REGDOC-2.3.2: Accident Management

Preface

This regulatory document is part of the CNSC's operating performance series of regulatory documents, which also covers the conduct of licensed activities. The full list of regulatory document series is included at the end of this document and can also be found on the CNSC's website.

REGDOC-2.3.2, Accident Management, sets out the requirements and guidance of the Canadian Nuclear Safety Commission (CNSC) for the development, implementation and validation of accident management programs for reactor facilities.

Accident management is a commitment to the defence-in-depth approach and is an important component in the licensee's overall capabilities to ensure the risks from nuclear reactors remain low. Defence in depth is applied to all organizational, behavioural, and design-related safety and security activities to ensure they are subject to overlapping provisions. It is important for licensees to implement and maintain operational procedures, guidelines and adequate capabilities to deal with abnormal situations and accidents, including severe accidents. This regulatory document specifies safety principles, high-level requirements and supporting guidelines that allow licensees to develop, implement, and evaluate an integrated accident management program, which includes components that address severe accident management.

Key principles and elements used in developing this document are consistent with International Atomic Energy Agency (IAEA) safety principles, guides and reports, such as the following:

• International Atomic Energy Agency (IAEA) Safety Fundamentals No. SF-1, IAEA Safety Standards for protection people and the environment - Fundamental Safety Principles [1]
• IAEA Safety Standards Series No. NS-G-2.15, STI/PUB/1376, Severe Accident Management Programmes for Nuclear Power Plants - Safety Guide [2]
• IAEA Safety Reports Series No. 32, STI/PUB/1167, Implementation of Accident Management Programmes in Nuclear Power Plants [3]
• IAEA Services Series No. 9, IAEA-SVS-09, Guidelines for the Review of Accident Management Programmes in Nuclear Power Plants [4]

This document reflects lessons learned from the Fukushima nuclear event of March 2011, and addresses findings from the CNSC Fukushima Task Force Report. This document supersedes REGDOC-2.3.2, Severe Accident Management Programs for Nuclear Reactors, published in September 2013.

REGDOC-2.3.2 is intended to form part of the licensing basis for a regulated facility or activity within the scope of the document. It is intended for inclusion in licences as either part of the conditions and safety and control measures in a licence, or as part of the safety and control measures to be described in a licence application and the documents needed to support that application.

For proposed new facilities: This document will be used to assess new licence applications for reactor facilities.

Guidance contained in this document exists to inform the applicant, to elaborate further on requirements or to provide direction to licensees and applicants on how to meet requirements. It also provides more information about how CNSC staff evaluate specific problems or data during their review of licence applications. Licensees are expected to review and consider guidance; should they choose not to follow it, they should explain how their chosen alternate approach meets regulatory requirements.

For existing facilities: The requirements contained in this document do not apply unless they have been included, in whole or in part, in the licence or licensing basis.

A graded approach, commensurate with risk, may be defined and used when applying the requirements and guidance contained in this regulatory document. The use of a graded approach is not a relaxation of requirements. With a graded approach, the application of requirements is commensurate with the risks and particular characteristics of the facility or activity.

An applicant or licensee may put forward a case to demonstrate that the intent of a requirement is addressed by other means and demonstrated with supportable evidence.

The requirements and guidance in this document are consistent with modern national and international practices addressing issues and elements that control and enhance nuclear safety. In particular, they establish a modern, risk-informed approach to the categorization of accidents - one that considers a full spectrum of possible events, including events of greatest consequence to the public.

1. Introduction

1.1 Purpose

REGDOC-2.3.2, Accident Management, sets out the requirements and guidance of the Canadian Nuclear Safety Commission (CNSC) for the development, implementation and validation of integrated accident management programs (IAMPs) for reactor facilities.

1.2 Scope

IAMP refers to all arrangements needed to manage any accident affecting a reactor facility. It addresses accidents resulting from all kinds of initiators, originating from technical or human induced failures or natural or man-made hazards. Initiators affecting any part of the facility, in particular the reactors and spent fuel pools, including possible combinations of affected installations are considered. IAMPs also address all operating states, both in operation and shutdown. IAMPs make use of all available infrastructures, equipment, procedures and guidelines, and human and organizational resources.

This regulatory document stipulates regulatory requirements and supporting guidance for licensees to develop, implement and evaluate IAMPs for nuclear reactor facilities, excluding reactors with a thermal output capacity less than 10 MW thermal.

The IAMP shall be commensurate with the relative risk posed by the licensed activities of a reactor facility, which may be influenced by the reactor thermal power and available protective systems. For some reactors, it may be possible to show that certain elements of an IAMP are unnecessary or do not apply. It is the responsibility of an applicant or a licensee to demonstrate that accident management provisions are adequate to limit the risk posed by accidents, including severe accidents.

The document specifies IAMP requirements and guidance that are to be used to develop and validate necessary items such as emergency operating procedures (EOP), severe accident management guidelines (SAMG), and to demonstrate the licensees' capabilities to manage the anticipated operational occurrences (AOO), design-basis accidents (DBA) and beyond-design- basis accidents (BDBA), including design extension conditions (DEC) and severe accidents.

Accident management is an important component in licensees' overall capabilities to ensure the risks associated with operating nuclear reactors remain low. Licensees need to be able to demonstrate they have appropriate programs in place to manage deviations from normal operation, up to severe accidents. The definition of "accident management" given in this regulatory document is in line with international practice, and has evolved from the existing IAEA definition and adapted to cover both DBAs and BDBAs.

This document focuses on the accident management aspects and thus does not include requirements and guidance for emergency preparedness and response, as those are given in REGDOC-2.10.1, Nuclear Emergency Preparedness and Response [5].

1.3 Relevant legislation

Sections of the Nuclear Safety and Control Act (NSCA) and its regulations relevant to this document include:

• subsection 24(4) of the NSCA, which stipulates that "no licence may be issued, renewed, amended or replaced unless, in the opinion of the Commission, the applicant
  • (a) is qualified to carry on the activity that the licence will authorize the licensee to carry on; and
  • (b) will, in carrying on that activity, make adequate provision for the protection of the environment, the health and safety of persons and the maintenance of national security and measures required to implement international obligations to which Canada has agreed."
• paragraphs 12(1)(a) to 12(1)(f) of the General Nuclear Safety and Control Regulations, which stipulate that "every licensee shall:
  • (a) ensure the presence of a sufficient number of qualified workers to carry on the licensed activity safely and in accordance with the NSCA, the regulations made under the NSCA and the licence;
  • (b) train the workers to carry on the licensed activity in accordance with the NSCA, the regulations made under the NSCA and the licence;
  • (c) take all reasonable precautions to protect the environment and the health and safety of persons and to maintain security of nuclear facilities and of nuclear substances;
  • (d) provide the devices required by the NSCA, the regulations made under the NSCA and the licence and maintain them within the manufacturer's specifications;
  • (e) require that every person at the site of the licensed activity use equipment, devices, clothing and procedures in accordance with the NSCA, the regulations made under the NSCA and the licence;
  • (f) take all reasonable precautions to control the release of radioactive nuclear substances or hazardous substances within the site of the licensed activity and into the environment as a result of the licensed activity."
• section 5 of the Class I Nuclear Facilities Regulations, which stipulates that "an application for a licence to construct a Class I nuclear facility shall contain the following information in addition to the information required by section 3:
  • (d) a description of the structures proposed to be built as part of the nuclear facility, including their design and their design characteristics;
  • (e) a description of the systems and equipment proposed to be installed at the nuclear facility, including their design and their design operating conditions;
  • (i) the effects on the environment and the health and safety of persons that may result from the construction, operation and decommissioning of the nuclear facility, and the measures that will be taken to prevent or mitigate those effects."
• section 6 of the Class I Nuclear Facilities Regulations, which stipulates that "an application for a licence to operate a Class I nuclear facility shall contain, in addition to other information:
  • (d) the proposed measures, policies, methods and procedures for operating and maintaining the nuclear facility;
  • (g) the proposed commissioning program for the systems and equipment that will be used at the nuclear facility;
  • (h) the effects on the environment and the health and safety of persons that may result from the operation and decommissioning of the nuclear facility, and the measures that will be taken to prevent or mitigate those effects;
  • (i) the proposed location of points of release, the proposed maximum quantities and concentrations, and the anticipated volume and flow rate of releases of nuclear substances and hazardous substances into the environment, including their physical, chemical and radiological characteristics;
  • (j) the proposed measures to control releases of nuclear substances and hazardous substances into the environment;
  • (k) the proposed measures to prevent or mitigate the effects of accidental releases of nuclear substances and hazardous substances on the environment, the health and safety of persons and the maintenance of national security, including measures to
    1. assist off-site authorities in planning and preparing to limit the effects of an accidental release,
    2. notify off-site authorities of an accidental release or the imminence of an accidental release,
    3. report information to off-site authorities during and after an accidental release,
    4. assist off-site authorities in dealing with the effects of an accidental release, and
    5. test the implementation of the measures to prevent or mitigate the effects of an accidental release."
• section 7 of the Class I Nuclear Facilities Regulations, which stipulates that "an application for a licence to decommission a Class I nuclear facility shall contain the following information in addition to the information required by section 3:
  • (i) the proposed measures to prevent or mitigate the effects of accidental releases of nuclear substances and hazardous substances on the environment, the health and safety of persons and the maintenance of national security, including an emergency response plan."

