Integration of procedures, guidelines

As stated in Section 3.3.4, a transition from EOPs to SAMGs must be defined. This can be either a fixed and irreversible transition or a parallel execution of both, with a consistency check and priority given to the SAMGs.

In the former case EOPs should be formally exited and need to be modified to include such exit conditions.

Paragraph 4.7 of Ref. [7] requires that the transition from normal operation to emergency operation be clearly defined and be effectively made without jeopardizing safety. It is required to designate the responsibilities of all those persons who would be present on the site in an emergency as part of the transi-tion. It is also required to ensure that the transition to emergency response and the performance of initial response actions do not impair the ability of the

operational staff (such as the CR staff) to follow the procedures necessary for safe operations and for taking mitigatory actions.

In addition, the process for the classification of emergencies and the activation of the response, as established in Ref. [7] (paras 4.20, 4.70), should be integrated into the process of activation of and transition to the accident management arrangements.

The actual transition is decided upon either by the CR staff when they reach the exit conditions, or by higher levels in the emergency response organi-zation (ERO) hierarchy once they have taken note of the deteriorating situation of the plant. Appendix VII gives examples of the ‘exit criteria’ and transition mechanisms for several actual applications.

As a consequence, the ERO should be reorganized to include the activities of the TSC (or equivalent support) with respect to SAMGs. This sometimes entails the establishment of a separate accident analysis team (AAT) whose prime responsibility is to assess the plant state and give recommendations to the respon-sible management. Principles for dealing with these will have been defined in phase 1, and they must now be implemented. Important issues to be addressed include:

(a) Consistency with the emergency plan and any necessary upgrades to it, (b) Definition and approval of the responsibility matrix,

(c) Definition of criteria for activation of the TSC and AAT, (d) TSC equipment for monitoring the current plant status.

The accident management guidance provides a function which has up to now been missing at most plants — that of identifying, evaluating and imple-menting a set of well-defined recovery actions to terminate or mitigate releases and restore a controlled stable condition in a plant which is experiencing a severe accident. Since this function did not previously exist in any formal way, it has not been reflected in the organization defined by the plant’s emergency plan, which in most cases deals primarily with the management of off-site occurrences. The SAMGs must be integrated into the organizational structure defined in the emergency plan and interface with it to ensure a consistent and co-ordinated response to severe accident conditions. Therefore, as part of the plant specific SAMG implementation, the emergency plan needs to be reviewed with respect to the actions that should be taken following the SAMG, to ensure that conflicts do not exist. This review might recommend changes to the emergency plan to eliminate such conflicts.

It needs to be ensured that there are no conflicts with the arrangements made for security, fire fighting and support from off the site, such as the off-site fire brigade or off-site security.

An important part of the integration of the SAMGs with the emergency arrangements is the definition of the matrix of responsibilities for severe acci-dent mitigation actions. Use of the SAMGs will result in recommendations for CR operators to take specific actions in response to decisions made at the appropriate level. If the event has developed to the extent that SAMGs are required at all, which means that there has been a multitude of systems and equipment failures, the availability of equipment needed to perform mitiga-tory actions needs to be assessed ‘on the spot’, and continually reassessed during the use of the SAMGs. The guidelines therefore provide a structure for the evaluation of current plant conditions and equipment availability, and a means to determine which of the available courses of action is the most appropriate.

Following the evaluation and recommendation of a course of action, the decision must be made to either implement the proposed actions or choose alternative actions, and then act upon that decision. Therefore, in a severe accident situa-tion, the on-site ERO must have three kinds of personnel:

(1) Evaluators: This is a team responsible for evaluating (using the SAMGs) and identifying a relevant accident management strategy. This requires a detailed knowledge of the SAMGs and a good understanding of the underlying severe accident phenomena, as well as access to plant status information. Sometimes this group of people is called the AAT or acci-dent management team (AMT).

(2) Decision makers: These persons have the authority to decide on the implementation of an accident management strategy (as put forth by the evaluators) and have a broader understanding of the status of other aspects of the emergency response, including effects off-site, which he or she takes into consideration when making decisions.

(3) Implementers: This team implements the recommended strategy in the CR.

The above responsibilities are to be defined clearly in the AMP documentation. The emergency plan must reflect these responsibilities since it defines the overall emergency organization.

The guidelines can be structured to separate the evaluators from the implementers. Normally it is suggested that the evaluators be in the TSC and the implementers the CR duty shift.¹⁰ However, during the plant specific implementation phase the accommodation of these different SAMG functions

10For example, the generic US SAMG has been written on this basis.

within the plant’s emergency organization (as defined in the emergency plan) has to be addressed on a plant specific level.

Apart from the three core functions mentioned above, other support functions are useful or required. For instance, the flow of information between the TSC (or equivalent group) and the CR, as well as from the TSC (or equiv-alent) to other parts of the ERO, must be well organized. These functions are best assigned to dedicated ‘communicators’. However, as a severe accident will generate extensive communication needs, both on-site and off-site, it is desirable that the off-site needs do not interfere with accident management.

Section 5 further describes the plant’s emergency organization, including the responsibilities of the TSC and AAT.

Reference [7] establishes requirements for performing various emer-gency response functions, including: establishing emeremer-gency management oper-ations; identifying, notifying and activating; taking mandatory action; and pro-tecting emergency workers. These requirements form the foundation of the emergency response arrangements on the site.

4.6. VERIFICATION AND VALIDATION OF PROCEDURES AND