R1-R4 ENSREG Stress Test - Summary

Detta ar en PDF-tolkning fran Darwin av dokument 2158963 / 2.0 

Sekretessklass: Hemlig 

Ringhals AB 

Dokumenttyp Dokumentstatus Statusdatum Dokument-ID/Version 

Rapport-projekt Frisläppt 2011-10-27 2158963 / 2.0 

Intern dokumentägare Sekretessklass Gäller t o m Alt. dokument-ID 1 

PRRT Hemlig Externa händelser 

PSG / FSG enl dok.nr Ersätter Alt. dokument-ID 2 

Handläggare Granskat av Godkänt av 

Myhrberg Björn PRRTAS 

Jerregård Anders PRR1D 

Eckegren Lennart PRRTF 

Granhäll Tord PRR2T 

Eklöw Kajsa PRRTAS 

Frisläppt av 

R1-R4 ENSREG Stress Test - Summary 

Lövefors Daun Annette PRRQ 

SUMMARY 

An assessment of the site has been made at situations beyond the design 

bases of the units. The assessment has been performed in accordance with 

the ENSREG stress test specification. The stress test is focused on the areas: 

- Earthquake, where the stressing is made by applying an earthquake with 

ground acceleration about four times beyond the design value (the 10 -7 

earthquake vs. 10 -5 earthquake). 

- Flooding, where the stressing is made by applying sea-rise levels beyond 

design. The design basis sea-rise level is 2,65 m. The plant robustness is 

evaluated by applying sea-rise levels of 3, 3,3 and 4 m. 

- Loss of offsite power and station blackout. In this case the stressing is 

performed by applying a gradually increased of loss of power, ending up 

with only battery power as the available source. 

- Loss of ultimate heat sink, where the stressing is made by applying 

gradually decreasing availability of seawater, ending up with no seawater 

at all available. 

- Accident management, where the stressing is made by imposing potential 

obstacles for the accident management processes such as infrastructure 

destruction, unavailable facilities, loss of power, habitability issues etc. 

In all cases, the very beneficial impact of the containment filtered vent 

feature is observed. 

In the earthquake case, the engineering judgement is that the units will be 

able to withstand the design basis earthquake (DBE). Safe shutdown is 

judged to be feasible. The spent fuel cooling systems are not seismically 

qualified. At beyond design bases condition for the stress test, the applied 

case is an earthquake corresponding to an exceedance frequency of 10 -7 per 

Delgivning och distribution 

Delgivning för åtgärd: 

Delgivning för kännedom: Referensgrupp, Hans Länsisyrjä RQS, interngranskare, remissgranskare, 

projektmedlemmar, cRTAS, cRQ 

Distribution: 1 (52)



Dokumentstatus Alt dokument ID 1 Alt dokument ID 2 Dokument ID / Version 

Frisläppt Externa händelser 2158963 / 2.0 

site and year. At this condition, the containments, the containment filtered 

vents, the fuel buildings and the fuel pools and the severe accident mitigation 

systems are judged to be able to perform their release preventing functions. 

As mentioned above, the spent fuel cooling systems are not seismically 

qualified. 

In the flooding case, the assessment concludes that for the design basis 

flooding, a sea level rise of 2,65 m, no fuel damage will occur. Beyond 

design basis, flooding of the units may occur with the potential of causing 

fuel damage by elimination of safety functions and spent fuel cooling 

equipment. Robustness exists up to the ground level, which is 3 m above sea 

level. At a sea-level rise of 4 m fuel damages are judged to be possible. 

Addressing the question of an appropriate sea-level rise is required before 

relevant measures can be taken. 

In the “Loss of offsite power and station blackout” case, the assessment 

concludes that the limiting case is when only battery power is available. 

Robustness exists as long as anyone of the ordinary backup power sources 

(diesel generators or gas turbines) or the steam driven auxiliary feedwater 

systems are available. Postulating power system recovery times beyond 

design, exhaustion of batteries, depletion of the water sources for the steam 

driven systems and operation at low RCS inventory conditions will cause 

fuel damage. The containment filtered vent feature will contribute in keeping 

the releases within allowable limits. The loss of power will also cause a loss 

of the spent fuel cooling. 

Addressing the adequacy of the current battery capacities and the availability 

of the backup power sources is required before relevant measures can be 

taken. 

In the case of loss of ultimate heat sink, the assessment concludes that 

robustness exists for several days in all cases, with the exception of 

operation at low RCS inventory conditions at the PWR’s. Addressing the 

operation at low RCS inventory conditions coincident with loss of UHS is 

required before relevant measures can be taken. 

Regarding accident management, the assessment concludes robustness for 

events within design. The beneficial impact of the containment filtered vent 

is emphasised. When applying the Fukushima scenario as described in the 

stress test specification, a number of shortcomings are displayed. The 

emergency response organization can not handle four units simultaneously 

affected, the two existing mobile pump/generator units may not be enough, 

loss of cooling of the spent fuel pools can not be managed etc. Addressing 

the appropriate scenario to be applied is required before relevant measures 

can be taken. 

The evaluation of the Ringhals site in the light of the Fukushima accident 

and in accordance with the ENSREG stress test specification has revealed a 

number of areas subject to improvement: 

- The spent fuel pool cooling abilities needs to be further 

evaluated/reinforced 

Hemlig 2 (52)





- The properties of the emergency response organization needs to be 

reconsidered 

- The flooding scenario needs to be reconsidered 

- The requirement for battery capacity is generally an area to analyze 

further. 

- The adequacy of the present water supplies needs to be reconsidered. 

The resulting potential plant improvements within each area are indicated in 

the referenced detailed evaluations, and summarized in this report. Before 

implementation of the indicated improvements is initiated, further in depth 

consideration is required to assure the correctness and suitability and that no 

jeopardizing of other plant properties will be caused. 

Hemlig 3 (52)





R E V I D E R I N G S F Ö R T E C K N I N G 

Version 

Nr. 

Reviderade 

sidor 

Orsak 

Handläggare/ 

Frisläppt av 

2.0 Första utgåvan B Myhrberg/ 

A Lövefors 

Hemlig 4 (52)





INNEHÅLLSFÖRTECKNING 

1 INTRODUCTION ........................................................................................8 

1.1 Stress test background information........................................................8 

1.2 Evaluation method of plant robustness ..................................................8 

1.3 Previous reporting during the process ...................................................9 

1.4 Other assessments of the incident..........................................................9 

1.5 Scope of the stress test............................................................................9 

2 SITE DESCRIPTION ................................................................................10 

2.1 The site ....................................................................................................10 

2.1.1 Hydrological characteristics ......................................................................10 

2.1.2 Seismological characteristics ....................................................................11 

2.1.3 Exposure to air transportation events........................................................11 

2.2 Applicability of the ENREG accessibility limitations of 24 hours 

respectively 72 hours .............................................................................11 

2.3 Basic design of the plants......................................................................13 

2.3.1 Ringhals 1 characteristics .........................................................................14 




2.4 Safety significant differences ................................................................14 

2.5 Defence in depth principle .....................................................................16 

2.6 The containment filtered vent feature ...................................................20 

2.7 Performed safety enhancements...........................................................23 

2.8 Routine safety enhancement work ........................................................24 

2.9 Scope and results of PSA ......................................................................24 

2.9.1 Scope .......................................................................................................24 

2.9.2 Ringhals 1.................................................................................................24 

2.9.3 Ringhals 2.................................................................................................26 

2.9.4 Ringhals 3.................................................................................................27 

2.9.5 Ringhals 4.................................................................................................29 

3 STRESSTEST RESULTS.........................................................................30 

3.1 Earthquake ..............................................................................................30 

3.2 Flooding ..................................................................................................32 

3.3 Loss of offsite power (LOOP) and station blackout (SBO) ..................34 

3.4 Loss of ultimate heat sink without/with SBO........................................41 

3.4.1 Loss of ultimate heat sink without SBO.....................................................41 

3.4.2 Loss of ultimate heat sink with SBO..........................................................44 

3.5 Accident management............................................................................44 

4 SUMMARY ASSESSMENT......................................................................48 

Hemlig 5 (52)





5 AREAS SUBJECT TO IMPROVEMENTS ................................................50 

6 REFERENCES .........................................................................................51 

Hemlig 6 (52)





LIST OF ABBREVIATIONS 

DBE 

CFV 

RCS 

PWR 

BWR 

Design Bases Earthquake 

Containment Filtered Vent 

Reactor Coolant System 

Pressurized Water Reactor 

Boiling Water Reactor 

ENSREG European Nuclear Safety Regulators 

SAR 

TMI 

WANO 

SOER 

LOOP 

Safety Analysis Report 

Three Mile Island 

World Association of Nuclear Operators 

Significant Operating Experience Report 

Loss of Offsite Power 

OPS Original Plant Section (Ringhals unit 1) 

DPS Diversified Plant Section (Ringhals unit 1) 

SBO 

UHS 

ICS 

PGA 

CRDM 

DBF 

Station Blackout 

Ultimate Heat Sink 

Independent Containment Spray 

Peak Ground Acceleration 

Control Rod Drive Mechanism 

Design Bases Flooding 

Hemlig 7 (52)





1 INTRODUCTION 

1.1 Stress test background information 

On the 25th of March 2011, the European Council of Ministers declared that 

the safety of all EU nuclear plants should be reviewed on the basis of 

comprehensive and transparent risk and safety assessments (“stress tests”) as 

a consequence of the Fukushima accident. The organization ENSREG 

(European Nuclear Safety Regulators Group), which is an expert body, 

composed of senior officials from national regulatory or nuclear safety 

authorities from all 27 member states in the EU, has thereafter agreed on the 

criteria for how the stress tests should be performed. 

The report at hand is a summary of Ringhals AB’s answer to the Swedish 

Radiation Safety Authority’s injunction ”Förnyade säkerhetsvärderingar av 

tålighet mot vissa händelser” [7], which states that Ringhals AB must 

perform the ENSREG stress test for all its units. The stress test specification 

is found in Appendix 2 in [7]. 

1.2 Evaluation method of plant robustness 

Nuclear power plants are designed with large safety margins. The safety 

margins are related to a number of postulated events, such as pipe breaks in 

the primary system, steam line break, flooding, wind etc. The plants are 

designed to withstand these postulated conditions with satisfactory margins. 

