Continuous Improvement of Nuclear Safety

61

Continuous Improvement of Nuclear Safety

Rasa Ptasekaite, Swedish Ministry of Environment

Introduction

There probably is no doubt that high level of safety is one of the funda-mental requirements for nuclear energy to have a future and to be accept-ed. However, the ways of achieving, maintaining and enhancing the high-est reasonably possible standards of safety is a question that seems to be slightly in a shadow of the objective itself. The concept of continuous im-provement of nuclear safety is generally known, but rarely analysed or de-fined. What is continuous improvement of nuclear safety – an objective, a principle or an obligation? Does continuous improvement of nuclear safe-ty have any limits? What parties are responsible for improving safety? These are only few of the questions that need to be answered in order to fully understand the role of continuous improvement in achieving high level of nuclear safety. Therefore, the main goal of this paper is to identify and define the concept of continuous improvement of nuclear safety. Due to the limitations of the article, the actual content of the latter concept, an-swering the question of what and how nuclear safety can be improved, is left for another occasion. The analysis is mainly based on IAEA legal framework and the reports of the OECD/NEA Committee on Nuclear Regulatory Activities (CNRA) and the IAEA International Nuclear Safety Advisory Group (INSAG). European legislation on nuclear safety and cer-tain examples from Swedish national legislation on the matter will be pre-sented where relevant.

For the simplicity of terminology only two terms – “regulator” and “op-erator” – are used in this paper. In different sources referred to in this arti-cle the regulator is called “regulatory authority”, “regulatory body” etc., and the operator has the names of “licence holder”, “licensee”, “operating organisation” etc.

62

1. Concept of nuclear safety1

In order to understand the concept of continuous improvement of nuclear safety, it is important to understand the concept of nuclear safety itself. Due to that, the first part of this paper is devoted to short description of nuclear safety.

The fundamental safety objective is to protect people and the environ-ment from harmful effects of ionizing radiation. The restriction of the like-lihood of events that might lead to a loss of control over a nuclear reactor core, nuclear chain reaction, radioactive source or any other source of ra-diation is one of the measures to ensure that facilities are operated and ac-tivities conducted so as to achieve the highest standards of safety that can reasonably be achieved.2 In other words, the “restriction of the likelihood” is the base of the nuclear safety.

Nuclear safety is commonly defined3 as the achievement of proper op-erating conditions, prevention of accidents, or mitigation of accident con-sequences, resulting in protection of workers, the public and the environ-ment from undue radiation hazards. This definition covers the understand-ing of nuclear safety as freedom from physical harm, meaning both acute and latent health effects from exposure to radiation, as well as unreasona-ble risk and environmental damage due to the operation of nuclear facili-ties.

In this context it should be mentioned that, interestingly enough, the main legal act regulating nuclear safety in the international arena – the Convention on Nuclear Safety4 (the Safety Convention) – does not define nuclear safety. It can be agreed that defining nuclear safety is quite prob-lematic, keeping in mind that it has so many different aspects and ele-ments. However, certain points are worth mentioning here. Firstly, as pre-sented earlier, certain descriptions of nuclear safety have been provided in

____________________ 1 More detailed in R. Ptasekaite “The Role of the Regulator: Nuclear Safety and

Nuclear Safety Culture”, Proceedings of the INLA Congress, Manchester 2012. Available on internet: http://www.burges-salmon.com/INLA_2012/10193.pdf.

2 IAEA Safety Standards for protecting people and the environment, Fundamental Safety Principles, Safety Fundamentals No SF-1, IAEA, Vienna (2006); p. 4.

3 CNRA report “The Regulatory Goal of Assuring Nuclear Safety”, OECD NEA (2008), p. 11; and IAEA Safety Glossary, Terminology Used in Nuclear Safety and Radiation Protection, 2007 Edition, p.133 IAEA Vienna (2007).

4 Convention on Nuclear Safety, Legal Series No 16, IAEA, Vienna (1994).

bla3

63

IAEA Safety Fundamentals5, as well as in the CNRA and the INSAG re-ports, which shows that defining nuclear safety is not impossible. Second-ly, the main objective of the Safety Convention is to achieve and maintain high level of nuclear safety, and the lack of, if not definition, then at least a description of what exactly the Parties are aiming to “achieve and main-tain” does not actually improve the possibilities of fulfilment of the latter objective.

Finally, it is worth noticing the general perception that it is not possible to achieve absolute safety (i.e., zero risk) in nuclear activities. That im-plies that nuclear activity is deemed to be safe if the perceived risks are judged to be acceptable.6 In order to minimise the risks that need to be ac-ceptable, continuous improvement of nuclear safety is essential.

2. Concept of continuous improvement of nuclear safety

After short definition of nuclear safety it seems reasonable to move for-ward towards understanding what continuous improvement of nuclear safety is. The analysis will be started by defining the latter concept. After that, the scope, limits and the parties responsible for the continuous im-provement of nuclear safety will be identified, and, finally, certain delib-eration on maintaining and improving safety will be presented.

2.1 The definition

The objective of the Safety Fundamentals7 is to establish the fundamental safety objective, safety principles and concepts that provide the basis for the IAEA’s safety standards and its safety related programme. While de-fining the fundamental safety objective – protecting people and the envi-ronment from harmful effects of ionizing radiation – the Safety Funda-mentals state that, in order “to ensure that facilities are operated and the activities conducted so as to achieve the highest standards of safety that

____________________ 5 “IAEA Safety Standards for protecting people and the environment, Fundamental

Safety Principles, Safety Fundamentals No. SF-1”, IAEA, Vienna (2006);; 6 CNRA report “The Regulatory Goal of Assuring Nuclear Safety”, OECD NEA

(2008), p. 16. 7 IAEA Safety Standards for protecting people and the environment, Fundamental

Safety Principles, Safety Fundamentals, No SF-1, p.3, par. 1.8, IAEA, Vienna (2006).

64

can reasonably be achieved, measures have to be taken”. Certain aspects seem to be worth mentioned here.

