160 angra 2 (fu) - international atomic energy agency mission to angra 2_mar...the angra 2 osart...
TRANSCRIPT
NSNI/OSART/160/011
ORIGINAL: English
DIVISION OF NUCLEAR INSTALLATION SAFETY
OPERATIONAL SAFETY REVIEW MISSION
IAEA-NSNI/OSART/160/011
REPORT
OF THE
OSART (OPERATIONAL SAFETY REVIEW TEAM)
MISSION
TO THE
ANGRA 2
NUCLEAR POWER PLANT
BRAZIL
28 March – 14 April 2011
PREAMBLE
This report presents the results of the IAEA Operational Safety Review Team (OSART)
review of Angra 2 Nuclear Power Plant, Brazil. It includes recommendations for
improvements affecting operational safety for consideration by the responsible Brazilian
authorities and identifies good practices for consideration by other nuclear power plants. Each
recommendation, suggestion, and good practice is identified by a unique number to facilitate
communication and tracking.
Any use of or reference to this report that may be made by the competent Brazilian
organizations is solely their responsibility.
FOREWORD
by the
Director General
The IAEA Operational Safety Review Team (OSART) programme assists Member States to
enhance safe operation of nuclear power plants. Although good design, manufacture and
construction are prerequisites, safety also depends on the ability of operating personnel and
their conscientiousness in discharging their responsibilities. Through the OSART programme,
the IAEA facilitates the exchange of knowledge and experience between team members who
are drawn from different Member States, and plant personnel. It is intended that such advice
and assistance should be used to enhance nuclear safety in all countries that operate nuclear
power plants.
An OSART mission, carried out only at the request of the relevant Member State, is directed
towards a review of items essential to operational safety. The mission can be tailored to the
particular needs of a plant. A full scope review would cover nine operational areas:
management, organization and administration; training and qualification; operations;
maintenance; technical support; operating experience feedback; radiation protection; chemistry;
and emergency planning and preparedness. Depending on individual needs, the OSART review
can be directed to a few areas of special interest or cover the full range of review topics.
Essential features of the work of the OSART team members and their plant counterparts are the
comparison of a plant's operational practices with best international practices and the joint
search for ways in which operational safety can be enhanced. The IAEA Safety Series
documents, including the Safety Standards and the Basic Safety Standards for Radiation
Protection, and the expertise of the OSART team members form the bases for the evaluation.
The OSART methods involve not only the examination of documents and the interviewing of
staff but also reviewing the quality of performance. It is recognized that different approaches are
available to an operating organization for achieving its safety objectives. Proposals for further
enhancement of operational safety may reflect good practices observed at other nuclear power
plants.
An important aspect of the OSART review is the identification of areas that should be improved
and the formulation of corresponding proposals. In developing its view, the OSART team
discusses its findings with the operating organization and considers additional comments made
by plant counterparts. Implementation of any recommendations or suggestions, after
consideration by the operating organization and adaptation to particular conditions, is entirely
discretionary.
An OSART mission is not a regulatory inspection to determine compliance with national safety
requirements nor is it a substitute for an exhaustive assessment of a plant's overall safety status,
a requirement normally placed on the respective power plant or utility by the regulatory body.
Each review starts with the expectation that the plant meets the safety requirements of the
country concerned. An OSART mission attempts neither to evaluate the overall safety of the
plant nor to rank its safety performance against that of other plants reviewed. The review
represents a `snapshot in time'; at any time after the completion of the mission care must be
exercised when considering the conclusions drawn since programmes at nuclear power plants
are constantly evolving and being enhanced. To infer judgements that were not intended would
be a misinterpretation of this report.
The report that follows presents the conclusions of the OSART review, including good
practices and proposals for enhanced operational safety, for consideration by the Member
State and its competent authorities.
CONTENT
INTRODUCTION AND MAIN CONCLUSIONS ................................................................... 1�
1.� MANAGEMENT, ORGANIZATION AND ADMINISTRATION.................................. 3�
2.� TRAINING AND QUALIFICATIONS ........................................................................... 11�
3.� OPERATIONS ................................................................................................................. 15�
4.� MAINTENANCE ............................................................................................................ 23�
5.� TECHNICAL SUPPORT ................................................................................................ 36�
6.� OPERATING EXPERIENCE FEEDBACK .................................................................... 41�
7.� RADIATION PROTECTION .......................................................................................... 49�
8.� CHEMISTRY .................................................................................................................. 53�
9.� EMERGENCY PLANNING AND PREPAREDNESS .................................................. 67�
DEFINITIONS ......................................................................................................................... 89�
LIST OF IAEA REFERENCES (BASIS) ................................................................................ 91�
TEAM COMPOSITION OF THE OSART MISSION ............................................................ 94�
INTRODUCTION AND MAIN CONCLUSIONS1
INTRODUCTION AND MAIN CONCLUSIONS
INTRODUCTION
At the request of the government of the Republic of Brazil, an IAEA Operational Safety Review
Team (OSART) of international experts visited Angra 2 Nuclear Power Plant from 28 March –
14 April 2011. The purpose of the mission was to review operating practices in the areas of
Management organization and administration; Training and qualification; Operations;
Maintenance; Technical support; Operating Experience; Radiation protection; Chemistry;
Emergency planning and preparedness; and safety culture. In addition, an exchange of technical
experience and knowledge took place between the experts and their plant counterparts on how
the common goal of excellence in operational safety could be further pursued.
The two units on the site are operated by Eletronuclear. The first unit is a 640 MWe, PWR
supplied by Westinghouse. Unit 1 was put into commercial operation in January 1985. The
second Unit is a 1350 MWe supplied by Siemens/KWU. Unit 2 was put into commercial
operation in February 2001. There are approximately 650 permanent workers on the site.
The Angra 2 OSART mission was the 160th
in the programme, which began in 1982. The team
was composed of experts from Armenia, Belgium, Canada, France, Hungary, Russia, Sweden,
the United Kingdom, and together with the IAEA staff members and observers from China and
South Africa. The collective nuclear power experience of the team was approximately 317
years.
Before visiting the plant, the team studied information provided by the IAEA and the Angra
plant to familiarize themselves with the plant's main features and operating performance, staff
organization and responsibilities, and important programmes and procedures. During the
mission, the team reviewed many of the plant's programmes and procedures in depth, examined
indicators of the plant's performance, observed work in progress, and held in-depth discussions
with plant personnel.
Throughout the review, the exchange of information between the OSART experts and plant
personnel was very open, professional and productive. Emphasis was placed on assessing the
effectiveness of operational safety rather than simply the content of programmes. The
conclusions of the OSART team were based on the plant's performance compared with good
international practices.
The following report is produced to summarize the findings in the review scope, according to
the OSART Guidelines document. The text reflects only those areas where the team considers
that a Recommendation, a Suggestion, an Encouragement, a Good Practice or a Good
Performance is appropriate. In all other areas of the review scope, where the review did not
reveal further safety conclusions at the time of the review, no text is included. This is reflected
in the report by the omission of some paragraph numbers where no text is required.
MAIN CONCLUSIONS
The OSART team concluded that the managers of Angra 2 NPP are committed to improving the
operational safety and reliability of their plant. The team found good areas of performance,
including the following:
INTRODUCTION AND MAIN CONCLUSIONS2
− the plant established a programme to have Senior Reactor Licensed Engineers in
departments other than the operations department
− The plant has set-up an efficient evacuation process in case of emergency
A number of proposals for improvements in operational safety were offered by the team. The
most significant proposals include the following:
− The plant should fully implement an integrated management system
− The organisation should implement a timely procurement process which will support the
safe operation.
− The plant should improve its oversight and implementation of operating activities to
support high performance in the conduct of operations
− The plant should develop a comprehensive ageing management programme in order to
ensure the continued reliability of important systems, structures and components.
Angra 2 NPP management expressed a determination to address the areas identified for
improvement and indicated a willingness to accept a follow up visit in about eighteen months.
MANAGEMENT, ORGANIZATION AND ADMINISTRATION 3
1. MANAGEMENT, ORGANIZATION AND ADMINISTRATION
1.1. ORGANIZATION AND ADMINISTRATION
There are sufficient resources at the plant to conduct routine plant activities, to
respond to plant challenges and to deal with requests for assistance. New staff were
recruited since 2010 due to the restart of construction of Angra 3, a majority of which
are trained in Angra 2. The staffing policy is directed at retaining a pool of
experienced and knowledgeable staff. Moreover, since 2004, the plant has established
a programme to have senior reactor licensed engineers in departments other than the
operations department. The team considers this as a good practice.
1.3. MANAGEMENT OF SAFETY
Indicators are used to monitor the performance of the plant. According to these
indicators, Angra 2 was the front runner in 2009 when compared to the equivalent
plants in Germany. However, these indicators are not sufficient to give management
an in-depth overview of plant performance.
The plant is managed through several dedicated meetings. The rules are established
with a set of procedures but some aspects are not precisely described. The
communication is based on informal inter-relations between managers and staff. Also,
there are no formal tools to recognize and appreciate the contribution of individuals
and groups in the achievement of their tasks. There is no separate line department to
give an independent safety status of plant operation and to verify the operational
safety analysis. The above considerations indicate that there is a lack of an integrated
management system. The team made a recommendation in this area.
Ineffective procurement results in a large maintenance backlog, temporary
modifications and a lack of spare parts. This weakness already has affected the
operation of the plant and could compromise safety. The team made a
recommendation in this area.
1.5. INDUSTRIAL SAFETY PROGRAMME
The industrial safety behaviours and indicators are not overly advertised or
communicated on the plant. In the field, some safety rules, procedures and instructions
are not clearly stated or strictly adhered to. Managers and staff should consider
undertaking field observations with respect to industrial safety. Reports are issued
when a threshold is reached for a category of events. These reports are not widely
communicated to the staff and contractors. The team developed a suggestion in this
area.
MANAGEMENT, ORGANIZATION AND ADMINISTRATION 4
DETAILED MANAGEMENT, ORGANIZATION AND ADMINISTRATION
FINDINGS
1.1. ORGANIZATION AND ADMINISTRATION
1.1(a) Good Practice: In 2004, the plant established a programme to have Senior Reactor
Licensed Engineers in departments other than the operations department. This programme
supports the safe operation of the plant and improves the plant knowledge of line managers and
engineers.
Currently there are nine licensed engineers in the following departments:
− two in system and reactor performance department;
− two in work control division;
− four in maintenance superintendence; and
− one in support engineering superintendence.
These engineers support their departments with the license training knowledge and assist in
the decision making process with regard to the safe operation of the plant.
MANAGEMENT, ORGANIZATION AND ADMINISTRATION 5
1.3. MANAGEMENT OF SAFETY
1.3 (1) Issue: An effective integrated management system is not implemented at the plant.
Several elements of a management system were identified at the plant, however the following
facts were observed by the team:
− There is no integrated formal way to monitor safety performance and to obtain an
overview of departmental performance:
� There are no trends of low level indicators (e.g. break of hand, leg injuries,
etc) to assist in improving overall industrial safety,
� There are no performance indicators for the Quality/Safety level of spare
parts related to the preventive maintenance backlog,
� Performance indicators for materials management are not available,
� There are no performance indicators for the outage preparation phase,
� Absence of performance indicators used by the emergency planning and
preparedness (EPP) staff to drive their actions, activities and priorities.
− Job descriptions do not exist for some disciplines e.g. EPP and engineering
− Required qualification (knowledge, skills and competencies) is not defined for some
disciplines e.g. Emergency Response Organisation (ERO) members
− There is no extensive system of staff recognition in the plant and there is no strategy to
maintain or enhance workers motivation.
− There is a requirement at the plant to perform periodic self-assessments at the
management levels but no evidence has been shown in some departments since 2009.
Without a fully effective integrated management system in place, the management for safety
can be compromised.
Recommendation: The plant should fully implement an integrated management system.
IAEA Basis
GS-R-3:
2.1. A management system shall be established, implemented, assessed and continually
improved. It shall be aligned with the goals of the organization and shall contribute to their
achievement. The main aim of the management system shall be to achieve and enhance safety
by:
− Bringing together in a coherent manner all the requirements for managing the
organization;
− Describing the planned and systematic actions necessary to provide adequate
confidence that all these requirements are satisfied;
MANAGEMENT, ORGANIZATION AND ADMINISTRATION 6
− Ensuring that health, environmental, security, quality and economic requirements
are not considered separately from safety requirements, to help preclude their
possible negative impact on safety.
3.1. Management at all levels shall demonstrate its commitment to the establishment,
implementation, assessment and continual improvement of the management system and shall
allocate adequate resources to carry out these activities.
MANAGEMENT, ORGANIZATION AND ADMINISTRATION 7
1.3(2) Issue: The unavailability of spare parts and an ineffective procurement process could
compromise the continued safe operation.
The plant has tried to improve the efficiency of the procurement process. However, the
following facts were observed:
− There is a number of outstanding orders for safety/quality spare parts.
− There are a number of temporary modifications (SMTs) in place due to spare parts
unavailability, some of them using spare parts of differing quality level. Six of these
SMTs are related to the unavailability of safety related equipment spare parts, one of
which is in existence for over two years.
− There are a number of critical spare parts (classified as important to safety) that are in the
warehouse in quantities below the required minimum.
− Spare parts reserved for outage have been used for emergent defects on the plant.
− There are delayed safety-related tasks and a large backlog of maintenance due to the
backlog of spare parts and procurement.
− The maintenance overhaul for the 480V Emergency Diesel Generator Set 2 – 7XJ/XK
was postponed for approximately two years due to spare parts unavailability.
− The above same diesel was isolated to resolve a start time problem. As the engine stayed
inoperable for more than 14 days owing to lack of suitable spare parts, the Unit was
shutdown in accordance with the Technical Specification. This transient could have been
avoided if the overhaul was performed in due time.
− Local suppliers are chosen on a lowest cost bases (Federal Rule 8666).
− Angra 2 demineralizer supports Angra 1 and vice versa. Planned modifications to
improve both demineralizer plants are still pending due to administrative and financial
difficulties.
− The equipment for Total Organic Carbon measurement in demineralised water is out of
order for more than eight months, because of problems with the supplier and services
provider.
− Problems exist with purchasing materials, reagents, equipment over the value of 16.000.-
Rs due to a bureaucratic acquisition process. It was identified as an area for improvement
by the self-assessment of chemistry in 2009.
Without an appropriate procurement process in place, it could lead to unnecessary transients
on the plant or degradation of the safety of the plant.
Recommendation: The organisation should implement a timely procurement process which
will support safe operation and ensure the ready availability of safety related spare parts.
MANAGEMENT, ORGANIZATION AND ADMINISTRATION 8
IAEA Basis
GS-R-3
4.1. Senior management shall determine the amount of resources necessary and shall provide
the resources to carry out the activities of the organization and to establish, implement, assess
and continually improve the management system.
(‘Resources’ includes individuals, infrastructure, the working environment, information and
knowledge, and suppliers, as well as material and financial resources).
GS-G-3.5:
4.21. Inventories of material such as consumables and spare parts should be maintained at
appropriate levels, with due recognition of the fact that safety takes priority over economic
considerations.
NS-G-2.3:
6.3. The number of temporary modifications should be kept to a minimum. A time limit
should be specified for their removal or conversion into permanent modifications.
7.20. The list of spare parts to be kept in stores should be reviewed and updated as a
consequence of a modification, so that the necessary new spare parts will be procured and
those spare parts that no longer conform will be modified or disposed of.
ILO-OSH 2001 Guidelines:
3.10.4.1. Procedures should be established and maintained to ensure that:
(a) compliance with safety and health requirements for the organization is identified,
evaluated and incorporated into purchasing and leasing specifications;
(b) national laws and regulations and the organization's own OSH requirements are
identified prior to the procurement of goods and services; and
(c) arrangements are made to achieve conformance to the requirements prior to their
use.
MANAGEMENT, ORGANIZATION AND ADMINISTRATION 9
1.5 INDUSTRIAL SAFETY PROGRAMME
1.5(1) Issue: The communication and enforcement practices of all aspects of industrial safety
to plant staff and contractors are not sufficient.
There are achievements in the area of industrial safety but the expectations, analyses and
results are not sufficiently promoted to site personnel and contractors.
The team noted the following facts:
− Initial safety briefing gives limited information on industrial safety and fire protection
(e.g. no information is given concerning the weekly test of the 2 emergency signals).
− The basic manual of industrial safety, issued as a booklet, is not given during the initial
safety briefing.
− There is no clear requirement to wear ear protection in the mechanical workshop even
when very loud activities are ongoing.
− There is an inconsistent use of safety hats in the mechanical workshop due to unclear
rules.
− Several tasks were observed to be undertaken without a work order.
− A worker without safety goggles in the mechanical workshop used compressed air to
clean clothes despite a visible sign stating that it was forbidden to clean the clothes in
such a manner.
− An electrical machine was energized with wires (no plug).
− Metal grating connector left near open gap on top of the turbine hall with a possible risk
of it falling down and injuring people or components.
Without extensive communication and enforcement of industrial safety practices, the risk of
injury may increase.