At the stress test according to ENSREG, the plant properties at conditions 

beyond the postulated design conditions are evaluated. This will result in an 

evaluation of to what extent the plant can withstand conditions beyond 

design without fuel damage occurring. 

The stress test principle is that the plant safety functions gradually are 

assumed to fail, regardless of redundancy properties. This will finally display 

a level of degradation where fuel damage is unavoidable. 

The stress test specification frequently addresses the point at which “fuel 

damage is unavoidable”. In the evaluations this point generally is when the 

core exit thermocouples indicate 650C (PWR) or the water level has 

decreased to the top of the core (BWR). In some cases, emptying of water 

sources is applied as criteria, however somewhat conservative. Concerning 

fuel pool discussions, the point is applied as the point when the water level 

has decreased to the top of the fuel assemblies. 

The base for the evaluation is the current unit analyses in the SAR’s, 

supplemented by descriptive discussions and engineering judgements where 

we are beyond the scope of the SAR. 

The stress test according to the ENSREG specification has an endpoint when 

fuel damage is unavoidable. However, the Swedish plants are designed to 

cope with a scenario even after severe fuel damage and vessel melt-through 

Hemlig 8 (52)





has occurred. This scenario, the containment filtered vent scenario, was 

introduced at the Swedish plants in 1988 in accordance with government 

decision 11, 1986 [27]. The purpose of this government decision, derived 

from the TMI accident, was among others to prevent a ground deposition at 

severe accidents that in the long term will prevent the utilization of extensive 

land areas. The containment filtered vent feature is described in section 2.6. 

1.3 Previous reporting during the process 

The evaluation of the units according to the ENSREG stress test 

specification was initiated by the regulator SSM via the injunction 

2011/2065, ”Förnyade säkerhetsvärderingar av tålighet mot vissa händelser ” 

[7]. 

The prerequisites for the stress test was reported by Ringhals AB in 2011-06- 

08 [8], additional prerequisites were reported 2011-07-12 [9]. The 

prerequisites were reviewed by SSM in a review report 2011-07-29 [10]. 

The progress of the work was reported to SSM in 2011-08-15 [11], 

contributing to the national progress report submitted to the EU in 2011-09- 

15. 

1.4 Other assessments of the incident 

Shortly after the accident, the regulator SSM emphasized the importance of 

initiating plant specific evaluations, aimed at identifying potential 

reinforcements [12]. A dedicated project was established within the Ringhals 

site organization [13]. This project was later adapted to the requirements of 

the regulatory injunction [7]. 

The WANO SOER’s 2011-2 and 2011-3 are addressed within the site 

organization. 

WANO SOER 2011-2, Fukushima Daiichi Nuclear station fuel damage 

caused by earthquake and tsunami, was addressed and reported [30]. 

WANO SOER 2011-3, Fukushima Daiichi Nuclear station spent fuel 

pool/pond loss of cooling and makeup, is being addressed at the moment. 

1.5 Scope of the stress test 

The extent of the stress test according to the ENSREG specification results 

in an evaluation of the plant in the following perspectives: 

- The earthquake perspective, meaning that an evaluation is performed by 

applying an earthquake more severe than the design earthquake. The 

plant possibilities to fulfil the release preventing functions at theses 

conditions are evaluated. 

- The flooding perspective, meaning that an evaluation is performed of the 

magnitude of a flooding the plant can withstand before fuel damage is 

unavoidable. 

Hemlig 9 (52)





- The loss of power perspective, meaning that an evaluation is performed 

of the plant long term properties during a gradual loss of power sources 

until only battery power remains. The available range of time until fuel 

damage is unavoidable is evaluated. 

- The ultimate heat sink perspective, meaning that an evaluation is 

performed of the plant long term properties during a gradual loss of sea 

water for plant cooling. The available range of time until fuel damage is 

unavoidable is evaluated. 

- The accident management perspective, meaning that an evaluation is 

performed of the adequacy of the accident management procedures, and 

of the emergency response organization. 

A common feature of the evaluations is that potential cliff-edge effects are 

identified. Cliff-edge effects may be e.g. exhaustion of batteries, lack of 

diesel fuel, emptied water supplies etc. A cliff edge effect causes the 

sequence of events to change in a significant way, and based on this, areas 

subject to improvements, further evaluations or reinforcements can be 

identified. 

The stress test specification frequently addresses the point at which “fuel 

damage is unavoidable”. In the evaluations this point is defined as when the 

core exit thermocouples indicate 650C (PWR) or the water level has 

decreased to the top of the core (BWR). Concerning fuel pool discussions, 

the point is defined as the point when the water level has decreased to the top 

of the fuel elements. 

2 SITE DESCRIPTION 

2.1 The site 

The Ringhals plant is situated along the west coast of Sweden on the Värö 

peninsula within the Varberg municipality in the province of Halland. 

Contiguous cities are Varberg 25 km south of and Gothenburg 60 km north 

of Ringhals. 

The site has four units, one BWR and three PWR’s. The site is operated by 

Ringhals AB, who is the license holder. 

2.1.1 Hydrological characteristics 

The site is situated by the sea, and is consequently exposed to events 

originating from the sea. In the vicinity of the site, there are no dams or 

rivers constituting potential sources of flooding. The single source of 

flooding with the potential to cause a sequence of events resulting in fuel 

damage is a sea-level rise. 

The assumed highest flooding level is a sea level rise of 2,65 m [3]. 

Tsunami 

Hemlig 10 (52)





A tsunami is created by seismic events or underwater landslides. 

During an underwater earthquake a large amount of energy is added to the 

water. Since these events often occurs in the Pacific at large depths, the 

energy addition does not result in a significant level increase in the open sea. 

The result is a minor level increase of 0,5 – 1 m moving at large velocity 

away from the area. The energy is transmitted as a long wave, at the velocity 

C = (g * h) 1/2 , 

Where the depth h often is of the magnitude 4000m. This results in a wave 

velocity of » 200 m/s (700 km/h). When reaching the shore the wave will be 

retarded by the decreasing depth, resulting in an increasing height. 

In the seas surrounding Sweden no tsunami has been registered. Even if 

tsunami initiating events should occur, the impact would be small since the 

depth of the surrounding sea is limited. The average depth in the Baltic is 60 

m and is assumed to be similar in the Kattegatt, resulting in a wave velocity 

of 25 m/s. This concludes that the waves will not generate any larger waves 

with the potential to cause any major damage [18]. 

Tide 

Water level variations due to tide are usually insignificant, but may add up to 

an extra 30 cm to the water level variations due to atmospheric pressure and 

wind load [18]. 

2.1.2 Seismological characteristics 

In Scandinavia seismic activity is generally low. The region is generally 

considered as being seismically stable. Only a few incidents have been 

registered in historic time, which might have damaged an industrial plant of 

today. The risk of a nuclear accident in Sweden, caused by an Earthquake, 

may thus be considered to be low. The bedrock conditions at the site are 

further discussed in [20] 

The design basis earthquake is an earthquake with the occurrence frequency 

of 10 -5 /year [21]. 

2.1.3 Exposure to air transportation events 

The probability of an airplane incident in the vicinity of the Ringhals site is 

estimated to be very low, 2E-8 [22]. The air transportation is further 

discussed in [29]. 

2.2 Applicability of the ENREG accessibility limitations of 24 hours 

respectively 72 hours 

In the ENSREG document a footnote states that: 

Hemlig 11 (52)





“All offsite electric power supply to the site is lost. The offsite power should 

be assumed to be lost for several days. The site is isolated from delivery of 

heavy material for 72 hours by road, rail or waterways. Portable light 

equipment can arrive to the site from other locations after the first 24 hours.” 

Application of the stated timeframes of 24 respectively 72 hours requires is 

required to be further motivated. 

Within the site, it has to be credible that the generated amount of debris in 

the plant yard can be handled in such a way that transportation activities are 

possible. 

In order to credit portable light equipment after the first 24 hours, access to 

the site area has to be made credible, i.e snow obstacles and other obstacles 

should be made credible to be removed. Further, the assessed light 

equipment, has to be available within transportation range. Light equipment 

is assumed to be equipment transportable by off road vehicles or 

bandwagons. 

In order to credit heavy material first 72 hours, access to the site area has to 

be made credible, i.e snow obstacles and other obstacles should be made 

credible to be removed. Further, the assessed heavy material, has to be 

available within transportation range. Heavy material is basically assumed to 

be equipment requiring truck transportation by road. 

The site organisation capabilities regarding clearance of the site area in case 

of bad weather conditions or other events is managed by the on shift rescue 

team. At their disposal, the team has a fully equipped fire truck and an off 

road vehicle. At emergency situations, the site heavy vehicles such as front 

loaders and lifting trucks are also available. Based on the presence of the on 

shift rescue team and the available equipment, it is judged that the site area 

can be cleared for transportation purposes within 24 hours following bad 

weather conditions or other events. 

The transportation possibilities by road at bad weather or other difficult 

situations are managed by Trafikverket (Department of Transportation) and 

its local subcontractors. The experiences from previous bad weather 

conditions is that the roads are cleared well within 24 hours. Should the 

situation reach a societal emergency level, the First Commander of Rescue 

Service disposes all of the resources of the society. 

Based on the experience of historical bad weather situations, and the 

availability of the total society resources in emergency situations, it is 

reasonable to site specifically apply the timeframes of 24 hours respectively 

72 hours as described in the footnote of the ENSREG document. 

Hemlig 12 (52)





2.3 Basic design of the plants 

The plants are designed to confine the radioactive material by physical 

barriers. There are dedicated systems intended to protect and maintain these 

barriers. 

The barriers are the fuel pellet structure, the fuel cladding, the reactor 

coolant pressure boundary and the containment. 

The protective functions included in the plant design in order to maintain the 

barrier integrity are characterized of design according to the single failure 

criterion, i.e. one single failure in the protective function does not jeopardize 

the purpose of the function. 

The plants were originally designed with two main trains of safety functions. 

The supporting power system was divided into four sub trains, each one with 

a dedicated emergency diesel generator. Two sub trains are supporting each 

main train. 