First of all, it should be noticed that the wording the highest standards of safety that can reasonably be achieved is better known as the universal SAHARA principle (safety as high as reasonably achievable), which just as ALARA (as low as reasonably achievable) and ALARP (as low as rea-sonably practicable) express the same basic question “how safe is safe enough?”8. An international system of safety fundamentals, requirements and guidelines creates the legal grounds for the Global Nuclear Safety Re-gime9 which provides essential framework on what should and could be the answer to the question on how safe should be considered safe enough. However, there is no straight or easy answer to this question. What is con-sidered to be safe and safe enough has a tendency to change with time and is highly dependent not only on developments in science and technology, but also on rising safety expectations of the society – if everything else (cars, hospitals, etc.) is constantly getting safer, the same is expected from the nuclear energy sector. Furthermore, the concept of “safe enough” is al-so significantly influenced by the global events in the nuclear energy sec-tor. There is probably no doubt that the seismic and tsunami hazards as-sessment has become much more relevant criteria for nuclear safety after the nuclear accident at the Fukushima Daiichi nuclear power plant.10

The relation between the fundamental safety objective and the SAHA-RA principle could be worth discussing as well. The latter objective clear-ly requires that facilities have to be operated and the activities have con-ducted under the highest reasonable level of safety. This implies that the fundamental safety objective of protecting people and environment can only be achieved if highest possible level of safety is ensured. Due to that, it could be said that the SAHARA principle is an essential element of the fundamental safety objective.

____________________ 8 CNRA report ”Improving Versus Maintaining Nuclear Safety”, p.13, OECD

NEA (2002). 9 INSAG, Strengthening the Global Nuclear Safety Regime, INSAG-21, IAEA Vi-

enna (2006). 10 Such as: IAEA Report on Protection Against Extreme Earthquakes and Tsunamis

in the Light of the Accident at the Fukushima Daiichi Nuclear Power Plant, IAEA Vienna 2012; Communication from the Commission to the Council and the European Parliament on the comprehensive risk and safety assessments ("stress tests") of nuclear power plants in the European Union and related activi-ties, European Commission, Brussels, 4.10.2012 COM(2012) 571 final.

bla3

65

Furthermore, the relation between the continuous improvement of safe-ty and the fundamental safety objective should be identified. It might seem that the fundamental safety objective does not mention the continuous im-provement, as it explicitly requires only the highest level standards of safety that can reasonably be achieved. However, the concept of the high-est standards that can reasonably be achieved plays a significant role in defining and understanding the concept of the continuous improvement of nuclear safety. Due to the timespan covered by a nuclear power plant, from its initial design stages to its eventual decommissioning and disman-tling, that can be as much as fifty years or more, there will certainly be major changes in the engineering and scientific knowledge that underpins the design, construction, operation and maintenance of the plant, as well as a better understanding of the threats that are posed by and to the plant from a variety of internal and external sources.11 This means that continu-ous high level of nuclear safety seems not really possible without im-provements. If the continuous improvement is an essential part of the highest possible level of safety and, as it was mentioned earlier, the high-est possible level of safety could be considered to be an essential element in the fundamental safety objective, all that implies the conclusion that the continuous improvement of nuclear safety is a certain element of the fun-damental safety objective. In other words, continuous improvement of nu-clear safety could be considered as an instrument to achieve the funda-mental safety objective of protecting people and the environment and that establishes the latter concept as one of the corner-stones in nuclear safety.

There should be no doubt that the latter conclusion plays a significant role in defining the concept of continuous improvement of nuclear safety. It should be noticed, however, that par. 2.1 of the Safety Fundamentals on-ly implies the logical connection between the fundamental safety objective and the continuous improvement of safety, rather than explicitly establish-ing continuous improvement of nuclear safety as a part of the fundamental safety objective.

The final question in defining continuous improvement of nuclear safe-ty is whether the latter concept should be defined as an objective, a princi-ple or an obligation. Before going deeper into this discussion, it should be noticed that there probably is no straightforward answer to the latter ques-tion and the analysis presented below represents only one possible point of view on the issue. ____________________ 11 CNRA report ”Improving Versus Maintaining Nuclear Safety”, p.7, OECD NEA

(2002).

66

In par. 4.27 of the Requirement 22 in the IAEA’s General Safety Re-quirements for Governmental, Legal and Regulatory Framework for Safe-ty12 it is stated that “the regulatory body shall emphasize the continuous enhancement of safety as a general objective”. Several aspects should be mentioned here.

The wording of the latter requirement seems to imply that continuous improvement is an objective. Even though it might seem that the answer to the question above is clear, it might be worth analysing the latter para-graph more thoroughly. According to the wording, continuous enhance-ment of safety is a general objective. However, there is no elaboration on whether it is a general objective of safety, or a general objective of stabil-ity and consistency of regulatory control, which is the title of the latter re-quirement. As the IAEA General Safety Requirements were established in order for the IAEA Safety Fundamentals to be applied13 it seems reasona-ble to come back to the fundamental safety objective and its relation to the continuous improvement of nuclear safety that was analysed earlier. As it was established in the beginning of this chapter, continuous improvement of safety is an essential element of high level of nuclear safety, which im-plies the logical connection between the fundamental safety objective of protecting people and the environment and the continuous improvement of safety. In other words, the continuous improvement of nuclear safety seems to be an instrument for reaching the high level of nuclear safety and not the objective of it. Besides that, under the IAEA system of Safety Standards, it seems unlikely that general objective of safety would be es-tablished not in the Safety Fundamentals, but rather under a certain Re-quirement in the General Safety Requirements. Therefore, the conclusion can be drawn that the continuous enhancement of nuclear safety should not be considered as a general objective of safety. In order to answer the question whether continuous improvement of nuclear safety could be de-fined as an objective, a systematic analysis of the Requirement 22 on sta-ble and consistent regulatory control is required here. Paragraph 4.26 elaborating the latter Requirement states that the stable and consistent reg-ulatory control means that regulatory process should be a formal processes

____________________ 12 IAEA Safety Standards for protecting people and the environment, Governmen-

tal, Legal and Regulatory Framework for Safety, General Safety Requirements Part 1, No. GSR Part 1, par.4.27, p.22, IAEA Vienna (2010).