Suggestion: The plant should consider strengthening its communication and enforcement of
all aspects of industrial safety to plant staff and contractors.
IAEA Basis
GS-R-3:
5.26. Information relevant to safety, health, environmental, security, quality and economic
goals shall be communicated to individuals in the organization and, where necessary, to other
interested parties.
MANAGEMENT, ORGANIZATION AND ADMINISTRATION 10
ILO-OSH 2001 Guidelines:
3.6.1. Arrangements and procedures should be established and maintained for:
(a) receiving, documenting and responding appropriately to internal and external
communications related to OSH;
(b) ensuring the internal communication of OSH information between relevant levels
and functions of the organization; and
(c) ensuring that the concerns, ideas and inputs of workers and their representatives on
OSH matters are received, considered and responded to.
3.9.1. Consistent with the OSH policy and based on the initial or subsequent reviews,
measurable OSH objectives should be established, which are:
(a) specific to the organization, and appropriate to and according to its size and nature
of activity;
(b) consistent with the relevant and applicable national laws and regulations, and the
technical and business obligations of the organization with regard to OSH;
(c) focused towards continually improving workers' OSH protection to achieve the
best OSH performance;
(d) realistic and achievable;
(e) documented, and communicated to all relevant functions and levels of the
organization; and
(f) periodically evaluated and if necessary updated.
TRAINING AND QUALIFICATION 11
2. TRAINING AND QUALIFICATIONS
2.2. TRAINING FACILITIES, EQUIPMENT AND MATERIAL
The simulator does not fully replicate the Main Control Room (the simulator has 39 panels as
opposed to 46 in the Main Control Room), but measures are in place to compensate for these
differences. Existing procedures do not require periodic review, timely modification, and
updating of training facilities and materials. The team developed a recommendation in this
area.
2.3. QUALITY OF THE TRAINING PROGRAMME
The plant controls the dissemination of information on modifications among the instructors,
but it is not done formally. This could result in some of the instructors not being aware of the
modifications implemented.
Continuing training/retraining is not consistently implemented on a regular basis across all
the departments of the plant and a suggestion was developed by the team in this area.
TRAINING AND QUALIFICATION 12
DETAILED TRAINING AND QUALIFICATION FINDINGS
2.2 TRAINING FACILITIES, EQUIPMENT AND MATERIAL
2.2(1) Issue: There is no requirement in the existing procedures to upgrade the simulator
and training material on a timely and periodic basis.
The team observed the following inconsistencies:
− Modification NDS 59 issued 29/06/2007 is not yet implemented on the
simulator (Reactor Protection System)
− The training material SEAE/SEEE 0466/0467 has not been updated/reviewed
since 11/2006
− The training material KBA 0417 has not been updated/reviewed since 12/2007
− The training material KBE 0421 has not been updated/reviewed since
30/08/2002
− The training material LKG 1468.1 has not been updated/ reviewed since
09/2004 and it has two different figures with the same nomenclature.
Without a periodic review, timely modification and updating of training facilities and
materials to ensure that they accurately reflect all modifications and changes made to
the plant, the training could cause operational errors that could compromise safety.
Recommendation: The plant should develop and implement requirements for the
periodic review and timely modification and updating of all training facilities and
materials.
IAEA Basis:
NS-R-2
3.11. Representative simulator facilities shall be used for the training of operating
personnel….
3.13. A programme shall be put in place to assess and improve the training programmes. In
addition, a system shall be in place for timely modification and updating of the training
facilities and materials to ensure that they accurately reflect plant conditions.
NS-G-2.8; para 6.7: A procedure should be in place for the periodic review and timely
modification and updating of training facilities and materials, to ensure that they 2.3
TRAINING AND QUALIFICATION 14
2.3. QUALITY OF THE TRAINING PROGRAMMES
2.3(1) Issue: Continuing training/retraining is not consistently implemented on a regular basis
in some departments.
− There are no requirements in the Engineering and Chemistry departments as well
as in Internal Operating Experience (IOE) and Emergency Planning (EP) groups
(except for Emergency Response Organization [ERO] members) to undertake
retraining except general employee training on a regular basis
− Retraining of the staff in the Engineering Department was not performed in 2009-
2010 and thirteen people did not participate in the retraining performed in 2008
− During the period from 2008 to 2010, only two out of eighteen people were
trained in the Chemistry Department (as a result of events associated with their
activity)
− One out of three IOE staff did not receive retraining in the last five years
− One out of three EP staff, who do not belong to the ERO, have not received
retraining for the last two years
Without regular refresher training, staff could lose competence and as a consequence
make errors in executing work associated with safety.
Suggestion: Consideration should be given to provide continuing training/retraining
on a regular basis to all departments.
IAEA Basis:
NS-G-2.8;
4.22: Comprehensive training should comprise initial training and continuing training
or retraining... Continuing training should be provided for all persons throughout their
working life, as it is necessary to ensure that their knowledge, skills and attitudes are
maintained current in both theory and practice. Continuing training should also be
directed to the permanent improvement of skills and attitudes which is necessary for
safety related activities... The training programme for every individual should define
the contents of the initial training, continuing training or retraining...
4.23. Initial and continuing training for all employees of the operating organization,
including plant personnel, should include general employee training (see para. 4.43) as
well as training for a thorough understanding of their particular duties and
responsibilities and of their contribution to the safe and efficient operation of the
organization’s plant.
4.29. Continuing training should be carried out on a regular basis...
OPERATIONS 15
3. OPERATIONS
3.4. CONDUCT OF OPERATIONS
Conduct of operations in the plant does not fully meet international standards. The conduct
of operations plant manual expects clear and correct logging of shift routines; important plant
parameters; field operator surveillance results; and compliance with the Limiting Conditions
for Operation. The team observed several non-compliances to these expectations such as the
shift handover and some operating procedures were not carried out in accordance with the
plant expectations. The use of error prevention tools such as pre-job briefings were also
observed to be less than adequate. The team has made a recommendation in this area.
3.5. WORK AUTHORIZATIONS
The plant does not have an adequate integration of its work control process between
departments and there are gaps in ownership. The planning, preparation, evaluation and
review of some isolations and post-maintenance qualification controls are not performed
adequately. Operations staff did not demonstrate adequate control and overview of the safety
tags on some occasions. Handwritten modifications without appropriate peer checking are
condoned. The team has made a suggestion in this area.
3.6. FIRE PREVENTION AND PROTECTION PROGRAMME
The plant has implemented a comprehensive fire risk assessment analysis. Procedures control
temporary fire hazards at the job site, however the team observed fire loads in the turbine hall
and the UPQ building in contravention of these procedures. The plant does not fully control
its fire protection systems such as fire barriers, fire doors and penetrations to the required
standards. The team observed a number of defects in fire protection systems that were not
reported and analyzed. The team has made a recommendation in this area.
3.7. MANAGEMENT OF ACCIDENT CONDITIONS
The plant has robust procedures and training in place for accident conditions. Event and
symptom based emergency procedures are implemented. In addition, accident procedures
(chapter 3-5.1; 3-5.2; 3-5.3) concerning different earthquake scenarios are in place. The plant
has no Severe Accident Management Guidelines (SAMGs). However, the plant has recently
initiated a contract with a supplier to provide SAMGs within 3 years. In addition, actions
have been taken after the Fukushima event in order to assess and evaluate the Angra 2 NPP
resilience to a range of situations (effect of landslides or prolonged loss of electrical power or
ultimate heat sink). The team encourages the plant to continue this approach and use SAMG
procedures as per NS-G-2.15.
OPERATIONS 16
DETAILED OPERATIONS FINDINGS
3.4 CONDUCT OF OPERATIONS
3.4(1) Issue: The plant´s implementation and oversight of various types of activities
contributing to the conduct of operations is not at the expected standards.
− Shift logging of Operational Limits and Conditions and oversight of significant
tasks is missing in several cases. For example:
1. the logging of CLO 66/11 was missing for 2 shifts on 18/03/11.
2. Shift log 1362 failed to note new reactor power and generator power
following power change.
− Pre job briefs for significant high hazard tasks on the 150 bar compressed air
system for the generator load break switch (BAC23AA025) works were unclear,
interrupted halfway through and did not confirm that all the work party understood
a test schedule change.
− The oversight of field operator tours by shift supervisors does not identify
significant issues with surveillance and monitoring of plant. For example Inverter
BRU40, Rectifier BTP40, BARAMENTO 48/24 voltages were out of specified
values on operator inspections sheets but no operator noting of this or shift
supervisor follow up was evident or recorded.
− Review of outage technical specification for Boron sampling; surveillance
requirement 16.3.9.1.2 dated 28/11/2010 requires comparison of channels
JKT01CX051C and JKT01CX053C which indicate neutron flux. The procedure
results have an out of spec parameter for neutron flux (10% versus 4%), the
acceptance criteria are ambiguous and there was no noting or challenge by
operator, supervisor or technical department.
− The reviewers observed on several occasions that the main control room was noisy
due to shouting and conversations, the maximum 15 persons allowed in the
control room is not always respected and the rules for room entry are not always
followed, e.g. hard hats were worn in the control room near the panels and the
public address system was not isolated, as required by procedures, at the start of a
fire drill.
If a high level performance of operations is not established then the safe operation of the
plant can be compromised.
Recommendation: The plant should improve its oversight and implementation of
operating activities to support a high performance in the conduct of operations.
OPERATIONS 17
IAEA Basis:
NS-R-2
3.13. A programme shall be put in place to assess and improve the training programmes. In
addition, a system shall be in place for timely modification and updating of the training
facilities and materials to ensure that they accurately reflect plant conditions.
NS-G-2.14
4.12. Operators should consider the level of complexity of any activity and their own level of
familiarity with the activity prior to performing it. In the case of complex or infrequently
performed tasks, the shift supervisor should be involved in the decision to perform the
activity and should ensure that an adequate pre-job briefing is conducted. If, after the pre-job
briefing has been performed, the operator does not feel confident that the activity can be
conducted safely and efficiently, the activity should not be commenced and, with the
involvement of the operations management, other options should be sought.
NS-G-2.14
4.16. All important information about the plant status, the work in progress and the plant
evolutions in the previous shift should be transferred and documented properly in the course
of the shift turnover. This information should include a joint check of systems in which the
incoming and outgoing operators walk down the control panels and jointly read checklists,
log books, records and messages to familiarize themselves adequately with the status of
systems and equipment.
NS-G-2.14
4.29. The management’s expectations with regard to performance in the control room should
be established and operators should be trained to meet these expectations. These expectations
should be made clear and managers should ensure that all operators understand them.
Managers should continuously monitor the performance of operators in fulfilling the
management’s expectations.
NS-G-2.14
4.35. Personnel assigned the task of carrying out rounds should be made responsible for
verifying that operating equipment and standby equipment operate within normal parameters.
They should take note of equipment that is deteriorating and of factors affecting
environmental conditions, such as water and oil leaks, burned out light bulbs and changes in
building temperature or the cleanness of the air. Any problems noted with equipment should
be promptly communicated to the control room personnel and corrective action should be
initiated.
OPERATIONS 18
NS-G-2.14
6.4. Management should establish rules and processes to ensure normal working conditions
for control room operators. Consideration should be given to the following:
—Conversations not relating to plant operations and their support should be minimized;
—Discussions not relating directly to the operation of equipment should be conducted in
subdued tones;
—Telephone calls to and from the control room should be limited in subject matter to topics
relating to current plant operations;
—The use of public address systems at the plant should be closely controlled by personnel in
the main control room and should usually be limited to conveying information on the status of
the plant;
—Communications by hand-held radio between field operators and operators in the main
control room should be short and concise. For instance, radios should be used for the initial
call-up and the call should then be switched to telephones where possible;
—The use of radio receivers, computers and other electronic devices for purposes relating to
anything other than plant operations (e.g. for entertainment) should be limited or prohibited.
OPERATIONS 19
3.5 WORK AUTHORIZATION
3.5(1) Issue: The work control and authorization process of the plant is not fully effective.
During the review the team noted the following facts:
− The planning, preparation, evaluation and review of isolations and tasks are not
adequate. For example, insufficient and inadequate tag lists were about to be
placed on a 150 bar compressed air system (work item LT200912494). Last
minute check by shift supervisor prevented this.
− A task that was ongoing on redundancy train 10 (LT201107169) which was visible
on the work control panel near the entrance to the Main Control Room was not
identified by the night shift and, as a consequence, this task was allowed to
continue in parallel with a task on train 40 thereby potentially compromising
defence in depth.
− Tag lists are not adequately controlled and are modified without double checking,
e.g. work items LT201100834 and LT2011014208.
− Post maintenance checks identified in the work permit BAC023AA035 were not
appropriate to allow confirmation that there were no leaks on the system.
If the plant does not apply an effective work control and authorization system, the safe
execution of work on the plant may be compromised.
Suggestion: The plant should consider improving the effectiveness of its work
control and authorisation process.
IAEA Basis:
NS-G-2.14
7.4. The work control process should ensure adequate interfaces between all work groups.
Operations personnel should assist the maintenance department in the planning and execution
of work on plant systems and components to ensure that the reliability and availability of
equipment are optimized. By doing this, operations personnel will be better able to assess the
risk when equipment is inoperable and the period of unavailability of important items of
equipment due to maintenance will be reduced.
7.5. The work control process should be used to ensure that operations personnel, in
particular the operators in the main control room, are aware of and have approved the work in
the plant and are maintaining correct control of the plant configuration. The process should
further be used to ensure that operations personnel are aware of all the expected effects of the
work performed, including alarms and changes to the functioning of systems
OPERATIONS 20
3.6 FIRE PREVENTION AND PROTECTION PROGRAMME
3.6 (1) Issue: The fire safety and protection systems are not effectively controlled.
During the review the team identified:
− More than 12 fire penetrations were observed to be not sealed properly, including
nuclear safety related plant areas such as the ULB building, e.g. there is a damaged
fire penetration next to door to UBA0524 and UBA 05645 has a cable through an
unsealed conduit, fire penetration next to door to UBA557 is damaged, and
ULB0446, ULB0449, ULB0469 where the fire penetrations are not sealed.
− There is no effective fire penetration management plan, master list of penetrations
or drawings.
− Defects on fire protection systems have not been formally analysed and managed
by operations, e.g. in the ULB building there is a standing ‘release alarm’ on
electronic card SGK07 (SOT 201101483) and on the FM200 fire system a vessel
pressure sensor has poor material condition and no defect tag.
− A number of fire doors in several areas were in an inappropriate state or had
defective closers, e.g. doors BA972, PQ103, and BA529.
− Poor material condition of several fire systems such as leaking fire hydrant valves
SGA22AA005 in the turbine hall, degraded paintwork and labels on main
transformer fire deluge systems, entrance to UBA0536 has a degraded fire escape
line and fire storage area and there is inadequate labelling of fire system
components in several areas, particularly in the ULB building.
− Several electrical cabinets in safety related plant areas such as the ULB building
and the DC essential switchboards, were open or had gaps in the panel doors.
− Areas such as the chlorination plant (UPQ building) and turbine hall 5.15 metre
level have poor storage of combustible materials and fire loads.
If the plant does not manage the plant fire safety and protection systems to the required
standard the safe operation of the plant in the event of a fire may be compromised.
Recommendation: The plant should review and improve the control of the fire safety
and protection systems.
OPERATIONS 21
IAEA Basis:
NS-R-2
2.30. The operating organization shall make arrangements for ensuring fire safety on the basis
of a fire safety analysis which shall be periodically updated. Such arrangements shall include:
application of the principle of defence in depth; assessment of the impact of plant
modifications on fire fighting; control of combustibles and ignition sources; inspection,
maintenance and testing of fire protection measures; establishment of a manual fire fighting
capability; and the training of plant personnel.
NS-G-2.1
2.13. Effective procedures for inspection, maintenance and testing should be prepared and
implemented throughout the lifetime of the plant with the objective of ensuring the continued
minimization of fire load, and the reliability of the installed features for detecting,
extinguishing and mitigating the effects of fires, including established fire barriers.
NS-G-2.1
7.1. A comprehensive programme should be established and implemented to perform
appropriate inspection, maintenance and testing of all fire protection measures (passive and
active, including manual fire fighting equipment) specified as important to safety. The
specific fire protection systems, equipment, components and emergency procedures included
in the program should be identified and documented. Where such documentation is not
available (for example, if the fire hazard analysis has not yet been performed and other
documentation is incomplete), all fire protection measures should be assumed to be important
to safety unless the contrary assumption can be justified.
NS-G-2.1
7.2. The inspection, maintenance and testing programme should cover the following fire
protection measures:
—passive fire rated compartment barriers and structural components of buildings, including
the seals of barrier penetrations;
—fire barrier closures such as fire doors and fire dampers;
—locally applied separating elements such as fire retardant coatings and cable wraps;
—fire detection and alarm systems, including flammable gas detectors;
—emergency lighting systems;
—water based fire extinguishing systems;
—a water supply system including a water source, a supply and distribution pipe, sectional
and isolation valves, and fire pump assemblies;
OPERATIONS 22
—gaseous and dry powder fire extinguishing systems;
—portable fire extinguishers;
—smoke and heat removal systems and air pressurization systems;
—communication systems for use in fire incidents;
—manual fire fighting equipment including emergency vehicles;
—respirators and protective clothing for radiological applications;
—access and escape routes for fire fighting personnel;
— emergency procedures.
