160 Angra 2 (FU) - International Atomic Energy Agency Mission to Angra 2_Mar...The Angra 2 OSART mission was the 160 th in the programme, which began in 1982. The team was composed

NSNI/OSART/160/011

ORIGINAL: English

DIVISION OF NUCLEAR INSTALLATION SAFETY

OPERATIONAL SAFETY REVIEW MISSION

IAEA-NSNI/OSART/160/011

REPORT

OF THE

OSART (OPERATIONAL SAFETY REVIEW TEAM)

MISSION

TO THE

ANGRA 2

NUCLEAR POWER PLANT

BRAZIL

28 March – 14 April 2011

PREAMBLE

This report presents the results of the IAEA Operational Safety Review Team (OSART)

review of Angra 2 Nuclear Power Plant, Brazil. It includes recommendations for

improvements affecting operational safety for consideration by the responsible Brazilian

authorities and identifies good practices for consideration by other nuclear power plants. Each

recommendation, suggestion, and good practice is identified by a unique number to facilitate

communication and tracking.

Any use of or reference to this report that may be made by the competent Brazilian

organizations is solely their responsibility.

FOREWORD

by the

Director General

The IAEA Operational Safety Review Team (OSART) programme assists Member States to

enhance safe operation of nuclear power plants. Although good design, manufacture and

construction are prerequisites, safety also depends on the ability of operating personnel and

their conscientiousness in discharging their responsibilities. Through the OSART programme,

the IAEA facilitates the exchange of knowledge and experience between team members who

are drawn from different Member States, and plant personnel. It is intended that such advice

and assistance should be used to enhance nuclear safety in all countries that operate nuclear

power plants.

An OSART mission, carried out only at the request of the relevant Member State, is directed

towards a review of items essential to operational safety. The mission can be tailored to the

particular needs of a plant. A full scope review would cover nine operational areas:

management, organization and administration; training and qualification; operations;

maintenance; technical support; operating experience feedback; radiation protection; chemistry;

and emergency planning and preparedness. Depending on individual needs, the OSART review

can be directed to a few areas of special interest or cover the full range of review topics.

Essential features of the work of the OSART team members and their plant counterparts are the

comparison of a plant's operational practices with best international practices and the joint

search for ways in which operational safety can be enhanced. The IAEA Safety Series

documents, including the Safety Standards and the Basic Safety Standards for Radiation

Protection, and the expertise of the OSART team members form the bases for the evaluation.

The OSART methods involve not only the examination of documents and the interviewing of

staff but also reviewing the quality of performance. It is recognized that different approaches are

available to an operating organization for achieving its safety objectives. Proposals for further

enhancement of operational safety may reflect good practices observed at other nuclear power

plants.

An important aspect of the OSART review is the identification of areas that should be improved

and the formulation of corresponding proposals. In developing its view, the OSART team

discusses its findings with the operating organization and considers additional comments made

by plant counterparts. Implementation of any recommendations or suggestions, after

consideration by the operating organization and adaptation to particular conditions, is entirely

discretionary.

An OSART mission is not a regulatory inspection to determine compliance with national safety

requirements nor is it a substitute for an exhaustive assessment of a plant's overall safety status,

a requirement normally placed on the respective power plant or utility by the regulatory body.

Each review starts with the expectation that the plant meets the safety requirements of the

country concerned. An OSART mission attempts neither to evaluate the overall safety of the

plant nor to rank its safety performance against that of other plants reviewed. The review

represents a `snapshot in time'; at any time after the completion of the mission care must be

exercised when considering the conclusions drawn since programmes at nuclear power plants

are constantly evolving and being enhanced. To infer judgements that were not intended would

be a misinterpretation of this report.

The report that follows presents the conclusions of the OSART review, including good

practices and proposals for enhanced operational safety, for consideration by the Member

State and its competent authorities.

CONTENT

INTRODUCTION AND MAIN CONCLUSIONS ................................................................... 1�

1.� MANAGEMENT, ORGANIZATION AND ADMINISTRATION.................................. 3�

2.� TRAINING AND QUALIFICATIONS ........................................................................... 11�

3.� OPERATIONS ................................................................................................................. 15�

4.� MAINTENANCE ............................................................................................................ 23�

5.� TECHNICAL SUPPORT ................................................................................................ 36�

6.� OPERATING EXPERIENCE FEEDBACK .................................................................... 41�

7.� RADIATION PROTECTION .......................................................................................... 49�

8.� CHEMISTRY .................................................................................................................. 53�

9.� EMERGENCY PLANNING AND PREPAREDNESS .................................................. 67�

DEFINITIONS ......................................................................................................................... 89�

LIST OF IAEA REFERENCES (BASIS) ................................................................................ 91�

TEAM COMPOSITION OF THE OSART MISSION ............................................................ 94�

INTRODUCTION AND MAIN CONCLUSIONS1

INTRODUCTION AND MAIN CONCLUSIONS

INTRODUCTION

At the request of the government of the Republic of Brazil, an IAEA Operational Safety Review

Team (OSART) of international experts visited Angra 2 Nuclear Power Plant from 28 March –

14 April 2011. The purpose of the mission was to review operating practices in the areas of

Management organization and administration; Training and qualification; Operations;

Maintenance; Technical support; Operating Experience; Radiation protection; Chemistry;

Emergency planning and preparedness; and safety culture. In addition, an exchange of technical

experience and knowledge took place between the experts and their plant counterparts on how

the common goal of excellence in operational safety could be further pursued.

The two units on the site are operated by Eletronuclear. The first unit is a 640 MWe, PWR

supplied by Westinghouse. Unit 1 was put into commercial operation in January 1985. The

second Unit is a 1350 MWe supplied by Siemens/KWU. Unit 2 was put into commercial

operation in February 2001. There are approximately 650 permanent workers on the site.

The Angra 2 OSART mission was the 160th

in the programme, which began in 1982. The team

was composed of experts from Armenia, Belgium, Canada, France, Hungary, Russia, Sweden,

the United Kingdom, and together with the IAEA staff members and observers from China and

South Africa. The collective nuclear power experience of the team was approximately 317

years.

Before visiting the plant, the team studied information provided by the IAEA and the Angra

plant to familiarize themselves with the plant's main features and operating performance, staff

organization and responsibilities, and important programmes and procedures. During the

mission, the team reviewed many of the plant's programmes and procedures in depth, examined

indicators of the plant's performance, observed work in progress, and held in-depth discussions

with plant personnel.

Throughout the review, the exchange of information between the OSART experts and plant

personnel was very open, professional and productive. Emphasis was placed on assessing the

effectiveness of operational safety rather than simply the content of programmes. The

conclusions of the OSART team were based on the plant's performance compared with good

international practices.

The following report is produced to summarize the findings in the review scope, according to

the OSART Guidelines document. The text reflects only those areas where the team considers

that a Recommendation, a Suggestion, an Encouragement, a Good Practice or a Good

Performance is appropriate. In all other areas of the review scope, where the review did not

reveal further safety conclusions at the time of the review, no text is included. This is reflected

in the report by the omission of some paragraph numbers where no text is required.

MAIN CONCLUSIONS

The OSART team concluded that the managers of Angra 2 NPP are committed to improving the

operational safety and reliability of their plant. The team found good areas of performance,

including the following:

INTRODUCTION AND MAIN CONCLUSIONS2

− the plant established a programme to have Senior Reactor Licensed Engineers in

departments other than the operations department

− The plant has set-up an efficient evacuation process in case of emergency

A number of proposals for improvements in operational safety were offered by the team. The

most significant proposals include the following:

− The plant should fully implement an integrated management system

− The organisation should implement a timely procurement process which will support the

safe operation.

− The plant should improve its oversight and implementation of operating activities to

support high performance in the conduct of operations

− The plant should develop a comprehensive ageing management programme in order to

ensure the continued reliability of important systems, structures and components.

Angra 2 NPP management expressed a determination to address the areas identified for

improvement and indicated a willingness to accept a follow up visit in about eighteen months.

MANAGEMENT, ORGANIZATION AND ADMINISTRATION 3

1. MANAGEMENT, ORGANIZATION AND ADMINISTRATION

1.1. ORGANIZATION AND ADMINISTRATION

There are sufficient resources at the plant to conduct routine plant activities, to

respond to plant challenges and to deal with requests for assistance. New staff were

recruited since 2010 due to the restart of construction of Angra 3, a majority of which

are trained in Angra 2. The staffing policy is directed at retaining a pool of

experienced and knowledgeable staff. Moreover, since 2004, the plant has established

a programme to have senior reactor licensed engineers in departments other than the

operations department. The team considers this as a good practice.

1.3. MANAGEMENT OF SAFETY

Indicators are used to monitor the performance of the plant. According to these

indicators, Angra 2 was the front runner in 2009 when compared to the equivalent

plants in Germany. However, these indicators are not sufficient to give management

an in-depth overview of plant performance.

The plant is managed through several dedicated meetings. The rules are established

with a set of procedures but some aspects are not precisely described. The

communication is based on informal inter-relations between managers and staff. Also,

there are no formal tools to recognize and appreciate the contribution of individuals

and groups in the achievement of their tasks. There is no separate line department to

give an independent safety status of plant operation and to verify the operational

safety analysis. The above considerations indicate that there is a lack of an integrated

management system. The team made a recommendation in this area.

Ineffective procurement results in a large maintenance backlog, temporary

modifications and a lack of spare parts. This weakness already has affected the

operation of the plant and could compromise safety. The team made a

recommendation in this area.

1.5. INDUSTRIAL SAFETY PROGRAMME

The industrial safety behaviours and indicators are not overly advertised or

communicated on the plant. In the field, some safety rules, procedures and instructions

are not clearly stated or strictly adhered to. Managers and staff should consider

undertaking field observations with respect to industrial safety. Reports are issued

when a threshold is reached for a category of events. These reports are not widely

communicated to the staff and contractors. The team developed a suggestion in this

area.


DETAILED MANAGEMENT, ORGANIZATION AND ADMINISTRATION

FINDINGS

1.1. ORGANIZATION AND ADMINISTRATION

1.1(a) Good Practice: In 2004, the plant established a programme to have Senior Reactor

Licensed Engineers in departments other than the operations department. This programme

supports the safe operation of the plant and improves the plant knowledge of line managers and

engineers.

Currently there are nine licensed engineers in the following departments:

− two in system and reactor performance department;

− two in work control division;

− four in maintenance superintendence; and

− one in support engineering superintendence.

These engineers support their departments with the license training knowledge and assist in

the decision making process with regard to the safe operation of the plant.


1.3. MANAGEMENT OF SAFETY

1.3 (1) Issue: An effective integrated management system is not implemented at the plant.

Several elements of a management system were identified at the plant, however the following

facts were observed by the team:

− There is no integrated formal way to monitor safety performance and to obtain an

overview of departmental performance:

� There are no trends of low level indicators (e.g. break of hand, leg injuries,

etc) to assist in improving overall industrial safety,

� There are no performance indicators for the Quality/Safety level of spare

parts related to the preventive maintenance backlog,

� Performance indicators for materials management are not available,

� There are no performance indicators for the outage preparation phase,

� Absence of performance indicators used by the emergency planning and

preparedness (EPP) staff to drive their actions, activities and priorities.

− Job descriptions do not exist for some disciplines e.g. EPP and engineering

− Required qualification (knowledge, skills and competencies) is not defined for some

disciplines e.g. Emergency Response Organisation (ERO) members

− There is no extensive system of staff recognition in the plant and there is no strategy to

maintain or enhance workers motivation.

− There is a requirement at the plant to perform periodic self-assessments at the

management levels but no evidence has been shown in some departments since 2009.

Without a fully effective integrated management system in place, the management for safety

can be compromised.

Recommendation: The plant should fully implement an integrated management system.

IAEA Basis

GS-R-3:

2.1. A management system shall be established, implemented, assessed and continually

improved. It shall be aligned with the goals of the organization and shall contribute to their

achievement. The main aim of the management system shall be to achieve and enhance safety

by:

− Bringing together in a coherent manner all the requirements for managing the

organization;

− Describing the planned and systematic actions necessary to provide adequate

confidence that all these requirements are satisfied;


− Ensuring that health, environmental, security, quality and economic requirements

are not considered separately from safety requirements, to help preclude their

possible negative impact on safety.

3.1. Management at all levels shall demonstrate its commitment to the establishment,

implementation, assessment and continual improvement of the management system and shall

allocate adequate resources to carry out these activities.


1.3(2) Issue: The unavailability of spare parts and an ineffective procurement process could

compromise the continued safe operation.

The plant has tried to improve the efficiency of the procurement process. However, the

following facts were observed:

− There is a number of outstanding orders for safety/quality spare parts.

− There are a number of temporary modifications (SMTs) in place due to spare parts

unavailability, some of them using spare parts of differing quality level. Six of these

SMTs are related to the unavailability of safety related equipment spare parts, one of

which is in existence for over two years.

− There are a number of critical spare parts (classified as important to safety) that are in the

warehouse in quantities below the required minimum.

− Spare parts reserved for outage have been used for emergent defects on the plant.

− There are delayed safety-related tasks and a large backlog of maintenance due to the

backlog of spare parts and procurement.

− The maintenance overhaul for the 480V Emergency Diesel Generator Set 2 – 7XJ/XK

was postponed for approximately two years due to spare parts unavailability.

− The above same diesel was isolated to resolve a start time problem. As the engine stayed

inoperable for more than 14 days owing to lack of suitable spare parts, the Unit was

shutdown in accordance with the Technical Specification. This transient could have been

avoided if the overhaul was performed in due time.

− Local suppliers are chosen on a lowest cost bases (Federal Rule 8666).

− Angra 2 demineralizer supports Angra 1 and vice versa. Planned modifications to

improve both demineralizer plants are still pending due to administrative and financial

difficulties.

− The equipment for Total Organic Carbon measurement in demineralised water is out of

order for more than eight months, because of problems with the supplier and services

provider.

− Problems exist with purchasing materials, reagents, equipment over the value of 16.000.-

Rs due to a bureaucratic acquisition process. It was identified as an area for improvement

by the self-assessment of chemistry in 2009.

Without an appropriate procurement process in place, it could lead to unnecessary transients

on the plant or degradation of the safety of the plant.

Recommendation: The organisation should implement a timely procurement process which

will support safe operation and ensure the ready availability of safety related spare parts.


IAEA Basis

GS-R-3

4.1. Senior management shall determine the amount of resources necessary and shall provide

the resources to carry out the activities of the organization and to establish, implement, assess

and continually improve the management system.

(‘Resources’ includes individuals, infrastructure, the working environment, information and

knowledge, and suppliers, as well as material and financial resources).

GS-G-3.5:

4.21. Inventories of material such as consumables and spare parts should be maintained at

appropriate levels, with due recognition of the fact that safety takes priority over economic

considerations.

NS-G-2.3:

6.3. The number of temporary modifications should be kept to a minimum. A time limit

should be specified for their removal or conversion into permanent modifications.

7.20. The list of spare parts to be kept in stores should be reviewed and updated as a

consequence of a modification, so that the necessary new spare parts will be procured and

those spare parts that no longer conform will be modified or disposed of.

ILO-OSH 2001 Guidelines:

3.10.4.1. Procedures should be established and maintained to ensure that:

(a) compliance with safety and health requirements for the organization is identified,

evaluated and incorporated into purchasing and leasing specifications;

(b) national laws and regulations and the organization's own OSH requirements are

identified prior to the procurement of goods and services; and

(c) arrangements are made to achieve conformance to the requirements prior to their

use.


1.5 INDUSTRIAL SAFETY PROGRAMME

1.5(1) Issue: The communication and enforcement practices of all aspects of industrial safety

to plant staff and contractors are not sufficient.

There are achievements in the area of industrial safety but the expectations, analyses and

results are not sufficiently promoted to site personnel and contractors.

The team noted the following facts:

− Initial safety briefing gives limited information on industrial safety and fire protection

(e.g. no information is given concerning the weekly test of the 2 emergency signals).

− The basic manual of industrial safety, issued as a booklet, is not given during the initial

safety briefing.

− There is no clear requirement to wear ear protection in the mechanical workshop even

when very loud activities are ongoing.

− There is an inconsistent use of safety hats in the mechanical workshop due to unclear

rules.

− Several tasks were observed to be undertaken without a work order.

− A worker without safety goggles in the mechanical workshop used compressed air to

clean clothes despite a visible sign stating that it was forbidden to clean the clothes in

such a manner.

− An electrical machine was energized with wires (no plug).

− Metal grating connector left near open gap on top of the turbine hall with a possible risk

of it falling down and injuring people or components.

Without extensive communication and enforcement of industrial safety practices, the risk of

injury may increase.

Suggestion: The plant should consider strengthening its communication and enforcement of

all aspects of industrial safety to plant staff and contractors.