1.4 National and international documents

REGDOC-2.3.2, Accident Management, represents the CNSC's adaptation of the principles and guidelines set forth in national and international documents, including the following:

• International Atomic Energy Agency (IAEA) Safety Fundamentals No. SF-1, Fundamental Safety Principles [1]
• IAEA Specific Safety Requirements No. SSR-2/2, Safety of Nuclear Power Plants: Commissioning and Operation (Requirement 19: Accident management programme), [6]
• IAEA Safety Standards Series No. NS-G-2.15, STI/PUB/1376, Severe Accident Management Programmes for Nuclear Power Plants - Safety Guide [2]
• IAEA Safety Guide No. NS-G-2.15, Severe Accident Management Programmes for Nuclear Power Plants [7]
• IAEA Safety Reports Series No. 32, Implementation of Accident Management Programmes in Nuclear Power Plants [3]
• IAEA INSAG-10, Defence in Depth in Nuclear Safety [8]
• IAEA INSAG-12, 75-INSAG-3 Rev. 1, Basic Safety Principles for Nuclear Power Plants [9]
• IAEA TECDOC-1440, Overview of Training Methodology for Accident Management at Nuclear Power Plants [10]
• IAEA Safety Services Series No. 9, IAEA-SVS-09, Guidelines for the Review of Accident Management Programmes in Nuclear Power Plants [4]
• CSA Group N286, Management System Requirements for Nuclear Facilities [11]

2. Accident Management and Its Links With Emergency Preparedness and the Principle of Defence in Depth

Emergency management includes the prevention and mitigation, preparedness, response and recovery of nuclear emergencies.

Prevention of nuclear emergencies at Canadian nuclear facilities is the responsibility of the licensees. Through the authority of the Nuclear Safety and Control Act, the CNSC regulates the Canadian nuclear industry in order to prevent unreasonable risk to the environment, the health and safety of persons, and national security. Mitigation of nuclear emergencies aims at ensuring that equipment, such as hydrogen recombiners, or procedures, such as emergency operating procedures, are put in place before a nuclear emergency to reduce the potential magnitude or impact of the hazard. REGDOC 2.3.2 addresses this component of emergency management.

Preparedness relates to actions taken before a nuclear emergency in order to be ready to respond and manage its consequences, and includes the development of response procedures and plans, training workers, maintaining emergency facilities, exercises and fostering public awareness.

Response refers to those actions taken during a nuclear emergency, both onsite and offsite, to reduce the magnitude of the hazard and manage its consequences on health, safety and the environment. Response actions include protecting workers, supporting accident management activities, emergency public communication, emergency medical assistance, and shelter-in-place or evacuation.

Recovery includes the short-term and long-term actions taken both onsite and offsite in order to restore to an acceptable level both the organizations involved in and the communities affected by the nuclear emergency. The level of restoration would typically be determined by the responsible authorities, in consultation with the stakeholders affected by the nuclear emergency.

Further information on nuclear preparedness, response and recovery can be found in REGDOC‑2.10.1, Nuclear Emergency Preparedness and Response.

The fundamental premise underlying accident management is that the organization operating a nuclear reactor must be able to respond to any credible accident in order to:

• prevent the escalation of the accident
• mitigate the consequences of the accident
• achieve a long-term safe stable state after the accident

To achieve the above goals, an integrated accident management program (IAMP) is put in place. An IAMP is a structured framework that comprises a cohesive set of plans and arrangements undertaken to ensure that, if an accident occurs:

• the safety systems and the available structures, systems and components (SSCs) can be used to control the reactivity, cool the fuel and contain the radioactive materials such that damage to the reactor and harm to workers, public, and environment is prevented or mitigated
• the personnel with responsibilities for accident management are adequately prepared to utilize the available resources, procedures, and guidelines to perform effective accident management actions and, when deemed necessary, to call for and interact with the emergency response teams

AOOs and DBAs are included in the IAMP, to ensure that they do not progress to more challenging accidents and that their consequences are mitigated to remain within established limits. Essential features for mitigating AOOs and DBAs already exist in operating reactors; they include:

• design provisions allowing automatic actuation of controls and/or safety systems which terminate the vast majority of events
• EOPs to respond to events within the design basis
• the associated programs for equipment maintenance, human performance, training, and shift complement

A plant-specific IAMP builds on the existing components/documents, and integrates all available provisions for accident management.

Thus, accident management provides capability to respond to an accident within the reactor facility. It is important to recognize that accident management interfaces closely but is distinct from emergency preparedness, which provides emergency responses to mitigate the onsite and offsite impacts of an accident to workers and the public.

Both accident management and emergency preparedness form part of the defence-in-depth provisions. In particular, accident management contributes to the levels 3 and 4 of defence-in-depth, while emergency preparedness corresponds to level 5 of defence-in-depth. Defense-in- depth level 3 is associated with the control of an accident and rule based procedures are, in general, used. Level 4 of defense-in-depth refers to BDBAs including severe accidents where efforts are focused on managing the accident and operators may need to move beyond the use of EOPs to guidelines/procedures with considerable judgment required.

Figure 1 illustrates links between the accident management, emergency preparedness and defence in depth. IAMP focuses on preventing an event that has already occurred from escalating and minimizing its radiological releases through use of various physical and procedural provisions. The specific provisions may vary depending on the accident (which may be a design-basis accident or beyond-design-basis accident, including a severe accident). The emergency preparedness program (which is described in REGDOC-2.10.1 [5]) specifies how the nuclear facilities and organizations concerned are prepared for and plan to respond to an emergency including a nuclear or radiological emergency, both onsite and offsite, in order to protect workers and the public.

It is recognized that response to accidents of different severity would require different actions. Careful consideration of transition criteria is essential in ensuring a seamless activation of appropriate response.

Appendix A further illustrates various essential elements of an IAMP used to respond to AOO, DBA and BDBA.

3. Requirements for an Integrated Accident Management Program

This section specifies the requirements for an IAMP. The first subsection sets the goals of accident management. The second subsection gives the general or high-level requirements. Then, specific requirements covering various elements for an IAMP are grouped under the requirements for equipment, procedures, and organizational and human aspects.

