2011-03-17

Questions and answers about nuclear safety

Questions presented to Fortum regarding nuclear safety and the safety of the Loviisa nuclear power plant are included below along with the answers to them.

1) A serious nuclear power plant accident that has released radioactivity into the environment has occurred in Japan. How is it possible that this kind of accident has happened even though it was known that earthquakes can happen in Japan and that they can cause tsunamis?

Behind Japan’s nuclear power plant accident was the exceptionally strong and long-lasting earthquake that happened on Friday, 3 March 2011. According to the information in the media, the tsunami following the earthquake crippled a large part of the plants’ safety systems.
Risk assessment is an integral part of the design process of a nuclear power plant. The assessment is used to prepare for various internal and external threats potentially endangering the plant’s safety. Fortum does not have comprehensive information on the safety systems and design principles of the plants in Japan; therefore, at this point, it is impossible to evaluate all the factors that contributed to the accident.

2) Is it possible that a similar accident could happen in a Finnish nuclear power plant?

The nuclear power plant accident in Japan was caused by a very strong earthquake and the tsunami that followed. Due to Finland’s geographical location, a similar initiating event is impossible. Serious reactor accidents caused by other reasons are possible also in Finland, and comprehensive measures in preparation for such events have been undertaken at Finnish plants over several decades.

The Loviisa power plant has prepared for a wide range of internal and external hazards that could lead to reactor core damage. External hazards include e.g.:

- Earthquakes, although the risks are small in Finland due to low seismic activity
- Fires, analysing potential damage on a room-by-room basis
- Floods caused by pipe breakages and equipment malfunctions
- Strong winds, including tornadoes and downbursts
- High and low sea-water level
- Heavy algae concentration, frazil ice, and heavy or freezing snowfall as a single phenomenon and in conjunction with strong wind
- Oil transports
as well as many other events, taking into consideration also situations when the plant is not operating at full capacity or is in outage status.

3) What is the risk of an accident at Loviisa?

Based on a full scope risk analysis, the probability of reactor core damage of Loviisa’s number one unit is 4.6x10-5 per year, i.e. less frequent than once every 20,000 years. Fortum engages in continuous research and development work to lower the risk level further. Additionally, Loviisa’s power plant has a management strategy in place for a serious reactor accident so that core damage would not release emissions into the environment (see question 4).

4) How is Loviisa prepared for a severe reactor accident?

A severe reactor accident refers to an accident in which the nuclear power plant’s reactor core is fully or partially damaged. Severe reactor accidents were not included in the original design basis of the Loviisa power plant. As safety-awareness has evolved, the plant has been modernized and the plant has implemented a severe accident management strategy aiming to protect human health and safety and to prevent the long-term pollution of extensive land and water areas in the event of reactor core damage. Preparedness for severe accidents and their management is continuously maintained and developed.
 
Several management systems are used in management of severe accidents; the most important of these systems are described below.

CONTAINMENT BUILDING
The purpose of the containment building is to prevent the release of radioactive materials into the environment in an accident situation. The containment building can significantly mitigate the consequences of an accident, and that is why it is especially important that the integrity and leak-tightness of the containment building be maintained in an accident situation. It is critical to tightly close the pipelines and other lead-throughs penetrating the containment building.

PRIMARY CIRCUIT PRESSURE REDUCTION
The possibility of reducing pressure in the primary circuit is an essential safety function in severe accidents in situations where the reactor’s residual heat cannot be transferred normally to the secondary circuit. Reducing pressure in the primary circuit ensures successful cooling of the core and prevents the reactor pressure vessel from rupturing under high pressure.

CONTROLLED HYDROGEN REMOVAL
If the fuel rods overheat, a chemical reaction is initiated between the water and the cladding of the fuel rods; the chemical reaction produces a large amount of hydrogen. Hydrogen gas is directed from the reactor to the containment building e.g. through depressurization of the primary circuit or a possible leak. Hydrogen gas is explosive in high concentrations when it comes into contact with oxygen. If the hydrogen is not removed in a controlled manner throughout the accident, the integrity of the containment building can be jeopardized.

At the Loviisa power plant hydrogen generated in an accident situation is controlled with ice condensers, hydrogen recombiners and glow plugs (see question 8).

COOLING OF THE REACTOR PRESSURE VESSEL AND THE CONTAINMENT BUILDING
External cooling of the reactor pressure vessel ensures the integrity of the pressure vessel throughout the accident also in the event of a fuel meltdown. The core remnants are retained and cooled inside the pressure vessel, thus avoiding a loss of integrity of the containment building as a result of events related to a rupture in the reactor pressure vessel.
The containment building’s external spray system prevents damage to the containment building caused by excess pressure in a severe reactor accident. The containment building’s external spay system is powered by a separate diesel engine. If needed, fire engine equipment can be used to spray the containment building.

