1. Operational Safety of Nuclear Plants Best practices of operational experience feedback system use Dr. Michael Maqua, GRS September, 17, 2010 EC-TAIEX-INFRA 42192, Kiev

2. Content Introduction Main References OPEX Process Examples MAQUA-OPEX - Kiev 17.09.2010 2

3. Introduction Nuclear Safety is based on Conservative (robust) designs, Well trained personnel and Operating organizations with high safety culture. This can be achieved with application of a comprehensive maintenance system. Main element of the maintenance system is the feedback loop – the learning from experiences. MAQUA-OPEX - Kiev 17.09.2010 3

4. IAEA Safety Fundamentals (1) 3.16. The process of safety assessment for facilities and activities is repeated in whole or in part as necessary later in the conduct of operations in order to take into account changed circumstances (such as the application of new standards or scientific and technological developments), the feedback of operating experience, modifications and the effects of ageing. For operations that continue over long periods of time, assessments are reviewed and repeated as necessary. Continuation of such operations is subject to these reassessments demonstrating to the satisfaction of the regulatory body that the safety measures remain adequate. MAQUA-OPEX - Kiev 17.09.2010 4

5. IAEA Safety Fundamentals (2) 3.17. Despite all measures taken, accidents may occur. The precursors to accidents have to be identified and analysed, and measures have to be taken to prevent the recurrence of accidents. The feedback of operating experience from facilities and activities — and, where relevant, from elsewhere — is a key means of enhancing safety. Processes must be put in place for the feedback and analysis of operating experience, including initiating events, accident precursors, near misses, accidents and unauthorized acts, so that lessons may be learned, shared and acted upon. MAQUA-OPEX - Kiev 17.09.2010 5

6. Content Introduction Main References OPEX Process Examples MAQUA-OPEX - Kiev 17.09.2010 6

7. Main References  IAEA Safety Fundamentals  IAEA NS-R-2: Safety of Nuclear Power Plants: Operation  IAEA NS-G-2.11: A System for the Feedback of Experience from Events in Nuclear Installations  INSAG 23: Improving the International System for Operating Experience Feedback  NEA No. 6159: Regulatory Challenges in Using Nuclear Operating Experience  NEA-WGOE: The Use of International Operating Experience Feedback for Improving Nuclear Safety  WENRA Reference Level J: Operating Experience Feedback MAQUA-OPEX - Kiev 17.09.2010 7

8. 8

9. Content Introduction Main References OPEX Process Examples MAQUA-OPEX - Kiev 17.09.2010 9

10. Steps of the OPEX Process  Reporting of events at plants;  Screening of events — primarily on the basis of safety significance;  Investigation of events;  Corrective actions;  Trending and review;  Dissemination and exchange of OPEX, including by the use of international systems;  Continuous monitoring and improvement of programmes for the feedback of safety related operational experience;  A storage, retrieval and documentation system for information on events. MAQUA-OPEX - Kiev 17.09.2010 10

11. Reporting of events at plants  There are two level of reporting:  Plant internally  Any measure should be reported  Typically about 3.000 maintenance records per plant and year  Reporting to the regulatory body  Comprehensive set of reporting criteria  Typically less than 10 reports per plant and year MAQUA-OPEX - Kiev 17.09.2010 11

12. French reporting criteria ESS 1 Reactor emergency shutdown ESS 2 Manual or automatic triggering of a safety system ESS 3 Non-compliance with technical operating specifications ESS 4 Consequences from outside or inside ESS 5 Wilful actions with potential adverse effects on installation safety ESS 6 Shutdown following an incident or anomaly ESS 7 Event with multiple failures, consequential faults, common mode etc. ESS 8 Events in primary, secondary and adjoining systems that might result in abnormal operating conditions ESS 9 Design, manufacturing and assembly faults in systems (except criterion 8) ESS 10 Other events affecting installation safety MAQUA-OPEX - Kiev 17.09.2010 12

13. German reporting criteria (main headings only) 1.1 Discharge of radioactive materials 1.2 Release of radioactive materials 1.3 Contamination 1.4 Diversion of radioactive materials 2. Plant Engineering 2.1 Defects, failures or malfunctions in the safety system or in other safety related systems or plant components 2.2 Defects, leakages in pipes and vessels 2.3 Criticality problems 2.4 Drop of loads, events during handling or transportation 2.5 Other events 3. External Impacts or Internal Events 3.1 External impacts 3.2 Fires, explosions or floods 4. Events prior to the Grant of the License for Loading the Reactor MAQUA-OPEX - Kiev 17.09.2010 13

