In all nuclear reactors, energy is produced within the fuel by a chain reaction of fissions of the nuclei of its atoms. The most common nuclear fuel is uranium-235. Each fission splits a fuel atom into two new fission product atoms and also expels from its nucleus neutrons which cause further fissions of the atoms. Most of the energy released by the fission is carried away by the fission products, and in turn is converted into thermal energy in the adjacent fuel atoms as they stop these rapidly moving fission products and absorb their radiation. The neutrons carry away about 3% of the energy of fission.

The reactor core is prevented from getting too hot by a liquid or gaseous coolant, which also produces the steam (either directly or indirectly) to drive the turbine. Neutron-absorbing materials are incorporated into control rods, which can be moved in and out of cavities in the core of the reactor to control the fission reaction rate to that desired by the power station operator. In pressurized water reactors, absorbing materials can be put in the reactor coolant system via soluble absorbers.

Most fission products are unstable, and thus radioactive. They decay, releasing radiation of a type and at a rate characteristic of each fission product element, and a new daughter product which may also be radioactive. This decay sequence continues until it finally results in daughter products which are stable (not radioactive). Other radioactive products are formed in the reactor by absorption of neutrons in the nucleus of the atoms of non-fissile materials, such as uranium-238, and structural materials, such as guides, supports and fuel cladding.

In reactors which have been operating for some time, the decay of the fission products and the creation of new fission products reaches a near equilibrium. At this point, the radiation and resulting energy production from the decay of radioactive products is nearly a tenth of all that produced in the reactor.

It is this large amount of radioactive material that creates the risks which are specific to nuclear power stations. Under operating conditions, most of these radioactive materials behave like solids, but some behave like gases, or become volatile at the high temperature in the reactor. Some of these radioactive materials could be readily absorbed into living organisms, and have significant effects on biological processes. Thus, they are dangerous if released or dispersed into the environment.

Nuclear Station Types and Characteristics

Thermal reactors use materials called moderators to slow the fast neutrons produced by fission so that they can be captured more readily by the fissile uranium-235 atoms. Ordinary water is often used as a moderator. Other moderators used are graphite and deuterium, an isotope of hydrogen, which is used in the form of deuterium oxide—heavy water. Ordinary water is mostly hydrogen oxide, and contains a small proportion (0.015%) of heavy water.

Heat is removed from the fuel by a coolant, which directly or indirectly produces steam to drive the turbine, and which also controls the temperature of the reactor core, preventing it from getting too hot and damaging the fuel or structural materials. Coolants in common use in thermal reactors include ordinary water, heavy water and carbon dioxide. Water has good heat transfer characteristics (high specific heat, low viscosity, easily pumped) and is the most common coolant used in nuclear power stations. Cooling a reactor core with pressurized or boiling water allows high core power densities so that large power units can be built into relatively small reactor vessels. However, the reactor coolant system using water must operate at high pressure in order to reach useful steam pressures and temperatures for efficient operation of the steam turbine-generator. The integrity of the reactor cooling system boundary is therefore very important for all water-cooled nuclear power stations, as it is a barrier that protects the safety of the workers, the public and the environment.

The fuel in all water-cooled power reactors, and most other reactors, is ceramic uranium dioxide, clad in metal—stainless steel or a zirconium alloy. The sintered uranium dioxide provides a non-combustible fuel which can operate for extended periods and retain its fission products at high temperatures without significant distortion or failure. The only operating thermal power reactors using other than uranium dioxide fuel, are the Magnox stations (which are carbon dioxide-cooled), and these are gradually being taken out of service as they reach the end of their service life.

Neutron-absorbing materials (such as boron, cadmium, hafnium and gadolinium) used in various forms, such as in steel-clad control rods or in solution in coolants or moderators, can be moved in and out of the reactor core in order to control the fission reaction rate at any designated level. In contrast to fossil fuel power generation, no increase in the quantity of fuel is needed to increase the power level produced in a fission chain reaction.