IAEA Basis

GS-R-3:

5.26. Information relevant to safety, health, environmental, security, quality and economic

goals shall be communicated to individuals in the organization and, where necessary, to other

interested parties.


ILO-OSH 2001 Guidelines:

3.6.1. Arrangements and procedures should be established and maintained for:

(a) receiving, documenting and responding appropriately to internal and external

communications related to OSH;

(b) ensuring the internal communication of OSH information between relevant levels

and functions of the organization; and

(c) ensuring that the concerns, ideas and inputs of workers and their representatives on

OSH matters are received, considered and responded to.

3.9.1. Consistent with the OSH policy and based on the initial or subsequent reviews,

measurable OSH objectives should be established, which are:

(a) specific to the organization, and appropriate to and according to its size and nature

of activity;

(b) consistent with the relevant and applicable national laws and regulations, and the

technical and business obligations of the organization with regard to OSH;

(c) focused towards continually improving workers' OSH protection to achieve the

best OSH performance;

(d) realistic and achievable;

(e) documented, and communicated to all relevant functions and levels of the

organization; and

(f) periodically evaluated and if necessary updated.

TRAINING AND QUALIFICATION 11

2. TRAINING AND QUALIFICATIONS

2.2. TRAINING FACILITIES, EQUIPMENT AND MATERIAL

The simulator does not fully replicate the Main Control Room (the simulator has 39 panels as

opposed to 46 in the Main Control Room), but measures are in place to compensate for these

differences. Existing procedures do not require periodic review, timely modification, and

updating of training facilities and materials. The team developed a recommendation in this

area.

2.3. QUALITY OF THE TRAINING PROGRAMME

The plant controls the dissemination of information on modifications among the instructors,

but it is not done formally. This could result in some of the instructors not being aware of the

modifications implemented.

Continuing training/retraining is not consistently implemented on a regular basis across all

the departments of the plant and a suggestion was developed by the team in this area.


DETAILED TRAINING AND QUALIFICATION FINDINGS

2.2 TRAINING FACILITIES, EQUIPMENT AND MATERIAL

2.2(1) Issue: There is no requirement in the existing procedures to upgrade the simulator

and training material on a timely and periodic basis.

The team observed the following inconsistencies:

− Modification NDS 59 issued 29/06/2007 is not yet implemented on the

simulator (Reactor Protection System)

− The training material SEAE/SEEE 0466/0467 has not been updated/reviewed

since 11/2006

− The training material KBA 0417 has not been updated/reviewed since 12/2007

− The training material KBE 0421 has not been updated/reviewed since

30/08/2002

− The training material LKG 1468.1 has not been updated/ reviewed since

09/2004 and it has two different figures with the same nomenclature.

Without a periodic review, timely modification and updating of training facilities and

materials to ensure that they accurately reflect all modifications and changes made to

the plant, the training could cause operational errors that could compromise safety.

Recommendation: The plant should develop and implement requirements for the

periodic review and timely modification and updating of all training facilities and

materials.

IAEA Basis:

NS-R-2

3.11. Representative simulator facilities shall be used for the training of operating

personnel….

3.13. A programme shall be put in place to assess and improve the training programmes. In

addition, a system shall be in place for timely modification and updating of the training

facilities and materials to ensure that they accurately reflect plant conditions.

NS-G-2.8; para 6.7: A procedure should be in place for the periodic review and timely

modification and updating of training facilities and materials, to ensure that they 2.3



2.3. QUALITY OF THE TRAINING PROGRAMMES

2.3(1) Issue: Continuing training/retraining is not consistently implemented on a regular basis

in some departments.

− There are no requirements in the Engineering and Chemistry departments as well

as in Internal Operating Experience (IOE) and Emergency Planning (EP) groups

(except for Emergency Response Organization [ERO] members) to undertake

retraining except general employee training on a regular basis

− Retraining of the staff in the Engineering Department was not performed in 2009-

2010 and thirteen people did not participate in the retraining performed in 2008

− During the period from 2008 to 2010, only two out of eighteen people were

trained in the Chemistry Department (as a result of events associated with their

activity)

− One out of three IOE staff did not receive retraining in the last five years

− One out of three EP staff, who do not belong to the ERO, have not received

retraining for the last two years

Without regular refresher training, staff could lose competence and as a consequence

make errors in executing work associated with safety.

Suggestion: Consideration should be given to provide continuing training/retraining

on a regular basis to all departments.

IAEA Basis:

NS-G-2.8;

4.22: Comprehensive training should comprise initial training and continuing training

or retraining... Continuing training should be provided for all persons throughout their

working life, as it is necessary to ensure that their knowledge, skills and attitudes are

maintained current in both theory and practice. Continuing training should also be

directed to the permanent improvement of skills and attitudes which is necessary for

safety related activities... The training programme for every individual should define

the contents of the initial training, continuing training or retraining...

4.23. Initial and continuing training for all employees of the operating organization,

including plant personnel, should include general employee training (see para. 4.43) as

well as training for a thorough understanding of their particular duties and

responsibilities and of their contribution to the safe and efficient operation of the

organization’s plant.

4.29. Continuing training should be carried out on a regular basis...

OPERATIONS 15

3. OPERATIONS

3.4. CONDUCT OF OPERATIONS

Conduct of operations in the plant does not fully meet international standards. The conduct

of operations plant manual expects clear and correct logging of shift routines; important plant

parameters; field operator surveillance results; and compliance with the Limiting Conditions

for Operation. The team observed several non-compliances to these expectations such as the

shift handover and some operating procedures were not carried out in accordance with the

plant expectations. The use of error prevention tools such as pre-job briefings were also

observed to be less than adequate. The team has made a recommendation in this area.

3.5. WORK AUTHORIZATIONS

The plant does not have an adequate integration of its work control process between

departments and there are gaps in ownership. The planning, preparation, evaluation and

review of some isolations and post-maintenance qualification controls are not performed

adequately. Operations staff did not demonstrate adequate control and overview of the safety

tags on some occasions. Handwritten modifications without appropriate peer checking are

condoned. The team has made a suggestion in this area.

3.6. FIRE PREVENTION AND PROTECTION PROGRAMME

The plant has implemented a comprehensive fire risk assessment analysis. Procedures control

temporary fire hazards at the job site, however the team observed fire loads in the turbine hall

and the UPQ building in contravention of these procedures. The plant does not fully control

its fire protection systems such as fire barriers, fire doors and penetrations to the required

standards. The team observed a number of defects in fire protection systems that were not

reported and analyzed. The team has made a recommendation in this area.

3.7. MANAGEMENT OF ACCIDENT CONDITIONS

The plant has robust procedures and training in place for accident conditions. Event and

symptom based emergency procedures are implemented. In addition, accident procedures

(chapter 3-5.1; 3-5.2; 3-5.3) concerning different earthquake scenarios are in place. The plant

has no Severe Accident Management Guidelines (SAMGs). However, the plant has recently

initiated a contract with a supplier to provide SAMGs within 3 years. In addition, actions

have been taken after the Fukushima event in order to assess and evaluate the Angra 2 NPP

resilience to a range of situations (effect of landslides or prolonged loss of electrical power or

ultimate heat sink). The team encourages the plant to continue this approach and use SAMG

procedures as per NS-G-2.15.

OPERATIONS 16

DETAILED OPERATIONS FINDINGS

3.4 CONDUCT OF OPERATIONS

3.4(1) Issue: The plant´s implementation and oversight of various types of activities

contributing to the conduct of operations is not at the expected standards.

− Shift logging of Operational Limits and Conditions and oversight of significant

tasks is missing in several cases. For example:

1. the logging of CLO 66/11 was missing for 2 shifts on 18/03/11.

2. Shift log 1362 failed to note new reactor power and generator power

following power change.

− Pre job briefs for significant high hazard tasks on the 150 bar compressed air

system for the generator load break switch (BAC23AA025) works were unclear,

interrupted halfway through and did not confirm that all the work party understood

a test schedule change.

− The oversight of field operator tours by shift supervisors does not identify

significant issues with surveillance and monitoring of plant. For example Inverter

BRU40, Rectifier BTP40, BARAMENTO 48/24 voltages were out of specified

values on operator inspections sheets but no operator noting of this or shift

supervisor follow up was evident or recorded.

− Review of outage technical specification for Boron sampling; surveillance

requirement 16.3.9.1.2 dated 28/11/2010 requires comparison of channels

JKT01CX051C and JKT01CX053C which indicate neutron flux. The procedure

results have an out of spec parameter for neutron flux (10% versus 4%), the

acceptance criteria are ambiguous and there was no noting or challenge by

operator, supervisor or technical department.

− The reviewers observed on several occasions that the main control room was noisy

due to shouting and conversations, the maximum 15 persons allowed in the

control room is not always respected and the rules for room entry are not always

followed, e.g. hard hats were worn in the control room near the panels and the

public address system was not isolated, as required by procedures, at the start of a

fire drill.

If a high level performance of operations is not established then the safe operation of the

plant can be compromised.

Recommendation: The plant should improve its oversight and implementation of

operating activities to support a high performance in the conduct of operations.

OPERATIONS 17

IAEA Basis:

NS-R-2

3.13. A programme shall be put in place to assess and improve the training programmes. In

addition, a system shall be in place for timely modification and updating of the training

facilities and materials to ensure that they accurately reflect plant conditions.

NS-G-2.14

4.12. Operators should consider the level of complexity of any activity and their own level of

familiarity with the activity prior to performing it. In the case of complex or infrequently

performed tasks, the shift supervisor should be involved in the decision to perform the

activity and should ensure that an adequate pre-job briefing is conducted. If, after the pre-job

briefing has been performed, the operator does not feel confident that the activity can be

conducted safely and efficiently, the activity should not be commenced and, with the

involvement of the operations management, other options should be sought.

NS-G-2.14

4.16. All important information about the plant status, the work in progress and the plant

evolutions in the previous shift should be transferred and documented properly in the course

of the shift turnover. This information should include a joint check of systems in which the

incoming and outgoing operators walk down the control panels and jointly read checklists,

log books, records and messages to familiarize themselves adequately with the status of

systems and equipment.

NS-G-2.14

4.29. The management’s expectations with regard to performance in the control room should

be established and operators should be trained to meet these expectations. These expectations

should be made clear and managers should ensure that all operators understand them.

Managers should continuously monitor the performance of operators in fulfilling the

management’s expectations.

NS-G-2.14

4.35. Personnel assigned the task of carrying out rounds should be made responsible for

verifying that operating equipment and standby equipment operate within normal parameters.

They should take note of equipment that is deteriorating and of factors affecting

environmental conditions, such as water and oil leaks, burned out light bulbs and changes in

building temperature or the cleanness of the air. Any problems noted with equipment should

be promptly communicated to the control room personnel and corrective action should be

initiated.

OPERATIONS 18

NS-G-2.14

6.4. Management should establish rules and processes to ensure normal working conditions

for control room operators. Consideration should be given to the following:

—Conversations not relating to plant operations and their support should be minimized;

—Discussions not relating directly to the operation of equipment should be conducted in

subdued tones;

—Telephone calls to and from the control room should be limited in subject matter to topics

relating to current plant operations;

—The use of public address systems at the plant should be closely controlled by personnel in

the main control room and should usually be limited to conveying information on the status of

the plant;

—Communications by hand-held radio between field operators and operators in the main

control room should be short and concise. For instance, radios should be used for the initial

call-up and the call should then be switched to telephones where possible;

—The use of radio receivers, computers and other electronic devices for purposes relating to

anything other than plant operations (e.g. for entertainment) should be limited or prohibited.

OPERATIONS 19

3.5 WORK AUTHORIZATION

3.5(1) Issue: The work control and authorization process of the plant is not fully effective.

During the review the team noted the following facts:

− The planning, preparation, evaluation and review of isolations and tasks are not

adequate. For example, insufficient and inadequate tag lists were about to be

placed on a 150 bar compressed air system (work item LT200912494). Last

minute check by shift supervisor prevented this.

− A task that was ongoing on redundancy train 10 (LT201107169) which was visible

on the work control panel near the entrance to the Main Control Room was not

identified by the night shift and, as a consequence, this task was allowed to

continue in parallel with a task on train 40 thereby potentially compromising

defence in depth.

− Tag lists are not adequately controlled and are modified without double checking,

e.g. work items LT201100834 and LT2011014208.

− Post maintenance checks identified in the work permit BAC023AA035 were not

appropriate to allow confirmation that there were no leaks on the system.

If the plant does not apply an effective work control and authorization system, the safe

execution of work on the plant may be compromised.

Suggestion: The plant should consider improving the effectiveness of its work

control and authorisation process.

IAEA Basis:

NS-G-2.14

7.4. The work control process should ensure adequate interfaces between all work groups.

Operations personnel should assist the maintenance department in the planning and execution

of work on plant systems and components to ensure that the reliability and availability of

equipment are optimized. By doing this, operations personnel will be better able to assess the

risk when equipment is inoperable and the period of unavailability of important items of

equipment due to maintenance will be reduced.

7.5. The work control process should be used to ensure that operations personnel, in

particular the operators in the main control room, are aware of and have approved the work in

the plant and are maintaining correct control of the plant configuration. The process should

further be used to ensure that operations personnel are aware of all the expected effects of the

work performed, including alarms and changes to the functioning of systems

OPERATIONS 20

3.6 FIRE PREVENTION AND PROTECTION PROGRAMME

3.6 (1) Issue: The fire safety and protection systems are not effectively controlled.

During the review the team identified:

− More than 12 fire penetrations were observed to be not sealed properly, including

nuclear safety related plant areas such as the ULB building, e.g. there is a damaged

fire penetration next to door to UBA0524 and UBA 05645 has a cable through an

unsealed conduit, fire penetration next to door to UBA557 is damaged, and

ULB0446, ULB0449, ULB0469 where the fire penetrations are not sealed.

− There is no effective fire penetration management plan, master list of penetrations

or drawings.

− Defects on fire protection systems have not been formally analysed and managed

by operations, e.g. in the ULB building there is a standing ‘release alarm’ on

electronic card SGK07 (SOT 201101483) and on the FM200 fire system a vessel

pressure sensor has poor material condition and no defect tag.

− A number of fire doors in several areas were in an inappropriate state or had

defective closers, e.g. doors BA972, PQ103, and BA529.

− Poor material condition of several fire systems such as leaking fire hydrant valves

SGA22AA005 in the turbine hall, degraded paintwork and labels on main

transformer fire deluge systems, entrance to UBA0536 has a degraded fire escape

line and fire storage area and there is inadequate labelling of fire system

components in several areas, particularly in the ULB building.

− Several electrical cabinets in safety related plant areas such as the ULB building

and the DC essential switchboards, were open or had gaps in the panel doors.

− Areas such as the chlorination plant (UPQ building) and turbine hall 5.15 metre

level have poor storage of combustible materials and fire loads.

If the plant does not manage the plant fire safety and protection systems to the required

standard the safe operation of the plant in the event of a fire may be compromised.

Recommendation: The plant should review and improve the control of the fire safety

and protection systems.

OPERATIONS 21

IAEA Basis:

NS-R-2

2.30. The operating organization shall make arrangements for ensuring fire safety on the basis

of a fire safety analysis which shall be periodically updated. Such arrangements shall include:

application of the principle of defence in depth; assessment of the impact of plant

modifications on fire fighting; control of combustibles and ignition sources; inspection,

maintenance and testing of fire protection measures; establishment of a manual fire fighting

capability; and the training of plant personnel.

NS-G-2.1

2.13. Effective procedures for inspection, maintenance and testing should be prepared and

implemented throughout the lifetime of the plant with the objective of ensuring the continued

minimization of fire load, and the reliability of the installed features for detecting,

extinguishing and mitigating the effects of fires, including established fire barriers.

NS-G-2.1

7.1. A comprehensive programme should be established and implemented to perform

appropriate inspection, maintenance and testing of all fire protection measures (passive and

active, including manual fire fighting equipment) specified as important to safety. The

specific fire protection systems, equipment, components and emergency procedures included

in the program should be identified and documented. Where such documentation is not

available (for example, if the fire hazard analysis has not yet been performed and other

documentation is incomplete), all fire protection measures should be assumed to be important

to safety unless the contrary assumption can be justified.

NS-G-2.1

7.2. The inspection, maintenance and testing programme should cover the following fire

protection measures:

—passive fire rated compartment barriers and structural components of buildings, including

the seals of barrier penetrations;

—fire barrier closures such as fire doors and fire dampers;

—locally applied separating elements such as fire retardant coatings and cable wraps;

—fire detection and alarm systems, including flammable gas detectors;

—emergency lighting systems;

—water based fire extinguishing systems;

—a water supply system including a water source, a supply and distribution pipe, sectional

and isolation valves, and fire pump assemblies;

OPERATIONS 22

—gaseous and dry powder fire extinguishing systems;

—portable fire extinguishers;

—smoke and heat removal systems and air pressurization systems;

—communication systems for use in fire incidents;

—manual fire fighting equipment including emergency vehicles;

—respirators and protective clothing for radiological applications;

—access and escape routes for fire fighting personnel;

— emergency procedures.

