Defence in depth

Defence in depth. The design process should ensure that multiple levels of protection are provided and the necessity of human intervention is minimized. 

Reactor faults can act rapidly, allowing no time for operator action should the protection fail. In these circumstances it is vital to have a number of lines of identically protecting systems (redundancy) to maintain safety. Defence in depth is provided. For example, containment of fission products is ensured by a combination of fuel integrity, cladding, pressure vessel integrity and containment structures. 

While there are various conceptual approaches to maintenance, the relevant activities may be divided into preventive and corrective maintenance. A considerable part of aU maintenance activity is performed while the plant is shut down however, maintenance may be planned and executed under power operation provided that adequate defence in depth is maintained. For definitions of different types of maintenance, see the Glossary. 

A comprehensive work planning and control system applying the defence in depth principle should be implemented so that work activities can be properly authorized, scheduled and carried out by either plant personnel or contractors, in accordance with appropriate procedures, and can be completed in a timely manner. The work planning system should maintain high availability and reliability of important plant SSCs. 

The fact that TMI didn t result in a public health catastrophe has to be ascribed to the Defence in Depth principle systematically adopted as Western safety practice. The concept provides multiple redundant and diverse barriers against radioactive releases, well beyond what could be thought strictly necessary. TMI showed that this principle offers protection against the unforeseen and the unknown possible events. 

Is the optimal combination of the course of actions chosen by the two young men who opened the door very dissimilar from the Defence in Depth concept, well established as a foundation block of the nuclear safety It seems not, and this seems to also be the conclusion of the chemical engineer who invented the story. 

It is true that the foresighted adoption of Defence in Depth provisions at TMI prevented any casualties. It can be recalled that only 666 GBq (18 Ci) of iodine were released to the environment, with a correspondingly minute virtual dose at the fence of 0.8 mSv. 

Whereas the dangers of the above example never materialized, the behaviour of the reactor pressure vessel during the Three Mile Island accident is exceptional. It withstood the outpouring of about twenty tons of molten core on its bottom, in conditions of highly deteriorated internal cooling. This behaviour indicated to the technical experts the presence of a powerful and up to then neglected barrier in the Defence in Depth, which is now utilized in a planned way as a potential asset. 

Luckily, the external radioactivity releases were negligible by virtue of the Defence in Depth incorporated in Western plants and in particular by the presence of the containment. As we know, the core was completely destroyed. 

The complete adoption of the Defence in Depth principle has to be noted in its more evolved version, which includes five superimposed levels of defenee, concisely summarized as follows good design, good control, adequate emergency systems, accident management (various levels of seriousness eonsidered), internal and external emergeney plans. 

Incidents with significant failure in safety provisions but with sufficient defence in depth remaining to cope with additional failures. These include events where the actual failures would be rated at level 1 but which reveal additional organizational inadequacies or safety culture deficiencies. 

USNRC s policy for implementing risk-informed regulation was expressed in the 1995 policy statement on the use of probabilistic risk assessment (PRA) methods in nuclear regulatory activities. The policy statement says The use of PRA technology should be increased in all regulatory matters to the extent supported by the state-of-the-art in PRA methods and data and in a manner that complements the NRC s deterministic approach and supports the NRC s traditional defence-in-depth philosophy. 

ARl 77 Implementation of Defence in Depth for next generation light water reactors. No. 986,... 

ARl78 Defence in Depth in nuclear safety. No. 10, 26 September 1996. 

Before fuel loading, an external emergency plan (EEP) must be operative as a part of the Defence in Depth (see Chapter 9). To this end, usually, a dedicated issue of the safety evaluation is prepared, containing the technical basis for the external emergency plan. 

The objective of the event-independent part of the Emergency Operating Procedures (EOPs) is to provide means to evaluate and restore the plant nuclear safety. The concept is based on the premise that radiation release to the environment can be minimised if the barriers to activity release are protected (barriers of defence in depth). In order to accomplish this goal, a set of functions has been defined which are critical from the plant nuclear safety point of view. These are the Critical Safety Functions. To be able to evaluate the status of these functions. Status Trees have been designed, one per CSF. Once the state of the CSF is evaluated, based on their state and the rules of priority one can designate a Function Restoration Guideline to be implemented for restoring CSF (see Appendix 3). 

Technical criteria are generally quantitative (probabilistic) and mostly on lower levels (subsidiary). They typically concern core damage, unacceptable release, and unacceptable health risks. In later years, some countries have defined separate criteria to address robustness in defence in depth, e.g., by having a separate criterion for reactor containment integrity. 

Defence in depth aspects are considered in the criteria by stating requirements for different safety functions. 

Requirements and concepts for the safe design of nuclear power plants are developed in Ref [1], in which PIEs are defined. PIEs can challenge any level of defence in depth and have to be considered in the design process. The PIEs to be considered will include internal hazards. PIEs are defined in appendix I of Ret [1]. 

According to the general principle of defence in depth, the following... 

In order of preference, the best design approach is to practically eliminate the PIE (i.e. to make P acceptably small) the next best approach is to separate SSCs from sources (i.e. to make P2 acceptably small) there is also the option of making the consequences acceptable (i.e. to make P3 acceptably small). However, to the extent possible, defence in depth should be maintained by ensuring that the second level of defence and, if necessary, the third level of defence are effective. It may also be necessary in some cases to use a combination of all three levels. 

Deterministic safety analysis (frequently referred to as accident analysis) is an important tool for confirming the adequacy and efficiency of provisions for the safety of nuclear power plants in accordance with the defence in depth concept. Owing to the close interrelation between accident analysis and safety, an analysis that lacks consistency, is incomplete or is of poor quahty is considered a safety issue for a given nuclear power plant. The development of IAEA guidance publications for accident analysis is thus an important step towards resolving this issue. 

---