Peak Everything, Overshoot, & Collapse

Preface. Below are my notes from the Greenpeace 146-page “Lifetime extension of ageing nuclear power plants”.  Even if you don’t understand all the terms, read on anyhow, since it certainly conveys why nuclear plants grow more dangerous with age.  Imagine how fast you’d die after being fried by radiation and heat. So do metal and cement.  They too will eventually crack, corrode, and break. 

Reading this makes me want to shut nuclear power plants down as soon as possible. They are clearly not a “solution” to replace fossil energy, especially because their nuclear wastes will poison the earth for hundreds of thousands of years. Both of my books explain why there are no alternatives to fossil fuels for transportation, manufacturing high heat, natural gas fertilizers, half a million products made out of fossil fuels, and the electric grid itself, which requires natural gas as the backup for intermittent energy when it’s not up, and to balance it when it is. 

Physical ageing. A comprehensive range of physical ageing mechanisms is described in the IAEA safety guide on ageing management:  Degradation of mechanical components can be caused by radiation embrittlement (affecting the RPV beltline region), general corrosion, stress corrosion cracking, weld-related cracking, and mechanical wear and fretting (affecting rotating components). Electrical and instrumentation and control components can be affected by insulation embrittlement and degradation (cables, motor windings, transformers), partial discharges (transformers, inductors, medium and high voltage equipment), oxidation, appearance of monocrystals and metallic diffusion.

Civil structures, especially concrete elements, can suffer damage due to aggressive chemical attacks and corrosion of the embedded steel, cracks and distortion due to increased stress levels from settling, and loss of material due to freeze–thaw processes. Pre-stressed containment tendons can lose their pre-stress due to relaxation, shrinkage, creep and elevated temperature.

Ageing of electrical installations.  In the field of instrumentation and control equipment, cables are among the components of most concern in terms of ageing. During the operational lifetime of reactors, the plastics of the cable insulation are exposed to environmental influences that cause deterioration. Oxidation is the dominant ageing mechanism of polymer cable coating, leading to embrittlement of the material, which increases the potential for cracking. Cracked cables can cause short circuits followed by electrical failures or even cable fires. Ageing cables therefore have the potential for serious common-cause failures of instrumentation and control equipment, especially under accident conditions.

Ageing effects on the reactor pressure vessel. The RPV and its internals are the most stressed components in a nuclear power plant. During operation the RPV has to withstand: • neutron radiation that causes increasing embrittlement of the steel and weld seams; • material fatigue due to frequent load cycles resulting from changing operational conditions; • mechanical and thermal stresses from operating conditions, including fast reactor shutdowns (scrams) and other events throughout the operational lifetime; and • different corrosion mechanisms caused by adverse conditions such as chemical impacts or vibrations.

Embrittlement under neutron radiation is of special importance for old reactors. At the time of their construction, knowledge of neutron-induced embrittlement was limited, so sometimes unsuitable materials were used.

Ageing of reactor pressure vessel head penetrations and primary circuit components. Leaks in the primary circuit components of PWRs due to ageing mechanisms such as stress corrosion cracking can lead to accidents involving loss of primary coolant. For systems and components in the primary circuit, especially high-quality standards are required to prevent loss of coolant and consequent loss of function. 

EIA (2020) International Energy Statistics. Petroleum and other liquids. Data Options. U.S. Energy Information Administration. Select crude oil including lease condensate to see data past 2017.

Aging nuclear plants in the news:

Pécout A (2022) French energy supplier EDF shows concern over corrosion problems at its nuclear plants. Cracked pipes were detected in the safety injection systems of several reactors. As inspections continued, only 30 reactors out of 56 were operating by the end of Wednesday, April 20. Le Monde.  The phenomenon of corrosion has been a cause for concern in the industry for several months now, as it causes cracks in reactor pipes, especially in their safety injection system. That is the important backup system of nuclear stations, which is designed to cool the primary circuit by injecting borated water into it in the event of an accident. Inspections have already detected cracks in five reactors, between the second half of 2021 and the beginning of 2022, and at least four more could be affected, which means the issue might affect all of France’s nuclear power plants, although further evaluation is needed.

Alice Friedemann   www.energyskeptic.com  author of  “Life After Fossil Fuels: A Reality Check on Alternative Energy”, 2021, Springer; “When Trucks Stop Running: Energy and the Future of Transportation”, 2015, Springer; Barriers to Making Algal Biofuels, and “Crunch! Whole Grain Artisan Chips and Crackers”. Podcasts: Collapse Chronicles, Derrick Jensen, Practical Prepping, KunstlerCast 253, KunstlerCast278, Peak Prosperity , XX2 report

Greenpeace. 2014.  Lifetime extension of ageing nuclear power plants: Entering a new era of risk. Greenpeace Switzerland.

Summary of major risk arguments

Important aspects of risk with respect to ageing reactors are: • physical ageing; • conceptual and technological ageing; • ageing of staff and atrophy of knowledge; As of 2014, the average age of European reactors has risen to 29 years. As the number of new-build reactors in the EU has been very limited since the 1990s, European nuclear power plant operators have followed two strategic routes, lifetime extension and power uprating. These two strategies have serious implications for the safety of nuclear power plants, especially with respect to the following aspects:

1) Physical ageing of components in nuclear power plants leads to degradation of material properties. The effects of ageing mechanisms such as crack propagation, corrosion and embrittlement have to be countered by continuous monitoring and timely replacement of components. Nevertheless, an increasing level of material degradation cannot be completely avoided and is accepted to a certain degree, therefore lowering the original safety margins. Particularly under accident conditions that cannot be precisely predicted, an abrupt failure of already weakened components cannot be fully excluded.

2) Power uprating imposes significant additional stresses on nuclear power plant components due to an increase in flow rates, temperatures and pressures. Ageing mechanisms can be exacerbated by these additional stresses. Modifications necessitated by power uprating may additionally introduce new potential sources of failure due to adverse interactions between new and old equipment.

3) Reactor lifetime extension and power uprating therefore decrease originally designed safety margins and increase the risk of failures.

4) Serious problems related to ageing effects have already been encountered in nuclear power plants worldwide, even though they have not yet exceeded their design lifetimes. Typical ageing problems are: • embrittlement, cracks or leaks in the RPV or primary circuit components; • damage to RPV internals such as core shrouds; • degradation of older concrete containment and reactor buildings; and • degradation of electrical cables and transformers.

5) The fundamental design of a nuclear power plant is determined at the time of planning and construction. The science and technology of nuclear reactor safety is continually developing. Subsequent adaptation of a plant’s design to new safety requirements is possible only to a limited degree. Thus, during the lifetime of a facility, the gap between the technology employed and state-of-the-art technology is constantly increasing.

6) To enable lifetime extensions of existing plants, operators must implement enhanced ageing management. Nevertheless, general acceptance criteria for the maximum permitted extent of ageing effects are not defined. Besides technical aspects of ageing, ageing management has to consider loss of experienced staff both in the plant’s workforce and in the supply chain, as well as problems of quality assurance under changing external supply conditions.

7) With increasing lifetime, the radioactive inventory stored in a reactor’s spent fuel pool and, where present, dry storage increases. As the risk associated with the spent fuel pools and dry storage was initially perceived as low, design requirements with respect to cooling and physical protection were weak. New risk perceptions after the 9/11 terrorist attacks and the Fukushima disaster necessitate a considerable improvement in the safety of spent fuel storage.

8) The site specific design basis of older nuclear power plants was usually rather weak concerning external hazards such as earthquakes, flooding and extreme weather. Site-specific reassessments of plants usually result in stricter hazard assumptions due to better knowledge and higher standards. However, comprehensive retrofitting is difficult to implement in older power plants, especially in terms of protection against earthquakes or even terrorist acts such as deliberate aircraft impacts. In the case of multiple-unit sites, the possibility of emergency situations occurring simultaneously in different units had been largely overlooked until the Fukushima disaster.

9) Until now, most evacuation plans for nuclear power plants have covered radii of less than 10 km. No harmonization of country-specific regulations in the EU has yet been achieved. The Chernobyl and Fukushima disasters show that external emergency plans for plants need to include larger evacuation areas. 10) The European Stress Test provided valuable insights into the safety level of European nuclear power plants. Nevertheless, important aspects of ageing were not explicitly addressed and evaluated. ENSREG created a list of good practices and recommended possible safety enhancements. But neither the good practices nor the identified safety enhancements are obligatory for EU nuclear power plants.

***

The heyday of nuclear power plant construction was the 1970s and 1980s. While most of the first generation of reactors have been closed down, the following second generation of reactors are largely still operational. By 11 March 2014, the third anniversary of the Fukushima nuclear disaster, the 25 oldest reactors in Europe (excluding Russia) will be over 35 years old.

Almost half of those are older than their original design lifetime. In Europe excluding Russia, 46 out of 151 operational reactors are older than their original design lifetimes or within three years of reaching that date. However, only a few of those reactors will be closed down in the near future – most have had, or are set to have, their lifetimes extended for a further 20 years or more. In the United States, meanwhile, more than two-thirds of the ageing reactor fleet have received extended licenses to take them to 60 years of operation. As a result, we are entering a new era of nuclear risk.

The design lifetime is the period of time during which a facility or component is expected to perform according to the technical specifications to which it was produced. Life-limiting processes include an excessive number of reactor trips and load cycle exhaustion. Physical ageing of systems, structures and components is paralleled by technological and conceptual ageing, because existing reactors allow for only limited retroactive implementation of new technologies and safety concepts. Together with ‘soft’ factors such as outmoded organizational structures and the loss of staff know-how and motivation as employees retire, these factors cause the overall safety level of older reactors to become increasingly inadequate by modern standards.

Ageing of staff and atrophy of knowledge. The building of new nuclear reactors came to an almost complete halt for many years, beginning in the 1980s. The nuclear sector became less important, the need for personnel declined, and career prospects in the industry deteriorated. Young professionals began to be in short supply. However, the safe operation of nuclear power plants relies on experienced employees in the plants themselves and in the supply chain. Irreplaceable and undocumented knowledge can be lost when older personnel leaves. In the near future, first-hand knowledge from the construction phase will no longer be available – a phenomenon that we can already see today. Adverse effects on the safety performance of ageing reactors due to the atrophy of the knowledge base may be expected.

Another aspect of ageing is that in a declining market the number of manufacturers and service providers working exclusively or predominantly in the nuclear field has diminished over time. Specific experience has been lost and cannot be maintained on an equivalent level, especially where the delivery of technology only used in older plants is required. It has become apparent that the extraordinary high quality standards required for nuclear power plants will no longer be met with the same reliability as before. Manufacturers and subcontractors with insufficient experience in the nuclear field have become a significant factor in the decrease of quality and the increase in failures.

Measures to uprate a reactor’s power output can further compromise safety margins, for instance because increased thermal energy production results in an increased output of steam and cooling water, leading to greater stresses on piping and heat exchange systems, so exacerbating ageing mechanisms. Modifications necessitated by power uprating may additionally introduce new potential sources of failure due to adverse interactions between new and old equipment. Thus, both lifetime extension and power uprating decrease a plant’s originally designed safety margins and increase the risk of failures.

Physical ageing issues include those affecting the reactor pressure vessel (including embrittlement, vessel head penetration cracking, and deterioration of internals) and the containment and the reactor building, cable deterioration, and ageing of transformers. Conceptual and technological ageing issues include the inability to withstand a large aircraft impact, along with inadequate earthquake and flooding resistance. Some reactor types, such as the British advanced gas-cooled reactors (AGC) and Russian-designed VVER-440 and RBMK (Chernobyl-type) reactors suffer specific problems.