Once an increase in rate of fission energy production is initiated, it will continue until it is stopped by the insertion into the core of the appropriate quantity of neutron-absorbing materials and moderator. Such a power increase is caused by a surplus of neutrons in the fission chain reaction over that required for just a break-even chain reaction. Therefore, the fission rate and resulting power production can be controlled very sensitively by adding or removing very small amounts of neutron-absorbing materials. If a sudden reduction in power level is required, a relatively large amount of neutron-absorbing material is injected into the core. Each reactor concept has its own reactivity characteristic which determines the designs of control and shutdown neutron-absorbing devices to ensure efficient power control and safe and rapid shutdown when required. However, the same basic control and safety principles apply to all.

The main types of thermal power reactors in service today are illustrated in figure 1, and the main characteristics are given in table 1. In the simplified illustrations in figure 1, concrete shields are shown surrounding the reactors and the primary coolant systems. The shields, which comprise a variety of designs, generally provide both shielding against direct radiation from the reactor and also provide containment of any leaks from reactor cooling or moderator systems, and generally are designed to withstand the significant pressures which could result in the event of a major failure of coolant systems.

Figure 1. Types of nuclear power stations

Table 1. Nuclear power station characteristics (1997)

In a pressurized water reactor (PWR) power station, the reactor primary coolant and moderator are the same—purified ordinary water, which is separated from the secondary feedwater/steam circuit by a metallic boundary in steam generators (sometimes called boilers), through which the heat is transferred by conduction. The steam fed to the turbine-generator is therefore not radioactive, and the steam turbine-generator plant can be operated like a conventional power plant. Because hydrogen in the primary coolant/moderator water absorbs a significant fraction of the neutrons, it is necessary to enrich the fuel’s fissile uranium-235 isotope content to between 2% and 5% to sustain a practical chain reaction for long-term power production.

In all operating nuclear power stations with pressurized heavy water reactors (PHWRs), the reactor moderator and primary coolant is heavy water with a very high isotopic deuterium content (>99%). In the CANDU PHWR, which constitutes almost all the operating PHWRs, the moderator is separated from the primary coolant and held at relatively low temperature and pressure, which provides a convenient environment to locate monitoring and control instrumentation, and a built-in back-up cooling capability in the event of primary coolant piping failure. The fuel and primary coolant in the CANDU are in horizontal pressure tubes in the reactor core. As in the PWRs, the primary coolant and secondary feedwater/steam circuit are separated by a metallic boundary in steam generators, through which the heat is transferred from the primary heavy water to the ordinary water steam-feedwater system. The steam fed to the turbine generator plant is therefore ordinary water steam, not radioactive (except for small amounts due to leaks), and the turbine-generator plant can be operated like a conventional thermal power plant. The heavy water moderator and coolant absorbs only a very small fraction of the neutrons generated during fission, allowing a practical chain reaction for long-term power production using natural uranium (0.071% uranium-235). Existing PHWRs can operate with slightly enriched uranium-235 fuel, which results in proportionately greater total energy extraction from the fuel.

In a boiling water reactor (BWR) nuclear power station, the primary cooling water is partially evaporated in the reactor core itself, and the steam generated there is fed directly to the turbine-generator. The operating pressure in the reactor is lower than that in the PWRs, but the steam pressure fed to the turbine is similar. The steam fed to the turbine is slightly radioactive, requiring some precautions because of the potential low-level contamination of the turbine/feedwater system. However, this has not proven to be an important factor in operation and maintenance of BWRs. In BWRs the control of reactor power is affected by the amount of steam in the core, and this has to be offset by appropriate control of the rate of coolant flow or reactivity insertions as the power level of the reactor is changed.

Magnox reactors, also known as gas cooled reactors (GLRs), are fuelled with natural uranium metal clad in magnesium. They are cooled by carbon dioxide at modest pressure, but generate relatively high-temperature steam, which gives good thermal efficiency. They have large cores with low power densities, so that the pressure vessels, which also act as the only containment structures, are also large. The pressure vessels in the early Magnox reactors were steel. In the later Magnox reactors a prestressed concrete vessel contained both the reactor core and the steam-raising heat exchangers.

Advanced gas-cooled reactors (AGRs) use enriched uranium oxide fuel (2.3% U-235). They are cooled by carbon dioxide at higher pressure than the Magnox reactors, and have improved heat transfer and thermal efficiency. The greater core power density in the AGRs compared to the Magnox reactors allows the AGR reactor to be smaller and more powerful. The prestressed concrete pressure vessel, which contains both the reactor core and the steam raising heat exchangers, also acts as the containment structure.