Additional information on the fire protection measures which should be inspected,

maintained and tested is provided in the Annex.

7.3. Minimum acceptable levels of availability should be established and documented for all

fire protection features identified as important to safety. Interim compensatory measures

should be defined for each fire protection feature identified in this way. These compensatory

measures should be implemented on a temporary basis in the event that the minimum level of

availability for a given fire protection feature is not maintained or the fire protection feature is

determined to be inoperable. Both the compensatory measure to be implemented and the

allowable time schedule for its implementation should be determined, documented and

reviewed. If the minimum acceptable level of availability of a fire protection measure has not

been specified, it should be assumed to be 100%.

MAINTENANCE 23

4. MAINTENANCE

4.2. MAINTENANCE FACILITIES AND EQUIPMENT

The team identified that the control and storage of maintenance equipment and

materials is not at the appropriate level. Several items of equipment and materials

inside the plant and its stores are damaged or in poor condition. The team made a

suggestion in this area.

4.3. MAINTENANCE PROGRAMMES

The team discovered that the plant has enhanced its ability and process to conduct

maintenance evaluations of systems, structures and components. The concept of

streamlined reliability centred maintenance is used in order to optimize the

maintenance frequencies and the necessary maintenance tasks. For example, several

safety related pumps are now being maintained using condition based maintenance,

which has reduced the number of interventions and the probability of failures

introduced by scheduled preventive maintenance. The team identified this as a good

performance.

The team recognized that a comprehensive ageing management programme for the

plant has not been established and that the effectiveness of the plant’s maintenance

programme for safety related equipment could be affected. It was observed by the

team that several events have happened due to ageing degradation and that there is no

schedule to implement a comprehensive ageing management programme. The team

made a recommendation in this area.

4.5. CONDUCT OF MAINTENANCE WORK

The team identified that there is insufficient control of maintenance work practices

including post-job reviews. The plant has written expectations for the conduct of

maintenance; however the team made several observations of work places and work

practices that were non-compliant to these expectations. The team made a


4.6. MATERIAL CONDITIONS

It was recognized by the team that the plant has a leakage management programme.

However, it was discovered that several leaks exist and that several categories of leaks

in the plant’s computerized work control system were incorrect. Further, several

observations made by the team revealed that the process for monitoring leaks in the

plant does not meet the expectations. The team made a recommendation in this area.

MAINTENANCE 24

4.7. WORK CONTROL

The team acknowledged that the plant has a work control process in place, which is

controlled by a procedure in combination with cross functional meetings. However,

the work control process is not fully effective due to the presence of a large backlog

for both preventive and elective maintenance. There are also weaknesses in the control

of prioritization, which could result in untimely repair of important systems, structures

and components. The team made a recommendation in this area.

4.9. OUTAGE MANAGEMENT

For the outage preparation, the team observed that there is no preparation milestone

plan, no important freeze dates and no outage organization chart in the outage

guideline. Moreover, the plant does not document contractors’ experience or include

their review reports into the outage review report.

The team encourages the plant to improve its outage preparation and implement

arrangements in order to enhance the control and evaluate the efficiency of the outage

preparation. The plant is also encouraged to include contractors’ outage experience

into the outage review report in order to improve the analysis of the outage results for

continuous improvements.

MAINTENANCE 25

DETAILED MAINTENANCE FINDING

4.2. MAINTENANCE FACILITIES AND EQUIPMENT

4.2(1) Issue: The control and storage of some maintenance equipment and materials does not

meet the plant expectations.

Examples of facts identified by the team include:

− Damaged and inappropriate control and storage of tackle blocks and lifting

eyes in room JA0864

− Damaged slings i.e. 2131 with visible fraying

− Installed tackle block, in room GN101, was damaged

− In maintenance stores ST0118, ST0109, ST0114 the following facts were

identified:

� Tackle block, 438005, was damaged

� Hydraulic jacks had damaged o-rings, e.g. CH2045

� Lifting slings were in poor condition and some had visible fraying, e.g.

2529, 2277

� Some electrical cables were damaged and others were in poor condition

− Austenitic steel was stored together with carbon steel in the mechanical work

shop ST0131

− Calibration control cards in the maintenance store, ST0114, with requirements

to specify the KKS system id, in order to have full traceability were just signed

with the building number. E.g. control cards for torque wrenches 2015102,

1082430, V110117, 731793, 1070082, V.060159, 766945, 731792

Without proper control and storage of equipment and materials, the safety of the plant

and personnel could be jeopardized.

Suggestion: The plant should consider improving its programme for the control and

storage of equipment and materials in order to meet its expectations.

IAEA Basis: NS-G-2.6; 8.32. The operating organization should ensure that storage

facilities offer adequate space and provide for the secure retention of stocks in suitable

environmental conditions, in order to prevent deterioration. Access and the installed

handling equipment should be adequate for the types and sizes of items to be stored.

MAINTENANCE 26

NS-G-2.6

8.19. Plant management should provide suitable mobile lifting and transport facilities,

with clear indications of their lifting capacity. In the selection and use of these

facilities, due account should be taken of the possible radiological consequences of

their failure. Examples of precautions taken include regular examination and

maintenance of lifting equipment, periodic testing, special inspections before major

operations involving lifting and rigging, and cautionary notices limiting movements of

loads over specified areas. All operations involving lifting and rigging should be

performed by trained personnel.

NS-G-2.6

9.44. When test equipment is found to be out of calibration ... For this purpose a

history of usage should be maintained for each piece of test equipment....a tag or other

suitable means.

NS-G-2.6

10.23. All equipment should be properly identified in the calibration records, and the

validity of the calibration should be regularly verified by the operating organization in

accordance with the quality assurance programme.

MAINTENANCE 27

4.3. MAINTENANCE PROGRAMMES

4.3(1) Issue: A comprehensive plant ageing management programme is not developed.

The following facts were identified by the team:

− The root cause of several reportable events was due to ageing e.g.

� 9-11-10, Electrolytic capacitor ageing

� 28-7-10, Temperature sensor thermo resistance ageing

� EAR PAR 10-002, Insulation Ageing

− The plant does not have a developed and implemented ageing management

programme in place. A draft for a future programme is under development,

however, an implementation time schedule does not exist.

Without a comprehensive ageing management programme, the maintenance

programme for safety related equipment may not be fully effective and could therefore

affect plant safety.

Recommendation: The plant should develop a comprehensive ageing management

programme in order to ensure the continued reliability of important systems, structures

and components.

IAEA Basis:

NS-R-2

6.4. The frequency of preventive and predictive maintenance, testing, surveillance and

inspection of individual structures, systems and components shall be determined on

the basis of:

(1) The importance to safety of the structures, systems and components

(2) Their inherent reliability

(3) Their assessed potential for degradation in operation and their ageing

characteristics

(4) Operational experience

NS-G-2.4

6.77. Managing the safety aspects of nuclear power plant ageing requires

implementation of effective programmes for the timely detection and mitigation of

ageing degradation of plant structures, systems and components important to safety,

so as to ensure their integrity and functional capability throughout the plant’s service

life.

6.78. The programme to manage the ageing process should contain, but is not limited

to, such elements as:

MAINTENANCE 28

− identification of the degradation processes that could adversely affect plant

safety;

− identification of components that are susceptible to ageing degradation that

could affect plant safety;

− adequate and current methods for the detection of ageing problems;

− appropriate records to enable the ageing process to be tracked;

− a methodology for corrective action in order to mitigate and/or remove ageing

effects; and

− changes to the maintenance, testing, surveillance and in-service inspection

programme to reflect the analysis of ageing test results.

NS-G-2.6

2.1. The maintenance programme for a nuclear power plant should cover all

preventive and remedial measures that are necessary to … mitigate degradation of a

functioning SSC.

NS-G-2.12

3.1. Ageing management of SSCs important to safety should be implemented

proactively (with foresight and anticipation) throughout the plant’s lifetime, i.e. in

design, fabrication and construction, commissioning, operation (including long term

operation and extended shutdown) and decommissioning.

4.31. A specific programme for the ageing management of each structure, component

or group of structures and components selected by the screening process should be

developed and documented. The ageing management programme should identify: (a)

effective and appropriate actions and practices for managing ageing that provide for

timely detection and mitigation of ageing effects in the structure or component; and

(b) indicators of the effectiveness of the programme. Thus the effectiveness of current

practices should be confirmed in light of applicable ageing evaluations and condition

assessments, and/or improvements to current practices should be recommended, as

appropriate.

MAINTENANCE 29

4.5 CONDUCT OF MAINTENANCE

4.5(1) Issue: There is insufficient control of maintenance work practices.

Several facts were identified by the team, which included poor work practices and lack

of post job reviews e.g.

− The job of draining the gearbox of the polar crane inside the containment

building had to be done twice due to lack of proper preparation and planning

− Installed flanges with no visible bolt threads on PAC60BR020, LAB12BR001,

MAN21CT001

− Tape was used to fasten cables on MKG51CT501

− Silicone was used to seal leak on 5XJG01CP503 and QUA01AA009

− Poor installation of electrical connection to air conditioner on the top of outage

office room in UMA building

− FME covers were missing e.g.

� Pipe GNA02AP002

� Pump near GNB02BR102

� 2 repaired pumps in mechanical workshop

− Poor cleanliness during maintenance work on JMF00AB001 with bolts, nuts

and tools stored loosely on the floor in the changing area

− Oil was dripping from the polar crane gearbox cover which was placed in the

designated FME area near the spent fuel pool

− Maintenance job on the safety related pump QUP30AP001 had a step-by-step

procedure and a pre-job briefing protocol but none of them were signed off

during the work

− During a lift of a heavy air cylinder tank in the mechanical workshop, it was

observed that only one sling was used and it had only one single lifting point.

The lift zone had not been designated.

− Damaged lifting sling with visible fraying was used while lifting materials in

the mechanical workshop ST013

Without sufficient control of work practices and work places, safety related systems,

structures and components may not be able to fulfil the safety function.

Recommendation: The plant should improve its control over maintenance work

practices.

MAINTENANCE 30

IAEA Basis:

NS-R-2

2.11. All activities that may affect safety and which can be planned in advance shall

be conducted in accordance with established procedures which shall be submitted by

the operating organization to the regulatory body for approval, if so required

2.13. The operating organization shall ensure that regular reviews of the operation of

the plant are conducted, with the aim of ensuring: that an appropriate safety

consciousness and safety culture prevail; that the provisions set forth for enhancing

safety are observed; that documentation is up to date; and that there are no indications

of overconfidence or complacency. Where practicable, suitable objective performance

measures shall be used. The results shall be made available to plant management and

appropriate corrective actions shall be taken.

GS-G-3.5

5.149. A process should be established and implemented to control maintenance of

the systems, structures and components of the installation. Further recommendations

and guidance are provided in Refs [8, 9].

5.150. Housekeeping and cleanliness should be considered an essential process to

provide a clean workplace and to encourage a high standard of workmanship. The

process should include establishing, maintaining and enforcing standards for

housekeeping and cleanliness that:

(a)Prevent the contamination of items and individuals;

(b)Minimize the risk of injury;

(c)Reduce the risk of occurrence of conventional accidents such as fires;

(d)Protect open systems and equipment from contamination with foreign

material during maintenance and modification;

(e)Control the movement of materials, equipment, tools and individuals into

and out of work areas;

(f)Ensure that cleanliness inspections are performed immediately prior to

reassembly of systems or components;

(g)Encourage individuals to leave an area as clean as or cleaner than it was

before they carried out activities in it.

NS-G-2.6;

3.8. Contractors should be subject to the same standards as plant staff, particularly in

the areas of professional competence, adherence to procedures and evaluation of

MAINTENANCE 31

performance. Suitable steps should be taken to ensure that contractors conform to the

technical standards and the safety culture of the operating organization.

INSAG-15

3.5 Nearly all events, ranging from industrial and radiological accidents, incidents and

near misses to failures affecting nuclear safety, start with an unintentionally unsafe act

or an unacceptable plant condition or process. These have often been latent and have

gone undetected or been treated as ‘custom and practice’ and therefore been ignored.

Then, in combination with another challenge to the system, a further more significant

failure occurs. Minimizing existing latent shortcomings in working practices or plant

conditions is therefore vital in avoiding more serious events.

MAINTENANCE 32

4.6 MATERIAL CONDITION

4.6(1) Issue: The plant leakage management programme is not fully effective.


− Several leakages were found by the team without any work requests and

permanent monitoring e.g. MKW03CL061, XJN01AA001, QMA02BB001

− Several leakages were not categorized as leakages in the work control system

and would therefore not be monitored e.g. 201007777, 201001433, 201004400

− Several work requests with severity 5 leaks (the highest severity) have been

open in the work control system for more than 10 months, without them being

re-categorized or completed, e.g. 201016832, 201016624, 201004105

− Fabric/tissues were used to collect an oil leak on PUS20AP001 and

LAC20AP001

− Tape was used to seal leakage on KLK15CF524

− Oil leakage on the circulation pump PAC10AP001 was spreading oil onto

electrical cables

− Work request 201107750 was categorized as a leakage, however no leak

exists; the work request was due to I&C issues

Without a robust leak management programme in place, the plant integrity cannot be

assured and the safe operation of the plant could be compromised.

Recommendation: The plant should review and fully implement its leakage

management programme.

IAEA Basis:

NS-R-2

6.5. Repairs to structures, systems and components shall be performed as promptly as

practicable. Priorities shall be established with account taken first of the relative

importance to safety of the defective structure, system or component.

MAINTENANCE 33

5.17. Responsibilities and lines of communication shall clearly be set out in writing

for situations in which the operating personnel discover that the status or conditions of

plant systems or equipment are not in accordance with operating procedures.

NS-G-2-6

4.22. The elimination of plant defects should be tracked to completion, and records

should be kept of the work performed. These records should be accessible whenever

needed for review.

NS-G-2.2

I.22. Leakage limits should be such that the coolant inventory can be maintained by

normal make-up systems and that the system integrity can be maintained to the degree

assumed in the safety analysis report. Specifications of maximum leakage from

particular components important to safety, commensurate with their safety function,

should be provided. In establishing leakage limits, consideration should be given to

the permissible limits of contamination of the environment or of secondary systems by

the leaking media. Operability requirements should be stated for the detection of, or

for measuring systems for, leakage of reactor coolant. In general, leakages should be

classified as identified (for example, leakages into collection systems such as those at

pump seals, into the containment atmosphere or through the steam generator; these

leakages should be measured in order not to mask the unidentified leakages) or

unidentified leakages.

MAINTENANCE 34

4.7 WORK CONTROL

4.7(1) Issue: The plant work control process is not always effective.


− 27 work requests with priority 1 (immediate action) were used to perform

predictive and preventive maintenance tasks during 2010

− 31 work requests were identified, some on safety related equipment, which had

not been prioritized, e.g. 201010708 and 201005828

− Several work requests with priority 3 (repair within 14 days) were overdue for

more than 2 years e.g. 200700705, 200804121, 200908300

− The backlog for elective maintenance >180days reached 481 work requests.

113 are due to engineering and 93 are due to planning. The rest are considered

as due to lack of spare parts

− The backlog for preventive maintenance reached 453 work request, of which

>200 have not been signed off, and the trend is increasing

− Work request 201104576 was categorized as a severity 5 leakage, however no

leak existed, the work request was due to bearing issues

− There is no clear correlation between plant prioritization and leakage severity,

e.g. 201002684, 201001968

Without a proper work control process, the planning and prioritization can result in

untimely repair of important systems, structures and components and have

implications on plant safety.

Recommendation: The plant should improve its work control process and its

effectiveness.

MAINTENANCE 35

IAEA Basis:

NS-R-2

6.5. Repairs to structures, systems and components shall be performed as promptly as

practicable. Priorities shall be established with account taken first of the relative

importance to safety of the defective structure, system or component.

6.7. A comprehensive work planning and control system shall be implemented to

ensure that maintenance, testing, surveillance and inspection work is properly

authorized and is carried out in accordance with established procedures. Co-ordination

shall be established among different maintenance groups (for mechanical, electrical,

instrumentation and control, and civil maintenance), and with operations and support

groups (groups for fire protection, radiation protection, physical protection and

industrial safety).

NS-G-2-6

5.14. A comprehensive work planning and control system applying the defence in

depth principle should be implemented so that work activities can be properly

authorized scheduled and carried out by either plant personnel or contractors, in

accordance with appropriate procedures, and can be completed in a timely manner.

The work planning system should maintain high availability and reliability of

important plant SSCs.