Spent fuel storage presents a special risk for ageing nuclear power plants due to the build-up of large amounts of spent fuel. Examples of problems include inadequate protection against external hazards and the risks of a long-term loss of cooling (due to poor redundancy and low quality standards in spent fuel pool cooling systems), both issues illustrated by the Fukushima catastrophe. The re-racking of spent fuel elements into more compact storage units to increase the space available for the larger than expected amount of spent fuel is a further source of risk.

Site-specific risks change over time. New insights into earthquake risk require higher protection standards which cannot be fully met by modification of older nuclear power plants. The lack of emergency preparedness evident during the Fukushima disaster forces a reassessment of risks including those of flooding and loss of external infrastructure. Especially when seen in the light of the implications of climate change in terms of extreme weather and sea level rise.

The Fukushima disaster also highlighted the risk of an external event compromising multiple reactors at the same time – a situation hardly any multi-unit site is prepared for. Sources of common-cause failures include shared cooling inlets, pumping stations, pipelines, electricity infrastructure and so on – issues that were not sufficiently addressed in, for instance, the post Fukushima EU Stress Test of nuclear reactors. Perceptions of the most suitable locations for nuclear power plants have also changed over time. Many older plants are located in highly populated areas, obviously making emergency preparedness much more complex than for plants situated far from population areas, and greatly increasing the potential for harm.

The EU Stress Test furthermore did not explicitly cover ageing-related issues. The use of the original design basis to determine the robustness of reactors was particularly unsatisfactory, because design deficiencies and differences between different reactors were not fully taken into account. Because beyond design basis events had not been systematically analyzed before, too little documentation was available and expert judgement played too large a part.

ECONOMICS OF NUCLEAR AGEING Prof. Stephen Thomas – University of Greenwich

If the cost of modifications is relatively low, life-extended nuclear power plants can be highly profitable to their owners because the capital cost of the plant (making up most of the cost of a unit of nuclear-generated electricity) will already have been paid off, leaving only the operations and maintenance cost to be paid. Other advantages to the owner include the fact that the plant is a known quantity.

In the USA, reactor retirements have mostly been due to economic reasons (including the prohibitive cost of repair), though some have been because of design reasons. In Germany most closures have stemmed from political decisions, though a few have been design-related. Elsewhere, reasons have been mainly economic (France) or technical and economic (Canada, Spain, the UK), political (Italy, Sweden) or political and design-related (Japan, largely in the wake of the Fukushima disaster).

National regulators are constantly increasing safety requirements, but for ageing reactors these can never be set at the level of the best available technology. For instance, design lessons from the 1975 Browns Ferry accident were applied to most designs developed after that, but those from the 1979 Three Mile Island accident and the Chernobyl (1986) and Fukushima (2011) disasters can only be taken into limited account.

Three plants (Vermont Yankee, Kewaunee and Crystal River) recently closed before lifetime extension was obtained because of excessive costs in the context of low electricity prices. San Onofre in California closed even before an extension was applied for, because of the cost of repairs.

The increasing risk posed by nuclear ageing should lead to an increase in operators’ insurance premiums. With ageing nuclear reactors, adequate financial security to cover the costs of a potential accident becomes even more a necessity. It is important for society as a whole that objective calculations are made of the damage that a nuclear accident could potentially cause, and on that basis alternative systems of financing the coverage have to be investigated. It is obviously important to accompany this with a mandatory financial security requirement for operators, but the higher resulting costs resulting from such an analysis should not be a reason to limit liability.

LIABILITY OF AGEING NUCLEAR REACTORS Prof. Tom Vanden Borre – University of Leuven; Prof. Michael Faure – University of Maastricht

It is especially important that compulsory insurance protects victims against insolvency of the operator. Conversely, the conventions, even as revised by their relevant protocols, allow for only up to about 1% of the cost of an accident to be compensated for.

Legal channeling of all liability to the operator is problematic. From the viewpoint of victims it would be preferable to be able to address a claim against several persons or corporations, as this would increase their chances of receiving compensation. It would also have a preventive effect since all parties bearing a share of the risk would have an incentive to avoid damage. Countries considering plant lifetime extension should end funding part of the liability coverage with public means, extend liability to suppliers, and introduce unlimited liability for operators, while requiring the latter to have third-party liability insurance coverage or other financial security of a realistic level in terms of the actual scope for damage.

Countries should opt for reactor lifetime extension only if arrangements for the compensation of victims in the event of an accident are substantially improved. A higher level of liability would not only benefit the victims of a nuclear accident but would again have an important preventive effect. Pooling unlimited liability across Europe would encourage operators to monitor one another, since they would be reluctant to allow a bad risk into their system.

POLITICS, PUBLIC PARTICIPATION AND NUCLEAR AGEING Ir. Jan Haverkamp – Greenpeace, Nuclear Transparency Watch

As of January 2014, more than 50% of operational reactors worldwide were over 30 years old. Forty-five reactors have exceeded 40 years, 14 of them located in Europe including Russia. Beznau 1 in Switzerland is the oldest operational reactor in Europe and – together with Tarapur-1 and 2 in India – the oldest in the world at nearly 45 years. None of the reactors that have so far been permanently shut down worldwide has reached 50 years of operation since first grid connection. The British Calder Hall and Chapelcross reactors have come closest, reaching 44 and 47 years respectively. The reactors at both sites were small units with a power capacity of 60 MW each. The average age of shut down reactors worldwide is less than 25 years. From these numbers it is evident that little operational experience exists of nuclear reactors with more than 40 years of commercial operation.

Construction of new reactors

Around 1980, more than 200 reactors were simultaneously under construction. In the 1990s and 2000s this figure dropped to well under 50 reactors. Only recently has there been a modest increase in construction start-ups. Enhanced safety requirements, generally decreasing acceptance of nuclear power in many countries and financial risks have prevented the European nuclear industry from building new reactors.

Most reactors under construction today are located in Asia, and over the past 10 years, new reactors have been connected to the grid in China (10), India (7), Japan (4), South Korea (4), Russia (3), Ukraine (2), Iran (1), Pakistan (1) and Romania (1).

In order to maintain nuclear energy output levels, European governments and operators are following two strategic routes, both of which are seen as less expensive and politically more convenient than building new reactors: • Plant lifetime extension (PLEX) of reactors; and • Plant power uprating (PPU) of reactors. Lifetime extension and power uprating allow electrical generating capacity to be maintained or enhanced with comparatively little effort in terms of financing, planning, licensing and technical implementation, compared to building a new reactor.

The term ‘physical ageing’ encompasses the time-dependent mechanisms that result in degradation of a component’s quality. After three or four decades of operation under high pressure, temperature, radiation and chemical impacts as well as changing load cycles, the risk of ageing becomes more and more significant. Unexpected combinations of various adverse effects such as corrosion, embrittlement, crack progression or drift of electrical parameters may result in the failure of technical equipment, leading to the loss of required safety functions. Life-limiting processes include the exceeding of the designed maximum number of reactor trips and load cycle exhaustion.

In addition to plant lifetime extension, operators of nuclear power plants may wish to enhance the power output of their reactors. The process of increasing the maximum power level at which a commercial reactor may operate is called a plant power uprate (PPU). To increase the power output, the reactor will be refueled with either slightly more enriched uranium fuel or a higher percentage of new fuel.

A power uprate forces the reactor to produce more thermal energy, which results in an increased production of the steam that is used for electricity generation. A higher power level thus produces a greater flow of steam and cooling water through the systems, and components such as pipes, valves, pumps and heat exchangers must therefore be capable of accommodating this higher flow. Moreover, electrical transformers and generators must be able to cope with the more demanding operating conditions that exist at the higher power level.

While more recent nuclear power plants have equipment hatches for the replacement of large parts already included in the reactor building and containment, in older plants it may be necessary to cut a hole through the concrete, rebar, and steel liner of the reactor building and containment in order to exchange large components such as steam generators. The concrete must first be hydro-blasted, sawn, or chipped away by jackhammer from the rebar and the steel liner of the containment, leaving them exposed to the environment. These methods can weaken the containment and the steel liner severely.  

Accordingly it was planned to cut a large hole in the concrete containment, which was strengthened with hundreds of tightened vertical and horizontal steel tendons. But after the tension in some of the tendons was relaxed, unexpected stresses inside the concrete occurred, causing delamination and cracking of the containment. The operator Progress Energy’s repair attempts made the situation worse, and the plant was permanent shut down in February 2013. Another example of the pitfalls of heavy component replacement concerns the steam generator replacement in units 2 and 3 of the San Onofre nuclear power plant in California, which resulted in permanent shutdown of both plants. Severe and unexpected degradation of tubes appeared in the newly installed steam generators after only approximately 1.7 years and 1 year respectively of effective full power operation. The excessive tube wear was caused by a combination of flow-induced vibration and inadequate support structures. The risk of the replacement became obvious in January 2012, when a tube in the unit 3 steam generator

experienced a coolant leak after only 11 months of operation. Steam generator tube ruptures are severe nuclear incidents which result in radioactivity transfer from primary circuit into secondary circuit and can also affect the core cooling due to loss of coolant.

The safety concept of nuclear reactors builds upon a systematic approach comprising technical and organizational measures. The following fundamental safety functions must be ensured for all plant states, whatever the type of reactor:

1) control of reactivity 2) limiting the insertion of reactivity; 3) ensuring safe shutdown and long-term subcriticality; and 4) ensuring subcriticality during handling and storage of irradiated and new fuel assemblies; 5) removal of heat from the core and from the spent fuel pool: 6) sufficient quantity of coolant and heat sinks; 7) ensuring heat transfer from the core to the heat sink; and 8) ensuring heat removal from the fuel pool; 9) confinement of radioactive material: 10) confinement of radioactive material by effective barriers and retention functions; 11) shielding of people and environment against radiation; and 12) control of planned radioactive releases, as well as limitation of accidental radioactive releases.

Replacement of the RPV (like the replacement of the containment) is impossible for economic and practical reasons. Consequently, if ageing mechanisms prevent further safe operation of these components, the reactor will have to be shut down. The risk of loss of RPV integrity increases under accident conditions, as the IAEA explains: If an embrittled RPV were to have a flaw of critical size and certain severe system transients were to occur, the flaw could propagate very rapidly through the vessel, possibly resulting in a through-wall crack and challenging the integrity of the RPV.

The IAEA identifies such severe transients as: Pressurized thermal shocks (PTS), characterized by rapid cooling of the downcomer and internal RPV surface, followed sometimes by repressurization of the RPV (PWR and WWER reactor types) Cold overpressure (high pressure at low temperature) for example at the end of shutdown situations.

So the unidentified degradation of RPVs, such as cracks and flaws, therefore has the potential to escalate an incident into an uncontrollable accident, even though it does not cause problems during normal operation. During power operation the RPV is not accessible for inspections or intervention measures. As a result defects may remain undetected for longer periods of time.

Extensive research programs are being conducted in order to gauge the resistance and stability of RPVs. At present there are conflicting scientific opinions concerning the current significance and further progression of ageing. Huge uncertainties are involved in estimating and predicting the progression of ageing and the long-term behavior of materials, especially under accident conditions.

A special problem arises from cracks in the RPV head penetrations – nozzles through which the control rods pass into the core. These nozzles are exposed to the high temperature and pressure of the RPV, the chemically aggressive primary coolant, and intense radiation combined with changes of load.

Ageing of reactor pressure vessel internals The main function of RPV internals is to keep the nuclear fuel elements in the reactor core in a stable position. Stable reactor core geometry is a prerequisite for reactor shutdown and fuel cooling. Distortion of internals due to cracks, as well as the release of fragments from internals, may affect the function of the control rods and thus prevent safe shutdown, and may also compromise the cooling of fuel elements. Foreign particles or fragments of RPV internal which are released and transported into the primary circuit can damage other important components such as coolant pumps, pipes or vessels which are connected to the RPV.