Light water graphite reactors (LWGRs) are a hybrid of different nuclear power systems. The only power stations of this type in operation today are the RBMK reactors located in the former Soviet Union, that is, in Russia, Ukraine and Lithuania. In the RBMK reactors the ordinary water coolant flows upward through vertical coolant channels (tubes) which contain the fuel, and boils within the core. The steam produced in the core is fed directly to the turbine-generator as in a BWR. The graphite moderator which surrounds the coolant channels operates at a temperature sufficiently above that of the coolant so that the heat generated in the graphite by moderating the neutrons is removed by the coolant channels. The RBMK reactors are large and have many coolant channels (>1,500).

Fast breeder reactors (FBRs) require enrichment of fissile material in the range of 20% and can sustain the fission chain reaction primarily by absorbing the fast neutrons produced in the fission process. These reactors do not need a moderator to slow down the neutrons, and can use excess neutrons to breed plutonium-239, a potential fuel for reactors. They can produce more fuel than they consume. While a number of these reactors were built to produce electricity in nine countries around the world, technical and practical difficulties related to the use of liquid metal coolants (sodium) and the very high heat rates has caused interest to wane. There are now only three or four relatively small liquid metal fast breeder reactors (LMFBRs) in service as power producers in the world, producing a total of less than 1,000 megawatts of electric power (MWe), and they are being phased out of service gradually. The technology of breeding reactors, however, has been considerably developed and documented for future use if ever required.

Fuel and Fuel Handling

The process that begins with mining uranium-bearing ore and ends with the final disposal of the used fuel and all fuel processing wastes is usually called the nuclear fuel cycle. There are many variations in fuel cycles, depending on the type of reactor involved and the design of the heat removal arrangements in the reactor core.

The basic PWR and BWR fuel cycles are nearly identical, varying only in the levels of enrichment and the detailed design of the fuel elements. The steps involved, usually at different locations and facilities, are:

• uranium mining and milling to produce yellowcake (U₃O8)
• uranium conversion to uranium hexafluoride (UF₆)
• enrichment
• fuel fabrication, which involves uranium conversion to uranium dioxide (UO₂), fuelled pellet production, fuel rod manufacture in lengths equal to the reactor core height, and manufacture of fuel assemblies containing about 200 fuel rods per assembly in a square array
• installation and operation in a nuclear power plant
• either reprocessing or temporary storage
• shipment of used fuel or enrichment waste to a federal/central repository
• eventual disposal, which is still in the development stage.

Precautions are required during these processes to ensure that the amount of enriched fuel at any location is less than that which could result in a significant fission chain reaction, except, of course, in the reactor. This results in material space restrictions in manufacture, shipping and storage.

In contrast, the CANDU reactor uses natural uranium, and has a simple fuel cycle from mining the ore to fuel disposal, which does not include the steps involved to provide enrichment and reprocessing. The fuel for the CANDU is manufactured semi-automatically in half-metre long round bundles of 28 or 37 fuel rods containing UO₂ pellets. There are no space restrictions in manufacturing natural uranium fuel, or in shipping or storing either the new or used fuel. The immobilization and disposal of used CANDU fuel has been under development for 17 years in Canada, and is currently in the concept approval stage.

In all operating power reactors, with the exception of the Magnox type, the basic component of the reactor fuel is the cylindrical fuel pellet, composed of uranium dioxide (UO₂) powder which is compacted and then sintered to attain the required density and ceramic characteristics. These sintered pellets, which are sealed in seamless zirconium alloy or stainless steel tubing to produce fuel rods or elements, are chemically inert with respect to their cladding at normal reactor temperatures and pressures. Even if the cladding is damaged or breached and the coolant comes in contact with the UO₂, this ceramic material retains most of the radioactive fission products and resists deterioration caused by the high-temperature water.

The Magnox reactors use natural uranium metal fuel clad in magnesium, and operate successfully at relatively high temperatures, because the coolant, carbon dioxide, does not react with these metals under dry conditions.