13 IAEA Safety Standards for protecting people and the environment, Governmen-tal, Legal and Regulatory Framework for Safety, General Safety Requirements Part 1, No. GSR Part 1, par.1.2, p.1, IAEA Vienna (2010).

bla3

67

based on specified policies followed by specified procedures, justifying and basing its requirements, judgements and decisions on the objectives, principles and associated criteria for safety. The following paragraph in the content of the Requirement 22 is the paragraph 4.27 on the continuous enhancement of nuclear safety mentioned above, and the last paragraph 4.28 establishes the need of consistency in the regulatory decision making process in order for the regulatory control to be considered consistent. The systematic analysis of the disposition of the Requirement 22 allows draw-ing the conclusion that regulator is required to emphasize the continuous enhancement in nuclear safety in the frame of the requirement on con-sistent and stable regulatory control, which means that promotion of con-tinuous improvement is an essential element of the stable and consistent regulatory control. Due to that, it seems reasonable to conclude that even though the wording of the Requirement 22 implies that continuous im-provement is an objective, it could be more precisely defined as an essen-tial element of the stabile and consistent regulatory control.

The ones not convinced with the reasoning above, might contravene that the European nuclear safety legislation, to be more specific, the Eur-atom Nuclear Safety Directive,14 clearly establishes the continuous im-provement of nuclear safety in its objectives in Article 1. Answering that, several aspects are worth mentioning. Firstly, Article 1 in the latter Di-rective establishes the objectives of the Nuclear Safety Directive, which should not be identified with the objectives of nuclear safety in general, and, secondly, the wording of the Article 1 implies that the objective is to establish the Community framework which would allow maintaining and promoting the continuous improvement of nuclear safety. The latter im-plies that the national framework would have an objective to maintain and promote continuous improvement. None on the mentioned above, howev-er, allows drawing the conclusion that continuous improvement of nuclear safety could be defined as an objective. Remaining provisions in the Nu-clear Safety Directive that concern continuous improvement of nuclear safety will be analysed further on in this article.

Furthermore, it should be noticed beforehand (a separate section later on in this article is devoted to the following aspect), that continuous im-provement of nuclear safety is not unlimited, which means that improve-ments have to be reasonable and evaluated with scrutiny before they are implemented. This implies that only those continuous improvements that ____________________ 14 Council Directive 2009/71/EURATOM of 25 June 2009 establishing a Commu-

nity framework for the nuclear safety of nuclear installations, OJ L 172, 2.7.2009.

68

contribute to high level of nuclear safety should be embraced. Colligating what has been said, the concept of continuous improvement as such should not be considered to be an objective.

If the continuous improvement of nuclear safety should not be generally defined as an objective the following question is whether it could be better described as a principle or as an obligation. In order to answer that, first-ly, a sketchy distinction between a principle and an obligation in nuclear legal framework should be made. Besides other things, one of the main features that separate the principle from the obligation is the lack of duty-holder. The origin of the principle is so general that it applies to all and everyone that comes into contact with it, for example, well known funda-mental principle of responsibility for safety. The principle clearly states that prime responsibility for safety rests with the person or organization responsible for facilities and activities that give rise to radiation risks. The latter principle only establishes the rule and does not elaborate who has to apply it, as it has to be applied by all and everyone (the government, the regulator, the operator etc.). The obligation, on the other hand, has a direct connection to a certain duty-holder – there always seems to be a certain party/parties that are responsible for fulfilling the obligation. The descrip-tion of the Safety Requirements15 implies, even though the format and style of the requirements should be harmonised with national legal frame-work, they have to be met, or otherwise measures have to be taken. In ad-dition to this, it is specifically stated that if the party is not specified in the requirements the implication should be made that the appropriate parties are responsible for fulfilling them. Due to that, concerning the continuous improvement of nuclear safety, the question that needs to be answered is whether continuous improvement of nuclear safety has a duty-holder.

Requirement 19 of the IAEA’s General Safety Requirements16 state that management system of the regulatory body “shall maintain the efficiency and effectiveness of the regulatory body in discharging its responsibilities and performing its functions. This includes the promotion of enhance-ments in safety, and the fulfilment of its obligations in an appropriate, timely and cost effective manner so as to build confidence.” Requirement

____________________ 15 IAEA Safety Standards for protecting people and the environment, Governmen-

tal, Legal and Regulatory Framework for Safety, General Safety Requirements Part 1, No. GSR Part 1, IAEA Vienna (2010).

16 IAEA Safety Standards for protecting people and the environment, Governmen-tal, Legal and Regulatory Framework for Safety, General Safety Requirements Part 1, par. 4.16 No. GSR Part 1, IAEA Vienna (2010).

bla3

69

12 of the Specific Safety Requirements on Commissioning and Opera-tion17 establishes that “[…] the operating organization shall implement any necessary corrective actions and reasonably practicable modifications for compliance with applicable standards aiming at enhancing the safety of the plant”. These two examples show that when requiring to continu-ously improve nuclear safety, the party responsible for the latter is clearly established – it is the regulator’s management system and the operating organisation in the cases mentioned above. The conclusion can be drawn that it is more reasonable to define the continuous improvement of nuclear safety as a certain obligation rather than principle. The actual duty-holders of this obligation will be analysed in the later section of this paper.

2.2 The scope

The fundamental safety objective states18 that in order to “ensure that fa-cilities are operated and activities conducted so as to achieve the highest standards of safety that can reasonably be achieved, measures have to be taken:

a) To control the radiation exposure of people and the release of ra-dioactive material to the environment;

b) To restrict the likelihood of events that might lead to a loss of control over a nuclear reactor core, nuclear chain reaction, radio-active source or any other source of radiation;

c) To mitigate the consequences of such events if they were to oc-cur.”

Firstly, it seems reasonable to analyse what exactly the provision above establishes – does it identify certain types of measures that need to be tak-en or does it aim for something else. Analysing the logical construction of the wording above it could be stated that the model is “measures have to be taken, in order to...”. This implies that measures are not really identi-fied in the latter provision – it is only their purpose or objective that is es-tablished here: to control, to restrict and to mitigate. This means that in or-der to achieve the highest standards of safety, measures that aim to con-

____________________ 17 IAEA Safety Standards for protecting people and the environment, Safety of Nu-

clear Power Plants: Commissioning and Operation, Specific Safety Requirements No. SSR-2/2, par. 4.47, IAEA Vienna (2011).

18 “IAEA Safety Standards for protecting people and the environment, Fundamental Safety Principles, Safety Fundamentals No SF-1”, p.4-5, IAEA, Vienna (2006).

70

trol, restrict and mitigate need to be taken. As the fundamental objective of safety is to protect, the question that might be asked here is, what the relation between the latter objectives, the fundamental safety objective and continuous improvement of nuclear safety is.