The two train design has during the years been reinforced. Additional reactor 

trip systems have been installed on all units. On Ringhals 1 an entire diverse 

plant section (DPS) has been installed in addition to the original plant section 

(OPS). Measures to strengthen the physical and functional separation of the 

trains have been taken. 

The parallel trains may in some cases perform the intended functions by 

different methods such as steam driven and motor driven pumps, 

diversification. 

The plant is designed to protect the barriers with automatically taken 

measures or by permitting reasonable time for consideration of manual 

actions. The latter is often called "Grace time" or "Time for reflection". 

All units are equipped with steam driven systems to provide core cooling 

capabilities, either directly to the reactor vessel (BWR) or via the steam 

generators (PWR). 

The power supply to the unit during normal operation consists of two 

alternative sources; the national 400 kV grid and the national 130 kV grid. 

At accident conditions, the power is supplied by four dedicated diesel 

generators and gas turbine plant common for the site. Ringhals 1 has in 

addition to this another two air cooled diesel generators installed within the 

diversified plant section. The unit is also equipped with house load operation 

feature, according to the national grid requirements. Furthermore, an 

additional full capacity mobile diesel generator is available at the site. The 

power supply to the filtered vent systems has independent battery capacity 

and a dedicated mobile generator set. 

The spent fuel is stored in the spent fuel pools at the unit for an average time 

of one year, prior to transportation to the national spent fuel storage facility. 

Hemlig 13 (52)





2.3.1 Ringhals 1 characteristics 

Ringhals 1 is an ASEA-Atom design BWR with a rated thermal power of 

2540 MW. The first criticality was achieved by august 20, 1973. 


Ringhals 2 is a Westinghouse design three loop PWR with a rated thermal 

power of 2660 MW. The first criticality was achieved by June 19, 1974. 



power of 3151 MW. The first criticality was achieved by July 29, 1980. 



power of 2783 MW. The first criticality was achieved by May 19, 1982. 

2.4 Safety significant differences 

The safety significant properties and differences regarding the areas of the 

stress test scope (earthquake, flooding, LOOP/SBO, UHS, severe accident 

management) are discussed below. 

All units are finalising programs to improve the safety of the plants as 

requested in regulations that have been implemented for that purpose 

(SSMFS 2008:17). These requirements encompass the ability of the units to 

cope with external events. 

Earthquake 

With regard to the safety properties during earthquake conditions, there are 

no significant structural differences between the units. 

The four units at the site are exposed to the same seismic conditions. 

Originally, the units were not designed with seismic considerations since 

Sweden is a zone with low seismic activity. 

The modern national regulations require seismic upgrading of the units, 

which is an ongoing work. 

The BWR unit is divided into two parts regarding the safety features, OPS 

(Original Plant Section) and DPS (Diverse Plant Section), where the DPS is 

seismically qualified. 

The I&C-system on Ringhals 2 was recently replaced and seismically 

qualified. 

Hemlig 14 (52)





The essential safety feature with regard to radioactive releases, the filtered 

vent of the containments, was originally designed with seismic 

considerations. 

Flooding 

With regard to the safety properties at flooding conditions, there are no 

significant differences between the units. 

The four units are erected at the same ground level, 3 meters above sea level, 

and are consequently equally exposed to flooding. Other potential flooding 

sources such as dams or rivers do not exist in the vicinity of the site. 

Loss of offsite power/Station blackout (LOOP/SBO) 

With regard to the safety properties at LOOP/SBO conditions, there are 

differences between the units. 

All units are equipped with four diesel generators, supplying redundant 

equipment. The durability of the diesel generators is further discussed in the 

LOOP section of the report. 

Ringhals 1 is further equipped with two additional diesel generators, 

supplying the DPS. (At Ringhals 1, a physically and functionally separated 

and diversified reactor protection system called DPS (Diversified Plant 

Section) has been installed. The DPS works in parallel with the Original 

Plant Section, OPS.) 

All units have steam driven systems supplying cooling capacity at loss of 

power situations. 

All units are supplied with battery capacity for the SBO case. The durability 

of the batteries is further discussed in the SBO section of the report. 

Ultimate Heat Sink (UHS) 

With regard to the safety properties of the UHS, there are no significant 

differences between the units. 

The UHS is the sea. The seawater canal system is similar for all units. 

The properties of the seawater canal system are further discussed in the UHS 

section of the report. 

Severe accident management 

With regard to severe accident management, there is no significant difference 

between the units. 

Hemlig 15 (52)





The severe accident management is based on the presence of the filtered vent 

feature of the units. The severe accident scenario resulting in a reactor vessel 

melt-through trained in similar ways for the BWR and the PWR’s. 

The accident management organisation is common for the site. 

2.5 Defence in depth principle 

As described above the plants are designed with the safety objective of 

confining the radioactive material by physical barriers, maintained by 

dedicated protective systems and the management of the plant. This 

philosophy is described in the defence in depth principle. 

In order to meet the principal safety objectives, the concept of defence in 

depth is one of the most fundamental principles guiding the design of the 

plant and the principles for administrative control of the operation, providing 

an overall strategy for safety measures and features of nuclear power plants. 

When properly applied, the defence in depth concept ensures that no single 

human or equipment failure would lead to harm to the public, and even 

combinations of failures that are improbable would lead to little or no harm. 

Defence in depth helps to establish that the basic safety functions; 

- Controlling the power, 

- Cooling the fuel, and 

- Confining radioactive material, 

are preserved, and that radioactive material do not reach people or the 

environment. 

The principle of defence in depth is implemented primarily by means of a 

series of barriers which would in principle never be jeopardized, and which 

must be violated in turn before harm can occur to people or the environment. 

These barriers are physical, providing for the confinement of radioactive 

materials at successive locations. 

The concept of defence in depth, as applied to all safety activities, whether 

organizational, behavioural or design related, ensures that they are subject to 

overlapping provisions, so that if a failure were to occur, it would be 

detected and compensated for or corrected by appropriate measures. 

Application of the defence in depth concept throughout design and operation 

provides a graded protection against a wide variety of transients, anticipated 

operational occurrences and accidents, including those resulting from 

equipment failure of human action within the plant, and events that originate 

outside the plant. 

With the publication of INSAG-3, 1988 five levels, as presented in the list 

below, were defined 

Hemlig 16 (52)





Levels of 

defence in 

depth 

Level 1 

Level 2 

Level 3 

Level 4 

Level 5 

Objective 

Prevention of abnormal operation and 

failures 

Control of abnormal operation and 

detection of failures 

Control of accidents within the design 

basis 

Control of severe plant conditions, 

including prevention of accident 

progression and mitigation of the 

consequences of severe accidents 

Mitigation of radiological consequences 

of significant releases of radioactive 

materials 

Essential means 

Conservative design and high 

quality in construction and 

operation 

Control, limiting and 

protection systems and other 

surveillance features 

Engineered safety features and 

accident procedures 

Complementary measures and 

accident management 

Off-site emergency response 

Application of the concept of defence in depth in the design of the plant 

provides a series of levels of defence (inherent features, equipment and 

procedures) aimed at preventing accidents and ensuring appropriate 

protection in the event that prevention fails. 

The aim of the first level of defence is to prevent deviations from normal 

operation. This leads to the requirement that the plant should be soundly and 

conservatively designed, constructed, maintained and operated in accordance 

with appropriate quality levels and engineering practices, such as the 

application of redundancy, independence and diversity in order prevent 

equipment failures. 

The aim of the second level of defence is to detect and intercept deviations 

from normal operational states in order to prevent anticipated operational 

occurrences from escalating to accident conditions. This is in recognition of 

the fact that some postulated initiating events are likely to occur over the 

service lifetime of a nuclear power plant, despite the care taken to prevent 

them. This level necessitates the provision of specific systems as determined 

in the safety analysis and the definition of operating procedures to prevent or 

minimize damage from such postulated initiating events. 

For the third level of defence, it is assumed that, although very unlikely, the 

escalation of certain anticipated operational occurrences or postulated 

initiating events may not be arrested by a preceding level and a more serious 

event may develop. These unlikely events are anticipated in the design basis 

for the plant, and inherent safety features, fail-safe design, additional 

equipment and procedures are provided to control their consequences and to 

achieve stable and acceptable plant states following such events. This leads 

Hemlig 17 (52)





to the requirement that engineered safety features be provided that are 

capable of leading the plant first to a controlled state, and subsequently to a 

safe shutdown state, and maintaining at least one barrier for the confinement 

of radioactive material. 

The aim of the fourth level of defence is to address severe accidents in which 

the design basis may be exceeded and to ensure that radioactive releases are 

kept as low as practicable. The most important objective of this level is the 

protection of the confinement function. This may be achieved by 

complementary measures and procedures to prevent accident progression, 

and by mitigation of the consequences of selected severe accidents, in 

addition to accident management procedures. The protection provided by the 

confinement may be demonstrated using best estimate methods. 

The fifth and final level of defence is aimed at mitigation of the radiological 

consequences of potential releases of radioactive materials that may result 

from accident conditions. This requires the provision of an adequately 

equipped emergency control center, and plans for the on-site and off-site 

emergency response. 

A relevant aspect of the implementation of defence in depth is the provision 

in the design of a series of physical barriers to confine the radioactive 

material at specified locations. The number of necessary physical barriers 

depends on the potential internal and external hazards, and the potential 

consequences of failures. Interaction between the defence in depth concept 

and the barrier concept can be illustrated with the following figure. 

Hemlig 18 (52)





Fig 2-1, Defence in depth vs barriers 

Hemlig 19 (52)





2.6 The containment filtered vent feature 

A common characteristic of the units is the containment filtered vent feature. 

R1-R4 started commercial operation 1975-1983 and were designed a decade 

earlier, with a clear focus at prevention of core damage (i.e. level 1-3 of the 

defence in depth principle). Due to the TMI-2 accident 1979 the interest for 

mitigating actions increased (i.e. level 4-5 of the defence in depth principle) 

and as a result some mitigating systems were implemented in Ringhals in the 

late 1980:s: 

- Containment Filtered Vent (CFV, system 362) 

- Independent Containment Spray (ICS, system 367/365 injecting via 

system 322) 

The filtered containment venting feature was installed in the Swedish power 

plants as a result of new requirements stipulated by the Swedish government. 

