《福島事件後龍門電廠（核四廠）壓力測試評估》

福島核災後龍門電廠（核四廠）壓力測試評估 Review of the post-Fukushima nuclear stress-tests of the Lungmen nuclear power plant (NPP4)

綠色和平東亞辦公室委托壓力測試評估報告 歐妲．貝克 漢諾瓦 2013 年 8 月

Study commissioned by Greenpeace East Asia Oda Becker Hannover, August 2013

主要作者：Dipl. Phys. 歐妲．貝克，漢諾瓦（德國）, oda.becker@web.de 協助：瑪格．帕特里夏．洛倫茨

Author: Dipl. Phys. Oda Becker, Hannover (Germany), oda.becker@web.de with Mag. Patricia Lorenz

1

摘要 臺灣原能會在 2012 年宣布將採用在歐盟實施的福島核災後壓力測試方式作為基礎，進行 臺灣核電廠的壓力測試。 如同歐盟，綠色和平邀請物理學家 Oda Becker 針對臺灣目前核能計畫的重點──核四廠的 壓力測試報告進行評估。此次評估中得到一個清楚的結論，若要改善反應爐目前的狀態以 把核災風險降至最低是有困難的。此外，再加上因福島核災後對於核四廠的核安升級建議 不甚明確，便已足夠構成充分的理由說明核四廠不應該繼續興建，直至最終取得運轉執 照。核四廠與臺北市的距離很近，因此不可能將 核四廠提升至相應合理的安全水準。如此 不可排除的核災發生時，將會造成數百萬人的災難。 本報告的第一章介紹臺灣核能發電的現況以及核四廠的歷史。 接著評析福島核災後歐盟執行的壓力測試程序，該程序為臺灣目前核安壓力測試的基礎。 福島核災的恐怖結果是由數十年來錯誤的安全管理原則所造成，強大核能工業壓力的影響 下，導致核能管制機構的安全規範極度鬆散，這問題不只存在於日本。該事件讓歐盟感到 震撼，促使歐盟深切的希望能對於核能及其相關安全性之問題有所改變，並且將絕對有可 能發生的意外事件，但以往因發生的機率很小而被忽略的事件均納入核安的考量之中。 針對此次事件的回應，歐盟進行了一系列的壓力測試，希望這些測試可以降低歐洲國家的 核災風險。此次壓力測試讓歐洲建有核電廠的國家開始著手訂立國家型行動計劃，就過去 兩年中所發現的缺失加以改善。綠色和平針對這些計劃進行評估，而評估結果指出，儘管 在壓力測試後歐盟國家已經大量投入與核能安全相關的安全升級，但許多關鍵的核安相關 的問題仍然未獲解決。另外，即使是目前已經在處理的問題，也需要再幾年的時間才能予 以修正，在此期間，歐洲人民仍暴露在核災風險之中。 針對歐盟壓力測試的批評包括：其測試廣度有限、缺乏明確標準、同儕審核（peer-review ）流程的侷限性以及參與的專家缺乏獨立性。歐盟管制機構之所以宣稱其壓力測試獲得最 高分，是因為這些國家即使知道自己的反應爐有缺陷，仍然打算持續運轉。公民組織的代 表及專家憂心，歐盟的壓力測試主要目的僅是用來提升歐洲核電管理部門對於核能安全的 信心，而不是真正探究核能本身已經或將會產生的問題。 第三章在描述臺灣壓力測試的設計和現狀。其中發現，臺灣的壓力測試重蹈歐盟壓力測試 中的缺失。本報告更進一步的聚焦於核四廠執行的壓力測試。 在臺灣，地震是重要的現實問題。目前的評估採用 400 年的地震歷史，並不足以當作為設 計基準地震（DBE）。歐盟的地震重現期建議以一萬年做週期計算。臺灣的核安管制機構 原能會沒有訂立出設計基準地震（DBE）的標準要求。核四廠 的耐震設計更被認定無法應 付設計基準以外的狀況。目前無法得知臺電在核四取得執照運轉前，是否會先改善原能會 所提出的缺失。 核四廠目前無法應付海嘯和極端氣候所導致的洪水風險。再者，目前的洪水設計所依據的 海嘯數據分析不夠充足，必須重新定義。 排水系統亦不足以因應歐盟建議的以每一萬年一次的極端降雨狀況，而僅能因應一百年一 次的極端降雨標準。壓力測試揭露了核四的危險性和斷崖效應（cliff edge effects），並且 顯示洪水可能會導致危險事故。 此外，政府間氣候變遷小組（IPCC）預測極端氣候發生頻率將增加的趨勢，核四廠亦未充 分考量。

2

這份評估結果點出幾項當核電廠遇到廠外電源喪失（off-site power losses）的情況時會有的 弱點。尤其在一些事故，如：地震或者極端天然災害發生時，並不能確保可以仰賴場外緊 急應變措施。目前臺電提出少數可增加緊急應變措施健全性措施，且該類措施需要額外的 人為手動啟用，而前述災害發生時，人為手動啟用很可能受阻。 缺少備用的最終熱沉（loss of ultimate hear sink），此為歐盟核電廠用以大幅減低最終熱沉 失效的風險的常見措施，但原委會僅為消極的建議臺電就此進行評估。目前提出的評估報 告中，於考量可能的意外狀況範疇時，一直都沒有充分地評估如果設備雙重故障（兩個反 應爐同時失效）或輻射外洩意外時該如何應變。 評估發現，嚴重事故的管理（SAM）也大有問題，包括：洩壓和反應爐壓力槽（RPV）失 效的問題。原能會皆未積極要求核四廠須具備圍阻體過濾排氣系統以及能防止氫爆的被動 式氫氣再結合器（PAR）。報告強調，嚴重事故管理（SAM）措施如果沒有做好將會使放 射性物質釋放到環境中。 近期較新式的進步型沸水式反應器已配有爐心捕集器（core-catcher），但核四廠卻採用舊 型進步型沸水式反應器的設計，無法得知若產生爐心熔穿效應（melt-through）發生時，是 否有足以因應。 針對發生重大事故時，放射性廢水水量的分析和防止其廢水洩漏到海中的管理措施不夠充 分。另外，有關重大事故中的用過燃料池的相關分析，與歐盟壓力測試報告中相同議題的 分析結果相比，極為不足。 斷然處置措施（Urgent Response Guidelines）裡實施的時機不適當，並且使人擔憂。經濟合 作暨發展組織（OECD）特別提出，若將斷然處置程序措施引（ultimate response guideline） 與緊急操作程序書（emergency operating procedures）、嚴重事故處理指引（severe accident management guidelines）及大範圍廠區受損救援指引（extensive damage mitigation guidelines ） 進行整合，將導致更多的困惑。 第四章闡述壓力測試以外的其他議題。部份內容主要取得於《遠見雜誌》2013 年 3 月對林 宗堯先生的專訪。報導指出核四廠在設備採購和設計修改時的缺失、核四廠不安全之處、 施工中所發生的事以及失敗的品質保證（QA）。儀控（I&C）系統架構相關的問題則涵蓋 缺乏傳統類比硬體接線（hard-wired）系統作為後備，此項後備系統目前在芬蘭和美國的歐 洲壓水式反應爐（EPR）為必要的設計。另外一個問題則是，試運轉流程並非由獨立的測 試人員進行，而是臺電公司自己的員工進行檢測。本章於結論中亦分析臺灣核能管理機構 --原能會是否能提供獨立性的有效監督與控管。 第五章分析比較新型歐洲進步型沸水式反應器（EU-ABWR）與核四廠所採用的過時進步 型沸水式反應器（ABWR）設計，並突顯一些未被解決的問題，包括：大型飛機撞擊防護 、被動式隔離冷凝器系統、爐心捕集器、被動式圍阻體冷卻系統，以及嚴重事故專用的電 源供應管理。 從第六章的總結中可得到清楚的評斷：就現有的天然災害而言，核四廠 具有設計上的弱點 以及在結構、系統與組件上的缺陷，這些缺陷不可能因改善而達到可被接受的安全層級。 因此，導致大量放射性物質外洩的嚴重意外是有可能發生。考量到核四廠與臺北市相距甚 近，若發生此類嚴重意外，數百萬人將會受災。 根據所列出的種種事實，建議終止核四廠計畫並且不讓核四廠運轉。 Oda Becker 2013 年於漢諾威

3

EXECUTIVE SUMMARY The nuclear regulator of Taiwan announced in 2012 it wanted to carry out nuclear stress tests of its nuclear park on the basis of the post-Fukushima nuclear stress tests carried out in the EU. Like in the EU, Greenpeace commissioned physicist Oda Becker to carry out an assessment of the stress test reports of a key project for the Taiwanese nuclear programme, the Lungmen nuclear power plant (NPP4). The review comes to the conclusion that it would be difficult to backfit the reactor in its current state so that it would meet state of the art risk reduction levels. Furthermore, lack of clarity about the proposed post-Fukushima upgrades should be sufficient reason not forward the project to final licensing. It is not feasible to bring the NPP4 to a safety level that can be justified facing the fact of its short distance to the city of Taipei. A severe accident, which cannot be excluded, would have disastrous consequences for millions of people.

In Chapter 1, this report provides an introduction into the status of nuclear power in Taiwan and the history of the Lungmen nuclear power plant, also known as the Fourth nuclear power plant (NPP4).

This is followed by a critical overview of the EU post-Fukushima nuclear stress tests that form the basis for those in Taiwan. The Fukushima catastrophe was the horrible result of decades of mistaken safety philosophy, a very lax safety regulation under strong industry influence on the regulators – not only in Japan. The first shock led in the EU to the honest wish to change this, to also involve events which are definitely possible but were kept out of the safety cases by using probabilities.

In response, the European Union carried out a series of nuclear stress tests, introduced as a transparent exercise to reduce the risk of nuclear energy in Europe. As a result, the countries with nuclear power stations worked out national action plans to address weaknesses that emerged during the two years of analysis. In spite of significant investments into safety upgrades following the tests1, many vital and known issues were, however, not addressed. Even problems that are being dealt with will take years to be remedied – leaving European citizens exposed to these risks in the meantime.

Criticism on the EU stress tests include its limited scope, the lack of clear criteria, the limitations of the peer-review process and insufficient independence of the involved experts.

While national regulators claimed receiving the highest scores for their stress tests, they intend to let reactors continue to run despite known flaws. This gave credence to the fear of representatives of civil society and independent experts that the stress tests were mainly set up to improve the confidence in the safety of the European nuclear power sector regardless of his findings.

In Chapter 3, the set-up and state of the Taiwanese nuclear stress tests is described. It is found that these stress tests repeat the flaws of the EU stress tests. It further concentrates on the stress tests of the Lungmen nuclear power station (NPP4).

1 The European Commission estimates the total costs of nuclear upgrades in the EU following the stresstests at around 25 Billion EUR; http://www.nytimes.com/2012/10/04/world/europe/safety-review-sayseuropes-nuclear-reactors-need-repair.html?_r=0

4

The issue of earthquakes is a crucial one for Taiwan reality. It is concluded that the current assessment of 400 years of earthquake history is insufficient for determining design based earthquake (DBE) criteria. Taiwanese nuclear regulator AEC does not give requirements for the return frequency of earthquakes for determining DBE, whereas the EU recommends one of 10-4 per annum. The seismic resistance of NPP4 is furthermore deemed insufficient in beyond design base situations. It remains unclear whether the already by AEC acknowledged shortfalls have to be remedied before the start-up license is received.

Flooding risks continue to be of unacceptable level both during tsunamis and extreme weather. The analysis for the design basis tsunami are inadequate and needs to be redefined.

Drainage systems are not sufficient to deal with the EU recommended standard of once in 10 000 years, but only once in 100 years extreme precipitation. The stress tests revealed dangerous weak points and cliff edge effects that show that flooding could result in a dangerous accident situation.

Also the preparation for an increase in extreme weather events as predicted by the Intergovernmental Panel on Climate Change (IPCC) is insufficient.

This review surfaces several weaknesses in meeting off-site power losses. Especially the reliance on off-site emergency services in some cases cannot be guaranteed in cases of an earthquake or extreme weather catastrophe. Envisioned measures to increase robustness are limited and need additional manual action, which might be challenging under extreme circumstances.

The lack of an alternate ultimate heat sink, a usual EU practice that could reduce risks of loss of ultimate heat sink (UHS) considerably, is only recommended by the regulator AEC for evaluation. Dual unit failure (both reactors failing at the same time) and accidents with the spent fuel have been insufficiently included in potential accident scenarios.

The study finds several important issues in severe accident management (SAM), including issues concerning depressurisation and reactor pressure vessel (RPV) failure.

The lack of a filtered containment venting system is criticised, as well as the lack of passive autocatalytic recombiners (PARs) to prevent hydrogen explosions and the fact that AEC does not aggressively prescribe these. The issue of SAM measures that would de-facto release radioactive substances into the environment is highlighted.

Where newer ABWR designs are equipped with a so called core catcher, it is not clear whether the measures for melt-through at NPP4, which is an older ABWR version, are sufficient.

Management of radioactive water amounts and leakage to the sea during large accidents are found insufficiently analysed. Accidents involving the spent fuel pools are in comparison with the already inadequate EU recommendations insufficiently analysed.

The implementation timing of the Urgent Response Guidelines (URGs) appear insufficient, and there exists concern, among others voiced by the OECD, that the proposed integration of emergency operating procedures (EOPs), severe accident management guidelines (SAMGs), and extensive damage mitigation guidelines (EDMGs) with the ultimate response guidelines (URGs) will lead to more confusion.

5

Chapter 4 highlights issues that are not addressed in the stress tests. This is largely based on a March 2013 special interview with Tsung Yao Lin by Global View Monthly. It points out shortcomings during procurement of equipment, design alternations, inadequacies in safety culture, incidents during the construction process and failing quality insurance (QA). Concerns regarding the information and control (I&C) system architecture include the lack of a hard-wired back-up as now required for the EPR reactor designs in Finland and the US. Problems during test-operation procedures created a situation in which not independent test operators, but TPC own operators carried out tests.

The chapter concludes with an analysis of the question whether the regulator AEC is sufficiently equipped to provide independent oversight.

In Chapter 5, the newer EU-ABWR is analysed and compared with the outdated ABWR design of the NPP4, highlighting several issues that remain unaddressed. This includes protection against impacts from large aircraft, a passive isolation condenser system, a core catcher, a passive containment cooling system and a dedicated power supply for severe accident management.

The conclusions in Chapter 6 lead to a final sobering judgment: Regarding the existing natural hazards, the design weaknesses and the deficiencies of the structures, system and components, it is not possible to retrospectively bring the NPP4 to an acceptable safety level. Therefore, a severe accident with a major release of radioactive substances cannot be excluded.

Considering the short distance of the NPP4 to the city of Taipei, such a severe accident would have disastrous consequences for millions of people.

Taking all facts into account it is recommended to stop the NPP4 project and to not commission this nuclear power plant.

Oda Becker Hannover, 2013

6

Table of Contents 1 Introduction ..............................................................................................................................8 1.1 Nuclear Power in Taiwan..................................................................................................9 1.2 Introduction Lungmen NPP ............................................................................................10 2 The EU stress tests .................................................................................................................12 2.1 Shortcomings of the EU stress tests ................................................................................12 2.2 Procedure ........................................................................................................................15 2.3 ENSREG´s results of the National Actions Plans...........................................................16 2.4 Discussion of the ENSREG´s results ..............................................................................17 2.5 Conclusion of the critical review of the EU stress tests..................................................18 3 Weaknesses the Taiwanese stress tests revealed ...................................................................21 3.1 Earthquakes .....................................................................................................................21 3.2 Flooding ..........................................................................................................................26 3.3 Other extreme natural hazards ........................................................................................30 3.4 Loss of all power supply (SBO) and ultimate heat sink (UHS) ......................................32 3.5 Severe Accident Management ........................................................................................36 4 Weaknesses the Taiwanese stress tests ignored .....................................................................43 4.1 Shortcoming during procurement of equipment .............................................................43 4.2 Many design changes ......................................................................................................44 4.3 Inadequate safety culture ................................................................................................44 4.4 Incidents during the construction process .......................................................................45 4.5 Insufficient quality assurance (QA) ................................................................................46 4.6 Concerns regarding the I&C System ..............................................................................47 4.7 Inappropriate test-operation procedures .........................................................................47 4.8 Role of the Atomic Energy Council (AEC) ....................................................................48 5 The EU-ABWR ......................................................................................................................50 5.1 Defence-in-Depth Concept .............................................................................................51 5.2 Technical realisation of DiD requirements .....................................................................52 5.3 Severe Accidents (DiD Level 4) .....................................................................................53 6 Discussion of the results and conclusions ..............................................................................55 7 References ..............................................................................................................................60 8 Abbreviations .........................................................................................................................63

7

1 Introduction One important lesson of the Fukushima accident is that nuclear accidents really occur – even in developed industrialised countries. The operation of nuclear power plants is always without any exception connected with the residual risk of an uncontrolled nuclear accident.2 Nuclear safety in the absolute sense does not exist. The expression “a nuclear plant is safe” only means that the residual risk is accepted [WENISCH 2012].