5.18. Management of the work should be recognized as a cross-functional process, not

exclusive to any one work group but integrating the important activities of all work

groups. Consequently, for the work control process to be fully effective, all needs and

concerns in relation to operations, maintenance, technical support, radiation

protection, procurement and stores, contractors and other matters should be

considered and should be accommodated wherever appropriate, consistent with the

long term operating strategy for the plant.

5.19. The effectiveness of the work control process should be monitored by

appropriate indicators (such as repeated work orders, individual and collective

radiation doses, the backlog of pending work orders, interference with operations) and

by assessing whether corrective action is taken whenever required.

TECHNICAL SUPPORT 36

5. TECHNICAL SUPPORT

5.2. SURVEILLANCE PROGRAMME

Planning, control and evaluation of the effectiveness of surveillance activities

is done by different plant departments: Operating, Maintenance, Planning, and

System and Reactor Performance Departments. Although the planning and

control of surveillance tests are well organized with a software programme, the

planning, control and evaluation of the surveillance programme is not always

performed in a systematic and effective way. In addition, no formal

requirements are set and only a few indicators exist for surveillance

programme effectiveness evaluation. Also, the calculation of indicators

performed by the SISA (Sistema Integrado Surveillance de Angra) software is

not always clear and correct. The team developed a suggestion in this area.

5.3. PLANT MODIFICATION SYSTEM

A clear system for modification categorization in accordance with their safety

significance has not been established for permanent and temporary plant

modifications. The team developed a suggestion in this area.

5.6. COMPUTER BASED SYSTEMS IMPORTANT TO SAFETY

Computer based systems are used at the plant for process monitoring

applications and for administration applications. The management of the

computer based systems is performed by the Operating and System and

Reactor Performance Departments.

Nevertheless, the team noted that the categorization with regard to safety

significance for computer based systems is only done partially. The existing

procedure provides criteria only for essential software. However, hardware for

computer based systems is not addressed. The team encourages the plant to

establish clear requirements for classification as well as for verification and

validation for computer based systems.


DETAILED TECHNICAL SUPPORT FINDINGS

5.2. SURVEILLANCE PROGRAMME

5.2.(1) Issue: The planning, control and evaluation of the surveillance programme is

not always performed in a systematic and effective way.

During the mission it was noted that:

− No formal requirements are set for surveillance programme

effectiveness evaluation.

− Limited indicators exist for surveillance programme effectiveness

evaluation.

− The final weekly schedule (dated 23/02/2011) was sent to the shift

supervisor with several hand made changes.

− More than 600 open work requests exist (from July 2010). These have

not been reviewed or revised, therefore, no appropriate measures have

been taken.

− Control for the execution of tests is being done only on the basis of the

tolerance limit date and there is no control for the planned execution

date.

Without systematic and effective planning, control and evaluation of the

surveillance programme the plant may lose the opportunity of maintaining and

improving the equipment availability and safety.

Suggestion: The plant should consider implementing measures for improving

the systematic and effective planning, control and evaluation of the

surveillance programme.


IAEA Basis:

NS-R-2

6.7. A comprehensive work planning and control system shall be implemented

to ensure that maintenance, testing, surveillance and inspection work is

properly authorized and is carried out in accordance with established

procedures.

NS-G-2.6

4.4. The goals, objectives and priorities of the MS&I programme should be

defined so as to be consistent with the policies and objectives at the plant.

Appropriate operational safety performance indicators should be established

and used to monitor and enhance the quality of MS&I. Senior management

should encourage effective and high quality performance of MS&I. Results

and feedback from the performance of MS&I should be used in accountability

reviews and in establishing goals and objectives for subsequent planning

periods.

NS-G-2.6

6.5. The operating organization should ensure that the results of MS&I are

evaluated in order to verify compliance with the acceptance criteria.

NS-G-2.6

9.7. The surveillance programme should be developed by the operating

organization. Implementation should be scheduled such that the safety of the

plant does not depend on untested or unmonitored SSCs.


5.3 PLANT MODIFICATION SYSTEM

5.3(1) Issue: A clear system for modification categorization in accordance with their safety

significance has not been established for permanent or temporary plant modifications.

The plant has a structured and documented process for the implementation of

permanent and temporary modifications on the basis of the project model, which

includes a safety assessment and a prioritization system only for permanent

modifications.

However, the team found that:

− No criteria are established for the categorization of each specific modification

in accordance with its safety significance.

− There is no safety categorization in the procedure for permanent and temporary

plant modifications.

− The safety review process for all safety related modification is the same

regardless of their safety significance.

− The permanent modification 0151.08 (replacement of KAA20/30AA010/011

valves) is only classified as safety related and was not categorised in

accordance with its safety significance (the same for 0039.08 KPL).

− Temporary modification 0030.11 (JAB system measurement of reactor cover)

is only classified as safety related and not categorised in accordance with its

safety significance (the same for 0021.11 for LAR system).

Without clear modification categorization in accordance with their safety significance,

and with subsequent adequate analysis, the safety of the plant may be compromised.

Suggestion: The plant should consider establishing a clear system for modification

categorization in accordance with their safety significance for permanent and

temporary plant modifications.

IAEA Basis:

NS-R-2

7.1. Modifications to a nuclear power plant may consist of:

(1) Modifications to structures, systems and components;

(2) Modifications to the operational limits and conditions;

(3) Modifications to instructions and procedures; or

(4) A combination of the above; and


(5) Modification of organizations.

7.2. Proposed modifications to structures, systems and components important to

safety, which affect the bases on which the operating licence was issued, to the

operational limits and conditions, and to procedures and other documents originally

approved by the regulatory body shall be submitted to the regulatory body for prior

approval. Any other proposed modifications shall be submitted to the regulatory body

for prior approval if so required. Modifications should be categorized according to

their safety significance.

NS-G-2.3

4.3. Following the completion of the initial process of safety assessment (see para.

4.8), the proposed modification should be categorized in accordance with its safety

significance. This categorization should follow an established procedure agreed with

the regulatory body.

NS-G-2.3

4.6. The principles for managing modifications are the same for all categories, but in

each step of the modification process the categorization of the modifications

determines the depth and breadth of the safety review and the regulatory control which

should be applied.

NS-G-2.3

4.7. The criteria applicable in determining the categorization for each specific

modification should be defined and documented in order to enable correct assessment

of the potential effect on safety.

OPERATING EXPERIENCE

41

6. OPERATING EXPERIENCE FEEDBACK

6.1. MANAGEMENT, ORGANIZATION AND FUNCTIONS OF THE OE

PROGRAMME

The team recognized that there is no conformity in the organization of the plant’s

operating experience system. There are several independent operating experience

reporting programmes maintained within various plant departments and services. It

was identified that the plant operating experience feedback system does not have

adequate integration, coordination and requirements to ensure effective utilization of

operating experience for improving operational safety. The team made a suggestion in

this area.

6.2. REPORTING OF OPERATING EXPERIENCE

It was observed by the team that the events reporting process and subsequent practice

of selecting events for analysis do not always contribute to the optimal use of the

plant’s operating experience. Insufficient reporting of plant deficiencies can lead to a

failure in early identification of accident precursors. The team developed a suggestion

in this area.

6.5. ANALYSIS

The team identified that the plant has some deficiencies in the process for

investigation and analysis of event reports. Without following a thorough approach in

the investigation and analysis of events, the plant may not succeed in the timely and

correct identification of the causes of an event and may not be able to initiate proper

corrective actions to preclude further occurrence of safety related events. The team

made a recommendation in this area.


42

DETAILED OPERATING EXPERIENCE FINDINGS

DETAILED OPERATING EXPERIENCE FEEDBACK FINDINGS

6.1 MANAGEMENT, ORGANIZATION AND FUNCTION

6.1(1) Issue: The plant operating experience feedback system does not have adequate

integration, coordination and requirements to ensure effective utilization of operating

experience for improving operational safety.

During the review, the team noted the following facts:

− There are several input points into Maximo software such as low level events

and near misses; work request; pre and post job briefings; events reports and

other plant specific aspects. However a current software configuration does not

allow handling all the data related to reported plant deficiencies promptly for

the benefit of plant operating experience programme.

− Defects on plant equipment are processed through the work request system and

therefore excluded from the operating experience feedback process.

− There is no requirement in the OE procedures to prioritize corrective actions

according to significance for safety. The responsible person prioritizes by

coding the corrective actions that are in SGP (Pending Tracking System)

according to a working procedure. However, this person does not participate in

the event investigation and analysis process and has limited knowledge about

the technical content of a report.

− The work requests related to corrective actions are coded separately in the plant

departments and services with a specific coding system. The corrective actions

cannot be prioritized in an integrated manner.

− Only a part of the plant’s corrective actions is tracked by the SGP monitoring

system. The rest of the corrective actions are tracked by different software

programmes in the respective departments and services. It is not possible to

have an integrated assessment of the corrective actions that are in progress,

fulfilled or out of due date.

− There is no feedback process established with permanent contractors to fully

integrate them into the plant’s operating experience feedback loop.

Without proper centralization and coordination of operating experience from activities

among the departments and services of the plant, the plant may lose opportunities for

improving operational safety performance.

Suggestion: Consideration should be given to provide adequate integration and

coordination of operating experience activities at the plant to ensure effective

utilization of operating experience for improving operational safety.


43

IAEA Basis: NS-G-2.11; 2.5: The organization that operates a nuclear installation

should maintain an effective system for the collection and analysis of operational

experience and should promptly disseminate safety significant information among its

own staff and to other relevant organizations.

2.12: A detailed procedure should be developed by operating organization on the basis

of the requirements for the national system established by the regulatory body. The

procedure should define the process for dealing with all internal and external

information on events at nuclear installation. The procedure should precisely define

the structure of the system for the feedback of operational experience, the type of

information, the channels of communication, the responsibilities of the groups and

organizations involved, and the purpose of the documentation produced….

5.6: Corrective actions should therefore be prioritized. Those actions affecting safety

should be given the highest priority, while the actions that are desirable rather than

essential should be shown as such.


44

6.2 REPORTING OF OPERATING EXPERIENCE

6.2(1) Issue: The events reporting process and subsequent practice of selecting events for

analysis do not always contribute to optimal use of the plant’s operating experience.


− No formal and refresher training provided to the plant personnel on event

reporting although the plant has received four event investigation training

courses by international organizations in the past eight years.

− The process stated in 2PA-GE 50 does not include examples of low level

events (LLE) and near misses for reporting.

− Criteria for reporting of deficiencies in the field are unclear and result in a

number of plant deficiencies remaining unreported and uncorrected:

� Emergency Diesel RED #6: oil leak

� Emergency Diesel RED #8: oil leak

� QMA 02 BB 001 (Emergency steam generator area): water and oil

leaks

� 2XJG 01 AP 002 was not reported as defective after Diesel #2 test on

30 March 2011.

Although the reporting is an integral part of the plant’s operating experience feedback

system the responsibility to report deficiencies remains with plant employees.

− Screening criteria for LLE and external OE are not formalized.

− The number of LLE events reported by the plant personnel on a monthly basis

is low in comparison to internationally benchmarked practices.

− Selecting LLE events and near misses for further processing is carried out at

the discretion of an OE representative during a morning screening meeting with

no formal, specific written guidance.

Without a robust and clear reporting process that has a subsequent event selection

practice for analysis, the plant may fail to identify accident precursors in a timely

manner and prevent significant events.

Suggestion: The plant should consider improving the event reporting process and

subsequent event selection practice for analysis in order to make optimal use of

operating experience.


45

IAEA Basis: NS-G-2.11

3.8: … The screening criteria for external events should follow the criteria that govern

the reporting of internal events to determine whether detailed investigation is

necessary.

10.2: Operating organizations should develop documents specifying appropriate

reporting criteria specific to the type of plant being operated and consistent with

national regulatory requirements. These criteria should specify the types of events and

incidents, including problems, potential problems, non-consequential events, near

misses and suggestions for improvement. These reports about events and incidents

should be collected and reported internally, and some of them should be reported

externally to the plant or utility.

10.4. Operating experience should be reported in a timely manner to facilitate learning

from events. To this end operating organizations should put in place the necessary

arrangements to ensure that all events that occur during operation of the plant are

systematically reported and analyzed.

10.9. The operating organization should develop detailed procedures for the reporting

of events.


46

6.5. ANALYSIS

6.5(1) Issue: The process for significant event investigations and analyses does not always

demonstrate conformity to the scope, completeness and timeliness of producing

reports.


− Significant event reports (RES) do not indicate what investigation method or

combination of methods was used during analysis and do not always contain

reference data. There is no evidence of using barrier analysis in the reports

reviewed during the evaluation (approximately 50 reports).

− A psychologist does not always participate in the investigation and analysis of

significant events with human performance implications:

� 2RES 098 2010 - 2ORO 002 2010;

� 2RES 012 2009 – 2ORO 001 2009;

− There are no requirements in the procedure 2 PA-GE 50 to address more severe

conditions, than those existing during the actual event, when performing

analysis of an event. The analysis of significant events does not include an

extent of condition review.

− There is no time frame specified in the procedure 2PA-GE 50 for timeliness of

producing preliminary reports. Preliminary report RPE 102.2010 took 12 days

to be prepared.

− There is no evidence that plant personnel who are involved in root cause

analysis receive refreshing training.

− Timeframes for producing significant event reports do not always correspond

with the requirements set forth in the instruction 2PA-GE 50 (30 days) and

sometimes exceed this period by up to seven months.

� 2RES 024. 2009 finished 25.06.2009 – target date 13.04 2009

� 2RES 023. 2009 finished 23.04.2009 – target date 06.04.2009

� 2RES 018.2009 finished 09.10.2009 – target date 02.04.2009

− The performance indicator on the number of overdue reports (RES-RDO) has

remained unsatisfactory for more than one year.

Without following a thorough approach in the investigation and analysis of events, the

plant may not succeed in the timely and correct identification of the causes of an event

and may not be able to initiate proper corrective actions to preclude further occurrence

of safety related events.

Recommendation: The plant should improve the process for significant event

investigation and analyses to ensure conformity with the scope, completeness and

timeliness of producing reports.


47

IAEA Basis:

NS-R-2

2.21. Operating experience at the plant shall be evaluated in a systematic way.

Abnormal events with significant safety implications shall be investigated to establish

their direct and root causes. The investigation shall, where appropriate, result in clear

recommendations to the plant management, which shall take appropriate corrective

action without undue delay. Information resulting from such evaluations and

investigations shall be fed back to the plant personnel.

NS-G-2.11

II.9: Causes. The direct causes, root causes and causal factors of the event should be

clearly described. (Annex I provides more details on direct and root causes in paras I–

10, I–11.) The reasons for equipment malfunctions, problems of human performance,

organizational weaknesses, design and manufacturing deficiencies and other relevant

facts should be included under causes. Whenever appropriate the method used for

cause analysis should be referenced in the report.

II.8. The safety assessment should be focused on the safety consequences and

implications of the event. The primary aim of this review is to ascertain why the event

occurred and whether it would have been more severe under reasonable and credible

alternative conditions, such as at different power levels or in different operating

modes. The safety significance of the event should be indicated.

10.10.…The procedures should stipulate a time limit for reporting events, the format

for the type of reports and the administrative arrangements for their distribution.

Appendix III

II.3: Training (both initial and refresher) should be provided for the staff who might

take part in an investigation. This should include training in investigation techniques,

documentation needs, witness interviews, conflict resolution and dealing with

confidentiality issues. Event investigation training for personnel from operating

organizations is frequently available at the corporate department, the supporting

organizations, the WANO and the Institute of Nuclear Power Operations, as well as

through the IAEA. Whereas all investigators should receive some basic training in

event investigation, including root cause analysis, for more difficult and complex

investigations there may need to be at least one expert facilitator who is familiar with

such methods of investigation.

NS-G-2.4


48

6.67: The responsibility, qualification criteria and training requirements of personnel

performing activities to review operating experience should be clearly defined.

Personnel who conduct investigation of abnormal events should be provided with

training in investigative root cause analysis techniques such as accident investigation,

human factor analysis (including organizational factors), management oversight and

risk tree analysis, change analysis and barrier analysis…”

RADIATION PROTECTION

49

7. RADIATION PROTECTION

7.2. RADIATION WORK CONTROL

All work carried out within the Controlled Area is subject to a ‘Routine’ or ‘Special’

Radiation Work Permit (RWP). There is a system in place which will not allow entry to the

Controlled Area until the RWP has been activated for each individual by the radiological

control point. However, the team has identified that there is a lack of appropriate detail in the

production of RWPs, and that RWPs are not fully enforced in the field. The team has made a

recommendation for the improvement of this process.

.


50

DETAILED RADIATION PROTECTION FINDINGS

7.3. RADIATION WORK CONTROL

7.2(1) Issue: The Radiological Work Permit does not always contain appropriate

radiological conditions, and is not fully implemented in the field.

Because of low radiation and contamination levels in the plant, clear instructions are

not always given to the workers, resulting in a lack of awareness of radiological

conditions.