Whereas in order to achieve the highest standards of safety, measures that aim to control, restrict and mitigate need to be taken, it implies that the three objectives above are the elements of the high level of safety. The high level of safety is an essential condition for protecting people and en-vironment, which means that it is essential for achieving the fundamental safety objective as well. Due to that, the objectives to control, restrict and mitigate should be considered to be the necessary elements of the funda-mental safety objective. Since it has already been established that continu-ous improvement of nuclear safety is an instrument to achieve the funda-mental safety objective, it seems reasonable to conclude that continuous improvement of nuclear safety should cover control of exposure and re-lease, restriction of likelihood, and mitigation of consequences, in order for the high level of safety to be achieved and the fundamental safety ob-jective to be fulfilled.

The Safety Fundamentals19 further establish that “the fundamental safe-ty objective applies for all facilities and activities and for all stages over the lifetime of a facility or radiation source, including planning, siting, de-sign, manufacturing, construction, commissioning and operation, as well as decommissioning and closure. This includes the associated transport of radioactive material and management of radioactive waste”.

Since the fundamental objective of safety applies everywhere, the high level of safety must also be ensured everywhere. As it was already estab-lished that continuous improvement is an essential element of the high level of nuclear safety, the conclusion could be drawn that continuous im-provement should also be required for all facilities and activities and for all stages over the lifetime: planning, siting, design, manufacturing, con-struction, commissioning and operation, as well as decommissioning and closure.

Systematic analysis of the IAEA Safety Standards seems to confirm the latter conclusion. Certain selective examples could be given here.

____________________ 19 IAEA Safety Standards for protecting people and the environment, Fundamental

Safety Principles, Safety Fundamentals No SF-1”, par. 2.2, IAEA, Vienna (2006).

bla3

71

The Specific Safety Requirements on safety of nuclear power plant’s design20 require design organization to establish and implement a man-agement system that, among other things, shall include the means for iden-tifying and correcting design deficiencies, controlling design changes and assuring that safety improvements shall be in accordance with established procedures that call on appropriate engineering codes and standards. This shows that continuous improvement of nuclear safety is already required in the design phase of nuclear installation. Furthermore, prior to the au-thorization of the construction, the regulator should review, assess and in-spect on a systematic basis, the development of the design of the installa-tion as demonstrated in the safety documentation which may include re-quirements to improve safety through design optimization.21 That implies that continuous improvement of safety ought to be taken into account in the licensing process as well. In addition to this, due to the prime respon-sibility for safety, the management system of the operating organisation shall, among other things, monitor and assess the performance of the oper-ating functions and overall safety performance of the organization on a regular basis, in order to verify compliance with the objectives for safe operation and assess the effectiveness of management for safety, to reveal deviations, and to identify opportunities for improvement.22 This means that continuous improvement of nuclear safety, in form of improvements in operating functions and the management system, is required during the operations of the nuclear facility. The final example shows that continuous improvement of nuclear safety is also required in order to restrict the like-lihood of events that might lead to a loss of control and to mitigate the consequences of such events if they were to occur. Requirement 20 on de-sign extension conditions in the Specific Safety Requirements on safety of nuclear power plant’s design establishes that a set of design extension conditions shall be derived on the basis of engineering judgement, deter-ministic assessments and probabilistic assessments for the purpose of fur-ther improving the safety of the nuclear power plant by enhancing the

____________________ 20 IAEA Safety Standards for protecting people and the environment, Safety of Nu-

clear Power Plants: Design, Specific Safety Requirements No SSR-2/1, par. 3.2 and 3.3, IAEA Vienna (2012).

21 IAEA Safety Standards for protecting people and the environment, Licensing Process for Nuclear Installations, Specific Safety Guide No SSG-12, par. 3.40, IAEA, Vienna (2010).

22 IAEA Safety Standards for protecting people and the environment, Safety of Nu-clear Power Plants: Commissioning and Operation, Specific Safety Requirements No SSR-2/2, par. 3.2, IAEA, Vienna (2011).

72

plant’s capabilities to withstand, without unacceptable radiological conse-quences, accidents that are either more severe than design basis accidents or that involve additional failures.

Consolidating what has been said, the scope of the continuous im-provement of nuclear safety is rather vast and multi-layered – not only it covers the essential elements of high level of nuclear safety, it also should be applied to all activities and installations in all stages of their lifetime. That only confirms the continuous improvement of nuclear safety being the corner-stone of high level of nuclear safety.

2.3 The limits

The SAHARA principle predicates that the level of safety has to be as high as can reasonably be achieved. The Safety Fundamentals state23 that the safety objective “has to be achieved without unduly limiting the opera-tion of facilities or the conduct of the activities that give rise to radiation risks”. That implies that the objective of high level of nuclear safety has certain, so called “reasonability” factor. The question that might be worth analysing here is how the latter reasonability factor interacts with the con-cept of continuous improvement. Since it was stated earlier the continuous improvement is an essential element of high level of safety, it seems that continuous improvement of safety should be obliged to follow the same reasonability principle as well. This statement could be confirmed by sev-eral examples. The Requirement 22 on the stability and consistency of regulatory control in the Governmental, Legal and Regulatory Framework for Safety24 states that the regulatory body shall recognise the risks associ-ated with making modifications to well established practises. Prospective changes in regulatory requirements shall be subject to careful scrutiny to evaluate the possible enhancements in safety that are to be achieved.

In addition to this, INSAG has stated25 that disciplined approach is needed when deciding whether to adopt proposed incremental safety im-____________________ 23 IAEA Safety Standards for protecting people and the environment, Fundamental

Safety Principles, Safety Fundamentals, No SF-1, p.4, par. 2.1, IAEA Vienna (2006).

24 IAEA Safety Standards for protecting people and the environment, Governmen-tal, Legal and Regulatory Framework for Safety, General Safety Requirements Part 1, No GSR Part 1 p. 22, IAEA Vienna (2010).

25 INSAG, Basic Safety Principles for Nuclear Power Plant 75-INSAG-3 Rev. 1, INSAG-12, p. 2 IAEA Vienna (1999).

bla3

73

provements for any nuclear plant, as it is important to avoid concentrating resources on improvements that have only marginal effects, and to recog-nize that a safety improvement may also affect economic or other societal factors. INSAG further states that special care is needed to ensure that an intended safety improvement does not have detrimental effects that out-weigh its benefits.

