power plant workers received in other country are reported in the central register of the home country of the workers. The radiation doses received in other countries are reported to STUK with a specific dose record, the use of which is also imposed by the regulations of European Union.

The occupational radiation doses of the Loviisa plant have clearly remained under the set dose limits.

The largest individual annual radiation doses at the Loviisa plant have typically been below 20 mSv, and an average annual dose has been under 4 mSv. In 1997 the largest radiation dose of one worker was 19.7 mSv.

The largest dose of a Finnish worker during a 5 years period 1993–1997 was received during working at Swedish nuclear power plants, and it is 89 mSv. The respective dose at the Loviisa plant is 64 mSv.

In conclusion, the radiation dose control of the Loviisa plant workers has been carried out as provided in Section 8 of Decision 395/1991. In the future, it is still essential to pay special attention to workers, who carry out demanding duties from the viewpoint of radiation safety at various nuclear power plants.

3.3 Limit for normal operation

The limit for the dose commitment of the individual of the population, arising from normal operation of a nuclear power plant in any period of one year, is 0.1 mSv. Based on this limit, release limits for radioactive materials during the normal operation of a nuclear power plant are to be defined. (Section 9 of Decision 395/1991)

The provision of Section 9 of Decision 395/1991 concerning the protection of an individual shall be simultaneously implemented with the ALARA-principle concerning the limitation of radiation exposure (Chapter 3.1). In Guides YVL 7.2 and YVL 7.3 detailed requirements are presented for calculation methods, by means of which the radiation exposure of the population is evaluated.

The release limits of radioactive materials for the Loviisa plant are defined in the Technical Specifications concerning the operation of the units. The limits have been separately defined for the radioactive noble gas and iodine releases to the atmosphere and on the other hand for the releases in water. A separate nuclide-specific release limit has been defined for radioactive tritium in the water releases. The purpose of the release limits is to restrict the annual radiation exposure of the individuals of the surroundings population, caused by the operation of the plant units, clearly below the limit 0.1 mSv defined in Section 9 of Decision 395/1991. The utility has to monitor continuously releases and radioactive materials in the surroundings and to report at once to STUK on abnormal situations.

The average radiation exposure of the most exposed group is considered, when the radiation dose of an individual of the population, caused by releases of radioactive materials, is calculated. The group represents a fictitious group comprising the individuals of the population, which based on their residence and life styles are theoretically considered to receive the largest radiation dose as a result of releases.

IVO revised in 1992 the calculation methods for evaluating the radiation exposure of the surroundings population. They are in compliance with the requirements of Guides YVL 7.2 and YVL 7.3. In 1997, STUK started a study to compare employed models domestically and internationally, and to evaluate possible needs for development.

In 1996, the calculated lifetime dose commitment of the most exposed individual of the population was 0.0002 mSv in the surroundings of the Loviisa plant, as reported by IVO (on average the annual dose caused by natural radiation is 3 mSv in Finland). A reference calculation made by STUK resulted in a smaller figure. The calculated dose has decreased in recent years to below one tenth of the former one. This is a result of the implemented measures at the Loviisa plant for limiting releases.

In conclusion, no such releases have been caused by the operation of the Loviisa plant, as a result of which the radiation exposure limit 0.1 mSv defined in Section 9 of Decision 395/1991 would be exceeded.

3.4 Limit for an anticipated operational transient

The limit for the dose of the individual of the population, arising, as the result of an anticipated operational transient, from external radiation in the period of one year and the simultaneous radioactive materials intake, is 0.1 mSv. (Section 10 of Decision 395/1991)

Detailed requirements for the analyses concerning anticipated transients are presented in Guide YVL 2.2. If an operational transient may result in the release of radioactive materials, the radiation doses caused by the release shall be evaluated.

The descriptions of the analyses concerning anticipated operational transients are provided in the Safety Analysis Report for the Loviisa 1 and 2 units. As regards the behaviour of the plant these analyses are dealt with in Chapter 2.4. It is not expected that the operational transients result in the increased release of radioactive materials, because fuel failures are not caused or releases can be prevented by the plant systems. As regards radiation dose calculations, the employed methods comply with the requirements of Guides YVL 7.2 and YVL 7.3 except small deviations, which have no effect on the reliability of the result. It is essential that the radiation dose calculation methods include improbable assumptions, which in reality mean the overestimation of the doses calculated as the consequences of releases.

In conclusion, no such release has been caused by the anticipated operational transients of the Loviisa plant, as a result of which the radiation dose of the individual of the population would exceed the limit 0.1 mSv defined in Section 10 of Decision 395/1991.

3.5 Limit for a postulated accident

The limit for the dose of the individual of the population, arising, as the result of a postulated accident, from external radiation in the period of one year and the simultaneous radioactive materials intake, is 5 mSv. (Section 11 of Decision 395/1991)

Guides YVL 2.2, YVL 7.2 and YVL 7.3 include detailed requirements for the accident analyses on the behaviour of the plant and for calculating releases and radiation doses related to accidents as well as for the acceptability of results.

The accident analyses and related calculation methods are subject to a continuos development throughout the whole lifetime of a nuclear power plant. The descriptions of the accident analyses for the Loviisa 1 and 2 units are provided in the Safety Analysis Reports concerning the units (Chapter 2.4). IVO's analytical methods related to radiation exposure have been developed over the years, and they comply with the requirements of the Guides YVL 7.2 and YVL 7.3 except small deviations, which have no effect on the reliability of the results. It is essential that the radiation dose calculation methods include improbable assumptions, which in reality mean the overestimation of the doses calculated as the consequences of releases.

Based on the analyses measures are taken when necessary for improving safety. As regards radiation safety, IVO has during the passed term of the licence paid special attention to an accident situation where a large reactor coolant leak from the primary circuit to the secondary circuit could fast occur as a result of a steam generator inner damage. Since 1994, IVO has implemented at the Loviisa 1 and 2 units essential modifications (Chapter 4.1). Their purpose is i.a. to prevent the fuel damages and large releases of radioactive materials in connection with these kind of leaks. The purpose of the accident management measures has not primarily been to limit the release of the postulated accident and the theoretical radiation dose of an individual in the surroundings, but to prevent surely a severe reactor damage during the accident.

According to the results of the accident analyses, a major leak from the primary to secondary circuit at the Loviisa plant could result in an essential radiation dose to an individual of the population (the maximum calculated dose commitment is 13 mSv).

In conclusion, the postulated accidents of the Loviisa plant do not cause such releases of radioactive materials, as a result of which the radiation dose of an individual of the population would exceed the limit 5 mSv defined in Section 11 of Decision 395/1991, except major leaks from the primary to the secondary circuit. In these cases the results of the analyses show with a good safety margin that the limit (100 mSv) of a postulated accident, defined in Section 28 of Decision 395/1991 for nuclear power plants in operation, is not exceeded.

3.6 Limit for a severe accident

The limit for the release of radioactive materials arising from a severe accident is a release which causes neither acute harmful health effects to the population in the vicinity of the nuclear power plant nor any long-term restrictions on the use of extensive areas of land and water. For satisfying the requirement applied to long-term effects, the limit for an atmospheric release of cesium-137 is 100 TBq. The combined fall-out consisting of nuclides other than cesium-isotopes shall not cause, in the long term, starting three months from the accident, a hazard greater than would arise from a cesium release corresponding to the above-mentioned limit.

The possibility that, as the result of a severe accident, the above mentioned requirement is not met, shall be extremely small. (Section 12 of Decision 395/1991)

The original design bases of the Loviisa 1 and 2 units have not included provisions for loads or a radiation situation during a severe reactor accident. During passed years IVO has carried out extensive studies, the purpose of which has been to define needed modifications at the Loviisa 1 and 2 units for severe accidents. As a result of the work IVO has drawn up an overall plan on the needed measures. STUK has approved the technical principles of the plan. A part of the modifications has already been done and a part is under implementation. STUK has had to hurry the implementation of the modifications, because IVO has not proceeded according to its own original target schedule. In this report the issue is dealt with in Chapter 4.5.

Functions of the containment and releases of radioactive materials have been evaluated with the level 2 PSA analyses from a probabilistic point of view (Chapter 2.4).

The planned increase of reactor power has no essential effect on the measures needed for severe accidents.

As regards severe accidents, the radiation exposure of an individual employee at the Loviisa plant site could be abnormally large at the beginning of an emergency situation. This is due to the fact that the radiation protection of the containment roof is not adequate in these kind of situations. A part of radiation penetrating the roof upwards would be reflected by air and directed towards the plant site as external radiation. The modification of the containment roof structures is not anymore possible in practice, taking into account harmful safety related factors caused by this kind of modification. Most recently in 1997, IVO clarified the situation and measures for improving the safety of the staff during an emergency. The reports have shown that the radiation exposure caused by a severe accident does not exceed the design requirements for radiation protection, when adequate attention is paid to conditions, i.a. in the planning, implementation and exercises of emergency preparedness activities.

It is concluded that after the designed modifications being implemented at the Loviisa plant, or to be implemented in the near future, the provisions of Section 12 of Decision 395/1991 are fulfilled as well as reasonable achievable, taking into account the provisions of Sections 27 and 28 of Decision 395/1991.


4 NUCLEAR SAFETY

4.1 Levels of protection

In design, construction and operation proven or otherwise carefully examined high quality technolog shall be employed to prevent operational transients and accidents (preventive measures).

A nuclear power plant shall encompass systems by the means of which operational transients and accidents can be quickly and reliably detected and the aggravation of any event can be prevented. Accidents leading to extensive releases of radioactive materials shall be highly unlikely (control of transients and accidents).