Taiwan has performed a stress tests exercise for its nuclear power plants largely based upon the EU stress tests model. In late 2012, Taiwan invited the European Commission to set up a peer review of these stress tests. Based upon this request, the Commission organised a review team by selecting volunteering experts from its ENSREG group as well as from its own Services. A nine-person team of nuclear safety specialists will conduct a peer review of the country's three operating nuclear power plants and the unit under construction (Lungmen NPP).

In April 2013, Greenpeace East Asia commissioned Oda Becker, a German nuclear expert, to prepare a critical review of the stress tests of the Forth Nuclear Power Plant in Taiwan (Lungmen NPP or NPP4).

These evaluations3 do not claim to be exhaustive, but the findings contribute to a more comprehensive understanding of safety and risk of the NPP4.

After a short general introduction about nuclear power in Taiwan, chapter 2 of this report gives an overview on the stress tests performed in Europe. It describes the shortcomings and limits of the stress tests specifications as well as the intermediate results (including a critical review) of the ongoing follow-up stress tests procedure.

Chapter 3 discusses the weaknesses of the NPP4 that have been revealed during the stress tests and the measures proposed by the operator (Taiwan Power Company – TPC) and national regulator (Atomic Energy Council – AEC) to remedy these weaknesses.

The construction of the NPP4 was accompanied with several problems. These problems result in safety issues which are out of the scope of the stress tests. The most important shortcomings are discussed in chapter 4.

2 The core melt probability of nuclear power plants is about 1: 100,000 per year and plant. This means a core melt probability in any plant around the world of about 1: 230 per year and a core melt probability of about 1:2500 per plant within an operation time of 40 years. But the accidents at Chernobyl and Fukushima proved that the real occurrence of accidents is not the same as the calculated probability.

3 The evaluations are based on the studies “Critical Review of the EU Stress Test performed on Nuclear Power Plants” published in May 2012 and the “Critical Review of the National Action Plan (NAcP); EU Stress Test performed on Nuclear Power Plants” published in April 2013 [WENISCH 2012; BECKER 2013].

8

To complete the picture, chapter 5 presents the design improvements of the EU-ABWR, which is the adaption of the reactor design of the NPP4 to the European market.

The last chapter discusses the findings and formulates conclusions.

1.1 Nuclear Power in Taiwan In Taiwan, there are currently three operating nuclear power plants (NPPs): Chinshan, Kuosheng and Maanshan, which are also called the first, second and third NPP, respectively. Each of these NPPs is equipped with two identical reactors. In addition, there is a nuclear power plant under construction, the Lungmen NPP (LMNPP), or the fourth NPP (NPP4), comprising two units. All the nuclear power plants are owned and operated by the state-owned Taiwan Power Company (TPC).

In 2012, the three operating NPPs provided 38.7 TWh or 18.4 percent of the country’s electricity (down from a maximum of 41 percent in 1988). Taiwan’s nuclear program has a certain number of very specific problems. The nuclear plants are located in areas with high population density, high seismicity and at risk from tsunamis. In addition, with the absence of a long-term waste strategy, the spent fuel pools are filling up and, in spite of re-racking and dense-packing, the first pools are expected to be full by 2014 [SCHNEIDER 2013].

In November 2011, the government presented a new energy strategy to “steadily reduce nuclear dependency, create a low-carbon green energy environment and gradually move towards a nuclear-free homeland” [WNN 2011a].

The new policy 4 states that the three operating nuclear power plants will not operate beyond their planned 40-year lives and that Taiwan's fourth nuclear power plant at Lungmen will not begin operation until all safety requirements are met. Furthermore, the island's oldest units at Chinshan (grid connection 1977 and 1978) will face early closure when both Lungmen units will start commercial operation. In parallel, Taiwan plans to accelerate its energy efficiency and renewable energy policy.

The Taiwanese public is increasingly critical towards the country’s nuclear power program, and on March 9, 2013 more than 200,000 people demonstrated in various cities against the start-up of the Lungmen plant. An opinion survey released in late March 2013 indicated that a 73 percent majority is in favor of stopping the construction of the Lungmen plant.

In fact, in recent years the Taiwanese anti-nuke campaign has grown from minor or rare social events to a new major movement. On May 28, 2012, movie directors Yi Cheng Ko and Li Ren Dai have initiated the “I am human being and I refuse nuclear power” 4

The new policy is in line with Article 23 of the Basic Environment Act, which directs the government to make plans that will eventually see Taiwan become nuclear-free.

9

campaign. They made use of the traffic light and arranged a big “human being” in Chinese characters on Ketagalan Boulevard, right in front of the presidential office building. This received a sizeable response.

While performing at Golden Melody Awards in 2012, influential band Mayday also showed their stance by shining “I am human and I refuse nuclear power” LED lighting on stage. Other famous entertainers have also publicly stated their anti-nuke attitude.

1.2 Introduction Lungmen NPP The Lungmen nuclear power plant (LMNPP) or the Fourth nuclear power plant (NPP4) facing the Pacific Ocean is located at an inward bay area of northeast Taiwan. The site is situated only approximately 40 kilometres east of Taipei city. About 1.5 million people are living in the the 30-km-radius of the site and about 9.14 million people are living in the 75-km-radius [NATURE 2011].

The NPP4 comprises two units. The reactor type used is ABWR (Advanced Boiling Water Reactors).

Since the Atomic Energy Council (AEC) issued a construction permit for the fourth nuclear power plant in March 1999, the plant has remained a highly controversial issue5.

On October 27, 2000, Taiwan’s cabinet ordered a halt to the construction of the Lungmen NPP. The decision was taken by the ruling Democratic People’s Party (DPP) and was opposed by the opposition Kuomintang (KMT) [NEI 2000a]. The project restarted in 2001 after a legal appeal and a government resolution in favor of the plant.

In 2005, it was announced that commissioning of the plant would be delayed to 2009 from the original schedule of 2006 – 2007. Rising oil import costs and a local economic slowdown had apparently affected investment in the project, which in turn affected the construction progress. The units were put on track for completion in 2011 and 2012 by a funding decision in March 2009 [WNN 2011c]. In May 2012, media reports gave 2014 – 15 as the currently planned start-up date.

TPC anticipates that at least 40,000 million NTD need to be added in 2013, which means the overall budget for NPP4 is likely to top 320,000 million NTD.

In February 2013, the budget was temporarily frozen. According to the Atomic Energy Council (AEC), the first unit was nearly finished and operator TPC was presently carrying out on-site testing of operating procedures and systems functions by April 2013.

5

This was the same with the history of the NPP4: TPC has presented the plan to construct NPP4 in May 1980. However, in July 1986 the budget was frozen. In February 1992, the Ministry of Executive approved to resume implementation of the NPP4 plan. In May 1996, Legislative Yuan passed a bill to abolish all NPP programs, including stop constructing NPP4. In October 1996, the Legislative Yuan passed a re-vote bill to nuclear abolition proposed by Executive Yuen.

10

On April 26, 2013, the ruling party introduced a bill in the legislature to organize a national referendum over the future of the Lungmen project. What appears to be an exemplary exercise of democracy is seen by many as a manoeuvre to get a silent majority for the project’s completion. The referendum legislation requires a quorum of at least 50 percent to make the outcome binding, a score difficult to achieve nationwide [SCHNEIDER 2013]. All six national referendums held so far in Taiwan have failed to reach the 50 percent turnout threshold [NW 27/06/13].

11

2 The EU stress tests The March 2011 accident at the Fukushima Daiichi nuclear power plant (NPP) proved that it was not justified to exclude highly unlikely accidents from happening. In a prompt reaction to this catastrophic accident, the European Council concluded on 25 March, 2011 that the safety of all European (EU) nuclear power plants should be reviewed on the basis of a comprehensive and transparent risk and safety assessment ("stress tests"). The European Nuclear Safety Regulators Group (ENSREG) took over this task.

However, two months later the scope of the EU stress tests was reduced: The EU stress tests were defined as a targeted reassessment of the safety margins of nuclear power plants developed by ENSREG, with contributions from the European Commission. The EU stress tests comprise three topics: (1) External Hazards, (2) Loss of Safety Systems and (3) Management of Severe Accidents.

The idea of a comprehensive risk assessment of the European power plants was not the intention any more. The specifications of the ENSREG stress test do not provide a method for comparing the safety of the different plants, nor does it answer how safe European plants actually are.

2.1 Shortcomings of the EU stress tests It is important to underline that the EU stress tests cannot be understood as a comprehensive safety check of the NPP in Europe. The EU stress tests did not take into account all key safety issues, thus the scope of these tests was not designed to deliver a comprehensive risk assessment.

Representatives of civil society and independent experts were pointing out that the stress tests were mainly set up to improve the confidence in the safety of the European NPPs.

In advance to the EU stress tests Wolfgang Renneberg, former head of the Reactor Safety Department of the German Federal Environment Ministry, analysed the specifications of the EU stress tests and published his results in a study commissioned by the Greens in the European Parliament. According to his study, the EU stress tests cannot assess the safety of the European nuclear power plants and therefore cannot serve as basis to decide which nuclear power plants need to be shut down. The stress tests will not provide information about the reliability of plant safety measures to prevent postulated failures of the safety systems or about all those other scenarios and serious events that could lead to a severe accident [RENNEBERG 2011].

The specifications and the procedure of the EU stress tests have the following important shortcomings and limitations [WENISCH 2012]: 12

Limited scope  The scenarios that are under review are incomplete. Accident scenarios and failure modes typical for e.g. an airplane crash or internal fire, human failure including combinations of those events that until now have not been under consideration, are not covered by the stress tests.  Particularly an air plane crash is not considered in the frame of the stress tests.

ENSREG regards this scenario under the terms of security and therefore claims not to be competent to include it in the stress tests.6 This is an evidently misleading argument. The fact that air planes might crash on a nuclear power plant is completely independent of its cause and it might therefore happen without any terrorist background. An airplane crash has to be considered as a relevant safety issue.  Obviously, it is always better to prevent accidents from happening than to deal with the consequences of an occurred accident, but safety features of the plant that are needed to prevent an accident are only partly under review.  The quality of the plants’ safety-related systems and components, such as the material of pipes, reactor vessel, valves and pumps, control and instrumentation equipment are not investigated in the stress tests. This issue is of particular concern for NPP4.  Ageing effects of structures, systems and components (SSCs) are not considered in the stress tests. The tests take no account of degradation effects, even though these could significantly aggravate the development of an accident caused by an external event. Ageing-related incidents have the potential to trigger, but particularly to aggravate accidents sequence.  The stress tests take for granted that all the SSCs assessed are in place and without fault, but the operational experience shows this is not the reality. Incidents caused by defective mounting or forgotten scrap etc. are possible. This issue is of particular concern for NPP4.  The stress test specifications require descriptions of the plant properties, but requirements on the quality and the comprehensiveness of the descriptions are not defined. So far as the specifications rely on the licensed design and its safety case, they rely on aged criteria and methods.  The safety management of nuclear power plants, which is of acute importance, is not included in the stress tests.

6

Risks due to security threats are not part of the mandate of ENSREG and the prevention and response to incidents due to malevolent or terrorists acts (including aircraft crashes) involve different competent authorities, hence it is proposed that the Council establishes a specific working group composed of Member States and associating the European Commission, within their respective competences, to deal with these issues [ENSREG 2011].

13

 Another important area of special attention regarding the safety of nuclear power plants, the quality of personnel training, is not included in the stress tests.

Lack of criteria  One of the major weaknesses is the lack of definition in the stress test specifications, what level of safety should be achieved if the plants should be back-fitted or should be shut down. Any criteria that define the required robustness of a plant are missing.

This fact makes it very difficult for politicians and the public to assess the safety level of the plant.7 Limited peer review process  To enhance the credibility of the stress test process, the national reports will be subjected to a peer review process. The complexity of data, of calculation methods, of assumptions about the safety parameters and their interdependence within the system of a nuclear power plant is extremely high. Regarding the short time frame (about three months) and the immense workload, it is not possible to perform a well-founded peer review process.

Insufficient independence of the involved experts  The operators´ reports are the most important basis for the final national report and the assessment of the safety of the plant. For obvious reasons, the operators cannot be considered independent: It is in their interest to demonstrate that a plant does not require costly back-fitting measures.  The national stress test reports are written be the national nuclear authority. In the past, those experts and their technical support organisations legitimated the operation of the power plants under their supervision and they informed the public that the plants were operating safely. Conducting stress tests makes them review their own practice and their own statements about safety and about acceptable risks.  Almost none of the other experts involved in the peer review process is really “independent”. Beside the members of those countries without nuclear power plants the ENSREG consists mostly of the chairpersons of the nuclear authorities of the countries operating nuclear power plants. Realistically it is necessary to expect that this peer review process will identify only evident deficiencies. Furthermore, criticising colleagues within an official process whose results shall be open to the public is difficult.

7

The German Reactor Safety Commission has defined four levels of robustness in the frame of the German stress test. The basic level is chosen as a level that must be fulfilled by all operating plants, taking into account that all plants meet the licensing conditions and have realised all back-fitting measures required by the authority. Each of the three levels of robustness defines a specific larger kind of safety-margin.

14

Considering the limited scope of the stress tests, the missing of clear assessment criteria, and taking into account the interests of the involved experts, reports might serve mainly to demonstrate to the public that the plants are operating safely.

Nevertheless, the stress tests could serve as a first assessment of the plants´ capability to withstand several external events. One important new feature which has now been introduced is the evaluation of the so-called “cliff edge effects”: A cliff edge effect describes a qualitative degradation of the plant’s safety conditions (comparable to walking on a cliff and the next step fall down). The tests may result in technical and organisational recommendations to be better prepared in the case of such accidents.

2.2 Procedure The first phase of the EU Stress tests started in June 2011 – the operators of the NPPs prepared a self-evaluation of their plants. Licensees had to provide a final report by October 31, 2011.

In the second phase, the national regulator reviewed final reports submitted by the operators. All final national stress test reports were handed over to the EU Commission

by December 31, 2011.

Then the third phase started: the peer review process, which was conducted by experts nominated by the national states to review the national reports. The peer review was completed with a main report that includes final conclusions and recommendations at European level regarding the three topical parts and 17 country reports including countryspecific conclusions and recommendations. The report was published by the ENSREG on April 26, 2012.

In June 2012, when the ENSREG report was presented to the European Council, the EU Commission did not see the Council mandate for the stress tests fulfilled and demanded further testing; six additional so-called fact-finding visits were undertaken. Those followup reports were published in late October 2012.

To implement the stress test findings, an ENSREG action plan (published in August 2012) was developed to track implementation of the recommendations. In October 2012, ENSREG published a compilation of recommendations to assist the preparation as well as the review of National Action Plans (NAcPs).

In line with the ENSREG action plan, each national regulator had set up a NAcP to remedy the identified shortcomings during the EU stress tests and published it by the end of 2012. In January 2013, the NAcPs were published at the ENSREG website. Despite the fact that all participating countries are strongly committed to the issue of transparency, only about half of them posted the NAcP in their national language on a dedicated website.

15

The ENSREG action plan specified the need to peer review these NAcPs via a common discussion at a dedicated ENSREG-workshop to share lessons learned on the implementation of post-Fukushima safety improvements. This ENSREG-workshop to discuss the NAcPs took place in Brussels on 22 – 26 April 2013.

It was the intention to present the outcomes of the workshop to the public in the following ENSREG conference on June 11 and 12, 2013. However, the presentation was very general, no country-specific shortcomings were explained. One of the key objectives of ENSREG to improve the overall transparency on issues relating to the safety of nuclear installations was not at all fulfilled.

