Structure of the EOP package and general strategies

The previous phases have resulted in the definition of the overall scope of the EOP and the event coverage of that scope. This has been distributed between the scenario dependent and scenario independent set of EOPs. The next step is to further distribute the scope within each of these categories into more specific individual procedures. The most important item at this level is to ensure that all the pieces of the overall scope are properly covered. 

A detailed structure of procedures will be established by grouping them into logical and technically consistent entities (series of major actions) from the standpoint of plant operation. This will dictate the number of recovery procedures and their individual scope of coverage. Great care should be given to defining the links between the individual procedures. 

To ensure that exhaustive checking of the safety functions is addressed, all the safety functions and the possible challenges to them have to be identified and verified. This means that it is necessary to establish a complete, documented and explicit list of the safety functions that are applicable to the plant as well as the list of all possible challenges to any of these functions. The specific safety functions are the functions applied in the design intended to eventually protect the public by protecting the integrity of the successive barriers. Minimum barriers to be considered are  

For example, typical safety functions that are representative of the status of the barriers and can be applied in safety function restoration guidelines (FRGs) for PWR technology are  

Extreme recovery measures will usually be implemented only with increasing severity of the challenge. For example, if a safety function restoration measure could result in severe damage to important plant equipment (e.g. a primary coolant pump, a secondary system, etc.) this measure will only be taken when all other possible restoration measures have been tried and have failed. The actions that must be taken are strictly a matter of priority. The optimal recovery procedures would normally be written in such a way as to protect the integrity of plant systems and equipment. However, since plant systems and equipment have a lower priority than the reactor core and preventing the release of radioactivity they will be sacrificed before the latter are allowed to occur. 

---