14. Screening of events (1) Screening of event information is undertaken to ensure that all significant matters relevant to safety are considered and that all applicable lessons learned are taken into account. The screening process should be used to select events for detailed investigation and analysis. This should include prioritization according to safety significance and the identification of adverse trends. Screening has to be performed On plant level On regulatory level MAQUA-OPEX - Kiev 17.09.2010 14

15. Screening of events (2) Plant level Generic implications that apply to the plant; Whether there is similar equipment at the plant; Whether there are similar practices at the plant that predispose it to similar events; The possible prior occurrence of a similar event; Reported actions taken that are applicable to the plant. National level (a) National group to lead the process of feedback of operational experience, including issues of safety assessment and cause analysis; (b) Vendors, suppliers and designers who use operational experience to improve their designs; (c) Research institutions. MAQUA-OPEX - Kiev 17.09.2010 15

16. Investigation of events (1)  Establishment of the complete event sequence (what happened);  Determination of the deviations (how it happened);  Cause analysis:  Direct cause (why it happened);  Root cause (why it was possible);  Assessment of the safety significance (what could have happened);  Identification of corrective actions. MAQUA-OPEX - Kiev 17.09.2010 16

17. Investigation of events (2)  Application of systematic analysis methodology recommendable  Often various expertises necessary  Do not forget cross-cutting issues;  Human factors;  Organizational factors;  Think of similar equipment, systems, conditions when defining corrective actions. MAQUA-OPEX - Kiev 17.09.2010 17

18. Corrective Actions  Application of systematic analysis methodology recommendable  Modifications to equipment and the installation of additional devices and means to prevent the recurrence of the same or similar events;  Improvements of procedures and administrative measures, and additional checks and control;  Rectifying deficiencies revealed in the documentation for operation (operation manuals);  Rectifying deficiencies in normative documents;  Training personnel to perform jobs properly;  Making changes to the working environment;  Making changes to the planning and scheduling of work and/or to the individuals assigned to particular duties. MAQUA-OPEX - Kiev 17.09.2010 18

19. Trending and Review  Trending is a process used to identify conditions of degradation on the basis of the analysis of past events (precursors) at the plant.  The goal of any trending programme should be to identify an abnormal trend early enough that the operating organization can initiate an investigation and take corrective actions to prevent a significant event.  Trend analysis reports should do the following:  Provide useful information to line managers at a regular frequency that depends on the amount of coded event data generated;  Focus attention on those items in the trend report for which further action may be necessary;  Provide sufficient detail in the report so that adverse trends can be understood;  Provide clearly labelled graphs where appropriate;  Present data in a format (e.g. in tables) that is easy to reference. MAQUA-OPEX - Kiev 17.09.2010 19

20. Dissemination, Exchange of OPEX  For operating organizations or licensees to be able to enhance the safety of the plant by implementing the applicable corrective actions as derived from operational experience;  To improve the understanding by the operating personnel of the operating conditions and response characteristics of the plant;  To enable the vendors to be able to improve their design and manufactured products by taking into account lessons learned;  To enable contractors providing maintenance services to be better prepared so as to anticipate potential problems;  To enable research establishments to prioritize research and to provide an additional means of improving their knowledge, which may be of help to the operating organization of the nuclear installation. MAQUA-OPEX - Kiev 17.09.2010 20

21. Continuous monitoring and improvement of programmes  ‘Self-assessment’ by the operating organization of the nuclear installation;  Peer review to determine whether the process meets established international standards;  Regulatory review and/or inspection. MAQUA-OPEX - Kiev 17.09.2010 21

22. Storage, retrieval and documentation system Typical requirements for a storage, retrieval and documentation system:  Events at similar units;  Systems or components that failed or that were affected;  Identification of the causes of events;  Identification of lessons learned;  Identification of trends or patterns;  Events with similar consequences for personnel or for the environment;  Identification of failure types or human factor issues;  Identification of recovery actions and corrective actions. MAQUA-OPEX - Kiev 17.09.2010 22

23. Content Introduction Main References OPEX Process Examples MAQUA-OPEX - Kiev 17.09.2010 23

24. WENRA Reference Level J Typical requirements for a storage, retrieval and documentation system:  Events at similar units;  Systems or components that failed or that were affected;  Identification of the causes of events;  Identification of lessons learned;  Identification of trends or patterns;  Events with similar consequences for personnel or for the environment;  Identification of failure types or human factor issues;  Identification of recovery actions and corrective actions. MAQUA-OPEX - Kiev 17.09.2010 24