During the review, the team observed the following:

− The plant has experienced several minor events (28/01, 07/02, 16/03) of

individuals exceeding EPD (Electronic Personal Dosimeter) maximum dose rate

alarm level. In each case, individuals had entered an area not covered under their

RWP. Individuals had also removed physical barriers and passed signs requiring

contact with the radiological control point.

− Under RWP 112400, pipe work was being drained using a temporary pump in

Room JB174. Prior to starting work, a leak was identified from the pump.

Contamination as a result of the leak exceeded ‘Radiological Assessment’ levels

on the RWP. Clear actions levels were not stated, but the general site instruction

is to stop work and reassess if there is a variation from the given levels. Verbal

communication from the radiological control point allowed work to continue to

5 times the levels given in the RWP. The room in which the work was taking

place contained a Hot Spot KBA32BR407, measuring 5mSv/h. No indication of

the presence of this Hot Spot was given in the RWP.

− When issuing an EPD, confirmation is required that the RWP has been read and

understood. An individual was instructed to answer yes by plant staff, without

having seen RWP, even though a copy was requested.

− Under RWP 112411, radiation detectors were being calibrated. Radiation

workers were expected only to follow advice from the RMT (Radiological

Monitoring Technician) and members of work party were not expected to know

the radiological conditions in a Very High Dose rate area. Radiation workers

were not expected to understand the radiological conditions.

− A room containing radioactive materials was denoted by a caution sign on the

door, with a barrier placed across the door. On the caution sign, it was stated that

the radiological control point should be contacted before entering this area.

Individuals took down the barrier and entered this room without contacting the

radiological control point. Entry to this area was not covered under their RWP.

− RWP 112002 for routine operations and RWP 112004 for chemistry surveillance

routines has the incorrect task code, with a maintenance task code (2) used

instead. Both RWPs were signed off by radiological protection. Routine

Operations RWP (112002) is not held as a copy with the operations team, and is

not used as a part of the work brief.


51

− A contractor was performing work on the polar crane in the reactor building

(UJA). An Eletrobras employee supervising the contractors knew that a survey

had been carried out earlier in the day. On request, the supervisor was aware that

there was a survey available in the work pack, however he could give no details

on its contents or radiological conditions, other than to say “it is low”.

− Individual observed wearing TLD (Thermo Luminescent Dosimeter) and EPD

on the outer pockets of his PPE, which is contrary to induction training. This

was not challenged by other members of the work party.

− An individual was observed to roll up his PPE sleeve and check the time on his

wrist watch. This was not done with the required approval from an RMT

(Radiological Monitoring Technician). There were observations of individuals

making hand-to-face movements, wiping faces and touching goggles in the

contaminated area.

Without clear instructions and an understanding of radiological conditions, the

ability of the plant to reduce, and prevent unplanned, radiation exposures and

personal contamination is challenged.

Recommendation: The plant should review and reinforce its Radiological Work Permit

process and its implementation in the field.

IAEA Basis:

NS-G-2.7

3.44. For tasks necessitating radiological precautions, a radiation work permit (RWP) should

normally be prepared. A copy of the RWP should be submitted to the supervisor of the work

and it should be retained with the work team throughout the performance of the work.

Information and instructions that may be given in the RWP in addition to a description of the

work would include for instance:

(a) details of average dose rates and possible areas of elevated activity in the working area on

the basis of a survey made prior to the work or otherwise estimated;

(b) estimates of contamination levels and how they might change in the course of the work;

(c) additional dosimeters to be used by the workers;

(d) protective equipment to be used in different phases of the work;

(f) instructions on when to contact members of the radiation protection group.

5.5. Training measures should cover the following topics to a level of detail commensurate

with the assigned tasks and responsibilities of the respective worker or supervisor:


52

(a) the main types of ionizing radiation and their effects;

(b) basic quantities and units in radiation protection;

(e) use of protective equipment such as shielding and protective clothing;

(f) use of survey meters and contamination monitors, and individual external and internal

monitoring, including dose assessment;

(g) the potential risks associated with the operation of nuclear power plants;

(i) warning signs and alarm signals and information on appropriate actions to be taken;

(j) contamination control, decontamination and reduction of sources of radiation;

(k) responsibility to inform designated persons immediately in the event of any unforeseen

occurrence entailing increased risks in relation to radiation;

(o) behaviour in controlled areas.

CHEMISTRY 53

8. CHEMISTRY

8.1. ORGANIZATION AND FUNCTIONS

The team identified inconsistencies between different procedures and actual chemistry

analytical practices used in laboratories that could lead to inadequate chemical environments

which could impact on safety of systems and components.

Additionally, it was also found, that chemistry procedures are not always subjected to regular

revision and appropriate classification.

The team developed a suggestion in this area in order to improve the consistency and

implement proper revision and classification of chemistry procedures.

8.3 CHEMICAL SURVEILLANCE PROGRAMME

Based on supporting facts, the team found that the analytical methods and comprehensive

evaluations of chemical and radiochemical results are not fully established and implemented.

Without fully establishing and implementing these, the corrosion state of primary and

secondary systems cannot be properly evaluated. This may lead to corrosion damage to

primary and secondary surfaces, formation of unexpected deposits on fuel assemblies or

steam generator surfaces and result in accelerated activity build-up, higher plant dose rates

and increased exposure of plant personnel.

It was suggested by the team to improve and implement the existing analytical methods and

evaluations of chemical and radiochemical results.

8.5. LABORATORIES, EQUIPMENT AND INSTRUMENTS

The computerized system to alert the responsible person regarding the expiry date of

laboratory reagents was identified as a good performance by the team.

The general conditions in the chemistry laboratories are good, but the team encourages the

plant to improve the housekeeping in this area.

The operability of the liquid and gaseous post accident sampling system and methods were

considered by the team as an area for improvement. Without adequately trained personnel for

liquid and gaseous post accident sampling and ensuring availability of the system, the plant

may not be adequately prepared for this work to be performed in the requested time, and may

not be familiar with overall actions to be taken.

The team recommended the plant to improve the procedures, training, engineering support,

maintenance and undertake periodical testing activities of the post accident sampling system

to ensure operability of the system for requested liquid and gaseous samples in post accident

situations.

CHEMISTRY 54

8.6. QUALITY CONTROL OF OPERATIONAL CHEMICALS AND OTHER

The team found that the process of the storage and quality control of operational chemicals

and other substances were not at an appropriate standard. The team recognised both

programme and performance based facts in this area during the review. Without a well

structured and comprehensive process for the storage and quality control of operational

chemicals and other substances, there is the potential risk of improper use, personal injury

and possible detrimental effects on safety system components. The team made a


CHEMISTRY 55

DETAILED CHEMISTRY FINDINGS

8.1 ORGANIZATION AND FUNCTIONS

8.1(1)Issue: Inconsistencies exist between the chemistry practices used in laboratories

and the corresponding administrative and technical procedures.

The following facts were observed during the review, concerning equipment

calibration and checking with standard solutions. Before using an instrument, the

instrument should be checked by comparing it with a standard:

− 2PQL 03.1.10: checking with standard buffer solution is not required before

performing a pH measurement, and the procedural requirement is that the calibration

frequency is only once per week,

− 2PQL 03.1.13: checking with standard solutions is not required before performing an

ion-chromatographic measurements, and the procedural requirement is that the

calibration frequency is only once per 6 months,

− 2PQL 03.4.09: checking with standard gases is not required before performing a gas-

chromatographic measurements, and the procedural requirement is that the calibration

frequency is only once per year,

− 2PA-QR09: contains only general requirements of checking equipment before

carrying out the measurements.

Additionally, it was also found, that chemistry procedures are not always subjected to

regular revision and they are often classified as N/A (others), instead of Q (important

aspect).

The inconsistency between different procedures and chemistry analytical practices used

in laboratories could lead to inadequate chemical environments which could impact on

safety of systems and components.

Suggestion: Consideration should be given to improving the consistency between the

chemistry practices used in laboratories and the corresponding administrative and

technical procedures and to proper revision and classification of chemistry procedures.

IAEA Basis:

NS-G-2.4

6.75. „Documentation should be controlled in a consistent, compatible manner throughout the

plant and the operating organization. This includes the preparation, change, review, approval,

release and distribution of documentation. Lists and procedures for these functions should be

prepared and controlled.”

CHEMISTRY 56

GS-G-3.5

5.10. “It shall be ensured that document users are aware of and use appropriate and correct

documents.”

GS-G-3.1

2.60. Level 3 information consists of a wide range of documents to prescribe the specific

details for the performance of tasks by individuals or by small functional groups or teams.

The type and format of documents at this level can vary considerably, depending on the

application involved. The primary consideration should be to ensure that the documents are

suitable for use by the appropriate individuals and that the contents are clear, concise and

unambiguous, whatever the format.”

CHEMISTRY 57

8.3 CHEMICAL SURVEILLANCE PROGRAMME

8.3(1) Issue: Analytical methods and comprehensive evaluations of chemical and

radiochemical results are not fully established and implemented.

The team identified the following facts during the review:

− corrosion and erosion-corrosion product transport are not fully monitored and

evaluated both in the primary and secondary circuit:

� there is no limit value for corrosion product activity concentration in primary

coolant,

� model calculations for corrosion product transport estimation are not done,

� dissolved corrosion product activity concentrations are not trended in primary

coolant,

� the built-in filter up-stream of the primary coolant sampling point inadvertently

affects the representative sampling of particulates,

− since 2006 there has been a slight increasing tendency of the total alpha activity

concentration measured in the spent fuel storage pool (FAL), but no evaluation has

been carried out concerning the possible reason,

− only I-131 activity concentration in primary coolant is trended regularly, all the other

iodine nuclides (I-132, 133, 134 and 135) are just measured,

− activity concentrations of noble gases are determined only from the liquid phase of

primary coolant which does not properly represent the total gas content,

− chloride is not considered as a control parameter in the secondary feed water and

steam generator (SG) blow down and measured only in SG blow down (the source is

the feed water)

− high silica concentration values are measured in demineralised water almost every 4th

month:

� there are only two trenches/lines of ion-exchangers to serve Angra1, 2 and Angra3

in the future,

� when one trench/line is out of operation (due to regeneration, resin change or

operational problem), the quality of the produced water decreases because of

overloading the operating ion exchange trench/line,

� as result, hide-out return of silica in secondary coolant during the last start-up was

two times higher than in the previous one, because the silica concentration in the

produced demineralised water was 10 times higher in many cases, during the cycle

8 than in cycle 7, but the reason was not analyzed and evaluated,

� 6,1-10,1 kg of sludge was removed from each steam-generator in 2007 with

sludge lancing, but the chemical composition of sludge was not analyzed and

evaluated,

− the equipment for total organic carbon (TOC) measurement in demineralised water

has been out of operation for more than 8 months:

� it was decided to measure chemical oxygen demand (COD) instead of TOC, which

only gives partial information on the organic content of demineralised water (like

bacteria, fungi and microbes),

� biological fouling cannot be followed and minimized based on this measurement.

CHEMISTRY 58

Without fully establishing and implementing proper analytical methods and comprehensive

evaluations of analytical results the corrosion state of primary and secondary systems cannot

be evaluated. This may lead to corrosion damage to primary and secondary surfaces,

formation of unexpected deposits on fuel assemblies or steam generator surfaces and result in

accelerated activity build-up, higher plant dose rates and increased exposure of plant

personnel.

Suggestion: Consideration should be given to improving and implementing the analytical

methods and evaluations of chemical and radiochemical results.

IAEA Basis:

SSG-13:

4.10. The fuel integrity monitoring programme should include appropriate procedures to

ensure that chemistry and radiochemistry data indicative of fuel integrity are systematically

analyzed for trends and evaluated to detect anomalous behaviour [9].

4.43. Special attention should be paid to the integrity of the various parts of the secondary

systems that may be significantly affected by flow accelerated corrosion.

4.46. The levels of deleterious impurities (e.g. sodium, chloride and sulphate ions and lead

and copper) in the steam generators should be minimized and controlled. Blow down limits

for the steam generator should be established, with action levels for each chemical impurity

that may be deleterious for the steam generator tubes and potentially present in the system.

4.47. The influence of chemistry control on the integrity of the steam generator should be

evaluated. The main tools for such an evaluation are:

(b) The evaluation of ‘hideout return’ effects (the levelling of concentrations) during at least

some of the shutdowns for refuelling;

(c) Calculation codes or any other relevant method for estimating the chemistry

characteristics of the liquid contained in crevices in, and deposits on, the steam generator tube

during operation.

5.14. The control of corrosion product transport should be established and implemented in

order to minimize the release and re-deposition of activated corrosion products from the core

that may result in very high radiation fields out-of-core. This transport should be minimized

by keeping primary water chemistry parameters as constant as possible and as close as

possible to the optimal values during normal power operation.

CHEMISTRY 59

6.17. Laboratory monitoring involves sampling of plant systems and analyzing for specific

chemistry properties, concentrations of dissolved and suspended impurities and activities of

radio nuclides. The scope and periodicity of chemistry monitoring activities to be performed

should be set out and made available. Sampling points, periodicity of analysis and procedure

should be established for each chemistry regime (start-up, shutdown, operation at stable

power levels, transients).

6.22. Primary coolant activity monitoring should be carried out in support of the following

tasks:

(a) Measurement of fission product activity as a means of evaluating the fuel integrity,

identifying fuel cladding leaks and estimating cladding defect type and number:

- Properly selected radionuclide activity ratios should be applied to assess the burn up of

leaking fuel rods in order to facilitate their identification during operation or outages,

depending on the type of reactor.

6.23. Radiochemistry measurements should be part of spent fuel handling operations, starting

from reactor pool storage through any transport operations to interim storage facilities, in

order to monitor fuel integrity and the possible propagation of defects after removal of fuel

from the reactor.

6.29. Determination of the activity of primary surface deposits serves for the identification of

either potential specific radionuclide contaminants (e.g. antimony, silver) or trends and

anomalies in occupational radiation exposure. This determination should be made by the use

of wipe sampling, corrosion layer scraping or electrochemical sampling, or by in situ gamma

spectrometry of appropriately selected parts of the primary circuit, or by other methods.

7.8. Trends should be reviewed soon after data have been recorded, in order to identify

problems that may need corrective action before a parameter exceeds its specified limit.

Trending should also be used to evaluate transients of short duration caused by plant

operational changes and slower long term changes occurring under stable plant conditions.

Evaluation of slow changes may facilitate the prediction of when a change could become a

significant safety problem.

7.9. Significant short and long term chemistry results should be routinely evaluated and

reported to the appropriate level of management. Effective communication with other groups

should be established when analytical data indicate the need for prompt action to correct

chemistry related problems.

CHEMISTRY 60

8.5 LABORATORIES, EQUIPMENT AND INSTRUMENTS

8.5(1) Issue: The operability of the liquid and gaseous post accident sampling system and

methods are improperly considered, maintained, trained and tested.

The following facts were identified by the team during the review:

− the procedures (2PEQ 01, 2PEQ02, 2PEQ03, 2PEQ04) are inadequately developed for

comprehensive post accident sampling,

− methods for obtaining, transporting and analyzing samples are not defined,

− the exact sampling points for obtaining liquid and gaseous samples are not defined,

− the necessary equipment for sampling (transportation trolley, dilution stand, shielding)

are not available,

− the only training for staff was a classroom training on the procedures,

− exercises and drills on simulated operation of the system have never been performed

in the plant,

− system operability is not tested and maintained periodically.

Without adequately trained personnel for liquid and gaseous post accident sampling and

ensuring availability of system, the plant may not be adequately prepared for this work to be

performed in the requested time, and may not be familiar with overall actions to be taken and

could affect personnel safety during accident conditions.

Recommendation: Post accident sampling procedures, training, engineering support,

maintaining and periodically testing activities should be improved in order to ensure

operability of the system for requested liquid and gaseous samples in post accident situations.

IAEA Basis:

NS-R-2

2.38. Instruments, tools, equipment, documentation and communication systems to be used in

emergencies shall be kept available and shall be maintained in good operating condition, in

such a manner that they are unlikely to be affected by or made unavailable by the postulated

accidents.

SSG-13,

6.43. A post-accident sampling system or other adequate sampling facility should be ready to

operate when required by emergency procedures and should also be considered for use in

taking regular samples from plant systems. If a post accident sampling system does not exist,

other approaches should be adopted for core damage evaluation and for estimation of the

inventory of fission products released into the containment.

6.44. For proper operation of a post-accident sampling system, the following should be

provided:

CHEMISTRY 61

(a) Operating procedures for the post-accident sampling system.

(b) Radiation protection measures for personnel who carry out sampling and analysis; such

measures should be evaluated in advance and applied when the post-accident sampling

system is used.

(c) A programme for preventive maintenance.

(d) Regular checks of the operability of the post-accident sampling system.