The basic objective of the design of the fuel rods in a nuclear reactor is to transfer the fission heat generated in the fuel to the coolant, while maintaining the integrity of the fuel rods even under the most severe transient conditions. For all operating reactors, extensive testing of simulated fuel in heat transfer laboratories has demonstrated that the anticipated maximum in-reactor heat transient condition can be accommodated with adequate safety margins by the specific fuel designed and licensed for the application.

New fuel delivered from the fabrication plant to the power station is not significantly radioactive, and can be handled manually or by manually operated lifting/handling tools, without shielding. A typical fuel assembly for a PWR or BWR reactor is a square array of about 200 fuel rods, about 4 m long, weighing about 450 kg. About 200 of these assemblies are required in a large PWR or BWR reactor. The fuel is handled by overhead crane and placed in vertical racks in the dry in the new fuel storage area. To install new fuel in an in-service light-water reactor such as a PWR or BWR, all operations are conducted under a sufficient depth of water to provide shielding for anyone above the reactor. The flanged lid of the reactor vessel must first be removed and some of the used fuel taken out, (usually one-third to one-half reactor core), by overhead crane and fuel-handling elevators.

The used fuel is placed in water-filled storage bays. Other used fuel assemblies in the core may be rearranged in position (generally moved toward the centre of the core), to shape the power production in the reactor. New fuel assemblies are then installed in all vacant fuel site positions. It may require from 2 to 6 weeks to refuel a larger reactor, depending on the workforce and the amount of fuel to be replaced.

The CANDU reactor and some gas-cooled reactors are fuelled on-power by remote-operated equipment which removes used fuel and installs new fuel elements or bundles. In the case of the CANDU, the fuel is half-metre-long bundles of fuel rods, approximately 10 cm in diameter and weighing about 24 kg. The fuel is received from the manufacturer in cardboard packing cases and stored in a designated new-fuel storage area, ready to load into the reactor. Fuel is generally loaded into an operating reactor on a daily basis to sustain the reactivity of the reactor. In a large CANDU reactor, 12 bundles per day is a typical refuelling rate. The bundles are loaded by hand onto a new-fuel loading device which in turn loads the bundles into a fueling machine which is controlled remotely from the station control room. To load new fuel into a reactor, two remote-operated fuelling machines are manoeuvred by remote control and coupled onto the ends of the horizontal fuel channel to be refuelled. The channel is opened by the fuelling machines at both ends while the cooling system is at operating pressure and temperature, and new fuel is pushed in one end and used fuel is withdrawn from the other end of the channel. When the required number of fuel bundles have been installed, the channel seals are re-installed by the fuelling machine, and the fuelling machines may go on to refuel another channel or to discharge the used fuel into the used-fuel water-filled storage bay.

The used fuel discharged from all operating reactors is very radioactive and requires cooling to prevent overheating, and shielding to prevent direct irradiation of any sensitive living organisms or equipment nearby. The usual procedure is to discharge the used fuel into a water-storage pool with at least 4 m of water coverage over the fuel for shielding. This allows safe observation of the fuel through the water, and access for moving it under water to a more long-term storage location.

One year after discharge from a reactor, the overall radioactivity and heat generation from used fuel will decrease to about 1% of its initial value on discharge, and within 10 years to about 0.1% of its initial value at discharge. After about 5 to 10 years from discharge, the heat production has decreased to the point that it is feasible to remove the fuel from the water pool and store it in the dry form in a container with only natural circulation of air around the fuel container. However, it is still quite radioactive, and shielding of its direct radiation is required for many decades. Prevention of ingestion of the fuel material by living organisms is required for a much longer period.

The actual disposal of used fuel from power reactors is still in the development and approval stages. Disposal of used fuel from power reactors in various geologic structures is being studied intensely in a number of countries, but has not as yet been approved anywhere in the world. The concept of storage deep underground in stable rock structures is now in the approval process in Canada as a safe and practical method of finally disposing of these high-level radioactive wastes. However, it is anticipated that even with concept approval by the year 2000, the actual disposal of used fuel will not take place until about 2025.

In-plant Operations

In all 33 countries with nuclear power programmes, there are regulatory bodies that establish and enforce safety regulations related to the operation of nuclear facilities. However, it is generally the power utility which owns and operates nuclear power facilities that is held responsible and liable for the safe operation of its nuclear power plants. The role of the operator is really a management task of information gathering, planning and decision making, and only occasionally includes a more active control when routine operation is disrupted. The operator is not the primary protective system.