Another problem affecting power plant electrical installations arises from the external power supply. The European network of transmission grids for electricity has grown beyond European frontiers in recent years, and has changed from a static to a dynamic system behaviour. The increasing dynamic and higher volatility of the electricity network has various causes, of which the input of electricity from variable renewable sources is only one. It also results from increasing electricity transit through countries, changing characteristics of consumer behavior and the impact of changing electricity markets. Moreover, the upgrading and extension of the transmission grid has often been neglected or addressed belatedly. The resultant increasing dynamic and higher volatility produces high overloads, frequency deviations and other instabilities.

As a result the electro-technical design and components of a power plant – especially the unit transformers at the interface with the transmission network, but also the network protection equipment, other transformers, rectifiers, circuit breakers and so on – have to meet high quality standards. Otherwise short circuits or overloads can affect electro-technical components and propagate up to failures of engineering components of the power plant.

The unit transformers, usually two per unit, are often as old as the reactor itself. Replacement of the transformers is usually not envisaged due to the high costs of necessary power outages. Instead, comprehensive test procedures are conducted on ageing transformers. Nevertheless, ageing unit transformers and their protection systems often give rise to incidents resulting in reactor scrams and even compromising mechanical components of the power plant. Older unit transformers can suffer damage due to network instabilities, which can then result in transformer fires. In many cases, the root causes cannot be identified due to the destruction of the transformer. After several incidents in Germany, most German nuclear power plants have had their unit transformers replaced.

The development of science and technology continuously produces new knowledge about possible failure modes, properties of materials, and verification, testing and computational methodologies. This leads to technological ageing of the existing safety concept in nuclear power plants. At the same time, as a result of lessons learnt from operational experiences such as the major accidents at Three Mile Island, Chernobyl and Fukushima Daiichi, power plants have to fulfil new regulatory requirements. Thus earlier safety concepts are themselves becoming obsolete, in a process of so-called conceptual ageing. Very often, new regulatory requirements are applicable only to new nuclear reactors, while for existing plants different criteria are applied. Changes in the safety philosophy can also be introduced by malicious acts. The 9/11 terrorist attacks in the USA showed the need for more robust protection against external hazards. Older nuclear power plants have not been designed to withstand the impact of an aircraft on the reactor building. While an accidental aircraft impact was required to be taken into account in the design of some newer power plants, not one nuclear power plant worldwide has been designed to withstand the intentional impact of a large commercial aircraft like an Airbus 380. Accordingly, it can be questioned whether any existing nuclear power plant would withstand such an attack.

Ageing PWR and BWR design concepts. The fundamental design principles of modern nuclear power plants consist among others of redundancy; conceptual segregation of redundant subsystems, unless this conflicts with safety benefits; physical separation of redundant subsystems; preference for passive over active safety equipment; and a high degree of automation. Reactors such as the two-loop PWRs Beznau 1 and 2, and Doel 1 and 2, have a limited number of safety subsystems. The original basic design of the Beznau reactors has only one emergency feedwater system and two core cooling subsystems (a small degree of redundancy). One common cooling pipe is used instead of the three or four independent subsystems typical of stateof-the-art modern reactors (therefore having no segregation of redundant subsystems). Although a lot of additional installations have been carried out at Beznau to compensate for the design shortcomings, their quality standards would not meet the current high standards for safety systems80. Retrofitting of additional safety systems under conditions of a shortage of space because main structures cannot be changed, can result in higher complexity and in interface problems between existing and retrofitted systems. Similar problems exist in older BWRs of two-loop design.

A lack of robustness of the reactor building to withstand external hazards is a problem common to many older reactors.

Concerning the only operational German BWRs, Gundremmingen B and C, two former members of the German federal nuclear regulator have produced a list of design deficits. According to their analyses:

• the construction of the reactor vessel does not represent the technical state of the art • only two of the required three redundancies of the emergency core cooling system are sufficiently qualified as safety systems; • the determination of the design basis earthquake has not been reviewed for decades, and the peak ground acceleration of the current design basis earthquake (a key parameter) does not fulfil the IAEA’s minimum requirements; • some safety-relevant components and subsystems are not qualified to resist the design basis earthquake; • the basic design of the spent fuel pool and its cooling system is outdated; and • the basic plant design does not take into account the possibility of flooding as a result of a breach of a nearby weir on the Danube.

VVER-440 The Russian VVER-440/V-213 PWR design (Dukovany 1–4, Paks 1-4, Bohunice V2 and Mochovce 1,2) suffers design problems concerning the emergency core cooling and emergency diesel generator systems. At Dukovany, external hazards may cause simultaneous loss of offsite power to all four reactors. In these circumstances, the simultaneous loss of function of the Jihlava River raw water pumping station, the raw water conditioning and the cooling-towers is unavoidable. As a consequence of the loss of cooling and the following overheating of the essential service water, a loss of the emergency diesel generators could also result. In this event only temporary emergency measures would be available for the cooling of the four reactors and their spent fool pools. Furthermore, the two pipes that supply the raw water for all four reactors are not protected against any external hazards. 85 Comparable design deficits affect the other European VVER-440/V-213s. To overcome major shortcomings of the design, both Finnish VVER-440/V-213 reactors are equipped with Western-type containment and control systems. The VVER-440 reactors are designed as twin units, sharing many operating systems and safety systems, for example the emergency feedwater system, the central pumping station for the essential service water system, and the diesel generator station. The sharing of safety systems increases the risk of common-cause failures affecting the safety of both reactors at the same time.

All VVER-440 type reactors with the exception of Loviisa in Finland have only a basic level of containment. External hazards such as earthquakes, chemical explosions or aircraft impacts were not taken into account in the original design of these plants.

Despite the defects of the type, it almost seems as though certain European countries are competing with one another to extend the lifetimes and uprate the power of their VVER-440/V-230 and V-213 reactors, as shown in Table 1.3. Finland and Hungary, in particular, intend lifetime extension up to 50 years and power uprating of 18 and 15 per cent respectively, while the Czech Republic and Slovakia are also planning lifetime extension and uprating.

The RBMK (Reaktor Bolshoy Moshchnosti Kanalniy) design from the former Soviet Union is a graphite-moderated reactor. The reactor’s characteristic positive void coefficient and instability at low power levels caused the April 1986 Chernobyl disaster, when the reactor core exploded due to a power excursion and released high amounts of radioactivity across Eastern and Western Europe, contaminating areas. There was a consensus during the 1992 G7 summit in Munich to close the last two European RBMK reactors outside Russia, located in Lithuania, due to strong concerns about the design. This decision was implemented as part of Lithuania’s EU accession. Ignalina 1 was closed in December 2004 and Ignalina 2 at the end of 2009, leaving Russia as the only country which has operational RBMK reactors. The EU has agreed to pay Lithuania part of the decommissioning costs and some compensation for closure and extended and increased its financial help in November 201389.

Ageing management as explained so far is explicitly aimed at creating the conditions for the extended operation of old reactors. However, regulatory requirements for extended operation of existing plants do take into account the limited capabilities of ageing design features. Which means that they do not correspond to the safety requirements for new reactors. Against this background, regulation is intended to allow a large degree of flexibility in the case of lifetime extension. It is not intended to set strict limits. Consequently, clear and general accepted criteria for a maximum permitted degree of ageing are usually lacking, which is a major shortcoming in dealing with ageing effects.

The likelihood of system or component failure is commonly illustrated by the so-called ‘bathtub curve’ (Figure 1.9). A high incidence of early failures (mainly caused during design, manufacturing and installation) is followed by a significant decrease in failure probability. Later, the probability will increase again due to the increasing influence of ageing effects. The objective of ageing management is to keep the failure rate at a low level. Monitoring programs and resulting measures such as maintenance, repair and precautionary replacement of components have to come into effect before the failure rate begins to increase significantly towards the end of the technical lifetime. Ageing plants are thus approaching the edge of the bathtub curve. Technical modifications and changing modes of operation which result in higher loads, especially power uprating, have the potential to increase failure rates. Consequently, for ageing plants even a modest increase in lifetime may cause a significant increase in failure frequency, leading to a loss of safety-related functions.

It is difficult to produce an accurate estimation of the risk of ageing-related failures for an extended reactor lifetime of over 40 years. A simple bathtub curve will probably not reflect the reality. Experience shows that a simple distribution of observed data must be qualified by the awareness of additional influences as follows: • Non-technical ageing effects are not considered within the failure rate as illustrated by the bathtub curve. In principle, it is not possible to show a clear mathematical distribution of these impacts over time. • Operational experience, which is an essential basis for the prediction of ageing-related failure rates, is in the case of most reactor types available for less than a 40-year lifetime and so does not cover the proposed lifetime extensions. • Underestimated ageing mechanisms or new mechanisms which are constantly being discovered can result in unexpected damage and serious incidents. Additionally, the precautionary replacement of intact components prevents detailed evaluation of potential ageing mechanisms. • Ageing management programs as implemented so far have not proved sufficient to prevent the occurrence of serious ageing effects. Latent failures and damage at an early stage can remain undetected and cannot be observed in the failure rate. • Technical modifications and changing modes of operation result in higher loads. Power uprating in particular may contribute to a more frequent occurrence of ageing-related failures. • With increasing age, uncertainties in the assessment of the present condition and future performance of components may become more and more significant. • As a result of all these factors, the technical limit of a reactor’s lifetime may be exceeded earlier than initially assumed – contrary to the assumptions underlying extended operation.

A basic safety principle is that safety-related equipment must be proven in use. However, the development of technology means that technology originally used in a power plant design will become obsolete. Identical parts for repair and replacement are available only for a limited time. A change of equipment involves inherent risks, because an equivalent proof of satisfactory performance in service is not available.  EXAMPLE: the replacement of hard-wired control devices by digital control technology has triggered controversial discussions about how to guarantee the required reliability of safety-related control functions. Failure mechanisms and procedures for inspection and quality assurance are not transferable from one technology to the other. Susceptibility to faults may increase, and interaction between old and new control technology may cause additional problems.

There is an increasing trend for components to be delivered and installed without adequate quality certification. As a result, retrofitting or refurbishment of equipment carries a risk of introducing new defects into the plant.   EXAMPLE: in the course of a retrofit required for seismic protection, thousands of anchor bolts were wrongly installed in several plants in Germany and had to be replaced. Some manufacturers and suppliers intentionally offer substandard components to increase profitability. Naturally, such components cannot guarantee the required reliability and effectiveness.

EXAMPLES: In Japan between 2003 and 2012, several thousand electrical parts and fittings were delivered with faked certificates. Most of them were at the time of discovery installed in operational nuclear power plants. A significant proportion were used in components with safety-related functions. It has been suggested that around 100 employees of operators and of several suppliers were involved.

Spent fuel storage.  During operation of a nuclear reactor, a large inventory of radioactive fission products and actinides is produced in the reactor core. This radioactive inventory is concentrated in the nuclear fuel. After three to five years in the reactor core, the spent fuel is taken out of the RPV and replaced with new fuel. The spent fuel is then stored in spent fuel pools, to enable continuous cooling and the decay of the radioactive inventory. Spent fuel pools are fundamentally large pools of water. The radioactivity of the spent fuel assemblies inside the pool is shielded by the water above the fuel. A pool cooling system is required to remove residual decay heat from the pool. Spent fuel pools are located either inside the containment within the reactor building (as in many PWRs), inside the reactor building but outside the actual containment (as in BWRs) or even in a separate spent fuel pool building (as in many older PWRs).