25. WENRA Reference Level J (1)  WENRA is a „club“ of European regulators and has no ruling competence  WENRA = West European Nuclear Regulators Association  „Reference Levels“ have set up showing the consensus of requirements  These reference levels are based on IAEA Safety Standards  European regulators have agreed to respect the reference levels in their regulation and have performed a detail benchmark  Reference level J shows practical requirements on OPEX 25

26. WENRA Reference Level J (2) 26 NoRL - Englisch 1 Programmes and Responsibilities 1.1The licensee shall establish and conduct a programme to collect, screen, analyse, and document operating experience and events at the plant in a systematic way. Relevant operational experience and events reported by other plants shall also be considered. 1.2Operating experience at the plant shall be evaluated to identify any latent safety relevant failures or potential precursors and possible tendencies towards degraded safety performance or reduction in safety margin. 1.3The licensee shall designate staff for carrying out these programmes, for the dissemination of findings important to safety and – where appropriate – for recommendations on actions to be taken. Significant findings and trends shall be reported to the licensee’s top management. 1.4Staff responsible for evaluation of operational experience and investigation into events shall receive adequate training, resources, and support from the line management. 1.5The licensee shall ensure that results are obtained, that conclusions are drawn, measures are taken, good practices are considered and that timely and appropriate corrective actions are implemented to prevent recurrence and to counteract developments adverse to safety.

27. 27 2 Collection and storage of information 2.1The information relevant to experience from normal and abnormal operation and other important safety-related information shall be organized, documented, and stored in such a way that it can be easily retrieved and systematically searched, screened and assessed by the designated staff. WENRA Reference Level J (3)

28. 28 NoRL - Englisch 3 Reporting and dissemination of safety significant information 3.1The licensee shall report events of significance to safety in accordance with established procedures and criteria. 3.2Plant personnel shall be required to report abnormal events and be encouraged to report internally near misses relevant to the safety of the plant. 3.3Information resulting from the operational experience shall be disseminated to relevant staff and shared with relevant national and international bodies. 3.4A process shall be put in place to ensure that operating experience of events at the plant concerned as well as of relevant events at other plants is appropriately considered in the training programme for staff with tasks related to safety. WENRA Reference Level J (4)

29. 29 NoRL - Englisch 1 Programmes and Responsibilities 4 Assessment and investigation of events 4.1An initial assessment of events important to safety shall be performed without delay to determine whether urgent actions are necessary. 4.2The licensee shall have procedures specifying appropriate investigation methods, including methods of human performance analysis. 4.3Event investigation shall be conducted on a time schedule consistent with the event significance. The investigation shall: - Establish the complete event sequence; - Determine the deviation; - Include direct and root cause analysis; - Assess the safety significance including potential consequences; and - Identify corrective actions. 4.4The operating organisation shall maintain liaison as appropriate with the organizations (manufacturer, research organization, designer) involved in design and construction, with the aims of feeding back information on operating experience and obtaining advice, if necessary, in case of equipment failures or abnormal events. 4.5As a result of the analysis, timely corrective actions shall be taken such as technical modifications, administrative measures or personnel training to restore safety, to avoid event recurrence and where appropriate to improve safety. WENRA Reference Level J (5)

30. 30 NoRL - Englisch 1 Programmes and Responsibilities 5 Review and continuous improvement of the OEF process 5.1Periodic reviews of the effectiveness of the OEF process based on performance criteria shall be undertaken and documented either within a self-assessment programme by the licensee or by a peer review team. WENRA Reference Level J (6)

31. Good Practices at GRS  GRS is a Technical Safety Organization and supports the Federal Ministry in the evaluation of operating experiences  All German reportable events are analyzed by GRS  GRS is the connection point to important international organizations regarding OPEX like  International Reporting System on operating experiences of IAEA and NEA (IRS)  International Nuclear and radiological Event Scale (INES) of IAEA  NEA/CNRA Working Group of Operating Experience (WGOE)  EU Clearinghouse on operating experiences 31

32. Main Sources of OPEX accessible to regulators in Germany German OPEX  Reportable Events of German NPP‘s  Reports of Operators  Other Information Foreign OPEX  IRS-Reports (IAEA/OECD Incident Reporting System – new name: International Reporting System for Operating Experience)  INES-Reports (International Nuclear and Radiological Event Scale)  Other Information (working groups, bilateral exchange etc.) 32