2.3 ENSREG´s results of the National Actions Plans During the EU stress test process, all countries identified the need for analysis, hardware improvements, procedural modifications and regulatory actions, and corresponding implementation schedules in their National Actions Plans (NAcPs). In a number of countries significant safety improvement programmes had been completed or were ongoing prior to the Fukushima accident. On-going programmes were updated to reflect the ENSREG recommendations and new plans were prepared. Further national review is still pending, on the basis of on-going investigations and analyses, and may lead to additional measures [ENSREG 2013].

The ENSREG summarised the following observations after review of the NAcPs:  In all countries, a variety of additional mobile equipment like pumps, diesel generators, air compressors and other equipment has already been procured.  Some countries are planning new, permanently installed and partly bunkered systems to ensure the decay heat removal from reactor core and spent fuel pools, while most countries rely more on mobile equipment to ensure decay heat removal from reactor core and spent fuel pools in case of extreme situations and loss of the safety systems.  One of the main issues is the definition of robustness, i.e. the scope of the safety margins beyond design basis. The question is how robust the equipment necessary to cope with beyond design situations has to be.  Maintaining containment integrity under severe accident conditions remains an important unresolved issue for the accident management.  Filtered containment venting to prevent containment overpressure has already been implemented in certain countries. Some other countries are now implementing the Filtered Containment Venting System (FCVS) while others are considering improving the existing ones. Several countries, but in particular those with small reactors, are implementing or analysing different complementary technical measures for long-term heat removal from the containment.

16

 As a reaction to the Fukushima Daiichi accident many countries are now installing Passive Autocatalytic Recombiners (PAR) to manage hydrogen in the containment to cope with beyond design basis accident conditions or are reconsidering their number and position.  Studies necessary to re-evaluate the Severe Accident Management (SAM) strategy taking into account the Fukushima lessons have to be performed. This will take several years and a lot of money, because conducting experiments in the field of severe accidents is very complex. Enhancing international exchanges on research and solutions on molten core cooling and stabilisation are necessary.  One important issue is the provision of the necessary resources and arrangements to cope with simultaneous severe accidents on several installations of the same site in the context of regional devastation resulting from a natural disaster.  The qualification of instrumentations used during severe accident conditions especially in the long term is another issue.  Also, the dealing with large volumes of contaminated water remains an unsolved issue.

2.4 Discussion of the ENSREG´s results As main results of its peer review process, the ENSREG concluded in April 2012 that all countries have taken significant steps to improve the safety of their plants, with varying degrees of practical implementation [ENSREG 2012a].

The April 2013 ENSREG peer review workshop to review the nation actions plans concluded – and that was its only actual result – that a follow-up peer review would be valuable by providing an opportunity for exchange of information among participants.

According to the ENSREG, such a follow-up peer review could be conducted in 2015 or later when the results of important studies and assessments are available.

The key issue, which is still open, is how comprehensively these follow-up peer reviews of the NAcPs will be conducted. This might be seen as the last opportunity to force the nuclear regulators to formulate mandatory requirements which need to be fulfilled in a rather stringent time schedule – in contrast to the years or even decades currently planned in many countries. This could make operators decide to shut down old and unsafe nuclear power plants instead of investing into extensive modernisation measures. From today´s point of view it cannot be assumed that the ENSREG would chose to act this way.

It is very disappointing what happened with the alarming findings of EU stress tests.

Despite the fact that the stress tests revealed a number of shortcomings regarding the plants´ capability to withstand several external hazards and the lack of possibilities to

17

cope with the consequences, the outcomes of the peer review consist only of recommendations for “further improvements”.

The fear of representatives of civil society and independent experts that the stress tests were mainly set up to improve the confidence in the safety of the European NPPs regardless of his findings becomes true.

Until now, the ENSREG does not assess, but only describe the shortcomings of the European NPPs. The country stress test reports do not formulate any overall conclusions – not even if a specific NPP has shortcomings similar to those at the Fukushima NPP. However, this is insufficient to use as a basis for deciding on the future of a NPP. A comprehensive assessment taking into account all facts is necessary for the politicians and the public to decide about the risk for people and environment.

During the stress tests peer review, the ENSREG did not look at the current safety level of the European nuclear power plants, but the potential increase of the safety level in the next decade. Furthermore, the ENSREG has not defined or even recommended any time schedule for the implementation of the required measures.8 The operation of dangerous NPPs is ongoing.

The ENSREG summary of the current status of the National Action Plans (NAcPs) again only describes the plans’ weaknesses. An assessment of the sufficiency to remedy the dangerous situation is not provided. The ENSREG avoids mentioning, whether the NAcPs are sufficient to amend the dangerous situation if completely implemented.

2.5 Conclusion of the critical review of the EU stress tests The Fukushima catastrophe was the horrible result of decades of mistaken safety philosophy, a very lax safety regulation under strong industry influence on the regulators – not only in Japan. The first shock led to the honest attempt to change this, to also involve events which are definitely possible but were kept out of the safety cases by using probabilities [BECKER 2013].

On October 12, 2012, Tokyo Electric Power Co (TEPCO) admitted that the company had failed to prevent the Fukushima accident, reversing its earlier statement that the accident could not have been foreseen. TEPCO attributed those facts to multiple root causes: First, the management assumed a severe accident was extremely unlikely to occur in Japan, and feared that retrofitting safety systems would increase anxiety among the public, especially among the residents near the plant and would require a costly shutdown period [NW 18/10/12].

8

The ENSREG does not have a regulatory mandate. To define, require and monitor the implementation of safety improvements stays in the competence of the national regulatory authorities, who are members of the ENSREG. 18

The risk of natural hazard exists to a different extent for all European NPPs, but like in Japan the operators insist on the low probabilities to avoid high investments and antinuclear activities of the public.

The EU tried to respond to this “new experience” of Fukushima by conducting the stress tests and hoping that the results will lead to higher safety. It is evident, however, that some countries treated this task rather as a formality or paperwork than a plant safety upgrade program.

In general, there are different possibilities for operators and nuclear authorities to deal with the shortcomings the stress tests revealed:  A quick response, but without any guarantee that the measures are sufficient (e.g.

Cernavoda NPP, Romania).  A comprehensive evaluation of possible hazards and protective measures, which will take more than ten years (e.g. France).  Business-as-usual (e.g. Dukovany, Czech Republic), i.e. the idea of the stress tests is more or less ignored; the already on-going (insufficient) back-fitting programs are listed within the NAcPs. However, none of these options increases the nuclear safety to an acceptable level. The very obvious solution – permanent shutdown – needs to be considered and is in several cases the only safe option. One of the major problems of the stress tests is the lack of definition what level of safety (robustness) should be achieved or in which cases the plants should be back-fitted or shutdown, thus the peer review process does not provide any advice for this decision.

To which extent the envisaged measures will improve the safety level is in particular an economical issue. Better protection will result in higher costs. However, to improve the safety level in an area prone of seismic or flooding hazards is also a technical issue.

Necessary safety levels could not be achieved subsequently.

However, the operators are heavily relying on the new magic solution to severe deficiencies at the plants due to design or the site: mobile equipment, which is easy to plan and store in the plant and therefore a cheaper solution than the installation of new systems protected against external hazards. Mobile equipment is presented as the solution to compensate deficiencies of the reactors and the spent fuel pools. But under severe accident conditions, it is very unlikely that the proposed mobile equipment can be put to work as quickly as necessary; to rely to such a large extent on manual actions is irresponsible in regard of the consequences of a severe accident [BECKER 2013].

Furthermore, the new mobile equipment is useless if the staff response during the accident is not perfectly according to plan. Not only the “know-how” but also the “know19

why� is very important. This is an important lesson learnt from the Fukushima accident, which should result in the implementation of passive safety systems designed to withstand beyond design accidents with appropriate safety margins.

Thus, the authors concluded: Up to now, no lessons learnt from the accident at Fukushima. At all European nuclear power plants severe accidents can occur – any time [BECKER 2013].

20

3 Weaknesses the Taiwanese stress tests revealed Taiwan has performed a stress tests exercise for its nuclear power plants largely based upon the EU stress tests model. The stress tests report has been written by the licensee, the Taiwan Power Company (TPC), for the operating units and the units under constructions (NPP4). These reports were submitted to the regulator, the Atomic Energy Council (AEC) for review. The AEC prepared a national stress tests report (NR) documenting the results of its review. The NR was published in May 2013 [AEC 2013].

Building on the results of the stress tests and insights from the actions being taken by other countries, on November 5, 2012, the AEC established requirements to implement enhancements. These requirements were embodied in regulatory orders issued by the AEC to TPC. However, these requirements are non-binding requirements. TPC may propose alternatives subject to AEC approval. Additionally, at the end of each chapter of the national stress tests report, the AEC formulates several general requirements. For none of the requirements any time schedule for implementation is set.

This chapter presents a review of the safety issues of the fourth nuclear power plant based on the stress tests reports. The following chapter is mainly based on the information provided by the national stress tests report. Some information provided in TPC´s stress tests report of Lungmen NPP is also presented [TPC 2013].

In spring 2013, a peer review of the stress tests has been conducted by a six-person team assembled with the involvement the Organization for Economic Cooperation and Development (OECD) and the Nuclear Energy Agency (NEA). The NR and three stress test reports of the operating nuclear power plants were provided to OECD/NEA experts in January 2013 [OECD 2013]. Some of the findings of the OECD/NEA report published in April 2013 are included in the following chapter.

3.1 Earthquakes Taiwan is located at a complex juncture between the Eurasian Plate and Philippine Sea Plate, where earthquakes occur frequently. Due to the collision of these two plates, the eastern part of Taiwan moves toward northwest at a rate of about 2.5 – 8.0cm/year.

Hence, the seismic design of structures, systems and components (SSCs) of nuclear power plants in Taiwan is an important issue [NEI 2009a].

Although Taiwan is prone to earthquakes, up to now, the country has not experienced an earthquake strong enough to challenge the seismic design of its nuclear power plants. The biggest earthquake in 100 years, the magnitude 7.3 Chi-Chi quake on September 21, 1999, had no impact on the three existing plants, supposedly only due to the great hypocentre distance [NEI 2009a].

21

Seismic hazard evaluation The Lungmen nuclear power plant site is located in a high seismic risk zone, thus earthquakes are an important hazard for the plant. To determine the Design Basis Earthquake (DBE), the historical earthquake records of the past 400 years of the area within a 320 kilometres radius of the site were collected. In 1992, the DBE was determined based on the assumption that an earthquake of a local magnitude of 7.3, which occurred in east of Taiwan in 1908, happened 5 kilometres east of the site. The calculated values of peak ground acceleration (PGA) of this earthquake are between 0.23g and 0.41g. The PGA of the DBE for the NPP4 is determined to be 0.4g.

Historical records for only 400 years are a rather brief period to assess the possible earthquake intensity. But the use of paleoseismic investigations for determining the DBE is not mentioned.9 In 2004, the Taiwan Power Company (TPC) contracted a project10 to study the possible earthquake hazards of NPP4. The results showed that the 0.4g DBE is still adequate. But now this evaluation is nearly 10 years old, and thus outdated. Re-evaluation of seismic hazards for any site nearly always shows that the earthquake hazard was underestimated.11

The OECD/NEA group pointed out that it is clear that historical data can only be used as supporting information for seismic hazards, because of the lack of a sufficiently long seismological catalogue. The major source of information should come from the seismotectonic characterization of faults12 [OECD 2013].

Aybars Gurpinar, a consultant on earthquake resistance with more than 20 years experience with the IAEA and responsible for the review of the seismic hazard evaluations, questioned TPC's position that its nuclear power plants only needed to withstand an earthquake with a magnitude of 8.1 – 8.2. These values were used during the stress tests and were developed based on a general country wide investigation of the seismic hazards. The expert emphasised from the discussions with TPC it was not clear whether there were sufficient tectonic arguments to use the countrywide seismic values [OECD 2013].

9

10

11

12

Paleoseismology looks at geological sediments and rocks for signs of ancient earthquakes. It is used to supplement seismic monitoring, for the calculation of seismic hazards.

“Re-analysis and evaluation of Earthquake Threats to the NPP4 Site”(National Centre of Research Institute) On December 26, 2006, two consecutive strong earthquakes – both with a local magnitude of 7.0 – hit the most southern part of Taiwan, Hengchun village, where the Maanshan nuclear power plant is located. It was the strongest earthquake ever experienced by Taiwan’s existing nuclear power units, and it raised public concerns about the seismic safety of the nuclear power plant. Before the Hengchun earthquake, the determined maximum potential earthquake in the subzone to which Maanshan belongs was 5.9 [NEI 2009a].

This includes the dimensions of the fault (length, down-dip, width), orientation (strike, dip), amount and direction of displacement, rate of deformation, maximum historical intensity and magnitude, paleoseismic data, geological complexity (segmentation, branching, structural relationships), earthquake data and comparisons with similar structures.

22

A lesson learnt from the Fukushima accident is that countrywide investigations do not provide sufficient details that are needed to appropriately consider the seismic and tsunami hazards for nuclear power plants. Thus, site-specific investigations are necessary, but not available yet.

The expert stated in the context of a site-specific seismic hazard analysis, it may be necessary to revise maximum magnitude values for faults. He suggested a value of 9.0.

This was the magnitude of the Tohoku earthquake of 2011 that triggered the Fukushima accident [OECD 2013].

One of the most important weaknesses is the lack of calculation of the return frequency for earthquakes, which is crucial for determining the DBE. The return frequency was an important approach to assess the adequacy of the evaluation of the DBE in the frame of the EU stress tests. The use of a return frequency of 10-4 per annum is recommended by the ENSREG [ENSREG 2012b].

The AEC required to perform an updated and thorough seismic evaluation and to take every measure needed to fulfil the ENSREG stress test requirements. A re-analysis of the seismic hazard curve is to be conducted to see whether the annual exceedance frequency of current DBE is adequate. However, there is no specific AEC requirement regarding the return frequency.

Seismic resistance of the NPP4 According to TPC, all safety related-systems, structures, and components (SSCs) as well as their subsystems can sustain integrity and assure their safety function during a DBE; also indirect effects of a DBE (as internal flooding) are no hazards for the plant.

After the Fukushima accident, TPC initiated a re-inforcement action plan (RAP) to improve the seismic resistance of equipment under severe earthquake conditions. The installation of seismic resistance pipes connecting the ground floor of the reactor building to the water source to make-up water to the spent fuel pool (SFP) is planned. Also, the water level and temperature instrumentation of the SFP has to be improved.

The evaluation of seismic margins revealed that the off-site power supply is the weakest seismic capacity equipment. According to TPC, the off-site power gets lost due to an earthquake with an intensity above 0.3g, which is even below the DBE. TPC pointed out there are four successful paths to achieve reactor core long-term heat removal.

For the successful path 1, all the necessary safety functions for the unit normal cold shutdown paths via a residual heat removal (RHR) system can be successfully performed.

The emergency diesel generators (EDGs) provide the AC power for the important equipment. The medium seismic withstanding value is 2.0g. Thus, the calculated safety 23

margin is 1.6g compared to the DBE. This value is pretty good. However, there are doubts about the reliability of the structures, systems and components (see chapter 4).

For the three other successful paths, when the RHR system is unavailable due to earthquake, the fire water system has to provide the reactor core long-term cooling. The seismic withstanding value of the fire water storage tank (1.1g) is the lowest, but a substantial improvement of the fire water storage tank is not feasible. Instead, TPC is considering modifying the interface of the fire water and raw water systems. Thereby, the raw water can be introduced directly into the intake pipe of the fire water pump.

According to TPC, the raw water reservoirs can provide a stable water supply to the fire water system after an earthquake. The raw water reservoir is located on the west side flat hills with 116 meters of elevation, 112 meters long and 63 meters wide. The volume of water storage is 48,000 m続. However, the raw water reservoir is only designed not to collapse during DBE. Its capability against an earthquake with seismic intensity higher than 0.4 g is probably very limited.

If an earthquake occurs with an intensity exceeding the DBE, the structure of the raw water reservoir may collapse due to structural crack. According to TPC, however, the leakage is limited (maximum peak leakage flow of 46.6 m続/s), and the flood is transported to the downstream of marine outfall. Thus, a reinforcement of the raw water reservoir is not envisaged.

But the leakage of the raw water reservoir can obviously threaten the safety of the plant, because the water needed to cool the reactors and the spent fuel pools during an accident will flow out.

The AEC required upgrading the seismic resistance of the raw water reservoir. This is to be appreciated. However, until now it is not known whether this reinforcement will be performed, i.e. whether it is technically and economically feasible.