3.1 Goals of accident management

In accordance with the NSCA and associated regulations, the overarching nuclear safety objective is to protect individuals, society, and the environment from harm by establishing and maintaining effective defences against radiological hazards and hazardous substances. When an accident occurs in a nuclear reactor facility, the above objective is achieved by fulfilling the following fundamental safety functions:

• control of reactivity
• removal of heat from the fuel
• confinement of radioactive material
• shielding against radiation
• control of operational discharges and hazards substances, as well as limitation of accidental releases
• monitoring of safety-critical parameters to guide operator actions

The specific goals of a comprehensive and effective IAMP are to:

• terminate the progression of the accident as early as possible
• prevent an accident from leading to severe consequences
• maintain the integrity of fission product barriers including containment and spent fuel storage
• minimize the release of radioactive materials into the environment
• achieve a long-term safe stable state of the reactor core or spent fuel storage

To fulfill these high-level requirements, the licensee shall meet all the requirements specified in this section and consider the guidance given in sections 4, 5, 6 and 7.

3.2 General requirements

In support of the development, implementation, and validation of an IAMP, licensees shall:

1. develop and implement a reactor-specific IAMP, to ensure that adequate capabilities are maintained to cope with scenarios ranging from AOOs to severe accidents
2. address, to the extent practicable, the initiating events that have the potential to cause extensive infrastructure damage such that offsite resources are not readily available
3. ensure that the IAMP covers all modes of reactor operation including the shutdown state; events that could cause damage to the fuel in a reactor core, in transport to storage, or stored in a spent fuel pool shall be considered
4. identify and document challenges to safety functions and physical barriers and perform safety analysis
5. identify and confirm reactor site capabilities to cope with the challenges to safety functions in performing accident management actions
6. conduct periodic reviews, drills and integrated exercises to confirm or improve the effectiveness of the established IAMP
7. ensure that the IAMP interfaces with the emergency preparedness program
8. make accident management provisions, including:
   1. developing criteria for use in determining what procedures to use
   2. demonstrating the capability to take actions to protect and inform personnel at the scene
   3. identifying the roles and responsibilities of the personnel responsible for accident management
   4. identifying and evaluating reactor systems and features suitable for use during accident management
   5. providing adequate training to personnel involved in managing an accident

3.3 Equipment and instrumentation requirements

Licensees shall:

1. provide adequate capabilities to preserve the physical barriers for release of radioactivity and to ensure that means are available to:
   1. control challenges posed by DBAs within appropriate limits
   2. mitigate consequences of BDBAs
   3. reduce radiation risks from possible releases of radioactive materials by carrying out accident management actions
2. address the information needs for accident management, by providing adequate instrumentation that is capable of:
   1. diagnosing that an accident, including a severe accident, is occurring or has occurred
   2. obtaining information, as necessary, on key parameters (which may include neutron flux, temperatures, pressures, flows, combustible gas concentrations, and radiation levels) to assess accident conditions and progression
   3. addressing continuously the state of essential safety functions, including reactor core monitoring, reactivity control, fuel cooling, hydrogen control, and containment
   4. confirming the effectiveness of the accident management actions
3. demonstrate with reasonable assurance that the equipment and instruments used in severe accident management will survive and perform their intended functions in the ensuing harsh conditions

3.4 Requirements for procedures and guidelines

Licensees shall:

1. develop, verify and validate accident management procedures and guidelines, including EOPs and SAMGs
2. account for factors specific to the reactor design in the development of SAMGs for severe accidents
3. consider that information available to the operating staff or emergency groups may be incomplete and characterized by significant uncertainties
4. include the following in SAMGs:
   1. the parameters and their thresholds that define the transition from EOPs to SAMGs
   2. key parameters to diagnose the state of various reactor and reactor systems throughout the progression of the accident
   3. actions to be taken to counter the damage mechanisms that would potentially challenge the integrity of the containment, irrespective of predicted frequencies of occurrence for those damage mechanisms
   4. indicators that can be used to judge the success of the implemented actions
   5. the communication protocol to be followed during implementation of accident management
   6. guidance on dealing with multi-unit damage, uncovered fuel in spent fuel pools, releases of radioactive materials and hydrogen into buildings adjacent to the containment
5. ensure the EOPs and SAMGs consider sufficiently long time periods to initiate and complete required actions, taking into account the human and organizational performance and the possibility of prolonged time required to restore power due to multi-unit damage or large-scale external disturbances
6. include necessary steps into guidelines for events where supplementary equipment (also called emergency mitigating equipment (EME)) and where external supports are required to mitigate the accident consequences
7. provide for transition from the accident management activities to accident recovery

3.5 Requirements for human and organizational performance

Licensees shall:

1. establish the organizational infrastructure necessary for implementing IAMPs, which covers aspects such as authority, organization, co-ordination of the response, plans and procedures, training, drills and exercises, human factors, and quality assurance programs.
2. ensure that personnel involved in managing an accident have the necessary information, procedures, and human and materiel resources to carry out effective accident management and mitigation actions
3. clearly define the roles, responsibilities and authorities for the personnel involved in accident management and ensure coordination among different organizations
4. ensure that the IAMP contains provisions for the setup of emergency response facilities
5. establish and implement initial and continuing training programs for all personnel who are required to respond to accidents in accordance with the principles of a systematic approach to training
6. make sufficient provisions to ensure habitability of facilities required to support human performance during the implementation of the IAMP or provide alternate habitable facilities

4. Guidance for Developing an Integrated Accident Management Program

To satisfy the requirements specified in section 3 pertinent to development of an IAMP, the licensee should consider the following guidance.

4.1 General considerations

A structured top-down approach (as illustrated in Appendix A) should be used for developing an IAMP. At the top level, the objectives of accident management should be defined according to the level of defence and associated goals that are given in section 3. Challenges to safety functions and physical barriers, together with the associated damage mechanisms and conditions, should be identified, which is referred to as identification of challenges. For each of the identified challenges, suitable and effective measures or provisions should be derived, described, and referenced or documented in procedures or guidelines, and used for training the personnel responsible for executing the measures for managing such an accident, should it occur.

The staff responsible for developing the IAMP should have a sufficient level of training and experience regarding accident management in a nuclear facility.

4.2 Establishment of an integrated accident management program

For setting out an IAMP, the following steps should be taken:

• identification of challenges to the reactor safety functions
• identification of reactor capabilities
• development of strategies and measures to cope with the identified challenges
• performance of supporting analyses to evaluate and confirm the adequacy of the strategies and measures developed
• development of procedures and guidelines
• consideration of other elements such as equipment and instrumentation provisions, organizational responsibilities, and communication interfaces

While following the above major steps for establishing an IAMP, the licensee should also consider the following important elements as described in section 4.3:

• equipment provisions
• role of instrumentation
• organizational responsibilities
• on-site communication interfaces and external interfaces, if necessary

Licensees should also consult REGDOC-2.12.1, High-Security Sites: Nuclear Response Force, and G-274, Security Programs for Category I or II Nuclear Material or Certain Nuclear Facilities for further information regarding security aspects of accident management.

4.2.1 Identification of challenges to reactor safety functions

The development of an IAMP should consider postulated initiating events and accident sequences that could be caused by credible failures or malfunctions of SSCs, human errors, common-cause internal and external hazards, and combinations thereof.

Challenges that are not considered in the reactor design envelope, but could potentially threaten the integrity of the containment should be practically eliminated; that is, the existing process systems, safety and control systems, complementary design features, available SSCs, and procedural provisions should make the occurrence of these challenges practically impossible. For example, the installed rupture disks or relief valves that provide reliable and sufficient depressurization capability for a reactor core or vessel can eliminate the high-pressure corium ejection phenomenon and thus the possibility of direct containment heating by corium.