(e) Regular training of personnel designated for operation of the post-accident sampling

system (i.e. personnel taking grab samples and performing subsequent activities).

(f) Specification of the chemistry parameters to be monitored (e.g. conductivity in the reactor

water cleanup system and gaseous fission products in the main steam system).

(g) Procedures for optimizing occupational radiation exposure.

Safety of Nuclear Power Plants: Operation, Requirements, NS-R-2,

2.33. The emergency plan of the operating organization shall include the following:

(3) The arrangements for initial and subsequent assessment of the radiological

conditions on and off the site;

2.35. Site personnel shall be trained in the performance of their duties in an emergency. There

shall be a means of informing all employees and all other persons on the site of the actions to

be taken in the event of an emergency.

2.38. Instruments, tools, equipment, documentation and communication systems to be used in

emergencies shall be kept available and shall be maintained in good operating condition, in

such a manner that they are unlikely to be affected by or made unavailable by the postulated

accidents.

Radiation Protection and Radioactive Waste Management in the Operation of Nuclear Power

Plants, Safety Guide, NS-G-2.7,

5.4. Training for workers should cover all topics relevant to the radiation task assignments

and the potential risks. Those who need to work in zones of high radiation levels should be

trained in their specific work activities so as to enable them to perform their duties in the

minimum possible time, in keeping with the principle of optimization. This could include, for

example, training on mock-ups, rehearsing the planned work and practicing emergency

actions.

5.7. Training on emergency procedures should be given periodically to ensure that all persons

who would need to take action in an emergency know which actions to take.

CHEMISTRY 62

8.6 QUALITY CONTROL OF OPERATIONAL CHEMICALS AND OTHER

SUBSTANCES

8.6(1) Issue: The process for storage and quality control of operational chemicals and other

substances is not at an appropriate standard.

The team identified the following programme facts during the review:

− different and non consistent procedures are used (PA-GE75, 2PA-QR07, 2PA-QG01,

not valid procedure for Unit2) instead of having one combined procedure for

purchase, quality control and use of operational chemicals and other substances,

− quality requirements for purchase and use of operational chemicals and other

substances are not given in those procedures,

− the Areva documents (ie. MTS 134.00 from 1992 and 1998, GPS.T-1-00/0129 from

2000) are still used without any revision and approval,

− the classification (commercial N/A, non safety Q, nuclear safety S) is done by

engineering support, and there is no chemistry involvement in the quality control

process,

− ~5% of the stored items are not classified (commercial N/A, non safety Q, nuclear

safety S).

In addition, the following performance facts were also observed by the team:

− all operational chemicals and other substances are stored in warehouses and used at

workplaces without easily visible quality control identification and approval labelling,

the use of teflon is prohibited in the primary side of the plant but teflon/rubber

sealings were found in the central warehouse to be used in high temperature LBA

systems (317459: main steam isolating valve, 317430: blow down isolating valve)

acids and alkaline solutions were stored in the same chemical warehouse without

physical separation,

− mortar (Argamassa) was stored together with operational chemicals in the chemical

warehouse,

− 2 drums (200 l each) were found in the temporary warehouse for flammables with

inflated and heavily corroded lids,

− 200 l drum of Fyrquel was stored outside the oil warehouse without any indication of

danger,

− two damaged sacks containing ion exchange resins were stored together with intact

ones in the chemical warehouse,

− 200 l drums for temporary storage of oil were found without identification labels in

turbine building at -0.85m level,

− isolation oil tank without retention containment, stored close to the road in a zone not

dedicated for storage,

CHEMISTRY 63

− large amounts of lithium-hydroxide and boric acid were found in the hot lab without

quality control identification and approval label, bottles and canisters containing

flammable liquids were stored in room JA0864, flammable chemicals were stored in

the welding workshop and in the decontamination room KA0423 without quality

control identification and approval label,

− a can of lubricating oil spray was found in the emergency diesel generator room

without labelling and approval,

− a plastic bag full with water samples was observed in the cold lab without any

identification.

Without a well structured and comprehensive process for storage and quality control of

operational chemicals and other substances the inappropriately stored and controlled

chemicals and other substances could have the potential risk of improper use, personal injury

and have detrimental effects on safety system components.

Recommendation: The plant should establish and implement a well structured and

comprehensive process for storage and quality control of operational chemicals and other

substances.

IAEA Basis:

NS-R-2

6.11. Arrangements shall be made to procure, receive, store and issue parts and materials for

use in the plant. For further guidance see Safety Series No. 50-C/SG-Q on Quality Assurance

for Safety in Nuclear Power Plants and other Nuclear Installations, and in particular the Code

and the Safety Guides Q4, Q6, Q12 and Q13 [4].

SSG-13,

9.1. A policy should be established to prevent the use of chemicals or other substances that

could introduce potentially harmful impurities into plant areas or circuits, thereby affecting

the coolant, auxiliary and safety systems, or other external surfaces. The responsibility for

coordinating the control of chemicals and other substances on-site should also be clearly

established in accordance with the requirements established in Ref. [7].

9.2. The operating organization should be responsible for the use of the proper chemicals and

for their correct quality.

9.3. The use of chemicals and other materials at the plant, including those brought to the plant

by contractors, should be controlled in accordance with clearly established procedures. The

intrusion of non-conforming chemicals or other substances into plant systems can result in

deviations in the chemistry regime, leading to component and system damage or increase of

dose rates. The use of uncontrolled materials on the surfaces of the components may also

induce damage.

CHEMISTRY 64

9.4. One or more lists of approved chemicals and other substances that are allowed to be used

at the nuclear power plant should be made available. These lists should be well known by

chemistry, maintenance and procurement staff and contractors.

9.5. The reagents and ion exchange resins used for any safety related system should be within

the required specifications with regard to impurities and this should be verified before their

use.

9.6. Chemicals and other substances should not be used in systems, structures or components

if they contain corrosion inducing components above specified limits.

9.7. Procedures for the procurement, storage, replacement and ordering of chemicals and

other substances, including hazardous chemicals, should be made available.

9.8. When receiving chemicals, the specified quality should be verified by chemical analysis

and/or by a certificate and a chemical identification test.

9.9. Chemicals and substances should be labelled according to the area in which they are

permitted to be used, so that they can be clearly identified. The label should indicate the shelf

life of the material.

9.10. When a chemical is transferred from a stock container to a smaller container, the latter

should be labelled with the name of the chemical, the date of transfer and pictograms to

indicate the risk and application area. The contents of the smaller container should not be

transferred back into the stock container. Residues of chemicals and substances should be

disposed of in accordance with plant procedures. The quality of chemicals in open stock

containers should be checked periodically.

9.11. The replacement of harmful chemicals or other substances (from the point of view of

personnel safety, environmental protection and material compatibility) by harmless ones

should be encouraged.

9.12. Staff involved in receiving, storing, transporting and using chemical substances should

be trained to understand storage compatibility, labelling requirements, handling, safety and

impacts on structures, systems and components at the plant (see Section 8).

9.13. Management should periodically carry out walk downs of the plant to evaluate the

effectiveness of the chemistry programme and to check for uncontrolled storage of chemicals.

9.14. Material safety data sheets for all approved chemicals and substances should be made

available and easily accessible. These data sheets should include, as minimum, possible

dangers to the health of staff, preventive measures for handling the materials and medical

recommendations in case of accidental use.

CHEMISTRY 65

9.15. Chemicals should only be stored in an appropriate store that is fire protected and

captures spillages and which is equipped with a safety shower, as required. Oxidizing and

reducing chemicals, flammable solvents and concentrated acid and alkali solutions should be

stored separately. Tanks containing chemicals should be appropriately labelled. Reasonably

small amounts of chemicals can be stored in other controlled environments in the workshops

or operational department.

9.16. In the storage of chemicals, account should be taken of the reduced shelf life of opened

containers. Unsealed and partly emptied containers should be stored in such a manner that the

remaining product is kept in a satisfactory condition.

9.17. A procedure should be established to define the proper quality of all oils used for each

component important to safety and used for the availability of systems important to safety.

9.18. Lubricants and hydraulic oils from systems important to safety and/or the availability of

systems important to safety should be regularly analysed to check control parameters that

characterize the condition of the lubricant.

Maintenance, Surveillance and In-service Inspection in Nuclear Power Plants, Safety Guide,

NS-G-2.6,

8.34. The administrative arrangements should include written procedures assigning the

responsibility for regularly examining stored items and auditing the administration of stores

in order to detect any deterioration or any unauthorized or unrecorded use of stored items.

Particular attention should be paid to retention of the original identification of items during

storage.

Safety in the use of chemicals at work – ILO:

4.3.2. The purpose of the label is to give essential information on:

a) the classification of the chemical;

b) its hazards;

c) the precautions to be observed.

The information should refer to both acute and chronic exposure hazards.

6.7.1. Hazardous chemicals should be stored under conditions specific to their inherent

properties and characteristics to ensure safety and in accordance with established criteria.

CHEMISTRY 66

6.7.3. The control measures to provide protection should cover any combination of the

following:

(a) the compatibility and segregation of stored chemicals,

(i) temperature, humidity and ventilation requirements,

(j) labelling and relabeling requirements,

(l) requirements relating to possible physical and chemical changes in stored chemicals (e.g.

not to store beyond the expiration period recommended on the label and the chemical safety

data sheet).

EMERGENCY PLANNING AND PREPAREDNESS 67

9. EMERGENCY PLANNING AND PREPAREDNESS

9.1. EMERGENCY PROGRAMME

The on-site emergency plan (PEL) is coordinated by a staff of 3 Full Time Equivalent agents.

However, there are no detailed job descriptions for this staff and no indicators are used to

drive their actions and activities.

9.2. RESPONSE FUNCTIONS

The transition from normal to emergency operations and the necessary emergency response

organisation (ERO) functions are clearly defined. The bases to take the appropriate mitigating

and urgent protective actions exist. The PEL is designed and elaborated to take the protective

actions for the people on the site before any exposure. However, as this precautionary

approach is not always possible, the PEL should include a more progressive emergency

response in order to guarantee, in any circumstances, the safety of all persons on the site and

emergency workers. The team has made a recommendation in this area.

The team noticed that the information and data exchanges between the on-site and off-site

emergency centres are mainly based on oral communications. No (white) board or other

communication aid or structured support documents are developed to record and share the

key information (performed assessments, conclusions and recommendations, etc.) and data

among the on-site and off-site ERO. The team encourages the plant to develop and enhance

tools, aids and support documents to improve the emergency response and facilitate the

transfer of the key information during the turnover process.

9.3. EMERGENCY PLANS AND ORGANIZATION

In case a site evacuation is decided by the plant when the PEL is activated, the evacuation

process could be performed efficiently due to efficient preparatory measures like the

implementation of a car policy facilitating a safe evacuation. The team has identified it as a

good practice.

9.7. TRAINING, DRILLS AND EXERCISES

A training program for ERO is not developed based on requirements defining the knowledge,

skill and competencies (qualification requirements) for each ERO function member.

The current drills and exercise program does not include sufficient characteristics to assess

the effectiveness of the ERO capability. The team has made a recommendation in this area.


DETAILED EMERGENCY PLANNING AND PREPAREDNESS FINDINGS

9.2. RESPONSE FUNCTIONS

9.2(1) Issue: The protection of all persons on the site in the event of an emergency is not

fully effective.

The team identified the following facts:

− The assembly points, located outside, are not equipped with any personal

protective measures (for example, overshoes, overalls, etc.) or equipment, except

for TLDs.

− No sheltering protective measure is considered in the on-site emergency plan

(PEL), except as an alternative for evacuation in case of adverse conditions

(blocking of the roads, significant radioactive release, etc.).

− No assembly points/rooms inside buildings.

− No mustering performed before site evacuation (only a subsequent check is

performed by the physical protection services to confirm the effective evacuation

of the site and the identification of any missing person).

− Some Alert/Site emergency criteria include events with potential hazard for the

on-site people (e.g. presence of toxic gases in the vicinity of the plant not under

control) whereas the on-site emergency plan does not consider emergency

protective measures under such conditions.

− No continuous monitoring of radiation levels at the assembly points and at the 2

on-site emergency centres located outside the vital area.

− If stable iodine administration is decided in a site emergency, the implementation

of this protective measure will be time consuming and resource constraining due

to the absence of people gathering/assembling as they are instructed to stay in their

workplaces.

− The emergency response equipment dedicated to the on-site responders (such as

physical protection personnel) does not include alarming dosimeters. There are no

dedicated emergency scheme legal dosimeters.

− There are no dedicated emergency alarming dosimeters with specific alarm levels

(higher than default alarm levels set at 50 µSv & 50 µSv/h).

− Escape routes are clearly marked (painted green line with fluorescent yellow

arrows) but not in the stairs. Obstacles or obstruction of emergency escape routes

as well as some escape route signs; missing EXIT (“SAIDA”) signs; and damaged

emergency escape lights were observed by the team.


− Evacuation of a zone/building as a result of a fire is not initiated by an alarm

signal but initiated and performed by the local intervention team. However,

announcement through the public address system is expected.

− There are no indications of the route to the four assembly points located outside.

Ineffective protection of all persons on the site could lead to unnecessary personnel

hazard, exposure and/or uncontrolled spread of contamination.

Recommendation: The plant should improve the effectiveness of the protection of all

persons on the site in case of an emergency.

Basis:

IAEA GS-R.2

4.51 The operator of a facility […] shall make arrangements to ensure the safety of all

persons on the site in the event of a nuclear or radiological emergency. This shall

include arrangements: […] for all persons on the site to take appropriate actions

immediately upon notification of an emergency; to account for those on the site; to

locate and recover those unaccounted for; […]. The facility shall provide suitable

assembly points for all persons on the site and “shall be provided with a sufficient

number of safe escape routes, clearly and durably marked, with reliable emergency

lighting, ventilation and other building services essential to the safe use of these

routes. The escape routes shall meet the relevant international requirements for

radiation zoning and fire protection and the relevant national requirements for

industrial safety and… security.”

IAEA GS-R.2 –, , ,

4.50 The jurisdictions within the precautionary action zone and/or the urgent

protective action planning zone shall make arrangements to take appropriate urgent

action promptly upon the notification of a nuclear or radiological emergency. These

arrangements shall include arrangements for: taking appropriate actions for the

protection of emergency workers;…..


4.56 Arrangements shall be made to protect emergency workers, in accordance with

international standards.

4.58 Those called upon to respond at a facility in threat category I, II or III […] shall

be designated as emergency workers. Such assisting personnel as […], medical

personnel and drivers and crews of evacuation vehicles shall be designated as

emergency workers.

4.62 […] arrangements to assess continually and to record the doses received by

emergency workers; procedures to ensure that doses received and contamination are

controlled in accordance with established guidance and international standards; and

arrangements for the provision of appropriate specialized protective equipment,

procedure and training for emergency response […]

GS-G-2.1

3.5 the operator should be responsible, as appropriate, for:

Table 3 […] Protect individuals on the site and on-site emergency workers

− […] Protection individuals on the site and within the area controlled by the

operator.

4.13 The urgent protective actions and countermeasures should include the following

[…]:

− Sheltering

Table 15 Assembly point: Locations where non-essential personnel at the facility are

assembled; accounted for and sheltered or evacuated […] Areas […] with sufficient

room for on-site non essential (non-response) staff (including construction workers or

other non permanent personnel). Easily accessible, provides some protection from a

release or exposure, and is continuously monitored.

[…]

Operational Support Centre (OSC): […] continuous monitoring of radiation levels; in

a location that will probably remain habitable under emergency conditions.


IAEA Basis:

EPR-METHOD-2003 –,

4.2.4. A4.7 Arrange for the safety of all people on the site in the event of a radiation

emergency. Include arrangements […] to account for those on the site; to locate those

unaccounted for; to implement urgent protective actions (i.e. evacuation, shelter […]

Arrange suitable assembly points for all persons in the facility and provide sufficient

number of safe escape routes, clearly and durably marked, with reliable emergency

lighting, ventilation and other building services essential to the safe use of these

routes. Ensure escape routes meet the relevant international requirements for radiation

zoning and fire protection and the relevant national requirements for industrial safety

and security. Provide suitable alarm and communication systems so that all persons in

the facility and on the site can be warned and instructed, even under emergency

conditions.

4.2.17. B5.2 […] For nuclear power plants, provide on-site personnel with thyroid

prophylaxis, which should not delay their evacuation or sheltering.

Develop a procedure to monitor the dose in the on-site assembly areas or shelters and

evacuate if necessary.

Arrange to monitor and manage the contamination of evacuees from the site […]

[…] There should be provisions to continuously monitor radiological conditions and

control of contamination within the facilities and for evacuation if warranted.


9.3 EMERGENCY PLANS AND ORGANIZATION

9.3(a) Good practice: The site evacuation could be performed efficiently at the appropriate

decision point due to efficient preparatory measures.