5) What happens if the connection to external power grid and the auxiliary diesel engines at Loviisa NPP are lost? What preparations have been made to cope in cases of disruptions to the power supply at Loviisa NPP?

Below is a description of how the power supply takes place at the Loviisa power plant in normal conditions, in malfunction situations, and the preparations made in case of a total loss of power supply.

POWER SUPPLY IN NORMAL OPERATING CONDITIONS
During the plant’s power operation, the electrical power needed for the plant’s own use and safety systems comes from the plant’s main generators. In other situations, electrical power can be taken from an external 400-kV or 110-kV grid. There are two connections to the 400-kV grid.

POWER SUPPLY IN MALFUNCTION SITUATIONS
If the power supply from the plant’s main generator and the external grid has been lost, the emergency diesel generators will start; each plant unit has four emergency diesel generators. The diesel generators also charge the batteries that provide the back-up power for the automation systems.

PREPARATIONS FOR TOTAL LOSS OF POWER SUPPLY
The plant has also prepared for a situation in which the power supply from the main generators, the external grid, and the emergency diesel generators has been lost. In this case, the power supply from the 110-kV grid can be substituted with the Fingrid gas turbine located in the plant area. The gas turbine eventually will be replaced with Fortum’s own diesel generator, which is under construction. Power can be supplied also from another plant unit. Additionally, there is the possibility to supply electricity for the plant’s safety systems from the nearby Ahvenkoski hydropower plant using a 20-kV power line reserved for this purpose.

For severe accidents, the plant also has two additional air-cooled diesel generators. They are placed in separate location from the seawater-cooled emergency diesel generators. These diesel generators can be used when needed also for charging all the batteries that are important for safety.

If necessary, the electric-power water pumps needed in the cooling of the reactor can be replaced also with fixedly installed diesel engine-powered pumps, which can also operate when all power supply to the plant has been lost.

6) How has Loviisa plant prepared for a sudden rise in the sea level? Could the sea level at Loviisa rise above the design bases? How have you ensured that the design bases are correct?

The elevation of Loviisa power plant yard area is +3.00 meters.

Studies show that the threat of a high sea level will not occur suddenly, it will be predictable. The occurrence of a high sea level at Loviisa requires heavy storms to rage in the North Sea for a long period of time – typically a couple of weeks – resulting in an exceptionally large volume of water flowing through the Strait of Denmark into the Baltic Sea. Strong south-western and western winds over the Baltic Sea, lasting several days, will have to push water from the central areas of the sea into the Gulf of Finland. If additionally there is high pressure over the Baltic Sea and low pressure over the Loviisa area, the pressure difference will raise the sea level at Loviisa. Spillover (the bathtub effect) of the water level in the Gulf of Finland can also raise the water level locally. The tidewater effect caused by the moon also has a small impact.

The Finnish Institute of Marine Research has estimated that, as a result of the above-mentioned phenomena, the maximum explainable water level at Loviisa is +213 cm. The Gudrun storm on 9 January 2005 raised the sea level at Loviisa to +177 cm, according to the Finnish Institute of Marine Research.

Because a high sea level can be predicted, the Loviisa plant has anticipatory sea-level monitoring and operating instructions in place in the event of high sea levels. Additionally, it has been agreed that the relevant authorities will provide the Loviisa power plant’s control room with a separate preliminary warning of a high sea level.

7) If the sea level rises more than three meters, what are the consequences?

Even if the seawater level were to rise somewhat over three meters and cover Hästholmen island, where the power plant is located, the reactor can be cooled using the diesel-powered pumps that do not require electricity. The probability of a sea level this high is very small. The Loviisa power plant is developing flood preparedness in the long-term.

The reactor core in both Loviisa power plant units is located 10 meters above sea level inside a gas- and water-tight containment building. Thus the seawater could not directly flood the interior of the containment building.

8) How has Loviisa prepared for hydrogen diffusion?

Loviisa has prepared for a situation in a severe accident in which a lot of hydrogen gas can be generated in the reactor core when the fuel cladding overheats and reacts with steam. Hydrogen control at Loviisa is based on hydrogen removal using different means as effectively as possible as soon as it has been released into the containment building.

Hydrogen gas is directed from the reactor to the containment building e.g. through depressurization of the primary circuit or a possible leak. Hydrogen gas is explosive in high concentrations when it comes into contact with oxygen. If the hydrogen is not removed in a controlled manner throughout the accident, the integrity of the containment building can be jeopardized.