The Ringhals specific requirement is referred to as “Regeringsbeslut 11, 

1986” [27]. 

The design requirements of the filtered vent are i.a (according to 

regeringsbeslut 11) 

- In the case of core damage, prepared plant specific strategies shall exist 

in order to protect the reactor containment function and to reach a stable 

condition where the core is cooled and covered by water. 

- It is vital that the reactor containment function remains intact during the 

first 10 to 15 hours after a core damage. 

- In order to protect the reactor containment against damage from 

overpressure during severe accident events, a controlled depressurization 

of the reactor containment shall be feasible. The pressure relief devices 

shall be independent of operator actions and independent of other safety 

systems. The pressure relief devices shall also be possible to operate by 

the operators. 

- The releases shall be limited to maximum 0.1 % of the reactor core 

content of cesium-134 and cesium-137 in a reactor core of 1800 MW 

thermal power, provided that other nuclides of significance, from the use 

of land viewpoint, are limited to the same extent as cesium. 

The chosen design scenario is station blackout (SBO, loss of all AC) and loss 

of steam-driven pumps, with no manual actions credited during the first 8 

hours. Without actions or mitigating systems such a scenario will typically 

give serious core degradation within 1-2 hours, vessel failure within 2-4 

hours followed by containment overpressurization and somewhat later gross 

failure of containment with large releases of fission products, unless 

mitigating measures are taken. 

Hemlig 20 (52)





The requirement is to mitigate the design scenario so that the release of 

134 Cs and 137 Cs will be no more than corresponding to 0.1% of the core 

inventory of a 1800 MW th core. 

After 8 hours the ICS is assumed to be available, which will reduce the containment 

pressure and temporarily terminate the filtered release (or delay the 

initiation). 

In the design scenario for BWR (R1) the pressure in the containment will not 

reach the design pressure within 8 hours, why the actuation of ICS at this 

time will significantly delay the overpressurization of the containment until 

more than 24 hours. Somewhat later at a certain pressure the CFV is assumed 

to be actuated manually, but in case of no manual actions the CFV will be 

automatically actuated through the bursting of a rupture disk. 

In the design scenario for PWR (R2-R4), the pressure in the containment typically 

will reach the design pressure after 4-6 hours. Since no manual 

actions are credited during the first 8 hours the CFV will be automatically 

actuated through the bursting of a rupture disk and will reduce the 

containment pressure through a filtered release. After 8 hours the ICS is 

available which will reduce containment pressure and terminate the current 

CFV-release. 

However, (for both BWR and PWR) if no other means of cooling of the containment 

becomes available the ICS injection cannot continue “forever” since 

it will fill up the containment and has to be terminated at a certain level after 

approximately 30 hours. The pressure will then rise and there will be repeated 

activations of the CFV with an energy balance established with “feedand-boil” 

with the ICS intermittently injecting water and the CFV dissipating 

energy through a filtered release of steam. 

The possibility to passively (no operator decision required) prevent a 

containment over-pressurization is an important feature when answering the 

ENSREG questions about protecting containment integrity. 

All plants have chosen the FILTRA/MVSS concept to fulfill the 

requirements. 

FILTRA/MVSS stands for Filtered Containment Venting – Multi Venturi 

Scrubber System. The major component is a scrubber system comprising a 

large number of small venturi scrubbers submerged in a water pool. A 

venturi scrubber is a gas cleaning device that relies on the passage of the gas 

through a fine mist of water droplets. The design of the venturis is based 

upon the suppliers wide experience in this area gained in designing venturis 

for cleaning polluted gases from various industrial plants. 

Separation of aerosols and gaseous iodine takes place in the venturis and the 

radioactive matter is transferred to the pool water. 

Since the venturis are located on different levels and are sealed off by the 

internal water level, the number of engaged venturis is proportional to the 

pressure in the containment and thereby the total relief flow. Consequently, 

each venturi always operate close to the optimal flow and high 

Hemlig 21 (52)





decontamination factors are therefore achieved over a wide flow range. The 

activation of venturis is inherently automatic and no external flow control is 

required. 

A moisture separator collects the entrained pool water droplets efficiently. 

The basic design requirement in Sweden was that depressurization of the 

reactor containment shall be possible without relying on operator action. This 

required activation by means of a rupture disc and efficient separation over a 

very wide flow range. Further, a sturdy design operating at low pressure was 

preferred, in order not to have the filter function jeopardized by dynamic 

effects such as hydrogen explosions. 

A principal figure of the filter is shown below. 

Fig 2-1, Containment filtered vent principal design 

A = Pressure relief line 

from the containment 

D = Pool 

G = Pressure vessel 

B = Venturi distribution E = Moisture H = Manhole 

Hemlig 22 (52)





system 

C = Venturis including 

riser pipe 

separator 

F = Release to 

atmosphere 

I = Liner 

A principal sketch of the connection to the containment is shown below. 

Figure 2-2, FILTRA/MVSS connection to the containment 

2.7 Performed safety enhancements 

At Ringhals, safety enhancing plant modifications have been performed 

during the lifetime of the units. The major modifications are: 

- Modifications triggered by the TMI accident 

- The severe accident mitigation systems and procedures (including i. a. 

the containment filtered vent feature) 

- Steam generator replacements 

- Recirculation strainer reinforcements 

- Replacement of the I&C equipment on Ringhals 2, including a diverse 

protection system 

- Installation of a diverse protection system on Ringhals 3 and 4 

Hemlig 23 (52)





- Installation of a functionally and physically diverse protection section 

(DPS) on Ringhals 1 

- Installation of passive hydrogen recombiners 

- Localizing the plant specific simulators on site, achieving increased 

training opportunities and efficiency. 

- Development and training of the emergency response organization, based 

on experiences from drills and events such as TMI and the Chernobyl 

accident. 

2.8 Routine safety enhancement work 

Safety evaluations are a part of the daily work tasks. The plant technical 

specification controls the safe operation of the units, and each deviation from 

this is subject to a safety evaluation in the resulting licensee event report. 

The experience feedback system of site supplies potential safety 

enhancements based on information from suppliers and organizations. 

The safety level of the units is also continuously developed driven by the 

development of the national regulations. Revised regulations requires 

backfitting of the units to fulfil the new requirements. 

At present, such a backfit program is in progress . The program is extensive, 

with a time schedule of several years [14-17]. 

Periodic safety reviews are made each 10 year and in addition (safety) 

reviews are made by external expertise from IAEA and WANO. 

2.9 Scope and results of PSA 

2.9.1 Scope 

2.9.2 Ringhals 1 

The PSA models for Ringhals 1, 2, 3 and 4 are plant specific. The focus is on 

the frequency of core damage, PSA level 1, and the frequency of release of 

radioactive substances, PSA level 2. The PSA models constitute an 

important tool for many risk-informed applications and the results are 

described in the Safety Analysis Report (SAR) for each plant. However it is 

important to bear in mind that the results of a PSA are valid only given 

certain conditions and assumptions. This also implies that the numerical 

values for different plants (including the four units at Ringhals) are not 

directly comparable due to differences in the modelling. 

The results for Ringhals 1 are taken from the Ringhals 1 SAR [23]. 

Results PSA level 1 for power operation 

Hemlig 24 (52)





The mean value of the core damage frequency from all initiating events 

which are modelled for power operation is 2.2E-5 /year. The contributions to 

this value from different initiating event types are shown in figure 2.9.2-1. 

Figure 2.9.2-1. Contribution to the core damage frequency during power 

operation from different types of initiating events 

Results PSA level 2 for power operation 

Releases exceeding 0.1 % of the core inventory of radioactive materials for a 

reactor of 1800 MW are defined as releases which corresponds to 0.072% of 

the core inventory for Ringhals 1. 

The result is a release frequency for Ringhals 1 of 2.8E-6 /year. 

Results PSA level 1 for low power operating modes 

The mean value of the core damage frequency from all initiating events, 

which are modelled for the low power operating modes, is 2.0E-6 / year. 

The contributions to this value from the different initiating event types are 

shown in figure 2.9.2-2. 

Figure 2.9.2-2. Contribution to the core damage frequency during low 

power operating modes from different types of initiating events 

Results PSA level 2 for low power operating modes 

The release frequency for the low power operating modes is estimated to be 

1.8E-7/year. 

Results PSA level 1 for refueling outage 

Hemlig 25 (52)






which are modelled for a refueling outage, is 5.9E-5 / year. 


shown in figure 2.9.2-3. External events are analysed but the contribution is 

shown to be small enough to neglect. 

Figure 2.9.2-3 Contribution to the core damage frequency during refuelling 

outage from different types of initiating events 



The release frequency is defined in the same way as for power operation. 

This is estimated to be 1.2E-6 /year. 1.5.3 

The results for Ringhals 2 are taken from the R2 SAR, Part 8.7 Probabilistic 

Safety Analyses [24]. 

Results PSA level 1 for power operation and the low power operating 

modes 


which are modelled for power operation and the low power operating modes, 

is 3.6E-5 /year. 



Hemlig 26 (52)





Internal Events 

46% 

Area Events 

52% 

External Events 

2% 


Figure 2.9.2-4. Contribution to the core damage frequency during refuelling 



modes 

The large early release frequency for Ringhals 2 is estimated to be 7.5E-7 

/year. 

Results PSA level 1 and 2 for refueling outage 

A plant specific analysis of the shutdown states has been developed but is 

not yet included in the R2 SAR. However an indication of the risk 

distribution can be achieved by studying the results from the corresponding 

analyses for Ringhals 3 and Ringhals 4. 

The results for Ringhals 3 are taken from the R3 SAR Chapter 15.9 – 

Probabilistic Safety Analysis [25]. 


modes 

The mean value of the core damage frequency from all initiating events 

which are modelled for power operation and the low power operating modes 




Hemlig 27 (52)






47% 

Area Events 

48% 


5% 




modes 

The release frequency for Ringhals 3 is 9.3E-7 /year. 



which are modelled for a refueling outage, is 1.5E-5 /year. 




Area Events 

31% 


69% 

Figure 2.9.2-6. Contribution to the core damage frequency during refuelling 



Hemlig 28 (52)






The release frequency is defined in the same way as for power operation. 