The site has implemented a car parking policy that requires cars to be parked at

authorized locations. It is also required that the cars are to be parked facing out in

these locations. This car policy is included in the mandatory yearly retraining

document for the general employees. The implemented policy observed during the

mission facilitates a safe evacuation process.

Every three months, the plant assesses the number of people expected for each of the

four assembly points. This estimation is further more refined weekly and is completed

by the determination of the number of the busses needed depending on the working

conditions (working hours, outside working hours, week, week-end) and the figures

are recorded in the weekly on-duty call list. This practice facilitates the initiation of an

evacuation of the site by limiting the required actions to the identified resources.

During the general off-site exercise, organized every two years, an effective

evacuation of the site is tested and the time needed to perform such a site evacuation is

recorded. These records indicate a complete evacuation of the site could be conducted

within ninety minutes, including the subsequent verification of the effective site

evacuation.


9.7. TRAINING, DRILLS AND EXERCISES

9.7(1) Issue: The periodic drills and exercises programme is not sufficient to assess the

effectiveness of the emergency response capability.


− No unannounced drills, exercises or mobilization tests are performed.

− The on-site and off-site exercises are always organized during working hours.

− The scope of internal exercises is limited in terms of duration; events tested

(limited to Unusual & Alert event categories); and participation of staff members

not involved in the emergency response organization (ERO).

− The turnover process of the ERO functions has never been tested during an

exercise.

− The simulated media (as actor) has never been tested during an exercise.

− The remote Emergency Centre located in Mambucaba is not included in the

exercise schedule.

− The plant does not have a systematic or organized process to check the regular

participation of ERO staff members during exercises.

Without sufficient periodic drills and exercises, the plant cannot effectively assess the

emergency response capability.

Recommendation: The plant should improve the periodic drills and exercise program

to include periodic, realistic, comprehensive and integrated on-site exercises.

IAEA Basis:

IAEA GS-R.2

5.33 Exercise programmes shall be conducted to ensure that all specified functions

required to be performed for emergency response and all organizational interfaces

[…] are tested at suitable intervals. These programmes shall include the participation

in some exercises of as many as possible of the organizations concerned.

5.34 The staff responsible for critical response functions […] shall participate in a

training exercise or drill at least once every year.

5.35 The officials off the site responsible for making decisions on protective actions

for the population within the precautionary action zone and/or the urgent protective

action planning zone […] shall regularly participate in exercises.


NS-R-2

2.37. The emergency plan shall be tested in an exercise before the commencement of

operation. There shall thereafter at suitable intervals be exercises of the emergency

plan, some of which shall be witnessed by the regulatory body. Some of these

exercises shall be integrated and shall include the participation of as many as possible

of the organizations concerned. The plans shall be subject to review and updating in

the light of experience gained.

Safety Series No.115

Appendix V – V.3 (e) […] provision be made for training personnel involved in

implementing emergency plans and the plans be rehearsed at suitable intervals in

conjunction with designated authorities

EPR-METHOD-2003

4.2.18. B6.3 Exercise scenarios, simulation, or play should be realistic. […]

Organizations that are not part of the response organization, but that could play an

important role (e.g. the builder of the facility, the IAEA) should participate in

exercises periodically.

4.2.18. B6.6 The individuals […] who would fill crucial leadership roles should

participate in the training, drills or exercises. Substitutes who would not fill those

positions during a real emergency should not be allowed.

SAFETY CULTURE 75

13. SAFETY CULTURE

13.1 WORK AND MANAGEMENT PRACTICES

The plant does not have an integrated process based management system in place. Informal

and non-systematic work practices exist at all levels of the organization. Some examples

include:

− handwritten and uncontrolled mark-ups of final work plans

− procedures are not updated timely, not followed and sometimes missing

− mechanism for involving staff in contributing improvement ideas is handled informally

− lack of clarity on how formal actions or modifications are undertaken following departmental

self- assessments

− operations does not apply a fully effective work control and authorization process

− the plant’s work control process is not always effective

− the planning, control, and evaluation of the surveillance program is not always performed in a

systematic and effective way

There is evidence of a basic assumption that informal systems are sufficient to ensure safety.

However, strong safety culture requires more formal and systematic ways of working in order

to reduce the risk of missed information, miscommunication, misunderstanding, and to have

control of work practices in a way that permits traceability of issues and focused learning and

improvement. It is also unclear how main multi-disciplinary processes are defined,

understood and integrated at the plant, and how linkages between processes are managed to

ensure proper alignment. For example, main processes such as supply and licensing cut

across directorates, putting control of critical contributors to safety outside the control of

plant management. Similarly, vision and direction setting for the plant is not well

communicated so employees can relate their work to the goals of the organization. The

assessment shows that there is a cultural preference for working on the more tangible,

compartmentalized and immediate issues, and less on addressing longstanding issues and

cross cutting main process problems.

The plant has undergone significant organizational change and there are more changes

planned for the coming year. It is not clear that a formal risk assessment was performed to

assess and manage the implications of the changes. From a safety culture perspective, this is

a concern because organizational changes:

− disrupt lines of communication

− shift responsibilities for safety

− can disorient personnel in their work functions

− disrupt control over clearly safety related functions

The plant manager is responsible and accountable for nuclear safety. However, critical

functions such as: procurement, engineering, licensing, and quality control are situated

outside the control of plant management. One example is the longstanding spare parts

problem which requires involvement of all four directorates, plus the legal department on a

higher hierarchical level in order to champion and resolve supply issues.

There are other examples of how the plant does not fully understand the importance of human

and organizational factors in cultivating safety. The screening of external operating

experience is performed by two engineers and does not include the perspective and

SAFETY CULTURE 76

understanding of a human factors specialist. Similarly, the behavioural sciences perspective is

only brought into event investigations if a preliminary assessment performed by Operations

determines that human or organizational issues have contributed to the event. This reliance on

engineering competencies has a high likelihood of overlooking underlying human factors and

latent organizational weaknesses. The team made a recommendation on these informal

practices.

The plant management team has, however, demonstrated good cross-disciplinary cooperation

and team work. The plant management could benefit from the talents of behavioural scientists

and organizational factor specialists to better support individuals and teams in carrying out

their tasks safely and successfully.

13.2 SAFETY IMAGE, RELATIONSHIPS AND ABILITY TO CHALLENGE AND

QUESTION

The plant culture reflects the national and local culture that creates emotionally warm and

relaxing interpersonal environments. This aspect of the plant’s culture translates into a

healthy awareness of the responsibility for the welfare of plant employees, the broader

community and the environment, which is the essence of safety culture. It supports healthy

communications, pride in work, and loyalty to the plant. This is a positive base for building a

constructive safety culture and should be maintained.

The plant has put significant effort into building a clear picture of safety culture in its

workforce. The results of this effort are evident in the consistency of language and concepts

expressed in interviews and focus groups. From a safety culture perspective this is positive

and the team recognized this as a good performance. Individuals at the plant feel that their

tasks and performance are important contributors to the success of the organization. However,

some consideration needs to be given to ways in which the focus on nuclear safety can be

enhanced. Events at other plants, show how consistently positive indicators can lead to high

confidence and a self-image of ‘we are one of the best’ in the world. Depending on how

widespread this focus is on positive indicators and pride in work, it can create a false sense

that risks are well managed at all levels of the organization. This, in turn, can lead to denial of

problems and a perception of being safe simply because negative signals do not fit into the

positive self-image.

A positive self-image combined with strong interpersonal relationships can, in the worst case,

create a culture where the majority share the same views. This cultural coherence can lead to

a strong inclination to fit-in, and an unwillingness to think independently, challenge and

criticize the bases for decisions and practices. The result of the safety culture assessment does

not show clear evidence of complacency, but it does show a tendency in that direction.

During all three focus groups and in interviews with managers, superintendents, supervisors

and staff, a very favourable and unified picture of the perceived success of the integrated

safety management approach was expressed. People were satisfied with the safety

performance of the plant. In contrast, the technical review of other OSART areas indicated

that this is not a fully realistic self-image. Challenges exist in a variety of areas such as:

• conduct of operations

SAFETY CULTURE 77

• conduct of maintenance

• surveillance programs

• fire prevention

• ageing management

• operating experience

• control and storage of equipment and tools

• management of significant organizational changes

• quality control of chemicals and other substances, etc.

When asked in interviews and focus groups what could be done to improve safety, most

responses identified topics outside the plant or outside the control of the plant management.

There is a reluctance to freely discuss internal safety problems and challenges. The team did

not observe strong evidence of open challenging and critical thinking about the performance

or practices at the plant. The team suggested that the plant be more self-critical.

13.3 LEADERSHIP, HUMAN PERFORMANCE AND ORGANIZATIONAL ASPECTS

The plant has a well developed approach to human performance whereby human performance

is linked to internal and external event information in order to help employees fully

understand how accidents can be avoided through the use of human performance tools.

During the interviews and focus groups it was clearly evident that employees have understood

the value of the human performance concepts and tools. From the perspective of cultivating

safety culture understanding, this approach to educating staff is positive.

As the plant continues to work with human performance and other training and development

activities, it needs to understand that it is shaping behaviours and practices that influence

culture. Specifically, it is important to ensure that the training is tailored to the local and

national culture.

For example, when training courses are brought into the organization from other countries,

special attention should be given to making sure that the training content does not directly or

indirectly devalue or discourage the interactions that are the healthy aspects of the safety

culture at the plant. These kinds of contradictions can create confusion in a culture and

degrade an organization’s way of functioning. Alignment with the local and national culture

is most important in the development of leadership expectations and training, where there is a

widespread tendency to emphasize an autocratic and rigid leadership style in nuclear

facilities. This should also be a consideration when implementing an integrated management

system.

Eletronuclear is in the process of establishing a leadership development program. It has

provided some formal leadership training opportunities to managers and frontline supervisors.

However, there is no formal leadership development program that has been created to

integrate three key aspects: leadership principles and practices, safety concepts and practices,

and the positive aspects of the local and Brazilian culture. The plant should tailor a leadership

program that incorporates these three aspects. The team made a suggestion in this regard.

SAFETY CULTURE 78

A final comment to the safety culture review, in order to be successful in enhancing safety

culture, the plant needs to develop a coherent strategy around all improvement activities (e.g.

technical, human performance, integrated management system), and understand how they

affect each other. When enhancing culture, improvement cannot be achieved through a list of

separate activities. Safety culture is inherent in all the activities of the organization. The

plant must take care to ensure that all improvements work with the positive aspects of the

existing local culture. Safety culture assessments (self and independent) are encouraged to be

conducted more frequently and used as the basis for making improvements.

SAFETY CULTURE 79

DETAILED SAFETY CULTURE FINDINGS

13.1 WORK AND MANAGEMENT PRACTICES

13 (1) Issue: Some aspect of the formal organizational management are missing and the

utility and plant do not clearly understand how omitted aspects can compromise nuclear

safety..

During the review the team noted the following:

− Lack of an integrated process based management system.

− Organizational structure does not support clear integration of organizational

goals and work processes that are critical to nuclear safety.

− Incomplete risk assessment of organizational changes.

− Incomplete long term strategy and plan for staff retention.

− Incomplete systematic leadership development and succession planning

process.

− Incomplete systematic safety culture assessment on a periodic basis.

− The plant manager is responsible and accountable for nuclear safety, however

the authority for nuclear safety is spread across multiple directorates.

− Root cause analyses are conducted but inconsistently executed (e.g. scope and

rigor, significant event reports not completed, and related corrective actions

lagging).

− Handwritten and uncontrolled mark ups of final work plans.

− Problem with inventory of spare parts for Angra 1 and 2, e.g. identification

coding, warehousing.

− Isolations completed and then the work not carried out due to lack of spare

parts.

− Challenges of maintaining consistency when applying the same procedures to

Angra 1 and 2.

− A characteristic of the plant is working informally through relationships and

verbal sharing of information.

− Acceptance of problems with the structure and placing accountability for

issues with other directorates (purchasing, legal), government and external

organizations (contractor companies) for not resolving systemic problems and

longstanding challenges.

SAFETY CULTURE 80

− Belief that engineering competencies are suited to assessing and addressing

human and organizational factors.

− Misunderstanding of the safety implications of the interaction between

individual, technology and organization.

− Not actively communicating organizational strategies and plans.

− Belief in the sufficiency of hierarchical, top down communication.

− Tolerance for inconsistently defined programs (technical surveillance, ageing

program, material inventory).

− Inconsistent follow through and fulfilment of commitments once problems

have been understood.

Not understanding and valuing missing organizational aspects can compromise

nuclear safety. Existence of unsystematic work practices and inconsistently defined

program and process dimensions can mask latent organizational weaknesses. This can

compromise organizational effectiveness and the prevention of events. Lack of

systemic thinking can lead to a narrow approach to understanding and solving safety

problems.

Recommendation: The utility should work with the plant in reviewing and understanding

how omitted organisational aspects can compromise nuclear safety and taking steps to

mitigate these disadvantages.

IAEA Basis:

GS-R-3

2.1. A management system shall be established, implemented, assessed and continually

improved. It shall be aligned with the goals of the organization and shall contribute to their

achievement. The main aim of the management system shall be to achieve and enhance safety

by:

− Bringing together in a coherent manner all the requirements for managing the

organization;

− Describing the planned and systematic actions necessary to provide adequate

confidence that all these requirements are satisfied;

− Ensuring that health, environmental, security, quality and economic requirements are

not considered separately from safety requirements, to help preclude their possible

negative impact on safety.

2.8. The documentation of the management system shall include the following:

− The policy statements of the organization;

− A description of the management system;

− A description of the structure of the organization;

SAFETY CULTURE 81

− A description of the functional responsibilities, accountabilities, levels of authority

and interactions of those managing, performing and assessing work;

− A description of the processes and supporting information that explain how work is to

be prepared, reviewed, carried out, recorded, assessed and improved.

2.9. The documentation of the management system shall be developed to be understandable to

those who use it. Documents shall be readable, readily identifiable and available at the point

of use.

2.10. The documentation of the management system shall reflect:

− The characteristics of the organization and its activities;

− The complexities of processes and their interactions.

5.6. For each process a designated individual shall be given the authority and responsibility

for:

− Developing and documenting the process and maintaining the necessary supporting

documentation;

− Ensuring that there is effective interaction between interfacing processes;

− Ensuring that process documentation is consistent with any existing documents;

− Ensuring that the records required to demonstrate that the process results have been

achieved are specified in the process documentation;

− Monitoring and reporting on the performance of the process;

− Promoting improvement in the process;

− Ensuring that the process, including any subsequent changes to it, is aligned with the

goals, strategies, plans and objectives of the organization.

5.7. For each process, any activities for inspection, testing, verification and validation, their

acceptance criteria and the responsibilities for carrying out these activities shall be specified.

For each process, it shall be specified if and when these activities are to be performed by

designated individuals or groups other than those who originally performed the work.

5.8. Each process shall be evaluated to ensure that it remains effective.

5.9. The work performed in each process shall be carried out under controlled conditions, by

using approved current procedures, instructions, drawings or other appropriate means that are

periodically reviewed to ensure their adequacy and effectiveness. Results shall be compared

with expected values.

5.10. The control of processes contracted to external organizations shall be identified within

the management system. The organization shall retain overall responsibility when contracting

any processes.

GS-G-3.5

2.30. Reference [1] states in para. 2.5 that:

“The management system shall be used to promote and support a strong safety culture by:

SAFETY CULTURE 82

— Providing the means by which the organization supports individuals and teams in carrying

out their tasks safely and successfully, taking into account the interaction between

individuals, technology and the organization.”

……..

Human factors and the interaction between individuals, technology and the

organization

2.32. All safety barriers are designed, constructed, strengthened, breached or eroded by the

action or inaction of individuals. Human factors in the organization are critical for safe

operation and they should not be separated from technical aspects. Ultimately, safety results

from the interaction of individuals with technology and with the organization.

2.33.The concept of safety culture embraces this integration of individuals and technical

aspects. However, whereas the culture of an organization influences human behaviour

through the values, beliefs and assumptions held by the personnel of the organization, there

are also other factors that may have an influence on how humans act in a given situation.

2.34. In a strong safety culture, there should be a knowledge and understanding of human

behaviour mechanisms and established human factor principles should be applied to ensure

the outcomes for safety of individuals–technology–organization interactions. This could be

achieved by including experts on human factors in all relevant activities and teams.

2.35. The interaction between the individual, technology and the organization can be

explained as follows. In a given situation, individuals have various types of resource at their

disposal to enable them to carry out a task successfully.

These resources may be intrinsic to the individual in the form of competence, motivation,

cognitive abilities, etc. Resources may also be physical resources (such as instrumentation,

procedures or computer aids), or they may reside in the working environment, through

teamwork, communication and leadership, in the management system and in the culture.