At the Loviisa power plant hydrogen generated in an accident situation is controlled with ice condensers, hydrogen recombiners and glow plugs. In exceptional situations, the ice condensers are used to mix the hydrogen accumulated in the containment building into the large air volume within the containment building; at the same time, the pressure in the containment building decreases when the ice melts.

The hydrogen mixed in the air space of the containment building is removed in a controlled manner with hydrogen recombiners installed in the containment building. Hydrogen and oxygen react chemically in the hydrogen recombiners, forming water and heat from the hydrogen and the oxygen contained in the air. Hydrogen recombiners are completely passive and operate without electricity or control systems.

The containment building also has a separately installed glow-plug system, which can be used in situations where the generation of hydrogen is momentarily and locally so strong that mixing it with oxygen and the recombining of hydrogen cannot guarantee sufficiently low concentrations of hydrogen. With the glow plugs, locally high concentrations of hydrogen can be burned in a controlled manner without jeopardizing the integrity of the containment building.

9) Why don’t the old reactors have to fulfil the same safety requirements as the new ones?

Authorities define the safety requirements for nuclear power plants. The authority in Finland is the Finnish Radiation and Nuclear Safety Authority (STUK). The requirements are based on comprehensive risk analyses and are set at an acceptable risk level based on the best available information. Safety requirements have been further tightened over the years. It is practically impossible to realize all the requirements set for new plants in the old plants. However, the plant’s safety systems have been improved in many ways over the years.

10) What kinds of safety improvements have been made at Loviisa over the years?

As described in the answer to question 4, numerous plant modifications have been made at the Loviisa power plant to manage severe accidents. Some other examples of safety improvements made over the years include:
- Cooling system upgrades for instrumentation spaces
- New floor drain filters in the containment building
- New primary safety valves
- Risk of core damage caused by flooding has been reduced by raising the height of the flood threshold, preventing seawater from reaching the lower spaces of the reactor building in the event of flooding in the turbine hall
- Securing the heat sink
- Back-up residual heat removal system
- Securing cooling for diesel generators
By implementing these and similar measures, it has been possible to continuously reduce the plant’s core damage frequency, as shown in the illustration below:

Loviisa 1: Relative decrease in the probability of a severe reactor accident as a result of safety improvements

 
 
11) How is Fortum’s Loviisa power plant monitored?

The Finnish Radiation and Nuclear Safety Authority (STUK) continuously monitors the operation of the Loviisa power plant. STUK has appointed a local inspector for the power plant; the inspector works at the plant permanently, monitoring and supervising the operations at Loviisa. Additionally, Fortum provides STUK with e.g. a daily 24-hour report on the plant’s operations. There are hundreds of radiation monitoring stations in and around the plant. All radioactivity analyses of environmental samples are done at STUK’s environmental laboratory. In all, about 500 radioactivity analyses are done annually at STUK’s laboratory in addition to the power plant’s own, continuous radiation measurements and the dose measurements done on individuals. STUK requires extensive intermediate safety assessments as a part of the operating licence.

Loviisa power plant operations are also monitored by the European Atomic Energy Community (Euratom) and the International Atomic Energy Agency (IAEA). They particularly monitor the handling of nuclear material at the plant. Power companies also carry out peer reviews to share best practices.

12) How has the Loviisa nuclear power plant prepared for oil accidents?
 
The Loviisa power plant has prepared for oil accidents on the Gulf of Finland. The measures to be implemented at the plant depend on the plant’s operational status and the location of the oil spill. If needed, the plant in operating status is shut down and the cooling water intake is switched to the discharge side, which is on the opposite side of the island on which the power plant is located.

In the event of a major oil spill, oil can reach also this water intake location. In this case, it is possible to switch to use of the plant site internal cooling water circulation. It is possible to continue with this cooling method for about 24 hours.

The water in internal cooling circulation will gradually heat up. If it is still not possible to take cooling water from the sea, the plant can be cooled by releasing clean steam from the secondary circuit into the atmosphere. This can be continued for several days without the need for additional water. If the problem situation were to continue, clean water could be transported to the plant. About 20 cubic meters of water per hour is needed.

If the plant is going through an annual outage when an oil accident occurs, the need for cooling water is inherently smaller. In this case, the same measures are used up to the internal cooling circulation. Releasing steam can’t be used in all phases of the annual outage, but the measure can be taken into use in approximately 24 hours, regardless of the phase of the annual outage.

If, in spite of all the cautionary measures, oily seawater has entered the cooling systems, the plant must be cooled using the above-described release of steam into the atmosphere, and the necessary cleaning measures must be initiated.

As part of the long-term safety improvements, Fortum is designing a parallel cooling system for the seawater cooling. This will further improve safety, particularly during plant outages, in the event of oil spills and also e.g. heavy algae concentrations.