According to the NR, only the direct effects of earthquakes beyond the design basis are considered, but also indirect effects have the potential to endanger successful paths.

Indirect impacts of earthquakes are internal flooding due to pipe-breaks, fires due to the release of flammable substances or impacts due to damage of non-seismically qualified components. This is an additional reason why it is not completely credible that the plant could withstand a beyond design basis earthquake.

However, the envisaged measures to increase the seismic margins of the plant are very limited. It is intended to shorten the time needed to establish the fire water system: The operator must manually open at least two isolation valves, which are located in equipment channel C of the reactor building. In addition, the operator must manually 24

open the electric valve. It is also planned to shorten the decision making process by making clear guidelines. However, the main problem is not solved at all: manual actions of the operator are necessary.

On July 16, 2007, in Japan, where the earthquake focal mechanisms are very similar to those in Taiwan, all seven reactors at the Kashiwazaki-Kariwa site were struck by the 6.8 magnitude Niigata Chuetsu offshore (NCO) earthquake. The location and magnitude of this earthquake has never been expected in the design of the plant. Some 63 incidents were confirmed, including a release of radioactive iodine through the main stack at unit 7, which is the same reactor type (ABWR) as the units of the NPP4. The safety margin of the plant’s SSCs prevented a severe accident after the hit of the earthquake; however, failures of some non-safety SSCs caused unexpected damages to the plant13 [NEI 2007a; NEI 2009a; WNN 2009a].

One important lesson learnt from the NCO earthquake is that a well-protected nuclear power plant should have substantial seismic margin. It is not clear from the NR, whether a comprehensive seismic Probabilistic Risk Assessment (PRA) has been performed for NPP4. If not, this would be an important approach to provide insights that are necessary to develop backfitting measures to obtain seismic margins.

The AEC considers that the resulting action plan of TPCs seismic re-assessment is adequate, but pointed out that the schedule should be more efficient and speeded-up.

Thus, the question comes up, how the schedule is set, in particular, could operation start licence before the re-assessment and the necessary improvement measures are done?

Additional to the limited upgrading measures envisaged by TPC, the AEC required a seismic upgrade of the plant fire brigade building structures. This is very crucial, because of the important tasks of the fire brigade to cope with an accident. Also, necessary functionality upgrades of the emergency response facilities and the enhancement of the power durability of seismic monitoring sensors are needed.

The reinforcement of the structures of the Technical Support Centre (TSC) is required, which is not able to withstand an earthquake yet. In addition, the AEC’s Department of Nuclear Technology is requesting TPC to consider building a seismically isolated TSC based on the practice being implemented in Japan in the light of the Fukushima accident.

However, establishment of a TSC that could be very useful during an emergency regarding the protection of the people should only be considered, and thus probably not built.

13

The unit 7 was restarted after almost 22 months of checks and repairs.

25

3.2 Flooding The Fukushima accident highlighted the hazard of flooding events for nuclear power plants. One of the main questions after the Fukushima accident was the predictability of the wave height of the tsunami. In 2008/2009, two studies regarding the tsunami hazard were performed on behalf of TEPCO.14 Accordingly, the calculated wave heights at the intake points at Fukushima Daiichi NPP were 9 to 10 meters.15 Thus, TEPCO knew that the implemented protection (against wave height of about 6 meters) was not sufficient.

But nevertheless the wave height of the tsunami which triggered the Fukushima accident (14 meters) was not to be expected. Thus, for all NPPs that are threatened by tsunamis, safety margins of at least 6 meters are to be considered.

Note, according to TEPCO´s post-Fukushima stress tests report for unit 7 of the Kashiwazaki-Kariwa 16 , after additional safety measures, the allowable tsunami height over the 3.3 meters design basis is 15 meters [NEI 2012c].

Generally, the expected main effects of flooding – that could all threaten the NPP4 – are as follows [IAEA 2003]: 

The presence of water in many areas of the plant may be a common cause failure (CCF) for safety-related systems, such as the emergency power supply systems or the electric switchyard.



Considerable damage can also be caused by the infiltration of water into internal areas of the plant, by rise of the water table induced by high flood levels. Water pressure on walls and foundations may challenge their structural capacity.



Deficiencies in the site drainage systems may also cause flooding of the plant.



The dynamic effect of the water can damage the structure and the foundations of the plant as well as many systems and components located outside the plant.



Flooding can also contribute to the dispersion of radioactive material to the environment.

Protection against tsunamis The Design Basis Tsunami (DBT), i.e. current protection against a tsunami, is based on the worst tsunami in the history of Taiwan. According to the historic records, two severe tsunamis occurred in Taiwan in 1867 and 1918, respectively. The wave height of the tsunami happened on June 11, 1867 at 134 km north of Keelung was approximately 7.5 meters. After considering the influence of tides and geographic factors, the height of the DBT for NPP4 is set to be 8.57 meters.

14

15 16

One study investigated the possible impact of the wave height of the Jogan-Tsunami at the intake points of the NPP Fukushima. The second study evaluated a possible undersea earthquake at the coast near the NPP Fukushima.

The authors thank A.Y. Indradiningrat (cervus nuclear consulting) for helpful advice to this issue. which is the same reactor type (ABWR) as in the NPP4 26

This methodology to assess an external hazard is not in accordance with the ENSREG recommendations that ask for the use of a return frequency of 10-4 per annum with respect to external hazards.

The ground elevation of the main building area at the Lungmen site is 12 meters, which is 3.4 meters higher than the calculated wave heights. Therefore, in the opinion of TPC, NPP4 would not be threatened by tsunamis.

On August 19, 2011, the National Science Council (NSC) published a tsunami report17, after assessing the 22 earthquake origins of potential maximum tsunami in Taiwan.

According to the NSC, the result shows that the potential tsunami run-up height is lower than the evaluated DBT. However, it is pointed out, that there are still significant uncertainties in tsunami run-up predictions due to the definition of tsunami sources.

The OECD/NEA experts suggested the deletion of the analysis provided by the National Science Council (NSC) from the stress tests report. They criticise several issues: As mentioned above, higher earthquake magnitudes are to be considered. The maximum magnitudes have a major impact both on the seismic hazard as well as the tsunami hazard results. The NSC analyses did not model a tsunami resulting from undersea landslides and undersea volcanic eruptions. But, for example an active submarine volcano was identified in the north of Taiwan that can be considered a potential tsunami source.

Another source of significant uncertainty in tsunami run-up predictions is the use of approximate near-shore topography instead of accurate bathymetry. The experts recommended to re-analyse the tsunami hazard using state-of-the-art modeling [NW 16/05/13; OECD 2013].

Thus, the necessary tsunami run-up, against which the NPP4 has to be protected, is not known so far. The design basis tsunami has to be redefined.

Nevertheless, TPC is required to enhance the water tightness of buildings or build a sea wall to a level of 6 meters above current licensing to address the uncertainty from the original DBT height.

TPC plans to build a tsunami wall to cover the uncertainty. The envisaged height of this protection wall is 2.5 meters or elevation 14.5 meters respectively. This value means a safety margin of nearly 6 meters compared to the calculated waves of the DBT. However, this value would be only sufficient if the evaluation of the DBT was correct, but obviously it is not.

Therefore, it is a matter of fact that the protection against tsunamis is not adequate, even after building the sea wall.

17

Influence of Tsunami Induced by Potential Massive Scale of Earthquakes on the Nuclear Power Station in Taiwan 27

The AEC formulates only very general requirements: TPC should further review the appropriateness of the DBT and take the associated improvements to its nuclear power plants. A detailed scenario simulation of seismic and tsunami hazards are to be performed.

However, even a tsunami similar to the current DBT could be a danger for the plant.

When the tsunami run-up height reaches 8.6 meters, the exterior walls of the pump house (at an elevation of 5.3 meters) will sustain additional water pressure as well as impact force. According to TPC´s “Lungmen NPP Tsunami Prevention Capability Review Report�, the integrity of the pump house structure needs to be strengthened. Additionally, the plant needs to confirm that the sealing material for openings of the pump house can sustain the water pressure caused by tsunamis.

Furthermore, the stress tests reveal that, if an earthquake-triggered tsunami seizes the shore near the plant and causes the plant to lose its ultimate heat sink (UHS), there is only one successful path to achieve reactor core long-term heat removal and prevent an accident18.

Protection against extreme rainfall To determine the Design Basis Flood (DBF)19, the plant adopts the precipitation records measured at Keelung Weather Station from 1901 to 1982. The calculated probable maximum precipitation (PMP) is 310 mm/h. Even though the annual maximum precipitation data recorded in the years 1961 to 2006 shows a slightly increasing trend, the design of the drainage capability is assessed as adequate by TPC.

To prevent internal flooding, rainfall-induced surface flows in the main building area (power block) should be removed via the drainage system into the sea. The drainage system is designed to deal with 100-yearly maximum precipitation as well as to carry the run-off from a storm with 100-yearly return. The methodology is not in accordance with the ENSREG recommendations that ask for the use of a return frequency of 10,000 per year.

Climate changes have caused severe rainfall in the form of typhoons and/or tropical storms in recent years. Thus, the AEC requires reviewing the appropriateness of the DBF; associated improvements should be taken to increase the robustness of the plants against flooding. However, it is stated that these should be reviewed and approved by the AEC through the process of periodic safety review every ten years. Thus, it is not clarified whether the measures should take place before operation of the plant starts.

18

19

RCIC system starts its short-term water feeding function, which should give operators the time to manually start the Safety Relief Valve (SRV) and set up AC-Independent Water Addition (ACIWA).

Thereafter, the ACIWA system has to provide long-term water feeding to reactors and the Containment Overpressure Protection System (COPS) has to provide containments long-term heat removal. i.e. the flooding that the plant has to be protected against 28

The stress tests revealed dangerous weak points and cliff edge effects, because all exterior doors on the ground floor of the plant buildings are not watertight; internal flooding would occur in case of a beyond design basis flood. Thus, flood barrier plates have been installed at the doors on ground floors directly connecting to the outside of buildings, at the tunnel where the radwaste building enters the reactor/control building, and at the passage where the access control building enters reactor buildings.

To prevent internal flooding resulting from water outside of buildings, penetrations of buildings sealed with the water stops are only 30 cm higher than ground floor. Structures of safety-related systems as well as their components are also 30 cm higher than ground elevation.

The flooding risks are of concern due to a “cliff-edge� effect, in that the safety consequences of a flooding event may increase sharply with a small increase in the water level [NRC 2012]. A safety margin of only 30 cm seems to be very small.

To prevent internal flooding caused by leakage from damaged equipment (e.g. because of rupture of pipes) inside the buildings, some areas of the reactor building are equipped with watertight doors or semi-watertight doors.

If the floors in reactor buildings (at elevation 4,800 mm) containing safety-related electric switchgear are flooded, all safety-related AC electric equipment would fail. This situation would lead to a station blackout (SBO) and the loss of the ultimate heat sink (UHS). To increase the protection against flooding, water-tight doors to prevent flooding from flowing into rooms at elevation 4,800 mm have been added.

However, during former flooding events at nuclear power plants (e.g. at the Blayais NPP, France, in 1999) safety equipment located below the level of the site was damaged, because the water resistance/tightness of doors was miscalculated or seals of cable penetration were corroded.

In case of an internal flooding draining the water by pumps is envisaged to restore the function of the equipment located on the ground floor of the plant as soon as possible.

TPC has concluded that the drainage capability inside buildings is sufficient, nevertheless, in addition to the existing sump pumps, mobile drainage pumps have been procured.20

There is no information regarding how soon the function of this equipment can be restored and how long the flooding would have to persist for a critical situation to develop. However, the loss of equipment caused by a sudden flooding could not be prevented by sump pumps. Furthermore, additional manual actions are necessary to perform this measure.

20

The plant will add 2 manoeuvrable engine-driven drain sump pumps and 20 electric drainage pumps. 6 engine-driven mobile drainage pumps and 12 electric drainage pumps are already procured.

29

In addition to the limited measures envisaged by TPC, the AEC requires upgrading the watertight capability of doors of buildings containing important safety-related equipment, fire-fighting doors as well as pipeline penetrations seals.

These requirements sound appropriate in regard of the threat of flooding. However, they are very general, so it cannot be judged whether the scope is sufficient. Furthermore, the time schedule is not mentioned. Therefore, it cannot be assured that necessary backfitting measures will take place before NPP4 starts operation.

3.3 Other extreme natural hazards According to the Intergovernmental Panel on Climate Change (IPCC), the type, frequency and intensity of extreme weather events are expected to change as the earth’s climate changes. These changes could occur even with relatively small mean climate changes. Changes in some types of extreme events have already been observed, for example, increases in the frequency and intensity of heat waves and heavy precipitation [IPCC 2007].

Generally, the frequency of occurrence of more intense rainfall events in many parts of Asia has increased, causing severe floods, landslides, and mud flows, while the number of rainy days and total annual amount of precipitation has decreased [IPCC 2013].

Recently a typhoon showed its potential to threaten a nuclear power plant: On July 13, 2013, during the typhoon Soulik that caused widespread damage to the power grid, a large amount of debris was washed into the sea water intake of Chinshan unit 2, clogging it, damaging three debris screens and prompting operators to shut the unit down [WNN 2013a].

Extreme weather events, such as typhoons, heavy rain, and mudslides, can affect the Lungmen NPP site. Possible flooding events are the main resulting hazard of extreme weather events, which was dealt in the previous chapter. But also further effects of extreme weather events could threaten the safety of the plant.

The design wind speed of all relevant buildings21, i.e. the wind speed all buildings have to be resistant against, is only 54m/s. Given the fact that typhoons of high intensities were observed in the past years, an evaluation of the protection of the buildings containing safety-related equipment against projectiles in case of a beyond design typhoon (with wind speed exceeding 70.2 m/s) is required by the AEC. Because these evaluations are missing, the threat of projectiles resulting from typhoons is not yet known.

21

reactor buildings, control buildings, the switchgear building, the auxiliary fuel building, and the off gas stack turbine buildings, the radwaste building, the water plant, the fire-fighting pump house, and the switchyard 30

The Lungmen NPP site is located within the watersheds of Shiding Stream and Shuangxi Stream. According to the record of the Soil and Water Conservation Bureau (SWCB), both streams are not mudslide-prone; the landscape of this area is relatively flat. However, if unexpected mudslides happen and cause flooding to reroute and to flood the main building area, units may be affected.

Regarding extreme weather events, further weak points are identified: 

If a beyond design basis (BDB) storm seizes the plant, and if the BDB precipitation could not be drained by the drainage trenches and the surface flow floods the main building area, units may be affected.



If the inlets of the sea water pump house in the reactor buildings are stuck by massive debris, causing further clogging at the mesh and affecting the water intake of the pumps, reactors lose the ultimate heat sink (UHS).



Main weak point is flooding on the bottom floor, -8,200 mm of the reactor building, because this floor contains all safety-related emergency core cooling systems.

The improvement of protection against extreme weather events – besides the limited flood protection as discussed above – envisaged by TPC are in particular the introduction of procedures. It is stated for example: If beyond design basis events happen and reactors lose all AC power source and all water supply, the plant must get prepared to take actions to provide cooling to the reactor according to the Ultimate Response Guideline (URG) (see chapter 3.5).

The OECD/NEA group concluded that, although some combinations of events were considered in the determination of elevations of DBT, a systematic evaluation of combinations of events in the areas of flooding and extreme natural hazards was not performed. The experts recommended to implement a systematic approach for selecting and combining extreme hazards, including re-evaluating the probable maximum precipitation (PMP) with regional topographic maps [NW 16/05/13; OECD 2013].

The AEC required performing a systematic evaluation of combinations of extreme weather events.

The AEC recommended that TPC should conduct a quantitative risk assessment concerning the potential volcanic hazard. According to the AEC´s non-binding requirements, a volcanic probabilistic risk assessment (PRA) is to be performed and the impacts from ash dispersion are to be studied.

All in all, nearly all evaluations about extreme weather events/natural hazards are missing, thus there are a lot of threats that are not yet known.

31

3.4 Loss of all power supply (SBO) and ultimate heat sink (UHS) Even when a nuclear power plant is shut down, it needs electric power supply, particularly to operate the pumps of cooling circuit, and also it needs an ultimate heat sink (UHS) to remove heat from the cooling circuit and other vital systems necessary to avoid an accident. Total loss of offsite and onsite power supply – Station Black-out (SBO) – and loss of Ultimate Heat Sink (UHS) scenarios could result in severe accidents.