Additional information on the fire protection measures which should be inspected,
maintained and tested is provided in the Annex.
7.3. Minimum acceptable levels of availability should be established and documented for all
fire protection features identified as important to safety. Interim compensatory measures
should be defined for each fire protection feature identified in this way. These compensatory
measures should be implemented on a temporary basis in the event that the minimum level of
availability for a given fire protection feature is not maintained or the fire protection feature is
determined to be inoperable. Both the compensatory measure to be implemented and the
allowable time schedule for its implementation should be determined, documented and
reviewed. If the minimum acceptable level of availability of a fire protection measure has not
been specified, it should be assumed to be 100%.
MAINTENANCE 23
4. MAINTENANCE
4.2. MAINTENANCE FACILITIES AND EQUIPMENT
The team identified that the control and storage of maintenance equipment and
materials is not at the appropriate level. Several items of equipment and materials
inside the plant and its stores are damaged or in poor condition. The team made a
suggestion in this area.
4.3. MAINTENANCE PROGRAMMES
The team discovered that the plant has enhanced its ability and process to conduct
maintenance evaluations of systems, structures and components. The concept of
streamlined reliability centred maintenance is used in order to optimize the
maintenance frequencies and the necessary maintenance tasks. For example, several
safety related pumps are now being maintained using condition based maintenance,
which has reduced the number of interventions and the probability of failures
introduced by scheduled preventive maintenance. The team identified this as a good
performance.
The team recognized that a comprehensive ageing management programme for the
plant has not been established and that the effectiveness of the plant’s maintenance
programme for safety related equipment could be affected. It was observed by the
team that several events have happened due to ageing degradation and that there is no
schedule to implement a comprehensive ageing management programme. The team
made a recommendation in this area.
4.5. CONDUCT OF MAINTENANCE WORK
The team identified that there is insufficient control of maintenance work practices
including post-job reviews. The plant has written expectations for the conduct of
maintenance; however the team made several observations of work places and work
practices that were non-compliant to these expectations. The team made a
recommendation in this area.
4.6. MATERIAL CONDITIONS
It was recognized by the team that the plant has a leakage management programme.
However, it was discovered that several leaks exist and that several categories of leaks
in the plant’s computerized work control system were incorrect. Further, several
observations made by the team revealed that the process for monitoring leaks in the
plant does not meet the expectations. The team made a recommendation in this area.
MAINTENANCE 24
4.7. WORK CONTROL
The team acknowledged that the plant has a work control process in place, which is
controlled by a procedure in combination with cross functional meetings. However,
the work control process is not fully effective due to the presence of a large backlog
for both preventive and elective maintenance. There are also weaknesses in the control
of prioritization, which could result in untimely repair of important systems, structures
and components. The team made a recommendation in this area.
4.9. OUTAGE MANAGEMENT
For the outage preparation, the team observed that there is no preparation milestone
plan, no important freeze dates and no outage organization chart in the outage
guideline. Moreover, the plant does not document contractors’ experience or include
their review reports into the outage review report.
The team encourages the plant to improve its outage preparation and implement
arrangements in order to enhance the control and evaluate the efficiency of the outage
preparation. The plant is also encouraged to include contractors’ outage experience
into the outage review report in order to improve the analysis of the outage results for
continuous improvements.
MAINTENANCE 25
DETAILED MAINTENANCE FINDING
4.2. MAINTENANCE FACILITIES AND EQUIPMENT
4.2(1) Issue: The control and storage of some maintenance equipment and materials does not
meet the plant expectations.
Examples of facts identified by the team include:
− Damaged and inappropriate control and storage of tackle blocks and lifting
eyes in room JA0864
− Damaged slings i.e. 2131 with visible fraying
− Installed tackle block, in room GN101, was damaged
− In maintenance stores ST0118, ST0109, ST0114 the following facts were
identified:
� Tackle block, 438005, was damaged
� Hydraulic jacks had damaged o-rings, e.g. CH2045
� Lifting slings were in poor condition and some had visible fraying, e.g.
2529, 2277
� Some electrical cables were damaged and others were in poor condition
− Austenitic steel was stored together with carbon steel in the mechanical work
shop ST0131
− Calibration control cards in the maintenance store, ST0114, with requirements
to specify the KKS system id, in order to have full traceability were just signed
with the building number. E.g. control cards for torque wrenches 2015102,
1082430, V110117, 731793, 1070082, V.060159, 766945, 731792
Without proper control and storage of equipment and materials, the safety of the plant
and personnel could be jeopardized.
Suggestion: The plant should consider improving its programme for the control and
storage of equipment and materials in order to meet its expectations.
IAEA Basis: NS-G-2.6; 8.32. The operating organization should ensure that storage
facilities offer adequate space and provide for the secure retention of stocks in suitable
environmental conditions, in order to prevent deterioration. Access and the installed
handling equipment should be adequate for the types and sizes of items to be stored.
MAINTENANCE 26
NS-G-2.6
8.19. Plant management should provide suitable mobile lifting and transport facilities,
with clear indications of their lifting capacity. In the selection and use of these
facilities, due account should be taken of the possible radiological consequences of
their failure. Examples of precautions taken include regular examination and
maintenance of lifting equipment, periodic testing, special inspections before major
operations involving lifting and rigging, and cautionary notices limiting movements of
loads over specified areas. All operations involving lifting and rigging should be
performed by trained personnel.
NS-G-2.6
9.44. When test equipment is found to be out of calibration ... For this purpose a
history of usage should be maintained for each piece of test equipment....a tag or other
suitable means.
NS-G-2.6
10.23. All equipment should be properly identified in the calibration records, and the
validity of the calibration should be regularly verified by the operating organization in
accordance with the quality assurance programme.
MAINTENANCE 27
4.3. MAINTENANCE PROGRAMMES
4.3(1) Issue: A comprehensive plant ageing management programme is not developed.
The following facts were identified by the team:
− The root cause of several reportable events was due to ageing e.g.
� 9-11-10, Electrolytic capacitor ageing
� 28-7-10, Temperature sensor thermo resistance ageing
� EAR PAR 10-002, Insulation Ageing
− The plant does not have a developed and implemented ageing management
programme in place. A draft for a future programme is under development,
however, an implementation time schedule does not exist.
Without a comprehensive ageing management programme, the maintenance
programme for safety related equipment may not be fully effective and could therefore
affect plant safety.
Recommendation: The plant should develop a comprehensive ageing management
programme in order to ensure the continued reliability of important systems, structures
and components.
IAEA Basis:
NS-R-2
6.4. The frequency of preventive and predictive maintenance, testing, surveillance and
inspection of individual structures, systems and components shall be determined on
the basis of:
(1) The importance to safety of the structures, systems and components
(2) Their inherent reliability
(3) Their assessed potential for degradation in operation and their ageing
characteristics
(4) Operational experience
NS-G-2.4
6.77. Managing the safety aspects of nuclear power plant ageing requires
implementation of effective programmes for the timely detection and mitigation of
ageing degradation of plant structures, systems and components important to safety,
so as to ensure their integrity and functional capability throughout the plant’s service
life.
6.78. The programme to manage the ageing process should contain, but is not limited
to, such elements as:
MAINTENANCE 28
− identification of the degradation processes that could adversely affect plant
safety;
− identification of components that are susceptible to ageing degradation that
could affect plant safety;
− adequate and current methods for the detection of ageing problems;
− appropriate records to enable the ageing process to be tracked;
− a methodology for corrective action in order to mitigate and/or remove ageing
effects; and
− changes to the maintenance, testing, surveillance and in-service inspection
programme to reflect the analysis of ageing test results.
NS-G-2.6
2.1. The maintenance programme for a nuclear power plant should cover all
preventive and remedial measures that are necessary to … mitigate degradation of a
functioning SSC.
NS-G-2.12
3.1. Ageing management of SSCs important to safety should be implemented
proactively (with foresight and anticipation) throughout the plant’s lifetime, i.e. in
design, fabrication and construction, commissioning, operation (including long term
operation and extended shutdown) and decommissioning.
4.31. A specific programme for the ageing management of each structure, component
or group of structures and components selected by the screening process should be
developed and documented. The ageing management programme should identify: (a)
effective and appropriate actions and practices for managing ageing that provide for
timely detection and mitigation of ageing effects in the structure or component; and
(b) indicators of the effectiveness of the programme. Thus the effectiveness of current
practices should be confirmed in light of applicable ageing evaluations and condition
assessments, and/or improvements to current practices should be recommended, as
appropriate.
MAINTENANCE 29
4.5 CONDUCT OF MAINTENANCE
4.5(1) Issue: There is insufficient control of maintenance work practices.
Several facts were identified by the team, which included poor work practices and lack
of post job reviews e.g.
− The job of draining the gearbox of the polar crane inside the containment
building had to be done twice due to lack of proper preparation and planning
− Installed flanges with no visible bolt threads on PAC60BR020, LAB12BR001,
MAN21CT001
− Tape was used to fasten cables on MKG51CT501
− Silicone was used to seal leak on 5XJG01CP503 and QUA01AA009
− Poor installation of electrical connection to air conditioner on the top of outage
office room in UMA building
− FME covers were missing e.g.
� Pipe GNA02AP002
� Pump near GNB02BR102
� 2 repaired pumps in mechanical workshop
− Poor cleanliness during maintenance work on JMF00AB001 with bolts, nuts
and tools stored loosely on the floor in the changing area
− Oil was dripping from the polar crane gearbox cover which was placed in the
designated FME area near the spent fuel pool
− Maintenance job on the safety related pump QUP30AP001 had a step-by-step
procedure and a pre-job briefing protocol but none of them were signed off
during the work
− During a lift of a heavy air cylinder tank in the mechanical workshop, it was
observed that only one sling was used and it had only one single lifting point.
The lift zone had not been designated.
− Damaged lifting sling with visible fraying was used while lifting materials in
the mechanical workshop ST013
Without sufficient control of work practices and work places, safety related systems,
structures and components may not be able to fulfil the safety function.
Recommendation: The plant should improve its control over maintenance work
practices.
MAINTENANCE 30
IAEA Basis:
NS-R-2
2.11. All activities that may affect safety and which can be planned in advance shall
be conducted in accordance with established procedures which shall be submitted by
the operating organization to the regulatory body for approval, if so required
2.13. The operating organization shall ensure that regular reviews of the operation of
the plant are conducted, with the aim of ensuring: that an appropriate safety
consciousness and safety culture prevail; that the provisions set forth for enhancing
safety are observed; that documentation is up to date; and that there are no indications
of overconfidence or complacency. Where practicable, suitable objective performance
measures shall be used. The results shall be made available to plant management and
appropriate corrective actions shall be taken.
GS-G-3.5
5.149. A process should be established and implemented to control maintenance of
the systems, structures and components of the installation. Further recommendations
and guidance are provided in Refs [8, 9].
5.150. Housekeeping and cleanliness should be considered an essential process to
provide a clean workplace and to encourage a high standard of workmanship. The
process should include establishing, maintaining and enforcing standards for
housekeeping and cleanliness that:
(a)Prevent the contamination of items and individuals;
(b)Minimize the risk of injury;
(c)Reduce the risk of occurrence of conventional accidents such as fires;
(d)Protect open systems and equipment from contamination with foreign
material during maintenance and modification;
(e)Control the movement of materials, equipment, tools and individuals into
and out of work areas;
(f)Ensure that cleanliness inspections are performed immediately prior to
reassembly of systems or components;
(g)Encourage individuals to leave an area as clean as or cleaner than it was
before they carried out activities in it.
NS-G-2.6;
3.8. Contractors should be subject to the same standards as plant staff, particularly in
the areas of professional competence, adherence to procedures and evaluation of
MAINTENANCE 31
performance. Suitable steps should be taken to ensure that contractors conform to the
technical standards and the safety culture of the operating organization.
INSAG-15
3.5 Nearly all events, ranging from industrial and radiological accidents, incidents and
near misses to failures affecting nuclear safety, start with an unintentionally unsafe act
or an unacceptable plant condition or process. These have often been latent and have
gone undetected or been treated as ‘custom and practice’ and therefore been ignored.
Then, in combination with another challenge to the system, a further more significant
failure occurs. Minimizing existing latent shortcomings in working practices or plant
conditions is therefore vital in avoiding more serious events.
MAINTENANCE 32
4.6 MATERIAL CONDITION
4.6(1) Issue: The plant leakage management programme is not fully effective.
The following facts were identified by the team:
− Several leakages were found by the team without any work requests and
permanent monitoring e.g. MKW03CL061, XJN01AA001, QMA02BB001
− Several leakages were not categorized as leakages in the work control system
and would therefore not be monitored e.g. 201007777, 201001433, 201004400
− Several work requests with severity 5 leaks (the highest severity) have been
open in the work control system for more than 10 months, without them being
re-categorized or completed, e.g. 201016832, 201016624, 201004105
− Fabric/tissues were used to collect an oil leak on PUS20AP001 and
LAC20AP001
− Tape was used to seal leakage on KLK15CF524
− Oil leakage on the circulation pump PAC10AP001 was spreading oil onto
electrical cables
− Work request 201107750 was categorized as a leakage, however no leak
exists; the work request was due to I&C issues
Without a robust leak management programme in place, the plant integrity cannot be
assured and the safe operation of the plant could be compromised.
Recommendation: The plant should review and fully implement its leakage
management programme.
IAEA Basis:
NS-R-2
6.5. Repairs to structures, systems and components shall be performed as promptly as
practicable. Priorities shall be established with account taken first of the relative
importance to safety of the defective structure, system or component.
MAINTENANCE 33
5.17. Responsibilities and lines of communication shall clearly be set out in writing
for situations in which the operating personnel discover that the status or conditions of
plant systems or equipment are not in accordance with operating procedures.
NS-G-2-6
4.22. The elimination of plant defects should be tracked to completion, and records
should be kept of the work performed. These records should be accessible whenever
needed for review.
NS-G-2.2
I.22. Leakage limits should be such that the coolant inventory can be maintained by
normal make-up systems and that the system integrity can be maintained to the degree
assumed in the safety analysis report. Specifications of maximum leakage from
particular components important to safety, commensurate with their safety function,
should be provided. In establishing leakage limits, consideration should be given to
the permissible limits of contamination of the environment or of secondary systems by
the leaking media. Operability requirements should be stated for the detection of, or
for measuring systems for, leakage of reactor coolant. In general, leakages should be
classified as identified (for example, leakages into collection systems such as those at
pump seals, into the containment atmosphere or through the steam generator; these
leakages should be measured in order not to mask the unidentified leakages) or
unidentified leakages.
MAINTENANCE 34
4.7 WORK CONTROL
4.7(1) Issue: The plant work control process is not always effective.
The following facts were identified by the team:
− 27 work requests with priority 1 (immediate action) were used to perform
predictive and preventive maintenance tasks during 2010
− 31 work requests were identified, some on safety related equipment, which had
not been prioritized, e.g. 201010708 and 201005828
− Several work requests with priority 3 (repair within 14 days) were overdue for
more than 2 years e.g. 200700705, 200804121, 200908300
− The backlog for elective maintenance >180days reached 481 work requests.
113 are due to engineering and 93 are due to planning. The rest are considered
as due to lack of spare parts
− The backlog for preventive maintenance reached 453 work request, of which
>200 have not been signed off, and the trend is increasing
− Work request 201104576 was categorized as a severity 5 leakage, however no
leak existed, the work request was due to bearing issues
− There is no clear correlation between plant prioritization and leakage severity,
e.g. 201002684, 201001968
Without a proper work control process, the planning and prioritization can result in
untimely repair of important systems, structures and components and have
implications on plant safety.
Recommendation: The plant should improve its work control process and its
effectiveness.
MAINTENANCE 35
IAEA Basis:
NS-R-2
6.5. Repairs to structures, systems and components shall be performed as promptly as
practicable. Priorities shall be established with account taken first of the relative
importance to safety of the defective structure, system or component.
6.7. A comprehensive work planning and control system shall be implemented to
ensure that maintenance, testing, surveillance and inspection work is properly
authorized and is carried out in accordance with established procedures. Co-ordination
shall be established among different maintenance groups (for mechanical, electrical,
instrumentation and control, and civil maintenance), and with operations and support
groups (groups for fire protection, radiation protection, physical protection and
industrial safety).
NS-G-2-6
5.14. A comprehensive work planning and control system applying the defence in
depth principle should be implemented so that work activities can be properly
authorized scheduled and carried out by either plant personnel or contractors, in
accordance with appropriate procedures, and can be completed in a timely manner.
The work planning system should maintain high availability and reliability of
important plant SSCs.
5.18. Management of the work should be recognized as a cross-functional process, not
exclusive to any one work group but integrating the important activities of all work
groups. Consequently, for the work control process to be fully effective, all needs and
concerns in relation to operations, maintenance, technical support, radiation
protection, procurement and stores, contractors and other matters should be
considered and should be accommodated wherever appropriate, consistent with the
long term operating strategy for the plant.