This is estimated to be 1.6E-6 /year. 

The results for Ringhals 4 are taken from the R4 Förnyad SAR Systemdel 

Kapitel 15.9 – Probabilistic Safety Analysis [26]. 


modes 

The mean value for the core damage frequency from all initiating events 

which are modelled for power operation and the low power operating modes 





35% 


4% 

Area Events 

61% 




modes 

The release frequency for Ringhals 4 as 1.1E-6 /year. 



which are modelled for a refueling outage, is 4.4E-5 /year. 




Hemlig 29 (52)






49% 

Area Events 

51% 

Figure 2.9.2-8. Contribution to the core damage frequency during 

refuelling outage from different types of initiating events 


The release frequency is defined in the same way as for power operation and 

estimated to be 1.8E-6 /year. 

3 STRESSTEST RESULTS 

3.1 Earthquake 

This summary of the earthquake evaluation is a summary of [28]. The 

summary is at an overall level, presenting the main areas for improvement. 

An assessment has been performed of the properties of the plant at elevated 

earthquake conditions. The severity of the earthquake assumed has been 

increased from the design basis level of a 10 -5 earthquake to a 10 -7 

earthquake. This results in an increase of the accelerations of about four 

times. The engineering judgement is that the containments, fuel buildings, 

spent fuel pools and containment filtered vents will be able to fulfill their 

functions. Further analysis are required regarding the spent fuel pool cooling 

equipment, the Control Rod Drive Mechanisms of Ringhals 2/3/4, the 

Ringhals 1 scram system and the Ringhals 1 reactor building roof. 

In the original design, seismic loads were not included as design basis since 

the loads from earthquakes were considered small. The robustness of the 

structures called on for other reasons was considered enough to withstand 

the possible earthquakes. 

Thereafter, seismic requirements have been applied. 

Seismic loads have originally been applied for the Containment Filtered 

Vents (CFVs) and mobile units for water and power supply. The CFVs were 

installed during the late 80’s in accordance with the Swedish government 

decision 11 [27]. The ground response spectra for the CFVs were chosen in 

Hemlig 30 (52)





accordance with US NRC Regulatory Guide 1.60 scaled to a PGA of 0.15 g 

horizontally and 0.10 g vertically. 

Further, seismic events with a probability of 10 -5 per year have been 

considered at plant modifications performed since the beginning of the 90’s, 

concerning equipment important for reactor safety. The ground response 

spectra used are valid for a typical Swedish hard rock site and are based on 

[21]. 

The assessment is that the units can reach safe shutdown at a 10 -5 

earthquake. The spent fuel cooling systems are not seismically qualified. 

The stress test is performed by applying a more severe earthquake than the 

Swedish 10-5 earthquake. The applied case is an earthquake corresponding 

to an exceedance frequency of 10 -7 per site and year, based on [21]. The 

resulting peak ground acceleration is 0,41g, i.e. about four times higher than 

the DBE acceleration of 0,11g. 

Based on this earthquake level, the release preventing features of the plant 

and the spent fuel pools are evaluated. The release preventing features in this 

context are the containment with isolation provisions and the mitigation 

systems below: 

- Redundant water supply to the containment. Water supply is 

available from the mobile unit for water and power supply. 

- Controlled pressure relief of the reactor containment is performed via 

the MVSS (Multi Venture Scrubber System) connected to the reactor 

containment with a pipe. 

- Non-filtered pressure relief of the reactor containment at LOCA in 

combination with degraded pressure suppression function. (Only for 

BWR.) 

- Also other systems credited at severe accidents are evaluated, such as 

trip systems, pressure relief systems 

It has further been evaluated if an earthquake could cause a flooding of the 

plant. The evaluation shows that this is not a realistic combination at the 

Ringhals site. 

The engineering judgement is that the containment integrities will be 

maintained, the containment filtered vents will be able to fulfill their 

functions, and the mitigation systems will be able to fulfill their functions in 

case of an earthquake with frequency level 10 -7 annual at site. 

The fuel storage pools and the fuel racks of Ringhals 1 are judged to be able 

to fulfill their functions in case of an earthquake with frequency level 10 -7 

annual at site. 

The fuel storage pools of Ringhals 2-4 are judged to be able to fulfill their 

functions in case of an earthquake with frequency level 10 -7 annual at site, 

while the fuel racks needs further consideration. 

Hemlig 31 (52)





3.2 Flooding 

The spent fuel cooling equipment on all units are not seismically qualified 

and needs further analysis regarding their possibility to maintain the cooling 

function after an earthquake. The roof of the reactor building of Ringhals 1 

needs further analysis. 

The CRDM’s of Ringhals 2-4 and the scram system of Ringhals 1 also needs 

further analysis. 

This summary of the flooding evaluation is a summary of [6]. The summary 

is at an overall level, presenting the main areas for improvement. 

The Ringhals site is situated on the Swedish west coast, utilizing the sea as 

ultimate heat sink. In the vicinity of the site, there are no dams or rivers 

constituting sources of flooding. The single source of flooding with the 

potential to cause a sequence of events resulting in fuel damage is a sea-level 

rise. 

The phenomena tsunami is not assumed to occur in Sweden. This 

assumptions is motivated by the requirement of large seismic activities 

combined by large depths of the sea in order to create a tsunami. The seismic 

activity in the Scandinavian area is low and the waters are relatively shallow. 

Historically, no tsunamis have ever been registered in Swedish waters [1]. 

A sea-level rise is the considered source of a flooding event. The design 

bases flooding, DBF, is a sea-level of 102,65 m. The normal sea-level is 

specified as 100 m and the ground level at site is 103 m. 

The design bases flooding is based on statistics during the period 1887 to 

2006 [2]. The original DBF was 101,43 m, a so-called 100-year value that, 

as the name indicates, was the highest water level measured during a 100- 

year period. In accordance with the regulations stated in § 14 of SSMFS 

2008:17, this was reconsidered in order to reflect a flooding with a frequency 

of 10 -4 to 10 -6 /year. The flooding level of 102,65 m has been determined to 

have the frequency 10 -5 /year [3]. 

The design basis is judged to be adequate, based on the large number of 

measurements of the sea level available. 

In accordance with the ENSREG stresstest specification an evaluation of the 

margins have been performed. In the flooding case, the robustness of the 

plant when exceeding the DBF has been evaluated. The evaluated scenarios 

and results are: 

Hemlig 32 (52)





Scenario Sea water level Comment Fuel 

damage 

1 Below +102,65 m DBF which the plant is 

designed to handle 

2 +102,65 m - +103 m Flooding above DBF but 

not above ground level 

3 +103 m - +103,3 m Flooding above ground 

level, manageable 

amounts of water 

entering the buildings 

4 +103,3 m - +104 m Flooding significantly 

above ground level, 

large amount of water 

entering the buildings 

5 Above +104 m The main doors break 

and all buildings are 

internally flooded up to 

this level. 

No 

No 

Unlikely 

Possible 

Yes 

In scenario 1, the sea-level is within the DBF which is discussed above. 

In scenario 2, the sea-level is above the DBF but below ground level. In this 

situation the cooling water tunnels will be the affected part of the plant as 

discussed above. 

In scenario 3 manageable amounts of water will enter the plant and severe 

damage to the fuel is therefore deemed to be unlikely. Water will enter the 

plant through leakages in doors and pipe/cable penetrations, e.g. in the intake 

buildings. The leakage will be limited and no catastrophic failure will occur. 

The probability of a sea-level above +103 m has not been calculated but, as 

a comparison, a flood of +103,1 m is according to report [2] assumed to have 

a frequency of 10 -6 /year. 

In scenario 4 large amounts of water will enter the plant through various 

openings. It is difficult to predict whether or not this level of water will lead 

to severe damage to the fuel since that depends on a number of factors such 

as which rooms are flooded and the duration of the flooding. The probability 

of a sea-level above +103 m has not been calculated but, as a comparison, a 

flood of +103,1 m is according to report [2] assumed to have a frequency of 

10 -6 /year. 

Hemlig 33 (52)





In scenario 5 the water reaches a level where the doors break. When the 

doors break the water will flood the entire plant instantly up to the level the 

flood was before the doors broke. Components of safety significance will be 

flooded and core damage (as well as spent fuel storage damage) will occur. 

The cliff edge effects identified at the evaluation of the flooding event are 

summarized: 

- As the DBF will not lead to internal flooding no cliff edge effects are 

identified within the DBF scenario. 

Beyond the DBF, i.e. with a postulated sea level rise of 4 m, cliff edge 

effects have been identified: 

- The significant cliff edge effect is the water level at which the outer 

doors will break and the buildings instantaneously will be flooded. 

Based on the identified cliff edge effects, the following area will be subject 

to reinforcements or in depth evaluations: 

- The ultimate cliff edge effect is when the doors break and the plant 

becomes flooded with core and spent fuel damage as a result. 

3.3 Loss of offsite power (LOOP) and station blackout (SBO) 

This summary of the cases loss of offsite power and station blackout is a 

summary of [4]. The summary is at an overall level, presenting the main 

areas for improvement. 

The onsite power system is designed with several alternate AC-power 

sources and emergency diesel generators that can be used if offsite power is 

lost. From a functional perspective, the power supply can be illustrated as 

shown in the figure below. 

Hemlig 34 (52)





Fig 3.3-1, Functional design of power supply system 

AC-sources 

The AC system consists of a number of subsystems that ensures that the 

onsite power system under all operating conditions has power supply so that 

the safety systems can perform their safety function. 

In principal there are three different AC power sources for supply to the 

safety power systems, and these are: 

1. Normal supply path via the 400 kV transmission system and/or the main 

generator via unit auxiliary transformer and the 6 kV busbar in the 

preferred power supply. 

2. Alternative supply path from 130 kV transmission system via the start-up 

transformer, start-up switchgear and the 6 kV busbar in the preferred 

power supply. Via this supply path a connection can be established to the 

gas turbines when required. 

3. Diesel generators (1 per electrical train), which during loss of offsite 

power automatically takes over the supply of the safety power systems. 

There is also a mobile diesel generator (DG910) available at Ringhals, 

which can replace any of the ordinary emergency diesel generators. 