Effective technical and administrative measures shall be taken for the mitigation of the consequences of an accident. Counter-measures for bringing an accident under control and for preventing radiation hazards shall be planned in advance (mitigation of consequences). (Section 13 of Decision 395/1991)

Detailed requirements related to Section 13 of Decision 395/1991 are given in Guides YVL 1.0 and YVL 1.4.

The Loviisa 1 and 2 units have operated reliably. The number of the occurred incidents significant to safety has remained small. Incidents have been dealt with in quarterly reports issued by STUK, in the statements 28.9.1983 and 22.11.1988 related to the applications for the new operating licenses of the units, in the former Safety Review Report (STUK, 1991) and in Annex 4 of the statement related to the application for the new operating licenses of the Loviisa plant submitted in 1998 to the Ministry of Trade and Industry.

In addition to the structure of the plant, the quality of operating activities has also an essential effect on preventing transient and accidents. Quality assurance related to operating instructions, other plant instructions and operating activities has been developed by IVO continuously in recent years. In the training of the staff, the importance of recognising the instructions and quality assurance programme has been emphased.

The inspection programme of STUK concerning the operation of a nuclear power plant includes several inspections which are concentrated on procedures and methods followed in operating activities. Quality assurance and operating activities are dealt with in a more detailed way in Chapters 2.3 and 5.

Guide YVL 1.0 requires that a nuclear power plant is equipped with a protection system. The Loviisa 1 and 2 units are provided with the protection systems which comprise a reactor protection system and a plant protection system. The duty of the protection systems is to initiate automatically the needed safety functions, if some quantity important to safety essentially deviates from its normal value. The duty of the reactor protection system is to initiate the shutdown of the reactor. The most important of the functions initiated by the plant protection system are emergency core cooling, decay heat removal and containment functions. For these functions the Loviisa 1 and 2 units are equipped with the necessary safety systems (Chapter 4.6).

The reactor protection system is realised by using relay technics, and the plant protection system by using conventional electronics. The technics employed is proven, but is already getting obsolete. The design and implementation of the reactor protection system are based on those solutions on which the plant supplier had got experiences from earlier constructed VVER-type plants. The reliability of the system has been improved based on experiences by replacing some components with more reliable ones, and by adding new components in the system to ensure the function also in the case of a common-cause failure of the redundant components. The tests and operational experiences of the plant protection system show that the solutions employed until now have been appropriate.

As a result of the development of automation technics, the anticipated need to replace present technics with a so-called programmable automation may become topical in the next ten year period. IVO Group has know-how and experience on new automation technics, because it is used at other power plants of the company. All available know-how is needed to be utilised, if and when programmable automation technics are taken into use at the Loviisa plant.

The protection systems fulfil the fail safe principle required by Guide YVL 1.0. It means that each subsystem settles in a state requiring protection, if any of its components fails.

For mitigating the consequences of the postulated accidents taken into account in the design of the Loviisa plant, the plant has been equipped with the appropriate safety systems. In addition, the operators of the plant have available procedures for transient and accident situations. These procedures have been evaluated by STUK. Emergency Plan is a document approved by STUK. It includes i.a. the definitions of duty and responsibility areas for accident situations. Regular exercises are carried out for testing planned emergency preparedness activities.

Major amounts of radioactive materials could be releases to the environment mainly in severe accidents. The provision for severe accidents is dealt with in a more detailed way in Chapter 4.5.

In conclusion, the levels of protection at the Loviisa plant comply with the provisions of Section 13 of Decision 395/1991. There are, however, deficiencies as regards the ensuring of the containment integrity and safety functions. These are dealt with in Chapters 4.5 and 4.6.

4.2 Technical barriers for preventing the dispersion of radioactive materials

Dispersion of radioactive materials from the fuel of the nuclear reactor to the environment shall be prevented by means of successive barriers which are the fuel and its cladding, the cooling circuit (the primary circuit) of the nuclear reactor and the containment building. (Section 14 of Decision 395/1991)

Detailed provisions on the integrity of the technical barriers are given in Sections 15, 16 and 17 of Decision 395/1991.

During the operation of a nuclear power plant, radioactive materials are mainly produced as the result of uranium nuclei fissions in the fuel pellets, made from uranium dioxide. The uranium dioxide matrix creates as such the first barrier for preventing the dispersion of radioactive materials. During normal operational conditions, when the temperature of uranium dioxide does not rise abnormally high, the great majority of fission products remains inside the fuel pellets (in matrix).

As regards the Loviisa 1 and 2 nuclear fuel, the uranium dioxide pellets have been loaded in cladding tubes, the external diameter of which is about 9 mm. The cladding tubes have been hermetically plugged by welding and fabricated as fuel assemblies, each comprising of 126 fuel rods. Based on its properties the cladding material is well suited for the reactor conditions, and it also fulfils the abnormal durability requirements caused by high temperatures.

Next barrier following nuclear fuel (uranium dioxide matrix and surrounding hermetic cladding tube), for preventing the dispersion of radioactive materials, is the pressure-retaining barrier of the primary circuit. The main components of the primary circuit (the reactor pressure vessel, steam generators, pressurizer, pipings) have been manufactured from stainless steel, or from carbon steel with a stainless steel cladding.

A basis for the primary circuit design was that releases to the environment would remain within the set limits, although about one percent of the fuel rods in the reactor (about 40 000 fuel rods altogether) would lose their cladding integrity during normal operational conditions. The water treatment system of the primary circuit has been equipped with filter devices by means of which fission products released in the coolant can be filtered and removed. This concerns also corrosion products, which have been activated by neutron radiation and which are moving in the primary circuit.

Current requirements for the basic dimensioning of the primary circuit as well as of the fuel assemblies are mainly similar as in the construction stage of the plant.

The whole primary circuit is inside the hermetic containment, made from stainless steel plates. The steel containment is surrounded by a concrete cylindrical secondary containment. The secondary containment has a light roof structure supported by a steel frame. A low pressure is held in the space between the primary and secondary containment. The space has been equipped with a filtered ventilation system for reducing possible releases of radioactive materials in accident situations.

The containment was not originally designed for severe reactor accidents. Measures for severe accidents are still under implementation. However, the basic plans for the implementation of all the measures considered necessary for mitigating the consequences of severe accident have been accepted, and already partly implemented. (Chapter 4.5).

In conclusion, the Loviisa plant has been provided with the technical barriers for preventing the dispersion of radioactive materials as defined in Section 14 of Decision 395/1991.

4.3 Ensuring fuel integrity

The probability of significant degradation of fuel cooling or of a fuel failure due to other reasons shall be low during normal operational conditions and anticipated operational transients.

During postulated accidents, the rate of fuel failures shall remain low and fuel coolability shall not be endangered.

The possibility of a criticality accident shall be extremely low. (Section 15 of Decision 395/1991)

Detailed requirements related to Section 15 of Decision 395/1991 are given in Guides YVL 1.0, YVL 2.2 and YVL 6.2.

An essential objective of the modernisation of the Loviisa 1 and 2 units is the increase of the reactor thermal power by 9 percent units. The increase is implemented without changing the current fuel thermal margins. This results in that the power increase has no essential effects on the behaviour of the fuel and reactor during normal operational conditions, anticipated transient and postulated accidents.

Fuel cladding has been fabricated from a zirconium-niobium alloy. The fuel manufacturer has a significant amount of experiences on its use as a fuel rod cladding material. The experiences extend to 1960's. The results of operational experiences and hot cell examinations, received from the manufacturer, could be confirmed by means of spent fuel examinations carried out at the plant. The oxide layer on the fuel cladding, caused by corrosion, remains very thin, and the ductility properties of the material remain sufficient for the fuel operation life.

Measurement results on fission gas amounts, released in fuel rods from fuel pellets, have been received from the fuel manufacturer. These results have also been assessed with analytical methods. In addition, supplementary measurement results have been received on fuel assemblies irradiated at the Loviisa plant. Based on these results and analyses the release rate of fission gases can be considered to be adequately small at the current operation mode of the reactor.

The fuel integrity in transient situations related to the normal reactor operation is ensured by the limitations concerning power change rates. These limitations are mainly based on studies carried out at research reactors as well as on operating experiences received from Russia and other countries.

The probability of fuel failures can be considered, based on the current operating experiences of the Loviisa plant, to be adequately small during normal operational conditions. The structure of the fuel assemblies and rods have been developed step by step based on accumulated experiences. The current upper part design of the fuel assemblies takes properly into account the elongation of fuel rods during the operation—the elongation is bigger than originally considered. The manufacturing process of fuel pellets has been changed. The inner pressure of fuel rods has been increased. The material of fuel assembly spacers will be in the future a zirconium–niobium alloy. All these changes have had a favourable effect on the fuel integrity during normal operational conditions, anticipated transients and postulated accidents.

Fuel assemblies with spacers made from zirconium–niobium alloy were damaged as a result of fuel assembly blockages during the operation in the years 1994–1995. Blockages occurred also in fuel assemblies with steel spacers, but the rate was slower. The event is dealt with in a more detailed way in Annex 4 of the statement concerning the operating licence application (Operating experiences during the term of the operating licence). Later operating experiences on zirconium–niobium spacers have not been abnormal.

The probability of a significant degradation of fuel cooling (heat transfer crisis) is very low at the Loviisa 1 and 2 units. This depends mainly on the favourable relations between the fuel gross and linear power as well as the primary and secondary coolant flow rates, coolant amounts and related time constants. This is indicated e.g. by a fairly big dryout margin during a stationary state.