5.19. The effectiveness of the work control process should be monitored by
appropriate indicators (such as repeated work orders, individual and collective
radiation doses, the backlog of pending work orders, interference with operations) and
by assessing whether corrective action is taken whenever required.
TECHNICAL SUPPORT 36
5. TECHNICAL SUPPORT
5.2. SURVEILLANCE PROGRAMME
Planning, control and evaluation of the effectiveness of surveillance activities
is done by different plant departments: Operating, Maintenance, Planning, and
System and Reactor Performance Departments. Although the planning and
control of surveillance tests are well organized with a software programme, the
planning, control and evaluation of the surveillance programme is not always
performed in a systematic and effective way. In addition, no formal
requirements are set and only a few indicators exist for surveillance
programme effectiveness evaluation. Also, the calculation of indicators
performed by the SISA (Sistema Integrado Surveillance de Angra) software is
not always clear and correct. The team developed a suggestion in this area.
5.3. PLANT MODIFICATION SYSTEM
A clear system for modification categorization in accordance with their safety
significance has not been established for permanent and temporary plant
modifications. The team developed a suggestion in this area.
5.6. COMPUTER BASED SYSTEMS IMPORTANT TO SAFETY
Computer based systems are used at the plant for process monitoring
applications and for administration applications. The management of the
computer based systems is performed by the Operating and System and
Reactor Performance Departments.
Nevertheless, the team noted that the categorization with regard to safety
significance for computer based systems is only done partially. The existing
procedure provides criteria only for essential software. However, hardware for
computer based systems is not addressed. The team encourages the plant to
establish clear requirements for classification as well as for verification and
validation for computer based systems.
TECHNICAL SUPPORT 37
DETAILED TECHNICAL SUPPORT FINDINGS
5.2. SURVEILLANCE PROGRAMME
5.2.(1) Issue: The planning, control and evaluation of the surveillance programme is
not always performed in a systematic and effective way.
During the mission it was noted that:
− No formal requirements are set for surveillance programme
effectiveness evaluation.
− Limited indicators exist for surveillance programme effectiveness
evaluation.
− The final weekly schedule (dated 23/02/2011) was sent to the shift
supervisor with several hand made changes.
− More than 600 open work requests exist (from July 2010). These have
not been reviewed or revised, therefore, no appropriate measures have
been taken.
− Control for the execution of tests is being done only on the basis of the
tolerance limit date and there is no control for the planned execution
date.
Without systematic and effective planning, control and evaluation of the
surveillance programme the plant may lose the opportunity of maintaining and
improving the equipment availability and safety.
Suggestion: The plant should consider implementing measures for improving
the systematic and effective planning, control and evaluation of the
surveillance programme.
TECHNICAL SUPPORT 38
IAEA Basis:
NS-R-2
6.7. A comprehensive work planning and control system shall be implemented
to ensure that maintenance, testing, surveillance and inspection work is
properly authorized and is carried out in accordance with established
procedures.
NS-G-2.6
4.4. The goals, objectives and priorities of the MS&I programme should be
defined so as to be consistent with the policies and objectives at the plant.
Appropriate operational safety performance indicators should be established
and used to monitor and enhance the quality of MS&I. Senior management
should encourage effective and high quality performance of MS&I. Results
and feedback from the performance of MS&I should be used in accountability
reviews and in establishing goals and objectives for subsequent planning
periods.
NS-G-2.6
6.5. The operating organization should ensure that the results of MS&I are
evaluated in order to verify compliance with the acceptance criteria.
NS-G-2.6
9.7. The surveillance programme should be developed by the operating
organization. Implementation should be scheduled such that the safety of the
plant does not depend on untested or unmonitored SSCs.
TECHNICAL SUPPORT 39
5.3 PLANT MODIFICATION SYSTEM
5.3(1) Issue: A clear system for modification categorization in accordance with their safety
significance has not been established for permanent or temporary plant modifications.
The plant has a structured and documented process for the implementation of
permanent and temporary modifications on the basis of the project model, which
includes a safety assessment and a prioritization system only for permanent
modifications.
However, the team found that:
− No criteria are established for the categorization of each specific modification
in accordance with its safety significance.
− There is no safety categorization in the procedure for permanent and temporary
plant modifications.
− The safety review process for all safety related modification is the same
regardless of their safety significance.
− The permanent modification 0151.08 (replacement of KAA20/30AA010/011
valves) is only classified as safety related and was not categorised in
accordance with its safety significance (the same for 0039.08 KPL).
− Temporary modification 0030.11 (JAB system measurement of reactor cover)
is only classified as safety related and not categorised in accordance with its
safety significance (the same for 0021.11 for LAR system).
Without clear modification categorization in accordance with their safety significance,
and with subsequent adequate analysis, the safety of the plant may be compromised.
Suggestion: The plant should consider establishing a clear system for modification
categorization in accordance with their safety significance for permanent and
temporary plant modifications.
IAEA Basis:
NS-R-2
7.1. Modifications to a nuclear power plant may consist of:
(1) Modifications to structures, systems and components;
(2) Modifications to the operational limits and conditions;
(3) Modifications to instructions and procedures; or
(4) A combination of the above; and
TECHNICAL SUPPORT 40
(5) Modification of organizations.
7.2. Proposed modifications to structures, systems and components important to
safety, which affect the bases on which the operating licence was issued, to the
operational limits and conditions, and to procedures and other documents originally
approved by the regulatory body shall be submitted to the regulatory body for prior
approval. Any other proposed modifications shall be submitted to the regulatory body
for prior approval if so required. Modifications should be categorized according to
their safety significance.
NS-G-2.3
4.3. Following the completion of the initial process of safety assessment (see para.
4.8), the proposed modification should be categorized in accordance with its safety
significance. This categorization should follow an established procedure agreed with
the regulatory body.
NS-G-2.3
4.6. The principles for managing modifications are the same for all categories, but in
each step of the modification process the categorization of the modifications
determines the depth and breadth of the safety review and the regulatory control which
should be applied.
NS-G-2.3
4.7. The criteria applicable in determining the categorization for each specific
modification should be defined and documented in order to enable correct assessment
of the potential effect on safety.
OPERATING EXPERIENCE
41
6. OPERATING EXPERIENCE FEEDBACK
6.1. MANAGEMENT, ORGANIZATION AND FUNCTIONS OF THE OE
PROGRAMME
The team recognized that there is no conformity in the organization of the plant’s
operating experience system. There are several independent operating experience
reporting programmes maintained within various plant departments and services. It
was identified that the plant operating experience feedback system does not have
adequate integration, coordination and requirements to ensure effective utilization of
operating experience for improving operational safety. The team made a suggestion in
this area.
6.2. REPORTING OF OPERATING EXPERIENCE
It was observed by the team that the events reporting process and subsequent practice
of selecting events for analysis do not always contribute to the optimal use of the
plant’s operating experience. Insufficient reporting of plant deficiencies can lead to a
failure in early identification of accident precursors. The team developed a suggestion
in this area.
6.5. ANALYSIS
The team identified that the plant has some deficiencies in the process for
investigation and analysis of event reports. Without following a thorough approach in
the investigation and analysis of events, the plant may not succeed in the timely and
correct identification of the causes of an event and may not be able to initiate proper
corrective actions to preclude further occurrence of safety related events. The team
made a recommendation in this area.
OPERATING EXPERIENCE
42
DETAILED OPERATING EXPERIENCE FINDINGS
DETAILED OPERATING EXPERIENCE FEEDBACK FINDINGS
6.1 MANAGEMENT, ORGANIZATION AND FUNCTION
6.1(1) Issue: The plant operating experience feedback system does not have adequate
integration, coordination and requirements to ensure effective utilization of operating
experience for improving operational safety.
During the review, the team noted the following facts:
− There are several input points into Maximo software such as low level events
and near misses; work request; pre and post job briefings; events reports and
other plant specific aspects. However a current software configuration does not
allow handling all the data related to reported plant deficiencies promptly for
the benefit of plant operating experience programme.
− Defects on plant equipment are processed through the work request system and
therefore excluded from the operating experience feedback process.
− There is no requirement in the OE procedures to prioritize corrective actions
according to significance for safety. The responsible person prioritizes by
coding the corrective actions that are in SGP (Pending Tracking System)
according to a working procedure. However, this person does not participate in
the event investigation and analysis process and has limited knowledge about
the technical content of a report.
− The work requests related to corrective actions are coded separately in the plant
departments and services with a specific coding system. The corrective actions
cannot be prioritized in an integrated manner.
− Only a part of the plant’s corrective actions is tracked by the SGP monitoring
system. The rest of the corrective actions are tracked by different software
programmes in the respective departments and services. It is not possible to
have an integrated assessment of the corrective actions that are in progress,
fulfilled or out of due date.
− There is no feedback process established with permanent contractors to fully
integrate them into the plant’s operating experience feedback loop.
Without proper centralization and coordination of operating experience from activities
among the departments and services of the plant, the plant may lose opportunities for
improving operational safety performance.
Suggestion: Consideration should be given to provide adequate integration and
coordination of operating experience activities at the plant to ensure effective
utilization of operating experience for improving operational safety.
OPERATING EXPERIENCE
43
IAEA Basis: NS-G-2.11; 2.5: The organization that operates a nuclear installation
should maintain an effective system for the collection and analysis of operational
experience and should promptly disseminate safety significant information among its
own staff and to other relevant organizations.
2.12: A detailed procedure should be developed by operating organization on the basis
of the requirements for the national system established by the regulatory body. The
procedure should define the process for dealing with all internal and external
information on events at nuclear installation. The procedure should precisely define
the structure of the system for the feedback of operational experience, the type of
information, the channels of communication, the responsibilities of the groups and
organizations involved, and the purpose of the documentation produced….
5.6: Corrective actions should therefore be prioritized. Those actions affecting safety
should be given the highest priority, while the actions that are desirable rather than
essential should be shown as such.
OPERATING EXPERIENCE
44
6.2 REPORTING OF OPERATING EXPERIENCE
6.2(1) Issue: The events reporting process and subsequent practice of selecting events for
analysis do not always contribute to optimal use of the plant’s operating experience.
During the review the team noted the following facts:
− No formal and refresher training provided to the plant personnel on event
reporting although the plant has received four event investigation training
courses by international organizations in the past eight years.
− The process stated in 2PA-GE 50 does not include examples of low level
events (LLE) and near misses for reporting.
− Criteria for reporting of deficiencies in the field are unclear and result in a
number of plant deficiencies remaining unreported and uncorrected:
� Emergency Diesel RED #6: oil leak
� Emergency Diesel RED #8: oil leak
� QMA 02 BB 001 (Emergency steam generator area): water and oil
leaks
� 2XJG 01 AP 002 was not reported as defective after Diesel #2 test on
30 March 2011.
Although the reporting is an integral part of the plant’s operating experience feedback
system the responsibility to report deficiencies remains with plant employees.
− Screening criteria for LLE and external OE are not formalized.
− The number of LLE events reported by the plant personnel on a monthly basis
is low in comparison to internationally benchmarked practices.
− Selecting LLE events and near misses for further processing is carried out at
the discretion of an OE representative during a morning screening meeting with
no formal, specific written guidance.
Without a robust and clear reporting process that has a subsequent event selection
practice for analysis, the plant may fail to identify accident precursors in a timely
manner and prevent significant events.
Suggestion: The plant should consider improving the event reporting process and
subsequent event selection practice for analysis in order to make optimal use of
operating experience.
OPERATING EXPERIENCE
45
IAEA Basis: NS-G-2.11
3.8: … The screening criteria for external events should follow the criteria that govern
the reporting of internal events to determine whether detailed investigation is
necessary.
10.2: Operating organizations should develop documents specifying appropriate
reporting criteria specific to the type of plant being operated and consistent with
national regulatory requirements. These criteria should specify the types of events and
incidents, including problems, potential problems, non-consequential events, near
misses and suggestions for improvement. These reports about events and incidents
should be collected and reported internally, and some of them should be reported
externally to the plant or utility.
10.4. Operating experience should be reported in a timely manner to facilitate learning
from events. To this end operating organizations should put in place the necessary
arrangements to ensure that all events that occur during operation of the plant are
systematically reported and analyzed.
10.9. The operating organization should develop detailed procedures for the reporting
of events.
OPERATING EXPERIENCE
46
6.5. ANALYSIS
6.5(1) Issue: The process for significant event investigations and analyses does not always
demonstrate conformity to the scope, completeness and timeliness of producing
reports.
During the review the team noted the following facts:
− Significant event reports (RES) do not indicate what investigation method or
combination of methods was used during analysis and do not always contain
reference data. There is no evidence of using barrier analysis in the reports
reviewed during the evaluation (approximately 50 reports).
− A psychologist does not always participate in the investigation and analysis of
significant events with human performance implications:
� 2RES 098 2010 - 2ORO 002 2010;
� 2RES 012 2009 – 2ORO 001 2009;
− There are no requirements in the procedure 2 PA-GE 50 to address more severe
conditions, than those existing during the actual event, when performing
analysis of an event. The analysis of significant events does not include an
extent of condition review.
− There is no time frame specified in the procedure 2PA-GE 50 for timeliness of
producing preliminary reports. Preliminary report RPE 102.2010 took 12 days
to be prepared.
− There is no evidence that plant personnel who are involved in root cause
analysis receive refreshing training.
− Timeframes for producing significant event reports do not always correspond
with the requirements set forth in the instruction 2PA-GE 50 (30 days) and
sometimes exceed this period by up to seven months.
� 2RES 024. 2009 finished 25.06.2009 – target date 13.04 2009
� 2RES 023. 2009 finished 23.04.2009 – target date 06.04.2009
� 2RES 018.2009 finished 09.10.2009 – target date 02.04.2009
− The performance indicator on the number of overdue reports (RES-RDO) has
remained unsatisfactory for more than one year.
Without following a thorough approach in the investigation and analysis of events, the
plant may not succeed in the timely and correct identification of the causes of an event
and may not be able to initiate proper corrective actions to preclude further occurrence
of safety related events.
Recommendation: The plant should improve the process for significant event
investigation and analyses to ensure conformity with the scope, completeness and
timeliness of producing reports.
OPERATING EXPERIENCE
47
IAEA Basis:
NS-R-2
2.21. Operating experience at the plant shall be evaluated in a systematic way.
Abnormal events with significant safety implications shall be investigated to establish
their direct and root causes. The investigation shall, where appropriate, result in clear
recommendations to the plant management, which shall take appropriate corrective
action without undue delay. Information resulting from such evaluations and
investigations shall be fed back to the plant personnel.
NS-G-2.11
II.9: Causes. The direct causes, root causes and causal factors of the event should be
clearly described. (Annex I provides more details on direct and root causes in paras I–
10, I–11.) The reasons for equipment malfunctions, problems of human performance,
organizational weaknesses, design and manufacturing deficiencies and other relevant
facts should be included under causes. Whenever appropriate the method used for
cause analysis should be referenced in the report.
II.8. The safety assessment should be focused on the safety consequences and
implications of the event. The primary aim of this review is to ascertain why the event
occurred and whether it would have been more severe under reasonable and credible
alternative conditions, such as at different power levels or in different operating
modes. The safety significance of the event should be indicated.
10.10.…The procedures should stipulate a time limit for reporting events, the format
for the type of reports and the administrative arrangements for their distribution.
Appendix III
II.3: Training (both initial and refresher) should be provided for the staff who might
take part in an investigation. This should include training in investigation techniques,
documentation needs, witness interviews, conflict resolution and dealing with
confidentiality issues. Event investigation training for personnel from operating
organizations is frequently available at the corporate department, the supporting
organizations, the WANO and the Institute of Nuclear Power Operations, as well as
through the IAEA. Whereas all investigators should receive some basic training in
event investigation, including root cause analysis, for more difficult and complex
investigations there may need to be at least one expert facilitator who is familiar with
such methods of investigation.
NS-G-2.4
OPERATING EXPERIENCE
48
6.67: The responsibility, qualification criteria and training requirements of personnel
performing activities to review operating experience should be clearly defined.
Personnel who conduct investigation of abnormal events should be provided with
training in investigative root cause analysis techniques such as accident investigation,
human factor analysis (including organizational factors), management oversight and
risk tree analysis, change analysis and barrier analysis…”
RADIATION PROTECTION
49
7. RADIATION PROTECTION
7.2. RADIATION WORK CONTROL
All work carried out within the Controlled Area is subject to a ‘Routine’ or ‘Special’
Radiation Work Permit (RWP). There is a system in place which will not allow entry to the
Controlled Area until the RWP has been activated for each individual by the radiological
control point. However, the team has identified that there is a lack of appropriate detail in the
production of RWPs, and that RWPs are not fully enforced in the field. The team has made a
recommendation for the improvement of this process.
.
RADIATION PROTECTION
50
DETAILED RADIATION PROTECTION FINDINGS
7.3. RADIATION WORK CONTROL
7.2(1) Issue: The Radiological Work Permit does not always contain appropriate
radiological conditions, and is not fully implemented in the field.