33. Licensing and Supervision of NPPs in Germany 33 Rulemaking super- vision of states Information exchange between states International exchange Licensing supervision Operation Design contruction RSK NPP state regulatorTÜV BMU BfS GRS state regulator NPP Vendor …

34. Since 1975 reporting of events based on Reporting Ordinance (AtSMV) Event reporting supports  Supervision of NPP  Systematic OPEX Feedback 34 Event reporting in Germany

35. Dissemination of reportable events in Germany 35 NPP State RegulatorTÜV BMU BfSGRS

36. Approach to evaluate OPEX may differ depending on  Souce of OPEX  Objectives  Intended use In the following described in more detail  Procedure for evaluation of reportable events by GRS  Basic procedure comparable in other organizations 36 Overview Event Evaluation

37. Event Evaluation in GRS 37

38. Event Evaluation Procedure in GRS (1) 38 Established Facts / Assessment by respective Department(s) Event Discussion: In-depth Analysis /Infor- mation Notice Required? Screening: Immediate Action required? Established Facts / Assessment Technical Opinion Yes No

39. Event Evaluation Procedure in GRS (2) 39 Trend analyses Quantitative data generation Precursor analyses Data Bases In-depth Analysis => Information Notice / Technical Opinion Paper => Generic Report Event Discussion: In-depth Analysis / Information Notice required? No Yes

40. Main objectives of OPEX in GRS Evaluation of events/ findings with respect to  safety significance  new insights Elimination of weaknesses Prevention of events 40

41. Identification of generic aspects e.g.  deficits in rules and regulation  deficiencies in methods and tool for safety justification  new phenomena not taken into account  common cause failure  deficiencies in safety management Investigation of applicability to other NPP  event, weaknesses or corrective actions relevant for other plants  recommendation of actions to be taken Dissemination of information notices and evaluation reports 41 Further objectives of OPEX in GRS

42. 42 „Screening“ 15 Information Notices 15 Information Notices 25 Technical Opinion Papers 25 Technical Opinion Papers 5 Generic Reports 5 Generic Reports Coding Data Storage 130 German + 60 foreign Events 130 German + 60 foreign Events 30 Events relevant for Safety Deliverables of OPEX in GRS

43. NPP Reported to Utility Reviewed by Utility Corrective Actions Utility Event at NPP Reported to WANO / INPO Reported to Regulator WANO/INPO IAEA/NEA Reviewed by world- wide NPPs Corrective Actions Reviewed by regulators / NPPs world-wide Verify corrective actions taken Reported to IRS 1000s1100 1000s 80 Safety Improves Use of International OPEX

44. Operational Safety of Nuclear Plants Benefits and performance of precursor's studies Dr. Michael Maqua, GRS September, 17, 2010 EC-TAIEX-INFRA 42192, Kiev

45. IAEA Safety Fundamentals 3.17. Despite all measures taken, accidents may occur. The precursors to accidents have to be identified and analysed, and measures have to be taken to prevent the recurrence of accidents. The feedback of operating experience from facilities and activities — and, where relevant, from elsewhere — is a key means of enhancing safety. Processes must be put in place for the feedback and analysis of operating experience, including initiating events, accident precursors, near misses, accidents and unauthorized acts, so that lessons may be learned, shared and acted upon. MAQUA-OPEX - Kiev 17.09.2010 45

46. GRS Precursor Studies  In its systematic evaluation of operating experiences the GRS performs precursor studies since 1993  Main goals of precursor studies are  Analysis of specific events with probabilistic methods to, determine the remaining safety margins  Continuous supervision of the safety level of German NPPs,  Identification of events with considerably reduced safety margins.  Basis of the analysis is the real event regarding the failures / unavailabilities as well as further circumstances and conditions  Precursor studies are performed if certain triggers are met 46

47. GRS Triggers for Precursor Studies  Precursors with initiating event  Precursors without initiating event (malfunctions of safety related components or safety systems)  Precursors with a potential initiating event (probability of initiating event significantly increased)  Precursors with potential common cause failures  If the estimated probability of hazard states is estimated to be lower than 10 -6 no analysis will be performed 47

48. Some Results of GRS Precursor Studies  More than 100 events have analyzed in the last 15 years from about 1600 event reports  Highest probability analyzed was 5.5 E-04  Average probability for hazard states about 10 -5 for all years 48

49. Effectiveness of Operating Experience Feedback 49

50. Have we learned from OPEX? 50 Source: IAEA PRIS TMI-2 Chernobyl-4

51. Thank you very much for your attention!