After approximately five years, when the heat generation has decreased sufficiently, it is in principle possible to reload the spent fuel elements into dry storage casks, which can then be placed in an interim storage facility. At this stage heat removal from the spent fuel occurs passively via convection – active systems for heat removal are no longer needed.  As a nuclear power plant ages and spent fuel is added to the pool, the radioactive inventory stored there increases, thus increasing the potential level of radioactive contamination in the event of an accident involving the spent fuel pool.

Spent fuel storage policy varies between European countries. The spent fuel from the Spain’s reactors is currently stored in the plants’ own pools. The original storage racks have been progressively replaced with significantly more compact units, so expanding the storage capacity. This so-called re-racking is also practised at other countries’ power plants, for example Bohunice in Slovakia. As a result of this approach, the radioactive inventory stored in the fuel pools is increased beyond the initial design values.

The cessation of reprocessing of spent fuel from Belgian reactors has led to stockpiling at the spent fuel pools at Tihange. The operator, Electrabel GDF Suez, has stated that by 2020 the on-site storage capacity for spent fuel will be full.

Risks of spent fuel storage. A loss of cooling to a spent fuel pool while there is spent fuel in the pool will lead to heating of the pool water and increased evaporation. The rate of heating of the pool water will depend primarily on the heat load in the fuel pool. Most heat will be contributed by the youngest spent fuel elements in the pool. The heat emitted by a fuel element depends on various factors such as the fuel type, the burnup and the time since shutdown of the critical reaction. Thus, the time taken for the pool to heat by a given amount is not directly related to the quantity of spent fuel in the pool  

Given sufficient evaporation of the water in the pool, the spent fuel elements will become uncovered and there is then a risk of them overheating and becoming damaged – in an extreme case a situation similar to a meltdown of the reactor core can develop, associated with the risk of hydrogen production and explosions.

Physical damage to the spent fuel pool could also lead to water being lost, with the spent fuel elements potentially being uncovered rapidly, again leading to fuel damage and a release of radioactivity.

The risks associated with spent fuel storage were initially perceived to be low in comparison to the risks associated with the nuclear reactor core. Reasons for this were the much lower power density of the spent fuel (compared with that of the fuel in the reactor core, and the much lower risk of a critical reaction in the spent fuel pool. Because of the low power density and the large amount of water in a s spent fuel pool, considerable grace time is available in the event of a loss of spent fuel pool cooling, as long as the integrity of the fuel pool remains unchallenged.

This perception of low risk led to weaknesses in the safety of spent fuel pools especially in older power plants, as follows: • Due to the perceived long grace time in the event of a loss of spent fool pool cooling, cooling systems tend to have a poor level of redundancy in comparison with the emergency cooling systems for the reactor core. • As events involving a loss of external electricity were perceived to be likely to be of only short duration, spent fuel cooling systems are often not supported by emergency power supply systems.

• Spent fuel pools and their cooling systems are often not specifically protected against external hazards, especially in the case of older BWRs and VVER-440 reactors. • The fuel pool is sometimes placed outside the containment (BWRs, some older PWRs and VVER-440), thus making release of radioactivity to the environment possible in the event of fuel damage.

Changed perceptions of risk Following the 9/11 terrorist attacks in the USA, a renewed discussion of the safety of spent fuel storage took place. It was acknowledged that spent fuel pools located outside the reactor building in dedicated spent fuel pool buildings have a considerably lower degree of protection against terrorist attacks such as a deliberate aircraft impact. Such attacks could lead to a long-term loss of cooling or the immediate destruction of the pool structure itself, thus resulting in fuel damage and consequent large-scale releases of radioactivity to the environment.

The 2011 Fukushima disaster demonstrated powerfully the risks associated with other external hazards to spent fuel storage. Cooling of the spent fuel pools was lost after the earthquake, when external power to the site was lost. In addition, the essential service water systems were destroyed by the subsequent tsunami. When the hydrogen explosions in Unit 1, Unit 3 and Unit 4 destroyed the upper parts of the reactor buildings, the spent fuel pools were uncovered and came into direct contact with the environment.

Furthermore, the integrity of the reactor buildings was compromised as a consequence of the earthquake and the explosions. It was consequently feared that the buildings could at least partly collapse, in which case the integrity of the spent fuel pools would also be lost and cooling of the fuel would no longer be possible. Moreover, large amounts of debris from the heavily damaged reactor buildings – including the heavy structures of the fuel handling crane – had fallen into the spent fuel pools, with the risk that it had destroyed fuel assemblies

Staff had to attempt to ensure sufficient cooling of both the three reactor cores and the spent fuel pools simultaneously, which complicated matters further. For several days, the necessary cooling of the spent fuel remained a serious emergency challenge. First attempts were conducted with helicopters and water cannon, while later special truck mounted concrete pumps were used. At the end of 2013, nearly three years after the event, the spent fuel pools, especially that of the badly damaged unit 4, pose a severe danger to the site and surrounding environment. Full recovery of the spent fuel from all fuel pools is expected to take around another decade.

In the aftermath of the Fukushima disaster, the safety of spent fuel storage has again been keenly debated in many countries in the EU and worldwide.

For example, the Swiss nuclear regulator ENSI ordered directly after the Fukushima catastrophe in 2011 a design reassessment of spent fuel storage with regard to risks from earthquake, external flooding or a combination of the two. One outcome was that retrofitting of the spent fuel pool cooling system was required at the Mühleberg plant. However, the spent fuel pool itself has not been given improved protection against terrorist attacks such as a deliberate aircraft impact.

Improvements to the safety of spent fuel storage discussed in the EU amount to additional instrumentation to monitor the spent fuel pool temperature and water level, retrofitting of water feed systems to enable refilling the spent fuel pool from external sources in the event of a loss of cooling, and the need for measures to protect against hydrogen explosions in the area of the spent fuel pool.

While these measures are important first steps to enhance the safety of spent fuel storage, other major shortcomings have not yet been addressed. No fundamental improvement of the physical protection of spent fuel pools that are not located inside well-protected reactor buildings has so far been discussed. Neither is the problem of containing possible releases of radioactivity from damaged spent fuel addressed by the improvements mentioned above. While freshly unloaded spent fuel requires several years of cooling in a spent fuel pool, another important step to enhance the safety of spent fuel storage would be the unloading of the older spent fuel from fuel pools into dry cask storage in physically well protected interim storage facilities.

External hazards and siting issues. Several of the lessons of the Fukushima disaster relate to the insufficient consideration of external hazards in the design and siting of the power plant. Furthermore it has become evident that additional problems arise from a severe accident happening in several units on one site at the same time.

Country-specific regulatory requirements may also change considerably due to new operational experience. For example, France is changing its regulatory requirements with respect to the assessment of flooding risks in response to a severe event happening at the Blayais power plant.

Loss of key external infrastructure as a result of a natural disaster is another important factor. Natural disasters with extensive and long-lasting effects were usually not taken into account as an explicit design basis condition. Today, a more robust degree of plant autonomy is required to cope with situations beyond the original design basis. Unfortunately, some measures to cope with emergency situations are based on conventional installations and infrastructure (external non-nuclear power plants, transportation routes, alternative cooling water resources) which are not as well protected as nuclear installations. This also holds true for some of the emergency preparedness measures for severe accidents that have been specifically introduced in response to the lessons learnt from the Three Mile Island and Chernobyl disasters.

Seismic hazards. Older nuclear power plants were often originally designed to resist a lower magnitude of earthquake than has to be taken into account today. Moreover, in the case of some sites with low seismicity, earthquakes were not considered at all in the original design, or only a very low level of resistance was requested. Today, even for sites with low seismicity, a minimum level of earthquake resistance is required. For several European power plants, this requirement remains to be fulfilled. In addition, new scientific findings require that seismic risk levels of existing plants are redetermined in accordance with the latest methods and data. In several cases, a recalculation of the robustness of existing plants to show consistency with the new standards has been accepted instead of the implementation of expensive retrofit s.

Extreme weather conditions and climate change. The development of the risk posed by extreme weather conditions and the associated changes in risk perception are an important example of conceptual ageing.

In general, it is expected that normally occurring extreme weather conditions can be withstood by solidly constructed buildings, especially those designed to withstand extreme external events such as earthquakes, aircraft impacts or chemical explosions.

Scientific research has shown that an increasing intensity and frequency of extreme weather events must be expected. The possibility of nuclear emergencies due to extreme precipitation (including snowfall), sudden icing, storms and tornadoes, heat waves and droughts has therefore to be considered. The effects of these extreme weather conditions, such as flooding, landslides, cooling water inlet or drainage clogging, forest fires or water shortages can directly compromise a power plant and can cause wide-ranging as well as long-lasting impairment of vital infrastructure. External infrastructure such as electricity and feedwater supplies and access roads are most threatened by natural impacts. It has to be assumed that in the event of an extreme weather event the site will become inaccessible. The effectiveness of fire-fighting and other external assistance and the delivery of external auxiliary emergency equipment and support, can thus be substantially affected.

Weak protection against natural hazards is a typical problem of ageing power plants, if the design is not adapted to cope with changing risk levels and new scientific findings. Nevertheless, in the context of the European stress test some operators refused a re-evaluation of external hazards. Conversely, some countries such as the Czech Republic admitted that they had underestimated extreme weather conditions up to now.

As reactors need large amounts of cooling water, they are usually located on lakes or rivers or by the sea. Consequently, the risk of flooding of the site has to be taken into account. New assessments according to the state-of-the-art of science and technology often reveal insufficient flood protection missed by previous assessments. Changes of land use in the surrounding area (land sealing, water management, embankment) may influence the flooding risk. These changes may happen over a much shorter timescale than climatic changes and thus have to be taken into re-assessed on a regular basis. As a rule public flood protection is designed for less significant and more frequent flooding events than nuclear power plants need to be protected against, for example events with return periods of 100 years rather than 10,000 years. Unforeseen combinations of natural hazards including extreme weather (storm and precipitation, sudden icing, land slides) as well as insufficient plant protection (undersized drainage systems, missing sealing, water ingress through underground channels) can exacerbate the consequences of an extreme weather event. Some sites are forced to rely on temporary measures which are not as reliable as permanent flood protection measures, or indeed a location above the level of a design basis flood.

EXAMPLES: in December 2009, as a result of prolonged and heavy rainfall, large quantities of vegetation were washed into the river Rhône. Subsequently, the feedwater intake of the Cruas 4 reactor was blocked, leading to a shutdown of the reactor. After a shutdown, residual heat removal is still required to avoid overheating of the reactor. However, the residual heat removal system was dependent on the functioning of the same cooling water intake. The operator was forced to take emergency action: it took over five and a half hours to unblock the water intake.

In 2011 a flood had a serious impact on the Fort Calhoun power plant in Nebraska, even though it was less serious than the design basis flood. The site was flooded to a depth of 60cm. A rubber barrier installed as a temporary flood protection measure burst. Simultaneously a fire broke out in the control room. The electricity supply and some of the emergency diesel generators failed due to the flooding. The spent fuel pool cooling system was interrupted until the back-up emergency power supply started successfully. The entire site was inaccessible and some installations could not be reached for needed action. Staff had to remain on site for a prolonged period. Additional fuel had to be delivered rapidly and under difficult conditions to enable the emergency diesel generators to operate for a prolonged time.