Among credible events, a selected set of accident sequences that can be used to represent the consequences of each group of accident sequences should be used to obtain insights into the behaviour of the accident and to identify challenges to reactor safety functions. This requires investigating how specific accidents will challenge safety functions and - if safety functions are lost and not restored in due time - how the accident progresses, how the fission product barriers are breached, how long it will take to reach each stage of the accident, and how severe each accident stage will be.

In the domain of beyond-design-basis accidents (BDBA), insights into the response of the reactor to BDBAs, including severe accidents, should be obtained. A technical basis for SAM should document the understanding of severe accident phenomena and reactor-specific physical processes, such as core degradation, in-vessel core debris retention, ex-vessel corium spreading and coolability, molten fuel coolant interaction, molten core concrete interaction, and all known containment challenge mechanisms. The technical basis should also include severe accident phenomena in spent fuel bays and multi-unit distress. The technical basis should be updated as necessary to reflect the state-of-the-art knowledge and experimental data obtained from applicable severe accident research programs and lessons learned from the reactors that have experienced severe core damage. The updated knowledge and data should be used to evaluate the reactor ability to cope with accidents and to deduce suitable accident management strategies, provisions, procedures, and guidelines.

Reactor-specific beyond-design-basis initiating events, such as events triggered by extreme external hazards (e.g., earthquakes, flooding, and extreme weather conditions), should also be considered to increase the reactor coping capability. The aim is to ensure that a set of sufficient, supplementary onsite equipment and consumables (e.g., fuel and water inventories) are identified, obtained, protected and stored onsite or offsite. These can be used to maintain or restore the cooling of the core, the containment, and the spent fuel pool following a beyond-design-basis initiating event. After the consumables are used up, offsite resources should be obtained to sustain those cooling functions indefinitely.

Accident management should consider that some beyond-design-basis initiating events may result in similar challenges to all units on the site.

Challenges for severe accidents and beyond-design-basis initiating events may be identified using a targeted assessment of safety margins against a set of postulated extreme conditions that cause a consequential loss of safety functions leading to severe core damage. Such a reactor-specific "stress test" can be used to determine the time of autonomy of reactor-critical safety functions, any potential weak points, and any cliff-edge effects for a given set of the considered extreme situations. This type of exercise may be used to identify the potential for safety improvements and to provide input to the development of an IAMP.

4.2.2 Identification of reactor capabilities

Similar to identification of challenges, all reactor capabilities to fulfill the safety functions and to preserve fission product barriers during DBAs or BDBAs should be investigated in terms of capabilities of both SSCs and personnel. Reactor capabilities to cope with BDBAs by the available SSCs including the complementary design features should be identified, including the use of non-dedicated systems, external water sources, temporary connections (hoses, mobile or portable equipment), and offsite hardware and personnel resources. Considerations should also be given to whether failed systems can be restored to service. In addition, an assessment should be made of how operator actions are carried out to mitigate accident consequences.

Multiple diverse SAM measures should be provided for significant challenges to containment integrity. Consideration should be given to both the benefit and potential negative impact of using portable or supplementary equipment to cope with beyond-design-basis initiating events.

Relevant information including lessons learned from past nuclear accidents as well as data from experimental activities should be considered during the identification of reactor capabilities.

4.2.3 Development of strategies and measures

To ensure that the accident management objectives are achieved, a set of strategies for severe accident prevention and accident mitigation should be developed on the basis of the understanding of accident phenomena and reactor-specific accidents, as well as the considerations of the identified reactor challenges and capabilities.

Preventive strategies are needed to preserve safety functions that are important to prevent core damage such as maintaining core cooling and containment integrity. Mitigative strategies are needed to terminate the progression of core damage once it has started, minimize the radiological consequences, and achieve a long-term safe stable state.

Reactor damage states, such as damaged fuel, core uncovered and damaged, core debris uncovered leading to failure of the reactor vessel, and movement of the core debris outside the reactor vessel, should be identified based on the reactor parameters monitored and considered in the development of accident management strategies.

Suitable strategies that cover each reactor damage state should be developed and prioritized, taking into consideration the evolution of the accident (i.e., the time window for each reactor-specific damage state) and both positive and negative effects. The possibly large uncertainties in identifying such a time window should be taken into account.

For each of the strategies developed, all suitable measures or actions should be identified and evaluated, taking into account the effects of accident conditions on equipment, instrumentation, and the personnel who perform the actions. Effectiveness of the most suitable or preferable measures for each reactor damage state should be assessed and documented in detail.

The licensee should identify practical preventive and mitigation actions to achieve the accident management objectives. Generally, accident management actions should include:

• establishment and maintenance of reactivity control
• assurance of availability of heat sink for heat generated in the reactor core
• depressurization of the reactor coolant system and steam generators
• maintenance of coolant inventory in the primary heat transport system
• control of pressure and water inventory in steam generators
• control of pressure and water inventory inside the calandria or reactor vessel
• control of pressure and water inventory outside the calandria or reactor vessel
• assurance of containment isolation
• control of the containment pressure and temperature
• control of the concentration of hydrogen and other flammable gases
• prevention of unfiltered releases of radioactive products

To increase the reactor coping capability against beyond-design-basis initiating events, suitable strategies should be established; for example, use of the installed SSCs for the initial accident management phase, dedicated systems or supplementary equipment stored onsite or offsite for the transition phase during which the installed SSCs are incapacitated, and offsite equipment and resources to maintain or restore fuel and containment cooling functions indefinitely.

4.2.4 Supporting analyses

Safety analysis to support an IAMP can be largely based on the existing analysis (e.g., documented in safety reports or probabilistic safety assessment [PSA] documents). Additional analysis, if required, should be performed specifically to address accident management issues.

Safety analysis should be used to assist in developing an IAMP by:

• formulating the technical basis for identification of reactor challenges and capabilities and development of strategies, measures, procedures and guidelines
• demonstrating the acceptability of the identified solutions to support the selected strategies, measures, procedures and guidelines against the established criteria
• determining the reference source terms and accident conditions for environmental qualification of equipment for DBAs and survivability/operability assessments of equipment for BDBAs, including severe accidents

Safety analysis performed to support SAM should use the best-estimate approach. Uncertainties in the analytical prediction of challenges to fission product barriers should be taken into account if the level of knowledge of important severe accident phenomena and physical processes is low and if the associated supporting experimental data are insufficient.

Necessary computational aids should be identified and developed to assist in the overall success of accident management activities performed by the response organization prior to an actual event. These computational aids are typically obtained using simplified assumptions and are often presented graphically.

The results of deterministic severe accident analysis should assist the licensee to:

• specify the criteria that would indicate the onset of severe core damage
• identify the symptoms (i.e., parameters and their values) by which reactor personnel may determine the reactor core condition and state of protective barriers
• identify the challenges to fission product boundaries in different reactor states, including shutdown states
• evaluate the timing of such challenges to improve the potential for successful human intervention
• identify the reactor systems and materiel resources that may be used for SAM purposes
• assess that SAM actions would be effective to counter challenges to protective barriers
• evaluate performance of equipment and instrumentation under accident conditions
• develop and validate computational aids for SAM

For severe accidents, the results of PSA should assist the licensee to:

• verify that SAM would be effective for representative severe accident sequences, including multi-unit events, events triggered by natural and human-induced external hazards, and events involving an extended loss of all AC power
• provide a basis for assessing safety benefits of potential design enhancement options
• identify accident scenarios for personnel training and drill purposes

The credited human actions in preparation of the IAMP should be supported with adequate analyses. Considerations should be given to:

• the instrumentation to provide clear and unambiguous indication of the need to take action
• allowing sufficient time for the operator to detect and diagnose the event, and carry out the required actions
• environmental conditions that do not prevent safe completion of the operator action
• the required training

4.2.5 Development of procedures and guidelines

Procedures and guidelines to implement the strategies and measures for accident management should be developed and described in documents such as EOPs and SAMGs, or equivalent documents (see the requirements specified in section 3.4). If EOPs and SAMGs already exist, the IAMP can be built using these existing elements. Any new information on reactor site configuration, changes in hazards, and knowledge gained should be considered, and if appropriate procedures and guidelines should be updated accordingly.