Because of low radiation and contamination levels in the plant, clear instructions are
not always given to the workers, resulting in a lack of awareness of radiological
conditions.
During the review, the team observed the following:
− The plant has experienced several minor events (28/01, 07/02, 16/03) of
individuals exceeding EPD (Electronic Personal Dosimeter) maximum dose rate
alarm level. In each case, individuals had entered an area not covered under their
RWP. Individuals had also removed physical barriers and passed signs requiring
contact with the radiological control point.
− Under RWP 112400, pipe work was being drained using a temporary pump in
Room JB174. Prior to starting work, a leak was identified from the pump.
Contamination as a result of the leak exceeded ‘Radiological Assessment’ levels
on the RWP. Clear actions levels were not stated, but the general site instruction
is to stop work and reassess if there is a variation from the given levels. Verbal
communication from the radiological control point allowed work to continue to
5 times the levels given in the RWP. The room in which the work was taking
place contained a Hot Spot KBA32BR407, measuring 5mSv/h. No indication of
the presence of this Hot Spot was given in the RWP.
− When issuing an EPD, confirmation is required that the RWP has been read and
understood. An individual was instructed to answer yes by plant staff, without
having seen RWP, even though a copy was requested.
− Under RWP 112411, radiation detectors were being calibrated. Radiation
workers were expected only to follow advice from the RMT (Radiological
Monitoring Technician) and members of work party were not expected to know
the radiological conditions in a Very High Dose rate area. Radiation workers
were not expected to understand the radiological conditions.
− A room containing radioactive materials was denoted by a caution sign on the
door, with a barrier placed across the door. On the caution sign, it was stated that
the radiological control point should be contacted before entering this area.
Individuals took down the barrier and entered this room without contacting the
radiological control point. Entry to this area was not covered under their RWP.
− RWP 112002 for routine operations and RWP 112004 for chemistry surveillance
routines has the incorrect task code, with a maintenance task code (2) used
instead. Both RWPs were signed off by radiological protection. Routine
Operations RWP (112002) is not held as a copy with the operations team, and is
not used as a part of the work brief.
RADIATION PROTECTION
51
− A contractor was performing work on the polar crane in the reactor building
(UJA). An Eletrobras employee supervising the contractors knew that a survey
had been carried out earlier in the day. On request, the supervisor was aware that
there was a survey available in the work pack, however he could give no details
on its contents or radiological conditions, other than to say “it is low”.
− Individual observed wearing TLD (Thermo Luminescent Dosimeter) and EPD
on the outer pockets of his PPE, which is contrary to induction training. This
was not challenged by other members of the work party.
− An individual was observed to roll up his PPE sleeve and check the time on his
wrist watch. This was not done with the required approval from an RMT
(Radiological Monitoring Technician). There were observations of individuals
making hand-to-face movements, wiping faces and touching goggles in the
contaminated area.
Without clear instructions and an understanding of radiological conditions, the
ability of the plant to reduce, and prevent unplanned, radiation exposures and
personal contamination is challenged.
Recommendation: The plant should review and reinforce its Radiological Work Permit
process and its implementation in the field.
IAEA Basis:
NS-G-2.7
3.44. For tasks necessitating radiological precautions, a radiation work permit (RWP) should
normally be prepared. A copy of the RWP should be submitted to the supervisor of the work
and it should be retained with the work team throughout the performance of the work.
Information and instructions that may be given in the RWP in addition to a description of the
work would include for instance:
(a) details of average dose rates and possible areas of elevated activity in the working area on
the basis of a survey made prior to the work or otherwise estimated;
(b) estimates of contamination levels and how they might change in the course of the work;
(c) additional dosimeters to be used by the workers;
(d) protective equipment to be used in different phases of the work;
(f) instructions on when to contact members of the radiation protection group.
5.5. Training measures should cover the following topics to a level of detail commensurate
with the assigned tasks and responsibilities of the respective worker or supervisor:
RADIATION PROTECTION
52
(a) the main types of ionizing radiation and their effects;
(b) basic quantities and units in radiation protection;
(e) use of protective equipment such as shielding and protective clothing;
(f) use of survey meters and contamination monitors, and individual external and internal
monitoring, including dose assessment;
(g) the potential risks associated with the operation of nuclear power plants;
(i) warning signs and alarm signals and information on appropriate actions to be taken;
(j) contamination control, decontamination and reduction of sources of radiation;
(k) responsibility to inform designated persons immediately in the event of any unforeseen
occurrence entailing increased risks in relation to radiation;
(o) behaviour in controlled areas.
CHEMISTRY 53
8. CHEMISTRY
8.1. ORGANIZATION AND FUNCTIONS
The team identified inconsistencies between different procedures and actual chemistry
analytical practices used in laboratories that could lead to inadequate chemical environments
which could impact on safety of systems and components.
Additionally, it was also found, that chemistry procedures are not always subjected to regular
revision and appropriate classification.
The team developed a suggestion in this area in order to improve the consistency and
implement proper revision and classification of chemistry procedures.
8.3 CHEMICAL SURVEILLANCE PROGRAMME
Based on supporting facts, the team found that the analytical methods and comprehensive
evaluations of chemical and radiochemical results are not fully established and implemented.
Without fully establishing and implementing these, the corrosion state of primary and
secondary systems cannot be properly evaluated. This may lead to corrosion damage to
primary and secondary surfaces, formation of unexpected deposits on fuel assemblies or
steam generator surfaces and result in accelerated activity build-up, higher plant dose rates
and increased exposure of plant personnel.
It was suggested by the team to improve and implement the existing analytical methods and
evaluations of chemical and radiochemical results.
8.5. LABORATORIES, EQUIPMENT AND INSTRUMENTS
The computerized system to alert the responsible person regarding the expiry date of
laboratory reagents was identified as a good performance by the team.
The general conditions in the chemistry laboratories are good, but the team encourages the
plant to improve the housekeeping in this area.
The operability of the liquid and gaseous post accident sampling system and methods were
considered by the team as an area for improvement. Without adequately trained personnel for
liquid and gaseous post accident sampling and ensuring availability of the system, the plant
may not be adequately prepared for this work to be performed in the requested time, and may
not be familiar with overall actions to be taken.
The team recommended the plant to improve the procedures, training, engineering support,
maintenance and undertake periodical testing activities of the post accident sampling system
to ensure operability of the system for requested liquid and gaseous samples in post accident
situations.
CHEMISTRY 54
8.6. QUALITY CONTROL OF OPERATIONAL CHEMICALS AND OTHER
The team found that the process of the storage and quality control of operational chemicals
and other substances were not at an appropriate standard. The team recognised both
programme and performance based facts in this area during the review. Without a well
structured and comprehensive process for the storage and quality control of operational
chemicals and other substances, there is the potential risk of improper use, personal injury
and possible detrimental effects on safety system components. The team made a
recommendation in this area.
CHEMISTRY 55
DETAILED CHEMISTRY FINDINGS
8.1 ORGANIZATION AND FUNCTIONS
8.1(1)Issue: Inconsistencies exist between the chemistry practices used in laboratories
and the corresponding administrative and technical procedures.
The following facts were observed during the review, concerning equipment
calibration and checking with standard solutions. Before using an instrument, the
instrument should be checked by comparing it with a standard:
− 2PQL 03.1.10: checking with standard buffer solution is not required before
performing a pH measurement, and the procedural requirement is that the calibration
frequency is only once per week,
− 2PQL 03.1.13: checking with standard solutions is not required before performing an
ion-chromatographic measurements, and the procedural requirement is that the
calibration frequency is only once per 6 months,
− 2PQL 03.4.09: checking with standard gases is not required before performing a gas-
chromatographic measurements, and the procedural requirement is that the calibration
frequency is only once per year,
− 2PA-QR09: contains only general requirements of checking equipment before
carrying out the measurements.
Additionally, it was also found, that chemistry procedures are not always subjected to
regular revision and they are often classified as N/A (others), instead of Q (important
aspect).
The inconsistency between different procedures and chemistry analytical practices used
in laboratories could lead to inadequate chemical environments which could impact on
safety of systems and components.
Suggestion: Consideration should be given to improving the consistency between the
chemistry practices used in laboratories and the corresponding administrative and
technical procedures and to proper revision and classification of chemistry procedures.
IAEA Basis:
NS-G-2.4
6.75. „Documentation should be controlled in a consistent, compatible manner throughout the
plant and the operating organization. This includes the preparation, change, review, approval,
release and distribution of documentation. Lists and procedures for these functions should be
prepared and controlled.”
CHEMISTRY 56
GS-G-3.5
5.10. “It shall be ensured that document users are aware of and use appropriate and correct
documents.”
GS-G-3.1
2.60. Level 3 information consists of a wide range of documents to prescribe the specific
details for the performance of tasks by individuals or by small functional groups or teams.
The type and format of documents at this level can vary considerably, depending on the
application involved. The primary consideration should be to ensure that the documents are
suitable for use by the appropriate individuals and that the contents are clear, concise and
unambiguous, whatever the format.”
CHEMISTRY 57
8.3 CHEMICAL SURVEILLANCE PROGRAMME
8.3(1) Issue: Analytical methods and comprehensive evaluations of chemical and
radiochemical results are not fully established and implemented.
The team identified the following facts during the review:
− corrosion and erosion-corrosion product transport are not fully monitored and
evaluated both in the primary and secondary circuit:
� there is no limit value for corrosion product activity concentration in primary
coolant,
� model calculations for corrosion product transport estimation are not done,
� dissolved corrosion product activity concentrations are not trended in primary
coolant,
� the built-in filter up-stream of the primary coolant sampling point inadvertently
affects the representative sampling of particulates,
− since 2006 there has been a slight increasing tendency of the total alpha activity
concentration measured in the spent fuel storage pool (FAL), but no evaluation has
been carried out concerning the possible reason,
− only I-131 activity concentration in primary coolant is trended regularly, all the other
iodine nuclides (I-132, 133, 134 and 135) are just measured,
− activity concentrations of noble gases are determined only from the liquid phase of
primary coolant which does not properly represent the total gas content,
− chloride is not considered as a control parameter in the secondary feed water and
steam generator (SG) blow down and measured only in SG blow down (the source is
the feed water)
− high silica concentration values are measured in demineralised water almost every 4th
month:
� there are only two trenches/lines of ion-exchangers to serve Angra1, 2 and Angra3
in the future,
� when one trench/line is out of operation (due to regeneration, resin change or
operational problem), the quality of the produced water decreases because of
overloading the operating ion exchange trench/line,
� as result, hide-out return of silica in secondary coolant during the last start-up was
two times higher than in the previous one, because the silica concentration in the
produced demineralised water was 10 times higher in many cases, during the cycle
8 than in cycle 7, but the reason was not analyzed and evaluated,
� 6,1-10,1 kg of sludge was removed from each steam-generator in 2007 with
sludge lancing, but the chemical composition of sludge was not analyzed and
evaluated,
− the equipment for total organic carbon (TOC) measurement in demineralised water
has been out of operation for more than 8 months:
� it was decided to measure chemical oxygen demand (COD) instead of TOC, which
only gives partial information on the organic content of demineralised water (like
bacteria, fungi and microbes),
� biological fouling cannot be followed and minimized based on this measurement.
CHEMISTRY 58
Without fully establishing and implementing proper analytical methods and comprehensive
evaluations of analytical results the corrosion state of primary and secondary systems cannot
be evaluated. This may lead to corrosion damage to primary and secondary surfaces,
formation of unexpected deposits on fuel assemblies or steam generator surfaces and result in
accelerated activity build-up, higher plant dose rates and increased exposure of plant
personnel.
Suggestion: Consideration should be given to improving and implementing the analytical
methods and evaluations of chemical and radiochemical results.
IAEA Basis:
SSG-13:
4.10. The fuel integrity monitoring programme should include appropriate procedures to
ensure that chemistry and radiochemistry data indicative of fuel integrity are systematically
analyzed for trends and evaluated to detect anomalous behaviour [9].
4.43. Special attention should be paid to the integrity of the various parts of the secondary
systems that may be significantly affected by flow accelerated corrosion.
4.46. The levels of deleterious impurities (e.g. sodium, chloride and sulphate ions and lead
and copper) in the steam generators should be minimized and controlled. Blow down limits
for the steam generator should be established, with action levels for each chemical impurity
that may be deleterious for the steam generator tubes and potentially present in the system.
4.47. The influence of chemistry control on the integrity of the steam generator should be
evaluated. The main tools for such an evaluation are:
(b) The evaluation of ‘hideout return’ effects (the levelling of concentrations) during at least
some of the shutdowns for refuelling;
(c) Calculation codes or any other relevant method for estimating the chemistry
characteristics of the liquid contained in crevices in, and deposits on, the steam generator tube
during operation.
5.14. The control of corrosion product transport should be established and implemented in
order to minimize the release and re-deposition of activated corrosion products from the core
that may result in very high radiation fields out-of-core. This transport should be minimized
by keeping primary water chemistry parameters as constant as possible and as close as
possible to the optimal values during normal power operation.
CHEMISTRY 59
6.17. Laboratory monitoring involves sampling of plant systems and analyzing for specific
chemistry properties, concentrations of dissolved and suspended impurities and activities of
radio nuclides. The scope and periodicity of chemistry monitoring activities to be performed
should be set out and made available. Sampling points, periodicity of analysis and procedure
should be established for each chemistry regime (start-up, shutdown, operation at stable
power levels, transients).
6.22. Primary coolant activity monitoring should be carried out in support of the following
tasks:
(a) Measurement of fission product activity as a means of evaluating the fuel integrity,
identifying fuel cladding leaks and estimating cladding defect type and number:
- Properly selected radionuclide activity ratios should be applied to assess the burn up of
leaking fuel rods in order to facilitate their identification during operation or outages,
depending on the type of reactor.
6.23. Radiochemistry measurements should be part of spent fuel handling operations, starting
from reactor pool storage through any transport operations to interim storage facilities, in
order to monitor fuel integrity and the possible propagation of defects after removal of fuel
from the reactor.
6.29. Determination of the activity of primary surface deposits serves for the identification of
either potential specific radionuclide contaminants (e.g. antimony, silver) or trends and
anomalies in occupational radiation exposure. This determination should be made by the use
of wipe sampling, corrosion layer scraping or electrochemical sampling, or by in situ gamma
spectrometry of appropriately selected parts of the primary circuit, or by other methods.
7.8. Trends should be reviewed soon after data have been recorded, in order to identify
problems that may need corrective action before a parameter exceeds its specified limit.
Trending should also be used to evaluate transients of short duration caused by plant
operational changes and slower long term changes occurring under stable plant conditions.
Evaluation of slow changes may facilitate the prediction of when a change could become a
significant safety problem.
7.9. Significant short and long term chemistry results should be routinely evaluated and
reported to the appropriate level of management. Effective communication with other groups
should be established when analytical data indicate the need for prompt action to correct
chemistry related problems.
CHEMISTRY 60
8.5 LABORATORIES, EQUIPMENT AND INSTRUMENTS
8.5(1) Issue: The operability of the liquid and gaseous post accident sampling system and
methods are improperly considered, maintained, trained and tested.
The following facts were identified by the team during the review:
− the procedures (2PEQ 01, 2PEQ02, 2PEQ03, 2PEQ04) are inadequately developed for
comprehensive post accident sampling,
− methods for obtaining, transporting and analyzing samples are not defined,
− the exact sampling points for obtaining liquid and gaseous samples are not defined,
− the necessary equipment for sampling (transportation trolley, dilution stand, shielding)
are not available,
− the only training for staff was a classroom training on the procedures,
− exercises and drills on simulated operation of the system have never been performed
in the plant,
− system operability is not tested and maintained periodically.
Without adequately trained personnel for liquid and gaseous post accident sampling and
ensuring availability of system, the plant may not be adequately prepared for this work to be
performed in the requested time, and may not be familiar with overall actions to be taken and
could affect personnel safety during accident conditions.
Recommendation: Post accident sampling procedures, training, engineering support,
maintaining and periodically testing activities should be improved in order to ensure
operability of the system for requested liquid and gaseous samples in post accident situations.
IAEA Basis:
NS-R-2
2.38. Instruments, tools, equipment, documentation and communication systems to be used in
emergencies shall be kept available and shall be maintained in good operating condition, in
such a manner that they are unlikely to be affected by or made unavailable by the postulated
accidents.
SSG-13,
6.43. A post-accident sampling system or other adequate sampling facility should be ready to
operate when required by emergency procedures and should also be considered for use in
taking regular samples from plant systems. If a post accident sampling system does not exist,
other approaches should be adopted for core damage evaluation and for estimation of the
inventory of fission products released into the containment.
6.44. For proper operation of a post-accident sampling system, the following should be
provided:
CHEMISTRY 61
(a) Operating procedures for the post-accident sampling system.
(b) Radiation protection measures for personnel who carry out sampling and analysis; such
measures should be evaluated in advance and applied when the post-accident sampling
system is used.
(c) A programme for preventive maintenance.
(d) Regular checks of the operability of the post-accident sampling system.
(e) Regular training of personnel designated for operation of the post-accident sampling
system (i.e. personnel taking grab samples and performing subsequent activities).