If a loss of offsite power (LOOP) occurs 22 , Lungmen NPP’s three seismic resistance emergency diesel generators (EDGs) will start automatically to provide power supply.

The EDGs are located on three corners of the reactor building at an elevation of 12.3 meters. This is only 30 cm above the site elevation, which guarantees not enough safety margins against flooding events.

The function of the EDGs relies on cooling water, which is provided by the Reactor Building Cooling Water (RBCW) system. Heat absorbed by RBCW is removed by the Reactor Building Service Water (RBSW) system and then dissipated to the sea.23 In case of loss of EDGs, the 7th EDG can take over its design function. This 7th EDG is seismically designed and located in the Auxiliary Fuel Building (AFB), but also only at an elevation of 12.3 meters. However, the 7th EDG is air-cooled, thus it does not depend on cooling water. Its start and control power is provided by an independent battery set, which can deliver DC power for 3.5 hours.

The 7th EDG is designed to totally replace the water-cooled EDGs of either unit 1 or unit 2. After the Fukushima accident, which highlighted that an external hazard may affect all the units on a site, TPC added a new procedure. Accordingly, the 7th EDG may be used to simultaneously supply power to unit 1 and 2.

However, the output of the 7th EDG is only sufficient to supply power to operate one division of both units. It is not required by the AEC to install a second air-cooled EDG, but only to perform an evaluation regarding this issue.

The installation of two air-cooled gas turbine generators located inside a seismically isolated building at the switchyard at an elevation of 29.8 meters is envisaged. 24 Note that without these gas turbines, AC emergency power supply is rather weak – with the 7th EDG as the only element of a second stationary line of defence. With the gas turbines, the emergency power supply would be on a level comparable to that in the EU.

22 23

24

TPC is required to improve the reliability of offsite power supplies.

Each EDG is equipped with a tank capacity to run continuously for 5 hours, and one storage tank that can provide fuel for 7 days (only for one EDG), but can be refilled from a tank truck. Unit 1 EDGs and Unit 2 EDGs can support each other in case of emergency.

Besides, in order to increase the reliability of transmitting power to reactor safety systems from gas turbine generators, it is planned to add 4.16kV independent transmission lines.

32

In case of loss of AC power, i.e. in case of Station Black-Out (SBO), the reactor water level shall be maintained by the Reactor Core Isolation Cooling (RCIC) system. RCIC operation relies on DC power.25 Based on the existing design, DC power can be supplied by a battery set for 8 hours.26 The water source is the suppression pool of the containment or the condensate storage tank (CST).

Within this 8 hours period, the operator shall set up normal power supply and alternative power supply including the 7th EDG, gas turbines, and backup mobile power.27 However, the RCIC system has only one division, i.e. if any failure occurs, it gets lost.28 To prevent fuel degradation after RCIC operation has stopped, it is planned to connect the outlet of the fire engine to the AC-Independent Water Addition (ACIWA) pipe to inject water into the reactor or suppression pool. The station has several fire engines, which should take suction water, e.g. from a raw water reservoir, or take sea water from the discharge channel.

According to TPC, offsite supports are available; the Fire Bureau of New Taipei City will provide manpower, vehicles, and equipment. However, after an extreme natural disaster, the fire engines will probably be called for use at other locations.

The required time (only 10 – 30 minutes) for the onsite and offsite fire engines etc. to be ready for operation onsite seems to be calculated without considering conditions after a natural disaster (like an earthquake).

Another possible way to provide water to the reactor is by gravity from a raw water reservoir located at an elevation of 116 meters, through fire piping to the ACIWA piping.

However, as mentioned above, probably the water would no longer be available after an extreme earthquake.

Envisaged measures to increase the robustness of the plant to prevent fuel damage are limited and need several additional manual actions: The RCIC system may be manually restarted if its DC power supply is lost. According to TPC, the operating steps have been demonstrated to be feasible and have been incorporated in the procedure. Furthermore, if the Safety Relief Valves (SRVs) should suffer a loss of operating gas or electrical power due to a beyond design basis event, manual actions are possible to open the SRVs.

25 26

27

28

The speed governor of the RCIC turbine requires DC power According to TPC, the duration of DC power supply to RCIC (and SRV/ADS) can be extended to 24 hours with load shedding. However, this measure is not reliable and demands additional manual actions.

Additionally, two mobile diesel generators to provide power to the 4.16kV bus as well as five small mobile diesel generators to provide power to battery chargers will be procured.

The safety-related systems have mostly three independent divisions.

33

Loss of Ultimate Heat Sink (UHS) During normal operation, the Circulating Water Pump (CWP) removes the heat of the condenser to the sea. After a reactor shutdown, decay heat is removed by the Residual Heat Removal (RHR) System through heat exchangers to the Reactor Building Cooling Water (RBCW) System and then to the Reactor Building Service Water (RBSW) System and finally to the sea, which serves as the ultimate heat sink (UHS).

The function of the UHS gets lost, when the water intake is unavailable, e.g. because of clogging. Furthermore, UHS function gets lost, if the RBSW and/or RBCW system(s) lose(s) function (e.g. because pump room temperature is not maintained below 40°C by its safety-related ventilation system).29

If UHS function gets lost, the reactor is to be depressurized by releasing steam into the containment; at the same time, water from all possible water sources is continuously provided through AC-Independent Water Addition (ACIWA) to the reactor (see chapter 3.5).

TPC´s envisaged measures to increase the robustness of the plant regarding loss of UHS are very limited: an emergency sea cooling water recovery plan has been established; furthermore, spare RBSW and RBCW motors for emergency replacement have been prepared.

Fuel damage can occur in the reactor core and/or spent fuel pool quite rapidly, in case the UHS is lost. An additional alternate UHS that is installed at several EU nuclear power plants could considerably reduce the risk of the total UHS loss. However, only the evaluation about this issue is required by the AEC: TPC is required to perform an evaluation regarding the establishment of an additional alternate heat sink such as the water fed by groundwater wells.

TPC is also required to study the feasibility of adding the mobile heat exchanger to remove the heat from the containment and/or reactor.

Spent fuel pool The Spent Fuel Pool (SFP) is located on the upper part of the reactor building (elevation 31.7 meter), outside the primary containment.30

29

If RBSW system fails, but RBCW system is still available, it is an option to provide cooling water to the RBCW heat exchanger through temporary piping.

30 The primary containment is a cylindrical steel-lined reinforced concrete structure integrated with the reactor building. The reactor building provides a secondary containment around the primary containment 34

During normal operation, the residual heat removal and water makeup of the spent fuel pool (SFP) is by ways of fuel pool cooling and cleanup system (FPCU). The heat is removed by the RBCW and the RBSW system to the sea (ultimate heat sink).

If the ultimate heat sink (UHS) gets lost, the fuel pool cooling system can perform the water make up function. Since decay heat cannot dissipate into the UHS, evaporation will be the only way to remove decay heat.

In case of loss of offsite power, the non-safety related bus will not be able to provide AC power, thus the FPCU pump cannot operate. In this case, the residual heat removal system (operating in RHR FPC mode) will perform the fuel pool water makeup and cooling function.

In case of SBO, the SFP will lose forced cooling and normal water makeup function.

Back-up design provisions are not available. Thus, firewater in reactor building 7th floor has to be injected into the SFP by using the fire hose located on the side of the SFP. 31 The diesel driven fire pump of the fire water system can provide water from the fire water storage tank, through only one division of the RHR system (RHR-C piping) or directly through the firewater system. However, the seismic capability of fire water storage tank is low. The back-up water shall be provided from the raw water reservoir, however the structures of the raw water reservoir are threatened by an extreme earthquake.

The installation of seismically designed firewater piping to make up and spray firewater is planned. This backfitting measure is to be appreciated; however without an appropriate water reservoir it could be nearly useless. A lot of manpower is needed to transport water via fire engines to the SFP.

The plant plans to purchase mobile water injection equipment: 4 mobile firewater pumps and air inflated water tanks (15 tons) are to be provided as the fire water backup system.

But this is also a limited measure, regarding the large amount of water needed to prevent a severe accident.

AEC´s conclusion and requirements The measures to prevent and mitigate SBO and loss of UHS situations that are envisaged

by TPC are very limited. Obviously, the evaluations of the different accident scenarios are not sufficient. Therefore, TPC is required to analyse the consequences of both units in the site being affected. This is one of the most important lessons learnt from the Fukushima accident, and thus all EU Countries with operating multi-unit plants have dealt with this issue.

31

During power outage, the SFP and reactor cavity are interlinked. Firewater pumps, tank truck engines, or mobile fire engines shall makeup water into the SFP (or reactor core) through the RHR system.

35

Furthermore the consequential impact on the spent fuel pool (including the integrity of the pool structure) in case of a loss of all power supply (SBO) and complete loss of the heat sink should be evaluated. This is also one of the most important lessons learnt from the Fukushima accident.

With respect to the SBO, the TPC is required to establish the equipment, procedures, and training necessary to implement an extended loss of all AC power supply of 72 hours for core and spent fuel pool cooling and for the reactor coolant system and primary containment integrity as needed.

In the opinion of the AEC, the feasibility of TPC´s accident management is not assured.

Thus, the AEC required: The operability of the non-conventional means including mobile equipment, fire trucks, etc. should be justified on the basis of technical data 32 . A systematic review of the non-conventional provisions should be performed, focusing appropriate operation of plant equipment in the relevant circumstances, taking into account extreme external hazards and a potentially harsh working environment. Thus, all of TPC´s measures to cope with a loss of all power supply (SBO) and loss of ultimate heat sink (UHS) could fail and a severe accident could occur.

3.5 Severe Accident Management Severe Accident Management is necessary to prevent or mitigate major releases of radioactive substances.

In order to cope with the compound disaster condition, for example earthquake and tsunami, TPC had prepared the Ultimate Response Guidelines (URG), developed following the Fukushima accident. Their relevant items (including reactor pressure relief, alternative water injection and the required power for essential systems and instrumentation control via mobile power source) in phase-1 shall be independently completed by the station manpower itself within only one hour.

However, only if the measures can be performed as fast as envisaged, fuel damage will not occur. After only 1.6 hours, the time of core water level drops to top of active fuel (TAF), and then fuel damage starts. This time span is very short to take appropriate measures. However, the strategy for preventing fuel damage described in the NR remains vague. It is stated that all possible and available manpower and materials are mobilized to arrange all available water sources including each kind of alternative water flooding path, power sources, and water sources etc. It has to be considered that after an extreme earthquake and/or tsunami it is very difficult and dangerous to perform these measures.

32

design, operation, alignment and connections, periodic testing, preventive maintenance, etc.

36

A very large amount of water is required to prevent a core melt accident with a major release of radioactive substances. For combined events that occur in both units, the total required makeup water, including reactor and SFP, is 442.2 tons per hour (1947 gpm).

Several possibilities for water supply exist. However, the capacity of the onsite fire engine, for example, is 12 tons. TPC stated that the raw water reservoir can supply continuously for 86.84 hours (3.62 days). But in case it fails during an earthquake, it is very difficult to provide such a large amount of cooling water.

Depressurization of the reactor According to TPC, if the Emergency Core Cooling System (ECCS), including RCIC, is expected to be unavailable, a controlled depressurization of the reactor must be performed while the ECCS is still available. Once the ECCS is unavailable, an emergency depressurization of the reactor must be performed immediately by opening safety relief valves (SRVs).

The AEC highlighted the problem of the two step depressurization strategy that has been adopted for prolonged SBO situation: With the slow and controlled depressurization process (first stage), the reactor can be brought to and maintained at a relatively safe state.

In the second stage, the fast emergency depressurization of the reactor is performed. But if the reactor is at a relatively high danger state (namely, a high pressure state), fast depressurization of the reactor will lead to a core uncover even if the water level is high before depressurization. Thus the envisaged procedure according to the URGs could have negatve effects.

The AEC alerts that the subtle detail matters. The controlled depressurization should not be confused with the emergency depressurization. However, the two terminologies are not well distinguished in TPC’s stress test report.

Prevention of RPV failure According to TPC, the station’s overall program for URG can assure the integrity of the reactor pressure vessel (RPV). If fuel is damaged, the station shall perform the evaluation of rescue measures and proposed actions in coordination with severe accident management guidelines (SAMGs).

However the measures that should be taken after occurrence of fuel damage are only described very briefly and vague. Thus, there are doubts that these measures could be conducted under the catastrophic conditions after an extreme natural event. After stop of operation of the RCIC, the reactor pressure vessel (RPV) will fail after only 9.7 hour.33

33

If RCIC keeps operation for 24 hours, the time of core water level drops to TAF (top of active fuel) is 4.3 hours. The time RPV failed: 15.1 hrs.

37

Note: ENSREG warns the depressurization of the reactor coolant system (RCS) after core melt is considered to be a crucial action to avoid high-pressure core melt ejection from the RPV, which could potentially challenge the containment integrity and facilitate water injection from low-pressure sources [ENSREG 2012b].

Prevention of containment overpressure After loss of function of the ultimate heat sink (UHS), the reactor has to be depressurized.

Heat generated in the reactor will be removed to the primary containment. Thus, the suppression pool water temperature will increase rapidly. Because it is likely that its temperature and consequently the primary containment pressure will exceed design limits, the containment pressure has to be released to protect the containment integrity.

As a filtered containment venting system (FCVS) is not installed, the release of a large amount of radioactive substance will result. FCVS is a filtering system for removing the radioactive material throughout different highly efficient filter stages.

TPC has not the intention to implement a FCVS. TPC has only set power recovery of the Standby Gas Treatment System (SGTS) as the first priority item in the URGs. The release of radioactive substances shall be mitigated by the SGTS, which depends on power supply.

Despite the fact that the lack of FCVS is a serious shortcoming, there is no AEC requirement concerning the implementation for such a system.

Note: in the design of the EU-ABWR, a FCVS is implemented (see chapter 5). FCVS are to be installed in the ABWRs in Japan.34 Prevention of hydrogen explosion If the fuel loses adequate cooling during an accident, hydrogen can be generated by zirconium water reaction. To manage hydrogen risks inside the containment and prevent hydrogen explosions, hydrogen igniters and recombiners or containment spray shall be used to reduce the containment hydrogen concentration. However, AC power supply is necessary to use these devices. Thus, containment exhaust is planned to reduce hydrogen concentration, despite the fact that this measure will cause a release of radioactive substances.

It is a serious shortcoming that passive autocatalytic recombiners (PARs) to prevent hydrogen explosions are not installed, and the chief measure to prevent hydrogen explosions and overpressure in the containment is by venting. Note that PARs sufficient

34

Hitachi-GE Nuclear Energy and Areva will work together to install filtered containment venting systems (FCVS) at boiling water reactors (BWRs) in Japan [NUCNET 2013].

38

for BDBA are installed or definitely planned in the European nuclear power plants (apart from those with inertisation).

TPC is required to install PARs, but only by the still non-binding requirements of the AEC. Thus, it is not clear, whether PARs are to be installed and if so, when this has to happen.

In order to prevent hydrogen accumulation in the secondary containment (reactor building) that could result in hydrogen explosions, the station shall open blasting windows located on the upper part of the reactor building to release hydrogen outside by natural convection.

During an accident this measure will also result in a release of radioactive material.

Prevention of basemat melt-through To prevent containment basemat melt-through after the reactor pressure vessel (RPV), the lower drywell shall be flooded via the AC-Independent Water Addition (ACIWA) system.

If the diesel-driven fire pumps failed to start, it is planned to flood with raw water by gravity.

If the ACIWA system failed, the Lower Drywell Flooding (LDF) system, a passive system, shall be used as an alternative flooding system: After the molten core will drop down upon the drywell basemat, suppression pool water would flood into the lower drywell when its high temperature fusible plug acts. According to TPC, the reaction between molten core and concrete would be limited.

It is not discussed in the NR whether the flooding is fast enough to protect the basemat and the penetrations in the lower drywell. Furthermore, it is questionable, whether in this stage of the accident a sufficient amount of water will be available.

All in all, the measures for the prevention of the basemat melt-through are not sufficient.

This fact is underlined by the new safety feature of the EU-ABWR (core catcher) to cool and stabilise the molten core (see chapter 5).