Possible effects of climate change are insufficiently addressed, for example, in the safety design of older UK power plants such as Wylfa, Hunterston B and Hinkley Point B. Hunterston B and Hinkley Point B may not tolerate wave overtopping of protection dykes in the event of an extreme storm surge exacerbated by climate change. Flooding of installations may result, especially if the drain water discharge is not as effective as assumed in the safety design, for example due to unforeseen clogging. In this event, the power plants would have to rely on provisional measures, such as the use of fire hydrants to ensure cooling water supply at Hinkley Point, or temporary dams to protect against flooding. Climate change is predicted to result in sea level rise and higher intensity and frequency of extreme storm surge events, as well as increased maximum wave heights. Furthermore it must be acknowledged that dams or dykes do not completely guarantee flood protection. Ageing mechanisms reducing their reliability and efficiency are a common problem. In certain cases it has been shown that these installations are of inadequate size due to incorrect design assumptions and failure to adapt to changing standards. The European stress test report on Hinkley Point B summarized the potential impact of sea level rise there.

However, work subsequent to the second periodic safety review indicated a sea level rise due to climate change of approximately 0.88 m at Hinkley Point B over the current century. This indicated that sea level rise will be 9.18 m AOD [above Ordnance Datum] by 2016. This depth is still not adequate to threaten the main Hinkley Point B nuclear island at 10.21m AOD. However the cooling water pumphouse at 8.08m AOD would be flooded with consequential loss of the systems inside. The increased flood levels due to climate change do not change the nuclear safety arguments as the flooding is infrequent and therefore loss of cooling water systems remains tolerable given that the fire hydrant remains available.

Sites with multiple nuclear power plants and twin units Until the Fukushima disaster, it had usually been assumed that it was an advantage to have several reactors at one site, as they could support each other with shared equipment, personnel or emergency power supply in the event of an emergency affecting one reactor. The negative impacts on a site’s other reactors of a severe accident in one reactor were not appropriately taken into account. In practice, safety-related systems which are connected to multiple units or designed for alternating operation may give rise to adverse interactions. In many cases the shared usage of components and systems such as water reservoirs, pipelines and pumps is intended to compensate for an inadequate capacity of subsystems and/or insufficient redundancies. Multiple units are also often meshed by using cooling water inlets and pumping stations jointly. If a system’s function is requested for one unit its availability for the other unit or units may become insufficient. Switching operations and modifications affecting one unit may also result in unexpected effects on the other unit(s). Moreover, external hazards have the potential to cause simultaneous failures of identical components of several reactors on one site.

EXAMPLES: At Fukushima Daiichi, the site’s external power supply was lost as a consequence of the earthquake. The pumping stations of the cooling systems and most of the emergency diesel generators on site were destroyed by the tsunami. The four oldest reactors at Fukushima suffered the greatest destruction. The oldest unit – Fukushima Daiichi 1 – was the first of three units to suffer a core meltdown, leading to a hydrogen explosion that partly destroyed the reactor building. The reactor cores of units 5 and 6, the newest units at the site and located on higher ground, remained undamaged. Fukushima Daiichi units 3 and 4 used a shared chimney as part of the venting system for severe accidents. Hydrogen gas produced by the overheating of fuel in unit 3 – was released during venting operations and spread over piping to the common chimney into the reactor building of unit 4, leading to a severe hydrogen explosion.

It should be emphasized that the European Stress Test specification did not take specific account of issues facing multi-unit plants, and assessment of the risks due to common-cause failures or consequential failures between units was seldom addressed in the Stress Test reports. The operators of multi-unit power plants often describe only a single reactor as a reference for all units and their reports hardly touch on possible interactions between or simultaneous problems of several units.

Considering the impact of the July 2007 Chuetsu earthquake off the coast of Japan’s Niigata Prefecture on the KashiwazakiKariwa multi-unit power plant, as well as the impacts of the March 2011 earthquake and tsunami on the Fukushima-Daiichi site, the IAEA decided in October 2012 to focus on the problem, admitting that it had hitherto been neglected: The number of sites housing multi-unit nuclear power plants (NPPs) and other co-located nuclear installations is increasing. An external event may generate one or more correlated hazards, or a combination of non-corelated hazards arising from different originating events, that can threaten the safety of NPPs and other nuclear installations. The safety assessment of a site with a single-unit NPP for external hazards is challenging enough, but the task becomes even more complex when the safety evaluation of a multi-unit site is to be carried out with respect to multiple hazards… The currently available guidance material for the safety assessment of NPP sites in relation to external events is not comprehensive. The IAEA has not published safety standards in all the areas of this subject.

Development of infrastructure and population. Nuclear power plants are often built near areas of high population density to ensure proximity between power production and consumption, and because they require well-developed road and power supply infrastructure. Moreover, the extension of existing sites has often been given preference since decisions in favor of new sites became more difficult to secure. Of course, the already high population density surrounding sites may increase with time. In the meantime, increasing knowledge about the possible consequences of accidents and radioactive releases shows the need for new assessments of the risks to the public.

The more people are liable to be affected by emergency civil protection measures in the event of a nuclear accident, the more difficult such measures will become to implement. Information provision, monitoring, decontamination, traffic management and medical care, as well as the process of evacuation, will present severe organizational challenges for the civil protection authorities.

Most European countries have evacuation plans covering a radius of less than 10 km around their nuclear power plants. No harmonization of national regulations has yet been achieved. The experiences of Chernobyl and Fukushima, as well as modern computer simulations, show that external emergency plans for nuclear power plants should be extended. Calculations by the ÖkoInstitut show that an area as large as 10,000 km2 could be affected by evacuation and relocation after a severe nuclear power plant accident involving a large and early release of radioactivity. A radius of more than 50 km around the plant may thus be affected.

The more people are liable to be affected by emergency civil protection measures in the event of a nuclear accident, the more difficult such measures will become to implement. Information provision, monitoring, decontamination, traffic management and medical care, as well as the process of evacuation, will present severe organizational challenges for the civil protection authorities. Most European countries have evacuation plans covering a radius of less than 10 km around their nuclear power plants. No harmonization of national regulations has yet been achieved. The experiences of Chernobyl and Fukushima, as well as modern computer simulations, show that external emergency plans for nuclear power plants should be extended.133 Calculations by the ÖkoInstitut show that an area as large as 10,000 km2 could be affected by evacuation and relocation after a severe nuclear power plant accident involving a large and early release of radioactivity. A radius of more than 50 km around the plant may thus be affected.

Table 1.4 gives examples of older reactors close to the larger cities of Europe. Notably, all the main cities in Switzerland are in the neighborhood of ageing nuclear power plants and might be subject to evacuation in the event of a major accident. It should be emphasized that the region of Basel is the seismically most active region in Western Europe besides Italy and Greece (neither of which has any operational nuclear power plants) and also has six of the oldest active reactors in existence. In the area of Fukushima approximately 150,000 people had to leave their homes; while around Chernobyl 116,000 people from the 30km area, and subsequently another 240,000 people, were permanently relocated.

Older reactor Country Affected cities Doel 1–4 Belgium Antwerp Population in the area of the cities 5,000,000 Tihange 1–3 Belgium Liège, Namur 860,000 Dukovany 1–4 Czech Republic Brno 800,000 Mühleberg Switzerland Bern 500,000 Beznau 1–2 Switzerland Zürich, Basel 2,000,000 Leibstadt Switzerland Zürich, Basel 2,000,000 Gösgen Switzerland Zürich, Basel 2,000,000 Fessenheim 1–2 France Mulhouse, Basel, Freiburg 1,500,000 Gravelines 1–6 France Calais, Dunkirk 300,000 Bugey 2–5 France Lyon 1,300,000 Blayais 1–4 France Bordeaux 720,000 Dungeness B 1–2 United Kingdom London 14,000,000 Borssele Netherlands Ghent 600,000 Table 1.4 – European urban populations potentially affected by a major nuclear incident involving an older reactor

Lessons (to be) learnt from Fukushima – the EU Stress Test

Scope of the EU Stress Test The European Stress Test focused on the ability of nuclear power plants to withstand events beyond the original design basis, sometimes referred to as robustness. To this end, severe events were defined whose consequences had to be investigated by the operators and the national regulators.140 In the light of the Fukushima disaster external hazard played a key role in the EU Stress Test, with earthquake, flooding and extreme weather conditions required to be evaluated. Furthermore, as the earthquake and tsunami that caused the Fukushima disaster resulted in the total loss of important safety functions, an investigation of a postulated loss of electrical power and of the ultimate heat sink for the reactor core and the spent fuel pool, independent of the causing initiating event, was to be conducted.

The pre-planned measures to deal with a severe accident at the Fukushima site were not capable of preventing core meltdown and hydrogen explosions. Accordingly, the severe accident management measures in place in EU nuclear power plants, i.e. measures to secure the cooling of core and spent fuel pool and the integrity of the containment, and to restrict radioactive releases, were also to be investigated.

Shortcomings in the scope of the EU Stress Test

the scope of the EU Stress Test did not include other significant events that could lead to a severe accident, consideration of which is necessary for any comprehensive assessment of the safety of nuclear power plants, such as: • loss-of-coolant accidents; • reactivity-initiated events or anticipated transients without scram; • internal events such as fires or internal flooding; and • anthropogenic events, including terrorist acts such as deliberate aircraft impacts.

The specific topic of the ageing of nuclear power plants was also outside the scope of the EU Stress Test. This is of special importance, as several aspects of ageing as discussed in section 3 will have an impact on either the probability of an initiating event or the possible consequences of such an event. For example, the risk of a small break loss-of-coolant accident will be influenced by the quality of chosen materials, the manufacturing processes and frequency and efficacy of in-service inspections. Ageing mechanisms will enhance the risk of failures of piping. Moreover, issues of design ageing, such as absence or insufficient physical separation of redundancies in older reactors, will increase the risk of common cause failures in events such as internal fires or internal flooding, compared with the risk faced by a more modern reactor. Particularly with respect to malevolent events, the design requirements for older plants were much less demanding than those for more recent plants.

Thus, because of the restricted scope of the safety assessment and its failure to cover ageing as an important topic, the EU Stress Test cannot be seen as a comprehensive assessment of the safety of EU nuclear power plants as originally requested by the European Council.

The procedure clearly did not focus on important shortcomings in the original design basis of European nuclear power plants, nor on significant differences in the design bases of plants either within one country or in different countries. While the operator and national regulator had to discuss the conformance of the plant with its design basis, they were not required to consider the design’s compliance with modern standards such as the WENRA Safety Objectives for New Power Plants or even with safety standards for existing nuclear power plants such as the WENRA Reference Levels.

As a result, the design deficiencies of older plants were not fully covered by the results of the EU Stress Test. For example, for a loss of electrical power, important factors such as the physical separation or protection of the emergency power supply system were not analyzed in detail, even though the Fukushima disaster clearly showed that design flaws such as placing all emergency diesel generators and switchyards in the basement of the building without protection against flooding of the site can have a severe impact on the safety of a plant.

with respect to the robustness of the nuclear power plant, possible cliff-edge effects were to be identified. But at the same time, no procedure was defined to assess the robustness of the plant with respect to those possible cliff-edge effects.

The typical schedule for a comprehensive safety assessment such as those that are performed in many countries on a regular, typically ten-year basis, foresees a longer assessment period. Operators prepare their safety assessment documents over several years, and several years more are required by the authorities and their technical support organizations to evaluate the operator’s reports and reach conclusions regarding necessary safety enhancements. Thus it is evident that, especially with respect to beyond design basis events, which have never before been analyzed in detail, only a very limited quantity of validated or even qualified documents was available for the assessment. An important part of the results produced by the Stress Tests thus had to rely on expert judgement. For older plants, the documentation produced during design and construction was not as comprehensive as is required today. Furthermore, first-hand knowledge of people who designed and constructed the plant is often no longer available, as noted in section 3.3. As a result, an in-depth assessment of older plants relying mostly on existing documentation will of necessity be limited in scope. As the number of site visits conducted in the course of the Stress Test was very limited, discrepancies between documentation and the actual status of individual plants could not be realistically assessed. No site visits were conducted for nearly two-thirds of reactors; for example only 3 out of 16 operational reactors in the UK and 12 out of 58 in France were visited. The oldest British reactors, at Wylfa, Hunterston and Hinkley, received no visits from reviewers.

