福島核災後龍門電廠（核四廠）壓力測試評估 review of the post
TRANSCRIPT
1
福島核災後龍門電廠（核四廠）壓力測試評估
Review of the post-Fukushima nuclear stress-tests of the
Lungmen nuclear power plant (NPP4)
綠色和平東亞辦公室委托壓力測試評估報告
歐妲．貝克
漢諾瓦 2013 年 8 月
Study commissioned by Greenpeace East Asia
Oda Becker
Hannover, August 2013
主要作者：Dipl. Phys. 歐妲．貝克，漢諾瓦（德國）, [email protected]
協助：瑪格．帕特里夏．洛倫茨
Author:
Dipl. Phys. Oda Becker, Hannover (Germany), [email protected]
with Mag. Patricia Lorenz
2
摘要
臺灣原能會在 2012 年宣布將採用在歐盟實施的福島核災後壓力測試方式作為基礎，進行
臺灣核電廠的壓力測試。
如同歐盟，綠色和平邀請物理學家 Oda Becker 針對臺灣目前核能計畫的重點──核四廠的
壓力測試報告進行評估。此次評估中得到一個清楚的結論，若要改善反應爐目前的狀態以
把核災風險降至最低是有困難的。此外，再加上因福島核災後對於核四廠的核安升級建議
不甚明確，便已足夠構成充分的理由說明核四廠不應該繼續興建，直至最終取得運轉執
照。核四廠與臺北市的距離很近，因此不可能將 核四廠提升至相應合理的安全水準。如此
不可排除的核災發生時，將會造成數百萬人的災難。
本報告的第一章介紹臺灣核能發電的現況以及核四廠的歷史。
接著評析福島核災後歐盟執行的壓力測試程序，該程序為臺灣目前核安壓力測試的基礎。
福島核災的恐怖結果是由數十年來錯誤的安全管理原則所造成，強大核能工業壓力的影響
下，導致核能管制機構的安全規範極度鬆散，這問題不只存在於日本。該事件讓歐盟感到
震撼，促使歐盟深切的希望能對於核能及其相關安全性之問題有所改變，並且將絕對有可
能發生的意外事件，但以往因發生的機率很小而被忽略的事件均納入核安的考量之中。
針對此次事件的回應，歐盟進行了一系列的壓力測試，希望這些測試可以降低歐洲國家的
核災風險。此次壓力測試讓歐洲建有核電廠的國家開始著手訂立國家型行動計劃，就過去
兩年中所發現的缺失加以改善。綠色和平針對這些計劃進行評估，而評估結果指出，儘管
在壓力測試後歐盟國家已經大量投入與核能安全相關的安全升級，但許多關鍵的核安相關
的問題仍然未獲解決。另外，即使是目前已經在處理的問題，也需要再幾年的時間才能予
以修正，在此期間，歐洲人民仍暴露在核災風險之中。
針對歐盟壓力測試的批評包括：其測試廣度有限、缺乏明確標準、同儕審核（peer-review
）流程的侷限性以及參與的專家缺乏獨立性。歐盟管制機構之所以宣稱其壓力測試獲得最
高分，是因為這些國家即使知道自己的反應爐有缺陷，仍然打算持續運轉。公民組織的代
表及專家憂心，歐盟的壓力測試主要目的僅是用來提升歐洲核電管理部門對於核能安全的
信心，而不是真正探究核能本身已經或將會產生的問題。
第三章在描述臺灣壓力測試的設計和現狀。其中發現，臺灣的壓力測試重蹈歐盟壓力測試
中的缺失。本報告更進一步的聚焦於核四廠執行的壓力測試。
在臺灣，地震是重要的現實問題。目前的評估採用 400 年的地震歷史，並不足以當作為設
計基準地震（DBE）。歐盟的地震重現期建議以一萬年做週期計算。臺灣的核安管制機構
原能會沒有訂立出設計基準地震（DBE）的標準要求。核四廠 的耐震設計更被認定無法應
付設計基準以外的狀況。目前無法得知臺電在核四取得執照運轉前，是否會先改善原能會
所提出的缺失。
核四廠目前無法應付海嘯和極端氣候所導致的洪水風險。再者，目前的洪水設計所依據的
海嘯數據分析不夠充足，必須重新定義。
排水系統亦不足以因應歐盟建議的以每一萬年一次的極端降雨狀況，而僅能因應一百年一
次的極端降雨標準。壓力測試揭露了核四的危險性和斷崖效應（cliff edge effects），並且
顯示洪水可能會導致危險事故。
此外，政府間氣候變遷小組（IPCC）預測極端氣候發生頻率將增加的趨勢，核四廠亦未充
分考量。
3
這份評估結果點出幾項當核電廠遇到廠外電源喪失（off-site power losses）的情況時會有的
弱點。尤其在一些事故，如：地震或者極端天然災害發生時，並不能確保可以仰賴場外緊
急應變措施。目前臺電提出少數可增加緊急應變措施健全性措施，且該類措施需要額外的
人為手動啟用，而前述災害發生時，人為手動啟用很可能受阻。
缺少備用的最終熱沉（loss of ultimate hear sink），此為歐盟核電廠用以大幅減低最終熱沉
失效的風險的常見措施，但原委會僅為消極的建議臺電就此進行評估。目前提出的評估報
告中，於考量可能的意外狀況範疇時，一直都沒有充分地評估如果設備雙重故障（兩個反
應爐同時失效）或輻射外洩意外時該如何應變。
評估發現，嚴重事故的管理（SAM）也大有問題，包括：洩壓和反應爐壓力槽（RPV）失
效的問題。原能會皆未積極要求核四廠須具備圍阻體過濾排氣系統以及能防止氫爆的被動
式氫氣再結合器（PAR）。報告強調，嚴重事故管理（SAM）措施如果沒有做好將會使放
射性物質釋放到環境中。
近期較新式的進步型沸水式反應器已配有爐心捕集器（core-catcher），但核四廠卻採用舊
型進步型沸水式反應器的設計，無法得知若產生爐心熔穿效應（melt-through）發生時，是
否有足以因應。
針對發生重大事故時，放射性廢水水量的分析和防止其廢水洩漏到海中的管理措施不夠充
分。另外，有關重大事故中的用過燃料池的相關分析，與歐盟壓力測試報告中相同議題的
分析結果相比，極為不足。
斷然處置措施（Urgent Response Guidelines）裡實施的時機不適當，並且使人擔憂。經濟合
作暨發展組織（OECD）特別提出，若將斷然處置程序措施引（ultimate response guideline）
與緊急操作程序書（emergency operating procedures）、嚴重事故處理指引（severe accident
management guidelines）及大範圍廠區受損救援指引（extensive damage mitigation guidelines ）
進行整合，將導致更多的困惑。
第四章闡述壓力測試以外的其他議題。部份內容主要取得於《遠見雜誌》2013 年 3 月對林
宗堯先生的專訪。報導指出核四廠在設備採購和設計修改時的缺失、核四廠不安全之處、
施工中所發生的事以及失敗的品質保證（QA）。儀控（I&C）系統架構相關的問題則涵蓋
缺乏傳統類比硬體接線（hard-wired）系統作為後備，此項後備系統目前在芬蘭和美國的歐
洲壓水式反應爐（EPR）為必要的設計。另外一個問題則是，試運轉流程並非由獨立的測
試人員進行，而是臺電公司自己的員工進行檢測。本章於結論中亦分析臺灣核能管理機構
--原能會是否能提供獨立性的有效監督與控管。
第五章分析比較新型歐洲進步型沸水式反應器（EU-ABWR）與核四廠所採用的過時進步
型沸水式反應器（ABWR）設計，並突顯一些未被解決的問題，包括：大型飛機撞擊防護
、被動式隔離冷凝器系統、爐心捕集器、被動式圍阻體冷卻系統，以及嚴重事故專用的電
源供應管理。
從第六章的總結中可得到清楚的評斷：就現有的天然災害而言，核四廠 具有設計上的弱點
以及在結構、系統與組件上的缺陷，這些缺陷不可能因改善而達到可被接受的安全層級。
因此，導致大量放射性物質外洩的嚴重意外是有可能發生。考量到核四廠與臺北市相距甚
近，若發生此類嚴重意外，數百萬人將會受災。
根據所列出的種種事實，建議終止核四廠計畫並且不讓核四廠運轉。
Oda Becker
2013 年於漢諾威
4
EXECUTIVE SUMMARY
The nuclear regulator of Taiwan announced in 2012 it wanted to carry out nuclear stress
tests of its nuclear park on the basis of the post-Fukushima nuclear stress tests carried out
in the EU.
Like in the EU, Greenpeace commissioned physicist Oda Becker to carry out an
assessment of the stress test reports of a key project for the Taiwanese nuclear
programme, the Lungmen nuclear power plant (NPP4). The review comes to the
conclusion that it would be difficult to backfit the reactor in its current state so that it
would meet state of the art risk reduction levels. Furthermore, lack of clarity about the
proposed post-Fukushima upgrades should be sufficient reason not forward the project to
final licensing. It is not feasible to bring the NPP4 to a safety level that can be justified
facing the fact of its short distance to the city of Taipei. A severe accident, which cannot
be excluded, would have disastrous consequences for millions of people.
In Chapter 1, this report provides an introduction into the status of nuclear power in
Taiwan and the history of the Lungmen nuclear power plant, also known as the Fourth
nuclear power plant (NPP4).
This is followed by a critical overview of the EU post-Fukushima nuclear stress tests that
form the basis for those in Taiwan. The Fukushima catastrophe was the horrible result of
decades of mistaken safety philosophy, a very lax safety regulation under strong industry
influence on the regulators – not only in Japan. The first shock led in the EU to the honest
wish to change this, to also involve events which are definitely possible but were kept out
of the safety cases by using probabilities.
In response, the European Union carried out a series of nuclear stress tests, introduced as
a transparent exercise to reduce the risk of nuclear energy in Europe. As a result, the
countries with nuclear power stations worked out national action plans to address
weaknesses that emerged during the two years of analysis. In spite of significant
investments into safety upgrades following the tests1, many vital and known issues were,
however, not addressed. Even problems that are being dealt with will take years to be
remedied – leaving European citizens exposed to these risks in the meantime.
Criticism on the EU stress tests include its limited scope, the lack of clear criteria, the
limitations of the peer-review process and insufficient independence of the involved
experts.
While national regulators claimed receiving the highest scores for their stress tests, they
intend to let reactors continue to run despite known flaws. This gave credence to the fear
of representatives of civil society and independent experts that the stress tests were
mainly set up to improve the confidence in the safety of the European nuclear power
sector regardless of his findings.
In Chapter 3, the set-up and state of the Taiwanese nuclear stress tests is described. It is
found that these stress tests repeat the flaws of the EU stress tests. It further concentrates
on the stress tests of the Lungmen nuclear power station (NPP4).
1 The European Commission estimates the total costs of nuclear upgrades in the EU following the stress-
tests at around 25 Billion EUR; http://www.nytimes.com/2012/10/04/world/europe/safety-review-says-
europes-nuclear-reactors-need-repair.html?_r=0
5
The issue of earthquakes is a crucial one for Taiwan reality. It is concluded that the
current assessment of 400 years of earthquake history is insufficient for determining
design based earthquake (DBE) criteria. Taiwanese nuclear regulator AEC does not give
requirements for the return frequency of earthquakes for determining DBE, whereas the
EU recommends one of 10-4
per annum. The seismic resistance of NPP4 is furthermore
deemed insufficient in beyond design base situations. It remains unclear whether the
already by AEC acknowledged shortfalls have to be remedied before the start-up license
is received.
Flooding risks continue to be of unacceptable level both during tsunamis and extreme
weather. The analysis for the design basis tsunami are inadequate and needs to be
redefined.
Drainage systems are not sufficient to deal with the EU recommended standard of once in
10 000 years, but only once in 100 years extreme precipitation. The stress tests revealed
dangerous weak points and cliff edge effects that show that flooding could result in a
dangerous accident situation.
Also the preparation for an increase in extreme weather events as predicted by the
Intergovernmental Panel on Climate Change (IPCC) is insufficient.
This review surfaces several weaknesses in meeting off-site power losses. Especially the
reliance on off-site emergency services in some cases cannot be guaranteed in cases of an
earthquake or extreme weather catastrophe. Envisioned measures to increase robustness
are limited and need additional manual action, which might be challenging under extreme
circumstances.
The lack of an alternate ultimate heat sink, a usual EU practice that could reduce risks of
loss of ultimate heat sink (UHS) considerably, is only recommended by the regulator
AEC for evaluation. Dual unit failure (both reactors failing at the same time) and
accidents with the spent fuel have been insufficiently included in potential accident
scenarios.
The study finds several important issues in severe accident management (SAM),
including issues concerning depressurisation and reactor pressure vessel (RPV) failure.
The lack of a filtered containment venting system is criticised, as well as the lack of
passive autocatalytic recombiners (PARs) to prevent hydrogen explosions and the fact
that AEC does not aggressively prescribe these. The issue of SAM measures that would
de-facto release radioactive substances into the environment is highlighted.
Where newer ABWR designs are equipped with a so called core catcher, it is not clear
whether the measures for melt-through at NPP4, which is an older ABWR version, are
sufficient.
Management of radioactive water amounts and leakage to the sea during large accidents
are found insufficiently analysed. Accidents involving the spent fuel pools are in
comparison with the already inadequate EU recommendations insufficiently analysed.
The implementation timing of the Urgent Response Guidelines (URGs) appear
insufficient, and there exists concern, among others voiced by the OECD, that the
proposed integration of emergency operating procedures (EOPs), severe accident
management guidelines (SAMGs), and extensive damage mitigation guidelines (EDMGs)
with the ultimate response guidelines (URGs) will lead to more confusion.
6
Chapter 4 highlights issues that are not addressed in the stress tests. This is largely based
on a March 2013 special interview with Tsung Yao Lin by Global View Monthly. It
points out shortcomings during procurement of equipment, design alternations,
inadequacies in safety culture, incidents during the construction process and failing
quality insurance (QA). Concerns regarding the information and control (I&C) system
architecture include the lack of a hard-wired back-up as now required for the EPR reactor
designs in Finland and the US. Problems during test-operation procedures created a
situation in which not independent test operators, but TPC own operators carried out tests.
The chapter concludes with an analysis of the question whether the regulator AEC is
sufficiently equipped to provide independent oversight.
In Chapter 5, the newer EU-ABWR is analysed and compared with the outdated ABWR
design of the NPP4, highlighting several issues that remain unaddressed. This includes
protection against impacts from large aircraft, a passive isolation condenser system, a
core catcher, a passive containment cooling system and a dedicated power supply for
severe accident management.
The conclusions in Chapter 6 lead to a final sobering judgment:
Regarding the existing natural hazards, the design weaknesses and the deficiencies of the
structures, system and components, it is not possible to retrospectively bring the NPP4 to
an acceptable safety level. Therefore, a severe accident with a major release of
radioactive substances cannot be excluded.
Considering the short distance of the NPP4 to the city of Taipei, such a severe accident
would have disastrous consequences for millions of people.
Taking all facts into account it is recommended to stop the NPP4 project and to not
commission this nuclear power plant.
Oda Becker
Hannover, 2013
7
Table of Contents 1 Introduction .............................................................................................................................. 8
1.1 Nuclear Power in Taiwan.................................................................................................. 9
1.2 Introduction Lungmen NPP ............................................................................................ 10
2 The EU stress tests ................................................................................................................. 12
2.1 Shortcomings of the EU stress tests ................................................................................ 12
2.2 Procedure ........................................................................................................................ 15
2.3 ENSREG s results of the National Actions Plans........................................................... 16
2.4 Discussion of the ENSREG s results .............................................................................. 17
2.5 Conclusion of the critical review of the EU stress tests .................................................. 18
3 Weaknesses the Taiwanese stress tests revealed ................................................................... 21
3.1 Earthquakes ..................................................................................................................... 21
3.2 Flooding .......................................................................................................................... 26
3.3 Other extreme natural hazards ........................................................................................ 30
3.4 Loss of all power supply (SBO) and ultimate heat sink (UHS) ...................................... 32
3.5 Severe Accident Management ........................................................................................ 36
4 Weaknesses the Taiwanese stress tests ignored ..................................................................... 43
4.1 Shortcoming during procurement of equipment ............................................................. 43
4.2 Many design changes ...................................................................................................... 44
4.3 Inadequate safety culture ................................................................................................ 44
4.4 Incidents during the construction process ....................................................................... 45
4.5 Insufficient quality assurance (QA) ................................................................................ 46
4.6 Concerns regarding the I&C System .............................................................................. 47
4.7 Inappropriate test-operation procedures ......................................................................... 47
4.8 Role of the Atomic Energy Council (AEC) .................................................................... 48
5 The EU-ABWR ...................................................................................................................... 50
5.1 Defence-in-Depth Concept ............................................................................................. 51
5.2 Technical realisation of DiD requirements ..................................................................... 52
5.3 Severe Accidents (DiD Level 4) ..................................................................................... 53
6 Discussion of the results and conclusions .............................................................................. 55
7 References .............................................................................................................................. 60
8 Abbreviations ......................................................................................................................... 63
8
1 Introduction
One important lesson of the Fukushima accident is that nuclear accidents really occur –
even in developed industrialised countries. The operation of nuclear power plants is
always without any exception connected with the residual risk of an uncontrolled nuclear
accident.2
Nuclear safety in the absolute sense does not exist. The expression “a nuclear
plant is safe” only means that the residual risk is accepted [WENISCH 2012].