All modern nuclear power plants have highly reliable automatic, very responsive control and safety systems which protect the reactor and other plant components continuously, and which are generally designed to be fail-safe on loss of power. The operator is not expected to duplicate or substitute for these automatic control and protective systems. The operator, however, must be able to shut down the reactor almost instantly if necessary, and should be capable of recognizing and responding to any aspect of plant operation, thus adding to the diversity of protection. The operator needs the ability to understand, diagnose and anticipate the development of the overall situation from a large amount of data provided by the automatic data and information systems.

The operator is expected to:

• understand what the normal conditions are in all systems relevant to the current overall status of the plant
• recognize, with help from the automatic systems or special monitoring devices, when abnormal conditions arise, and their significance
• know how to respond correctly to restore the plant to normal operation, or bring the plant to a safe shutdown condition.

How well the operator can do this depends on the design of the machine as well as the operator’s ability and training.

Every nuclear power station must have competent, stable and well-trained operators on duty at all times. Potential nuclear operators undergo a comprehensive training programme, which usually includes classroom and on-the-job training in science, equipment and power systems, radiation protection and operating policies and principles. Training simulators are always used in US utility nuclear plant operation to provide the operator with hands-on experience in plant operations, during upsets and in unusual conditions. The interface between the operator and the power systems is through the control room instrumentation. Well-designed instrumentation systems can improve the understanding and proper response of the operators.

It is usual to appoint the key operating staff for a nuclear power station while it is still under construction, so they can advise from an operating point of view, and can assemble staff who will commission and operate the station. They also prepare a comprehensive set of operating procedures before the station is commissioned and allowed to operate. Design experts and regulatory personnel inspect these procedures for consistency of design intent and operating practices.

The staff are expected to operate the station systematically and rigorously in accordance with the operating procedures and work authorizations. The operating staff continually work to ensure public safety by conducting a comprehensive programme of testing and monitoring the safety systems and protective barriers, and by maintaining the ability to deal with any plant emergency. Where operators may have to take action in response to an alteration in the state of the plant, there are written, systematic procedures to guide them and to provide the detailed information needed to control the plant. Such procedures are reviewed by station and regulatory safety committees.

A well-thought-out operation safety management programme includes:

• detailed knowledge of areas critical to safety
• standards or targets that define acceptable performance
• a programme for monitoring performance, responding to problems and reporting results
• an experience review programme to establish trends, the degree of compliance with standards and the cause of any unacceptable or deteriorating performance
• a means of assessing the impact of proposed changes to hardware or operating procedures and implementing changes consistent with the accepted standard.

In addition to procedures for normal operation, there is an event-reporting system at each nuclear power station to investigate and document any failures and deterioration of equipment, shortcomings in design or construction, and operating errors detected by monitoring systems or regular tests and inspections. The basic cause of each event is determined so that the appropriate corrective or preventive action can be developed. Event reports, including the results of the analysis and recommendations, are reviewed by the station management and by experts in safety and human factors, who are usually based off the station site.

The International Atomic Energy Agency’s (IAEA) Incident Reporting System operates around the world to complement the national systems and ensure that information is shared among all participating countries. The World Association of Nuclear Operators (WANO) also provides a detailed information exchange at the operational level.

Nuclear reactors and all their auxiliary and safety-related systems are maintained and tested according to quality assurance requirements at planned intervals, to ensure reliability throughout their service life. In addition to automatic monitoring, there are systematic manual tests and investigations for evidence of impairment or failure of equipment systems. These include regular field surveillance, preventive maintenance, periodic tests and the study of changes in plant conditions.

Very demanding performance targets are set for process and safety systems to keep the risk to the public and station staff acceptably small. For process systems, which are actively operating while electricity is being generated, failure rates are compared to performance targets, which may result in design changes where performance is substandard. Safety systems need a different approach, because they come into operation only if process systems fail. Comprehensive test programmes monitor these systems and their components, and the results are used to determine how much of the time each of them would likely be out of service. The total amount of time the safety systems are calculated to be out of service is compared to a very high performance standard. If a deficiency is detected in a safety system it is put right immediately or the reactor is shut down.