Although a significant number of possible improvements was identified, not a single plant in the EU faced an unplanned shutdown or was permanently shut down as a direct result of the EU Stress Test. While a broad range of safety issues and good practices was identified in the framework of the Stress Test, there is still no unified or harmonized set of minimum requirements at an EU level. The actual level of improvements implemented is decided on a national basis.

important severe accident response measures (such as hardened filtered vents) that had been developed and promoted well before the Fukushima disaster have still not been implemented in all EU nuclear power plants, and there is still no EU-wide mandatory requirement to implement them. Even in those plants where severe accident measures, like hardened filtered vents have been implemented, they are sometimes not fully protected against external events such as earthquakes. While important safety improvements such as the installation of a diverse and fully independent secondary heat sink and an emergency control building, are identified by the Stress Test as good practices, there is no general consensus in favor of such retrofits. Some countries already have an additional layer of safety systems to ensure fundamental safety functions, including auxiliary systems (such as emergency diesel supply) in physically separated and/or specially protected buildings. Some countries such as France are preparing requirements to install a so-called ‘hardened core’ of equipment. Such a hardened core should safeguard all fundamental safety functions including auxiliary systems, even against external hazards of a much higher impact than has been allowed for by design basis assumptions up until now. A hardened core of this kind would be a very valuable retrofit for all EU nuclear power plants. At the same time, it has to be

that the implementation of such a core will take a number of years, even in France where it is already under discussion for a longer time.

While all the above aspects can be dealt with individually, the complex interactions between all of them have the potential fundamentally to undermine the safety level of ageing nuclear power plants.

The economics of nuclear power plant lifetime extension

The nuclear power plants that came on line in the 1970s, and which make up a significant proportion of the world’s nuclear generating stock, are now coming to the end of their expected operating life, typically 30–40 years. The replacement of these reactors with new nuclear capacity is highly problematic, for example in terms of cost, finance and siting, so utilities are increasingly looking to extend the lifetime of their existing nuclear power plants as the easiest way to maintain their nuclear capacity. If the cost of modifications were to prove relatively low, life-extended plants could be highly profitable to their owners because the capital cost (which makes up the majority of the cost of a unit of nuclear electricity) will already have been paid off, leaving only the operating and maintenance (O&M) costs to be paid.

The report looks at lifetime extensions of 10 years or more, as opposed to shorter extensions which are often granted on a more ad hoc basis. It focuses on pressurized water reactors (PWRs) and boiling water reactors (BWRs), which accounted for 271 and 84 respectively of the 435 reactors in operation worldwide in November 2013, and which encompass the majority of reactors being considered for lifetime extension. In a number of countries, only one or two reactors are coming up for retirement and the authorities’ approach to lifetime extension may be tailored to specific conditions at these reactors. The report therefore focuses on the two countries, the USA and France, which, because they have a significant numbers of reactors nearing their original licensed lifetime, might be expected to have developed a more systematic process for authorizing lifetime extension.

The case for lifetime extension

The advantages to nuclear power plant owners of lifetime extension are as follows: • The cost is expected to be much lower than that of new-build nuclear or other electricity generation capacity. • Maintaining capacity on an existing site is much less likely to cause public opposition than new-build, even on an existing site. • Upgrading an existing plant represents a low economic risk because it is expected to be much less likely to lead to cost escalation and time overruns than new-build. • Unexpected technical problems are much less likely with a long-established design than with a new, relatively untested design. • If a plant’s capacity represents a large proportion of the country’s nuclear capacity, extending its lifetime will help maintain nuclear skills, which may be lost if the reactor(s) involved are closed. • It may allow upgrades to be carried out to improve the plant’s profitability, for example raising the output by installing a more efficient turbine generator. • It delays the start of decommissioning and reduces the annual provisions needed to fund this process. Decommissioning is technologically largely unproven, raises issues of waste disposal and is expected to be an expensive, challenging and controversial process.

However, the process of lifetime extension is dependent on convincing national nuclear safety regulatory authorities that the reactor’s design is safe enough to allow it to be re-licensed for a period of time that represents a significant fraction (up to half) of its original expected lifetime. It is clear that none of the designs that are currently reaching the end of their lifetime could be licensed as new-builds, and even if major safety upgrades are made the plants in question will still fall short of the standards expected of a new plant. However, while the quality of these designs falls short of current requirements, the plants are much more a known quality; any major design flaws or construction errors are likely to have emerged after more than 30 years of operation, and the operating workforces are well-established and ought to be competent.

While lifetime extension is clearly an expedient option in many cases, it does raise serious questions. These include the following: • How appropriate is it to re-license facilities that inevitably fall well short of the design standards required for new plants? • How far can regulators be sure that all significant plant deterioration can be identified, especially in parts of the plant that are effectively inaccessible? • How far can regulators be sure that significant construction quality issues, which would be picked up now because of improved quality control technology or more rigorous procedures, do not exist? 2 Concepts of power plant lifetime While regulatory approval is a necessary condition for continued operation, it is far from being a sufficient condition.

There are at least six different concepts of the lifetime of a power plant, in particular, a nuclear power plant, which are relevant. These include: • design lifetime; • accounting lifetime; • economic lifetime; • political lifetime; • physical lifetime; and • regulatory lifetime.

Nuclear economics. Prior to discussing these concepts, it is useful to outline briefly the main determinants of the economics of nuclear power. A detailed discussion of the subject is beyond the scope of this report, but some basic information is useful. The major element in the cost of a unit of nuclear-generated electricity is the fixed cost, mostly comprising the construction cost. This fixed cost is determined by the construction cost itself and the cost of capital. There is no consensus on the construction cost of a nuclear power plant, and there has been a strong upward trend in real construction costs throughout the history of nuclear power. The cost of capital is highly variable and depends entirely on the circumstances of the plant, specifically the perceived risk of the project to its financiers.

The O&M costs represent the main element of the rest of the cost of a unit of nuclear-generated electricity besides the fixed cost. However, only for the USA -there are reliable data on O&M costs in the public domain. This is available because the US economic regulatory system will only allow properly audited costs to be recovered from consumers. Even this source of data is becoming less extensive as more US plants recover their costs from a non-regulated, competitive market and are not required to publish accurate costs. In other countries, there is no incentive for utilities to publish O&M costs. Utilities regard this information as commercially confidential and also have good reason to present their investments in nuclear power in a good light, so data from other countries have to be treated with skepticism.

Design lifetime. The plant’s design lifetime is set by the specifications of the materials used and equipment installed, and how long these are expected to remain serviceable. The design lifetime is not a precise measure of how long a power plant will last, because this will depend on a number of factors, in particular the O&M regime. For example, if any thermal power plant is shut down and started up more often than expected, this will impose thermal stresses likely to shorten the life of the plant. If the plant is not maintained as well as expected, its life will be shortened. In the case of nuclear power plants, there is still limited experience of how long materials will last when exposed to radioactive bombardment. In practice, plants are retired not on the basis of the design lifetime but according to other factors, and design lifetime is not considered further in this chapter.

Accounting lifetime. Any capital asset is given an accounting lifetime when it enters service: this represents the period over which the construction cost is to be recovered. Once the initial capital cost has been recovered, the plant is said to be ‘amortised’, and the output can be profitably sold at marginal cost plus a profit margin. In the case of a nuclear power plant, for which the operating costs are expected to be a relatively low proportion, perhaps 30 per cent, of the overall cost of a unit of electricity, once the initial costs have been recovered the plant may be seen as a cheap source of electricity. However, this is not invariably the case: for example, in 2013 the retirement of five US nuclear power plants was announced because the costs of operating them and keeping them in service were too high for them to be profitable.

In theory, whether a plant is amortised or not should not influence decisions on retirement – the initial costs have to be repaid whether or not the plant is operating. The operating costs should be the sole determinant of whether or not to retire a plant. However, whether or not plants are amortised may influence political decisions about their future. In Germany, the utilities are demanding compensation for the government’s phase-out policy because closing the plants at about year 30 will prevent the utilities earning large profits from their continued operation.3 In Belgium, the government was demanding the payment of windfall taxes on the profits made by the utilities as a condition for allowing their plants to be life-extended.4 Unsurprisingly, the German utilities who filed for compensation for not being allowed to life-extend their plants, claimed that their foregone profits would have been high so as to ensure that their compensation will be high, while the Belgian utilities claimed that the profits of their life-extended plants would be lower than the Belgian electricity regulator’s estimate so as to minimise the windfall taxes payable. However, like design lifetime, accounting lifetime is an ex ante measure and not generally speaking a determinant of decisions on lifetime extension, and is therefore not considered further in this report.

Economic lifetime. Any piece of industrial plant is generally only kept in service as long as it is profitable. Once a piece of industrial plant such as a power plant is no longer profitable and there is little realistic prospect of it becoming profitable again, it will be retired. This is particularly relevant in the case of technologies in which progress is rapid, or when the costs of the existing technology or its potential replacements changes. For it to be economic to replace a piece of plant, the cost of building and operating its intended replacement must be less than the cost of continuing to operate the existing plant. For example, in the past, old coal-fired power plants were often retired because new coal-fired designs were available that were so much more thermally efficient than their predecessors that the cost savings from lower coal consumption would more than pay for the capital cost of the replacement. Changes in environmental regulations, may also help to justify the retirement and replacement of existing capacity. For example, in the 1990s combined cycle gas turbines had such low overall costs, because of low construction costs, low world gas market prices and high thermal efficiencies, that in some cases they were able economically to replace existing coal-fired capacity, helped by the fact that the cost of retrofitting environmental controls to the coal-fired plants was avoided (the environmental performance of the gas-fired plants being intrinsically superior). It should not be overlooked, however, that any unamortised capital costs of a plant that is retired and replaced will have to be met from the revenues of the replacement plant, in addition to its own capital costs.

Political lifetime. Major pieces of industrial plant may also be subject to considerations of political acceptability: if a process or product is no longer politically acceptable, the plant must be retired. This is clearly illustrated by countries with nuclear ‘phase-out’ policies where plants are retired because they no longer command public acceptance, even if the regulator is prepared to continue to license the plant. In some cases, the political forces are external; this was the case for Eastern European and former Soviet Union countries including Bulgaria, Lithuania, Slovakia and Ukraine, on which the West placed pressure to retire designs of nuclear power plant that it categorized as unsafe.

Physical lifetime. Many components in power plants are readily and quite cheaply replaceable, and plants all of whose major components can readily be replaced can be seen as effectively having an indefinite life-time. In practice, the lifetime of such plants will be determined by economic or regulatory factors. A simple analogy is ‘your grandfather’s axe’, which had had three blades and four handles but was still the same axe. However, where there are components that it would clearly not be economically viable to replace – so-called life-limiting components – the plant’s lifetime will be determined by the lifetime of those components. A simple analogy is a bicycle: failure of the frame means bicycle has to be scrapped. The older a plant gets, the lower its value tends to become once repaired, and the more likely it is that the replacement of a given component will turn out to be prohibitively expensive. For nuclear power plants, the most commonly quoted life-limiting component is the reactor vessel. If the integrity of the vessel can no longer be guaranteed, there is a risk of the core being exposed to the environment and the plant has to be retired.

before the accident at the Three Mile Island power plant in Pennsylvania, USA, it was assumed that the simultaneous failure of two independent safety systems was so unlikely as to be effectively impossible. Three Mile Island proved that this was not the case, so additional safety requirements had to be introduced.