Taiwan has performed a stress tests exercise for its nuclear power plants largely based
upon the EU stress tests model. In late 2012, Taiwan invited the European Commission to
set up a peer review of these stress tests. Based upon this request, the Commission
organised a review team by selecting volunteering experts from its ENSREG group as
well as from its own Services. A nine-person team of nuclear safety specialists will
conduct a peer review of the country's three operating nuclear power plants and the unit
under construction (Lungmen NPP).
In April 2013, Greenpeace East Asia commissioned Oda Becker, a German nuclear
expert, to prepare a critical review of the stress tests of the Forth Nuclear Power Plant in
Taiwan (Lungmen NPP or NPP4).
These evaluations3 do not claim to be exhaustive, but the findings contribute to a more
comprehensive understanding of safety and risk of the NPP4.
After a short general introduction about nuclear power in Taiwan, chapter 2 of this report
gives an overview on the stress tests performed in Europe. It describes the shortcomings
and limits of the stress tests specifications as well as the intermediate results (including a
critical review) of the ongoing follow-up stress tests procedure.
Chapter 3 discusses the weaknesses of the NPP4 that have been revealed during the stress
tests and the measures proposed by the operator (Taiwan Power Company – TPC) and
national regulator (Atomic Energy Council – AEC) to remedy these weaknesses.
The construction of the NPP4 was accompanied with several problems. These problems
result in safety issues which are out of the scope of the stress tests. The most important
shortcomings are discussed in chapter 4.
2 The core melt probability of nuclear power plants is about 1: 100,000 per year and plant. This means a
core melt probability in any plant around the world of about 1: 230 per year and a core melt probability
of about 1:2500 per plant within an operation time of 40 years. But the accidents at Chernobyl and
Fukushima proved that the real occurrence of accidents is not the same as the calculated probability. 3 The evaluations are based on the studies “Critical Review of the EU Stress Test performed on Nuclear
Power Plants” published in May 2012 and the “Critical Review of the National Action Plan (NAcP); EU
Stress Test performed on Nuclear Power Plants” published in April 2013 [WENISCH 2012; BECKER
2013].
9
To complete the picture, chapter 5 presents the design improvements of the EU-ABWR,
which is the adaption of the reactor design of the NPP4 to the European market.
The last chapter discusses the findings and formulates conclusions.
1.1 Nuclear Power in Taiwan
In Taiwan, there are currently three operating nuclear power plants (NPPs): Chinshan,
Kuosheng and Maanshan, which are also called the first, second and third NPP,
respectively. Each of these NPPs is equipped with two identical reactors. In addition,
there is a nuclear power plant under construction, the Lungmen NPP (LMNPP), or the
fourth NPP (NPP4), comprising two units. All the nuclear power plants are owned and
operated by the state-owned Taiwan Power Company (TPC).
In 2012, the three operating NPPs provided 38.7 TWh or 18.4 percent of the country’s
electricity (down from a maximum of 41 percent in 1988). Taiwan’s nuclear program has
a certain number of very specific problems. The nuclear plants are located in areas with
high population density, high seismicity and at risk from tsunamis. In addition, with the
absence of a long-term waste strategy, the spent fuel pools are filling up and, in spite of
re-racking and dense-packing, the first pools are expected to be full by 2014
[SCHNEIDER 2013].
In November 2011, the government presented a new energy strategy to “steadily reduce
nuclear dependency, create a low-carbon green energy environment and gradually move
towards a nuclear-free homeland” [WNN 2011a].
The new policy4 states that the three operating nuclear power plants will not operate
beyond their planned 40-year lives and that Taiwan's fourth nuclear power plant at
Lungmen will not begin operation until all safety requirements are met. Furthermore, the
island's oldest units at Chinshan (grid connection 1977 and 1978) will face early closure
when both Lungmen units will start commercial operation. In parallel, Taiwan plans to
accelerate its energy efficiency and renewable energy policy.
The Taiwanese public is increasingly critical towards the country’s nuclear power
program, and on March 9, 2013 more than 200,000 people demonstrated in various cities
against the start-up of the Lungmen plant. An opinion survey released in late March 2013
indicated that a 73 percent majority is in favor of stopping the construction of the
Lungmen plant.
In fact, in recent years the Taiwanese anti-nuke campaign has grown from minor or rare
social events to a new major movement. On May 28, 2012, movie directors Yi Cheng Ko
and Li Ren Dai have initiated the “I am human being and I refuse nuclear power”
4 The new policy is in line with Article 23 of the Basic Environment Act, which directs the government to
make plans that will eventually see Taiwan become nuclear-free.
10
campaign. They made use of the traffic light and arranged a big “human being” in
Chinese characters on Ketagalan Boulevard, right in front of the presidential office
building. This received a sizeable response.
While performing at Golden Melody Awards in 2012, influential band Mayday also
showed their stance by shining “I am human and I refuse nuclear power” LED lighting on
stage. Other famous entertainers have also publicly stated their anti-nuke attitude.
1.2 Introduction Lungmen NPP
The Lungmen nuclear power plant (LMNPP) or the Fourth nuclear power plant (NPP4)
facing the Pacific Ocean is located at an inward bay area of northeast Taiwan. The site is
situated only approximately 40 kilometres east of Taipei city. About 1.5 million people
are living in the the 30-km-radius of the site and about 9.14 million people are living in
the 75-km-radius [NATURE 2011].
The NPP4 comprises two units. The reactor type used is ABWR (Advanced Boiling
Water Reactors).
Since the Atomic Energy Council (AEC) issued a construction permit for the fourth
nuclear power plant in March 1999, the plant has remained a highly controversial issue5.
On October 27, 2000, Taiwan’s cabinet ordered a halt to the construction of the Lungmen
NPP. The decision was taken by the ruling Democratic People’s Party (DPP) and was
opposed by the opposition Kuomintang (KMT) [NEI 2000a]. The project restarted in
2001 after a legal appeal and a government resolution in favor of the plant.
In 2005, it was announced that commissioning of the plant would be delayed to 2009
from the original schedule of 2006 – 2007. Rising oil import costs and a local economic
slowdown had apparently affected investment in the project, which in turn affected the
construction progress. The units were put on track for completion in 2011 and 2012 by a
funding decision in March 2009 [WNN 2011c]. In May 2012, media reports gave 2014 –
15 as the currently planned start-up date.
TPC anticipates that at least 40,000 million NTD need to be added in 2013, which means
the overall budget for NPP4 is likely to top 320,000 million NTD.
In February 2013, the budget was temporarily frozen. According to the Atomic Energy
Council (AEC), the first unit was nearly finished and operator TPC was presently
carrying out on-site testing of operating procedures and systems functions by April 2013.
5 This was the same with the history of the NPP4: TPC has presented the plan to construct NPP4 in May
1980. However, in July 1986 the budget was frozen. In February 1992, the Ministry of Executive
approved to resume implementation of the NPP4 plan. In May 1996, Legislative Yuan passed a bill to
abolish all NPP programs, including stop constructing NPP4. In October 1996, the Legislative Yuan
passed a re-vote bill to nuclear abolition proposed by Executive Yuen.
11
On April 26, 2013, the ruling party introduced a bill in the legislature to organize a
national referendum over the future of the Lungmen project. What appears to be an
exemplary exercise of democracy is seen by many as a manoeuvre to get a silent majority
for the project’s completion. The referendum legislation requires a quorum of at least 50
percent to make the outcome binding, a score difficult to achieve nationwide
[SCHNEIDER 2013]. All six national referendums held so far in Taiwan have failed to
reach the 50 percent turnout threshold [NW 27/06/13].
12
2 The EU stress tests
The March 2011 accident at the Fukushima Daiichi nuclear power plant (NPP) proved
that it was not justified to exclude highly unlikely accidents from happening. In a prompt
reaction to this catastrophic accident, the European Council concluded on 25 March,
2011 that the safety of all European (EU) nuclear power plants should be reviewed on the
basis of a comprehensive and transparent risk and safety assessment ("stress tests"). The
European Nuclear Safety Regulators Group (ENSREG) took over this task.
However, two months later the scope of the EU stress tests was reduced: The EU stress
tests were defined as a targeted reassessment of the safety margins of nuclear power
plants developed by ENSREG, with contributions from the European Commission. The
EU stress tests comprise three topics: (1) External Hazards, (2) Loss of Safety Systems
and (3) Management of Severe Accidents.
The idea of a comprehensive risk assessment of the European power plants was not the
intention any more. The specifications of the ENSREG stress test do not provide a
method for comparing the safety of the different plants, nor does it answer how safe
European plants actually are.
2.1 Shortcomings of the EU stress tests
It is important to underline that the EU stress tests cannot be understood as a
comprehensive safety check of the NPP in Europe. The EU stress tests did not take into
account all key safety issues, thus the scope of these tests was not designed to deliver a
comprehensive risk assessment.
Representatives of civil society and independent experts were pointing out that the stress
tests were mainly set up to improve the confidence in the safety of the European NPPs.
In advance to the EU stress tests Wolfgang Renneberg, former head of the Reactor Safety
Department of the German Federal Environment Ministry, analysed the specifications of
the EU stress tests and published his results in a study commissioned by the Greens in the
European Parliament. According to his study, the EU stress tests cannot assess the safety
of the European nuclear power plants and therefore cannot serve as basis to decide which
nuclear power plants need to be shut down. The stress tests will not provide information
about the reliability of plant safety measures to prevent postulated failures of the safety
systems or about all those other scenarios and serious events that could lead to a severe
accident [RENNEBERG 2011].
The specifications and the procedure of the EU stress tests have the following important
shortcomings and limitations [WENISCH 2012]:
13
Limited scope
The scenarios that are under review are incomplete. Accident scenarios and failure
modes typical for e.g. an airplane crash or internal fire, human failure including
combinations of those events that until now have not been under consideration, are
not covered by the stress tests.
Particularly an air plane crash is not considered in the frame of the stress tests.
ENSREG regards this scenario under the terms of security and therefore claims not
to be competent to include it in the stress tests.6 This is an evidently misleading
argument. The fact that air planes might crash on a nuclear power plant is
completely independent of its cause and it might therefore happen without any
terrorist background. An airplane crash has to be considered as a relevant safety
issue.
Obviously, it is always better to prevent accidents from happening than to deal with
the consequences of an occurred accident, but safety features of the plant that are
needed to prevent an accident are only partly under review.
The quality of the plants’ safety-related systems and components, such as the
material of pipes, reactor vessel, valves and pumps, control and instrumentation
equipment are not investigated in the stress tests. This issue is of particular concern
for NPP4.
Ageing effects of structures, systems and components (SSCs) are not considered in
the stress tests. The tests take no account of degradation effects, even though these
could significantly aggravate the development of an accident caused by an external
event. Ageing-related incidents have the potential to trigger, but particularly to
aggravate accidents sequence.
The stress tests take for granted that all the SSCs assessed are in place and without
fault, but the operational experience shows this is not the reality. Incidents caused
by defective mounting or forgotten scrap etc. are possible. This issue is of
particular concern for NPP4.
The stress test specifications require descriptions of the plant properties, but
requirements on the quality and the comprehensiveness of the descriptions are not
defined. So far as the specifications rely on the licensed design and its safety case,
they rely on aged criteria and methods.
The safety management of nuclear power plants, which is of acute importance, is
not included in the stress tests.
6 Risks due to security threats are not part of the mandate of ENSREG and the prevention and response to
incidents due to malevolent or terrorists acts (including aircraft crashes) involve different competent
authorities, hence it is proposed that the Council establishes a specific working group composed of
Member States and associating the European Commission, within their respective competences, to deal
with these issues [ENSREG 2011].
14
Another important area of special attention regarding the safety of nuclear power
plants, the quality of personnel training, is not included in the stress tests.
Lack of criteria
One of the major weaknesses is the lack of definition in the stress test specifications,
what level of safety should be achieved if the plants should be back-fitted or should
be shut down. Any criteria that define the required robustness of a plant are missing.
This fact makes it very difficult for politicians and the public to assess the safety
level of the plant.7
Limited peer review process
To enhance the credibility of the stress test process, the national reports will be
subjected to a peer review process. The complexity of data, of calculation methods,
of assumptions about the safety parameters and their interdependence within the
system of a nuclear power plant is extremely high. Regarding the short time frame
(about three months) and the immense workload, it is not possible to perform a
well-founded peer review process.
Insufficient independence of the involved experts
The operators reports are the most important basis for the final national report and
the assessment of the safety of the plant. For obvious reasons, the operators cannot
be considered independent: It is in their interest to demonstrate that a plant does not
require costly back-fitting measures.
The national stress test reports are written be the national nuclear authority. In the
past, those experts and their technical support organisations legitimated the
operation of the power plants under their supervision and they informed the public
that the plants were operating safely. Conducting stress tests makes them review
their own practice and their own statements about safety and about acceptable risks.
Almost none of the other experts involved in the peer review process is really
“independent”. Beside the members of those countries without nuclear power plants
the ENSREG consists mostly of the chairpersons of the nuclear authorities of the
countries operating nuclear power plants. Realistically it is necessary to expect that
this peer review process will identify only evident deficiencies. Furthermore,
criticising colleagues within an official process whose results shall be open to the
public is difficult.
7 The German Reactor Safety Commission has defined four levels of robustness in the frame of the
German stress test. The basic level is chosen as a level that must be fulfilled by all operating plants,
taking into account that all plants meet the licensing conditions and have realised all back-fitting
measures required by the authority. Each of the three levels of robustness defines a specific larger kind
of safety-margin.
15
Considering the limited scope of the stress tests, the missing of clear assessment criteria,
and taking into account the interests of the involved experts, reports might serve mainly
to demonstrate to the public that the plants are operating safely.
Nevertheless, the stress tests could serve as a first assessment of the plants capability to
withstand several external events. One important new feature which has now been
introduced is the evaluation of the so-called “cliff edge effects”: A cliff edge effect
describes a qualitative degradation of the plant’s safety conditions (comparable to
walking on a cliff and the next step fall down). The tests may result in technical and
organisational recommendations to be better prepared in the case of such accidents.
2.2 Procedure
The first phase of the EU Stress tests started in June 2011 – the operators of the NPPs
prepared a self-evaluation of their plants. Licensees had to provide a final report by
October 31, 2011.
In the second phase, the national regulator reviewed final reports submitted by the
operators. All final national stress test reports were handed over to the EU Commission
by December 31, 2011.
Then the third phase started: the peer review process, which was conducted by experts
nominated by the national states to review the national reports. The peer review was
completed with a main report that includes final conclusions and recommendations at
European level regarding the three topical parts and 17 country reports including country-
specific conclusions and recommendations. The report was published by the ENSREG on
April 26, 2012.
In June 2012, when the ENSREG report was presented to the European Council, the EU
Commission did not see the Council mandate for the stress tests fulfilled and demanded
further testing; six additional so-called fact-finding visits were undertaken. Those follow-
up reports were published in late October 2012.
To implement the stress test findings, an ENSREG action plan (published in August 2012)
was developed to track implementation of the recommendations. In October 2012,
ENSREG published a compilation of recommendations to assist the preparation as well
as the review of National Action Plans (NAcPs).
In line with the ENSREG action plan, each national regulator had set up a NAcP to
remedy the identified shortcomings during the EU stress tests and published it by the end
of 2012. In January 2013, the NAcPs were published at the ENSREG website. Despite
the fact that all participating countries are strongly committed to the issue of transparency,
only about half of them posted the NAcP in their national language on a dedicated
website.
16
The ENSREG action plan specified the need to peer review these NAcPs via a common
discussion at a dedicated ENSREG-workshop to share lessons learned on the
implementation of post-Fukushima safety improvements. This ENSREG-workshop to
discuss the NAcPs took place in Brussels on 22 – 26 April 2013.
It was the intention to present the outcomes of the workshop to the public in the
following ENSREG conference on June 11 and 12, 2013. However, the presentation was
very general, no country-specific shortcomings were explained. One of the key objectives
of ENSREG to improve the overall transparency on issues relating to the safety of
nuclear installations was not at all fulfilled.