(f) Specification of the chemistry parameters to be monitored (e.g. conductivity in the reactor
water cleanup system and gaseous fission products in the main steam system).
(g) Procedures for optimizing occupational radiation exposure.
Safety of Nuclear Power Plants: Operation, Requirements, NS-R-2,
2.33. The emergency plan of the operating organization shall include the following:
(3) The arrangements for initial and subsequent assessment of the radiological
conditions on and off the site;
2.35. Site personnel shall be trained in the performance of their duties in an emergency. There
shall be a means of informing all employees and all other persons on the site of the actions to
be taken in the event of an emergency.
2.38. Instruments, tools, equipment, documentation and communication systems to be used in
emergencies shall be kept available and shall be maintained in good operating condition, in
such a manner that they are unlikely to be affected by or made unavailable by the postulated
accidents.
Radiation Protection and Radioactive Waste Management in the Operation of Nuclear Power
Plants, Safety Guide, NS-G-2.7,
5.4. Training for workers should cover all topics relevant to the radiation task assignments
and the potential risks. Those who need to work in zones of high radiation levels should be
trained in their specific work activities so as to enable them to perform their duties in the
minimum possible time, in keeping with the principle of optimization. This could include, for
example, training on mock-ups, rehearsing the planned work and practicing emergency
actions.
5.7. Training on emergency procedures should be given periodically to ensure that all persons
who would need to take action in an emergency know which actions to take.
CHEMISTRY 62
8.6 QUALITY CONTROL OF OPERATIONAL CHEMICALS AND OTHER
SUBSTANCES
8.6(1) Issue: The process for storage and quality control of operational chemicals and other
substances is not at an appropriate standard.
The team identified the following programme facts during the review:
− different and non consistent procedures are used (PA-GE75, 2PA-QR07, 2PA-QG01,
not valid procedure for Unit2) instead of having one combined procedure for
purchase, quality control and use of operational chemicals and other substances,
− quality requirements for purchase and use of operational chemicals and other
substances are not given in those procedures,
− the Areva documents (ie. MTS 134.00 from 1992 and 1998, GPS.T-1-00/0129 from
2000) are still used without any revision and approval,
− the classification (commercial N/A, non safety Q, nuclear safety S) is done by
engineering support, and there is no chemistry involvement in the quality control
process,
− ~5% of the stored items are not classified (commercial N/A, non safety Q, nuclear
safety S).
In addition, the following performance facts were also observed by the team:
− all operational chemicals and other substances are stored in warehouses and used at
workplaces without easily visible quality control identification and approval labelling,
the use of teflon is prohibited in the primary side of the plant but teflon/rubber
sealings were found in the central warehouse to be used in high temperature LBA
systems (317459: main steam isolating valve, 317430: blow down isolating valve)
acids and alkaline solutions were stored in the same chemical warehouse without
physical separation,
− mortar (Argamassa) was stored together with operational chemicals in the chemical
warehouse,
− 2 drums (200 l each) were found in the temporary warehouse for flammables with
inflated and heavily corroded lids,
− 200 l drum of Fyrquel was stored outside the oil warehouse without any indication of
danger,
− two damaged sacks containing ion exchange resins were stored together with intact
ones in the chemical warehouse,
− 200 l drums for temporary storage of oil were found without identification labels in
turbine building at -0.85m level,
− isolation oil tank without retention containment, stored close to the road in a zone not
dedicated for storage,
CHEMISTRY 63
− large amounts of lithium-hydroxide and boric acid were found in the hot lab without
quality control identification and approval label, bottles and canisters containing
flammable liquids were stored in room JA0864, flammable chemicals were stored in
the welding workshop and in the decontamination room KA0423 without quality
control identification and approval label,
− a can of lubricating oil spray was found in the emergency diesel generator room
without labelling and approval,
− a plastic bag full with water samples was observed in the cold lab without any
identification.
Without a well structured and comprehensive process for storage and quality control of
operational chemicals and other substances the inappropriately stored and controlled
chemicals and other substances could have the potential risk of improper use, personal injury
and have detrimental effects on safety system components.
Recommendation: The plant should establish and implement a well structured and
comprehensive process for storage and quality control of operational chemicals and other
substances.
IAEA Basis:
NS-R-2
6.11. Arrangements shall be made to procure, receive, store and issue parts and materials for
use in the plant. For further guidance see Safety Series No. 50-C/SG-Q on Quality Assurance
for Safety in Nuclear Power Plants and other Nuclear Installations, and in particular the Code
and the Safety Guides Q4, Q6, Q12 and Q13 [4].
SSG-13,
9.1. A policy should be established to prevent the use of chemicals or other substances that
could introduce potentially harmful impurities into plant areas or circuits, thereby affecting
the coolant, auxiliary and safety systems, or other external surfaces. The responsibility for
coordinating the control of chemicals and other substances on-site should also be clearly
established in accordance with the requirements established in Ref. [7].
9.2. The operating organization should be responsible for the use of the proper chemicals and
for their correct quality.
9.3. The use of chemicals and other materials at the plant, including those brought to the plant
by contractors, should be controlled in accordance with clearly established procedures. The
intrusion of non-conforming chemicals or other substances into plant systems can result in
deviations in the chemistry regime, leading to component and system damage or increase of
dose rates. The use of uncontrolled materials on the surfaces of the components may also
induce damage.
CHEMISTRY 64
9.4. One or more lists of approved chemicals and other substances that are allowed to be used
at the nuclear power plant should be made available. These lists should be well known by
chemistry, maintenance and procurement staff and contractors.
9.5. The reagents and ion exchange resins used for any safety related system should be within
the required specifications with regard to impurities and this should be verified before their
use.
9.6. Chemicals and other substances should not be used in systems, structures or components
if they contain corrosion inducing components above specified limits.
9.7. Procedures for the procurement, storage, replacement and ordering of chemicals and
other substances, including hazardous chemicals, should be made available.
9.8. When receiving chemicals, the specified quality should be verified by chemical analysis
and/or by a certificate and a chemical identification test.
9.9. Chemicals and substances should be labelled according to the area in which they are
permitted to be used, so that they can be clearly identified. The label should indicate the shelf
life of the material.
9.10. When a chemical is transferred from a stock container to a smaller container, the latter
should be labelled with the name of the chemical, the date of transfer and pictograms to
indicate the risk and application area. The contents of the smaller container should not be
transferred back into the stock container. Residues of chemicals and substances should be
disposed of in accordance with plant procedures. The quality of chemicals in open stock
containers should be checked periodically.
9.11. The replacement of harmful chemicals or other substances (from the point of view of
personnel safety, environmental protection and material compatibility) by harmless ones
should be encouraged.
9.12. Staff involved in receiving, storing, transporting and using chemical substances should
be trained to understand storage compatibility, labelling requirements, handling, safety and
impacts on structures, systems and components at the plant (see Section 8).
9.13. Management should periodically carry out walk downs of the plant to evaluate the
effectiveness of the chemistry programme and to check for uncontrolled storage of chemicals.
9.14. Material safety data sheets for all approved chemicals and substances should be made
available and easily accessible. These data sheets should include, as minimum, possible
dangers to the health of staff, preventive measures for handling the materials and medical
recommendations in case of accidental use.
CHEMISTRY 65
9.15. Chemicals should only be stored in an appropriate store that is fire protected and
captures spillages and which is equipped with a safety shower, as required. Oxidizing and
reducing chemicals, flammable solvents and concentrated acid and alkali solutions should be
stored separately. Tanks containing chemicals should be appropriately labelled. Reasonably
small amounts of chemicals can be stored in other controlled environments in the workshops
or operational department.
9.16. In the storage of chemicals, account should be taken of the reduced shelf life of opened
containers. Unsealed and partly emptied containers should be stored in such a manner that the
remaining product is kept in a satisfactory condition.
9.17. A procedure should be established to define the proper quality of all oils used for each
component important to safety and used for the availability of systems important to safety.
9.18. Lubricants and hydraulic oils from systems important to safety and/or the availability of
systems important to safety should be regularly analysed to check control parameters that
characterize the condition of the lubricant.
Maintenance, Surveillance and In-service Inspection in Nuclear Power Plants, Safety Guide,
NS-G-2.6,
8.34. The administrative arrangements should include written procedures assigning the
responsibility for regularly examining stored items and auditing the administration of stores
in order to detect any deterioration or any unauthorized or unrecorded use of stored items.
Particular attention should be paid to retention of the original identification of items during
storage.
Safety in the use of chemicals at work – ILO:
4.3.2. The purpose of the label is to give essential information on:
a) the classification of the chemical;
b) its hazards;
c) the precautions to be observed.
The information should refer to both acute and chronic exposure hazards.
6.7.1. Hazardous chemicals should be stored under conditions specific to their inherent
properties and characteristics to ensure safety and in accordance with established criteria.
CHEMISTRY 66
6.7.3. The control measures to provide protection should cover any combination of the
following:
(a) the compatibility and segregation of stored chemicals,
(i) temperature, humidity and ventilation requirements,
(j) labelling and relabeling requirements,
(l) requirements relating to possible physical and chemical changes in stored chemicals (e.g.
not to store beyond the expiration period recommended on the label and the chemical safety
data sheet).
EMERGENCY PLANNING AND PREPAREDNESS 67
9. EMERGENCY PLANNING AND PREPAREDNESS
9.1. EMERGENCY PROGRAMME
The on-site emergency plan (PEL) is coordinated by a staff of 3 Full Time Equivalent agents.
However, there are no detailed job descriptions for this staff and no indicators are used to
drive their actions and activities.
9.2. RESPONSE FUNCTIONS
The transition from normal to emergency operations and the necessary emergency response
organisation (ERO) functions are clearly defined. The bases to take the appropriate mitigating
and urgent protective actions exist. The PEL is designed and elaborated to take the protective
actions for the people on the site before any exposure. However, as this precautionary
approach is not always possible, the PEL should include a more progressive emergency
response in order to guarantee, in any circumstances, the safety of all persons on the site and
emergency workers. The team has made a recommendation in this area.
The team noticed that the information and data exchanges between the on-site and off-site
emergency centres are mainly based on oral communications. No (white) board or other
communication aid or structured support documents are developed to record and share the
key information (performed assessments, conclusions and recommendations, etc.) and data
among the on-site and off-site ERO. The team encourages the plant to develop and enhance
tools, aids and support documents to improve the emergency response and facilitate the
transfer of the key information during the turnover process.
9.3. EMERGENCY PLANS AND ORGANIZATION
In case a site evacuation is decided by the plant when the PEL is activated, the evacuation
process could be performed efficiently due to efficient preparatory measures like the
implementation of a car policy facilitating a safe evacuation. The team has identified it as a
good practice.
9.7. TRAINING, DRILLS AND EXERCISES
A training program for ERO is not developed based on requirements defining the knowledge,
skill and competencies (qualification requirements) for each ERO function member.
The current drills and exercise program does not include sufficient characteristics to assess
the effectiveness of the ERO capability. The team has made a recommendation in this area.
EMERGENCY PLANNING AND PREPAREDNESS 68
DETAILED EMERGENCY PLANNING AND PREPAREDNESS FINDINGS
9.2. RESPONSE FUNCTIONS
9.2(1) Issue: The protection of all persons on the site in the event of an emergency is not
fully effective.
The team identified the following facts:
− The assembly points, located outside, are not equipped with any personal
protective measures (for example, overshoes, overalls, etc.) or equipment, except
for TLDs.
− No sheltering protective measure is considered in the on-site emergency plan
(PEL), except as an alternative for evacuation in case of adverse conditions
(blocking of the roads, significant radioactive release, etc.).
− No assembly points/rooms inside buildings.
− No mustering performed before site evacuation (only a subsequent check is
performed by the physical protection services to confirm the effective evacuation
of the site and the identification of any missing person).
− Some Alert/Site emergency criteria include events with potential hazard for the
on-site people (e.g. presence of toxic gases in the vicinity of the plant not under
control) whereas the on-site emergency plan does not consider emergency
protective measures under such conditions.
− No continuous monitoring of radiation levels at the assembly points and at the 2
on-site emergency centres located outside the vital area.
− If stable iodine administration is decided in a site emergency, the implementation
of this protective measure will be time consuming and resource constraining due
to the absence of people gathering/assembling as they are instructed to stay in their
workplaces.
− The emergency response equipment dedicated to the on-site responders (such as
physical protection personnel) does not include alarming dosimeters. There are no
dedicated emergency scheme legal dosimeters.
− There are no dedicated emergency alarming dosimeters with specific alarm levels
(higher than default alarm levels set at 50 µSv & 50 µSv/h).
− Escape routes are clearly marked (painted green line with fluorescent yellow
arrows) but not in the stairs. Obstacles or obstruction of emergency escape routes
as well as some escape route signs; missing EXIT (“SAIDA”) signs; and damaged
emergency escape lights were observed by the team.
EMERGENCY PLANNING AND PREPAREDNESS 69
− Evacuation of a zone/building as a result of a fire is not initiated by an alarm
signal but initiated and performed by the local intervention team. However,
announcement through the public address system is expected.
− There are no indications of the route to the four assembly points located outside.
Ineffective protection of all persons on the site could lead to unnecessary personnel
hazard, exposure and/or uncontrolled spread of contamination.
Recommendation: The plant should improve the effectiveness of the protection of all
persons on the site in case of an emergency.
Basis:
IAEA GS-R.2
4.51 The operator of a facility […] shall make arrangements to ensure the safety of all
persons on the site in the event of a nuclear or radiological emergency. This shall
include arrangements: […] for all persons on the site to take appropriate actions
immediately upon notification of an emergency; to account for those on the site; to
locate and recover those unaccounted for; […]. The facility shall provide suitable
assembly points for all persons on the site and “shall be provided with a sufficient
number of safe escape routes, clearly and durably marked, with reliable emergency
lighting, ventilation and other building services essential to the safe use of these
routes. The escape routes shall meet the relevant international requirements for
radiation zoning and fire protection and the relevant national requirements for
industrial safety and… security.”
IAEA GS-R.2 –, , ,
4.50 The jurisdictions within the precautionary action zone and/or the urgent
protective action planning zone shall make arrangements to take appropriate urgent
action promptly upon the notification of a nuclear or radiological emergency. These
arrangements shall include arrangements for: taking appropriate actions for the
protection of emergency workers;…..
EMERGENCY PLANNING AND PREPAREDNESS 70
4.56 Arrangements shall be made to protect emergency workers, in accordance with
international standards.
4.58 Those called upon to respond at a facility in threat category I, II or III […] shall
be designated as emergency workers. Such assisting personnel as […], medical
personnel and drivers and crews of evacuation vehicles shall be designated as
emergency workers.
4.62 […] arrangements to assess continually and to record the doses received by
emergency workers; procedures to ensure that doses received and contamination are
controlled in accordance with established guidance and international standards; and
arrangements for the provision of appropriate specialized protective equipment,
procedure and training for emergency response […]
GS-G-2.1
3.5 the operator should be responsible, as appropriate, for:
Table 3 […] Protect individuals on the site and on-site emergency workers
− […] Protection individuals on the site and within the area controlled by the
operator.
4.13 The urgent protective actions and countermeasures should include the following
[…]:
− Sheltering
Table 15 Assembly point: Locations where non-essential personnel at the facility are
assembled; accounted for and sheltered or evacuated […] Areas […] with sufficient
room for on-site non essential (non-response) staff (including construction workers or
other non permanent personnel). Easily accessible, provides some protection from a
release or exposure, and is continuously monitored.
[…]
Operational Support Centre (OSC): […] continuous monitoring of radiation levels; in
a location that will probably remain habitable under emergency conditions.
EMERGENCY PLANNING AND PREPAREDNESS 71
IAEA Basis:
EPR-METHOD-2003 –,
4.2.4. A4.7 Arrange for the safety of all people on the site in the event of a radiation
emergency. Include arrangements […] to account for those on the site; to locate those
unaccounted for; to implement urgent protective actions (i.e. evacuation, shelter […]
Arrange suitable assembly points for all persons in the facility and provide sufficient
number of safe escape routes, clearly and durably marked, with reliable emergency
lighting, ventilation and other building services essential to the safe use of these
routes. Ensure escape routes meet the relevant international requirements for radiation
zoning and fire protection and the relevant national requirements for industrial safety
and security. Provide suitable alarm and communication systems so that all persons in
the facility and on the site can be warned and instructed, even under emergency
conditions.
4.2.17. B5.2 […] For nuclear power plants, provide on-site personnel with thyroid
prophylaxis, which should not delay their evacuation or sheltering.
Develop a procedure to monitor the dose in the on-site assembly areas or shelters and
evacuate if necessary.
Arrange to monitor and manage the contamination of evacuees from the site […]
[…] There should be provisions to continuously monitor radiological conditions and
control of contamination within the facilities and for evacuation if warranted.
EMERGENCY PLANNING AND PREPAREDNESS 72
9.3 EMERGENCY PLANS AND ORGANIZATION
9.3(a) Good practice: The site evacuation could be performed efficiently at the appropriate
decision point due to efficient preparatory measures.