As the latter examples indicate slightly different aspects of reasonability factor in the continuous improvement of nuclear safety – Requirement 22 is addressed to the regulator while the INSAG statement is more directed to the operator – several implications could be done here. Firstly, general conclusion could be made that the improvements in order to achieve high level of nuclear safety should be reasonable. Secondly, the reasonability of continuous improvement of nuclear safety is required both from the regu-lator in improving the regulatory requirements and from the operator in in-troducing technical safety improvements in practice.

Another aspect that might be worth analysing is the content of the rea-sonability factor. In other words, the question on how it should be deter-mined that a certain improvement is reasonable enough, could be asked here.

The INSAG report on Basic Safety Principles for Nuclear Power Plant26 mentioned above states that the proposer should justify each significant improvement in terms of its urgency, safety merit and implementation cost. Furthermore, the INSAG report elaborates that in seeking to obtain safety improvements to existing installations, account is taken of the bal-ance between benefits and drawbacks (including costs). Also, account needs to be taken of the implications of changes for the usefulness of the experience gained and training developed in operating the plant in its ex-isting configuration. Another example is that of organizational changes which can have the potential either to improve or to impair safety perfor-mance. It is important to ensure, prior to implementation, that the effect of the proposed changes will not reduce safety, either when the change has been completed or during the transitional period while it is being imple-mented.

In my opinion, INSAG gives a rather descent description on how the principle of cost-benefit evaluation works in the continuous improvement of nuclear safety. As it is mentioned above, the main criteria for the adop-tion of the improvement ought to be its urgency, safety merit and cost. It seems reasonably to state that the latter criteria are listed in the priority or-____________________ 26 75-INSAG-3 Rev. 1, INSAG-12, p. 2 IAEA Vienna (1999).

74

der and all of them are closely connected together. The most urgent im-provements ought to be the ones that are absolutely necessary for main-taining high level of safety. Due to the fact that their safety merit should be considered as high, the urgent improvements are the ones that should be done first. Balancing safety merit and costs of the improvement is an-other issue that seems to be worth a discussion.

It should be noticed that concept of costs in this context represents not only the financial or administrative costs that might occur in order to im-plement the improvement, but also, for example, cost of changes in estab-lished practices and safety culture as new adjustments need to be done or costs of improvement to the design integrity of the facility. Generally, the cost-benefit principle implies that only such improvements where the safe-ty merit of the improvement outbalances the costs of it should be enforced. The rule seems to be quite simple, however, the implementation of the lat-ter principle might to be rather complex. The main issue here is how much the merits of the safety improvement have to outweigh the costs.

As it was mentioned earlier, the General Safety Requirements, even though requiring the regulator to promote continuous improvement, clear-ly state that any modifications must be subject to careful scrutiny.27 Fur-thermore, where innovative improvements beyond current practices have been incorporated, it has to be determined in the safety assessment wheth-er compliance with the safety requirements has been demonstrated by an appropriate programme of research, analysis and testing complemented by a subsequent programme of monitoring during operation.28 In the Specific Safety Requirements on design of the nuclear power plant29 it is stated that it might not be practicable to apply all the requirements of this publication to nuclear power plants that are already in operation or under construction; in addition, it might not be feasible to modify designs that have already been approved by regulatory bodies. For the safety analysis of such de-signs, it is expected that a comparison will be made with the current standards, for example as part of the periodic safety review for the plant, ____________________ 27 IAEA Safety Standards for protecting people and the environment, Governmen-

tal, Legal and Regulatory Framework for Safety, General Safety Requirements Part 1, No GSR Part 1 par. 4.27, IAEA Vienna (2010).

28 IAEA Safety Standards for protecting people and the environment, Safety As-sessment For Facilities And Activities, General Safety Requirements Part 4, No GSR Part 4, par.4.29, IAEA, Vienna (2009).

29 IAEA Safety Standards for protecting people and the environment, Safety of Nu-clear Power Plants: Design, Specific Safety Requirements No SSR-2/1, par. 1.3, IAEA Vienna (2012).

bla3

75

to determine whether the safe operation of the plant could be further en-hanced by means of reasonably practicable safety improvements. In addi-tion to this, INSAG has also emphasised30 the importance to maintain the integrity of the design of a nuclear power plant over its entire lifetime in order to achieve a continuous high level of safety.

The practice shows that many events were reported during 2009-2011 involving deficiencies in the modification process. In some cases, modifi-cations which were intended to improve plant safety resulted in degraded safety conditions because of unanticipated consequences. Modifications intended to improve safety, if not carried out with adequate design checks and acceptance controls, can inadvertently result in a reduction of safety. As even minor changes can lead to significant events, sufficient design ri-gor needs to be maintained during the modifications.31

Consolidating what has been said, the conclusion can be drawn that any modification can be called an improvement and should be implemented only if the safety merits of the modification significantly overweight the possible and probable costs. Furthermore any planned improvement should be analysed with scrutiny and evaluated according to its urgency, safety merits and costs. In addition to this, it seems important to have in mind that in some cases even if theoretically the safety merits of the im-provements seem to be sufficient it can in practice result in decreasing the existing level of safety. Due to that, the analysis and the evaluation of the costs and benefits of every plan modification are of an essential im-portance in order for the modification to be improvement in nuclear safe-ty.

2.4 Maintaining v. improving nuclear safety

Independent of any industry or societal demands to build in new levels of safety, the actual level of safety of any given plant is a constantly shifting condition and never is a single state for any plant. There are two broad sets of reasons for this32: ____________________ 30 INSAG, Maintaining the Design Integrity of Nuclear Installations throughout

their Operating Life, INSAG-19, IAEA, Vienna (2003). 31 Nuclear Power Plant Operating Experience, from the IAEA/NEA International

Reporting System for Operating Experience 2009-2011, NEA No. 7120, OECD (2012).

32 CNRA report ”Improving Versus Maintaining Nuclear Safety”, p.15-16, OECD NEA (2002).

76

Technical reasons: x Physically the plant is not a constant over time. It's constantly ageing,

which alters some components and performance characteristics. New and updated component parts enter the plant – e.g. valve and other manufacturers alter their products slightly over time as they seek manufacturing cost reductions or upgrades in performance.

x New knowledge changes the representation of the plant in analytic models and current “understanding”. As we know more about failure probabilities, good practice or characteristics of ageing, the plant isn't the same as in its prior analytical representations.