2.3 ENSREG s results of the National Actions Plans
During the EU stress test process, all countries identified the need for analysis, hardware
improvements, procedural modifications and regulatory actions, and corresponding
implementation schedules in their National Actions Plans (NAcPs). In a number of
countries significant safety improvement programmes had been completed or were on-
going prior to the Fukushima accident. On-going programmes were updated to reflect the
ENSREG recommendations and new plans were prepared. Further national review is still
pending, on the basis of on-going investigations and analyses, and may lead to additional
measures [ENSREG 2013].
The ENSREG summarised the following observations after review of the NAcPs:
In all countries, a variety of additional mobile equipment like pumps, diesel
generators, air compressors and other equipment has already been procured.
Some countries are planning new, permanently installed and partly bunkered
systems to ensure the decay heat removal from reactor core and spent fuel pools,
while most countries rely more on mobile equipment to ensure decay heat removal
from reactor core and spent fuel pools in case of extreme situations and loss of the
safety systems.
One of the main issues is the definition of robustness, i.e. the scope of the safety
margins beyond design basis. The question is how robust the equipment necessary
to cope with beyond design situations has to be.
Maintaining containment integrity under severe accident conditions remains an
important unresolved issue for the accident management.
Filtered containment venting to prevent containment overpressure has already been
implemented in certain countries. Some other countries are now implementing the
Filtered Containment Venting System (FCVS) while others are considering
improving the existing ones. Several countries, but in particular those with small
reactors, are implementing or analysing different complementary technical
measures for long-term heat removal from the containment.
17
As a reaction to the Fukushima Daiichi accident many countries are now installing
Passive Autocatalytic Recombiners (PAR) to manage hydrogen in the containment
to cope with beyond design basis accident conditions or are reconsidering their
number and position.
Studies necessary to re-evaluate the Severe Accident Management (SAM) strategy
taking into account the Fukushima lessons have to be performed. This will take
several years and a lot of money, because conducting experiments in the field of
severe accidents is very complex. Enhancing international exchanges on research
and solutions on molten core cooling and stabilisation are necessary.
One important issue is the provision of the necessary resources and arrangements to
cope with simultaneous severe accidents on several installations of the same site in
the context of regional devastation resulting from a natural disaster.
The qualification of instrumentations used during severe accident conditions
especially in the long term is another issue.
Also, the dealing with large volumes of contaminated water remains an unsolved
issue.
2.4 Discussion of the ENSREG s results
As main results of its peer review process, the ENSREG concluded in April 2012 that all
countries have taken significant steps to improve the safety of their plants, with varying
degrees of practical implementation [ENSREG 2012a].
The April 2013 ENSREG peer review workshop to review the nation actions plans
concluded – and that was its only actual result – that a follow-up peer review would be
valuable by providing an opportunity for exchange of information among participants.
According to the ENSREG, such a follow-up peer review could be conducted in 2015 or
later when the results of important studies and assessments are available.
The key issue, which is still open, is how comprehensively these follow-up peer reviews
of the NAcPs will be conducted. This might be seen as the last opportunity to force the
nuclear regulators to formulate mandatory requirements which need to be fulfilled in a
rather stringent time schedule – in contrast to the years or even decades currently planned
in many countries. This could make operators decide to shut down old and unsafe nuclear
power plants instead of investing into extensive modernisation measures. From today s
point of view it cannot be assumed that the ENSREG would chose to act this way.
It is very disappointing what happened with the alarming findings of EU stress tests.
Despite the fact that the stress tests revealed a number of shortcomings regarding the
plants capability to withstand several external hazards and the lack of possibilities to
18
cope with the consequences, the outcomes of the peer review consist only of
recommendations for “further improvements”.
The fear of representatives of civil society and independent experts that the stress tests
were mainly set up to improve the confidence in the safety of the European NPPs
regardless of his findings becomes true.
Until now, the ENSREG does not assess, but only describe the shortcomings of the
European NPPs. The country stress test reports do not formulate any overall
conclusions – not even if a specific NPP has shortcomings similar to those at the
Fukushima NPP. However, this is insufficient to use as a basis for deciding on the future
of a NPP. A comprehensive assessment taking into account all facts is necessary for the
politicians and the public to decide about the risk for people and environment.
During the stress tests peer review, the ENSREG did not look at the current safety level
of the European nuclear power plants, but the potential increase of the safety level in the
next decade. Furthermore, the ENSREG has not defined or even recommended any time
schedule for the implementation of the required measures.8 The operation of dangerous
NPPs is ongoing.
The ENSREG summary of the current status of the National Action Plans (NAcPs) again
only describes the plans’ weaknesses. An assessment of the sufficiency to remedy the
dangerous situation is not provided. The ENSREG avoids mentioning, whether the
NAcPs are sufficient to amend the dangerous situation if completely implemented.
2.5 Conclusion of the critical review of the EU stress tests
The Fukushima catastrophe was the horrible result of decades of mistaken safety
philosophy, a very lax safety regulation under strong industry influence on the
regulators – not only in Japan. The first shock led to the honest attempt to change this, to
also involve events which are definitely possible but were kept out of the safety cases by
using probabilities [BECKER 2013].
On October 12, 2012, Tokyo Electric Power Co (TEPCO) admitted that the company had
failed to prevent the Fukushima accident, reversing its earlier statement that the accident
could not have been foreseen. TEPCO attributed those facts to multiple root causes: First,
the management assumed a severe accident was extremely unlikely to occur in Japan, and
feared that retrofitting safety systems would increase anxiety among the public,
especially among the residents near the plant and would require a costly shutdown period
[NW 18/10/12].
8 The ENSREG does not have a regulatory mandate. To define, require and monitor the implementation
of safety improvements stays in the competence of the national regulatory authorities, who are members
of the ENSREG.
19
The risk of natural hazard exists to a different extent for all European NPPs, but like in
Japan the operators insist on the low probabilities to avoid high investments and anti-
nuclear activities of the public.
The EU tried to respond to this “new experience” of Fukushima by conducting the stress
tests and hoping that the results will lead to higher safety. It is evident, however, that
some countries treated this task rather as a formality or paperwork than a plant safety
upgrade program.
In general, there are different possibilities for operators and nuclear authorities to deal
with the shortcomings the stress tests revealed:
A quick response, but without any guarantee that the measures are sufficient (e.g.
Cernavoda NPP, Romania).
A comprehensive evaluation of possible hazards and protective measures, which
will take more than ten years (e.g. France).
Business-as-usual (e.g. Dukovany, Czech Republic), i.e. the idea of the stress tests
is more or less ignored; the already on-going (insufficient) back-fitting programs
are listed within the NAcPs.
However, none of these options increases the nuclear safety to an acceptable level. The
very obvious solution – permanent shutdown – needs to be considered and is in several
cases the only safe option. One of the major problems of the stress tests is the lack of
definition what level of safety (robustness) should be achieved or in which cases the
plants should be back-fitted or shutdown, thus the peer review process does not provide
any advice for this decision.
To which extent the envisaged measures will improve the safety level is in particular an
economical issue. Better protection will result in higher costs. However, to improve the
safety level in an area prone of seismic or flooding hazards is also a technical issue.
Necessary safety levels could not be achieved subsequently.
However, the operators are heavily relying on the new magic solution to severe
deficiencies at the plants due to design or the site: mobile equipment, which is easy to
plan and store in the plant and therefore a cheaper solution than the installation of new
systems protected against external hazards. Mobile equipment is presented as the solution
to compensate deficiencies of the reactors and the spent fuel pools. But under severe
accident conditions, it is very unlikely that the proposed mobile equipment can be put to
work as quickly as necessary; to rely to such a large extent on manual actions is
irresponsible in regard of the consequences of a severe accident [BECKER 2013].
Furthermore, the new mobile equipment is useless if the staff response during the
accident is not perfectly according to plan. Not only the “know-how” but also the “know-
20
why” is very important. This is an important lesson learnt from the Fukushima accident,
which should result in the implementation of passive safety systems designed to
withstand beyond design accidents with appropriate safety margins.
Thus, the authors concluded: Up to now, no lessons learnt from the accident at
Fukushima. At all European nuclear power plants severe accidents can occur – any time
[BECKER 2013].
21
3 Weaknesses the Taiwanese stress tests revealed
Taiwan has performed a stress tests exercise for its nuclear power plants largely based
upon the EU stress tests model. The stress tests report has been written by the licensee,
the Taiwan Power Company (TPC), for the operating units and the units under
constructions (NPP4). These reports were submitted to the regulator, the Atomic Energy
Council (AEC) for review. The AEC prepared a national stress tests report (NR)
documenting the results of its review. The NR was published in May 2013 [AEC 2013].
Building on the results of the stress tests and insights from the actions being taken by
other countries, on November 5, 2012, the AEC established requirements to implement
enhancements. These requirements were embodied in regulatory orders issued by the
AEC to TPC. However, these requirements are non-binding requirements. TPC may
propose alternatives subject to AEC approval. Additionally, at the end of each chapter of
the national stress tests report, the AEC formulates several general requirements. For
none of the requirements any time schedule for implementation is set.
This chapter presents a review of the safety issues of the fourth nuclear power plant based
on the stress tests reports. The following chapter is mainly based on the information
provided by the national stress tests report. Some information provided in TPC s stress
tests report of Lungmen NPP is also presented [TPC 2013].
In spring 2013, a peer review of the stress tests has been conducted by a six-person team
assembled with the involvement the Organization for Economic Cooperation and
Development (OECD) and the Nuclear Energy Agency (NEA). The NR and three stress
test reports of the operating nuclear power plants were provided to OECD/NEA experts
in January 2013 [OECD 2013]. Some of the findings of the OECD/NEA report published
in April 2013 are included in the following chapter.
3.1 Earthquakes
Taiwan is located at a complex juncture between the Eurasian Plate and Philippine Sea
Plate, where earthquakes occur frequently. Due to the collision of these two plates, the
eastern part of Taiwan moves toward northwest at a rate of about 2.5 – 8.0cm/year.
Hence, the seismic design of structures, systems and components (SSCs) of nuclear
power plants in Taiwan is an important issue [NEI 2009a].
Although Taiwan is prone to earthquakes, up to now, the country has not experienced an
earthquake strong enough to challenge the seismic design of its nuclear power plants. The
biggest earthquake in 100 years, the magnitude 7.3 Chi-Chi quake on September 21, 1999,
had no impact on the three existing plants, supposedly only due to the great hypocentre
distance [NEI 2009a].
22
Seismic hazard evaluation
The Lungmen nuclear power plant site is located in a high seismic risk zone, thus
earthquakes are an important hazard for the plant. To determine the Design Basis
Earthquake (DBE), the historical earthquake records of the past 400 years of the area
within a 320 kilometres radius of the site were collected. In 1992, the DBE was
determined based on the assumption that an earthquake of a local magnitude of 7.3,
which occurred in east of Taiwan in 1908, happened 5 kilometres east of the site. The
calculated values of peak ground acceleration (PGA) of this earthquake are between
0.23g and 0.41g. The PGA of the DBE for the NPP4 is determined to be 0.4g.
Historical records for only 400 years are a rather brief period to assess the possible
earthquake intensity. But the use of paleoseismic investigations for determining the DBE
is not mentioned.9
In 2004, the Taiwan Power Company (TPC) contracted a project10
to study the possible
earthquake hazards of NPP4. The results showed that the 0.4g DBE is still adequate. But
now this evaluation is nearly 10 years old, and thus outdated. Re-evaluation of seismic
hazards for any site nearly always shows that the earthquake hazard was
underestimated.11
The OECD/NEA group pointed out that it is clear that historical data can only be used as
supporting information for seismic hazards, because of the lack of a sufficiently long
seismological catalogue. The major source of information should come from the
seismotectonic characterization of faults12
[OECD 2013].
Aybars Gurpinar, a consultant on earthquake resistance with more than 20 years
experience with the IAEA and responsible for the review of the seismic hazard
evaluations, questioned TPC's position that its nuclear power plants only needed to
withstand an earthquake with a magnitude of 8.1 – 8.2. These values were used during
the stress tests and were developed based on a general country wide investigation of the
seismic hazards. The expert emphasised from the discussions with TPC it was not clear
whether there were sufficient tectonic arguments to use the countrywide seismic values
[OECD 2013].
9 Paleoseismology looks at geological sediments and rocks for signs of ancient earthquakes. It is used to
supplement seismic monitoring, for the calculation of seismic hazards. 10
“Re-analysis and evaluation of Earthquake Threats to the NPP4 Site”(National Centre of Research
Institute) 11
On December 26, 2006, two consecutive strong earthquakes – both with a local magnitude of 7.0 – hit
the most southern part of Taiwan, Hengchun village, where the Maanshan nuclear power plant is
located. It was the strongest earthquake ever experienced by Taiwan’s existing nuclear power units, and
it raised public concerns about the seismic safety of the nuclear power plant. Before the Hengchun
earthquake, the determined maximum potential earthquake in the subzone to which Maanshan belongs
was 5.9 [NEI 2009a]. 12
This includes the dimensions of the fault (length, down-dip, width), orientation (strike, dip), amount and
direction of displacement, rate of deformation, maximum historical intensity and magnitude,
paleoseismic data, geological complexity (segmentation, branching, structural relationships), earthquake
data and comparisons with similar structures.
23
A lesson learnt from the Fukushima accident is that countrywide investigations do not
provide sufficient details that are needed to appropriately consider the seismic and
tsunami hazards for nuclear power plants. Thus, site-specific investigations are necessary,
but not available yet.
The expert stated in the context of a site-specific seismic hazard analysis, it may be
necessary to revise maximum magnitude values for faults. He suggested a value of 9.0.
This was the magnitude of the Tohoku earthquake of 2011 that triggered the Fukushima
accident [OECD 2013].
One of the most important weaknesses is the lack of calculation of the return frequency
for earthquakes, which is crucial for determining the DBE. The return frequency was an
important approach to assess the adequacy of the evaluation of the DBE in the frame of
the EU stress tests. The use of a return frequency of 10-4
per annum is recommended by
the ENSREG [ENSREG 2012b].
The AEC required to perform an updated and thorough seismic evaluation and to take
every measure needed to fulfil the ENSREG stress test requirements. A re-analysis of the
seismic hazard curve is to be conducted to see whether the annual exceedance frequency
of current DBE is adequate. However, there is no specific AEC requirement regarding
the return frequency.
Seismic resistance of the NPP4
According to TPC, all safety related-systems, structures, and components (SSCs) as well
as their subsystems can sustain integrity and assure their safety function during a DBE;
also indirect effects of a DBE (as internal flooding) are no hazards for the plant.
After the Fukushima accident, TPC initiated a re-inforcement action plan (RAP) to
improve the seismic resistance of equipment under severe earthquake conditions. The
installation of seismic resistance pipes connecting the ground floor of the reactor building
to the water source to make-up water to the spent fuel pool (SFP) is planned. Also, the
water level and temperature instrumentation of the SFP has to be improved.
The evaluation of seismic margins revealed that the off-site power supply is the weakest
seismic capacity equipment. According to TPC, the off-site power gets lost due to an
earthquake with an intensity above 0.3g, which is even below the DBE. TPC pointed out
there are four successful paths to achieve reactor core long-term heat removal.
For the successful path 1, all the necessary safety functions for the unit normal cold
shutdown paths via a residual heat removal (RHR) system can be successfully performed.
The emergency diesel generators (EDGs) provide the AC power for the important
equipment. The medium seismic withstanding value is 2.0g. Thus, the calculated safety
24
margin is 1.6g compared to the DBE. This value is pretty good. However, there are
doubts about the reliability of the structures, systems and components (see chapter 4).
For the three other successful paths, when the RHR system is unavailable due to
earthquake, the fire water system has to provide the reactor core long-term cooling. The
seismic withstanding value of the fire water storage tank (1.1g) is the lowest, but a
substantial improvement of the fire water storage tank is not feasible. Instead, TPC is
considering modifying the interface of the fire water and raw water systems. Thereby, the
raw water can be introduced directly into the intake pipe of the fire water pump.
According to TPC, the raw water reservoirs can provide a stable water supply to the fire
water system after an earthquake. The raw water reservoir is located on the west side flat
hills with 116 meters of elevation, 112 meters long and 63 meters wide. The volume of
water storage is 48,000 m³. However, the raw water reservoir is only designed not to
collapse during DBE. Its capability against an earthquake with seismic intensity higher
than 0.4 g is probably very limited.
If an earthquake occurs with an intensity exceeding the DBE, the structure of the raw
water reservoir may collapse due to structural crack. According to TPC, however, the
leakage is limited (maximum peak leakage flow of 46.6 m³/s), and the flood is
transported to the downstream of marine outfall. Thus, a reinforcement of the raw water
reservoir is not envisaged.
But the leakage of the raw water reservoir can obviously threaten the safety of the plant,
because the water needed to cool the reactors and the spent fuel pools during an accident
will flow out.
The AEC required upgrading the seismic resistance of the raw water reservoir. This is to
be appreciated. However, until now it is not known whether this reinforcement will be
performed, i.e. whether it is technically and economically feasible.