The EOPs should contain a set of information, instructions and actions designed to prevent the escalation of an accident, mitigate its consequences and bring the reactor to a safe and stable state.

The SAMGs should contain a set of information, instructions and actions designed to mitigate the consequences of a severe accident according to the chosen strategies. Uncertainties may exist both in the reactor status and in the outcome of a selected action. Therefore, SAMGs should propose a range of possible actions and allow for additional evaluation and alternative actions.

SAMGs should also address various positive and negative consequences of proposed actions, including the use of equipment, limitations of the equipment, cautions and benefits.

The procedures and guidelines should be verified and validated. This should include the usability of the procedures and guidelines (see section 5.2). Clear criteria for EOP to SAMG transition should be defined.

Adequate guidance should be provided in the design of the IAMP to ensure that its event and symptom-based EOP components, or equivalent, are appropriately coordinated among the responsible personnel and that the symptom-based approach is invoked when it is required.

Measures, including providing guidelines and training, should be defined to support staff decision-making for situations where an event has progressed to a stage for which procedures have not been defined.

EOPs and SAMGs should cover events with multi-unit damage, potential damage to the fuel in spent fuel pools, releases of radioactive materials and hydrogen into buildings adjacent to the containment, and run-off of contaminated water to the environment.

The time period that EOPs or SAMGs assume to initiate and complete required actions should reflect potential damage to the reactor. For example, a SAMG may specify a time period required to hook up alternative power and water sources. For external events, the extent of reactor damage and disturbances from outside or at the grid should be taken into account to prolong this time period. Having a diesel back on line may take a whole day or even longer, much more than the time that is assumed sufficient for an intact site area without large disturbances from outside.

For beyond-design-basis initiating events, the reactor may require supplementary equipment stored onsite or offsite and external support to mitigate the accident consequences. These necessary measures should be specified in guidelines for coping with these events.

4.3 Other considerations

Additional important elements that should be considered in the development of an IAMP include equipment and instrumentation, organizational responsibilities, and communication interfaces.

4.3.1 Equipment provisions

Reactors should be equipped with hardware provisions (which may include supplementary onsite and offsite equipment) to fulfill the fundamental safety functions (i.e., control of reactivity, removal of heat from the fuel, confinement of radioactive material) as far as reasonable for all accidents considered in the IAMP, including severe accidents. Dedicated systems and complementary design features should be provided to practically eliminate some severe accident phenomena such as core melt at high pressures and hydrogen detonation. All complementary design features and available water sources for removal of decay heat from damaged reactor fuel should be identified in advance and put in place for managing severe accidents, particularly for maintaining the cooling of the core debris and the integrity of the containment.

Suitable analysis tools and methods should be used, in conjunction with the existing risk (e.g., based on the identified reactor challenges and capabilities), to aid in decision-making regarding equipment and instrumentation provisions or upgrades for accident management.

For the most serious BDBA challenges, such as an extended loss of heat sinks, buildup of a diverse and flexible mitigation capability should be considered. For example, portable or supplementary equipment can provide multiple means of obtaining power and water to support key safety functions for all reactors at a site.

BDBAs and severe accidents potentially create harsh environments with high temperature, high pressure, high radiation level, and high concentration of combustible gases. These environmental conditions, which could well exceed those of DBAs used for equipment qualification, present additional challenges to the equipment. The licensee should perform equipment survivability assessments to provide reasonable assurance that equipment used in SAM is available at the time it is called upon to perform.

Survivability of the equipment that could be used in SAM should be evaluated through a systematic review and assessment of equipment functions and conditions based on the available knowledge and data, such as from equipment environmental qualification for DBA, severe accident testing and analysis, and engineering judgment. The following steps should be taken:

• identification of accident management actions used to mitigate severe accidents
• definition of fuel and core damage stage and time period for each accident management action
• identification of equipment used to perform each of the actions
• determination of the bounding environmental conditions to the equipment within each time period
• demonstration that the equipment will survive to perform its function

The habitability of the facilities used in accident management (such as the main control room, the secondary control room, and the emergency response facilities, including a technical support centre)  should be assessed and assured, taking into account the environmental conditions (e.g., radiological conditions and other conditions related to lighting, ventilation, temperature and communication) within and surrounding the facilities during an accident. Where necessary, alternate habitable facilities should be provided.

4.3.2 Role of instrumentation

Adequate instrumentation should be available at each stage of an accident for the monitoring and diagnosis of reactor conditions and for assisting in accident evaluation, accident management decision-making, and action execution.

The reactor parameters used in each stage of accident management should be checked and evaluated for their reliability. The preferred method to obtain the necessary information is to use the instrumentation that is qualified for the expected environmental conditions. The effect of environmental conditions on the instrument reading should be estimated and taken into account to produce the procedures and guidelines. Any key instrumentation reading from a non-qualified instrument that is used to diagnose reactor conditions for SAM should have an alternate method, (possibly including computational aids) to compare the reading. Where the risks associated with faulty readings are high under local environmental conditions, consideration should be given to upgrading or replacing the instruments. For scenarios where the required parameters are missing or their measurements are unreliable, the need for development of computational aids to obtain information should be identified, and appropriate computational aids developed in advance.

The guidelines for equipment survivability specified in section 4.3.1 for severe accident conditions also apply to reactor instrumentation. A list of instrumentation for each stage of the severe accident should be established. Reasonable assurance should be provided that the instrumentation used to monitor severe accident progression and facilitate accident management actions is available. Harsh environmental conditions, including the effects of hydrogen burn within the containment on cables and electrical containment penetrations, should be also taken into account.

Given that during a severe accident the total information flow may be overwhelming and that some of the indications may be contradictory due to failed equipment and instrumentation, the licensee should consider using diagnostic and support tools to help with decision-making for accident management (e.g., computational aids as discussed in section 4.2.4).

4.3.3 Organizational responsibilities

An IAMP should clearly define and document the roles and responsibilities at each stage of an accident, including:

• evaluation and recommendation ("evaluators")
• lines of authority ("decision makers")
• implementation of the actions ("implementers")
• transfer of responsibilities and decision-making authority
• interfaces with other organizations and authorities

The duties of the "evaluators" are to assess the reactor conditions, identify potential actions, evaluate the potential impacts of these actions, and recommend actions to be taken. During the execution of EOPs, both the evaluators and implementers who carry out the approved actions may come from the main control room and field personnel.

For SAM, the technical advisory team at the technical support centre should perform evaluations and recommend recovery actions to the decision-making authority. The control room staff should provide input to the evaluations of the technical support centre on the basis of their knowledge of reactor equipment and instrumentation, and their other special skills from their training.

The technical support centre personnel should have a good understanding of the underlying severe accident phenomena and reactor-specific accident progression stages. They should have a detailed knowledge of the EOPs and the SAMGs. The team of the technical support centre should communicate extensively with the control room staff.

Lines of authority should be clearly defined at each stage of the accident. Where evaluation responsibilities and decision-making authority are transferred from the control room staff to the technical support centre and a higher level of authority, the transition should be made at some specific point in time that poses no additional risk to accident management.

Specifically, the licensee should establish clear roles and responsibilities of the following participants for each stage of an accident. The list includes, but is not limited to:

• plant shift supervisors
• control room shift supervisors
• reactor unit operators
• common service operators
• field personnel
• senior health physicist
• emergency response manager
• nuclear safety manager
• plant manager
• technical advisory team

The above-listed roles and positions may vary by station; however, if titles vary, the functions should be equivalent.