Based on the reasons mentioned above heat transfer crisis is very improbable during anticipated transients.

Related to the postulated accidents fuel failures would mainly be expected in loss of coolant accidents, in an accident concerning a control rod ejection and in an ATWS-accident. Related to these accidents, analyses have shown that the plant complies with the appropriate acceptance criteria, also when the reactor power has been increased by 9%.

One basic objective is to prevent transients leading to an unintended criticality of the reactor and/or to a reactivity increase. The possibility and importance of malfunctions resulting in the dilution of the boron solution—boron is used as a reactivity poison—and of the inner dilution of the boron concentration in connection with some accident types have been evaluated. Based on calculations, significant plant modifications have been done for preventing the sudden dilution of the boron content. Due to these modifications the plant now fulfils the appropriate acceptance criteria. The prevention of an unintended criticality has also been taken into account in the fuel storage and handling systems of the plant.

The reliability of the reactor core and containment emergency cooling systems during an accident has been improved by replacing the containment emergency sumps of the systems. Heat insulator materials, damaged in a loss of coolant accident, would have blocked the reactor emergency cooling and decay heat removal, if the material had drifted to the original sumps.The need for the modification was discovered in the analyses, which were started based on a foreign operating event.

In conclusion, the fuel integrity of the Loviisa plant has been ensured as defined in Section 15 of Decision 395/1991.

4.4 Ensuring primary circuit integrity

The primary circuit of a nuclear reactor shall be designed so that the stresses imposed upon it remain, with sufficient confidence, below the values defined for structural materials for preventing a fast growth crack during normal operational conditions, anticipated operational transients and postulated accidents. The possibility of a primary circuit break due to other reasons shall be low, too. (Section 16 of Decision 395/1991)

The most important components of the primary circuit of the Loviisa 1 and 2 units are the reactor pressure vessel, pressurizer, main circulation pipings, primary collector and heat transfer pipings of the steam generators, reactor coolant pumps, main isolation valves and those pipings which have a direct connection to the reactor pressure vessel. Requirements for the construction plan of the primary circuit components are given in Guides YVL 3.1, YVL 3.3, YVL 5.3 and YVL 5.4. According to these Guides, the components in Safety Class 1 shall be dimensioned as required by the standard ASME Boiler and Pressure Vessel Code, Section III, or in other way resulting in the same safety level. The primary circuit components of the Loviisa 1 and 2 units have been designed according to a Russian standard concerning nuclear power plants, except the reactor coolant pump, which has been designed according to ASME III. As regards brittle fracture assessments, the old Russian standard from the year 1973 includes deficiencies. Otherwise these two standards do not essentially deviate from each other as regards the dimensioning.

During the manufacturing of the Loviisa 1 and 2 pressure vessels systematic quality assurance activities could not be implemented in the way required by YVL Guides. The licensee tried to ensure the quality by compensatory measures. The resulting deficiencies cause some uncertainties in the evaluation of the pressure vessels embrittlement.

The reactor pressure vessel has been manufactured from a low alloy CrMoV-steel, and it has an inner cladding made from austenitic stainless steel. After the three year operation of the Loviisa 1 unit it was noted, based on the examinations of material samples irradiated inside the pressure vessel that the material properties of the circular weld joint at the level of the reactor core weakened faster than anticipated. The observation was made before the commissioning of the Loviisa 2 unit. Neutron radiation produced in the reactor core increases the critical temperature around which the ductility of the reactor pressure vessel quickly decreases, when the temperature drops. During the normal operating temperature safety is not endangered. However, in some transient and accident conditions cold water is injected in the primary circuit, and the danger of the sudden brittle fracture of the pressure vessel increases, if there are cracks in the pressure vessel.

The integrity of the pressure vessel in the conditions mentioned above has been evaluated by means of thermohydraulic and fracture-mechanical calculations. For decreasing the dose rate of fast neutrons 36 fuel assemblies on the perimeter of the reactor core have been replaced by steel elements. Several modifications of the plant have been implemented for reducing loads and decreasing their probabilities. For preventing a cold pressurisation during outages, primary circuit relief valves functioning in a low pressure have been installed at the units. In addition, the best non-destructive testing methods have been used for finding out possible cracks.

IVO has made both deterministic and probabilistic safety analyses concerning the Loviisa 1 and 2 reactor pressure vessels. Both analyses fulfil the acceptance criteria set for them.

The brittle weld joint of the Loviisa 1 reactor pressure vessel was heat-treated during the 1996 annual outage for improving the ductility properties of the welding material. In this connection the reactor pressure vessel was subject to thorough non-destructive tests. The use of the reactor pressure vessel has been accepted so far until the 2004 annual outage. In the current analyses the re-embrittlement has been conservatively evaluated.

Embrittlement rate will be re-assessed before the year 2004 on the bases of the results of material samples, representing the critical weld joint. The samples are irradiated inside the reactor pressure vessel.

Based on the smaller contents of impurities in the critical welding material the use of the Loviisa 2 reactor pressure vessel has been accepted until 2010. So the service life of the pressure vessel is 30 years also without a heat-treatment.

Other pressure-retaining components of the primary circuits of the Loviisa 1 and 2 units have been manufactured from austenitic stainless steel or carbon steel which has an austenitic stainless steel cladding. A safety factor for deformations is at least 1.5. So the size of a crack resulting in a sudden break is so big that the crack can, with great confidence, be detected either as a small leakage or be found out in inservice inspections. Based on the material selections, common corrosion wearing wall thichnesses can't occur in the primary circuit.

The effect of the power increase on the primary circuit integrity is very minor, because the operating pressure isn't changed and the operating temperature is increased only by few degrees. The flow rate of the primary circuit remains almost unchanged. The power increase raises the fast neutron dose of the reactor pressure vessel, and it has been taken into account in the safety analyses.

The primary circuit over-pressure protection was made more effective in 1996 by installing new relief valves which have been demonstrated to function both with water, steam, and with a compound of water and steam.

Erosion corrosion failures have been detected in the original feedwater distributors on the secondary side of the steam generators. Although the direct safety significance of these failures is minor, IVO has decided to replace the feedwater distributors. The new feedwater distributors are of a new type. They are located on the pipe assembly of the steam generator which is a different place than the original one. In this connection IVO has extensively studied different distributors, as an objective a structure which is so undisturbed as possible. As a result of the new location of the distributor, heat fatigue may be possible in the steam generator pipes during some accident situations. This has been exactly examined. The final design has been accepted. New distributors are in a trial use, and the final installations will be done by 2000.

The original fatigue analyses of the components have been carried out a 30 years service life as a basic assumption. The number of different loading situations has been evaluated for the analyses based on this service life. The frequency of the occurred loadings has been essentially smaller than anticipated. The ageing control of the primary circuit components has been made more effective by taking in use a new instruction for the management of ageing (Chapter 5.2).

In conclusion, the primary circuit integrity of the Loviisa plant has been demonstrated to comply with the provisions of Section 16 of Decision 395/1991. As regards the Loviisa 1 reactor pressure vessel, the situation will be, however, re-assessed before the 2004 annual outage based on additional examinations.

4.5 Ensuring containment integrity

The containment shall be designed so that it will withstand reliably pressure and temperature loads, jet forces and impacts of missiles arising from anticipated operational transients and postulated accidents.

Furthermore, the containment shall be designed so that the pressure and temperature created inside the containment as a consequence of a severe accident will not result in its uncontrollable failure.

The possibility of the creation of such a mixture of gases as could burn or explode in a way which endangers containment integrity shall be small in all accidents.

The hazard of a containment building failure due to a core melt shall also be taken into account in other respect in designing the containment building concept. (Section 17 of Decision 395/1991)

Detailed requirements related to Section 17 of Decision 395/1991 are given in Guide YVL 1.0. The application of Section 17 to operating nuclear power plants is also regulated in Section 28 of Decision 395/1991.

The Loviisa 1 and 2 units are provided with the containment in which the increase of the inner pressure caused by steam is limited by ice condensers. The inner spray system of the containment and the treatment systems for burnable gases are an essential part in the provision for mitigating accident situations. The primary, pressure-retaining tight steel containment is surrounded by a secondary building with concrete walls. The purpose of the double structure is to protect the primary containment against external effects, and to enable a low pressure in the space between the buildings with a filtered ventilation system. Releases to the environment, arising from containment leaks, can be decreased in this way in accident situations.

The functioning and tightness of the manholes, penetrations and process lines isolation valves of the containment are verified with regular periodic tests. The tightness of the primary steel containment is verified every forth year with tightness tests. A special periodic testing programme has been established for testing the functions of the auxiliary systems necessary for the overall containment function.

For controlling the pressure in the space between the primary and secondary containment, the space has been equipped with hatches to protect against a high/low pressure. The potential high pressure in the space would have been able to cause the steel containment to collapse, and the low pressure the light-structure roof of the secondary containment to break down.

Arrangements for tighten the upright doors of the material gate, located in the lower part of the containment, have been improved by replacing the former simple compressed air seal with two independent compressed air seals.

A light aircraft collision has been defined as a design basis for the outer concrete containment building against external missiles. However, the roof structure of the building does not protect the steel containment from all directions: a light aircraft dropping in a steep angle would be stopped only by the inner concrete structures of the steel containment. The essential structures of the primary circuit could not be damaged, however, by a missile like this. Taking into account the provisions of Section 28 of Decision 395/1991, the current situation at the Loviisa plant can be considered acceptable as regards this issue.