According to the NR, only the direct effects of earthquakes beyond the design basis are
considered, but also indirect effects have the potential to endanger successful paths.
Indirect impacts of earthquakes are internal flooding due to pipe-breaks, fires due to the
release of flammable substances or impacts due to damage of non-seismically qualified
components. This is an additional reason why it is not completely credible that the plant
could withstand a beyond design basis earthquake.
However, the envisaged measures to increase the seismic margins of the plant are very
limited. It is intended to shorten the time needed to establish the fire water system: The
operator must manually open at least two isolation valves, which are located in
equipment channel C of the reactor building. In addition, the operator must manually
25
open the electric valve. It is also planned to shorten the decision making process by
making clear guidelines. However, the main problem is not solved at all: manual actions
of the operator are necessary.
On July 16, 2007, in Japan, where the earthquake focal mechanisms are very similar to
those in Taiwan, all seven reactors at the Kashiwazaki-Kariwa site were struck by the 6.8
magnitude Niigata Chuetsu offshore (NCO) earthquake. The location and magnitude of
this earthquake has never been expected in the design of the plant. Some 63 incidents
were confirmed, including a release of radioactive iodine through the main stack at unit 7,
which is the same reactor type (ABWR) as the units of the NPP4. The safety margin of
the plant’s SSCs prevented a severe accident after the hit of the earthquake; however,
failures of some non-safety SSCs caused unexpected damages to the plant13
[NEI 2007a;
NEI 2009a; WNN 2009a].
One important lesson learnt from the NCO earthquake is that a well-protected nuclear
power plant should have substantial seismic margin. It is not clear from the NR, whether
a comprehensive seismic Probabilistic Risk Assessment (PRA) has been performed for
NPP4. If not, this would be an important approach to provide insights that are necessary
to develop backfitting measures to obtain seismic margins.
The AEC considers that the resulting action plan of TPCs seismic re-assessment is
adequate, but pointed out that the schedule should be more efficient and speeded-up.
Thus, the question comes up, how the schedule is set, in particular, could operation start
licence before the re-assessment and the necessary improvement measures are done?
Additional to the limited upgrading measures envisaged by TPC, the AEC required a
seismic upgrade of the plant fire brigade building structures. This is very crucial, because
of the important tasks of the fire brigade to cope with an accident. Also, necessary
functionality upgrades of the emergency response facilities and the enhancement of the
power durability of seismic monitoring sensors are needed.
The reinforcement of the structures of the Technical Support Centre (TSC) is required,
which is not able to withstand an earthquake yet. In addition, the AEC’s Department of
Nuclear Technology is requesting TPC to consider building a seismically isolated TSC
based on the practice being implemented in Japan in the light of the Fukushima accident.
However, establishment of a TSC that could be very useful during an emergency
regarding the protection of the people should only be considered, and thus probably not
built.
13
The unit 7 was restarted after almost 22 months of checks and repairs.
26
3.2 Flooding
The Fukushima accident highlighted the hazard of flooding events for nuclear power
plants. One of the main questions after the Fukushima accident was the predictability of
the wave height of the tsunami. In 2008/2009, two studies regarding the tsunami hazard
were performed on behalf of TEPCO.14
Accordingly, the calculated wave heights at the
intake points at Fukushima Daiichi NPP were 9 to 10 meters.15
Thus, TEPCO knew that
the implemented protection (against wave height of about 6 meters) was not sufficient.
But nevertheless the wave height of the tsunami which triggered the Fukushima accident
(14 meters) was not to be expected. Thus, for all NPPs that are threatened by tsunamis,
safety margins of at least 6 meters are to be considered.
Note, according to TEPCO s post-Fukushima stress tests report for unit 7 of the
Kashiwazaki-Kariwa16
, after additional safety measures, the allowable tsunami height
over the 3.3 meters design basis is 15 meters [NEI 2012c].
Generally, the expected main effects of flooding – that could all threaten the NPP4 – are
as follows [IAEA 2003]:
The presence of water in many areas of the plant may be a common cause failure
(CCF) for safety-related systems, such as the emergency power supply systems or
the electric switchyard.
Considerable damage can also be caused by the infiltration of water into internal
areas of the plant, by rise of the water table induced by high flood levels. Water
pressure on walls and foundations may challenge their structural capacity.
Deficiencies in the site drainage systems may also cause flooding of the plant.
The dynamic effect of the water can damage the structure and the foundations of
the plant as well as many systems and components located outside the plant.
Flooding can also contribute to the dispersion of radioactive material to the
environment.
Protection against tsunamis
The Design Basis Tsunami (DBT), i.e. current protection against a tsunami, is based on
the worst tsunami in the history of Taiwan. According to the historic records, two severe
tsunamis occurred in Taiwan in 1867 and 1918, respectively. The wave height of the
tsunami happened on June 11, 1867 at 134 km north of Keelung was approximately 7.5
meters. After considering the influence of tides and geographic factors, the height of the
DBT for NPP4 is set to be 8.57 meters.
14
One study investigated the possible impact of the wave height of the Jogan-Tsunami at the intake points
of the NPP Fukushima. The second study evaluated a possible undersea earthquake at the coast near the
NPP Fukushima. 15
The authors thank A.Y. Indradiningrat (cervus nuclear consulting) for helpful advice to this issue. 16
which is the same reactor type (ABWR) as in the NPP4
27
This methodology to assess an external hazard is not in accordance with the ENSREG
recommendations that ask for the use of a return frequency of 10-4
per annum with
respect to external hazards.
The ground elevation of the main building area at the Lungmen site is 12 meters, which is
3.4 meters higher than the calculated wave heights. Therefore, in the opinion of TPC,
NPP4 would not be threatened by tsunamis.
On August 19, 2011, the National Science Council (NSC) published a tsunami report17
,
after assessing the 22 earthquake origins of potential maximum tsunami in Taiwan.
According to the NSC, the result shows that the potential tsunami run-up height is lower
than the evaluated DBT. However, it is pointed out, that there are still significant
uncertainties in tsunami run-up predictions due to the definition of tsunami sources.
The OECD/NEA experts suggested the deletion of the analysis provided by the National
Science Council (NSC) from the stress tests report. They criticise several issues: As
mentioned above, higher earthquake magnitudes are to be considered. The maximum
magnitudes have a major impact both on the seismic hazard as well as the tsunami hazard
results. The NSC analyses did not model a tsunami resulting from undersea landslides
and undersea volcanic eruptions. But, for example an active submarine volcano was
identified in the north of Taiwan that can be considered a potential tsunami source.
Another source of significant uncertainty in tsunami run-up predictions is the use of
approximate near-shore topography instead of accurate bathymetry. The experts
recommended to re-analyse the tsunami hazard using state-of-the-art modeling [NW
16/05/13; OECD 2013].
Thus, the necessary tsunami run-up, against which the NPP4 has to be protected, is not
known so far. The design basis tsunami has to be redefined.
Nevertheless, TPC is required to enhance the water tightness of buildings or build a sea
wall to a level of 6 meters above current licensing to address the uncertainty from the
original DBT height.
TPC plans to build a tsunami wall to cover the uncertainty. The envisaged height of this
protection wall is 2.5 meters or elevation 14.5 meters respectively. This value means a
safety margin of nearly 6 meters compared to the calculated waves of the DBT. However,
this value would be only sufficient if the evaluation of the DBT was correct, but obviously
it is not.
Therefore, it is a matter of fact that the protection against tsunamis is not adequate, even
after building the sea wall.
17
Influence of Tsunami Induced by Potential Massive Scale of Earthquakes on the Nuclear Power Station
in Taiwan
28
The AEC formulates only very general requirements: TPC should further review the
appropriateness of the DBT and take the associated improvements to its nuclear power
plants. A detailed scenario simulation of seismic and tsunami hazards are to be performed.
However, even a tsunami similar to the current DBT could be a danger for the plant.
When the tsunami run-up height reaches 8.6 meters, the exterior walls of the pump house
(at an elevation of 5.3 meters) will sustain additional water pressure as well as impact
force. According to TPC´s “Lungmen NPP Tsunami Prevention Capability Review
Report”, the integrity of the pump house structure needs to be strengthened. Additionally,
the plant needs to confirm that the sealing material for openings of the pump house can
sustain the water pressure caused by tsunamis.
Furthermore, the stress tests reveal that, if an earthquake-triggered tsunami seizes the
shore near the plant and causes the plant to lose its ultimate heat sink (UHS), there is only
one successful path to achieve reactor core long-term heat removal and prevent an
accident18
.
Protection against extreme rainfall
To determine the Design Basis Flood (DBF)19
, the plant adopts the precipitation records
measured at Keelung Weather Station from 1901 to 1982. The calculated probable
maximum precipitation (PMP) is 310 mm/h. Even though the annual maximum
precipitation data recorded in the years 1961 to 2006 shows a slightly increasing trend,
the design of the drainage capability is assessed as adequate by TPC.
To prevent internal flooding, rainfall-induced surface flows in the main building area
(power block) should be removed via the drainage system into the sea. The drainage
system is designed to deal with 100-yearly maximum precipitation as well as to carry the
run-off from a storm with 100-yearly return. The methodology is not in accordance with
the ENSREG recommendations that ask for the use of a return frequency of 10,000 per
year.
Climate changes have caused severe rainfall in the form of typhoons and/or tropical
storms in recent years. Thus, the AEC requires reviewing the appropriateness of the DBF;
associated improvements should be taken to increase the robustness of the plants against
flooding. However, it is stated that these should be reviewed and approved by the AEC
through the process of periodic safety review every ten years. Thus, it is not clarified
whether the measures should take place before operation of the plant starts.
18
RCIC system starts its short-term water feeding function, which should give operators the time to
manually start the Safety Relief Valve (SRV) and set up AC-Independent Water Addition (ACIWA).
Thereafter, the ACIWA system has to provide long-term water feeding to reactors and the Containment
Overpressure Protection System (COPS) has to provide containments long-term heat removal. 19
i.e. the flooding that the plant has to be protected against
29
The stress tests revealed dangerous weak points and cliff edge effects, because all
exterior doors on the ground floor of the plant buildings are not watertight; internal
flooding would occur in case of a beyond design basis flood. Thus, flood barrier plates
have been installed at the doors on ground floors directly connecting to the outside of
buildings, at the tunnel where the radwaste building enters the reactor/control building,
and at the passage where the access control building enters reactor buildings.
To prevent internal flooding resulting from water outside of buildings, penetrations of
buildings sealed with the water stops are only 30 cm higher than ground floor. Structures
of safety-related systems as well as their components are also 30 cm higher than ground
elevation.
The flooding risks are of concern due to a “cliff-edge” effect, in that the safety
consequences of a flooding event may increase sharply with a small increase in the water
level [NRC 2012]. A safety margin of only 30 cm seems to be very small.
To prevent internal flooding caused by leakage from damaged equipment (e.g. because of
rupture of pipes) inside the buildings, some areas of the reactor building are equipped
with watertight doors or semi-watertight doors.
If the floors in reactor buildings (at elevation 4,800 mm) containing safety-related electric
switchgear are flooded, all safety-related AC electric equipment would fail. This situation
would lead to a station blackout (SBO) and the loss of the ultimate heat sink (UHS). To
increase the protection against flooding, water-tight doors to prevent flooding from
flowing into rooms at elevation 4,800 mm have been added.
However, during former flooding events at nuclear power plants (e.g. at the Blayais NPP,
France, in 1999) safety equipment located below the level of the site was damaged,
because the water resistance/tightness of doors was miscalculated or seals of cable
penetration were corroded.
In case of an internal flooding draining the water by pumps is envisaged to restore the
function of the equipment located on the ground floor of the plant as soon as possible.
TPC has concluded that the drainage capability inside buildings is sufficient, nevertheless,
in addition to the existing sump pumps, mobile drainage pumps have been procured.20
There is no information regarding how soon the function of this equipment can be
restored and how long the flooding would have to persist for a critical situation to
develop. However, the loss of equipment caused by a sudden flooding could not be
prevented by sump pumps. Furthermore, additional manual actions are necessary to
perform this measure.
20
The plant will add 2 manoeuvrable engine-driven drain sump pumps and 20 electric drainage pumps. 6
engine-driven mobile drainage pumps and 12 electric drainage pumps are already procured.
30
In addition to the limited measures envisaged by TPC, the AEC requires upgrading the
watertight capability of doors of buildings containing important safety-related equipment,
fire-fighting doors as well as pipeline penetrations seals.
These requirements sound appropriate in regard of the threat of flooding. However, they
are very general, so it cannot be judged whether the scope is sufficient. Furthermore, the
time schedule is not mentioned. Therefore, it cannot be assured that necessary backfitting
measures will take place before NPP4 starts operation.
3.3 Other extreme natural hazards
According to the Intergovernmental Panel on Climate Change (IPCC), the type,
frequency and intensity of extreme weather events are expected to change as the earth’s
climate changes. These changes could occur even with relatively small mean climate
changes. Changes in some types of extreme events have already been observed, for
example, increases in the frequency and intensity of heat waves and heavy precipitation
[IPCC 2007].
Generally, the frequency of occurrence of more intense rainfall events in many parts of
Asia has increased, causing severe floods, landslides, and mud flows, while the number
of rainy days and total annual amount of precipitation has decreased [IPCC 2013].
Recently a typhoon showed its potential to threaten a nuclear power plant: On July 13,
2013, during the typhoon Soulik that caused widespread damage to the power grid, a
large amount of debris was washed into the sea water intake of Chinshan unit 2, clogging
it, damaging three debris screens and prompting operators to shut the unit down [WNN
2013a].
Extreme weather events, such as typhoons, heavy rain, and mudslides, can affect the
Lungmen NPP site. Possible flooding events are the main resulting hazard of extreme
weather events, which was dealt in the previous chapter. But also further effects of
extreme weather events could threaten the safety of the plant.
The design wind speed of all relevant buildings21
, i.e. the wind speed all buildings have to
be resistant against, is only 54m/s. Given the fact that typhoons of high intensities were
observed in the past years, an evaluation of the protection of the buildings containing
safety-related equipment against projectiles in case of a beyond design typhoon (with
wind speed exceeding 70.2 m/s) is required by the AEC. Because these evaluations are
missing, the threat of projectiles resulting from typhoons is not yet known.
21
reactor buildings, control buildings, the switchgear building, the auxiliary fuel building, and the off gas
stack turbine buildings, the radwaste building, the water plant, the fire-fighting pump house, and the
switchyard
31
The Lungmen NPP site is located within the watersheds of Shiding Stream and Shuangxi
Stream. According to the record of the Soil and Water Conservation Bureau (SWCB),
both streams are not mudslide-prone; the landscape of this area is relatively flat. However,
if unexpected mudslides happen and cause flooding to reroute and to flood the main
building area, units may be affected.
Regarding extreme weather events, further weak points are identified:
If a beyond design basis (BDB) storm seizes the plant, and if the BDB
precipitation could not be drained by the drainage trenches and the surface flow
floods the main building area, units may be affected.
If the inlets of the sea water pump house in the reactor buildings are stuck by
massive debris, causing further clogging at the mesh and affecting the water
intake of the pumps, reactors lose the ultimate heat sink (UHS).
Main weak point is flooding on the bottom floor, -8,200 mm of the reactor
building, because this floor contains all safety-related emergency core cooling
systems.
The improvement of protection against extreme weather events – besides the limited
flood protection as discussed above – envisaged by TPC are in particular the introduction
of procedures. It is stated for example: If beyond design basis events happen and reactors
lose all AC power source and all water supply, the plant must get prepared to take actions
to provide cooling to the reactor according to the Ultimate Response Guideline (URG)
(see chapter 3.5).
The OECD/NEA group concluded that, although some combinations of events were
considered in the determination of elevations of DBT, a systematic evaluation of
combinations of events in the areas of flooding and extreme natural hazards was not
performed. The experts recommended to implement a systematic approach for selecting
and combining extreme hazards, including re-evaluating the probable maximum
precipitation (PMP) with regional topographic maps [NW 16/05/13; OECD 2013].
The AEC required performing a systematic evaluation of combinations of extreme
weather events.
The AEC recommended that TPC should conduct a quantitative risk assessment
concerning the potential volcanic hazard. According to the AEC s non-binding
requirements, a volcanic probabilistic risk assessment (PRA) is to be performed and the
impacts from ash dispersion are to be studied.
All in all, nearly all evaluations about extreme weather events/natural hazards are
missing, thus there are a lot of threats that are not yet known.
32
3.4 Loss of all power supply (SBO) and ultimate heat sink (UHS)
Even when a nuclear power plant is shut down, it needs electric power supply,
particularly to operate the pumps of cooling circuit, and also it needs an ultimate heat
sink (UHS) to remove heat from the cooling circuit and other vital systems necessary to
avoid an accident. Total loss of offsite and onsite power supply – Station Black-out
(SBO) – and loss of Ultimate Heat Sink (UHS) scenarios could result in severe accidents.