In consideration of beyond-design-basis initiating events, the minimum number of qualified personnel needed for managing the situation should be identified. The effects of extreme weather conditions, seismic events or events that are disruptive to society on the availability of skilled personnel should be considered. Contingency plans should be developed to identify substitutes that could perform the same tasks in case these skilled workers are unavailable. Suitable backups should be pre-defined for key roles in the accident management organization, including potentially the possibility to transfer authority in whole or in part.

4.3.4 Communication interfaces

During a severe accident, no single group is likely to have the complete information, knowledge, and skills required to manage the accident. It is therefore important to establish effective onsite communication interfaces among groups including the emergency response teams as specified in REGDOC-2.10.1, Nuclear Emergency Preparedness and Response. These interfaces will enable efficient integration of the information and expertise available within the operating and supporting organizations or from other involved authorities.

The impact of beyond-design-basis initiating events on communication should be considered. It may be prudent in some DBA conditions to inform offsite authorities; provisions should be made for reliable communication among different accident management and emergency response organizations. Conditions include extreme situations such as widespread onsite and offsite damage caused by severe weather conditions, flooding or earthquake. Measures should be taken to ensure the effectiveness of the emergency communication systems, including regular practice in their use.

Licensees should also consult RD/GD-99.3, Public Information and Disclosure concerning public disclosure protocols regarding events and developments at their facilities.

5. Guidance for Implementing an Integrated Accident Management Program

To satisfy the requirements specified in section 3 pertinent to the implementation of an IAMP, the licensee should consider the guidance given in this section.

Implementation of an IAMP should consider, but not be limited to:

• integration of procedures, guidelines, and arrangements to ensure that interfacing issues are addressed and that all IAMP components are put in place to meet the goals of accident management
• verification of the procedures and guidelines to ensure that they work as intended
• consideration of human factors and human-machine interface issues to ensure that the required accident management actions can be implemented as intended and in a timely manner
• organizational aspects to ensure that the defined responsibility matrix is consistent with the qualifications and expertise of the staff and with other authorities and supporting organizations
• personnel training to ensure that a suitable training plan is executed to implement the IAMP

5.1 Integration of procedures, guidelines and arrangements

Licensees should integrate the established procedures, guidelines, and arrangements including equipment and personnel resources to implement the reactor-specific IAMP.

EOP to SAMG transition and the associated issues including roles and responsibilities, equipment performance, and potential instrument errors under accident conditions should be identified and addressed. The implementation stage may identify necessary changes in certain aspects of the IAMP.

The onsite and offsite emergency response plans and procedures should be reviewed with respect to the accident management actions, to ensure that conflicts do not exist. Hardware arrangements, including temporary and supplementary equipment, should be checked for their operability and usability under accident conditions.

5.2 Verification and validation of procedures and guidelines

The overall process of verification and validation should be formally documented. The level of documentation required will depend upon the complexity of issues addressed and the potential impact on safety.

The objectives of the verification and validation of accident management procedures and guidelines are to:

• demonstrate that procedures and guidelines achieve the goals for which they were developed
• confirm their usability (in terms of being easily understood and followed by their users)
• verify technical accuracy (meaning identification of the correct equipment and line-ups)
• assure completeness of scope (that is, to provide adequate guidance for all expected activities)
• confirm that all specified actions are reasonable (i.e., consider possible challenges and threats to the personnel) and identify alternatives, where appropriate.

5.3 Human and organizational performance

Safe and reliable human and organizational performance is an essential part of IAMP. Such performance under emergency situations should be taken into account during the implementation of the IAMP to meet the expectations specified in regulatory guides G-276, Human Factors Engineering Program Plans [12], and G-323, Ensuring the Presence of Sufficient Qualified Staff at Class I Nuclear Facilities - Minimum Staff Complement [13]. Field operator performance and human-machine interface issues under hazardous environments and conditions should be identified and considered during the execution of SAMG actions. SAM may require sufficient qualified personnel that are not part of the normal minimum staff complement.

Sufficient verification and validation of all aspects of human and organizational performance, including EOPs and SAMGs, to execute all the identified accident management actions should be conducted to clearly demonstrate that they can be carried out by reactor personnel under all types of conditions covered by the IAMP.

The IAMP should incorporate measures to ensure that the personnel are ready to carry out the appropriate roles and responsibilities. For example, certain accident events may cause damage to the facilities (e.g., the technical support centre) and provisions should be made to ensure the habitability of the facilities or an alternative is available.

Improvement of the IAMP should be achieved through the consideration and incorporation of relevant results from well-supported research in human performance, including decision-making.

EOP implementation primarily involves the operations organization, with support from other organizations as needed. SAMG implementation has wider organizational implications, which require careful considerations in terms of roles and responsibilities, personnel qualification, and interfaces with the technical support centre and the emergency response centre (see section 4.3.3).

Appropriate arrangements should be identified for shift turnover and provision of food and other amenities for prolonged duty caused by beyond-design-basis initiating events.

Consideration should be given to the fact that reactor staff may be concerned about family and friends following a beyond-design-basis initiating event and may be under extremely high stress while executing accident management actions. For certain situations, it may be impossible to increase or replace staff for a given time. Measures should be taken to address all of these situations.

5.4 Training

Appropriate levels of training should be provided to the operating personnel and responsible organizations to ensure their competency in using all instructions and actions specified in EOPs, and their knowledge of the information required to identify events and accidents that are beyond the design basis and of the guidelines specified in SAMGs.

Training should be commensurate with every personnel's respective roles in the case of an accident, enabling them to:

• understand their roles and responsibilities within the IAMP
• learn about accident phenomena and processes
• become familiar with the activities to be carried out
• enhance their ability to perform in stressful conditions
• verify the effectiveness and improve the clarity of procedures and guidelines

The licensee should establish qualification, training, deployment, and staffing numbers for the various organizational groups involved in accident management.

Training programs should address the roles to be performed by the different groups, and include drills and exercises to enable assessment of the interactions between the various groups involved in IAMP. A set of drills should be developed to cover multi-unit events and external events.

The purpose of conducting regular drills and integrated exercises is to confirm and maintain that each of the essential elements related to procedures, equipment and personnel of the IAMP has a high degree of assurance of effectiveness, should an accident occur.

While there are potential limitations to the use of simulators for BDBA, the licensee should use simulator training, as appropriate, because it provides a realistic and interactive environment, and is an efficient method for enhancing human response in complex situations. Where simulator training is not used, other means to address the human response / human and organizational performance aspects should be implemented.

Licensees should also consult REGDOC-2.2.2, Personnel Training for information concerning requirements and guidance for training systems.

6. Guidance for Validating an Integrated Accident Management Program

To satisfy the requirements specified in section 3 pertinent to validation of an IAMP, the licensee should consider the guidance given in this section.

The first step of validating an IAMP is to review the program to assess its completeness and adequacy. The review also gives an opportunity to identify specific areas in the IAMP that need improvement to enhance reactor capabilities to cope with an accident. The adequacy of the SSCs and human/materiel resources that are required to complete IAMP actions should be assessed.

To ensure the continued effectiveness of the IAMP, the licensee should have a procedural mechanism (see requirement 6 in section 3.2) by which its components are continuously reviewed to ensure that the technical basis remains sound and current, and that station staff can carry them out effectively. Where the review indicates that improvements are required, the IAMP should be revised promptly to incorporate those improvements.

6.1 Review of integrated accident management program

Review of an IAMP before its implementation is intended to check its quality, consistency and completeness. Review of IAMP after its implementation is to evaluate its adequacy, effectiveness, and any needs for updating and strengthening. The review includes self-assessments and independent reviews.

