Periodic Safety Review NPP Borssele reduced TCDF
by a factor of 4.
Borssele is a two-loop PWR built by Siemens KWU,
that became operational in 1973. It is operated by the Dutch utility
EPZ, which over the years has invested regularly in safety and
efficiency. After its first PSR a plant modernisation programme
of around 250 million Euros has been implemented in 1997 during
a five-month outage. Highlights included the back fitting of new
primary safety valves, new steam and feed water lines, a new control
room, an emergency control room, new emergency diesel generators
with higher capacity and a reserve ultimate heat sink.
In 2004 EPZ has decided to improve the plant’s
balance of plant to a gross capacity of 510 MWe (see e-news issue
15, winter January 2007). This was carried out by Siemens during
the 2006 outage.
In the same outage also the majority of measures
were implemented that followed from the second PSR. These improvements
have resulted in another significant gain in nuclear safety (see
Figure 1. Changes in total core damage frequency
as a result of safety improvements.
This paper reports on the process of the latest
periodic review, as well as on examples of implemented measures.
The associated gains, in terms of nuclear safety, are seen as
the first priority for EPZ. At the same time these gains contribute
to our goal of staying in the top of the safest nuclear power
plants in the western world.
Periodic safety review
The operating license of the Borssele power plant
stipulates that EPZ should conduct and report a periodic safety
review every 10 years. This PSR is extensive and analyses developments
in technology and regulations with respect to the current licensing
base. The periodic safety reviews cover both design and operation,
with technological-, organisational-, personnel- and administrative
The most recent PSR covers the period 1993 –
2002 and consists of an evaluation-, a conceptual- and an implementation
phase. An important result of the evaluation phase was that Borssele
is operated safely, in compliance with (inter)national regulations
and current state-of-the art technology. In addition, several
areas for further improvement and optimisation have been identified.
The improvements have been selected, amongst others, for their
impact on the total core damage frequency contribution (TCDF,
PSA Level 1) and on individual risk contribution (PSA Level 3).
This was calculated with the full scope, plant-specific living
probabilistic safety assessment model. In figure 1 the integrated
effect of these improvements on the total CDF is given. It shows
that the most recent periodic safety review has resulted in another
significant gain, despite the 1985 and 1997 back fitting projects
which already reduced the original total CDF number significantly.
An important decision has been to increase the so-called mission
time in the PSA from 24 hours to 72 hours. This has allowed us
to identify areas of improvement beyond the original 24 hours
after the occurrence of an event. It has turned out that for some
rare external events a significant safety improvement could be
Evaluation phase (1999 – 2003)
The evaluation of subjects for improvement started in 1999 by
gathering information from different sources, such as:
Input from personnel (listening to own organisation)
Assessing new and upcoming regulations (national, KTA and
Information from aging programmes (conceptual and physical)
Probabilistic Safety Analyses (In house living PSA model,
as well as know-how of commercial companies in the field of
Over more than 1200 issues were gathered and
clustered in 26 basic reports. After a first evaluation 176 issues
of potential improvement were selected, based on know-how and
Conceptual phase (2003 – 2005)
The potential improvements were further analysed
during the conceptual phase, and measures were formulated in order
to obtain the improvement. An estimation of costs was made together
with the expected benefits, which were selected on expected gains
in nuclear safety and based on:
Impact on the total core damage frequency (CDF) and the individual
risk were calculated with a plant-specific living probabilistic
safety assessment model.
Upcoming regulations and defence-in-depth approaches (failures,
availability, reliability,..) was analysed.
Radiation protection gain.
Collective, individual and environmental doses were calculated.
The issues for improvement were split into Technical
(design) measures and OPA measures (organisational, personnel
and administrative measures). All measures were subject to a cost/benefit
analysis, and the end result has been agreed upon by the regulator
in June 2005.
Implementation phase (2005 – 2007)
The modifications resulting from the technical
measures were conducted by a separate project organisation. It
covered around 35 measures of which 20 measures were conducted
by own personnel. The remaining 15 measures were carried out by
the consortium Belgatom – GTI on a design & construct
basis. Within this consortium Belgatom was responsible for the
project management, the nuclear engineering and the final testing.
Detail engineering, purchasing and construction was carried out
The engineering process and (safety) evaluation
by personnel took place in 2005 and first half of 2006. Some of
the measures required a change in the operating license. This
was honoured in the beginning of 2006. Therefore, construction
could start in the second half of 2006, and was concentrated in
the outage of 2006. In 2007 some smaller constructions are finalized
and documentation is completed. In the following paragraphs some
examples are given, showing the diversity of the implemented measures.
Figure 2. Remotely opened explosion hatches.
Defence in depth measures.
Several defence in depth measures were formulated
that cover different lines of defence, i.e. from prevention of
system failures to extending the design basis of the plant. Examples
of these measures are the installation of new improved seals of
the low pressure safety injection pumps, an additional feeding
possibility of the back-up decay heat removal system with a fire
pump, installation of an additional pump in the cooling circuit
for the irradiated fuel storage pond, and an additional pump for
the emergency residual heat removal system.
Furthermore, the installation of a connection
between the two emergency grids (6kV – 400 V) and extending
battery power have been carried out. The power supply of the reactor
protection system is extra secured and the dependence of the external
grid has been further diminished, resulting in a significant gain
As a last example, remotely opened explosion
hatches have been installed (see figure 2). Between the operating-
and the innercontainment section of the reactor building there
are explosion hatches, which are designed to burst open in case
of accidental pressure build-up, so as to limit damage to the
innercontainment. In case of a very small LOCA with hydrogen buildup,
the explosion hatches at top and bottom of the steam generator
sections can now be opened remotely from the control room. In
this way an air flow is forced by means of a chimney effect. The
hydrogen will mix and reach the passive recombinators at the different
positions in the reactor building.
Figure 3. Air intake of bunkered diesels.
Assessing risks from external events.
In a periodic safety review also off-site events
are assessed that could influence the plant’s safety. Increased
traffic of LPG tankers on our river have led to installation of
igniters for external flammable clouds. More severe storms and
sea level increase, due to a possible climate change, has led
to an even more conservative design level of external flooding.
The air intakes of the bunkered diesels were placed higher up
with an external structure attached to the bunkered building (see
figure 3). Because of the safety function, the pipework is earthquake-proof,
blast-proof and on different sides of the building to reduce common
Also a crashtender (see figure 4) was acquired
to be able to fight kerosene fires that would challenge vital
Figure 4. Crashtender for fighting kerosene fires.