There is variation between countries on the duration of the nuclear power plant licences. In the USA, nuclear plants were given a lifetime of 40 years by the Nuclear Regulatory Commission (NRC), at the end of which the licence must be renewed or the plant shut. At the other end of the spectrum, in the UK, once a nuclear plant has been licensed for operation, that licence remains in force only until the next major maintenance shutdown, usually about a year ahead, after which the regulator (the Office of Nuclear Regulation (ONR)6) must approve the restart. In France, nuclear power plants are subject to a 10-yearly review by the Autorité de ) must approve the restart. In France, nuclear power plants are subject to a 10-yearly review by the Autorité de year licence does not give the operator carte blanche to run the plant for 40 years, as it can be withdrawn at any time. For example, in 1987, the NRC found evidence of poor operating practice at the two-unit Peach Bottom site in Pennsylvania.7 As a result the two reactors were closed for more than two years until the NRC was satisfied that the issues had been resolved. Severe reactor head degradation was found at the Davis-Besse power plant in Ohio and the plant was kept off-line for two years until repairs had been carried out to the NRC’s satisfaction.

Experience of nuclear plant lifetimes Some of the nuclear power plants that have so far been retired around the world were early designs that had been shown to have design problems. For example, four out of six of the first generation BWRs were retired around 1980 because their steam generators were causing serious problems. Experience of nuclear technology and of regulatory approval of new designs should mean that serious design errors are less likely now. However, such errors are still possible, particularly in the case of more radical new designs. For example, the N4 design developed by Framatome (predecessor of Areva, the French public-owned nuclear power corporation) for four reactors built in the 1990s in France contained a number of significant design errors that delayed commercial operation and necessitated significant design changes.

In practice, nuclear power plants may be retired for a combination of reasons; in the following tables the reason for retirement listed is the major one.

Nuclear power plant retirements to date have been dominated by the USA, Germany, Eastern Europe and the countries of the former Soviet Union. By comparison, there have been relatively few retirements in the rest of the world.

In the USA, the dominant reason for plant retirement has been economic, particularly in the 1990s and again in 2013 – both times when the natural gas price was low, and nuclear power plants could be economically replaced by gas-fired plants. The NRC had actually given approval in principle for two of the five plants whose retirement was announced in 2013 to continue to operate for a total of 60 years. One study identifies 38 US reactors as being under threat of closure on economic grounds, with 12 under particular threat (see Annex 1). This shows how quickly the outlook for an operating nuclear power plant can alter with changes in fossil fuel prices, the need for significant repairs and the need for significant safety upgrades. The larger the extent that nuclear plants are exposed to unpredictable wholesale electricity markets, the more economically vulnerable they become. The five plants whose retirement was announced in 2013 deserve further discussion as, while the fundamental issue was cost, there were important differences between them that illustrate the issues involved in lifetime extension.

San Onofre 2 and 3 Units 2 and 3 of the San Onofre plant in California were completed in 1983 and 1984 respectively. They were built and are owned by Southern California Edison (SCE). The retirement of the San Onofre units was related to the cost of replacing the steam generators. The plants had been closed in January 2012 after the discovery of tube wear in the steam generators, which had been replaced as recently as 2010 (Unit 2) and 2011 (Unit 3) at a cost of $602m. SCE claimed in November 2012 that it was safe to continue to operate the units at 70 per cent capacity, but by May 2013 it had been unable to convince the NRC of its case and the plant was shut down. SCE is now trying to recover the cost of the apparently inadequate replacement steam generators from the supplier, Mitsubishi and from its insurer, and also wants to pass any unrecovered costs on to consumers. The issue facing SCE is how far it will be able to recover both these costs and the replacement power costs from its consumers. California has a regulated energy market, and as of September 2013 there were doubts as to whether the regulator, the California Public Utilities Commission (CPUC), would allow these costs to be recovered.17 By November 2013, it seemed likely that CPUC would rule that already calculated replacement power costs would have to be refunded to consumers.18 The closure of the plant therefore seems to have been related more to concerns about the safety of the steam generators and the consecutive need to have them replaced, uncertainties about recovery of the repair costs and related future costs than to the cost of gas-fired alternatives.

In Germany, the dominant reason for plant retirements has been the political decision to phase out nuclear power, first taken in 2002 (as a result of which two reactors were retired) and then reconfirmed in 2011 after the Fukushima disaster, whereupon a further eight reactors were retired. The remaining nine reactors will be progressively retired over the period from 2015 to 2022.

Eastern Europe and the former Soviet Union. In Eastern Europe and the former Soviet Union, the dominant reason for plant retirement has been concerns about the safety of some Soviet technologies – especially the RBMK design used at the Chernobyl site, but also the first generation Soviet PWR, the VVER. A condition for entry into the European Union for Bulgaria, Slovakia and Lithuania was that plants using these suspect designs be retired. Russia’s own regulatory process is not open and the reasons for retirement of plants are not publicly disclosed.

The RBMK design uses graphite as a moderator, and if the integrity of the moderator cannot be assumed, safety issues emerge. During the 1990s Russia essentially rebuilt four reactors of the RBMK design at the Leningradskaya site near St. Petersburg, with shutdowns of about two years. The plants were also upgraded to take account of the lessons from the Chernobyl disaster, and after a further 18 month shutdown to repair the graphite, the first unit at the site was returned to service in November 2013. The other three units are now expected to undergo similar repairs. It has not been reported how long these reactors are expected to continue to operate. The six RBMKs built outside Russia, in Lithuania and at Chernobyl, have all been retired. Including the four at Leningradskaya, eleven RBMKs remain in service in Russia but these will not be considered further because the determinants of their lifetime are very different to those of PWRs and BWRs and because there is no reliable information on the standards the Russian authorities require these plants to meet.

In the rest of the world, there has been a mixture of reasons for retirement. The gas-cooled reactors (GCRs) using carbon dioxide as a coolant and graphite as a moderator (installed in the UK, France, Italy, Spain22 and Japan) were very expensive to operate and all except those in the UK have now been retired. In the UK, all reactors of the first-generation Magnox design have been closed except for one, expected to close in 2015; but all seven plants using the second-generation UK design, the Advanced Gas-cooled Reactor (AGR), remained in service in 2013. For graphite moderated reactors, the main life-limiting component is the graphite moderator framework which thins and distorts with exposure to heat and radiation. The GCRs are not considered further in this report because the determinants of their lifetime are different to those for PWRs and BWRs.

In the Canadian-designed Pressurised Heavy Water Reactors (CANDUs), the fuel is contained in a large number of pressure tubes rather than in a single pressure vessel. Up until 1987, it was assumed that these pressure tubes would leak before breaking so that there would be ample warning of a pressure tube rupture, and tube failure was therefore not seen as a serious safety issue. This assumption was then proved false when it was discovered that rupture could occur unpredictably. Since then, once the integrity of these pressure tubes can no longer be assumed (expected to be after 20–25 years), they must be replaced in a major repair. For three reactors, the cost of this was seen as unjustifiable and they were therefore retired. The special issue of the integrity of the pressure tubes means that the decision-making for CANDUs is somewhat different to that for PWRs and BWRs, and accordingly CANDUs are not considered further in this report.

Following a 1987 referendum Italy took the decision to close its nuclear plants, and although there were attempts by Prime Minister Silvio Berlusconi to reverse this decision, it was confirmed by a second referendum in 2011. A phase-out decision taken in 1980 in Sweden under a referendum led to only two out of 12 of the country’s reactors being shut down before the policy was abandoned in 2010. Similarly, a phase-out promise made in 2004 by the Spanish government has led to the closure of only one of the remaining nine units, a very small, old reactor.

The impetus for lifetime extension programmes Until the last decade, nuclear power plants had an expected lifetime of 40 years or less. As the first wave of commercial nuclear power plants did not enter service until the mid-1960s, plant retirements were few and generally driven by either economic factors, design issues or political factors. Table 2.5 shows that for most countries dealing with retirement is still not a major issue. Nearly half (14) of the 31 countries operating nuclear power plants have no reactors aged 35 or older.

Countries with more than 40 per cent of their reactors in service or under construction aged 35 or older, that use PWRs or BWRs and that have three or more reactors aged over 35 (see Table 2.5) include Belgium, Sweden, Switzerland and the USA. The first three of these countries have or have had nuclear phase-out policies, which if carried through would mean that the issue of lifetime extension would have limited relevance.

The USA is by far the most advanced country in terms of its progress towards lifetime extension: the majority of its reactors have been given approval by the NRC to operate for at least 60 years as opposed to the 40-year life for which they were originally licensed. However, this was done before the Fukushima disaster and, as has been demonstrated by the retirements in 2013, the existence of permission to extend a reactor’s lifetime to 60 years is far from a guarantee that it will actually operate for this long.

While France appears to have less need to consider lifetime extension as yet, the scale and speed of the French nuclear power programme from 1977 to 1992 means that the issue is already of importance for planning. Of the 58 reactors in service in 2013, 23 were commissioned in the period 1977–82 (see Table 2.6), representing more than 20GW of capacity. If France was to replace all this capacity with the latest French design, the European Pressurised Water Reactor (EPR), this would require at least 13 new reactors. If we assume that the cost per reactor would be the same as that agreed by the UK government for its Hinkley Point B EPR, €9.5bn24, and the existing reactors were replaced at age 40, the investment needed before 2022 would be in excess of €120bn in present-day terms, a sum that would be difficult for France to finance. To put this figure in perspective, it represents about double the annual turnover of the entire global EDF group.

However, President François Hollande was elected on a promise to reduce the nuclear contribution to France’s electricity from 75 per cent to 50 per cent, and has promised to close the two oldest reactors, at Fessenheim, by the end of 2016. Moreover, the ASN is requiring an expensive range of upgrades to take account of the lessons from the Fukushima disaster, making lifetime extension less attractive. The French case is therefore complex and highly uncertain.

For the purposes of lifetime extension, it is clear that the technologies under consideration are far short of the standards that would be required for a reactor planned today. By definition, all were designed before the Browns Ferry accident of 1975 and can take only limited account of the lessons learnt there, much less the lessons from the Three Mile Island (1979) accident and the Chernobyl (1986) and Fukushima (2011) disasters. The Browns Ferry accident occurred when a fire in a cable tray disabled the control systems for all three reactors on the site and led to the recognition of the need for a much greater degree of independence of the reactors on a multi-unit site. The first reactors designed post-Chernobyl have yet to enter service, while it is clear that the lessons to be learnt from Fukushima are only now beginning to emerge and that it will be decades before they are fully embodied in the available reactor designs.

Many of these design lessons cannot be applied to existing reactors. For example, the Chernobyl disaster led to a requirement in some jurisdictions that ‘core-catchers’ be installed to prevent the core burning down into the environment in the event of a reactor vessel failure. Similarly the 9/11 terrorist attack led to a requirement that reactor containments should be able to stand up to impact from a full size civil aircraft. It is clear that neither of these requirements could be met in existing reactors, and that the BAT standard cannot therefore be met. So the decision to life-extend inevitably means giving what is essentially a new life of perhaps 20 years to a facility that falls far short of current best practice. Regulators must therefore judge how far short of current standards it is acceptable for facilities to fall.

Conclusions.  Very few nuclear reactors have been retired because they have reached the end of their licensed lifetime. Much likelier life-determining factors are: the economics of the plant; the existence of national phase-out policies; serious and unexpected equipment failures; and, for older designs in particular, existence of design issues that makes their continued operation unacceptable in terms of current standards. There seems to be a consensus among regulators that most existing reactors can be safely operated in principle for 60 years, and there are even investigations in the USA into extending lives to 80 years.