It is necessary to review and evaluate the effectiveness of the IAMP periodically to ensure it reflects modern requirements, reflects lessons from drills and exercises, incorporates knowledge gained from any new information and experimental data, and includes any changes in personnel, reactor equipment and instrumentation conditions, and training needs. The review should cover all the aspects of the preparation, development, implementation, and documentation of the IAMP, including:

• review that the selection and scope of the IAMP meet requirements
• review of the technical basis on the understanding of reactor-specific accident progression (reactor damage states), phenomena, and challenges, and on the state-of-the-art knowledge and data to tackle those challenges
• assessment of whether the identified reactor challenges and capabilities realistically address reactor design and conditions
• assessment of whether the identified supplementary equipment for coping with beyond- design-basis initiating events is sufficient and properly protected, proceduralized, and maintained
• evaluation of whether the identified strategies and measures are adequate for achieving the established IAMP objectives
• review of the supporting accident analysis including computational aids for IAMP
• evaluation of reactor equipment performance
• evaluation of reactor instrumentation performance for accident management monitoring
• verification and validation of the procedures and guidelines to ensure their overall quality and usability
• check of the interface between the IAMP and the emergency preparedness program
• review of responsibility allocation, staffing, personnel qualification, training needs, and performance
• review of IAMP documentation and revisions

In addition, completeness of the provisions important for implementing an IAMP should be reviewed in relation to the basic safety principles and IAMP requirements specified in section 3. All the identified provisions should be reviewed to evaluate whether they exist and can be successfully implemented. The review should also identify if additional provisions are required to strengthen the ability of the reactor staff to manage an accident, including a severe accident, or evaluate if an absence of a provision leads to the weakness in defence in depth.

6.2 Evaluation of systems and equipment

Reactor design capabilities for accident management, such as containment venting, hydrogen mitigation, and coolant make-up provisions should be identified and their effectiveness should be evaluated.

For all systems and equipment that are expected to perform in a way or under conditions that were not considered in their original design, the licensee should conduct an assessment of their potential availability, effectiveness, and limitations for use in support of an IAMP. Existing systems may warrant design enhancement if the assessment reveals that the potential consequences of severe accidents are such that the existing systems may not provide the desired preventive and mitigating capabilities.

Essential reactor monitoring features and instrumentation for diagnosing reactor state should be identified and assessed for severe accident conditions, and reasonable assurance should be provided that they will function reliably and provide meaningful data.

The validation of an IAMP should also include an assessment of the adequacy and sufficiency of supplementary equipment and consumables (fuel and water inventories) used to maintain or restore nuclear fuel and containment cooling for coping with beyond-design-basis initiating events.

6.3 Assessment of resources

The licensee should perform an assessment to determine the availability of coolant, energy, and other materiel resources that may be required for the effective completion of accident management actions.

For procurement of external resources (e.g., equipment, power, water and personnel), the licensee should assess the adequacy of arrangements with other organizations to ensure availability, timing and access to these resources during accidents, with consideration of potential challenges posed by common cause and/or external events. These arrangements should be formalized and documented.

7. Guidance for Documentation of an Integrated Accident Management Program

To satisfy the requirements specified in section 3 pertinent to documentation of an IAMP, the licensee should consider the following guidance.

All aspects of an IAMP should be described, typically by a suite of IAMP documents consisting of manuals, procedures, guidelines together with their technical basis and supporting safety analysis reports for justifications, explanations, verification and validation. There are also many other related documents such as description of the reactor physical protection, PSA studies, equipment and instrumentation survivability assessments, and reactor "stress test" reports as appropriate.

At a minimum, the licensee should provide the following documented information about an IAMP:

• goals and principles used for development and implementation of the IAMP
• technical basis and results of probabilistic and deterministic analyses conducted in support of the IAMP
• EOPs and SAMGs
• performance capabilities for the systems and equipment that are used in support of accident management procedures and actions
• responsibilities of persons and organizations involved in the IAMP, including requirements and plans for personnel training
• results of the IAMP validation and reviews

The technical basis documents provide technical information important to an IAMP. They can build on or provide a cross-reference to the existing technical descriptions. They should include, but not be limited to:

• justification of accident selection and coverage of the IAMP, including a general description of reactor response to accidents
• distinct stages of an accident progression if no accident management actions are credited
• understanding of the relevant phenomena and the associated physical processes, including challenges to fission product barriers and the associated mechanisms and conditions
• state of the current knowledge of the phenomena, including current predictive capabilities for modeling the phenomena and physical processes and relevant analytical and experimental supports
• any other aspects or special topics important to EOP and SAMG development and verification

Reviews and revisions of the IAMP documents should be tracked and controlled.

Appendix A: Overlapping Provisions of an Emergency Preparedness Program and an Integrated Accident Management Program

Abbreviations

Abbreviation	Full term
IAMP	integrated accident management program
AOO	anticipated operational occurrence
BDBA	beyond-design-basis accident
CNSC	Canadian Nuclear Safety Commission
CSA	Canadian Standards Association
DBA	design-basis accident
DEC	design extension condition
EOP	emergency operating procedure
EME	emergency mitigating equipment
EMEG	emergency mitigating equipment guideline
IAEA	International Atomic Energy Agency
NSCA	Nuclear Safety and Control Act
PSA	probabilistic safety assessment
SAM	severe accident management
SAMG	severe accident management guideline
SSCs	structures, systems and components

Glossary

accident management

The taking of a set of actions during the evolution of an accident to prevent the escalation of the accident, to mitigate the consequences of the accident, and to achieve a long-term safe stable state after the accident.

anticipated operational occurrence

An operational process deviating from normal operation that is expected to occur at least once during the operating lifetime of a reactor facility but which, in view of the appropriate design provisions, does not cause any significant damage to items important to safety or lead to accident conditions.

arrangements

The pre-determined integrated set of infrastructural elements necessary to provide the capability for performing a specified function or task required in response to a nuclear or radiological emergency. These elements may include hardware (e.g., equipment and instrumentation), authorities and responsibilities, materiel and human resources, organization, co-ordination, communication, and training.

beyond-design-basis accident

Accident conditions less frequent and potentially more severe than a design-basis accident. A beyond- design-basis accident may or may not involve core degradation.

beyond-design-basis initiating event

Any initiating event that is not considered in the design of the facility including external hazards that are beyond the design basis such as large seismic loads, tsunamis, flooding by extreme high water level, damage by extreme weather conditions (e.g., hurricanes, ice-rains, sandstorms, etc.), or man-made actions or structures, such as airplane crashes, transport accidents, nearby chemical plants, gas pipes or river dams.

cliff-edge effect

A large increase in the severity of consequences caused by a small change of conditions. Note: cliff-edge effects can be caused by changes in the characteristics of the environment, the event, or changes in the reactor response.

complementary design feature

A design feature added to the design as a stand-alone structure, system or component (SSC), or added capability to an existing SSC, enabling them to cope with design extension conditions.
Note: Complementary design features may also be referred to as "additional safety features".

corium

A lava-like molten mixture of portions of nuclear reactor core.

design-basis accident

Accident conditions for which a reactor facility is designed, according to established design criteria, and for which the damage to the fuel and the release of radioactive material are kept within authorized limits.

design extension conditions

A subset of beyond-design-basis accidents that are considered in the design process of the facility in accordance with best-estimate methodology to keep releases of radioactive material within acceptable limits. Design extension conditions could include severe accident conditions.

deterministic safety analysis

An analysis of nuclear reactor facility responses to an event, which is performed using predetermined rules and assumptions (e.g., those concerning the initial operational state, availability and performance of the systems and operator actions). Deterministic analysis can use either conservative or best-estimate methods.

emergency operating procedures

Reactor specific procedures containing instructions to operating staff for implementing measures to terminate some anticipated operational occurrences and to prevent core degradation in design-basis accidents and/or beyond-design-basis accidents.

emergency response procedures

A set of instructions with a detailed description of the actions to be taken by response personnel during an emergency.

emergency response

The integrated set of equipment, procedures and personnel necessary to provide the capability for performing a specified function or task required in order to prevent, mitigate or control the effects of an accidental release.