There are also extensive tests and maintenance programmes during periodic scheduled shutdowns. For example, all pressure-bearing vessels, components and their welds are systematically inspected by non-destructive methods according to safety code regulations.

Safety Principles and Related Safety Design Features

There are four aspects of the fission chain reaction which could be dangerous and which cannot be separated from the use of nuclear energy to produce electricity, and therefore require safety measures:

1. Fission results in ionizing radiation, which requires shielding from direct exposure to radiation.
2. Highly radioactive fission products are created, requiring tight enclosures to prevent contamination of the external environment and possible ingestion.
3. The fission chain reaction is a dynamic process requiring continuous control.
4. The heat production cannot be instantly stopped, since radioactive decay continues to produce heat after the fission chain reaction is terminated, requiring long-term cooling.

The safety requirements which these characteristics demand account for the major differences in safety equipment and operating strategy in a nuclear station compared to those in a power-generating station utilizing fossil fuel. How these safety requirements are fulfilled differs for different types of nuclear stations, but the fundamental safety principles are the same in all nuclear stations.

During the licensing procedure, each nuclear installation has to prove that radioactive releases will be less than specified regulatory limits, both during normal operating conditions and in the event of faults or accident conditions. The priority is to prevent failures rather than simply to mitigate their consequences, but the design has to be capable of dealing with failures if, in spite of all precautions, they do occur. This requires the highest degree of quality assurance and control, applied to all equipment, construction functions and operations. Inherent safety characteristics and engineered safety measures are designed to prevent and control accidents and contain and minimize the release of radioactive materials.

In particular, the heat generation and cooling capacity must be matched at all times. During operation, heat is removed from the reactor by a coolant, which is pumped through piping connected to the reactor, and flows over the fuel cladding surface. In the event of loss of power to the pumps or sudden failure of the connecting piping, cooling of the fuel would be interrupted, which could result in a rapid rise in the temperature of the fuel, possible failure of the fuel cladding, and escape of radioactive material from the fuel to the reactor vessel. A rapid shutdown of the fission chain reaction, backed up by possible activation of standby or emergency cooling systems, would prevent fuel damage. These safety measures are provided in all nuclear stations.

Even when the reactor has been shut down, loss of cooling and failure of the standby or emergency cooling capability could result in overheating of the fuel because of the continuing fission product decay heat production in the fuel, as indicated in figure 2. While the decay heat is only 1% or 2% of the full-power heat production, if it is not removed, the fuel temperature could reach failure levels within minutes of complete loss of cooling. The principle of nuclear power plant safety design requires that all circumstances that could lead to fuel overheating, damage and release of radioactive materials from the fuel are carefully assessed and prevented by engineered control and protective systems.

Figure 2. Decay heat after reactor shutdown

To protect a nuclear power station, there are three kinds of safety features: inherent characteristics, passive systems and active systems. These are used in various combinations in operating nuclear stations.

Inherent safety characteristics make use of the laws of nature to keep the power plant safe. There are inherent safety characteristics of some nuclear fuels such that, as their temperature rises, the fission chain reaction rate is slowed. There are inherent safety characteristics with some designs of cooling systems whereby the coolant will circulate over the fuel by natural circulation to adequately remove the decay heat without operation of any pumps. There are inherent safety characteristics in most metallic structures that result in yielding or stretching under severe loads rather than bursting or failure.

Passive safety features include the lifting of dead weight (gravity) relief valves by the pressure of the fluid to be relieved, or in the use of stored energy in emergency coolant injection systems, or in some containment vessels which are designed to accommodate the energy from failure of piping systems and subsequent decay heat.

Active safety systems include all systems which require activating signals and a power supply of some form. Active systems can generally control a wider range of circumstances than inherent and passive systems, and can be tested without restrictions during operation of the reactor.

The safety design of nuclear power stations is based on a selected combination of inherent, passive and active systems to meet the regulatory safety requirements of the jurisdiction in which the nuclear station is located. A high degree of automation in safety-related systems is necessary to relieve operations personnel, as much as possible, of the need to take quick decisions and actions under stress. Nuclear power reactor systems are designed to adjust to changes in demanded power output automatically, and generally changes are gradual. It is particularly important that safety-related systems be continuously capable of responding promptly, effectively and reliably when required. To meet this high level of performance these systems must comply with the highest quality assurance criteria and be designed to the well established safety design principles of redundancy, diversity and physical separation.