Based on what is presented above, it can be concluded that the containment and to it directly related auxiliary systems have been designed so that the containment withstands reliably pressure and temperature loads, jet forces and impacts of missiles arising from anticipated operational transients and postulated accidents according to Section 17 of Decision 395/1991 and Guide YVL 1.0.

The original design bases of the Loviisa 1 and 2 containment systems have not directly included loads arising from severe accidents. Section 17 of Decision 395/1991 and Guide YVL 1.0 require for a severe accident management as regards the containment of new nuclear power plants. As regards this issue the provisions of Sections 27 and 28 are applied to nuclear power plants in operation. Based on a long research and development work IVO has established a strategy for the severe accident management which is due to the special features of the plant internationally considered unique and innovative in many respects. The essential parts of the strategy are the reliable pressure reduction of the primary circuit, the retaining of melt core in the reactor pressure vessel by cooling the pressure vessel externally, the containment decay heat removal by the external containment spray system and the prevention of a sudden pressurisation (hydrogen fires and explosions) by ensuring with catalytic recombiners the controlled oxidation of hydrogen released in the core meltdown process. The strategic plan also includes provisions for instrumentation, automation and electrification which are needed for the implementation of these measures and which are independent from the other operation of the plant. An especially favourable aspect in the IVO's overall plan is the aim to take care of the retention of the containment tightness also during severe accidents.

Because the integrity and tightness of the steel containment can be retained, the safety significance of the containment bypass through the process and other systems is emphasised. This fact is also seen in the results of the level 2 PSA. The detection of the containment bypass during accident situations and the prevention of its consequences in a more reliable way than now are evident subjects for development requiring attention in the future.

When all the measures of this overall plan have been implemented, it can be concluded that as regards severe accidents the Loviisa plant complies with the provisions of Section 17 of Decision 395/1991 and Guide YVL 1.0, taking into account Section 28 of Decision 395/1991.

From the above mentioned measures the external containment spray system was implemented in 1991. The basic design of other measures was accepted in 1995 for the reactor pressure vessel external cooling system and in 1997 for the control of hydrogen. STUK has had to hurry the planning and schedules of the implementation.

4.6 Ensuring safety functions

In ensuring safety functions, inherent safety features attainable by design shall be made use of in the first place. In particular, the combined effect of a nuclear reactor's physical feedbacks shall be such that it mitigates the increase of reactor power.

If inherent safety features cannot be made use of in ensuring a safety function, priority shall be given to systems and components which do not require an off-site power supply or which, in consequence of a loss of power supply, will settle in a state preferable from the safety point of view.

Systems which perform the most important safety functions shall be able to carry out their functions even though an individual component in any system would fail to operate and additionally any component affecting the safety function would be out of operation simultaneously due to repairs or maintenance.

A nuclear power plant shall have on-site and off-site electrical power supply systems. The execution of the most important safety functions shall be possible by using either of the two electrical power supply systems.

Safety systems which back up each other as well as parallel parts of safety systems shall be separated from each other so that their failure due to an external common cause failure is unlikely.

In ensuring the most important safety functions, systems based on diverse principles of operation shall be used to the extent possible. (Section 18 of Decision 395/1991)

Detailed requirements related to Section 18 of Decision 395/1991 are given in Guides YVL 1.0, YVL 2.1 and YVL 2.7. The application of Section 18 to nuclear power plants in operation is also regulated in Section 28 of Decision 395/1991.

The most important safety functions of a nuclear power plant are 1) reactor shutdown, 2) decay heat removal from the reactor to the ultimate heat sink and 3) the functioning of the containment. These functions shall be ensured during normal operational conditions, anticipated operational transients and postulated accidents.

Inherent reactor-physical feedbacks have been made use of in the design of the Loviisa 1 and 2 reactors and their reloadings so that each physical feedback separately, and thus their combined effect, mitigates the increase of reactor power during transient and accident conditions. This is demonstrated analytically as well as experimentally during the start-up of the plant after the reloading outages.

Both the control rods and the reactor boron systems are available for shutting down the reactor. The control rods can be used either by driving them into the reactor by means of a electric motor, or by dropping them into the reactor by gravitation in connection with a reactor scram. If the control rods lose the needed electrical power, they drop into the reactor and shut down it.

The reloadings of the Loviisa 1 and 2 reactors have been designed so that the reactor can be shut down with the control rods during normal operational conditions, anticipated operational transient and postulated accidents, although the most effective control rod would not function.

In addition to the control rods, the reactors can be shut down with the boron systems. Boron is used in the coolant for the long-term power control of the reactor. Modifications in the systems and operation mode of the plant have been done for avoiding an unintended boron concentration dilution of the coolant. The risk of the boron concentration dilution arising from external reasons has been reduced to an acceptable level with these measures. The safety significance of the inner boron dilution during some accident situations has been considered small based on IVO's extensive assessments.

Decay heat is removed from the primary to the secondary circuit by a gravitation-driven inherent circulation in six similar coolant loops. Heat transferred into the secondary circuit can be further transferred in the sea or to the atmosphere by several different systems. In these systems active components are needed. The driving power of these components are supplied either from the diesel-backed power sources or diesel generators. The additional emergency feedwater system has been equipped with own diesel-operated pumps. The system is partly common to both units. The decay heat removal by the secondary circuit is ensured in a versatile and reliable way.

After a possible break in the primary circuit, at the beginning water would be obtained in the primary circuit from the safety accumulator tanks which discharge without external driving power. Later on, decay heat should be removed by means of the active components which need electric energy as a driving power and which mainly are four- redundant.

If the decay heat removal isn't possible through the secondary circuit, there is an alternative way to remove decay heat directly from the primary circuit by a so-called feed and bleed method. In this case, water is injected in the primary circuit with high pressure safety injection cooling pumps. In the primary circuit up-heated water is discharged in the containment by opening the new relief valves of the pressurizer. The valves have a large capacity. Decay heat is removed from the containment by circulation through the sumps by means of the emergency heat transfer chain.

The emergency sump structures of the containment have been completely re-designed after a foreign operational event indicated that the original design had essential deficiencies. A sump blockage would mean the complete loss of the emergency core cooling function. A danger for a blockage occurs, when heat insulators around the primary circuit pipes are damaged during pipe breaks. Due to its characteristics, a damaged insulator material disturbs the sump function much more than previously was believed. The new strainer structures of the sumps have been designed to collect the largest possible amount of damaged insulators without disturbing the emergency core cooling function. This amount has been determined based on the best current knowledge, taking into account also other impurities released simultaneously. In addition, the new sump strainers have been equipped with an instrumentation and a purification system. In this way the build-up of a blockage can be controlled and when necessary the strainers can be purified. So the long-term function is also ensured.

As a result of the sump modification, a need has also been noted to evaluate more closely the functioning of the high pressure safety injection pumps during a sump circulation. The pumps in question have been designed only for pumping clean water, but during the sump circulation they may be exposed to impurity loads, especially at the beginning of the circulation. IVO has examined the functioning of the pumps with water including insulator-impurities. A need to reduce the loadings of the pumps has been observed. Final investigations on needed measures are still being carried out.

The intermediate circuit of the emergency heat transfer chain has a function to transfer decay heat from the emergency core cooling systems to the sea water. The intermediate circuit has been re-dimensioned, because the original design included faults. According to the revised safety analyses, the sump water accumulating on the containment floor may warm up until to the saturated temperature in some primary coolant leak situations. This increases the heat load to the intermediate circuit, and together with the simultaneous high sea water temperature results in the temperature level increase of 10 degrees in the intermediate circuit. In addition to the decay heat transfer, the intermediate circuit has a function to cool almost all emergency, auxiliary and support systems important to the plant's safety, and their room spaces. The original design temperatures of the most cooling objects of this kind would be exceeded, when the temperature of the intermediate circuit rises. IVO took immediately measures both to make the functioning of the intermediate circuit more effective and to develop the systems concerned and components to withstand the higher functioning temperature. The needed measures have been designed and mainly implemented. These safety improvements would have been made independently of the plant nominal power.

Plant modifications have been done to ensure the reactor core cooling and decay heat transfer in the case of leaks from the primary side of a steam generator to the secondary circuit. These plant modifications are the construction of a new safety injection water tank common for the both units, the spray pipelines of the pressurizer from the high pressure safety injection pumps and the increases of a protection automation. The management of the primary–secondary leaks is based on the assumption that the steam pipelines integrity is maintained. Pressure shocks endangering the integrity of the steam piping in this situation are being evaluated. However, the possibility of the pressure shocks of a dangerous magnitude, in the critical location of the piping from the viewpoint of the accident management, can be evaluated to be so small that the management of the primary–secondary leaks can be considered as acceptable.

The functioning of active components is not required to keep the containment pressure and temperature within the design values at the beginning of any design basis accident. In situations during which large amounts of steam leak in the containment, the containment inner spray system is needed to ensure the integrity and functioning of the containment after the melting of the ice in the ice condensers. In this kind of situation decay heat released from the reactor is separately transferred through the emergency core cooling system and intermediate cooling system into the sea water circuit. The functioning of these systems is based on active components which need electric energy as their driving power. Decay heat removal from the containment is also possible to carry out with an external spray system which is directed on the outer surface of the containment. The spray pumps get their driving power from the own diesel generators which are independent of other electric systems of the plant. The tightness of the process penetrations of the containment is ensured with isolation valves, the number of which is mainly two, one is inside and the other outside the containment.