If a loss of offsite power (LOOP) occurs22
, Lungmen NPP’s three seismic resistance
emergency diesel generators (EDGs) will start automatically to provide power supply.
The EDGs are located on three corners of the reactor building at an elevation of 12.3
meters. This is only 30 cm above the site elevation, which guarantees not enough safety
margins against flooding events.
The function of the EDGs relies on cooling water, which is provided by the Reactor
Building Cooling Water (RBCW) system. Heat absorbed by RBCW is removed by the
Reactor Building Service Water (RBSW) system and then dissipated to the sea.23
In case of loss of EDGs, the 7th
EDG can take over its design function. This 7th
EDG is
seismically designed and located in the Auxiliary Fuel Building (AFB), but also only at
an elevation of 12.3 meters. However, the 7th
EDG is air-cooled, thus it does not depend
on cooling water. Its start and control power is provided by an independent battery set,
which can deliver DC power for 3.5 hours.
The 7th
EDG is designed to totally replace the water-cooled EDGs of either unit 1 or unit
2. After the Fukushima accident, which highlighted that an external hazard may affect all
the units on a site, TPC added a new procedure. Accordingly, the 7th
EDG may be used to
simultaneously supply power to unit 1 and 2.
However, the output of the 7th
EDG is only sufficient to supply power to operate one
division of both units. It is not required by the AEC to install a second air-cooled EDG,
but only to perform an evaluation regarding this issue.
The installation of two air-cooled gas turbine generators located inside a seismically
isolated building at the switchyard at an elevation of 29.8 meters is envisaged.24
Note that
without these gas turbines, AC emergency power supply is rather weak – with the 7th
EDG as the only element of a second stationary line of defence. With the gas turbines, the
emergency power supply would be on a level comparable to that in the EU.
22
TPC is required to improve the reliability of offsite power supplies. 23
Each EDG is equipped with a tank capacity to run continuously for 5 hours, and one storage tank that
can provide fuel for 7 days (only for one EDG), but can be refilled from a tank truck. Unit 1 EDGs and
Unit 2 EDGs can support each other in case of emergency. 24
Besides, in order to increase the reliability of transmitting power to reactor safety systems from gas
turbine generators, it is planned to add 4.16kV independent transmission lines.
33
In case of loss of AC power, i.e. in case of Station Black-Out (SBO), the reactor water
level shall be maintained by the Reactor Core Isolation Cooling (RCIC) system. RCIC
operation relies on DC power.25
Based on the existing design, DC power can be supplied
by a battery set for 8 hours.26
The water source is the suppression pool of the containment
or the condensate storage tank (CST).
Within this 8 hours period, the operator shall set up normal power supply and alternative
power supply including the 7th
EDG, gas turbines, and backup mobile power.27
However, the RCIC system has only one division, i.e. if any failure occurs, it gets lost.28
To prevent fuel degradation after RCIC operation has stopped, it is planned to connect
the outlet of the fire engine to the AC-Independent Water Addition (ACIWA) pipe to
inject water into the reactor or suppression pool. The station has several fire engines,
which should take suction water, e.g. from a raw water reservoir, or take sea water from
the discharge channel.
According to TPC, offsite supports are available; the Fire Bureau of New Taipei City will
provide manpower, vehicles, and equipment. However, after an extreme natural disaster,
the fire engines will probably be called for use at other locations.
The required time (only 10 – 30 minutes) for the onsite and offsite fire engines etc. to be
ready for operation onsite seems to be calculated without considering conditions after a
natural disaster (like an earthquake).
Another possible way to provide water to the reactor is by gravity from a raw water
reservoir located at an elevation of 116 meters, through fire piping to the ACIWA piping.
However, as mentioned above, probably the water would no longer be available after an
extreme earthquake.
Envisaged measures to increase the robustness of the plant to prevent fuel damage are
limited and need several additional manual actions: The RCIC system may be manually
restarted if its DC power supply is lost. According to TPC, the operating steps have been
demonstrated to be feasible and have been incorporated in the procedure. Furthermore, if
the Safety Relief Valves (SRVs) should suffer a loss of operating gas or electrical power
due to a beyond design basis event, manual actions are possible to open the SRVs.
25
The speed governor of the RCIC turbine requires DC power 26
According to TPC, the duration of DC power supply to RCIC (and SRV/ADS) can be extended to 24
hours with load shedding. However, this measure is not reliable and demands additional manual actions. 27
Additionally, two mobile diesel generators to provide power to the 4.16kV bus as well as five small
mobile diesel generators to provide power to battery chargers will be procured. 28
The safety-related systems have mostly three independent divisions.
34
Loss of Ultimate Heat Sink (UHS)
During normal operation, the Circulating Water Pump (CWP) removes the heat of the
condenser to the sea. After a reactor shutdown, decay heat is removed by the Residual
Heat Removal (RHR) System through heat exchangers to the Reactor Building Cooling
Water (RBCW) System and then to the Reactor Building Service Water (RBSW) System
and finally to the sea, which serves as the ultimate heat sink (UHS).
The function of the UHS gets lost, when the water intake is unavailable, e.g. because of
clogging. Furthermore, UHS function gets lost, if the RBSW and/or RBCW system(s)
lose(s) function (e.g. because pump room temperature is not maintained below 40°C by
its safety-related ventilation system).29
If UHS function gets lost, the reactor is to be depressurized by releasing steam into the
containment; at the same time, water from all possible water sources is continuously
provided through AC-Independent Water Addition (ACIWA) to the reactor (see chapter
3.5).
TPC s envisaged measures to increase the robustness of the plant regarding loss of UHS
are very limited: an emergency sea cooling water recovery plan has been established;
furthermore, spare RBSW and RBCW motors for emergency replacement have been
prepared.
Fuel damage can occur in the reactor core and/or spent fuel pool quite rapidly, in case the
UHS is lost. An additional alternate UHS that is installed at several EU nuclear power
plants could considerably reduce the risk of the total UHS loss. However, only the
evaluation about this issue is required by the AEC: TPC is required to perform an
evaluation regarding the establishment of an additional alternate heat sink such as the
water fed by groundwater wells.
TPC is also required to study the feasibility of adding the mobile heat exchanger to
remove the heat from the containment and/or reactor.
Spent fuel pool
The Spent Fuel Pool (SFP) is located on the upper part of the reactor building (elevation
31.7 meter), outside the primary containment.30
29
If RBSW system fails, but RBCW system is still available, it is an option to provide cooling water to the
RBCW heat exchanger through temporary piping. 30
The primary containment is a cylindrical steel-lined reinforced concrete structure integrated with the
reactor building. The reactor building provides a secondary containment around the primary
containment
35
During normal operation, the residual heat removal and water makeup of the spent fuel
pool (SFP) is by ways of fuel pool cooling and cleanup system (FPCU). The heat is
removed by the RBCW and the RBSW system to the sea (ultimate heat sink).
If the ultimate heat sink (UHS) gets lost, the fuel pool cooling system can perform the
water make up function. Since decay heat cannot dissipate into the UHS, evaporation will
be the only way to remove decay heat.
In case of loss of offsite power, the non-safety related bus will not be able to provide AC
power, thus the FPCU pump cannot operate. In this case, the residual heat removal
system (operating in RHR FPC mode) will perform the fuel pool water makeup and
cooling function.
In case of SBO, the SFP will lose forced cooling and normal water makeup function.
Back-up design provisions are not available. Thus, firewater in reactor building 7th
floor
has to be injected into the SFP by using the fire hose located on the side of the SFP.31
The
diesel driven fire pump of the fire water system can provide water from the fire water
storage tank, through only one division of the RHR system (RHR-C piping) or directly
through the firewater system. However, the seismic capability of fire water storage tank
is low. The back-up water shall be provided from the raw water reservoir, however the
structures of the raw water reservoir are threatened by an extreme earthquake.
The installation of seismically designed firewater piping to make up and spray firewater
is planned. This backfitting measure is to be appreciated; however without an
appropriate water reservoir it could be nearly useless. A lot of manpower is needed to
transport water via fire engines to the SFP.
The plant plans to purchase mobile water injection equipment: 4 mobile firewater pumps
and air inflated water tanks (15 tons) are to be provided as the fire water backup system.
But this is also a limited measure, regarding the large amount of water needed to prevent
a severe accident.
AEC s conclusion and requirements
The measures to prevent and mitigate SBO and loss of UHS situations that are envisaged
by TPC are very limited. Obviously, the evaluations of the different accident scenarios
are not sufficient. Therefore, TPC is required to analyse the consequences of both units in
the site being affected. This is one of the most important lessons learnt from the
Fukushima accident, and thus all EU Countries with operating multi-unit plants have
dealt with this issue.
31
During power outage, the SFP and reactor cavity are interlinked. Firewater pumps, tank truck engines,
or mobile fire engines shall makeup water into the SFP (or reactor core) through the RHR system.
36
Furthermore the consequential impact on the spent fuel pool (including the integrity of
the pool structure) in case of a loss of all power supply (SBO) and complete loss of the
heat sink should be evaluated. This is also one of the most important lessons learnt from
the Fukushima accident.
With respect to the SBO, the TPC is required to establish the equipment, procedures, and
training necessary to implement an extended loss of all AC power supply of 72 hours for
core and spent fuel pool cooling and for the reactor coolant system and primary
containment integrity as needed.
In the opinion of the AEC, the feasibility of TPC s accident management is not assured.
Thus, the AEC required: The operability of the non-conventional means including mobile
equipment, fire trucks, etc. should be justified on the basis of technical data32
. A
systematic review of the non-conventional provisions should be performed, focusing
appropriate operation of plant equipment in the relevant circumstances, taking into
account extreme external hazards and a potentially harsh working environment. Thus, all
of TPC s measures to cope with a loss of all power supply (SBO) and loss of ultimate
heat sink (UHS) could fail and a severe accident could occur.
3.5 Severe Accident Management
Severe Accident Management is necessary to prevent or mitigate major releases of
radioactive substances.
In order to cope with the compound disaster condition, for example earthquake and
tsunami, TPC had prepared the Ultimate Response Guidelines (URG), developed
following the Fukushima accident. Their relevant items (including reactor pressure relief,
alternative water injection and the required power for essential systems and
instrumentation control via mobile power source) in phase-1 shall be independently
completed by the station manpower itself within only one hour.
However, only if the measures can be performed as fast as envisaged, fuel damage will
not occur. After only 1.6 hours, the time of core water level drops to top of active fuel
(TAF), and then fuel damage starts. This time span is very short to take appropriate
measures. However, the strategy for preventing fuel damage described in the NR remains
vague. It is stated that all possible and available manpower and materials are mobilized to
arrange all available water sources including each kind of alternative water flooding path,
power sources, and water sources etc. It has to be considered that after an extreme
earthquake and/or tsunami it is very difficult and dangerous to perform these measures.
32
design, operation, alignment and connections, periodic testing, preventive maintenance, etc.
37
A very large amount of water is required to prevent a core melt accident with a major
release of radioactive substances. For combined events that occur in both units, the total
required makeup water, including reactor and SFP, is 442.2 tons per hour (1947 gpm).
Several possibilities for water supply exist. However, the capacity of the onsite fire
engine, for example, is 12 tons. TPC stated that the raw water reservoir can supply
continuously for 86.84 hours (3.62 days). But in case it fails during an earthquake, it is
very difficult to provide such a large amount of cooling water.
Depressurization of the reactor
According to TPC, if the Emergency Core Cooling System (ECCS), including RCIC, is
expected to be unavailable, a controlled depressurization of the reactor must be
performed while the ECCS is still available. Once the ECCS is unavailable, an
emergency depressurization of the reactor must be performed immediately by opening
safety relief valves (SRVs).
The AEC highlighted the problem of the two step depressurization strategy that has been
adopted for prolonged SBO situation: With the slow and controlled depressurization
process (first stage), the reactor can be brought to and maintained at a relatively safe state.
In the second stage, the fast emergency depressurization of the reactor is performed. But
if the reactor is at a relatively high danger state (namely, a high pressure state), fast
depressurization of the reactor will lead to a core uncover even if the water level is high
before depressurization. Thus the envisaged procedure according to the URGs could have
negatve effects.
The AEC alerts that the subtle detail matters. The controlled depressurization should not
be confused with the emergency depressurization. However, the two terminologies are
not well distinguished in TPC’s stress test report.
Prevention of RPV failure
According to TPC, the station’s overall program for URG can assure the integrity of the
reactor pressure vessel (RPV). If fuel is damaged, the station shall perform the evaluation
of rescue measures and proposed actions in coordination with severe accident
management guidelines (SAMGs).
However the measures that should be taken after occurrence of fuel damage are only
described very briefly and vague. Thus, there are doubts that these measures could be
conducted under the catastrophic conditions after an extreme natural event. After stop of
operation of the RCIC, the reactor pressure vessel (RPV) will fail after only 9.7 hour.33
33
If RCIC keeps operation for 24 hours, the time of core water level drops to TAF (top of active fuel) is 4.3
hours. The time RPV failed: 15.1 hrs.
38
Note: ENSREG warns the depressurization of the reactor coolant system (RCS) after core
melt is considered to be a crucial action to avoid high-pressure core melt ejection from
the RPV, which could potentially challenge the containment integrity and facilitate water
injection from low-pressure sources [ENSREG 2012b].
Prevention of containment overpressure
After loss of function of the ultimate heat sink (UHS), the reactor has to be depressurized.
Heat generated in the reactor will be removed to the primary containment. Thus, the
suppression pool water temperature will increase rapidly. Because it is likely that its
temperature and consequently the primary containment pressure will exceed design limits,
the containment pressure has to be released to protect the containment integrity.
As a filtered containment venting system (FCVS) is not installed, the release of a large
amount of radioactive substance will result. FCVS is a filtering system for removing the
radioactive material throughout different highly efficient filter stages.
TPC has not the intention to implement a FCVS. TPC has only set power recovery of the
Standby Gas Treatment System (SGTS) as the first priority item in the URGs. The
release of radioactive substances shall be mitigated by the SGTS, which depends on
power supply.
Despite the fact that the lack of FCVS is a serious shortcoming, there is no AEC
requirement concerning the implementation for such a system.
Note: in the design of the EU-ABWR, a FCVS is implemented (see chapter 5). FCVS are
to be installed in the ABWRs in Japan.34
Prevention of hydrogen explosion
If the fuel loses adequate cooling during an accident, hydrogen can be generated by
zirconium water reaction. To manage hydrogen risks inside the containment and prevent
hydrogen explosions, hydrogen igniters and recombiners or containment spray shall be
used to reduce the containment hydrogen concentration. However, AC power supply is
necessary to use these devices. Thus, containment exhaust is planned to reduce hydrogen
concentration, despite the fact that this measure will cause a release of radioactive
substances.
It is a serious shortcoming that passive autocatalytic recombiners (PARs) to prevent
hydrogen explosions are not installed, and the chief measure to prevent hydrogen
explosions and overpressure in the containment is by venting. Note that PARs sufficient
34
Hitachi-GE Nuclear Energy and Areva will work together to install filtered containment venting systems
(FCVS) at boiling water reactors (BWRs) in Japan [NUCNET 2013].
39
for BDBA are installed or definitely planned in the European nuclear power plants
(apart from those with inertisation).
TPC is required to install PARs, but only by the still non-binding requirements of the
AEC. Thus, it is not clear, whether PARs are to be installed and if so, when this has to
happen.
In order to prevent hydrogen accumulation in the secondary containment (reactor
building) that could result in hydrogen explosions, the station shall open blasting
windows located on the upper part of the reactor building to release hydrogen outside by
natural convection.
During an accident this measure will also result in a release of radioactive material.
Prevention of basemat melt-through
To prevent containment basemat melt-through after the reactor pressure vessel (RPV), the
lower drywell shall be flooded via the AC-Independent Water Addition (ACIWA) system.
If the diesel-driven fire pumps failed to start, it is planned to flood with raw water by
gravity.
If the ACIWA system failed, the Lower Drywell Flooding (LDF) system, a passive
system, shall be used as an alternative flooding system: After the molten core will drop
down upon the drywell basemat, suppression pool water would flood into the lower
drywell when its high temperature fusible plug acts. According to TPC, the reaction
between molten core and concrete would be limited.
It is not discussed in the NR whether the flooding is fast enough to protect the basemat
and the penetrations in the lower drywell. Furthermore, it is questionable, whether in this
stage of the accident a sufficient amount of water will be available.
All in all, the measures for the prevention of the basemat melt-through are not sufficient.
This fact is underlined by the new safety feature of the EU-ABWR (core catcher) to cool
and stabilise the molten core (see chapter 5).
Prevention of liquid radioactive releases
During and after an accident, the liquid radioactive release can only be prevented if the
waste system and release routes are guaranteed to be safe. Otherwise, the radioactive
liquid will first flow into the reactor building sump and then overflow. In the worst case,
the liquid submerges into the first and second floors of the building. Then it further flows
outside the building into rain-water sewers or sinks into the bottom layer sea water
draining tunnel. The release will flow into the sea via the cooling sea water outlets.