Prevention of liquid radioactive releases During and after an accident, the liquid radioactive release can only be prevented if the waste system and release routes are guaranteed to be safe. Otherwise, the radioactive liquid will first flow into the reactor building sump and then overflow. In the worst case, the liquid submerges into the first and second floors of the building. Then it further flows outside the building into rain-water sewers or sinks into the bottom layer sea water draining tunnel. The release will flow into the sea via the cooling sea water outlets.

39

According to the NR, the release of the radioactive water should be stopped immediately.

However, the procedure is not explained. Furthermore, the worst case of liquid releases into the sea is mentioned without indication how fast such releases could overflow in different accident scenarios, and which amounts of radioactive water could be released.

The storage capacity is limited (17,968 m続). Thus, it has to be expected that large amounts of liquid radioactive releases will enter into the environment.

ENSREG points out that conceptual solutions for post-accident fixing of contamination and the treatment of potentially large volumes of contaminated water should be addressed [ENSREG 2012b]. This important issue highlighted by the Fukushima accident is neither addressed by TPC nor by the AEC. Spent fuel pools (SFP) If the spent fuel pool (SFP) water level is dropped, SFP emergency water makeup shall be performed by ways of fire hydrants, fire water tankers and engine-driven fire water pumps. The arrangement of the phase-1 strategies of the URG shall be completed within 2 hours.

In the worst case, after loss of SFP cooling and water makeup, the pool water temperature will rise and the water will begin to boil after 9.5 hours.35 TPC stated that after 9.5 hours, the members of support teams36 should be on site and the supporting should be ready.

TPC has the opinion that there is sufficient time to restore the power supply or to prepare the alternative power supply for restoring SFP cooling or water makeup, because fuels degradation will not start before 98.37 hours. Even in case adequate radiation shielding is lost (after 52 hours), the station will be able to carry out SFP water makeup or spray through its dedicated water makeup or spray piping.

However, to secure cooling of the SFP, comprehensive manual actions are required. It is difficult to add water in the spent fuel pool, which is located at a height of about 32 meters under accident conditions. The Fukushima accident has highlighted this issue.

The location of the SFP outside the primary containment aggravates the situation, thus a release of radioactive material is threatening during a severe accident.

If SFP water temperature increases, second containment venting to discharge heat into atmosphere has to be performed. However, this measure will cause a release of radioactive substances.

35

36

The decay heat in the SFP is the maximum if all core fuel is transferred to the SFP in the shortest time after unit shutdown. The decay heat of the spent fuel is calculated based on the assumptions that spent fuels are discharged into the pool from last 9 cycles and all core fuels are discharged after 7 days of unit shutdown.

Technical Support Centre (TSC), Accident Management Team (AMT), Operation Support Centre (OSC), Health Physic Centre (HPC), and Emergency Public Information Centre (EPIC) 40

For the case of spent fuel becoming uncovered, there is no discussion in the NR about the possibility of a steam-water reaction or zirconium fire or about the hydrogen which will be produced. It has to be assumed that there are no measures available to cope with such a severe accident.

Note that in the EU, it is under consideration to take measures to practically eliminate spent fuel uncover in the pool, because the situation after fuel uncover is extremely dangerous.37

According to the ENSREG, the hydrogen production in SFPs has to be carefully analyzed and adequate countermeasures adopted if necessary [ENSREG 2012a].

The means for reliably monitoring the water level in the SFP under accident conditions are not addressed by TPC. The AEC required installing SFP instrumentation to monitor key spent fuel pool parameters (i.e., water level, temperature, and area radiation levels) consistent with the recommendation 7.1 of the USNRC NTTF Report. Accordingly, only the protection against design-basis events is required. This is not in accordance with the ENSREG recommendation, which ask for the use of dedicated instrumentation resistant to extreme external hazards (i.e. beyond design events), either passive or powered from reliable sources.

AEC´s conclusion and requirements The assessment and conclusions of the AEC indicates that the severe accident management of the NPP4 is not sufficient at all:

AEC highlighted the importance of the justification of the URG; of particular concern is the depressurization of the reactor. This is the key measure to be able to prevent a severe accident.

Regarding the establishment of the URGs, the AEC requires TPC to identify their implementation timing, the subsequent measures and monitoring strategy, including the monitoring of radioactive releases, backup ability of present systems and equipment, etc.

In the opinion of AEC, the hydrogen and containment pressure control strategies in the URG do not take into account various accident scenarios.

The AEC has obviously doubts that the operator is able to cope with a severe accident that affects both units simultaneously. TPC is required to estimate the duration of

37

ENSREG highlighted: “Maintained coolant inventory in the SFP needs to be ensured by verification or by upgrading SFP structural integrity, installation of qualified monitoring, and by provisions for redundant and diverse sources of additional coolant resistant to external hazards in order to practically eliminate the risk of fuel uncovery“ [ENSREG 2012a].

41

independent response capability for various severe accidents, beyond design accidents, and multi-event accidents.

Furthermore, the AEC requires ensuring the capability of DC power for instrumentation and control (I&C) systems of main control room (MCR) during SBO accidents.

The AEC requires the integration of the emergency operating procedures (EOPs), severe accident management guidelines (SAMGs), and extensive damage mitigation guidelines (EDMGs) with the ultimate response guidelines (URGs). Note: The OECD/NEA group pointed out that there could be a little confusion on how the URGs are to be used in conjunction with EOPs and SAMGs [OECD 2013].

Regarding procedures, training and exercises, the AEC requires combining the additional equipment and operations into the procedures or guideline, to re-evaluate the feasibility of EOPs and SAMGs with the involvement of new procedures/guidelines, to ensure that the SAMGs are appropriate for multi-unit events and to improve the emergency preparedness staffing and communications.

The ENSREG recommended to asses and ensure the radiation protection of operators and all other staff involved in the SAM and emergency arrangements by adequate monitoring, guaranteed habitability of the facilities needed for accident control [ENSREG 2012b].

This important issue is not adequately addressed by TPC or the AEC.

The ENSREG pointed out that the means for maintaining containment integrity should in particular include depressurization of the reactor coolant system, prevention of damaging hydrogen explosions, and means of addressing long-term containment overpressurization, such as filtered venting [ENSREG 2012b]. None of these means is sufficiently addressed by TPC. The means are also only partly included in the AEC requirements, i.e. containment failure and thus the release of radioactive material will not be prevented adequately in the future – not even if technical means are available.

42

4 Weaknesses the Taiwanese stress tests ignored Several safety issues that can trigger or aggregate an accident have not been evaluated during the stress tests. They are discussed in this chapter.

This chapter is mainly based on a special edition magazine published in March 2013 in Taiwan38. This article includes comprehensive information provided by Tsung Yao Lin39, an expert with practical experiences in nuclear power plant construction and safety analysis and a former member of the Fourth Nuclear Power Plant Safety Monitoring Committee.

In July 2011, Tsung Yao Lin stated that NPP4’s problems are so sizable and serious that TPC will not be able to solve this by itself. He wrote a paper titled “Essay on the Fourth Nuclear Power Plant”, in which he described structural issues of NPP4 (including equipment, construction, quality assurance and supervision). Later he published “Strategies for the Fourth Nuclear Power Plant”, suggesting practical solutions. The chairman of the Fourth Nuclear Power Plant Safety Monitoring Committee placed a very high value on this report.

4.1 Shortcoming during procurement of equipment In the beginning, TPC wanted to have a consulting firm to organise and handle all the contracts. However, the bidding price for experienced foreign consulting firms would have been relatively high, because they would take more risks. Unfortunately, no bidder won the bid as their offers exceeded the 20% of the base price.

Under the limited budget, TPC outsourced the two ABWRs to GE, and then hired Stone and Webster International Corporation (SWIC) as the consultant taking charge of the design. According to the agreement, SWIC was responsible to come up with the purchase specifications, and TPC was in charge of the procurement. It was difficult to ensure the quality of the equipment purchased through low bidding prices; furthermore, it disrupted the working procedure. The incident mentioned below with the fire plug reveals that there are shortcomings in TPC’s expertise in procurement.

In July 2007, TPC decided to terminate the agreement. Many projects were unfinished at the time of termination, such as NPP4’s final safety analysis report (FSAR). TPC had to undertake those tasks; however, TPC does not have sufficient experience to do so.

38

39

Author: Wang Mei Zhen (王美珍), Special edition on Longmen Nuclear Power Plant (NPP4) Controversies, Global View Monthly, March 2013 He graduated from Department of Nuclear Engineering of Ching Hua University in 1969 and worked for both GE and Bechtel Corporation as a consultant. During the time when NPP2 and NPP3 were under construction, Lin worked as the representative of a US consultant company for seven years.

43

4.2 Many design changes The Atomic Energy Council (AEC) pointed out that between 2007 and February 2012, TPC has made at least 15 major violations, including changing construction design at will.

During the construction process, up to 1,530 items underwent changes in design. TPC mentioned three reasons: First, the consulting firm, SWIC, left the project. SWIC made lots of mistakes in design drawings, and those all had to be corrected.

Second, from the very beginning, General Electric Co. (GE), who won the bid for the nuclear island, planned to completely copy the model of Japan’s Kashiwazaki-Kariwa nuclear power plant. However, the facilities Japan bought were made in Japan, whereas the facilities GE bought were made in Europe and the US. They all differed in size. It was figured out in the beginning that many facilities could not fit in the nuclear island. Motors and pipelines were all somewhat different from original designs.

Third, the sequence of facilities installation also results in design changes. For example, if water pipes are installed first, then it is likely that air pipes and electrical lines will not fit. To avoid changes, the sequence has to be exactly the same as design drawings show, but in fact it is impossible as NPP4 must adhere to the government’s Procurement Act. What came first would be installed first, and this was likely to affect the facilities delivered later. Therefore, changes had to be made and there was no way to stick to the original design.

Because of all design changes the design of the actual plant is not similar to the original design. This could affect the plant behaviour during accidents or the resistance against earthquakes.

4.3 Inadequate safety culture International experts pointed to the inadequate safety culture during the construction process: 

Some years ago, the Atomic Energy Council invited representatives of Japan Nuclear Energy Safety Organization (JNES) to assist in check-up. Later on, those Japanese representatives wrote in the report: “This construction site was not safe.

We were worried it would pose threats to Japanese representatives’ safety. As a result, we were unsure whether we would be able to come to assistance again.”



A couple of years ago, a former designer of GE, Yoichi Kikuchi, came to Taiwan to inspect NPP4’s construction site. In an interview he commented: “In every aspect, I didn’t think this power plant would be worked. Rusted steel reinforcing bars were scattered everywhere. Engineering and construction management was commissioned to downstream contractors, and no one was overseeing the construction prudently.”

44

Several important shortcomings that could result in accidents during operation were identified and remedied. In 2002, for example, TPC had to reassemble four of five layers of the reactor pressure vessel (RPV) support platform of unit 1, after regulators confirmed that workers used improper welding material in assembling it the first time. Workers had used low-intensity welding material to assemble the platform where high-intensity material had been specified.

One important reason for the insufficient safety culture during the construction phase is the following: NPP4 workers revealed that Hung Chi Shih, former vice president of TPC, insisted on speeding up the work to meet the deadline. He would set up a completion date, and if the team failed, all managers and directors would be demoted to technicians. As a result, many issues were left unreported to avoid getting scolded.

Safety culture in the construction site should be conscientious and must be extremely strict. However, quite the opposite seems to be the case.

4.4 Incidents during the construction process The construction of NPP4 did not only take a long time, it was also accompanied by a lot of troubles. In the last few years, several incidents, among them fires and floods, occurred during NPP4’s construction phase:

Jul. 2008:

When typhoon Sinlaku hit Taiwan, the lack of disaster prevention carried out by TPC caused accumulated water flood into the second machine room that reached two meters high, immersing facilities such as the emergency cooling system.

Jan. 2010:

Piles of electric cords were burned up, causing fire at the construction site.

Mar. 2010:

The first reactor’s uninterruptible power system failed, causing fire in the central control room.

May 2010:

TPC workers followed the method used in the three nuclear power plants to clean the electronic enclosure of the central control room with vacuum cleaners. Unexpectedly, the static electricity generated interfered with the output voltage, and caused a short-circuit.

Jul. 2010:

The electrical system was burned out, causing power outage in the plant.

Aug. 2010:

Rain damaged a voltage transformer, causing abnormal power supply for three days.

Sep. 2010:

Electric cables were not laid as required (see below).

Jan. 2011:

Electric cables in the central room were damaged by mice. Only after this incident, a strict rule has been made that no food is allowed at the construction site.

45

Aug. 2011:

Operators pumped water from the condensate water tank to the suppression pool without following the maintenance rules. This caused a large volume of water to emit from the valve body. The control rod accumulator’s level switch and some other safety-related equipment were affected by the water.

Oct. 2011:

TPC commissioned an inexperienced company to manufacture electric machinery pipes.

Mar. 2012:

The tap of the fire hydrant in the first unit room of NPP4 failed and water poured out, causing up to 30 cm of water accumulation in the equipment operating room. The reason was that for the hydrant a Japanese model was used, whereas the connecting extinguisher pipe was from the US. Merely 26.1% of the parts fit properly.

Apr. 2012:

A malfunctioning automatic bleeder vent of the sea water system caused the overflow of sea water, resulting in 150 cm of water accumulation.

However, the same thing already happened in September, October, and December 2011. This showed that TPC is incapable of completely resolving issues concerning equipment design and quality that cause the incidents to happen again.

Up to now, only the failures of structures, systems and components (SSCs) running into problems were exposed. But it has to be expected that other parts have deficiencies as well and that there are several deficiencies that remain undiscovered.

Additionally, since the plant has been under construction for so long, it is possible that degradations effects take place already.

4.5 Insufficient quality assurance (QA) In August 2011, cable re-arrangement was needed since cables were laid incorrectly. In total, those cables were 2120 thousand meters in length. This example showed that NPP4 had problems with supervision and quality assurance.

There are three layers of quality assurance. The first layer is the internal quality assurance from contractors, the second one is supervision from Lungmen Construction Office, and the third one is quality assurance from the safety unit of the TPC head office.

In the past, TPC deployed their own staff, but now many operating staff are employed by contractors. At Lungmen Construction Office, there are around 1,500 quality assurance testers (second layer), among them around 680 persons from TPC.

TPC failed to identify the problem of cable rearrangement at the first and second layers and discovered the problems at the third layer, only.

46

Tsung Yao Lin highlighted another issue regarding insufficient quality assurance.

Welding operation had been problematic while he was a member of the Fourth Nuclear Power Plant Safety Monitoring Committee. If welding is not done properly, pipes would break and water would leak.

The Quality Assurance (QA) should guarantee, among others, that deficiencies are remedied, however the QA is insufficient.

4.6 Concerns regarding the I&C System The instrumentation and control (I&C) system architecture, together with plant operations personnel, serves as the "central nervous system" of a nuclear power plant (NPP). Through its various elements (e.g., sensors, transmitters, actuators, etc.), the plant I&C system senses basic physical parameters, integrates information, and makes automatic adjustments to plant operations. It also responds to failures and off-normal events, thus it is necessary to cope with accidents. The IAEA recommended giving as much attention as their importance for design, testing, operation, maintenance, licensing, operation, and modernization of I&C systems [IAEA 2013].

NPP4 is the first Taiwanese NPP designed to be totally digitally controlled. The operation and maintenance of the Information and Control (I&C) system will be an issue for the system operator and regulator. 40,000 digital signals brought up safety concerns. This system had been assigned to three different contractors. Thus, there are doubts whether the interfaces will work together or not, and their accuracy and stability remain an underlying concern [NW 16/05/13].

The Finnish regulator, for example, requires a hard-wired backup to the digital system for the EPR (also with a digitized I&C system) under construction at Olkiluoto nuclear power site. In 2010, the US NRC required AREVA to modify its US EPR design to include a hard-wired back-up.

The AEC needs to require the installation of a hard-wired backup I&C system in NPP4.

4.7 Inappropriate test-operation procedures SWIC, the company responsible for the test-operation, lacked the necessary expertise.

According to TPC, SWIC did a very poor job. They even returned the money for compiling the procedures before the agreement was terminated, and asked TPC to write down the procedures themselves.

However, this could also lead to shortcomings, because TPC has not enough experience to do this. Test-operation begins with composing the procedures, because the way the

47

procedures are written determines how the tests are to be conducted. Things that are not mentioned in the procedures will not be checked.

Another major issue is in the primary stage during NPP4’s test operation: those performing the tests and those taking over the plant were the same group of TPC people.

Thus, it has to be feared that not all failures of the systems will be discovered. To overlook failures of the I&C system is of particular concern.