Organisational reasons: x Organisationally there is no constant level of safety at a plant. Key or-

ganisational variables like worker attentiveness and interdepartmental trust can decay over time. Routines, worker turnover and ageing of the workforce can change the ability of the members to cope with sur-prise. There will be almost imperceptible shifts in standards enforce-ment as safety becomes taken for granted.

Under the analysis of different OECD/NEA member countries made by CNRA33, the conclusion has been made that the national submissions in-dicate that there are differences in how member countries describe their responsibilities to ensure adequate nuclear safety and about whether their regulatory approaches require licensees to continuously improve safety or to continuously maintain safety. Furthermore, CNRA has pointed out that various descriptions of whether safety has to be maintained or improved may cause confusion for the regulator’s stakeholders, particularly licen-sees and the general public.

One of the possible solutions to decrease the confusion could be an en-deavour to identify a more defined line between maintaining and improv-ing safety. It should be noticed, however, that the analysis below is com-pletely theoretical and does not imply anything concerning usage of the latter terms in national legislation otherwise.

Logical perception of the concept maintaining already implies that there must be a certain level that should be continuously kept. In nuclear safety that “level” is established by the licencing basis. The definition of licens-

____________________ 33 CNRA report ”Improving Versus Maintaining Nuclear Safety”, p.19, OECD

NEA (2002).

bla3

77

ing basis34 is a set of regulatory requirements applicable to a nuclear in-stallation. The licensing basis is normally established before nuclear power plant goes into operation and consists of: a detailed description of the plant and site facilities; the design safety analysis; applicable codes and standards; operational procedures, rules and limits; emergency procedures, etc. Once the licensing basis has been established, the regulatory authority requires the plant to remain in conformity with it throughout its operation-al life, i.e. the level of safety as defined in the licensing basis must be maintained.35

The CNRA report36 establishes that even though the licensing basis stays the same, the scientific and engineering understanding of the various components of it may well change. Due to that, in some cases licensees have to upgrade their safety analysis following some unexpected event or when carrying out a major review, such as a Periodic Safety Review (PSR). However, according to the report, such modifications and im-provements are considered to be strictly to maintain the licensing basis. In addition to this, it should be noticed that the latter CNRA report, unlike concerning the concept of maintaining, does not really define the improv-ing of nuclear safety.

If safety analysis is a part of licencing basis and certain scientific and engineering development requires the safety analysis to be upgraded, the question is whether the licensing basis in that case stays the same. As it was mentioned earlier, licencing basis is a set of requirements that define the level of safety for the installation. Due to that, in my opinion, any modifications that need to be implemented in the nuclear power plant which might induce the change in regulatory safety requirements ought to be defined as improvement of nuclear safety. Other modifications that need to be done, but do not influence the licensing basis would, in that case, fall under the process of maintaining nuclear safety. Consequently, the criteria for identifying and separating maintenance from improvement, is the content of licensing basis.

____________________ 34 CNRA report “The Regulatory Goal of Assuring Nuclear Safety”, OECD NEA

(2008), p. 108; and IAEA Safety Glossary, Terminology Used in Nuclear Safety and Radiation Protection, 2007 Edition, p.133 IAEA Vienna (2007).

35 CNRA report ”Improving Versus Maintaining Nuclear Safety”, p.9, OECD NEA (2002).

36 CNRA report ”Improving Versus Maintaining Nuclear Safety”, p.9-10, OECD NEA (2002).

78

Article 1 of the Nuclear Safety Convention37 states that one of the ob-jectives of the Convention is to achieve and maintain a high level of nu-clear safety. On one hand, it might seem that the latter Convention estab-lishes only the concept of maintaining mentioned above. This would im-ply that the international convention on nuclear safety does not have an objective to continuously improve nuclear safety. However, this does not seem the case due to the following reasoning. Only identifying the words “maintain” and “improve” might not give a full picture on the objective of the provision. It is important to analyse what the provision is aiming to maintain or improve. Since one of the objectives of the Nuclear Safety Convention mentioned above is to achieve and maintain high level of nu-clear safety and high level of safety is an essential element of the funda-mental safety objective, the conclusion could be drawn that high level of safety is a certain goal and does not need to be improved. Due to that, wording “maintaining a high level of nuclear safety” includes both – maintaining and improving nuclear safety. In other words, one can main-tain and improve nuclear safety, but only maintain the high level of it.

2.5 The parties responsible

After identifying continuous improvement of nuclear safety as an obliga-tion and defining its scope and limits, it seems reasonable to analyse whose obligation the continuous improvement of nuclear safety is consid-ered to be.

A number of examples presented earlier in the paper on the established obligation of the continuous improvement of nuclear safety might already have given out the preliminary signal that the obligation of continuously improving of nuclear safety lays on both – the regulator and the operator. Nevertheless, it might be worth analysing how the latter parties share the obligations and interact in the field of continuous improvement of nuclear safety. In order for the latter analysis to be complete, a general reference to how do these parties interact in the field of nuclear safety might be needed.

____________________ 37 International Atomic Energy Agency (IAEA), Convention on Nuclear Safety,

Legal Series No. 16, IAEA, Vienna (1994).

bla3

79

Systematic analysis of the IAEA’s legal framework38 has shown that the main role of the regulatory body in the field of nuclear safety could be described in a following way: the regulator creates “the rules of playing safe” and controls how the operator follows them, while the operator has to play by those rules and prove it to the regulator on regular basis. In oth-er words, “the game” is played by the regulator’s rules, which means that while the operator is responsible for the actual safety in nuclear installa-tion, it is the regulator who decides what is considered to be safe.

Having roughly described the sharing of roles between the regulator and the operator in the field of nuclear safety, the analysis on how do they interact in the field of continuous improvement of nuclear safety should be done. Keeping in mind the vast scope of the continuous improvement of nuclear safety, it seems reasonable to start by identifying the regulator’s and the operator’s responsibilities in the latter field.