40
According to the NR, the release of the radioactive water should be stopped immediately.
However, the procedure is not explained. Furthermore, the worst case of liquid releases
into the sea is mentioned without indication how fast such releases could overflow in
different accident scenarios, and which amounts of radioactive water could be released.
The storage capacity is limited (17,968 m³). Thus, it has to be expected that large
amounts of liquid radioactive releases will enter into the environment.
ENSREG points out that conceptual solutions for post-accident fixing of contamination
and the treatment of potentially large volumes of contaminated water should be addressed
[ENSREG 2012b]. This important issue highlighted by the Fukushima accident is neither
addressed by TPC nor by the AEC.
Spent fuel pools (SFP)
If the spent fuel pool (SFP) water level is dropped, SFP emergency water makeup shall
be performed by ways of fire hydrants, fire water tankers and engine-driven fire water
pumps. The arrangement of the phase-1 strategies of the URG shall be completed within
2 hours.
In the worst case, after loss of SFP cooling and water makeup, the pool water temperature
will rise and the water will begin to boil after 9.5 hours.35
TPC stated that after 9.5 hours,
the members of support teams36
should be on site and the supporting should be ready.
TPC has the opinion that there is sufficient time to restore the power supply or to prepare
the alternative power supply for restoring SFP cooling or water makeup, because fuels
degradation will not start before 98.37 hours. Even in case adequate radiation shielding is
lost (after 52 hours), the station will be able to carry out SFP water makeup or spray
through its dedicated water makeup or spray piping.
However, to secure cooling of the SFP, comprehensive manual actions are required. It is
difficult to add water in the spent fuel pool, which is located at a height of about 32
meters under accident conditions. The Fukushima accident has highlighted this issue.
The location of the SFP outside the primary containment aggravates the situation, thus a
release of radioactive material is threatening during a severe accident.
If SFP water temperature increases, second containment venting to discharge heat into
atmosphere has to be performed. However, this measure will cause a release of
radioactive substances.
35
The decay heat in the SFP is the maximum if all core fuel is transferred to the SFP in the shortest time
after unit shutdown. The decay heat of the spent fuel is calculated based on the assumptions that spent
fuels are discharged into the pool from last 9 cycles and all core fuels are discharged after 7 days of unit
shutdown. 36
Technical Support Centre (TSC), Accident Management Team (AMT), Operation Support Centre (OSC),
Health Physic Centre (HPC), and Emergency Public Information Centre (EPIC)
41
For the case of spent fuel becoming uncovered, there is no discussion in the NR about the
possibility of a steam-water reaction or zirconium fire or about the hydrogen which will
be produced. It has to be assumed that there are no measures available to cope with such
a severe accident.
Note that in the EU, it is under consideration to take measures to practically eliminate
spent fuel uncover in the pool, because the situation after fuel uncover is extremely
dangerous.37
According to the ENSREG, the hydrogen production in SFPs has to be carefully analyzed
and adequate countermeasures adopted if necessary [ENSREG 2012a].
The means for reliably monitoring the water level in the SFP under accident conditions
are not addressed by TPC. The AEC required installing SFP instrumentation to monitor
key spent fuel pool parameters (i.e., water level, temperature, and area radiation levels)
consistent with the recommendation 7.1 of the USNRC NTTF Report. Accordingly, only
the protection against design-basis events is required. This is not in accordance with the
ENSREG recommendation, which ask for the use of dedicated instrumentation resistant
to extreme external hazards (i.e. beyond design events), either passive or powered from
reliable sources.
AEC s conclusion and requirements
The assessment and conclusions of the AEC indicates that the severe accident
management of the NPP4 is not sufficient at all:
AEC highlighted the importance of the justification of the URG; of particular concern is
the depressurization of the reactor. This is the key measure to be able to prevent a severe
accident.
Regarding the establishment of the URGs, the AEC requires TPC to identify their
implementation timing, the subsequent measures and monitoring strategy, including the
monitoring of radioactive releases, backup ability of present systems and equipment, etc.
In the opinion of AEC, the hydrogen and containment pressure control strategies in the
URG do not take into account various accident scenarios.
The AEC has obviously doubts that the operator is able to cope with a severe accident
that affects both units simultaneously. TPC is required to estimate the duration of
37
ENSREG highlighted: “Maintained coolant inventory in the SFP needs to be ensured by verification or
by upgrading SFP structural integrity, installation of qualified monitoring, and by provisions for
redundant and diverse sources of additional coolant resistant to external hazards in order to practically
eliminate the risk of fuel uncovery“ [ENSREG 2012a].
42
independent response capability for various severe accidents, beyond design accidents,
and multi-event accidents.
Furthermore, the AEC requires ensuring the capability of DC power for instrumentation
and control (I&C) systems of main control room (MCR) during SBO accidents.
The AEC requires the integration of the emergency operating procedures (EOPs), severe
accident management guidelines (SAMGs), and extensive damage mitigation guidelines
(EDMGs) with the ultimate response guidelines (URGs). Note: The OECD/NEA group
pointed out that there could be a little confusion on how the URGs are to be used in
conjunction with EOPs and SAMGs [OECD 2013].
Regarding procedures, training and exercises, the AEC requires combining the additional
equipment and operations into the procedures or guideline, to re-evaluate the feasibility
of EOPs and SAMGs with the involvement of new procedures/guidelines, to ensure that
the SAMGs are appropriate for multi-unit events and to improve the emergency
preparedness staffing and communications.
The ENSREG recommended to asses and ensure the radiation protection of operators and
all other staff involved in the SAM and emergency arrangements by adequate monitoring,
guaranteed habitability of the facilities needed for accident control [ENSREG 2012b].
This important issue is not adequately addressed by TPC or the AEC.
The ENSREG pointed out that the means for maintaining containment integrity should in
particular include depressurization of the reactor coolant system, prevention of damaging
hydrogen explosions, and means of addressing long-term containment over-
pressurization, such as filtered venting [ENSREG 2012b]. None of these means is
sufficiently addressed by TPC. The means are also only partly included in the AEC
requirements, i.e. containment failure and thus the release of radioactive material will
not be prevented adequately in the future – not even if technical means are available.
43
4 Weaknesses the Taiwanese stress tests ignored
Several safety issues that can trigger or aggregate an accident have not been evaluated
during the stress tests. They are discussed in this chapter.
This chapter is mainly based on a special edition magazine published in March 2013 in
Taiwan38
. This article includes comprehensive information provided by Tsung Yao Lin39
,
an expert with practical experiences in nuclear power plant construction and safety
analysis and a former member of the Fourth Nuclear Power Plant Safety Monitoring
Committee.
In July 2011, Tsung Yao Lin stated that NPP4’s problems are so sizable and serious that
TPC will not be able to solve this by itself. He wrote a paper titled “Essay on the Fourth
Nuclear Power Plant”, in which he described structural issues of NPP4 (including
equipment, construction, quality assurance and supervision). Later he published
“Strategies for the Fourth Nuclear Power Plant”, suggesting practical solutions. The
chairman of the Fourth Nuclear Power Plant Safety Monitoring Committee placed a very
high value on this report.
4.1 Shortcoming during procurement of equipment
In the beginning, TPC wanted to have a consulting firm to organise and handle all the
contracts. However, the bidding price for experienced foreign consulting firms would
have been relatively high, because they would take more risks. Unfortunately, no bidder
won the bid as their offers exceeded the 20% of the base price.
Under the limited budget, TPC outsourced the two ABWRs to GE, and then hired Stone
and Webster International Corporation (SWIC) as the consultant taking charge of the
design. According to the agreement, SWIC was responsible to come up with the purchase
specifications, and TPC was in charge of the procurement. It was difficult to ensure the
quality of the equipment purchased through low bidding prices; furthermore, it disrupted
the working procedure. The incident mentioned below with the fire plug reveals that there
are shortcomings in TPC’s expertise in procurement.
In July 2007, TPC decided to terminate the agreement. Many projects were unfinished at
the time of termination, such as NPP4’s final safety analysis report (FSAR). TPC had to
undertake those tasks; however, TPC does not have sufficient experience to do so.
38
Author: Wang Mei Zhen (王美珍), Special edition on Longmen Nuclear Power Plant (NPP4)
Controversies, Global View Monthly, March 2013 39
He graduated from Department of Nuclear Engineering of Ching Hua University in 1969 and worked
for both GE and Bechtel Corporation as a consultant. During the time when NPP2 and NPP3 were
under construction, Lin worked as the representative of a US consultant company for seven years.
44
4.2 Many design changes
The Atomic Energy Council (AEC) pointed out that between 2007 and February 2012,
TPC has made at least 15 major violations, including changing construction design at will.
During the construction process, up to 1,530 items underwent changes in design. TPC
mentioned three reasons: First, the consulting firm, SWIC, left the project. SWIC made
lots of mistakes in design drawings, and those all had to be corrected.
Second, from the very beginning, General Electric Co. (GE), who won the bid for the
nuclear island, planned to completely copy the model of Japan’s Kashiwazaki-Kariwa
nuclear power plant. However, the facilities Japan bought were made in Japan, whereas
the facilities GE bought were made in Europe and the US. They all differed in size. It was
figured out in the beginning that many facilities could not fit in the nuclear island. Motors
and pipelines were all somewhat different from original designs.
Third, the sequence of facilities installation also results in design changes. For example,
if water pipes are installed first, then it is likely that air pipes and electrical lines will not
fit. To avoid changes, the sequence has to be exactly the same as design drawings show,
but in fact it is impossible as NPP4 must adhere to the government’s Procurement Act.
What came first would be installed first, and this was likely to affect the facilities
delivered later. Therefore, changes had to be made and there was no way to stick to the
original design.
Because of all design changes the design of the actual plant is not similar to the original
design. This could affect the plant behaviour during accidents or the resistance against
earthquakes.
4.3 Inadequate safety culture
International experts pointed to the inadequate safety culture during the construction
process:
Some years ago, the Atomic Energy Council invited representatives of Japan
Nuclear Energy Safety Organization (JNES) to assist in check-up. Later on, those
Japanese representatives wrote in the report: “This construction site was not safe.
We were worried it would pose threats to Japanese representatives’ safety. As a
result, we were unsure whether we would be able to come to assistance again.”
A couple of years ago, a former designer of GE, Yoichi Kikuchi, came to Taiwan
to inspect NPP4’s construction site. In an interview he commented: “In every
aspect, I didn’t think this power plant would be worked. Rusted steel reinforcing
bars were scattered everywhere. Engineering and construction management was
commissioned to downstream contractors, and no one was overseeing the
construction prudently.”
45
Several important shortcomings that could result in accidents during operation were
identified and remedied. In 2002, for example, TPC had to reassemble four of five layers
of the reactor pressure vessel (RPV) support platform of unit 1, after regulators confirmed
that workers used improper welding material in assembling it the first time. Workers had
used low-intensity welding material to assemble the platform where high-intensity
material had been specified.
One important reason for the insufficient safety culture during the construction phase is
the following: NPP4 workers revealed that Hung Chi Shih, former vice president of TPC,
insisted on speeding up the work to meet the deadline. He would set up a completion date,
and if the team failed, all managers and directors would be demoted to technicians. As a
result, many issues were left unreported to avoid getting scolded.
Safety culture in the construction site should be conscientious and must be extremely
strict. However, quite the opposite seems to be the case.
4.4 Incidents during the construction process
The construction of NPP4 did not only take a long time, it was also accompanied by a lot
of troubles. In the last few years, several incidents, among them fires and floods, occurred
during NPP4’s construction phase:
Jul. 2008: When typhoon Sinlaku hit Taiwan, the lack of disaster prevention carried
out by TPC caused accumulated water flood into the second machine room
that reached two meters high, immersing facilities such as the emergency
cooling system.
Jan. 2010: Piles of electric cords were burned up, causing fire at the construction site.
Mar. 2010: The first reactor’s uninterruptible power system failed, causing fire in the
central control room.
May 2010: TPC workers followed the method used in the three nuclear power plants
to clean the electronic enclosure of the central control room with vacuum
cleaners. Unexpectedly, the static electricity generated interfered with the
output voltage, and caused a short-circuit.
Jul. 2010: The electrical system was burned out, causing power outage in the plant.
Aug. 2010: Rain damaged a voltage transformer, causing abnormal power supply for
three days.
Sep. 2010: Electric cables were not laid as required (see below).
Jan. 2011: Electric cables in the central room were damaged by mice. Only after this
incident, a strict rule has been made that no food is allowed at the
construction site.
46
Aug. 2011: Operators pumped water from the condensate water tank to the
suppression pool without following the maintenance rules. This caused a
large volume of water to emit from the valve body. The control rod
accumulator’s level switch and some other safety-related equipment were
affected by the water.
Oct. 2011: TPC commissioned an inexperienced company to manufacture electric
machinery pipes.
Mar. 2012: The tap of the fire hydrant in the first unit room of NPP4 failed and water
poured out, causing up to 30 cm of water accumulation in the equipment
operating room. The reason was that for the hydrant a Japanese model was
used, whereas the connecting extinguisher pipe was from the US. Merely
26.1% of the parts fit properly.
Apr. 2012: A malfunctioning automatic bleeder vent of the sea water system caused
the overflow of sea water, resulting in 150 cm of water accumulation.
However, the same thing already happened in September, October, and
December 2011. This showed that TPC is incapable of completely
resolving issues concerning equipment design and quality that cause the
incidents to happen again.
Up to now, only the failures of structures, systems and components (SSCs) running into
problems were exposed. But it has to be expected that other parts have deficiencies as
well and that there are several deficiencies that remain undiscovered.
Additionally, since the plant has been under construction for so long, it is possible that
degradations effects take place already.
4.5 Insufficient quality assurance (QA)
In August 2011, cable re-arrangement was needed since cables were laid incorrectly. In
total, those cables were 2120 thousand meters in length. This example showed that NPP4
had problems with supervision and quality assurance.
There are three layers of quality assurance. The first layer is the internal quality assurance
from contractors, the second one is supervision from Lungmen Construction Office, and
the third one is quality assurance from the safety unit of the TPC head office.
In the past, TPC deployed their own staff, but now many operating staff are employed by
contractors. At Lungmen Construction Office, there are around 1,500 quality assurance
testers (second layer), among them around 680 persons from TPC.
TPC failed to identify the problem of cable rearrangement at the first and second layers
and discovered the problems at the third layer, only.
47
Tsung Yao Lin highlighted another issue regarding insufficient quality assurance.
Welding operation had been problematic while he was a member of the Fourth Nuclear
Power Plant Safety Monitoring Committee. If welding is not done properly, pipes would
break and water would leak.
The Quality Assurance (QA) should guarantee, among others, that deficiencies are
remedied, however the QA is insufficient.
4.6 Concerns regarding the I&C System
The instrumentation and control (I&C) system architecture, together with plant
operations personnel, serves as the "central nervous system" of a nuclear power plant
(NPP). Through its various elements (e.g., sensors, transmitters, actuators, etc.), the plant
I&C system senses basic physical parameters, integrates information, and makes
automatic adjustments to plant operations. It also responds to failures and off-normal
events, thus it is necessary to cope with accidents. The IAEA recommended giving as
much attention as their importance for design, testing, operation, maintenance, licensing,
operation, and modernization of I&C systems [IAEA 2013].
NPP4 is the first Taiwanese NPP designed to be totally digitally controlled. The operation
and maintenance of the Information and Control (I&C) system will be an issue for the
system operator and regulator. 40,000 digital signals brought up safety concerns. This
system had been assigned to three different contractors. Thus, there are doubts whether
the interfaces will work together or not, and their accuracy and stability remain an
underlying concern [NW 16/05/13].
The Finnish regulator, for example, requires a hard-wired backup to the digital system for
the EPR (also with a digitized I&C system) under construction at Olkiluoto nuclear
power site. In 2010, the US NRC required AREVA to modify its US EPR design to
include a hard-wired back-up.
The AEC needs to require the installation of a hard-wired backup I&C system in NPP4.
4.7 Inappropriate test-operation procedures
SWIC, the company responsible for the test-operation, lacked the necessary expertise.
According to TPC, SWIC did a very poor job. They even returned the money for
compiling the procedures before the agreement was terminated, and asked TPC to write
down the procedures themselves.
However, this could also lead to shortcomings, because TPC has not enough experience
to do this. Test-operation begins with composing the procedures, because the way the
48
procedures are written determines how the tests are to be conducted. Things that are not
mentioned in the procedures will not be checked.
Another major issue is in the primary stage during NPP4’s test operation: those
performing the tests and those taking over the plant were the same group of TPC people.
Thus, it has to be feared that not all failures of the systems will be discovered. To
overlook failures of the I&C system is of particular concern.