Normally the supply path from the 400 kV transmission system is used, but 

there is also fast-bus-transfer equipment to change the supply to the 130 kV 

transmission system. There is one fast-bus-transfer equipment for each 

electrical train (A, C, B, D) and these equipments are independent of each 

other and supplied by batteries (110 V DC). 

Hemlig 35 (52)





Should the power supply according to both 1 and 2 fail, there are four diesel 

generators ready to automatically start up and take over the supply of the 

safety power systems, one diesel generator per electrical train. 

Further, all four units at the Ringhals NPP are designed to be able to transfer 

to house load operation if offsite power should be lost. During house load 

operation the main generators are only supplying the units onsite power 

system with electrical power. The main generators are no longer connected 

to the 400kV grid, so the electrical power that is generated only cover the 

need for the unit itself. It is an advantage (positive for the defense in depth 

strategy) to have an additional source of electrical power for safety power 

system equipment in a situation when offsite power is lost, especially if both 

possibilities (400kV and 130 kV) to feed the electrical distribution system 

from offsite power is lost at the same time. 

DC supplies 

In principal there are two different DC power sources and supplies for 

supplying the DC distribution systems. 

1. Rectifiers supplied by the safety power systems. 

The rectifiers supply connected DC loads with uninterrupted power and 

at the same time charge or maintain batteries in a fully charged state. 

2. Batteries. 

During loss of voltage on the preferred power supply an interruption in 

voltage will occur before the diesel-generators have started and 

energized the 6 kV safety power systems. During this time the batteries 

will take over and supply connected DC loads with uninterruptible 

power. 

The robustness of the unit power supply is evaluated in accordance with the 

ENSREG stress test specification and divided into three cases: 

1. Loss of offsite power, LOOP, meaning that the power from the 400 kV 

and 130 kV grids is lost while emergency diesel generators, gas turbines 

and batteries are still available. 

2. LOOP and loss of on-site backup power sources meaning that the power 

from the 400 kV and 130 kV grids is lost together with loss of 

emergency diesel generators, while gas turbines, batteries and diversified 

emergency diesel generators are still available. The diversified diesel 

generators intended here are two dedicated diesel generators supplying 

the DPS part of Ringhals 1 (Ringhals 1 safety systems are divided into 

two separate sections, Original Plant Section OPS and the Diverse Plant 

Section DPS. The sections are functionally and physically separated). 

3. LOOP and loss of the ordinary back-up sources and loss of any other 

diverse back-up sources meaning that only battery secured power 

systems are available. 

Hemlig 36 (52)





Case 1, Loss of offsite power, LOOP, meaning that the power from the 400 

kV and 130 kV grids is lost while emergency diesel generators and gas 

turbines are still available 

This case constitutes a design case for the units. The grid is assumed to be 

lost and if house load operation fails the remaining power source for the vital 

equipment is the four emergency power diesel generators (Ringhals 1 

equipped with two additional diesels). The gas turbines also remains intact. 

The case is functionally described in the figure below. 

Fig 3.3-2, Functional design of power supply system, LOOP condition 

The robustness of the plant is in this situation controlled by the endurance of 

the emergency power diesel generators, i.e. from a practical point of view 

the supplies of fuel- and lube oil. A calculation of these consumables has 

been performed. 

The calculations of the consumables are based on the assumption that the 

initial condition is power operation, because the consumption of 

consumables (diesel, etc.) is highest in an emergency scenario that starts 

during power operation. The calculations are based primarily on the 

minimum allowable stored volume, according to the technical specifications. 

The result will be valid when all units are affected at the same time. 

However, if for instance only one unit is affected the consumption of fuel 

and lubrication oil for this unit will be the same but the endurance will be 

significantly longer. This because the supplies that are common for all four 

units can be used for the affected plant only. 

The result is summarized in the following figure. 

Hemlig 37 (52)





Light equipment on-site 

Heavy equipment on-site 

Fuel 

OPS 

Lube oil 

Unit 1 

Fuel 

DPS 

Lube oil 

Unit 2 

Fuel 

Lube oil 

Unit 3/4 

Fuel 

Lube oil 

Time 

1 day 3 days 7 days 

On-site supplies – no refilling required 

on-site supplies – refilling required 

off-site supplies / refilling from other units tanks 

Fig 3.3-3, Usage of consumables 

The calculations shows that if all four units are affected simultaneously, 

delivery of diesel fuel is required after five days. After five days 

transportation to the site and within the site area is assumed to be feasible. 

The power supply from the gasturbines has a fuel supply enabling power 

delivery for a period of several weeks. 

The result of the evaluation is that the power supply in this case can be 

maintained for a long time. Hence, no fuel damage will occur in this case. 

Case 2, LOOP and loss of on-site backup power sources meaning that the 

power from the 400 kV and 130 kV grids is lost together with loss of 

emergency diesel generators, while gas turbines and diversified emergency 

diesel generators are still available. 

In this case the grid is assumed to be lost, the four emergency power diesel 

generators do not start and house load operation is not credited, resulting in 

that the remaining power source for the vital equipment is the gas turbines. 

Hemlig 38 (52)






Fig 3.3-4, Functional design of power supply system, LOOP and loss of onsite 

backup power sources 

The robustness of the plant is in this situation controlled by the endurance of 

the gas turbines, i.e. from a practical point of view the fuel- and lube oil 

supplies. 

The evaluation shows that at a simultaneous occurence of this event at all 

four units, the power supply from the gas turbines will have an endurance of 

several weeks. Rated power for one gas turbine is greater than the rated 

power of all emergency diesel generators in Ringhals together (the gas 

turbine power station consists of four gas turbines). 

In addition to the gas turbines Ringhals 1 is equipped with two diversified 

diesel generators within the DPS-section of the plant (Diversified Plant 

Section). These diesel generators are assumed to be operable and the 

evaluation shows an endurance of seven days until refueling is required. 

The result of the evaluation is that the power supply in this case can be 

maintained for a long time. Hence, no fuel damage will occur in this case. 

Case 3, LOOP and loss of the ordinary back-up sources and loss of any other 

diverse back-up sources meaning that only battery secured power systems 

are available 

In this case the grid is assumed to be lost, the emergency power diesel 

generators does not start, the gas turbines does not start and house load 

operation is not credited, resulting in that battery power remains for 

monitoring and control of the plant. 

Hemlig 39 (52)






Fig 3.3-5, Functional design of power supply system, LOOP and loss of the 

ordinary back-up sources and loss of any other diverse back-up sources 

In this situation, the plants are dependent on their steam driven auxiliary 

feedwater systems. 

Ringhals 1 is equipped with a steam driven auxiliary feedwater pump 

capable of delivering a flow corresponding to the steam released to the 

condensation pool. The pump is dependent of control valves, whose 

functional time is limited by the battery capacity. 

The PWR-units, Ringhals 2-4, are equipped with steam driven auxiliary 

feedwater pumps, cooling the units via the steam generators. The pumps may 

be locally operated manually. However, monitoring of the steam generators 

is required in this situation, which is dependent on battery power. It is 

possible to supply power to the monitoring function by the mobile unit for 

water and power supply. The survival time for the mobile unit without 

refueling is 1 day [4]. After 1 day it is assumed that refueling is feasible, in 

accordance with the ENSREG assumptions. 

For Ringhals 1, the evaluation shows that the time for depletion of batteries 

and loss of auxiliary feedwater results in an estimated time of 16 h until fuel 

damage occurs. 

For Ringhals 2-4, the evaluation shows that the time for depletion of 

batteries and loss of auxiliary feedwater results in an estimated time of 9 h 

until fuel damage occurs. Connecting the mobile unit for water and power 

supply enables the utilization of the steam driven auxiliary feedwater pump 

until the loss of RCS inventory by the RCP seal leakage causes fuel damage, 

which is estimated to occur after 3 days. 

In the scenario where the SBO occurs at low RCS inventory operation 

conditions in a PWR, fuel damage will be unavoidable in a shorter time 

Hemlig 40 (52)





range. The evaluation shows that fuel damage will be unavoidable after 10 

hours. 

In the case of SBO at low RCS inventory conditions, or when the steam 

driven systems are exhausted, we enter the containment filtered vent 

scenario. This scenario and associated equipment was installed at Swedish 

units in 1988, in accordance with the government decision 11, 1986 [27]. 

The scenario is described in chapter 2.6. 

The spent fuel stored in the spent fuel pools will also loose the cooling at a 

loss of power scenario. The spent fuel pools are evaluated in [5]. The 

evaluation shows that without corrective actions in order to reestablish 

cooling and/or feeding, fuel damage will occur after 3-5 days (PWR –BWR) 

in a refueling situation, i.e. maximum heat load assumed. 

During operation, i.e. with a heat load representative of an operating season, 

the evaluation shows that without corrective actions, fuel damage will occur 

after 13-26 days (PWR resp. BWR). 

The cliff edge effects identified at the evaluation of the three loss-of-power 

cases are summarized: 

- The battery depletion times decides the time period for which control and 

monitoring of the steam driven systems is feasible. 

- The feeding and cooling options for the spent fuel pools affects the time 

until fuel damage occurs 

Based on the identified cliff edge effects, the following areas will be subject 


- The adequacy of the present mobile pump/generator resources need to be 

assessed. 

- The battery capacity is generally an area to analyze further. 

- Some operating procedures for SBO recovery needs to be updated. 

- Cooling and feeding options and strategies for the spent fuel pools. 

3.4 Loss of ultimate heat sink without/with SBO 

This summary of the cases loss of ultimate heat sink without/with SBO is a 

summary of [4]. The summary is at an overall level, presenting the main 

areas for improvement. 

3.4.1 Loss of ultimate heat sink without SBO 

The ultimate heat sink of the units is the sea. The intake of the cooling water 

for the units has two intake canals; one for units 1 and 2 and one for units 3 

and 4. The intake canals are equipped with an outer intake barrier at the 

Hemlig 41 (52)





entrance of the canal, to prevent floating objects, such as timber, oil and ice, 

to enter the canal. 