The design basis of the Loviisa 1 and 2 systems important to safety has not been that in addition to the inoperability of any individual component another component would be assumed to be out of operation simultaneously due to repairs or maintenance. Instead, as an aim it has been set that all systems important to safety are able to carry out their functions even though any individual component of the system would fail to operate. This reason also has caused that, after the commissioning of the plant, many changes and replacements of individual components have had to be done to increase the reliability of the systems and the overall reliability level. In addition, many completely new redundant systems have been built.

The possibility for a preventive maintenance during the operation is limited for the systems where the number of the redundant components is only two. The needed preventive maintenance requires, however, that from time to time some components are separated from the process. Maximising the operability of systems with a well planned preventive maintenance is a demanding duty. It is subject to IVO's continuous attention.

The external electric power supply system of the Loviisa plant comprises two 400 kV and one 110 kV connections to the Finnish base electrical network. In addition to the normal internal electric systems, there are four diesel generators per unit for the emergency supply of electric power as well as battery systems. The plant safety systems have been divided into two subsystems which are separated from each other. Each subsystem is supplied from the external electrical network or from two diesel generators. Each component is supplied from a bus bar connected to a separate diesel generator in those plant systems which comprise four redundant active components, e.g. low and high pressure safety injection pumps.

A 20 kV overhead line connection has also been built to the Loviisa plant from the Ahvenkoski hydro power station, located at the extent of 20 km from the Loviisa plant. This connection can be coupled instead of any diesel generator.

Many electric component modifications have been done at the Loviisa 1 and 2 units to ensure safety functions. The purpose of these modifications is to ensure the functioning of the safety systems during accident conditions, taking into account the requirements indicated by the revised safety analyses.

Detailed requirements given in the Technical Specifications guide the operation of the units in maintaining continuously the acceptable safety level and in ensuring the necessary safety functions. The requirements of the Technical Specifications are extensive as regards their number as well as very detailed as regards their content, indicating thus the need to compensate system deficiencies resulted from the design bases with strict administrative procedures.

The components needed for the safety functions of the Loviisa 1 and 2 units are not completely well separated physically, and so a same external cause may result in a failure of redundant components. Therefore, after the commissioning of the plant several modifications have had to be done, mainly as a result of the separation requirements for fire protection. The physical separation of the systems has been further improved based on the results of the probabilistic safety analyses concerning fire and flood risks.

In conclusion, the safety functions of the Loviisa plant have been ensured according to Section 18 of Decision 395/1991 except the following deviations: The functioning of the safety systems has not fully been ensured in case of an individual component is inoperable and additionally other component is out of operation simultaneously due to repairs or maintenance. In addition, the redundant parts of the safety systems have not been fully separated from each other so that their failure as a result of the same external cause would be unlikely.

After the commissioning of the plant, safety functions have been continuously improved by means of studies carried out and plant modifications implemented based on the studies. In addition, the safety systems of the Loviisa units are mainly functionally exceptionally flexible which compensates the above mentioned deficiency concerning the reliability of the safety functions. Paragraph 2 of Section 28 of Decision 395/1991 relates also to the evaluation of the safety level.

4.7 Avoiding human errors

Special attention shall be paid to the avoidance, detection and repair of human errors. The possibility of human errors shall be taken into account both in the design of the nuclear power plant and in the planning of its operation so that the plant withstands well errors and deviations from planned operational actions. (Section 19 of Decision 395/1991)

Human errors can not be entirely avoided. However, the possibility of errors can be made smaller with proper instructions, procedures, training and efficient quality assurance (Chapters 2.3 and 5.1, 5.2 and 5.3)

For identifying human error possibilities and for clarifying their consequences IVO has prepared an extensive evaluation concerning these issues. This evaluation is a part of the probabilistic safety analysis. For analysing hidden defects influencing the course of a possible transient or accident, IVO has evaluated regularly performed duties of different types at the plant. In the analysis concerning human errors such operational and maintenance mistakes have been evaluated which may act as an initiating event of a transient or an accident. Different plant states and duties related to them have been evaluated in detail.

Control actions needed during an accident have been divided in the evaluation into two parts: a diagnosis and actions taken to prevent the accident. Possibilities for mistakes has been studied with the help of a simulator. Plant procedures for emergency situations have been developed and will be further developed, taking also into account the results of PSA.

For preventing human errors it is important, that the operating events are carefully evaluated and, if necessary, procedures or the plant is developed to prevent similar mistakes. IVO has developed the utilisation of operating experiences and does the so-called root cause analyses out of every significant event.

When starting up the plant from an outage, the systems essential to plant safety are tested and inspected. The aim of this procedure is to try to notice the possible mistakes.

The protection systems of the plant initiate the safety systems automatically when needed so that the operators will have enough time to consider actions according to operating instructions. Due to the inherent characteristics of the Loviisa plant, the operators will have usually more time for consideration in a transient situation than at any other nuclear power plant.

The Loviisa plant is well equipped concerning the needed training for preventing human errors. A simulator is at hand. It is used for training the operators to come through accident situations.

Studies on human errors until now and the development of improvement measures are also internationally focused on the activities of the plant operators and of the lowest levels of the operating organisation. In the future, also the functions of an organisation more extensively and the preventing of human errors in design activities may be significant targets for development.

In conclusion, the Loviisa plant and it's operation have been implemented as provided in Section 19 of Decision 395/1991.

4.8 Protection against external events and fires

The most important nuclear power plant safety functions shall remain operable in spite of any natural phenomena estimated possible on site or other events external to the plant. In addition, the combined effects of accident conditions induced by internal causes and simultaneous natural phenomena shall be taken into account to the extent estimated possible.

Structures, systems and components important to safety shall be designed and located, as well as protected by means of structural fire barriers and adequate fire fighting systems so that the likelihood of fires and explosions is small and their effect on plant safety insignificant. (Section 20 of Decision 395/1991).

Detailed requirements related to Section 20 of Decision 395/1991 are presented in Guides YVL 1.0, YVL 2.6, YVL 4.1, YVL 4.2 and YVL 4.3.

The structures of the Loviisa plant have been designed taking into account the loads caused by natural phenomena applied in Finland. The risks caused by natural phenomena have been later on reviewed in connection with the weather risk analysis, prepared by IVO. The analysis has identified a few needs for improvement. External missiles, like aircraft crashes or other effects of events caused by human actions, have been taken into account in the plant design to a smaller extent than required for new nuclear power plants (see e.g. Chapter 4.6). The combinations of internal and external effects, evaluated to be possible, have not be taken into account in the Loviisa plant design as required by Guide YVL 1.0. These events are evaluated in connection with PSA, which is described in a more detailed way in Chapter 2.4.

The effects of an earthquake were evaluated to be small at the time when the Loviisa plant was designed. They were not separately taken into account in the design, but it was considered that safety factors related to structures and components are adequate for taking into account earthquakes. The fulfilment of the earthquake requirements presented in Guide 2.6 has been assessed in the probabilistic safety analysis made by IVO. According to its results, the risks arising from earthquakes are small as compared with other risks.

Loss of off-site electric power supply has been taken into account in the plant design. The plant is currently also equipped with a net connection to the Ahvenkoski hydro power station to ensure the power supply. The main transformers have been protected with a sprinkler system which essentially reduces the risk that a fire would spread into the surrounding buildings, especially into the turbine hall.

The possibility of fires and nuclear accident risks caused by them were not adequately taken into account initially in the functional design and the lay-out design of the Loviisa plant. Therefore, fire compartments were not implemented in many parts so that the plant safety functions could be maintained during all fire situations considered possible. For this reason the significance of an active fire fighting (fire alarm and extinguishing systems as well as operative fire fighting) is important along with structural fire protection arrangements.

Fire safety has been improved with several measures at the Loviisa plant after its commissioning. These measures have been implemented in various fields of fire protection. As a result, the plant safety against the effects of fires has been essentially improved.

For a provision against oil fires in the turbine hall several measures have been taken. Fire insulators of the load-bearing steel structures of the turbine building have been installed. The turbine hall has been equipped with an automatic sprinkler system and the significant parts of the turbines have been protected. Later on, the fire wall of the turbine hall has been built up to protect components important to reactor decay heat removal. Furthermore, the additional emergency feedwater system has been built for the case that all feedwater and emergency feedwater systems would be lost in a turbine hall fire.

The risk to lose the AC-power during transformer fires has been reduced by protecting the diesel generators against fires. The 110 kV net connection has been physically separated from the 400 kV connection so that the loss of both connections as a result of a transformer fire is improbable. Several improvements against fires have been done in off-site power supply arrangements and in diesel generators. The original fire water pumps are supplied only from the off-site electrical network. Therefore, an additional fire water pump station has been constructed at the plant. It has been equipped with diesel-driven fire water pumps and with a separate fire water tank. Fire water pipings and fire estinguishing systems as well as their coverage have been improved. A new addressed fire alarm system is under construction. Several structural improvements for fire safety have been done, or are under design.

The level of the operative fire protection has been improved by establishing a plant fire- fighting crew which is permanent, constantly ready to depart and has the proper equipment. As regards fire protection and fire risks also plant instructions have been complemented.

In the cable spaces, underneath the control room level of the control room building, a halon system is used as a primary fire protection at this moment. The use of halons is being given up globally till the year 2000, because of the hazardous effects it has to the climate. Such special problems are related to these spaces, which restrict possibilities to use water and gas extinguishing systems. The replacement of the halon system with another appropriate and equally reliable extinguishing system can be, with this kind of narrow schedule, practically impossible. The fire safety of the cable spaces of the control room building has a great importance to nuclear safety. Therefore, STUK considers desirable that an adequate transitional period would be available for the design and realisation of a new extinguishing system.