However, in the 15 years since lifetime extension began to be adopted, the perception of the risk attached to assuming a significantly longer life has increased. In the USA, the process of obtaining the first lifetime extensions went smoothly, without major plant modifications being required. However, as more problematic plants came up for consideration and safety-related incidents (initially the 9/11 attack) began to play a role in official thinking, the process became more difficult and expensive. It also became clearer, especially after the Fukushima disaster, that in-principle approval for a reactor to operate for 60 years was far from being a guarantee that it actually would complete a 60-year operational life.

The collapse of natural gas prices in the USA also emphasized that there are economic risks to lifetime extension, with two of the four plants retired in the USA in 2013 being closed purely on the grounds that they were expected to become loss-makers.

A longer lifetime gave utilities the opportunity to justify upgrades aimed at improving the economics of a plant, such as power upgrades. However, as the risks and costs of lifetime extension became clearer, the case for this additional discretionary investment was weakened.

Regulators face the difficult task of determining how safe is safe enough. It is clear that the designs of plants now reaching the point where lifetime extension will be considered fall far short of the requirements for a new plant, and that retrofitting to bring them up to today’s new-build standards would be technically and economically infeasible. As a result the required standard for the upgraded technology of a life-extended plant tends to be merely that the risk should be as low as reasonably achievable (ALARA), with the ‘best available technology’ (BAT) standard being unattainable.

There appears to be a significant difference between the requirements of the US regulator NRC, and those of the French regulator ASN, particularly post-Fukushima. The ASN is now requiring an extensive range of upgrades, for example improved seismic resistance and flood protection of back-up power and control rooms. The NRC does not appear to have modified its requirements significantly in the light of Fukushima, and the cost of related modifications appears to be much lower than in France, despite the fact that some US reactors are of comparable type and vintage to Fukushima’s, whereas the French reactors are of a very different design.

Nuclear Liability Of Ageing Nuclear Reactors

The relationship between reactor lifetime extension and nuclear liability is a key issue, which is the particular focus of this chapter. It analyses the possible impact of lifetime extension on nuclear liability and examines to what extent a nuclear operator would be liable for the costs of an incident affecting a life-extended reactor. It addresses the following questions: • Does the current legal framework on nuclear liability address nuclear ageing and lifetime extension of reactors? • Would it be a good idea to have a specific provision addressing nuclear ageing and lifetime extension of reactors? • What is the liability of suppliers of upgrades for life-extended reactors?

According to European Commission figures, the March 2011 Fukushima disaster caused €130bn of damage.

The question now arises whether a nuclear incident in Europe would cause a similar amount of damage. A report by the French Institut de Radioprotection et de Sûreté Nucléaire (IRSN) has indicated that the damage caused by a serious nuclear incident in France would cost between €120bn and €300bn.

The costs of the Fukushima disaster as well as the recent French study demonstrate once again that the amounts provided for under the nuclear liability conventions are absolutely too low. Even assuming that the 2004 Protocols to the Paris and Brussels Supplementary Convention was in force, this would mean that potentially only half of one per cent of the damage could be compensated for (€1.5bn available against damage of €300bn).

A first consequence of the liability subsidy is that nuclear operators may enjoy a preferential situation in the energy market compared with other producers that do not receive such a subsidy. Since operators of nuclear plants do not have to internalize the full social cost of their activity, the price of nuclear energy will be artificially lowered compared with energy from other sources, leading to a distortion of competition and reducing the incentive to build other types of power plant.

A consequence of inadequate victim compensation, is that it would be very hard to ensure equal treatment of victims. There is a significant risk that victims who have filed a claim first will be awarded compensation first, while, victims who are later in filing a claim (for example because effects on health become apparent only sometime after the incident) face the risk of receiving less compensation or no compensation at all, especially when the compensation already awarded exceeds the limited liability amounts. This possibility raises important issues in terms

Insurance of nuclear risk

Reactor ageing and lifetime extension may of course have important consequences for the demand for nuclear insurance and financial security and for the price of the cover provided. To the extent that the probability of a nuclear accident increases with ageing, there are consequences for the premiums charged; to the extent that chance (larger chance of failure) and the magnitude of the potential damage (because of a decreasing functionality of protection barriers) may increases, there may be consequences for the necessary scope of cover. This prospect threatens to exacerbate the tendency whereby debate on reform of nuclear liability (for example towards unlimited operators’ liability) has always been obstructed by the argument that higher levels of liability than currently provided for by the conventions, and certainly unlimited liability, would be uninsurable. As we will argue below, this argument contains serious fallacies. First, policymakers have been too much dependent on one-sided information provided by the nuclear industry as to what amounts would be insurable. More recent estimates, for example by nuclear reinsurers, hold that substantially larger amounts could be covered30; moreover, it is, as the examples of some EU Member States show, not necessary to link the level of nuclear liability to the available level of insurance coverage on the market. Liability could in principle be unlimited (as in Germany), but the required financial cover could be limited to the amount that could be provided by the market. Policymakers need to become much more critical and rather than relying on one-sided information provided by the nuclear lobby, conduct an objective analysis of cover available on the financial and insurance markets, taking into account information from relevant stakeholders such as large reinsurers.

Conclusions Countries that opt for reactor lifetime extension should do so only in the context of substantially improved arrangements for compensation of victims of a nuclear incident – a higher level liability will not only be beneficial for the victims of a nuclear incident but will also have an important preventive effect. There seems to be little doubt about the advantages of some of the principles of the international nuclear liability regimes, especially as far as strict liability and compulsory insurance are concerned. There has, however, been much criticism of legal channeling, limited liability and state funding. Strict liability favours victims because they do not need to prove negligence or a fault on the part of an operator in order to be compensated. Compulsory insurance guarantees that a certain level of compensation will be available even if, for example, an operator goes bankrupt after a nuclear incident.

The other principles of the conventions were created in favor of the nuclear industry: the limitation of liability is the most striking example of this. The amount of limited liability was set not as a function of the potential cost of the damage caused by an incident, but as a function of the capacity of operators to buy financial security for their third-party liability. Limited liability is an effective subsidy to the nuclear industry and should be abolished. Nuclear operators must be subject to unlimited liability just like any other industrial corporations.

Concentration of liability (legal channeling) also clearly favors the wider nuclear industry because suppliers cannot be held liable for damage caused by goods or services they supplied. Closely linked to concentration of liability is the concentration of jurisdiction. The aim of this provision is to guarantee that no judge in a country other than that where the incident occurred will accept jurisdiction and apply legislation denying limited and concentrated liability. Overall, the balance of the conventions is largely to the advantage of the nuclear industry, which is unsurprising given that their principles are based on studies conducted on behalf of the US Atomic Forum the mentioned Preliminary and Harvard studies).

Given the conclusion that a nuclear operator should not be able to benefit from any limitation of liability, there is little advantage in advocating that the liability levels of power plants whose reactors have been granted lifetime extensions should be higher than those of other nuclear power plants. To allow such a difference would be implicitly to favor limited liability for ‘non-extended’ reactors. There is no reason why non-extended reactors should continue to receive such a subsidy.

The question then arises whether given its larger risk, a life-extended nuclear reactor should perhaps be subject to a higher level of compulsory liability insurance. Such a proposal is unconvincing. If European operators were pooled in an US-type system of retrospective premiums, the operators would mutually monitor one another. We can assume that they would not allow a bad risk into their system. If a life-extended reactor represented a higher risk, this would inevitably be reflected in the premium demanded of the operator.

Another severe criticism of the current nuclear compensation system offered by the conventions is that it would potentially compensate only about one per cent of the damage caused by a major nuclear incident. This situation needs to be changed not only in the framework of reactor lifetime extension, but also for all current and newly built nuclear power plants.

Given the clear advantages of the US nuclear liability and insurance system, other countries should envisage the creation of a similar model. It is true that the US system is not perfect either, since for example it also limits operators’ liability. Moreover, the retrospective premium creates a potential insolvency risk, while it is to be feared that the US Government would intervene if damage were to exceed the second tier of coverage. However, the Price-Anderson Act does internalize the costs of a nuclear accident to a much greater extent than the system defined by the nuclear liability conventions.

Politics, public participation and nuclear ageing

This chapter explores the means by which the public can influence decisions on the lifetime extension of nuclear reactors. As already described in earlier chapters, the decision to extend the lifetime of an ageing nuclear reactor is made on the basis of interactions between a range of factors. Nuclear safety is one of these, and at least in terms of nuclear public relations it is given priority. Reality shows, however, that economic or political arguments can play an overriding role.

As Chapter 1 explains, in terms of nuclear safety we are entering a new era of risk. Due to the short-lived nuclear construction boom starting in the 1970s, the number of reactors operating beyond their originally foreseen design lifetime of 30 or 40 years is growing rapidly. And after Fukushima, public concerns around nuclear power are growing as well. These anxieties have already brought a de facto end to the nuclear renaissance previously talked up by the industry, with reactor construction worldwide slowing considerably. However, the industry is also weary of any increase in public concern about old reactors, hiding the reality behind acronyms such as PLEX (plant life-time extension) or the more recently introduced term LTO (long-term operation). Few people know that these terms denote plans to increase the lifetime of what are already outdated nuclear designs by 50 or even 100 per cent. If they knew, many might feel that this was an unacceptable gamble on technology.

Ownership status of the operator. In a number of countries, such as Ukraine, the Czech Republic and Hungary, the nuclear operator is a state-owned company and dividends from the operation of nuclear power plants go to the state budget. This can compromise the government’s objectivity concerning lifetime extension of older reactors, because their continued operation will help to meet budget commitments. Because the respective governments also have a seat on the board of their state-owned utilities, the national nuclear regulator has to withstand coordinated pressure from both sides.

Conversely, privatization can also lead to complications in reactor lifetime decisions. We have already mentioned the example of Borssele in the Netherlands, where after privatization of the state-owned utility, the lifetime restriction to 40 years (the reactor’s design lifetime) was overturned and the reactor’s lifetime prolonged by 20 years under threat of large compensation claims. The Dutch nuclear regulator, de Kerntechnische Dienst, which is part of the Ministry of Economic Affairs, Agriculture and Innovation, is currently under pressure of this political promise for an extended lifetime in its assessment to allow prolonged operation after a PSR.

Political clout of the operator When Angela Merkel became Chancellor of Germany for the second time in 2009, she had to fulfil her election promise to the four nuclear operators, in return for supporting her new party, that she would reassess the nuclear phase-out law adopted in 2002. This reassessment resulted in September 2010 in an average extension of reactor lifetimes of 8 years for older reactors and 14 years for newer reactors. However, this decision was reversed a few months later after the Fukushima disaster.

Other factors. There are in addition other factors, known from previous nuclear decisions, that may influence a decision to grant a lifetime extension to an ageing nuclear reactor. These include energy security arguments (especially where there is little awareness of potential alternatives), legal complexity, lack of access to information (for example where the operator has an information monopoly on crucial data), and undue influence on the operator’s part on the national media (for example as a major advertiser).

The regulator under pressure Among the stakeholders in the decision process around lifetime extension, a country’s nuclear regulator holds a key position. Not only can it order the closure of a nuclear reactor that it deems substandard, it can also demand proposals for upgrades, prescribe upgrades or prescribe changes in management and safety culture. In addition to nuclear safety, its decisions will have implications for the economics of the power plant and its operator, as well as for its organizational culture. Given the powerful position most nuclear operators hold in national life – many of them have a significant share of the national electricity market, in some cases amounting to more than half – the regulator’s decisions are also highly political. Accordingly, proven independence is vital to enable the nuclear regulator to maintain a non-negotiable emphasis on nuclear safety.