The role of the regulator in continuous improvement of nuclear safety is basically established in two paragraphs of the General Safety Require-ments39 that already have been analysed earlier. Par. 4.16 requires the reg-ulator to promote the enhancement in safety and par. 4.27 requires the regulator to emphasise the continuous improvement of safety considering the reasonability factor which has already been analysed in the previous section. The regulator should require that the operator reports regularly on adherence to safety objectives and compliance with specified regulatory requirements, and on efforts made to enhance safety. The regulatory body should review and assess the reports and should perform inspections to confirm compliance with regulatory requirements and to confirm that the facility is able to continue in operation.40 In addition to this, the regulator should at all times require reasonably achievable improvements to be made in the design or operating procedures of the facility with the aim of

____________________ 38 The detailed analysis of the role of the regulator in the field of nuclear safety has

been done in: R. Ptasekaite “The Role of the Regulator: Nuclear Safety and Nu-clear Safety Culture”, Proceedings of the INLA Congress, Manchester 2012. Available on internet: http://www.burges-salmon.com/INLA_2012/10193.pdf.

39 IAEA Safety Standards for protecting people and the environment, Governmen-tal, Legal and Regulatory Framework for Safety, General Safety Requirements Part 1, No GSR Part 1 par. 4.27, IAEA Vienna (2010).

40 IAEA Safety Standards for protecting people and the environment, Review and Assessment of Nuclear Facilities by the Regulatory Body, Safety Guide, No. GS-G-1.2, par. 2.18, IAEA, Vienna (2002).

80

reducing potential radiological consequences.41 Considering the regula-tions and guides issued by the regulator, the regulator should require at all times reasonably practicable improvements in the safety of facilities and to this end should periodically review its regulations and guides against scientific and technological advances. The extent to which regulations and guides should be revised should depend on their level of detail. If safety goals and general guidance only are given, less frequent revision will be necessary. If legal requirements are changed, this may necessitate changes to regulations and guides.42 Taking to the consideration mentioned above and keeping in mind that it is the regulator that decides what is considered to be safe, the conclusion can be drawn that the regulator has the same role even in the field of continuous improvement. It is the regulator that de-cides when and what kind of the changes in the regulatory requirements are needed to ensure the highest reasonably possible level of safety. Fur-thermore, it should be noticed that comparing the regulator’s role in pro-motion aspect of nuclear safety and continuous improvement of nuclear safety respectively, the regulator’s responsibility to promote continuous improvement of nuclear safety is explicitly established in the Safety Re-quirements, while such obligation for the regulator to promote high level of nuclear safety is lacking. Consequently, it seems reasonable to state that regulator’s obligations to establish the legal framework of requirements on how the continuous improvement of nuclear safety should be exercised and to promote continuous improvement of nuclear safety as such are of a significant importance to high level of nuclear safety.

It might seem that operator’s obligations in continuous improvement for nuclear safety should emerge straight from its prime responsibility for safety established in the Fundamental Safety Principles43. Even though an operator is responsible for ensuring high level of nuclear safety which im-plies that it should also have the prime responsibility to insure that neces-sary improvements are done in order to achieve that high level of safety, the Fundamental Safety Principles do not explicitly devote that responsi-bility to the operator. Under the par. 3.6 the responsibilities of the operator ____________________ 41 IAEA Safety Standards for protecting people and the environment, Review and

Assessment of Nuclear Facilities by the Regulatory Body, Safety Guide, No. GS-G-1.2, par. 3.50, IAEA, Vienna (2002).

42 IAEA Safety Standards for protecting people and the environment, Review and Assessment of Nuclear Facilities by the Regulatory Body, Safety Guide, No. GS-G-1.2, par. 3.29, IAEA, Vienna (2002).

43 IAEA Safety Standards for protecting people and the environment, Fundamental Safety Principles, Safety Fundamentals No SF-1, IAEA, Vienna (2006).

bla3

81

are listed out and the responsibility to continuously improve nuclear safety is not there. The latter paragraph only states that operator is responsible for “establishing procedures and arrangements to maintain safety under all conditions”. General Safety Requirements on safety assessment for facili-ties and activities establish44 that it is the person or the organisation re-sponsible for the activity of facility that has a responsibility to carry out the safety assessment. Putting it into the context of nuclear safety, it is a responsibility of the operator. The purpose of the safety assessment is, among other things, to determine whether an adequate level of safety has been achieved and what appropriate safety related improvements to the design and operation are needed. Under the par. 4.64 of these General Safety Requirements the safety report must include conclusions of the ac-ceptability of the level of safety achieved and the identification of neces-sary improvements and additional measures. This implies that operator has to continuously control that certain level of nuclear safety is achieved and identify the measures that need to be taken in order for that level of safety to be maintained. In operational safety, the connection between the opera-tor’s prime responsibility for safety and its obligation in continuous im-provement of safety is established in par. 3.2 of the Specific Safety Re-quirements for Safety of Nuclear Power Plants: Commissioning and Oper-ation. Under the latter paragraph, due to the prime responsibility for safe-ty, the management system of the operating organisation shall, among other things, monitor and assess the performance of the operating func-tions and overall safety performance of the organization on a regular basis, in order to verify compliance with the objectives for safe operation and as-sess the effectiveness of management for safety, to reveal deviations, and to identify opportunities for improvement.45 Furthermore, the latter Spe-cific Safety Requirements require the operator to establish and implement operational policies that give safety the highest priority. The latter policy must include a commitment to achieving enhancements in operational safety.46 Concerning the safety policies, INSAG has concluded47 that an

____________________ 44 IAEA Safety Standards for protecting people and the environment, Safety As-

sessment for Facilities and Activities, General Safety Requirements Part 4 No GSR Part 4, Requirements 3 and 4, IAEA, Vienna (2009).

45 IAEA Safety Standards for protecting people and the environment, Safety of Nu-clear Power Plants: Commissioning and Operation, Specific Safety Requirements No SSR-2/2, par. 3.2, IAEA, Vienna (2011).

46 IAEA Safety Standards for protecting people and the environment, Safety of Nu-clear Power Plants: Commissioning and Operation, Specific Safety Requirements No SSR-2/2, par. 4.5, IAEA, Vienna (2011).