The Loviisa plant does not comply with all the requirements of Guide YVL 4.3, because of the inadequate separation of systems and of the deficiencies of fire alarm systems or structural fire endurance. The fire risks caused by these factors are reviewed in the probabilistic safety analysis, which is focused on fires.

In conclusion, the Loviisa plant is currently protected sufficiently against external events and fires, as provided in Section 20 of Decision 395/1991. However, the level of protection against fires has to be developed further, among other things for correcting the deficiencies brought out by PSA.

4.9 Safety classification

The functions important to the safety of the systems, structures and components of a nuclear power plant shall be defined and the systems, structures and components classified according to their safety significance.

The systems, structures and components important to safety shall be designed, manufactured, installed and operated so that their quality level and the inspections and tests required to verify their quality level are adequate considering any item's safety significance. (Section 21 of Decision 395/1991)

Detailed requirements related to Section 21 of Decision 395/1991 are given in Guide YVL 2.1.

Safety classification is established to ensure that the quality level required in the design, manufacturing and installation of the systems, structures and components important to safety as well as the needed inspections and tests are commensurate with the importance to safety of each item. Safety classification provides a starting point for the definition of the requirements to be set for the design, manufacturing, installation, inspection, testing, operation and quality assurance of a system, structure or component.

Safety classification is used by STUK when defining regulatory control measures. The interdependence of safety classification and regulatory control measures are described in detail in the various YVL Guides.

In the classification document the systems, structures and components of the units have been assigned to three Safety Classes, Safety Classes 1, 2 and 3, and to Class EYT (not classified as regards nuclear safety). Items most important to safety are assigned to Safety Class 1.

Safety classification of the components of the process systems has been presented in a safety classification document which comprises classification charts and classification lists. This document was accepted by STUK in December 1994. When systems are changed, IVO presents necessary modifications and complements in the safety classification of the systems in connection with preinspection documents submitted to STUK for approval. The modified safety classification documents are submitted to STUK once a year.

Safety classification of the electric systems comprises a system-level safety classification list (dated 20.6.1995) presented in Chapter 8.1 of LOFSAR and a separate component-level safety classification list (dated 11.4.1990) which has been presented as an annex to the safety classification document. A component-level safety classification has been established for the electric devices in Safety Classes 1, 2 and 3.

A system-level safety classification of the automation equipment has been presented in the classification list (dated 20.1.1997) in Chapter 8.1 of LOFSAR, and a component-level safety classification in a separate document (dated 7.6.1989) and in its revisions.

Safety classification of the electric and automation equipment is maintained and complemented in a respective way as the safety classification of the process components.

In addition to the ordinary Safety Classes, additional requirements may be defined for certain components based on a so-called accident condition classification and on some electric provisions. Based on these requirements the classification of some components has been changed, and they have been replaced with the components withstanding accident conditions in a better way. The results of the probabilistic safety analyses may also result in defining additional requirements for some systems or components.

In conclusion, the safety classification of the Loviisa plant complies with the provisions of Section 21 of Decision 395/1991.

4.10 Monitoring and control of a nuclear power plant

A nuclear power plant's control rooms shall contain equipment which provide information about the plant's operational state and any deviations from normal operation as well as systems which monitor the state of the plant's safety systems during operation and their functioning during operational transients and accidents.

A nuclear power plant shall contain automatic systems that maintain the plant in a safe state during transients and accidents long enough to provide the operators a sufficient time to consider and implement the correct actions.

There shall be an emergency control post at a nuclear power plant which is independent of the control room and the necessary local control systems by the means of which the nuclear reactor can be shut down and cooled and residual heat from the nuclear reactor and spent fuel stored at the plant can be removed. (Section 22 of Decision 395/1991)

The Loviisa 1 and 2 units have their own independent main control rooms. There are available the needed process information and all the needed control actions can be performed there. Alarm signals from the spent fuel storages are also available in the Loviisa 2 main control room. As regards their implementation, the main control rooms are of proven control room technology.

Process information is presented in the main control room with indicating meters, indicator lights and recorders as well as with the monitors of the process computer system. There are two redundant alarm systems in the main control room. These systems have been realised by using two different technics, conventional and computer-based technics. Indicator light fields are in the operator's consoles, and two monitors have been reserved for computer alarms. In addition, data on events and conditions as well as the exceedings of warning and alarm limits are recorded by the alarm printers. The process computer gives process information in an illustrative format for the use of the operators.

In addition to the main control room, the shutdown of the reactor as well as the control and monitoring actions necessary for safety can be performed by means of a so-called emergency control room table, located in the main control room of the other unit.

In addition to the main control room, the additional control rooms are located in the both auxiliary buildings for controlling the functioning of important auxiliary processes. Furthermore, there are the unit-specific ventilation control rooms and the diesel-specific local control posts at the plant. The alarm signals from all auxiliary control rooms are available in a combined format in the main control rooms.

The Loviisa 1 and 2 protection systems have been designed so that quick operator actions are not required for the start-up of the safety systems during transient or accident situations. Possibilities of human errors are effectively reduced by a sufficient consideration time available to the operators before control or other actions, by appropriate instructions for transient and emergency situations as well as by operator training. The process computer has been equipped with a so-called critical safety functions control system (KTT), by means of which an operator can follow the performance of all the safety functions in a combined and clear format. An identification system for transient situations is also related to the control of the critical safety functions. An operator may use it as a support when a situation is being identified.

Ageing of the Loviisa 1 and 2 electric and automation equipment and systems as well as cables is systematically followed. The ageing of the plant protection automation has been evaluated in a study carried out by the Technical Research Centre of Finland (VTT). According to the study there are still no technical need to replace the system. Ageing components have been systematically replaced at the both units with new devices and components fulfilling the current requirements. Cables have also been extensively replaced.

In the licence application a licence term extending until the year 2008 is proposed. It is presumable that during that period old systems and devices will be replaced with systems and devices, in which programmable technology is employed. This will set new challenges both to the staff and the quality system of the units. The modernisation of automation technics shall be done in a controlled way.

In conclusion, the monitoring and control of the Loviisa plant have been implemented in compliance with the provisions of Section 22 of Decision 395/1991.


5 OPERATION OF A NUCLEAR POWER PLANT

5.1 Technical Specifications and plant procedures

Technical and administrative requirements and restrictions for ensuring the safe operation of a nuclear power plant shall be set forth in the plant's Technical Specifications.

Appropriate procedures shall exist for the operation, maintenance, in-service inspections and periodic tests as well as transient and accident conditions of a nuclear power plant. (Section 23 of Decision 395/1991)

IVO has established the Technical Specifications for the Loviisa 1 and 2 units, and STUK has reviewed and accepted them. The Technical Specifications are continuously updated, and all the changes need to be approved by STUK. The limitations and conditions of the reactor and plant operation, the requirements for periodic tests and the essential administrative instructions are presented in the Technical Specifications. IVO is further developing the Technical Specifications so that their readability and usability are improved. Concurrently, the aim is to complement the Technical Specifications with more detailed bases. Then the reading of the Technical Specifications is easier in problem situations. The latest extensive change approved by STUK is the updating of the chapter of the Technical Specifications concerning periodic tests. The chapter corresponds now with the development of the periodic test programme.

The operating procedures of the Loviisa plant are a part of the quality assurance programme. The most important instruction types are:

  • administrative instructions of which the Organisational Manual and especially the Administrative Rules included in the Manual are essential
  • instructions for emergency and transient situations
  • fuel handling instructions and instructions for radiation protection
  • normal state instructions and testing instructions
  • maintenance instructions.

The updating and coverage of the procedures are subjects to inspection in the STUK's inspection programme for the operation of the Loviisa plant. In addition, during all inspections of the programme individual instructions are evaluated.

An advanced and updated guidance system exists at the Loviisa plant. It includes about 2050 separate instructions. The instructions cover well work processes and functions important to safety and availability.

The guidance system is a part of the quality system of the plant. Strict requirements have been set in the Quality Assurance Manual for the coverage, responsibilities, updating and observance of the guidance system and instructions. According to the Manual the evaluation of the guidance system is included in the annual review of the coverage and effectiveness of the quality assurance programme. Among other things the requirements, adequacy and need for updating of the instructions and the fulfilment of the set requirements are considered in this review.

In conclusion, the Technical Specifications and procedures required in Section 23 of Decision 395/1991 exist for the operation of the Loviisa plant. The state of the plant procedures is good at the Loviisa plant. Procedures are maintained, evaluated and developed systematically and in a controlled way.

5.2 Operation and maintenance

In all activities affecting the operation of a nuclear power plant and the availability of components, a systematic approach shall be applied for ensuring plant operators' continuous awareness of the state of the plant and its components.

The reliable operation of systems and components shall be ensured by adequate maintenance as well as by regular in-service inspections and periodic tests. (Section 24 of Decision 395/1991)

Plant operation

The procedures followed in the operating activities of the Loviisa 1 and 2 units are based on written instructions and on operating orders prepared when needed. An operating order is prepared e.g. when the operating state or power of the unit is changed, or for measures related to the reactor or nuclear fuel.

By means of a work request system it is ensured i.a. that the plant operators are aware of the state of the unit. IVO has developed, and develops further, its work request system based on accumulated operating experiences. In addition to the work request system the operators in the main control room of the units follow failures, repairs and preventive maintenance of the components referred to in the Technical Specifications. A shift supervisor gives a permit to start a specific work when he has evaluated the work plans specified in the work request system, taking into account the operability requirements of the systems and components set in the Technical Specifications. The main control room is provided with information on the operating states of the systems and components and on the conditions of room spaces as well as on possible deviations existing. The deviations are responded according to the procedures for operation and transients.