The site has implemented a car parking policy that requires cars to be parked at
authorized locations. It is also required that the cars are to be parked facing out in
these locations. This car policy is included in the mandatory yearly retraining
document for the general employees. The implemented policy observed during the
mission facilitates a safe evacuation process.
Every three months, the plant assesses the number of people expected for each of the
four assembly points. This estimation is further more refined weekly and is completed
by the determination of the number of the busses needed depending on the working
conditions (working hours, outside working hours, week, week-end) and the figures
are recorded in the weekly on-duty call list. This practice facilitates the initiation of an
evacuation of the site by limiting the required actions to the identified resources.
During the general off-site exercise, organized every two years, an effective
evacuation of the site is tested and the time needed to perform such a site evacuation is
recorded. These records indicate a complete evacuation of the site could be conducted
within ninety minutes, including the subsequent verification of the effective site
evacuation.
EMERGENCY PLANNING AND PREPAREDNESS 73
9.7. TRAINING, DRILLS AND EXERCISES
9.7(1) Issue: The periodic drills and exercises programme is not sufficient to assess the
effectiveness of the emergency response capability.
The team identified the following facts:
− No unannounced drills, exercises or mobilization tests are performed.
− The on-site and off-site exercises are always organized during working hours.
− The scope of internal exercises is limited in terms of duration; events tested
(limited to Unusual & Alert event categories); and participation of staff members
not involved in the emergency response organization (ERO).
− The turnover process of the ERO functions has never been tested during an
exercise.
− The simulated media (as actor) has never been tested during an exercise.
− The remote Emergency Centre located in Mambucaba is not included in the
exercise schedule.
− The plant does not have a systematic or organized process to check the regular
participation of ERO staff members during exercises.
Without sufficient periodic drills and exercises, the plant cannot effectively assess the
emergency response capability.
Recommendation: The plant should improve the periodic drills and exercise program
to include periodic, realistic, comprehensive and integrated on-site exercises.
IAEA Basis:
IAEA GS-R.2
5.33 Exercise programmes shall be conducted to ensure that all specified functions
required to be performed for emergency response and all organizational interfaces
[…] are tested at suitable intervals. These programmes shall include the participation
in some exercises of as many as possible of the organizations concerned.
5.34 The staff responsible for critical response functions […] shall participate in a
training exercise or drill at least once every year.
5.35 The officials off the site responsible for making decisions on protective actions
for the population within the precautionary action zone and/or the urgent protective
action planning zone […] shall regularly participate in exercises.
EMERGENCY PLANNING AND PREPAREDNESS 74
NS-R-2
2.37. The emergency plan shall be tested in an exercise before the commencement of
operation. There shall thereafter at suitable intervals be exercises of the emergency
plan, some of which shall be witnessed by the regulatory body. Some of these
exercises shall be integrated and shall include the participation of as many as possible
of the organizations concerned. The plans shall be subject to review and updating in
the light of experience gained.
Safety Series No.115
Appendix V – V.3 (e) […] provision be made for training personnel involved in
implementing emergency plans and the plans be rehearsed at suitable intervals in
conjunction with designated authorities
EPR-METHOD-2003
4.2.18. B6.3 Exercise scenarios, simulation, or play should be realistic. […]
Organizations that are not part of the response organization, but that could play an
important role (e.g. the builder of the facility, the IAEA) should participate in
exercises periodically.
4.2.18. B6.6 The individuals […] who would fill crucial leadership roles should
participate in the training, drills or exercises. Substitutes who would not fill those
positions during a real emergency should not be allowed.
SAFETY CULTURE 75
13. SAFETY CULTURE
13.1 WORK AND MANAGEMENT PRACTICES
The plant does not have an integrated process based management system in place. Informal
and non-systematic work practices exist at all levels of the organization. Some examples
include:
− handwritten and uncontrolled mark-ups of final work plans
− procedures are not updated timely, not followed and sometimes missing
− mechanism for involving staff in contributing improvement ideas is handled informally
− lack of clarity on how formal actions or modifications are undertaken following departmental
self- assessments
− operations does not apply a fully effective work control and authorization process
− the plant’s work control process is not always effective
− the planning, control, and evaluation of the surveillance program is not always performed in a
systematic and effective way
There is evidence of a basic assumption that informal systems are sufficient to ensure safety.
However, strong safety culture requires more formal and systematic ways of working in order
to reduce the risk of missed information, miscommunication, misunderstanding, and to have
control of work practices in a way that permits traceability of issues and focused learning and
improvement. It is also unclear how main multi-disciplinary processes are defined,
understood and integrated at the plant, and how linkages between processes are managed to
ensure proper alignment. For example, main processes such as supply and licensing cut
across directorates, putting control of critical contributors to safety outside the control of
plant management. Similarly, vision and direction setting for the plant is not well
communicated so employees can relate their work to the goals of the organization. The
assessment shows that there is a cultural preference for working on the more tangible,
compartmentalized and immediate issues, and less on addressing longstanding issues and
cross cutting main process problems.
The plant has undergone significant organizational change and there are more changes
planned for the coming year. It is not clear that a formal risk assessment was performed to
assess and manage the implications of the changes. From a safety culture perspective, this is
a concern because organizational changes:
− disrupt lines of communication
− shift responsibilities for safety
− can disorient personnel in their work functions
− disrupt control over clearly safety related functions
The plant manager is responsible and accountable for nuclear safety. However, critical
functions such as: procurement, engineering, licensing, and quality control are situated
outside the control of plant management. One example is the longstanding spare parts
problem which requires involvement of all four directorates, plus the legal department on a
higher hierarchical level in order to champion and resolve supply issues.
There are other examples of how the plant does not fully understand the importance of human
and organizational factors in cultivating safety. The screening of external operating
experience is performed by two engineers and does not include the perspective and
SAFETY CULTURE 76
understanding of a human factors specialist. Similarly, the behavioural sciences perspective is
only brought into event investigations if a preliminary assessment performed by Operations
determines that human or organizational issues have contributed to the event. This reliance on
engineering competencies has a high likelihood of overlooking underlying human factors and
latent organizational weaknesses. The team made a recommendation on these informal
practices.
The plant management team has, however, demonstrated good cross-disciplinary cooperation
and team work. The plant management could benefit from the talents of behavioural scientists
and organizational factor specialists to better support individuals and teams in carrying out
their tasks safely and successfully.
13.2 SAFETY IMAGE, RELATIONSHIPS AND ABILITY TO CHALLENGE AND
QUESTION
The plant culture reflects the national and local culture that creates emotionally warm and
relaxing interpersonal environments. This aspect of the plant’s culture translates into a
healthy awareness of the responsibility for the welfare of plant employees, the broader
community and the environment, which is the essence of safety culture. It supports healthy
communications, pride in work, and loyalty to the plant. This is a positive base for building a
constructive safety culture and should be maintained.
The plant has put significant effort into building a clear picture of safety culture in its
workforce. The results of this effort are evident in the consistency of language and concepts
expressed in interviews and focus groups. From a safety culture perspective this is positive
and the team recognized this as a good performance. Individuals at the plant feel that their
tasks and performance are important contributors to the success of the organization. However,
some consideration needs to be given to ways in which the focus on nuclear safety can be
enhanced. Events at other plants, show how consistently positive indicators can lead to high
confidence and a self-image of ‘we are one of the best’ in the world. Depending on how
widespread this focus is on positive indicators and pride in work, it can create a false sense
that risks are well managed at all levels of the organization. This, in turn, can lead to denial of
problems and a perception of being safe simply because negative signals do not fit into the
positive self-image.
A positive self-image combined with strong interpersonal relationships can, in the worst case,
create a culture where the majority share the same views. This cultural coherence can lead to
a strong inclination to fit-in, and an unwillingness to think independently, challenge and
criticize the bases for decisions and practices. The result of the safety culture assessment does
not show clear evidence of complacency, but it does show a tendency in that direction.
During all three focus groups and in interviews with managers, superintendents, supervisors
and staff, a very favourable and unified picture of the perceived success of the integrated
safety management approach was expressed. People were satisfied with the safety
performance of the plant. In contrast, the technical review of other OSART areas indicated
that this is not a fully realistic self-image. Challenges exist in a variety of areas such as:
• conduct of operations
SAFETY CULTURE 77
• conduct of maintenance
• surveillance programs
• fire prevention
• ageing management
• operating experience
• control and storage of equipment and tools
• management of significant organizational changes
• quality control of chemicals and other substances, etc.
When asked in interviews and focus groups what could be done to improve safety, most
responses identified topics outside the plant or outside the control of the plant management.
There is a reluctance to freely discuss internal safety problems and challenges. The team did
not observe strong evidence of open challenging and critical thinking about the performance
or practices at the plant. The team suggested that the plant be more self-critical.
13.3 LEADERSHIP, HUMAN PERFORMANCE AND ORGANIZATIONAL ASPECTS
The plant has a well developed approach to human performance whereby human performance
is linked to internal and external event information in order to help employees fully
understand how accidents can be avoided through the use of human performance tools.
During the interviews and focus groups it was clearly evident that employees have understood
the value of the human performance concepts and tools. From the perspective of cultivating
safety culture understanding, this approach to educating staff is positive.
As the plant continues to work with human performance and other training and development
activities, it needs to understand that it is shaping behaviours and practices that influence
culture. Specifically, it is important to ensure that the training is tailored to the local and
national culture.
For example, when training courses are brought into the organization from other countries,
special attention should be given to making sure that the training content does not directly or
indirectly devalue or discourage the interactions that are the healthy aspects of the safety
culture at the plant. These kinds of contradictions can create confusion in a culture and
degrade an organization’s way of functioning. Alignment with the local and national culture
is most important in the development of leadership expectations and training, where there is a
widespread tendency to emphasize an autocratic and rigid leadership style in nuclear
facilities. This should also be a consideration when implementing an integrated management
system.
Eletronuclear is in the process of establishing a leadership development program. It has
provided some formal leadership training opportunities to managers and frontline supervisors.
However, there is no formal leadership development program that has been created to
integrate three key aspects: leadership principles and practices, safety concepts and practices,
and the positive aspects of the local and Brazilian culture. The plant should tailor a leadership
program that incorporates these three aspects. The team made a suggestion in this regard.
SAFETY CULTURE 78
A final comment to the safety culture review, in order to be successful in enhancing safety
culture, the plant needs to develop a coherent strategy around all improvement activities (e.g.
technical, human performance, integrated management system), and understand how they
affect each other. When enhancing culture, improvement cannot be achieved through a list of
separate activities. Safety culture is inherent in all the activities of the organization. The
plant must take care to ensure that all improvements work with the positive aspects of the
existing local culture. Safety culture assessments (self and independent) are encouraged to be
conducted more frequently and used as the basis for making improvements.
SAFETY CULTURE 79
DETAILED SAFETY CULTURE FINDINGS
13.1 WORK AND MANAGEMENT PRACTICES
13 (1) Issue: Some aspect of the formal organizational management are missing and the
utility and plant do not clearly understand how omitted aspects can compromise nuclear
safety..
During the review the team noted the following:
− Lack of an integrated process based management system.
− Organizational structure does not support clear integration of organizational
goals and work processes that are critical to nuclear safety.
− Incomplete risk assessment of organizational changes.
− Incomplete long term strategy and plan for staff retention.
− Incomplete systematic leadership development and succession planning
process.
− Incomplete systematic safety culture assessment on a periodic basis.
− The plant manager is responsible and accountable for nuclear safety, however
the authority for nuclear safety is spread across multiple directorates.
− Root cause analyses are conducted but inconsistently executed (e.g. scope and
rigor, significant event reports not completed, and related corrective actions
lagging).
− Handwritten and uncontrolled mark ups of final work plans.
− Problem with inventory of spare parts for Angra 1 and 2, e.g. identification
coding, warehousing.
− Isolations completed and then the work not carried out due to lack of spare
parts.
− Challenges of maintaining consistency when applying the same procedures to
Angra 1 and 2.
− A characteristic of the plant is working informally through relationships and
verbal sharing of information.
− Acceptance of problems with the structure and placing accountability for
issues with other directorates (purchasing, legal), government and external
organizations (contractor companies) for not resolving systemic problems and
longstanding challenges.
SAFETY CULTURE 80
− Belief that engineering competencies are suited to assessing and addressing
human and organizational factors.
− Misunderstanding of the safety implications of the interaction between
individual, technology and organization.
− Not actively communicating organizational strategies and plans.
− Belief in the sufficiency of hierarchical, top down communication.
− Tolerance for inconsistently defined programs (technical surveillance, ageing
program, material inventory).
− Inconsistent follow through and fulfilment of commitments once problems
have been understood.
Not understanding and valuing missing organizational aspects can compromise
nuclear safety. Existence of unsystematic work practices and inconsistently defined
program and process dimensions can mask latent organizational weaknesses. This can
compromise organizational effectiveness and the prevention of events. Lack of
systemic thinking can lead to a narrow approach to understanding and solving safety
problems.
Recommendation: The utility should work with the plant in reviewing and understanding
how omitted organisational aspects can compromise nuclear safety and taking steps to
mitigate these disadvantages.
IAEA Basis:
GS-R-3
2.1. A management system shall be established, implemented, assessed and continually
improved. It shall be aligned with the goals of the organization and shall contribute to their
achievement. The main aim of the management system shall be to achieve and enhance safety
by:
− Bringing together in a coherent manner all the requirements for managing the
organization;
− Describing the planned and systematic actions necessary to provide adequate
confidence that all these requirements are satisfied;
− Ensuring that health, environmental, security, quality and economic requirements are
not considered separately from safety requirements, to help preclude their possible
negative impact on safety.
2.8. The documentation of the management system shall include the following:
− The policy statements of the organization;
− A description of the management system;
− A description of the structure of the organization;
SAFETY CULTURE 81
− A description of the functional responsibilities, accountabilities, levels of authority
and interactions of those managing, performing and assessing work;
− A description of the processes and supporting information that explain how work is to
be prepared, reviewed, carried out, recorded, assessed and improved.
2.9. The documentation of the management system shall be developed to be understandable to
those who use it. Documents shall be readable, readily identifiable and available at the point
of use.
2.10. The documentation of the management system shall reflect:
− The characteristics of the organization and its activities;
− The complexities of processes and their interactions.
5.6. For each process a designated individual shall be given the authority and responsibility
for:
− Developing and documenting the process and maintaining the necessary supporting
documentation;
− Ensuring that there is effective interaction between interfacing processes;
− Ensuring that process documentation is consistent with any existing documents;
− Ensuring that the records required to demonstrate that the process results have been
achieved are specified in the process documentation;
− Monitoring and reporting on the performance of the process;
− Promoting improvement in the process;
− Ensuring that the process, including any subsequent changes to it, is aligned with the
goals, strategies, plans and objectives of the organization.
5.7. For each process, any activities for inspection, testing, verification and validation, their
acceptance criteria and the responsibilities for carrying out these activities shall be specified.
For each process, it shall be specified if and when these activities are to be performed by
designated individuals or groups other than those who originally performed the work.
5.8. Each process shall be evaluated to ensure that it remains effective.
5.9. The work performed in each process shall be carried out under controlled conditions, by
using approved current procedures, instructions, drawings or other appropriate means that are
periodically reviewed to ensure their adequacy and effectiveness. Results shall be compared
with expected values.
5.10. The control of processes contracted to external organizations shall be identified within
the management system. The organization shall retain overall responsibility when contracting
any processes.
GS-G-3.5
2.30. Reference [1] states in para. 2.5 that:
“The management system shall be used to promote and support a strong safety culture by:
SAFETY CULTURE 82
— Providing the means by which the organization supports individuals and teams in carrying
out their tasks safely and successfully, taking into account the interaction between
individuals, technology and the organization.”
……..
Human factors and the interaction between individuals, technology and the
organization
2.32. All safety barriers are designed, constructed, strengthened, breached or eroded by the
action or inaction of individuals. Human factors in the organization are critical for safe
operation and they should not be separated from technical aspects. Ultimately, safety results
from the interaction of individuals with technology and with the organization.
2.33.The concept of safety culture embraces this integration of individuals and technical
aspects. However, whereas the culture of an organization influences human behaviour
through the values, beliefs and assumptions held by the personnel of the organization, there
are also other factors that may have an influence on how humans act in a given situation.
2.34. In a strong safety culture, there should be a knowledge and understanding of human
behaviour mechanisms and established human factor principles should be applied to ensure
the outcomes for safety of individuals–technology–organization interactions. This could be
achieved by including experts on human factors in all relevant activities and teams.
2.35. The interaction between the individual, technology and the organization can be
explained as follows. In a given situation, individuals have various types of resource at their
disposal to enable them to carry out a task successfully.
These resources may be intrinsic to the individual in the form of competence, motivation,
cognitive abilities, etc. Resources may also be physical resources (such as instrumentation,
procedures or computer aids), or they may reside in the working environment, through
teamwork, communication and leadership, in the management system and in the culture.
When the content, design and organization of the task correspond to the individual’s needs
and capabilities, the conditions prevail for the individual to perform in a way that promotes
safety. Thus, resources intrinsic and extrinsic to the individual may help in preventing human
error by providing barriers to error.