emergency response organization or team

Group of inter-related responders whose role is to mitigate the consequences of an emergency. An emergency response organization involves pre-defined coordination of roles and responsibilities.

emergency response arrangements

See arrangements.

external event

Any event that proceeds from the environment external to a reactor facility and that can cause failure of structures, systems and/or components. External events include, but are not limited to, earthquakes, floods and hurricanes.

human factors

Factors that influence human performance as they relate to the safety of a nuclear facility, including activities during design, construction, commissioning, operation, maintenance and decommissioning phases.

human performance

The outcomes of human behaviours, functions and actions in a specified environment, reflecting the ability of workers and management to meet the system's defined performance under the conditions in which the system will be employed.

internal event

An event internal to the reactor facility that results from human error or failure in a structure, system or component.

licensing basis

A set of requirements and documents for a regulated facility or activity comprising:

• the regulatory requirements set out in the applicable laws and regulations
• the conditions and safety and control measures described in the facility's or activity's licence and the documents directly referenced in that licence
• the safety and control measures described in the licence application and the documents needed to support that licence application

long-term safe stable state

A state in which fuel in the core or the spent fuel pool is submerged in water, the associated reactivity is controlled to remain subcritical, and a long-term decay heat removal from the fuel is achieved and maintained.

normal operation

Operation of a reactor facility within specified operational limits and conditions, including start-up, power operation, shutting down, shutdown, maintenance, testing and refuelling.

offsite

The facilities and organizations outside the juridical consideration of the licensed facility, including the various federal, provincial and municipal organizations that are required to communicate with and respond to a facility accident in accordance with the facility accident management procedures.

onsite

The physical domain of the facility to which a licence is granted.

plant design envelope

The range of conditions and events (including design extension conditions) that are explicitly taken into account in the design of the nuclear power plant, such that it can be reasonably expected that significant radioactive releases would be practically eliminated by the planned operation of process and control systems, safety systems, safety support systems and complementary design features.

post accident

A long-term safe stable state that is achieved in the reactor facilities after an accident.

practically eliminated

The possibility of certain conditions occurring being physically impossible or with a high level of confidence to be extremely unlikely to arise.

safety analysis

Analysis by means of appropriate analytical tools that establishes and confirms the design basis for the items important to safety; and ensures that the overall facility design is capable of meeting the acceptance criteria for each reactor state.

safety system

A system important to safety, provided to ensure the safe shutdown of the reactor or the residual heat removal from the core, or to limit the consequences of anticipated operational occurrences and design- basis accidents.

severe accident

An accident more severe than a design-basis accident, and involving severe fuel degradation in the reactor core or spent fuel pool.

severe accident management

Mitigating the consequences of a severe accident to achieve a long-term safe stable state.

severe accident management guidelines

A set of recommendations for actions to take when handing severe accidents.

shutdown state

A subcritical reactor state with a defined margin to prevent a return to criticality without external actions.

supplementary equipment

Equipment and instruments that are not installed as part of the original plant design, but are used as an additional provision to mitigate the consequences of an accident. An example is the emergency mitigating equipment (EME). The use of EME is covered in the EME guidelines (EMEG).

structures, systems and components

A general term encompassing all of the elements of a facility or activity that contribute to protection and safety. Structures are the passive elements: buildings, vessels, shielding, etc. A system comprises several components, assembled in such a way as to perform a specific (active) function. A component is a discrete element of a system. Examples are wires, transistors, integrated circuits, motors, relays, solenoids, pipes, fittings, pumps, tanks, and valves.

usability

The extent to which a product can be used by specified users, to achieve specified goals, with effectiveness, efficiency and satisfaction in a specified context of use.

validation (for human factors)

The process of determining the degree to which the human-machine system design and supporting mechanisms facilitate the achievement of overall safety and operational goals.

verification (for human factors)

The process of demonstrating that equipment and system have been designed as specified, and that adherence to human factors guidelines has been maintained.

References

1. International Atomic Energy Agency (IAEA) Safety Fundamentals No. SF-1, IAEA Safety Standards for protection people and the environment - Fundamental Safety Principles, Vienna, Austria, 2006.
2. IAEA Safety Standards Series No. NS-G-2.15, STI/PUB/1376, Severe Accident Management Programmes for Nuclear Power Plants - Safety Guide, Vienna, Austria, 2009.
3. IAEA Safety Reports Series No. 32, STI/PUB/1167, Implementation of Accident Management Programmes in Nuclear Power Plants, Vienna, Austria, 2004.
4. IAEA Services Series No. 9, IAEA-SVS-09, Guidelines for the Review of Accident Management Programmes in Nuclear Power Plants, Vienna, Austria, 2003.
5. Canadian Nuclear Safety Commission (CNSC), REGDOC-2.10.1, Nuclear Emergency Preparedness and Response, Ottawa, 2014.
6. IAEA Specific Safety Requirements No. SSR-2/2, Safety of Nuclear Power Plants: Commissioning and Operation (Requirement 19: Accident management programme), Vienna, Austria, 2011.
7. IAEA Safety Guide No. NS-G-2.15, Severe Accident Management Programmes for Nuclear Power Plants, Vienna, Austria, 2009.
8. IAEA INSAG-10, Defence in Depth in Nuclear Safety, Vienna, Austria, 1997
9. IAEA INSAG-12, 75-INSAG-3 Rev. 1, Basic Safety Principles for Nuclear Power Plants, Vienna, 1999 IAEA INSAG-10, Defence in Depth in Nuclear Safety, Vienna, Austria, 1996.
10. IAEA TECDOC-1440, Overview of Training Methodology for Accident Management at Nuclear Power Plants, Vienna, Austria, 2005.
11. CSA Group N286, Management System Requirements for Nuclear Facilities, Mississauga.
12. CNSC, G-276, Human Factors Engineering Program Plans, Ottawa, 2003.
13. CNSC, G-323, Ensuring the Presence of Sufficient Qualified Staff at Class I Nuclear Facilities - Minimum Staff Complement, Ottawa, 2007.

CNSC Regulatory Document Series

Facilities and activities within the nuclear sector in Canada are regulated by the Canadian Nuclear Safety Commission (CNSC). In addition to the Nuclear Safety and Control Act and associated regulations, there may also be requirements to comply with other regulatory instruments such as regulatory documents or standards.

Effective April 2013, the CNSC's catalogue of existing and planned regulatory documents has been organized under three key categories and twenty-five series, as set out below. Regulatory documents produced by the CNSC fall under one of the following series:

• 1.0 Regulated facilities and activities
• Series 1.1 Reactor facilities
  • 1.2 Class IB facilities
  • 1.3 Uranium mines and mills
  • 1.4 Class II facilities
  • 1.5 Certification of prescribed equipment
  • 1.6 Nuclear substances and radiation devices
• 2.0 Safety and control areas
• Series 2.1 Management system
  • 2.2 Human performance management
  • 2.3 Operating performance
  • 2.4 Safety analysis
  • 2.5 Physical design
  • 2.6 Fitness for service
  • 2.7 Radiation protection
  • 2.8 Conventional health and safety
  • 2.9 Environmental protection
  • 2.10 Emergency management and fire protection
  • 2.11 Waste management
  • 2.12 Security
  • 2.13 Safeguards and non-proliferation
  • 2.14 Packaging and transport
• 3.0 Other regulatory areas
• Series 3.1 Reporting requirements
  • 3.2 Public and Aboriginal engagement
  • 3.3 Financial guarantees
  • 3.4 Commission proceedings
  • 3.5 Information dissemination

Note: The regulatory document series may be adjusted periodically by the CNSC. Each regulatory document series listed above may contain multiple regulatory documents. For the latest list of regulatory documents, visit the CNSC's website at nuclearsafety.gc.ca/eng/acts-and-regulations/regulatory-documents/.