4.8 Role of the Atomic Energy Council (AEC)
As described above, TPC has not enough experience to guarantee that the structures,
systems and components (SSCs) are installed as intended and with the appropriate
quality. This situation is aggravated by lack of experience of the Atomic Energy Council
(AEC).
According to Tsung Yao Lin, under the existing circumstances the safety of NPP4 could
not be guaranteed by the AEC. Tsung Yao Lin criticized that the AEC was merely
checking the laws, regulations, and procedures.
Lin explained that the AEC has adopted the regulatory style used for the operating plants.
However, since these plants adopted a standard design and were built by foreign
consulting firms under turnkey contracts, in a way they were already checked by the
nuclear energy control authority in the US. The AEC only had to make sure all things
abide by relevant laws and regulations, and check the procedures.
As NPP4 has a unique design and its contract with the original foreign consulting firm
had been terminated, the consulting firm’s duties, such as design, procurement, and
supervision were handed over to TPC and other contractors. However, the AEC did not
have the manpower to run on-site inspections for the designs, facilities, constructions and
test-operations.
According to Tsung Yao Lin, the US nuclear regulatory commission (NRC) has more
than 2,000 engineers to provide consulting services; thus, their inspections and audits can
be thorough. Although the AEC has tried its best, it is still inadequate. The AEC could
only conduct random inspections, not general ones, even for those safety-related systems.
The above-mentioned incident with the fire plug reveals that there are shortcomings in
TPC’s expertise in procurement. However, the appropriateness of TPC’s procurements
and the installation process are not under the AEC’s control.
Furthermore, the AEC admitted that it is impossible to check through all the test
operation procedures.
49
Lin criticized the ministry for incompetence in solving problems regarding the plant. In
addition, Lin said that the AEC is incapable of comprehensively supervising the
construction of the nuclear power plant, adding that the there is no guarantee for the
power plant’s safety and quality.
However, the ministry answered that the government will fulfil its duty, ensuring that the
NPP4 will not be allowed to function unless security checks prove its safety; even if a
referendum accepts to continue construction of the nuclear power plant [TAIPEITIMES
2013a].
Lin added that it is difficult to find solutions for problems at NPP4, because there are too
few professionals at the Ministry of Economic Affairs and the council who understand
the issues [TAIPEITIMES 2013c].
50
5 The EU-ABWR
There are two Advanced Boiling Water Reactors (ABWR) installed in the NPP4. The
ABWR nuclear island is designed and manufactured by General Electric Co. (GE).
The ABWR was originally developed in Japan. The first ABWRs (Kashiwazaki-Kariwa-
6 and -7) entered into commercial operation in 1996 and 1997, respectively. Since then,
only three more units started commercial operation in Japan: Hamaoka-5 (2005),
Higashidori-1 (2005) and Shika-2 (2006). However, these plants are offline for safety
checks following the Fukushima accident.
The ABWR was developed jointly by General Electric Co. (GE), Toshiba and Hitachi,
following on from GE's development of the BWR concept in the 1950s [WNN 2009b].
Today, both GE-Hitachi (who merged their nuclear businesses in 2007) and Toshiba
assert the right to build the ABWR [WNN 2009b].
GE-Hitachi Nuclear Energy (GEH)40
has submitted an application to the US Nuclear
Regulatory Commission (NRC) to renew the certification for its ABWR. Formerly, only
GE-Hitachi owned the US design certification. The US NRC issued a final rule certifying
the design on May 12, 1997. The original 15 year ABWR certification is set to expire in
June 2012. The latest application includes a design update to reflect the current NRC
requirement for an aircraft impact assessment [NEI 2010c].
In April 2013, Hitachi-GE signed agreements with UK nuclear regulators to carry out a
generic design assessment (GDA) of its new ABWR reactor design41
[NEI 2013b]. GDA
is a long-term and rigorous process, which will ultimately determine whether the
regulators will consider the ABWR suitable for construction in the UK [NEI 2013c].
Two ABWRs are planned for the South Texas Project (STP) in the US42
, but Toshiba was
selected as the prime contractor for the development in March 2008 [NEI 2009b; WNN
2009c].
Toshiba subsequently developed its own variant of the certified ABWR design for
construction at units 3 and 4 of the existing STP site, which were scheduled to come
online in 2016 and 2017, respectively. This design was submitted to the NRC in June
2009 and had to meet new aircraft impact rules. The Toshiba version of the ABWR
40
GEH is a global nuclear alliance created by General Electric and Hitachi. In Japan, the alliance is
Hitachi-GE Nuclear Energy Ltd. 41
Horizon Nuclear Power plans to build two to three 1300 MW-class ABWR-based nuclear power plants
at Wylfa and Oldbury (UK) 42
The future development of South Texas Project (STP) units 3 and 4 looks unlikely after majority
shareholder NRG Energy announced in April 2011 that it was withdrawing from the project, writing
down a $481 million investment and excluding any further investment [SCHNEIDER 2013].
51
would be considered safe even if one was hit by a large civilian aircraft. Following such
an impact, only minimal operator input should prove necessary in order to keep the
reactor core cooled and to maintain integrity and cooling at the used fuel pools. In
November 2011, NRC certified an amended version of Toshiba s ABWR [WNN 2010a;
WNN 2011d].
Toshiba is currently adapting the ABWR design also for the European market, first for
Finland. Toshiba's 1600 MW EU-ABWR design is under consideration for an envisaged
new nuclear power plant at the Hanhikivi site in northern Finland [NEI 2013a]. The
European version of the ABWR has been called EU-ABWR. Safety improvements based
on the defence-in-depth (DiD) concept have been implemented for instance to prevent
and mitigate long-term Station Black-Outs (SBO) and severe accidents.
The following chapter highlights the shortcoming of the outdated design of the ABWR
constructed at the Lungmen NPP, because these ABWRs have not implemented these
necessary safety features according to the state-of-the-art.
However, it is not clear whether it is technically feasible to upgrade the ABWR design of
NPP4 to the EU-ABWR standard. The feasibility could be limited due to two reasons:
First, it is physically impossible that the new safety features fit into the existing structures.
Second, it is not clear whether the safety systems which are sufficient for a European
nuclear power plant site are also appropriate for the Lungmen nuclear power plant site,
which is threatened by severe earthquakes.
5.1 Defence-in-Depth Concept
Principally, the Defence-in-Depth (DiD) concept was already part of the very early power
reactor designs. However, additional considerations have been done in order to take plant
conditions into account which are beyond the original design basis. The most recent
advancements have been done based on major lessons learnt from the Fukushima
accident [YAMAZAKI 2013].
The operational principle of the DiD concept shall be implemented to
1. ensure reliable prevention of anticipated operational occurrences (AOO) and
accidents (prevention)
2. facilitate the quick and reliable detection of AOO and accidents and prevent the
aggravation of any event (control of anticipated operational occurrences and
accidents)
3. mitigate the consequence of any accident and prevent radiation hazards (mitigation
of consequences)
52
The DiD concept of the EU-ABWR is based on the concept that is established by the
Reactor Harmonization Working Group (RHWG) of Western European Nuclear
Regulators Association (WENRA). Accordingly, the safety functions concept shall be
assured through five successive levels of protection. An illustration of the safety levels is
given in Figure 1.
Figure 1: Defence in Depth (DiD) Concept according to the WENRA
5.2 Technical realisation of DiD requirements
In the DiD Level 2, the safety functions are implemented to restore and maintain a
normal state after defined Anticipated Operational Occurrence (AOO) using for example
the Isolation Condenser (IC). The IC system is implemented in the EU-ABWR to
enhance the safety level. It is a passive system that condenses steam from the reactor and
feeds the condensate through the feedwater lines back to the reactor. The heat from the IC
is transferred to the coolant water of the IC tanks and from there directly to the
atmosphere. A schematic of the IC, that partly uses the same components as the Passive
Containment Cooling System (PCCS), is given in Figure 2.
53
Figure 2: Isolation Condenser (IC) and Passive Containment Cooling System (PCCS)
The structures, systems, and components (SSCs) designated to DiD level 3a – Design
Basis Accident (DBA) – fulfil safety functions in case of postulated single initiating
events. These SSCs are independent of those used in normal operation and in case of
AOO.
The initiating events for DiD Level 3b – Design Extension Condition (DEC) – are
defined as postulated accidents with coincident common cause failure (CCF), multiple
failures and rare events, such as extreme weather phenomena or a commercial air plane
crash.
Compared to the previous ABWR versions EU-ABWR adopts an Emergency Core
Cooling System (ECCS) that consists of three divisions of different sub-systems.
5.3 Severe Accidents (DiD Level 4)
The EU-ABWR includes complementary safety features specifically designed to fulfil
safety functions required in postulated core melt accidents (DiD level 4).
Several Severe Accident Management (SAM) measures are implemented in the EU-
ABWR design preventing or mitigating containment failures. The SAM strategy utilises a
core catcher against molten core-concrete interaction and loss of core melt cooling. To
prevent containment overpressure, the Passive Containment Cooling System (PCCS) is
used for containment heat removal. Figure 3 illustrates the interaction of the core catcher
and the PCCS.
54
Figure 3: Operation of EU-ABWR Passive Containment Heat Removal System during Severe
Accident
The initial cooling water for the core catcher is supplied from the suppression pool.
Fusible valves will open the PCCS condensate drain. A large amount of steam is then
generated at the core catcher and released into the drywell. The gas mixture including
steam and non-condensable (NC) gases flows from the drywell into the PCCS. The steam
is condensed inside the PCCS heat exchanger which is located in the same tanks as the IC.
The condensate is drained gravitationally to the core catcher down-comer. NC gases are
purged to the wet well pool through the NC gas vent lines.
The passive severe accident mitigation systems aim to maintain the containment integrity
without containment venting. The initial cooling water capacity lasts for at least 72 hours.
No external power is necessary to initiate the driving force opening motor operated
valves or starting pumps. The EU-ABWR has a dedicated power supply for the
instrumentation and control system for SAM measures even in the event of SBO and loss
of essential power supply.
Note: These are the statements of the supplier, who is interested in selling his product.
Certainly, whether all systems will operate in a severe accident situation during or after
an earthquake is not guaranteed. Nevertheless, the design is improved compared to the
original ABWR design by adding passive systems to avoid manual actions of the operator
in case of loss of all power supply and/or ultimate heat sink.
55
6 Discussion of the results and conclusions
Experience of the stress tests in Europe
Despite the fact that the stress tests revealed a number of shortcomings regarding the
plants’ capability to withstand several external hazards and the lack of possibilities to
cope with the consequences, the outcomes of the peer reviews of the European nuclear
power plants consist only of recommendations for “further improvements”. The fear of
representatives of civil society and independent experts that the stress tests were mainly
set up to improve the confidence in the safety of the European NPPs regardless of his
findings becomes true. The operation of dangerous NPPs is ongoing.
The experience highlights: the ENSREG did not assess, but only describe the
shortcomings of the European NPPs. The peer review of the stress test reports did not
formulate any overall conclusions – not even if a specific NPP showed shortcomings
similar to those of the Fukushima NPP.
Furthermore, the ENSREG avoided mentioning, whether the national action plans (NAcP)
to remedy the weaknesses are sufficient to amend the dangerous situation if completely
implemented.
One of the major weaknesses is the lack of definition in the stress test specifications,
which level of safety should be achieved if the plants should be back-fitted or shut down.
This deficit makes it very difficult for politicians and the public to assess the safety level
of the plant.
Therefore, it cannot to be expected that the peer review of the ENSREG/EC group will
give any advice about the decision to commission NPP4 or not – regardless of the
findings.
Limited scope of the stress tests
The EU stress tests cannot be understood as a comprehensive safety check of nuclear
power plants, because the stress tests did not take into account all key safety issues.
However, the safety issues that are out of the scope of the stress tests are of utmost
importance to assess the risk of the NPP4.
The quality of the plants’ structures, systems and components (SSCs) are not investigated
during the stress tests. Furthermore, the stress tests take for granted that all the SSCs are
in place and without faults. This assumption is not correct for any nuclear power plant,
but particularly not for the NPP4. TPC could not guarantee that the SSCs are installed
with the appropriate quality and without deficiencies. This situation is aggravated by
excessive demands of the Atomic Energy Council (AEC).
56
Several failures of structures, systems and components (SSCs) have been discovered
during the construction process. However, up-to now only failures running into problems
were exposed. Because quality assurance programs as well as test procedures are
insufficient, there are real fears that not all failures of the SSCs will be discovered before
commissioning. In addition, the overlook of potential failures of the I&C system are of
particular concern.
Numerous design changes could affect the plant’s behaviour during accidents and its
capability to resist against earthquakes.
All these failures could aggravate an accident situations triggered by a natural hazard.
Stress test results and measures to remedy weaknesses
The Lungmen nuclear power plant site is located in a high seismic risk zone, thus
earthquakes are an important hazard for the plant. Since a site-specific seismic hazard
analysis is lacking, it may be necessary to revise maximum magnitude values for faults.
A value of 9.0, which was the magnitude of the 2011 Tohoku earthquake that triggered
the Fukushima accident, is possible. However, the envisaged measures to increase the
seismic margins of the plant are very limited.
Regarding earthquake hazards, there is also an unsolvable problem: There are doubts
about the reliability of the structures, systems and components (SSCs) of the NPP4. It is
probably impossible to calculate the seismic resistance of the plant, due to the numerous
shortcomings during the construction phase. Those construction mistakes will make the
resistance of the plant unpredictable and the plant especially vulnerable to seismic
hazards.
Fukushima highlighted the danger of flooding triggered by a tsunami. But it is highly
questionable whether the operator, TPC, and the regulatory authority, AEC, are fully
aware of this problem. An adequate evaluation of the tsunami hazard using state-of-the-
art modelling is missing. Thus, the wave run-up, against which the NPP4 has to be
protected, is not known so far. Therefore, it is a matter of fact that the protection against
tsunamis is not adequate, even after implementing the envisaged measures (e.g. building
a sea wall).
The protection (including safety margin) against flooding events caused by storms and
heavy rain is also not sufficient. Extreme weather events, such as typhoons, heavy rain,
and mudslides can affect the Lungmen NPP site. However, the effects are not analysed
adequately. Furthermore, a systematic evaluation of combinations of extreme weather
events is still lacking. The same is true for the risk assessment of the potential volcanic
hazards.
57
The stress tests in Taiwan should largely be based upon the EU stress test model.
However, the methodology used to evaluate the design basis of natural events is not in
accordance with recommendations of the EU stress tests.
In summary the threat of natural hazards is not sufficiently evaluated. However, the
threat is significantly greater than assumed by TPC.
The ultimate heat sink (UHS) is vulnerable against natural hazards. Nevertheless the
measures to prevent loss of heat removal envisaged by TPC are very limited. A more
expensive, but more effective measure would be the implementation of a new
independent diversified ultimate heat sink (UHS) (without using the sea). But until now
this is not definitely required by the AEC.
According to the AEC, TPC s evaluations of the different accident scenarios are not
sufficient. Furthermore, in the opinion of the AEC, the feasibility of TPC s accident
management to prevent a severe accident is not assured.
All in all, both the design and the non-conventional means (e.g. mobile equipment) are
not sufficient to cope with a loss of all power supply (SBO) and loss of the ultimate heat
sink (UHS) triggered by an earthquake or another extreme natural event. It is not clarified
to which extent TPC will remedy this dangerous situation which could result in a severe
accident. Measures envisaged by TPC to prevent fuel damage need several additional
manual actions of the operator.
Obviously TEPCO is planning a more comprehensive upgrading program of its ABWR
(Kashiwazaki-Kariwa unit 7) compared to TPC: After performing stress tests, TEPCO
envisaged several backfitting measures. According to TEPCO, after implementing
additional safety measures, even if a Station Black-Out (SBO) occurs, it would take about
12 days until coolant injection functions for the reactor core and spent fuel pool get lost.43
The Severe Accident Management necessary to prevent or mitigate major releases of
radioactive substances envisaged by TPC is not sufficient. In order to cope with the
compound disaster condition, for example earthquake and tsunami, TPC had prepared
procedures (Ultimate Response Guidelines (URG)). AEC highlighted the importance of
the justification of the procedures (URGs) to cope with a severe accident; of particular
concern is the depressurisation of the reactor. This is the key measure to be able to
prevent a severe accident. However, the measure proposed by TPC could have a negative
effect.
43
The additional safety measures included water-tight seals, flood barriers, air-cooled gas turbine
generators, emergency electrical switchgears and back-up truck-mounted heat exchangers. Other
equipment installed includes hydrogen sensors inside the reactor building, filtered containment vents,
spent fuel pool water level gauge and camera, on-site heavy equipment for debris removal and
additional radiation monitoring cameras [NEI 2012c].
58
Specially, there are doubts about the implementation timing of the URGs. However, only
if the measures can be performed as fast as envisaged, fuel damage will not occur. But
after loss of water supply, the fuel damage would start after only 1.6 hours. It has to be
considered that after an extreme earthquake and/or tsunami it is very difficult and
dangerous to perform these measures.