Redundancy is the provision of more components or subsystems than are needed to just make the system work—for example, providing three or four components where only two are needed to function for the system to perform properly.

Diversity is the provision of two or more systems which are based on different design or functional principles to perform the same safety function.

Physical separation of components or systems which are designed to perform the same safety function, provides protection against local damage which could otherwise impair the performance of the safety systems.

An important illustration of the application of these safety design principles is in the electric power supply in nuclear stations, which is based on more than one connection to the main power system, backed up on site by several automatic-start diesels and/or combustion turbines, and by banks of batteries and motor-generator sets to ensure the reliable supply of electricity to the vital safety-related systems.

The basic preventive measure against release of radioactive materials from a nuclear station is very simple in principle: a series of leak-tight barriers between the radioactive materials and the environment, in order to provide shielding against direct radiation and containment of the radioactive materials. The innermost barrier is the ceramic or metallic fuel itself, which binds most of the radioactive materials within its matrix. The second barrier is the leak-tight, corrosion-resistant cladding. The third barrier is the primary pressure-bearing boundary of the coolant system. Finally, most nuclear power systems are enclosed in a pressure-resistant containment structure which is designed to withstand failure of the largest piping system within and to contain any radioactive materials released into containment.

The basic aim of the nuclear power station safety design is to maintain the integrity of these multiple barriers by a defence-in-depth approach which can be characterized by three levels of safety measures: preventive, protective and mitigative measures.

Preventive measures include: meeting the highest level of quality assurance during design, construction and operation; highly trained operators who undergo periodic retraining; utilizing inherent safety features; providing appropriate design margins; undertaking careful preventive maintenance, continual testing and inspection and correction of deficiencies; constant monitoring; thorough safety assessments and reassessments when required; and evaluation and causal analysis of incidents and faults, making appropriate modifications.

Protective measures include: fast-acting shut-down systems; responsive automatic pressure-relief valves/systems; interlock circuits to protect against false operation; automatic monitoring of vital safety functions; and continuous measurement and control of radiation levels and effluent radioactivity so as not to exceed allowable limits.

Mitigative measures include: emergency reactor cooling systems; highly reliable emergency feedwater systems; diverse and redundant emergency power systems; containment to prevent any radioactive materials leaking from the station, which is designed for a variety of natural and artificial stresses such as earthquakes, high winds, floods or aircraft impingement; and, finally, emergency planning and accident management, which includes radiation monitoring, informing safety authorities and advising the public, control of contamination and distribution of mitigating materials.

Nuclear safety does not only depend on technical and scientific factors; human factors play a very important role. Regulatory control provides an independent verification of all safety aspects of nuclear stations. However, nuclear safety is primarily ensured not by laws and regulations, but by responsible design, operation and utility management, which includes appropriate reviews and approvals by those with knowledge and authority.

The only nuclear station accident to have very serious consequences for the public occurred during a test of cooling capability in an unusual configuration in a RBMK nuclear station at Chernobyl in Ukraine in 1986. In this severe accident the reactor was destroyed and a large amount of radioactive materials escaped to the environment. It was subsequently found that the reactor did not have an adequate shut-down system and that it was unstable at low power. Design weaknesses, human error and lack of proper utility management all contributed to the accident. Modifications have been made to the remaining operating RBMK reactors to eliminate serious design weaknesses, and operating instructions have been improved to ensure there will not be a repeat of this unfortunate accident.

Much has been learned from the RBMK accident and from other less serious nuclear station accidents (such as the Three Mile Island accident in the United States in 1978) and from many minor accidents and incidents over more than 30 years of nuclear power station operation. The goal of the nuclear community is to ensure that no nuclear power station incident endanger the workers, the public or the environment. Close cooperation under such programmes as the IAEA Incident Reporting Systems and WANO, the scrutiny of industry groups and regulatory agencies, and vigilance by nuclear stations owners and operators, make this goal more attainable.

Acknowledgement: The editor thanks Tim Meadler and the Uranium Institute for providing information for table 1.

Back