STUK observes the functioning of the work request system in connection with the inspection programme for the operation. Furthermore, based on the reports submitted to STUK and through on-site inspections STUK controls that the Technical Specifications are followed. STUK's resident inspectors at the site follow regularly the operating activities of the units.

When the plant is started after an annual maintenance outage or other repair outage, the valves, pumps and other process and electric devices and instruments of the system important to plant safety are inspected to ensure that they are operable. Before and during the start-up of the plant the needed tests are performed in addition. So it is finally ensured that the systems and components of the plant function appropriately.

Maintenance

Requirements for maintenance are given in Guide YVL 1.8.

In addition to preventive and repairing maintenance, the maintenance activities of the Loviisa 1 and 2 units cover the design and implementation of modification works, spare part maintenance, activities during outages as well as quality control related to these activities.

The maintenance organisation of the plant plans and prepares annual maintenance outages together with the operating organisation. Special attention has been paid to the reliable activities of subcontractors as well as to the technical competence of external human resources. Both the utility and STUK control companies performing inspection activities and the technical competence of organisations carrying out various duties. In addition to the normal monitoring activities, the preventive maintenance programme includes also continuously measuring methods, such as the vibration measurements of the control rod drive units, reactor coolant pumps and turbogenerators, the monitoring of the primary circuit loadings as well as the monitoring of leakages, water chemistry and lose parts.

The maintenance procedures at the Loviisa plant have been programmed in the plant computer according to the work request system. Some parts of the system are available to STUK for reading.

The functioning of the systems and components is ensured with regular tests. The systems and components to be tested and the time periods of the tests are presented in the Technical Specifications. At least the respective periodic tests are required after the modification and repairing works and maintenance activities requiring dismounting. The performance test programme to be carried out after an essential modification is required to be approved by STUK in advance.

In addition, inspections regarding to the functioning and condition of components are carried out when necessary based on operating experiences from other plants and on the advancement of technical knowledge. Other operating organisations of VVER-type reactors have been essential sources of operating experiences in this respect.

STUK controls monitoring and maintenance activities as well as repair and modification works with regular inspections. During inspections it is aimed to make sure that the utility has adequate resources, such as a competent staff, instructions, a spare part and material storage as well as tools for the sufficiently effective implementation of the monitoring and maintenance activities. Special subjects are the condition monitoring programmes for the carbon steel pipings and their results.

Inservice inspections

The condition of the pressure-retaining components of the Loviisa 1 and 2 units is ensured with regular inservice inspections. The components of the primary circuit are inspected by means of non-destructive examination methods. These regularly repeated examinations are carried out during outages according to Guide YVL 3.8. The results of the inservice inspections are compared with the results of the previous inspections and of the preservice inspections which have been carried out before the commissioning.

The inservice inspection programmes are submitted to STUK for approval before each inspection series. Programmes and related inspection instructions are changed when necessary, taking into account the development of requirements and standards in the field, the advancement of examination technics and inspection experiences as well as operating experiences in Finland and abroad.

Those places have been tried to select as inspection objects where defects arise most probably. These kind of places are e.g. objects susceptible to fatigue due to temperature variations. The selection of inspection objects is subject to a continuous development.

The length of the inspection period of the regular inspections (e.g. ASME) is normally ten years. Inspection programmes have been complemented with additional inspections as regards the reactor pressure vessel and the primary circuit pipings, and the length of the inspection period has been reduced to eight years. The length of the inspection period of the objects susceptible to thermal fatigue is three years.

Guide YVL 3.8 and the latest revisions of the regulations ASME Code, Section XI are applied as approval bases for the inservice inspection programmes and instructions.

The qualification system for the inservice inspection is being developed. The plans are still very general. STUK follows carefully the development and implementation of the plans.

In addition to the inspections mentioned above, physical inspections concerning the condition and reliability of pressure vessels are carried out as regular pressure vessel inspections according to the Finnish pressure vessel legislation. Such inspections are a full inspection, an internal inspection and an operational inspection. These inspections include non-destructive examinations as well as pressure and tightness tests. The inspections of pipings have been defined in the system-specific monitoring programmes. These periodic inspections are dealt with in Guides YVL 3.0, YVL 3.3, YVL 5.3, YVL 5.4, YVL 5.7. The periodic inspection programmes fulfil the requirements of YVL Guides, as regards the number and technics of inspections.

The reliability of the non-destructive examination methods for the primary circuit pipings and components has been essentially improved after the commissioning of the plant. Due to the structural material properties of the reactor coolant pumps and main isolation valves, needs and possibilities for development still exist in the inspection technics of these components. The implementation of the qualification system of inservice inspections is an essential subject for development of activities.

Plant ageing management

Ageing of the systems and components at the Loviisa 1 and 2 unit is followed based on operating and maintenance experiences. A systematic ageing management, utilising the reports and data systems related to inspection, testing, maintenance and repair activities, was established in 1995. The head for maintenance is responsible for it.

Measures and needs for development are annually planned in the joint meetings of the units responsible for operation, training, maintenance and technics. Needed experts of ageing phenomena are invited to participate in these meetings. The working groups on primary and secondary circuit monitoring are responsible for the identification of problems related to pressure vessels' lifetime and for the evaluation of monitoring methods. These working groups are comprised of the representatives of the units for operation, maintenance and technics.

For defining needed measures the systems have been grouped based on the requirements of the Technical Specifications for the components of the systems, on effects to production and on preconditions for maintenance. The people responsible for the systems follow the ageing of the most important components and uphold the relevant data system, used in the planning of needed measures. Other exploitable data systems contain information on ageing phenomena, maintenance history and inservice inspections.

In conclusion, the operation of the Loviisa plant has been arranged as provided in Section 24 of Decision 395/1991.

5.3 Personnel

Nuclear power plant personnel shall be well suited for its duties, competent and well trained. Initial, complementary and refresher training programmes shall be established for the personnel.

For ensuring safety in all situations, competent personnel shall be available in a sufficient number. (Section 25 of Decision 395/1991)

Detailed requirements related to Section 25 of Decision 395/1991 are given in Guide YVL 1.7. The licensing procedure for operators is given in Guide YVL 1.6. These Guides relate primarily to the normal operation of the plant.

The Loviisa plant is headed by a plant director (responsible director). The operating organisation is comprised of five groups: operation, maintenance, training and technical groups as well as an administrative group. The operating organisation is supported by the Nuclear Committee of the Loviisa plant. Its members are experts in different fields. The majority of the members works at the Myyrmäki headquarters of IVO Power Engineering Oy in Vantaa. In addition, other organisation units of IVO outside the plant also participate in the evaluation of safety and in the technical support to the plant. The duties, responsibilities and authorities of the various units of the plant operating organisation and of IVO's internal support organisation are presented in the Administrative Rules and Organisational Manual of the Loviisa plant.

The minimum staffing of the main control room and the plant site is presented in the Technical Specifications of the Loviisa plant. According to the plant duty system a person outside the shifts is continuously reachable for the control room staff. The person has the highest level operator competence (the level of shift supervisor). The system is aimed to ensure safety, when operator actions are made during emergency situations.

The principles and organisation of the training activities of the Loviisa plant as well as detailed training instructions have been presented in the Training Manual. It has been established to ensure the systematic implementation of training activities. The training group takes care of training activities at the plant. It is comprised of 11 persons. For assisting the training group, organisation unit-specific contact persons have been appointed. They ensure that unit- and individual-specific needs are taken into account and that information is transferred to both directions.

The competence requirements of the personnel are presented in the Training Manual. The competence requirements are based on the duties of each vacancy, on responsibility areas and on regulatory requirements related to the duties in question. The competence requirements define the basic education of a person and the initial and refresher training to be given at the Loviisa plant.

A full-scope training simulator identical with the plant is available for the training of the plant operators. Simulator training is given to new operator candidates during about 50 days as a part of the initial training. In addition to the simulator training, the initial training programme of the operators includes course-oriented classroom lectures and practical training at the plant and in the main control room. The initial training takes about one and a half years. Thereafter an operator can be licensed to work as a turbine or reactor operator. At the end of the training period a written and oral examination as well as the demonstration of professional skills at the simulator are arranged for the operators. These are preconditions for the work as an operator or a shift supervisor in the main control room of the plant.

For the operators of the plant a refresher training programme has been established. It is implemented in the periods of three years. The programme includes those subjects which shall be annually gone through. In addition, the refresher training of the operators includes annually simulator training during two weeks, covering normal operational situations (e.g. start-up and shutdown situations) and plenty of training for disturbance situations. Refresher training is arranged for the plant operators during three weeks a year on average.

Those persons of the plant personnel, who are responsible for certain key functions, need to be accepted by STUK before they can start the job. Such persons are the responsible director and his deputy, the shift supervisors and operators of the plant, and the persons responsible for physical protection and emergency preparedness arrangements. The plant operator licenses are valid for three years periods. E.g. a continuous work in the control room, participation in the refresher training programme and in a teamwise demonstration of professional skills as well as an oral examination are preconditions for the renewal of a license.

In addition, STUK approves the supervisors of the use of the plant pressure vessels. Likewise, only the companies and their employees approved by STUK are allowed to make repairs in the pressure-retaining structures and to carry out inspections related to mechanical components and structures.

Personnel training is an inspection object in STUK's inspection programme for the operation. During the training inspections in 1996 and 1997, special attention was paid to the training required for the modernisation of the plant.