82

operator needs to demonstrate a commitment to achieving improvements in safety wherever it is reasonably practicable to do so as part of a con-tinuing commitment to the achievement of excellence. The organization’s improvement strategy for achieving higher safety performance and for more efficient ways to achieve existing standards will have the best chance of success if it is set out as part of a well-defined programme with clear objectives and targets against which to monitor progress. In addition to this, the operator is required to establish an adequate audit and review system to ensure that the safety policy of the operating organization is be-ing implemented effectively and that lessons are being learned from its own experience and from the experience of others to improve safety per-formance.48 According to what is mentioned above, the conclusion can be made that operator’s obligation in continuous improvement of nuclear safety basically consists of controlling, assessing, reviewing and ensuring that regulator’s established level of safety is maintained.

Consolidating what has been said and defining the regulator’s and the operator’s role in continuous improvement of nuclear safety, the conclu-sion could be drawn that role of each of the latter parties and the concepts of maintaining and improving safety seem to interact very closely – the regulator is responsible for determining the level of safety that should be considered to be as high as reasonably achievable which implies that the regulator is improving nuclear safety, and the operator concentrates on ful-filling the existing safety requirements that have been established by the regulator and that way is maintaining nuclear safety.

At this point it seems reasonable to look slightly deeper in to the Euro-pean legislation. Article 6.2 of the Nuclear Safety Directive49 states that Member States shall ensure that the national framework in place requires licence holders, under the supervision of the competent regulatory authori-ty, to regularly assess and verify, and continuously improve, as far as rea-sonably achievable, the nuclear safety of their nuclear installations in a systematic and verifiable manner. The latter article clearly establishes that it is the operator’s obligation to improve safety and the regulator only has

47 INSAG, Management of Operational Safety in Nuclear Power Plants, INSAG-13,

IAEA Vienna (1999). 48 IAEA Safety Standards for protecting people and the environment, Safety of Nu-

clear Power Plants: Commissioning and Operation, Specific Safety Requirements No SSR-2/2, par. 4.33, IAEA, Vienna (2011).

49 Council Directive 2009/71/EURATOM of 25 June 2009 establishing a Commu-nity framework for the nuclear safety of nuclear installations, OJ L 172, 2.7.2009.

bla3

83

a function of supervision. In addition to this, in Article 5 on Competent Safety Authority the improvement of nuclear safety is not mentioned at all. If to look at the Article 6.2 from the perspective of the continuous im-provement of nuclear safety, it might seem that Directive implies that it is the operator, and not the regulator, that is obliged “to push up the bar” of safety requirements and decides what level of safety is considered to be the high, and how safe is safe enough. Nevertheless, in this case it seems reasonable to notice that even though continuous improvement is in the wording of the article, the main focus of the latter provision is not identi-fying the share or responsibilities between the regulator and the operator in continuous improvement of nuclear safety, but rather establish periodi-cal safety review as the essential responsibility of the operator that also falls under the regulator’s supervision. As it has been mentioned earlier, periodical safety review (or safety assessment) allows the operator to evaluate the level of safety and identify the necessary improvements that are needed to be implemented. The wording “under the supervision of the competent regulatory authority” implies that even though it is the operator that might find certain improvement necessary it is the regulator that de-cides whether and how they should be enforced. Due to that, the even though the Directive does not establish it directly, the conclusion on the definition of the regulator’s and the operator’s role in continuous im-provement of nuclear safety mentioned above seems to be applicable even on the European level. This does not, however, change the fact, that regu-lation on continuous improvement of nuclear safety in the Directive is not really flawless – it still lacks clear establishment that continuous im-provement of nuclear safety falls under the regulator’s responsibilities as well.

3. Continuous improvement of safety in national legal framework – Swe-den

After thorough analysis on international regulation on continuous im-provement of nuclear safety, it seems reasonable to do a certain descrip-tive analysis the national Swedish legislation on the matter.50

____________________ 50 Due to the author’s employment in the Swedish Government Offices, only the

descriptive part of the analysis will be done in this chapter.

84

The main legal act establishing the legal framework for nuclear safety is the Act on Nuclear Activities (1984:3)51 (the Act). The provisions of the Act that are of a relevance to this research are the following.

Section 4 Safety of nuclear activities shall be maintained by implementing the measures necessary in order to:

1. prevent defects in or the malfunction of equipment, improper handling, sabo-tage or other circumstance that could result in a radiological accident, and

2. prevent unlawful handling of nuclear material and nuclear waste.

Section 10 A party that holds a licence for nuclear activities shall be responsible for ensuring that all the necessary measures are taken for:

1. maintaining safety, taking into account the nature of the operation and the cir-cumstances in which it is conducted, […].

As it can be seen above, the main focus in the latter legislation is on maintaining safety of nuclear activities. However, section 9 in the regula-tion on Safety in Nuclear Facilities52 issued by the Swedish Radiation Safety Authority requires the licence holder to have a documentation of safety objectives and guidelines on how safety shall be maintained and improved. The Swedish Radiation Safety Authority, being the national regulator, elaborates53 the latter regulation as requiring the licensee to maintain and develop safety, where “develop” includes a continuous work to “hunt” for safety deficiencies in the reactor design and the quality of the safety work, and to take actions if deficiencies are discovered. This means technically improved safety, but formally safety is maintained. The Swe-dish Radiation Safety Authority further consolidates that they require “li-censees to continuously analyse safety and take actions if deficiencies are discovered, not to continuously improve safety in an absolute sense”.

Conclusions

Consolidating all that has been said, the conclusions are following:

____________________ 51 The English version translated by the Swedish Radiation Safety Authority can be

found here: http://www.stralsakerhetsmyndigheten.se/Global/IRRS/ Act%20on%20Nuclear%20Activities.pdf.

52 It is a free translation of latter regulation done by author of the article. 53 CNRA report ”Improving Versus Maintaining Nuclear Safety”, p.28, OECD

NEA (2002).

bla3

85

x Continuous improvement of nuclear safety being an instrument to achieve the fundamental safety objective is one of the corner stones in nuclear safety.

x Continuous improvement of nuclear safety is best defined as an obligation, rather than principle or objective.

x Continuous improvement of nuclear safety is required for all fa-cilities and activities and for all stages over the lifetime and co-vers control of exposure and release, restriction of likelihood and mitigation of consequences.

x One of the criteria for separating maintenance of nuclear safety from improvement might be the licensing basis. Modifications which might induce the change in regulatory safety requirements are improving nuclear safety, while those modifications that do not influence the licensing basis are for maintaining nuclear safe-ty. Nuclear safety can be maintained or improved, but high level of nuclear safety can only be maintained.