When the content, design and organization of the task correspond to the individual’s needs

and capabilities, the conditions prevail for the individual to perform in a way that promotes

safety. Thus, resources intrinsic and extrinsic to the individual may help in preventing human

error by providing barriers to error.

2.36. When analysing events, consideration should be given to the possible influence of all

these factors on human behaviour. These factors should also be considered when the purpose

is to identify potential weaknesses in the interactions between individuals–technology–

organization and to determine how to strengthen barriers or introduce new barriers to prevent

human error. Ideally, interdisciplinary teams should carry out predictive and preventive

analyses of these types of event. Such teams should include human behaviour competence, so

as to analyse the individuals–technology–organization interactions from different perspectives

in order to identify suitable barrier functions.

2.37. Individuals should also be trained in how to recognize situations that are likely to give

rise to errors, so that they can avoid making mistakes. In addition, there are various activities

that could be carried out on an individual basis to prevent error. Among these are:

SAFETY CULTURE 83

(a)Pre-job briefings, asking the questions: What are the critical steps? What situations

associated with the work assignment are likely to give rise to errors? What defences are

in place to prevent events?

(b)Self-checks applying the stop–think–act–review (STAR) concept.

(c)Peer checks — having a second individual check the intended action prior to carrying

it out.

(d)Three-way communication by which a message is communicated from one individual

to another. The individual receiving the message repeats the message to confirm a clear

understanding and the originator acknowledges that the message has been correctly

understood and so closes the communication loop.

(e)Conservative decision making should be applied when there are no procedures in place or

plans made for the activity. Further guidance is provided in Ref. [7].

SAFETY CULTURE 84

13.2 SAFETY IMAGE, RELATIONSHIPS AND ABILITY TO CHALLENGE AND

QUESTION

13(2) Issue: The plant does not demonstrate sufficient critical thinking, willingness to

challenge, and critical questioning.

During the review, the team identified the following:

− Favourable and unified picture delivered by managers during focus group e.g.

integrated safety approach, success of cultivating safety awareness inside the

plant and the broader community.

− Tendency to externalize safety concerns – problems are ‘outside the fence’

and ‘outside of our control’

− Strong interpersonal relationships, social norms and conforming

− No evidence in interviews, focus groups or safety culture survey of different

or challenging perspectives on the current state.

− Very few examples of poor practices internally, preferring reference to

unacceptable safety practices in other external organizations.

− Belief that procedure updating, dissemination and adherence is sufficient to

ensure safety.

− Technical and organizational issues not resolved in a timely manner.

− Sometimes minimizing the importance of identifying and solving problems.

− There is a demonstration of pride that could lead to lower consideration for

risks

− Social relationships extend to all aspects of life, namely work, home life,

community, recreation.

Without adequate self-critique, the plant may not recognize long standing issues

important to safety, and may exhibit a pattern of mutual reassurance that does not

challenge common reasoning.

Suggestion: The plant should consider being more willing to challenge, to encourage critical

thinking, questioning of interpretations and conclusions, to seek diverse opinions, and to

demonstrate greater focus on safety.

SAFETY CULTURE 85

Basis: GS-G-3.5

“Management should establish processes and should show by individual example and

direction that it expects individuals to look for ways to learn and improve with regard to

safety.” Section 2.18

Safety culture attributes:

LEADERSHIP FOR SAFETY IS CLEAR - ”Managers should not tolerate or ignore

substandard performance in relation to safety for any reason.”

SAFETY IS LEARNING DRIVEN –”A questioning attitude prevails at all organizational

levels:

— Individuals should notice and should be able to question unusual signs and occurrences

and should seek guidance when in doubt.

—Individuals at all levels should be encouraged to ask detailed questions in meetings.

— Management should be questioning of its own attitudes and views and should actively

seek independent views.

GS-G-3.5 “An organization should continually strive to improve its performance so that it

does not become complacent. Complacency is often a precursor to a serious decline in safety

culture.”

Section 2.18.

“The following are typical symptoms of a decline in safety culture:

• Organizations become complacent and focus on the successes of the past, and are

reluctant to invest in acquiring new knowledge and skills for the future.” Section 2.29.

SAFETY CULTURE 86

13.3 LEADERSHIP, HUMAN PERFORMANCE AND ORGANIZATIONAL ASPECTS

13 (3) Issue: There is no clearly defined program for establishing and developing leadership

competencies, selecting leaders, and aligning leadership expectations with the strengths of the

local and national culture.


− Lack of leadership development program.

− Use of international organizations training.

− Lack of formal plant succession planning.

− Leadership principles and expectations are not formally defined and used in

management and leadership evaluation.

− Focus on cultivating organizational image rather than actual processes.

− Employee perception that they are not heard or listened to, including during problem

solving.

− High value placed on technical competency rather than supervisory responsibilities for

addressing human and interpersonal issues and organizational management.

− Inconsistent leadership styles and practices.

− Strong preference for hierarchical leadership style.

− Belief that good leadership involves self-confidence, charisma, technical knowledge,

and self-control, and not always the capacity to chart a future course and get things

done.

Lack of purposeful identification and development of leaders can result in poor focus,

alignment and achievement required for safety.

Suggestion: The plant should consider establishing its own clearly defined programme

regarding required leadership expectations and competencies as well as selection criterias for

leadership positions.

IAEA Basis:

SF1

Principle 3: Leadership and management for safety

Effective leadership and management for safety must be established and sustained in

organizations concerned with, and facilities and activities that give rise to, radiation risks.

3.12. Leadership in safety matters has to be demonstrated at the highest levels in an

organization. Safety has to be achieved and maintained by means of an effective management

SAFETY CULTURE 87

system. This system has to integrate all elements of management so that requirements for

safety are established and applied coherently with other requirements, including those for

human performance, quality and security, and so that safety is not compromised by other

requirements or demands. The management system also has to ensure the promotion of a

safety culture, the regular assessment of safety performance and the application of lessons

learned from experience.

3.13. A safety culture that governs the attitudes and behaviour in relation to safety of all

organizations and individuals concerned must be integrated in the management system. Safety

culture includes:

—Individual and collective commitment to safety on the part of the leadership, the

management and personnel at all levels;

— Accountability of organizations and of individuals at all levels for safety;

—Measures to encourage a questioning and learning attitude and to discourage complacency

with regard to safety.

GS-G-3.5

Leadership for safety is clear

Section 2.15. Senior managers should be the leading advocates of safety and should

demonstrate in both words and actions their commitment to safety. The ‘message’ on safety

should be communicated frequently and consistently. Leaders8 develop and influence cultures

by their actions (and inactions) and by the values and assumptions that they communicate. A

leader is a person who has an influence on the thoughts, attitudes and behaviour of others.

Leaders cannot completely control safety culture, but they may influence it. Managers and

leaders throughout an organization should set an example for safety, for example, through

their direct involvement in training and in oversight in the field of important activities.

Individuals in an organization generally seem to emulate the behaviours and values that their

leaders personally demonstrate. Standards should therefore be set within the organization for

aspects that are important for safety.

The difference between management and leadership can be stated simply whereby

‘management’ is a function and ‘leadership’ is a relationship. Management ensures that work

is completed in accordance with requirements, plans and resources. It is through leadership

that individuals may be influenced and motivated, and organizations changed. Managers may

also act as leaders.

Safety culture attributes:

”Managers and leaders throughout an organization should set an example for safety, for

example, through their direct involvement in training and in oversight in the field of

important activities.” Section 2.18

LEADERSHIP FOR SAFETY IS CLEAR

Leadership skills are systematically developed:

SAFETY CULTURE 88

— Managers and supervisors should be selected and evaluated with due consideration of their

demonstrated ability to foster a strong safety culture.

—A succession plan that includes aspects of safety culture should be put in place for

developing future managers.

89

DEFINITIONS

DEFINITIONS – OSART MISSION

Recommendation

A recommendation is advice on what improvements in operational safety should be made in

that activity or programme that has been evaluated. It is based on IAEA Safety Standards or

proven, good international practices and addresses the root causes rather than the symptoms

of the identified concern. It very often illustrates a proven method of striving for excellence,

which reaches beyond minimum requirements. Recommendations are specific, realistic and

designed to result in tangible improvements. Absence of recommendations can be interpreted

as performance corresponding with proven international practices.

Suggestion

A suggestion is either an additional proposal in conjunction with a recommendation or may

stand on its own following a discussion of the pertinent background. It may indirectly

contribute to improvements in operational safety but is primarily intended to make a good

performance more effective, to indicate useful expansions to existing programmes and to

point out possible superior alternatives to ongoing work. In general, it is designed to stimulate

the plant management and supporting staff to continue to consider ways and means for

enhancing performance.

Note: if an item is not well based enough to meet the criteria of a ‘suggestion’, but the expert

or the team feels that mentioning it is still desirable, the given topic may be described in the

text of the report using the phrase ‘encouragement’ (e.g. The team encouraged the plant

to…).

Good practice

A good practice is an outstanding and proven performance, programme, activity or equipment

in use that contributes directly or indirectly to operational safety and sustained good

performance. A good practice is markedly superior to that observed elsewhere, not just the

fulfilment of current requirements or expectations. It should be superior enough and have

broad application to be brought to the attention of other nuclear power plants and be worthy

of their consideration in the general drive for excellence. A good practice has the following

characteristics:

− novel;

− has a proven benefit;

− replicable (it can be used at other plants);

− does not contradict an issue.

90

The attributes of a given ‘good practice’ (e.g. whether it is well implemented, or cost

effective, or creative, or it has good results) should be explicitly stated in the description of

the ‘good practice’.

Note: An item may not meet all the criteria of a ‘good practice’, but still be worthy to take

note of. In this case it may be referred as a ‘good performance’, and may be documented in

the text of the report. A good performance is a superior objective that has been achieved or a

good technique or programme that contributes directly or indirectly to operational safety and

sustained good performance, that works well at the plant. However, it might not be necessary

to recommend its adoption by other nuclear power plants, because of financial

considerations, differences in design or other reasons.

91

LIST OF IAEA REFERENCES (BASIS)

Safety Standards

• SF-1; Fundamental Safety Principles (Safety Fundamentals)

• Safety Series No.115; International Basic Safety Standards for Protection

Against Ionizing Radiation and for the Safety of Radiation Sources

• Safety Series No.117; Operation of Spent Fuel Storage Facilities

• NS-R-1; Safety of Nuclear Power Plants: Design Requirements

• NS-R-2; Safety of Nuclear Power Plants: Operation (Safety Requirements)

• NS-G-1.1; Software for Computer Based Systems Important to Safety in

Nuclear Power Plants (Safety Guide)

• NS-G-2.1; Fire Safety in the Operation of Nuclear Power Plans (Safety Guide)

• NS-G-2.2; Operational Limits and Conditions and Operating Procedures for

Nuclear Power Plants (Safety Guide)

• NS-G-2.3; Modifications to Nuclear Power Plants (Safety Guide)

• NS-G-2.4; The Operating Organization for Nuclear Power Plants (Safety

Guide)

• NS-G-2.5; Core Management and Fuel Handling for Nuclear Power Plants

(Safety Guide)

• NS-G-2.6; Maintenance, Surveillance and In-service Inspection in Nuclear

Power Plants (Safety Guide)

• NS-G-2.7; Radiation Protection and Radioactive Waste Management in the

Operation of Nuclear Power Plants (Safety Guide)

• NS-G-2.8; Recruitment, Qualification and Training of Personnel for Nuclear

Power Plants (Safety Guide)

• NS-G-2.9; Commissioning for Nuclear Power Plants (Safety Guide)

• NS-G-2-10; Periodic Safety Review of Nuclear Power Plants (Safety Guide)

• NS-G-2.11; A System for the Feedback of Experience from Events in Nuclear

Installations (Safety Guide)

• NS-G-2.12; Ageing Management for Nuclear Power Plants (Safety Guide)

• NS-G-2.13; Evaluation of Seismic Safety for Existing Nuclear Installations

(Safety Guide)

• NS-G-2.14; Conduct of Operations at Nuclear Power Plants (Safety Guide)

92

• NS-G-2.15; Severe Accident Management Programmes for Nuclear Power

Plants Safety Guide (Safety Guide)

• GS-R-1; Legal and Governmental Infrastructure for Nuclear, Radiation,

Radioactive Waste and Transport Safety (Safety Requirements)

• GS-R-2; Preparedness and Response for a Nuclear or Radiological Emergency

(Safety Requirements)

• GS-R-3; The Management System for Facilities and Activities (Safety

Requirements)

• GS-G-2.1; Arrangement for Preparedness for a Nuclear or Radiological

Emergency (Safety Guide)

• GS-G-3.1; Application of the Management System for Facilities and Activities

(Safety Guide)

• GS-G-3.5; The Management System for Nuclear Installations (Safety Guide)

• RS-G-1.1; Occupational Radiation Protection (Safety Guide)

• RS-G-1.2; Assessment of Occupational Exposure Due to Intakes of

Radionuclides (Safety Guide)

• RS-G-1.3; Assessment of Occupational Exposure Due to External Sources of

Radiation (Safety Guide)

• RS-G-1.8; Environmental and Source Monitoring for Purpose of Radiation

Protection (Safety Guide)

• WS-G-6.1; Storage of Radioactive Waste (Safety Guide)

• SSG-13; Chemistry Programme for Water Cooled Nuclear Power Plants

� INSAG, Safety Report Series

• INSAG-4; Safety Culture

• INSAG-10; Defence in Depth in Nuclear Safety

• INSAG-12; Basic Safety Principles for Nuclear Power Plants, 75-INSAG-3

Rev.1

• INSAG-13; Management of Operational Safety in Nuclear Power Plants

• INSAG-14; Safe Management of the Operating Lifetimes of Nuclear Power

Plants

• INSAG-15; Key Practical Issues In Strengthening Safety Culture

• INSAG-16; Maintaining Knowledge, Training and Infrastructure for Research

and Development in Nuclear Safety

93

• INSAG-17; Independence in Regulatory Decision Making

• INSAG-18; Managing Change in the Nuclear Industry: The Effects on Safety

• INSAG-19; Maintaining the Design Integrity of Nuclear Installations

Throughout Their Operating Life

• INSAG-20; Stakeholder Involvement in Nuclear Issues

• INSAG-23; Improving the International System for Operating Experience

Feedback

• Safety Report Series No.11; Developing Safety Culture in Nuclear Activities

Practical Suggestions to Assist Progress

• Safety Report Series No.21; Optimization of Radiation Protection in the

Control of Occupational Exposure

• Safety Report Series No.48; Development and Review of Plant Specific

Emergency Operating Procedures

� Other IAEA Publications

• IAEA Safety Glossary Terminology used in nuclear safety and radiation

protection 2007 Edition

• Services series No.12; OSART Guidelines

• EPR-EXERCISE-2005; Preparation, Conduct and Evaluation of Exercises to

Test Preparedness for a Nuclear or Radiological Emergency, (Updating IAEA-

TECDOC-953)

• EPR-METHOD-2003; Method for developing arrangements for response to a

nuclear or radiological emergency, (Updating IAEA-TECDOC-953)

• EPR-ENATOM-2002; Emergency Notification and Assistance Technical

Operations Manual

� International Labour Office publications on industrial safety

• ILO-OSH 2001; Guidelines on occupational safety and health management

systems (ILO guideline)

• Safety and health in construction (ILO code of practice)

• Safety in the use of chemicals at work (ILO code of practice)

94

TEAM COMPOSITION OF THE OSART MISSION

GEST Pierre - IAEA

IAEA

Years of nuclear experience: 32

Review area: Team Leader

HENDERSON Neil - IAEA

IAEA


Review area: Deputy Team Leader

JEANNIN Bernard – IAEA


Review area: MOA

BASRA Kirandeep Kaur – UK

Bradwell site


Review area: RP

BLADON Alan - UK

British Energy, UK


Review area: Operations

DEGUELDRE Didier – Belgium

Bel V, subsidiary of the Federal Agency for

Nuclear Control (FANC)


Review area: Emergency Planning and Preparedness

FRANZETTI Christophe – FRA

EDF


Review area: Operations II

HAAGE Monica -IAEA


Review area: Safety Culture

LYRSTEDT Fredrik – SWE

Ringhals AB


Review area: Maintenance

95

MALKHASYAN Hakob – ARM

WorleyParsons Nuclear Services


Review area: Technical Support

MARTINENKO Yuri– IAEA


Review area: Operating Experience

RENEV Alexander - EU

JRC-IE


Review area: Training and Qualification

SCHUNK Janos – HUN

Paks NPP

Years of nuclear experience:33

Review area: Chemistry

WATTS Germaine - CAN

New Brunswick Power Corporation


Review area: Safety Culture

OBSERVERS

VALAITHAM Mahesh – ZA

Koeberg Nuclear Power Station, ESKOM


Review area: Observer

LIU Hai Rong – CPR


Review area: Observer