The cooling water systems are common to Ringhals units 1 and 2 and 

Ringhals units 3 and 4. Each reactor pair is equipped with two intake 

buildings, one for main cooling water and one for auxiliary cooling water, 

with screening equipment for removal of debris from the seawater. The 

cooling water is lead back into the sea through two tunnels, one for each 

reactor pair. 

The cooling water system is designed with several sluice gates to allow 

different alignments in order to provide cooling water to the reactor 

buildings during all operation conditions (normal operation, maintenance, 

testing and postulated accidents). For example, if clogging of both intake 

buildings occurs, it is possible to provide auxiliary cooling water from the 

discharge water tunnel to the salt water system. If also the discharge water 

tunnel is clogged it is possible to re-circulate the cooling water in order to 

obtain cooling water to the salt water system. Also, one of the trains in the 

intake buildings for main cooling water is used as a backup for auxiliary 

cooling water. 

At normal operation, the cooling water flow is approximately 80 m 3 /s (to 

each reactor pair). In case of loss of off-site power for all units the auxiliary 

cooling water flow is approximately 7 m 3 /s. 

As mentioned above, the sea is the ultimate heat sink and the only source of 

water for the cooling water system. However, the probability of losing this 

source is low. There are also several ways to line up the cooling water 

depending on the situation. Events that could possibly result in a loss of UHS 

as a consequence are listed below. 

- Low water level 

- Clogging of intake water 

- Blocked discharge tunnel 

- Tunnel collapse 

The stress test is performed by, with a deterministic approach, postulating a 

long term loss of the UHS. Off-site power is assumed to be available. The 

cause of the loss of the UHS is not considered. Three different cases with 

different severity have been postulated: 

Case 1. 

Case 2. 

Case 3. 

Blockage of the intake buildings (possibility to use the discharge 

as intake) 

Blockage of the intake buildings and discharge tunnel (possibility 

to re-circulate the cooling water) 

Total loss of the UHS (no water available to the salt water system, 

715) 

Hemlig 42 (52)





Case 1, Blockage of the intake buildings (possibility to use the discharge as 

intake) 

In this case the intake of the seawater is blocked. Line-up is made to use the 

discharge tunnel as intake. 

The evaluation shows that this is a feasible way of maintaining the cooling 

chain working. No fuel damage will occur in this case. 

Case 2, Blockage of the intake buildings and discharge tunnel (possibility to 

re-circulate the cooling water) 

In this case both the intake and the discharge tunnel are blocked. Line-up is 

made to recirculate the contained amounts of water. This amount of water 

will accumulate the residual heat, and after some time the cooling chain will 

not be usable. The cooling of the units will then rely on the auxiliary 

feedwater systems together with associated sources of water. 

The evaluation neglects the time interval for heating the contained amount of 

sea-water, and focuses on the consumption time for the available sources of 

auxiliary feedwater. With this assumption the the available water sources 

will be emptied after 25 days (Ringhals 1), 17 days (Ringhals 2) and 11 days 

(Ringhals 3/4). Fuel damage will consequently occur at the earliest after 

these times. 

Case 3, Total loss of the UHS (no water available to the salt water system, 

715) 

In this case the sea-water is not available, causing the cooling chain to be 

inoperable. The cooling of the units will rely on the auxiliary feedwater 

systems together with associated sources of water. 

The evaluation focuses on the consumption time for the available sources of 

auxiliary feedwater. The available water sources will be emptied after 25 

days (Ringhals 1), 17 days (Ringhals 2) and 11 days (Ringhals 3/4). Fuel 

damage will consequently occur at the earliest after these times. 

In this evaluation, the case with loss of UHS when the RCS is at reduced 

inventory conditions in midloop conditions is not discussed. The SG’s are 

not available in this condition, and consequently the loss of UHS causes a 

loss of the cooling chain. This case is bounded by SBO at midloop or low 

RCS inventory conditions, resulting in a time range to unavoidable fuel 

damage of at least 10 hours, since safety injection is available in this case. 

During a loss of the ultimate heat sink the spent fuel pool cooling will also 

ultimately fail. Without corrective actions boiling will occur and the water 

level in the pool will decrease. Fuel damage will be unavoidable after 3-5 

days (PWR –BWR) The evaluation shows further that with feeding from 

available water sources fuel damage will occur after 3 weeks (Ringhals 1) 

and 2 weeks (Ringhals 2-4) respectively. 

Hemlig 43 (52)





The cliff edge effects identified at the evaluation of the three loss-of-UHS 

cases are summarized: 

- The water supplies will be emptied after certain periods of time. 

Based on the identified cliff edge effects, the following areas will be subject 


- The adequacy of the present water supplies need to be assessed. 

3.4.2 Loss of ultimate heat sink with SBO 

This case is bounded by the SBO-case as discussed in section 3.3 above. At 

an SBO event, one of the effects is that the operation of the pumps 

circulating the UHS coolant is interrupted. The plant response to the SBO 

events is consequently the same whether the UHS is lost or not. Hence, the 

method and the results for SBO described in section 3.3 are valid also for 

this case. 

3.5 Accident management 

This summary of the accident management is a summary of [31]. The 

summary is at an overall level, presenting the main areas for improvement. 

The accident management of the site consists of: 

- Emergency operating procedures, controlling the operators managing of 

the units 

- The emergency response organization, managing measures within the 

site and the coordination with external authorities and external resources. 

The emergency response organization includes a technical support 

function for the operators 

The emergency operating procedures are based on the generic procedure 

packages from the respective vendor, with plant specific adaptations. 

Specific adaptations have been performed with regard to the containment 

filtered vent feature, unique for the Swedish plant design. 

The emergency response organization is initiated by the engineer on duty, 

being on site around the clock (24/7). The organization includes 

management of the entire site, and the affected unit. The organization further 

includes technical support function for the operators, radiation protection 

function, coordination function and recovery staff. The organization has a 

response time of 2 h. 

The accident management is initially focused on preventing fuel damage. 

The strategy is to assure subcriticality, water supply to the core and removal 

of the residual heat. 

If core damage becomes unavoidable, the severe accident management 

strategies are applied. Actions are then shifted from prevention of fuel 

Hemlig 44 (52)





damage towards mitigation of the consequences to the public. Primary 

system pressure is reduced, in order to allow larger amounts of water to be 

injected into the system. Pressure reduction is also performed to avoid a high 

pressure melt-through of the reactor pressure vessel. Other strategies are also 

applied in preparation for a possible vessel melt-through. 

The severe accident strategies were developed as a part of the installation of 

the containment filtered vent. The containment filtered vent was installed in 

1988 as a result of a government decision (government decision 11, 1986), 

triggered by the TMI accident. The filtered vent is further described in 

section 2.6. 

If all measures to recover the core cooling fails, vessel melt-through will 

occur and the strategy is focused on maintaining the integrity of the 

containment. 

The containment integrity is challenged by: 

- An overpressure situation that may occur as a consequence of a hydrogen 

detonation, or as a consequence of steam formation due to vessel meltthrough. 

- Basemat melt-through as a consequence of ex-vessel core after a vessel 

melt-through. 

- Containment bypass by severe accident induced steam generator tube 

rupture in PWR 

These phenomena are taken into account within the safety systems and 

accident management of the units. 

The hydrogen detonation in BWR-containment is prevented by keeping an 

inerted atmosphere in the containment (nitrogen filling of the containment). 

The hydrogen detonation in PWR containments is prevented by the installed 

passive autocatalytic hydrogen recombiners, PAR. 

Overpressure of the containments is normally prevented by containment 

spraying. In the case of a station black-out it is still possible to spray the 

containment by use of mobile independent pump units. If spraying is not 

successful the pressure relief will be performed by the filtered vent feature 

described in section 2.6. The evaluation shows that the site has two mobile 

independent pump units, which may be inadequate if four units are affected 

simultaneously. 

For the PWR’s, preventing a base-mat melt-through is made by filling the 

containments with water to a certain level. The BWR always have the 

condensation pool filled with water underneath the reactor pressure vessel. 

Hemlig 45 (52)





These measures can be taken independently of power supply from 

emergency power diesel generators and batteries. Two dedicated mobile 

pump/generator units are available for the purpose. 

The evaluation further includes the management of the spent fuel pools at a 

loss of cooling event. At the loss of cooling, the radiation shielding achieved 

by the water level will decrease. The radiation shielding has decreased to an 

unacceptable level when the water level has decreased to 2 m above the fuel. 

This will with maximum heat load occur after 2-3 days (PWR – BWR) if no 

countermeasures are taken. 

As long as the radiation shielding is maintained, it is possible to restore the 

fuel pool cooling provided power is available. If power is not available, 

feeding of the pools by the use of firewater is possible. 

The adequacy of the existing accident management measures have been 

assessed: 

- Containment filtered vent system 

In the context of the Fukushima disaster the CFV system appears to be 

an important last line of defense capable of significantly mitigate 

accident scenarios with loss of several safety functions and core damage. 

The system is designed for earthquake, is unlikely to be affected by 

flooding and will retain most of its capability even without supporting 

actions. 

The system will be activated passively by a rupture-disc at excessive 

containment pressures, and hence no decision-making is required. 

- Hydrogen risk in PWR 

The PAR-system (Passive Autocatalytic hydrogen Recombiners) in the 

Ringhals PWR:s appears to be a robust and reliable way of limiting the 

risk associated with hydrogen from severe core damage. 

The system is designed for earthquake and independent of supporting 

systems. 

Hydrogen risk in BWR 

In the context of the Fukushima disaster the ability to vent the 

containment through the CFV-system appears to be an important 

possibility to reduce the hydrogen risk. The system is designed for 

earthquake, high radiation and high hydrogen concentrations, and have 

only minor dependencies on supporting systems. Purging containment 

with nitrogen might be difficult to do due to high radiation. 

The ability to handle hydrogen/oxygen without venting is less reliable for 

Hemlig 46 (52)





severe accident conditions, and may require further actions within a 

week. 

- Independent pump/generator 

The system 367 consists of 2 fire-trucks equipped with independent 

diesel-driven pump and generator. 

The pump can take suction at various sources including the sea, and can 

feed the containment spray system as well as feed-and-boil of the spentfuel 

pool. 

The generator charges the batteries in the 362-system. At PWR it can 

charge parts of the DC-batteries. 

The system is designed for earthquake and is fairly independent of 

supporting systems. 