4.8 Role of the Atomic Energy Council (AEC) As described above, TPC has not enough experience to guarantee that the structures, systems and components (SSCs) are installed as intended and with the appropriate quality. This situation is aggravated by lack of experience of the Atomic Energy Council (AEC).

According to Tsung Yao Lin, under the existing circumstances the safety of NPP4 could not be guaranteed by the AEC. Tsung Yao Lin criticized that the AEC was merely checking the laws, regulations, and procedures.

Lin explained that the AEC has adopted the regulatory style used for the operating plants.

However, since these plants adopted a standard design and were built by foreign consulting firms under turnkey contracts, in a way they were already checked by the nuclear energy control authority in the US. The AEC only had to make sure all things abide by relevant laws and regulations, and check the procedures.

As NPP4 has a unique design and its contract with the original foreign consulting firm had been terminated, the consulting firm’s duties, such as design, procurement, and supervision were handed over to TPC and other contractors. However, the AEC did not have the manpower to run on-site inspections for the designs, facilities, constructions and test-operations.

According to Tsung Yao Lin, the US nuclear regulatory commission (NRC) has more than 2,000 engineers to provide consulting services; thus, their inspections and audits can be thorough. Although the AEC has tried its best, it is still inadequate. The AEC could only conduct random inspections, not general ones, even for those safety-related systems.

The above-mentioned incident with the fire plug reveals that there are shortcomings in TPC’s expertise in procurement. However, the appropriateness of TPC’s procurements and the installation process are not under the AEC’s control.

Furthermore, the AEC admitted that it is impossible to check through all the test operation procedures.

48

Lin criticized the ministry for incompetence in solving problems regarding the plant. In addition, Lin said that the AEC is incapable of comprehensively supervising the construction of the nuclear power plant, adding that the there is no guarantee for the power plant’s safety and quality.

However, the ministry answered that the government will fulfil its duty, ensuring that the NPP4 will not be allowed to function unless security checks prove its safety; even if a referendum accepts to continue construction of the nuclear power plant [TAIPEITIMES 2013a].

Lin added that it is difficult to find solutions for problems at NPP4, because there are too few professionals at the Ministry of Economic Affairs and the council who understand the issues [TAIPEITIMES 2013c].

49

5 The EU-ABWR There are two Advanced Boiling Water Reactors (ABWR) installed in the NPP4. The ABWR nuclear island is designed and manufactured by General Electric Co. (GE).

The ABWR was originally developed in Japan. The first ABWRs (Kashiwazaki-Kariwa6 and -7) entered into commercial operation in 1996 and 1997, respectively. Since then, only three more units started commercial operation in Japan: Hamaoka-5 (2005), Higashidori-1 (2005) and Shika-2 (2006). However, these plants are offline for safety checks following the Fukushima accident.

The ABWR was developed jointly by General Electric Co. (GE), Toshiba and Hitachi, following on from GE's development of the BWR concept in the 1950s [WNN 2009b].

Today, both GE-Hitachi (who merged their nuclear businesses in 2007) and Toshiba assert the right to build the ABWR [WNN 2009b].

GE-Hitachi Nuclear Energy (GEH) 40 has submitted an application to the US Nuclear Regulatory Commission (NRC) to renew the certification for its ABWR. Formerly, only GE-Hitachi owned the US design certification. The US NRC issued a final rule certifying the design on May 12, 1997. The original 15 year ABWR certification is set to expire in June 2012. The latest application includes a design update to reflect the current NRC requirement for an aircraft impact assessment [NEI 2010c].

In April 2013, Hitachi-GE signed agreements with UK nuclear regulators to carry out a generic design assessment (GDA) of its new ABWR reactor design 41 [NEI 2013b]. GDA is a long-term and rigorous process, which will ultimately determine whether the regulators will consider the ABWR suitable for construction in the UK [NEI 2013c].

Two ABWRs are planned for the South Texas Project (STP) in the US42, but Toshiba was selected as the prime contractor for the development in March 2008 [NEI 2009b; WNN 2009c].

Toshiba subsequently developed its own variant of the certified ABWR design for construction at units 3 and 4 of the existing STP site, which were scheduled to come online in 2016 and 2017, respectively. This design was submitted to the NRC in June 2009 and had to meet new aircraft impact rules. The Toshiba version of the ABWR 40

41

42

GEH is a global nuclear alliance created by General Electric and Hitachi. In Japan, the alliance is Hitachi-GE Nuclear Energy Ltd. Horizon Nuclear Power plans to build two to three 1300 MW-class ABWR-based nuclear power plants at Wylfa and Oldbury (UK) The future development of South Texas Project (STP) units 3 and 4 looks unlikely after majority shareholder NRG Energy announced in April 2011 that it was withdrawing from the project, writing down a $481 million investment and excluding any further investment [SCHNEIDER 2013].

50

would be considered safe even if one was hit by a large civilian aircraft. Following such an impact, only minimal operator input should prove necessary in order to keep the reactor core cooled and to maintain integrity and cooling at the used fuel pools. In November 2011, NRC certified an amended version of Toshiba´s ABWR [WNN 2010a; WNN 2011d].

Toshiba is currently adapting the ABWR design also for the European market, first for Finland. Toshiba's 1600 MW EU-ABWR design is under consideration for an envisaged new nuclear power plant at the Hanhikivi site in northern Finland [NEI 2013a]. The European version of the ABWR has been called EU-ABWR. Safety improvements based on the defence-in-depth (DiD) concept have been implemented for instance to prevent and mitigate long-term Station Black-Outs (SBO) and severe accidents.

The following chapter highlights the shortcoming of the outdated design of the ABWR constructed at the Lungmen NPP, because these ABWRs have not implemented these necessary safety features according to the state-of-the-art.

However, it is not clear whether it is technically feasible to upgrade the ABWR design of NPP4 to the EU-ABWR standard. The feasibility could be limited due to two reasons: First, it is physically impossible that the new safety features fit into the existing structures.

Second, it is not clear whether the safety systems which are sufficient for a European nuclear power plant site are also appropriate for the Lungmen nuclear power plant site, which is threatened by severe earthquakes.

5.1 Defence-in-Depth Concept Principally, the Defence-in-Depth (DiD) concept was already part of the very early power reactor designs. However, additional considerations have been done in order to take plant conditions into account which are beyond the original design basis. The most recent advancements have been done based on major lessons learnt from the Fukushima accident [YAMAZAKI 2013].

The operational principle of the DiD concept shall be implemented to 1. ensure reliable prevention of anticipated operational occurrences (AOO) and accidents (prevention) 2. facilitate the quick and reliable detection of AOO and accidents and prevent the aggravation of any event (control of anticipated operational occurrences and accidents) 3. mitigate the consequence of any accident and prevent radiation hazards (mitigation of consequences)

51

The DiD concept of the EU-ABWR is based on the concept that is established by the Reactor Harmonization Working Group (RHWG) of Western European Nuclear Regulators Association (WENRA). Accordingly, the safety functions concept shall be

assured through five successive levels of protection. An illustration of the safety levels is given in Figure 1.

Figure 1: Defence in Depth (DiD) Concept according to the WENRA

5.2 Technical realisation of DiD requirements In the DiD Level 2, the safety functions are implemented to restore and maintain a normal state after defined Anticipated Operational Occurrence (AOO) using for example the Isolation Condenser (IC). The IC system is implemented in the EU-ABWR to enhance the safety level. It is a passive system that condenses steam from the reactor and feeds the condensate through the feedwater lines back to the reactor. The heat from the IC is transferred to the coolant water of the IC tanks and from there directly to the atmosphere. A schematic of the IC, that partly uses the same components as the Passive Containment Cooling System (PCCS), is given in Figure 2.

52

Figure 2: Isolation Condenser (IC) and Passive Containment Cooling System (PCCS)

The structures, systems, and components (SSCs) designated to DiD level 3a – Design Basis Accident (DBA) – fulfil safety functions in case of postulated single initiating events. These SSCs are independent of those used in normal operation and in case of AOO. The initiating events for DiD Level 3b – Design Extension Condition (DEC) – are defined as postulated accidents with coincident common cause failure (CCF), multiple failures and rare events, such as extreme weather phenomena or a commercial air plane crash.

Compared to the previous ABWR versions EU-ABWR adopts an Emergency Core Cooling System (ECCS) that consists of three divisions of different sub-systems.

5.3 Severe Accidents (DiD Level 4) The EU-ABWR includes complementary safety features specifically designed to fulfil safety functions required in postulated core melt accidents (DiD level 4).

Several Severe Accident Management (SAM) measures are implemented in the EUABWR design preventing or mitigating containment failures. The SAM strategy utilises a core catcher against molten core-concrete interaction and loss of core melt cooling. To prevent containment overpressure, the Passive Containment Cooling System (PCCS) is used for containment heat removal. Figure 3 illustrates the interaction of the core catcher and the PCCS.

53

Figure 3: Operation of EU-ABWR Passive Containment Heat Removal System during Severe Accident

The initial cooling water for the core catcher is supplied from the suppression pool.

Fusible valves will open the PCCS condensate drain. A large amount of steam is then generated at the core catcher and released into the drywell. The gas mixture including steam and non-condensable (NC) gases flows from the drywell into the PCCS. The steam is condensed inside the PCCS heat exchanger which is located in the same tanks as the IC. The condensate is drained gravitationally to the core catcher down-comer. NC gases are purged to the wet well pool through the NC gas vent lines.

The passive severe accident mitigation systems aim to maintain the containment integrity without containment venting. The initial cooling water capacity lasts for at least 72 hours.

No external power is necessary to initiate the driving force opening motor operated valves or starting pumps. The EU-ABWR has a dedicated power supply for the instrumentation and control system for SAM measures even in the event of SBO and loss of essential power supply.

Note: These are the statements of the supplier, who is interested in selling his product.

Certainly, whether all systems will operate in a severe accident situation during or after an earthquake is not guaranteed. Nevertheless, the design is improved compared to the original ABWR design by adding passive systems to avoid manual actions of the operator in case of loss of all power supply and/or ultimate heat sink.

54

6 Discussion of the results and conclusions Experience of the stress tests in Europe Despite the fact that the stress tests revealed a number of shortcomings regarding the plants’ capability to withstand several external hazards and the lack of possibilities to cope with the consequences, the outcomes of the peer reviews of the European nuclear power plants consist only of recommendations for “further improvements”. The fear of representatives of civil society and independent experts that the stress tests were mainly set up to improve the confidence in the safety of the European NPPs regardless of his findings becomes true. The operation of dangerous NPPs is ongoing.

The experience highlights: the ENSREG did not assess, but only describe the shortcomings of the European NPPs. The peer review of the stress test reports did not formulate any overall conclusions – not even if a specific NPP showed shortcomings similar to those of the Fukushima NPP.

Furthermore, the ENSREG avoided mentioning, whether the national action plans (NAcP) to remedy the weaknesses are sufficient to amend the dangerous situation if completely implemented.

One of the major weaknesses is the lack of definition in the stress test specifications, which level of safety should be achieved if the plants should be back-fitted or shut down.

This deficit makes it very difficult for politicians and the public to assess the safety level of the plant.

Therefore, it cannot to be expected that the peer review of the ENSREG/EC group will give any advice about the decision to commission NPP4 or not – regardless of the findings.

Limited scope of the stress tests The EU stress tests cannot be understood as a comprehensive safety check of nuclear power plants, because the stress tests did not take into account all key safety issues.

However, the safety issues that are out of the scope of the stress tests are of utmost importance to assess the risk of the NPP4.

The quality of the plants’ structures, systems and components (SSCs) are not investigated during the stress tests. Furthermore, the stress tests take for granted that all the SSCs are in place and without faults. This assumption is not correct for any nuclear power plant, but particularly not for the NPP4. TPC could not guarantee that the SSCs are installed with the appropriate quality and without deficiencies. This situation is aggravated by excessive demands of the Atomic Energy Council (AEC).

55

Several failures of structures, systems and components (SSCs) have been discovered during the construction process. However, up-to now only failures running into problems were exposed. Because quality assurance programs as well as test procedures are insufficient, there are real fears that not all failures of the SSCs will be discovered before commissioning. In addition, the overlook of potential failures of the I&C system are of particular concern.

Numerous design changes could affect the plant’s behaviour during accidents and its capability to resist against earthquakes.

All these failures could aggravate an accident situations triggered by a natural hazard.

Stress test results and measures to remedy weaknesses The Lungmen nuclear power plant site is located in a high seismic risk zone, thus earthquakes are an important hazard for the plant. Since a site-specific seismic hazard analysis is lacking, it may be necessary to revise maximum magnitude values for faults.

A value of 9.0, which was the magnitude of the 2011 Tohoku earthquake that triggered the Fukushima accident, is possible. However, the envisaged measures to increase the seismic margins of the plant are very limited.

Regarding earthquake hazards, there is also an unsolvable problem: There are doubts about the reliability of the structures, systems and components (SSCs) of the NPP4. It is probably impossible to calculate the seismic resistance of the plant, due to the numerous shortcomings during the construction phase. Those construction mistakes will make the resistance of the plant unpredictable and the plant especially vulnerable to seismic hazards.

Fukushima highlighted the danger of flooding triggered by a tsunami. But it is highly questionable whether the operator, TPC, and the regulatory authority, AEC, are fully aware of this problem. An adequate evaluation of the tsunami hazard using state-of-theart modelling is missing. Thus, the wave run-up, against which the NPP4 has to be protected, is not known so far. Therefore, it is a matter of fact that the protection against tsunamis is not adequate, even after implementing the envisaged measures (e.g. building a sea wall).

The protection (including safety margin) against flooding events caused by storms and heavy rain is also not sufficient. Extreme weather events, such as typhoons, heavy rain, and mudslides can affect the Lungmen NPP site. However, the effects are not analysed adequately. Furthermore, a systematic evaluation of combinations of extreme weather events is still lacking. The same is true for the risk assessment of the potential volcanic hazards.

56

The stress tests in Taiwan should largely be based upon the EU stress test model.

However, the methodology used to evaluate the design basis of natural events is not in accordance with recommendations of the EU stress tests.

In summary the threat of natural hazards is not sufficiently evaluated. However, the threat is significantly greater than assumed by TPC.

The ultimate heat sink (UHS) is vulnerable against natural hazards. Nevertheless the measures to prevent loss of heat removal envisaged by TPC are very limited. A more expensive, but more effective measure would be the implementation of a new independent diversified ultimate heat sink (UHS) (without using the sea). But until now this is not definitely required by the AEC.

According to the AEC, TPC´s evaluations of the different accident scenarios are not sufficient. Furthermore, in the opinion of the AEC, the feasibility of TPC´s accident management to prevent a severe accident is not assured.

All in all, both the design and the non-conventional means (e.g. mobile equipment) are not sufficient to cope with a loss of all power supply (SBO) and loss of the ultimate heat sink (UHS) triggered by an earthquake or another extreme natural event. It is not clarified to which extent TPC will remedy this dangerous situation which could result in a severe accident. Measures envisaged by TPC to prevent fuel damage need several additional manual actions of the operator.

Obviously TEPCO is planning a more comprehensive upgrading program of its ABWR (Kashiwazaki-Kariwa unit 7) compared to TPC: After performing stress tests, TEPCO envisaged several backfitting measures. According to TEPCO, after implementing additional safety measures, even if a Station Black-Out (SBO) occurs, it would take about 12 days until coolant injection functions for the reactor core and spent fuel pool get lost.43

The Severe Accident Management necessary to prevent or mitigate major releases of radioactive substances envisaged by TPC is not sufficient. In order to cope with the compound disaster condition, for example earthquake and tsunami, TPC had prepared procedures (Ultimate Response Guidelines (URG)). AEC highlighted the importance of the justification of the procedures (URGs) to cope with a severe accident; of particular concern is the depressurisation of the reactor. This is the key measure to be able to prevent a severe accident. However, the measure proposed by TPC could have a negative effect.

43

The additional safety measures included water-tight seals, flood barriers, air-cooled gas turbine generators, emergency electrical switchgears and back-up truck-mounted heat exchangers. Other equipment installed includes hydrogen sensors inside the reactor building, filtered containment vents, spent fuel pool water level gauge and camera, on-site heavy equipment for debris removal and additional radiation monitoring cameras [NEI 2012c].

57

Specially, there are doubts about the implementation timing of the URGs. However, only if the measures can be performed as fast as envisaged, fuel damage will not occur. But after loss of water supply, the fuel damage would start after only 1.6 hours. It has to be considered that after an extreme earthquake and/or tsunami it is very difficult and dangerous to perform these measures.