2.36. When analysing events, consideration should be given to the possible influence of all
these factors on human behaviour. These factors should also be considered when the purpose
is to identify potential weaknesses in the interactions between individuals–technology–
organization and to determine how to strengthen barriers or introduce new barriers to prevent
human error. Ideally, interdisciplinary teams should carry out predictive and preventive
analyses of these types of event. Such teams should include human behaviour competence, so
as to analyse the individuals–technology–organization interactions from different perspectives
in order to identify suitable barrier functions.
2.37. Individuals should also be trained in how to recognize situations that are likely to give
rise to errors, so that they can avoid making mistakes. In addition, there are various activities
that could be carried out on an individual basis to prevent error. Among these are:
SAFETY CULTURE 83
(a)Pre-job briefings, asking the questions: What are the critical steps? What situations
associated with the work assignment are likely to give rise to errors? What defences are
in place to prevent events?
(b)Self-checks applying the stop–think–act–review (STAR) concept.
(c)Peer checks — having a second individual check the intended action prior to carrying
it out.
(d)Three-way communication by which a message is communicated from one individual
to another. The individual receiving the message repeats the message to confirm a clear
understanding and the originator acknowledges that the message has been correctly
understood and so closes the communication loop.
(e)Conservative decision making should be applied when there are no procedures in place or
plans made for the activity. Further guidance is provided in Ref. [7].
SAFETY CULTURE 84
13.2 SAFETY IMAGE, RELATIONSHIPS AND ABILITY TO CHALLENGE AND
QUESTION
13(2) Issue: The plant does not demonstrate sufficient critical thinking, willingness to
challenge, and critical questioning.
During the review, the team identified the following:
− Favourable and unified picture delivered by managers during focus group e.g.
integrated safety approach, success of cultivating safety awareness inside the
plant and the broader community.
− Tendency to externalize safety concerns – problems are ‘outside the fence’
and ‘outside of our control’
− Strong interpersonal relationships, social norms and conforming
− No evidence in interviews, focus groups or safety culture survey of different
or challenging perspectives on the current state.
− Very few examples of poor practices internally, preferring reference to
unacceptable safety practices in other external organizations.
− Belief that procedure updating, dissemination and adherence is sufficient to
ensure safety.
− Technical and organizational issues not resolved in a timely manner.
− Sometimes minimizing the importance of identifying and solving problems.
− There is a demonstration of pride that could lead to lower consideration for
risks
− Social relationships extend to all aspects of life, namely work, home life,
community, recreation.
Without adequate self-critique, the plant may not recognize long standing issues
important to safety, and may exhibit a pattern of mutual reassurance that does not
challenge common reasoning.
Suggestion: The plant should consider being more willing to challenge, to encourage critical
thinking, questioning of interpretations and conclusions, to seek diverse opinions, and to
demonstrate greater focus on safety.
SAFETY CULTURE 85
Basis: GS-G-3.5
“Management should establish processes and should show by individual example and
direction that it expects individuals to look for ways to learn and improve with regard to
safety.” Section 2.18
Safety culture attributes:
LEADERSHIP FOR SAFETY IS CLEAR - ”Managers should not tolerate or ignore
substandard performance in relation to safety for any reason.”
SAFETY IS LEARNING DRIVEN –”A questioning attitude prevails at all organizational
levels:
— Individuals should notice and should be able to question unusual signs and occurrences
and should seek guidance when in doubt.
—Individuals at all levels should be encouraged to ask detailed questions in meetings.
— Management should be questioning of its own attitudes and views and should actively
seek independent views.
GS-G-3.5 “An organization should continually strive to improve its performance so that it
does not become complacent. Complacency is often a precursor to a serious decline in safety
culture.”
Section 2.18.
“The following are typical symptoms of a decline in safety culture:
• Organizations become complacent and focus on the successes of the past, and are
reluctant to invest in acquiring new knowledge and skills for the future.” Section 2.29.
SAFETY CULTURE 86
13.3 LEADERSHIP, HUMAN PERFORMANCE AND ORGANIZATIONAL ASPECTS
13 (3) Issue: There is no clearly defined program for establishing and developing leadership
competencies, selecting leaders, and aligning leadership expectations with the strengths of the
local and national culture.
The team identified the following facts:
− Lack of leadership development program.
− Use of international organizations training.
− Lack of formal plant succession planning.
− Leadership principles and expectations are not formally defined and used in
management and leadership evaluation.
− Focus on cultivating organizational image rather than actual processes.
− Employee perception that they are not heard or listened to, including during problem
solving.
− High value placed on technical competency rather than supervisory responsibilities for
addressing human and interpersonal issues and organizational management.
− Inconsistent leadership styles and practices.
− Strong preference for hierarchical leadership style.
− Belief that good leadership involves self-confidence, charisma, technical knowledge,
and self-control, and not always the capacity to chart a future course and get things
done.
Lack of purposeful identification and development of leaders can result in poor focus,
alignment and achievement required for safety.
Suggestion: The plant should consider establishing its own clearly defined programme
regarding required leadership expectations and competencies as well as selection criterias for
leadership positions.
IAEA Basis:
SF1
Principle 3: Leadership and management for safety
Effective leadership and management for safety must be established and sustained in
organizations concerned with, and facilities and activities that give rise to, radiation risks.
3.12. Leadership in safety matters has to be demonstrated at the highest levels in an
organization. Safety has to be achieved and maintained by means of an effective management
SAFETY CULTURE 87
system. This system has to integrate all elements of management so that requirements for
safety are established and applied coherently with other requirements, including those for
human performance, quality and security, and so that safety is not compromised by other
requirements or demands. The management system also has to ensure the promotion of a
safety culture, the regular assessment of safety performance and the application of lessons
learned from experience.
3.13. A safety culture that governs the attitudes and behaviour in relation to safety of all
organizations and individuals concerned must be integrated in the management system. Safety
culture includes:
—Individual and collective commitment to safety on the part of the leadership, the
management and personnel at all levels;
— Accountability of organizations and of individuals at all levels for safety;
—Measures to encourage a questioning and learning attitude and to discourage complacency
with regard to safety.
GS-G-3.5
Leadership for safety is clear
Section 2.15. Senior managers should be the leading advocates of safety and should
demonstrate in both words and actions their commitment to safety. The ‘message’ on safety
should be communicated frequently and consistently. Leaders8 develop and influence cultures
by their actions (and inactions) and by the values and assumptions that they communicate. A
leader is a person who has an influence on the thoughts, attitudes and behaviour of others.
Leaders cannot completely control safety culture, but they may influence it. Managers and
leaders throughout an organization should set an example for safety, for example, through
their direct involvement in training and in oversight in the field of important activities.
Individuals in an organization generally seem to emulate the behaviours and values that their
leaders personally demonstrate. Standards should therefore be set within the organization for
aspects that are important for safety.
The difference between management and leadership can be stated simply whereby
‘management’ is a function and ‘leadership’ is a relationship. Management ensures that work
is completed in accordance with requirements, plans and resources. It is through leadership
that individuals may be influenced and motivated, and organizations changed. Managers may
also act as leaders.
Safety culture attributes:
”Managers and leaders throughout an organization should set an example for safety, for
example, through their direct involvement in training and in oversight in the field of
important activities.” Section 2.18
LEADERSHIP FOR SAFETY IS CLEAR
Leadership skills are systematically developed:
SAFETY CULTURE 88
— Managers and supervisors should be selected and evaluated with due consideration of their
demonstrated ability to foster a strong safety culture.
—A succession plan that includes aspects of safety culture should be put in place for
developing future managers.
89
DEFINITIONS
DEFINITIONS – OSART MISSION
Recommendation
A recommendation is advice on what improvements in operational safety should be made in
that activity or programme that has been evaluated. It is based on IAEA Safety Standards or
proven, good international practices and addresses the root causes rather than the symptoms
of the identified concern. It very often illustrates a proven method of striving for excellence,
which reaches beyond minimum requirements. Recommendations are specific, realistic and
designed to result in tangible improvements. Absence of recommendations can be interpreted
as performance corresponding with proven international practices.
Suggestion
A suggestion is either an additional proposal in conjunction with a recommendation or may
stand on its own following a discussion of the pertinent background. It may indirectly
contribute to improvements in operational safety but is primarily intended to make a good
performance more effective, to indicate useful expansions to existing programmes and to
point out possible superior alternatives to ongoing work. In general, it is designed to stimulate
the plant management and supporting staff to continue to consider ways and means for
enhancing performance.
Note: if an item is not well based enough to meet the criteria of a ‘suggestion’, but the expert
or the team feels that mentioning it is still desirable, the given topic may be described in the
text of the report using the phrase ‘encouragement’ (e.g. The team encouraged the plant
to…).
Good practice
A good practice is an outstanding and proven performance, programme, activity or equipment
in use that contributes directly or indirectly to operational safety and sustained good
performance. A good practice is markedly superior to that observed elsewhere, not just the
fulfilment of current requirements or expectations. It should be superior enough and have
broad application to be brought to the attention of other nuclear power plants and be worthy
of their consideration in the general drive for excellence. A good practice has the following
characteristics:
− novel;
− has a proven benefit;
− replicable (it can be used at other plants);
− does not contradict an issue.
90
The attributes of a given ‘good practice’ (e.g. whether it is well implemented, or cost
effective, or creative, or it has good results) should be explicitly stated in the description of
the ‘good practice’.
Note: An item may not meet all the criteria of a ‘good practice’, but still be worthy to take
note of. In this case it may be referred as a ‘good performance’, and may be documented in
the text of the report. A good performance is a superior objective that has been achieved or a
good technique or programme that contributes directly or indirectly to operational safety and
sustained good performance, that works well at the plant. However, it might not be necessary
to recommend its adoption by other nuclear power plants, because of financial
considerations, differences in design or other reasons.
91
LIST OF IAEA REFERENCES (BASIS)
Safety Standards
• SF-1; Fundamental Safety Principles (Safety Fundamentals)
• Safety Series No.115; International Basic Safety Standards for Protection
Against Ionizing Radiation and for the Safety of Radiation Sources
• Safety Series No.117; Operation of Spent Fuel Storage Facilities
• NS-R-1; Safety of Nuclear Power Plants: Design Requirements
• NS-R-2; Safety of Nuclear Power Plants: Operation (Safety Requirements)
• NS-G-1.1; Software for Computer Based Systems Important to Safety in
Nuclear Power Plants (Safety Guide)
• NS-G-2.1; Fire Safety in the Operation of Nuclear Power Plans (Safety Guide)
• NS-G-2.2; Operational Limits and Conditions and Operating Procedures for
Nuclear Power Plants (Safety Guide)
• NS-G-2.3; Modifications to Nuclear Power Plants (Safety Guide)
• NS-G-2.4; The Operating Organization for Nuclear Power Plants (Safety
Guide)
• NS-G-2.5; Core Management and Fuel Handling for Nuclear Power Plants
(Safety Guide)
• NS-G-2.6; Maintenance, Surveillance and In-service Inspection in Nuclear
Power Plants (Safety Guide)
• NS-G-2.7; Radiation Protection and Radioactive Waste Management in the
Operation of Nuclear Power Plants (Safety Guide)
• NS-G-2.8; Recruitment, Qualification and Training of Personnel for Nuclear
Power Plants (Safety Guide)
• NS-G-2.9; Commissioning for Nuclear Power Plants (Safety Guide)
• NS-G-2-10; Periodic Safety Review of Nuclear Power Plants (Safety Guide)
• NS-G-2.11; A System for the Feedback of Experience from Events in Nuclear
Installations (Safety Guide)
• NS-G-2.12; Ageing Management for Nuclear Power Plants (Safety Guide)
• NS-G-2.13; Evaluation of Seismic Safety for Existing Nuclear Installations
(Safety Guide)
• NS-G-2.14; Conduct of Operations at Nuclear Power Plants (Safety Guide)
92
• NS-G-2.15; Severe Accident Management Programmes for Nuclear Power
Plants Safety Guide (Safety Guide)
• GS-R-1; Legal and Governmental Infrastructure for Nuclear, Radiation,
Radioactive Waste and Transport Safety (Safety Requirements)
• GS-R-2; Preparedness and Response for a Nuclear or Radiological Emergency
(Safety Requirements)
• GS-R-3; The Management System for Facilities and Activities (Safety
Requirements)
• GS-G-2.1; Arrangement for Preparedness for a Nuclear or Radiological
Emergency (Safety Guide)
• GS-G-3.1; Application of the Management System for Facilities and Activities
(Safety Guide)
• GS-G-3.5; The Management System for Nuclear Installations (Safety Guide)
• RS-G-1.1; Occupational Radiation Protection (Safety Guide)
• RS-G-1.2; Assessment of Occupational Exposure Due to Intakes of
Radionuclides (Safety Guide)
• RS-G-1.3; Assessment of Occupational Exposure Due to External Sources of
Radiation (Safety Guide)
• RS-G-1.8; Environmental and Source Monitoring for Purpose of Radiation
Protection (Safety Guide)
• WS-G-6.1; Storage of Radioactive Waste (Safety Guide)
• SSG-13; Chemistry Programme for Water Cooled Nuclear Power Plants
� INSAG, Safety Report Series
• INSAG-4; Safety Culture
• INSAG-10; Defence in Depth in Nuclear Safety
• INSAG-12; Basic Safety Principles for Nuclear Power Plants, 75-INSAG-3
Rev.1
• INSAG-13; Management of Operational Safety in Nuclear Power Plants
• INSAG-14; Safe Management of the Operating Lifetimes of Nuclear Power
Plants
• INSAG-15; Key Practical Issues In Strengthening Safety Culture
• INSAG-16; Maintaining Knowledge, Training and Infrastructure for Research
and Development in Nuclear Safety
93
• INSAG-17; Independence in Regulatory Decision Making
• INSAG-18; Managing Change in the Nuclear Industry: The Effects on Safety
• INSAG-19; Maintaining the Design Integrity of Nuclear Installations
Throughout Their Operating Life
• INSAG-20; Stakeholder Involvement in Nuclear Issues
• INSAG-23; Improving the International System for Operating Experience
Feedback
• Safety Report Series No.11; Developing Safety Culture in Nuclear Activities
Practical Suggestions to Assist Progress
• Safety Report Series No.21; Optimization of Radiation Protection in the
Control of Occupational Exposure
• Safety Report Series No.48; Development and Review of Plant Specific
Emergency Operating Procedures
� Other IAEA Publications
• IAEA Safety Glossary Terminology used in nuclear safety and radiation
protection 2007 Edition
• Services series No.12; OSART Guidelines
• EPR-EXERCISE-2005; Preparation, Conduct and Evaluation of Exercises to
Test Preparedness for a Nuclear or Radiological Emergency, (Updating IAEA-
TECDOC-953)
• EPR-METHOD-2003; Method for developing arrangements for response to a
nuclear or radiological emergency, (Updating IAEA-TECDOC-953)
• EPR-ENATOM-2002; Emergency Notification and Assistance Technical
Operations Manual
� International Labour Office publications on industrial safety
• ILO-OSH 2001; Guidelines on occupational safety and health management
systems (ILO guideline)
• Safety and health in construction (ILO code of practice)
• Safety in the use of chemicals at work (ILO code of practice)
94
TEAM COMPOSITION OF THE OSART MISSION
GEST Pierre - IAEA
IAEA
Years of nuclear experience: 32
Review area: Team Leader
HENDERSON Neil - IAEA
IAEA
Years of nuclear experience: 34
Review area: Deputy Team Leader
JEANNIN Bernard – IAEA
Years of nuclear experience: 28
Review area: MOA
BASRA Kirandeep Kaur – UK
Bradwell site
Years of nuclear experience: 4
Review area: RP
BLADON Alan - UK
British Energy, UK
Years of nuclear experience: 14
Review area: Operations
DEGUELDRE Didier – Belgium
Bel V, subsidiary of the Federal Agency for
Nuclear Control (FANC)
Years of nuclear experience: 23
Review area: Emergency Planning and Preparedness
FRANZETTI Christophe – FRA
EDF
Years of nuclear experience: 21
Review area: Operations II
HAAGE Monica -IAEA
Years of nuclear experience: 8
Review area: Safety Culture
LYRSTEDT Fredrik – SWE
Ringhals AB
Years of nuclear experience: 5
Review area: Maintenance
95
MALKHASYAN Hakob – ARM
WorleyParsons Nuclear Services
Years of nuclear experience: 22
Review area: Technical Support
MARTINENKO Yuri– IAEA
Years of nuclear experience: 27
Review area: Operating Experience
RENEV Alexander - EU
JRC-IE
Years of nuclear experience: 31
Review area: Training and Qualification
SCHUNK Janos – HUN
Paks NPP
Years of nuclear experience:33
Review area: Chemistry
WATTS Germaine - CAN
New Brunswick Power Corporation
Years of nuclear experience: 10
Review area: Safety Culture
OBSERVERS
VALAITHAM Mahesh – ZA
Koeberg Nuclear Power Station, ESKOM
Years of nuclear experience: 15
Review area: Observer
LIU Hai Rong – CPR
Years of nuclear experience: 10
Review area: Observer