It is also very difficult – or even impossible – to provide the large amount of water that is
required to prevent a severe accident (442.2 tons per hour for both units). It is not proven
that during and after a natural hazard sufficient water sources exist and water supply is
possible.
None of the means for maintaining containment integrity during a severe accident is
sufficiently addressed by TPC. The means are also only partly included in the
requirements of AEC, i.e. containment failure and thus the subsequent release of
radioactive material during a severe accident will not be prevented adequately – not even
if technical means are available.
The envisaged chief measure to prevent hydrogen explosions and overpressure in the
containment is by venting, despite the fact that this measure will cause a major release of
radioactive substances.
The measures for the prevention of the basemat melt-through are not sufficient.
Furthermore in case of a severe accident, it has to be expected that large amounts of
radioactive water will be released into the environment. Adequate measures suitable to
cope with a severe accident in the spent fuel pools are also lacking.
Toshiba is currently adapting the ABWR design also for the European market. The EU-
ABWR includes complementary safety features specifically designed to fulfil safety
functions required in postulated core melt accidents. Several passive devices to manage a
severe accident and to prevent containment failures are implemented in the EU-ABWR
design. The new safety features of the EU-ABWR highlight the shortcomings of the
design of the ABWRs of the Lungmen NPP that have not implemented these passive
state-of-the-art measures.
Instead, TPC is heavily relying on the new magic solution to compensate the design
deficiencies: mobile equipment, which is easy to plan and store in the plant and therefore
a cheaper solution than the installation of new systems protected against external hazards.
But under severe accident conditions, it is very unlikely that the proposed mobile
equipment can be put to work as quickly as needed. Furthermore, the new mobile
equipment is useless if the staff response during the accident is not functionally according
to plan. This is an important lesson learnt from the Fukushima accident, which should
59
result in the implementation of passive safety systems designed to withstand beyond
design basis accidents with appropriate safety margins.
To rely to such a large extent on manual actions is irresponsible in regard of the
consequences of a severe accident.
The AEC requirements
It is consensus among experts that the peer review of stress tests cannot provide
exhaustive verification of the comprehensiveness and adequacy of the safety measures.
Consequently, this process cannot replace the more detailed work performed by the
national regulatory bodies. However, there are concerns that the Taiwanese regulator, the
Atomic Energy Council (AEC), has not sufficient experience and resources to cope with
the workload of all necessary evaluations and back-fitting measures.
The AEC’s requirements to remedy the weaknesses of the NPP4 are very general, thus
the scope of the backfitting measures cannot be judged. Furthermore, the time schedule
for implementation of proposed safety measures is not mentioned. Therefore, it cannot be
assured that necessary backfitting measures will be in place before NPP4 starts operating.
The decision about the scope of necessary back-fitting measures is in particular an
economical issue. Comprehensive backfitting will result in better protection but also in
higher costs. However, to improve the safety level in an area prone to seismic or flooding
hazards is a highly technical issue. An adequate safety level cannot be achieved
subsequently. Thus, it is impossible to achieve an acceptable safety level for NPP4.
Conclusion
Regarding the existing natural hazards, the design weaknesses and the deficiencies of the
structures, system and components, it is not possible to retrospectively bring the NPP4 to
an acceptable safety level. Therefore, a severe accident with a major release of
radioactive substances cannot be excluded.
Considering the short distance of the NPP4 to the city of Taipei, such a severe accident
would have disastrous consequences for millions of people.
Taking all facts into account we recommend to stop the NPP4 project and to not
commission this nuclear power plant
60
7 References
AEC 2013: Atomic Energy Council Taiwan Stress Test National Report for Nuclear Power
Plants, May 28, 2013,
BECKER 2013: Critical Review of the National Action Plan (NAcP); EU Stress Test performed
on Nuclear Power Plants; Study commissioned by Greenpeace; Oda Becker, Patricia Lorenz;
Wien, Hannover, April 2013
ENSREG 2011: European Nuclear Safety Regulators Group (ENSREG): Declaration of
ENSREG, “Stress test” specifications; Brussels, 2011/05/13, http://www.ensreg.eu/node/286
ENSREG 2012a Peer review report; Stress tests performed on European nuclear power plants; 25
April 2012;
www.ensreg.eu/sites/default/files/EU%20Stress%20Test%20Peer%20Review%20Final%20Report_0.pdf
ENSREG 2012b Compilation of recommendations and suggestions; Peer review of stress tests
performed on European nuclear power plants; 27 July 2012;
http://www.ensreg.eu/sites/default/files/Compilation%20of%20Recommendationsl_0.pdf
HSU 2013a: Letter to ENSREG Experts; 3 July 2013; Gloria Kuang-Jung HSU, Jay Fang, Lill
Liu, Chia-Wei Chao, Chou-Han Lee, Irene Chen
HSU 2013b: Comments on Taiwan Stress Test National Report for NPPs; submitted by Gloria
Kunag-Jung HSU Taiwan Environmental Protection Union; 4 July 2013
IAEA 2003: International Atomic Energy Agency (IAEA): Flooding Hazard for Nuclear Power
Plants on Coastal and River Sites, Safety Guide; IAEA Safety Standard Series; NS-G-3.5;
Vienna; December 2003
IAEA 2013: International Atomic Energy Agency (IAEA): Nuclear Power Engineering;
Instrumentation and Control Technologies; Vienna 2013;
http://www.iaea.org/NuclearPower/IandC/index.html
IPCC 2007: Contribution of Work Group 1 to the Fourth Assessment Report of the
Intergovernmental Panel on Climate Change, 2007;
http://www.ipcc.ch/publications_and_data/ar4/wg1/en/contents.html
IPCC 2013: Intergovernmental panel on climate change: IPCC Fourth Assessment Report:
Climate Change 2007; http://www.ipcc.ch/publications_and_data/ar4/wg2/en/ch10s10-2-3.html
JPG 2012: Joint Project Group: Stress Tests & Vulnerability Assessment; Recommendations and
Experience of the Joint Project Group; 2012; www.joint-
project.org/upload/file/JointProjectGroup2012_Brochure_StressTests_VulnerabilityAssessment.p
df
NATURE 2011: Nature International weekly journal of science; Reactors, residents and rsik;
April, 21; 2011 http://www.nature.com/news/2011/110421/full/472400a.html
NEI 2000a: Nuclear Engineering International (NEI): Lungmen closure starts row 29 November
2000; http://www.neimagazine.com/news/newslungmen-closure-starts-row-721/
NEI 2007a: Nuclear Engineering International (NEI): Quake impact on reactor complex explored
2 August 2007; http://www.neimagazine.com/news/newsquake-impact-on-reactor-complex-explored-721/
NEI 2009a: Nuclear Engineering International (NEI): Seismic safety under scrutiny in Taiwan 29
May 2009; http://www.neimagazine.com/features/featureseismic-safety-under-scrutiny-in-taiwan/
NEI 2009b: Nuclear Engineering International (NEI): EPC contract signed for South Texas
ABWRs 26 February 2009; http://www.neimagazine.com/news/newsepc-contract-signed-for-south-
texas-abwrs/
NEI 2010c: Nuclear Engineering International (NEI): GE asks NRC to renew ABWR license, 13
December 2010; http://www.neimagazine.com/news/newsge-asks-nrc-to-renew-abwr-license/
NEI 2012a: Nuclear Engineering International (NEI): Parliament endorses Lithuanian nuclear
project 25 June 2012; http://www.neimagazine.com/news/newsparliament-endorses-lithuanian-nuclear-
project/
61
NEI 2012c: Nuclear Engineering International (NEI): Kashiwazaki-Kariwa 1&7 stress test results
published, 24 January 2012; http://www.neimagazine.com/news/newskashiwazaki-kariwa-17-stress-test-
results-published/
NEI 2013a: Nuclear Engineering International (NEI): Fennovoima considers mid-sized VVER
reactor for Hanhikivi 8 April 2013 Toshiba's 1600 MW EU-ABWR
http://www.neimagazine.com/news/newsfennovioma-considers-mid-sized-vver-reactor-for-hanhikivi/
NEI 2013b: Nuclear Engineering International (NEI): Horizon and Hitachi-GE sign contract for
design work on Wylfa nuclear plant 16 May 2013; http://www.neimagazine.com/news/newshorizon-
and-hitachi-ge-sign-contract-for-design-work-on-wylfa-nuclear-plant/
NEI 2013c: Nuclear Engineering International (NEI): UK regulators gear up for ABWR review,
11 April 2013; http://www.neimagazine.com/news/newsuk-regulators-gear-up-for-abwr-review/
NRC 2012: Recommendations for enhancing reactor safety in the 21st century; the near-term task
force review of insights from the Fukushima Dai-Ichi accident; Dr. Charles Miller, Amy
Cubbage, Daniel Dorman, Jack Grobe, Gary Holahan, Nathan Sanfilippo; JULY 12, 2011;
http://pbadupws.nrc.gov/docs/ML1118/ML111861807.pdf
NUCNET 2013: The Communications Network for Nuclear Energy and Ionising Radiation:
Hitachi and Areva to install Filtered Venting Systems at Japan’s BWRs; David Dalton; June 5,
2013; www.nucnet.org/all-the-news/2013/06/05/hitachi-and-areva-to-install-filtered-venting-systems-at-
japan-s-bwrs
NW 16/05/13: The McGraw-Hill Companies: Nucleonics Week 54, May 16, 2013
NW 18/10/12: The McGraw-Hill Companies: Nucleonics Week 53, October 18, 2012
NW 27/06/13: The McGraw-Hill Companies: Nucleonics Week 54, June 27, 2013
OECD 2013: Independent Peer Review Report of the Stress Tests Performed on the Operating
Reactors in Chinese Taipei; 23 April 2013
RENNEBERG 2011: Renneberg, W.; Becker, O.; Neumann, W.: The European „Stress test” for
Nuclear Power Plants; Expertise on behalf of the Parliamentary Group of the Greens in the
European Parliament; Bonn, October 2011
SCHNEIDER 2013: The World Nuclear Industry Status Report 2012; Mycle Schneider, Antony
Froggatt, Paris, London, Kyoto, July 2013;
http://www.worldnuclearreport.org/IMG/pdf/20130716msc-worldnuclearreport2013-lr-v4.pdf
TAIPEITIMES 2013a: Taipei Times: Gongliao patience urged; Helen Ku; 02 August 2013;
http://www.taipeitimes.com/News/biz/archives/2013/08/02/2003568699
TAIPEITIMES 2013b: Taipei Times: Nuclear plant may win democracy; Jay Fang; 05 August
2013; http://www.taipeitimes.com/News/editorials/archives/2013/08/05/2003568945
TAIPEITIMES 2013c: Taipei Times: TaiPower vows Gongliao plant is safe; Lee I-chia; 05
August 2013; http://www.taipeitimes.com/News/taiwan/archives/2013/08/05/2003568971
TOSHIBA 2011: Toshiba Corporation: US-ABWR and EU-ABWR Design, Safety Technology,
Operability Features and their Current Deployment; 5 July 2011;
http://www.iaea.org/NuclearPower/Downloadable/Meetings/2011/2011-07-04-07-08-WS-
NPTD/4_JAPAN_ABWR_Toshiba_Ishibashi.pdf
TPC 2013: Taiwan Power Company (OPC): EU Stress Test for Lungmen NPP - Licensee Report
(Rev.1b); May 2013
WENISCH 2012a: Wenisch, A.; Becker, O. Lorenz, P.: Critical Review of the EU Stress Test
performed on Nuclear Power Plants; commissioned by Greenpeace, Wien, Hannover, May 2012
WNN 2009a: World Nuclear News (WNN): Earthquake-hit unit gets OK for full output, 02 June
2009; http://www.world-nuclear-news.org/IT-Earthquake_hit_unit_gets_OK_for_full_output-
0206094.html
WNN 2009b: World Nuclear News (WNN): Toshiba signs contract for South Texas ABWRs, 25
February 2009; http://www.world-nuclear-news.org/newsarticle.aspx?id=24725
WNN 2009c: World Nuclear News (WNN): Exelon opts for resurgent ABWR. 26 March 2009;
http://www.world-nuclear-news.org/C_Exelon_opts_for_ABWR_2603092.html
62
WNN 2010a: World Nuclear News (WNN): Shaw to be exclusive EPC contractor for Toshiba
ABWR, 30 November 2010;
www.world-nuclear-news.org/C-Shaw_to_be_exclusive_EPC_contractor_for_Toshiba-ABWR-
3011108.html
WNN 2011a: World Nuclear News (WNN): New nuclear energy policy for Taiwan, 03
November 2011; http://www.world-nuclear-news.org/NP-New_nuclear_energy_policy_for_Taiwan-
0311117.html
WNN 2011c: World Nuclear News (WNN): Shaw receives compensation for Lungmen. 01
February 2011; http://www.world-nuclear-news.org/IT-Shaw_receives_compensation_for_Lungmen-
0102115.html
WNN 2011d: World Nuclear News (WNN): ABWR fit for aircraft impact, 02 November 2011;
http://www.world-nuclear-news.org/RS_ABWR_fit_for_aircraft_impact_021111a.html
WNN 2013a: World Nuclear News (WNN): Taiwan reactor offline after typhoon, 16 July 2013;
http://www.world-nuclear-news.org/RS_Taiwan_reactor_offline_after_typhoon_1607131.html
YAMAZAKI 2013: Defence-in-Depth Concept for the EU-ABWR; Hiroshi Yamazaki, Toshiba
International Limited; Steffen Fuchs, (Toshiba International Limited); Annual Meeting on
Nuclear Technology; Berlin; 14-16 May, 2013
63
8 Abbreviations
ABWR Advanced Boiling Water Reactor
ACIWA AC-Independent Water Addition
AEC Atomic Energy Council
AFB Auxiliary Fuel Building
AMT Accident Management Team
AOO Anticipated Operational Occurrences’
BDB Beyond Design Basis
BDBA Beyond Design Basis Accident
CCF Common Cause Failure
CST Condensate Storage Tank
CWP Circulating Water Pump
DBA Design Basis Accident
DBE Design Basis Earthquake
DBF Design Basis Flood
DBT Design Basis Tsunami
DEC Design Extension Condition
DiD Defence in Depth
DPP Democratic People’s Party
ECCS Emergency Core Cooling System
EDG Emergency Diesel Generator
EDMG Extensive Damage Mitigation Guideline
ENSREG European Nuclear Safety Regulators Group
EOP Emergency Operating Procedure
EPIC Emergency Public Information Centre
EPR European Pressurised Reactor
EU European Union
FPCU Fuel Pool Cooling and Cleanup System
FSAR Final Safety Analysis Report
GDA Generic Design Assessment
GE General Electric Company.
GEH GE-Hitachi Nuclear Energy
HPC Health Physic Centre
I&C Information and Control
IAEA International Atomic Energy Agency
IC Isolation Condenser
IPCC Intergovernmental Panel on Climate Change
JNES Japan Nuclear Energy Safety Organization
KMT Kuomintang
LDF Lower Drywell Flooding
LMNPP Lungmen Nuclear Power Plant
LOOP Loss of Offsite Power
LY Legislative Yuan
MCR Main Control Room
MOEA Ministry of Economic Affairs
NAcP National Action Plan
NC non-condensable
NCO Niigata Chuetsu Offshore
NEA Nuclear Energy Agency
NPP Nuclear Power Plant
NPP4 Forth NPP = Lungmen NPP
NR National Report
64
NRC Nuclear Regulatory Commission
NSC National Science Council
NTTF Near Term Task Force
OECD Organization for Economic Cooperation and Development
OSC Operation Support Centre
PAR Passive Autocatalytic Recombiners
PCCS Passive Containment Cooling System
PGA Peak Ground Acceleration
PMP Probable Maximum Precipitation
PRA Probabilistic Risk Assessment
QA Quality Assurance
RAP Reinforcement Action Plan
RBCW Reactor Building Cooling Water
RBSW Reactor Building Service Water
RCIC Reactor Core Isolation Cooling
RCS Reactor Coolant System
RHR Residual Heat Removal
RHWG Reactor Harmonization Working Group
RPV Reactor Pressure Vessel
SAM Severe Accident Management
SAMG Severe Accident Management Guideline
SBO Station Blackout
SFP Spent Fuel Pool
SGTS Standby Gas Treatment System
SRV Safety Relief Valve
SSC Structures, Systems and Component
STP South Texas Project
SWCB Soil and Water Conservation Bureau
SWIC Stone and Webster International Corporation
TAF Top of Active Fuel
TEPCO Tokyo Electric Power Company
TPC Taiwan Power Company
TSC Technical Support Centre
UHS Ultimate Heat Sink
URG Ultimate Response Guideline
US United States of America
US NRC US Nuclear Regulatory Commission
WENRA Western European Nuclear Regulators Association