It is also very difficult – or even impossible – to provide the large amount of water that is required to prevent a severe accident (442.2 tons per hour for both units). It is not proven that during and after a natural hazard sufficient water sources exist and water supply is possible.

None of the means for maintaining containment integrity during a severe accident is sufficiently addressed by TPC. The means are also only partly included in the requirements of AEC, i.e. containment failure and thus the subsequent release of radioactive material during a severe accident will not be prevented adequately – not even if technical means are available.

The envisaged chief measure to prevent hydrogen explosions and overpressure in the containment is by venting, despite the fact that this measure will cause a major release of radioactive substances.

The measures for the prevention of the basemat melt-through are not sufficient.

Furthermore in case of a severe accident, it has to be expected that large amounts of radioactive water will be released into the environment. Adequate measures suitable to cope with a severe accident in the spent fuel pools are also lacking.

Toshiba is currently adapting the ABWR design also for the European market. The EUABWR includes complementary safety features specifically designed to fulfil safety functions required in postulated core melt accidents. Several passive devices to manage a severe accident and to prevent containment failures are implemented in the EU-ABWR design. The new safety features of the EU-ABWR highlight the shortcomings of the design of the ABWRs of the Lungmen NPP that have not implemented these passive state-of-the-art measures.

Instead, TPC is heavily relying on the new magic solution to compensate the design deficiencies: mobile equipment, which is easy to plan and store in the plant and therefore a cheaper solution than the installation of new systems protected against external hazards.

But under severe accident conditions, it is very unlikely that the proposed mobile equipment can be put to work as quickly as needed. Furthermore, the new mobile equipment is useless if the staff response during the accident is not functionally according to plan. This is an important lesson learnt from the Fukushima accident, which should

58

result in the implementation of passive safety systems designed to withstand beyond design basis accidents with appropriate safety margins.

To rely to such a large extent on manual actions is irresponsible in regard of the consequences of a severe accident.

The AEC requirements It is consensus among experts that the peer review of stress tests cannot provide exhaustive verification of the comprehensiveness and adequacy of the safety measures.

Consequently, this process cannot replace the more detailed work performed by the national regulatory bodies. However, there are concerns that the Taiwanese regulator, the Atomic Energy Council (AEC), has not sufficient experience and resources to cope with the workload of all necessary evaluations and back-fitting measures.

The AEC’s requirements to remedy the weaknesses of the NPP4 are very general, thus the scope of the backfitting measures cannot be judged. Furthermore, the time schedule for implementation of proposed safety measures is not mentioned. Therefore, it cannot be assured that necessary backfitting measures will be in place before NPP4 starts operating.

The decision about the scope of necessary back-fitting measures is in particular an economical issue. Comprehensive backfitting will result in better protection but also in higher costs. However, to improve the safety level in an area prone to seismic or flooding hazards is a highly technical issue. An adequate safety level cannot be achieved subsequently. Thus, it is impossible to achieve an acceptable safety level for NPP4.

Conclusion Regarding the existing natural hazards, the design weaknesses and the deficiencies of the structures, system and components, it is not possible to retrospectively bring the NPP4 to an acceptable safety level. Therefore, a severe accident with a major release of radioactive substances cannot be excluded.

Considering the short distance of the NPP4 to the city of Taipei, such a severe accident would have disastrous consequences for millions of people.

Taking all facts into account we recommend to stop the NPP4 project and to not commission this nuclear power plant

59

7 References AEC 2013: Atomic Energy Council Taiwan Stress Test National Report for Nuclear Power Plants, May 28, 2013, BECKER 2013: Critical Review of the National Action Plan (NAcP); EU Stress Test performed on Nuclear Power Plants; Study commissioned by Greenpeace; Oda Becker, Patricia Lorenz; Wien, Hannover, April 2013 ENSREG 2011: European Nuclear Safety Regulators Group (ENSREG): Declaration of ENSREG, “Stress test” specifications; Brussels, 2011/05/13, http://www.ensreg.eu/node/286 ENSREG 2012a Peer review report; Stress tests performed on European nuclear power plants; 25 April 2012; www.ensreg.eu/sites/default/files/EU%20Stress%20Test%20Peer%20Review%20Final%20Report_0.pdf

ENSREG 2012b Compilation of recommendations and suggestions; Peer review of stress tests performed on European nuclear power plants; 27 July 2012; http://www.ensreg.eu/sites/default/files/Compilation%20of%20Recommendationsl_0.pdf

HSU 2013a: Letter to ENSREG Experts; 3 July 2013; Gloria Kuang-Jung HSU, Jay Fang, Lill Liu, Chia-Wei Chao, Chou-Han Lee, Irene Chen HSU 2013b: Comments on Taiwan Stress Test National Report for NPPs; submitted by Gloria Kunag-Jung HSU Taiwan Environmental Protection Union; 4 July 2013 IAEA 2003: International Atomic Energy Agency (IAEA): Flooding Hazard for Nuclear Power Plants on Coastal and River Sites, Safety Guide; IAEA Safety Standard Series; NS-G-3.5; Vienna; December 2003 IAEA 2013: International Atomic Energy Agency (IAEA): Nuclear Power Engineering; Instrumentation and Control Technologies; Vienna 2013; http://www.iaea.org/NuclearPower/IandC/index.html IPCC 2007: Contribution of Work Group 1 to the Fourth Assessment Report of the Intergovernmental Panel on Climate Change, 2007; http://www.ipcc.ch/publications_and_data/ar4/wg1/en/contents.html

IPCC 2013: Intergovernmental panel on climate change: IPCC Fourth Assessment Report: Climate Change 2007; http://www.ipcc.ch/publications_and_data/ar4/wg2/en/ch10s10-2-3.html JPG 2012: Joint Project Group: Stress Tests & Vulnerability Assessment; Recommendations and Experience of the Joint Project Group; 2012; www.jointproject.org/upload/file/JointProjectGroup2012_Brochure_StressTests_VulnerabilityAssessment.p df NATURE 2011: Nature International weekly journal of science; Reactors, residents and rsik; April, 21; 2011 http://www.nature.com/news/2011/110421/full/472400a.html NEI 2000a: Nuclear Engineering International (NEI): Lungmen closure starts row 29 November 2000; http://www.neimagazine.com/news/newslungmen-closure-starts-row-721/ NEI 2007a: Nuclear Engineering International (NEI): Quake impact on reactor complex explored 2 August 2007; http://www.neimagazine.com/news/newsquake-impact-on-reactor-complex-explored-721/ NEI 2009a: Nuclear Engineering International (NEI): Seismic safety under scrutiny in Taiwan 29 May 2009; http://www.neimagazine.com/features/featureseismic-safety-under-scrutiny-in-taiwan/ NEI 2009b: Nuclear Engineering International (NEI): EPC contract signed for South Texas ABWRs 26 February 2009; http://www.neimagazine.com/news/newsepc-contract-signed-for-southtexas-abwrs/

NEI 2010c: Nuclear Engineering International (NEI): GE asks NRC to renew ABWR license, 13 December 2010; http://www.neimagazine.com/news/newsge-asks-nrc-to-renew-abwr-license/ NEI 2012a: Nuclear Engineering International (NEI): Parliament endorses Lithuanian nuclear project 25 June 2012; http://www.neimagazine.com/news/newsparliament-endorses-lithuanian-nuclearproject/

60

NEI 2012c: Nuclear Engineering International (NEI): Kashiwazaki-Kariwa 1&7 stress test results published, 24 January 2012; http://www.neimagazine.com/news/newskashiwazaki-kariwa-17-stress-testresults-published/

NEI 2013a: Nuclear Engineering International (NEI): Fennovoima considers mid-sized VVER reactor for Hanhikivi 8 April 2013 Toshiba's 1600 MW EU-ABWR http://www.neimagazine.com/news/newsfennovioma-considers-mid-sized-vver-reactor-for-hanhikivi/

NEI 2013b: Nuclear Engineering International (NEI): Horizon and Hitachi-GE sign contract for design work on Wylfa nuclear plant 16 May 2013; http://www.neimagazine.com/news/newshorizonand-hitachi-ge-sign-contract-for-design-work-on-wylfa-nuclear-plant/

NEI 2013c: Nuclear Engineering International (NEI): UK regulators gear up for ABWR review, 11 April 2013; http://www.neimagazine.com/news/newsuk-regulators-gear-up-for-abwr-review/ NRC 2012: Recommendations for enhancing reactor safety in the 21st century; the near-term task force review of insights from the Fukushima Dai-Ichi accident; Dr. Charles Miller, Amy Cubbage, Daniel Dorman, Jack Grobe, Gary Holahan, Nathan Sanfilippo; JULY 12, 2011; http://pbadupws.nrc.gov/docs/ML1118/ML111861807.pdf

NUCNET 2013: The Communications Network for Nuclear Energy and Ionising Radiation: Hitachi and Areva to install Filtered Venting Systems at Japan’s BWRs; David Dalton; June 5, 2013; www.nucnet.org/all-the-news/2013/06/05/hitachi-and-areva-to-install-filtered-venting-systems-atjapan-s-bwrs

NW 16/05/13: The McGraw-Hill Companies: Nucleonics Week 54, May 16, 2013 NW 18/10/12: The McGraw-Hill Companies: Nucleonics Week 53, October 18, 2012 NW 27/06/13: The McGraw-Hill Companies: Nucleonics Week 54, June 27, 2013 OECD 2013: Independent Peer Review Report of the Stress Tests Performed on the Operating Reactors in Chinese Taipei; 23 April 2013 RENNEBERG 2011: Renneberg, W.; Becker, O.; Neumann, W.: The European „Stress test” for Nuclear Power Plants; Expertise on behalf of the Parliamentary Group of the Greens in the European Parliament; Bonn, October 2011 SCHNEIDER 2013: The World Nuclear Industry Status Report 2012; Mycle Schneider, Antony Froggatt, Paris, London, Kyoto, July 2013; http://www.worldnuclearreport.org/IMG/pdf/20130716msc-worldnuclearreport2013-lr-v4.pdf

TAIPEITIMES 2013a: Taipei Times: Gongliao patience urged; Helen Ku; 02 August 2013; http://www.taipeitimes.com/News/biz/archives/2013/08/02/2003568699

TAIPEITIMES 2013b: Taipei Times: Nuclear plant may win democracy; Jay Fang; 05 August 2013; http://www.taipeitimes.com/News/editorials/archives/2013/08/05/2003568945 TAIPEITIMES 2013c: Taipei Times: TaiPower vows Gongliao plant is safe; Lee I-chia; 05 August 2013; http://www.taipeitimes.com/News/taiwan/archives/2013/08/05/2003568971 TOSHIBA 2011: Toshiba Corporation: US-ABWR and EU-ABWR Design, Safety Technology, Operability Features and their Current Deployment; 5 July 2011; http://www.iaea.org/NuclearPower/Downloadable/Meetings/2011/2011-07-04-07-08-WSNPTD/4_JAPAN_ABWR_Toshiba_Ishibashi.pdf

TPC 2013: Taiwan Power Company (OPC): EU Stress Test for Lungmen NPP - Licensee Report (Rev.1b); May 2013 WENISCH 2012a: Wenisch, A.; Becker, O. Lorenz, P.: Critical Review of the EU Stress Test performed on Nuclear Power Plants; commissioned by Greenpeace, Wien, Hannover, May 2012 WNN 2009a: World Nuclear News (WNN): Earthquake-hit unit gets OK for full output, 02 June 2009; http://www.world-nuclear-news.org/IT-Earthquake_hit_unit_gets_OK_for_full_output0206094.html

WNN 2009b: World Nuclear News (WNN): Toshiba signs contract for South Texas ABWRs, 25 February 2009; http://www.world-nuclear-news.org/newsarticle.aspx?id=24725 WNN 2009c: World Nuclear News (WNN): Exelon opts for resurgent ABWR. 26 March 2009; http://www.world-nuclear-news.org/C_Exelon_opts_for_ABWR_2603092.html

61

WNN 2010a: World Nuclear News (WNN): Shaw to be exclusive EPC contractor for Toshiba ABWR, 30 November 2010; www.world-nuclear-news.org/C-Shaw_to_be_exclusive_EPC_contractor_for_Toshiba-ABWR3011108.html

WNN 2011a: World Nuclear News (WNN): New nuclear energy policy for Taiwan, 03 November 2011; http://www.world-nuclear-news.org/NP-New_nuclear_energy_policy_for_Taiwan0311117.html

WNN 2011c: World Nuclear News (WNN): Shaw receives compensation for Lungmen. 01 February 2011; http://www.world-nuclear-news.org/IT-Shaw_receives_compensation_for_Lungmen0102115.html

WNN 2011d: World Nuclear News (WNN): ABWR fit for aircraft impact, 02 November 2011; http://www.world-nuclear-news.org/RS_ABWR_fit_for_aircraft_impact_021111a.html

WNN 2013a: World Nuclear News (WNN): Taiwan reactor offline after typhoon, 16 July 2013; http://www.world-nuclear-news.org/RS_Taiwan_reactor_offline_after_typhoon_1607131.html

YAMAZAKI 2013: Defence-in-Depth Concept for the EU-ABWR; Hiroshi Yamazaki, Toshiba International Limited; Steffen Fuchs, (Toshiba International Limited); Annual Meeting on Nuclear Technology; Berlin; 14-16 May, 2013

62

8 Abbreviations ABWR ACIWA AEC AFB AMT AOO BDB BDBA CCF CST CWP DBA DBE DBF DBT DEC DiD DPP ECCS EDG EDMG ENSREG EOP EPIC EPR EU FPCU FSAR GDA GE GEH HPC I&C IAEA IC IPCC JNES KMT LDF LMNPP LOOP LY MCR MOEA NAcP NC NCO NEA NPP NPP4 NR

Advanced Boiling Water Reactor AC-Independent Water Addition Atomic Energy Council Auxiliary Fuel Building Accident Management Team Anticipated Operational Occurrences’ Beyond Design Basis Beyond Design Basis Accident Common Cause Failure Condensate Storage Tank Circulating Water Pump Design Basis Accident Design Basis Earthquake Design Basis Flood Design Basis Tsunami Design Extension Condition Defence in Depth Democratic People’s Party Emergency Core Cooling System Emergency Diesel Generator Extensive Damage Mitigation Guideline European Nuclear Safety Regulators Group Emergency Operating Procedure Emergency Public Information Centre European Pressurised Reactor European Union Fuel Pool Cooling and Cleanup System Final Safety Analysis Report Generic Design Assessment General Electric Company.

GE-Hitachi Nuclear Energy Health Physic Centre Information and Control International Atomic Energy Agency Isolation Condenser Intergovernmental Panel on Climate Change Japan Nuclear Energy Safety Organization Kuomintang Lower Drywell Flooding Lungmen Nuclear Power Plant Loss of Offsite Power Legislative Yuan Main Control Room Ministry of Economic Affairs National Action Plan non-condensable Niigata Chuetsu Offshore Nuclear Energy Agency Nuclear Power Plant Forth NPP = Lungmen NPP National Report 63

NRC NSC NTTF OECD OSC PAR PCCS PGA PMP PRA QA RAP RBCW RBSW RCIC RCS RHR RHWG RPV SAM SAMG SBO SFP SGTS SRV SSC STP SWCB SWIC TAF TEPCO TPC TSC UHS URG US US NRC WENRA

Nuclear Regulatory Commission National Science Council Near Term Task Force Organization for Economic Cooperation and Development Operation Support Centre Passive Autocatalytic Recombiners Passive Containment Cooling System Peak Ground Acceleration Probable Maximum Precipitation Probabilistic Risk Assessment Quality Assurance Reinforcement Action Plan Reactor Building Cooling Water Reactor Building Service Water Reactor Core Isolation Cooling Reactor Coolant System Residual Heat Removal Reactor Harmonization Working Group Reactor Pressure Vessel Severe Accident Management Severe Accident Management Guideline Station Blackout Spent Fuel Pool Standby Gas Treatment System Safety Relief Valve Structures, Systems and Component South Texas Project Soil and Water Conservation Bureau Stone and Webster International Corporation Top of Active Fuel Tokyo Electric Power Company Taiwan Power Company Technical Support Centre Ultimate Heat Sink Ultimate Response Guideline United States of America US Nuclear Regulatory Commission Western European Nuclear Regulators Association

64