Since there are 2 fire-trucks for 4 units the availability might be limited if 

considering more than one accident simultaneously, and/or considering 

several needs (e.g. fuel pool feeding and independent containment spray) 

simultaneously. 

Destroyed infrastructure might hinder the activation of the system. 

- Spent Fuel Pool (SFP) 

Generally the SFP:s have several possibilities for cooling, but most of 

them require that the SFP-building is habitable. 

According to [5] the time from loss of SFP cooling to onset of boiling is 

in some cases around 9-14 hours, and to loss of shielding around 2-3 

days. 

Once water-levels in the SFP has decreased through boiling, or because 

of structural failure, and caused loss of shielding, there are few severe 

accident management measures available. 

The site emergency response organization has been evaluated based on the 

Fukushima event: 

- The management of a Fukushima-size acccident requires an organization 

being independent of surrounding society for a relatively long period of 

time. This is not the design basis for Ringhals emergency response 

organization. 

- The present emergency response organization is basically designed to 

manage one affected unit. Training exercises have been performed on 

two affected units. 

- The emergency response organization has a response time of 2 h. 

However, if the infrastructure is damaged the assumed response time is 

Hemlig 47 (52)





in accordance with the ENSREG assumption, i.e. 24 h. This will affect 

the performance of the staff being on site. 

- The emergency response organization is not designed with flooding and 

earthquake as design basis. It is judged that an earthquake does not 

impact the emergency response organization. At a flooding event beyond 

DBF, to the stressed levels above ground level, the emergency response 

organization premises will be flooded. (A backup emergency response 

location is available) 

- The emergency response organization has no guidance for long time 

management of accidents of the Fukushima extent. 

4 SUMMARY ASSESSMENT 

An assessment has been made the site at situations beyond the design bases 

of the units. The assessment has been performed in accordance with the 

ENSREG stress test specification. The stress test is focused on the areas: 

- Earthquake, where the stressing is made by applying an earthquake with 

a ground acceleration about four times beyond the design value (the 10 -7 

earthquake vs. 10 -5 earthquake). 

- Flooding, where the stressing is made by applying sea-rise levels beyond 

design. The design basis sea-rise level is 2,65 m. The plant robustness is 

evaluated by applying sea-rise levels of 3, 3,3 and 4 m. 

- Loss of offsite power and station blackout. In this case the stressing is 

performed by applying a gradually increased of loss of power, ending up 

with only battery power as the available source. 

- Loss of ultimate heat sink, where applying a gradually decreasing 

availability of seawater makes the stressing, ending up with no seawater 

at all available. 

- Accident management, where the stressing is made by imposing potential 

obstacles for the accident management processes such as infrastructure 

destruction, unavailable facilities, loss of power, habitability issues etc. 

In all cases, the very beneficial impact of the containment filtered vent 

feature is observed. 

In the earthquake case, the engineering judgement is that the units will be 

able to withstand the design basis earthquake (DBE). Safe shutdown is 

judged to be feasible. The spent fuel cooling systems are not seismically 

qualified. At beyond design bases condition for the stress test, the applied 

case is an earthquake corresponding to an exceedance frequency of 10 -7 per 

site and year. At this condition, the containments, the CFV’s, the fuel 

buildings and the fuel pools and the severe accident mitigation systems are 

judged to be able to perform their release preventing functions. As 

Hemlig 48 (52)





mentioned above, the spent fuel cooling systems are not seismically 

qualified. 

In the flooding case, the assessment concludes that for the design basis 

flooding, a sea level rise of 2,65 m, no fuel damage will occur. Beyond 

design basis, flooding of the units may occur with the potential of causing 

fuel damage by elimination of safety functions and spent fuel cooling 

equipment. Robustness exists up to the ground level, which is 3 m above sea 

level. At a sea-level rise of 4 m fuel damages are judged to be possible. 

Addressing the question of an appropriate sea-level rise is required before 

relevant measures can be taken. 

In the “Loss of offsite power and station blackout” case, the assessment 

concludes that the limiting case is when only battery power is available. 

Robustness exists as long as anyone of the ordinary backup power sources 

(diesel generators or gas turbines) or the steam driven auxiliary feedwater 

systems are available. Postulating power system recovery times beyond 

design, exhaustion of batteries, depletion of the water sources for the steam 

driven systems and operation at low RCS inventory conditions will cause 

fuel damage. The containment filtered vent feature will contribute in keeping 

the releases within allowable limits. The loss of power will also cause a loss 

of the spent fuel cooling. 

Addressing the adequacy of the current battery capacities and the availability 

of the backup power sources is required before relevant measures can be 

taken. 

In the case of loss of ultimate heat sink, the assessment concludes that 

robustness exists for several days in all cases, with the exception of 

operation at low RCS inventory conditions at the PWR’s. Addressing the 

operation at low RCS inventory conditions coincident with loss of UHS is 

required before relevant measures can be taken. 

Regarding accident management, the assessment concludes robustness for 

events within design. The beneficial impact of the containment filtered vent 

is emphasised. When applying the Fukushima scenario as described in the 

stress test specification, a number of shortcomings are displayed. The 

emergency response organization can not handle four units simultaneously 

affected, the two existing mobile pump/generator units may not be enough, 

long time management guidance is not developed. Addressing the 

appropriate scenario to be applied is required before relevant measures can 

be taken. 

Hemlig 49 (52)





5 AREAS SUBJECT TO IMPROVEMENTS 

The following main areas are found to be suitable subjects to improvement: 

- The spent fuel pool cooling abilities needs to be further 

evaluated/reinforced 

- The properties of the emergency response organization needs to be 

reconsidered 

- The flooding scenario needs to be reconsidered 

- The requirement for battery capacity is generally an area to analyze 

further. 

- The adequacy of the present water supplies needs to be reconsidered. 

Hemlig 50 (52)





6 REFERENCES 

A: Validated in the licensing process. 

B: Not validated in the licensing process but gone through licensee’s quality 

assurance program. 

C: Not one of the above. 

1. Rapport över extrema väder och vattenhändelser i Sverige, SMHI, 

Darwin-id 981109065 (A) 

2. NOG Säk och Miljö – Metodik för analys av vissa yttre händelser, 

Darwin-id 1944610/2.0 (B) 

3. R1-R4 Sammanställning samt händelseklassning av yttre händelser, 

Darwin-id 1978823/2.0 (A) 

4. R1-R4 ENSREG Stress Test – LOOP, SBO, Loss of UHS, Loss of 

UHS+SBO, Darwin-id 2141878/2.0 (B) 

5. R1-R4 ENSREG stress test - Loss of spent fuel cooling, Darwin-id: 

2151759/2.0. (B) 

6. R1-R4 ENSREG Stress Test – Flooding, Darwin-id: 2146711/2.0 (B) 

7. R1-R4 Förnyade säkerhetsvärderingar av tålighet mot vissa händelser, 

Darwin-id 2142379/2.0 (C) 

8. Svar på SSM beslut: Förnyade säkerhetsvärderingar av tålighet mot vissa 

händelser, Redovisning av utgångspunkter och antaganden för analyser 

och säkerhetsvärderingar, Darwin-id 2143627 (C) 

9. Antaganden för analyser och säkerhetsvärderingar vid förnyade 

säkerhetsvärderingar av tålighet mot vissa händelser. 

Kompletterande information, Darwin-id 2148889 (C) 

10. Stresstester – Granskning av tillståndshavarnas redovisning av 

utgångspunkter och antaganden, Darwin-id 2151064 (C) 

11. Förnyade säkerhetsvärderingar av tåligheten mot vissa händelser – 

Lägesrapport 15 augusti, Darwin-id 2152578 (C) 

12. Åtgärder med anledning av händelserna vid Fukushima kärnkraftverk i 

Japan, Darwin-id 2132120. (C) 

13. Beskrivning av uppdrag – Projekt Externa händelser, Darwin-id 2140747 

(B) 

14. Ringhals 1 – Övergångsplan för uppfyllande av SKIFS 2004:2, Darwinid 

1890250 (B) 

Hemlig 51 (52)






1893247 (B) 


1891057 (B) 


1890928 (B) 

18. Rapport över extrema väder och vattenhändelser i Sverige, SMHI, 

Darwin-id 981109065 (A) 

19. SKI Technical Report 92:3 "Project Seismic Safety" Report NO.4 and 5, 

April 1992, Darwin-id 1705297 (C) 

20. R2 SAR part 2, Plant site, ch. 6 (A) 

21. SKI Technical Report 92:3 "Project Seismic Safety" Summary report, 

April 1992, Darwin-id 960909047 (C) 

22. R1-R4 PSA Level 1, Detailed External Events Analysis, Darwin-id 

1826084/5.0 (A) 

23. R1 Avsnitt 8.17 Probabilistisk säkerhetsanalys (PSA). FSAR/Allmän del, 

Darwin-id 980408029/6.7 (B) 

24. R2 SAR, Part 8.7 Probabilistic Safety Analyses, SplitVision-id 1217042 

(A) 

25. R3 SAR Chapter 15.9 – Probabilistic Safety Analysis, 

Darwin-id 1911712 / 5.0 (A) 

26. R2-R4 PSA. Förenklad modellering och utvärdering av PAR, 

Darwin-id 2028648 / 2.0 (B) 

27. Regeringsbeslut 11, R1-R4 Villkor för fortsatt tillstånd enl. 5§ lagen 

(1984:3) om kärnteknisk verksamhet att driva kärnkraftsreaktorer, 1986, 

Darwin-id 980227022/1.0 (C) 

28. R1-R4 ENSREG Stress Test – Earthquake, Darwin-id 2146557/2.0 (B) 

29. R2 SAR, ch. 2.3, Split Vision id 637394 (A) 

30. Ringhals- Station response to WANO SOER 2011-2 Fukushima Daiichi 

Nuclear Station Fuel Damage Caused by Earthquake and Tsunami, 

Darwin-id 2140020 (B) 

31. R1-R4 ENSREG Stress test – Severe accident management, Darwin-id 

2142360/2.0 (B) 

Hemlig 52 (52)

R1-R4 ENSREG Stress Test - Summary

Create successful ePaper yourself

Delete template?

Save as template?