In addition to the normal operating organisation, an emergency preparedness organisation has been defined to the plant for accident situations. The emergency preparedness organisation has been described in the Emergency Plan. The activities of the emergency organisation are trained during annual emergency exercises. A security organisation has been defined to the plant in the Security Plan. This organisation is responsible for the planning and maintaining of physical protection arrangements.

In addition to the normal operation of the plant, the Loviisa plant is also responsible for the design related to the implementation of the nuclear safety principles. According to STUK's opinion the Loviisa plant has not available an adequate number of a sufficiently educated personnel for dealing with extensive and/or many-sided principled safety issues. Therefore it is important that the expertise available in IVO Group is utilised to an adequate extent and so that the organisation unit responsible for the design of principle bears also its responsibility for the state of the plant according to a good safety culture.

In conclusion, the training and competence of the personnel of the Loviisa plant are in compliance with the provisions of Section 25 of Decision 395/1991 as regards the operation and maintenance of the plant. According to IVO's current organisational structure the Loviisa plant is responsible for the design related to the implementation of the safety principles. Taking care of this responsibility is a significant subject for development in the future also as regards training activities.

5.4 Monitoring releases of radioactive materials

Releases of radioactive materials from a nuclear power plant and their concentrations in the environment shall be effectively monitored. (Section 26 of Decision 395/1991)

Detailed requirements related to Section 26 of Decision 395/1991 are given in Guides YVL 7.6 and YVL 7.7.

The Loviisa plant has been equipped with the technical systems by means of which the largest part of radioactive materials contained in the plant process systems is collected and stored. Only a small part of radioactive materials may be released to the environment.

The releases of radioactive materials take place through an exhaust stack to the atmosphere in the form of gases or particles, as well as in the form of dissolved matters or particles in a sea water tunnel and further to the sea environment. The releases of radioactive materials from the Loviisa plant to the atmosphere and sea environment are monitored at all release channels by means of radiation meters measuring continuously as well as by taking samples and analysing nuclide-specific radioactivities in a laboratory.

STUK has approved the procedures concerning radiation measurements and laboratory analyses. STUK also controls regularly these activities.

An extensive environmental radiation monitoring programme is implemented in the surroundings of the Loviisa plant. The programme has been approved by STUK. According to the programme, the possible spreading of radioactive materials is continuously monitored by analysing radionuclide contents in foods produced in the plant surroundings and in other samples indicating the spreading of releases.

The monitoring programme contains annually about 500 samples. Sample types are e.g. milk, meat, corn and vegetables as well as water and aerosols in air. In addition, samples are taken from such indicator organisms which accumulate very effectively radioactive materials from their environment. Nuclides important to the radiation exposure of the people are analysed from the samples: gamma-active nuclides such as Co-60, I-131 and Cs-137, beta-active nuclides such as H-3 and Sr-90, and alfa-active nuclides such as Pu-238, Pu-239 and Pu-240.

The releases of the Loviisa plant have remained in recent years below 1/1000 part of the annual release limits, when considering the effects on radiation doses. As regards release amounts, noble gases are dominant in air releases and tritium in water releases. Released nuclides detected in the environment have been activated corrosion products (e.g. Co-60) and some other activated nuclides as well as tritium. Indications of radioactive substances in soil samples have been unusual, mainly detected in powerful air samplers and fallout during outages. In the indicator samples of the water environment very minor amounts of radioactive substances released from the plant have been regularly detected. These have no importance to the people or nature of the environment. Radioactive substances released from the Chernobyl accident are also dominant in the environmental samples of nuclear power plants.

The results of the environmental monitoring confirm the monitoring results of the radioactive material releases at the Loviisa plant.

At the beginning of 1990's an automatic measuring system for external radiation was installed in the surroundings of the Loviisa plant. Its purpose is to give a quick signal on the possible change of the radiation level in the environment during a possible emergency situation. There is a meteorological tower near the plant for observing the spreading of a radioactive release in the atmosphere. Its measuring instrumentation has been modernised, but the commissioning of the revised system is still going.

In conclusion, the releases of radioactive materials are monitored at the Loviisa plant according to the provisions of Section 26 of Decision 395/1991.

5.5 Operating experiences and safety research

Operating experience from nuclear power plants as well as results of safety research shall be systematically followed and assessed.

For further safety enhancement, actions shall be taken which can be regarded as justified considering operating experience and the results of safety research as well as the advancement of science and technology. (Section 27 of Decision 395/1991)

Operating experiences

The operating organisation of the Loviisa plant deals with the own operating experiences of the plant. The co-ordination of this activity has been concentrated to a safety engineer appointed to this job. However, the actual activities as regards operating experiences are carried out by various organisational units in a distributed manner.

For the evaluation of operating experiences from other nuclear power plants a special operating experience group has been established. It has expertise in various fields of technics. This group (IVO-KKR) reviews the received reports and evaluates whether measures are needed at the plant, in procedures or in instructions as a result of some event. From IVO Power Engineering Oy the head of the office for safety and nuclear fuel is the chairman of IVO-KKR. Other members are experts at the Loviisa plant, e.g. two engineers from the safety group.

The group gives annually a couple of recommendations to the management group of the plant for further consideration and for decision-making on possible further measures. The quality assurance engineers of the Loviisa plant follow the progress of the measures. STUK monitors the dealing with the operating experiences received from other plants in connection with an inspection carried out annually. IVO also reports semi-annually to STUK on the activities of IVO-KKR.

IVO and TVO have also a joint operating experience group (VKK), which deals i.a. with the most significant events of both plants.

The follow-up of the operating events at IVO's own plants is a part of the normal operating and maintenance activities. It can be considered that IVO's procedures are at the present comprehensive enough, and that all events important to safety will be appropriately documented and directed for more detailed analyses.

The depth of the analysis of an operating event depends on the nature of the event and on the severity of consequences. A so-called root cause analysis is prepared on events which are considered significant. In this analysis the root causes of an event are defined in addition to the direct causes. They relate often to the human activities and are so primarily organisational from their origin. IVO has in recent years actively developed the methods it employs, especially as regards the appropriate dealing with the events of minor consequences. This can be considered to be a proper development direction, because the careful analysis of the events of minor consequences and the implementation of appropriate measures eliminate preconditions for more severe events.

As regards other plants, essential information sources for IVO-KKR are WANO (World Association of Nuclear Operators) as well as IAEA (International Atomic Energy Agency) and OECD/NEA (Nuclear Energy Agency). WANO is a joint organisation of utilities. It takes care of collecting information on events at nuclear power plants and of reporting. IAEA and OECD/NEA uphold respective connections primarily between safety authorities.

The decision-making in questions concerning the operating experience activities and the surveillance of the activities take place according to the normal management and quality assurance procedures of the plant.

For the operating experience activities instructions have been given in the guidance system of the Loviisa plant.

Such operating events have not occurred at the Loviisa plant which would have caused direct danger to safety. The recurrence of some event types which as such appear harmless (e.g. breaks in small pipings of the feedwater system due to thermal fatigue) and a special event, nuclear fuel blockage during operation, have indicated that experience accumulating from operating events could be utilised more effectively.

Safety research

During the passed term of the operating licence IVO has invested in safety research substantially more than what is a normal international level. This is mainly caused by the uniqueness of the Loviisa plant, but also by the culture arisen in IVO Group already during the construction stage of the plant. Based on experiences it appreciates self-sufficiency of know-how.

IVO did an especially high-grade and internationally considered significant work when it developed a management strategy for severe accidents. A plant supplier (Westinghouse) has planned to employ the procedure of cooling the melted core inside the reactor pressure vessel in a so-called advanced pressurised water reactor concept. This procedure has been developed by IVO.

Other pioneering research projects have been the assessments of internal boron dilution as a part of the evaluation of the boron dilution risks, basic studies on the accident behaviour of the heat insulator materials and the development of strainer structures in connection with the containment sump modification, as well as the studies on hydraulic impacts of the feedwater distributors and on thermal fatigue of steam generator pipes related to the structural design of the feedwater distributors.

In conclusion, the provisions of Section 27 of Decision 395/1991 concerning the utilisation of operating experiences and the results of safety research are mainly well fulfilled. The operating experience activities at the Loviisa plant are mainly appropriate. The number of significant operating events has remained small despite the ageing of the plant. On the other hand, a tendency to recurrence has been seen as regards some event types.

Attention needs to be paid to maintaining a high level research culture also in the future. Only an adequate self-sufficiency in this respect ensures to IVO the availability of appropriate safety improvements, when they are needed. However, an important development subject for the Loviisa plant is the utilisation of own operating experiences so that adequately extensive and correct conclusions are drawn for preventing the reoccurrence of similar events.

5.6 Nuclear power plants in operation

For the part of such a nuclear power plant for which an operating licence was issued before the entry into force of this decision (an operating nuclear power plant) the limit for the dose referred to in Section 11 is 100 mSv, unless the application of the provisions contained in Section 11, as such, is justified, considering the provisions of Section 27, second paragraph.

The provisions of Sections 12, 17 and 18 of this decision are applied to an operating nuclear power plant to the extent justified based on the provisions of Section 27, second paragraph, and taking into account the technical solutions of the nuclear power plant in question.(Section 28 of Decision 395/1991)

Section 28 of Decision 395/1991 imposes some deviations from the provisions of Sections 11, 12, 17 and 18. The compliance with the Provisions in question are evaluated in Chapters 3.5, 3.6, 4.5 and 4.6.


REFERENCE

STUK, Safety review report on the Loviisa plant based on Decision 395/1991 of the Council of State, STUK-B-YTO 81, April 1991.

Share this page