What are the safety implications of having more than one reactor on a single site to operate and maintain? Multi-unit sites are not new, but they may have been treated as if the units are entirely separate from a safety viewpoint. The prospect of sites with shared services across a group of small reactors, or mixed sites, have led safety organisations to develop Probabilistic Risk Assessments (PRAs) – more commonly only known as Probabilistic Safety Assessments (PSAs) in Europe – specifically for multi-unit sites.
In a session titled ‘Multi-Unit Risk: Are We Ready for This?’ at the most recent US Nuclear Regulatory Commission (NRC) Annual Regulatory Information Conference, Jonathan Evans, Chief of the Probabilistic Risk Assessment Branch, for Nuclear Regulatory Research (RES) at the NRC chaired the session, noting that since Fukushima, multi-unit risk has received increasing attention. “It continues to shape how we think about site level safety and future reactor deployment,” said Evans. This session explored the topic of multi-unit (MU) risk for both the existing fleet of light water reactors and advanced reactor designs.
Dr. Shahen Poghosyan, Senior Nuclear Safety Officer at the International Atomic Energy Agency (IAEA) noted that PSA in general plays an important role in the IAEA framework and safety standards and is considered a powerful tool. Together with deterministic safety analysis it allows a holistic understanding of the risk profile for nuclear installations and thus risk-informed decision-making. However, on digging deeper into the safety assessment, “we still have one reactor at the time mindset,” he said, despite the fact that nearly 80% of the sites worldwide are multi-unit sites.
The Electric Power Research Institute (EPRI) has been involved in developing and applying MU PRA guidance for both US and international nuclear power plants. Outlining the current approach and status for developing an MU PRA standard, Mark Wishart, senior technical lead at EPRI, said “it’s not about taking units’ [PRAs] and adding them, but about them interacting”. He said there are “shared systems” like central services or even a containment and “coupling comes into play”. In the future, risk assessment also may have to consider other types of coupling, such as co-generation (with heat customers) or hydrogen production. However, Wishart said the there was “no substantial difference… the [existing] framework is generally applicable” to enable risks to be assessed for each unit before considering the multi-unit implications.
He highlighted takeaways from a pilot with Canada – which of course has decades of experience of multi-unit sites, including those that share key equipment such as steam generators, and has used multi-site considerations for PRAs from the start. European experience of multi-unit sites is also extensive, as is that of other countries’ programmes, and clearly the experience from Fukushima in Japan had been an important input into US and international work on multi-unit sites.
An early question that arises is in the multi-site definition: when is a reactor a ‘unit’ and when is it a ‘module’ that is part of a unit? There are at least three different ways of describing multi units; they may share key equipment (as with Candu steam generators), systems (such as pumps) or equipment (such as firefighting equipment). Shahen Poghosyen, Senior Nuclear Safety Officer, International Atomic Energy Agency, said that organisation did not have a definition of a multi-unit site, but one key point was to see whether one initiating event could affect two or more units. It is already a fundamental requirement even for single unit risk assessments to consider multi-unit interactions, but that might include positive interactions such as the flexibility to use equipment across multi units (making more available).
Assessing the operational state
Complexity has increased over the last two decades. Multi-unit sites are likely to have units in different states (for example in refuelling or maintenance outage with other units continue to operate), with different alarms live, or be at different points in a similar procedure. The numbers of potential combinations of states increase rapidly as the number of units increases. What does that mean for risk assessment, especially in a control room where there are operators of several units working at nearby desks?
The potential variety of multi-unit sites became clear during the session. At one extreme a site may have reactors of different types (BWR and PWR), from different suppliers. If they are the same nominal type, they may of different ages and hence versions and different operating histories, and their services may be entirely separate.
In contrast, on an SMR site some small or micro reactors may have six or 12 units operated from the same control room. If there is just a one or two small or micro reactor units the operator has to take staffing decisions against a background where there is budget for just one or two staff. Even in a two-unit site with otherwise identical units, they may be in a ‘mirror’ configuration that introduces different fragilities.
The NRC’s Susan Cooper summarised the integrated site risk approach and results from the NRC’s Level 3 probabilistic risk assessment (PRA) project, including MU Level 1, 2, and 3 results. She said that “just adding” two risks for two units provided no new insights, saying “we wanted to get more insights from our MU PSA efforts”. She introduced ‘integrated site risk’ as “a term we’d never had before” when the organisation began working on this.
Developing a multi-unit PSA process
The NRC used a reference site with two PWRs, two spent fuel pools and two dry stores. The PSA process revealed that multi-unit core damage frequency was “always a fraction of that for a single unit” but the difference varied depending on the strength of dependencies between the units.
Issues to be aware of included timings. In the event of an accident on a multi-unit site “things are happening at the same time [for site staff] and that can lead to challenging situations,” she said, echoing Wishart’s point. Coupling between the units may lead to common-cause failure and seismic hazard was among these potential issues. Another issue was competition for common resources, such as pumps. However, later discussion focused equally on the opportunity to share resources on a multi-unit site.
Enercon’s Rocky Summit reminded delegates that US regulatory guidance still largely treats units on one site in ‘silos’. That may raise questions about small effects that are repeated or multiplied, possibly over a period of time. For example, he said, “looking at constraints associated with releases. If you have two or four small releases [each individually below regulatory limits] how do we know we are not missing an accumulation?”
Summit talked about initiating events, such as loss of offsite power, that could have an effect across a multi-unit site. Seismic events were highlighted several times as potential common cause failures, but Summit pointed out that actual effects could vary with ground conditions in areas separated by just a few hundred metres. He postulated a seismic event that could have different outcomes for adjacent reactors on separate basemats – even putting forward a scenario, in a seismic event, where one basemat is tilted into that housing the adjacent unit.
One issue that concerned the session panel as a whole was the data available to assess risks. The database of incidents held by INPO has data on only 100 events. Even for a single unit common cause failure data is scarce, even for one component failure. Considering risk assessments for multi-unit sites with five, six or seven component failures “there is a risk of extrapolating beyond the data”.
